BASELINE: Update Chromium to 79.0.3945.139

Change-Id: I336b7182fab9bca80b709682489c07db112eaca5
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

1627 files changed, 42073 insertions, 56741 deletions

diff --git a/chromium/content/DEPS b/chromium/content/DEPS
index c804e5c3d24..96a1943bffe 100644
--- a/chromium/content/DEPS
+++ b/chromium/content/DEPS
@@ -29,7 +29,6 @@ include_rules = [
 
   "+crypto",
   "+grit/blink_resources.h",
-  "+grit/content_strings.h",
 
   "+dbus",
   "+gpu",
diff --git a/chromium/content/README.md b/chromium/content/README.md
index ec6b0428d1a..6b7423845e5 100644
--- a/chromium/content/README.md
+++ b/chromium/content/README.md
@@ -1,11 +1,98 @@
-Content is the core code needed to render a page using a multi-process sandboxed
-browser.
+# Content module
 
-Developer documentation:
-https://www.chromium.org/developers/content-module
+## High-level overview
+The "content" module is located in `src/content`, and is the core code needed to
+render a page using a multi-process sandboxed browser. It includes all the web
+platform features (i.e. HTML5) and GPU acceleration. It does not include Chrome
+features, e.g. extensions/autofill/spelling etc.
 
-Internal Documentation:
+## Motivation
+As the Chromium code has grown, features inevitably hooked into the wrong
+places, causing layering violations and dependencies that shouldn't exist. It's
+been hard for developers to figure out what the "best" way is because the APIs
+(when they existed) and features were together in the same directory. To avoid
+this happening, and to add a clear separation between the core pieces of the
+code that render a page using a multi-process browser, consensus was reached to
+move the core Chrome code into `src/content` ([content not
+chrome](http://blog.chromium.org/2008/10/content-not-chrome.html) :) ).
 
-* [Bluetooth](browser/bluetooth/README.md)
+## content vs chrome
+As discussed above, `content` should only have the core code needed to render a
+page. Chrome features use APIs that are provided by `content` to filter IPCs and
+get notified of events that they require. [How to Add New Features (without
+bloating
+RenderView/RenderViewHost/WebContents)](https://www.chromium.org/developers/design-documents/multi-process-architecture/how-to-add-new-features)
+describes how to do this.
+
+As an example, here's a (non-exhaustive) list of features that are Chrome only,
+and so are not in content. This means that `content` code shouldn't have to know
+anything about them, only providing generic APIs that they can be built upon.
+- Extensions
+- NaCl
+- SpellCheck
+- Autofill
+- Sync
+- Prerendering
+- Safe Browsing
+- Translate
+
+As the list above shows, even browser features that are common to modern
+browsers are not in `content`. The dividing line is that `src/content` only has
+code that is required to implement the web platform. Features that aren't
+covered by web specs should live in `src/chrome`. If a feature is being
+implemented and the team foresees that it would be a spec, it should still go in
+`src/chrome`. Once it has a spec, then it can move to `src/content`.
+
+Where code interacts with online network services that must be supplied by the
+vendor, the favored approach is to fully implement that feature outside of the
+`content` module. E.g. from the list above Safe Browsing, Translate, Sync and
+Autofill require various network services to function, and the `chrome` layer is
+the natural place to encapsulate that behavior. For those few cases where we
+need to make network requests using code in the content module in order to
+implement generic HTML5 features (e.g. the network location service for
+Geolocation), the embedder must fully define the the endpoint to connect to,
+typically it might do this by injecting the service URL. We do not want any such
+policy coded into the `content` module at all, again to keep it generic.
+
+## Architectural Diagram
+TODO: Draw a modern diagram.
+
+See an older diagram at: https://www.chromium.org/developers/content-module.
+
+The diagram illustrates the layering of the different modules. A module can
+include code directly from lower modules. However, a module can not include code
+from a module that is higher than it.  This is enforced through DEPS rules.
+Modules can implement embedder APIs so that modules lower than them can call
+them. Examples of these APIs are the WebKit API and the Content API.
 
+## Content API
+The [Content API](public/README.md) is how code in content can indirectly call
+Chrome. Where possible, Chrome features try to hook in by filtering IPCs and
+listening to events per [How to Add New Features (without bloating
+RenderView/RenderViewHost/WebContents)](https://www.chromium.org/developers/design-documents/multi-process-architecture/how-to-add-new-features).
+When there isn't enough context (i.e.  callback from WebKit) or when the
+callback is a one-off, we have a `ContentClient` interface that the embedder
+(Chrome) implements. `ContentClient` is available in all processes. Some
+processes also have their own callback API as well, i.e.
+`ContentBrowserClient/ContentRendererClient/ContentPluginClient`.
 
+## Status and Roadmap
+The current status is `content` doesn't depend on chrome at all (see the meta
+[bug](https://bugs.chromium.org/p/chromium/issues/detail?id=76697) and all bugs
+it depends on). We now have a basic browser built on top of `content`
+("`content_shell`") that renders pages using `content` on all platforms. This
+allow developers working on the web platform and core code to only have to
+build/test content, instead of all of chrome.
+
+We have a separate target for `content`'s unit tests in `content_unittests`, and
+integration tests in `content_browsertests`.
+
+`content` is build at a separate dll to speed up the build.
+
+We've created an API around `content`, similar to our WebKit API. This isolates
+embedders from content's inner workings, and makes it clear to people working on
+content which methods are used by embedders.
+
+## Further documentation
+
+* [Bluetooth](browser/bluetooth/README.md)
diff --git a/chromium/content/app/android/content_child_process_service_delegate.cc b/chromium/content/app/android/content_child_process_service_delegate.cc
index ac1c9661bb7..4d5c0d3526f 100644
--- a/chromium/content/app/android/content_child_process_service_delegate.cc
+++ b/chromium/content/app/android/content_child_process_service_delegate.cc
@@ -18,8 +18,8 @@
 #include "content/public/android/content_jni_headers/ContentChildProcessServiceDelegate_jni.h"
 #include "content/public/common/content_descriptors.h"
 #include "content/public/common/content_switches.h"
+#include "gpu/command_buffer/service/texture_owner.h"
 #include "gpu/ipc/common/android/scoped_surface_request_conduit.h"
-#include "gpu/ipc/common/android/texture_owner.h"
 #include "gpu/ipc/common/gpu_surface_lookup.h"
 #include "services/service_manager/embedder/shared_file_util.h"
 #include "services/service_manager/embedder/switches.h"
diff --git a/chromium/content/app/content_main_runner_impl.cc b/chromium/content/app/content_main_runner_impl.cc
index 579f1767e7c..998ef865992 100644
--- a/chromium/content/app/content_main_runner_impl.cc
+++ b/chromium/content/app/content_main_runner_impl.cc
@@ -42,6 +42,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/task/post_task.h"
+#include "base/task/thread_pool/thread_pool_instance.h"
 #include "base/trace_event/trace_event.h"
 #include "components/discardable_memory/service/discardable_shared_memory_manager.h"
 #include "components/download/public/common/download_task_runner.h"
@@ -52,6 +53,7 @@
 #include "content/browser/scheduler/browser_task_executor.h"
 #include "content/browser/startup_data_impl.h"
 #include "content/browser/startup_helper.h"
+#include "content/browser/tracing/memory_instrumentation_util.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/url_schemes.h"
 #include "content/public/app/content_main_delegate.h"
@@ -69,9 +71,6 @@
 #include "media/media_buildflags.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/cpp/features.h"
-#include "services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h"
-#include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
-#include "services/resource_coordinator/public/mojom/service_constants.mojom.h"
 #include "services/service_manager/embedder/switches.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 #include "services/service_manager/sandbox/switches.h"
@@ -417,15 +416,6 @@ void PreSandboxInit() {
 
 #endif  // OS_LINUX
 
-#if !defined(CHROME_MULTIPLE_DLL_CHILD)
-void InitializeBrowserClientProcessImpl() {
-  memory_instrumentation::ClientProcessImpl::Config config(
-      GetSystemConnector(), resource_coordinator::mojom::kServiceName,
-      memory_instrumentation::mojom::ProcessType::BROWSER);
-  memory_instrumentation::ClientProcessImpl::CreateInstance(config);
-}
-#endif  // !defined(CHROME_MULTIPLE_DLL_CHILD)
-
 }  // namespace
 
 class ContentClientInitializer {
@@ -756,15 +746,41 @@ int ContentMainRunnerImpl::Initialize(const ContentMainParams& params) {
     RegisterContentSchemes(delegate_->ShouldLockSchemeRegistry());
 
 #if defined(OS_ANDROID) && (ICU_UTIL_DATA_IMPL == ICU_UTIL_DATA_FILE)
-    int icudata_fd = g_fds->MaybeGet(kAndroidICUDataDescriptor);
-    if (icudata_fd != -1) {
-      auto icudata_region = g_fds->GetRegion(kAndroidICUDataDescriptor);
-      if (!base::i18n::InitializeICUWithFileDescriptor(icudata_fd,
-                                                       icudata_region))
+    // On Android, we have two ICU data files. A main one with most languages
+    // that is expected to always be available and an extra one that is
+    // installed separately via a dynamic feature module. If the extra ICU data
+    // file is available we have to apply it _before_ the main ICU data file.
+    // Otherwise, the languages of the extra ICU file will be overridden.
+    if (process_type.empty()) {
+      // In browser process load ICU data files from disk.
+      if (GetContentClient()->browser()->ShouldLoadExtraIcuDataFile()) {
+        if (!base::i18n::InitializeExtraICU()) {
+          return TerminateForFatalInitializationError();
+        }
+      }
+      if (!base::i18n::InitializeICU()) {
         return TerminateForFatalInitializationError();
+      }
     } else {
-      if (!base::i18n::InitializeICU())
+      // In child process map ICU data files loaded by browser process.
+      int icu_extra_data_fd = g_fds->MaybeGet(kAndroidICUExtraDataDescriptor);
+      if (icu_extra_data_fd != -1) {
+        auto icu_extra_data_region =
+            g_fds->GetRegion(kAndroidICUExtraDataDescriptor);
+        if (!base::i18n::InitializeExtraICUWithFileDescriptor(
+                icu_extra_data_fd, icu_extra_data_region)) {
+          return TerminateForFatalInitializationError();
+        }
+      }
+      int icu_data_fd = g_fds->MaybeGet(kAndroidICUDataDescriptor);
+      if (icu_data_fd == -1) {
         return TerminateForFatalInitializationError();
+      }
+      auto icu_data_region = g_fds->GetRegion(kAndroidICUDataDescriptor);
+      if (!base::i18n::InitializeICUWithFileDescriptor(icu_data_fd,
+                                                       icu_data_region)) {
+        return TerminateForFatalInitializationError();
+      }
     }
 #else
     if (!base::i18n::InitializeICU())
@@ -941,7 +957,7 @@ int ContentMainRunnerImpl::RunServiceManager(MainFunctionParams& main_params,
     download::SetIOTaskRunner(
         service_manager_environment_->ipc_thread()->task_runner());
 
-    InitializeBrowserClientProcessImpl();
+    InitializeBrowserMemoryInstrumentationClient();
 
 #if defined(OS_ANDROID)
     if (start_service_manager_only) {
diff --git a/chromium/content/app/service_manager_environment.cc b/chromium/content/app/service_manager_environment.cc
index d9104589f07..30fa151aa83 100644
--- a/chromium/content/app/service_manager_environment.cc
+++ b/chromium/content/app/service_manager_environment.cc
@@ -8,7 +8,6 @@
 
 #include "build/build_config.h"
 #include "content/browser/browser_process_sub_thread.h"
-#include "content/browser/service_manager/common_browser_interfaces.h"
 #include "content/browser/service_manager/service_manager_context.h"
 #include "content/browser/startup_data_impl.h"
 #include "content/public/common/service_manager_connection.h"
@@ -25,9 +24,7 @@ ServiceManagerEnvironment::ServiceManagerEnvironment(
           mojo::core::ScopedIPCSupport::ShutdownPolicy::FAST)),
       service_manager_context_(
           std::make_unique<ServiceManagerContext>(ipc_thread_->task_runner())) {
-  auto* system_connection = ServiceManagerConnection::GetForProcess();
-  RegisterCommonBrowserInterfaces(system_connection);
-  system_connection->Start();
+  ServiceManagerConnection::GetForProcess()->Start();
 }
 
 ServiceManagerEnvironment::~ServiceManagerEnvironment() = default;
diff --git a/chromium/content/app/strings/BUILD.gn b/chromium/content/app/strings/BUILD.gn
deleted file mode 100644
index 2bb880fcd17..00000000000
--- a/chromium/content/app/strings/BUILD.gn
+++ /dev/null
@@ -1,66 +0,0 @@
-# Copyright 2014 The Chromium Authors. All rights reserved.
-# Use of this source code is governed by a BSD-style license that can be
-# found in the LICENSE file.
-
-import("//tools/grit/grit_rule.gni")
-
-grit("strings") {
-  source = "content_strings.grd"
-  outputs = [
-    "grit/content_strings.h",
-    "content_strings_am.pak",
-    "content_strings_ar.pak",
-    "content_strings_bg.pak",
-    "content_strings_bn.pak",
-    "content_strings_ca.pak",
-    "content_strings_cs.pak",
-    "content_strings_da.pak",
-    "content_strings_de.pak",
-    "content_strings_el.pak",
-    "content_strings_en-GB.pak",
-    "content_strings_en-US.pak",
-    "content_strings_es.pak",
-    "content_strings_es-419.pak",
-    "content_strings_et.pak",
-    "content_strings_fa.pak",
-    "content_strings_fake-bidi.pak",
-    "content_strings_fi.pak",
-    "content_strings_fil.pak",
-    "content_strings_fr.pak",
-    "content_strings_gu.pak",
-    "content_strings_he.pak",
-    "content_strings_hi.pak",
-    "content_strings_hr.pak",
-    "content_strings_hu.pak",
-    "content_strings_id.pak",
-    "content_strings_it.pak",
-    "content_strings_ja.pak",
-    "content_strings_kn.pak",
-    "content_strings_ko.pak",
-    "content_strings_lt.pak",
-    "content_strings_lv.pak",
-    "content_strings_ml.pak",
-    "content_strings_mr.pak",
-    "content_strings_ms.pak",
-    "content_strings_nl.pak",
-    "content_strings_nb.pak",
-    "content_strings_pl.pak",
-    "content_strings_pt-BR.pak",
-    "content_strings_pt-PT.pak",
-    "content_strings_ro.pak",
-    "content_strings_ru.pak",
-    "content_strings_sk.pak",
-    "content_strings_sl.pak",
-    "content_strings_sr.pak",
-    "content_strings_sv.pak",
-    "content_strings_sw.pak",
-    "content_strings_ta.pak",
-    "content_strings_te.pak",
-    "content_strings_th.pak",
-    "content_strings_tr.pak",
-    "content_strings_uk.pak",
-    "content_strings_vi.pak",
-    "content_strings_zh-CN.pak",
-    "content_strings_zh-TW.pak",
-  ]
-}
diff --git a/chromium/content/app/strings/content_strings.grd b/chromium/content/app/strings/content_strings.grd
deleted file mode 100644
index 38b452ebe15..00000000000
--- a/chromium/content/app/strings/content_strings.grd
+++ /dev/null
@@ -1,1095 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-
-<!-- This file contains definitions of resources that will be translated for
-each locale. Specifically, these are UI strings that are used by content that
-need to be translated for each locale.-->
-
-<!-- Some of these strings and string descriptions were taken from
-WebKit/win/WebCoreLocalizedStrings.cpp so we include the original license
-below:
-
-/*
- * Copyright (C) 2007 Apple Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
--->
-
-<grit base_dir="." latest_public_release="0" current_release="1"
-      output_all_resource_defines="false" source_lang_id="en" enc_check="möl">
-  <outputs>
-    <!-- TODO add each of your output files.  Modify the three below, and add
-    your own for your various languages.  See the user's guide
-    (https://www.chromium.org/developers/tools-we-use-in-chromium/grit/grit-users-guide)
-    for more details.
-    Note that all output references are relative to the output directory
-    which is specified at build time. -->
-    <output filename="grit/content_strings.h" type="rc_header">
-      <emit emit_type='prepend'></emit>
-    </output>
-    <output filename="content_strings_am.pak" type="data_package" lang="am" />
-    <output filename="content_strings_ar.pak" type="data_package" lang="ar" />
-    <output filename="content_strings_bg.pak" type="data_package" lang="bg" />
-    <output filename="content_strings_bn.pak" type="data_package" lang="bn" />
-    <output filename="content_strings_ca.pak" type="data_package" lang="ca" />
-    <output filename="content_strings_cs.pak" type="data_package" lang="cs" />
-    <output filename="content_strings_da.pak" type="data_package" lang="da" />
-    <output filename="content_strings_de.pak" type="data_package" lang="de" />
-    <output filename="content_strings_el.pak" type="data_package" lang="el" />
-    <output filename="content_strings_en-GB.pak" type="data_package" lang="en-GB" />
-    <output filename="content_strings_en-US.pak" type="data_package" lang="en" />
-    <output filename="content_strings_es.pak" type="data_package" lang="es" />
-    <output filename="content_strings_es-419.pak" type="data_package" lang="es-419" />
-    <output filename="content_strings_et.pak" type="data_package" lang="et" />
-    <output filename="content_strings_fa.pak" type="data_package" lang="fa" />
-    <output filename="content_strings_fake-bidi.pak" type="data_package" lang="fake-bidi" />
-    <output filename="content_strings_fi.pak" type="data_package" lang="fi" />
-    <output filename="content_strings_fil.pak" type="data_package" lang="fil" />
-    <output filename="content_strings_fr.pak" type="data_package" lang="fr" />
-    <output filename="content_strings_gu.pak" type="data_package" lang="gu" />
-    <output filename="content_strings_he.pak" type="data_package" lang="he" />
-    <output filename="content_strings_hi.pak" type="data_package" lang="hi" />
-    <output filename="content_strings_hr.pak" type="data_package" lang="hr" />
-    <output filename="content_strings_hu.pak" type="data_package" lang="hu" />
-    <output filename="content_strings_id.pak" type="data_package" lang="id" />
-    <output filename="content_strings_it.pak" type="data_package" lang="it" />
-    <output filename="content_strings_ja.pak" type="data_package" lang="ja" />
-    <output filename="content_strings_kn.pak" type="data_package" lang="kn" />
-    <output filename="content_strings_ko.pak" type="data_package" lang="ko" />
-    <output filename="content_strings_lt.pak" type="data_package" lang="lt" />
-    <output filename="content_strings_lv.pak" type="data_package" lang="lv" />
-    <output filename="content_strings_ml.pak" type="data_package" lang="ml" />
-    <output filename="content_strings_mr.pak" type="data_package" lang="mr" />
-    <output filename="content_strings_ms.pak" type="data_package" lang="ms" />
-    <output filename="content_strings_nl.pak" type="data_package" lang="nl" />
-    <!-- The translation console uses 'no' for Norwegian Bokmål. It should
-         be 'nb'. -->
-    <output filename="content_strings_nb.pak" type="data_package" lang="no" />
-    <output filename="content_strings_pl.pak" type="data_package" lang="pl" />
-    <output filename="content_strings_pt-BR.pak" type="data_package" lang="pt-BR" />
-    <output filename="content_strings_pt-PT.pak" type="data_package" lang="pt-PT" />
-    <output filename="content_strings_ro.pak" type="data_package" lang="ro" />
-    <output filename="content_strings_ru.pak" type="data_package" lang="ru" />
-    <output filename="content_strings_sk.pak" type="data_package" lang="sk" />
-    <output filename="content_strings_sl.pak" type="data_package" lang="sl" />
-    <output filename="content_strings_sr.pak" type="data_package" lang="sr" />
-    <output filename="content_strings_sv.pak" type="data_package" lang="sv" />
-    <output filename="content_strings_sw.pak" type="data_package" lang="sw" />
-    <output filename="content_strings_ta.pak" type="data_package" lang="ta" />
-    <output filename="content_strings_te.pak" type="data_package" lang="te" />
-    <output filename="content_strings_th.pak" type="data_package" lang="th" />
-    <output filename="content_strings_tr.pak" type="data_package" lang="tr" />
-    <output filename="content_strings_uk.pak" type="data_package" lang="uk" />
-    <output filename="content_strings_vi.pak" type="data_package" lang="vi" />
-    <output filename="content_strings_zh-CN.pak" type="data_package" lang="zh-CN" />
-    <output filename="content_strings_zh-TW.pak" type="data_package" lang="zh-TW" />
-  </outputs>
-  <translations>
-    <file path="translations/content_strings_am.xtb" lang="am" />
-    <file path="translations/content_strings_ar.xtb" lang="ar" />
-    <file path="translations/content_strings_bg.xtb" lang="bg" />
-    <file path="translations/content_strings_bn.xtb" lang="bn" />
-    <file path="translations/content_strings_ca.xtb" lang="ca" />
-    <file path="translations/content_strings_cs.xtb" lang="cs" />
-    <file path="translations/content_strings_da.xtb" lang="da" />
-    <file path="translations/content_strings_de.xtb" lang="de" />
-    <file path="translations/content_strings_el.xtb" lang="el" />
-    <file path="translations/content_strings_en-GB.xtb" lang="en-GB" />
-    <file path="translations/content_strings_es.xtb" lang="es" />
-    <file path="translations/content_strings_es-419.xtb" lang="es-419" />
-    <file path="translations/content_strings_et.xtb" lang="et" />
-    <file path="translations/content_strings_fa.xtb" lang="fa" />
-    <file path="translations/content_strings_fi.xtb" lang="fi" />
-    <file path="translations/content_strings_fil.xtb" lang="fil" />
-    <file path="translations/content_strings_fr.xtb" lang="fr" />
-    <file path="translations/content_strings_gu.xtb" lang="gu" />
-    <file path="translations/content_strings_hi.xtb" lang="hi" />
-    <file path="translations/content_strings_hr.xtb" lang="hr" />
-    <file path="translations/content_strings_hu.xtb" lang="hu" />
-    <file path="translations/content_strings_id.xtb" lang="id" />
-    <file path="translations/content_strings_it.xtb" lang="it" />
-    <!-- The translation console uses 'iw' for Hebrew, but we use 'he'. -->
-    <file path="translations/content_strings_iw.xtb" lang="he" />
-    <file path="translations/content_strings_ja.xtb" lang="ja" />
-    <file path="translations/content_strings_kn.xtb" lang="kn" />
-    <file path="translations/content_strings_ko.xtb" lang="ko" />
-    <file path="translations/content_strings_lt.xtb" lang="lt" />
-    <file path="translations/content_strings_lv.xtb" lang="lv" />
-    <file path="translations/content_strings_ml.xtb" lang="ml" />
-    <file path="translations/content_strings_mr.xtb" lang="mr" />
-    <file path="translations/content_strings_ms.xtb" lang="ms" />
-    <file path="translations/content_strings_nl.xtb" lang="nl" />
-    <file path="translations/content_strings_no.xtb" lang="no" />
-    <file path="translations/content_strings_pl.xtb" lang="pl" />
-    <file path="translations/content_strings_pt-BR.xtb" lang="pt-BR" />
-    <file path="translations/content_strings_pt-PT.xtb" lang="pt-PT" />
-    <file path="translations/content_strings_ro.xtb" lang="ro" />
-    <file path="translations/content_strings_ru.xtb" lang="ru" />
-    <file path="translations/content_strings_sk.xtb" lang="sk" />
-    <file path="translations/content_strings_sl.xtb" lang="sl" />
-    <file path="translations/content_strings_sr.xtb" lang="sr" />
-    <file path="translations/content_strings_sv.xtb" lang="sv" />
-    <file path="translations/content_strings_sw.xtb" lang="sw" />
-    <file path="translations/content_strings_ta.xtb" lang="ta" />
-    <file path="translations/content_strings_te.xtb" lang="te" />
-    <file path="translations/content_strings_th.xtb" lang="th" />
-    <file path="translations/content_strings_tr.xtb" lang="tr" />
-    <file path="translations/content_strings_uk.xtb" lang="uk" />
-    <file path="translations/content_strings_vi.xtb" lang="vi" />
-    <file path="translations/content_strings_zh-CN.xtb" lang="zh-CN" />
-    <file path="translations/content_strings_zh-TW.xtb" lang="zh-TW" />
-  </translations>
-  <release seq="1" allow_pseudo="false">
-    <messages fallback_to_english="true">
-      <!-- TODO add all of your "string table" messages here.  Remember to
-      change nontranslateable parts of the messages into placeholders (using the
-      <ph> element).  You can also use the 'grit add' tool to help you identify
-      nontranslateable parts and create placeholders for them. -->
-
-      <message name="IDS_DETAILS_WITHOUT_SUMMARY_LABEL" desc="Clickable label to show detailed information or to hide the detailed information.">
-        Details
-      </message>
-      <message name="IDS_FORM_CALENDAR_CLEAR" desc="Label for a button which clears a date input field.">
-        Clear
-      </message>
-      <message name="IDS_FORM_CALENDAR_TODAY" desc="Label for a button which sets today to a date input field.">
-        Today
-      </message>
-      <message name="IDS_FORM_SUBMIT_LABEL" desc="Default label for Submit buttons in forms on webpages.">
-        Submit
-      </message>
-      <message name="IDS_FORM_INPUT_ALT" desc="Alt text for &lt;input&gt; elements with no alt, title, or value">
-        Submit
-      </message>
-      <message name="IDS_FORM_RESET_LABEL" desc="default label for Reset buttons in forms on webpages">
-        Reset
-      </message>
-      <message name="IDS_FORM_FILE_BUTTON_LABEL" desc="title for a single file chooser button used in HTML forms">
-        Choose File
-      </message>
-      <message name="IDS_FORM_MULTIPLE_FILES_BUTTON_LABEL" desc="title for a multiple file chooser button used in HTML forms. This title should be as short as possible.">
-        Choose Files
-      </message>
-      <message name="IDS_FORM_FILE_NO_FILE_LABEL" desc="text to display in file button used in HTML forms when no file is selected">
-        No file chosen
-      </message>
-      <message name="IDS_FORM_FILE_MULTIPLE_UPLOAD" desc="text to display next to file buttons in HTML forms when 2 or more files are selected for uploading. This is not used for a case that just 1 file is selected.">
-        <ph name="NUMBER_OF_FILES">$1<ex>3</ex></ph> files
-      </message>
-      <message name="IDS_FORM_OTHER_COLOR_LABEL" desc="Label for button that opens a full color chooser so the user can choose colors other than the ones in the list.">
-        Other...
-      </message>
-      <message name="IDS_FORM_OTHER_DATE_LABEL" desc="Label for button that opens a full calendar picker so the user can choose dates other than the ones in the list." meaning="for date label">
-        Other...
-      </message>
-      <message name="IDS_FORM_OTHER_MONTH_LABEL" desc="Label for button that opens a full month picker so the user can choose dates other than the ones in the list." meaning="for month label">
-        Other...
-      </message>
-      <message name="IDS_FORM_OTHER_WEEK_LABEL" desc="Label for button that opens a full week picker so the user can choose dates other than the ones in the list." meaning="for week label">
-        Other...
-      </message>
-      <message name="IDS_FORM_PLACEHOLDER_FOR_DAY_OF_MONTH_FIELD" desc="Text for denoting day of month field position in date format. Short text is preferred. See http://crbug.com/152632 for samples.">
-        dd
-      </message>
-      <message name="IDS_FORM_PLACEHOLDER_FOR_MONTH_FIELD" desc="Text for denoting month field position in date format. Short text is preferred. See http://crbug.com/152632 for samples.">
-        mm
-      </message>
-      <message name="IDS_FORM_PLACEHOLDER_FOR_YEAR_FIELD" desc="Text for denoting day of month field position in date format. Short text is preferred. See http://crbug.com/152632 for samples.">
-        yyyy
-      </message>
-      <message name="IDS_FORM_SELECT_MENU_LIST_TEXT" desc="Text for the menu list rendering of a select element.">
-        <ph name="SELECTED_COUNT">$1<ex>3</ex></ph> selected
-      </message>
-      <message name="IDS_FORM_THIS_MONTH_LABEL" desc="Label for button in month picker to select this month.">
-        This month
-      </message>
-      <message name="IDS_FORM_THIS_WEEK_LABEL" desc="Label for button in week picker to select this week.">
-        This week
-      </message>
-      <message name="IDS_FORM_WEEK_NUMBER_LABEL" desc="Label for week number column in a calendar.">
-        Week
-      </message>
-
-      <message name="IDS_AX_CALENDAR_SHOW_DATE_PICKER" desc="Accessible description of a button to show a calendar from a date input field.">
-        Show date picker
-      </message>
-      <message name="IDS_AX_CALENDAR_SHOW_MONTH_SELECTOR" desc="Accessible description of a button to show month selection panel in a calendar picker.">
-        Show month selection panel
-      </message>
-      <message name="IDS_AX_CALENDAR_SHOW_NEXT_MONTH" desc="Accessible description of a button to show next month in a calendar picker.">
-        Show next month
-      </message>
-      <message name="IDS_AX_CALENDAR_SHOW_PREVIOUS_MONTH" desc="Accessible description of a button to show previous month in a calendar picker.">
-        Show previous month
-      </message>
-      <message name="IDS_AX_CALENDAR_WEEK_DESCRIPTION" desc="Accessible description of a button to select a specific week.">
-        <ph name="WEEK">$1<ex>Week 38, 2014</ex></ph>, starting on <ph name="WEEK_START_DATE">$2<ex>September 15, 2014</ex></ph>
-      </message>
-
-      <!-- Localized names for accessibility roles -->
-      <message name="IDS_AX_ROLE_ARTICLE" desc="Accessibility role description for article">
-        article
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-audio -->
-      <message name="IDS_AX_ROLE_AUDIO" desc="Accessible role description for audio">
-        audio
-      </message>
-      <message name="IDS_AX_ROLE_BANNER" desc="Accessibility role description for banner">
-        banner
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-input-color -->
-      <message name="IDS_AX_ROLE_COLOR_WELL" desc="Accessibility role description for a color picker">
-        color picker
-      </message>
-      <message name="IDS_AX_ROLE_COMPLEMENTARY" desc="Accessibility role description for complementary">
-        complementary
-      </message>
-      <message name="IDS_AX_ROLE_CONTENT_DELETION" desc="Accessibility role description for content deletion, meaning content that is has been or is suggested to be removed from a document, such as in a revision review">
-        deletion
-      </message>
-      <message name="IDS_AX_ROLE_CONTENT_INSERTION" desc="Accessibility role description for content insertion, meaning content that has been marked or is suggested to be inserte nto a document, such as in a revision review">
-        insertion
-      </message>
-      <message name="IDS_AX_ROLE_CHECK_BOX" desc="Accessibility role description for a check box">
-        checkbox
-      </message>
-      <message name="IDS_AX_ROLE_CONTENT_INFO" desc="Accessibility role description for credits and information about the content of the page, like copyrights and privacy statements">
-        content information
-      </message>
-      <message name="IDS_AX_ROLE_DATE" desc="Accessibility role description for a date input">
-        date picker
-      </message>
-      <message name="IDS_AX_ROLE_DATE_TIME_LOCAL" desc="Accessibility role description for a datetime-local input">
-        local date and time picker
-      </message>
-      <message name="IDS_AX_ROLE_DEFINITION" desc="Accessibility role description for a definition">
-        definition
-      </message>
-      <message name="IDS_AX_ROLE_DESCRIPTION_LIST" desc="Accessibility role description for a definition list">
-        definition list
-      </message>
-      <message name="IDS_AX_ROLE_DESCRIPTION_TERM" desc="Accessibility role description for description term (as in a description list)">
-        term
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-details -->
-      <message name="IDS_AX_ROLE_DETAILS" desc="Accessibility role description for details">
-        details
-      </message>
-      <message name="IDS_AX_ROLE_DISCLOSURE_TRIANGLE" desc="Accessibility role description for a disclosure triangle, a control shaped like a triangle that expands or collapses to show or hide extra content">
-        disclosure triangle
-      </message>
-      <message name="IDS_AX_ROLE_DOC_ABSTRACT" desc="Accessibility role description for abstract, meaning the summary of the contents of an article or book">
-        abstract
-      </message>
-      <message name="IDS_AX_ROLE_DOC_ACKNOWLEDGMENTS" desc="Accessibility role description for acknowledgments">
-        acknowledgments
-      </message>
-      <message name="IDS_AX_ROLE_DOC_AFTERWORD" desc="Accessibility role description for afterword">
-        afterword
-      </message>
-      <message name="IDS_AX_ROLE_DOC_APPENDIX" desc="Accessibility role description for appendix, meaning the summary of the contents of an article or book">
-        appendix
-      </message>
-      <message name="IDS_AX_ROLE_DOC_BACKLINK" desc="Accessibility role description for back link">
-        back link
-      </message>
-      <message name="IDS_AX_ROLE_DOC_BIBLIO_ENTRY" desc="Accessibility role description for bibliography entry">
-        bibliography entry
-      </message>
-      <message name="IDS_AX_ROLE_DOC_BIBLIOGRAPHY" desc="Accessibility role description for bibliography">
-        bibliography
-      </message>
-      <message name="IDS_AX_ROLE_DOC_BIBLIO_REF" desc="Accessibility role description for bibliography reference">
-        bibliography reference
-      </message>
-      <message name="IDS_AX_ROLE_DOC_CHAPTER" desc="Accessibility role description for chapter">
-        chapter
-      </message>
-      <message name="IDS_AX_ROLE_DOC_COLOPHON" desc="Accessibility role description for colophon">
-        colophon
-      </message>
-      <message name="IDS_AX_ROLE_DOC_CONCLUSION" desc="Accessibility role description for conclusion">
-        conclusion
-      </message>
-      <message name="IDS_AX_ROLE_DOC_COVER" desc="Accessibility role description for cover">
-        cover
-      </message>
-      <message name="IDS_AX_ROLE_DOC_CREDIT" desc="Accessibility role description for credit, a public acknowledgement of someone who was responsible for helping with something">
-        credit
-      </message>
-      <message name="IDS_AX_ROLE_DOC_CREDITS" desc="Accessibility role description for credits">
-        credits
-      </message>
-      <message name="IDS_AX_ROLE_DOC_DEDICATION" desc="Accessibility role description for dedication">
-        dedication
-      </message>
-      <message name="IDS_AX_ROLE_DOC_ENDNOTE" desc="Accessibility role description for endnote">
-        endnote
-      </message>
-      <message name="IDS_AX_ROLE_DOC_ENDNOTES" desc="Accessibility role description for endnotes">
-        endnotes
-      </message>
-      <message name="IDS_AX_ROLE_DOC_EPIGRAPH" desc="Accessibility role description for epigraph">
-        epigraph
-      </message>
-      <message name="IDS_AX_ROLE_DOC_EPILOGUE" desc="Accessibility role description for epilogue">
-        epilogue
-      </message>
-      <message name="IDS_AX_ROLE_DOC_ERRATA" desc="Accessibility role description for errata">
-        errata
-      </message>
-      <message name="IDS_AX_ROLE_DOC_EXAMPLE" desc="Accessibility role description for example">
-        example
-      </message>
-      <message name="IDS_AX_ROLE_DOC_FOOTNOTE" desc="Accessibility role description for footnote">
-        footnote
-      </message>
-      <message name="IDS_AX_ROLE_DOC_FOREWORD" desc="Accessibility role description for foreword">
-        foreword
-      </message>
-      <message name="IDS_AX_ROLE_DOC_GLOSSARY" desc="Accessibility role description for glossary">
-        glossary
-      </message>
-      <message name="IDS_AX_ROLE_DOC_GLOSS_REF" desc="Accessibility role description for glossary reference">
-        glossary reference
-      </message>
-      <message name="IDS_AX_ROLE_DOC_INDEX" desc="Accessibility role description for index">
-        index
-      </message>
-      <message name="IDS_AX_ROLE_DOC_INTRODUCTION" desc="Accessibility role description for introduction">
-        introduction
-      </message>
-      <message name="IDS_AX_ROLE_DOC_NOTE_REF" desc="Accessibility role description for note reference">
-        note reference
-      </message>
-      <message name="IDS_AX_ROLE_DOC_NOTICE" desc="Accessibility role description for notice">
-        notice
-      </message>
-      <message name="IDS_AX_ROLE_DOC_PAGE_BREAK" desc="Accessibility role description for page break">
-        page break
-      </message>
-      <message name="IDS_AX_ROLE_DOC_PAGE_LIST" desc="Accessibility role description for page list">
-        page list
-      </message>
-      <message name="IDS_AX_ROLE_DOC_PART" desc="Accessibility role description for part, as in a part of a book">
-        part
-      </message>
-      <message name="IDS_AX_ROLE_DOC_PREFACE" desc="Accessibility role description for preface">
-        preface
-      </message>
-      <message name="IDS_AX_ROLE_DOC_PROLOGUE" desc="Accessibility role description for prologue">
-        prologue
-      </message>
-      <message name="IDS_AX_ROLE_DOC_PULLQUOTE" desc="Accessibility role description for pullquote">
-        pullquote
-      </message>
-      <message name="IDS_AX_ROLE_DOC_QNA" desc="Accessibility role description for Q+A (questions and answers)">
-        Q&amp;A
-      </message>
-      <message name="IDS_AX_ROLE_DOC_SUBTITLE" desc="Accessibility role description for subtitle">
-        subtitle
-      </message>
-      <message name="IDS_AX_ROLE_DOC_TIP" desc="Accessibility role description for tip, as in a suggestion or idea">
-        tip
-      </message>
-      <message name="IDS_AX_ROLE_DOC_TOC" desc="Accessibility role description for table of contents">
-        table of contents
-      </message>
-      <message name="IDS_AX_ROLE_FEED" desc="Accessibility role description for a scrollable list of articles.">
-        feed
-      </message>
-      <message name="IDS_AX_ROLE_FIGURE" desc="Accessibility role description for figure">
-        figure
-      </message>
-      <message name="IDS_AX_ROLE_FORM" desc="Accessibility role description for form">
-        form
-      </message>
-      <message name="IDS_AX_ROLE_FOOTER" desc="Accessibility role description for footers">
-        footer
-      </message>
-      <message name="IDS_AX_ROLE_GRAPHICS_DOCUMENT" desc="Accessibility role description for graphics document">
-        graphics document
-      </message>
-      <message name="IDS_AX_ROLE_GRAPHICS_OBJECT" desc="Accessibility role description for graphics object">
-        graphics object
-      </message>
-      <message name="IDS_AX_ROLE_GRAPHICS_SYMBOL" desc="Accessibility role description for graphics symbol">
-        graphics symbol
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-input-email -->
-      <message name="IDS_AX_ROLE_EMAIL" desc="Accessibility role description for email input">
-        email
-      </message>
-      <message name="IDS_AX_AUTOFILL_POPUP_ACCESSIBLE_NODE_DATA" desc="The accessibility text to speak when we display an autofill popup">
-        Autofill
-      </message>
-      <if expr="is_macosx">
-        <message name="IDS_AX_ROLE_STEPPER" desc="Accessibility role description for a stepper - a control where you can use up/down arrows to increment or decrement it. The name 'stepper' is how this user interface element is described by VoiceOver on Mac OS X; the translation should be consistent with VoiceOver.">
-          stepper
-        </message>
-      </if>
-      <message name="IDS_AX_ROLE_TOGGLE_BUTTON" desc="Accessibility role description for a toggle button">
-        toggle button
-      </message>
-      <message name="IDS_AX_ROLE_HEADING" desc="Accessibility role description for headings">
-        heading
-      </message>
-      <message name="IDS_AX_ROLE_LINK" desc="Accessibility role description for link">
-        link
-      </message>
-      <message name="IDS_AX_ROLE_MAIN_CONTENT" desc="Accessibility role description for main content of the document.">
-        main
-      </message>
-      <message name="IDS_AX_ROLE_MARK" desc="Accessibility role description for highlighted content.">
-        highlighted content
-      </message>
-      <message name="IDS_AX_ROLE_MATH" desc="Accessibility role description for math">
-        math
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-meter -->
-      <message name="IDS_AX_ROLE_METER" desc="Accessibility role description for a meter, for example a temperature indicator or progress bar">
-          meter
-      </message>
-      <message name="IDS_AX_ROLE_NAVIGATIONAL_LINK" desc="Accessibility role description for group of navigational links.">
-        navigation
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-output -->
-      <message name="IDS_AX_ROLE_OUTPUT" desc="Accessibility role description for output">
-        output
-      </message>
-      <message name="IDS_AX_ROLE_REGION" desc="Accessibility role description for region">
-        region
-      </message>
-      <!-- https://www.w3.org/TR/core-aam-1.1/#role-map-searchbox -->
-      <if expr="is_win">
-        <message name="IDS_AX_ROLE_SEARCH_BOX" desc="UIA role description for search text field">
-          search box
-        </message>
-      </if>
-      <if expr="not is_win">
-        <message name="IDS_AX_ROLE_SEARCH_BOX" desc="Accessibility role description for search text field">
-          search text field
-        </message>
-      </if>
-      <message name="IDS_AX_ROLE_STATUS" desc="Accessibility role description for status">
-        status
-      </message>
-      <message name="IDS_AX_ROLE_SWITCH" desc="Accessibility role description for switch">
-        switch
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-input-tel -->
-      <message name="IDS_AX_ROLE_TELEPHONE" desc="Accessibility role description for telephone number input">
-        telephone
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-time -->
-      <message name="IDS_AX_ROLE_TIME" desc="Accessibility role description for a time">
-        time
-      </message>
-      <!-- https://w3c.github.io/html-aam/#el-input-url -->
-      <message name="IDS_AX_ROLE_URL" desc="Accessibility role description for URL input">
-        url
-      </message>
-      <message name="IDS_AX_ROLE_WEB_AREA" desc="Accessibility role description for web area">
-        HTML content
-      </message>
-      <message name="IDS_AX_ROLE_WEEK" desc="Accessibility role description for a week input">
-        week picker
-      </message>
-      <if expr="is_android">
-        <message name="IDS_AX_ROLE_ALERT" desc="Accessibility role description for an alert">
-          alert
-        </message>
-        <message name="IDS_AX_ROLE_ALERT_DIALOG" desc="Accessibility role description for an alert dialog">
-          alert_dialog
-        </message>
-        <message name="IDS_AX_ROLE_APPLICATION" desc="Accessibility role description for an application">
-          application
-        </message>
-        <message name="IDS_AX_ROLE_BLOCKQUOTE" desc="Accessibility role description for a blockquote">
-          blockquote
-        </message>
-        <message name="IDS_AX_ROLE_BUTTON" desc="Accessibility role description for a button">
-          button
-        </message>
-        <message name="IDS_AX_ROLE_COLUMN_HEADER" desc="Accessibility role description for a column header">
-          column header
-        </message>
-        <message name="IDS_AX_ROLE_COMBO_BOX" desc="Accessibility role description for a combo box, an editable text control with an associated drop-down list">
-          combo box
-        </message>
-        <message name="IDS_AX_ROLE_DATE_TIME" desc="Accessibility role description for a date / time picker">
-          date and time picker
-        </message>
-        <message name="IDS_AX_ROLE_DIALOG" desc="Accessibility role description for a dialog">
-          dialog
-        </message>
-        <message name="IDS_AX_ROLE_DIRECTORY" desc="Accessibility role description for a directory, for example a table of contents or list of employees">
-          directory
-        </message>
-        <message name="IDS_AX_ROLE_DOCUMENT" desc="Accessibility role description for a document">
-          document
-        </message>
-        <message name="IDS_AX_ROLE_EMBEDDED_OBJECT" desc="Accessibility role description for an embedded object, like a video inside a web page">
-          object
-        </message>
-        <message name="IDS_AX_ROLE_GRAPHIC" desc="Accessibility role description for a graphic or image">
-          graphic
-        </message>
-        <message name="IDS_AX_ROLE_HEADING_WITH_LEVEL" desc="Accessibility role description for a heading with a heading level, for example 'heading 1' is the most important heading and 'heading 3' is less important">
-          heading <ph name="HEADING_LEVEL">$1<ex>1</ex></ph>
-        </message>
-        <message name="IDS_AX_ROLE_INPUT_TIME" desc="Accessibility role description for a time picker control">
-          time picker
-        </message>
-        <message name="IDS_AX_ROLE_LIST_BOX" desc="Accessibility role description for a list box control">
-          list box
-        </message>
-        <message name="IDS_AX_ROLE_LOG" desc="Accessibility role description for an information log, such as a chat log or error log">
-          log
-        </message>
-        <message name="IDS_AX_ROLE_MARQUEE" desc="Accessibility role description for a marquee, such as a stock ticker or ad banner that frequently changes">
-          marquee
-        </message>
-        <message name="IDS_AX_ROLE_MENU" desc="Accessibility role description for a menu">
-          menu
-        </message>
-        <message name="IDS_AX_ROLE_MENU_BAR" desc="Accessibility role description for a menu bar">
-          menu bar
-        </message>
-        <message name="IDS_AX_ROLE_MENU_BUTTON" desc="Accessibility role description for a menu button, a button that opens a menu">
-          menu button
-        </message>
-        <message name="IDS_AX_ROLE_MENU_ITEM" desc="Accessibility role description for a menu item">
-          menu item
-        </message>
-        <message name="IDS_AX_ROLE_NOTE" desc="Accessibility role description for a note">
-          note
-        </message>
-        <message name="IDS_AX_ROLE_POP_UP_BUTTON" desc="Accessibility role description for a pop up button">
-          pop up button
-        </message>
-        <message name="IDS_AX_ROLE_PROGRESS_INDICATOR" desc="Accessibility role description for a progress indicator">
-          progress indicator
-        </message>
-        <message name="IDS_AX_ROLE_RADIO" desc="Accessibility role description for a radio button">
-          radio button
-        </message>
-        <message name="IDS_AX_ROLE_RADIO_GROUP" desc="Accessibility role description for a group of related radio buttons">
-          radio group
-        </message>
-        <message name="IDS_AX_ROLE_ROW_HEADER" desc="Accessibility role description for a row header in a table">
-          row header
-        </message>
-        <message name="IDS_AX_ROLE_SCROLL_BAR" desc="Accessibility role description for a scroll bar">
-          scroll bar
-        </message>
-        <message name="IDS_AX_ROLE_SEARCH" desc="Accessibility role description for the section of a web page containing controls for searching the page or site">
-          search
-        </message>
-        <message name="IDS_AX_ROLE_SLIDER" desc="Accessibility role description for a slider">
-          slider
-        </message>
-        <message name="IDS_AX_ROLE_SPIN_BUTTON" desc="Accessibility role description for a spin button, a control containing a numerical value that can be incremented or decremented by 1">
-          spin button
-        </message>
-        <message name="IDS_AX_ROLE_SPLITTER" desc="Accessibility role description for a splitter, a control that splits the window in two pieces and can usually be dragged">
-          splitter
-        </message>
-        <message name="IDS_AX_ROLE_TAB" desc="Accessibility role description for a tab">
-          tab
-        </message>
-        <message name="IDS_AX_ROLE_TABLE" desc="Accessibility role description for a table">
-          table
-        </message>
-        <message name="IDS_AX_ROLE_TAB_LIST" desc="Accessibility role description for a tab list">
-          tab list
-        </message>
-        <message name="IDS_AX_ROLE_TAB_PANEL" desc="Accessibility role description for a tab panel, the part of the window that changes when selecting a new tab">
-          tab panel
-        </message>
-        <message name="IDS_AX_ROLE_TIMER" desc="Accessibility role description for a timer">
-          timer
-        </message>
-        <message name="IDS_AX_ROLE_TOOLBAR" desc="Accessibility role description for a toolbar">
-          toolbar
-        </message>
-        <message name="IDS_AX_ROLE_TOOLTIP" desc="Accessibility role description for a tooltip">
-          tooltip
-        </message>
-        <message name="IDS_AX_ROLE_TREE" desc="Accessibility role description for a tree">
-          tree
-        </message>
-        <message name="IDS_AX_ROLE_TREE_GRID" desc="Accessibility role description for a tree grid">
-          tree grid
-        </message>
-        <message name="IDS_AX_ROLE_TREE_ITEM" desc="Accessibility role description for a tree item">
-          tree item
-        </message>
-      </if>
-
-      <!-- Automatic image annotations for accessibility -->
-      <if expr="is_win">
-        <then>
-          <message name="IDS_AX_UNLABELED_IMAGE_ROLE_DESCRIPTION" desc="Accessibility role description for a graphic (image) on a web page that does not have a description for blind users.">
-            Unlabeled graphic
-          </message>
-        </then>
-        <else>
-          <message name="IDS_AX_UNLABELED_IMAGE_ROLE_DESCRIPTION" desc="Accessibility role description for an image on a web page that does not have a description for blind users.">
-            Unlabeled image
-          </message>
-        </else>
-      </if>
-      <message name="IDS_AX_IMAGE_ELIGIBLE_FOR_ANNOTATION" desc="Accessibility message spoken out loud to screen reader users to inform them that they can get a description of an image by opening the context menu.">
-        To get missing image descriptions, open the context menu.
-      </message>
-      <message name="IDS_AX_IMAGE_ANNOTATION_PENDING" desc="Accessibility message spoken out loud to screen reader users saying that the browser is in the middle of trying to get a description for an image.">
-        Getting description...
-      </message>
-      <message name="IDS_AX_IMAGE_ANNOTATION_ADULT" desc="Accessibility message spoken out loud to screen reader users indicating that an image appears to be something like nudity or pornography or other policy violation that is not appropriate for children.">
-        Appears to contain adult content. No description available.
-      </message>
-      <message name="IDS_AX_IMAGE_ANNOTATION_NO_DESCRIPTION" desc="Accessibility message spoken out loud to screen reader users indicating that the browser was unable to provide a description for an image.">
-        No description available.
-      </message>
-      <message name="IDS_AX_IMAGE_ANNOTATION_OCR_CONTEXT" desc="Accessibility message spoken out loud to screen reader users when reading text that was automatically extracted from an image, for an example the word 'stop' could be extracted from a photo of a stop sign. Because automatic text extraction sometimes contains errors it is important that the language used indicates some uncertainty - it may say 'stop' or it appears to say 'stop', not it definitely says 'stop'.">
-        Appears to say: <ph name="OCR_TEXT">$1<ex>Stop</ex></ph>
-      </message>
-      <message name="IDS_AX_IMAGE_ANNOTATION_DESCRIPTION_CONTEXT" desc="Accessibility message spoken out loud to screen reader users when reading a computer-generated description of an image, for example a photo of the president at a press conference might be described as 'A person at a podium'. Because automatic image description is sometimes incorrect, it is important that the langauge used indicates some uncertainty - it may be a person, it appears to be a person, not it definitely is a person.">
-        Appears to be: <ph name="DESCRIPTION">$1<ex>A person at a podium</ex></ph>
-      </message>
-
-      <message name="IDS_AX_AM_PM_FIELD_TEXT" desc="Accessible description of the AM/PM field in a date/time control">
-        AM/PM
-      </message>
-
-      <message name="IDS_AX_DAY_OF_MONTH_FIELD_TEXT" desc="Accessible description of the day of month field in a date/time control">
-        Day
-      </message>
-
-      <message name="IDS_AX_HOUR_FIELD_TEXT" desc="Accessible description of the hour field in a date/time control">
-        Hours
-      </message>
-
-      <message name="IDS_AX_MEDIA_DEFAULT" desc="Accessible description of a media control.">
-        media control
-      </message>
-
-      <message name="IDS_AX_MEDIA_AUDIO_ELEMENT" desc="Accessible description of audio">
-        audio
-      </message>
-
-      <message name="IDS_AX_MEDIA_VIDEO_ELEMENT" desc="Accessible description of video">
-        video
-      </message>
-
-      <message name="IDS_AX_MEDIA_MUTE_BUTTON" desc="Accessibility role description for mute button">
-        mute
-      </message>
-
-      <message name="IDS_AX_MEDIA_UNMUTE_BUTTON" desc="Accessibility role description for turn mute off button">
-        unmute
-      </message>
-
-      <message name="IDS_AX_MEDIA_PLAY_BUTTON" desc="Accessibility role description for play button">
-        play
-      </message>
-
-      <message name="IDS_AX_MEDIA_PAUSE_BUTTON" desc="Accessibility role description for pause button">
-        pause
-      </message>
-
-      <message name="IDS_AX_MEDIA_CURRENT_TIME_DISPLAY" desc="Accessibility role description for elapsed time display">
-        elapsed time: <ph name="ELAPSED_TIME">$1<ex>0:25</ex></ph>
-      </message>
-
-      <message name="IDS_AX_MEDIA_TIME_REMAINING_DISPLAY" desc="Accessibility role description for time remaining display">
-        remaining time: <ph name="REMAINING_TIME">$1<ex>3:25</ex></ph>
-      </message>
-
-      <message name="IDS_AX_MEDIA_ENTER_FULL_SCREEN_BUTTON" desc="Accessibility role description for enter fullscreen button">
-        enter full screen
-      </message>
-
-      <message name="IDS_AX_MEDIA_EXIT_FULL_SCREEN_BUTTON" desc="Accessibility role description for exit fullscreen button">
-        exit full screen
-      </message>
-
-      <message name="IDS_AX_MEDIA_DISPLAY_CUT_OUT_FULL_SCREEN_BUTTON" desc="Accessibility role description for display cutout fullscreen button">
-        toggle display cutout fullscreen
-      </message>
-
-      <message name="IDS_AX_MEDIA_ENTER_PICTURE_IN_PICTURE_BUTTON" desc="Accessibility role description for enter Picture-in-Picture button">
-        enter picture-in-picture
-      </message>
-
-      <message name="IDS_AX_MEDIA_EXIT_PICTURE_IN_PICTURE_BUTTON" desc="Accessibility role description for exit Picture-in-Picture button">
-        exit picture-in-picture
-      </message>
-
-      <message name="IDS_AX_MEDIA_LOADING_PANEL" desc="Accessibility role description for the loading/buffering panel">
-        buffering
-      </message>
-
-      <message name="IDS_AX_MEDIA_SHOW_CLOSED_CAPTIONS_MENU_BUTTON" desc="Accessibility role description for show closed captions menu button">
-        show closed captions menu
-      </message>
-
-      <message name="IDS_AX_MEDIA_HIDE_CLOSED_CAPTIONS_MENU_BUTTON" desc="Accessibility role description for hide closed captions menu button">
-        hide closed captions menu
-      </message>
-
-      <message name="IDS_AX_MEDIA_CAST_OFF_BUTTON" desc="Accessibility role description for remote playback button">
-        play on remote device
-      </message>
-
-      <message name="IDS_AX_MEDIA_CAST_ON_BUTTON" desc="Accessibility role description for remote playback control button">
-        control remote playback
-      </message>
-
-      <message name="IDS_AX_MEDIA_DOWNLOAD_BUTTON" desc="Media controls download button.">
-        download media
-      </message>
-
-      <message name="IDS_AX_MEDIA_OVERFLOW_BUTTON" desc="Media controls overflow button.">
-        show more media controls
-      </message>
-
-      <message name="IDS_AX_MEDIA_AUDIO_ELEMENT_HELP" desc="Accessible help of audio controls">
-        audio
-      </message>
-
-      <message name="IDS_AX_MEDIA_VIDEO_ELEMENT_HELP" desc="Accessible help of video">
-        video
-      </message>
-
-      <message name="IDS_AX_MEDIA_AUDIO_SLIDER_HELP" desc="Accessibility help description for audio timeline slider">
-        audio time scrubber
-      </message>
-
-      <message name="IDS_AX_MEDIA_VIDEO_SLIDER_HELP" desc="Accessibility help description for video timeline slider">
-        video time scrubber
-      </message>
-
-      <message name="IDS_AX_MEDIA_VOLUME_SLIDER_HELP" desc="Accessibility help description for volume slider">
-        volume slider
-      </message>
-
-      <message name="IDS_AX_MEDIA_CURRENT_TIME_DISPLAY_HELP" desc="Accessibility help description for elapsed time display">
-        current time in seconds
-      </message>
-
-      <message name="IDS_AX_MEDIA_TIME_REMAINING_DISPLAY_HELP" desc="Accessibility help description for time remaining display">
-        number of seconds of video remaining
-      </message>
-
-      <message name="IDS_AX_MEDIA_OVERFLOW_BUTTON_HELP" desc="Accessibility help description for overflow button.">
-        more options
-      </message>
-
-      <message name="IDS_AX_MEDIA_TOUCHLESS_PLAY_PAUSE_ACTION" desc="Accessibility help description for play/pause action on touchless device using DPAD.">
-        select to toggle play pause
-      </message>
-
-      <message name="IDS_AX_MEDIA_TOUCHLESS_SEEK_ACTION" desc="Accessibility help description for seek action on touchless device using DPAD.">
-        left and right to seek
-      </message>
-
-      <message name="IDS_AX_MEDIA_TOUCHLESS_VOLUME_ACTION" desc="Accessibility help description for volume change action on touchless device using DPAD.">
-        up and down to change volume
-      </message>
-
-      <message name="IDS_AX_MILLISECOND_FIELD_TEXT" desc="Accessible description of the millisecond field in a date/time control">
-        Milliseconds
-      </message>
-
-      <message name="IDS_AX_MINUTE_FIELD_TEXT" desc="Accessible description of the minute field in a date/time control">
-        Minutes
-      </message>
-
-      <message name="IDS_AX_MONTH_FIELD_TEXT" desc="Accessible description of the month field in a date/time control">
-        Month
-      </message>
-
-      <message name="IDS_AX_SECOND_FIELD_TEXT" desc="Accessible description of the second field in a date/time control">
-        Seconds
-      </message>
-
-      <message name="IDS_AX_WEEK_OF_YEAR_FIELD_TEXT" desc="Accessible description of the week of year field in a date/time control">
-        Week
-      </message>
-
-      <message name="IDS_AX_YEAR_FIELD_TEXT" desc="Accessible description of the year field in a date/time control">
-        Year
-      </message>
-
-      <message name="IDS_FORM_INPUT_WEEK_TEMPLATE" desc="A specific week (1-53) in a specific year shown in a form control">
-        Week <ph name="WEEKNUMBER">$2<ex>51</ex></ph>, <ph name="YEAR">$1<ex>2012</ex></ph>
-      </message>
-      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_MULTIPLE_FILE" desc="Heading or short sentence shown when a file upload control in a webpage requires one or more files selected, but the user didn't specify any files.">
-        Please select one or more files.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH" desc="Heading or short sentence shown when a form control in a webpage requires specific type such as email address or URL, but the specified value does not comform to the type.">
-        Invalid value.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_EMPTY" desc="Heading or short sentence shown when there is an email field in a form and a user specified an empty value.">
-        Please enter a non-empty email address.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_EMPTY_DOMAIN" desc="Heading or short sentence shown when there is an email field in a form and a user specified an invalid value like 'user@'.">
-        Please enter a part following '<ph name="ATSIGN">$1<ex>@</ex></ph>'. '<ph name="INVALIDADDRESS">$2<ex>user@</ex></ph>' is incomplete.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_EMPTY_LOCAL" desc="Heading or short sentence shown when there is an email field in a form and a user specified an invalid value like '@example.com'.">
-        Please enter a part followed by '<ph name="ATSIGN">$1<ex>@</ex></ph>'. '<ph name="INVALIDADDRESS">$2<ex>@example.com</ex></ph>' is incomplete.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_INVALID_DOMAIN" desc="Heading or short sentence shown when there is an email field in a form and a user specified an invalid value like 'user@example,com'.">
-        A part following '<ph name="ATSIGN">$1<ex>@</ex></ph>' should not contain the symbol '<ph name="INVALIDCHARACTER">$2<ex>,</ex></ph>'.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_INVALID_DOTS" desc="Heading or short sentence shown when there is an email field in a form and a user specified an invalid value with wrong dots like 'user@example..com'.">
-        '<ph name="DOT">$1<ex>.</ex></ph>' is used at a wrong position in '<ph name="INVALIDDOMAIN">$2<ex>example..com</ex></ph>'.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_INVALID_LOCAL" desc="Heading or short sentence shown when there is an email field in a form and a user specified an invalid value like 'us,er@example.com'.">
-        A part followed by '<ph name="ATSIGN">$1<ex>@</ex></ph>' should not contain the symbol '<ph name="INVALIDCHARACTER">$2<ex>,</ex></ph>'.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_NO_AT_SIGN" desc="Heading or short sentence shown when there is an email field in a form and a user specified an invalid value like 'user'.">
-        Please include an '<ph name="ATSIGN">$1<ex>@</ex></ph>' in the email address. '<ph name="INVALIDADDRESS">$2<ex>user</ex></ph>' is missing an '<ph name="ATSIGN">$1<ex>@</ex></ph>'.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_MULTIPLE_EMAIL" desc="Heading or short sentence shown there is a field which accepts multiple e-mail addresses and a user specified a value which is not a comma-separated e-mail addresses.">
-        Please enter a comma separated list of email addresses.
-      </message>
-      <message name="IDS_FORM_VALIDATION_RANGE_UNDERFLOW" desc="Heading or short sentence shown when a form control value in a webpage needs to be larger than or equal to a minimum value specified by the page author, but a user specified a too small value.">
-        Value must be greater than or equal to <ph name="MINIMUM">$1<ex>0</ex></ph>.
-      </message>
-      <message name="IDS_FORM_VALIDATION_RANGE_UNDERFLOW_DATETIME" desc="Heading or short sentence shown when a form control value in a webpage needs to be later or equal to a minimum date/time value specified by the page author, but a user specified an earlier date/time.">
-        Value must be <ph name="MINIMUM_DATE_OR_TIME">$1<ex>01/04/2013</ex></ph> or later.
-      </message>
-      <message name="IDS_FORM_VALIDATION_RANGE_OVERFLOW" desc="Heading or short sentence shown when a form control value in a webpage needs to be smaller than or equal to a maximum value specified by the page author, but a user specified a too large value.">
-        Value must be less than or equal to <ph name="MAXIMUM">$1<ex>100</ex></ph>.
-      </message>
-      <message name="IDS_FORM_VALIDATION_RANGE_OVERFLOW_DATETIME" desc="Heading or short sentence shown when a form control value in a webpage needs to be earlier than or equal to a maximum date/time value specified by the page author, but a user specified a later date/time.">
-        Value must be <ph name="MAXIMUM_DATE_OR_TIME">$1<ex>12/31/2013</ex></ph> or earlier.
-      </message>
-      <message name="IDS_FORM_VALIDATION_BAD_INPUT_DATETIME" desc="Heading or short sentence shown when a user specified an incomplete value or an invalid date (such as 02/31/2012) to a date/time form control in a webpage.">
-        Please enter a valid value. The field is incomplete or has an invalid date.
-      </message>
-      <message name="IDS_FORM_VALIDATION_BAD_INPUT_NUMBER" desc="Heading or short sentence shown when a user entered a non-number string to a number field in a webpage.">
-        Please enter a number.
-      </message>
-
-<!-- The following IDS_FORM_VALIDATION_* messages were taken from Mozilla's dom.properties file.
-
-# ***** BEGIN LICENSE BLOCK *****
-# Version: MPL 1.1/GPL 2.0/LGPL 2.1
-#
-# The contents of this file are subject to the Mozilla Public License Version
-# 1.1 (the "License"); you may not use this file except in compliance with
-# the License. You may obtain a copy of the License at
-# http://www.mozilla.org/MPL/
-#
-# Software distributed under the License is distributed on an "AS IS" basis,
-# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
-# for the specific language governing rights and limitations under the
-# License.
-#
-# The Original Code is mozilla.org code.
-#
-# The Initial Developer of the Original Code is
-# Netscape Communications Corporation.
-# Portions created by the Initial Developer are Copyright (C) 2001
-# the Initial Developer. All Rights Reserved.
-#
-# Contributor(s):
-#   Mitch <mstoltz@netscape.com> (original author)
-#   Ehsan Akhgari <ehsan.akhgari@gmail.com>
-#
-# Alternatively, the contents of this file may be used under the terms of
-# either of the GNU General Public License Version 2 or later (the "GPL"),
-# or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
-# in which case the provisions of the GPL or the LGPL are applicable instead
-# of those above. If you wish to allow use of your version of this file only
-# under the terms of either the GPL or the LGPL, and not to allow others to
-# use your version of this file under the terms of the MPL, indicate your
-# decision by deleting the provisions above and replace them with the notice
-# and other provisions required by the GPL or the LGPL. If you do not delete
-# the provisions above, a recipient may use your version of this file under
-# the terms of any one of the MPL, the GPL or the LGPL.
-#
-# ***** END LICENSE BLOCK *****
--->
-      <message name="IDS_FORM_VALIDATION_VALUE_MISSING" desc="Heading or short sentence shown when a text form control in a webpage requires a value, but the user didn't specify any value.">
-        Please fill out this field.
-      </message>
-      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_CHECKBOX" desc="Heading or short sentence shown when a checkbox control in a webpage must be checked, but the user didn't check it.">
-        Please check this box if you want to proceed.
-      </message>
-      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_FILE" desc="Heading or short sentence shown when a file upload control in a webpage requires a file selected, but the user didn't specify any file.">
-        Please select a file.
-      </message>
-      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_RADIO" desc="Heading or short sentence shown when a radio button of a radio button group in a webpage must be selected, but the user selected nothing.">
-        Please select one of these options.
-      </message>
-      <message name="IDS_FORM_VALIDATION_VALUE_MISSING_SELECT" desc="Heading or short sentence shown when a value of a menu-list control in a webpage must be selected, but the user selected nothing.">
-        Please select an item in the list.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL" desc="Heading or short sentence shown when there is an email field in a form and a user specified a value which doesn't look like an e-mail address.">
-        Please enter an email address.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TYPE_MISMATCH_URL" desc="Heading or short sentence shown when there is a URL field in a form and a user specified a value which doesn't look like a URL.">
-        Please enter a URL.
-      </message>
-      <message name="IDS_FORM_VALIDATION_PATTERN_MISMATCH" desc="Heading or short sentence shown when a form control value needs to satisfy a pattern specified by the page author, but a user specified unmatched value.">
-        Please match the requested format.
-      </message>
-      <message name="IDS_FORM_VALIDATION_STEP_MISMATCH" desc="Heading or short sentence shown when a form control value in a webpage should be aligned to a step value specified by the page author, but a user speficified non-aligned value. e.g. A number type field, minimum value is 0, and step value is 4. If A user-specified value is not a multiple of 4, this warning message is shown.">
-        Please enter a valid value. The two nearest valid values are <ph name="VALID_VALUE_LOW">$1<ex>4</ex></ph> and <ph name="VALID_VALUE_HIGHER">$2<ex>8</ex></ph>.
-      </message>
-      <message name="IDS_FORM_VALIDATION_STEP_MISMATCH_CLOSE_TO_LIMIT" desc="Heading or short sentence shown when a form control value in a webpage should be aligned to a step value specified by the page author, but a user speficified non-aligned value. e.g. A number type field, minimum value is 0, and step value is 4. If A user-specified value is not a multiple of 4, this warning message is shown.">
-        Please enter a valid value. The nearest valid value is <ph name="VALID_VALUE">$1<ex>0</ex></ph>.
-      </message>
-      <message name="IDS_FORM_VALIDATION_TOO_LONG" desc="Heading or short sentence shown when a form control in a webpage needs to be shorter than a length specified by the page author, but a user specified long value.">
-        Please shorten this text to <ph name="MAX_CHARACTERS">$2<ex>100</ex></ph> characters or less (you are currently using <ph name="CURRENT_LENGTH">$1<ex>101</ex></ph> characters).
-      </message>
-      <message name="IDS_FORM_VALIDATION_TOO_SHORT" desc="Heading or short sentence shown when a form control in a webpage needs to be longer than a length specified by the page author, but a user specified a value of 1 character.">
-        Please lengthen this text to <ph name="MIN_CHARACTERS">$2<ex>101</ex></ph> characters or more (you are currently using 1 character).
-      </message>
-      <message name="IDS_FORM_VALIDATION_TOO_SHORT_PLURAL" desc="Heading or short sentence shown when a form control in a webpage needs to be longer than a length specified by the page author, but a user specified short value.">
-        Please lengthen this text to <ph name="MIN_CHARACTERS">$2<ex>101</ex></ph> characters or more (you are currently using <ph name="CURRENT_LENGTH">$1<ex>100</ex></ph> characters).
-      </message>
-
-      <message name="IDS_MEDIA_SESSION_FILE_SOURCE" desc="The name of the media session source if the media is a local file.">
-        Local File
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_CLOSED_CAPTIONS" desc="Media controls overflow menu item label for a closed captions button. The text for this overflow menu should be short.">
-        Captions
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_CLOSED_CAPTIONS_SUBMENU_TITLE" desc="Media controls overflow menu title for the closed captions submenu. The text for this overflow menu should be short.">
-        Options
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_CAST" desc="Media controls overflow menu item label for a cast button.">
-        Cast
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_ENTER_FULLSCREEN" desc="Media controls overflow menu item label for a button to enter fullscreen.">
-        Fullscreen
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_EXIT_FULLSCREEN" desc="Media controls overflow menu item label for a button to exit fullscreen.">
-        Exit fullscreen
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_MUTE" desc="Media controls overflow menu item label for a mute button.">
-        Mute
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_UNMUTE" desc="Media controls overflow menu item label for an unmute button.">
-        Unmute
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_PLAY" desc="Media controls overflow menu item label for a play button.">
-        Play
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_PAUSE" desc="Media controls overflow menu item label for a pause button.">
-        Pause
-      </message>
-      <message name="IDS_MEDIA_OVERFLOW_MENU_DOWNLOAD" desc="Media controls overflow menu item label for a download button.">
-       Download
-      </message>
-      <if expr="is_macosx">
-        <message name="IDS_MEDIA_OVERFLOW_MENU_ENTER_PICTURE_IN_PICTURE" desc="Media controls overflow menu item label for a button to enter Picture-in-Picture.">
-          Picture in Picture
-        </message>
-      </if>
-      <if expr="not is_macosx">
-        <message name="IDS_MEDIA_OVERFLOW_MENU_ENTER_PICTURE_IN_PICTURE" desc="Media controls overflow menu item label for a button to enter Picture-in-Picture.">
-          Picture in picture
-        </message>
-      </if>
-      <if expr="is_macosx">
-        <message name="IDS_MEDIA_OVERFLOW_MENU_EXIT_PICTURE_IN_PICTURE" desc="Media controls overflow menu item label for a button to exit Picture-in-Picture.">
-          Exit Picture-in-Picture
-        </message>
-      </if>
-      <if expr="not is_macosx">
-        <message name="IDS_MEDIA_OVERFLOW_MENU_EXIT_PICTURE_IN_PICTURE" desc="Media controls overflow menu item label for a button to exit Picture-in-Picture.">
-          Exit picture-in-picture
-        </message>
-      </if>
-      <message name="IDS_MEDIA_PICTURE_IN_PICTURE_INTERSTITIAL_TEXT" desc="Text message shown to user when in picture in picture mode. When a video is in picture in picture mode, an interstitial with this text appears where the video player is positioned. The video continues to play back in another window that gives the experience that the video is 'popped out'.">
-        Playing in picture-in-picture
-      </message>
-      <message name="IDS_MEDIA_REMOTING_CAST_TEXT" desc="Text message shown to the user when casting a video to a known remote device.">
-       Now casting to <ph name="DEVICE_FRIENDLY_NAME">$1<ex>Living Room TV</ex></ph>
-      </message>
-      <message name="IDS_MEDIA_REMOTING_CAST_TO_UNKNOWN_DEVICE_TEXT" desc="Text message shown to the user when casting a video to an unknown remote device.">
-       Now casting to your TV
-      </message>
-      <message name = "IDS_MEDIA_REMOTING_STOP_TEXT" desc="The transient text shown on top of the video when switching from media remoting to mirroring.">
-        Switched to mirroring
-      </message>
-      <message name = "IDS_MEDIA_REMOTING_STOP_BY_PLAYBACK_QUALITY_TEXT" desc="The transient text shown on top of the video when switching from media remoting to mirroring due to poor playback quality.">
-        Poor playback quality
-      </message>
-      <message name = "IDS_MEDIA_REMOTING_STOP_BY_ERROR_TEXT" desc="The transient text shown on top of the video when switching from media remoting to mirroring due to errors.">
-        Video playback error
-      </message>
-      <message name="IDS_MEDIA_SCRUBBING_MESSAGE_TEXT" desc="Message informing the user that they can double tap to skip ten seconds. This should be no longer than twice the length of the English version.">
-        Double tap left or right to skip 10s
-      </message>
-      <message name="IDS_MEDIA_TRACKS_NO_LABEL" desc="Menu item label for a text track that has no name specified. The number represents the track number in the list of tracks.">
-        Track <ph name="NUMBER">$1<ex>1</ex></ph>
-      </message>
-
-      <message name="IDS_MEDIA_TRACKS_OFF" desc="Menu item label for a text track that represents disabling closed captions">
-        Off
-      </message>
-
-      <message name="IDS_PLUGIN_INITIALIZATION_ERROR" desc="A message displayed when a plugin failed to load">
-        Couldn't load plugin.
-      </message>
-
-      <message name="IDS_MEDIA_PLAYBACK_ERROR" desc="Message informing that the user that there were issues playing back their media.">
-        Unable to play media.
-      </message>
-
-      <!-- Byte size units -->
-      <message name="IDS_UNITS_KIBIBYTES" desc="Units tag indicating a quantity of kilobytes">
-        <ph name="QUANTITY">$1<ex>42.0</ex></ph> KB
-      </message>
-      <message name="IDS_UNITS_MEBIBYTES" desc="Units tag indicating a quantity of megabytes">
-        <ph name="QUANTITY">$1<ex>42.0</ex></ph> MB
-      </message>
-      <message name="IDS_UNITS_GIBIBYTES" desc="Units tag indicating a quantity of gigabytes">
-        <ph name="QUANTITY">$1<ex>42.0</ex></ph> GB
-      </message>
-      <message name="IDS_UNITS_TEBIBYTES" desc="Units tag indicating a quantity of terabytes">
-        <ph name="QUANTITY">$1<ex>42.0</ex></ph> TB
-      </message>
-      <message name="IDS_UNITS_PEBIBYTES" desc="Units tag indicating a quantity of petabytes">
-        <ph name="QUANTITY">$1<ex>42.0</ex></ph> PB
-      </message>
-
-      <message name="CONTENT_INVALID_TRUE" desc="Error message for aria-invalid = true">
-        Invalid entry
-      </message>
-      <message name="CONTENT_INVALID_SPELLING" desc="Error message for aria-invalid = spelling">
-        Invalid spelling
-      </message>
-      <message name="CONTENT_INVALID_GRAMMAR" desc="Error message for aria-invalid = grammar">
-        Invalid grammar
-      </message>
-    </messages>
-  </release>
-</grit>
diff --git a/chromium/content/app/strings/content_strings_grd/IDS_MEDIA_SESSION_FILE_SOURCE.png.sha1 b/chromium/content/app/strings/content_strings_grd/IDS_MEDIA_SESSION_FILE_SOURCE.png.sha1
deleted file mode 100644
index 7ae1cf665af..00000000000
--- a/chromium/content/app/strings/content_strings_grd/IDS_MEDIA_SESSION_FILE_SOURCE.png.sha1
+++ /dev/null
@@ -1 +0,0 @@
-53ecf240f59804dfdb53d40001e317cee9284305
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_am.xtb b/chromium/content/app/strings/translations/content_strings_am.xtb
deleted file mode 100644
index 33cea04acc5..00000000000
--- a/chromium/content/app/strings/translations/content_strings_am.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="am">
-<translation id="1018939186200882850">የምናሌ ንጥል</translation>
-<translation id="10623998915015855">የማቀያየሪያ አዝራር</translation>
-<translation id="1088086359088493902">ሰኮንዶች</translation>
-<translation id="1171774979989969504">እባክዎ የኢሜይል አድራሻ ያስገቡ።</translation>
-<translation id="1178581264944972037">ለአፍታ አቁም</translation>
-<translation id="1188858454923323853">ማሟያ</translation>
-<translation id="1206619573307042055">መልሶ መልስ</translation>
-<translation id="1206693055195146388">ተንሸራታች</translation>
-<translation id="1211441953136645838">የግርጌ ማስታወሻ</translation>
-<translation id="1281252709823657822">መገናኛ</translation>
-<translation id="1335095011850992622">ክሬዲቶች</translation>
-<translation id="1342835525016946179">ጽሑፍ</translation>
-<translation id="1359897965706325498">ሰንደቅ</translation>
-<translation id="1589122976691792535">ክልል</translation>
-<translation id="1591562245178063882">በዚህ ወር</translation>
-<translation id="1637811476055996098">ፋይሎችን ይምረጡ</translation>
-<translation id="1650423536718072820">ጥቅስ</translation>
-<translation id="1727886345390570319">የተዘጉ የሥዕል መግለጫ ጽሑፎችን ምናሌ ደብቅ</translation>
-<translation id="1729654308190250600">እባክዎ ባዶ ያልሆነ የኢሜይል አድራሻ ያስገቡ።</translation>
-<translation id="1758486001363313524">ሌላ...</translation>
-<translation id="1806710327868736751">የማንቂያ_መገናኛ</translation>
-<translation id="1821985195704844674">የዛፍ ፍርግርግ</translation>
-<translation id="1822429046913737220">ጥዋት/ከሰዓት</translation>
-<translation id="1832974991323546415">በርቀት መሳሪያ ላይ አጫውት</translation>
-<translation id="190587075670221089">ስረዛ</translation>
-<translation id="1907737156431278478">ምሳሌ</translation>
-<translation id="1921819250265091946">ቀቀ</translation>
-<translation id="1930711995431081526">ሁኔታ</translation>
-<translation id="1938124657309484470">ዋጋ <ph name="MAXIMUM_DATE_OR_TIME" /> ወይም ከዚያ በፊት መሆን አለበት።</translation>
-<translation id="1946271899482435442">የቀን መልቀሚያ አሳይ</translation>
-<translation id="1993104285338243655">ወደ ማንጸባረቅ ተቀይሯል</translation>
-<translation id="2060505056492490888">«<ph name="DOT" />» በ«<ph name="INVALIDDOMAIN" />» ውስጥ በተሳሳተ ቦታ ላይ ነው የገባው።</translation>
-<translation id="2148716181193084225">ዛሬ</translation>
-<translation id="2158401438286456825">የገጽ ዝርዝር</translation>
-<translation id="2226276347425096477">እባክዎ ይህ ጽሑፍ ወደ <ph name="MAX_CHARACTERS" /> ወይም ከዚያ በታች ቁምፊዎች ያሳጥሩት (በአሁኑ ጊዜ <ph name="CURRENT_LENGTH" /> ቁምፊዎችን እየተጠቀሙ ነዎት)።</translation>
-<translation id="2246498165605549352">አካባቢያዊ ፋይል</translation>
-<translation id="2247351761944213033">ሳምንት <ph name="WEEKNUMBER" />፣ <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ትራክ <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">አመልካች ሳጥን</translation>
-<translation id="2311842470354187719">ገጽ ከፋይ</translation>
-<translation id="2335594187091864976">የቀን እና የሰዓት መራጭ</translation>
-<translation id="245932805758469625">የቪዲዮ ቀሪ ሰከንዶች ብዛት</translation>
-<translation id="248395913932153421">ቀን</translation>
-<translation id="2507943997699731163">እባክዎ ይህን መስክ ይሙሉት።</translation>
-<translation id="2508569020611168319">የትር ዝርዝር</translation>
-<translation id="2561842179657104141">ተጨማሪ የማህደረ መረጃ ቁጥጥሮችን አሳይ</translation>
-<translation id="2572483411312390101">አጫውት</translation>
-<translation id="2613802280814924224">እባክዎ የሚሰራ ዋጋ ያስገቡ። የሚቀርበው ዋጋ <ph name="VALID_VALUE" /> ነው።</translation>
-<translation id="2653659639078652383">አስገባ</translation>
-<translation id="2657045182931379222">ግራፊካዊ ነገር</translation>
-<translation id="2674318244760992338">ግርጌ</translation>
-<translation id="2709516037105925701">ራስ-ሙላ</translation>
-<translation id="2723001399770238859">ድምጽ</translation>
-<translation id="2746543609216772311">ዋጋ <ph name="MINIMUM_DATE_OR_TIME" /> ወይም ከዚያ በኋላ መሆን አለበት።</translation>
-<translation id="2759744352195237655">የብቅ-ባይ አዝራር</translation>
-<translation id="2761667185364618470">ለመቀጠል ከፈለጉ እባክዎ ይህ ሳጥን ላይ ምልክት ያድርጉ።</translation>
-<translation id="2844350028562914727">ዝርዝሮች</translation>
-<translation id="2896972712917208084">የሬዲዮ ስብስብ</translation>
-<translation id="2908441821576996758">እባክዎ በኮማ የተለዩ የኢሜይል አድራሻዎች ዝርዝር ያስገቡ።</translation>
-<translation id="2940813599313844715">ነገር</translation>
-<translation id="2942448076852699108">የደመቀ ይዘት</translation>
-<translation id="3040011195152428237">አገናኝ</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> ሜባ</translation>
-<translation id="3075154866155599887">እባክዎ የሚሰራ ዋጋ ያስገቡ። መስኩ ያልተጠናቀቀ ነው ወይም ልክ ያልሆነ ቀን አለው።</translation>
-<translation id="3078740164268491126">ሠንጠረዥ</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">እባክዎ አንድ ዩአርኤል ያስገቡ።</translation>
-<translation id="3175736971608411871">ሰዓት ቆጣሪ</translation>
-<translation id="3199563858620722075">ጥምድ ሳጥን</translation>
-<translation id="3450233048674729344">ዋጋ ከ<ph name="MAXIMUM" /> የሚያንስ ወይም ከእሱ እኩል መሆን አለበት።</translation>
-<translation id="3486220673238053218">ብየና</translation>
-<translation id="3557673793733683882">አርዕስት <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">ሳምንት መራጭ</translation>
-<translation id="3685101356851116974">መሰየሚያ ያልተሰጠው ምስል</translation>
-<translation id="3706100364254443312">ቀይር</translation>
-<translation id="3732799496749320381">ሚሜ</translation>
-<translation id="3754210790023674521">ከሥዕል-ውስጥ-ሥዕል ውጣ</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> ጊባ</translation>
-<translation id="3808586225841795776">የጊዜ ቆይታ</translation>
-<translation id="3822383571486410024">እባክዎ ይህን ጽሑፍ ወደ <ph name="MIN_CHARACTERS" /> ቁምፊዎች ወይም ከዚያ በላይ ያራዝሙት (አሁን እየተጠቀሙ ያሉት <ph name="CURRENT_LENGTH" />ቁምፊዎችን ነው)።</translation>
-<translation id="383465348367842624">ከ«<ph name="ATSIGN" />» በፊት የሚመጣ ክፍል የ«<ph name="INVALIDCHARACTER" />» ምልክት መያዝ የለበትም።</translation>
-<translation id="3846214748874656680">ከሙሉ ማያገጽ ውጣ</translation>
-<translation id="3920932319529768807">ድምዳሜ</translation>
-<translation id="3924558731517983934">መተግበሪያ</translation>
-<translation id="3944740393230681990">ቅድመ-ታሪክ</translation>
-<translation id="3960700977367013758">የማሸብለያ አሞሌ</translation>
-<translation id="4103419683916926126">ሚሊሰኮንዶች</translation>
-<translation id="4151657705144244502">ግራፊክ</translation>
-<translation id="4160057747563657758">ስልክ</translation>
-<translation id="4193965531860883258">መቅድም</translation>
-<translation id="4201051445878709314">ቀዳሚውን ወር አሳይ</translation>
-<translation id="421884353938374759">color picker</translation>
-<translation id="4248100235867064564">የምናሌ አሞሌ</translation>
-<translation id="4360991593054037559">እባክዎ የሚሰራ ዋጋ ያስገቡ። ሁለቱ የሚቀርቡ ዋጋዎች <ph name="VALID_VALUE_LOW" /> እና <ph name="VALID_VALUE_HIGHER" /> ናቸው።</translation>
-<translation id="4384583879834880242">ጥያቄ እና መልስ</translation>
-<translation id="4413860115965805769">የምናሌ አዝራር</translation>
-<translation id="4444765639179266822">እንዲህ የሚል ይመስላል፦ <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">የሙዳየ ቃላት ዋቢ</translation>
-<translation id="4522570452068850558">ዝርዝሮች</translation>
-<translation id="4542388879936266156">ቀሪ ጊዜ፦ <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ቅጽ</translation>
-<translation id="4661075872484491155">ዛፍ</translation>
-<translation id="4664250907885839816">ከ«<ph name="ATSIGN" />» በኋላ የሚመጣ ክፍል የ«<ph name="INVALIDCHARACTER" />» ምልክት መያዝ የለበትም።</translation>
-<translation id="4668956016107839909">ቅጥያዎች</translation>
-<translation id="4718048029184481307">በሥዕል-ውስጥ-ሥዕልን በማጫወት ላይ</translation>
-<translation id="4742539557769756338">ሽፋን</translation>
-<translation id="4748357248530471599">የተቆረጠው የማሳያ ክፍል ሙሉ ማያ ገጽን ይቀያይሩ</translation>
-<translation id="4757246831282535685">የትር ፓነል</translation>
-<translation id="4763480195061959176">ቪዲዮ</translation>
-<translation id="479989351350248267">ፈልግ</translation>
-<translation id="4812940957355064477">እባክዎ ቁጥር ያስገቡ።</translation>
-<translation id="4912536737030637138">የዋቢ መጽሐፍት ግቤት</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> ተመርጠዋል</translation>
-<translation id="4992066212339426712">ድምጸ-ከል አንሳ</translation>
-<translation id="49969490063480558">እባክዎ ከ«<ph name="ATSIGN" />» በኋላ አንድ ክፍል ያስገቡ። «<ph name="INVALIDADDRESS" />» ያልተሟላ ነው።</translation>
-<translation id="5034860022980953847">የሂደት አመልካች</translation>
-<translation id="5090250355906949916">የቪዲዮ ጊዜ አንፏቃቂ</translation>
-<translation id="5093189678851173835">የተቀረጸ ጽሑፍ</translation>
-<translation id="5117590920725113268">ቀጣዩን ወር አሳይ</translation>
-<translation id="512758898067543763">የረድፍ ራስጌ</translation>
-<translation id="5143125788380636750">ድሕረ ታሪክ</translation>
-<translation id="5164977714490026579">ዋጋ ከ<ph name="MINIMUM" /> የሚበልጥ ወይም ከእሱ እኩል መሆን አለበት።</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> ፔታ</translation>
-<translation id="5307600278924710095">እባክዎ አንድ ክፍል ያስገቡና «<ph name="ATSIGN" />»ን ያስከትሉ። «<ph name="INVALIDADDRESS" />» ያልተሟላ ነው።</translation>
-<translation id="5334352251556557839">ሚዲያን ማጫወት አልተቻለም።</translation>
-<translation id="5406322316791861025">ምስል</translation>
-<translation id="5453733299334684579">የዛፍ ንጥል</translation>
-<translation id="5466621249238537318">እባክዎ አንድ ወይም ተጨማሪ ፋይሎችን ይምረጡ።</translation>
-<translation id="5468998798572797635">ከሙሉ ማያ ገጽ ውጣ</translation>
-<translation id="5516424706154626233">ቀን መራጭ</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">ድምፅ-ከልን አንሳ</translation>
-<translation id="561939826962581046">ሰዓት</translation>
-<translation id="5630795885300617244">10 ሴ ለመዝለል ወደ ግራ ወይም ቀኝ ሁለቴ መታ ያድርጉ</translation>
-<translation id="5631759159893697722">ረቂቅ</translation>
-<translation id="5643186887447432888">አዝራር</translation>
-<translation id="5677946354068040947">ተጨማሪ አማራጮች</translation>
-<translation id="576709008726043716">መግቢያ</translation>
-<translation id="57838592816432529">ድምጽ ይዝጉ</translation>
-<translation id="5860033963881614850">አጥፋ</translation>
-<translation id="588258955323874662">ሙሉ ገጽ ዕይታ</translation>
-<translation id="5888666972993069672">አሁን ወደ <ph name="DEVICE_FRIENDLY_NAME" /> cast በማድረግ ላይ</translation>
-<translation id="591047860372322273">የፍለጋ ሳጥን</translation>
-<translation id="5939518447894949180">ዳግም አስጀምር</translation>
-<translation id="5966707198760109579">ሳምንት</translation>
-<translation id="5987525920412732405">ማሾሪያ አዝራር</translation>
-<translation id="6011459053400940133">የድምጽ ተንሸራታች</translation>
-<translation id="6015796118275082299">ዓመት</translation>
-<translation id="6023896073578205740">የዝርዝር ሳጥን</translation>
-<translation id="6150588977291308318">ዋቢ መጽሐፍት</translation>
-<translation id="6164829606128959761">ሜትር</translation>
-<translation id="6166809985690652833">ድሕረ ቃል</translation>
-<translation id="6209276755895393898">ይህ ይመስላል፦ <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">ሙዳየ ቃላት</translation>
-<translation id="6281763101136022427">ዩአርኤል</translation>
-<translation id="6310801910862476708">ከስዕል-ውስጥ-ስዕል ውጣ</translation>
-<translation id="6398862346408813489">የወር መምረጫ ፓነል አሳይ</translation>
-<translation id="6404546809543547843">የኦዲዮ ሰዓት አንፏቃቂ</translation>
-<translation id="6443871981718447451">የተዘጉ የመግለጫ ጽሁፎችን ምናሌ አሳይ</translation>
-<translation id="6453774872122745852">ምስጋና</translation>
-<translation id="648732519525291180">ሰዓት መራጭ</translation>
-<translation id="6550675742724504774">አማራጮች</translation>
-<translation id="6572309429103589720">ልክ ያልኾነ ሰዋሰው</translation>
-<translation id="658823671542763450">ወደ ሙሉ ገጽ ዕይታ ግባ</translation>
-<translation id="663493177488814956">ምግብ</translation>
-<translation id="6637586476836377253">የምዝግብ ማስታወሻ</translation>
-<translation id="6643016212128521049">አጽዳ</translation>
-<translation id="668171684555832681">ሌላ…</translation>
-<translation id="6692633176391053278">አስኪያጅ</translation>
-<translation id="6709570249143506788">ደካማ የመልሶ ማጫወት ጥራት</translation>
-<translation id="6755330956360078551">ጠቃሚ የመሣሪያ ምክር</translation>
-<translation id="6790428901817661496">አጫውት</translation>
-<translation id="6820355525329141109">ተሰኪን መጫን አልተቻለም።</translation>
-<translation id="6820615603175220800">የዋቢ መጽሐፍት ማጣቀሻ</translation>
-<translation id="6843725295806269523">ድምጸ-ከል ያድርጉ</translation>
-<translation id="6885760532393684712">ማውጫ</translation>
-<translation id="689129560213475294">ኮሎፎን</translation>
-<translation id="6934078000481955284">የጽሑፍ ጥቅስ</translation>
-<translation id="6941933287844615239">ማህደረ መረጃን አውርድ</translation>
-<translation id="6981594929165378967">ማስገባት</translation>
-<translation id="6989848892321993519">እባክዎ ይህን ጽሑፍ ወደ <ph name="MIN_CHARACTERS" /> ወይም ከዚያ በላይ ቁምፊዎች ያራዝሙት (አሁን እየተጠቀሙ ያሉት 1 ቁምፊ ነው)።</translation>
-<translation id="7033340931668032222">ድምጽ ለመቀየር ወደ ላይ እና ታች</translation>
-<translation id="709897737746224366">እባክዎ የተጠየቀውን ቅርጸት ያዛምዱ።</translation>
-<translation id="7118469954320184356">ምንም መግለጫ የለም።</translation>
-<translation id="7139483182332611405">መቅድም</translation>
-<translation id="7214187073215825913">የይዘት መረጃ</translation>
-<translation id="7263440858009898357">እባክዎ በዝርዝሩ ውስጥ አንድ ንጥል ይምረጡ።</translation>
-<translation id="727747134524199931">የአምድ ራስጌ</translation>
-<translation id="7320576522385648310">በማቋት ላይ</translation>
-<translation id="7353453495576941748">ክሬዲት</translation>
-<translation id="7364796246159120393">ፋይል ምረጥ</translation>
-<translation id="739024184232394898">ሌላ...</translation>
-<translation id="7405738980073107433">ግርጌ ማስታወሻዎች</translation>
-<translation id="7410239719251593705">የአዋቂ ይዘት የያዘ ይመስላል። ምንም መግለጫ የለም።</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> ቴባ</translation>
-<translation id="7491962110804786152">TAB</translation>
-<translation id="7514365320538308">አውርድ</translation>
-<translation id="7529102961911894712">የጀርባ አገናኝ</translation>
-<translation id="7533959249147584474">ያልተሰየመ ግራፊክ</translation>
-<translation id="7647456547678091388">ጠቃሚ ምክር</translation>
-<translation id="7661956066982048809">ግራፊካዊ ሰነድ</translation>
-<translation id="7673697353781729403">ሰዓቶች</translation>
-<translation id="7681220483256441252">መረጃ ጠቋሚ</translation>
-<translation id="7740050170769002709">የኤች ቲ ኤም ኤል ይዘት</translation>
-<translation id="7745230546936012372">የጎደሉ የምስል ዝርዝር መግለጫዎችን ለማግኘት፣ የአውድ ምናሌውን ይክፈቱ።</translation>
-<translation id="7750228210027921155">በሥዕል ውስጥ ሥዕል</translation>
-<translation id="775297008183122718">ትክክል ያልሆነ አገባብ </translation>
-<translation id="7789962463072032349">ላፍታ አቁም</translation>
-<translation id="7802800022689234070">ይፋ ማሳወቂያ ሶስት ማዕዘን</translation>
-<translation id="7888071071722539607">እባክዎ በኢሜይል አድራሻው ውስጥ «<ph name="ATSIGN" />» ያካትቱ። «<ph name="INVALIDADDRESS" />» ውስጥ «<ph name="ATSIGN" />» ይጎድላል።</translation>
-<translation id="7891486169920085145">መክፈያ</translation>
-<translation id="795667975304826397">ምንም ፋይል አልተመረጠም</translation>
-<translation id="8053789581856978548">የጽሑፍ መስክ ፈልግ</translation>
-<translation id="8057695513531652401">ማስታወቂያ</translation>
-<translation id="8105797009065549151">ማስታወሻ ማጣቀሻ</translation>
-<translation id="811583516810654505">ዝርዝርን በማግኘት ላይ...</translation>
-<translation id="8117451130807776954">በዚህ ሳምንት</translation>
-<translation id="8199524924445686405">ዓዓዓዓ</translation>
-<translation id="8208673686607688524">አካባቢያዊ ቀን እና ሰዓት መራጭ</translation>
-<translation id="8261464734335370856">ልክ ያልኾነ ሥርዓተ አጻጻፍ</translation>
-<translation id="8284326494547611709">መግለጫ ጽሑፎች</translation>
-<translation id="835897206747267392">ልክ ያልሆነ እሴት።</translation>
-<translation id="8403857369060869934">ያለፈው ጊዜ፦ <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">ክፍለ አካል</translation>
-<translation id="8433900881053900389">የመሣሪያ አሞሌ</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ፋይሎች</translation>
-<translation id="8451268428117625855">እባክዎ ፋይል ይምረጡ።</translation>
-<translation id="8461852803063341183">የሬዲዮ አዝራር</translation>
-<translation id="8474886197722836894">መታሰቢያነቱ</translation>
-<translation id="8531739829932800271">እርማት</translation>
-<translation id="8534579021159131403">ደቂቃዎች</translation>
-<translation id="8541249477527128034">የማህደረ መረጃ ቁጥጥር</translation>
-<translation id="8550857728288566671">ሥዕላዊ ምልክት</translation>
-<translation id="8583702881314752957">የብየና ዝርዝር</translation>
-<translation id="8597182159515967513">ርዕስ</translation>
-<translation id="8603553056539299761">ለመፈለግ ወደ ግራ እና ቀኝ</translation>
-<translation id="860475260694818407">ማውጫ</translation>
-<translation id="8613126697340063924">በርቀት መልሶ ማጫወትን ተቆጣጠር</translation>
-<translation id="862370744433916922">የግርጌ ጽሑፍ</translation>
-<translation id="8711688047404765493">ውጽዓት</translation>
-<translation id="8750798805984357768">እባክዎ ከእነዚህ አማራጮች ውስጥ አንዱን ይምረጡ።</translation>
-<translation id="8808573423886751634">ምዕራፍ</translation>
-<translation id="8845239796550121995">አሁን ወደ የእርስዎ ቴሌቪዥን cast በማድረግ ላይ</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">የቪዲዮ መልሶ ማጫወት ስህተት</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> ኪባ</translation>
-<translation id="8987927404178983737">ወር</translation>
-<translation id="901493112792887934">የአሁኑ ጊዜ በሰከንዶች</translation>
-<translation id="901834265349196618">ኢሜይል</translation>
-<translation id="9048119486235211610">አሰሳ</translation>
-<translation id="9062295712474918030">ሰነድ</translation>
-<translation id="9062307380734144336">አጫውት ባለበት አቁምን ለመቀያየር ይምረጡ</translation>
-<translation id="9093215626363556771">ከስዕል-ውስጥ-ስዕል ውጣ</translation>
-<translation id="9108370397979208512">ሒሳብ</translation>
-<translation id="9132465097189459683">ሌላ...</translation>
-<translation id="9138385573473225930">ማንቂያ</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />፣ የሚጀምረው በ<ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">በሥዕል ላይ ሥዕል</translation>
-<translation id="9168329111483466115">የግርጌ ማስታወሻ</translation>
-<translation id="954003015749068518">ወደ ስዕል-ውስጥ-ስዕል ይግቡ</translation>
-<translation id="966787709310836684">ምናሌ</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ar.xtb b/chromium/content/app/strings/translations/content_strings_ar.xtb
deleted file mode 100644
index 7005047b365..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ar.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ar">
-<translation id="1018939186200882850">عنصر القائمة</translation>
-<translation id="10623998915015855">زر التبديل</translation>
-<translation id="1088086359088493902">ثوانٍ‬‬</translation>
-<translation id="1171774979989969504">يُرجى إدخال عنوان البريد الإلكتروني.</translation>
-<translation id="1178581264944972037">الإيقاف مؤقتًا</translation>
-<translation id="1188858454923323853">تكميلي</translation>
-<translation id="1206619573307042055">صورة بها نص متحرك</translation>
-<translation id="1206693055195146388">شريط تمرير</translation>
-<translation id="1211441953136645838">تعليق ختامي</translation>
-<translation id="1281252709823657822">مربع حوار</translation>
-<translation id="1335095011850992622">إسهامات</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">إعلان بانر</translation>
-<translation id="1589122976691792535">منطقة</translation>
-<translation id="1591562245178063882">هذا الشهر</translation>
-<translation id="1637811476055996098">اختيار الملفات</translation>
-<translation id="1650423536718072820">اقتباس مستمد</translation>
-<translation id="1727886345390570319">إخفاء قائمة مقاطع الترجمة والشرح</translation>
-<translation id="1729654308190250600">يُرجى إدخال عنوان البريد الإلكتروني وعدم ترك الحق فارغًا.</translation>
-<translation id="1758486001363313524">آخر...</translation>
-<translation id="1806710327868736751">مربع حوار_للتنبيه</translation>
-<translation id="1821985195704844674">شبكة متفرعة</translation>
-<translation id="1822429046913737220">صباحًا/مساءً</translation>
-<translation id="1832974991323546415">تشغيل على جهاز بعيد</translation>
-<translation id="190587075670221089">حذف</translation>
-<translation id="1907737156431278478">مثال</translation>
-<translation id="1921819250265091946">يوم</translation>
-<translation id="1930711995431081526">الحالة</translation>
-<translation id="1938124657309484470">يجب أن تكون القيمة <ph name="MAXIMUM_DATE_OR_TIME" /> أو قبل ذلك.</translation>
-<translation id="1946271899482435442">عرض منتقي التاريخ</translation>
-<translation id="1993104285338243655">تم التبديل إلى النسخ المطابق.</translation>
-<translation id="2060505056492490888">تم استخدام "<ph name="DOT" />" في موضع خاطئ في "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">اليوم</translation>
-<translation id="2158401438286456825">قائمة صفحات</translation>
-<translation id="2226276347425096477">يُرجى اختصار هذا النص حتى يصل إلى <ph name="MAX_CHARACTERS" /> من الحروف أو أقل (أنت الآن تستخدم <ph name="CURRENT_LENGTH" /> من الحروف).</translation>
-<translation id="2246498165605549352">ملف محلي</translation>
-<translation id="2247351761944213033">الأسبوع <ph name="WEEKNUMBER" />، <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">المقطع الصوتي <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">مربع اختيار</translation>
-<translation id="2311842470354187719">فاصل صفحة</translation>
-<translation id="2335594187091864976">منتقي التاريخ والوقت</translation>
-<translation id="245932805758469625">عدد الثواني المتبقية من الفيديو</translation>
-<translation id="248395913932153421">يوم</translation>
-<translation id="2507943997699731163">يُرجى ملء هذا الحقل.</translation>
-<translation id="2508569020611168319">قائمة علامات التبويب</translation>
-<translation id="2561842179657104141">عرض المزيد من عناصر التحكم في الوسائط</translation>
-<translation id="2572483411312390101">تشغيل</translation>
-<translation id="2613802280814924224">يُرجى إدخال قيمة صالحة. علمًا بأن أقرب قيمة صالحة هي <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">إرسال</translation>
-<translation id="2657045182931379222">كائن رسومي</translation>
-<translation id="2674318244760992338">تذييل</translation>
-<translation id="2709516037105925701">الملء التلقائي</translation>
-<translation id="2723001399770238859">الصوت</translation>
-<translation id="2746543609216772311">يجب أن تكون القيمة <ph name="MINIMUM_DATE_OR_TIME" /> أو بعد ذلك.</translation>
-<translation id="2759744352195237655">زر بقائمة منبثقة</translation>
-<translation id="2761667185364618470">يُرجى تحديد هذا المربع إذا أردت المتابعة.</translation>
-<translation id="2844350028562914727">التفاصيل</translation>
-<translation id="2896972712917208084">مجموعة أزرار الاختيار</translation>
-<translation id="2908441821576996758">يُرجى إدخال قائمة مفصولة بفواصل لعناوين البريد الإلكتروني.</translation>
-<translation id="2940813599313844715">كائن</translation>
-<translation id="2942448076852699108">المحتوى المميز</translation>
-<translation id="3040011195152428237">رابط</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> ميغابايت</translation>
-<translation id="3075154866155599887">يرجى إدخال قيمة صالحة. الحقل غير مكتمل أو أن التاريخ غير صالح.</translation>
-<translation id="3078740164268491126">جدول</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">‏يُرجى إدخال عنوان URL.</translation>
-<translation id="3175736971608411871">الموقّت</translation>
-<translation id="3199563858620722075">مربع تحرير وسرد</translation>
-<translation id="3450233048674729344">يجب أن تكون القيمة أقل من أو تساوي <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">تعريف</translation>
-<translation id="3557673793733683882">عنوان <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">منتقي الأسبوع</translation>
-<translation id="3685101356851116974">صورة غير مُصنَّفة</translation>
-<translation id="3706100364254443312">تبديل</translation>
-<translation id="3732799496749320381">شهر</translation>
-<translation id="3754210790023674521">الخروج من وضع "نافذة ضمن نافذة"</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> غيغابايت</translation>
-<translation id="3808586225841795776">عبارة</translation>
-<translation id="3822383571486410024">يُرجى إطالة هذا النص إلى <ph name="MIN_CHARACTERS" /> من الحروف أو أكثر (أنت تستخدم حاليًا <ph name="CURRENT_LENGTH" /> من الحروف).</translation>
-<translation id="383465348367842624">الجزء المتبوع بالعلامة "<ph name="ATSIGN" />" يجب ألا يشتمل على الرمز "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">خروج من عرض ملء الشاشة</translation>
-<translation id="3920932319529768807">خاتمة</translation>
-<translation id="3924558731517983934">التطبيق</translation>
-<translation id="3944740393230681990">فاتحة</translation>
-<translation id="3960700977367013758">شريط التمرير</translation>
-<translation id="4103419683916926126">مللي ثانية</translation>
-<translation id="4151657705144244502">الرسم</translation>
-<translation id="4160057747563657758">هاتف</translation>
-<translation id="4193965531860883258">مقدمة</translation>
-<translation id="4201051445878709314">عرض الشهر السابق</translation>
-<translation id="421884353938374759">علبة الألوان</translation>
-<translation id="4248100235867064564">شريط قوائم</translation>
-<translation id="4360991593054037559">يُرجى إدخال قيمة صالحة. علمًا بأن القيم الصالحة تتراوح بين <ph name="VALID_VALUE_LOW" /> و<ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">سين وجيم</translation>
-<translation id="4413860115965805769">زر القائمة</translation>
-<translation id="4444765639179266822">يبدو أنه يقول: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">مرجع مسرد مصطلحات</translation>
-<translation id="4522570452068850558">التفاصيل</translation>
-<translation id="4542388879936266156">الوقت المتبقي: <ph name="REMAINING_TIME" />ّ</translation>
-<translation id="4597532268155981612">نموذج</translation>
-<translation id="4661075872484491155">متفرع</translation>
-<translation id="4664250907885839816">يجب ألا يشتمل الجزء الذي يلي العلامة "<ph name="ATSIGN" />" على الرمز "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">ملحق</translation>
-<translation id="4718048029184481307">تشغيل في وضع "نافذة ضمن النافذة"</translation>
-<translation id="4742539557769756338">غلاف</translation>
-<translation id="4748357248530471599">تبديل صورة مقطوعة للشاشة إلى وضع ملء الشاشة</translation>
-<translation id="4757246831282535685">لوحة علامة التبويب</translation>
-<translation id="4763480195061959176">فيديو</translation>
-<translation id="479989351350248267">بحث</translation>
-<translation id="4812940957355064477">يُرجى إدخال عدد.</translation>
-<translation id="4912536737030637138">إدخال قائمة مراجع</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> محددة</translation>
-<translation id="4992066212339426712">إعادة الصوت</translation>
-<translation id="49969490063480558">يُرجى إدخال الجزء الذي يلي العلامة "<ph name="ATSIGN" />"، حيث إن "<ph name="INVALIDADDRESS" />" غير مكتمل.</translation>
-<translation id="5034860022980953847">مؤشر التقدم</translation>
-<translation id="5090250355906949916">شريط تمرير وقت الفيديو</translation>
-<translation id="5093189678851173835">عبارة مقتبسة</translation>
-<translation id="5117590920725113268">عرض الشهر التالي</translation>
-<translation id="512758898067543763">عنوان الصف</translation>
-<translation id="5143125788380636750">تتِّمة</translation>
-<translation id="5164977714490026579">يجب أن تكون القيمة أكبر من أو تساوي <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> بيتابايت</translation>
-<translation id="5307600278924710095">يُرجى إدخال جزء متبوع بعلامة "<ph name="ATSIGN" />"، حيث إن "<ph name="INVALIDADDRESS" />" غير مكتمل.</translation>
-<translation id="5334352251556557839">تعذّر تشغيل الوسائط</translation>
-<translation id="5406322316791861025">شكل</translation>
-<translation id="5453733299334684579">عنصر متفرع</translation>
-<translation id="5466621249238537318">يُرجى تحديد ملف واحد أو أكثر.</translation>
-<translation id="5468998798572797635">إنهاء وضع ملء الشاشة</translation>
-<translation id="5516424706154626233">منتقي التاريخ</translation>
-<translation id="5537725057119320332">إرسال</translation>
-<translation id="5546461542133609677">إعادة الصوت</translation>
-<translation id="561939826962581046">الوقت</translation>
-<translation id="5630795885300617244">انقر مرّتين جهة اليمين أو اليسار لتخطي 10 ثوانٍ.</translation>
-<translation id="5631759159893697722">نبذة مختصرة</translation>
-<translation id="5643186887447432888">زر</translation>
-<translation id="5677946354068040947">خيارات إضافية</translation>
-<translation id="576709008726043716">مقدمة</translation>
-<translation id="57838592816432529">كتم الصوت</translation>
-<translation id="5860033963881614850">غير مفعّل</translation>
-<translation id="588258955323874662">ملء الشاشة</translation>
-<translation id="5888666972993069672">يتم الإرسال الآن إلى <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">مربع البحث</translation>
-<translation id="5939518447894949180">إعادة الضبط</translation>
-<translation id="5966707198760109579">الأسبوع</translation>
-<translation id="5987525920412732405">زر الدوران</translation>
-<translation id="6011459053400940133">شريط تمرير مستوى الصوت</translation>
-<translation id="6015796118275082299">عام</translation>
-<translation id="6023896073578205740">مربع القائمة</translation>
-<translation id="6150588977291308318">قائمة مراجع</translation>
-<translation id="6164829606128959761">متر</translation>
-<translation id="6166809985690652833">كلمة ختامية</translation>
-<translation id="6209276755895393898">يبدو أن: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">مسرد مصطلحات</translation>
-<translation id="6281763101136022427">‏عنوان URL</translation>
-<translation id="6310801910862476708">الخروج من وضع "نافذة ضمن نافذة"</translation>
-<translation id="6398862346408813489">عرض لوحة تحديد الشهر</translation>
-<translation id="6404546809543547843">شريط تمرير وقت الصوت</translation>
-<translation id="6443871981718447451">عرض قائمة مقاطع الترجمة والشرح</translation>
-<translation id="6453774872122745852">شكر وتقدير</translation>
-<translation id="648732519525291180">منتقي الوقت</translation>
-<translation id="6550675742724504774">خيارات</translation>
-<translation id="6572309429103589720">قواعد لغوية غير صالحة</translation>
-<translation id="658823671542763450">تشغيل وضع ملء الشاشة</translation>
-<translation id="663493177488814956">البطاقات</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">محو</translation>
-<translation id="668171684555832681">ملف تعريف آخر...</translation>
-<translation id="6692633176391053278">تخطي</translation>
-<translation id="6709570249143506788">جودة التشغيل ضعيفة.</translation>
-<translation id="6755330956360078551">تلميح</translation>
-<translation id="6790428901817661496">التشغيل</translation>
-<translation id="6820355525329141109">تعذر تحميل المكوّن الإضافي.</translation>
-<translation id="6820615603175220800">مرجع قائمة مراجع</translation>
-<translation id="6843725295806269523">كتم الصوت</translation>
-<translation id="6885760532393684712">الدليل</translation>
-<translation id="689129560213475294">إشارة ناشر</translation>
-<translation id="6934078000481955284">علامة اقتباس فقرة</translation>
-<translation id="6941933287844615239">تنزيل وسائط</translation>
-<translation id="6981594929165378967">إدراج</translation>
-<translation id="6989848892321993519">يُرجى إطالة هذا النص إلى <ph name="MIN_CHARACTERS" /> من الحروف أو أكثر (أنت الآن تستخدم حرفًا واحدًا).</translation>
-<translation id="7033340931668032222">الضغط على السهم المتجه إلى الأعلى والآخر المتجه إلى الأسفل لتغيير مستوى الصوت</translation>
-<translation id="709897737746224366">يُرجى مطابقة التنسيق المطلوب.</translation>
-<translation id="7118469954320184356">لا يتوفر أي وصف.</translation>
-<translation id="7139483182332611405">تمهيد</translation>
-<translation id="7214187073215825913">معلومات المحتوى</translation>
-<translation id="7263440858009898357">يُرجى تحديد عنصر من القائمة.</translation>
-<translation id="727747134524199931">عنوان العمود</translation>
-<translation id="7320576522385648310">التخزين مؤقتًا</translation>
-<translation id="7353453495576941748">إسهام</translation>
-<translation id="7364796246159120393">اختيار ملفّ</translation>
-<translation id="739024184232394898">آخر...</translation>
-<translation id="7405738980073107433">تعليقات ختامية</translation>
-<translation id="7410239719251593705">يبدو أنه يحتوي على محتوى للبالغين. لا يتوفر أي وصف.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> تيرابايت</translation>
-<translation id="7491962110804786152">علامة تبويب</translation>
-<translation id="7514365320538308">تنزيل</translation>
-<translation id="7529102961911894712">رابط رجوع</translation>
-<translation id="7533959249147584474">رسم غير مصنّف</translation>
-<translation id="7647456547678091388">نصيحة</translation>
-<translation id="7661956066982048809">مستند رسومي</translation>
-<translation id="7673697353781729403">ساعات</translation>
-<translation id="7681220483256441252">فهرس</translation>
-<translation id="7740050170769002709">‏محتوى HTML</translation>
-<translation id="7745230546936012372">للحصول على أوصاف الصور غير المتوفّرة، افتح قائمة السياقات.</translation>
-<translation id="7750228210027921155">نافذة ضمن النافذة</translation>
-<translation id="775297008183122718">إدخال غير صالح</translation>
-<translation id="7789962463072032349">إيقاف مؤقت</translation>
-<translation id="7802800022689234070">مثلث الإفصاح</translation>
-<translation id="7888071071722539607">يُرجى تضمين العلامة "<ph name="ATSIGN" />" في عنوان البريد الإلكتروني، حيث يفتقر "<ph name="INVALIDADDRESS" />" إلى العلامة "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">أداة التقسيم</translation>
-<translation id="795667975304826397">ّلم يتمّ اختيار أيّ ملفّ</translation>
-<translation id="8053789581856978548">الحقل النصي للبحث</translation>
-<translation id="8057695513531652401">ملاحظة</translation>
-<translation id="8105797009065549151">ملاحظة مرجعية</translation>
-<translation id="811583516810654505">جارٍ الحصول على وصف...</translation>
-<translation id="8117451130807776954">هذا الأسبوع</translation>
-<translation id="8199524924445686405">سنة</translation>
-<translation id="8208673686607688524">منتقي الوقت والتاريخ المحليان</translation>
-<translation id="8261464734335370856">تدقيق إملائي غير صالح</translation>
-<translation id="8284326494547611709">الترجمة والشرح</translation>
-<translation id="835897206747267392">قيمة غير صحيحة</translation>
-<translation id="8403857369060869934">الوقت المنقضي: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">جزء</translation>
-<translation id="8433900881053900389">شريط الأدوات</translation>
-<translation id="8444882422881193423">عدد الملفات: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">يُرجى تحديد ملف.</translation>
-<translation id="8461852803063341183">زر الاختيار</translation>
-<translation id="8474886197722836894">إهداء</translation>
-<translation id="8531739829932800271">قائمة بالأخطاء</translation>
-<translation id="8534579021159131403">دقائق</translation>
-<translation id="8541249477527128034">التحكم في الوسائط</translation>
-<translation id="8550857728288566671">رمز رسومي</translation>
-<translation id="8583702881314752957">قائمة تعريف</translation>
-<translation id="8597182159515967513">العنوان</translation>
-<translation id="8603553056539299761">الضغط على السهم الأيمن والأيسر لتنفيذ الإجراء</translation>
-<translation id="860475260694818407">جدول المحتويات</translation>
-<translation id="8613126697340063924">التحكم في التشغيل عن بعد</translation>
-<translation id="862370744433916922">ترجمة مصاحِبة</translation>
-<translation id="8711688047404765493">الإخراج</translation>
-<translation id="8750798805984357768">يُرجى اختيار أحد هذه الخيارات.</translation>
-<translation id="8808573423886751634">فصل</translation>
-<translation id="8845239796550121995">يتم الآن الإرسال إلى جهاز التلفزيون</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">خطأ في تشغيل الفيديو.</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> كيلوبايت</translation>
-<translation id="8987927404178983737">شهر</translation>
-<translation id="901493112792887934">المدة الحالية بالثواني</translation>
-<translation id="901834265349196618">بريد إلكتروني</translation>
-<translation id="9048119486235211610">تنقل</translation>
-<translation id="9062295712474918030">المستند</translation>
-<translation id="9062307380734144336">اختيار للتبديل بين تشغيل وإيقاف مؤقت</translation>
-<translation id="9093215626363556771">الخروج من وضع "نافذة ضمن نافذة"</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">آخر...</translation>
-<translation id="9138385573473225930">تنبيه</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />، ابتداء من <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">نافذة ضمن النافذة</translation>
-<translation id="9168329111483466115">حاشية سُفلية</translation>
-<translation id="954003015749068518">الدخول في وضع "نافذة ضمن نافذة"</translation>
-<translation id="966787709310836684">القائمة</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_bg.xtb b/chromium/content/app/strings/translations/content_strings_bg.xtb
deleted file mode 100644
index 35a649ad7ae..00000000000
--- a/chromium/content/app/strings/translations/content_strings_bg.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="bg">
-<translation id="1018939186200882850">елемент от меню</translation>
-<translation id="10623998915015855">бутон за превключване</translation>
-<translation id="1088086359088493902">Секунди</translation>
-<translation id="1171774979989969504">Моля, въведете имейл адрес.</translation>
-<translation id="1178581264944972037">Пауза</translation>
-<translation id="1188858454923323853">допълнение</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">плъзгач</translation>
-<translation id="1211441953136645838">бележка в края</translation>
-<translation id="1281252709823657822">диалогов прозорец</translation>
-<translation id="1335095011850992622">признания за източника</translation>
-<translation id="1342835525016946179">статия</translation>
-<translation id="1359897965706325498">банер</translation>
-<translation id="1589122976691792535">регион</translation>
-<translation id="1591562245178063882">Този месец</translation>
-<translation id="1637811476055996098">Избор на файлове</translation>
-<translation id="1650423536718072820">изнесен цитат</translation>
-<translation id="1727886345390570319">скриване на менюто за надписи</translation>
-<translation id="1729654308190250600">Моля, въведете имейл адрес.</translation>
-<translation id="1758486001363313524">Други...</translation>
-<translation id="1806710327868736751">диалогов прозорец със сигнал</translation>
-<translation id="1821985195704844674">дървовидна таблица</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">възпроизвеждане на отдалечено устройство</translation>
-<translation id="190587075670221089">изтриване</translation>
-<translation id="1907737156431278478">пример</translation>
-<translation id="1921819250265091946">дд</translation>
-<translation id="1930711995431081526">състояние</translation>
-<translation id="1938124657309484470">Стойността трябва да е <ph name="MAXIMUM_DATE_OR_TIME" /> или по-рано.</translation>
-<translation id="1946271899482435442">Показване на инструмента за избор на дата</translation>
-<translation id="1993104285338243655">Превключихте към дублиране</translation>
-<translation id="2060505056492490888">„<ph name="DOT" />“ се използва на неправилна позиция в/ъв „<ph name="INVALIDDOMAIN" />“.</translation>
-<translation id="2148716181193084225">Днес</translation>
-<translation id="2158401438286456825">списък със страниците</translation>
-<translation id="2226276347425096477">Моля, съкратете този текст до <ph name="MAX_CHARACTERS" /> знака или по-малко (понастоящем използвате <ph name="CURRENT_LENGTH" /> знака).</translation>
-<translation id="2246498165605549352">Локален файл</translation>
-<translation id="2247351761944213033">Седмица <ph name="WEEKNUMBER" />, <ph name="YEAR" /> г.</translation>
-<translation id="2277199496770840904">Запис <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">квадратче за отметка</translation>
-<translation id="2311842470354187719">разделител на страници</translation>
-<translation id="2335594187091864976">инструмент за избор на дата и час</translation>
-<translation id="245932805758469625">оставащи секунди до края на видеоклипа</translation>
-<translation id="248395913932153421">Ден</translation>
-<translation id="2507943997699731163">Моля, попълнете това поле.</translation>
-<translation id="2508569020611168319">списък с раздели</translation>
-<translation id="2561842179657104141">показване на още контроли за мултимедия</translation>
-<translation id="2572483411312390101">пускане</translation>
-<translation id="2613802280814924224">Моля, въведете валидна стойност. Най-близката такава е <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Изпращане</translation>
-<translation id="2657045182931379222">графичен обект</translation>
-<translation id="2674318244760992338">долен колонтитул</translation>
-<translation id="2709516037105925701">Автоматично попълване</translation>
-<translation id="2723001399770238859">звук</translation>
-<translation id="2746543609216772311">Стойността трябва да е <ph name="MINIMUM_DATE_OR_TIME" /> или по-късно.</translation>
-<translation id="2759744352195237655">бутон с изскачащ прозорец</translation>
-<translation id="2761667185364618470">Моля, поставете отметка в това квадратче, ако искате да продължите.</translation>
-<translation id="2844350028562914727">подробности</translation>
-<translation id="2896972712917208084">група бутони за избор</translation>
-<translation id="2908441821576996758">Моля, въведете списък с имейл адреси, разделени със запетаи.</translation>
-<translation id="2940813599313844715">обект</translation>
-<translation id="2942448076852699108">откроено съдържание</translation>
-<translation id="3040011195152428237">връзка</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> МБ</translation>
-<translation id="3075154866155599887">Моля, въведете валидна стойност. Данните в полето са непълни или датата е невалидна.</translation>
-<translation id="3078740164268491126">таблица</translation>
-<translation id="3086746722712840547">забележка</translation>
-<translation id="310520048233152454">Моля, въведете URL адрес.</translation>
-<translation id="3175736971608411871">таймер</translation>
-<translation id="3199563858620722075">разгъващ се списък</translation>
-<translation id="3450233048674729344">Стойността трябва да е по-малка или равна на <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">дефиниция</translation>
-<translation id="3557673793733683882">заглавие от ниво <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">инструмент за избор на седмица</translation>
-<translation id="3685101356851116974">Изображение без етикет</translation>
-<translation id="3706100364254443312">превключвател</translation>
-<translation id="3732799496749320381">мм</translation>
-<translation id="3754210790023674521">Изход от „Картина в картината“</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> ГБ</translation>
-<translation id="3808586225841795776">термин</translation>
-<translation id="3822383571486410024">Моля, удължете този текст поне до <ph name="MIN_CHARACTERS" /> знака (понастоящем използвате <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="383465348367842624">Текстът преди „<ph name="ATSIGN" />“ не бива да съдържа символа „<ph name="INVALIDCHARACTER" />“.</translation>
-<translation id="3846214748874656680">Изход от цял екран</translation>
-<translation id="3920932319529768807">заключение</translation>
-<translation id="3924558731517983934">приложение</translation>
-<translation id="3944740393230681990">пролог</translation>
-<translation id="3960700977367013758">лента за превъртане</translation>
-<translation id="4103419683916926126">Милисекунди</translation>
-<translation id="4151657705144244502">графика</translation>
-<translation id="4160057747563657758">телефон</translation>
-<translation id="4193965531860883258">предговор</translation>
-<translation id="4201051445878709314">Показване на предишния месец</translation>
-<translation id="421884353938374759">инструмент за избор на цветове</translation>
-<translation id="4248100235867064564">лента с менюта</translation>
-<translation id="4360991593054037559">Моля, въведете валидна стойност. Двете най-близки такива са <ph name="VALID_VALUE_LOW" /> и <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Въпроси и отговори</translation>
-<translation id="4413860115965805769">бутон за меню</translation>
-<translation id="4444765639179266822">Изглежда, че пише: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">препратка към определение в терминологичния речник</translation>
-<translation id="4522570452068850558">Подробности</translation>
-<translation id="4542388879936266156">оставащо време: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">формуляр</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Текстът след „<ph name="ATSIGN" />“ не бива да съдържа символа „<ph name="INVALIDCHARACTER" />“.</translation>
-<translation id="4668956016107839909">приложение</translation>
-<translation id="4718048029184481307">Възпроизвежда се в режим „Картина в картината“</translation>
-<translation id="4742539557769756338">корица</translation>
-<translation id="4748357248530471599">превключване между прорез на екрана и цял екран</translation>
-<translation id="4757246831282535685">панел с раздели</translation>
-<translation id="4763480195061959176">видео</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Моля, въведете номер.</translation>
-<translation id="4912536737030637138">библиографски запис</translation>
-<translation id="4975562563186953947">Избрани: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Включване на звука</translation>
-<translation id="49969490063480558">Моля, въведете текст след „<ph name="ATSIGN" />“. „<ph name="INVALIDADDRESS" />“ е непълно.</translation>
-<translation id="5034860022980953847">индикатор за напредък</translation>
-<translation id="5090250355906949916">времеви плъзгач за видеоклипа</translation>
-<translation id="5093189678851173835">епиграф</translation>
-<translation id="5117590920725113268">Показване на следващия месец</translation>
-<translation id="512758898067543763">заглавка на ред</translation>
-<translation id="5143125788380636750">епилог</translation>
-<translation id="5164977714490026579">Стойността трябва да е по-голяма или равна на <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> ПБ</translation>
-<translation id="5307600278924710095">Моля, въведете текст преди „<ph name="ATSIGN" />“. „<ph name="INVALIDADDRESS" />“ е непълно.</translation>
-<translation id="5334352251556557839">Мултимедийното съдържание не може да бъде възпроизведено.</translation>
-<translation id="5406322316791861025">фигура</translation>
-<translation id="5453733299334684579">елемент от дърво</translation>
-<translation id="5466621249238537318">Моля, изберете един или повече файлове.</translation>
-<translation id="5468998798572797635">изход от цял екран</translation>
-<translation id="5516424706154626233">инструмент за избор на дата</translation>
-<translation id="5537725057119320332">Предаване</translation>
-<translation id="5546461542133609677">пускане на звука</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Докоснете два пъти стрелката наляво или надясно, за да пропуснете 10 сек</translation>
-<translation id="5631759159893697722">резюме</translation>
-<translation id="5643186887447432888">бутон</translation>
-<translation id="5677946354068040947">още опции</translation>
-<translation id="576709008726043716">въведение</translation>
-<translation id="57838592816432529">Заглушаване</translation>
-<translation id="5860033963881614850">Изключено</translation>
-<translation id="588258955323874662">Цял екран</translation>
-<translation id="5888666972993069672">В момента се предава към „<ph name="DEVICE_FRIENDLY_NAME" />“</translation>
-<translation id="591047860372322273">поле за търсене</translation>
-<translation id="5939518447894949180">Нулиране</translation>
-<translation id="5966707198760109579">Седмица</translation>
-<translation id="5987525920412732405">брояч</translation>
-<translation id="6011459053400940133">плъзгач за силата на звука</translation>
-<translation id="6015796118275082299">Година</translation>
-<translation id="6023896073578205740">списъчно поле</translation>
-<translation id="6150588977291308318">библиография</translation>
-<translation id="6164829606128959761">индикатор</translation>
-<translation id="6166809985690652833">послеслов</translation>
-<translation id="6209276755895393898">Изглежда, че това е: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">терминологичен речник</translation>
-<translation id="6281763101136022427">url адрес</translation>
-<translation id="6310801910862476708">Изход от „Картина в картината“</translation>
-<translation id="6398862346408813489">Показване на панела за избиране на месец</translation>
-<translation id="6404546809543547843">времеви плъзгач за аудиозаписа</translation>
-<translation id="6443871981718447451">показване на менюто за надписи</translation>
-<translation id="6453774872122745852">признания</translation>
-<translation id="648732519525291180">инструмент за избор на час</translation>
-<translation id="6550675742724504774">Опции</translation>
-<translation id="6572309429103589720">Невалидна граматика</translation>
-<translation id="658823671542763450">вход за цял екран</translation>
-<translation id="663493177488814956">емисия</translation>
-<translation id="6637586476836377253">регистрационен файл</translation>
-<translation id="6643016212128521049">Изчистване</translation>
-<translation id="668171684555832681">Друг...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Лошо качество на възпроизвеждането</translation>
-<translation id="6755330956360078551">подсказка</translation>
-<translation id="6790428901817661496">Пускане</translation>
-<translation id="6820355525329141109">Приставката не можа да се зареди.</translation>
-<translation id="6820615603175220800">препратка към библиографски запис</translation>
-<translation id="6843725295806269523">заглушаване</translation>
-<translation id="6885760532393684712">директория</translation>
-<translation id="689129560213475294">колофон</translation>
-<translation id="6934078000481955284">блоков цитат</translation>
-<translation id="6941933287844615239">изтегляне на мултимедията</translation>
-<translation id="6981594929165378967">вмъкване</translation>
-<translation id="6989848892321993519">Моля, удължете този текст до поне <ph name="MIN_CHARACTERS" /> знака (понастоящем използвате 1 знак).</translation>
-<translation id="7033340931668032222">нагоре и надолу за промяна на силата на звука</translation>
-<translation id="709897737746224366">Моля, спазвайте изисквания формат.</translation>
-<translation id="7118469954320184356">Няма описание.</translation>
-<translation id="7139483182332611405">предисловие</translation>
-<translation id="7214187073215825913">информация за съдържанието</translation>
-<translation id="7263440858009898357">Моля, изберете елемент в списъка.</translation>
-<translation id="727747134524199931">заглавка на колона</translation>
-<translation id="7320576522385648310">буферира се</translation>
-<translation id="7353453495576941748">признание за източника</translation>
-<translation id="7364796246159120393">Избор на файл</translation>
-<translation id="739024184232394898">Други...</translation>
-<translation id="7405738980073107433">бележки в края</translation>
-<translation id="7410239719251593705">Изглежда има съдържание за пълнолетни. Няма описание.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> ТБ</translation>
-<translation id="7491962110804786152">раздел</translation>
-<translation id="7514365320538308">Изтегляне</translation>
-<translation id="7529102961911894712">препратка</translation>
-<translation id="7533959249147584474">Графика без етикет</translation>
-<translation id="7647456547678091388">съвет</translation>
-<translation id="7661956066982048809">графичен документ</translation>
-<translation id="7673697353781729403">Часове</translation>
-<translation id="7681220483256441252">показалец</translation>
-<translation id="7740050170769002709">HTML съдържание</translation>
-<translation id="7745230546936012372">За да изтеглите липсващите описания на изображения, отворете контекстното меню.</translation>
-<translation id="7750228210027921155">Картина в картината</translation>
-<translation id="775297008183122718">Въведеното е невалидно</translation>
-<translation id="7789962463072032349">поставяне на пауза</translation>
-<translation id="7802800022689234070">триъгълник за разкриване на съдържание</translation>
-<translation id="7888071071722539607">Моля, включете „<ph name="ATSIGN" />“ в имейл адреса. В/ъв „<ph name="INVALIDADDRESS" />“ липсва „<ph name="ATSIGN" />“.</translation>
-<translation id="7891486169920085145">разделител</translation>
-<translation id="795667975304826397">Няма избран файл</translation>
-<translation id="8053789581856978548">текстово поле за търсене</translation>
-<translation id="8057695513531652401">известие</translation>
-<translation id="8105797009065549151">препратка към бележка</translation>
-<translation id="811583516810654505">Описанието се изтегля...</translation>
-<translation id="8117451130807776954">Тази седмица</translation>
-<translation id="8199524924445686405">гггг</translation>
-<translation id="8208673686607688524">инструмент за избор на дата и час според местното време</translation>
-<translation id="8261464734335370856">Невалиден правопис</translation>
-<translation id="8284326494547611709">Надписи</translation>
-<translation id="835897206747267392">Невалидна стойност.</translation>
-<translation id="8403857369060869934">изминало време: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">част</translation>
-<translation id="8433900881053900389">лента с инструменти</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> файла</translation>
-<translation id="8451268428117625855">Моля, изберете файл.</translation>
-<translation id="8461852803063341183">бутон за избор</translation>
-<translation id="8474886197722836894">посвещение</translation>
-<translation id="8531739829932800271">списък с печатните грешки</translation>
-<translation id="8534579021159131403">Минути</translation>
-<translation id="8541249477527128034">медийна контрола</translation>
-<translation id="8550857728288566671">графичен символ</translation>
-<translation id="8583702881314752957">списък с дефиниции</translation>
-<translation id="8597182159515967513">заглавие</translation>
-<translation id="8603553056539299761">наляво и надясно за придвижване</translation>
-<translation id="860475260694818407">съдържание</translation>
-<translation id="8613126697340063924">управление на отдалеченото възпроизвеждане</translation>
-<translation id="862370744433916922">подзаглавие</translation>
-<translation id="8711688047404765493">изход</translation>
-<translation id="8750798805984357768">Моля, изберете една от тези опции.</translation>
-<translation id="8808573423886751634">глава</translation>
-<translation id="8845239796550121995">В момента се предава към телевизора ви</translation>
-<translation id="8851136666856101339">основен елемент</translation>
-<translation id="8875657656876809964">Грешка при възпроизвеждането на видеоклипа</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KБ</translation>
-<translation id="8987927404178983737">Месец</translation>
-<translation id="901493112792887934">текущо време в секунди</translation>
-<translation id="901834265349196618">имейл</translation>
-<translation id="9048119486235211610">навигация</translation>
-<translation id="9062295712474918030">документ</translation>
-<translation id="9062307380734144336">изберете за превключване между възпроизвеждане и пауза</translation>
-<translation id="9093215626363556771">изход от режима „Картина в картината“</translation>
-<translation id="9108370397979208512">математически израз</translation>
-<translation id="9132465097189459683">Други...</translation>
-<translation id="9138385573473225930">сигнал</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> – започва от <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Картина в картината</translation>
-<translation id="9168329111483466115">бележка под линия</translation>
-<translation id="954003015749068518">вход в режима „Картина в картината“</translation>
-<translation id="966787709310836684">меню</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_bn.xtb b/chromium/content/app/strings/translations/content_strings_bn.xtb
deleted file mode 100644
index eeba632ca97..00000000000
--- a/chromium/content/app/strings/translations/content_strings_bn.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="bn">
-<translation id="1018939186200882850">মেনু আইটেম</translation>
-<translation id="10623998915015855">টগল বোতাম</translation>
-<translation id="1088086359088493902">সেকেন্ড</translation>
-<translation id="1171774979989969504">অনুগ্রহ করে কোন ইমেল আইডি লিখুন:</translation>
-<translation id="1178581264944972037">বিরতি</translation>
-<translation id="1188858454923323853">পরিপূরক</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">স্লাইডার</translation>
-<translation id="1211441953136645838">এন্ডনোট</translation>
-<translation id="1281252709823657822">ডায়ালগ</translation>
-<translation id="1335095011850992622">ক্রেডিট</translation>
-<translation id="1342835525016946179">নিবন্ধ</translation>
-<translation id="1359897965706325498">ব্যানার</translation>
-<translation id="1589122976691792535">অঞ্চল</translation>
-<translation id="1591562245178063882">এই মাস</translation>
-<translation id="1637811476055996098">ফাইল বেছে নিন</translation>
-<translation id="1650423536718072820">পুলকোট</translation>
-<translation id="1727886345390570319">ক্লোজড ক্যাপশনের মেনু লুকান</translation>
-<translation id="1729654308190250600">অনুগ্রহ করে একটি খালি না থাকা ইমেল আইডি লিখুন৷</translation>
-<translation id="1758486001363313524">অন্যান্য...</translation>
-<translation id="1806710327868736751">সতর্কতার_ডায়ালগ</translation>
-<translation id="1821985195704844674">ট্রি গ্রিড</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">রিমোট ডিভাইসে প্লে করুন</translation>
-<translation id="190587075670221089">মোছা হচ্ছে</translation>
-<translation id="1907737156431278478">উদাহরণ</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">স্থিতি</translation>
-<translation id="1938124657309484470">মানকে অবশ্যই <ph name="MAXIMUM_DATE_OR_TIME" /> বা আগের হতে হবে৷</translation>
-<translation id="1946271899482435442">তারিখ বেছে নেওয়ার বিকল্পটি দেখান</translation>
-<translation id="1993104285338243655">মিররিং এ পরিবর্তন করা হয়েছে</translation>
-<translation id="2060505056492490888">'<ph name="INVALIDDOMAIN" />' এ একটি ভুল অবস্থানে '<ph name="DOT" />' ব্যবহৃত হয়েছে৷</translation>
-<translation id="2148716181193084225">আজ</translation>
-<translation id="2158401438286456825">পৃষ্ঠা তালিকা</translation>
-<translation id="2226276347425096477">দয়া করে এই পাঠ্যটি <ph name="MAX_CHARACTERS" />টি অক্ষর বা তার কমে (আপনি বর্তমানে <ph name="CURRENT_LENGTH" />টি অক্ষর ব্যবহার করছেন) সংক্ষিপ্ত করুন৷</translation>
-<translation id="2246498165605549352">স্থানীয় ফাইল</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" /> সপ্তাহ, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ট্র্যাক <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">চেকবাক্স</translation>
-<translation id="2311842470354187719">পৃষ্ঠা বিরতি</translation>
-<translation id="2335594187091864976">তারিখ এবং সময় চয়নকারি</translation>
-<translation id="245932805758469625">ভিডিও শেষ হতে এখনও যত সেকেন্ড বাকি আছে</translation>
-<translation id="248395913932153421">দিন</translation>
-<translation id="2507943997699731163">দয়া করে এই ক্ষেত্রটি পূরণ করুন৷</translation>
-<translation id="2508569020611168319">ট্যাব তালিকা</translation>
-<translation id="2561842179657104141">আরও মিডিয়া নিয়ন্ত্রণ দেখান</translation>
-<translation id="2572483411312390101">চালনা করুন</translation>
-<translation id="2613802280814924224">দয়া করে একটি বৈধ মান লিখুন৷ কাছাকাছির বৈধ মান হল <ph name="VALID_VALUE" />৷</translation>
-<translation id="2653659639078652383">জমা দিন</translation>
-<translation id="2657045182931379222">গ্রাফিক্স অবজেক্ট</translation>
-<translation id="2674318244760992338">পাদলেখ</translation>
-<translation id="2709516037105925701">স্বয়ংপূরণ</translation>
-<translation id="2723001399770238859">অডিও</translation>
-<translation id="2746543609216772311">মানকে অবশ্যই <ph name="MINIMUM_DATE_OR_TIME" /> বা পরবর্তী হতে হবে৷</translation>
-<translation id="2759744352195237655">পপ আপ বোতাম</translation>
-<translation id="2761667185364618470">আপনি এগিয়ে যেতে চাইলে এই বাক্সটি পরীক্ষা করুন৷</translation>
-<translation id="2844350028562914727">বিবরণ</translation>
-<translation id="2896972712917208084">রেডিও বোতাম গ্রুপ</translation>
-<translation id="2908441821576996758">অনুগ্রহ করে কমা দিয়ে আলাদা করা ইমেল আইডির তালিকা লিখুন৷</translation>
-<translation id="2940813599313844715">অবজেক্ট</translation>
-<translation id="2942448076852699108">হাইলাইট করা কন্টেন্ট</translation>
-<translation id="3040011195152428237">লিঙ্ক</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> এমবি</translation>
-<translation id="3075154866155599887">অনুগ্রহ করে একটি সঠিক মান লিখুন৷ ফিল্ডটি অসম্পূর্ণ অথবা একটি ভুল তারিখ আছে৷</translation>
-<translation id="3078740164268491126">সারণী</translation>
-<translation id="3086746722712840547">দ্রষ্টব্য</translation>
-<translation id="310520048233152454">দয়া করে একটি বৈধ URL প্রবেশ করুন৷</translation>
-<translation id="3175736971608411871">টাইমার</translation>
-<translation id="3199563858620722075">কম্বো বাক্স</translation>
-<translation id="3450233048674729344">মানটি অবশ্যই <ph name="MAXIMUM" />এর চেয়ে কম বা সমান হবে৷</translation>
-<translation id="3486220673238053218">সংজ্ঞা</translation>
-<translation id="3557673793733683882">শিরোনাম <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">সপ্তাহ চয়নকারি</translation>
-<translation id="3685101356851116974">লেবেল ছাড়া ছবি</translation>
-<translation id="3706100364254443312">পরিবর্তন করুন</translation>
-<translation id="3732799496749320381">মিমি</translation>
-<translation id="3754210790023674521">ছবির-মধ্যে-ছবি মোড থেকে বেরিয়ে আসুন</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> জিবি</translation>
-<translation id="3808586225841795776">পদ</translation>
-<translation id="3822383571486410024">দয়া করে এই পাঠ্যকে ন্যূনতম <ph name="MIN_CHARACTERS" /> অক্ষরের বা তার বেশি (আপনি বর্তমানে <ph name="CURRENT_LENGTH" />টি অক্ষর ব্যবহার করেছেন) দৈর্ঘের করুন।</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' অনুসরণ করে এমন একটি অংশে '<ph name="INVALIDCHARACTER" />' চিহ্ন থাকা উচিত নয়৷</translation>
-<translation id="3846214748874656680">পূর্ণস্ক্রীন থেকে প্রস্থান করুন</translation>
-<translation id="3920932319529768807">সিদ্ধান্ত</translation>
-<translation id="3924558731517983934">অ্যাপ্লিকেশান</translation>
-<translation id="3944740393230681990">ভূমিকা</translation>
-<translation id="3960700977367013758">স্ক্রল বার</translation>
-<translation id="4103419683916926126">মিলিসেকেন্ড</translation>
-<translation id="4151657705144244502">গ্রাফিক</translation>
-<translation id="4160057747563657758">টেলিফোন</translation>
-<translation id="4193965531860883258">মুখবন্ধ</translation>
-<translation id="4201051445878709314">পূর্ববর্তী মাস দেখান</translation>
-<translation id="421884353938374759">রঙ চয়নকারী</translation>
-<translation id="4248100235867064564">মেনু বার</translation>
-<translation id="4360991593054037559">দয়া করে একটি বৈধ মান লিখুন৷ দুটি কাছাকাছির বৈধ মান হল <ph name="VALID_VALUE_LOW" /> এবং <ph name="VALID_VALUE_HIGHER" />৷</translation>
-<translation id="4384583879834880242">প্রশ্ন এবং উত্তর</translation>
-<translation id="4413860115965805769">মেনু বোতাম</translation>
-<translation id="4444765639179266822">মনে হচ্ছে বলতে চাইছে: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">শব্দকোষের রেফারেন্স</translation>
-<translation id="4522570452068850558">বিশদ বিবরণ</translation>
-<translation id="4542388879936266156">বাকি সময়: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ফর্ম</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' অনুসরণ করে এমন একটি অংশে '<ph name="INVALIDCHARACTER" />' চিহ্ন থাকা উচিত নয়৷</translation>
-<translation id="4668956016107839909">পরিশিষ্ট</translation>
-<translation id="4718048029184481307">ছবির-মধ্যে-ছবি মোডে চলছে</translation>
-<translation id="4742539557769756338">কভার</translation>
-<translation id="4748357248530471599">ডিসপ্লে কাট-আউট ফুল-স্ক্রিনে টগল করুন</translation>
-<translation id="4757246831282535685">ট্যাব প্যানেল</translation>
-<translation id="4763480195061959176">ভিডিও</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">দয়া করে একটি সংখ্যা লিখুন৷</translation>
-<translation id="4912536737030637138">বিবলিওগ্রাফি এন্ট্রি</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" />টি নির্বাচিত</translation>
-<translation id="4992066212339426712">সশব্দ করুন</translation>
-<translation id="49969490063480558">দয়া করে '<ph name="ATSIGN" />' অনুসরণ করে একটি অংশ লিখুন৷ '<ph name="INVALIDADDRESS" />' অসম্পূর্ণ৷</translation>
-<translation id="5034860022980953847">অগ্রগতি সূচক</translation>
-<translation id="5090250355906949916">ভিডিওর সময় স্ক্রাবার</translation>
-<translation id="5093189678851173835">এপিগ্রাফ</translation>
-<translation id="5117590920725113268">পরবর্তী মাস দেখান</translation>
-<translation id="512758898067543763">সারি শিরোলেখ</translation>
-<translation id="5143125788380636750">উপসংহার</translation>
-<translation id="5164977714490026579">মানটি অবশ্যই <ph name="MINIMUM" />এর চেয়ে বেশি বা সমান হবে৷</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">'<ph name="ATSIGN" />' অনুসরণ করে একটি অংশ লিখুন৷ '<ph name="INVALIDADDRESS" />' অসম্পূর্ণ৷</translation>
-<translation id="5334352251556557839">মিডিয়া চালানো যাচ্ছে না।</translation>
-<translation id="5406322316791861025">আকার</translation>
-<translation id="5453733299334684579">ট্রি আইটেম</translation>
-<translation id="5466621249238537318">অনুগ্রহ করে এক বা একাধিক ফাইল নির্বাচন করুন৷</translation>
-<translation id="5468998798572797635">পূর্ণ স্ক্রিন বন্ধ করুন</translation>
-<translation id="5516424706154626233">তারিখ চয়নকারি</translation>
-<translation id="5537725057119320332">কাস্ট করুন</translation>
-<translation id="5546461542133609677">সশব্দ</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">১০ সেকেন্ড আগে পরে করার জন্য বাঁ অথবা ডান দিকে ডবল ট্যাপ করুন</translation>
-<translation id="5631759159893697722">বিমূর্ত</translation>
-<translation id="5643186887447432888">বোতাম</translation>
-<translation id="5677946354068040947">আরও বিকল্প</translation>
-<translation id="576709008726043716">পরিচয়</translation>
-<translation id="57838592816432529">মিউট করুন</translation>
-<translation id="5860033963881614850">বন্ধ করুন</translation>
-<translation id="588258955323874662">সম্পূর্নস্ক্রীণ</translation>
-<translation id="5888666972993069672"><ph name="DEVICE_FRIENDLY_NAME" /> এ কাস্ট করা হচ্ছে</translation>
-<translation id="591047860372322273">সার্চ বক্স</translation>
-<translation id="5939518447894949180">রিসেট করুন</translation>
-<translation id="5966707198760109579">সপ্তাহ</translation>
-<translation id="5987525920412732405">ঘোড়ানোর বোতাম</translation>
-<translation id="6011459053400940133">ভলিউম স্লাইডার</translation>
-<translation id="6015796118275082299">বছর</translation>
-<translation id="6023896073578205740">তালিকা বাক্স</translation>
-<translation id="6150588977291308318">বিবলিওগ্রাফি</translation>
-<translation id="6164829606128959761">মিটার</translation>
-<translation id="6166809985690652833">পরিশিষ্ট</translation>
-<translation id="6209276755895393898">মনে হচ্ছে: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">শব্দকোষ</translation>
-<translation id="6281763101136022427">ইউআরএল</translation>
-<translation id="6310801910862476708">ছবির-মধ্যে-ছবি মোড থেকে বেরিয়ে আসুন</translation>
-<translation id="6398862346408813489">মাস নির্বাচনের প্যানেল দেখান</translation>
-<translation id="6404546809543547843">অডিও সময় স্ক্রাবার</translation>
-<translation id="6443871981718447451">ক্লোজড ক্যাপশনের মেনু দেখান</translation>
-<translation id="6453774872122745852">কৃতজ্ঞতা স্বীকার</translation>
-<translation id="648732519525291180">সময় চয়নকারি</translation>
-<translation id="6550675742724504774">বিকল্পসমূহ</translation>
-<translation id="6572309429103589720">ভুল ব্যাকরণ</translation>
-<translation id="658823671542763450">পূর্ণ স্ক্রীনে প্রবেশ করুন</translation>
-<translation id="663493177488814956">ফিড</translation>
-<translation id="6637586476836377253">লগ</translation>
-<translation id="6643016212128521049">সাফ করুন</translation>
-<translation id="668171684555832681">অন্যান্য...</translation>
-<translation id="6692633176391053278">পদক্ষেপকারী</translation>
-<translation id="6709570249143506788">প্লেব্যাকের গুণমান খারাপ</translation>
-<translation id="6755330956360078551">সরঞ্জামটিপ</translation>
-<translation id="6790428901817661496">চালু করুন</translation>
-<translation id="6820355525329141109">প্লাগ-ইন লোড করা যায়নি।</translation>
-<translation id="6820615603175220800">বিবলিওগ্রাফি রেফারেন্স</translation>
-<translation id="6843725295806269523">মিউট</translation>
-<translation id="6885760532393684712">ডিরেক্টরি</translation>
-<translation id="689129560213475294">বইটির সম্পর্কে</translation>
-<translation id="6934078000481955284">ব্লক উদ্ধৃতি</translation>
-<translation id="6941933287844615239">মিডিয়া ডাউনলোড করুন</translation>
-<translation id="6981594929165378967">যোগ করা হচ্ছে</translation>
-<translation id="6989848892321993519">দয়া করে এই পাঠ্যকে ন্যূনতম <ph name="MIN_CHARACTERS" /> অক্ষরের বা তার বেশি দৈর্ঘ্যের করুন (আপনি বর্তমানে ১টি অক্ষর ব্যবহার করেছেন)।</translation>
-<translation id="7033340931668032222">ভলিউম পরিবর্তন করতে উপরে এবং নিচে</translation>
-<translation id="709897737746224366">দয়া করে অনুরোধ হওয়া বিন্যাসটি মেলান৷</translation>
-<translation id="7118469954320184356">কোনও বিবরণ নেই।</translation>
-<translation id="7139483182332611405">মুখবন্ধ</translation>
-<translation id="7214187073215825913">কন্টেন্টের তথ্য</translation>
-<translation id="7263440858009898357">তালিকা থেকে একটি আইটেম নির্বাচন করুন৷ </translation>
-<translation id="727747134524199931">কলাম শিরোলেখ</translation>
-<translation id="7320576522385648310">বাফার হচ্ছে</translation>
-<translation id="7353453495576941748">স্বীকৃতি</translation>
-<translation id="7364796246159120393">ফাইল বেছে নিন</translation>
-<translation id="739024184232394898">অন্যান্য...</translation>
-<translation id="7405738980073107433">এন্ডনোট</translation>
-<translation id="7410239719251593705">প্রাপ্তবয়স্কদের কন্টেন্ট আছে বলে মনে হচ্ছে। কোনও বিবরণ দেওয়া নেই।</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">ট্যাব</translation>
-<translation id="7514365320538308">ডাউনলোড করুন</translation>
-<translation id="7529102961911894712">ফিরে যাওয়ার লিঙ্ক</translation>
-<translation id="7533959249147584474">লেবেল ছাড়া ছবি</translation>
-<translation id="7647456547678091388">পরামর্শ</translation>
-<translation id="7661956066982048809">গ্রাফিক্স ডকুমেন্ট</translation>
-<translation id="7673697353781729403">ঘণ্টা</translation>
-<translation id="7681220483256441252">সূচি</translation>
-<translation id="7740050170769002709">HTML কন্টেন্ট</translation>
-<translation id="7745230546936012372">ছবির বিবরণ অনুপস্থিত থাকলে, সেটি জানতে সংশ্লিষ্ট মেনু খুলুন।</translation>
-<translation id="7750228210027921155">ছবির-মধ্যে-ছবি</translation>
-<translation id="775297008183122718">নির্ভুল নয়</translation>
-<translation id="7789962463072032349">বিরাম</translation>
-<translation id="7802800022689234070">উম্মোচন ত্রিভুজ</translation>
-<translation id="7888071071722539607">ইমেল আইডিতে অনুগ্রহ করে একটি '<ph name="ATSIGN" />' অন্তর্ভুক্ত করুন৷ '<ph name="INVALIDADDRESS" />'-তে একটি '<ph name="ATSIGN" />' অনুপস্থিত৷</translation>
-<translation id="7891486169920085145">স্প্লিটার</translation>
-<translation id="795667975304826397">কোনও ফাইল চয়ন করা হয় নি</translation>
-<translation id="8053789581856978548">সার্চ পাঠ্য ফিল্ড</translation>
-<translation id="8057695513531652401">বিজ্ঞপ্তি</translation>
-<translation id="8105797009065549151">নোটের রেফারেন্স</translation>
-<translation id="811583516810654505">বিবরণ খোঁজা হচ্ছে…</translation>
-<translation id="8117451130807776954">এই সপ্তাহ</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">স্থানীয় তারিখ ও সময় চয়নকারি</translation>
-<translation id="8261464734335370856">ভুল বানান</translation>
-<translation id="8284326494547611709">পরিচয়লিপিগুলি</translation>
-<translation id="835897206747267392">ভুল মান৷</translation>
-<translation id="8403857369060869934">অতিবাহিত সময়: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">অংশ</translation>
-<translation id="8433900881053900389">টুল দণ্ড</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> টি ফাইল</translation>
-<translation id="8451268428117625855">দয়া করে একটি ফাইল নির্বাচন করুন৷</translation>
-<translation id="8461852803063341183">রেডিও বোতাম</translation>
-<translation id="8474886197722836894">উৎসর্গ</translation>
-<translation id="8531739829932800271">ত্রুটি-বিচ্যুতি</translation>
-<translation id="8534579021159131403">মিনিট</translation>
-<translation id="8541249477527128034">মিডিয়া নিয়ন্ত্রণ</translation>
-<translation id="8550857728288566671">গ্রাফিক্স চিহ্ন</translation>
-<translation id="8583702881314752957">সংজ্ঞার তালিকা</translation>
-<translation id="8597182159515967513">শিরোনাম</translation>
-<translation id="8603553056539299761">খুঁজে পেতে ডানদিকে এবং বাঁদিকে</translation>
-<translation id="860475260694818407">সূচিপত্র</translation>
-<translation id="8613126697340063924">রিমোট প্লেব্যাক নিয়ন্ত্রণ করুন</translation>
-<translation id="862370744433916922">সাবটাইটেল</translation>
-<translation id="8711688047404765493">আউটপুট</translation>
-<translation id="8750798805984357768">দয়া করে বিকল্পগুলির একটি নির্বাচন করুন৷</translation>
-<translation id="8808573423886751634">অধ্যায়</translation>
-<translation id="8845239796550121995">এখন আপনার TV তে কাস্ট করা হচ্ছে</translation>
-<translation id="8851136666856101339">প্রধান</translation>
-<translation id="8875657656876809964">ভিডিও প্লেব্যাকে সমস্যা</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> কেবি</translation>
-<translation id="8987927404178983737">মাস</translation>
-<translation id="901493112792887934">সেকেন্ডে বর্তমান সময়</translation>
-<translation id="901834265349196618">ইমেল আইডি</translation>
-<translation id="9048119486235211610">নেভিগেশন</translation>
-<translation id="9062295712474918030">দস্তাবেজ</translation>
-<translation id="9062307380734144336">প্লে পজ টগল করতে বেছে নিন</translation>
-<translation id="9093215626363556771">ছবির-মধ্যে-ছবি মোড থেকে বেরিয়ে আসুন</translation>
-<translation id="9108370397979208512">গণিত</translation>
-<translation id="9132465097189459683">অন্যান্য...</translation>
-<translation id="9138385573473225930">সতর্কতা</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" /> এ শুরু</translation>
-<translation id="916607977885256133">ছবির-মধ্যে-ছবি</translation>
-<translation id="9168329111483466115">ফুটনোট</translation>
-<translation id="954003015749068518">ছবির-মধ্যে-ছবি মোডে যান</translation>
-<translation id="966787709310836684">মেনু</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ca.xtb b/chromium/content/app/strings/translations/content_strings_ca.xtb
deleted file mode 100644
index e3716e60ad6..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ca.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ca">
-<translation id="1018939186200882850">element del menú</translation>
-<translation id="10623998915015855">botó de commutació</translation>
-<translation id="1088086359088493902">Segons</translation>
-<translation id="1171774979989969504">Introduïu una adreça electrònica.</translation>
-<translation id="1178581264944972037">Posa en pausa</translation>
-<translation id="1188858454923323853">complementari</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">control lliscant</translation>
-<translation id="1211441953136645838">nota final</translation>
-<translation id="1281252709823657822">quadre de diàleg</translation>
-<translation id="1335095011850992622">crèdits</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">bàner</translation>
-<translation id="1589122976691792535">regió</translation>
-<translation id="1591562245178063882">Aquest mes</translation>
-<translation id="1637811476055996098">Trieu els fitxers</translation>
-<translation id="1650423536718072820">citació extreta</translation>
-<translation id="1727886345390570319">amaga el menú de subtítols</translation>
-<translation id="1729654308190250600">Introduïu una adreça electrònica.</translation>
-<translation id="1758486001363313524">Altres...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">quadrícula d'arbre</translation>
-<translation id="1822429046913737220">a. m./p. m.</translation>
-<translation id="1832974991323546415">reprodueix al dispositiu remot</translation>
-<translation id="190587075670221089">supressió</translation>
-<translation id="1907737156431278478">exemple</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">estat</translation>
-<translation id="1938124657309484470">El valor ha de ser <ph name="MAXIMUM_DATE_OR_TIME" /> o anterior.</translation>
-<translation id="1946271899482435442">Mostra el selector de dates</translation>
-<translation id="1993104285338243655">S'ha canviat a projecció</translation>
-<translation id="2060505056492490888">"<ph name="DOT" />" s'ha utilitzat en una posició incorrecta a "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Avui</translation>
-<translation id="2158401438286456825">llista de pàgines</translation>
-<translation id="2226276347425096477">Escurceu aquest text a un màxim de <ph name="MAX_CHARACTERS" /> caràcters (ara n'esteu utilitzant <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="2246498165605549352">Fitxer local</translation>
-<translation id="2247351761944213033">Setmana <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Pista <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">casella de selecció</translation>
-<translation id="2311842470354187719">salt de pàgina</translation>
-<translation id="2335594187091864976">selector de data i hora</translation>
-<translation id="245932805758469625">nombre de segons restants del vídeo</translation>
-<translation id="248395913932153421">Dia</translation>
-<translation id="2507943997699731163">Empleneu aquest camp.</translation>
-<translation id="2508569020611168319">llista de pestanyes</translation>
-<translation id="2561842179657104141">mostra més controls multimèdia</translation>
-<translation id="2572483411312390101">reprodueix</translation>
-<translation id="2613802280814924224">Introduïu un valor vàlid. El valor vàlid més proper és <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Envia</translation>
-<translation id="2657045182931379222">objecte gràfic</translation>
-<translation id="2674318244760992338">peu</translation>
-<translation id="2709516037105925701">Emplenament automàtic</translation>
-<translation id="2723001399770238859">àudio</translation>
-<translation id="2746543609216772311">El valor ha de ser <ph name="MINIMUM_DATE_OR_TIME" /> o posterior.</translation>
-<translation id="2759744352195237655">botó emergent</translation>
-<translation id="2761667185364618470">Marqueu aquesta casella si voleu continuar.</translation>
-<translation id="2844350028562914727">detalls</translation>
-<translation id="2896972712917208084">grup de botons d'opció</translation>
-<translation id="2908441821576996758">Introduïu una llista d'adreces electròniques separades per comes.</translation>
-<translation id="2940813599313844715">objecte</translation>
-<translation id="2942448076852699108">contingut realçat</translation>
-<translation id="3040011195152428237">enllaç</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Introduïu un valor vàlid. El camp està incomplet o conté una data no vàlida.</translation>
-<translation id="3078740164268491126">taula</translation>
-<translation id="3086746722712840547">nota</translation>
-<translation id="310520048233152454">Introduïu un URL.</translation>
-<translation id="3175736971608411871">temporitzador</translation>
-<translation id="3199563858620722075">quadre combinat</translation>
-<translation id="3450233048674729344">El valor ha de ser més petit o igual que <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definició</translation>
-<translation id="3557673793733683882">capçalera <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selector setmanal</translation>
-<translation id="3685101356851116974">Imatge sense etiquetar</translation>
-<translation id="3706100364254443312">commutador</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Surt del mode de pantalla en pantalla</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">terme</translation>
-<translation id="3822383571486410024">Allargueu aquest text fins a un mínim de <ph name="MIN_CHARACTERS" /> caràcters (ara n'utilitzeu <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="383465348367842624">Un nom d'usuari seguit de "<ph name="ATSIGN" />" no pot contenir el símbol "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Surt de la pantalla completa</translation>
-<translation id="3920932319529768807">conclusió</translation>
-<translation id="3924558731517983934">aplicació</translation>
-<translation id="3944740393230681990">pròleg</translation>
-<translation id="3960700977367013758">barra de desplaçament</translation>
-<translation id="4103419683916926126">Mil·lisegons</translation>
-<translation id="4151657705144244502">gràfic</translation>
-<translation id="4160057747563657758">telèfon</translation>
-<translation id="4193965531860883258">preàmbul</translation>
-<translation id="4201051445878709314">Mostra el mes anterior</translation>
-<translation id="421884353938374759">selector de color</translation>
-<translation id="4248100235867064564">barra de menús</translation>
-<translation id="4360991593054037559">Introduïu un valor vàlid. Els valors vàlids més propers són <ph name="VALID_VALUE_LOW" /> i <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Preguntes</translation>
-<translation id="4413860115965805769">botó de menú</translation>
-<translation id="4444765639179266822">Sembla que diu "<ph name="OCR_TEXT" />"</translation>
-<translation id="4446524499724042288">referència del glossari</translation>
-<translation id="4522570452068850558">Detalls</translation>
-<translation id="4542388879936266156">temps restant: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulari</translation>
-<translation id="4661075872484491155">arbre</translation>
-<translation id="4664250907885839816">Un domini precedit per "<ph name="ATSIGN" />" no pot contenir el símbol "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">apèndix</translation>
-<translation id="4718048029184481307">S'està reproduint en mode de pantalla en pantalla</translation>
-<translation id="4742539557769756338">portada</translation>
-<translation id="4748357248530471599">activa o desactiva la pantalla completa al retall de pantalla</translation>
-<translation id="4757246831282535685">tauler de pestanyes</translation>
-<translation id="4763480195061959176">vídeo</translation>
-<translation id="479989351350248267">cerca</translation>
-<translation id="4812940957355064477">Introduïu un número.</translation>
-<translation id="4912536737030637138">entrada bibliogràfica</translation>
-<translation id="4975562563186953947">Elements seleccionats: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Deixa de silenciar</translation>
-<translation id="49969490063480558">Introduïu un domini precedit per "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" no és una adreça electrònica completa.</translation>
-<translation id="5034860022980953847">indicador de progrés</translation>
-<translation id="5090250355906949916">barra de moment del vídeo</translation>
-<translation id="5093189678851173835">epígraf</translation>
-<translation id="5117590920725113268">Mostra el mes següent</translation>
-<translation id="512758898067543763">capçalera de la fila</translation>
-<translation id="5143125788380636750">epíleg</translation>
-<translation id="5164977714490026579">El valor ha de ser més gran o igual que <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Introduïu un nom d'usuari seguit de "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" no és una adreça completa.</translation>
-<translation id="5334352251556557839">No s'ha pogut reproduir el contingut multimèdia.</translation>
-<translation id="5406322316791861025">figura</translation>
-<translation id="5453733299334684579">element de l'arbre</translation>
-<translation id="5466621249238537318">Seleccioneu un o diversos fitxers.</translation>
-<translation id="5468998798572797635">surt de la pantalla completa</translation>
-<translation id="5516424706154626233">selector de data</translation>
-<translation id="5537725057119320332">Emet</translation>
-<translation id="5546461542133609677">deixa de silenciar</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Fes doble toc a l'esquerra o a la dreta per saltar 10 s</translation>
-<translation id="5631759159893697722">resum</translation>
-<translation id="5643186887447432888">botó</translation>
-<translation id="5677946354068040947">més opcions</translation>
-<translation id="576709008726043716">introducció</translation>
-<translation id="57838592816432529">Silencia</translation>
-<translation id="5860033963881614850">Desactivat</translation>
-<translation id="588258955323874662">Pantalla completa</translation>
-<translation id="5888666972993069672">S'està emetent a <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">quadre de cerca</translation>
-<translation id="5939518447894949180">Restableix</translation>
-<translation id="5966707198760109579">Setmana</translation>
-<translation id="5987525920412732405">botó de selecció de valors</translation>
-<translation id="6011459053400940133">control lliscant de volum</translation>
-<translation id="6015796118275082299">Any</translation>
-<translation id="6023896073578205740">quadre de llista</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">comptador</translation>
-<translation id="6166809985690652833">cloenda</translation>
-<translation id="6209276755895393898">Sembla el següent: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glossari</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Surt del mode de pantalla en pantalla</translation>
-<translation id="6398862346408813489">Mostra el tauler de la selecció de mes</translation>
-<translation id="6404546809543547843">barra de moment de l'àudio</translation>
-<translation id="6443871981718447451">mostra el menú de subtítols</translation>
-<translation id="6453774872122745852">agraïments</translation>
-<translation id="648732519525291180">selector d'hora</translation>
-<translation id="6550675742724504774">Opcions</translation>
-<translation id="6572309429103589720">La gramàtica no és vàlida</translation>
-<translation id="658823671542763450">passa a pantalla completa</translation>
-<translation id="663493177488814956">El meu tauler</translation>
-<translation id="6637586476836377253">registre</translation>
-<translation id="6643016212128521049">Esborra</translation>
-<translation id="668171684555832681">Altres...</translation>
-<translation id="6692633176391053278">desplaçador</translation>
-<translation id="6709570249143506788">Mala qualitat de reproducció</translation>
-<translation id="6755330956360078551">descripció emergent</translation>
-<translation id="6790428901817661496">Reprodueix</translation>
-<translation id="6820355525329141109">El connector no s'ha pogut carregar.</translation>
-<translation id="6820615603175220800">referència bibliogràfica</translation>
-<translation id="6843725295806269523">silencia</translation>
-<translation id="6885760532393684712">directori</translation>
-<translation id="689129560213475294">colofó</translation>
-<translation id="6934078000481955284">cita en bloc</translation>
-<translation id="6941933287844615239">baixa els fitxers multimèdia</translation>
-<translation id="6981594929165378967">inserció</translation>
-<translation id="6989848892321993519">Allarga aquest text fins a <ph name="MIN_CHARACTERS" /> caràcters o més (ara n'utilitzes 1).</translation>
-<translation id="7033340931668032222">amunt i avall per canviar el volum</translation>
-<translation id="709897737746224366">Feu servir el format sol·licitat.</translation>
-<translation id="7118469954320184356">No hi ha cap descripció disponible.</translation>
-<translation id="7139483182332611405">prefaci</translation>
-<translation id="7214187073215825913">informació sobre el contingut</translation>
-<translation id="7263440858009898357">Seleccioneu un element de la llista.</translation>
-<translation id="727747134524199931">capçalera de columna</translation>
-<translation id="7320576522385648310">s'estan emmagatzemant dades a la memòria intermèdia</translation>
-<translation id="7353453495576941748">crèdit</translation>
-<translation id="7364796246159120393">Tria un fitxer</translation>
-<translation id="739024184232394898">Altres...</translation>
-<translation id="7405738980073107433">notes finals</translation>
-<translation id="7410239719251593705">Sembla que inclou contingut per a adults. No hi ha cap descripció disponible.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">pestanya</translation>
-<translation id="7514365320538308">Baixa</translation>
-<translation id="7529102961911894712">enllaç d'entrada</translation>
-<translation id="7533959249147584474">Gràfic sense etiqueta</translation>
-<translation id="7647456547678091388">consell</translation>
-<translation id="7661956066982048809">document gràfic</translation>
-<translation id="7673697353781729403">Hores</translation>
-<translation id="7681220483256441252">índex</translation>
-<translation id="7740050170769002709">Contingut HTML</translation>
-<translation id="7745230546936012372">Per obtenir les descripcions que falten de les imatges, obre el menú contextual.</translation>
-<translation id="7750228210027921155">Pantalla en pantalla</translation>
-<translation id="775297008183122718">Entrada no vàlida</translation>
-<translation id="7789962463072032349">posa en pausa</translation>
-<translation id="7802800022689234070">triangle desplegable</translation>
-<translation id="7888071071722539607">Incloeu el símbol "<ph name="ATSIGN" />" a l'adreça electrònica. Al camp "<ph name="INVALIDADDRESS" />" falta el símbol "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">divisor</translation>
-<translation id="795667975304826397">No s'ha triat cap fitxer</translation>
-<translation id="8053789581856978548">camp de text de la cerca</translation>
-<translation id="8057695513531652401">avís</translation>
-<translation id="8105797009065549151">referència de la nota</translation>
-<translation id="811583516810654505">S'està obtenint la descripció...</translation>
-<translation id="8117451130807776954">Aquesta setmana</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">selector de data i hora local</translation>
-<translation id="8261464734335370856">L'ortografia no és vàlida</translation>
-<translation id="8284326494547611709">Subtítols</translation>
-<translation id="835897206747267392">Valor no vàlid.</translation>
-<translation id="8403857369060869934">temps transcorregut: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">part</translation>
-<translation id="8433900881053900389">barra d'eines</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> fitxers</translation>
-<translation id="8451268428117625855">Seleccioneu un fitxer.</translation>
-<translation id="8461852803063341183">botó d'opció</translation>
-<translation id="8474886197722836894">dedicatòria</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minuts</translation>
-<translation id="8541249477527128034">control de mitjans</translation>
-<translation id="8550857728288566671">símbol gràfic</translation>
-<translation id="8583702881314752957">llista de definicions</translation>
-<translation id="8597182159515967513">capçalera</translation>
-<translation id="8603553056539299761">dreta i esquerra per avançar i retrocedir</translation>
-<translation id="860475260694818407">taula de continguts</translation>
-<translation id="8613126697340063924">reproducció amb comandament</translation>
-<translation id="862370744433916922">subtítol</translation>
-<translation id="8711688047404765493">sortida</translation>
-<translation id="8750798805984357768">Seleccioneu una d'aquestes opcions.</translation>
-<translation id="8808573423886751634">capítol</translation>
-<translation id="8845239796550121995">S'està emetent al televisor</translation>
-<translation id="8851136666856101339">principal</translation>
-<translation id="8875657656876809964">Error de reproducció del vídeo</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mes</translation>
-<translation id="901493112792887934">temps actual en segons</translation>
-<translation id="901834265349196618">correu electrònic</translation>
-<translation id="9048119486235211610">navegació</translation>
-<translation id="9062295712474918030">document</translation>
-<translation id="9062307380734144336">selecciona aquesta opció per commutar entre reproduir i posar en pausa</translation>
-<translation id="9093215626363556771">surt del mode de pantalla en pantalla</translation>
-<translation id="9108370397979208512">matemàtiques</translation>
-<translation id="9132465097189459683">Altres...</translation>
-<translation id="9138385573473225930">alerta</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, a partir del dia <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Pantalla en pantalla</translation>
-<translation id="9168329111483466115">nota al peu</translation>
-<translation id="954003015749068518">ves al mode de pantalla en pantalla</translation>
-<translation id="966787709310836684">menú</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_cs.xtb b/chromium/content/app/strings/translations/content_strings_cs.xtb
deleted file mode 100644
index 32a8ca99fc8..00000000000
--- a/chromium/content/app/strings/translations/content_strings_cs.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="cs">
-<translation id="1018939186200882850">položka nabídky</translation>
-<translation id="10623998915015855">přepínací tlačítko</translation>
-<translation id="1088086359088493902">Sekundy</translation>
-<translation id="1171774979989969504">Zadejte prosím e-mailovou adresu.</translation>
-<translation id="1178581264944972037">Pozastavit</translation>
-<translation id="1188858454923323853">doplňkové</translation>
-<translation id="1206619573307042055">běžící text</translation>
-<translation id="1206693055195146388">posuvník</translation>
-<translation id="1211441953136645838">koncová poznámka</translation>
-<translation id="1281252709823657822">dialogové okno</translation>
-<translation id="1335095011850992622">poděkování</translation>
-<translation id="1342835525016946179">čl</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">oblast</translation>
-<translation id="1591562245178063882">Tento měsíc</translation>
-<translation id="1637811476055996098">Zvolit soubory</translation>
-<translation id="1650423536718072820">citace</translation>
-<translation id="1727886345390570319">skrýt nabídku titulků</translation>
-<translation id="1729654308190250600">Vyplňte e-mailovou adresu.</translation>
-<translation id="1758486001363313524">Jiné…</translation>
-<translation id="1806710327868736751">dialog upozornění</translation>
-<translation id="1821985195704844674">stromová mřížka</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">přehrát ve vzdáleném zařízení</translation>
-<translation id="190587075670221089">smazání</translation>
-<translation id="1907737156431278478">příklad</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">stav</translation>
-<translation id="1938124657309484470">Datum musí být <ph name="MAXIMUM_DATE_OR_TIME" /> nebo dříve.</translation>
-<translation id="1946271899482435442">Zobrazit výběr data</translation>
-<translation id="1993104285338243655">Přepnuto na zrcadlení</translation>
-<translation id="2060505056492490888">Znak <ph name="DOT" /> v doméně <ph name="INVALIDDOMAIN" /> není použitý správně.</translation>
-<translation id="2148716181193084225">Dnes</translation>
-<translation id="2158401438286456825">seznam stránek</translation>
-<translation id="2226276347425096477">Zkraťte prosím tento text na <ph name="MAX_CHARACTERS" /> znaků nebo méně. (Aktuálně má <ph name="CURRENT_LENGTH" /> znaků.)</translation>
-<translation id="2246498165605549352">Místní soubor</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. týden, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Stopa <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">zaškrtávací políčko</translation>
-<translation id="2311842470354187719">konec stránky</translation>
-<translation id="2335594187091864976">výběr data a času</translation>
-<translation id="245932805758469625">zbývající čas videa v sekundách</translation>
-<translation id="248395913932153421">Den</translation>
-<translation id="2507943997699731163">Vyplňte prosím toto pole.</translation>
-<translation id="2508569020611168319">seznam karet</translation>
-<translation id="2561842179657104141">zobrazit více ovládacích prvků médií</translation>
-<translation id="2572483411312390101">přehrát</translation>
-<translation id="2613802280814924224">Zadejte platnou hodnotu. Nejbližší platná hodnota je <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Odeslat</translation>
-<translation id="2657045182931379222">grafický objekt</translation>
-<translation id="2674318244760992338">zápatí</translation>
-<translation id="2709516037105925701">Automatické vyplňování</translation>
-<translation id="2723001399770238859">zvuk</translation>
-<translation id="2746543609216772311">Datum musí být <ph name="MINIMUM_DATE_OR_TIME" /> nebo později.</translation>
-<translation id="2759744352195237655">tlačítko s vyskakovacím oknem</translation>
-<translation id="2761667185364618470">Chcete-li pokračovat, zaškrtněte toto políčko.</translation>
-<translation id="2844350028562914727">podrobnosti</translation>
-<translation id="2896972712917208084">skupina přepínačů</translation>
-<translation id="2908441821576996758">Zadejte seznam e-mailových adres oddělených čárkami.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">zvýrazněný obsah</translation>
-<translation id="3040011195152428237">odkaz</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Zadejte prosím platnou hodnotu. Pole obsahuje neúplnou hodnotu nebo neplatné datum.</translation>
-<translation id="3078740164268491126">tabulka</translation>
-<translation id="3086746722712840547">pozn</translation>
-<translation id="310520048233152454">Zadejte prosím adresu URL.</translation>
-<translation id="3175736971608411871">časovač</translation>
-<translation id="3199563858620722075">rozbalovací seznam</translation>
-<translation id="3450233048674729344">Hodnota musí být menší nebo rovna <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definice</translation>
-<translation id="3557673793733683882">nadpis <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">výběr týdne</translation>
-<translation id="3685101356851116974">Neoznačený obrázek</translation>
-<translation id="3706100364254443312">přepínač</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Ukončit režim obrazu v obraze</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">výraz</translation>
-<translation id="3822383571486410024">Prodlužte prosím tento text na <ph name="MIN_CHARACTERS" /> či více znaků. (Aktuálně má <ph name="CURRENT_LENGTH" /> znaků.)</translation>
-<translation id="383465348367842624">Část před znakem <ph name="ATSIGN" /> nesmí obsahovat znak <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="3846214748874656680">Ukončit režim na celou obrazovku</translation>
-<translation id="3920932319529768807">závěr</translation>
-<translation id="3924558731517983934">aplikace</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">posuvník</translation>
-<translation id="4103419683916926126">Milisekundy</translation>
-<translation id="4151657705144244502">obrázek</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">předmluva</translation>
-<translation id="4201051445878709314">Zobrazit předchozí měsíc</translation>
-<translation id="421884353938374759">výběr barev</translation>
-<translation id="4248100235867064564">panel nabídky</translation>
-<translation id="4360991593054037559">Zadejte platnou hodnotu. Dvě nejbližší hodnoty jsou <ph name="VALID_VALUE_LOW" /> a <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Dotazy</translation>
-<translation id="4413860115965805769">tlačítko nabídky</translation>
-<translation id="4444765639179266822">Vypadá jako: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">odkaz na glosář</translation>
-<translation id="4522570452068850558">Podrobnosti</translation>
-<translation id="4542388879936266156">zbývající čas: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulář</translation>
-<translation id="4661075872484491155">strom</translation>
-<translation id="4664250907885839816">Část za znakem <ph name="ATSIGN" /> nesmí obsahovat znak <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="4668956016107839909">příloha</translation>
-<translation id="4718048029184481307">Video se přehrává v režimu obrazu v obraze</translation>
-<translation id="4742539557769756338">titulní strana</translation>
-<translation id="4748357248530471599">přepnout výřez displeje na celou obrazovku</translation>
-<translation id="4757246831282535685">panel karty</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Zadejte prosím číslo.</translation>
-<translation id="4912536737030637138">bibliografická položka</translation>
-<translation id="4975562563186953947">Vybráno: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Zapnout zvuk</translation>
-<translation id="49969490063480558">Zadejte část za znakem <ph name="ATSIGN" />. Adresa <ph name="INVALIDADDRESS" /> není úplná.</translation>
-<translation id="5034860022980953847">indikátor průběhu</translation>
-<translation id="5090250355906949916">posuvník času videa</translation>
-<translation id="5093189678851173835">nápis</translation>
-<translation id="5117590920725113268">Zobrazit další měsíc</translation>
-<translation id="512758898067543763">záhlaví řádku</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Hodnota musí být větší nebo rovna <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Zadejte část před znakem <ph name="ATSIGN" />. Adresa <ph name="INVALIDADDRESS" /> není úplná.</translation>
-<translation id="5334352251556557839">Médium nelze přehrát.</translation>
-<translation id="5406322316791861025">číslice</translation>
-<translation id="5453733299334684579">položka stromu</translation>
-<translation id="5466621249238537318">Vyberte prosím jeden nebo více souborů.</translation>
-<translation id="5468998798572797635">ukončit režim celé obrazovky</translation>
-<translation id="5516424706154626233">výběr data</translation>
-<translation id="5537725057119320332">Odeslat</translation>
-<translation id="5546461542133609677">zapnout zvuk</translation>
-<translation id="561939826962581046">čas</translation>
-<translation id="5630795885300617244">Dvojitým klepnutím na šipku vlevo nebo vpravo přeskočíte o 10 s</translation>
-<translation id="5631759159893697722">abstrakt</translation>
-<translation id="5643186887447432888">tlačítko</translation>
-<translation id="5677946354068040947">další možnosti</translation>
-<translation id="576709008726043716">úvod</translation>
-<translation id="57838592816432529">Ztlumit</translation>
-<translation id="5860033963881614850">Vypnuto</translation>
-<translation id="588258955323874662">Celá obrazovka</translation>
-<translation id="5888666972993069672">Odesílání do zařízení <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">vyhledávací pole</translation>
-<translation id="5939518447894949180">Resetovat</translation>
-<translation id="5966707198760109579">Týden</translation>
-<translation id="5987525920412732405">číselník</translation>
-<translation id="6011459053400940133">posuvník hlasitosti</translation>
-<translation id="6015796118275082299">Rok</translation>
-<translation id="6023896073578205740">seznam</translation>
-<translation id="6150588977291308318">bibliografie</translation>
-<translation id="6164829606128959761">měřič</translation>
-<translation id="6166809985690652833">doslov</translation>
-<translation id="6209276755895393898">Vypadá jako: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosář</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Ukončit režim obrazu v obraze</translation>
-<translation id="6398862346408813489">Zobrazit panel pro výběr měsíců</translation>
-<translation id="6404546809543547843">posuvník času zvuku</translation>
-<translation id="6443871981718447451">zobrazit nabídku skrytých titulků</translation>
-<translation id="6453774872122745852">poděkování</translation>
-<translation id="648732519525291180">výběr času</translation>
-<translation id="6550675742724504774">Možnosti</translation>
-<translation id="6572309429103589720">Neplatná gramatika</translation>
-<translation id="658823671542763450">přejít do režimu celé obrazovky</translation>
-<translation id="663493177488814956">zdroj</translation>
-<translation id="6637586476836377253">protokol</translation>
-<translation id="6643016212128521049">Vymazat</translation>
-<translation id="668171684555832681">Další...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Špatná kvalita přehrávání</translation>
-<translation id="6755330956360078551">popisek</translation>
-<translation id="6790428901817661496">Přehrát</translation>
-<translation id="6820355525329141109">Plugin se nepodařilo načíst.</translation>
-<translation id="6820615603175220800">bibliografický odkaz</translation>
-<translation id="6843725295806269523">ztlumit</translation>
-<translation id="6885760532393684712">adresář</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">bloková citace</translation>
-<translation id="6941933287844615239">stáhnout média</translation>
-<translation id="6981594929165378967">vložení</translation>
-<translation id="6989848892321993519">Prodlužte prosím tento text na <ph name="MIN_CHARACTERS" /> či více znaků. (Aktuálně má 1 znak.)</translation>
-<translation id="7033340931668032222">směr nahoru a dolů slouží ke změně hlasitosti</translation>
-<translation id="709897737746224366">Zadejte hodnotu, která odpovídá požadovanému formátu.</translation>
-<translation id="7118469954320184356">Popis není k dispozici.</translation>
-<translation id="7139483182332611405">předmluva</translation>
-<translation id="7214187073215825913">informace o obsahu</translation>
-<translation id="7263440858009898357">Vyberte prosím v seznamu některou položku.</translation>
-<translation id="727747134524199931">záhlaví sloupce</translation>
-<translation id="7320576522385648310">načítání do vyrovnávací paměti</translation>
-<translation id="7353453495576941748">poděkování</translation>
-<translation id="7364796246159120393">Vybrat soubor</translation>
-<translation id="739024184232394898">Jiné…</translation>
-<translation id="7405738980073107433">koncové poznámky</translation>
-<translation id="7410239719251593705">Zřejmě zahrnuje obsah pro dospělé. Popis není k dispozici.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">karta</translation>
-<translation id="7514365320538308">Stáhnout</translation>
-<translation id="7529102961911894712">zpětný odkaz</translation>
-<translation id="7533959249147584474">Neoznačená grafika</translation>
-<translation id="7647456547678091388">tip</translation>
-<translation id="7661956066982048809">grafický dokument</translation>
-<translation id="7673697353781729403">Hodiny</translation>
-<translation id="7681220483256441252">rejstřík</translation>
-<translation id="7740050170769002709">Obsah ve formátu HTML</translation>
-<translation id="7745230546936012372">Chcete-li získat popisky obrázků, otevřete kontextovou nabídku.</translation>
-<translation id="7750228210027921155">Obraz v obraze</translation>
-<translation id="775297008183122718">Neplatný vstup</translation>
-<translation id="7789962463072032349">pozastavit</translation>
-<translation id="7802800022689234070">tlačítko k zobrazení skrytého obsahu</translation>
-<translation id="7888071071722539607">Do e-mailové adresy zahrňte znak <ph name="ATSIGN" />. V adrese <ph name="INVALIDADDRESS" /> chybí znak <ph name="ATSIGN" />.</translation>
-<translation id="7891486169920085145">rozdělovač</translation>
-<translation id="795667975304826397">Soubor nevybrán</translation>
-<translation id="8053789581856978548">pole pro vyhledání textu</translation>
-<translation id="8057695513531652401">oznámení</translation>
-<translation id="8105797009065549151">odkaz na poznámku</translation>
-<translation id="811583516810654505">Získávání popisu...</translation>
-<translation id="8117451130807776954">Tento týden</translation>
-<translation id="8199524924445686405">rrrr</translation>
-<translation id="8208673686607688524">výběr místního data a času</translation>
-<translation id="8261464734335370856">Neplatný pravopis</translation>
-<translation id="8284326494547611709">Titulky</translation>
-<translation id="835897206747267392">Neplatná hodnota.</translation>
-<translation id="8403857369060869934">uplynulý čas: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">část</translation>
-<translation id="8433900881053900389">lišta</translation>
-<translation id="8444882422881193423">Počet souborů: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Vyberte prosím soubor.</translation>
-<translation id="8461852803063341183">přepínač</translation>
-<translation id="8474886197722836894">věnování</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minuty</translation>
-<translation id="8541249477527128034">ovládání médií</translation>
-<translation id="8550857728288566671">grafický symbol</translation>
-<translation id="8583702881314752957">seznam definic</translation>
-<translation id="8597182159515967513">záhlaví</translation>
-<translation id="8603553056539299761">směr vlevo a vpravo slouží k vyhledávání</translation>
-<translation id="860475260694818407">obsah</translation>
-<translation id="8613126697340063924">ovládání vzdáleného přehrávání</translation>
-<translation id="862370744433916922">titulek</translation>
-<translation id="8711688047404765493">výstup</translation>
-<translation id="8750798805984357768">Vyberte jednu z těchto možností.</translation>
-<translation id="8808573423886751634">kapitola</translation>
-<translation id="8845239796550121995">Odesílání do televize</translation>
-<translation id="8851136666856101339">hlavní</translation>
-<translation id="8875657656876809964">Chyba přehrávání videa</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Měsíc</translation>
-<translation id="901493112792887934">aktuální čas v sekundách</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navigace</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">výběrem přepnete mezi přehráváním a pozastavením</translation>
-<translation id="9093215626363556771">ukončit režim obrazu v obraze</translation>
-<translation id="9108370397979208512">matematika</translation>
-<translation id="9132465097189459683">Jiné…</translation>
-<translation id="9138385573473225930">upozornění</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, začíná <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Obraz v obraze</translation>
-<translation id="9168329111483466115">poznámka pod čarou</translation>
-<translation id="954003015749068518">spustit režim obrazu v obraze</translation>
-<translation id="966787709310836684">nabídka</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_da.xtb b/chromium/content/app/strings/translations/content_strings_da.xtb
deleted file mode 100644
index 9972475dace..00000000000
--- a/chromium/content/app/strings/translations/content_strings_da.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="da">
-<translation id="1018939186200882850">menupunkt</translation>
-<translation id="10623998915015855">til/fra-knap</translation>
-<translation id="1088086359088493902">Sekunder</translation>
-<translation id="1171774979989969504">Angiv en mailadresse.</translation>
-<translation id="1178581264944972037">Pause</translation>
-<translation id="1188858454923323853">supplerende</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">skyder</translation>
-<translation id="1211441953136645838">slutnote</translation>
-<translation id="1281252709823657822">dialogboks</translation>
-<translation id="1335095011850992622">anerkendelser</translation>
-<translation id="1342835525016946179">artikel</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">område</translation>
-<translation id="1591562245178063882">Denne måned</translation>
-<translation id="1637811476055996098">Vælg filer</translation>
-<translation id="1650423536718072820">opmærksomhedsskabende citat</translation>
-<translation id="1727886345390570319">skjul menuen for undertekster</translation>
-<translation id="1729654308190250600">Angiv en mailadresse, der ikke er tom.</translation>
-<translation id="1758486001363313524">Andet...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">trægitter</translation>
-<translation id="1822429046913737220">f.m./e.m.</translation>
-<translation id="1832974991323546415">afspil på en enhed via fjernadgang</translation>
-<translation id="190587075670221089">sletning</translation>
-<translation id="1907737156431278478">eksempel</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Værdien må ikke være senere end <ph name="MAXIMUM_DATE_OR_TIME" />.</translation>
-<translation id="1946271899482435442">Vis datovælger</translation>
-<translation id="1993104285338243655">Ændret til spejling</translation>
-<translation id="2060505056492490888">"<ph name="DOT" />" er placeret forkert i "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">I dag</translation>
-<translation id="2158401438286456825">sideliste</translation>
-<translation id="2226276347425096477">Forkort denne tekst til <ph name="MAX_CHARACTERS" /> tegn eller færre (du bruger i øjeblikket <ph name="CURRENT_LENGTH" /> tegn).</translation>
-<translation id="2246498165605549352">Lokal fil</translation>
-<translation id="2247351761944213033">Uge <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Spor <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">afkrydsningsfelt</translation>
-<translation id="2311842470354187719">sideskift</translation>
-<translation id="2335594187091864976">dato- og tidsvælger</translation>
-<translation id="245932805758469625">antal sekunder tilbage af videoen</translation>
-<translation id="248395913932153421">Dag</translation>
-<translation id="2507943997699731163">Udfyld dette felt.</translation>
-<translation id="2508569020611168319">faneliste</translation>
-<translation id="2561842179657104141">vis flere knapper til mediestyring</translation>
-<translation id="2572483411312390101">afspil</translation>
-<translation id="2613802280814924224">Angiv en gyldig værdi. Den nærmeste gyldige værdi er <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Indsend</translation>
-<translation id="2657045182931379222">grafikobjekt</translation>
-<translation id="2674318244760992338">sidefod</translation>
-<translation id="2709516037105925701">AutoFyld</translation>
-<translation id="2723001399770238859">lyd</translation>
-<translation id="2746543609216772311">Værdien må ikke være tidligere end <ph name="MINIMUM_DATE_OR_TIME" />.</translation>
-<translation id="2759744352195237655">pop op-knap</translation>
-<translation id="2761667185364618470">Markér dette felt, hvis du vil fortsætte.</translation>
-<translation id="2844350028562914727">detaljer</translation>
-<translation id="2896972712917208084">gruppe af alternativknapper</translation>
-<translation id="2908441821576996758">Angiv en kommasepareret liste over mailadresser.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">fremhævet indhold</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Angiv en gyldig værdi. Feltet er ufuldstændigt eller har en ugyldig dato.</translation>
-<translation id="3078740164268491126">tabel</translation>
-<translation id="3086746722712840547">bmrk</translation>
-<translation id="310520048233152454">Angiv en webadresse.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">kombifelt</translation>
-<translation id="3450233048674729344">Værdien skal være mindre end eller lig med <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definition</translation>
-<translation id="3557673793733683882">overskrift <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">ugevælger</translation>
-<translation id="3685101356851116974">Billedet har ingen etiket</translation>
-<translation id="3706100364254443312">kontakt</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Afslut integreret billede</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">term</translation>
-<translation id="3822383571486410024">Forlæng denne tekst til <ph name="MIN_CHARACTERS" /> eller flere tegn (du bruger i øjeblikket <ph name="CURRENT_LENGTH" /> tegn).</translation>
-<translation id="383465348367842624">Den del, der kommer før "<ph name="ATSIGN" />", må ikke indeholde "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Afslut fuld skærm</translation>
-<translation id="3920932319529768807">konklusion</translation>
-<translation id="3924558731517983934">applikation</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">rullepanel</translation>
-<translation id="4103419683916926126">Millisekunder</translation>
-<translation id="4151657705144244502">grafik</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">forord</translation>
-<translation id="4201051445878709314">Vis den foregående måned</translation>
-<translation id="421884353938374759">farvevælger</translation>
-<translation id="4248100235867064564">menulinje</translation>
-<translation id="4360991593054037559">Angiv en gyldig værdi. De to nærmeste gyldige værdier er <ph name="VALID_VALUE_LOW" /> og <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Spørgsmål og svar</translation>
-<translation id="4413860115965805769">menuknap</translation>
-<translation id="4444765639179266822">Der lader til at stå: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">reference på ordliste</translation>
-<translation id="4522570452068850558">Detaljer</translation>
-<translation id="4542388879936266156">resterende tid: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formular</translation>
-<translation id="4661075872484491155">træ</translation>
-<translation id="4664250907885839816">Den del, der kommer efter "<ph name="ATSIGN" />", må ikke indeholde symbolet "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">bilag</translation>
-<translation id="4718048029184481307">Afspiller i integreret billede</translation>
-<translation id="4742539557769756338">forside</translation>
-<translation id="4748357248530471599">skift fra skærmhak til fuld skærm</translation>
-<translation id="4757246831282535685">fanepanel</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">søg</translation>
-<translation id="4812940957355064477">Angiv et nummer.</translation>
-<translation id="4912536737030637138">bibliografipost</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> er valgt</translation>
-<translation id="4992066212339426712">Slå lyden til</translation>
-<translation id="49969490063480558">Angiv den del, der kommer efter "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" er ufuldstændig.</translation>
-<translation id="5034860022980953847">statusindikator</translation>
-<translation id="5090250355906949916">afspilningsbjælke for video</translation>
-<translation id="5093189678851173835">motto</translation>
-<translation id="5117590920725113268">Vis næste måned</translation>
-<translation id="512758898067543763">rækkeoverskrift</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Værdien skal være større end eller lig med <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Angiv den del, der kommer før "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" er ufuldstændig.</translation>
-<translation id="5334352251556557839">Mediet kunne ikke afspilles.</translation>
-<translation id="5406322316791861025">tal</translation>
-<translation id="5453733299334684579">træelement</translation>
-<translation id="5466621249238537318">Vælg en eller flere filer.</translation>
-<translation id="5468998798572797635">afslut fuld skærm</translation>
-<translation id="5516424706154626233">datovælger</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">slå lyden til</translation>
-<translation id="561939826962581046">tidspunkt</translation>
-<translation id="5630795885300617244">Tryk to gange til venstre eller højre for at springe ti sekunder over</translation>
-<translation id="5631759159893697722">abstrakt</translation>
-<translation id="5643186887447432888">knap</translation>
-<translation id="5677946354068040947">flere valgmuligheder</translation>
-<translation id="576709008726043716">indledning</translation>
-<translation id="57838592816432529">Slå lyden fra</translation>
-<translation id="5860033963881614850">Fra</translation>
-<translation id="588258955323874662">Fuld skærm</translation>
-<translation id="5888666972993069672">Caster nu til <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">søgefelt</translation>
-<translation id="5939518447894949180">Nulstil</translation>
-<translation id="5966707198760109579">Uge</translation>
-<translation id="5987525920412732405">skalafelt</translation>
-<translation id="6011459053400940133">lydstyrkeskyder</translation>
-<translation id="6015796118275082299">År</translation>
-<translation id="6023896073578205740">listefelt</translation>
-<translation id="6150588977291308318">bibliografi</translation>
-<translation id="6164829606128959761">måler</translation>
-<translation id="6166809985690652833">efterskrift</translation>
-<translation id="6209276755895393898">Det lader til at være: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">ordliste</translation>
-<translation id="6281763101136022427">webadresse</translation>
-<translation id="6310801910862476708">Afslut integreret billede</translation>
-<translation id="6398862346408813489">Vis panel til valg af måned</translation>
-<translation id="6404546809543547843">afspilningsbjælke for lyd</translation>
-<translation id="6443871981718447451">vis menuen for undertekster</translation>
-<translation id="6453774872122745852">tak</translation>
-<translation id="648732519525291180">tidsvælger</translation>
-<translation id="6550675742724504774">Valgmuligheder</translation>
-<translation id="6572309429103589720">Ugyldig grammatik</translation>
-<translation id="658823671542763450">åbn fuld skærm</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Ryd</translation>
-<translation id="668171684555832681">Andre...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Dårlig afspilningskvalitet</translation>
-<translation id="6755330956360078551">værktøjstip</translation>
-<translation id="6790428901817661496">Afspil</translation>
-<translation id="6820355525329141109">Pluginnet kunne ikke indlæses.</translation>
-<translation id="6820615603175220800">reference i bibliografi</translation>
-<translation id="6843725295806269523">slå lyden fra</translation>
-<translation id="6885760532393684712">indeks</translation>
-<translation id="689129560213475294">slutskrift</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">download medier</translation>
-<translation id="6981594929165378967">indsættelse</translation>
-<translation id="6989848892321993519">Forlæng denne tekst til <ph name="MIN_CHARACTERS" /> eller flere tegn (du bruger i øjeblikket ét tegn).</translation>
-<translation id="7033340931668032222">op og ned for at justere lydstyrken</translation>
-<translation id="709897737746224366">Find et match til det anmodede format.</translation>
-<translation id="7118469954320184356">Der er ingen beskrivelse.</translation>
-<translation id="7139483182332611405">forord</translation>
-<translation id="7214187073215825913">oplysninger om indholdet</translation>
-<translation id="7263440858009898357">Vælg et punkt på listen.</translation>
-<translation id="727747134524199931">kolonneoverskrift</translation>
-<translation id="7320576522385648310">gemmer i buffer</translation>
-<translation id="7353453495576941748">anerkendelse</translation>
-<translation id="7364796246159120393">Vælg fil</translation>
-<translation id="739024184232394898">Andet...</translation>
-<translation id="7405738980073107433">slutnoter</translation>
-<translation id="7410239719251593705">Ser ud til at indeholde voksenindhold. Der er ingen tilgængelig beskrivelse.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">fane</translation>
-<translation id="7514365320538308">Download</translation>
-<translation id="7529102961911894712">backlink</translation>
-<translation id="7533959249147584474">Grafikken har ingen etiket</translation>
-<translation id="7647456547678091388">tip</translation>
-<translation id="7661956066982048809">grafikdokument</translation>
-<translation id="7673697353781729403">Timer</translation>
-<translation id="7681220483256441252">indeks</translation>
-<translation id="7740050170769002709">HTML-indhold</translation>
-<translation id="7745230546936012372">Åbn genvejsmenuen for at få beskrivelser til billeder, der mangler en beskrivelse.</translation>
-<translation id="7750228210027921155">Integreret billede</translation>
-<translation id="775297008183122718">Ugyldig indtastning</translation>
-<translation id="7789962463072032349">pause</translation>
-<translation id="7802800022689234070">Trekant til at vise eller skjule indhold</translation>
-<translation id="7888071071722539607">Mailadressen skal indeholde et "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" mangler et "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">splitter</translation>
-<translation id="795667975304826397">Der er ikke valgt nogen fil</translation>
-<translation id="8053789581856978548">tekstfelt til søgning</translation>
-<translation id="8057695513531652401">meddelelse</translation>
-<translation id="8105797009065549151">reference i noter</translation>
-<translation id="811583516810654505">Henter beskrivelsen...</translation>
-<translation id="8117451130807776954">Denne uge</translation>
-<translation id="8199524924445686405">åååå</translation>
-<translation id="8208673686607688524">lokal dato- og tidsvælger</translation>
-<translation id="8261464734335370856">Ugyldig stavning</translation>
-<translation id="8284326494547611709">Undertekster</translation>
-<translation id="835897206747267392">Ugyldig værdi.</translation>
-<translation id="8403857369060869934">forløbet tid: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">del</translation>
-<translation id="8433900881053900389">værktøjslinje</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> filer</translation>
-<translation id="8451268428117625855">Vælg en fil.</translation>
-<translation id="8461852803063341183">alternativknap</translation>
-<translation id="8474886197722836894">dedikation</translation>
-<translation id="8531739829932800271">rettelser</translation>
-<translation id="8534579021159131403">Minutter</translation>
-<translation id="8541249477527128034">mediekontrol</translation>
-<translation id="8550857728288566671">grafiksymbol</translation>
-<translation id="8583702881314752957">liste over definitioner</translation>
-<translation id="8597182159515967513">overskrift</translation>
-<translation id="8603553056539299761">venstre og højre for at søge</translation>
-<translation id="860475260694818407">indholdsfortegnelse</translation>
-<translation id="8613126697340063924">kontrollér afspilning via fjernadgang</translation>
-<translation id="862370744433916922">undertitel</translation>
-<translation id="8711688047404765493">output</translation>
-<translation id="8750798805984357768">Vælg en af disse muligheder.</translation>
-<translation id="8808573423886751634">kapitel</translation>
-<translation id="8845239796550121995">Caster nu til dit fjernsyn</translation>
-<translation id="8851136666856101339">hovd</translation>
-<translation id="8875657656876809964">Fejl under videoafspilning</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Måned</translation>
-<translation id="901493112792887934">aktuel tid i sekunder</translation>
-<translation id="901834265349196618">mail</translation>
-<translation id="9048119486235211610">navigation</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">vælg for at aktivere eller deaktivere afspil sæt på pause</translation>
-<translation id="9093215626363556771">afslut integreret billede</translation>
-<translation id="9108370397979208512">matematik</translation>
-<translation id="9132465097189459683">Andet...</translation>
-<translation id="9138385573473225930">underretning</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, med start <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Integreret billede</translation>
-<translation id="9168329111483466115">fodnote</translation>
-<translation id="954003015749068518">start integreret billede</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_de.xtb b/chromium/content/app/strings/translations/content_strings_de.xtb
deleted file mode 100644
index 804577930ae..00000000000
--- a/chromium/content/app/strings/translations/content_strings_de.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="de">
-<translation id="1018939186200882850">Menüpunkt</translation>
-<translation id="10623998915015855">Schaltfläche zum Umschalten</translation>
-<translation id="1088086359088493902">Sekunden</translation>
-<translation id="1171774979989969504">Geben Sie eine E-Mail-Adresse ein.</translation>
-<translation id="1178581264944972037">Anhalten</translation>
-<translation id="1188858454923323853">ergänzend</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">Schieberegler</translation>
-<translation id="1211441953136645838">Endnote</translation>
-<translation id="1281252709823657822">Kleines Fenster</translation>
-<translation id="1335095011850992622">Mitwirkende</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">Banner</translation>
-<translation id="1589122976691792535">Region</translation>
-<translation id="1591562245178063882">Aktueller Monat</translation>
-<translation id="1637811476055996098">Dateien auswählen</translation>
-<translation id="1650423536718072820">Textzitat</translation>
-<translation id="1727886345390570319">Untertitelmenü ausblenden</translation>
-<translation id="1729654308190250600">Geben Sie eine E-Mail-Adresse ein.</translation>
-<translation id="1758486001363313524">Andere...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">Baumraster</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">auf Remote-Gerät wiedergeben</translation>
-<translation id="190587075670221089">Löschen</translation>
-<translation id="1907737156431278478">Beispiel</translation>
-<translation id="1921819250265091946">tt</translation>
-<translation id="1930711995431081526">Status</translation>
-<translation id="1938124657309484470">Verwenden Sie <ph name="MAXIMUM_DATE_OR_TIME" /> oder einen früheren Wert.</translation>
-<translation id="1946271899482435442">Datumsauswahl anzeigen</translation>
-<translation id="1993104285338243655">Zu 1:1-Wiedergabe gewechselt</translation>
-<translation id="2060505056492490888">Das Punktzeichen "<ph name="DOT" />" steht in "<ph name="INVALIDDOMAIN" />" an einer falschen Stelle.</translation>
-<translation id="2148716181193084225">Heute</translation>
-<translation id="2158401438286456825">Seitenliste</translation>
-<translation id="2226276347425096477">Kürzen Sie diesen Text auf max. <ph name="MAX_CHARACTERS" /> Zeichen. Zurzeit verwenden Sie <ph name="CURRENT_LENGTH" /> Zeichen.</translation>
-<translation id="2246498165605549352">Lokale Datei</translation>
-<translation id="2247351761944213033">Woche <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Titel <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">Kästchen</translation>
-<translation id="2311842470354187719">Seitenumbruch</translation>
-<translation id="2335594187091864976">Datums- und Uhrzeitauswahl</translation>
-<translation id="245932805758469625">verbleibende Videozeit in Sekunden</translation>
-<translation id="248395913932153421">Tag</translation>
-<translation id="2507943997699731163">Füllen Sie dieses Feld aus.</translation>
-<translation id="2508569020611168319">Tabliste</translation>
-<translation id="2561842179657104141">weitere Mediensteuerelemente anzeigen</translation>
-<translation id="2572483411312390101">Wiedergeben</translation>
-<translation id="2613802280814924224">Geben Sie einen gültigen Wert ein. Der nächstliegende gültige Wert ist <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Senden</translation>
-<translation id="2657045182931379222">Grafikobjekt</translation>
-<translation id="2674318244760992338">Fußzeile</translation>
-<translation id="2709516037105925701">AutoFill</translation>
-<translation id="2723001399770238859">Audio</translation>
-<translation id="2746543609216772311">Verwenden Sie <ph name="MINIMUM_DATE_OR_TIME" /> oder einen späteren Wert.</translation>
-<translation id="2759744352195237655">Pop-up-Schaltfläche</translation>
-<translation id="2761667185364618470">Klicken Sie dieses Kästchen an, wenn Sie fortfahren möchten.</translation>
-<translation id="2844350028562914727">Details</translation>
-<translation id="2896972712917208084">Optionsfeldgruppe</translation>
-<translation id="2908441821576996758">Geben Sie eine durch Kommas getrennte Liste der E-Mail-Adressen ein.</translation>
-<translation id="2940813599313844715">Objekt</translation>
-<translation id="2942448076852699108">markierte Inhalte</translation>
-<translation id="3040011195152428237">Link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Geben Sie einen gültigen Wert ein. Das Feld ist nicht vollständig oder enthält ein ungültiges Datum.</translation>
-<translation id="3078740164268491126">Tabelle</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Geben Sie eine URL ein.</translation>
-<translation id="3175736971608411871">Timer</translation>
-<translation id="3199563858620722075">Kombinationsfeld</translation>
-<translation id="3450233048674729344">Wert muss kleiner als oder gleich <ph name="MAXIMUM" /> sein.</translation>
-<translation id="3486220673238053218">Definition</translation>
-<translation id="3557673793733683882">Überschrift <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">Wochenauswahl</translation>
-<translation id="3685101356851116974">Bild ohne Label</translation>
-<translation id="3706100364254443312">wechseln</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Bild-im-Bild-Modus beenden</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">Begriff</translation>
-<translation id="3822383571486410024">Verlängern Sie diesen Text auf mindestens <ph name="MIN_CHARACTERS" /> Zeichen. Derzeit verwenden Sie <ph name="CURRENT_LENGTH" /> Zeichen.</translation>
-<translation id="383465348367842624">Vor dem <ph name="ATSIGN" />-Zeichen darf das Zeichen "<ph name="INVALIDCHARACTER" />" nicht verwendet werden.</translation>
-<translation id="3846214748874656680">Vollbildmodus beenden</translation>
-<translation id="3920932319529768807">Fazit</translation>
-<translation id="3924558731517983934">Anwendung</translation>
-<translation id="3944740393230681990">Prolog</translation>
-<translation id="3960700977367013758">Bildlaufleiste</translation>
-<translation id="4103419683916926126">Millisekunden</translation>
-<translation id="4151657705144244502">Grafik</translation>
-<translation id="4160057747563657758">Telefonnummer</translation>
-<translation id="4193965531860883258">Vorwort</translation>
-<translation id="4201051445878709314">Vorherigen Monat anzeigen</translation>
-<translation id="421884353938374759">color picker</translation>
-<translation id="4248100235867064564">Menüleiste</translation>
-<translation id="4360991593054037559">Geben Sie einen gültigen Wert ein. Die zwei nächstliegenden gültigen Werte sind <ph name="VALID_VALUE_LOW" /> und <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Fragen und Antworten</translation>
-<translation id="4413860115965805769">Menüschaltfläche</translation>
-<translation id="4444765639179266822">Es sieht aus wie: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">Glossarreferenz</translation>
-<translation id="4522570452068850558">Details</translation>
-<translation id="4542388879936266156">verbleibende Zeit: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">Formular</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Nach dem <ph name="ATSIGN" />-Zeichen darf das Zeichen "<ph name="INVALIDCHARACTER" />" nicht verwendet werden.</translation>
-<translation id="4668956016107839909">Anhang</translation>
-<translation id="4718048029184481307">Wird im Bild-im-Bild-Modus abgespielt</translation>
-<translation id="4742539557769756338">Titelseite</translation>
-<translation id="4748357248530471599">Vollbildmodus mit Display-Aussparung ein-/ausschalten</translation>
-<translation id="4757246831282535685">Tabsteuerfeld</translation>
-<translation id="4763480195061959176">Video</translation>
-<translation id="479989351350248267">Suchen</translation>
-<translation id="4812940957355064477">Geben Sie eine Nummer ein.</translation>
-<translation id="4912536737030637138">Bibliografieeintrag</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> ausgewählt</translation>
-<translation id="4992066212339426712">Stummschaltung aufheben</translation>
-<translation id="49969490063480558">Geben Sie etwas nach dem <ph name="ATSIGN" />-Zeichen ein. Die Angabe "<ph name="INVALIDADDRESS" />" ist unvollständig.</translation>
-<translation id="5034860022980953847">Fortschrittsanzeige</translation>
-<translation id="5090250355906949916">Video-Zeitachse</translation>
-<translation id="5093189678851173835">Motto</translation>
-<translation id="5117590920725113268">Nächsten Monat anzeigen</translation>
-<translation id="512758898067543763">Zeilenüberschrift</translation>
-<translation id="5143125788380636750">Epilog</translation>
-<translation id="5164977714490026579">Wert muss größer als oder gleich <ph name="MINIMUM" /> sein.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Geben Sie etwas vor dem <ph name="ATSIGN" />-Zeichen ein. Die Angabe "<ph name="INVALIDADDRESS" />" ist unvollständig.</translation>
-<translation id="5334352251556557839">Medien können nicht abgespielt werden.</translation>
-<translation id="5406322316791861025">Zahl</translation>
-<translation id="5453733299334684579">Baumelement</translation>
-<translation id="5466621249238537318">Wählen Sie eine oder mehrere Dateien aus.</translation>
-<translation id="5468998798572797635">Vollbildmodus beenden</translation>
-<translation id="5516424706154626233">Datumsauswahl</translation>
-<translation id="5537725057119320332">Übertragen</translation>
-<translation id="5546461542133609677">Ton an</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Tippen Sie links oder rechts doppelt, um 10 s zu überspringen</translation>
-<translation id="5631759159893697722">Zusammenfassung</translation>
-<translation id="5643186887447432888">Schaltfläche</translation>
-<translation id="5677946354068040947">weitere Optionen</translation>
-<translation id="576709008726043716">Einleitung</translation>
-<translation id="57838592816432529">Stummschalten</translation>
-<translation id="5860033963881614850">Aus</translation>
-<translation id="588258955323874662">Vollbild</translation>
-<translation id="5888666972993069672">Wird gerade auf <ph name="DEVICE_FRIENDLY_NAME" /> gestreamt</translation>
-<translation id="591047860372322273">Suchfeld</translation>
-<translation id="5939518447894949180">Zurücksetzen</translation>
-<translation id="5966707198760109579">Woche</translation>
-<translation id="5987525920412732405">Drehfeld</translation>
-<translation id="6011459053400940133">Schieberegler für die Lautstärke</translation>
-<translation id="6015796118275082299">Jahr</translation>
-<translation id="6023896073578205740">Listenfeld</translation>
-<translation id="6150588977291308318">Bibliografie</translation>
-<translation id="6164829606128959761">Messinstrument</translation>
-<translation id="6166809985690652833">Nachwort</translation>
-<translation id="6209276755895393898">Anscheinend ist es: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">Glossar</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Bild-im-Bild-Modus beenden</translation>
-<translation id="6398862346408813489">Auswahlbereich für Monatsanzeige</translation>
-<translation id="6404546809543547843">Audio-Zeitachse</translation>
-<translation id="6443871981718447451">Untertitelmenü einblenden</translation>
-<translation id="6453774872122745852">Danksagung</translation>
-<translation id="648732519525291180">Uhrzeitauswahl</translation>
-<translation id="6550675742724504774">Optionen</translation>
-<translation id="6572309429103589720">Ungültige Grammatik</translation>
-<translation id="658823671542763450">Vollbildmodus aktivieren</translation>
-<translation id="663493177488814956">Feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Löschen</translation>
-<translation id="668171684555832681">Andere...</translation>
-<translation id="6692633176391053278">Stepper</translation>
-<translation id="6709570249143506788">Schlechte Wiedergabequalität</translation>
-<translation id="6755330956360078551">Kurzinfo</translation>
-<translation id="6790428901817661496">Wiedergabe</translation>
-<translation id="6820355525329141109">Plug-in konnte nicht geladen werden.</translation>
-<translation id="6820615603175220800">Bibliografiereferenz</translation>
-<translation id="6843725295806269523">Stumm</translation>
-<translation id="6885760532393684712">Verzeichnis</translation>
-<translation id="689129560213475294">Kolophon</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">Medien herunterladen</translation>
-<translation id="6981594929165378967">Einfügen</translation>
-<translation id="6989848892321993519">Verlängern Sie diesen Text auf mindestens <ph name="MIN_CHARACTERS" /> Zeichen. Derzeit verwenden Sie 1 Zeichen.</translation>
-<translation id="7033340931668032222">oben und unten zum Ändern der Lautstärke</translation>
-<translation id="709897737746224366">Ihre Eingabe muss mit dem geforderten Format übereinstimmen.</translation>
-<translation id="7118469954320184356">Keine Beschreibung verfügbar.</translation>
-<translation id="7139483182332611405">Vorbemerkung</translation>
-<translation id="7214187073215825913">Informationen zum Inhalt</translation>
-<translation id="7263440858009898357">Wählen Sie ein Element in der Liste aus.</translation>
-<translation id="727747134524199931">Spaltenüberschrift</translation>
-<translation id="7320576522385648310">Wird zwischengespeichert</translation>
-<translation id="7353453495576941748">Danksagung</translation>
-<translation id="7364796246159120393">Datei auswählen</translation>
-<translation id="739024184232394898">Andere...</translation>
-<translation id="7405738980073107433">Endnoten</translation>
-<translation id="7410239719251593705">Enthält offenbar Inhalte nur für Erwachsene. Keine Beschreibung verfügbar.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Herunterladen</translation>
-<translation id="7529102961911894712">Rückverweis</translation>
-<translation id="7533959249147584474">Grafik ohne Label</translation>
-<translation id="7647456547678091388">Tipp</translation>
-<translation id="7661956066982048809">Grafikdokument</translation>
-<translation id="7673697353781729403">Stunden</translation>
-<translation id="7681220483256441252">Index</translation>
-<translation id="7740050170769002709">HTML-Inhalte</translation>
-<translation id="7745230546936012372">Wenn Sie fehlende Bildbeschreibungen abrufen möchten, öffnen Sie das Kontextmenü.</translation>
-<translation id="7750228210027921155">Bild-in-Bild</translation>
-<translation id="775297008183122718">Ungültiger Eintrag</translation>
-<translation id="7789962463072032349">Pausieren</translation>
-<translation id="7802800022689234070">Aufklappdreieck</translation>
-<translation id="7888071071722539607">Die E-Mail-Adresse muss ein <ph name="ATSIGN" />-Zeichen enthalten. In der Angabe "<ph name="INVALIDADDRESS" />" fehlt ein <ph name="ATSIGN" />-Zeichen.</translation>
-<translation id="7891486169920085145">Teilungsfunktion</translation>
-<translation id="795667975304826397">Keine ausgewählt</translation>
-<translation id="8053789581856978548">Feld für den Suchtext</translation>
-<translation id="8057695513531652401">Bemerkung</translation>
-<translation id="8105797009065549151">Hinweisreferenz</translation>
-<translation id="811583516810654505">Beschreibung wird abgerufen…</translation>
-<translation id="8117451130807776954">Diese Woche</translation>
-<translation id="8199524924445686405">jjjj</translation>
-<translation id="8208673686607688524">lokale Datums- und Uhrzeitauswahl</translation>
-<translation id="8261464734335370856">Ungültige Schreibweise</translation>
-<translation id="8284326494547611709">Untertitel</translation>
-<translation id="835897206747267392">Ungültiger Wert.</translation>
-<translation id="8403857369060869934">verstrichene Zeit: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">Teil</translation>
-<translation id="8433900881053900389">Symbolleiste</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> Dateien</translation>
-<translation id="8451268428117625855">Wählen Sie eine Datei aus.</translation>
-<translation id="8461852803063341183">Optionsfeld</translation>
-<translation id="8474886197722836894">Widmung</translation>
-<translation id="8531739829932800271">Druckfehler</translation>
-<translation id="8534579021159131403">Minuten</translation>
-<translation id="8541249477527128034">Mediensteuerung</translation>
-<translation id="8550857728288566671">Grafiksymbol</translation>
-<translation id="8583702881314752957">Definitionsliste</translation>
-<translation id="8597182159515967513">Kopfzeile</translation>
-<translation id="8603553056539299761">links und rechts zum Suchen</translation>
-<translation id="860475260694818407">Inhaltsverzeichnis</translation>
-<translation id="8613126697340063924">Remote-Wiedergabe steuern</translation>
-<translation id="862370744433916922">Untertitel</translation>
-<translation id="8711688047404765493">Ausgang</translation>
-<translation id="8750798805984357768">Wählen Sie eine dieser Optionen aus.</translation>
-<translation id="8808573423886751634">Kapitel</translation>
-<translation id="8845239796550121995">Wird gerade auf Ihren Fernseher gestreamt</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Videowiedergabefehler</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Monat</translation>
-<translation id="901493112792887934">Aktuelle Dauer in Sekunden</translation>
-<translation id="901834265349196618">E-Mail</translation>
-<translation id="9048119486235211610">Navigation</translation>
-<translation id="9062295712474918030">Dokument</translation>
-<translation id="9062307380734144336">Auswählen, um zwischen Wiedergabe und Pause zu wechseln</translation>
-<translation id="9093215626363556771">Bild-im-Bild-Modus beenden</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Andere...</translation>
-<translation id="9138385573473225930">Benachrichtigung</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> ab dem <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Bild-in-Bild</translation>
-<translation id="9168329111483466115">Fußnote</translation>
-<translation id="954003015749068518">Bild-im-Bild-Modus aktivieren</translation>
-<translation id="966787709310836684">Menü</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_el.xtb b/chromium/content/app/strings/translations/content_strings_el.xtb
deleted file mode 100644
index 2b88ed2ab32..00000000000
--- a/chromium/content/app/strings/translations/content_strings_el.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="el">
-<translation id="1018939186200882850">στοιχείο μενού</translation>
-<translation id="10623998915015855">κουμπί εναλλαγής</translation>
-<translation id="1088086359088493902">Δευτερόλεπτα</translation>
-<translation id="1171774979989969504">Εισαγάγετε μια διεύθυνση ηλεκτρονικού ταχυδρομείου.</translation>
-<translation id="1178581264944972037">Παύση</translation>
-<translation id="1188858454923323853">συμπληρωματικό</translation>
-<translation id="1206619573307042055">μαρκίζα</translation>
-<translation id="1206693055195146388">ρυθμιστικό</translation>
-<translation id="1211441953136645838">σημείωση τέλους</translation>
-<translation id="1281252709823657822">παράθυρο διαλόγου</translation>
-<translation id="1335095011850992622">συντελεστές</translation>
-<translation id="1342835525016946179">άρθρο</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">περιοχή</translation>
-<translation id="1591562245178063882">Αυτόν το μήνα</translation>
-<translation id="1637811476055996098">Επιλογή αρχείων</translation>
-<translation id="1650423536718072820">ελκυστική φράση</translation>
-<translation id="1727886345390570319">απόκρυψη μενού υποτίτλων</translation>
-<translation id="1729654308190250600">Καταχωρίστε μια διεύθυνση ηλεκτρονικού ταχυδρομείου.</translation>
-<translation id="1758486001363313524">Άλλες…</translation>
-<translation id="1806710327868736751">παράθυρο διαλόγου ειδοποιήσεων</translation>
-<translation id="1821985195704844674">πλέγμα δέντρου</translation>
-<translation id="1822429046913737220">Π.Μ./Μ.Μ.</translation>
-<translation id="1832974991323546415">αναπαραγωγή σε απομακρυσμένη συσκευή</translation>
-<translation id="190587075670221089">διαγραφή</translation>
-<translation id="1907737156431278478">παράδειγμα</translation>
-<translation id="1921819250265091946">ηη</translation>
-<translation id="1930711995431081526">κατάσταση</translation>
-<translation id="1938124657309484470">Η τιμή πρέπει να είναι <ph name="MAXIMUM_DATE_OR_TIME" /> ή προγενέστερη.</translation>
-<translation id="1946271899482435442">Εμφάνιση εργαλείου επιλογής ημερομηνίας</translation>
-<translation id="1993104285338243655">Εναλλαγή σε κατοπτρισμό</translation>
-<translation id="2060505056492490888">Το σύμβολο "<ph name="DOT" />" χρησιμοποιείται σε λάθος θέση στη διεύθυνση "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Σήμερα</translation>
-<translation id="2158401438286456825">λίστα σελίδων</translation>
-<translation id="2226276347425096477">Κάντε πιο σύντομο αυτό το κείμενο ώστε να έχει το πολύ <ph name="MAX_CHARACTERS" /> χαρακτήρες (αυτήν τη στιγμή χρησιμοποιείτε <ph name="CURRENT_LENGTH" /> χαρακτήρες).</translation>
-<translation id="2246498165605549352">Τοπικό αρχείο</translation>
-<translation id="2247351761944213033">Εβδομάδα <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Κομμάτι <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">πλαίσιο ελέγχου</translation>
-<translation id="2311842470354187719">αλλαγή σελίδας</translation>
-<translation id="2335594187091864976">εργαλείο επιλογής ημερομηνίας και ώρας</translation>
-<translation id="245932805758469625">χρόνος που απομένει από το βίντεο σε δευτερόλεπτα</translation>
-<translation id="248395913932153421">Ημέρα</translation>
-<translation id="2507943997699731163">Συμπληρώστε αυτό το πεδίο.</translation>
-<translation id="2508569020611168319">λίστα καρτελών</translation>
-<translation id="2561842179657104141">εμφάνιση περισσότερων στοιχείων ελέγχου μέσων</translation>
-<translation id="2572483411312390101">αναπαραγωγή</translation>
-<translation id="2613802280814924224">Καταχωρίστε μια έγκυρη τιμή. Η κοντινότερη έγκυρη τιμή είναι <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Υποβολή</translation>
-<translation id="2657045182931379222">αντικείμενο γραφικών</translation>
-<translation id="2674318244760992338">υποσέλιδο</translation>
-<translation id="2709516037105925701">Αυτόματη συμπλήρωση</translation>
-<translation id="2723001399770238859">ήχος</translation>
-<translation id="2746543609216772311">Η τιμή πρέπει να είναι <ph name="MINIMUM_DATE_OR_TIME" /> ή μεταγενέστερη.</translation>
-<translation id="2759744352195237655">αναδυόμενο κουμπί</translation>
-<translation id="2761667185364618470">Αν θέλετε να συνεχίσετε, επιλέξτε αυτό το πλαίσιο.</translation>
-<translation id="2844350028562914727">λεπτομέρειες</translation>
-<translation id="2896972712917208084">ομάδα κουμπιών επιλογής</translation>
-<translation id="2908441821576996758">Εισαγάγετε μια λίστα διευθύνσεων ηλεκτρονικού ταχυδρομείου διαχωρισμένη με κόμματα.</translation>
-<translation id="2940813599313844715">αντικείμενο</translation>
-<translation id="2942448076852699108">επισημασμένο περιεχόμενο</translation>
-<translation id="3040011195152428237">σύνδεσμος</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Καταχωρίστε μια έγκυρη τιμή. Το πεδίο είναι ελλιπές ή περιέχει μη έγκυρη ημερομηνία.</translation>
-<translation id="3078740164268491126">πίνακας</translation>
-<translation id="3086746722712840547">σημείωση</translation>
-<translation id="310520048233152454">Εισαγάγετε μια διεύθυνση URL.</translation>
-<translation id="3175736971608411871">χρονόμετρο</translation>
-<translation id="3199563858620722075">σύνθετο πλαίσιο</translation>
-<translation id="3450233048674729344">Η τιμή πρέπει να είναι μικρότερη ή ίση του <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">ορισμός</translation>
-<translation id="3557673793733683882">επικεφαλίδα <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">επιλογέας εβδομάδας</translation>
-<translation id="3685101356851116974">Εικόνα χωρίς ετικέτα</translation>
-<translation id="3706100364254443312">εναλλαγή</translation>
-<translation id="3732799496749320381">μμ</translation>
-<translation id="3754210790023674521">Έξοδος από τη λειτουργία picture-in-picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">όρος</translation>
-<translation id="3822383571486410024">Αυξήστε την έκταση αυτού του κειμένου στους <ph name="MIN_CHARACTERS" /> χαρακτήρες ή περισσότερο (αυτήν τη στιγμή χρησιμοποιείτε <ph name="CURRENT_LENGTH" /> χαρακτήρες).</translation>
-<translation id="383465348367842624">Το τμήμα της διεύθυνσης πριν το σύμβολο "<ph name="ATSIGN" />" δεν πρέπει να περιέχει το σύμβολο "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Έξοδος από πλήρη οθόνη</translation>
-<translation id="3920932319529768807">συμπέρασμα</translation>
-<translation id="3924558731517983934">εφαρμογή</translation>
-<translation id="3944740393230681990">πρόλογος</translation>
-<translation id="3960700977367013758">γραμμή κύλισης</translation>
-<translation id="4103419683916926126">Χιλιοστά του δευτερολέπτου</translation>
-<translation id="4151657705144244502">γραφικό</translation>
-<translation id="4160057747563657758">τηλέφωνο</translation>
-<translation id="4193965531860883258">εισαγωγή</translation>
-<translation id="4201051445878709314">Εμφάνιση προηγούμενου μήνα</translation>
-<translation id="421884353938374759">επιλογέας χρώματος</translation>
-<translation id="4248100235867064564">γραμμή μενού</translation>
-<translation id="4360991593054037559">Καταχωρίστε μια έγκυρη τιμή. Οι δύο πιο κοντινές έγκυρες τιμές είναι <ph name="VALID_VALUE_LOW" /> και <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Ερωτήσεις και απαντήσεις</translation>
-<translation id="4413860115965805769">κουμπί μενού</translation>
-<translation id="4444765639179266822">Φαίνεται πως λέει: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">αναφορά στο γλωσσάρι</translation>
-<translation id="4522570452068850558">Λεπτομέρειες</translation>
-<translation id="4542388879936266156">χρόνος που απομένει: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">φόρμα</translation>
-<translation id="4661075872484491155">δέντρο</translation>
-<translation id="4664250907885839816">Το τμήμα της διεύθυνσης μετά το σύμβολο "<ph name="ATSIGN" />" δεν πρέπει να περιέχει το σύμβολο "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">παράρτημα</translation>
-<translation id="4718048029184481307">Αναπαραγωγή σε λειτουργία picture-in-picture</translation>
-<translation id="4742539557769756338">εξώφυλλο</translation>
-<translation id="4748357248530471599">εναλλαγή πλήρους οθόνης εγκοπής οθόνης</translation>
-<translation id="4757246831282535685">παράθυρο καρτέλας</translation>
-<translation id="4763480195061959176">βίντεο</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Εισαγάγετε έναν αριθμό.</translation>
-<translation id="4912536737030637138">βιβλιογραφική καταχώριση</translation>
-<translation id="4975562563186953947">Επιλέχτηκαν <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Κατάργηση σίγασης</translation>
-<translation id="49969490063480558">Καταχωρίστε το τμήμα της διεύθυνσης μετά το σύμβολο "<ph name="ATSIGN" />". Η διεύθυνση "<ph name="INVALIDADDRESS" />" δεν είναι πλήρης.</translation>
-<translation id="5034860022980953847">ένδειξη προόδου</translation>
-<translation id="5090250355906949916">δείκτης χρόνου βίντεο</translation>
-<translation id="5093189678851173835">επιγραφή</translation>
-<translation id="5117590920725113268">Εμφάνιση επόμενου μήνα</translation>
-<translation id="512758898067543763">κεφαλίδα σειράς</translation>
-<translation id="5143125788380636750">επίλογος</translation>
-<translation id="5164977714490026579">Η τιμή πρέπει να είναι μεγαλύτερη ή ίση του <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Καταχωρίστε το τμήμα της διεύθυνσης πριν το σύμβολο "<ph name="ATSIGN" />". Η διεύθυνση "<ph name="INVALIDADDRESS" />" δεν είναι πλήρης.</translation>
-<translation id="5334352251556557839">Δεν είναι δυνατή η αναπαραγωγή μέσων.</translation>
-<translation id="5406322316791861025">αριθμός</translation>
-<translation id="5453733299334684579">στοιχείο δέντρου</translation>
-<translation id="5466621249238537318">Επιλέξτε ένα ή περισσότερα αρχεία.</translation>
-<translation id="5468998798572797635">έξοδος από πλήρη οθόνη</translation>
-<translation id="5516424706154626233">εργαλείο επιλογής ημερομηνίας</translation>
-<translation id="5537725057119320332">Μετάδοση</translation>
-<translation id="5546461542133609677">κατάργηση σίγασης</translation>
-<translation id="561939826962581046">ώρα</translation>
-<translation id="5630795885300617244">Πατήστε δύο φορές αριστερά ή δεξιά, για να παραβλέψετε 10 δευτ.</translation>
-<translation id="5631759159893697722">περίληψη</translation>
-<translation id="5643186887447432888">κουμπί</translation>
-<translation id="5677946354068040947">περισσότερες επιλογές</translation>
-<translation id="576709008726043716">εισαγωγή</translation>
-<translation id="57838592816432529">Σίγαση</translation>
-<translation id="5860033963881614850">Απενεργοποιημένη</translation>
-<translation id="588258955323874662">Πλήρης οθόνη</translation>
-<translation id="5888666972993069672">Μετάδοση τώρα στη συσκευή <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">πλαίσιο αναζήτησης</translation>
-<translation id="5939518447894949180">Επαναφορά</translation>
-<translation id="5966707198760109579">Εβδομάδα</translation>
-<translation id="5987525920412732405">κουμπί αυξομείωσης</translation>
-<translation id="6011459053400940133">ρυθμιστικό έντασης ήχου</translation>
-<translation id="6015796118275082299">Έτος</translation>
-<translation id="6023896073578205740">πλαίσιο λίστας</translation>
-<translation id="6150588977291308318">βιβλιογραφία</translation>
-<translation id="6164829606128959761">μετρητής</translation>
-<translation id="6166809985690652833">επίλογος</translation>
-<translation id="6209276755895393898">Φαίνεται πως είναι: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">γλωσσάρι</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Έξοδος από τη λειτουργία Picture-in-Picture</translation>
-<translation id="6398862346408813489">Εμφάνιση παραθύρου επιλογής μήνα</translation>
-<translation id="6404546809543547843">δείκτης χρόνου ήχου</translation>
-<translation id="6443871981718447451">εμφάνιση μενού υποτίτλων</translation>
-<translation id="6453774872122745852">ευχαριστίες</translation>
-<translation id="648732519525291180">εργαλείο επιλογής ώρας</translation>
-<translation id="6550675742724504774">Επιλογές</translation>
-<translation id="6572309429103589720">Μη έγκυρη γραμματική</translation>
-<translation id="658823671542763450">ενεργοποίηση πλήρους οθόνης</translation>
-<translation id="663493177488814956">ροή</translation>
-<translation id="6637586476836377253">αρχείο καταγραφής</translation>
-<translation id="6643016212128521049">Διαγραφή</translation>
-<translation id="668171684555832681">Άλλο...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Κακή ποιότητα αναπαραγωγής</translation>
-<translation id="6755330956360078551">επεξήγηση εργαλείου</translation>
-<translation id="6790428901817661496">Αναπαραγωγή</translation>
-<translation id="6820355525329141109">Δεν είναι δυνατή η φόρτωση της προσθήκης.</translation>
-<translation id="6820615603175220800">βιβλιογραφική αναφορά</translation>
-<translation id="6843725295806269523">σίγαση</translation>
-<translation id="6885760532393684712">κατάλογος</translation>
-<translation id="689129560213475294">εκδοτικό σήμα</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">λήψη μέσων</translation>
-<translation id="6981594929165378967">εισαγωγή</translation>
-<translation id="6989848892321993519">Αυξήστε την έκταση αυτού του κειμένου στους <ph name="MIN_CHARACTERS" /> χαρακτήρες ή περισσότερο (αυτήν τη στιγμή χρησιμοποιείτε 1 χαρακτήρα).</translation>
-<translation id="7033340931668032222">επάνω και κάτω για αλλαγή της έντασης ήχου</translation>
-<translation id="709897737746224366">Αντιστοιχίστε τη ζητούμενη μορφή.</translation>
-<translation id="7118469954320184356">Δεν υπάρχει διαθέσιμη περιγραφή.</translation>
-<translation id="7139483182332611405">πρόλογος</translation>
-<translation id="7214187073215825913">πληροφορίες για το περιεχόμενο</translation>
-<translation id="7263440858009898357">Επιλέξτε ένα στοιχείο από τη λίστα.</translation>
-<translation id="727747134524199931">κεφαλίδα στήλης</translation>
-<translation id="7320576522385648310">αποθήκευση στην προσωρινή μνήμη</translation>
-<translation id="7353453495576941748">εύσημα</translation>
-<translation id="7364796246159120393">Επιλογή αρχείου</translation>
-<translation id="739024184232394898">Άλλες…</translation>
-<translation id="7405738980073107433">σημειώσεις τέλους</translation>
-<translation id="7410239719251593705">Φαίνεται να περιέχει περιεχόμενο για ενηλίκους Δεν υπάρχει διαθέσιμη περιγραφή.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">καρτέλα</translation>
-<translation id="7514365320538308">Λήψη</translation>
-<translation id="7529102961911894712">σύνδεσμος επιστροφής</translation>
-<translation id="7533959249147584474">Γραφικό χωρίς ετικέτα</translation>
-<translation id="7647456547678091388">συμβουλή</translation>
-<translation id="7661956066982048809">έγγραφο γραφικών</translation>
-<translation id="7673697353781729403">Ώρες</translation>
-<translation id="7681220483256441252">ευρετήριο</translation>
-<translation id="7740050170769002709">Περιεχόμενο HTML</translation>
-<translation id="7745230546936012372">Για να λάβετε περιγραφές εικόνων που λείπουν, ανοίξτε το μενού περιβάλλοντος.</translation>
-<translation id="7750228210027921155">Picture in picture</translation>
-<translation id="775297008183122718">Μη έγκυρη καταχώριση</translation>
-<translation id="7789962463072032349">παύση</translation>
-<translation id="7802800022689234070">τρίγωνο εμφάνισης/απόκρυψης</translation>
-<translation id="7888071071722539607">Συμπεριλάβετε το σύμβολο "<ph name="ATSIGN" />" στη διεύθυνση ηλεκτρονικού ταχυδρομείου. Από τη διεύθυνση "<ph name="INVALIDADDRESS" />" λείπει το σύμβολο "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">διαχωριστής</translation>
-<translation id="795667975304826397">Δεν επιλέχθηκε κανένα αρχείο.</translation>
-<translation id="8053789581856978548">αναζήτηση πεδίου κειμένου</translation>
-<translation id="8057695513531652401">ειδοποίηση</translation>
-<translation id="8105797009065549151">παραπομπή</translation>
-<translation id="811583516810654505">Λήψη περιγραφής…</translation>
-<translation id="8117451130807776954">Αυτήν την εβδομάδα</translation>
-<translation id="8199524924445686405">εεεε</translation>
-<translation id="8208673686607688524">επιλογέας τοπικής ώρας και ημερομηνίας</translation>
-<translation id="8261464734335370856">Μη έγκυρη ορθογραφία</translation>
-<translation id="8284326494547611709">Υπότιτλοι</translation>
-<translation id="835897206747267392">Μη έγκυρη τιμή.</translation>
-<translation id="8403857369060869934">χρόνος που παρήλθε: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">τμήμα</translation>
-<translation id="8433900881053900389">γραμμή εργαλείων</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> αρχεία</translation>
-<translation id="8451268428117625855">Επιλέξτε ένα αρχείο.</translation>
-<translation id="8461852803063341183">κουμπί επιλογής</translation>
-<translation id="8474886197722836894">αφιέρωση</translation>
-<translation id="8531739829932800271">τυπογραφικά λάθη</translation>
-<translation id="8534579021159131403">Λεπτά</translation>
-<translation id="8541249477527128034">έλεγχος μέσων</translation>
-<translation id="8550857728288566671">σύμβολο γραφικών</translation>
-<translation id="8583702881314752957">λίστα ορισμών</translation>
-<translation id="8597182159515967513">επικεφαλίδα</translation>
-<translation id="8603553056539299761">αριστερά και δεξιά για αναζήτηση</translation>
-<translation id="860475260694818407">πίνακας περιεχομένων</translation>
-<translation id="8613126697340063924">έλεγχος απομακρυσμένης αναπαραγωγής</translation>
-<translation id="862370744433916922">υπότιτλος</translation>
-<translation id="8711688047404765493">έξοδος</translation>
-<translation id="8750798805984357768">Ορίστε μία από αυτές τις επιλογές.</translation>
-<translation id="8808573423886751634">κεφάλαιο</translation>
-<translation id="8845239796550121995">Γίνεται μετάδοση στην TV</translation>
-<translation id="8851136666856101339">κύριο</translation>
-<translation id="8875657656876809964">Σφάλμα αναπαραγωγής βίντεο</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Μήνας</translation>
-<translation id="901493112792887934">τρέχων χρόνος σε δευτερόλεπτα</translation>
-<translation id="901834265349196618">ηλεκτρονικό ταχυδρομείο</translation>
-<translation id="9048119486235211610">πλοήγηση</translation>
-<translation id="9062295712474918030">έγγραφο</translation>
-<translation id="9062307380734144336">Επιλέξτε για εναλλαγή αναπαραγωγής και παύσης.</translation>
-<translation id="9093215626363556771">έξοδος από τη λειτουργία picture-in-picture</translation>
-<translation id="9108370397979208512">μαθηματικά</translation>
-<translation id="9132465097189459683">Άλλες…</translation>
-<translation id="9138385573473225930">ειδοποίηση</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, από τις <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Παράθεση εικόνων</translation>
-<translation id="9168329111483466115">υποσημείωση</translation>
-<translation id="954003015749068518">είσοδος στη λειτουργία picture-in-picture</translation>
-<translation id="966787709310836684">μενού</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_en-GB.xtb b/chromium/content/app/strings/translations/content_strings_en-GB.xtb
deleted file mode 100644
index 74c2eb1dea0..00000000000
--- a/chromium/content/app/strings/translations/content_strings_en-GB.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="en-GB">
-<translation id="1018939186200882850">menu item</translation>
-<translation id="10623998915015855">toggle button</translation>
-<translation id="1088086359088493902">Seconds</translation>
-<translation id="1171774979989969504">Please enter an email address.</translation>
-<translation id="1178581264944972037">Pause</translation>
-<translation id="1188858454923323853">complementary</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">slider</translation>
-<translation id="1211441953136645838">endnote</translation>
-<translation id="1281252709823657822">dialogue</translation>
-<translation id="1335095011850992622">credits</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">region</translation>
-<translation id="1591562245178063882">This month</translation>
-<translation id="1637811476055996098">Choose Files</translation>
-<translation id="1650423536718072820">pullquote</translation>
-<translation id="1727886345390570319">hide closed captions menu</translation>
-<translation id="1729654308190250600">Please enter a non-empty email address.</translation>
-<translation id="1758486001363313524">Other...</translation>
-<translation id="1806710327868736751">alert_dialogue</translation>
-<translation id="1821985195704844674">tree grid</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">play on remote device</translation>
-<translation id="190587075670221089">deletion</translation>
-<translation id="1907737156431278478">example</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Value must be <ph name="MAXIMUM_DATE_OR_TIME" /> or earlier.</translation>
-<translation id="1946271899482435442">Show date picker</translation>
-<translation id="1993104285338243655">Switched to mirroring</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' is used at a wrong position in '<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">Today</translation>
-<translation id="2158401438286456825">page list</translation>
-<translation id="2226276347425096477">Please shorten this text to <ph name="MAX_CHARACTERS" /> characters or less (you are currently using <ph name="CURRENT_LENGTH" /> characters).</translation>
-<translation id="2246498165605549352">Local file</translation>
-<translation id="2247351761944213033">Week <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Track <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">Tick box</translation>
-<translation id="2311842470354187719">page break</translation>
-<translation id="2335594187091864976">date and time picker</translation>
-<translation id="245932805758469625">number of seconds of video remaining</translation>
-<translation id="248395913932153421">Day</translation>
-<translation id="2507943997699731163">Please fill in this field.</translation>
-<translation id="2508569020611168319">tab list</translation>
-<translation id="2561842179657104141">show more media controls</translation>
-<translation id="2572483411312390101">play</translation>
-<translation id="2613802280814924224">Please enter a valid value. The nearest valid value is <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Submit</translation>
-<translation id="2657045182931379222">graphics object</translation>
-<translation id="2674318244760992338">footer</translation>
-<translation id="2709516037105925701">Auto-fill</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Value must be <ph name="MINIMUM_DATE_OR_TIME" /> or later.</translation>
-<translation id="2759744352195237655">pop-up button</translation>
-<translation id="2761667185364618470">Please tick this box if you want to proceed.</translation>
-<translation id="2844350028562914727">details</translation>
-<translation id="2896972712917208084">radio group</translation>
-<translation id="2908441821576996758">Please enter a comma-separated list of email addresses.</translation>
-<translation id="2940813599313844715">object</translation>
-<translation id="2942448076852699108">highlighted content</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Please enter a valid value. The field is incomplete or has an invalid date.</translation>
-<translation id="3078740164268491126">table</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Please enter a URL.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">combo box</translation>
-<translation id="3450233048674729344">Value must be less than or equal to <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definition</translation>
-<translation id="3557673793733683882">heading <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">week picker</translation>
-<translation id="3685101356851116974">Unlabelled image</translation>
-<translation id="3706100364254443312">switch</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Exit picture-in-picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">term</translation>
-<translation id="3822383571486410024">Please lengthen this text to <ph name="MIN_CHARACTERS" /> characters or more (you are currently using <ph name="CURRENT_LENGTH" /> characters).</translation>
-<translation id="383465348367842624">A part followed by '<ph name="ATSIGN" />' should not contain the symbol '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="3846214748874656680">Exit full screen</translation>
-<translation id="3920932319529768807">conclusion</translation>
-<translation id="3924558731517983934">application</translation>
-<translation id="3944740393230681990">prologue</translation>
-<translation id="3960700977367013758">scroll bar</translation>
-<translation id="4103419683916926126">Milliseconds</translation>
-<translation id="4151657705144244502">graphic</translation>
-<translation id="4160057747563657758">telephone</translation>
-<translation id="4193965531860883258">foreword</translation>
-<translation id="4201051445878709314">Show previous month</translation>
-<translation id="421884353938374759">colour picker</translation>
-<translation id="4248100235867064564">menu bar</translation>
-<translation id="4360991593054037559">Please enter a valid value. The two nearest valid values are <ph name="VALID_VALUE_LOW" /> and <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Q&amp;A</translation>
-<translation id="4413860115965805769">menu button</translation>
-<translation id="4444765639179266822">Appears to say: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">glossary reference</translation>
-<translation id="4522570452068850558">Details</translation>
-<translation id="4542388879936266156">remaining time: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">form</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">A part following '<ph name="ATSIGN" />' should not contain the symbol '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="4668956016107839909">appendix</translation>
-<translation id="4718048029184481307">Playing in picture-in-picture</translation>
-<translation id="4742539557769756338">cover</translation>
-<translation id="4748357248530471599">toggle display cutout full screen</translation>
-<translation id="4757246831282535685">tab panel</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Please enter a number.</translation>
-<translation id="4912536737030637138">bibliography entry</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> selected</translation>
-<translation id="4992066212339426712">Unmute</translation>
-<translation id="49969490063480558">Please enter a part following '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' is incomplete.</translation>
-<translation id="5034860022980953847">progress indicator</translation>
-<translation id="5090250355906949916">video time scrubber</translation>
-<translation id="5093189678851173835">epigraph</translation>
-<translation id="5117590920725113268">Show next month</translation>
-<translation id="512758898067543763">row header</translation>
-<translation id="5143125788380636750">epilogue</translation>
-<translation id="5164977714490026579">Value must be greater than or equal to <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Please enter a part followed by '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' is incomplete.</translation>
-<translation id="5334352251556557839">Unable to play media.</translation>
-<translation id="5406322316791861025">figure</translation>
-<translation id="5453733299334684579">tree item</translation>
-<translation id="5466621249238537318">Please select one or more files.</translation>
-<translation id="5468998798572797635">exit full screen</translation>
-<translation id="5516424706154626233">date picker</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">un-mute</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Double-tap left or right to skip 10s</translation>
-<translation id="5631759159893697722">abstract</translation>
-<translation id="5643186887447432888">button</translation>
-<translation id="5677946354068040947">more options</translation>
-<translation id="576709008726043716">introduction</translation>
-<translation id="57838592816432529">Mute</translation>
-<translation id="5860033963881614850">Off</translation>
-<translation id="588258955323874662">Full screen</translation>
-<translation id="5888666972993069672">Now casting to <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">search box</translation>
-<translation id="5939518447894949180">Reset</translation>
-<translation id="5966707198760109579">Week</translation>
-<translation id="5987525920412732405">spin button</translation>
-<translation id="6011459053400940133">volume slider</translation>
-<translation id="6015796118275082299">Year</translation>
-<translation id="6023896073578205740">list box</translation>
-<translation id="6150588977291308318">bibliography</translation>
-<translation id="6164829606128959761">meter</translation>
-<translation id="6166809985690652833">afterword</translation>
-<translation id="6209276755895393898">Appears to be: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glossary</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Exit picture-in-picture</translation>
-<translation id="6398862346408813489">Show month selection panel</translation>
-<translation id="6404546809543547843">audio time scrubber</translation>
-<translation id="6443871981718447451">show closed captions menu</translation>
-<translation id="6453774872122745852">acknowledgements</translation>
-<translation id="648732519525291180">time picker</translation>
-<translation id="6550675742724504774">Options</translation>
-<translation id="6572309429103589720">Invalid grammar</translation>
-<translation id="658823671542763450">enter full screen</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Clear</translation>
-<translation id="668171684555832681">Other...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Poor playback quality</translation>
-<translation id="6755330956360078551">tooltip</translation>
-<translation id="6790428901817661496">Play</translation>
-<translation id="6820355525329141109">Couldn't load plug-in.</translation>
-<translation id="6820615603175220800">bibliography reference</translation>
-<translation id="6843725295806269523">mute</translation>
-<translation id="6885760532393684712">directory</translation>
-<translation id="689129560213475294">colophon</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">download media</translation>
-<translation id="6981594929165378967">insertion</translation>
-<translation id="6989848892321993519">Please lengthen this text to <ph name="MIN_CHARACTERS" /> characters or more (you are currently using 1 character).</translation>
-<translation id="7033340931668032222">up and down to change volume</translation>
-<translation id="709897737746224366">Please match the format requested.</translation>
-<translation id="7118469954320184356">No description available.</translation>
-<translation id="7139483182332611405">preface</translation>
-<translation id="7214187073215825913">content information</translation>
-<translation id="7263440858009898357">Please select an item in the list.</translation>
-<translation id="727747134524199931">column header</translation>
-<translation id="7320576522385648310">buffering</translation>
-<translation id="7353453495576941748">credit</translation>
-<translation id="7364796246159120393">Choose file</translation>
-<translation id="739024184232394898">Other...</translation>
-<translation id="7405738980073107433">endnotes</translation>
-<translation id="7410239719251593705">Appears to contain adult content. No description available.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Download</translation>
-<translation id="7529102961911894712">back link</translation>
-<translation id="7533959249147584474">Unlabelled graphic</translation>
-<translation id="7647456547678091388">tip</translation>
-<translation id="7661956066982048809">graphics document</translation>
-<translation id="7673697353781729403">Hours</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">HTML content</translation>
-<translation id="7745230546936012372">To get missing image descriptions, open the context menu.</translation>
-<translation id="7750228210027921155">Picture-in-picture</translation>
-<translation id="775297008183122718">Invalid entry</translation>
-<translation id="7789962463072032349">pause</translation>
-<translation id="7802800022689234070">disclosure triangle</translation>
-<translation id="7888071071722539607">Please include an '<ph name="ATSIGN" />' in the email address. '<ph name="INVALIDADDRESS" />' is missing an '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">splitter</translation>
-<translation id="795667975304826397">No file chosen</translation>
-<translation id="8053789581856978548">search text field</translation>
-<translation id="8057695513531652401">notice</translation>
-<translation id="8105797009065549151">note reference</translation>
-<translation id="811583516810654505">Getting description...</translation>
-<translation id="8117451130807776954">This week</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">local date and time picker</translation>
-<translation id="8261464734335370856">Invalid spelling</translation>
-<translation id="8284326494547611709">Captions</translation>
-<translation id="835897206747267392">Invalid value.</translation>
-<translation id="8403857369060869934">elapsed time: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">part</translation>
-<translation id="8433900881053900389">toolbar</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> files</translation>
-<translation id="8451268428117625855">Please select a file.</translation>
-<translation id="8461852803063341183">radio button</translation>
-<translation id="8474886197722836894">dedication</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutes</translation>
-<translation id="8541249477527128034">media control</translation>
-<translation id="8550857728288566671">graphics symbol</translation>
-<translation id="8583702881314752957">definition list</translation>
-<translation id="8597182159515967513">heading</translation>
-<translation id="8603553056539299761">left and right to seek</translation>
-<translation id="860475260694818407">table of contents</translation>
-<translation id="8613126697340063924">control remote playback</translation>
-<translation id="862370744433916922">subtitle</translation>
-<translation id="8711688047404765493">output</translation>
-<translation id="8750798805984357768">Please select one of these options.</translation>
-<translation id="8808573423886751634">chapter</translation>
-<translation id="8845239796550121995">Now casting to your TV</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Video playback error</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Month</translation>
-<translation id="901493112792887934">current time in seconds</translation>
-<translation id="901834265349196618">email</translation>
-<translation id="9048119486235211610">navigation</translation>
-<translation id="9062295712474918030">document</translation>
-<translation id="9062307380734144336">select to toggle play pause</translation>
-<translation id="9093215626363556771">exit picture-in-picture</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Other...</translation>
-<translation id="9138385573473225930">alert</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, starting on <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picture in Picture</translation>
-<translation id="9168329111483466115">footnote</translation>
-<translation id="954003015749068518">enter picture-in-picture</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_es-419.xtb b/chromium/content/app/strings/translations/content_strings_es-419.xtb
deleted file mode 100644
index 1d1784073c1..00000000000
--- a/chromium/content/app/strings/translations/content_strings_es-419.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="es-419">
-<translation id="1018939186200882850">elemento del menú</translation>
-<translation id="10623998915015855">botón de activación</translation>
-<translation id="1088086359088493902">Segundos</translation>
-<translation id="1171774979989969504">Ingresa una dirección de correo electrónico.</translation>
-<translation id="1178581264944972037">Detener</translation>
-<translation id="1188858454923323853">complementario</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">control deslizante</translation>
-<translation id="1211441953136645838">nota final</translation>
-<translation id="1281252709823657822">diálogo</translation>
-<translation id="1335095011850992622">créditos</translation>
-<translation id="1342835525016946179">artículo</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">región</translation>
-<translation id="1591562245178063882">Este mes</translation>
-<translation id="1637811476055996098">Elegir archivos</translation>
-<translation id="1650423536718072820">cita inicial</translation>
-<translation id="1727886345390570319">oculta el menú de subtítulos opcionales</translation>
-<translation id="1729654308190250600">Ingresa una dirección de correo electrónico que no esté vacía.</translation>
-<translation id="1758486001363313524">Otra...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">cuadrícula de árbol</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">jugar en el dispositivo remoto</translation>
-<translation id="190587075670221089">contenido borrado</translation>
-<translation id="1907737156431278478">ejemplo</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">estado</translation>
-<translation id="1938124657309484470">El valor debe ser igual o anterior a <ph name="MAXIMUM_DATE_OR_TIME" />.</translation>
-<translation id="1946271899482435442">Mostrar el selector de fechas</translation>
-<translation id="1993104285338243655">Se cambió a duplicación</translation>
-<translation id="2060505056492490888">El signo "<ph name="DOT" />" está colocado en una posición incorrecta en "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Hoy</translation>
-<translation id="2158401438286456825">listado de páginas</translation>
-<translation id="2226276347425096477">Acorta este texto a <ph name="MAX_CHARACTERS" /> caracteres o menos (actualmente estás usando <ph name="CURRENT_LENGTH" /> caracteres).</translation>
-<translation id="2246498165605549352">Archivo local</translation>
-<translation id="2247351761944213033">Semana <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Pista <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">casilla de verificación</translation>
-<translation id="2311842470354187719">salto de página</translation>
-<translation id="2335594187091864976">selector de fecha y hora</translation>
-<translation id="245932805758469625">cantidad de segundos restantes del video</translation>
-<translation id="248395913932153421">Día</translation>
-<translation id="2507943997699731163">Completa este campo</translation>
-<translation id="2508569020611168319">lista de pestañas</translation>
-<translation id="2561842179657104141">mostrar más controles de medios</translation>
-<translation id="2572483411312390101">reproducir</translation>
-<translation id="2613802280814924224">Ingresa un valor válido. El valor válido más aproximado es <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Enviar</translation>
-<translation id="2657045182931379222">objeto gráfico</translation>
-<translation id="2674318244760992338">pie de página</translation>
-<translation id="2709516037105925701">Autocompletar</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">El valor debe ser igual o posterior a <ph name="MINIMUM_DATE_OR_TIME" />.</translation>
-<translation id="2759744352195237655">botón con ventana emergente</translation>
-<translation id="2761667185364618470">Controla esta casilla si deseas continuar.</translation>
-<translation id="2844350028562914727">detalles</translation>
-<translation id="2896972712917208084">grupo de botones de selección</translation>
-<translation id="2908441821576996758">Ingresa una lista de direcciones de correo electrónico separadas por coma</translation>
-<translation id="2940813599313844715">objeto</translation>
-<translation id="2942448076852699108">contenido destacado</translation>
-<translation id="3040011195152428237">enlace</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Debes ingresar un valor válido. El campo está incompleto o contiene una fecha no válida.</translation>
-<translation id="3078740164268491126">tabla</translation>
-<translation id="3086746722712840547">nota</translation>
-<translation id="310520048233152454">Ingresa una URL.</translation>
-<translation id="3175736971608411871">cronómetro</translation>
-<translation id="3199563858620722075">cuadro combinado</translation>
-<translation id="3450233048674729344">El valor debe ser menor de o igual a <ph name="MAXIMUM" /></translation>
-<translation id="3486220673238053218">definición</translation>
-<translation id="3557673793733683882">encabezado <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selector de semana</translation>
-<translation id="3685101356851116974">Imagen sin etiquetar</translation>
-<translation id="3706100364254443312">cambiar</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Salir del modo de pantalla en pantalla</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">término</translation>
-<translation id="3822383571486410024">Alarga el texto a <ph name="MIN_CHARACTERS" /> o más caracteres (actualmente, usas <ph name="CURRENT_LENGTH" /> caracteres).</translation>
-<translation id="383465348367842624">El texto antes del signo "<ph name="ATSIGN" />" no debe incluir el símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Salir de pantalla completa</translation>
-<translation id="3920932319529768807">conclusión</translation>
-<translation id="3924558731517983934">aplicación</translation>
-<translation id="3944740393230681990">prólogo</translation>
-<translation id="3960700977367013758">barra de desplazamiento</translation>
-<translation id="4103419683916926126">Milisegundos</translation>
-<translation id="4151657705144244502">gráfico</translation>
-<translation id="4160057747563657758">teléfono</translation>
-<translation id="4193965531860883258">prefacio</translation>
-<translation id="4201051445878709314">Mostrar el mes anterior</translation>
-<translation id="421884353938374759">selector de color</translation>
-<translation id="4248100235867064564">barra de menús</translation>
-<translation id="4360991593054037559">Ingresa un valor válido. Los dos valores válidos más aproximados son <ph name="VALID_VALUE_LOW" /> y <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Preguntas y respuestas</translation>
-<translation id="4413860115965805769">botón de menú</translation>
-<translation id="4444765639179266822">Parece decir: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">referencia de glosario</translation>
-<translation id="4522570452068850558">Detalles</translation>
-<translation id="4542388879936266156">tiempo restante: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulario</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">El texto después del signo "<ph name="ATSIGN" />" no debe incluir el símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">apéndice</translation>
-<translation id="4718048029184481307">Reproduciendo en modo de pantalla en pantalla</translation>
-<translation id="4742539557769756338">portada</translation>
-<translation id="4748357248530471599">activar o desactivar la pantalla completa en el corte de pantalla</translation>
-<translation id="4757246831282535685">panel de pestañas</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Debes ingresar un número.</translation>
-<translation id="4912536737030637138">entrada de bibliografía</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> elementos seleccionados</translation>
-<translation id="4992066212339426712">Dejar de silenciar</translation>
-<translation id="49969490063480558">Ingresa texto después del signo "<ph name="ATSIGN" />". La dirección "<ph name="INVALIDADDRESS" />" está incompleta.</translation>
-<translation id="5034860022980953847">indicador de progreso</translation>
-<translation id="5090250355906949916">control deslizante de duración del video</translation>
-<translation id="5093189678851173835">epígrafe</translation>
-<translation id="5117590920725113268">Mostrar el mes siguiente</translation>
-<translation id="512758898067543763">encabezado de fila</translation>
-<translation id="5143125788380636750">epílogo</translation>
-<translation id="5164977714490026579">El valor debe ser mayor de o igual a <ph name="MINIMUM" /></translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Ingresa texto antes del signo "<ph name="ATSIGN" />". La dirección "<ph name="INVALIDADDRESS" />" está incompleta.</translation>
-<translation id="5334352251556557839">No es posible reproducir los archivos multimedia.</translation>
-<translation id="5406322316791861025">figura</translation>
-<translation id="5453733299334684579">elemento de árbol</translation>
-<translation id="5466621249238537318">Selecciona uno o más archivos.</translation>
-<translation id="5468998798572797635">salir de pantalla completa</translation>
-<translation id="5516424706154626233">selector de fecha</translation>
-<translation id="5537725057119320332">Transmitir</translation>
-<translation id="5546461542133609677">desactivar silencio</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Presiona dos veces a la derecha o izquierda para omitir 10 s</translation>
-<translation id="5631759159893697722">resumen</translation>
-<translation id="5643186887447432888">botón</translation>
-<translation id="5677946354068040947">más opciones</translation>
-<translation id="576709008726043716">introducción</translation>
-<translation id="57838592816432529">Silenciar</translation>
-<translation id="5860033963881614850">No</translation>
-<translation id="588258955323874662">Pantalla completa</translation>
-<translation id="5888666972993069672">Transmitiendo ahora a <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">cuadro de búsqueda</translation>
-<translation id="5939518447894949180">Restablecer</translation>
-<translation id="5966707198760109579">Semana</translation>
-<translation id="5987525920412732405">botón de control numérico</translation>
-<translation id="6011459053400940133">control deslizante del volumen</translation>
-<translation id="6015796118275082299">Año</translation>
-<translation id="6023896073578205740">cuadro de lista</translation>
-<translation id="6150588977291308318">bibliografía</translation>
-<translation id="6164829606128959761">medidor</translation>
-<translation id="6166809985690652833">posfacio</translation>
-<translation id="6209276755895393898">Parece ser: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosario</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Salir del modo de pantalla en pantalla</translation>
-<translation id="6398862346408813489">Mostrar el panel de selección de meses</translation>
-<translation id="6404546809543547843">control deslizante de duración del audio</translation>
-<translation id="6443871981718447451">muestra el menú de subtítulos opcionales</translation>
-<translation id="6453774872122745852">reconocimientos</translation>
-<translation id="648732519525291180">selector de hora</translation>
-<translation id="6550675742724504774">Opciones</translation>
-<translation id="6572309429103589720">Gramática no válida</translation>
-<translation id="658823671542763450">ingresar a pantalla completa</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">rgstr</translation>
-<translation id="6643016212128521049">Borrar</translation>
-<translation id="668171684555832681">Otro...</translation>
-<translation id="6692633176391053278">secuenciador</translation>
-<translation id="6709570249143506788">Baja calidad de reproducción</translation>
-<translation id="6755330956360078551">información sobre la herramienta</translation>
-<translation id="6790428901817661496">Reproducir</translation>
-<translation id="6820355525329141109">No se pudo cargar el complemento.</translation>
-<translation id="6820615603175220800">referencia bibliográfica</translation>
-<translation id="6843725295806269523">silencio</translation>
-<translation id="6885760532393684712">directorio</translation>
-<translation id="689129560213475294">colofón</translation>
-<translation id="6934078000481955284">bloque entrecomillado</translation>
-<translation id="6941933287844615239">descargar medios</translation>
-<translation id="6981594929165378967">contenido agregado</translation>
-<translation id="6989848892321993519">Extiende este texto para que tenga <ph name="MIN_CHARACTERS" /> caracteres o más (actualmente usas 1 carácter).</translation>
-<translation id="7033340931668032222">arriba y abajo para cambiar el volumen</translation>
-<translation id="709897737746224366">Haz coincidir el formato solicitado.</translation>
-<translation id="7118469954320184356">No hay una descripción disponible.</translation>
-<translation id="7139483182332611405">prefacio</translation>
-<translation id="7214187073215825913">información de contenido</translation>
-<translation id="7263440858009898357">Selecciona un elemento de la lista</translation>
-<translation id="727747134524199931">encabezado de columna</translation>
-<translation id="7320576522385648310">almacenando en búfer</translation>
-<translation id="7353453495576941748">crédito</translation>
-<translation id="7364796246159120393">Seleccionar archivo</translation>
-<translation id="739024184232394898">Otra...</translation>
-<translation id="7405738980073107433">notas finales</translation>
-<translation id="7410239719251593705">Al parecer, tiene contenido para adultos. No hay una descripción disponible.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Descargar</translation>
-<translation id="7529102961911894712">retrovínculo</translation>
-<translation id="7533959249147584474">Gráfico sin etiquetar</translation>
-<translation id="7647456547678091388">sugerencia</translation>
-<translation id="7661956066982048809">documento gráfico</translation>
-<translation id="7673697353781729403">Horas</translation>
-<translation id="7681220483256441252">índice</translation>
-<translation id="7740050170769002709">Contenido HTML</translation>
-<translation id="7745230546936012372">Para obtener las descripciones de imágenes faltantes, abre el menú contextual.</translation>
-<translation id="7750228210027921155">Pantalla en pantalla</translation>
-<translation id="775297008183122718">Entrada no válida</translation>
-<translation id="7789962463072032349">pausa</translation>
-<translation id="7802800022689234070">triángulo desplegable</translation>
-<translation id="7888071071722539607">Incluye un signo "<ph name="ATSIGN" />" en la dirección de correo electrónico. La dirección "<ph name="INVALIDADDRESS" />" no incluye el signo "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">separador</translation>
-<translation id="795667975304826397">No se eligió archivo</translation>
-<translation id="8053789581856978548">campo de texto de búsqueda</translation>
-<translation id="8057695513531652401">aviso</translation>
-<translation id="8105797009065549151">nota de referencia</translation>
-<translation id="811583516810654505">Obteniendo la descripción…</translation>
-<translation id="8117451130807776954">Esta semana</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">selector de fecha y hora locales</translation>
-<translation id="8261464734335370856">Ortografía no válida</translation>
-<translation id="8284326494547611709">Subtítulos</translation>
-<translation id="835897206747267392">Valor no válido.</translation>
-<translation id="8403857369060869934">tiempo transcurrido: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">parte</translation>
-<translation id="8433900881053900389">barra de herramientas</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> archivos</translation>
-<translation id="8451268428117625855">Selecciona un archivo.</translation>
-<translation id="8461852803063341183">botón de selección</translation>
-<translation id="8474886197722836894">dedicatoria</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutos</translation>
-<translation id="8541249477527128034">control de medios</translation>
-<translation id="8550857728288566671">símbolo gráfico</translation>
-<translation id="8583702881314752957">lista de definiciones</translation>
-<translation id="8597182159515967513">cabecera</translation>
-<translation id="8603553056539299761">izquierda y derecha para buscar</translation>
-<translation id="860475260694818407">índice</translation>
-<translation id="8613126697340063924">controlar la reproducción remota</translation>
-<translation id="862370744433916922">subtítulo</translation>
-<translation id="8711688047404765493">salida</translation>
-<translation id="8750798805984357768">Selecciona una de estas opciones.</translation>
-<translation id="8808573423886751634">capítulo</translation>
-<translation id="8845239796550121995">Transmitiendo a tu TV</translation>
-<translation id="8851136666856101339">ppal</translation>
-<translation id="8875657656876809964">Error de reproducción de video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mes</translation>
-<translation id="901493112792887934">tiempo actual en segundos</translation>
-<translation id="901834265349196618">correo electrónico</translation>
-<translation id="9048119486235211610">navegación</translation>
-<translation id="9062295712474918030">documento</translation>
-<translation id="9062307380734144336">selecciona para activar o desactivar la reproducción</translation>
-<translation id="9093215626363556771">salir del modo de pantalla en pantalla</translation>
-<translation id="9108370397979208512">expr mtmtc</translation>
-<translation id="9132465097189459683">Otra...</translation>
-<translation id="9138385573473225930">alerta</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, a partir del <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Pantalla en pantalla</translation>
-<translation id="9168329111483466115">nota a pie de página</translation>
-<translation id="954003015749068518">ingresar al modo de pantalla en pantalla</translation>
-<translation id="966787709310836684">menú</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_es.xtb b/chromium/content/app/strings/translations/content_strings_es.xtb
deleted file mode 100644
index eb1257006a1..00000000000
--- a/chromium/content/app/strings/translations/content_strings_es.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="es">
-<translation id="1018939186200882850">elemento de menú</translation>
-<translation id="10623998915015855">botón de activación</translation>
-<translation id="1088086359088493902">Segundos</translation>
-<translation id="1171774979989969504">Introduce una dirección de correo electrónico</translation>
-<translation id="1178581264944972037">Pausar</translation>
-<translation id="1188858454923323853">complementario</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">control deslizante</translation>
-<translation id="1211441953136645838">nota final</translation>
-<translation id="1281252709823657822">cuadro de diálogo</translation>
-<translation id="1335095011850992622">créditos</translation>
-<translation id="1342835525016946179">artículo</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">región</translation>
-<translation id="1591562245178063882">Este mes</translation>
-<translation id="1637811476055996098">Elegir archivos</translation>
-<translation id="1650423536718072820">cita</translation>
-<translation id="1727886345390570319">ocultar menú de subtítulos</translation>
-<translation id="1729654308190250600">Introduce una dirección de correo electrónico que no esté vacía.</translation>
-<translation id="1758486001363313524">Otra...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">cuadrícula de árbol</translation>
-<translation id="1822429046913737220">A.M./P.M.</translation>
-<translation id="1832974991323546415">reproducir en dispositivo remoto</translation>
-<translation id="190587075670221089">eliminación</translation>
-<translation id="1907737156431278478">ejemplo</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">estado</translation>
-<translation id="1938124657309484470">El valor debe ser igual o anterior a <ph name="MAXIMUM_DATE_OR_TIME" />.</translation>
-<translation id="1946271899482435442">Mostrar selector de fecha</translation>
-<translation id="1993104285338243655">Se ha cambiado a proyección</translation>
-<translation id="2060505056492490888">El signo "<ph name="DOT" />" está colocado en una posición incorrecta en la dirección "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Hoy</translation>
-<translation id="2158401438286456825">lista de páginas</translation>
-<translation id="2226276347425096477">Reduce la longitud de este texto a <ph name="MAX_CHARACTERS" /> caracteres o menos (actualmente, el texto tiene <ph name="CURRENT_LENGTH" /> caracteres)</translation>
-<translation id="2246498165605549352">Archivo local</translation>
-<translation id="2247351761944213033">Semana <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Pista <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">casilla de verificación</translation>
-<translation id="2311842470354187719">salto de página</translation>
-<translation id="2335594187091864976">selector de fecha y hora</translation>
-<translation id="245932805758469625">segundos de vídeo restantes</translation>
-<translation id="248395913932153421">Día</translation>
-<translation id="2507943997699731163">Completa este campo</translation>
-<translation id="2508569020611168319">lista de pestañas</translation>
-<translation id="2561842179657104141">mostrar más controles multimedia</translation>
-<translation id="2572483411312390101">reproducir</translation>
-<translation id="2613802280814924224">Introduce un valor válido. El valor válido más aproximado es <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Enviar</translation>
-<translation id="2657045182931379222">objeto gráfico</translation>
-<translation id="2674318244760992338">pie de página</translation>
-<translation id="2709516037105925701">Autocompletar</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">El valor debe ser igual o posterior a <ph name="MINIMUM_DATE_OR_TIME" />.</translation>
-<translation id="2759744352195237655">botón emergente</translation>
-<translation id="2761667185364618470">Selecciona esta casilla de verificación si quieres continuar</translation>
-<translation id="2844350028562914727">detalles</translation>
-<translation id="2896972712917208084">grupo de selección</translation>
-<translation id="2908441821576996758">Introduce una lista de direcciones de correo electrónico separada por comas</translation>
-<translation id="2940813599313844715">objeto</translation>
-<translation id="2942448076852699108">contenido resaltado</translation>
-<translation id="3040011195152428237">enlace</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Debes introducir un valor válido. El campo está incompleto o incluye una fecha no válida.</translation>
-<translation id="3078740164268491126">tabla</translation>
-<translation id="3086746722712840547">nota</translation>
-<translation id="310520048233152454">Introduce una URL</translation>
-<translation id="3175736971608411871">temporizador</translation>
-<translation id="3199563858620722075">cuadro combinado</translation>
-<translation id="3450233048674729344">El valor debe ser inferior o igual a <ph name="MAXIMUM" /></translation>
-<translation id="3486220673238053218">definición</translation>
-<translation id="3557673793733683882">encabezado <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selector de semana</translation>
-<translation id="3685101356851116974">Imagen sin descripción</translation>
-<translation id="3706100364254443312">interruptor</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Salir del modo imagen en imagen</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">término</translation>
-<translation id="3822383571486410024">Aumenta la longitud del texto a <ph name="MIN_CHARACTERS" /> caracteres como mínimo (actualmente, el texto tiene <ph name="CURRENT_LENGTH" /> caracteres).</translation>
-<translation id="383465348367842624">El texto seguido del signo "<ph name="ATSIGN" />" no debe incluir el símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Salir de pantalla completa</translation>
-<translation id="3920932319529768807">conclusión</translation>
-<translation id="3924558731517983934">aplicación</translation>
-<translation id="3944740393230681990">prólogo</translation>
-<translation id="3960700977367013758">barra de desplazamiento</translation>
-<translation id="4103419683916926126">Millisegundos</translation>
-<translation id="4151657705144244502">gráfico</translation>
-<translation id="4160057747563657758">teléfono</translation>
-<translation id="4193965531860883258">prefacio</translation>
-<translation id="4201051445878709314">Mostrar mes anterior</translation>
-<translation id="421884353938374759">selector de color</translation>
-<translation id="4248100235867064564">barra de menús</translation>
-<translation id="4360991593054037559">Introduce un valor válido. Los dos valores válidos más aproximados son <ph name="VALID_VALUE_LOW" /> y <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Preguntas</translation>
-<translation id="4413860115965805769">botón de menú</translation>
-<translation id="4444765639179266822">Parece que pone: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">referencia de glosario</translation>
-<translation id="4522570452068850558">Detalles</translation>
-<translation id="4542388879936266156">tiempo restante: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulario</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">El texto detrás del signo "<ph name="ATSIGN" />" no debe incluir el símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">apéndice</translation>
-<translation id="4718048029184481307">Reproduciendo en modo imagen en imagen</translation>
-<translation id="4742539557769756338">portada</translation>
-<translation id="4748357248530471599">activar pantalla completa en el recorte de la pantalla</translation>
-<translation id="4757246831282535685">panel de pestaña</translation>
-<translation id="4763480195061959176">vídeo</translation>
-<translation id="479989351350248267">buscar</translation>
-<translation id="4812940957355064477">Debes introducir un número</translation>
-<translation id="4912536737030637138">entrada bibliográfica</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> seleccionados</translation>
-<translation id="4992066212339426712">Activar sonido</translation>
-<translation id="49969490063480558">Introduce texto detrás del signo "<ph name="ATSIGN" />". La dirección "<ph name="INVALIDADDRESS" />" está incompleta.</translation>
-<translation id="5034860022980953847">indicador de progreso</translation>
-<translation id="5090250355906949916">control deslizante de duración de vídeo</translation>
-<translation id="5093189678851173835">epígrafe</translation>
-<translation id="5117590920725113268">Mostrar mes siguiente</translation>
-<translation id="512758898067543763">encabezado de fila</translation>
-<translation id="5143125788380636750">epílogo</translation>
-<translation id="5164977714490026579">El valor debe ser superior o igual a <ph name="MINIMUM" /></translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Introduce texto seguido del signo "<ph name="ATSIGN" />". La dirección "<ph name="INVALIDADDRESS" />" está incompleta.</translation>
-<translation id="5334352251556557839">No se ha podido reproducir el contenido multimedia.</translation>
-<translation id="5406322316791861025">cifra</translation>
-<translation id="5453733299334684579">elemento del árbol</translation>
-<translation id="5466621249238537318">Selecciona uno o varios archivos</translation>
-<translation id="5468998798572797635">salir de pantalla completa</translation>
-<translation id="5516424706154626233">selector de fecha</translation>
-<translation id="5537725057119320332">Enviar</translation>
-<translation id="5546461542133609677">activar sonido</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Toca dos veces a la derecha o a la izquierda para saltar 10 segundos</translation>
-<translation id="5631759159893697722">resumen</translation>
-<translation id="5643186887447432888">botón</translation>
-<translation id="5677946354068040947">más opciones</translation>
-<translation id="576709008726043716">introducción</translation>
-<translation id="57838592816432529">Silenciar</translation>
-<translation id="5860033963881614850">No</translation>
-<translation id="588258955323874662">Pantalla completa</translation>
-<translation id="5888666972993069672">Enviando a <ph name="DEVICE_FRIENDLY_NAME" /> en este momento</translation>
-<translation id="591047860372322273">cuadro de búsqueda</translation>
-<translation id="5939518447894949180">Restablecer</translation>
-<translation id="5966707198760109579">Semana</translation>
-<translation id="5987525920412732405">botón de control numérico</translation>
-<translation id="6011459053400940133">control deslizante de volumen</translation>
-<translation id="6015796118275082299">Año</translation>
-<translation id="6023896073578205740">cuadro de lista</translation>
-<translation id="6150588977291308318">bibliografía</translation>
-<translation id="6164829606128959761">medidor</translation>
-<translation id="6166809985690652833">epílogo</translation>
-<translation id="6209276755895393898">Parece que es: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosario</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Salir del modo imagen en imagen</translation>
-<translation id="6398862346408813489">Mostrar panel para seleccionar el mes</translation>
-<translation id="6404546809543547843">control deslizante de duración de audio</translation>
-<translation id="6443871981718447451">mostrar menú de subtítulos</translation>
-<translation id="6453774872122745852">agradecimientos</translation>
-<translation id="648732519525291180">selector de hora</translation>
-<translation id="6550675742724504774">Configuración</translation>
-<translation id="6572309429103589720">La gramática no es válida</translation>
-<translation id="658823671542763450">activar pantalla completa</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">registro</translation>
-<translation id="6643016212128521049">Eliminar</translation>
-<translation id="668171684555832681">Otros...</translation>
-<translation id="6692633176391053278">secuenciador</translation>
-<translation id="6709570249143506788">Calidad de reproducción baja</translation>
-<translation id="6755330956360078551">descripción emergente</translation>
-<translation id="6790428901817661496">Reproducir</translation>
-<translation id="6820355525329141109">No se ha podido cargar el complemento.</translation>
-<translation id="6820615603175220800">referencia bibliográfica</translation>
-<translation id="6843725295806269523">silenciar</translation>
-<translation id="6885760532393684712">directorio</translation>
-<translation id="689129560213475294">colofón</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">descargar archivos multimedia</translation>
-<translation id="6981594929165378967">inserción</translation>
-<translation id="6989848892321993519">Aumenta la longitud de este texto a <ph name="MIN_CHARACTERS" /> caracteres o más (actualmente, el texto tiene 1 carácter).</translation>
-<translation id="7033340931668032222">arriba o abajo para subir o bajar el volumen</translation>
-<translation id="709897737746224366">Utiliza un formato que coincida con el solicitado</translation>
-<translation id="7118469954320184356">No hay ninguna descripción disponible.</translation>
-<translation id="7139483182332611405">prefacio</translation>
-<translation id="7214187073215825913">información sobre el contenido</translation>
-<translation id="7263440858009898357">Selecciona un elemento de la lista</translation>
-<translation id="727747134524199931">encabezado de columna</translation>
-<translation id="7320576522385648310">almacenando en búfer</translation>
-<translation id="7353453495576941748">crédito</translation>
-<translation id="7364796246159120393">Seleccionar archivo</translation>
-<translation id="739024184232394898">Otra...</translation>
-<translation id="7405738980073107433">notas finales</translation>
-<translation id="7410239719251593705">Parece que incluye contenido para adultos. No hay ninguna descripción disponible.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tabulador</translation>
-<translation id="7514365320538308">Descargar</translation>
-<translation id="7529102961911894712">enlace de retroceso</translation>
-<translation id="7533959249147584474">Gráfico sin descripción</translation>
-<translation id="7647456547678091388">consejo</translation>
-<translation id="7661956066982048809">documento gráfico</translation>
-<translation id="7673697353781729403">Horas</translation>
-<translation id="7681220483256441252">índice</translation>
-<translation id="7740050170769002709">Contenido HTML</translation>
-<translation id="7745230546936012372">Para obtener las descripciones de las imágenes, abre el menú contextual.</translation>
-<translation id="7750228210027921155">Imagen en imagen</translation>
-<translation id="775297008183122718">Entrada no válida</translation>
-<translation id="7789962463072032349">pausar</translation>
-<translation id="7802800022689234070">triángulo de revelación</translation>
-<translation id="7888071071722539607">Incluye un signo "<ph name="ATSIGN" />" en la dirección de correo electrónico. La dirección "<ph name="INVALIDADDRESS" />" no incluye el signo "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">divisor</translation>
-<translation id="795667975304826397">Ningún archivo seleccionado</translation>
-<translation id="8053789581856978548">campo para buscar texto</translation>
-<translation id="8057695513531652401">aviso</translation>
-<translation id="8105797009065549151">referencia de nota</translation>
-<translation id="811583516810654505">Obteniendo la descripción...</translation>
-<translation id="8117451130807776954">Esta semana</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">selector de fecha y hora locales</translation>
-<translation id="8261464734335370856">La ortografía no es válida</translation>
-<translation id="8284326494547611709">Subtítulos</translation>
-<translation id="835897206747267392">Valor no válido</translation>
-<translation id="8403857369060869934">tiempo transcurrido: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">parte</translation>
-<translation id="8433900881053900389">barra de herramientas</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> archivos</translation>
-<translation id="8451268428117625855">Selecciona un archivo</translation>
-<translation id="8461852803063341183">botón de selección</translation>
-<translation id="8474886197722836894">dedicatoria</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutos</translation>
-<translation id="8541249477527128034">control de medios</translation>
-<translation id="8550857728288566671">símbolo gráfico</translation>
-<translation id="8583702881314752957">lista de definiciones</translation>
-<translation id="8597182159515967513">cabecera</translation>
-<translation id="8603553056539299761">izquierda o derecha para ir hacia delante o hacia atrás</translation>
-<translation id="860475260694818407">índice</translation>
-<translation id="8613126697340063924">reproducción de control remoto</translation>
-<translation id="862370744433916922">subtítulo</translation>
-<translation id="8711688047404765493">salida</translation>
-<translation id="8750798805984357768">Selecciona una de estas opciones</translation>
-<translation id="8808573423886751634">capítulo</translation>
-<translation id="8845239796550121995">Se está enviando contenido a tu TV</translation>
-<translation id="8851136666856101339">principal</translation>
-<translation id="8875657656876809964">No se puede reproducir el vídeo</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mes</translation>
-<translation id="901493112792887934">tiempo actual en segundos</translation>
-<translation id="901834265349196618">correo electrónico</translation>
-<translation id="9048119486235211610">navegación</translation>
-<translation id="9062295712474918030">documento</translation>
-<translation id="9062307380734144336">Selecciona para alternar entre reproducción y pausa</translation>
-<translation id="9093215626363556771">salir del modo imagen en imagen</translation>
-<translation id="9108370397979208512">expresión matemática</translation>
-<translation id="9132465097189459683">Otra...</translation>
-<translation id="9138385573473225930">alerta</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, a partir del <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Imagen en imagen</translation>
-<translation id="9168329111483466115">nota al pie</translation>
-<translation id="954003015749068518">abrir el modo imagen en imagen</translation>
-<translation id="966787709310836684">menú</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_et.xtb b/chromium/content/app/strings/translations/content_strings_et.xtb
deleted file mode 100644
index c6bc1ac83fc..00000000000
--- a/chromium/content/app/strings/translations/content_strings_et.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="et">
-<translation id="1018939186200882850">menüü-üksus</translation>
-<translation id="10623998915015855">ümberlülitusnupp</translation>
-<translation id="1088086359088493902">Sekundid</translation>
-<translation id="1171774979989969504">Sisestage meiliaadress.</translation>
-<translation id="1178581264944972037">Peata</translation>
-<translation id="1188858454923323853">täiendav</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">liugur</translation>
-<translation id="1211441953136645838">järelmärkus</translation>
-<translation id="1281252709823657822">dialoog</translation>
-<translation id="1335095011850992622">tiitrid</translation>
-<translation id="1342835525016946179">artikkel</translation>
-<translation id="1359897965706325498">bänner</translation>
-<translation id="1589122976691792535">piirkond</translation>
-<translation id="1591562245178063882">See kuu</translation>
-<translation id="1637811476055996098">Vali failid</translation>
-<translation id="1650423536718072820">tsitaat</translation>
-<translation id="1727886345390570319">peida subtiitrite menüü</translation>
-<translation id="1729654308190250600">Sisestage mittetühi e-posti aadress.</translation>
-<translation id="1758486001363313524">Muu ...</translation>
-<translation id="1806710327868736751">hoiatusdialoog</translation>
-<translation id="1821985195704844674">puuruudustik</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">kaugseadmes esitamine</translation>
-<translation id="190587075670221089">kustutamine</translation>
-<translation id="1907737156431278478">näide</translation>
-<translation id="1921819250265091946">pp</translation>
-<translation id="1930711995431081526">olek</translation>
-<translation id="1938124657309484470">Väärtus peab olema <ph name="MAXIMUM_DATE_OR_TIME" /> või varasem.</translation>
-<translation id="1946271899482435442">Kuupäevavalija kuvamine</translation>
-<translation id="1993104285338243655">Lülitatud peegeldamisele</translation>
-<translation id="2060505056492490888">Tähist „<ph name="DOT" />” on aadressis „<ph name="INVALIDDOMAIN" />” valesti kasutatud.</translation>
-<translation id="2148716181193084225">Täna</translation>
-<translation id="2158401438286456825">lehtede loend</translation>
-<translation id="2226276347425096477">Lühendage seda teksti <ph name="MAX_CHARACTERS" /> tähemärgini või rohkem (praegu kasutate <ph name="CURRENT_LENGTH" /> tähemärki).</translation>
-<translation id="2246498165605549352">Kohalik fail</translation>
-<translation id="2247351761944213033">Nädal <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904"><ph name="NUMBER" />. lugu</translation>
-<translation id="2291999235780842123">märkeruut</translation>
-<translation id="2311842470354187719">leheküljepiir</translation>
-<translation id="2335594187091864976">kuupäeva ja kellaaja valija</translation>
-<translation id="245932805758469625">video allesjäänud sekundite arv</translation>
-<translation id="248395913932153421">päev</translation>
-<translation id="2507943997699731163">Täitke see väli.</translation>
-<translation id="2508569020611168319">vahelehtede loend</translation>
-<translation id="2561842179657104141">kuva rohkem meedia juhtnuppe</translation>
-<translation id="2572483411312390101">esitus</translation>
-<translation id="2613802280814924224">Sisestage kehtiv väärtus. Lähim kehtiv väärtus on <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Esita</translation>
-<translation id="2657045182931379222">graafika objekt</translation>
-<translation id="2674318244760992338">jalus</translation>
-<translation id="2709516037105925701">Automaatne täitmine</translation>
-<translation id="2723001399770238859">heli</translation>
-<translation id="2746543609216772311">Väärtus peab olema <ph name="MINIMUM_DATE_OR_TIME" /> või hilisem.</translation>
-<translation id="2759744352195237655">hüpikunupp</translation>
-<translation id="2761667185364618470">Märkige see ruut, kui soovite jätkata.</translation>
-<translation id="2844350028562914727">üksikasjad</translation>
-<translation id="2896972712917208084">raadionuppude grupp</translation>
-<translation id="2908441821576996758">Sisestage meiliaadresside loend komadega eraldatult.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">esiletõstetud sisu</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Sisestage kehtiv väärtus. Väli on täitmata või sisaldab sobimatut kuupäeva.</translation>
-<translation id="3078740164268491126">tabel</translation>
-<translation id="3086746722712840547">märge</translation>
-<translation id="310520048233152454">Sisestage URL.</translation>
-<translation id="3175736971608411871">taimer</translation>
-<translation id="3199563858620722075">liitkast</translation>
-<translation id="3450233048674729344">Väärtus peab olema väiksem või võrdne <ph name="MAXIMUM" />-ga.</translation>
-<translation id="3486220673238053218">definitsioon</translation>
-<translation id="3557673793733683882">päis <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">nädala valija</translation>
-<translation id="3685101356851116974">Sildita pilt</translation>
-<translation id="3706100364254443312">lüliti</translation>
-<translation id="3732799496749320381">kk</translation>
-<translation id="3754210790023674521">Välju režiimist Pilt pildis</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">termin</translation>
-<translation id="3822383571486410024">Pikendage teksti vähemalt <ph name="MIN_CHARACTERS" /> tähemärgini (kasutate praegu <ph name="CURRENT_LENGTH" /> tähemärki).</translation>
-<translation id="383465348367842624">Märgile „<ph name="ATSIGN" />” eelnev osa ei tohi sisaldada sümbolit „<ph name="INVALIDCHARACTER" />”.</translation>
-<translation id="3846214748874656680">Täisekraanilt väljumine</translation>
-<translation id="3920932319529768807">kokkuvõte</translation>
-<translation id="3924558731517983934">rakendus</translation>
-<translation id="3944740393230681990">proloog</translation>
-<translation id="3960700977367013758">kerimisriba</translation>
-<translation id="4103419683916926126">Millisekundid</translation>
-<translation id="4151657705144244502">graafika</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">eessõna</translation>
-<translation id="4201051445878709314">Eelmise kuu kuvamine</translation>
-<translation id="421884353938374759">värvivalija</translation>
-<translation id="4248100235867064564">menüüriba</translation>
-<translation id="4360991593054037559">Sisestage kehtiv väärtus. Kaks lähimat kehtivat väärtust on <ph name="VALID_VALUE_LOW" /> ja <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Küsimused ja vastused</translation>
-<translation id="4413860115965805769">menüünupp</translation>
-<translation id="4444765639179266822">Näib ütlevat: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">sõnastiku viide</translation>
-<translation id="4522570452068850558">Üksikasjad</translation>
-<translation id="4542388879936266156">järelejäänud aeg: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">vorm</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Märgile „<ph name="ATSIGN" />” järgnev osa ei tohi sisaldada sümbolit „<ph name="INVALIDCHARACTER" />”.</translation>
-<translation id="4668956016107839909">lisa</translation>
-<translation id="4718048029184481307">Režiimis Pilt pildis mängimine</translation>
-<translation id="4742539557769756338">kaas</translation>
-<translation id="4748357248530471599">ekraani väljalõike täisekraanrežiimi sisse-/väljalülitamine</translation>
-<translation id="4757246831282535685">vahelehepaneel</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">otsing</translation>
-<translation id="4812940957355064477">Sisestage arv.</translation>
-<translation id="4912536737030637138">bibliograafia kirje</translation>
-<translation id="4975562563186953947">Valitud on <ph name="SELECTED_COUNT" /> üksust</translation>
-<translation id="4992066212339426712">Tühista vaigistus</translation>
-<translation id="49969490063480558">Sisestage märgile „<ph name="ATSIGN" />” järgnev osa. Aadress „<ph name="INVALIDADDRESS" />” pole täielik.</translation>
-<translation id="5034860022980953847">edenemise näidik</translation>
-<translation id="5090250355906949916">video ajakursor</translation>
-<translation id="5093189678851173835">epigraaf</translation>
-<translation id="5117590920725113268">Järgmise kuu kuvamine</translation>
-<translation id="512758898067543763">rea päis</translation>
-<translation id="5143125788380636750">epiloog</translation>
-<translation id="5164977714490026579">Väärtus peab olema suurem või võrdne <ph name="MINIMUM" />-ga.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Sisestage märgile „<ph name="ATSIGN" />” eelnev osa. Aadress „<ph name="INVALIDADDRESS" />” pole täielik.</translation>
-<translation id="5334352251556557839">Meediasisu ei saa esitada.</translation>
-<translation id="5406322316791861025">joonis</translation>
-<translation id="5453733299334684579">puuüksus</translation>
-<translation id="5466621249238537318">Valige üks või mitu faili.</translation>
-<translation id="5468998798572797635">täisekraanilt väljumine</translation>
-<translation id="5516424706154626233">kuupäeva valija</translation>
-<translation id="5537725057119320332">Ülekanne</translation>
-<translation id="5546461542133609677">vaigistuse tühistamine</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">10 sekundi võrra kerimiseks topeltpuudutage vasakul või paremal</translation>
-<translation id="5631759159893697722">abstraktne</translation>
-<translation id="5643186887447432888">nupp</translation>
-<translation id="5677946354068040947">rohkem valikuid</translation>
-<translation id="576709008726043716">sissejuhatus</translation>
-<translation id="57838592816432529">Vaigista</translation>
-<translation id="5860033963881614850">Väljas</translation>
-<translation id="588258955323874662">Täisekraan</translation>
-<translation id="5888666972993069672">Nüüd kantakse üle seadmesse <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">otsingukast</translation>
-<translation id="5939518447894949180">Lähtesta</translation>
-<translation id="5966707198760109579">Nädal</translation>
-<translation id="5987525920412732405">pöördnupp</translation>
-<translation id="6011459053400940133">helitugevuse liugur</translation>
-<translation id="6015796118275082299">Aasta</translation>
-<translation id="6023896073578205740">loendikast</translation>
-<translation id="6150588977291308318">bibliograafia</translation>
-<translation id="6164829606128959761">mõõdik</translation>
-<translation id="6166809985690652833">järelsõna</translation>
-<translation id="6209276755895393898">Näib olevat: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">sõnastik</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Välju režiimist Pilt pildis</translation>
-<translation id="6398862346408813489">Kuu valikupaneeli kuvamine</translation>
-<translation id="6404546809543547843">heli ajamõõdik</translation>
-<translation id="6443871981718447451">kuva subtiitrite menüü</translation>
-<translation id="6453774872122745852">tunnustused</translation>
-<translation id="648732519525291180">kellaaja valija</translation>
-<translation id="6550675742724504774">Valikud</translation>
-<translation id="6572309429103589720">Grammatikavead</translation>
-<translation id="658823671542763450">kuvamine täisekraanil</translation>
-<translation id="663493177488814956">voog</translation>
-<translation id="6637586476836377253">logi</translation>
-<translation id="6643016212128521049">Tühjenda</translation>
-<translation id="668171684555832681">Muu...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Kehv esituskvaliteet</translation>
-<translation id="6755330956360078551">tööriistavihje</translation>
-<translation id="6790428901817661496">Esita</translation>
-<translation id="6820355525329141109">Pistikprogrammi ei saanud laadida.</translation>
-<translation id="6820615603175220800">kasutatud kirjandus</translation>
-<translation id="6843725295806269523">vaigista</translation>
-<translation id="6885760532393684712">kataloog</translation>
-<translation id="689129560213475294">kolofoon</translation>
-<translation id="6934078000481955284">plokktsitaat</translation>
-<translation id="6941933287844615239">laadi meedia alla</translation>
-<translation id="6981594929165378967">lisamine</translation>
-<translation id="6989848892321993519">Pikendage teksti vähemalt <ph name="MIN_CHARACTERS" /> tähemärgini (kasutate praegu ühte tähemärki).</translation>
-<translation id="7033340931668032222">hääletugevuse muutmiseks üles- ja allanoole klahvi</translation>
-<translation id="709897737746224366">Vastendage nõutav vorming.</translation>
-<translation id="7118469954320184356">Kirjeldust pole.</translation>
-<translation id="7139483182332611405">eessõna</translation>
-<translation id="7214187073215825913">sisu teave</translation>
-<translation id="7263440858009898357">Valige loendist element.</translation>
-<translation id="727747134524199931">veeru päis</translation>
-<translation id="7320576522385648310">puhverdamine</translation>
-<translation id="7353453495576941748">autor(id)</translation>
-<translation id="7364796246159120393">Vali fail</translation>
-<translation id="739024184232394898">Muu ...</translation>
-<translation id="7405738980073107433">järelmärkused</translation>
-<translation id="7410239719251593705">Näib sisaldavat täiskasvanutele mõeldud sisu. Kirjeldust pole.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">Tabulaator</translation>
-<translation id="7514365320538308">Laadi alla</translation>
-<translation id="7529102961911894712">tagasilink</translation>
-<translation id="7533959249147584474">Sildita graafika</translation>
-<translation id="7647456547678091388">nõuanne</translation>
-<translation id="7661956066982048809">graafika dokument</translation>
-<translation id="7673697353781729403">Tunnid</translation>
-<translation id="7681220483256441252">register</translation>
-<translation id="7740050170769002709">HTML-sisu</translation>
-<translation id="7745230546936012372">Puuduvate pildikirjelduste hankimiseks avage kontekstimenüü.</translation>
-<translation id="7750228210027921155">Pilt pildis</translation>
-<translation id="775297008183122718">Kehtetu kirje</translation>
-<translation id="7789962463072032349">peata</translation>
-<translation id="7802800022689234070">avalikustamise kolmnurk</translation>
-<translation id="7888071071722539607">Lisage e-posti aadressile märk „<ph name="ATSIGN" />”. Aadressist „<ph name="INVALIDADDRESS" />” puudub märk „<ph name="ATSIGN" />”.</translation>
-<translation id="7891486169920085145">jagaja</translation>
-<translation id="795667975304826397">Pole valitud</translation>
-<translation id="8053789581856978548">otsinguteksti väli</translation>
-<translation id="8057695513531652401">teatis</translation>
-<translation id="8105797009065549151">märkuse viide</translation>
-<translation id="811583516810654505">Kirjelduse hankimine …</translation>
-<translation id="8117451130807776954">See nädal</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">kohaliku kuupäeva ja kellaaja valija</translation>
-<translation id="8261464734335370856">Õigekirjavead</translation>
-<translation id="8284326494547611709">Subtiitrid</translation>
-<translation id="835897206747267392">Kehtetu väärtus.</translation>
-<translation id="8403857369060869934">möödunud aeg: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">osa</translation>
-<translation id="8433900881053900389">tööriistariba</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> faili</translation>
-<translation id="8451268428117625855">Valige üks fail.</translation>
-<translation id="8461852803063341183">raadionupp</translation>
-<translation id="8474886197722836894">pühendus</translation>
-<translation id="8531739829932800271">veaparandused</translation>
-<translation id="8534579021159131403">Minutid</translation>
-<translation id="8541249477527128034">meedia juhtimine</translation>
-<translation id="8550857728288566671">graafika sümbol</translation>
-<translation id="8583702881314752957">definitsioonide loend</translation>
-<translation id="8597182159515967513">pealkiri</translation>
-<translation id="8603553056539299761">otsimiseks vasakut ja paremat klahvi</translation>
-<translation id="860475260694818407">sisukord</translation>
-<translation id="8613126697340063924">kaugesituse juhtimine</translation>
-<translation id="862370744433916922">alapealkiri</translation>
-<translation id="8711688047404765493">väljund</translation>
-<translation id="8750798805984357768">Tehke üks nendest valikutest.</translation>
-<translation id="8808573423886751634">peatükk</translation>
-<translation id="8845239796550121995">Kantakse nüüd üle telerisse</translation>
-<translation id="8851136666856101339">pea</translation>
-<translation id="8875657656876809964">Video taasesituse viga</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">kuu</translation>
-<translation id="901493112792887934">praegune aeg sekundites</translation>
-<translation id="901834265349196618">meil:</translation>
-<translation id="9048119486235211610">navigeerimine</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">valige esitamiseks/peatamiseks</translation>
-<translation id="9093215626363556771">välju režiimist Pilt pildis</translation>
-<translation id="9108370397979208512">matemaatika</translation>
-<translation id="9132465097189459683">Muu ...</translation>
-<translation id="9138385573473225930">hoiatus</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> alates kuupäevast <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Pilt pildis</translation>
-<translation id="9168329111483466115">allmärkus</translation>
-<translation id="954003015749068518">aktiveeri režiim Pilt pildis</translation>
-<translation id="966787709310836684">menüü</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_fa.xtb b/chromium/content/app/strings/translations/content_strings_fa.xtb
deleted file mode 100644
index 443dab76720..00000000000
--- a/chromium/content/app/strings/translations/content_strings_fa.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="fa">
-<translation id="1018939186200882850">مورد منو</translation>
-<translation id="10623998915015855">دکمه تغییر حالت</translation>
-<translation id="1088086359088493902">ثانیه</translation>
-<translation id="1171774979989969504">لطفاً یک نشانی ایمیل وارد کنید.</translation>
-<translation id="1178581264944972037">مکث</translation>
-<translation id="1188858454923323853">تکمیلی</translation>
-<translation id="1206619573307042055">نوشتار متحرک روی صفحه</translation>
-<translation id="1206693055195146388">لغزنده</translation>
-<translation id="1211441953136645838">ته‌نویس</translation>
-<translation id="1281252709823657822">کادر گفتگو</translation>
-<translation id="1335095011850992622">دست‌اندرکاران</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">برنما</translation>
-<translation id="1589122976691792535">منطقه</translation>
-<translation id="1591562245178063882">این ماه</translation>
-<translation id="1637811476055996098">انتخاب فایل‌ها</translation>
-<translation id="1650423536718072820">نقل‌قول</translation>
-<translation id="1727886345390570319">پنهان کردن منوی زیرنویس ناشنوایان</translation>
-<translation id="1729654308190250600">لطفاً یک نشانی ایمیل غیرخالی وارد کنید.</translation>
-<translation id="1758486001363313524">موارد دیگر...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">شبکه درختی</translation>
-<translation id="1822429046913737220">ق.ظ/ب.ظ</translation>
-<translation id="1832974991323546415">پخش در دستگاه راه دور</translation>
-<translation id="190587075670221089">حذف</translation>
-<translation id="1907737156431278478">مثال</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">وضعیت</translation>
-<translation id="1938124657309484470">مقدار باید <ph name="MAXIMUM_DATE_OR_TIME" /> یا قبل از آن باشد.</translation>
-<translation id="1946271899482435442">نمایش انتخابگر تاریخ</translation>
-<translation id="1993104285338243655">به نمایش صفحه‌نمایش روی دستگاه دیگر تغییر یافت</translation>
-<translation id="2060505056492490888">«<ph name="DOT" />» در «<ph name="INVALIDDOMAIN" />» در محل اشتباهی قرار دارد.</translation>
-<translation id="2148716181193084225">امروز</translation>
-<translation id="2158401438286456825">فهرست صفحه</translation>
-<translation id="2226276347425096477">لطفاً این متن را به اندازه <ph name="MAX_CHARACTERS" /> نویسه یا کمتر کوتاه کنید (شما در حال حاضر از <ph name="CURRENT_LENGTH" /> نویسه استفاده می‌کنید).</translation>
-<translation id="2246498165605549352">فایل محلی</translation>
-<translation id="2247351761944213033">هفته <ph name="WEEKNUMBER" />، <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">آهنگ <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">کادر تأیید</translation>
-<translation id="2311842470354187719">جداساز صفحه</translation>
-<translation id="2335594187091864976">انتخابگر تاریخ و زمان</translation>
-<translation id="245932805758469625">ثانیه‌های باقی‌مانده از ویدیو</translation>
-<translation id="248395913932153421">روز</translation>
-<translation id="2507943997699731163">لطفاً این قسمت را تکمیل کنید.</translation>
-<translation id="2508569020611168319">فهرست برگه</translation>
-<translation id="2561842179657104141">نمایش کنترل‌های رسانه بیشتر</translation>
-<translation id="2572483411312390101">پخش</translation>
-<translation id="2613802280814924224">لطفاً یک مقدار معتبر وارد کنید. نزدیک‌ترین مقدار معتبر <ph name="VALID_VALUE" /> است.</translation>
-<translation id="2653659639078652383">ارائه</translation>
-<translation id="2657045182931379222">شیء گرافیکی</translation>
-<translation id="2674318244760992338">پانویس</translation>
-<translation id="2709516037105925701">تکمیل خودکار</translation>
-<translation id="2723001399770238859">صدا</translation>
-<translation id="2746543609216772311">مقدار باید <ph name="MINIMUM_DATE_OR_TIME" /> یا بعد از آن باشد.</translation>
-<translation id="2759744352195237655">دکمه بازشو</translation>
-<translation id="2761667185364618470">درصورتی‌که می‌خواهید ادامه دهید، این کادر را انتخاب کنید.</translation>
-<translation id="2844350028562914727">جزئیات</translation>
-<translation id="2896972712917208084">گروه رادیویی</translation>
-<translation id="2908441821576996758">لطفاً لیستی از آدرس‌های ایمیل که با کاما از هم جدا شده‌اند را وارد کنید.</translation>
-<translation id="2940813599313844715">شیء</translation>
-<translation id="2942448076852699108">محتوای برجسته شده</translation>
-<translation id="3040011195152428237">پیوند</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> مگابایت</translation>
-<translation id="3075154866155599887">لطفاً یک مقدار معتبر وارد کنید. این قسمت کامل نیست و یا تاریخ نامعتبر است.</translation>
-<translation id="3078740164268491126">جدول</translation>
-<translation id="3086746722712840547">نت</translation>
-<translation id="310520048233152454">لطفاً یک نشانی وب وارد کنید.</translation>
-<translation id="3175736971608411871">تایمر</translation>
-<translation id="3199563858620722075">کادر ترکیبی</translation>
-<translation id="3450233048674729344">مقدار باید کمتر یا برابر با <ph name="MAXIMUM" /> باشد.</translation>
-<translation id="3486220673238053218">معنی</translation>
-<translation id="3557673793733683882">عنوان <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">انتخاب‌گر هفته</translation>
-<translation id="3685101356851116974">تصویر بدون برچسب</translation>
-<translation id="3706100364254443312">تعویض</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">خروج از تصویردرتصویر</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> گیگابایت</translation>
-<translation id="3808586225841795776">اصطلاح</translation>
-<translation id="3822383571486410024">لطفاً این نوشتار را به <ph name="MIN_CHARACTERS" /> نویسه یا بیشتر افزایش دهید (درحال حاضر از <ph name="CURRENT_LENGTH" /> نویسه استفاده می‌کنید).</translation>
-<translation id="383465348367842624">قسمت قبل از «<ph name="ATSIGN" />» نباید حاوی نماد «<ph name="INVALIDCHARACTER" />» باشد.</translation>
-<translation id="3846214748874656680">خروج از حالت تمام صفحه</translation>
-<translation id="3920932319529768807">نتیجه‌گیری</translation>
-<translation id="3924558731517983934">برنامه</translation>
-<translation id="3944740393230681990">گفتار آغازین</translation>
-<translation id="3960700977367013758">نوار پیمایش</translation>
-<translation id="4103419683916926126">میلی‌ ثانیه</translation>
-<translation id="4151657705144244502">گرافیک</translation>
-<translation id="4160057747563657758">تلفن</translation>
-<translation id="4193965531860883258">پیش‌گفتار</translation>
-<translation id="4201051445878709314">نمایش ماه قبلی</translation>
-<translation id="421884353938374759">انتخابگر رنگ</translation>
-<translation id="4248100235867064564">نوار منو</translation>
-<translation id="4360991593054037559">لطفاً یک مقدار معتبر وارد کنید. نزدیک‌ترین مقادیر معتبر <ph name="VALID_VALUE_LOW" /> و <ph name="VALID_VALUE_HIGHER" /> هستند.</translation>
-<translation id="4384583879834880242">پرسش و پاسخ</translation>
-<translation id="4413860115965805769">دکمه منو</translation>
-<translation id="4444765639179266822">ظاهراً <ph name="OCR_TEXT" /> را نشان می‌دهد</translation>
-<translation id="4446524499724042288">مرجع واژه‌نامه</translation>
-<translation id="4522570452068850558">جزئیات</translation>
-<translation id="4542388879936266156">زمان باقی‌مانده: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">فرم</translation>
-<translation id="4661075872484491155">درخت</translation>
-<translation id="4664250907885839816">قسمت بعد از «<ph name="ATSIGN" />» نباید حاوی نماد «<ph name="INVALIDCHARACTER" />» باشد.</translation>
-<translation id="4668956016107839909">ضمیمه</translation>
-<translation id="4718048029184481307">درحال پخش در حالت تصویردرتصویر</translation>
-<translation id="4742539557769756338">جلد</translation>
-<translation id="4748357248530471599">جابجایی برش نمایشگر تمام‌صفحه</translation>
-<translation id="4757246831282535685">پانل برگه</translation>
-<translation id="4763480195061959176">ویدئو</translation>
-<translation id="479989351350248267">جستجو</translation>
-<translation id="4812940957355064477">لطفاً شماره‌ای را وارد کنید.</translation>
-<translation id="4912536737030637138">ورودی فهرست منابع</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> انتخاب شد</translation>
-<translation id="4992066212339426712">باصدا کردن</translation>
-<translation id="49969490063480558">لطفاً قسمت بعد از «<ph name="ATSIGN" />» را وارد کنید. «<ph name="INVALIDADDRESS" />» ناقص است.</translation>
-<translation id="5034860022980953847">نشانگر پیشرفت</translation>
-<translation id="5090250355906949916">انتخابگر زمان ویدیو</translation>
-<translation id="5093189678851173835">نقل‌قول آغازین</translation>
-<translation id="5117590920725113268">نمایش ماه بعدی</translation>
-<translation id="512758898067543763">عنوان ردیف</translation>
-<translation id="5143125788380636750">گفتار پایانی</translation>
-<translation id="5164977714490026579">مقدار باید بیشتر یا مساوی با <ph name="MINIMUM" /> باشد.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> پتابایت</translation>
-<translation id="5307600278924710095">لطفاً قسمت قبل از «<ph name="ATSIGN" />» را وارد کنید. «<ph name="INVALIDADDRESS" />» ناقص است.</translation>
-<translation id="5334352251556557839">رسانه پخش نشد.</translation>
-<translation id="5406322316791861025">شکل</translation>
-<translation id="5453733299334684579">مورد درختی</translation>
-<translation id="5466621249238537318">لطفاً یک یا چند فایل را انتخاب کنید.</translation>
-<translation id="5468998798572797635">خروج از حالت تمام صفحه</translation>
-<translation id="5516424706154626233">انتخابگر تاریخ</translation>
-<translation id="5537725057119320332">فرستادن</translation>
-<translation id="5546461542133609677">صدادارکردن</translation>
-<translation id="561939826962581046">زمان</translation>
-<translation id="5630795885300617244">روی سمت راست یا چپ دو ضربه سریع بزنید تا ۱۰ ثانیه رد شود</translation>
-<translation id="5631759159893697722">انتزاعی</translation>
-<translation id="5643186887447432888">دکمه</translation>
-<translation id="5677946354068040947">گزینه‌های بیشتر</translation>
-<translation id="576709008726043716">مقدمه</translation>
-<translation id="57838592816432529">بی‌صدا کردن</translation>
-<translation id="5860033963881614850">خاموش</translation>
-<translation id="588258955323874662">تمام صفحه</translation>
-<translation id="5888666972993069672">درحال ارسال محتوا به <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">جعبه جستجو</translation>
-<translation id="5939518447894949180">بازنشانی</translation>
-<translation id="5966707198760109579">هفته</translation>
-<translation id="5987525920412732405">دکمه چرخش</translation>
-<translation id="6011459053400940133">لغزنده میزان صدا</translation>
-<translation id="6015796118275082299">سال</translation>
-<translation id="6023896073578205740">کادر فهرست</translation>
-<translation id="6150588977291308318">فهرست منابع</translation>
-<translation id="6164829606128959761">متر</translation>
-<translation id="6166809985690652833">سخن پایانی</translation>
-<translation id="6209276755895393898">به‌نظر می‌رسد <ph name="DESCRIPTION" /> باشد</translation>
-<translation id="6213469881011901533">واژه‌نامه</translation>
-<translation id="6281763101136022427">نشانی وب</translation>
-<translation id="6310801910862476708">خروج از تصویر در تصویر</translation>
-<translation id="6398862346408813489">نمایش پانل انتخاب ماه</translation>
-<translation id="6404546809543547843">انتخابگر زمان صدا</translation>
-<translation id="6443871981718447451">نمایش منوی زیرنویس ناشنوایان</translation>
-<translation id="6453774872122745852">قدردانی</translation>
-<translation id="648732519525291180">انتخابگر زمان</translation>
-<translation id="6550675742724504774">گزینه‌ها</translation>
-<translation id="6572309429103589720">دستور زبان نامعتبر</translation>
-<translation id="658823671542763450">رفتن به حالت تمام صفحه</translation>
-<translation id="663493177488814956">خبرمایه</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">پاک کردن</translation>
-<translation id="668171684555832681">دیگر...</translation>
-<translation id="6692633176391053278">گام به گام</translation>
-<translation id="6709570249143506788">کیفیت پخش ضعیف</translation>
-<translation id="6755330956360078551">نکته ابزار</translation>
-<translation id="6790428901817661496">پخش</translation>
-<translation id="6820355525329141109">افزایه بارگیری نشد.</translation>
-<translation id="6820615603175220800">مرجع فهرست منابع</translation>
-<translation id="6843725295806269523">بیصداکردن</translation>
-<translation id="6885760532393684712">فهرست راهنما</translation>
-<translation id="689129560213475294">انجامه</translation>
-<translation id="6934078000481955284">نقل‌قول</translation>
-<translation id="6941933287844615239">بارگیری رسانه</translation>
-<translation id="6981594929165378967">درج</translation>
-<translation id="6989848892321993519">لطفاً این نوشتار را به <ph name="MIN_CHARACTERS" /> نویسه یا بیشتر افزایش دهید (درحال‌حاضر از ۱ نویسه استفاده می‌کنید).</translation>
-<translation id="7033340931668032222">برای تغییر میزان صدا، به بالا و پایین بروید</translation>
-<translation id="709897737746224366">لطفاً با قالب درخواستی مطابقت دهید.</translation>
-<translation id="7118469954320184356">توضیحی دردسترس نیست.</translation>
-<translation id="7139483182332611405">پیش‌گفتار</translation>
-<translation id="7214187073215825913">اطلاعات محتوا</translation>
-<translation id="7263440858009898357">لطفاً یک مورد را در فهرست انتخاب کنید.</translation>
-<translation id="727747134524199931">عنوان ستون</translation>
-<translation id="7320576522385648310">درحال بافر کردن</translation>
-<translation id="7353453495576941748">تأیید اعتبار</translation>
-<translation id="7364796246159120393">انتخاب فایل</translation>
-<translation id="739024184232394898">موارد دیگر...</translation>
-<translation id="7405738980073107433">ته‌نویس‌ها</translation>
-<translation id="7410239719251593705">ظاهراً حاوی محتوای بزرگسالان است. توضیحی در دسترس نیست.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> ترابایت</translation>
-<translation id="7491962110804786152">برگه</translation>
-<translation id="7514365320538308">بارگیری</translation>
-<translation id="7529102961911894712">پیوند برگشت</translation>
-<translation id="7533959249147584474">گرافیک بدون برچسب</translation>
-<translation id="7647456547678091388">نکته</translation>
-<translation id="7661956066982048809">سند گرافیکی</translation>
-<translation id="7673697353781729403">ساعت</translation>
-<translation id="7681220483256441252">فهرست موضوعی</translation>
-<translation id="7740050170769002709">‏محتوای HTML</translation>
-<translation id="7745230546936012372">برای دریافت توضیحات تصویر جاافتاده، منوی بافت را باز کنید.</translation>
-<translation id="7750228210027921155">تصویردرتصویر</translation>
-<translation id="775297008183122718">ورودی نامعتبر</translation>
-<translation id="7789962463072032349">مکث</translation>
-<translation id="7802800022689234070">مثلث افشا</translation>
-<translation id="7888071071722539607">لطفاً نماد «<ph name="ATSIGN" />» را به نشانی ایمیل اضافه کنید. «<ph name="INVALIDADDRESS" />» در «<ph name="ATSIGN" />» موجود نیست.</translation>
-<translation id="7891486169920085145">تقسیم‌کننده</translation>
-<translation id="795667975304826397">فایلی انتخاب نشده است</translation>
-<translation id="8053789581856978548">فیلد نوشتاری جستجو</translation>
-<translation id="8057695513531652401">اطلاعیه</translation>
-<translation id="8105797009065549151">مرجع یادداشت</translation>
-<translation id="811583516810654505">درحال دریافت توضیح…</translation>
-<translation id="8117451130807776954">این هفته</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">انتخابگر تاریخ و زمان محلی</translation>
-<translation id="8261464734335370856">املای نامعتبر</translation>
-<translation id="8284326494547611709">زیرنویس‌ها</translation>
-<translation id="835897206747267392">مقدار نامعتبر.</translation>
-<translation id="8403857369060869934">زمان سپری‌شده: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">بخش</translation>
-<translation id="8433900881053900389">نوار ابزار</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> فایل</translation>
-<translation id="8451268428117625855">لطفاً یک فایل انتخاب کنید.</translation>
-<translation id="8461852803063341183">دکمه رادیو</translation>
-<translation id="8474886197722836894">تقدیم‌نامه</translation>
-<translation id="8531739829932800271">فهرست اشتباهات</translation>
-<translation id="8534579021159131403">دقیقه</translation>
-<translation id="8541249477527128034">کنترل رسانه</translation>
-<translation id="8550857728288566671">نماد گرافیکی</translation>
-<translation id="8583702881314752957">فهرست معنی‌ها</translation>
-<translation id="8597182159515967513">عنوان</translation>
-<translation id="8603553056539299761">برای جستجو، به چپ و راست بروید</translation>
-<translation id="860475260694818407">فهرست مطالب</translation>
-<translation id="8613126697340063924">کنترل بازپخش راه دور</translation>
-<translation id="862370744433916922">زیرنویس</translation>
-<translation id="8711688047404765493">خروجی</translation>
-<translation id="8750798805984357768">لطفاً یکی از این گزینه‌ها را انتخاب کنید.</translation>
-<translation id="8808573423886751634">فصل</translation>
-<translation id="8845239796550121995">درحال ارسال محتوا به تلویزیون</translation>
-<translation id="8851136666856101339">اصلی</translation>
-<translation id="8875657656876809964">خطا در بازپخش ویدئو</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> کیلوبایت</translation>
-<translation id="8987927404178983737">ماه</translation>
-<translation id="901493112792887934">زمان کنونی به ثانیه</translation>
-<translation id="901834265349196618">ایمیل</translation>
-<translation id="9048119486235211610">پیمایش</translation>
-<translation id="9062295712474918030">سند</translation>
-<translation id="9062307380734144336">برای تغییر وضعیت بین پخش/توقف موقت، انتخاب کنید</translation>
-<translation id="9093215626363556771">خروج از تصویر در تصویر</translation>
-<translation id="9108370397979208512">حساب</translation>
-<translation id="9132465097189459683">موارد دیگر...</translation>
-<translation id="9138385573473225930">هشدار</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />، شروع از <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">تصویر در تصویر</translation>
-<translation id="9168329111483466115">پانویس</translation>
-<translation id="954003015749068518">ورود به تصویر در تصویر</translation>
-<translation id="966787709310836684">منو</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_fi.xtb b/chromium/content/app/strings/translations/content_strings_fi.xtb
deleted file mode 100644
index 10151323dc9..00000000000
--- a/chromium/content/app/strings/translations/content_strings_fi.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="fi">
-<translation id="1018939186200882850">valikkokohde</translation>
-<translation id="10623998915015855">vaihtopainike</translation>
-<translation id="1088086359088493902">Sekuntia</translation>
-<translation id="1171774979989969504">Anna sähköpostiosoite.</translation>
-<translation id="1178581264944972037">Tauko</translation>
-<translation id="1188858454923323853">täydentävä</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">liukusäädin</translation>
-<translation id="1211441953136645838">loppuhuomautus</translation>
-<translation id="1281252709823657822">valintaikkuna</translation>
-<translation id="1335095011850992622">tunnustukset</translation>
-<translation id="1342835525016946179">artikkeli</translation>
-<translation id="1359897965706325498">banneri</translation>
-<translation id="1589122976691792535">alue</translation>
-<translation id="1591562245178063882">Tässä kuussa</translation>
-<translation id="1637811476055996098">Valitse tiedostot</translation>
-<translation id="1650423536718072820">erotettu lainaus</translation>
-<translation id="1727886345390570319">sulje tekstitysvalikko</translation>
-<translation id="1729654308190250600">Kirjoita ei-tyhjä sähköpostiosoite.</translation>
-<translation id="1758486001363313524">Muu...</translation>
-<translation id="1806710327868736751">ilmoitusvalintaikkuna</translation>
-<translation id="1821985195704844674">puuruudukko</translation>
-<translation id="1822429046913737220">AP/IP</translation>
-<translation id="1832974991323546415">toista etälaitteella</translation>
-<translation id="190587075670221089">poisto</translation>
-<translation id="1907737156431278478">esimerkki</translation>
-<translation id="1921819250265091946">pp</translation>
-<translation id="1930711995431081526">tila</translation>
-<translation id="1938124657309484470">Arvon on oltava <ph name="MAXIMUM_DATE_OR_TIME" /> tai aiempi.</translation>
-<translation id="1946271899482435442">Näytä päivämäärävalitsin</translation>
-<translation id="1993104285338243655">Peilaus käynnissä</translation>
-<translation id="2060505056492490888"><ph name="DOT" />-merkkiä on käytetty väärässä kohdassa osoitteessa <ph name="INVALIDDOMAIN" />.</translation>
-<translation id="2148716181193084225">Tänään</translation>
-<translation id="2158401438286456825">sivuluettelo</translation>
-<translation id="2226276347425096477">Lyhennä tämä teksti alle <ph name="MAX_CHARACTERS" /> merkkiin (tällä hetkellä käytössä <ph name="CURRENT_LENGTH" /> merkkiä).</translation>
-<translation id="2246498165605549352">Paikallinen tiedosto</translation>
-<translation id="2247351761944213033">Viikko <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Kappale <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">valintaruutu</translation>
-<translation id="2311842470354187719">sivunvaihto</translation>
-<translation id="2335594187091864976">päivämäärän ja ajan valitsin</translation>
-<translation id="245932805758469625">videon jäljellä oleva aika sekunteina</translation>
-<translation id="248395913932153421">Päivä</translation>
-<translation id="2507943997699731163">Täytä tämä kenttä.</translation>
-<translation id="2508569020611168319">välilehtiluettelo</translation>
-<translation id="2561842179657104141">näytä lisää mediaohjaimia</translation>
-<translation id="2572483411312390101">toista</translation>
-<translation id="2613802280814924224">Syötä kelvollinen arvo. Lähin kelvollinen arvo on <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Lähetä</translation>
-<translation id="2657045182931379222">grafiikkaobjekti</translation>
-<translation id="2674318244760992338">alaviite</translation>
-<translation id="2709516037105925701">Automaattinen täyttö</translation>
-<translation id="2723001399770238859">ääni</translation>
-<translation id="2746543609216772311">Arvon on oltava <ph name="MINIMUM_DATE_OR_TIME" /> tai myöhempi.</translation>
-<translation id="2759744352195237655">ponnahduspainike</translation>
-<translation id="2761667185364618470">Valitse tämä ruutu jatkaaksesi.</translation>
-<translation id="2844350028562914727">tiedot</translation>
-<translation id="2896972712917208084">valintapainikeryhmä</translation>
-<translation id="2908441821576996758">Anna pilkuilla erotettu sähköpostiosoitteiden luettelo.</translation>
-<translation id="2940813599313844715">kohde</translation>
-<translation id="2942448076852699108">korostettu sisältö</translation>
-<translation id="3040011195152428237">linkki</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> Mt</translation>
-<translation id="3075154866155599887">Anna kelvollinen arvo. Kentän arvo on puutteellinen tai annettu päivä on virheellinen.</translation>
-<translation id="3078740164268491126">taulukko</translation>
-<translation id="3086746722712840547">huom.</translation>
-<translation id="310520048233152454">Anna URL-osoite.</translation>
-<translation id="3175736971608411871">ajastin</translation>
-<translation id="3199563858620722075">yhdistelmäruutu</translation>
-<translation id="3450233048674729344">Arvon tulee olla pienempi tai yhtä suuri kuin <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">määritelmä</translation>
-<translation id="3557673793733683882">otsikko <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">viikon valitsin</translation>
-<translation id="3685101356851116974">Tunnisteeton kuva</translation>
-<translation id="3706100364254443312">vaihto</translation>
-<translation id="3732799496749320381">kk</translation>
-<translation id="3754210790023674521">Sulje kuva kuvassa ‑tila</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> Gt</translation>
-<translation id="3808586225841795776">termi</translation>
-<translation id="3822383571486410024">Pidennä tämä teksti yli <ph name="MIN_CHARACTERS" /> merkkiin (tällä hetkellä käytössä <ph name="CURRENT_LENGTH" /> merkkiä).</translation>
-<translation id="383465348367842624"><ph name="ATSIGN" />-osaa ennen tulevassa osassa ei pitäisi olla merkkiä <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="3846214748874656680">Sulje koko näytön tila.</translation>
-<translation id="3920932319529768807">johtopäätös</translation>
-<translation id="3924558731517983934">sovellus</translation>
-<translation id="3944740393230681990">prologi</translation>
-<translation id="3960700977367013758">vierityspalkki</translation>
-<translation id="4103419683916926126">Millisekuntia</translation>
-<translation id="4151657705144244502">kuva</translation>
-<translation id="4160057747563657758">puhelin</translation>
-<translation id="4193965531860883258">esipuhe</translation>
-<translation id="4201051445878709314">Näytä edellinen kuukausi</translation>
-<translation id="421884353938374759">värinvalitsin</translation>
-<translation id="4248100235867064564">valikkopalkki</translation>
-<translation id="4360991593054037559">Syötä kelvollinen arvo. Kaksi lähintä kelvollista arvoa ovat <ph name="VALID_VALUE_LOW" /> ja <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">K &amp; V</translation>
-<translation id="4413860115965805769">valikkopainike</translation>
-<translation id="4444765639179266822">Kuuluu sanovan: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">sanastoviittaus</translation>
-<translation id="4522570452068850558">Tiedot</translation>
-<translation id="4542388879936266156">jäljellä oleva aika: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">lomake</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816"><ph name="ATSIGN" />-osan jälkeen tulevassa osassa ei pitäisi olla merkkiä <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="4668956016107839909">liite</translation>
-<translation id="4718048029184481307">Toistetaan kuva kuvassa ‑tilassa</translation>
-<translation id="4742539557769756338">kansi</translation>
-<translation id="4748357248530471599">näyttölovi osana koko näytön tilaa päälle/pois</translation>
-<translation id="4757246831282535685">välilehtipaneeli</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">haku</translation>
-<translation id="4812940957355064477">Anna numero.</translation>
-<translation id="4912536737030637138">lähdeluettelomerkintä</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> valittu</translation>
-<translation id="4992066212339426712">Poista mykistys</translation>
-<translation id="49969490063480558">Kirjoita loppuun asti osoite, joka alkaa <ph name="ATSIGN" />. <ph name="INVALIDADDRESS" /> on vielä kesken.</translation>
-<translation id="5034860022980953847">etenemisen osoitin</translation>
-<translation id="5090250355906949916">videon ajan liukusäädin</translation>
-<translation id="5093189678851173835">epigrafi</translation>
-<translation id="5117590920725113268">Näytä seuraava kuukausi</translation>
-<translation id="512758898067543763">rivin otsikko</translation>
-<translation id="5143125788380636750">epilogi</translation>
-<translation id="5164977714490026579">Arvon tulee olla suurempi tai yhtä suuri kuin <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> Pt</translation>
-<translation id="5307600278924710095">Lisää <ph name="ATSIGN" />-osaa ennen tuleva osa. <ph name="INVALIDADDRESS" /> on puutteellinen.</translation>
-<translation id="5334352251556557839">Mediaa ei voi toistaa.</translation>
-<translation id="5406322316791861025">kuva</translation>
-<translation id="5453733299334684579">puukohde</translation>
-<translation id="5466621249238537318">Valitse vähintään yksi tiedosto.</translation>
-<translation id="5468998798572797635">poistu koko näytön tilasta</translation>
-<translation id="5516424706154626233">päivämäärän valitsin</translation>
-<translation id="5537725057119320332">Lähetä</translation>
-<translation id="5546461542133609677">peruuta mykistys</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Ohita 10 sekuntia kaksoisnapauttamalla vasemmalle tai oikealle.</translation>
-<translation id="5631759159893697722">tiivistelmä</translation>
-<translation id="5643186887447432888">painike</translation>
-<translation id="5677946354068040947">lisäasetukset</translation>
-<translation id="576709008726043716">johdanto</translation>
-<translation id="57838592816432529">Mykistä</translation>
-<translation id="5860033963881614850">Pois käytöstä</translation>
-<translation id="588258955323874662">Koko ruutu</translation>
-<translation id="5888666972993069672">Katsotaan TV:stä <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">hakukenttä</translation>
-<translation id="5939518447894949180">Tyhjennä</translation>
-<translation id="5966707198760109579">Viikko</translation>
-<translation id="5987525920412732405">pyöräytyspainike</translation>
-<translation id="6011459053400940133">äänenvoimakkuuden liukusäädin</translation>
-<translation id="6015796118275082299">Vuosi</translation>
-<translation id="6023896073578205740">luetteloruutu</translation>
-<translation id="6150588977291308318">lähdeluettelo</translation>
-<translation id="6164829606128959761">mittari</translation>
-<translation id="6166809985690652833">jälkipuhe</translation>
-<translation id="6209276755895393898">Näkyy olevan: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">sanasto</translation>
-<translation id="6281763101136022427">url-osoite</translation>
-<translation id="6310801910862476708">Sulje kuva kuvassa ‑tila</translation>
-<translation id="6398862346408813489">Näytä kuukaudenvalintapaneeli</translation>
-<translation id="6404546809543547843">äänen ajan liukusäädin</translation>
-<translation id="6443871981718447451">näytä tekstitysvalikko</translation>
-<translation id="6453774872122745852">kiitokset</translation>
-<translation id="648732519525291180">ajan valitsin</translation>
-<translation id="6550675742724504774">Asetukset</translation>
-<translation id="6572309429103589720">Kielioppivirhe</translation>
-<translation id="658823671542763450">siirry koko näytön tilaan</translation>
-<translation id="663493177488814956">fiidi</translation>
-<translation id="6637586476836377253">loki</translation>
-<translation id="6643016212128521049">Tyhjennä</translation>
-<translation id="668171684555832681">Joku muu profiili...</translation>
-<translation id="6692633176391053278">askellin</translation>
-<translation id="6709570249143506788">Heikko toiston laatu</translation>
-<translation id="6755330956360078551">työkaluvinkki</translation>
-<translation id="6790428901817661496">Toista</translation>
-<translation id="6820355525329141109">Laajennuksen lataaminen epäonnistui.</translation>
-<translation id="6820615603175220800">lähdeluetteloviittaus</translation>
-<translation id="6843725295806269523">äänetön</translation>
-<translation id="6885760532393684712">hakemisto</translation>
-<translation id="689129560213475294">kolofoni</translation>
-<translation id="6934078000481955284">muotoiltu lainaus</translation>
-<translation id="6941933287844615239">lataa media</translation>
-<translation id="6981594929165378967">lisäys</translation>
-<translation id="6989848892321993519">Pidennä tämä teksti vähintään <ph name="MIN_CHARACTERS" /> merkkiin (tällä hetkellä käytössä 1 merkki).</translation>
-<translation id="7033340931668032222">ylös ja alas, niin voit muuttaa äänenvoimakkuutta</translation>
-<translation id="709897737746224366">Käytä pyydettyä muotoilua.</translation>
-<translation id="7118469954320184356">Ei kuvausta saatavilla</translation>
-<translation id="7139483182332611405">johdanto</translation>
-<translation id="7214187073215825913">sisältötiedot</translation>
-<translation id="7263440858009898357">Valitse kohde luettelosta.</translation>
-<translation id="727747134524199931">sarakkeen otsikko</translation>
-<translation id="7320576522385648310">puskuroidaan</translation>
-<translation id="7353453495576941748">tunnustus</translation>
-<translation id="7364796246159120393">Valitse tiedosto</translation>
-<translation id="739024184232394898">Muu...</translation>
-<translation id="7405738980073107433">loppuhuomautukset</translation>
-<translation id="7410239719251593705">Vaikuttaa sisältävän aikuisille suunnattua sisältöä Ei kuvausta saatavilla</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> Tt</translation>
-<translation id="7491962110804786152">sarkain</translation>
-<translation id="7514365320538308">Lataa</translation>
-<translation id="7529102961911894712">viittaajan linkki</translation>
-<translation id="7533959249147584474">Grafiikka, jolla ei ole tunnistetta</translation>
-<translation id="7647456547678091388">vinkki</translation>
-<translation id="7661956066982048809">grafiikkadokumentti</translation>
-<translation id="7673697353781729403">Tuntia</translation>
-<translation id="7681220483256441252">hakemisto</translation>
-<translation id="7740050170769002709">HTML-sisältö</translation>
-<translation id="7745230546936012372">Avaa kontekstivalikko, niin näet puuttuvia kuvien selityksiä</translation>
-<translation id="7750228210027921155">Kuva kuvassa</translation>
-<translation id="775297008183122718">Virheellinen arvo</translation>
-<translation id="7789962463072032349">tauko</translation>
-<translation id="7802800022689234070">näyttämiskolmio</translation>
-<translation id="7888071071722539607">Sähköpostiosoitteeseen kuuluu <ph name="ATSIGN" />-osa. Osoitteesta <ph name="INVALIDADDRESS" /> puuttuu <ph name="ATSIGN" />.</translation>
-<translation id="7891486169920085145">jakaja</translation>
-<translation id="795667975304826397">Ei valittua tiedostoa</translation>
-<translation id="8053789581856978548">hakutekstikenttä</translation>
-<translation id="8057695513531652401">ilmoitus</translation>
-<translation id="8105797009065549151">muistiinpanoviittaus</translation>
-<translation id="811583516810654505">Haetaan kuvausta…</translation>
-<translation id="8117451130807776954">Tällä viikolla</translation>
-<translation id="8199524924445686405">vvvv</translation>
-<translation id="8208673686607688524">paikallisen päivämäärän ja ajan valitsin</translation>
-<translation id="8261464734335370856">Kirjoitusvirhe</translation>
-<translation id="8284326494547611709">Tekstitykset</translation>
-<translation id="835897206747267392">Virheellinen arvo.</translation>
-<translation id="8403857369060869934">kulunut aika: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">osa</translation>
-<translation id="8433900881053900389">työkalupalkki</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> tiedostoa</translation>
-<translation id="8451268428117625855">Valitse tiedosto.</translation>
-<translation id="8461852803063341183">valintapainike</translation>
-<translation id="8474886197722836894">omistuskirjoitus</translation>
-<translation id="8531739829932800271">oikaisut</translation>
-<translation id="8534579021159131403">Minuuttia</translation>
-<translation id="8541249477527128034">median hallinta</translation>
-<translation id="8550857728288566671">grafiikkasymboli</translation>
-<translation id="8583702881314752957">määritelmäluettelo</translation>
-<translation id="8597182159515967513">otsikko</translation>
-<translation id="8603553056539299761">vasemmalle ja oikealle, niin voit hakea</translation>
-<translation id="860475260694818407">sisällysluettelo</translation>
-<translation id="8613126697340063924">hallinnoi etätoistoa</translation>
-<translation id="862370744433916922">alaotsikko</translation>
-<translation id="8711688047404765493">syöte</translation>
-<translation id="8750798805984357768">Valitse yksi vaihtoehdoista.</translation>
-<translation id="8808573423886751634">luku</translation>
-<translation id="8845239796550121995">Suoratoistetaan televisioosi</translation>
-<translation id="8851136666856101339">pää</translation>
-<translation id="8875657656876809964">Videon toistovirhe</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kt</translation>
-<translation id="8987927404178983737">Kuukausi</translation>
-<translation id="901493112792887934">nykyinen toistoaika sekunteina</translation>
-<translation id="901834265349196618">sähköposti</translation>
-<translation id="9048119486235211610">navigointi</translation>
-<translation id="9062295712474918030">dokumentti</translation>
-<translation id="9062307380734144336">valitse, jos haluat toistaa tai keskeyttää toiston</translation>
-<translation id="9093215626363556771">sulje kuva kuvassa ‑tila</translation>
-<translation id="9108370397979208512">matematiikka</translation>
-<translation id="9132465097189459683">Muu...</translation>
-<translation id="9138385573473225930">ilmoitus</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, alkupäivä: <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Kuva kuvassa</translation>
-<translation id="9168329111483466115">alaviite</translation>
-<translation id="954003015749068518">avaa kuva kuvassa ‑tila</translation>
-<translation id="966787709310836684">valikko</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_fil.xtb b/chromium/content/app/strings/translations/content_strings_fil.xtb
deleted file mode 100644
index b3baf6c95c7..00000000000
--- a/chromium/content/app/strings/translations/content_strings_fil.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="fil">
-<translation id="1018939186200882850">item sa menu</translation>
-<translation id="10623998915015855">button sa pag-toggle</translation>
-<translation id="1088086359088493902">Segundo</translation>
-<translation id="1171774979989969504">Mangyaring magpasok ng email address.</translation>
-<translation id="1178581264944972037">I-pause</translation>
-<translation id="1188858454923323853">complementary</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">slider</translation>
-<translation id="1211441953136645838">endnote</translation>
-<translation id="1281252709823657822">dialog</translation>
-<translation id="1335095011850992622">mga credit</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">rehiyon</translation>
-<translation id="1591562245178063882">Buwang ito</translation>
-<translation id="1637811476055996098">Pumili ng Mga File</translation>
-<translation id="1650423536718072820">pullquote</translation>
-<translation id="1727886345390570319">itago ang menu ng mga nakasarang caption</translation>
-<translation id="1729654308190250600">Mangyaring maglagay ng isang non-empty na email address.</translation>
-<translation id="1758486001363313524">Iba pa...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">tree grid</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">i-play sa malayuang device</translation>
-<translation id="190587075670221089">pag-delete</translation>
-<translation id="1907737156431278478">halimbawa</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">katayuan</translation>
-<translation id="1938124657309484470">Dapat <ph name="MAXIMUM_DATE_OR_TIME" /> o mas nauna ang value.</translation>
-<translation id="1946271899482435442">Ipakita ang picker ng petsa</translation>
-<translation id="1993104285338243655">Lumipat sa pag-mirror</translation>
-<translation id="2060505056492490888">Ginamit ang '<ph name="DOT" />' sa maling posisyon sa '<ph name="INVALIDDOMAIN" />.'</translation>
-<translation id="2148716181193084225">Ngayon</translation>
-<translation id="2158401438286456825">listahan ng page</translation>
-<translation id="2226276347425096477">Mangyaring paikliin ang tekstong ito ng <ph name="MAX_CHARACTERS" /> (na) character o mas mababa (kasalukuyan kang gumagamit ng <ph name="CURRENT_LENGTH" /> (na) character).</translation>
-<translation id="2246498165605549352">Lokal na File</translation>
-<translation id="2247351761944213033">Linggo <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Track <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">checkbox</translation>
-<translation id="2311842470354187719">page break</translation>
-<translation id="2335594187091864976">picker ng petsa at oras</translation>
-<translation id="245932805758469625">bilang ng mga segundong natitira sa video</translation>
-<translation id="248395913932153421">Araw</translation>
-<translation id="2507943997699731163">Pakipunan ang field na ito.</translation>
-<translation id="2508569020611168319">listahan ng tab</translation>
-<translation id="2561842179657104141">magpakita ng higit pang kontrol sa media</translation>
-<translation id="2572483411312390101">i-play</translation>
-<translation id="2613802280814924224">Mangyaring maglagay ng isang wastong value. Ang pinakamalapit na wastong value ay <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Isumite</translation>
-<translation id="2657045182931379222">object ng graphics</translation>
-<translation id="2674318244760992338">footer</translation>
-<translation id="2709516037105925701">AutoFill</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Dapat <ph name="MINIMUM_DATE_OR_TIME" /> o mas bago ang value.</translation>
-<translation id="2759744352195237655">pop up na button</translation>
-<translation id="2761667185364618470">Pakitingnan ang kahon na ito kung gusto mong magpatuloy.</translation>
-<translation id="2844350028562914727">mga detalye</translation>
-<translation id="2896972712917208084">pangkat ng radyo</translation>
-<translation id="2908441821576996758">Mangyaring magpasok ng listahan ng email address na pinaghihiwalay ng kuwit.</translation>
-<translation id="2940813599313844715">object</translation>
-<translation id="2942448076852699108">naka-highlight na content</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> (na) MB</translation>
-<translation id="3075154866155599887">Mangyaring maglagay ng wastong halaga. Hindi kumpleto ang field o may isang di-wastong petsa.</translation>
-<translation id="3078740164268491126">talahanayan</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Mangyaring magpasok ng URL.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">combo box</translation>
-<translation id="3450233048674729344">Dapat mas mababa kaysa sa o katumbas ng <ph name="MAXIMUM" /> ang halaga.</translation>
-<translation id="3486220673238053218">kahulugan</translation>
-<translation id="3557673793733683882">heading <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">picker ng linggo</translation>
-<translation id="3685101356851116974">Walang label na larawan</translation>
-<translation id="3706100364254443312">lumipat</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Lumabas sa picture-in-picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> (na) GB</translation>
-<translation id="3808586225841795776">termino</translation>
-<translation id="3822383571486410024">Pakihabaan ang text na ito hanggang <ph name="MIN_CHARACTERS" /> (na) character o higit pa (kasalukuyan kang gumagamit ng <ph name="CURRENT_LENGTH" /> (na) character).</translation>
-<translation id="383465348367842624">Hindi dapat naglalaman ng simbolong '<ph name="INVALIDCHARACTER" />' ang bahagi bago ang '<ph name="ATSIGN" />.'</translation>
-<translation id="3846214748874656680">Lumabas sa fullscreen</translation>
-<translation id="3920932319529768807">konklusyon</translation>
-<translation id="3924558731517983934">application</translation>
-<translation id="3944740393230681990">prologue</translation>
-<translation id="3960700977367013758">scroll bar</translation>
-<translation id="4103419683916926126">Milliseconds</translation>
-<translation id="4151657705144244502">graphic</translation>
-<translation id="4160057747563657758">telepono</translation>
-<translation id="4193965531860883258">foreword</translation>
-<translation id="4201051445878709314">Ipakita ang nakaraang buwan</translation>
-<translation id="421884353938374759">tagapili ng kulay</translation>
-<translation id="4248100235867064564">menu bar</translation>
-<translation id="4360991593054037559">Mangyaring maglagay ng isang wastong value. Ang dalawang pinakamalapit na wastong value ay <ph name="VALID_VALUE_LOW" /> at <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Q&amp;A</translation>
-<translation id="4413860115965805769">button ng menu</translation>
-<translation id="4444765639179266822">Mukhang ang sabi ay: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">sanggunian sa glosaryo</translation>
-<translation id="4522570452068850558">Mga Detalye</translation>
-<translation id="4542388879936266156">natitirang oras: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">form</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Hindi dapat naglalaman ng simbolong '<ph name="INVALIDCHARACTER" />' ang bahagi pagkatapos ng '<ph name="ATSIGN" />.'</translation>
-<translation id="4668956016107839909">appendix</translation>
-<translation id="4718048029184481307">Nagpe-play sa picture-in-picture</translation>
-<translation id="4742539557769756338">cover</translation>
-<translation id="4748357248530471599">i-toggle ang fullscreen ng cutout ng display</translation>
-<translation id="4757246831282535685">panel ng tab</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Mangyaring maglagay ng numero.</translation>
-<translation id="4912536737030637138">entry sa bibliograpiya</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> ang napili</translation>
-<translation id="4992066212339426712">I-unmute</translation>
-<translation id="49969490063480558">Mangyaring maglagay ng isang bahagi pagkatapos ng '<ph name="ATSIGN" />.' Hindi kumpleto ang '<ph name="INVALIDADDRESS" />.'</translation>
-<translation id="5034860022980953847">indicator ng pag-usad</translation>
-<translation id="5090250355906949916">scrubber ng tagal ng video</translation>
-<translation id="5093189678851173835">epigraph</translation>
-<translation id="5117590920725113268">Ipakita ang susunod na buwan</translation>
-<translation id="512758898067543763">header ng row</translation>
-<translation id="5143125788380636750">epilogue</translation>
-<translation id="5164977714490026579">Dapat mas mataas kaysa sa o katumbas ng <ph name="MINIMUM" /> ang halaga.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> (na) PB</translation>
-<translation id="5307600278924710095">Mangyaring maglagay ng isang bahagi na sinusundan ng '<ph name="ATSIGN" />.' Hindi kumpleto ang '<ph name="INVALIDADDRESS" />.'</translation>
-<translation id="5334352251556557839">Hindi ma-play ang media.</translation>
-<translation id="5406322316791861025">anyo</translation>
-<translation id="5453733299334684579">item sa tree</translation>
-<translation id="5466621249238537318">Mangyaring pumili ng isa o higit pang mga file.</translation>
-<translation id="5468998798572797635">lumabas sa full screen</translation>
-<translation id="5516424706154626233">picker ng petsa</translation>
-<translation id="5537725057119320332">I-cast</translation>
-<translation id="5546461542133609677">i-unmute</translation>
-<translation id="561939826962581046">oras</translation>
-<translation id="5630795885300617244">Mag-double tap sa kaliwa o kanan upang lumaktaw nang 10s</translation>
-<translation id="5631759159893697722">abstract</translation>
-<translation id="5643186887447432888">button</translation>
-<translation id="5677946354068040947">higit pang opsyon</translation>
-<translation id="576709008726043716">panimula</translation>
-<translation id="57838592816432529">I-mute</translation>
-<translation id="5860033963881614850">Naka-off</translation>
-<translation id="588258955323874662">Fullscreen</translation>
-<translation id="5888666972993069672">Nagka-cast na sa <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">box para sa paghahanap</translation>
-<translation id="5939518447894949180">I-reset</translation>
-<translation id="5966707198760109579">Linggo</translation>
-<translation id="5987525920412732405">button ng pag-spin</translation>
-<translation id="6011459053400940133">slider ng volume</translation>
-<translation id="6015796118275082299">Taon</translation>
-<translation id="6023896073578205740">kahon ng listahan</translation>
-<translation id="6150588977291308318">bibliograpiya</translation>
-<translation id="6164829606128959761">metro</translation>
-<translation id="6166809985690652833">afterword</translation>
-<translation id="6209276755895393898">Mukhang: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosaryo</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Lumabas sa Picture-in-Picture</translation>
-<translation id="6398862346408813489">Ipakita ang panel ng pagpipilian ng buwan</translation>
-<translation id="6404546809543547843">scrubber ng oras ng audio</translation>
-<translation id="6443871981718447451">Ipakita ang menu ng mga nakasarang caption</translation>
-<translation id="6453774872122745852">mga pagkilala</translation>
-<translation id="648732519525291180">picker ng petsa</translation>
-<translation id="6550675742724504774">Mga Pagpipilian</translation>
-<translation id="6572309429103589720">Invalid na grammar</translation>
-<translation id="658823671542763450">mag-full screen</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">I-clear</translation>
-<translation id="668171684555832681">Iba pa...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Hindi magandang playback quality</translation>
-<translation id="6755330956360078551">tooltip</translation>
-<translation id="6790428901817661496">I-play</translation>
-<translation id="6820355525329141109">Hindi ma-load ang plugin.</translation>
-<translation id="6820615603175220800">sanggunian sa bibliograpiya</translation>
-<translation id="6843725295806269523">i-mute</translation>
-<translation id="6885760532393684712">direktoryo</translation>
-<translation id="689129560213475294">colophon</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">i-download ang media</translation>
-<translation id="6981594929165378967">paglagay</translation>
-<translation id="6989848892321993519">Pakidagdagan ang text na ito nang hanggang <ph name="MIN_CHARACTERS" /> (na) character o higit pa (kasalukuyan kang gumagamit ng 1 character).</translation>
-<translation id="7033340931668032222">pataas at pababa para baguhin ang volume</translation>
-<translation id="709897737746224366">Pakitugma ang hiniling na format.</translation>
-<translation id="7118469954320184356">Walang available na paglalarawan.</translation>
-<translation id="7139483182332611405">preface</translation>
-<translation id="7214187073215825913">impormasyon ng content</translation>
-<translation id="7263440858009898357">Mangyaring pumili ng item sa listahan.</translation>
-<translation id="727747134524199931">header ng column</translation>
-<translation id="7320576522385648310">nagba-buffer</translation>
-<translation id="7353453495576941748">credit</translation>
-<translation id="7364796246159120393">Pumili ng File</translation>
-<translation id="739024184232394898">Iba pa...</translation>
-<translation id="7405738980073107433">mga endnote</translation>
-<translation id="7410239719251593705">Mukhang may lamang pang-adult na content. Walang available na paglalarawan.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> (na) TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">I-download</translation>
-<translation id="7529102961911894712">back link</translation>
-<translation id="7533959249147584474">Walang label na graphic</translation>
-<translation id="7647456547678091388">tip</translation>
-<translation id="7661956066982048809">dokumento ng graphics</translation>
-<translation id="7673697353781729403">Oras</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">HTML na nilalaman</translation>
-<translation id="7745230546936012372">Para kunin ang mga paglalarawan ng larawan, buksan ang menu ng konteksto.</translation>
-<translation id="7750228210027921155">Picture in picture</translation>
-<translation id="775297008183122718">Di-wastong entry</translation>
-<translation id="7789962463072032349">i-pause</translation>
-<translation id="7802800022689234070">disclosure triangle</translation>
-<translation id="7888071071722539607">Mangyaring magsama ng '<ph name="ATSIGN" />' sa email address. Kulang ng '<ph name="ATSIGN" />' ang '<ph name="INVALIDADDRESS" />.'</translation>
-<translation id="7891486169920085145">splitter</translation>
-<translation id="795667975304826397">Walang napiling file</translation>
-<translation id="8053789581856978548">text field ng paghahanap</translation>
-<translation id="8057695513531652401">paunawa</translation>
-<translation id="8105797009065549151">sanggunian sa tala</translation>
-<translation id="811583516810654505">Kinukuha ang paglalarawan...</translation>
-<translation id="8117451130807776954">Linggong ito</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">picker ng lokal na petsa at oras</translation>
-<translation id="8261464734335370856">Invalid na spelling</translation>
-<translation id="8284326494547611709">Mga Caption</translation>
-<translation id="835897206747267392">Di-wastong halaga.</translation>
-<translation id="8403857369060869934">lumipas na oras: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">bahagi</translation>
-<translation id="8433900881053900389">toolbar</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> mga file</translation>
-<translation id="8451268428117625855">Mangyaring pumili ng file.</translation>
-<translation id="8461852803063341183">radio button</translation>
-<translation id="8474886197722836894">dedikasyon</translation>
-<translation id="8531739829932800271">mga erratum</translation>
-<translation id="8534579021159131403">Minuto</translation>
-<translation id="8541249477527128034">kontrol sa media</translation>
-<translation id="8550857728288566671">simbolo ng graphics</translation>
-<translation id="8583702881314752957">listahan ng kahulugan</translation>
-<translation id="8597182159515967513">heading</translation>
-<translation id="8603553056539299761">pakaliwa at pakanan para mag-seek</translation>
-<translation id="860475260694818407">talaan ng nilalaman</translation>
-<translation id="8613126697340063924">kontrolin ang malayuang pag-playback</translation>
-<translation id="862370744433916922">subtitle</translation>
-<translation id="8711688047404765493">output</translation>
-<translation id="8750798805984357768">Mangyaring pumili ng isa sa mga opsyong ito.</translation>
-<translation id="8808573423886751634">kabanata</translation>
-<translation id="8845239796550121995">Ikina-cast ngayon sa iyong TV</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Error sa pag-playback ng video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Buwan</translation>
-<translation id="901493112792887934">kasalukuyang oras ayon sa segundo</translation>
-<translation id="901834265349196618">email</translation>
-<translation id="9048119486235211610">navigation</translation>
-<translation id="9062295712474918030">dokumento</translation>
-<translation id="9062307380734144336">pillin para i-toggle ang i-play at i-pause</translation>
-<translation id="9093215626363556771">lumabas sa picture-in-picture</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Iba pa...</translation>
-<translation id="9138385573473225930">alerto</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, na magsisimula sa <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picture in Picture</translation>
-<translation id="9168329111483466115">footnote</translation>
-<translation id="954003015749068518">pumasok sa picture-in-picture</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_fr.xtb b/chromium/content/app/strings/translations/content_strings_fr.xtb
deleted file mode 100644
index 6539540c33f..00000000000
--- a/chromium/content/app/strings/translations/content_strings_fr.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="fr">
-<translation id="1018939186200882850">élément de menu</translation>
-<translation id="10623998915015855">bouton d'activation/de désactivation</translation>
-<translation id="1088086359088493902">Secondes</translation>
-<translation id="1171774979989969504">Veuillez saisir une adresse e-mail.</translation>
-<translation id="1178581264944972037">Suspendre</translation>
-<translation id="1188858454923323853">complémentaire</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">curseur</translation>
-<translation id="1211441953136645838">note de fin</translation>
-<translation id="1281252709823657822">boîte de dialogue</translation>
-<translation id="1335095011850992622">crédits</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">bannière</translation>
-<translation id="1589122976691792535">région</translation>
-<translation id="1591562245178063882">Ce mois</translation>
-<translation id="1637811476055996098">Sélect. fichiers</translation>
-<translation id="1650423536718072820">témoignage</translation>
-<translation id="1727886345390570319">masquer le menu des sous-titres</translation>
-<translation id="1729654308190250600">Veuillez saisir une adresse e-mail dans le champ correspondant.</translation>
-<translation id="1758486001363313524">Autre…</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">arborescence</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">lire sur un appareil à distance</translation>
-<translation id="190587075670221089">suppression</translation>
-<translation id="1907737156431278478">exemple</translation>
-<translation id="1921819250265091946">jj</translation>
-<translation id="1930711995431081526">état</translation>
-<translation id="1938124657309484470">La date ou l'heure doit être égale ou antérieure à "<ph name="MAXIMUM_DATE_OR_TIME" />".</translation>
-<translation id="1946271899482435442">Afficher le sélecteur de date</translation>
-<translation id="1993104285338243655">Passage à la duplication d'écran</translation>
-<translation id="2060505056492490888">L'emplacement du caractère "<ph name="DOT" />" est incorrect dans "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Aujourd'hui</translation>
-<translation id="2158401438286456825">liste des pages</translation>
-<translation id="2226276347425096477">Veuillez réduire ce texte à <ph name="MAX_CHARACTERS" /> caractères maximum (il compte actuellement <ph name="CURRENT_LENGTH" /> caractères).</translation>
-<translation id="2246498165605549352">Fichier local</translation>
-<translation id="2247351761944213033">Semaine <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Piste <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">case à cocher</translation>
-<translation id="2311842470354187719">saut de page</translation>
-<translation id="2335594187091864976">outil de sélection de la date et de l'heure</translation>
-<translation id="245932805758469625">nombre de secondes de vidéo restantes</translation>
-<translation id="248395913932153421">Jour</translation>
-<translation id="2507943997699731163">Veuillez renseigner ce champ.</translation>
-<translation id="2508569020611168319">liste d'onglets</translation>
-<translation id="2561842179657104141">afficher plus de commandes multimédias</translation>
-<translation id="2572483411312390101">lire</translation>
-<translation id="2613802280814924224">Veuillez saisir une valeur valide. La valeur valide la plus proche est "<ph name="VALID_VALUE" />".</translation>
-<translation id="2653659639078652383">Valider</translation>
-<translation id="2657045182931379222">objet graphique</translation>
-<translation id="2674318244760992338">pied de page</translation>
-<translation id="2709516037105925701">Saisie automatique</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">La date ou l'heure doit être égale ou postérieure à "<ph name="MINIMUM_DATE_OR_TIME" />".</translation>
-<translation id="2759744352195237655">bouton pop-up</translation>
-<translation id="2761667185364618470">Veuillez cocher cette case si vous souhaitez continuer.</translation>
-<translation id="2844350028562914727">détails</translation>
-<translation id="2896972712917208084">groupe de cases d'option</translation>
-<translation id="2908441821576996758">Veuillez saisir une liste d'adresses e-mail séparées par une virgule.</translation>
-<translation id="2940813599313844715">objet</translation>
-<translation id="2942448076852699108">contenu en surbrillance</translation>
-<translation id="3040011195152428237">Lien</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> Mo</translation>
-<translation id="3075154866155599887">Veuillez saisir une valeur valide. Le champ n'est pas complet ou contient une date non valide.</translation>
-<translation id="3078740164268491126">tableau</translation>
-<translation id="3086746722712840547">remarque</translation>
-<translation id="310520048233152454">Veuillez saisir une URL.</translation>
-<translation id="3175736971608411871">minuteur</translation>
-<translation id="3199563858620722075">boîte combinée</translation>
-<translation id="3450233048674729344">Cette valeur doit être inférieure ou égale à <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">définition</translation>
-<translation id="3557673793733683882">titre <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">outil de sélection de semaine</translation>
-<translation id="3685101356851116974">Image sans libellé</translation>
-<translation id="3706100364254443312">interrupteur</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Quitter le mode PIP (Picture-in-picture)</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> Go</translation>
-<translation id="3808586225841795776">terme</translation>
-<translation id="3822383571486410024">Veuillez allonger ce texte pour qu'il comporte au moins <ph name="MIN_CHARACTERS" /> caractères. Il en compte actuellement <ph name="CURRENT_LENGTH" />.</translation>
-<translation id="383465348367842624">La partie suivie du symbole "<ph name="ATSIGN" />" ne doit pas contenir le caractère "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Quitter le mode plein écran</translation>
-<translation id="3920932319529768807">conclusion</translation>
-<translation id="3924558731517983934">application</translation>
-<translation id="3944740393230681990">prologue</translation>
-<translation id="3960700977367013758">barre de défilement</translation>
-<translation id="4103419683916926126">Millisecondes</translation>
-<translation id="4151657705144244502">élément graphique</translation>
-<translation id="4160057747563657758">téléphone</translation>
-<translation id="4193965531860883258">avant-propos</translation>
-<translation id="4201051445878709314">Afficher le mois précédent</translation>
-<translation id="421884353938374759">palette couleurs</translation>
-<translation id="4248100235867064564">barre de menu</translation>
-<translation id="4360991593054037559">Veuillez saisir une valeur valide. Les deux valeurs valides les plus proches sont "<ph name="VALID_VALUE_LOW" />" et "<ph name="VALID_VALUE_HIGHER" />".</translation>
-<translation id="4384583879834880242">Questions/Réponses</translation>
-<translation id="4413860115965805769">bouton de menu</translation>
-<translation id="4444765639179266822">Voici la mention que contient probablement l'image : <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">référence de glossaire</translation>
-<translation id="4522570452068850558">Détails</translation>
-<translation id="4542388879936266156">temps restant : <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulaire</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">La partie précédée du symbole "<ph name="ATSIGN" />" ne doit pas contenir le caractère "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">annexe</translation>
-<translation id="4718048029184481307">Lecture en mode Picture-in-picture</translation>
-<translation id="4742539557769756338">couverture</translation>
-<translation id="4748357248530471599">activer/désactiver plein écran en encoche</translation>
-<translation id="4757246831282535685">panneau des onglets</translation>
-<translation id="4763480195061959176">vidéo</translation>
-<translation id="479989351350248267">rechercher</translation>
-<translation id="4812940957355064477">Veuillez saisir un nombre.</translation>
-<translation id="4912536737030637138">entrée bibliographique</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> élément(s) sélectionné(s)</translation>
-<translation id="4992066212339426712">Réactiver le son</translation>
-<translation id="49969490063480558">Veuillez saisir la partie manquante après le symbole "<ph name="ATSIGN" />". L'adresse "<ph name="INVALIDADDRESS" />" est incomplète.</translation>
-<translation id="5034860022980953847">indicateur de progression</translation>
-<translation id="5090250355906949916">barre de défilement de la durée de la vidéo</translation>
-<translation id="5093189678851173835">épigraphe</translation>
-<translation id="5117590920725113268">Afficher le mois suivant</translation>
-<translation id="512758898067543763">en-tête de ligne</translation>
-<translation id="5143125788380636750">épilogue</translation>
-<translation id="5164977714490026579">Cette valeur doit être supérieure ou égale à <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> Po</translation>
-<translation id="5307600278924710095">Veuillez saisir la partie manquante avant le caractère "<ph name="ATSIGN" />". L'adresse "<ph name="INVALIDADDRESS" />" est incomplète.</translation>
-<translation id="5334352251556557839">Impossible de lire les contenus multimédias.</translation>
-<translation id="5406322316791861025">nombre</translation>
-<translation id="5453733299334684579">élément d'arborescence</translation>
-<translation id="5466621249238537318">Veuillez sélectionner un ou plusieurs fichiers.</translation>
-<translation id="5468998798572797635">quitter le mode plein écran</translation>
-<translation id="5516424706154626233">outil de sélection de la date</translation>
-<translation id="5537725057119320332">Caster</translation>
-<translation id="5546461542133609677">réactiver le son</translation>
-<translation id="561939826962581046">horodatage</translation>
-<translation id="5630795885300617244">Appuyez deux fois à gauche/droite pour reculer/avancer de 10 s</translation>
-<translation id="5631759159893697722">résumé</translation>
-<translation id="5643186887447432888">bouton</translation>
-<translation id="5677946354068040947">plus d'options</translation>
-<translation id="576709008726043716">introduction</translation>
-<translation id="57838592816432529">Couper le son</translation>
-<translation id="5860033963881614850">Désactivé</translation>
-<translation id="588258955323874662">Plein écran</translation>
-<translation id="5888666972993069672">Diffusion en cours sur l'appareil "<ph name="DEVICE_FRIENDLY_NAME" />"</translation>
-<translation id="591047860372322273">champ de recherche</translation>
-<translation id="5939518447894949180">Réinitialiser</translation>
-<translation id="5966707198760109579">Semaine</translation>
-<translation id="5987525920412732405">bouton toupie</translation>
-<translation id="6011459053400940133">curseur de volume</translation>
-<translation id="6015796118275082299">Année</translation>
-<translation id="6023896073578205740">zone de liste</translation>
-<translation id="6150588977291308318">bibliographie</translation>
-<translation id="6164829606128959761">outil de mesure</translation>
-<translation id="6166809985690652833">postface</translation>
-<translation id="6209276755895393898">L'image représente probablement : <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glossaire</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Quitter le mode PIP (Picture-in-picture)</translation>
-<translation id="6398862346408813489">Afficher le panneau de sélection du mois</translation>
-<translation id="6404546809543547843">curseur durée audio</translation>
-<translation id="6443871981718447451">afficher le menu des sous-titres</translation>
-<translation id="6453774872122745852">remerciements</translation>
-<translation id="648732519525291180">outil de sélection de l'heure</translation>
-<translation id="6550675742724504774">Options</translation>
-<translation id="6572309429103589720">Grammaire non valide</translation>
-<translation id="658823671542763450">activer le mode plein écran</translation>
-<translation id="663493177488814956">flux</translation>
-<translation id="6637586476836377253">journal</translation>
-<translation id="6643016212128521049">Effacer</translation>
-<translation id="668171684555832681">Autre...</translation>
-<translation id="6692633176391053278">curseur</translation>
-<translation id="6709570249143506788">Mauvaise qualité de lecture</translation>
-<translation id="6755330956360078551">info-bulle</translation>
-<translation id="6790428901817661496">Lire</translation>
-<translation id="6820355525329141109">Impossible de charger le plug-in.</translation>
-<translation id="6820615603175220800">référence bibliographique</translation>
-<translation id="6843725295806269523">muet</translation>
-<translation id="6885760532393684712">annuaire</translation>
-<translation id="689129560213475294">achevé d'imprimer</translation>
-<translation id="6934078000481955284">bloc de citation</translation>
-<translation id="6941933287844615239">télécharger des contenus multimédias</translation>
-<translation id="6981594929165378967">insertion</translation>
-<translation id="6989848892321993519">Veuillez allonger ce texte pour qu'il comporte au moins <ph name="MIN_CHARACTERS" /> caractères. Il en compte actuellement un seul.</translation>
-<translation id="7033340931668032222">haut et bas pour modifier le volume</translation>
-<translation id="709897737746224366">Veuillez respecter le format requis.</translation>
-<translation id="7118469954320184356">Aucune description disponible.</translation>
-<translation id="7139483182332611405">préface</translation>
-<translation id="7214187073215825913">informations sur le contenu</translation>
-<translation id="7263440858009898357">Sélectionnez un élément dans la liste.</translation>
-<translation id="727747134524199931">en-tête de colonne</translation>
-<translation id="7320576522385648310">mise en mémoire tampon</translation>
-<translation id="7353453495576941748">crédit</translation>
-<translation id="7364796246159120393">Choisir un fichier</translation>
-<translation id="739024184232394898">Autre…</translation>
-<translation id="7405738980073107433">notes de fin</translation>
-<translation id="7410239719251593705">Semble être du contenu réservé aux adultes. Aucune description disponible.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> To</translation>
-<translation id="7491962110804786152">tabulation</translation>
-<translation id="7514365320538308">Télécharger</translation>
-<translation id="7529102961911894712">lien entrant</translation>
-<translation id="7533959249147584474">Image sans libellé</translation>
-<translation id="7647456547678091388">conseil</translation>
-<translation id="7661956066982048809">document graphique</translation>
-<translation id="7673697353781729403">Heures</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">Contenu HTML</translation>
-<translation id="7745230546936012372">Pour obtenir les descriptions d'image manquantes, ouvrez le menu contextuel.</translation>
-<translation id="7750228210027921155">Mode PIP (Picture-in-Picture)</translation>
-<translation id="775297008183122718">Saisie incorrecte</translation>
-<translation id="7789962463072032349">pause</translation>
-<translation id="7802800022689234070">triangle d'expansion</translation>
-<translation id="7888071071722539607">Veuillez inclure "<ph name="ATSIGN" />" dans l'adresse e-mail. Il manque un symbole "<ph name="ATSIGN" />" dans "<ph name="INVALIDADDRESS" />".</translation>
-<translation id="7891486169920085145">séparateur</translation>
-<translation id="795667975304826397">Aucun fichier choisi</translation>
-<translation id="8053789581856978548">champ de recherche de texte</translation>
-<translation id="8057695513531652401">notification</translation>
-<translation id="8105797009065549151">référence de note</translation>
-<translation id="811583516810654505">Récupération de la description…</translation>
-<translation id="8117451130807776954">Cette semaine</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">outil de sélection de la date et de l'heure locales</translation>
-<translation id="8261464734335370856">Orthographe non valide</translation>
-<translation id="8284326494547611709">Sous-titres</translation>
-<translation id="835897206747267392">Valeur incorrecte</translation>
-<translation id="8403857369060869934">temps écoulé : <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">partie</translation>
-<translation id="8433900881053900389">barre d'outils</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> fichiers</translation>
-<translation id="8451268428117625855">Veuillez sélectionner un fichier.</translation>
-<translation id="8461852803063341183">case d'option</translation>
-<translation id="8474886197722836894">dédicace</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutes</translation>
-<translation id="8541249477527128034">commande multimédia</translation>
-<translation id="8550857728288566671">symbole graphique</translation>
-<translation id="8583702881314752957">liste de définitions</translation>
-<translation id="8597182159515967513">en-tête</translation>
-<translation id="8603553056539299761">gauche et droite pour chercher</translation>
-<translation id="860475260694818407">sommaire</translation>
-<translation id="8613126697340063924">contrôler la lecture à distance</translation>
-<translation id="862370744433916922">sous-titre</translation>
-<translation id="8711688047404765493">sortie</translation>
-<translation id="8750798805984357768">Veuillez sélectionner l'une de ces options.</translation>
-<translation id="8808573423886751634">chapitre</translation>
-<translation id="8845239796550121995">En cours de diffusion sur votre téléviseur</translation>
-<translation id="8851136666856101339">principal</translation>
-<translation id="8875657656876809964">Erreur lors de la lecture de la vidéo</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> Ko</translation>
-<translation id="8987927404178983737">Mois</translation>
-<translation id="901493112792887934">durée actuelle en secondes</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navigation</translation>
-<translation id="9062295712474918030">document</translation>
-<translation id="9062307380734144336">sélectionner pour lire/mettre en pause</translation>
-<translation id="9093215626363556771">quitter le mode PIP</translation>
-<translation id="9108370397979208512">math.</translation>
-<translation id="9132465097189459683">Autre…</translation>
-<translation id="9138385573473225930">alerte</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> (premier jour de la semaine : <ph name="WEEK_START_DATE" />)</translation>
-<translation id="916607977885256133">Picture-in-picture</translation>
-<translation id="9168329111483466115">note de bas de page</translation>
-<translation id="954003015749068518">utiliser le mode PIP</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_gu.xtb b/chromium/content/app/strings/translations/content_strings_gu.xtb
deleted file mode 100644
index 3bdb54438f2..00000000000
--- a/chromium/content/app/strings/translations/content_strings_gu.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="gu">
-<translation id="1018939186200882850">મેનૂ આઇટમ</translation>
-<translation id="10623998915015855">ટોગલ બટન</translation>
-<translation id="1088086359088493902">સેકંડ</translation>
-<translation id="1171774979989969504">કૃપા કરી કોઈ ઇમેઇલ ઍડ્રેસ દાખલ કરો.</translation>
-<translation id="1178581264944972037">થોભો</translation>
-<translation id="1188858454923323853">પૂરક</translation>
-<translation id="1206619573307042055">માર્કી</translation>
-<translation id="1206693055195146388">સ્લાઇડર</translation>
-<translation id="1211441953136645838">અંતિમ નોંધ</translation>
-<translation id="1281252709823657822">સંવાદ</translation>
-<translation id="1335095011850992622">ક્રેડિટ</translation>
-<translation id="1342835525016946179">લેખ</translation>
-<translation id="1359897965706325498">બેનર</translation>
-<translation id="1589122976691792535">પ્રદેશ</translation>
-<translation id="1591562245178063882">આ મહિને</translation>
-<translation id="1637811476055996098">ફાઇલો પસંદ કરો</translation>
-<translation id="1650423536718072820">પુલક્વોટ</translation>
-<translation id="1727886345390570319">બંધ કરેલું ઉપશીર્ષક મેનૂ છુપાવો</translation>
-<translation id="1729654308190250600">કૃપા કરીને ખાલી ન હોય એવું ઇમેઇલ ઍડ્રેસ દાખલ કરો.</translation>
-<translation id="1758486001363313524">અન્ય...</translation>
-<translation id="1806710327868736751">ચેતવણી_સંવાદ</translation>
-<translation id="1821985195704844674">ટ્રી ગ્રિડ</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">રિમોટ ઉપકરણ પર ચલાવો</translation>
-<translation id="190587075670221089">ડિલીટ કરો</translation>
-<translation id="1907737156431278478">ઉદાહરણ</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">સ્થિતિ</translation>
-<translation id="1938124657309484470">મૂલ્ય <ph name="MAXIMUM_DATE_OR_TIME" /> અથવા પહેલાંનું હોવું આવશ્યક છે.</translation>
-<translation id="1946271899482435442">તારીખ પીકર બતાવો</translation>
-<translation id="1993104285338243655">મીરરીંગ પર સ્વિચ કર્યુંં</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' નો ઉપયોગ '<ph name="INVALIDDOMAIN" />' માં ખોટી જગ્યાએ થયો છે.</translation>
-<translation id="2148716181193084225">આજે</translation>
-<translation id="2158401438286456825">પેજ સૂચિ</translation>
-<translation id="2226276347425096477">કૃપા કરીને આ ટેક્સ્ટને <ph name="MAX_CHARACTERS" /> અક્ષર અથવા તેથી ઓછા સુધી નાનો કરો (તમે હાલમાં <ph name="CURRENT_LENGTH" /> અક્ષરોનો ઉપયોગ કરી રહ્યા છો).</translation>
-<translation id="2246498165605549352">સ્થાનિક ફાઇલ</translation>
-<translation id="2247351761944213033">અઠવાડિયું <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ટ્રૅક <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">ચેકબોક્સ</translation>
-<translation id="2311842470354187719">પેજ વિભાજન</translation>
-<translation id="2335594187091864976">તારીખ અને સમય પીકર</translation>
-<translation id="245932805758469625">વીડિયોની બાકી સેકન્ડ</translation>
-<translation id="248395913932153421">દિવસ</translation>
-<translation id="2507943997699731163">કૃપા કરીને આ ફીલ્ડ ભરો.</translation>
-<translation id="2508569020611168319">ટેબ સૂચિ</translation>
-<translation id="2561842179657104141">વધુ મીડિયા નિયંત્રણો બતાવો</translation>
-<translation id="2572483411312390101">ચલાવો</translation>
-<translation id="2613802280814924224">કૃપા કરીને એક માન્ય મૂલ્ય દાખલ કરો. નિકટતમ માન્ય મૂલ્ય <ph name="VALID_VALUE" /> છે.</translation>
-<translation id="2653659639078652383">સબમિટ કરો</translation>
-<translation id="2657045182931379222">ગ્રાફિક્સ ઑબ્જેક્ટ</translation>
-<translation id="2674318244760992338">ફૂટર</translation>
-<translation id="2709516037105925701">સ્વતઃભરો</translation>
-<translation id="2723001399770238859">ઑડિઓ</translation>
-<translation id="2746543609216772311">મૂલ્ય <ph name="MINIMUM_DATE_OR_TIME" /> અથવા પછીનું હોવું આવશ્યક છે.</translation>
-<translation id="2759744352195237655">પૉપ-અપ બટન</translation>
-<translation id="2761667185364618470">જો તમે આગળ વધવા માંગતા હો તો કૃપા કરીને આ બૉક્સને ચેક કરો.</translation>
-<translation id="2844350028562914727">વિગતો</translation>
-<translation id="2896972712917208084">રેડિઓ જૂથ</translation>
-<translation id="2908441821576996758">કૃપા કરીને અલ્પવિરામથી વિભાજિત ઇમેઇલ સરનામાંઓની સૂચિ દાખલ કરો.</translation>
-<translation id="2940813599313844715">ઑબ્જેક્ટ</translation>
-<translation id="2942448076852699108">હાઇલાઇટ કરેલું કન્ટેન્ટ</translation>
-<translation id="3040011195152428237">લિંક</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" />MB</translation>
-<translation id="3075154866155599887">કૃપા કરીને માન્ય કિંમત દાખલ કરો. ફીલ્ડ અપૂર્ણ છે અથવા અમાન્ય તારીખ ધરાવે છે.</translation>
-<translation id="3078740164268491126">કોષ્ટક</translation>
-<translation id="3086746722712840547">નોંધ</translation>
-<translation id="310520048233152454">કૃપા કરી કોઈ URL દાખલ કરો.</translation>
-<translation id="3175736971608411871">ટાઇમર</translation>
-<translation id="3199563858620722075">કૉમ્બો બૉક્સ</translation>
-<translation id="3450233048674729344">મૂલ્ય <ph name="MAXIMUM" /> જેટલું અથવા આનાથી ઓછું હોવું આવશ્યક છે.</translation>
-<translation id="3486220673238053218">વિવરણ</translation>
-<translation id="3557673793733683882">મથાળું <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">અઠવાડિયાનું પિકર</translation>
-<translation id="3685101356851116974">લેબલ વિનાની છબી</translation>
-<translation id="3706100364254443312">સ્વિચ</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">ચિત્રમાં ચિત્રમાંથી બહાર નીકળો</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">ટર્મ</translation>
-<translation id="3822383571486410024">કૃપા કરીને આ ટેક્સ્ટને <ph name="MIN_CHARACTERS" /> અક્ષર અથવા તેથી વધુ સુધી લંબાવો (તમે હાલમાં <ph name="CURRENT_LENGTH" /> અક્ષરોનો ઉપયોગ કરી રહ્યાં છો).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' દ્વારા અનુસરાઈ રહેલા ભાગમાં '<ph name="INVALIDCHARACTER" />' પ્રતીક શામેલ હોવું જોઈએ નહીં.</translation>
-<translation id="3846214748874656680">પૂર્ણસ્ક્રીનથી બહાર નીકળો</translation>
-<translation id="3920932319529768807">સારાંશ</translation>
-<translation id="3924558731517983934">ઍપ્લિકેશન</translation>
-<translation id="3944740393230681990">પ્રસ્તાવના</translation>
-<translation id="3960700977367013758">સ્ક્રોલ બાર</translation>
-<translation id="4103419683916926126">મીલીસેકન્ડ</translation>
-<translation id="4151657705144244502">ગ્રાફિક</translation>
-<translation id="4160057747563657758">ટેલિફોન</translation>
-<translation id="4193965531860883258">આમુખ</translation>
-<translation id="4201051445878709314">પાછળનો મહિનો બતાવો</translation>
-<translation id="421884353938374759">રંગ ચૂંટનાર</translation>
-<translation id="4248100235867064564">મેનૂ બાર</translation>
-<translation id="4360991593054037559">કૃપા કરીને એક માન્ય મૂલ્ય દાખલ કરો. બે નિકટતમ માન્ય મૂલ્યો <ph name="VALID_VALUE_LOW" /> અને <ph name="VALID_VALUE_HIGHER" /> છે.</translation>
-<translation id="4384583879834880242">પ્રશ્ન અને જવાબ</translation>
-<translation id="4413860115965805769">મેનૂ બટન</translation>
-<translation id="4444765639179266822">આવું બોલતા જણાય છે: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">શબ્દાવલીનો સંદર્ભ</translation>
-<translation id="4522570452068850558">વિગતો</translation>
-<translation id="4542388879936266156">બાકીનો સમય: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ફોર્મ</translation>
-<translation id="4661075872484491155">ટ્રી</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' ને અનુસરી રહેલા ભાગમાં '<ph name="INVALIDCHARACTER" />' પ્રતીક શામેલ હોવું જોઈએ નહીં.</translation>
-<translation id="4668956016107839909">જોડાણ</translation>
-<translation id="4718048029184481307">ચિત્રમાં ચિત્રમાંથી ચલાવી રહ્યાં છીએ</translation>
-<translation id="4742539557769756338">કવર</translation>
-<translation id="4748357248530471599">ડિસ્પ્લેમાં જ સામેલ પૂર્ણસ્ક્રીન ટૉગલ કરો</translation>
-<translation id="4757246831282535685">ટેબ પેનલ</translation>
-<translation id="4763480195061959176">વીડિયો</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">કૃપા કરીને એક નંબર દાખલ કરો.</translation>
-<translation id="4912536737030637138">ગ્રંથસૂચિની એન્ટ્રી</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> પસંદ કર્યા</translation>
-<translation id="4992066212339426712">અનમ્યૂટ કરો</translation>
-<translation id="49969490063480558">કૃપા કરીને '<ph name="ATSIGN" />' ને અનુસરી રહેલો ભાગ દાખલ કરો. '<ph name="INVALIDADDRESS" />' અપૂર્ણ છે.</translation>
-<translation id="5034860022980953847">પ્રગતિ સૂચક</translation>
-<translation id="5090250355906949916">વીડિયો ટાઇમ સ્ક્રબર</translation>
-<translation id="5093189678851173835">શિલાલેખ</translation>
-<translation id="5117590920725113268">આગલો મહિનો દર્શાવો</translation>
-<translation id="512758898067543763">પંક્તિ હેડર</translation>
-<translation id="5143125788380636750">ઉપસંહાર</translation>
-<translation id="5164977714490026579">મૂલ્ય <ph name="MINIMUM" /> જેટલું અથવા આનાથી વધુ હોવું આવશ્યક છે.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">કૃપા કરીને '<ph name="ATSIGN" />' ની આગળનો ભાગ દાખલ કરો. '<ph name="INVALIDADDRESS" />' અપૂર્ણ છે.</translation>
-<translation id="5334352251556557839">મીડિયા ચલાવવામાં નિષ્ફળ રહ્યાં.</translation>
-<translation id="5406322316791861025">આકૃતિ</translation>
-<translation id="5453733299334684579">ટ્રી આઇટમ</translation>
-<translation id="5466621249238537318">કૃપા કરીને એક અથવા વધુ ફાઇલ પસંદ કરો. </translation>
-<translation id="5468998798572797635">પૂર્ણ સ્ક્રીનથી બહાર નીકળો</translation>
-<translation id="5516424706154626233">તારીખ પીકર</translation>
-<translation id="5537725057119320332">કાસ્ટ કરો</translation>
-<translation id="5546461542133609677">અનમ્યૂટ કરો</translation>
-<translation id="561939826962581046">સમય</translation>
-<translation id="5630795885300617244">10 સેકન્ડ છોડવા માટે ડાબે અથવા જમણે બે વાર ટૅપ કરો</translation>
-<translation id="5631759159893697722">અમૂર્ત</translation>
-<translation id="5643186887447432888">બટન</translation>
-<translation id="5677946354068040947">વધુ વિકલ્પો</translation>
-<translation id="576709008726043716">પ્રસ્તાવના</translation>
-<translation id="57838592816432529">અવાજ બંધ કરો</translation>
-<translation id="5860033963881614850">બંધ</translation>
-<translation id="588258955323874662">પૂર્ણસ્ક્રીન</translation>
-<translation id="5888666972993069672">હવે <ph name="DEVICE_FRIENDLY_NAME" /> પર કાસ્ટ કરી રહ્યાં છીએ</translation>
-<translation id="591047860372322273">શોધ બૉક્સ</translation>
-<translation id="5939518447894949180">રીસેટ કરો</translation>
-<translation id="5966707198760109579">અઠવાડિયું</translation>
-<translation id="5987525920412732405">સ્પિન બટન</translation>
-<translation id="6011459053400940133">વોલ્યુમ સ્લાઇડર</translation>
-<translation id="6015796118275082299">વર્ષ</translation>
-<translation id="6023896073578205740">સૂચિ બૉક્સ</translation>
-<translation id="6150588977291308318">ગ્રંથસૂચિ</translation>
-<translation id="6164829606128959761">મીટર</translation>
-<translation id="6166809985690652833">સમાપન ભાષણ</translation>
-<translation id="6209276755895393898">આના જેવું જણાય છે: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">શબ્દાવલી</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">ચિત્ર-માં-ચિત્રમાંથી બહાર નીકળો</translation>
-<translation id="6398862346408813489">મહિના પસંદગી પેનલ દર્શાવો</translation>
-<translation id="6404546809543547843">ઑડિઓ સમય સ્ક્રબર</translation>
-<translation id="6443871981718447451">બંધ કરેલું ઉપશીર્ષક મેનૂ દર્શાવો</translation>
-<translation id="6453774872122745852">સ્વીકૃતિઓ</translation>
-<translation id="648732519525291180">સમય પીકર</translation>
-<translation id="6550675742724504774">વિકલ્પો</translation>
-<translation id="6572309429103589720">અમાન્ય વ્યાકરણ</translation>
-<translation id="658823671542763450">પૂર્ણ સ્ક્રીનમાં દાખલ થાઓ</translation>
-<translation id="663493177488814956">ફીડ</translation>
-<translation id="6637586476836377253">લૉગ</translation>
-<translation id="6643016212128521049">સાફ કરો</translation>
-<translation id="668171684555832681">અન્ય...</translation>
-<translation id="6692633176391053278">સ્ટેપર</translation>
-<translation id="6709570249143506788">ખરાબ પ્લેબૅક ક્વૉલિટી</translation>
-<translation id="6755330956360078551">ટૂલટીપ</translation>
-<translation id="6790428901817661496">ચલાવો</translation>
-<translation id="6820355525329141109">પ્લગિન લોડ કરી શક્યાં નથી.</translation>
-<translation id="6820615603175220800">ગ્રંથસૂચિનો સંદર્ભ</translation>
-<translation id="6843725295806269523">બંધ કરો</translation>
-<translation id="6885760532393684712">ડિરેક્ટરી</translation>
-<translation id="689129560213475294">પ્રકાશકની માહિતી</translation>
-<translation id="6934078000481955284">બ્લૉકક્વોટ</translation>
-<translation id="6941933287844615239">મીડિયા ડાઉનલોડ કરો</translation>
-<translation id="6981594929165378967">ઉમેરો</translation>
-<translation id="6989848892321993519">કૃપા કરીને આ ટેક્સ્ટને <ph name="MIN_CHARACTERS" /> અથવા તેથી વધુ અક્ષર સુધી લંબાવો (તમે હાલમાં 1 અક્ષરનો ઉપયોગ કરી રહ્યાં છો).</translation>
-<translation id="7033340931668032222">વૉલ્યૂમમાં ફેરફાર કરવા માટે up અને down</translation>
-<translation id="709897737746224366">કૃપા કરીને વિનંતી કરેલા ફોર્મેટ સાથે મેળ કરો.</translation>
-<translation id="7118469954320184356">કોઈ વર્ણન ઉપલબ્ધ નથી.</translation>
-<translation id="7139483182332611405">પ્રસ્તાવના</translation>
-<translation id="7214187073215825913">કન્ટેન્ટ વિશેની માહિતી</translation>
-<translation id="7263440858009898357">કૃપા કરીને સૂચિમાંથી એક આઇટમ પસંદ કરો.</translation>
-<translation id="727747134524199931">કૉલમ હેડર</translation>
-<translation id="7320576522385648310">બફર થઈ રહ્યું છે</translation>
-<translation id="7353453495576941748">ક્રેડિટ</translation>
-<translation id="7364796246159120393">ફાઇલ પસંદ કરો</translation>
-<translation id="739024184232394898">અન્ય...</translation>
-<translation id="7405738980073107433">અંતિમ નોંધ</translation>
-<translation id="7410239719251593705">પુખ્ત લોકો માટેનું કન્ટેન્ટ સમાવતી હોવાનું જણાય છે. કોઈ વર્ણન ઉપલબ્ધ નથી.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">ટેબ</translation>
-<translation id="7514365320538308">ડાઉનલોડ કરો</translation>
-<translation id="7529102961911894712">પાછળ લઈ જતી લિંક</translation>
-<translation id="7533959249147584474">લેબલ વિનાનું ગ્રાફિક</translation>
-<translation id="7647456547678091388">ટિપ</translation>
-<translation id="7661956066982048809">ગ્રાફિક્સ દસ્તાવેજ</translation>
-<translation id="7673697353781729403">કલાક</translation>
-<translation id="7681220483256441252">અનુક્રમણિકા</translation>
-<translation id="7740050170769002709">HTML માહિતી</translation>
-<translation id="7745230546936012372">છબીઓના ખૂટતા વર્ણનો માટે, સંદર્ભ મેનૂ ખોલો.</translation>
-<translation id="7750228210027921155">ચિત્રમાં ચિત્ર</translation>
-<translation id="775297008183122718">અમાન્ય એન્ટ્રી</translation>
-<translation id="7789962463072032349">થોભો</translation>
-<translation id="7802800022689234070">પ્રકટીકરણ ત્રિકોણ</translation>
-<translation id="7888071071722539607">કૃપા કરીને ઇમેઇલ સરનામાંમાં '<ph name="ATSIGN" />' શામેલ કરો. '<ph name="INVALIDADDRESS" />'માં '<ph name="ATSIGN" />' ખૂટે છે.</translation>
-<translation id="7891486169920085145">વિભાજનકર્તા</translation>
-<translation id="795667975304826397">કોઈ ફાઇલ પસંદ કરેલી નથી</translation>
-<translation id="8053789581856978548">ટેક્સ્ટ ફીલ્ડ શોધો</translation>
-<translation id="8057695513531652401">સૂચના</translation>
-<translation id="8105797009065549151">નોંધ સંદર્ભ</translation>
-<translation id="811583516810654505">વર્ણન મેળવી રહ્યાં છીએ…</translation>
-<translation id="8117451130807776954">આ અઠવાડિયે</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">સ્થાનિક તારીખ અને સમય પિકર</translation>
-<translation id="8261464734335370856">અમાન્ય જોડણી</translation>
-<translation id="8284326494547611709">કૅપ્શન્સ</translation>
-<translation id="835897206747267392">અમાન્ય મૂલ્ય.</translation>
-<translation id="8403857369060869934">વીતેલો સમય: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">ભાગ</translation>
-<translation id="8433900881053900389">ટુલબાર</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ફાઇલો</translation>
-<translation id="8451268428117625855">કૃપા કરીને કોઈ ફાઇલ પસંદ કરો.</translation>
-<translation id="8461852803063341183">રેડિઓ બટન</translation>
-<translation id="8474886197722836894">સમર્પણ</translation>
-<translation id="8531739829932800271">ભૂલ સુધારાની સૂચિ</translation>
-<translation id="8534579021159131403">મિનિટ</translation>
-<translation id="8541249477527128034">મીડિયાનું નિયંત્રણ</translation>
-<translation id="8550857728288566671">ગ્રાફિક્સ પ્રતીક</translation>
-<translation id="8583702881314752957">વિવરણ સૂચિ</translation>
-<translation id="8597182159515967513">મથાળું</translation>
-<translation id="8603553056539299761">શોધવા માટે left અને right</translation>
-<translation id="860475260694818407">અનુક્રમણિકા</translation>
-<translation id="8613126697340063924">રિમોટ પ્લેબેકનું નિયંત્રણ કરો</translation>
-<translation id="862370744433916922">(સબટાઇટલ)</translation>
-<translation id="8711688047404765493">આઉટપુટ</translation>
-<translation id="8750798805984357768">કૃપા કરીને આ વિકલ્પોમાંથી કોઈ એક પસંદ કરો.</translation>
-<translation id="8808573423886751634">પ્રકરણ</translation>
-<translation id="8845239796550121995">હમણાં તમારા TV પર કાસ્ટ કરી રહ્યાં છીએ</translation>
-<translation id="8851136666856101339">મુખ્ય</translation>
-<translation id="8875657656876809964">વીડિયો પ્લેબૅક ભૂલ</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">મહિનો</translation>
-<translation id="901493112792887934">સેકન્ડ્સમાં વર્તમાન સમય</translation>
-<translation id="901834265349196618">ઇમેઇલ</translation>
-<translation id="9048119486235211610">નેવિગેશન</translation>
-<translation id="9062295712474918030">દસ્તાવેજ</translation>
-<translation id="9062307380734144336">ચલાવવાનું અથવા થોભાવવાનું ટૉગલ કરવાનું પસંદ કરો</translation>
-<translation id="9093215626363556771">ચિત્ર-માં-ચિત્રમાંથી બહાર નીકળો</translation>
-<translation id="9108370397979208512">ગણિત</translation>
-<translation id="9132465097189459683">અન્ય...</translation>
-<translation id="9138385573473225930">ચેતવણી</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" /> થી શરૂ કરીને</translation>
-<translation id="916607977885256133">ચિત્ર-માં-ચિત્ર</translation>
-<translation id="9168329111483466115">ફૂટનોટ</translation>
-<translation id="954003015749068518">ચિત્ર-માં-ચિત્રમાં પ્રવેશ કરો</translation>
-<translation id="966787709310836684">મેનૂ</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_hi.xtb b/chromium/content/app/strings/translations/content_strings_hi.xtb
deleted file mode 100644
index 774c3bd05e1..00000000000
--- a/chromium/content/app/strings/translations/content_strings_hi.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="hi">
-<translation id="1018939186200882850">मेन्यू आइटम</translation>
-<translation id="10623998915015855">टॉगल बटन</translation>
-<translation id="1088086359088493902">सेकंड</translation>
-<translation id="1171774979989969504">कृपया ई-मेल पता दर्ज करें.</translation>
-<translation id="1178581264944972037">रोकें</translation>
-<translation id="1188858454923323853">पूरक</translation>
-<translation id="1206619573307042055">मार्की</translation>
-<translation id="1206693055195146388">स्लाइडर</translation>
-<translation id="1211441953136645838">एंड नोट</translation>
-<translation id="1281252709823657822">संवाद</translation>
-<translation id="1335095011850992622">क्रेडिट</translation>
-<translation id="1342835525016946179">लेख</translation>
-<translation id="1359897965706325498">बैनर</translation>
-<translation id="1589122976691792535">क्षेत्र</translation>
-<translation id="1591562245178063882">इस माह</translation>
-<translation id="1637811476055996098">फ़ाइलें चुनें</translation>
-<translation id="1650423536718072820">पुलकोट</translation>
-<translation id="1727886345390570319">बंद कैप्शन मेन्यू छिपाएं</translation>
-<translation id="1729654308190250600">कृपया गैर-खाली ईमेल पता डालें.</translation>
-<translation id="1758486001363313524">अन्य...</translation>
-<translation id="1806710327868736751">सूचना संवाद</translation>
-<translation id="1821985195704844674">ट्री ग्रिड</translation>
-<translation id="1822429046913737220">पूर्वाह्न/अपराह्न</translation>
-<translation id="1832974991323546415">दूरस्थ डिवाइस पर चलाएं</translation>
-<translation id="190587075670221089">मिटाना</translation>
-<translation id="1907737156431278478">उदाहरण</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">स्थिति</translation>
-<translation id="1938124657309484470">मान <ph name="MAXIMUM_DATE_OR_TIME" /> या पहले का होना चाहिए.</translation>
-<translation id="1946271899482435442">तारीख पिकर दिखाएं</translation>
-<translation id="1993104285338243655">'स्क्रीन शेयर करने' पर स्विच किया गया</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' का '<ph name="INVALIDDOMAIN" />' में गलत स्थान पर उपयोग किया गया है.</translation>
-<translation id="2148716181193084225">आज</translation>
-<translation id="2158401438286456825">पेज सूची</translation>
-<translation id="2226276347425096477">कृपया इस टेक्स्ट को <ph name="MAX_CHARACTERS" /> वर्णों या कम तक छोटा करें (वर्तमान में आप <ph name="CURRENT_LENGTH" /> वर्णों का उपयोग कर रहे हैं).</translation>
-<translation id="2246498165605549352">लोकल फ़ाइल</translation>
-<translation id="2247351761944213033">हफ़्ता <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ट्रैक <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">चेकबॉक्स</translation>
-<translation id="2311842470354187719">नया पेज</translation>
-<translation id="2335594187091864976">तारीख और समय पिकर</translation>
-<translation id="245932805758469625">बचे हुए वीडियो का कुल समय सेकंड में</translation>
-<translation id="248395913932153421">दिन</translation>
-<translation id="2507943997699731163">कृपया इस फ़ील्ड को भरें.</translation>
-<translation id="2508569020611168319">टैब सूची</translation>
-<translation id="2561842179657104141">ज़्यादा मीडिया नियंत्रण दिखाएं</translation>
-<translation id="2572483411312390101">चलाएं</translation>
-<translation id="2613802280814924224">कृपया कोई मान्य मान डालें. निकटतम मान्य मान <ph name="VALID_VALUE" /> है.</translation>
-<translation id="2653659639078652383">सबमिट करें</translation>
-<translation id="2657045182931379222">ग्राफ़िक्स ऑब्जेक्ट</translation>
-<translation id="2674318244760992338">पाद लेख</translation>
-<translation id="2709516037105925701">ऑटोमैटिक भरना</translation>
-<translation id="2723001399770238859">ऑडियो</translation>
-<translation id="2746543609216772311">मान <ph name="MINIMUM_DATE_OR_TIME" /> या बाद का होना चाहिए.</translation>
-<translation id="2759744352195237655">पॉप अप बटन</translation>
-<translation id="2761667185364618470">अगर आप आगे बढ़ना चाहते हैं तो इस बॉक्‍स को सही का निशान लगाकर चुनें.</translation>
-<translation id="2844350028562914727">जानकारी</translation>
-<translation id="2896972712917208084">रेडियो समूह</translation>
-<translation id="2908441821576996758">कृपया ईमेल पतों की अल्पविराम द्वारा विभाजित सूची दर्ज करें.</translation>
-<translation id="2940813599313844715">ऑब्जेक्ट</translation>
-<translation id="2942448076852699108">हाइलाइट की गई सामग्री</translation>
-<translation id="3040011195152428237">संपर्क</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> एमबी</translation>
-<translation id="3075154866155599887">कृपया सही मान डालें. फ़ील्ड अधूरी है या उसमें डाली गई तारीख गलत है.</translation>
-<translation id="3078740164268491126">टेबल</translation>
-<translation id="3086746722712840547">नोट</translation>
-<translation id="310520048233152454">कृपया यूआरएल डालें.</translation>
-<translation id="3175736971608411871">टाइमर</translation>
-<translation id="3199563858620722075">कॉम्बो बॉक्स</translation>
-<translation id="3450233048674729344">मान <ph name="MAXIMUM" /> से कम या इसके बराबर होना चाहिए.</translation>
-<translation id="3486220673238053218">परिभाषा</translation>
-<translation id="3557673793733683882">शीर्षक <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">हफ़्ता पिकर (हफ़्ता चुनने की सुविधा)</translation>
-<translation id="3685101356851116974">लेबल न की गई इमेज</translation>
-<translation id="3706100364254443312">स्विच करें</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">'पिक्चर में पिक्चर' सुविधा से बाहर निकलें</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> जीबी</translation>
-<translation id="3808586225841795776">शब्द</translation>
-<translation id="3822383571486410024">कृपया इस लेख को <ph name="MIN_CHARACTERS" /> वर्णों या ज़्यादा तक बढ़ाएं (वर्तमान में आप <ph name="CURRENT_LENGTH" /> वर्णों का उपयोग कर रहे हैं).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' के बाद आने वाले भाग में '<ph name="INVALIDCHARACTER" />' प्रतीक शामिल नहीं होना चाहिए.</translation>
-<translation id="3846214748874656680">पूर्णस्क्रीन से बाहर निकलें</translation>
-<translation id="3920932319529768807">निष्कर्ष</translation>
-<translation id="3924558731517983934">ऐप्लिकेशन</translation>
-<translation id="3944740393230681990">प्रस्तावना</translation>
-<translation id="3960700977367013758">स्क्रोल बार</translation>
-<translation id="4103419683916926126">मिलीसेकंड</translation>
-<translation id="4151657705144244502">ग्राफ़‍िक</translation>
-<translation id="4160057747563657758">टेलीफ़ोन</translation>
-<translation id="4193965531860883258">भूमिका</translation>
-<translation id="4201051445878709314">पिछला महीना दिखाएं</translation>
-<translation id="421884353938374759">रंग पिकर</translation>
-<translation id="4248100235867064564">मेन्यू बार</translation>
-<translation id="4360991593054037559">कृपया कोई मान्य मान डालें. दो निकटतम मान्य मान <ph name="VALID_VALUE_LOW" /> और <ph name="VALID_VALUE_HIGHER" /> हैं.</translation>
-<translation id="4384583879834880242">सवाल और जवाब</translation>
-<translation id="4413860115965805769">मेन्यू बटन</translation>
-<translation id="4444765639179266822">यह जानकारी इस बारे में लगती है: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">संदर्भ के लिए शब्दावली</translation>
-<translation id="4522570452068850558">विवरण</translation>
-<translation id="4542388879936266156">बचा हुआ समय: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">फ़ॉर्म</translation>
-<translation id="4661075872484491155">ट्री</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' के बाद आने वाले भाग में '<ph name="INVALIDCHARACTER" />' प्रतीक शामिल नहीं होना चाहिए.</translation>
-<translation id="4668956016107839909">परिशिष्ट</translation>
-<translation id="4718048029184481307">वीडियो को 'पिक्चर में पिक्चर' सुविधा में चलाया जा रहा है</translation>
-<translation id="4742539557769756338">कवर</translation>
-<translation id="4748357248530471599">डिसप्ले कटआउट फ़ुलस्क्रीन टॉगल करें</translation>
-<translation id="4757246831282535685">टैब पैनल</translation>
-<translation id="4763480195061959176">वीडियो</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">कृपया कोई संख्या डालें.</translation>
-<translation id="4912536737030637138">संदर्भ सूची प्रविष्टि</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> चुने गए</translation>
-<translation id="4992066212339426712">अनम्यूट करें</translation>
-<translation id="49969490063480558">कृपया '<ph name="ATSIGN" />' के बाद आने वाला भाग डालें. '<ph name="INVALIDADDRESS" />' अधूरा है.</translation>
-<translation id="5034860022980953847">प्रगति संकेतक</translation>
-<translation id="5090250355906949916">वीडियो टाइम स्क्रबर</translation>
-<translation id="5093189678851173835">इपिग्राफ़</translation>
-<translation id="5117590920725113268">अगला महीना दिखाएं</translation>
-<translation id="512758898067543763">पंक्ति शीर्षलेख</translation>
-<translation id="5143125788380636750">उपसंहार</translation>
-<translation id="5164977714490026579">मान <ph name="MINIMUM" /> से कम या इसके बराबर होना चाहिए.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">कृपया '<ph name="ATSIGN" />' के पहले वाला भाग डालें. '<ph name="INVALIDADDRESS" />' अधूरा है.</translation>
-<translation id="5334352251556557839">मीडिया नहीं चला पा रहे हैं.</translation>
-<translation id="5406322316791861025">आकृति</translation>
-<translation id="5453733299334684579">ट्री आइटम</translation>
-<translation id="5466621249238537318">कृपया एक या ज़्यादा फ़ाइल को चुनें.</translation>
-<translation id="5468998798572797635">फ़ुल स्क्रीन से बाहर निकलें</translation>
-<translation id="5516424706154626233">तारीख पिकर</translation>
-<translation id="5537725057119320332">कास्‍ट करें</translation>
-<translation id="5546461542133609677">अनम्यूट करें</translation>
-<translation id="561939826962581046">समय</translation>
-<translation id="5630795885300617244">10 सेकंड के लिए 'स्किप' करने के लिए बाएं या दाएं पर दो बार टैप करें</translation>
-<translation id="5631759159893697722">संक्षेप</translation>
-<translation id="5643186887447432888">बटन</translation>
-<translation id="5677946354068040947">ज़्यादा विकल्प</translation>
-<translation id="576709008726043716">परिचय</translation>
-<translation id="57838592816432529">म्यूट करें</translation>
-<translation id="5860033963881614850">बंद</translation>
-<translation id="588258955323874662">पूर्णस्‍क्रीन</translation>
-<translation id="5888666972993069672">अब <ph name="DEVICE_FRIENDLY_NAME" /> पर कास्ट किया जा रहा है</translation>
-<translation id="591047860372322273">खोज बॉक्स</translation>
-<translation id="5939518447894949180">रीसेट करें</translation>
-<translation id="5966707198760109579">हफ़्ता</translation>
-<translation id="5987525920412732405">स्पिन बटन</translation>
-<translation id="6011459053400940133">वॉल्यूम स्लाइडर</translation>
-<translation id="6015796118275082299">वर्ष</translation>
-<translation id="6023896073578205740">सूची बॉक्स</translation>
-<translation id="6150588977291308318">संदर्भ सूची</translation>
-<translation id="6164829606128959761">मीटर</translation>
-<translation id="6166809985690652833">उपसंहार</translation>
-<translation id="6209276755895393898">यह इमेज इस बारे में लगती है: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">शब्दावली</translation>
-<translation id="6281763101136022427">यूआरएल</translation>
-<translation id="6310801910862476708">'पिक्चर में पिक्चर से बाहर निकलें'</translation>
-<translation id="6398862346408813489">महीना चुनने का पैनल दिखाएं</translation>
-<translation id="6404546809543547843">ऑडियो समय स्क्रबर</translation>
-<translation id="6443871981718447451">बंद कैप्‍शन मेन्यू दिखाएं</translation>
-<translation id="6453774872122745852">धन्यवाद</translation>
-<translation id="648732519525291180">समय पिकर</translation>
-<translation id="6550675742724504774">विकल्प</translation>
-<translation id="6572309429103589720">गलत व्याकरण</translation>
-<translation id="658823671542763450">फ़ुल स्क्रीन में प्रवेश करें</translation>
-<translation id="663493177488814956">फ़ीड</translation>
-<translation id="6637586476836377253">लॉग</translation>
-<translation id="6643016212128521049">साफ़ करें</translation>
-<translation id="668171684555832681">अन्य...</translation>
-<translation id="6692633176391053278">स्टेपर</translation>
-<translation id="6709570249143506788">खराब वीडियो क्वालिटी</translation>
-<translation id="6755330956360078551">टूलटिप</translation>
-<translation id="6790428901817661496">चलाएं</translation>
-<translation id="6820355525329141109">प्लग इन लोड नहीं किया जा सका.</translation>
-<translation id="6820615603175220800">संदर्भ सूची का संदर्भ</translation>
-<translation id="6843725295806269523">म्यूट करें</translation>
-<translation id="6885760532393684712">निर्देशिका</translation>
-<translation id="689129560213475294">कॉलफ़न</translation>
-<translation id="6934078000481955284">ब्लॉककोट</translation>
-<translation id="6941933287844615239">मीडिया डाउनलोड करें</translation>
-<translation id="6981594929165378967">डालना</translation>
-<translation id="6989848892321993519">कृपया इस लेख को <ph name="MIN_CHARACTERS" /> या उससे ज़्यादा वर्णों तक बढ़ाएं (आप इस समय 1 वर्ण का उपयोग कर रहे हैं).</translation>
-<translation id="7033340931668032222">आवाज़ कम-ज़्यादा करने के लिए ऊपर और नीचे वाले बटन का इस्तेमाल करें</translation>
-<translation id="709897737746224366">कृपया अनुरोधित प्रारूप का मिलान करें.</translation>
-<translation id="7118469954320184356">कोई जानकारी मौजूद नहीं है.</translation>
-<translation id="7139483182332611405">आमुख</translation>
-<translation id="7214187073215825913">सामग्री की जानकारी</translation>
-<translation id="7263440858009898357">कृपया सूची में किसी आइटम को चुनें.</translation>
-<translation id="727747134524199931">स्तंभ शीर्षलेख</translation>
-<translation id="7320576522385648310">बफ़र हो रहा है</translation>
-<translation id="7353453495576941748">क्रेडिट</translation>
-<translation id="7364796246159120393">फ़ाइल चुनें</translation>
-<translation id="739024184232394898">अन्य...</translation>
-<translation id="7405738980073107433">एंडनोट</translation>
-<translation id="7410239719251593705">लगता है कि वयस्क सामग्री मौजूद है. कोई जानकारी मौजूद नहीं है.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">टैब</translation>
-<translation id="7514365320538308">डाउनलोड करें</translation>
-<translation id="7529102961911894712">बैक लिंक</translation>
-<translation id="7533959249147584474">बिना लेबल वाले ग्राफ़िक</translation>
-<translation id="7647456547678091388">सलाह</translation>
-<translation id="7661956066982048809">ग्राफ़िक्स दस्तावेज़</translation>
-<translation id="7673697353781729403">घंटे</translation>
-<translation id="7681220483256441252">इंडेक्स</translation>
-<translation id="7740050170769002709">HTML सामग्री</translation>
-<translation id="7745230546936012372">ऐसी इमेज जो मौजूद नहीं हैं उनके बारे में जानकारी पाने के लिए, संदर्भ मेन्यू खोलें.</translation>
-<translation id="7750228210027921155">पिक्चर में पिक्चर</translation>
-<translation id="775297008183122718">अमान्य प्रविष्टि</translation>
-<translation id="7789962463072032349">रोकें</translation>
-<translation id="7802800022689234070">प्रकटीकरण त्रिकोण</translation>
-<translation id="7888071071722539607">कृपया ईमेल पते में '<ph name="ATSIGN" />' शामिल करें. '<ph name="INVALIDADDRESS" />' में '<ph name="ATSIGN" />' नहीं है.</translation>
-<translation id="7891486169920085145">विभाजक</translation>
-<translation id="795667975304826397">कोई फाइल नहीं चुनी गई</translation>
-<translation id="8053789581856978548">लेख फ़ील्ड खोजें</translation>
-<translation id="8057695513531652401">सूचना</translation>
-<translation id="8105797009065549151">नोट संदर्भ</translation>
-<translation id="811583516810654505">इमेज की जानकारी ढूंढी जा रही है</translation>
-<translation id="8117451130807776954">इस हफ़्ते</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">स्थानीय तारीख और समय पिकर (स्थानीय तारीख और समय चुनने की सुविधा)</translation>
-<translation id="8261464734335370856">गलत स्पेलिंग</translation>
-<translation id="8284326494547611709">कैप्शन</translation>
-<translation id="835897206747267392">अमान्य मान.</translation>
-<translation id="8403857369060869934">बीता हुआ समय: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">भाग</translation>
-<translation id="8433900881053900389">टूलबार</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> फ़ाइल</translation>
-<translation id="8451268428117625855">कृपया किसी फ़ाइल को चुनें.</translation>
-<translation id="8461852803063341183">रेडियो बटन</translation>
-<translation id="8474886197722836894">लगन</translation>
-<translation id="8531739829932800271">गलतियां</translation>
-<translation id="8534579021159131403">मिनट</translation>
-<translation id="8541249477527128034">मीडिया नियंत्रण</translation>
-<translation id="8550857728288566671">ग्राफ़िक्स चिह्न</translation>
-<translation id="8583702881314752957">परिभाषा सूची</translation>
-<translation id="8597182159515967513">हेडिंग</translation>
-<translation id="8603553056539299761">कार्रवाई के लिए बाएं और दाएं बटन का इस्तेमाल करें</translation>
-<translation id="860475260694818407">विषय सूची</translation>
-<translation id="8613126697340063924">दूरस्थ प्लेबैक नियंत्रित करें</translation>
-<translation id="862370744433916922">सबटाइटल</translation>
-<translation id="8711688047404765493">आउटपुट</translation>
-<translation id="8750798805984357768">कृपया इनमें से कोई विकल्प चुनें.</translation>
-<translation id="8808573423886751634">पाठ</translation>
-<translation id="8845239796550121995">अब आपके टीवी पर कास्ट हो रहा है</translation>
-<translation id="8851136666856101339">मुख्य</translation>
-<translation id="8875657656876809964">वीडियो चलाने में गड़बड़ी</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> केबी</translation>
-<translation id="8987927404178983737">माह</translation>
-<translation id="901493112792887934">वर्तमान समय, सेकंड में</translation>
-<translation id="901834265349196618">ईमेल</translation>
-<translation id="9048119486235211610">मार्गदर्शक</translation>
-<translation id="9062295712474918030">दस्तावेज़</translation>
-<translation id="9062307380734144336">चलाएं और रोकें के बीच टॉगल करने के लिए चुनें</translation>
-<translation id="9093215626363556771">पिक्चर में पिक्चर से बाहर निकलें</translation>
-<translation id="9108370397979208512">गणित</translation>
-<translation id="9132465097189459683">अन्य...</translation>
-<translation id="9138385573473225930">सूचना</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" /> से प्रारंभ हो रहा है</translation>
-<translation id="916607977885256133">पिक्चर में पिक्चर</translation>
-<translation id="9168329111483466115">फ़ुटनोट</translation>
-<translation id="954003015749068518">पिक्चर में पिक्चर चालू करें</translation>
-<translation id="966787709310836684">मेन्यू</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_hr.xtb b/chromium/content/app/strings/translations/content_strings_hr.xtb
deleted file mode 100644
index f5ec4999c42..00000000000
--- a/chromium/content/app/strings/translations/content_strings_hr.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="hr">
-<translation id="1018939186200882850">stavka izbornika</translation>
-<translation id="10623998915015855">preklopni gumb</translation>
-<translation id="1088086359088493902">Sekunde</translation>
-<translation id="1171774979989969504">Unesite e-adresu.</translation>
-<translation id="1178581264944972037">Pauziraj</translation>
-<translation id="1188858454923323853">dopunski</translation>
-<translation id="1206619573307042055">pomični tekst</translation>
-<translation id="1206693055195146388">klizač</translation>
-<translation id="1211441953136645838">završna napomena</translation>
-<translation id="1281252709823657822">dijalog</translation>
-<translation id="1335095011850992622">zasluge</translation>
-<translation id="1342835525016946179">članak</translation>
-<translation id="1359897965706325498">natpis</translation>
-<translation id="1589122976691792535">regija</translation>
-<translation id="1591562245178063882">Ovaj mjesec</translation>
-<translation id="1637811476055996098">Odabir datoteka</translation>
-<translation id="1650423536718072820">izdvojeno</translation>
-<translation id="1727886345390570319">sakrij izbornik titlova</translation>
-<translation id="1729654308190250600">Unesite e-adresu koja nije prazna vrijednost.</translation>
-<translation id="1758486001363313524">Drugo...</translation>
-<translation id="1806710327868736751">dijaloški okvir upozorenja</translation>
-<translation id="1821985195704844674">rešetka u obliku stabla</translation>
-<translation id="1822429046913737220">prijepodne/poslijepodne</translation>
-<translation id="1832974991323546415">reproduciraj na udaljenom uređaju</translation>
-<translation id="190587075670221089">brisanje</translation>
-<translation id="1907737156431278478">primjer</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Vrijednost mora biti <ph name="MAXIMUM_DATE_OR_TIME" /> ili prije toga.</translation>
-<translation id="1946271899482435442">Prikaz alata za odabir datuma</translation>
-<translation id="1993104285338243655">Prebačeno na zrcaljenje</translation>
-<translation id="2060505056492490888">Znak "<ph name="DOT" />" upotrebljava se na pogrešnom položaju u domeni "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Danas</translation>
-<translation id="2158401438286456825">popis stranica</translation>
-<translation id="2226276347425096477">Skratite taj tekst na <ph name="MAX_CHARACTERS" /> znakova ili manje (trenutačno upotrebljavate <ph name="CURRENT_LENGTH" /> znakova).</translation>
-<translation id="2246498165605549352">Lokalna datoteka</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. tjedan, <ph name="YEAR" />. godina</translation>
-<translation id="2277199496770840904">Zapis <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">potvrdni okvir</translation>
-<translation id="2311842470354187719">prijelom stranice</translation>
-<translation id="2335594187091864976">alat za odabir datuma i vremena</translation>
-<translation id="245932805758469625">preostali broj sekundi videozapisa</translation>
-<translation id="248395913932153421">Dan</translation>
-<translation id="2507943997699731163">Ispunite ovo polje.</translation>
-<translation id="2508569020611168319">popis kartica</translation>
-<translation id="2561842179657104141">prikaži više kontrola za medije</translation>
-<translation id="2572483411312390101">reprodukcija</translation>
-<translation id="2613802280814924224">Unesite važeću vrijednost. Najbliža je važeća vrijednost <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Pošalji</translation>
-<translation id="2657045182931379222">grafički objekt</translation>
-<translation id="2674318244760992338">podnožje</translation>
-<translation id="2709516037105925701">Automatsko popunjavanje</translation>
-<translation id="2723001399770238859">zvuk</translation>
-<translation id="2746543609216772311">Vrijednost mora biti <ph name="MINIMUM_DATE_OR_TIME" /> ili nakon toga.</translation>
-<translation id="2759744352195237655">gumb skočnog prozora</translation>
-<translation id="2761667185364618470">Označite taj okvir ako želite ići dalje.</translation>
-<translation id="2844350028562914727">pojedinosti</translation>
-<translation id="2896972712917208084">grupa izbornih gumba</translation>
-<translation id="2908441821576996758">Unesite popis adresa e-pošte odijeljen zarezima.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">istaknuti sadržaj</translation>
-<translation id="3040011195152428237">veza</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Unesite važeću vrijednost. Ovo je polje nepotpuno ili sadrži nevažeći datum.</translation>
-<translation id="3078740164268491126">tablica</translation>
-<translation id="3086746722712840547">napom</translation>
-<translation id="310520048233152454">Unesite URL.</translation>
-<translation id="3175736971608411871">odbrojavanje</translation>
-<translation id="3199563858620722075">kombinirani okvir</translation>
-<translation id="3450233048674729344">Vrijednost mora biti <ph name="MAXIMUM" /> ili manja.</translation>
-<translation id="3486220673238053218">definicija</translation>
-<translation id="3557673793733683882">naslov <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">alat za odabir tjedna</translation>
-<translation id="3685101356851116974">Neoznačena slika</translation>
-<translation id="3706100364254443312">prebaci</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Zatvori sliku u slici</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">pojam</translation>
-<translation id="3822383571486410024">Produljite broj znakova u tekstu na minimalno <ph name="MIN_CHARACTERS" />. Trenutačno imate premalo znakova (<ph name="CURRENT_LENGTH" />).</translation>
-<translation id="383465348367842624">Dio adrese ispred znaka "<ph name="ATSIGN" />" ne smije sadržavati simbol "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Izlaz iz punog zaslona</translation>
-<translation id="3920932319529768807">zaključak</translation>
-<translation id="3924558731517983934">aplikacija</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">klizač</translation>
-<translation id="4103419683916926126">Milisekunde</translation>
-<translation id="4151657705144244502">slika</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">predgovor</translation>
-<translation id="4201051445878709314">Prikaži prethodni mjesec</translation>
-<translation id="421884353938374759">odabir boja</translation>
-<translation id="4248100235867064564">traka izbornika</translation>
-<translation id="4360991593054037559">Unesite važeću vrijednost. Dvije su najbliže važeće vrijednosti <ph name="VALID_VALUE_LOW" /> i <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Pitanja i odgovori</translation>
-<translation id="4413860115965805769">gumb izbornika</translation>
-<translation id="4444765639179266822">Čini se da piše: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">referenca iz pojmovnika</translation>
-<translation id="4522570452068850558">Detalji</translation>
-<translation id="4542388879936266156">preostalo vrijeme: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">obrazac</translation>
-<translation id="4661075872484491155">stablo</translation>
-<translation id="4664250907885839816">Dio adrese iza znaka "<ph name="ATSIGN" />" ne smije sadržavati simbol "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">dodatak</translation>
-<translation id="4718048029184481307">Reproducira se u načinu slika u slici</translation>
-<translation id="4742539557769756338">naslovnica</translation>
-<translation id="4748357248530471599">prebacite urez na zaslonu u cijeli zaslon</translation>
-<translation id="4757246831282535685">ploča kartice</translation>
-<translation id="4763480195061959176">videozapis</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Unesite broj.</translation>
-<translation id="4912536737030637138">bibliografski unos</translation>
-<translation id="4975562563186953947">Odabrano: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Uključi zvuk</translation>
-<translation id="49969490063480558">Unesite dio adrese iza znaka "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" nije potpuna e-adresa.</translation>
-<translation id="5034860022980953847">pokazivač napretka</translation>
-<translation id="5090250355906949916">klizač vremena videozapisa</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Prikaži sljedeći mjesec</translation>
-<translation id="512758898067543763">zaglavlje retka</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Vrijednost mora biti <ph name="MINIMUM" /> ili veća.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Unesite dio adrese ispred znaka "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" nije potpuna e-adresa.</translation>
-<translation id="5334352251556557839">Reprodukcija medija nije uspjela.</translation>
-<translation id="5406322316791861025">lik</translation>
-<translation id="5453733299334684579">stavka stabla</translation>
-<translation id="5466621249238537318">Izaberite jednu ili više datoteka.</translation>
-<translation id="5468998798572797635">izlazak iz cijelog zaslona</translation>
-<translation id="5516424706154626233">alat za odabir datuma</translation>
-<translation id="5537725057119320332">Emitiraj</translation>
-<translation id="5546461542133609677">uključivanje zvuka</translation>
-<translation id="561939826962581046">vrijeme</translation>
-<translation id="5630795885300617244">Dvaput dodirnite lijevo ili desno za preskakanje od 10 s</translation>
-<translation id="5631759159893697722">sažetak</translation>
-<translation id="5643186887447432888">gumb</translation>
-<translation id="5677946354068040947">više opcija</translation>
-<translation id="576709008726043716">uvod</translation>
-<translation id="57838592816432529">Isključi zvuk</translation>
-<translation id="5860033963881614850">Isključeno</translation>
-<translation id="588258955323874662">Puni zaslon</translation>
-<translation id="5888666972993069672">Trenutačno se emitira na uređaju <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">okvir za pretraživanje</translation>
-<translation id="5939518447894949180">Ponovno postavi</translation>
-<translation id="5966707198760109579">Tjedan</translation>
-<translation id="5987525920412732405">okretni gumb</translation>
-<translation id="6011459053400940133">Klizač za glasnoću</translation>
-<translation id="6015796118275082299">Godina</translation>
-<translation id="6023896073578205740">okvir s popisom</translation>
-<translation id="6150588977291308318">bibliografija</translation>
-<translation id="6164829606128959761">mjerač</translation>
-<translation id="6166809985690652833">pogovor</translation>
-<translation id="6209276755895393898">Čini se da je to: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">pojmovnik</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Izlaz iz načina slika u slici</translation>
-<translation id="6398862346408813489">Prikaži ploču za odabir mjeseca</translation>
-<translation id="6404546809543547843">klizač vremena audiozapisa</translation>
-<translation id="6443871981718447451">prikaži izbornik titlova</translation>
-<translation id="6453774872122745852">zahvale</translation>
-<translation id="648732519525291180">alat za odabir vremena</translation>
-<translation id="6550675742724504774">Opcije</translation>
-<translation id="6572309429103589720">Netočna gramatika</translation>
-<translation id="658823671542763450">otvaranje na cijelom zaslonu</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">zap</translation>
-<translation id="6643016212128521049">Izbriši</translation>
-<translation id="668171684555832681">Ostalo...</translation>
-<translation id="6692633176391053278">povećanje/smanjenje strelicama gore/dolje (stepper)</translation>
-<translation id="6709570249143506788">Loša kvaliteta reprodukcije</translation>
-<translation id="6755330956360078551">opis</translation>
-<translation id="6790428901817661496">Reproduciraj</translation>
-<translation id="6820355525329141109">Nije bilo moguće učitati dodatak.</translation>
-<translation id="6820615603175220800">bibliografska referenca</translation>
-<translation id="6843725295806269523">isključi ton</translation>
-<translation id="6885760532393684712">direktorij</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">uvučeni citat</translation>
-<translation id="6941933287844615239">preuzmi medij</translation>
-<translation id="6981594929165378967">umetanje</translation>
-<translation id="6989848892321993519">Produljite broj znakova u tekstu na minimalno <ph name="MIN_CHARACTERS" /> (trenutačno imate 1 znak).</translation>
-<translation id="7033340931668032222">gore i dolje za regulaciju glasnoće</translation>
-<translation id="709897737746224366">Udovoljite zadanom formatu.</translation>
-<translation id="7118469954320184356">Opis nije dostupan.</translation>
-<translation id="7139483182332611405">predgovor</translation>
-<translation id="7214187073215825913">informacije o sadržaju</translation>
-<translation id="7263440858009898357">Odaberite stavku s popisa.</translation>
-<translation id="727747134524199931">zaglavlje stupca</translation>
-<translation id="7320576522385648310">pohranjivanje u međuspremnik</translation>
-<translation id="7353453495576941748">zasluga</translation>
-<translation id="7364796246159120393">Odaberi datoteku</translation>
-<translation id="739024184232394898">Drugo...</translation>
-<translation id="7405738980073107433">završne napomene</translation>
-<translation id="7410239719251593705">Čini se da sadrži sadržaj za odrasle. Opis nije dostupan.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">kart</translation>
-<translation id="7514365320538308">Preuzmi</translation>
-<translation id="7529102961911894712">povratna veza</translation>
-<translation id="7533959249147584474">Neoznačena grafika</translation>
-<translation id="7647456547678091388">savjet</translation>
-<translation id="7661956066982048809">grafički dokument</translation>
-<translation id="7673697353781729403">Sati</translation>
-<translation id="7681220483256441252">indeks</translation>
-<translation id="7740050170769002709">HTML sadržaj</translation>
-<translation id="7745230546936012372">Da biste dohvatili opise slika koji nedostaju, otvorite kontekstni izbornik.</translation>
-<translation id="7750228210027921155">Slika u slici</translation>
-<translation id="775297008183122718">Nevažeći unos</translation>
-<translation id="7789962463072032349">pauziraj</translation>
-<translation id="7802800022689234070">trokut za otkrivanje</translation>
-<translation id="7888071071722539607">Uključite znak "<ph name="ATSIGN" />" u e-adresu. U adresi "<ph name="INVALIDADDRESS" />" nedostaje znak "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">razdjelnik</translation>
-<translation id="795667975304826397">Nije odabrana niti jedna datoteka.</translation>
-<translation id="8053789581856978548">pretraži tekstno polje</translation>
-<translation id="8057695513531652401">obavijest</translation>
-<translation id="8105797009065549151">referenca bilješke</translation>
-<translation id="811583516810654505">U tijeku je dohvaćanje opisa...</translation>
-<translation id="8117451130807776954">Ovaj tjedan</translation>
-<translation id="8199524924445686405">gggg</translation>
-<translation id="8208673686607688524">alat za odabir lokalnog datuma i vremena</translation>
-<translation id="8261464734335370856">Netočan pravopis</translation>
-<translation id="8284326494547611709">Titlovi</translation>
-<translation id="835897206747267392">Nevažeća vrijednost.</translation>
-<translation id="8403857369060869934">proteklo vrijeme: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">dio</translation>
-<translation id="8433900881053900389">alatna traka</translation>
-<translation id="8444882422881193423">Broj datoteka: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Odaberite datoteku.</translation>
-<translation id="8461852803063341183">izborni gumb</translation>
-<translation id="8474886197722836894">posveta</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minute</translation>
-<translation id="8541249477527128034">kontrola medija</translation>
-<translation id="8550857728288566671">grafički simbol</translation>
-<translation id="8583702881314752957">popis definicija</translation>
-<translation id="8597182159515967513">naslov</translation>
-<translation id="8603553056539299761">lijevo i desno za preskakanje</translation>
-<translation id="860475260694818407">sadržaj</translation>
-<translation id="8613126697340063924">upravljaj daljinskom reprodukcijom</translation>
-<translation id="862370744433916922">titl</translation>
-<translation id="8711688047404765493">izlaz</translation>
-<translation id="8750798805984357768">Izaberite jednu od tih opcija.</translation>
-<translation id="8808573423886751634">poglavlje</translation>
-<translation id="8845239796550121995">Emitira se na televizoru</translation>
-<translation id="8851136666856101339">glav</translation>
-<translation id="8875657656876809964">Pogreška pri reprodukciji videozapisa</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mjesec</translation>
-<translation id="901493112792887934">trenutačno vrijeme u sekundama</translation>
-<translation id="901834265349196618">e-pošta</translation>
-<translation id="9048119486235211610">navigacija</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">odaberite da biste prebacili s reprodukcije na pauzu i obrnuto</translation>
-<translation id="9093215626363556771">izlaz iz načina slika u slici</translation>
-<translation id="9108370397979208512">mat</translation>
-<translation id="9132465097189459683">Drugo...</translation>
-<translation id="9138385573473225930">upozorenje</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, počevši od <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Slika u slici</translation>
-<translation id="9168329111483466115">fusnota</translation>
-<translation id="954003015749068518">pokretanje načina slika u slici</translation>
-<translation id="966787709310836684">izbornik</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_hu.xtb b/chromium/content/app/strings/translations/content_strings_hu.xtb
deleted file mode 100644
index f7b1ea7112b..00000000000
--- a/chromium/content/app/strings/translations/content_strings_hu.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="hu">
-<translation id="1018939186200882850">menüelem</translation>
-<translation id="10623998915015855">átkapcsológomb</translation>
-<translation id="1088086359088493902">Másodperc</translation>
-<translation id="1171774979989969504">Kérjük, adjon meg egy e-mail címet.</translation>
-<translation id="1178581264944972037">Szünet</translation>
-<translation id="1188858454923323853">kiegészítő</translation>
-<translation id="1206619573307042055">fényújság</translation>
-<translation id="1206693055195146388">csúszka</translation>
-<translation id="1211441953136645838">záró jegyzet</translation>
-<translation id="1281252709823657822">párbeszédpanel</translation>
-<translation id="1335095011850992622">készítők</translation>
-<translation id="1342835525016946179">cikk</translation>
-<translation id="1359897965706325498">szalaghirdetés</translation>
-<translation id="1589122976691792535">régió</translation>
-<translation id="1591562245178063882">Ebben a hónapban</translation>
-<translation id="1637811476055996098">Fájlok kiválasztása</translation>
-<translation id="1650423536718072820">kiemelt idézet</translation>
-<translation id="1727886345390570319">a feliratok menü elrejtése</translation>
-<translation id="1729654308190250600">Kérjük, ne hagyja üresen az e-mail-cím mezőjét.</translation>
-<translation id="1758486001363313524">Más...</translation>
-<translation id="1806710327868736751">értesítő párbeszédpanel</translation>
-<translation id="1821985195704844674">farács</translation>
-<translation id="1822429046913737220">de./du.</translation>
-<translation id="1832974991323546415">lejátszás távoli eszközön</translation>
-<translation id="190587075670221089">törlés</translation>
-<translation id="1907737156431278478">példa</translation>
-<translation id="1921819250265091946">nn</translation>
-<translation id="1930711995431081526">állapot</translation>
-<translation id="1938124657309484470">Az érték <ph name="MAXIMUM_DATE_OR_TIME" /> vagy azt megelőző kell, hogy legyen.</translation>
-<translation id="1946271899482435442">Dátumválasztó megjelenítése</translation>
-<translation id="1993104285338243655">Átváltott tükrözésre</translation>
-<translation id="2060505056492490888">A „<ph name="DOT" />” rossz helyen van a(z) „<ph name="INVALIDDOMAIN" />” címben.</translation>
-<translation id="2148716181193084225">Ma</translation>
-<translation id="2158401438286456825">oldallista</translation>
-<translation id="2226276347425096477">Kérjük, rövidítse le a szöveget legfeljebb <ph name="MAX_CHARACTERS" /> karakterre (jelenleg <ph name="CURRENT_LENGTH" /> karaktert használ).</translation>
-<translation id="2246498165605549352">Helyi fájl</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. hét, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904"><ph name="NUMBER" />. szám</translation>
-<translation id="2291999235780842123">jelölőnégyzet</translation>
-<translation id="2311842470354187719">oldaltörés</translation>
-<translation id="2335594187091864976">dátum- és időválasztó</translation>
-<translation id="245932805758469625">a videóból hátralévő másodpercek száma</translation>
-<translation id="248395913932153421">nap</translation>
-<translation id="2507943997699731163">Kérjük, töltse ki ezt a mezőt.</translation>
-<translation id="2508569020611168319">laplista</translation>
-<translation id="2561842179657104141">további médiavezérlők megjelenítése</translation>
-<translation id="2572483411312390101">lejátszás</translation>
-<translation id="2613802280814924224">Kérjük, érvényes értéket adjon meg. A legközelebbi érvényes érték <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Elküldés</translation>
-<translation id="2657045182931379222">grafikus objektum</translation>
-<translation id="2674318244760992338">lábléc</translation>
-<translation id="2709516037105925701">Automatikus kitöltés</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Az érték <ph name="MINIMUM_DATE_OR_TIME" /> vagy azt követő kell, hogy legyen.</translation>
-<translation id="2759744352195237655">előugró gomb</translation>
-<translation id="2761667185364618470">Kérjük, jelölje be ezt a jelölőnégyzetet, ha tovább kíván haladni.</translation>
-<translation id="2844350028562914727">részletek</translation>
-<translation id="2896972712917208084">választógombcsoport</translation>
-<translation id="2908441821576996758">Kérjük, adjon meg egy vesszőkkel elválasztott e-mail címlistát.</translation>
-<translation id="2940813599313844715">objektum</translation>
-<translation id="2942448076852699108">kijelölt tartalom</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Kérjük, adjon meg érvényes értéket. A mező hiányos, vagy érvénytelen dátum van megadva.</translation>
-<translation id="3078740164268491126">táblázat</translation>
-<translation id="3086746722712840547">jegyzet</translation>
-<translation id="310520048233152454">Adjon meg egy URL-t.</translation>
-<translation id="3175736971608411871">időzítő</translation>
-<translation id="3199563858620722075">legördülő lista</translation>
-<translation id="3450233048674729344">Az érték legyen kisebb vagy egyenlő, mint <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definíció</translation>
-<translation id="3557673793733683882"><ph name="HEADING_LEVEL" />. címsor</translation>
-<translation id="3670698553867754311">hétválasztó</translation>
-<translation id="3685101356851116974">Címke nélküli kép</translation>
-<translation id="3706100364254443312">váltás</translation>
-<translation id="3732799496749320381">hh</translation>
-<translation id="3754210790023674521">Kilépés a kép a képben módból</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">kifejezés</translation>
-<translation id="3822383571486410024">Kérjük, <ph name="MIN_CHARACTERS" /> karakter hosszú vagy annál hosszabb szöveget adjon meg (jelenleg <ph name="CURRENT_LENGTH" /> karaktert használ).</translation>
-<translation id="383465348367842624">A „<ph name="ATSIGN" />” előtti rész nem tartalmazhat „<ph name="INVALIDCHARACTER" />” karaktert.</translation>
-<translation id="3846214748874656680">Teljes képernyő – ki</translation>
-<translation id="3920932319529768807">összefoglalás</translation>
-<translation id="3924558731517983934">alkalmazás</translation>
-<translation id="3944740393230681990">prológus</translation>
-<translation id="3960700977367013758">görgetősáv</translation>
-<translation id="4103419683916926126">Ezredmásodperc</translation>
-<translation id="4151657705144244502">grafika</translation>
-<translation id="4160057747563657758">telefonszám</translation>
-<translation id="4193965531860883258">előszó</translation>
-<translation id="4201051445878709314">Az előző hónap megjelenítése</translation>
-<translation id="421884353938374759">színválasztó</translation>
-<translation id="4248100235867064564">menüsor</translation>
-<translation id="4360991593054037559">Kérjük, érvényes értéket adjon meg. A két legközelebbi érvényes érték <ph name="VALID_VALUE_LOW" /> és <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Kérdések és válaszok</translation>
-<translation id="4413860115965805769">menügomb</translation>
-<translation id="4444765639179266822">Úgy tűnik, hogy a következő látható rajta: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">szószedet-hivatkozás</translation>
-<translation id="4522570452068850558">Részletek</translation>
-<translation id="4542388879936266156">hátralévő idő: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">űrlap</translation>
-<translation id="4661075872484491155">fa</translation>
-<translation id="4664250907885839816">A „<ph name="ATSIGN" />” utáni rész nem tartalmazhat „<ph name="INVALIDCHARACTER" />” karaktert.</translation>
-<translation id="4668956016107839909">függelék</translation>
-<translation id="4718048029184481307">Lejátszás kép a képben módban</translation>
-<translation id="4742539557769756338">borító</translation>
-<translation id="4748357248530471599">képernyőkivágás váltása teljes képernyőn</translation>
-<translation id="4757246831282535685">lappanel</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Kérjük, adjon meg egy számot.</translation>
-<translation id="4912536737030637138">bibliográfiai bejegyzés</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> kiválasztva</translation>
-<translation id="4992066212339426712">Némítás feloldása</translation>
-<translation id="49969490063480558">Kérjük, adja meg a „<ph name="ATSIGN" />” utáni részt is. A(z) „<ph name="INVALIDADDRESS" />” cím nem teljes.</translation>
-<translation id="5034860022980953847">folyamatjelző</translation>
-<translation id="5090250355906949916">a videóidő vezérlője</translation>
-<translation id="5093189678851173835">mottó</translation>
-<translation id="5117590920725113268">A következő hónap megjelenítése</translation>
-<translation id="512758898067543763">sorfejléc</translation>
-<translation id="5143125788380636750">végszó</translation>
-<translation id="5164977714490026579">Az érték legyen nagyobb vagy egyenlő, mint <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Kérjük, adja meg a „<ph name="ATSIGN" />” előtti részt is. A „<ph name="INVALIDADDRESS" />” cím nem teljes.</translation>
-<translation id="5334352251556557839">Nem sikerült a médiafájl lejátszása.</translation>
-<translation id="5406322316791861025">alak</translation>
-<translation id="5453733299334684579">faelem</translation>
-<translation id="5466621249238537318">Kérjük, válasszon ki egy vagy több fájlt.</translation>
-<translation id="5468998798572797635">kilépés a teljes képernyős nézetből</translation>
-<translation id="5516424706154626233">dátumválasztó</translation>
-<translation id="5537725057119320332">Küldés</translation>
-<translation id="5546461542133609677">némítás feloldása</translation>
-<translation id="561939826962581046">idő</translation>
-<translation id="5630795885300617244">A jobb/bal oldalon duplán koppintva ugorhat előre/vissza 10 másodpercet</translation>
-<translation id="5631759159893697722">absztrakt</translation>
-<translation id="5643186887447432888">gomb</translation>
-<translation id="5677946354068040947">további beállítások</translation>
-<translation id="576709008726043716">bevezetés</translation>
-<translation id="57838592816432529">Némítás</translation>
-<translation id="5860033963881614850">Kikapcsolva</translation>
-<translation id="588258955323874662">Teljes képernyő</translation>
-<translation id="5888666972993069672">Átküldés ide: <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">keresőmező</translation>
-<translation id="5939518447894949180">Visszaállítás</translation>
-<translation id="5966707198760109579">Hét</translation>
-<translation id="5987525920412732405">léptetőnyíl</translation>
-<translation id="6011459053400940133">hangerőcsúszka</translation>
-<translation id="6015796118275082299">Év</translation>
-<translation id="6023896073578205740">listamező</translation>
-<translation id="6150588977291308318">bibliográfia</translation>
-<translation id="6164829606128959761">mérő</translation>
-<translation id="6166809985690652833">utószó</translation>
-<translation id="6209276755895393898">Úgy tűnik, hogy a következőről van szó: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">szószedet</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Kilépés a kép a képben funkcióból</translation>
-<translation id="6398862346408813489">A hónapválasztási panel megjelenítése</translation>
-<translation id="6404546809543547843">hang idővonalának vezérlője</translation>
-<translation id="6443871981718447451">a feliratok menü mutatása</translation>
-<translation id="6453774872122745852">köszönetnyilvánítás</translation>
-<translation id="648732519525291180">időválasztó</translation>
-<translation id="6550675742724504774">Beállítások</translation>
-<translation id="6572309429103589720">Nyelvtani hiba</translation>
-<translation id="658823671542763450">teljes képernyős nézet</translation>
-<translation id="663493177488814956">hírcsatorna</translation>
-<translation id="6637586476836377253">napló</translation>
-<translation id="6643016212128521049">Törlés</translation>
-<translation id="668171684555832681">Egyéb...</translation>
-<translation id="6692633176391053278">léptető</translation>
-<translation id="6709570249143506788">Gyenge lejátszási minőség</translation>
-<translation id="6755330956360078551">elemleírás</translation>
-<translation id="6790428901817661496">Játék</translation>
-<translation id="6820355525329141109">Nem sikerült betölteni a beépülő modult.</translation>
-<translation id="6820615603175220800">bibliográfiai hivatkozás</translation>
-<translation id="6843725295806269523">némítás</translation>
-<translation id="6885760532393684712">címtár</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">bekezdésszintű idézet</translation>
-<translation id="6941933287844615239">médiafájlok letöltése</translation>
-<translation id="6981594929165378967">beszúrás</translation>
-<translation id="6989848892321993519">Legalább <ph name="MIN_CHARACTERS" /> karakter hosszú szöveget adjon meg (jelenleg 1 karaktert használ).</translation>
-<translation id="7033340931668032222">fel és le a hangerő módosításához</translation>
-<translation id="709897737746224366">Kérjük, tartsa magát a kívánt formátumhoz.</translation>
-<translation id="7118469954320184356">Nincs leírás.</translation>
-<translation id="7139483182332611405">bevezető</translation>
-<translation id="7214187073215825913">tartalom adatai</translation>
-<translation id="7263440858009898357">Kérjük, válasszon egyet a lista elemei közül.</translation>
-<translation id="727747134524199931">oszlopfejléc</translation>
-<translation id="7320576522385648310">pufferelés</translation>
-<translation id="7353453495576941748">elismerés</translation>
-<translation id="7364796246159120393">Fájl kiválasztása</translation>
-<translation id="739024184232394898">Más...</translation>
-<translation id="7405738980073107433">záró jegyzetek</translation>
-<translation id="7410239719251593705">Úgy tűnik, felnőtt tartalom van benne. Leírás nincs.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Letöltés</translation>
-<translation id="7529102961911894712">visszamutató link</translation>
-<translation id="7533959249147584474">Címke nélküli ábra</translation>
-<translation id="7647456547678091388">tipp</translation>
-<translation id="7661956066982048809">grafikus dokumentum</translation>
-<translation id="7673697353781729403">Óra</translation>
-<translation id="7681220483256441252">tárgymutató</translation>
-<translation id="7740050170769002709">HTML-tartalom</translation>
-<translation id="7745230546936012372">Ha hiányzó képleírásokat szeretne lekérni, nyissa meg a helyi menüt.</translation>
-<translation id="7750228210027921155">Kép a képben</translation>
-<translation id="775297008183122718">Érvénytelen bevitel</translation>
-<translation id="7789962463072032349">szüneteltetés</translation>
-<translation id="7802800022689234070">plusz tartalom kibontására szolgáló háromszög</translation>
-<translation id="7888071071722539607">Kérjük, írjon egy „<ph name="ATSIGN" />” karaktert az e-mail címbe. A(z) „<ph name="INVALIDADDRESS" />” címből hiányzik a „<ph name="ATSIGN" />” jel.</translation>
-<translation id="7891486169920085145">felosztó</translation>
-<translation id="795667975304826397">Nincs fájl kiválasztva</translation>
-<translation id="8053789581856978548">keresés a szövegmezőben</translation>
-<translation id="8057695513531652401">közlés</translation>
-<translation id="8105797009065549151">jegyzethivatkozás</translation>
-<translation id="811583516810654505">A leírás lekérdezése folyamatban van</translation>
-<translation id="8117451130807776954">Ezen a héten</translation>
-<translation id="8199524924445686405">éééé</translation>
-<translation id="8208673686607688524">helyi dátum- és időválasztó</translation>
-<translation id="8261464734335370856">Helyesírási hiba</translation>
-<translation id="8284326494547611709">Feliratok</translation>
-<translation id="835897206747267392">Érvénytelen érték.</translation>
-<translation id="8403857369060869934">eltelt idő: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">rész</translation>
-<translation id="8433900881053900389">eszköztár</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> fájl</translation>
-<translation id="8451268428117625855">Válasszon egy fájlt.</translation>
-<translation id="8461852803063341183">választógomb</translation>
-<translation id="8474886197722836894">ajánlás</translation>
-<translation id="8531739829932800271">hibajegyzék</translation>
-<translation id="8534579021159131403">Perc</translation>
-<translation id="8541249477527128034">médiavezérlő</translation>
-<translation id="8550857728288566671">grafikus szimbólum</translation>
-<translation id="8583702881314752957">definíciós lista</translation>
-<translation id="8597182159515967513">fejléc</translation>
-<translation id="8603553056539299761">balra és jobbra az ugráshoz</translation>
-<translation id="860475260694818407">tartalomjegyzék</translation>
-<translation id="8613126697340063924">távoli lejátszás kezelése</translation>
-<translation id="862370744433916922">felirat</translation>
-<translation id="8711688047404765493">kimenet</translation>
-<translation id="8750798805984357768">Kérjük, válassza ki az egyik opciót.</translation>
-<translation id="8808573423886751634">fejezet</translation>
-<translation id="8845239796550121995">Átküldés a tévére folyamatban</translation>
-<translation id="8851136666856101339">fő</translation>
-<translation id="8875657656876809964">Videólejátszási hiba</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">hónap</translation>
-<translation id="901493112792887934">jelenlegi idő másodpercben</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navigáció</translation>
-<translation id="9062295712474918030">dokumentum</translation>
-<translation id="9062307380734144336">válassza ki a lejátszás és szüneteltetés közötti váltáshoz</translation>
-<translation id="9093215626363556771">kilépés a kép a képben funkcióból</translation>
-<translation id="9108370397979208512">matematika</translation>
-<translation id="9132465097189459683">Más...</translation>
-<translation id="9138385573473225930">értesítés</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />. hét (<ph name="WEEK_START_DATE" />-i dátummal kezdődik)</translation>
-<translation id="916607977885256133">Kép a képben</translation>
-<translation id="9168329111483466115">lábjegyzet</translation>
-<translation id="954003015749068518">belépés a kép a képben funkcióba</translation>
-<translation id="966787709310836684">menü</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_id.xtb b/chromium/content/app/strings/translations/content_strings_id.xtb
deleted file mode 100644
index 1e89c84543c..00000000000
--- a/chromium/content/app/strings/translations/content_strings_id.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="id">
-<translation id="1018939186200882850">item menu</translation>
-<translation id="10623998915015855">tombol</translation>
-<translation id="1088086359088493902">Detik</translation>
-<translation id="1171774979989969504">Masukkan alamat email.</translation>
-<translation id="1178581264944972037">Jeda</translation>
-<translation id="1188858454923323853">komplementer</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">penggeser</translation>
-<translation id="1211441953136645838">catatan akhir</translation>
-<translation id="1281252709823657822">dialog</translation>
-<translation id="1335095011850992622">daftar penghargaan</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">spanduk</translation>
-<translation id="1589122976691792535">wilayah</translation>
-<translation id="1591562245178063882">Bulan ini</translation>
-<translation id="1637811476055996098">Pilih File</translation>
-<translation id="1650423536718072820">pullquote</translation>
-<translation id="1727886345390570319">sembunyikan menu subtitel</translation>
-<translation id="1729654308190250600">Jangan mengosongkan bidang alamat email.</translation>
-<translation id="1758486001363313524">Lainnya...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">kisi pohon</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">putar di perangkat jarak jauh</translation>
-<translation id="190587075670221089">penghapusan</translation>
-<translation id="1907737156431278478">contoh</translation>
-<translation id="1921819250265091946">hh</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Tanggal harus <ph name="MAXIMUM_DATE_OR_TIME" /> atau lebih awal.</translation>
-<translation id="1946271899482435442">Tampilkan alat pilih tanggal</translation>
-<translation id="1993104285338243655">Dialihkan ke pencerminan</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' digunakan pada posisi yang salah di '<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">Hari ini</translation>
-<translation id="2158401438286456825">daftar halaman</translation>
-<translation id="2226276347425096477">Pendekkan teks ini menjadi <ph name="MAX_CHARACTERS" /> karakter atau kurang (saat ini Anda menggunakan <ph name="CURRENT_LENGTH" /> karakter).</translation>
-<translation id="2246498165605549352">File Lokal</translation>
-<translation id="2247351761944213033">Minggu <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Lagu <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">kotak centang</translation>
-<translation id="2311842470354187719">batas halaman</translation>
-<translation id="2335594187091864976">pemilih tanggal dan waktu</translation>
-<translation id="245932805758469625">sisa durasi video dalam detik</translation>
-<translation id="248395913932153421">Hari</translation>
-<translation id="2507943997699731163">Harap isi bidang ini.</translation>
-<translation id="2508569020611168319">daftar tab</translation>
-<translation id="2561842179657104141">tampilkan kontrol media lainnya</translation>
-<translation id="2572483411312390101">main</translation>
-<translation id="2613802280814924224">Masukkan nilai yang valid. Nilai valid terdekatnya adalah <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Kirim</translation>
-<translation id="2657045182931379222">objek grafis</translation>
-<translation id="2674318244760992338">footer</translation>
-<translation id="2709516037105925701">Isi-Otomatis</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Tanggal harus <ph name="MINIMUM_DATE_OR_TIME" /> atau setelahnya.</translation>
-<translation id="2759744352195237655">tombol pop-up</translation>
-<translation id="2761667185364618470">Centang kotak ini jika Anda ingin melanjutkan.</translation>
-<translation id="2844350028562914727">detail</translation>
-<translation id="2896972712917208084">grup radio</translation>
-<translation id="2908441821576996758">Masukkan daftar alamat email yang dipisahkan dengan koma.</translation>
-<translation id="2940813599313844715">objek</translation>
-<translation id="2942448076852699108">konten yang disorot</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Masukkan nilai yang valid. Bidang tersebut tidak lengkap atau memiliki tanggal yang tidak valid.</translation>
-<translation id="3078740164268491126">tabel</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Masukkan URL.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">kotak kombo</translation>
-<translation id="3450233048674729344">Nilai harus lebih kecil atau sama dengan <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definisi</translation>
-<translation id="3557673793733683882">judul <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">pemilih minggu</translation>
-<translation id="3685101356851116974">Gambar tidak berlabel</translation>
-<translation id="3706100364254443312">saklar</translation>
-<translation id="3732799496749320381">bb</translation>
-<translation id="3754210790023674521">Keluar dari mode picture-in-picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">istilah</translation>
-<translation id="3822383571486410024">Perpanjang teks ini hingga <ph name="MIN_CHARACTERS" /> karakter atau lebih (saat ini Anda menggunakan <ph name="CURRENT_LENGTH" /> karakter).</translation>
-<translation id="383465348367842624">Bagian sebelum '<ph name="ATSIGN" />' tidak boleh berisi simbol '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="3846214748874656680">Keluar dari layar penuh</translation>
-<translation id="3920932319529768807">kesimpulan</translation>
-<translation id="3924558731517983934">aplikasi</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">bilah gulir</translation>
-<translation id="4103419683916926126">Milidetik</translation>
-<translation id="4151657705144244502">grafis</translation>
-<translation id="4160057747563657758">telepon</translation>
-<translation id="4193965531860883258">kata pengantar</translation>
-<translation id="4201051445878709314">Tampilkan bulan sebelumnya</translation>
-<translation id="421884353938374759">pemilih warna</translation>
-<translation id="4248100235867064564">bilah menu</translation>
-<translation id="4360991593054037559">Masukkan nilai yang valid. Dua nilai valid terdekat adalah <ph name="VALID_VALUE_LOW" /> dan <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Tanya Jawab</translation>
-<translation id="4413860115965805769">tombol menu</translation>
-<translation id="4444765639179266822">Muncul dengan menyatakan: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">referensi glosarium</translation>
-<translation id="4522570452068850558">Detail</translation>
-<translation id="4542388879936266156">sisa waktu: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulir</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Bagian setelah '<ph name="ATSIGN" />' tidak boleh berisi simbol '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="4668956016107839909">lampiran</translation>
-<translation id="4718048029184481307">Diputar dalam mode picture-in-picture</translation>
-<translation id="4742539557769756338">sampul</translation>
-<translation id="4748357248530471599">mengalihkan ke layar penuh potongan layar</translation>
-<translation id="4757246831282535685">panel tab</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Masukkan nomor.</translation>
-<translation id="4912536737030637138">entri bibliografi</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> dipilih</translation>
-<translation id="4992066212339426712">Bunyikan</translation>
-<translation id="49969490063480558">Masukkan bagian setelah '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' tidak lengkap.</translation>
-<translation id="5034860022980953847">indikator kemajuan</translation>
-<translation id="5090250355906949916">pengatur waktu video</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Tampilkan bulan berikutnya</translation>
-<translation id="512758898067543763">judul baris</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Nilai harus lebih besar daripada atau sama dengan <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Masukkan bagian yang diikuti dengan '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' tidak lengkap.</translation>
-<translation id="5334352251556557839">Tidak dapat memutar media.</translation>
-<translation id="5406322316791861025">sosok</translation>
-<translation id="5453733299334684579">item pohon</translation>
-<translation id="5466621249238537318">Pilih salah satu atau beberapa file.</translation>
-<translation id="5468998798572797635">keluar dari tampilan layar penuh</translation>
-<translation id="5516424706154626233">pemilih tanggal</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">suarakan</translation>
-<translation id="561939826962581046">waktu</translation>
-<translation id="5630795885300617244">Ketuk dua kali ke kiri atau kanan untuk melewati 10 detik</translation>
-<translation id="5631759159893697722">abstrak</translation>
-<translation id="5643186887447432888">tombol</translation>
-<translation id="5677946354068040947">opsi lainnya</translation>
-<translation id="576709008726043716">pendahuluan</translation>
-<translation id="57838592816432529">Bisukan</translation>
-<translation id="5860033963881614850">Nonaktif</translation>
-<translation id="588258955323874662">Layar Penuh</translation>
-<translation id="5888666972993069672">Sedang melakukan cast ke <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">kotak penelusuran</translation>
-<translation id="5939518447894949180">Setel ulang</translation>
-<translation id="5966707198760109579">Minggu</translation>
-<translation id="5987525920412732405">tombol putar</translation>
-<translation id="6011459053400940133">Pengatur volume</translation>
-<translation id="6015796118275082299">Tahun</translation>
-<translation id="6023896073578205740">kotak daftar</translation>
-<translation id="6150588977291308318">bibliografi</translation>
-<translation id="6164829606128959761">pengukur</translation>
-<translation id="6166809985690652833">penutup</translation>
-<translation id="6209276755895393898">Muncul sebagai: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosarium</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Keluar dari Mode Picture-in-Picture</translation>
-<translation id="6398862346408813489">Tampilkan panel pilihan bulan</translation>
-<translation id="6404546809543547843">scrubber waktu audio</translation>
-<translation id="6443871981718447451">tampilkan menu subtitel</translation>
-<translation id="6453774872122745852">ucapan terima kasih</translation>
-<translation id="648732519525291180">pemilih waktu</translation>
-<translation id="6550675742724504774">Opsi</translation>
-<translation id="6572309429103589720">Tata bahasa tidak valid</translation>
-<translation id="658823671542763450">masuk layar penuh</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Hapus</translation>
-<translation id="668171684555832681">Lainnya...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Kualitas pemutaran buruk</translation>
-<translation id="6755330956360078551">keterangan alat</translation>
-<translation id="6790428901817661496">Putar</translation>
-<translation id="6820355525329141109">Tidak dapat memuat plugin.</translation>
-<translation id="6820615603175220800">referensi bibliografi</translation>
-<translation id="6843725295806269523">bisukan</translation>
-<translation id="6885760532393684712">direktori</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">download media</translation>
-<translation id="6981594929165378967">penyisipan</translation>
-<translation id="6989848892321993519">Perpanjang teks ini menjadi <ph name="MIN_CHARACTERS" /> karakter atau lebih (saat ini Anda menggunakan 1 karakter).</translation>
-<translation id="7033340931668032222">ke atas dan ke bawah untuk mengubah volume</translation>
-<translation id="709897737746224366">Sesuaikan dengan format yang diminta.</translation>
-<translation id="7118469954320184356">Deskripsi tidak tersedia.</translation>
-<translation id="7139483182332611405">kata pengantar</translation>
-<translation id="7214187073215825913">informasi konten</translation>
-<translation id="7263440858009898357">Pilih item pada daftar.</translation>
-<translation id="727747134524199931">judul kolom</translation>
-<translation id="7320576522385648310">buffering</translation>
-<translation id="7353453495576941748">daftar penghargaan</translation>
-<translation id="7364796246159120393">Pilih File</translation>
-<translation id="739024184232394898">Lainnya...</translation>
-<translation id="7405738980073107433">catatan akhir</translation>
-<translation id="7410239719251593705">Tampaknya berisi konten khusus dewasa. Deskripsi tidak tersedia.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Download</translation>
-<translation id="7529102961911894712">back link</translation>
-<translation id="7533959249147584474">Grafik tidak berlabel</translation>
-<translation id="7647456547678091388">tips</translation>
-<translation id="7661956066982048809">dokumen grafis</translation>
-<translation id="7673697353781729403">Jam</translation>
-<translation id="7681220483256441252">indeks</translation>
-<translation id="7740050170769002709">Konten HTML</translation>
-<translation id="7745230546936012372">Untuk mendapatkan deskripsi gambar yang tidak ada, buka menu konteks.</translation>
-<translation id="7750228210027921155">Picture-in-picture</translation>
-<translation id="775297008183122718">Entri tidak valid</translation>
-<translation id="7789962463072032349">jeda</translation>
-<translation id="7802800022689234070">segitiga pengungkapan</translation>
-<translation id="7888071071722539607">Sertakan '<ph name="ATSIGN" />' pada alamat email. '<ph name="INVALIDADDRESS" />' tidak memiliki '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">pemisah</translation>
-<translation id="795667975304826397">Tidak ada file yang dipilih</translation>
-<translation id="8053789581856978548">bidang teks penelusuran</translation>
-<translation id="8057695513531652401">pemberitahuan</translation>
-<translation id="8105797009065549151">referensi catatan</translation>
-<translation id="811583516810654505">Mendapatkan deskripsi...</translation>
-<translation id="8117451130807776954">Minggu ini</translation>
-<translation id="8199524924445686405">tttt</translation>
-<translation id="8208673686607688524">pemilih tanggal dan waktu lokal</translation>
-<translation id="8261464734335370856">Ejaan tidak valid</translation>
-<translation id="8284326494547611709">Teks</translation>
-<translation id="835897206747267392">Nilai tidak valid.</translation>
-<translation id="8403857369060869934">waktu berlalu: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">bagian</translation>
-<translation id="8433900881053900389">bilah alat</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> file</translation>
-<translation id="8451268428117625855">Pilih file.</translation>
-<translation id="8461852803063341183">tombol radio</translation>
-<translation id="8474886197722836894">persembahan</translation>
-<translation id="8531739829932800271">erratum</translation>
-<translation id="8534579021159131403">Menit</translation>
-<translation id="8541249477527128034">kontrol media</translation>
-<translation id="8550857728288566671">simbol grafis</translation>
-<translation id="8583702881314752957">daftar definisi</translation>
-<translation id="8597182159515967513">kepala</translation>
-<translation id="8603553056539299761">ke kiri dan ke kanan untuk mencari</translation>
-<translation id="860475260694818407">daftar isi</translation>
-<translation id="8613126697340063924">kontrol pemutaran jarak jauh</translation>
-<translation id="862370744433916922">subjudul</translation>
-<translation id="8711688047404765493">keluaran</translation>
-<translation id="8750798805984357768">Pilih salah satu opsi berikut.</translation>
-<translation id="8808573423886751634">bab</translation>
-<translation id="8845239796550121995">Sekarang sedang mentransmisi ke TV Anda</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Error pemutaran video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Bulan</translation>
-<translation id="901493112792887934">waktu saat ini dalam detik</translation>
-<translation id="901834265349196618">email</translation>
-<translation id="9048119486235211610">navigasi</translation>
-<translation id="9062295712474918030">dokumen</translation>
-<translation id="9062307380734144336">pilih untuk mengalihkan putar jeda</translation>
-<translation id="9093215626363556771">keluar dari mode picture-in-picture</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Lainnya...</translation>
-<translation id="9138385573473225930">notifikasi</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, dimulai pada <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picture-in-Picture</translation>
-<translation id="9168329111483466115">catatan kaki</translation>
-<translation id="954003015749068518">masuk mode picture-in-picture</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_it.xtb b/chromium/content/app/strings/translations/content_strings_it.xtb
deleted file mode 100644
index c75d6e47e00..00000000000
--- a/chromium/content/app/strings/translations/content_strings_it.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="it">
-<translation id="1018939186200882850">voce di menu</translation>
-<translation id="10623998915015855">pulsante di attivazione/disattivazione</translation>
-<translation id="1088086359088493902">Secondi</translation>
-<translation id="1171774979989969504">Inserisci un indirizzo email.</translation>
-<translation id="1178581264944972037">Pausa</translation>
-<translation id="1188858454923323853">elementi complementari</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">dispositivo di scorrimento</translation>
-<translation id="1211441953136645838">nota finale</translation>
-<translation id="1281252709823657822">finestra di dialogo</translation>
-<translation id="1335095011850992622">ringraziamenti</translation>
-<translation id="1342835525016946179">articolo</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">regione</translation>
-<translation id="1591562245178063882">Questo mese</translation>
-<translation id="1637811476055996098">Scegli file</translation>
-<translation id="1650423536718072820">citazione</translation>
-<translation id="1727886345390570319">nascondi menu sottotitoli</translation>
-<translation id="1729654308190250600">Inserisci un indirizzo email valido.</translation>
-<translation id="1758486001363313524">Altro...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">griglia ad albero</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">riproduci su dispositivo remoto</translation>
-<translation id="190587075670221089">eliminazione</translation>
-<translation id="1907737156431278478">esempio</translation>
-<translation id="1921819250265091946">gg</translation>
-<translation id="1930711995431081526">stato</translation>
-<translation id="1938124657309484470">Il valore deve essere <ph name="MAXIMUM_DATE_OR_TIME" /> o precedente.</translation>
-<translation id="1946271899482435442">Mostra selettore date</translation>
-<translation id="1993104285338243655">Sei passato a mirroring</translation>
-<translation id="2060505056492490888">Il segno "<ph name="DOT" />" è utilizzato in una posizione errata in "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Oggi</translation>
-<translation id="2158401438286456825">elenco pagine</translation>
-<translation id="2226276347425096477">Riduci questo testo a <ph name="MAX_CHARACTERS" /> caratteri o meno (attualmente stai utilizzando <ph name="CURRENT_LENGTH" /> caratteri).</translation>
-<translation id="2246498165605549352">File locale</translation>
-<translation id="2247351761944213033">Settimana <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Traccia <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">casella di controllo</translation>
-<translation id="2311842470354187719">interruzione di pagina</translation>
-<translation id="2335594187091864976">selettore di data e ora</translation>
-<translation id="245932805758469625">numero di secondi di video rimanenti</translation>
-<translation id="248395913932153421">Giorno</translation>
-<translation id="2507943997699731163">Compila questo campo.</translation>
-<translation id="2508569020611168319">elenco schede</translation>
-<translation id="2561842179657104141">mostra altri controlli multimediali</translation>
-<translation id="2572483411312390101">riproduci</translation>
-<translation id="2613802280814924224">Inserisci un valore valido. Il valore valido più vicino è <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Invia</translation>
-<translation id="2657045182931379222">oggetto grafico</translation>
-<translation id="2674318244760992338">piè di pagina</translation>
-<translation id="2709516037105925701">Compilazione automatica</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Il valore deve essere <ph name="MINIMUM_DATE_OR_TIME" /> o successivo.</translation>
-<translation id="2759744352195237655">pulsante popup</translation>
-<translation id="2761667185364618470">Seleziona questa casella se intendi procedere.</translation>
-<translation id="2844350028562914727">dettagli</translation>
-<translation id="2896972712917208084">gruppo pulsanti di opzione</translation>
-<translation id="2908441821576996758">Inserisci un elenco di indirizzi email separati da virgola.</translation>
-<translation id="2940813599313844715">oggetto</translation>
-<translation id="2942448076852699108">contenuti evidenziati</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Inserisci un valore valido. Il campo è incompleto o presenta una data non valida.</translation>
-<translation id="3078740164268491126">tabella</translation>
-<translation id="3086746722712840547">nota</translation>
-<translation id="310520048233152454">Inserisci un URL.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">casella combinata</translation>
-<translation id="3450233048674729344">Il valore deve essere inferiore o uguale a <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definizione</translation>
-<translation id="3557673793733683882">intestazione <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selettore della settimana</translation>
-<translation id="3685101356851116974">immagine senza etichetta</translation>
-<translation id="3706100364254443312">strumento per il passaggio ad altri elementi</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Esci da Picture in picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">termine</translation>
-<translation id="3822383571486410024">Prolunga questo testo a <ph name="MIN_CHARACTERS" /> o più caratteri (al momento stai utilizzando <ph name="CURRENT_LENGTH" /> caratteri).</translation>
-<translation id="383465348367842624">Una parte seguita da "<ph name="ATSIGN" />" non deve contenere il simbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Esci da schermo intero</translation>
-<translation id="3920932319529768807">conclusioni</translation>
-<translation id="3924558731517983934">applicazione</translation>
-<translation id="3944740393230681990">prologo</translation>
-<translation id="3960700977367013758">barra di scorrimento</translation>
-<translation id="4103419683916926126">Millisecondi</translation>
-<translation id="4151657705144244502">immagine</translation>
-<translation id="4160057747563657758">telefono</translation>
-<translation id="4193965531860883258">premessa</translation>
-<translation id="4201051445878709314">Mostra mese precedente</translation>
-<translation id="421884353938374759">selettore colori</translation>
-<translation id="4248100235867064564">barra dei menu</translation>
-<translation id="4360991593054037559">Inserisci un valore valido. I due valori validi più vicini sono <ph name="VALID_VALUE_LOW" /> e <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Domande e risposte</translation>
-<translation id="4413860115965805769">pulsante di menu</translation>
-<translation id="4444765639179266822">Sembra che dica: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">riferimento glossario</translation>
-<translation id="4522570452068850558">Dettagli</translation>
-<translation id="4542388879936266156">Tempo rimanente: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">modulo</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Una parte che segue "<ph name="ATSIGN" />" non deve contenere il simbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">appendice</translation>
-<translation id="4718048029184481307">Riproduzione in modalità Picture in picture</translation>
-<translation id="4742539557769756338">copertina</translation>
-<translation id="4748357248530471599">attiva/disattiva lo schermo intero tagliato dalla visualizzazione</translation>
-<translation id="4757246831282535685">riquadro a schede</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">ricerca</translation>
-<translation id="4812940957355064477">Inserisci un numero.</translation>
-<translation id="4912536737030637138">voce bibliografica</translation>
-<translation id="4975562563186953947">Elementi selezionati: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Riattiva audio</translation>
-<translation id="49969490063480558">Inserisci una parte dopo "<ph name="ATSIGN" />". Il valore "<ph name="INVALIDADDRESS" />" è incompleto.</translation>
-<translation id="5034860022980953847">indicatore di avanzamento</translation>
-<translation id="5090250355906949916">dispositivo di scorrimento durata video</translation>
-<translation id="5093189678851173835">epigrafe</translation>
-<translation id="5117590920725113268">Mostra mese successivo</translation>
-<translation id="512758898067543763">intestazione di riga</translation>
-<translation id="5143125788380636750">epilogo</translation>
-<translation id="5164977714490026579">Il valore deve essere superiore o uguale a <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Inserisci una parte seguita da "<ph name="ATSIGN" />". Il valore "<ph name="INVALIDADDRESS" />" è incompleto.</translation>
-<translation id="5334352251556557839">Impossibile riprodurre i contenuti multimediali.</translation>
-<translation id="5406322316791861025">figura</translation>
-<translation id="5453733299334684579">elemento albero</translation>
-<translation id="5466621249238537318">Seleziona uno o più file.</translation>
-<translation id="5468998798572797635">esci da schermo intero</translation>
-<translation id="5516424706154626233">selettore di data</translation>
-<translation id="5537725057119320332">Trasmetti</translation>
-<translation id="5546461542133609677">riattiva audio</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Tocca due volte a sinistra o destra per saltare di 10 secondi</translation>
-<translation id="5631759159893697722">abstract</translation>
-<translation id="5643186887447432888">pulsante</translation>
-<translation id="5677946354068040947">altre opzioni</translation>
-<translation id="576709008726043716">introduzione</translation>
-<translation id="57838592816432529">Disattiva audio</translation>
-<translation id="5860033963881614850">Off</translation>
-<translation id="588258955323874662">Schermo intero</translation>
-<translation id="5888666972993069672">Trasmissione in corso a <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">casella di ricerca</translation>
-<translation id="5939518447894949180">Reimposta</translation>
-<translation id="5966707198760109579">Settimana</translation>
-<translation id="5987525920412732405">pulsante di selezione</translation>
-<translation id="6011459053400940133">dispositivo di scorrimento del volume</translation>
-<translation id="6015796118275082299">Anno</translation>
-<translation id="6023896073578205740">casella di riepilogo</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">indicatore</translation>
-<translation id="6166809985690652833">postfazione</translation>
-<translation id="6209276755895393898">Sembra che sia: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glossario</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Esci da Picture in picture</translation>
-<translation id="6398862346408813489">Mostra il riquadro di selezione del mese</translation>
-<translation id="6404546809543547843">dispositivo di scorrimento durata audio</translation>
-<translation id="6443871981718447451">mostra menu sottotitoli</translation>
-<translation id="6453774872122745852">riconoscimenti</translation>
-<translation id="648732519525291180">selettore di ora</translation>
-<translation id="6550675742724504774">Opzioni</translation>
-<translation id="6572309429103589720">Grammatica non valida</translation>
-<translation id="658823671542763450">passa a schermo intero</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Cancella</translation>
-<translation id="668171684555832681">Altro...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Scarsa qualità di riproduzione</translation>
-<translation id="6755330956360078551">descrizione comando</translation>
-<translation id="6790428901817661496">Play</translation>
-<translation id="6820355525329141109">Impossibile caricare il plug-in</translation>
-<translation id="6820615603175220800">riferimento bibliografico</translation>
-<translation id="6843725295806269523">disattiva audio</translation>
-<translation id="6885760532393684712">directory</translation>
-<translation id="689129560213475294">colophon</translation>
-<translation id="6934078000481955284">citazione lunga</translation>
-<translation id="6941933287844615239">scarica contenuti multimediali</translation>
-<translation id="6981594929165378967">inserimento</translation>
-<translation id="6989848892321993519">Prolunga questo testo a <ph name="MIN_CHARACTERS" /> o più caratteri (al momento stai utilizzando 1 carattere).</translation>
-<translation id="7033340931668032222">verso l'alto e verso il basso per regolare il volume</translation>
-<translation id="709897737746224366">Rispetta il formato richiesto.</translation>
-<translation id="7118469954320184356">Descrizione non disponibile.</translation>
-<translation id="7139483182332611405">prefazione</translation>
-<translation id="7214187073215825913">informazioni sui contenuti</translation>
-<translation id="7263440858009898357">Seleziona un elemento nell'elenco.</translation>
-<translation id="727747134524199931">intestazione di colonna</translation>
-<translation id="7320576522385648310">Buffering</translation>
-<translation id="7353453495576941748">ringraziamento</translation>
-<translation id="7364796246159120393">Scegli file</translation>
-<translation id="739024184232394898">Altro...</translation>
-<translation id="7405738980073107433">note finali</translation>
-<translation id="7410239719251593705">Sembra essere contenuto per adulti. Descrizione non disponibile.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">Tab</translation>
-<translation id="7514365320538308">Scarica</translation>
-<translation id="7529102961911894712">backlink</translation>
-<translation id="7533959249147584474">Immagine senza etichetta</translation>
-<translation id="7647456547678091388">suggerimento</translation>
-<translation id="7661956066982048809">documento grafico</translation>
-<translation id="7673697353781729403">Orario</translation>
-<translation id="7681220483256441252">indice</translation>
-<translation id="7740050170769002709">Contenuti HTML</translation>
-<translation id="7745230546936012372">Per accedere alle descrizioni mancanti delle immagini, apri il menu contestuale.</translation>
-<translation id="7750228210027921155">Picture in picture</translation>
-<translation id="775297008183122718">Valore non valido</translation>
-<translation id="7789962463072032349">pausa</translation>
-<translation id="7802800022689234070">triangolo descrittivo</translation>
-<translation id="7888071071722539607">Aggiungi un simbolo "<ph name="ATSIGN" />" nell'indirizzo email. In "<ph name="INVALIDADDRESS" />" manca un simbolo "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">barra di divisione</translation>
-<translation id="795667975304826397">Nessun file selezionato</translation>
-<translation id="8053789581856978548">campo di testo della ricerca</translation>
-<translation id="8057695513531652401">informativa</translation>
-<translation id="8105797009065549151">riferimento note</translation>
-<translation id="811583516810654505">Recupero descrizione…</translation>
-<translation id="8117451130807776954">Questa settimana</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">selettore di data e ora locali</translation>
-<translation id="8261464734335370856">Ortografia non valida</translation>
-<translation id="8284326494547611709">Sottotitoli</translation>
-<translation id="835897206747267392">Valore non valido.</translation>
-<translation id="8403857369060869934">Tempo trascorso: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">parte</translation>
-<translation id="8433900881053900389">barra degli strumenti</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> file</translation>
-<translation id="8451268428117625855">Seleziona un file.</translation>
-<translation id="8461852803063341183">pulsante di opzione</translation>
-<translation id="8474886197722836894">dedica</translation>
-<translation id="8531739829932800271">errata corrige</translation>
-<translation id="8534579021159131403">Minuti</translation>
-<translation id="8541249477527128034">controllo contenuti multimediali</translation>
-<translation id="8550857728288566671">simbolo grafico</translation>
-<translation id="8583702881314752957">elenco di definizioni</translation>
-<translation id="8597182159515967513">intestazione</translation>
-<translation id="8603553056539299761">sinistra e destra per cercare</translation>
-<translation id="860475260694818407">sommario</translation>
-<translation id="8613126697340063924">gestisci riproduzione remota</translation>
-<translation id="862370744433916922">sottotitolo</translation>
-<translation id="8711688047404765493">uscita</translation>
-<translation id="8750798805984357768">Seleziona una di queste opzioni.</translation>
-<translation id="8808573423886751634">capitolo</translation>
-<translation id="8845239796550121995">Ora in fase di trasmissione alla TV</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Errore di riproduzione video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Mese</translation>
-<translation id="901493112792887934">tempo attuale in secondi</translation>
-<translation id="901834265349196618">email</translation>
-<translation id="9048119486235211610">navigazione</translation>
-<translation id="9062295712474918030">documento</translation>
-<translation id="9062307380734144336">seleziona per attivare/disattivare la riproduzione/pausa</translation>
-<translation id="9093215626363556771">esci da picture in picture</translation>
-<translation id="9108370397979208512">elemento matematico</translation>
-<translation id="9132465097189459683">Altro...</translation>
-<translation id="9138385573473225930">avviso</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, a partire dal giorno <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picture in picture</translation>
-<translation id="9168329111483466115">piè di pagina</translation>
-<translation id="954003015749068518">attiva picture in picture</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_iw.xtb b/chromium/content/app/strings/translations/content_strings_iw.xtb
deleted file mode 100644
index 69d4b30bd80..00000000000
--- a/chromium/content/app/strings/translations/content_strings_iw.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="iw">
-<translation id="1018939186200882850">פריט בתפריט</translation>
-<translation id="10623998915015855">לחצן החלפה</translation>
-<translation id="1088086359088493902">שניות</translation>
-<translation id="1171774979989969504">הזן כתובת אימייל.</translation>
-<translation id="1178581264944972037">השהה</translation>
-<translation id="1188858454923323853">משלים</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">מחוון</translation>
-<translation id="1211441953136645838">הערת סיום</translation>
-<translation id="1281252709823657822">דו-שיח</translation>
-<translation id="1335095011850992622">קרדיטים</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">מודעת באנר</translation>
-<translation id="1589122976691792535">אזור</translation>
-<translation id="1591562245178063882">החודש</translation>
-<translation id="1637811476055996098">בחר קבצים</translation>
-<translation id="1650423536718072820">ציטוט</translation>
-<translation id="1727886345390570319">הסתרה של תפריט הכתוביות</translation>
-<translation id="1729654308190250600">הזן ערך נדרש בשדה של כתובת האימייל.</translation>
-<translation id="1758486001363313524">אחר...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">רשת של עץ</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">הפעלה במכשיר מרוחק</translation>
-<translation id="190587075670221089">מחיקה</translation>
-<translation id="1907737156431278478">דוגמה</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">מצב</translation>
-<translation id="1938124657309484470">על הערך להיות <ph name="MAXIMUM_DATE_OR_TIME" /> או מוקדם יותר.</translation>
-<translation id="1946271899482435442">הצגת בוחר התאריכים</translation>
-<translation id="1993104285338243655">הועבר לשיקוף מסך</translation>
-<translation id="2060505056492490888">נעשה שימוש ב-'<ph name="DOT" />' במיקום שגוי ב-'<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">היום</translation>
-<translation id="2158401438286456825">רשימת דפים</translation>
-<translation id="2226276347425096477">קצר טקסט זה ל-<ph name="MAX_CHARACTERS" /> תווים או פחות (אתה משתמש כעת ב-<ph name="CURRENT_LENGTH" /> תווים).</translation>
-<translation id="2246498165605549352">קובץ מקומי</translation>
-<translation id="2247351761944213033">שבוע <ph name="WEEKNUMBER" />‏, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">רצועה <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">תיבת סימון</translation>
-<translation id="2311842470354187719">מעבר דף</translation>
-<translation id="2335594187091864976">בוחר תאריך ושעה</translation>
-<translation id="245932805758469625">מספר השניות שנותרו עד לסיום הסרטון</translation>
-<translation id="248395913932153421">יום</translation>
-<translation id="2507943997699731163">זהו שדה חובה.</translation>
-<translation id="2508569020611168319">רשימת כרטיסיות</translation>
-<translation id="2561842179657104141">הצג עוד פקדי מדיה</translation>
-<translation id="2572483411312390101">הפעל</translation>
-<translation id="2613802280814924224">הזן ערך חוקי. הערך החוקי הקרוב ביותר הוא <ph name="VALID_VALUE" /></translation>
-<translation id="2653659639078652383">שלח</translation>
-<translation id="2657045182931379222">אובייקט גרפי</translation>
-<translation id="2674318244760992338">כותרת תחתונה</translation>
-<translation id="2709516037105925701">מילוי אוטומטי</translation>
-<translation id="2723001399770238859">אודיו</translation>
-<translation id="2746543609216772311">על הערך להיות <ph name="MINIMUM_DATE_OR_TIME" /> ומעלה.</translation>
-<translation id="2759744352195237655">לחצן קופץ</translation>
-<translation id="2761667185364618470">סמן תיבה זו אם אתה רוצה להמשיך.</translation>
-<translation id="2844350028562914727">פרטים</translation>
-<translation id="2896972712917208084">קבוצת לחצני בחירה</translation>
-<translation id="2908441821576996758">הזן רשימה של כתובות אימייל המופרדות באמצעות פסיקים.</translation>
-<translation id="2940813599313844715">אובייקט</translation>
-<translation id="2942448076852699108">תוכן מודגש</translation>
-<translation id="3040011195152428237">קישור</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">הזן ערך חוקי. השדה ריק או שהוא מכיל תאריך לא חוקי.</translation>
-<translation id="3078740164268491126">טבלה</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">הזן כתובת אתר.</translation>
-<translation id="3175736971608411871">טיימר</translation>
-<translation id="3199563858620722075">תיבה משולבת</translation>
-<translation id="3450233048674729344">הערך חייב להיות קטן מ-<ph name="MAXIMUM" /> או שווה לו.</translation>
-<translation id="3486220673238053218">הגדרה</translation>
-<translation id="3557673793733683882">כותרת <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">בורר השבועות</translation>
-<translation id="3685101356851116974">תמונה ללא תיאור</translation>
-<translation id="3706100364254443312">מעבר</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">יציאה ממצב תמונה בתוך תמונה</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">מונח</translation>
-<translation id="3822383571486410024">הארך טקסט זה ל-<ph name="MIN_CHARACTERS" /> תווים או יותר (אתה משתמש כרגע ב-<ph name="CURRENT_LENGTH" /> תווים).</translation>
-<translation id="383465348367842624">חלק ולאחריו '<ph name="ATSIGN" />' לא אמור לכלול את הסמל '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="3846214748874656680">צא ממסך מלא</translation>
-<translation id="3920932319529768807">סיכום</translation>
-<translation id="3924558731517983934">יישום</translation>
-<translation id="3944740393230681990">פרולוג</translation>
-<translation id="3960700977367013758">סרגל גלילה</translation>
-<translation id="4103419683916926126">אלפיות שנייה</translation>
-<translation id="4151657705144244502">פריט גרפי</translation>
-<translation id="4160057747563657758">טלפון</translation>
-<translation id="4193965531860883258">פתח דבר</translation>
-<translation id="4201051445878709314">הצג חודש קודם</translation>
-<translation id="421884353938374759">color picker</translation>
-<translation id="4248100235867064564">שורת תפריטים</translation>
-<translation id="4360991593054037559">הזן ערך חוקי. שני הערכים החוקיים הקרובים ביותר הם <ph name="VALID_VALUE_LOW" /> ו-<ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">שאלות ותשובות</translation>
-<translation id="4413860115965805769">לחצן תפריט</translation>
-<translation id="4444765639179266822">נראה שכתובים כאן הדברים הבאים: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">הפניה למילון מונחים</translation>
-<translation id="4522570452068850558">פרטים</translation>
-<translation id="4542388879936266156">הזמן שנותר: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">טופס</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">חלק ולאחריו '<ph name="ATSIGN" />' לא אמור לכלול את הסמל '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="4668956016107839909">נספח</translation>
-<translation id="4718048029184481307">הפעלה במצב תמונה בתוך תמונה</translation>
-<translation id="4742539557769756338">שער</translation>
-<translation id="4748357248530471599">מעבר מתצוגה באזור המגרעת של המסך למסך מלא</translation>
-<translation id="4757246831282535685">חלונית כרטיסיות</translation>
-<translation id="4763480195061959176">סרטוני וידאו</translation>
-<translation id="479989351350248267">Search</translation>
-<translation id="4812940957355064477">יש להזין מספר.</translation>
-<translation id="4912536737030637138">ערך ביבליוגרפי</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> נבחרו</translation>
-<translation id="4992066212339426712">בטל השתקה</translation>
-<translation id="49969490063480558">הזן חלק ולאחריו '<ph name="ATSIGN" />'‏. השדה '<ph name="INVALIDADDRESS" />' אינו מלא.</translation>
-<translation id="5034860022980953847">סימן ויזואלי להתקדמות</translation>
-<translation id="5090250355906949916">מחוון זמן הסרטון</translation>
-<translation id="5093189678851173835">ציטוט בראש ספר</translation>
-<translation id="5117590920725113268">הצג את החודש הבא</translation>
-<translation id="512758898067543763">כותרת שורה</translation>
-<translation id="5143125788380636750">אפילוג</translation>
-<translation id="5164977714490026579">הערך חייב להיות גדול מ-<ph name="MINIMUM" /> או שווה לו.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">הזן חלק ולאחריו '<ph name="ATSIGN" />'‏. השדה '<ph name="INVALIDADDRESS" />' אינו מלא.</translation>
-<translation id="5334352251556557839">לא ניתן להפעיל את המדיה.</translation>
-<translation id="5406322316791861025">ספרה</translation>
-<translation id="5453733299334684579">פריט בעץ</translation>
-<translation id="5466621249238537318">בחר קובץ אחד או יותר.</translation>
-<translation id="5468998798572797635">צא ממסך מלא</translation>
-<translation id="5516424706154626233">בוחר תאריכים</translation>
-<translation id="5537725057119320332">העברה</translation>
-<translation id="5546461542133609677">בטל השתקה</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">הקשה כפולה בצד ימין או שמאל מדלגת על 10 שניות</translation>
-<translation id="5631759159893697722">תקציר</translation>
-<translation id="5643186887447432888">לחצן</translation>
-<translation id="5677946354068040947">אפשרויות נוספות</translation>
-<translation id="576709008726043716">מבוא</translation>
-<translation id="57838592816432529">השתקה</translation>
-<translation id="5860033963881614850">כבוי</translation>
-<translation id="588258955323874662">מסך מלא</translation>
-<translation id="5888666972993069672">מתבצעת העברה אל <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">תיבת חיפוש</translation>
-<translation id="5939518447894949180">אפס</translation>
-<translation id="5966707198760109579">שבוע</translation>
-<translation id="5987525920412732405">לחצן קביעת ערך</translation>
-<translation id="6011459053400940133">מחוון עוצמת קול</translation>
-<translation id="6015796118275082299">שנה</translation>
-<translation id="6023896073578205740">תיבת רשימה</translation>
-<translation id="6150588977291308318">ביבליוגרפיה</translation>
-<translation id="6164829606128959761">מד</translation>
-<translation id="6166809985690652833">אחרית דבר</translation>
-<translation id="6209276755895393898">נראה כמו: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">מילון מונחים</translation>
-<translation id="6281763101136022427">‏כתובת URL</translation>
-<translation id="6310801910862476708">יציאה ממצב 'תמונה בתוך תמונה'</translation>
-<translation id="6398862346408813489">הצג חלונית לבחירת חודש</translation>
-<translation id="6404546809543547843">מסתיר משך אודיו</translation>
-<translation id="6443871981718447451">הצגת תפריט כתוביות</translation>
-<translation id="6453774872122745852">תודות</translation>
-<translation id="648732519525291180">בוחר שעות</translation>
-<translation id="6550675742724504774">אפשרויות</translation>
-<translation id="6572309429103589720">דקדוק שגוי</translation>
-<translation id="658823671542763450">היכנס למסך מלא</translation>
-<translation id="663493177488814956">פיד</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">ניקוי</translation>
-<translation id="668171684555832681">אחר...</translation>
-<translation id="6692633176391053278">פקד חצים</translation>
-<translation id="6709570249143506788">איכות הפעלה נמוכה</translation>
-<translation id="6755330956360078551">הסבר קצר</translation>
-<translation id="6790428901817661496">הפעל</translation>
-<translation id="6820355525329141109">לא ניתן היה לטעון את הפלאגין.</translation>
-<translation id="6820615603175220800">הפניה לביבליוגרפיה</translation>
-<translation id="6843725295806269523">השתקה</translation>
-<translation id="6885760532393684712">ספריה</translation>
-<translation id="689129560213475294">קולופון</translation>
-<translation id="6934078000481955284">‏רכיב blockquote</translation>
-<translation id="6941933287844615239">הורד מדיה</translation>
-<translation id="6981594929165378967">הוספה</translation>
-<translation id="6989848892321993519">עליך להאריך את הטקסט ל-<ph name="MIN_CHARACTERS" /> תווים או יותר (אתה משתמש כרגע בתו אחד).</translation>
-<translation id="7033340931668032222">מעלה ומטה כדי לשנות את עוצמת הקול</translation>
-<translation id="709897737746224366">התאם את הפורמט המבוקש.</translation>
-<translation id="7118469954320184356">אין תיאור זמין.</translation>
-<translation id="7139483182332611405">הקדמה</translation>
-<translation id="7214187073215825913">פרטי תוכן</translation>
-<translation id="7263440858009898357">בחר פריט מהרשימה.</translation>
-<translation id="727747134524199931">כותרת עמודה</translation>
-<translation id="7320576522385648310">אגירה</translation>
-<translation id="7353453495576941748">קרדיט</translation>
-<translation id="7364796246159120393">בחירת קובץ</translation>
-<translation id="739024184232394898">אחר...</translation>
-<translation id="7405738980073107433">הערות סיום</translation>
-<translation id="7410239719251593705">נראה שהתמונה כוללת תוכן למבוגרים בלבד. אין תיאור זמין.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">הורדה</translation>
-<translation id="7529102961911894712">קישור לאחור</translation>
-<translation id="7533959249147584474">גרפיקה ללא תיאור</translation>
-<translation id="7647456547678091388">טיפ</translation>
-<translation id="7661956066982048809">מסמך גרפי</translation>
-<translation id="7673697353781729403">שעות</translation>
-<translation id="7681220483256441252">אינדקס</translation>
-<translation id="7740050170769002709">‏תוכן HTML</translation>
-<translation id="7745230546936012372">כדי לקבל תיאורים חסרים של תמונות, יש לפתוח את תפריט ההקשר.</translation>
-<translation id="7750228210027921155">תמונה בתוך תמונה</translation>
-<translation id="775297008183122718">ערך לא חוקי</translation>
-<translation id="7789962463072032349">השהה</translation>
-<translation id="7802800022689234070">משולש הצגה/הסתרה</translation>
-<translation id="7888071071722539607">כלול '<ph name="ATSIGN" />' בכתובת האימייל. ב-'<ph name="INVALIDADDRESS" />' חסר '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">מפצל</translation>
-<translation id="795667975304826397">לא נבחר קובץ</translation>
-<translation id="8053789581856978548">שדה טקסט לחיפוש</translation>
-<translation id="8057695513531652401">הודעה</translation>
-<translation id="8105797009065549151">הפניה להערה</translation>
-<translation id="811583516810654505">התיאור עוד מעט מוכן…</translation>
-<translation id="8117451130807776954">השבוע</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">בורר תאריך ושעה מקומיים</translation>
-<translation id="8261464734335370856">איות שגוי</translation>
-<translation id="8284326494547611709">כתוביות</translation>
-<translation id="835897206747267392">ערך לא חוקי.</translation>
-<translation id="8403857369060869934">הזמן שחלף: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">חלק</translation>
-<translation id="8433900881053900389">סרגל כלים</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> קבצים</translation>
-<translation id="8451268428117625855">בחר קובץ.</translation>
-<translation id="8461852803063341183">לחצן בחירה</translation>
-<translation id="8474886197722836894">הקדשה</translation>
-<translation id="8531739829932800271">שגיאת דפוס</translation>
-<translation id="8534579021159131403">דקות</translation>
-<translation id="8541249477527128034">שליטה במדיה</translation>
-<translation id="8550857728288566671">סמל גרפי</translation>
-<translation id="8583702881314752957">רשימת הגדרות</translation>
-<translation id="8597182159515967513">כותרת</translation>
-<translation id="8603553056539299761">שמאלה וימינה כדי להריץ</translation>
-<translation id="860475260694818407">תוכן העניינים</translation>
-<translation id="8613126697340063924">שליטה בהפעלה מרחוק</translation>
-<translation id="862370744433916922">כותרת משנה</translation>
-<translation id="8711688047404765493">פלט</translation>
-<translation id="8750798805984357768">בחר אחת מהאפשרויות הבאות.</translation>
-<translation id="8808573423886751634">פרק</translation>
-<translation id="8845239796550121995">מעביר תוכן לטלוויזיה</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">שגיאה בהפעלת הסרטון</translation>
-<translation id="8901569739625249689">‏<ph name="QUANTITY" /> KB‏</translation>
-<translation id="8987927404178983737">חודש</translation>
-<translation id="901493112792887934">זמן נוכחי בשניות</translation>
-<translation id="901834265349196618">אימייל</translation>
-<translation id="9048119486235211610">ניווט</translation>
-<translation id="9062295712474918030">מסמך</translation>
-<translation id="9062307380734144336">יש לבחור באפשרות הזו כדי להפעיל או להשהות</translation>
-<translation id="9093215626363556771">יציאה ממצב 'תמונה בתוך תמונה'</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">אחר...</translation>
-<translation id="9138385573473225930">התראה</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, שמתחיל בתאריך <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">תמונה בתוך תמונה</translation>
-<translation id="9168329111483466115">הערת שוליים</translation>
-<translation id="954003015749068518">מעבר אל מצב 'תמונה בתוך תמונה'</translation>
-<translation id="966787709310836684">תפריט</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ja.xtb b/chromium/content/app/strings/translations/content_strings_ja.xtb
deleted file mode 100644
index 209ade652b2..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ja.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ja">
-<translation id="1018939186200882850">メニュー項目</translation>
-<translation id="10623998915015855">切り替えボタン</translation>
-<translation id="1088086359088493902">秒</translation>
-<translation id="1171774979989969504">メール アドレスを入力してください。</translation>
-<translation id="1178581264944972037">一時停止</translation>
-<translation id="1188858454923323853">捕捉</translation>
-<translation id="1206619573307042055">マーキー</translation>
-<translation id="1206693055195146388">スライダ</translation>
-<translation id="1211441953136645838">巻末注</translation>
-<translation id="1281252709823657822">ダイアログ</translation>
-<translation id="1335095011850992622">クレジット</translation>
-<translation id="1342835525016946179">記事</translation>
-<translation id="1359897965706325498">バナー</translation>
-<translation id="1589122976691792535">地域</translation>
-<translation id="1591562245178063882">今月</translation>
-<translation id="1637811476055996098">ファイル選択</translation>
-<translation id="1650423536718072820">引用</translation>
-<translation id="1727886345390570319">字幕メニューを表示しない</translation>
-<translation id="1729654308190250600">メール アドレスを入力してください。</translation>
-<translation id="1758486001363313524">その他...</translation>
-<translation id="1806710327868736751">アラート ダイアログ</translation>
-<translation id="1821985195704844674">ツリーグリッド</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">リモート デバイスで再生</translation>
-<translation id="190587075670221089">削除</translation>
-<translation id="1907737156431278478">例</translation>
-<translation id="1921819250265091946">日</translation>
-<translation id="1930711995431081526">ステータス</translation>
-<translation id="1938124657309484470"><ph name="MAXIMUM_DATE_OR_TIME" /> 以前の値を指定する必要があります。</translation>
-<translation id="1946271899482435442">日付選択ツールを表示</translation>
-<translation id="1993104285338243655">ミラーリングに切り替わりました</translation>
-<translation id="2060505056492490888">「<ph name="INVALIDDOMAIN" />」内の「<ph name="DOT" />」の位置が間違っています。</translation>
-<translation id="2148716181193084225">今日</translation>
-<translation id="2158401438286456825">ページリスト</translation>
-<translation id="2226276347425096477">このテキストを半角 <ph name="MAX_CHARACTERS" /> 文字以下にしてください（現時点で半角 <ph name="CURRENT_LENGTH" /> 文字です）。</translation>
-<translation id="2246498165605549352">ローカル ファイル</translation>
-<translation id="2247351761944213033"><ph name="YEAR" />年第<ph name="WEEKNUMBER" />週</translation>
-<translation id="2277199496770840904">トラック <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">チェックボックス</translation>
-<translation id="2311842470354187719">改ページ</translation>
-<translation id="2335594187091864976">日時選択ツール</translation>
-<translation id="245932805758469625">残りの再生時間（秒）</translation>
-<translation id="248395913932153421">日</translation>
-<translation id="2507943997699731163">このフィールドを入力してください。</translation>
-<translation id="2508569020611168319">タブリスト</translation>
-<translation id="2561842179657104141">その他のメディア コントロールを表示</translation>
-<translation id="2572483411312390101">再生</translation>
-<translation id="2613802280814924224">有効な値を入力してください。有効な値として最も近いのは <ph name="VALID_VALUE" /> です。</translation>
-<translation id="2653659639078652383">送信</translation>
-<translation id="2657045182931379222">図形オブジェクト</translation>
-<translation id="2674318244760992338">フッター</translation>
-<translation id="2709516037105925701">自動入力</translation>
-<translation id="2723001399770238859">音声</translation>
-<translation id="2746543609216772311"><ph name="MINIMUM_DATE_OR_TIME" /> 以降の値を指定する必要があります。</translation>
-<translation id="2759744352195237655">ポップアップ ボタン</translation>
-<translation id="2761667185364618470">次に進むにはこのチェックボックスをオンにしてください。</translation>
-<translation id="2844350028562914727">詳細</translation>
-<translation id="2896972712917208084">ラジオボタン グループ</translation>
-<translation id="2908441821576996758">メール アドレスのカンマ区切りリストを入力してください。</translation>
-<translation id="2940813599313844715">オブジェクト</translation>
-<translation id="2942448076852699108">ハイライト表示されたコンテンツ</translation>
-<translation id="3040011195152428237">リンク</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">有効な値を入力してください。フィールドの入力が不完全か、日付が無効です。</translation>
-<translation id="3078740164268491126">表</translation>
-<translation id="3086746722712840547">注記</translation>
-<translation id="310520048233152454">URL を入力してください。</translation>
-<translation id="3175736971608411871">タイマー</translation>
-<translation id="3199563858620722075">コンボボックス</translation>
-<translation id="3450233048674729344">値は <ph name="MAXIMUM" /> 以下にする必要があります。</translation>
-<translation id="3486220673238053218">定義</translation>
-<translation id="3557673793733683882">見出し <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">週選択ツール</translation>
-<translation id="3685101356851116974">ラベルのない画像</translation>
-<translation id="3706100364254443312">切り替え</translation>
-<translation id="3732799496749320381">月</translation>
-<translation id="3754210790023674521">ピクチャー イン ピクチャーを終了</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">用語</translation>
-<translation id="3822383571486410024">このテキストは <ph name="MIN_CHARACTERS" /> 文字以上で指定してください（現在は <ph name="CURRENT_LENGTH" /> 文字です）。</translation>
-<translation id="383465348367842624">「<ph name="ATSIGN" />」の前の文字列に記号「<ph name="INVALIDCHARACTER" />」を使用しないでください。</translation>
-<translation id="3846214748874656680">全画面表示を終了</translation>
-<translation id="3920932319529768807">まとめ</translation>
-<translation id="3924558731517983934">アプリケーション</translation>
-<translation id="3944740393230681990">プロローグ</translation>
-<translation id="3960700977367013758">スクロールバー</translation>
-<translation id="4103419683916926126">ミリ秒</translation>
-<translation id="4151657705144244502">グラフィック</translation>
-<translation id="4160057747563657758">電話</translation>
-<translation id="4193965531860883258">前書き</translation>
-<translation id="4201051445878709314">前の月を表示</translation>
-<translation id="421884353938374759">カラー選択ツール</translation>
-<translation id="4248100235867064564">メニューバー</translation>
-<translation id="4360991593054037559">有効な値を入力してください。有効な値として最も近いのは <ph name="VALID_VALUE_LOW" /> と <ph name="VALID_VALUE_HIGHER" /> です。</translation>
-<translation id="4384583879834880242">Q＆A</translation>
-<translation id="4413860115965805769">メニューボタン</translation>
-<translation id="4444765639179266822"><ph name="OCR_TEXT" /> というテキストのようです</translation>
-<translation id="4446524499724042288">用語参照</translation>
-<translation id="4522570452068850558">詳細</translation>
-<translation id="4542388879936266156">残り時間: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">フォーム</translation>
-<translation id="4661075872484491155">ツリー</translation>
-<translation id="4664250907885839816">「<ph name="ATSIGN" />」に続く文字列に記号「<ph name="INVALIDCHARACTER" />」を使用しないでください。</translation>
-<translation id="4668956016107839909">付録</translation>
-<translation id="4718048029184481307">ピクチャー イン ピクチャーを再生しています</translation>
-<translation id="4742539557769756338">表紙</translation>
-<translation id="4748357248530471599">ディスプレイ カットアウトに合わせた全画面表示に切り替えます</translation>
-<translation id="4757246831282535685">タブパネル</translation>
-<translation id="4763480195061959176">動画</translation>
-<translation id="479989351350248267">検索</translation>
-<translation id="4812940957355064477">数字を入力してください。</translation>
-<translation id="4912536737030637138">文献情報</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> 件選択</translation>
-<translation id="4992066212339426712">ミュートを解除</translation>
-<translation id="49969490063480558">「<ph name="INVALIDADDRESS" />」は完全なメールアドレスではありません。「<ph name="ATSIGN" />」に続く文字列を入力してください。</translation>
-<translation id="5034860022980953847">プログレスバー</translation>
-<translation id="5090250355906949916">動画シークバー</translation>
-<translation id="5093189678851173835">題辞</translation>
-<translation id="5117590920725113268">次の月を表示</translation>
-<translation id="512758898067543763">行見出し</translation>
-<translation id="5143125788380636750">エピローグ</translation>
-<translation id="5164977714490026579">値は <ph name="MINIMUM" /> 以上にする必要があります。</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">「<ph name="ATSIGN" />」の前の文字列を入力してください。「<ph name="INVALIDADDRESS" />」は完全なメール アドレスではありません。</translation>
-<translation id="5334352251556557839">メディアを再生できません。</translation>
-<translation id="5406322316791861025">図</translation>
-<translation id="5453733299334684579">ツリー項目</translation>
-<translation id="5466621249238537318">1 つ以上のファイルを選択してください。</translation>
-<translation id="5468998798572797635">全画面表示を終了</translation>
-<translation id="5516424706154626233">日付選択ツール</translation>
-<translation id="5537725057119320332">キャスト</translation>
-<translation id="5546461542133609677">ミュートを解除</translation>
-<translation id="561939826962581046">日時</translation>
-<translation id="5630795885300617244">左または右をダブルタップして 10 秒スキップします</translation>
-<translation id="5631759159893697722">概要</translation>
-<translation id="5643186887447432888">ボタン</translation>
-<translation id="5677946354068040947">その他のオプション</translation>
-<translation id="576709008726043716">序論</translation>
-<translation id="57838592816432529">ミュート</translation>
-<translation id="5860033963881614850">オフ</translation>
-<translation id="588258955323874662">全画面表示</translation>
-<translation id="5888666972993069672">現在 <ph name="DEVICE_FRIENDLY_NAME" /> にキャストしています</translation>
-<translation id="591047860372322273">検索ボックス</translation>
-<translation id="5939518447894949180">リセット</translation>
-<translation id="5966707198760109579">週</translation>
-<translation id="5987525920412732405">スピンボタン</translation>
-<translation id="6011459053400940133">音量スライダー</translation>
-<translation id="6015796118275082299">年</translation>
-<translation id="6023896073578205740">リストボックス</translation>
-<translation id="6150588977291308318">参考文献</translation>
-<translation id="6164829606128959761">メーター</translation>
-<translation id="6166809985690652833">後書き</translation>
-<translation id="6209276755895393898"><ph name="DESCRIPTION" /> の画像のようです</translation>
-<translation id="6213469881011901533">用語集</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">ピクチャー イン ピクチャーを終了</translation>
-<translation id="6398862346408813489">月選択パネルを表示</translation>
-<translation id="6404546809543547843">オーディオ再生バー</translation>
-<translation id="6443871981718447451">字幕メニューを表示</translation>
-<translation id="6453774872122745852">謝辞</translation>
-<translation id="648732519525291180">時間選択ツール</translation>
-<translation id="6550675742724504774">オプション</translation>
-<translation id="6572309429103589720">文法が無効です</translation>
-<translation id="658823671542763450">全画面表示</translation>
-<translation id="663493177488814956">フィード</translation>
-<translation id="6637586476836377253">ログ</translation>
-<translation id="6643016212128521049">削除</translation>
-<translation id="668171684555832681">その他...</translation>
-<translation id="6692633176391053278">ステッパー</translation>
-<translation id="6709570249143506788">低再生画質</translation>
-<translation id="6755330956360078551">ツールチップ</translation>
-<translation id="6790428901817661496">再生</translation>
-<translation id="6820355525329141109">プラグインを読み込むことができませんでした。</translation>
-<translation id="6820615603175220800">文献参照</translation>
-<translation id="6843725295806269523">ミュート</translation>
-<translation id="6885760532393684712">ディレクトリ</translation>
-<translation id="689129560213475294">奥付</translation>
-<translation id="6934078000481955284">引用</translation>
-<translation id="6941933287844615239">メディアをダウンロード</translation>
-<translation id="6981594929165378967">挿入</translation>
-<translation id="6989848892321993519">このテキストは <ph name="MIN_CHARACTERS" /> 文字以上で指定してください（現在 1 文字で指定されています）。</translation>
-<translation id="7033340931668032222">音量を変更するには上か下を押します</translation>
-<translation id="709897737746224366">指定されている形式で入力してください。</translation>
-<translation id="7118469954320184356">説明はありません。</translation>
-<translation id="7139483182332611405">序文</translation>
-<translation id="7214187073215825913">コンテンツの情報</translation>
-<translation id="7263440858009898357">リスト内の項目を選択してください。</translation>
-<translation id="727747134524199931">列見出し</translation>
-<translation id="7320576522385648310">バッファリング</translation>
-<translation id="7353453495576941748">クレジット</translation>
-<translation id="7364796246159120393">ファイルを選択</translation>
-<translation id="739024184232394898">その他...</translation>
-<translation id="7405738980073107433">巻末注</translation>
-<translation id="7410239719251593705">アダルト コンテンツが含まれているようです。説明はありません。</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">タブ</translation>
-<translation id="7514365320538308">ダウンロード</translation>
-<translation id="7529102961911894712">言及リンク</translation>
-<translation id="7533959249147584474">ラベルのない画像</translation>
-<translation id="7647456547678091388">ヒント</translation>
-<translation id="7661956066982048809">図形ドキュメント</translation>
-<translation id="7673697353781729403">時間</translation>
-<translation id="7681220483256441252">索引</translation>
-<translation id="7740050170769002709">HTML コンテンツ</translation>
-<translation id="7745230546936012372">画像の説明がない場合に取得するには、コンテキスト メニューを開きます。</translation>
-<translation id="7750228210027921155">ピクチャー イン ピクチャー</translation>
-<translation id="775297008183122718">入力した値が無効です</translation>
-<translation id="7789962463072032349">一時停止</translation>
-<translation id="7802800022689234070">三角形の展開ボタン</translation>
-<translation id="7888071071722539607">メール アドレスに「<ph name="ATSIGN" />」を挿入してください。「<ph name="INVALIDADDRESS" />」内に「<ph name="ATSIGN" />」がありません。</translation>
-<translation id="7891486169920085145">分割バー</translation>
-<translation id="795667975304826397">選択されていません</translation>
-<translation id="8053789581856978548">検索テキスト欄</translation>
-<translation id="8057695513531652401">注記</translation>
-<translation id="8105797009065549151">備考</translation>
-<translation id="811583516810654505">説明を取得しています...</translation>
-<translation id="8117451130807776954">今週</translation>
-<translation id="8199524924445686405"> 年 </translation>
-<translation id="8208673686607688524">ローカル日時選択ツール</translation>
-<translation id="8261464734335370856">スペルが無効です</translation>
-<translation id="8284326494547611709">字幕</translation>
-<translation id="835897206747267392">値が無効です。</translation>
-<translation id="8403857369060869934">経過時間: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">部</translation>
-<translation id="8433900881053900389">ツールバー</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ファイル</translation>
-<translation id="8451268428117625855">ファイルを選択してください。</translation>
-<translation id="8461852803063341183">ラジオボタン</translation>
-<translation id="8474886197722836894">献辞</translation>
-<translation id="8531739829932800271">正誤表</translation>
-<translation id="8534579021159131403">分</translation>
-<translation id="8541249477527128034">メディア管理</translation>
-<translation id="8550857728288566671">図形記号</translation>
-<translation id="8583702881314752957">定義リスト</translation>
-<translation id="8597182159515967513">見出し</translation>
-<translation id="8603553056539299761">再生位置を移動するには左か右を押します</translation>
-<translation id="860475260694818407">目次</translation>
-<translation id="8613126697340063924">リモート再生をコントロール</translation>
-<translation id="862370744433916922">副題</translation>
-<translation id="8711688047404765493">出力</translation>
-<translation id="8750798805984357768">これらのオプションから 1 つ選択してください。</translation>
-<translation id="8808573423886751634">章</translation>
-<translation id="8845239796550121995">テレビにキャストしています</translation>
-<translation id="8851136666856101339">本文</translation>
-<translation id="8875657656876809964">動画再生エラー</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">月</translation>
-<translation id="901493112792887934">現在の時間（秒単位）</translation>
-<translation id="901834265349196618">メール</translation>
-<translation id="9048119486235211610">ナビゲーション</translation>
-<translation id="9062295712474918030">ドキュメント</translation>
-<translation id="9062307380734144336">選択すると再生と一時停止を切り替えできます</translation>
-<translation id="9093215626363556771">ピクチャー イン ピクチャーを終了します</translation>
-<translation id="9108370397979208512">数式</translation>
-<translation id="9132465097189459683">その他...</translation>
-<translation id="9138385573473225930">アラート</translation>
-<translation id="9155987714137265666"><ph name="WEEK_START_DATE" /> から始まる <ph name="WEEK" /></translation>
-<translation id="916607977885256133">ピクチャー イン ピクチャー</translation>
-<translation id="9168329111483466115">脚注</translation>
-<translation id="954003015749068518">ピクチャー イン ピクチャーを開始します</translation>
-<translation id="966787709310836684">メニュー</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_kn.xtb b/chromium/content/app/strings/translations/content_strings_kn.xtb
deleted file mode 100644
index d6289d96ed8..00000000000
--- a/chromium/content/app/strings/translations/content_strings_kn.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="kn">
-<translation id="1018939186200882850">ಮೆನು ಐಟಂ</translation>
-<translation id="10623998915015855">ಟಾಗಲ್ ಬಟನ್</translation>
-<translation id="1088086359088493902">ಸೆಕೆಂಡುಗಳು</translation>
-<translation id="1171774979989969504">ದಯವಿಟ್ಟು ಇಮೇಲ್ ವಿಳಾಸವನ್ನು ನಮೂದಿಸಿ.</translation>
-<translation id="1178581264944972037">ವಿರಾಮ</translation>
-<translation id="1188858454923323853">ಪೂರಕವಾಗಿ</translation>
-<translation id="1206619573307042055">ಮಾರ್ಕ್ಯೂ</translation>
-<translation id="1206693055195146388">ಸ್ಲೈಡರ್</translation>
-<translation id="1211441953136645838">ಮುಕ್ತಾಯ ಟಿಪ್ಪಣಿ</translation>
-<translation id="1281252709823657822">ಸಂವಾದ</translation>
-<translation id="1335095011850992622">ಕ್ರೆಡಿಟ್‌ಗಳು</translation>
-<translation id="1342835525016946179">ಲೇಖನ</translation>
-<translation id="1359897965706325498">ಬ್ಯಾನರ್</translation>
-<translation id="1589122976691792535">ಪ್ರದೇಶ</translation>
-<translation id="1591562245178063882">ಈ ತಿಂಗಳು</translation>
-<translation id="1637811476055996098">ಫೈಲ್‌ಗಳನ್ನು ಆರಿಸಿ</translation>
-<translation id="1650423536718072820">ಪ್ರಮುಖ ಉಲ್ಲೇಖ</translation>
-<translation id="1727886345390570319">ಮುಚ್ಚಿದ ಶೀರ್ಷಿಕೆಗಳ ಮೆನುವನ್ನು ಮರೆಮಾಡಿ</translation>
-<translation id="1729654308190250600">ಖಾಲಿ-ಅಲ್ಲದ ಇಮೇಲ್ ವಿಳಾಸವನ್ನು ನಮೂದಿಸಿ.</translation>
-<translation id="1758486001363313524">ಇತರೆ...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">ಟ್ರೀ ಗ್ರಿಡ್</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">ರಿಮೋಟ್ ಸಾಧನದಲ್ಲಿ ಪ್ಲೇ ಮಾಡಿ</translation>
-<translation id="190587075670221089">ಅಳಿಸುವಿಕೆ</translation>
-<translation id="1907737156431278478">ಉದಾಹರಣೆ</translation>
-<translation id="1921819250265091946">ದಿದಿ</translation>
-<translation id="1930711995431081526">ಸ್ಥಿತಿ</translation>
-<translation id="1938124657309484470">ಮೌಲ್ಯವು <ph name="MAXIMUM_DATE_OR_TIME" /> ಅಥವಾ ಹಿಂದಿನದ್ದಾಗಿರಬೇಕು.</translation>
-<translation id="1946271899482435442">ದಿನಾಂಕದ ಆಯ್ಕೆಯನ್ನು ತೋರಿಸಿ</translation>
-<translation id="1993104285338243655">ಪ್ರತಿಬಿಂಬಿಸುವಿಕೆಗೆ ಬದಲಾಯಿಸಲಾಗಿದೆ</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' ಅನ್ನು '<ph name="INVALIDDOMAIN" />' ನಲ್ಲಿ ತಪ್ಪಾದ ಸ್ಥಾನದಲ್ಲಿ ಬಳಸಲಾಗಿದೆ.</translation>
-<translation id="2148716181193084225">ಇಂದು</translation>
-<translation id="2158401438286456825">ಪುಟ ಪಟ್ಟಿ</translation>
-<translation id="2226276347425096477">ದಯವಿಟ್ಟು ಈ ಪಠ್ಯವನ್ನು <ph name="MAX_CHARACTERS" /> ಅಕ್ಷರಗಳಿಗೆ ಅಥವಾ ಅದಕ್ಕಿಂತಲೂ ಕಡಿಮೆಗೆ ಸೀಮಿತಗೊಳಿಸಿ (ನೀವು ಪ್ರಸ್ತುತ <ph name="CURRENT_LENGTH" /> ಅಕ್ಷರಗಳನ್ನು ಬಳಸುತ್ತಿರುವಿರಿ).</translation>
-<translation id="2246498165605549352">ಸ್ಥಳೀಯ ಫೈಲ್</translation>
-<translation id="2247351761944213033">ವಾರ <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ಟ್ರ್ಯಾಕ್ <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">ಚೆಕ್‌ಬಾಕ್ಸ್</translation>
-<translation id="2311842470354187719">ಪುಟ ವಿಭಜನೆ</translation>
-<translation id="2335594187091864976">ದಿನಾಂಕ ಮತ್ತು ಸಮಯ ಪಿಕರ್</translation>
-<translation id="245932805758469625">ಇಷ್ಟು ಸೆಕೆಂಡಿನ ವೀಡಿಯೊ ಬಾಕಿ ಉಳಿದಿದೆ</translation>
-<translation id="248395913932153421">ದಿನ</translation>
-<translation id="2507943997699731163">ದಯವಿಟ್ಟು ಈ ಕ್ಷೇತ್ರವನ್ನು ಭರ್ತಿ ಮಾಡಿ.</translation>
-<translation id="2508569020611168319">ಟ್ಯಾಬ್ ಪಟ್ಟಿ</translation>
-<translation id="2561842179657104141">ಇನ್ನಷ್ಟು ಮಾಧ್ಯಮ ನಿಯಂತ್ರಣಗಳನ್ನು ತೋರಿಸು</translation>
-<translation id="2572483411312390101">ಪ್ಲೇ ಮಾಡಿ</translation>
-<translation id="2613802280814924224">ಮಾನ್ಯ ಮೌಲ್ಯವನ್ನು ನಮೂದಿಸಿ. ಹತ್ತಿರದ ಮಾನ್ಯ ಮೌಲ್ಯವು <ph name="VALID_VALUE" /> ಆಗಿದೆ.</translation>
-<translation id="2653659639078652383">ಸಲ್ಲಿಸು</translation>
-<translation id="2657045182931379222">ಗ್ರಾಫಿಕ್ಸ್ ವಸ್ತು</translation>
-<translation id="2674318244760992338">ಅಡಿಟಿಪ್ಪಣಿ</translation>
-<translation id="2709516037105925701">ಸ್ವಯಂತುಂಬುವಿಕೆ</translation>
-<translation id="2723001399770238859">ಆಡಿಯೋ</translation>
-<translation id="2746543609216772311">ಮೌಲ್ಯವು <ph name="MINIMUM_DATE_OR_TIME" /> ಅಥವಾ ನಂತರದ್ದಾಗಿರಬೇಕು.</translation>
-<translation id="2759744352195237655">ಪಾಪ್ ಅಪ್ ಬಟನ್</translation>
-<translation id="2761667185364618470">ನೀವು ಮುಂದುವರೆಯಬೇಕಾದರೆ ದಯವಿಟ್ಟು ಈ ಬಾಕ್ಸ್ ಅನ್ನು ಪರೀಕ್ಷಿಸಿ.</translation>
-<translation id="2844350028562914727">ವಿವರಗಳು</translation>
-<translation id="2896972712917208084">ರೇಡಿಯೋ ಗುಂಪು</translation>
-<translation id="2908441821576996758">ದಯವಿಟ್ಟು ಅಲ್ಪ ವಿರಾಮದಿಂದ ಬೇರ್ಪಡಿಸಿದ ಇಮೇಲ್ ವಿಳಾಸಗಳ ಪಟ್ಟಿಯನ್ನು ನಮೂದಿಸಿ.</translation>
-<translation id="2940813599313844715">ವಸ್ತು</translation>
-<translation id="2942448076852699108">ಹೈಲೈಟ್ ಮಾಡಲಾದ ವಿಷಯ</translation>
-<translation id="3040011195152428237">ಲಿಂಕ್</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">ದಯವಿಟ್ಟು ಮಾನ್ಯ ಮೌಲ್ಯವನ್ನು ನಮೂದಿಸಿ. ಕ್ಷೇತ್ರವು ಅಪೂರ್ಣವಾಗಿದೆ ಅಥವಾ ಅಮಾನ್ಯ ದಿನಾಂಕವನ್ನು ಹೊಂದಿದೆ.</translation>
-<translation id="3078740164268491126">ಕೋಷ್ಟಕ</translation>
-<translation id="3086746722712840547">ಟಿಪ್ಪಣಿ</translation>
-<translation id="310520048233152454">ದಯವಿಟ್ಟು URL ಅನ್ನು ನಮೂದಿಸಿ.</translation>
-<translation id="3175736971608411871">ಟೈಮರ್</translation>
-<translation id="3199563858620722075">ಕಾಂಬೊ ಬಾಕ್ಸ್</translation>
-<translation id="3450233048674729344">ಮೌಲ್ಯವು <ph name="MAXIMUM" /> ಕ್ಕೆ ಸಮನಾಗಿರಬಹುದು ಅಥವಾ ಅದಕ್ಕಿಂತಲೂ ಕಡಿಮೆ ಆಗಿರಬಹುದು.</translation>
-<translation id="3486220673238053218">ವಿವರಣೆ</translation>
-<translation id="3557673793733683882">ಶಿರೋನಾಮೆ <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">ವಾರದ ಆಯ್ಕೆ</translation>
-<translation id="3685101356851116974">ಲೇಬಲ್ ಮಾಡಿಲ್ಲದ ಚಿತ್ರ</translation>
-<translation id="3706100364254443312">ಸ್ವಿಚ್</translation>
-<translation id="3732799496749320381">ಮಿಮೀ</translation>
-<translation id="3754210790023674521">ಚಿತ್ರದಲ್ಲಿ ಚಿತ್ರ ಮೋಡ್‌ನಿಂದ ನಿರ್ಗಮಿಸಿ</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">ನಿಯಮ</translation>
-<translation id="3822383571486410024">ಈ ಪಠ್ಯವನ್ನು <ph name="MIN_CHARACTERS" /> ಅಕ್ಷರಗಳಿಗೆ ಅಥವಾ ಅದಕ್ಕಿಂತಲೂ ಹೆಚ್ಚಿಗೆ ಸೀಮಿತಗೊಳಿಸಿ (ನೀವು ಪ್ರಸ್ತುತವಾಗಿ <ph name="CURRENT_LENGTH" /> ಅಕ್ಷರಗಳನ್ನು ಬಳಸುತ್ತಿರುವಿರಿ).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' ನಂತರದ ಭಾಗವು '<ph name="INVALIDCHARACTER" />' ಚಿಹ್ನೆಯನ್ನು ಒಳಗೊಂಡಿರಬಾರದು.</translation>
-<translation id="3846214748874656680">ಪೂರ್ಣಪರದೆಯಿಂದ ನಿರ್ಗಮಿಸಿ</translation>
-<translation id="3920932319529768807">ತೀರ್ಮಾನ</translation>
-<translation id="3924558731517983934">ಅಪ್ಲಿಕೇಶನ್</translation>
-<translation id="3944740393230681990">ಪೀಠಿಕೆ</translation>
-<translation id="3960700977367013758">ಸ್ಕ್ರಾಲ್ ಪಟ್ಟಿ</translation>
-<translation id="4103419683916926126">ಮಿಲಿಸೆಕೆಂಡುಗಳು</translation>
-<translation id="4151657705144244502">ಗ್ರಾಫಿಕ್</translation>
-<translation id="4160057747563657758">ಫೋನ್</translation>
-<translation id="4193965531860883258">ಮುನ್ನುಡಿ</translation>
-<translation id="4201051445878709314">ಹಿಂದಿನ ತಿಂಗಳು ತೋರಿಸು</translation>
-<translation id="421884353938374759">ಬಣ್ಣದ ಆಯ್ಕೆಮಾಡುವಿಕೆ</translation>
-<translation id="4248100235867064564">ಮೆನು ಬಾರ್‌</translation>
-<translation id="4360991593054037559">ಮಾನ್ಯವಾದ ಮೌಲ್ಯವನ್ನು ನಮೂದಿಸಿ. <ph name="VALID_VALUE_LOW" /> ಮತ್ತು <ph name="VALID_VALUE_HIGHER" /> ಎರಡು ಹತ್ತಿರದ ಮಾನ್ಯ ಮೌಲ್ಯಗಳಾಗಿವೆ.</translation>
-<translation id="4384583879834880242">ಪ್ರಶ್ನೋತ್ತರ</translation>
-<translation id="4413860115965805769">ಮೆನು ಬಟನ್</translation>
-<translation id="4444765639179266822">ಹೀಗೆ ಹೇಳುತ್ತಿರಬಹುದು: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">ಪದಕೋಶ ಉಲ್ಲೇಖ</translation>
-<translation id="4522570452068850558">ವಿವರಗಳು</translation>
-<translation id="4542388879936266156">ಬಾಕಿ ಉಳಿದಿರುವ ಸಮಯ: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ಫಾರ್ಮ್</translation>
-<translation id="4661075872484491155">ಮರ</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' ನಂತರದ ಭಾಗವು '<ph name="INVALIDCHARACTER" />' ಚಿಹ್ನೆಯನ್ನು ಒಳಗೊಂಡಿರಬಾರದು.</translation>
-<translation id="4668956016107839909">ಅನುಬಂಧ</translation>
-<translation id="4718048029184481307">ಚಿತ್ರದಲ್ಲಿ ಚಿತ್ರ ಮೋಡ್‌ನಲ್ಲಿ ಪ್ಲೇ ಮಾಡಲಾಗುತ್ತಿದೆ</translation>
-<translation id="4742539557769756338">ಕವರ್</translation>
-<translation id="4748357248530471599">ಡಿಸ್‌ಪ್ಲೇ ಕಟ್‌ಔಟ್ ಪೂರ್ಣ ಸ್ಕ್ರೀನ್ ಟಾಗಲ್ ಮಾಡಿ</translation>
-<translation id="4757246831282535685">ಟ್ಯಾಬ್ ಫಲಕ</translation>
-<translation id="4763480195061959176">ವೀಡಿಯೊ</translation>
-<translation id="479989351350248267">ಹುಡುಕಾಡಿ</translation>
-<translation id="4812940957355064477">ದಯವಿಟ್ಟು ಸಂಖ್ಯೆಯನ್ನು ನಮೂದಿಸಿ.</translation>
-<translation id="4912536737030637138">ಗ್ರಂಥಸೂಚಿ ನಮೂದು</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> ಆಯ್ಕೆ ಮಾಡಲಾಗಿದೆ</translation>
-<translation id="4992066212339426712">ಅನ್‌ಮ್ಯೂಟ್</translation>
-<translation id="49969490063480558">'<ph name="ATSIGN" />' ನಂತರದ ಒಂದು ಭಾಗವನ್ನು ನಮೂದಿಸಿ. '<ph name="INVALIDADDRESS" />' ಅಪೂರ್ಣವಾಗಿದೆ.</translation>
-<translation id="5034860022980953847">ಪ್ರಗತಿ ಸೂಚಕ</translation>
-<translation id="5090250355906949916">ವೀಡಿಯೊ ಸಮಯದ ಸ್ಕ್ರಬ್ಬರ್</translation>
-<translation id="5093189678851173835">ಶಿಲಾಶಾಸನ</translation>
-<translation id="5117590920725113268">ಮುಂದಿನ ತಿಂಗಳು ತೋರಿಸಿ</translation>
-<translation id="512758898067543763">ಸಾಲಿನ ಶಿರೋನಾಮೆ</translation>
-<translation id="5143125788380636750">ಹಿನ್ನುಡಿ</translation>
-<translation id="5164977714490026579">ಮೌಲ್ಯವು <ph name="MINIMUM" /> ಕ್ಕಿಂತಲೂ ಹೆಚ್ಚಾಗಿರಬೇಕು ಅಥವಾ ಸಮನಾಗಿರಬೇಕು.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">'<ph name="ATSIGN" />' ನಂತರದ ಭಾಗವನ್ನು ನಮೂದಿಸಿ. '<ph name="INVALIDADDRESS" />' ಅಪೂರ್ಣವಾಗಿದೆ.</translation>
-<translation id="5334352251556557839">ಮೀಡಿಯಾ ಪ್ಲೇ ಮಾಡಲು ಸಾಧ್ಯವಾಗಲಿಲ್ಲ.</translation>
-<translation id="5406322316791861025">ಆಕೃತಿ</translation>
-<translation id="5453733299334684579">ಟ್ರೀ ಐಟಂ</translation>
-<translation id="5466621249238537318">ದಯವಿಟ್ಟು ಒಂದು ಅಥವಾ ಹೆಚ್ಚು ಫೈಲ್‌ಗಳನ್ನು ಆಯ್ಕೆಮಾಡಿ.</translation>
-<translation id="5468998798572797635">ಪೂರ್ಣಪರದೆಯಿಂದ ನಿರ್ಗಮಿಸಿ</translation>
-<translation id="5516424706154626233">ದಿನಾಂಕದ ಪಿಕರ್</translation>
-<translation id="5537725057119320332">ಪಾತ್ರವರ್ಗ</translation>
-<translation id="5546461542133609677">ಅನ್‌ಮ್ಯೂಟ್ ಮಾಡು</translation>
-<translation id="561939826962581046">ಸಮಯ</translation>
-<translation id="5630795885300617244">10ಸೆ ಸ್ಕಿಪ್ ಮಾಡಲು ಎಡಕ್ಕೆ ಅಥವಾ ಬಲಕ್ಕೆ ಡಬಲ್ ಟ್ಯಾಪ್ ಮಾಡಿ</translation>
-<translation id="5631759159893697722">ಸಾರಾಂಶ</translation>
-<translation id="5643186887447432888">ಬಟನ್</translation>
-<translation id="5677946354068040947">ಇನ್ನಷ್ಟು ಆಯ್ಕೆಗಳು</translation>
-<translation id="576709008726043716">ಪರಿಚಯ</translation>
-<translation id="57838592816432529">ಮ್ಯೂಟ್</translation>
-<translation id="5860033963881614850">ಆಫ್</translation>
-<translation id="588258955323874662">ಪೂರ್ಣಪರದೆ</translation>
-<translation id="5888666972993069672">ಈಗ <ph name="DEVICE_FRIENDLY_NAME" /> ಗೆ ಬಿತ್ತರಿಸಲಾಗುತ್ತಿದೆ</translation>
-<translation id="591047860372322273">ಹುಡುಕಾಟ ಬಾಕ್ಸ್</translation>
-<translation id="5939518447894949180">ಮರುಹೊಂದಿಸು</translation>
-<translation id="5966707198760109579">ವಾರ</translation>
-<translation id="5987525920412732405">ಸ್ಪಿನ್ ಬಟನ್</translation>
-<translation id="6011459053400940133">ವಾಲ್ಯೂಮ್ ಸ್ಲೈಡರ್</translation>
-<translation id="6015796118275082299">ವರ್ಷ</translation>
-<translation id="6023896073578205740">ಪಟ್ಟಿಯ ಬಾಕ್ಸ್</translation>
-<translation id="6150588977291308318">ಗ್ರಂಥಸೂಚಿ</translation>
-<translation id="6164829606128959761">ಮೀಟರ್</translation>
-<translation id="6166809985690652833">ನಂತರದ</translation>
-<translation id="6209276755895393898">ಹೀಗೆ ಕಾಣಿಸುತ್ತಿದೆ: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">ಪದಕೋಶ</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">ಚಿತ್ರದಲ್ಲಿನ ಚಿತ್ರದಿಂದ ನಿರ್ಗಮಿಸಿ</translation>
-<translation id="6398862346408813489">ತಿಂಗಳ ಆಯ್ಕೆ ಪ್ಯಾನಲ್ ತೋರಿಸಿ</translation>
-<translation id="6404546809543547843">ಆಡಿಯೊ ಸಮಯ ಸ್ಕ್ರಬ್ಬರ್</translation>
-<translation id="6443871981718447451">ಮುಚ್ಚಿದ ಶೀರ್ಷಿಕೆಗಳ ಮೆನುವನ್ನು ತೋರಿಸಿ</translation>
-<translation id="6453774872122745852">ಅಂಗೀಕಾರಗಳು</translation>
-<translation id="648732519525291180">ಸಮಯ ಪಿಕರ್</translation>
-<translation id="6550675742724504774">ಆಯ್ಕೆಗಳು</translation>
-<translation id="6572309429103589720">ಅಮಾನ್ಯ ವ್ಯಾಕರಣ</translation>
-<translation id="658823671542763450">ಪೂರ್ಣ ಪರದೆ ನಮೂದಿಸು</translation>
-<translation id="663493177488814956">ಫೀಡ್‌</translation>
-<translation id="6637586476836377253">ಲಾಗ್</translation>
-<translation id="6643016212128521049">ತೆರವುಗೊಳಿಸಿ</translation>
-<translation id="668171684555832681">ಇತರೆ...</translation>
-<translation id="6692633176391053278">ಸ್ಟೀಪರ್</translation>
-<translation id="6709570249143506788">ಪ್ಲೇಬ್ಯಾಕ್ ಗುಣಮಟ್ಟ ಕಳಪೆಯಾಗಿದೆ</translation>
-<translation id="6755330956360078551">ಟೂಲ್‌ ಟಿಪ್‌</translation>
-<translation id="6790428901817661496">ಪ್ಲೇ ಮಾಡು</translation>
-<translation id="6820355525329141109">ಪ್ಲಗ್-ಇನ್ ಲೋಡ್ ಮಾಡಲು ಸಾಧ್ಯವಾಗಲಿಲ್ಲ.</translation>
-<translation id="6820615603175220800">ಗ್ರಂಥಸೂಚಿ ಉಲ್ಲೇಖ</translation>
-<translation id="6843725295806269523">ಮ್ಯೂಟ್</translation>
-<translation id="6885760532393684712">ಡೈರೆಕ್ಟರಿ</translation>
-<translation id="689129560213475294">ಕೊಲೊಫೋನ್</translation>
-<translation id="6934078000481955284">ಬ್ಲಾಕ್‌ಕೋಟ್</translation>
-<translation id="6941933287844615239">ಮಾಧ್ಯಮ ಡೌನ್‌ಲೋಡ್</translation>
-<translation id="6981594929165378967">ಅಳವಡಿಕೆ</translation>
-<translation id="6989848892321993519">ಈ ಪಠ್ಯವನ್ನು <ph name="MIN_CHARACTERS" /> ಅಥವಾ ಇದಕ್ಕಿಂತಲೂ ಹೆಚ್ಚಿನ ಅಕ್ಷರಗಳಿಗೆ ಉದ್ದಗೊಳಿಸಿ (ನೀವು ಪ್ರಸ್ತುತ 1 ಅಕ್ಷರಗಳನ್ನು ಬಳಸುತ್ತಿರುವಿರಿ).</translation>
-<translation id="7033340931668032222">ವಾಲ್ಯೂಮ್ ಬದಲಾಯಿಸಲು ಮೇಲಕ್ಕೆ ಮತ್ತು ಕೆಳಕ್ಕೆ ಬಟನ್ ಒತ್ತಿರಿ</translation>
-<translation id="709897737746224366">ದಯವಿಟ್ಟು ವಿನಂತಿಸಿದ ಸ್ವರೂಪವನ್ನು ಹೊಂದಿಸಿ.</translation>
-<translation id="7118469954320184356">ಯಾವುದೇ ವಿವರಣೆ ಲಭ್ಯವಿಲ್ಲ.</translation>
-<translation id="7139483182332611405">ಮುನ್ನುಡಿ</translation>
-<translation id="7214187073215825913">ವಿಷಯದ ಮಾಹಿತಿ</translation>
-<translation id="7263440858009898357">ಪಟ್ಟಿಯಲ್ಲಿನ ಐಟಂ ಅನ್ನು ದಯವಿಟ್ಟು ಆಯ್ಕೆ ಮಾಡಿ.</translation>
-<translation id="727747134524199931">ಕಾಲಮ್ ಶಿರೋನಾಮೆ</translation>
-<translation id="7320576522385648310">ಬಫರ್ ಆಗುತ್ತಿದೆ</translation>
-<translation id="7353453495576941748">ಗೌರವ</translation>
-<translation id="7364796246159120393">ಫೈಲ್ ಆಯ್ಕೆ ಮಾಡಿ</translation>
-<translation id="739024184232394898">ಇತರೆ...</translation>
-<translation id="7405738980073107433">ಅಂತಿಮ ಟಿಪ್ಪಣಿಗಳು</translation>
-<translation id="7410239719251593705">ವಯಸ್ಕರ ವಿಷಯವನ್ನು ಒಳಗೊಂಡಿರುವಂತೆ ತೋರುತ್ತಿದೆ. ಯಾವುದೇ ವಿವರಣೆ ಲಭ್ಯವಿಲ್ಲ.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">ಟ್ಯಾಬ್</translation>
-<translation id="7514365320538308">ಡೌನ್‌ಲೋಡ್</translation>
-<translation id="7529102961911894712">ಬ್ಯಾಕ್‌ಲಿಂಕ್</translation>
-<translation id="7533959249147584474">ಲೇಬಲ್ ಮಾಡಿಲ್ಲದ ಗ್ರಾಫಿಕ್</translation>
-<translation id="7647456547678091388">ಸಲಹೆ</translation>
-<translation id="7661956066982048809">ಗ್ರಾಫಿಕ್ಸ್ ಡಾಕ್ಯುಮೆಂಟ್</translation>
-<translation id="7673697353781729403">ಗಂಟೆಗಳು</translation>
-<translation id="7681220483256441252">ಸೂಚಿಕೆ</translation>
-<translation id="7740050170769002709">HTML ವಿಷಯ</translation>
-<translation id="7745230546936012372">ಕಾಣೆಯಾಗಿರುವ ಚಿತ್ರದ ವಿವರಣೆಗಳನ್ನು ಪಡೆಯಲು, ಸಂದರ್ಭದ ಮೆನು ತೆರೆಯಿರಿ.</translation>
-<translation id="7750228210027921155">ಚಿತ್ರದಲ್ಲಿ ಚಿತ್ರ</translation>
-<translation id="775297008183122718">ಅಮಾನ್ಯ ನಮೂದು</translation>
-<translation id="7789962463072032349">ವಿರಾಮ</translation>
-<translation id="7802800022689234070">ತ್ರಿಕೋನ ಪ್ರಕಟಣೆ</translation>
-<translation id="7888071071722539607">ಇಮೇಲ್ ವಿಳಾಸದಲ್ಲಿ ಒಂದು '<ph name="ATSIGN" />' ಅನ್ನು ಸೇರಿಸಿ. '<ph name="ATSIGN" />' ನಲ್ಲಿ '<ph name="INVALIDADDRESS" />' ಕಾಣೆಯಾಗಿದೆ.</translation>
-<translation id="7891486169920085145">ಛೇದಕ</translation>
-<translation id="795667975304826397">ಯಾವುದೇ ಫೈಲ್ ಆಯ್ಕೆ ಮಾಡಿಲ್ಲ</translation>
-<translation id="8053789581856978548">ಪಠ್ಯ ಹುಡುಕಾಟದ ಫೀಲ್ಡ್</translation>
-<translation id="8057695513531652401">ಸೂಚನೆ</translation>
-<translation id="8105797009065549151">ಸೂಚನೆ ಉಲ್ಲೇಖ</translation>
-<translation id="811583516810654505">ವಿವರಣೆಯನ್ನು ಪಡೆಯಲಾಗುತ್ತಿದೆ...</translation>
-<translation id="8117451130807776954">ಈ ವಾರ</translation>
-<translation id="8199524924445686405">ವವವವ</translation>
-<translation id="8208673686607688524">ಸ್ಥಳೀಯ ದಿನಾಂಕ ಮತ್ತು ಸಮಯದ ಆಯ್ಕೆ</translation>
-<translation id="8261464734335370856">ಅಮಾನ್ಯ ಕಾಗುಣಿತ</translation>
-<translation id="8284326494547611709">ಶೀರ್ಷಿಕೆಗಳು</translation>
-<translation id="835897206747267392">ಅಮಾನ್ಯ ಮೌಲ್ಯ.</translation>
-<translation id="8403857369060869934">ಕಳೆದುಹೋದ ಸಮಯ: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">ಭಾಗ</translation>
-<translation id="8433900881053900389">ಟೂಲ್‌ಬಾರ್</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ಫೈಲ್‌ಗಳು</translation>
-<translation id="8451268428117625855">ದಯವಿಟ್ಟು ಫೈಲ್ ಆಯ್ಕೆಮಾಡಿ.</translation>
-<translation id="8461852803063341183">ರೇಡಿಯೋ ಬಟನ್</translation>
-<translation id="8474886197722836894">ಸಮರ್ಪಣೆ</translation>
-<translation id="8531739829932800271">ಎರ್ರಾಟಾ</translation>
-<translation id="8534579021159131403">ನಿಮಿಷಗಳು</translation>
-<translation id="8541249477527128034">ಮಾಧ್ಯಮ ನಿಯಂತ್ರಣ</translation>
-<translation id="8550857728288566671">ಗ್ರಾಫಿಕ್ಸ್ ಚಿಹ್ನೆ</translation>
-<translation id="8583702881314752957">ವಿವರಣೆ ಪಟ್ಟಿ</translation>
-<translation id="8597182159515967513">ಶೀರ್ಷಿಕೆ</translation>
-<translation id="8603553056539299761">ಸೀಕ್‌ಗಾಗಿ ಎಡ ಮತ್ತು ಬಲ ಬಟನ್ ಒತ್ತಿರಿ</translation>
-<translation id="860475260694818407">ಪರಿವಿಡಿ</translation>
-<translation id="8613126697340063924">ರಿಮೋಟ್ ಪ್ಲೇಬ್ಯಾಕ್ ನಿಯಂತ್ರಿಸಿ</translation>
-<translation id="862370744433916922">ಉಪಶೀರ್ಷಿಕೆ</translation>
-<translation id="8711688047404765493">ಔಟ್‌ಪುಟ್</translation>
-<translation id="8750798805984357768">ದಯವಿಟ್ಟು ಈ ಕೆಳಗಿನ ಆಯ್ಕೆಗಳಲ್ಲಿ ಒಂದನ್ನು ಆರಿಸಿ.</translation>
-<translation id="8808573423886751634">ಅಧ್ಯಾಯ</translation>
-<translation id="8845239796550121995">ಈಗ ನಿಮ್ಮ ಟಿವಿಯನ್ನು ಬಿತ್ತರಿಸಲಾಗುತ್ತಿದೆ</translation>
-<translation id="8851136666856101339">ಮುಖ್ಯ</translation>
-<translation id="8875657656876809964">ವೀಡಿಯೊ ಪ್ಲೇಬ್ಯಾಕ್ ದೋಷ</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">ತಿಂಗಳು</translation>
-<translation id="901493112792887934">ಸೆಕೆಂಡ್‌ಗಳಲ್ಲಿ ಪ್ರಸ್ತುತ ಸಮಯ</translation>
-<translation id="901834265349196618">ಇಮೇಲ್</translation>
-<translation id="9048119486235211610">ನ್ಯಾವಿಗೇಷನ್</translation>
-<translation id="9062295712474918030">ಡಾಕ್ಯುಮೆಂಟ್</translation>
-<translation id="9062307380734144336">ಪ್ಲೇ/ವಿರಾಮಗೊಳಿಸಿ ಟಾಗಲ್ ಮಾಡಲು ಆಯ್ಕೆಮಾಡಿ</translation>
-<translation id="9093215626363556771">ಚಿತ್ರದಲ್ಲಿನ ಚಿತ್ರದಿಂದ ನಿರ್ಗಮಿಸಿ</translation>
-<translation id="9108370397979208512">ಮ್ಯಾಥ್</translation>
-<translation id="9132465097189459683">ಇತರೆ...</translation>
-<translation id="9138385573473225930">ಎಚ್ಚರಿಕೆ</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" /> ರಂದು ಪ್ರಾರಂಭವಾಗುತ್ತದೆ</translation>
-<translation id="916607977885256133">ಚಿತ್ರದಲ್ಲಿ ಚಿತ್ರ</translation>
-<translation id="9168329111483466115">ಅಡಿಟಿಪ್ಪಣಿ</translation>
-<translation id="954003015749068518">ಚಿತ್ರದಲ್ಲಿನ ಚಿತ್ರವನ್ನು ಪ್ರವೇಶಿಸಿ</translation>
-<translation id="966787709310836684">ಮೆನು</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ko.xtb b/chromium/content/app/strings/translations/content_strings_ko.xtb
deleted file mode 100644
index 279cfe53099..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ko.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ko">
-<translation id="1018939186200882850">메뉴 항목</translation>
-<translation id="10623998915015855">전환 버튼</translation>
-<translation id="1088086359088493902">초</translation>
-<translation id="1171774979989969504">이메일 주소를 입력하세요.</translation>
-<translation id="1178581264944972037">일시중지</translation>
-<translation id="1188858454923323853">상호 보완</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">슬라이더</translation>
-<translation id="1211441953136645838">미주</translation>
-<translation id="1281252709823657822">대화상자</translation>
-<translation id="1335095011850992622">저작권 표시</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">배너</translation>
-<translation id="1589122976691792535">지역</translation>
-<translation id="1591562245178063882">이번 달</translation>
-<translation id="1637811476055996098">파일 선택</translation>
-<translation id="1650423536718072820">인용문</translation>
-<translation id="1727886345390570319">자막 메뉴 숨기기</translation>
-<translation id="1729654308190250600">비어 있지 않은 이메일 주소를 입력해 주세요.</translation>
-<translation id="1758486001363313524">다른 일자...</translation>
-<translation id="1806710327868736751">알림 대화상자</translation>
-<translation id="1821985195704844674">트리 격자</translation>
-<translation id="1822429046913737220">오전/오후</translation>
-<translation id="1832974991323546415">원격 기기에서 재생</translation>
-<translation id="190587075670221089">삭제</translation>
-<translation id="1907737156431278478">예시</translation>
-<translation id="1921819250265091946">일</translation>
-<translation id="1930711995431081526">상태</translation>
-<translation id="1938124657309484470">값은 <ph name="MAXIMUM_DATE_OR_TIME" /> 이전이어야 합니다.</translation>
-<translation id="1946271899482435442">날짜 선택도구 표시</translation>
-<translation id="1993104285338243655">미러링으로 전환됨</translation>
-<translation id="2060505056492490888">'<ph name="INVALIDDOMAIN" />'에서 '<ph name="DOT" />'의 위치가 잘못되었습니다.</translation>
-<translation id="2148716181193084225">오늘</translation>
-<translation id="2158401438286456825">페이지 목록</translation>
-<translation id="2226276347425096477">이 텍스트를 <ph name="MAX_CHARACTERS" />자 이하로 줄이세요(현재 <ph name="CURRENT_LENGTH" />자 사용 중).</translation>
-<translation id="2246498165605549352">로컬 파일</translation>
-<translation id="2247351761944213033"><ph name="YEAR" />, <ph name="WEEKNUMBER" />번째 주</translation>
-<translation id="2277199496770840904"><ph name="NUMBER" />번 트랙</translation>
-<translation id="2291999235780842123">체크박스</translation>
-<translation id="2311842470354187719">페이지 나누기</translation>
-<translation id="2335594187091864976">날짜 및 시간 선택기</translation>
-<translation id="245932805758469625">동영상 남은 시간</translation>
-<translation id="248395913932153421">일</translation>
-<translation id="2507943997699731163">이 입력란을 작성하세요.</translation>
-<translation id="2508569020611168319">탭 목록</translation>
-<translation id="2561842179657104141">미디어 컨트롤 더보기</translation>
-<translation id="2572483411312390101">재생</translation>
-<translation id="2613802280814924224">유효한 값을 입력해 주세요. 가장 근접한 유효 값은 <ph name="VALID_VALUE" />입니다.</translation>
-<translation id="2653659639078652383">제출</translation>
-<translation id="2657045182931379222">그래픽 객체</translation>
-<translation id="2674318244760992338">바닥글</translation>
-<translation id="2709516037105925701">자동 완성</translation>
-<translation id="2723001399770238859">오디오</translation>
-<translation id="2746543609216772311">값은 <ph name="MINIMUM_DATE_OR_TIME" /> 이후여야 합니다.</translation>
-<translation id="2759744352195237655">팝업 버튼</translation>
-<translation id="2761667185364618470">계속하려면 이 확인란을 선택하세요.</translation>
-<translation id="2844350028562914727">세부정보</translation>
-<translation id="2896972712917208084">라디오 그룹</translation>
-<translation id="2908441821576996758">이메일 주소를 쉼표로 구분하여 입력하세요.</translation>
-<translation id="2940813599313844715">객체</translation>
-<translation id="2942448076852699108">강조표시된 콘텐츠</translation>
-<translation id="3040011195152428237">링크</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" />MB</translation>
-<translation id="3075154866155599887">유효한 값을 입력하세요. 입력을 완료하지 않았거나 날짜가 잘못되었습니다.</translation>
-<translation id="3078740164268491126">표</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">URL을 입력하세요.</translation>
-<translation id="3175736971608411871">타이머</translation>
-<translation id="3199563858620722075">콤보 상자</translation>
-<translation id="3450233048674729344">값은 <ph name="MAXIMUM" /> 이하여야 합니다.</translation>
-<translation id="3486220673238053218">정의</translation>
-<translation id="3557673793733683882">제목 <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">주 선택도구</translation>
-<translation id="3685101356851116974">라벨이 없는 이미지</translation>
-<translation id="3706100364254443312">전환</translation>
-<translation id="3732799496749320381">월</translation>
-<translation id="3754210790023674521">PIP 모드 종료</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" />GB</translation>
-<translation id="3808586225841795776">용어</translation>
-<translation id="3822383571486410024">이 텍스트를 <ph name="MIN_CHARACTERS" />자 이상으로 늘리세요(현재 <ph name="CURRENT_LENGTH" />자 사용 중).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' 앞 부분에 '<ph name="INVALIDCHARACTER" />' 기호가 포함되면 안됩니다.</translation>
-<translation id="3846214748874656680">전체화면 종료</translation>
-<translation id="3920932319529768807">결론</translation>
-<translation id="3924558731517983934">애플리케이션</translation>
-<translation id="3944740393230681990">프롤로그</translation>
-<translation id="3960700977367013758">스크롤바</translation>
-<translation id="4103419683916926126">밀리초</translation>
-<translation id="4151657705144244502">그래픽</translation>
-<translation id="4160057747563657758">전화번호</translation>
-<translation id="4193965531860883258">서문</translation>
-<translation id="4201051445878709314">이전 달 표시</translation>
-<translation id="421884353938374759">color picker</translation>
-<translation id="4248100235867064564">메뉴 표시줄</translation>
-<translation id="4360991593054037559">유효한 값을 입력해 주세요. 가장 근접한 유효 값 2개는 <ph name="VALID_VALUE_LOW" /> 및 <ph name="VALID_VALUE_HIGHER" />입니다.</translation>
-<translation id="4384583879834880242">Q&amp;A</translation>
-<translation id="4413860115965805769">메뉴 버튼</translation>
-<translation id="4444765639179266822">텍스트가 <ph name="OCR_TEXT" />인 것으로 보입니다</translation>
-<translation id="4446524499724042288">용어 참조</translation>
-<translation id="4522570452068850558">세부정보</translation>
-<translation id="4542388879936266156">남은 시간: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">양식</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' 다음 부분에 '<ph name="INVALIDCHARACTER" />' 기호가 포함되면 안됩니다.</translation>
-<translation id="4668956016107839909">부록</translation>
-<translation id="4718048029184481307">PIP 모드에서 재생</translation>
-<translation id="4742539557769756338">표지</translation>
-<translation id="4748357248530471599">디스플레이 컷아웃을 전체화면으로 전환</translation>
-<translation id="4757246831282535685">탭 패널</translation>
-<translation id="4763480195061959176">동영상</translation>
-<translation id="479989351350248267">검색</translation>
-<translation id="4812940957355064477">숫자를 입력하세요.</translation>
-<translation id="4912536737030637138">참고문헌 항목</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" />개 선택됨</translation>
-<translation id="4992066212339426712">음소거 해제</translation>
-<translation id="49969490063480558">'<ph name="ATSIGN" />' 뒷 부분을 입력해 주세요. '<ph name="INVALIDADDRESS" />'(이)가 완전하지 않습니다.</translation>
-<translation id="5034860022980953847">진행률 표시기</translation>
-<translation id="5090250355906949916">동영상 시간 스크러버</translation>
-<translation id="5093189678851173835">제명</translation>
-<translation id="5117590920725113268">다음 달 표시</translation>
-<translation id="512758898067543763">행 헤더</translation>
-<translation id="5143125788380636750">에필로그</translation>
-<translation id="5164977714490026579">값은 <ph name="MINIMUM" /> 이상이어야 합니다.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" />PB</translation>
-<translation id="5307600278924710095">'<ph name="ATSIGN" />' 앞 부분을 입력해 주세요. '<ph name="INVALIDADDRESS" />'(이)가 완전하지 않습니다.</translation>
-<translation id="5334352251556557839">미디어를 재생할 수 없습니다.</translation>
-<translation id="5406322316791861025">그림</translation>
-<translation id="5453733299334684579">트리 항목</translation>
-<translation id="5466621249238537318">파일을 한 개 이상 선택하세요.</translation>
-<translation id="5468998798572797635">전체화면 닫기</translation>
-<translation id="5516424706154626233">날짜 선택기</translation>
-<translation id="5537725057119320332">전송</translation>
-<translation id="5546461542133609677">음소거 해제</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">10초를 건너뛰려면 왼쪽이나 오른쪽을 두 번 탭하세요.</translation>
-<translation id="5631759159893697722">초록</translation>
-<translation id="5643186887447432888">버튼</translation>
-<translation id="5677946354068040947">옵션 더보기</translation>
-<translation id="576709008726043716">소개</translation>
-<translation id="57838592816432529">음소거</translation>
-<translation id="5860033963881614850">사용 안함</translation>
-<translation id="588258955323874662">전체화면</translation>
-<translation id="5888666972993069672">현재 <ph name="DEVICE_FRIENDLY_NAME" />(으)로 전송 중</translation>
-<translation id="591047860372322273">검색창</translation>
-<translation id="5939518447894949180">초기화</translation>
-<translation id="5966707198760109579">주</translation>
-<translation id="5987525920412732405">스핀 버튼</translation>
-<translation id="6011459053400940133">볼륨 슬라이더</translation>
-<translation id="6015796118275082299">연도</translation>
-<translation id="6023896073578205740">목록 상자</translation>
-<translation id="6150588977291308318">참고문헌</translation>
-<translation id="6164829606128959761">미터</translation>
-<translation id="6166809985690652833">후기</translation>
-<translation id="6209276755895393898"><ph name="DESCRIPTION" /> 같습니다</translation>
-<translation id="6213469881011901533">용어설명</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">PIP 모드 종료</translation>
-<translation id="6398862346408813489">월 선택 패널 표시</translation>
-<translation id="6404546809543547843">오디오 시간 스크러버</translation>
-<translation id="6443871981718447451">자막 메뉴 표시</translation>
-<translation id="6453774872122745852">감사의 말</translation>
-<translation id="648732519525291180">시간 선택기</translation>
-<translation id="6550675742724504774">옵션</translation>
-<translation id="6572309429103589720">문법이 잘못되었습니다.</translation>
-<translation id="658823671542763450">전체화면 열기</translation>
-<translation id="663493177488814956">피드</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">삭제</translation>
-<translation id="668171684555832681">기타...</translation>
-<translation id="6692633176391053278">증감자</translation>
-<translation id="6709570249143506788">재생 품질 나쁨</translation>
-<translation id="6755330956360078551">도움말</translation>
-<translation id="6790428901817661496">재생</translation>
-<translation id="6820355525329141109">플러그인을 로드할 수 없습니다.</translation>
-<translation id="6820615603175220800">참고문헌 참조</translation>
-<translation id="6843725295806269523">음소거</translation>
-<translation id="6885760532393684712">디렉터리</translation>
-<translation id="689129560213475294">출판사 이름</translation>
-<translation id="6934078000481955284">인용구</translation>
-<translation id="6941933287844615239">미디어 다운로드</translation>
-<translation id="6981594929165378967">삽입</translation>
-<translation id="6989848892321993519">이 텍스트를 <ph name="MIN_CHARACTERS" />자 이상으로 늘리세요(현재 1자 사용 중).</translation>
-<translation id="7033340931668032222">위아래로 볼륨 조정</translation>
-<translation id="709897737746224366">요청한 형식과 일치시키세요.</translation>
-<translation id="7118469954320184356">설명이 없습니다.</translation>
-<translation id="7139483182332611405">머리말</translation>
-<translation id="7214187073215825913">콘텐츠 정보</translation>
-<translation id="7263440858009898357">목록에서 항목을 선택하세요.</translation>
-<translation id="727747134524199931">열 헤더</translation>
-<translation id="7320576522385648310">버퍼링</translation>
-<translation id="7353453495576941748">크레딧</translation>
-<translation id="7364796246159120393">파일 선택</translation>
-<translation id="739024184232394898">다른 주...</translation>
-<translation id="7405738980073107433">미주</translation>
-<translation id="7410239719251593705">성인용 콘텐츠가 포함된 것으로 보입니다. 설명이 없습니다.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" />TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">다운로드</translation>
-<translation id="7529102961911894712">뒤로 링크</translation>
-<translation id="7533959249147584474">라벨이 없는 그래픽</translation>
-<translation id="7647456547678091388">도움말</translation>
-<translation id="7661956066982048809">그래픽 문서</translation>
-<translation id="7673697353781729403">시간</translation>
-<translation id="7681220483256441252">색인</translation>
-<translation id="7740050170769002709">HTML 콘텐츠</translation>
-<translation id="7745230546936012372">누락된 이미지 설명을 확인하려면 컨텍스트 메뉴를 여세요.</translation>
-<translation id="7750228210027921155">PIP 모드</translation>
-<translation id="775297008183122718">입력값이 잘못되었습니다.</translation>
-<translation id="7789962463072032349">일시중지</translation>
-<translation id="7802800022689234070">펼치기/접기 삼각형</translation>
-<translation id="7888071071722539607">이메일 주소에 '<ph name="ATSIGN" />'를 포함해 주세요. '<ph name="INVALIDADDRESS" />'에 '<ph name="ATSIGN" />'가 없습니다.</translation>
-<translation id="7891486169920085145">분할선</translation>
-<translation id="795667975304826397">선택된 파일 없음</translation>
-<translation id="8053789581856978548">검색어 입력란</translation>
-<translation id="8057695513531652401">안내문</translation>
-<translation id="8105797009065549151">참고 자료</translation>
-<translation id="811583516810654505">설명 가져오는 중...</translation>
-<translation id="8117451130807776954">이번 주</translation>
-<translation id="8199524924445686405">연도</translation>
-<translation id="8208673686607688524">로컬 날짜 및 시간 선택도구</translation>
-<translation id="8261464734335370856">맞춤법이 잘못되었습니다.</translation>
-<translation id="8284326494547611709">자막</translation>
-<translation id="835897206747267392">값이 잘못되었습니다.</translation>
-<translation id="8403857369060869934">경과 시간: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">부</translation>
-<translation id="8433900881053900389">툴바</translation>
-<translation id="8444882422881193423">파일 <ph name="NUMBER_OF_FILES" />개</translation>
-<translation id="8451268428117625855">파일을 선택하세요.</translation>
-<translation id="8461852803063341183">라디오 버튼</translation>
-<translation id="8474886197722836894">헌정사</translation>
-<translation id="8531739829932800271">정오표</translation>
-<translation id="8534579021159131403">분</translation>
-<translation id="8541249477527128034">미디어 컨트롤</translation>
-<translation id="8550857728288566671">그래픽 기호</translation>
-<translation id="8583702881314752957">정의 목록</translation>
-<translation id="8597182159515967513">항목</translation>
-<translation id="8603553056539299761">좌우로 검색</translation>
-<translation id="860475260694818407">목차</translation>
-<translation id="8613126697340063924">원격 재생 제어</translation>
-<translation id="862370744433916922">부제</translation>
-<translation id="8711688047404765493">출력</translation>
-<translation id="8750798805984357768">다음 옵션 중 하나를 선택하세요.</translation>
-<translation id="8808573423886751634">장</translation>
-<translation id="8845239796550121995">TV로 전송 중</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">동영상 재생 오류</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" />KB</translation>
-<translation id="8987927404178983737">월</translation>
-<translation id="901493112792887934">현재 시간(초)</translation>
-<translation id="901834265349196618">이메일</translation>
-<translation id="9048119486235211610">탐색</translation>
-<translation id="9062295712474918030">문서</translation>
-<translation id="9062307380734144336">선택하여 재생/일시중지 전환</translation>
-<translation id="9093215626363556771">PIP 모드 종료</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">다른 달...</translation>
-<translation id="9138385573473225930">알림</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />(<ph name="WEEK_START_DATE" />에 시작)</translation>
-<translation id="916607977885256133">PIP 모드</translation>
-<translation id="9168329111483466115">각주</translation>
-<translation id="954003015749068518">PIP 모드 시작</translation>
-<translation id="966787709310836684">메뉴</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_lt.xtb b/chromium/content/app/strings/translations/content_strings_lt.xtb
deleted file mode 100644
index 8e94fd51f67..00000000000
--- a/chromium/content/app/strings/translations/content_strings_lt.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="lt">
-<translation id="1018939186200882850">meniu elementas</translation>
-<translation id="10623998915015855">perjungimo mygtukas</translation>
-<translation id="1088086359088493902">Sekundės</translation>
-<translation id="1171774979989969504">Įveskite el. pašto adresą.</translation>
-<translation id="1178581264944972037">Pristabdyti</translation>
-<translation id="1188858454923323853">papildomas</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">šliaužiklis</translation>
-<translation id="1211441953136645838">išnaša</translation>
-<translation id="1281252709823657822">dialogo langas</translation>
-<translation id="1335095011850992622">titrai</translation>
-<translation id="1342835525016946179">artikelis</translation>
-<translation id="1359897965706325498">reklamjuostė</translation>
-<translation id="1589122976691792535">regionas</translation>
-<translation id="1591562245178063882">Šis mėnuo</translation>
-<translation id="1637811476055996098">Pasirinkti failus</translation>
-<translation id="1650423536718072820">citata</translation>
-<translation id="1727886345390570319">slėpti subtitrų meniu</translation>
-<translation id="1729654308190250600">Įveskite el. pašto adresą (nepalikite lauko tuščio).</translation>
-<translation id="1758486001363313524">Kita...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">medžio tinklelis</translation>
-<translation id="1822429046913737220">iki pietų / po pietų</translation>
-<translation id="1832974991323546415">leisti naudojant nuotolinį įrenginį</translation>
-<translation id="190587075670221089">trynimas</translation>
-<translation id="1907737156431278478">pavyzdys</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">būsena</translation>
-<translation id="1938124657309484470">Vertė turi būti <ph name="MAXIMUM_DATE_OR_TIME" /> ar ankstesnė data.</translation>
-<translation id="1946271899482435442">Rodyti datos rinkiklį</translation>
-<translation id="1993104285338243655">Perjungta į ekrano vaizdo bendrinimą</translation>
-<translation id="2060505056492490888">„<ph name="DOT" />“ naudojamas netinkamoje „<ph name="INVALIDDOMAIN" />“ vietoje.</translation>
-<translation id="2148716181193084225">Šiandien</translation>
-<translation id="2158401438286456825">puslapių sąrašas</translation>
-<translation id="2226276347425096477">Sutrumpinkite šį tekstą iki <ph name="MAX_CHARACTERS" /> simb. ar mažiau (šiuo metu naudojate <ph name="CURRENT_LENGTH" /> simb.).</translation>
-<translation id="2246498165605549352">Vietos failas</translation>
-<translation id="2247351761944213033"><ph name="YEAR" /> m. <ph name="WEEKNUMBER" /> sav.</translation>
-<translation id="2277199496770840904"><ph name="NUMBER" /> takelis</translation>
-<translation id="2291999235780842123">žymimasis laukelis</translation>
-<translation id="2311842470354187719">puslapio lūžis</translation>
-<translation id="2335594187091864976">datos ir laiko rinkiklis</translation>
-<translation id="245932805758469625">likusių vaizdo įrašo sekundžių skaičius</translation>
-<translation id="248395913932153421">Diena</translation>
-<translation id="2507943997699731163">Užpildykite šį lauką.</translation>
-<translation id="2508569020611168319">skirtukų sąrašas</translation>
-<translation id="2561842179657104141">rodyti daugiau medijos valdiklių</translation>
-<translation id="2572483411312390101">paleisti</translation>
-<translation id="2613802280814924224">Įveskite tinkamą vertę. Artimiausia tinkama vertė yra <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Pateikti</translation>
-<translation id="2657045182931379222">grafikos objektas</translation>
-<translation id="2674318244760992338">poraštė</translation>
-<translation id="2709516037105925701">Automatinis pildymas</translation>
-<translation id="2723001399770238859">garso įrašas</translation>
-<translation id="2746543609216772311">Vertė turi būti <ph name="MINIMUM_DATE_OR_TIME" /> ar vėlesnė data.</translation>
-<translation id="2759744352195237655">Iššokantysis mygtukas</translation>
-<translation id="2761667185364618470">Jei norite tęsti, pažymėkite šį laukelį.</translation>
-<translation id="2844350028562914727">išsami informacija</translation>
-<translation id="2896972712917208084">akučių grupė</translation>
-<translation id="2908441821576996758">Įveskite kableliais atskirtą el. pašto adresų sąrašą.</translation>
-<translation id="2940813599313844715">objektas</translation>
-<translation id="2942448076852699108">paryškintas turinys</translation>
-<translation id="3040011195152428237">nuoroda</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Įveskite tinkamą vertę. Laukas užpildytas nevisiškai arba įvesta netinkama data.</translation>
-<translation id="3078740164268491126">lentelė</translation>
-<translation id="3086746722712840547">pastaba</translation>
-<translation id="310520048233152454">Įveskite URL.</translation>
-<translation id="3175736971608411871">laikmatis</translation>
-<translation id="3199563858620722075">jungtinis laukelis</translation>
-<translation id="3450233048674729344">Vertė turi būti <ph name="MAXIMUM" /> arba mažesnė.</translation>
-<translation id="3486220673238053218">apibrėžimas</translation>
-<translation id="3557673793733683882"><ph name="HEADING_LEVEL" /> antraštė</translation>
-<translation id="3670698553867754311">savaitės rinkiklis</translation>
-<translation id="3685101356851116974">Nepažymėtas vaizdas</translation>
-<translation id="3706100364254443312">jungiklis</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Išeiti iš vaizdo vaizde režimo</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">terminas</translation>
-<translation id="3822383571486410024">Pailginkite šį tekstą iki <ph name="MIN_CHARACTERS" /> simb. ar daugiau (šiuo metu naudojate <ph name="CURRENT_LENGTH" /> simb.).</translation>
-<translation id="383465348367842624">Prieš „<ph name="ATSIGN" />“ esančioje dalyje neturėtų būti simbolio „<ph name="INVALIDCHARACTER" />“.</translation>
-<translation id="3846214748874656680">Išjungti viso ekrano režimą</translation>
-<translation id="3920932319529768807">išvada</translation>
-<translation id="3924558731517983934">programa</translation>
-<translation id="3944740393230681990">prologas</translation>
-<translation id="3960700977367013758">slinkties juosta</translation>
-<translation id="4103419683916926126">Milisekundės</translation>
-<translation id="4151657705144244502">grafinis elementas</translation>
-<translation id="4160057747563657758">telefonas</translation>
-<translation id="4193965531860883258">pratarmė</translation>
-<translation id="4201051445878709314">Rodyti ankstesnį mėnesį</translation>
-<translation id="421884353938374759">spalvos parinkiklis</translation>
-<translation id="4248100235867064564">meniu juosta</translation>
-<translation id="4360991593054037559">Įveskite galiojančią vertę. Dvi artimiausios vertės yra <ph name="VALID_VALUE_LOW" /> ir <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Klausimai ir atsakymai</translation>
-<translation id="4413860115965805769">meniu mygtukas</translation>
-<translation id="4444765639179266822">Tai tikriausiai reiškia: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">aiškinamojo terminų žodyno nuoroda</translation>
-<translation id="4522570452068850558">Išsami informacija</translation>
-<translation id="4542388879936266156">likęs laikas: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">forma</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Po „<ph name="ATSIGN" />“ esančioje dalyje neturėtų būti simbolio „<ph name="INVALIDCHARACTER" />“.</translation>
-<translation id="4668956016107839909">priedas</translation>
-<translation id="4718048029184481307">Leidžiama vaizdo vaizde režimu</translation>
-<translation id="4742539557769756338">viršelis</translation>
-<translation id="4748357248530471599">perjungti ekrano išpjovą į visą ekraną</translation>
-<translation id="4757246831282535685">skirtuko skydelis</translation>
-<translation id="4763480195061959176">vaizdo įrašas</translation>
-<translation id="479989351350248267">ieškoti</translation>
-<translation id="4812940957355064477">Įveskite skaičių.</translation>
-<translation id="4912536737030637138">bibliografijos įrašas</translation>
-<translation id="4975562563186953947">Pasirinkta: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Įjungti garsą</translation>
-<translation id="49969490063480558">Įveskite dalį po „<ph name="ATSIGN" />“. „<ph name="INVALIDADDRESS" />“ nėra visas el. pašto adresas.</translation>
-<translation id="5034860022980953847">eigos indikatorius</translation>
-<translation id="5090250355906949916">vaizdo įrašo laiko valdiklis</translation>
-<translation id="5093189678851173835">epigrafas</translation>
-<translation id="5117590920725113268">Rodyti kitą mėnesį</translation>
-<translation id="512758898067543763">eilutės antraštė</translation>
-<translation id="5143125788380636750">epilogas</translation>
-<translation id="5164977714490026579">Vertė turi būti <ph name="MINIMUM" /> arba didesnė.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Įveskite el. pašto adreso dalį iki „<ph name="ATSIGN" />“. „<ph name="INVALIDADDRESS" />“ nėra visas el. pašto adresas.</translation>
-<translation id="5334352251556557839">Nepavyko paleisti medijos.</translation>
-<translation id="5406322316791861025">iliustracija</translation>
-<translation id="5453733299334684579">medžio elementas</translation>
-<translation id="5466621249238537318">Pasirinkite bent vieną failą.</translation>
-<translation id="5468998798572797635">išeiti iš viso ekrano režimo</translation>
-<translation id="5516424706154626233">datos rinkiklis</translation>
-<translation id="5537725057119320332">Perduoti</translation>
-<translation id="5546461542133609677">įjungti garsą</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Dukart palieskite kairėn arba dešinėn, kad praleistumėte 10 sek.</translation>
-<translation id="5631759159893697722">santrauka</translation>
-<translation id="5643186887447432888">mygtukas</translation>
-<translation id="5677946354068040947">daugiau parinkčių</translation>
-<translation id="576709008726043716">įžanga</translation>
-<translation id="57838592816432529">Nutildyti</translation>
-<translation id="5860033963881614850">Išjungta</translation>
-<translation id="588258955323874662">Visas ekranas</translation>
-<translation id="5888666972993069672">Dabar perduodama į „<ph name="DEVICE_FRIENDLY_NAME" />“</translation>
-<translation id="591047860372322273">paieškos laukelis</translation>
-<translation id="5939518447894949180">Nustatyti iš naujo</translation>
-<translation id="5966707198760109579">Savaitė</translation>
-<translation id="5987525920412732405">sukimo mygtukas</translation>
-<translation id="6011459053400940133">garsumo šliaužiklis</translation>
-<translation id="6015796118275082299">Metai</translation>
-<translation id="6023896073578205740">sąrašo laukelis</translation>
-<translation id="6150588977291308318">bibliografija</translation>
-<translation id="6164829606128959761">matuoklis</translation>
-<translation id="6166809985690652833">baigiamasis žodis</translation>
-<translation id="6209276755895393898">Tai tikriausiai yra: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">aiškinamasis terminų žodynas</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Išeiti iš vaizdo vaizde</translation>
-<translation id="6398862346408813489">Rodyti mėnesio pasirinkimo skydelį</translation>
-<translation id="6404546809543547843">garso laiko valdiklis</translation>
-<translation id="6443871981718447451">rodyti subtitrų meniu</translation>
-<translation id="6453774872122745852">padėka</translation>
-<translation id="648732519525291180">laiko rinkiklis</translation>
-<translation id="6550675742724504774">Parinktys</translation>
-<translation id="6572309429103589720">Netinkama gramatika</translation>
-<translation id="658823671542763450">įjungti viso ekrano režimą</translation>
-<translation id="663493177488814956">sklaidos kanalas</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Išvalyti</translation>
-<translation id="668171684555832681">Kita...</translation>
-<translation id="6692633176391053278">ėjimo aukštyn / žemyn valdiklis</translation>
-<translation id="6709570249143506788">Prasta atkūrimo kokybė</translation>
-<translation id="6755330956360078551">patarimas</translation>
-<translation id="6790428901817661496">Žaisti</translation>
-<translation id="6820355525329141109">Nepavyko įkelti papildinio.</translation>
-<translation id="6820615603175220800">bibliografijos nuoroda</translation>
-<translation id="6843725295806269523">nutildyti</translation>
-<translation id="6885760532393684712">katalogas</translation>
-<translation id="689129560213475294">informacija apie leidimą</translation>
-<translation id="6934078000481955284">citata</translation>
-<translation id="6941933287844615239">atsisiųsti mediją</translation>
-<translation id="6981594929165378967">įterpimas</translation>
-<translation id="6989848892321993519">Pailginkite šį tekstą iki <ph name="MIN_CHARACTERS" /> simb. ar daugiau (šiuo metu naudojate 1 simbolį).</translation>
-<translation id="7033340931668032222">aukštyn ir žemyn – pakeisti garsumą</translation>
-<translation id="709897737746224366">Priderinkite reikalaujamą formatą.</translation>
-<translation id="7118469954320184356">Nepasiekiamas joks aprašas.</translation>
-<translation id="7139483182332611405">įvadas</translation>
-<translation id="7214187073215825913">turinio informacija</translation>
-<translation id="7263440858009898357">Pasirinkite sąraše pateiktą elementą.</translation>
-<translation id="727747134524199931">stulpelio antraštė</translation>
-<translation id="7320576522385648310">rašoma į buferį</translation>
-<translation id="7353453495576941748">padėka</translation>
-<translation id="7364796246159120393">Pasirinkti failą</translation>
-<translation id="739024184232394898">Kita...</translation>
-<translation id="7405738980073107433">išnašos</translation>
-<translation id="7410239719251593705">Panašu, kad yra turinio suaugusiesiems. Nepasiekiamas joks aprašas.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">Tabuliavimo klavišas</translation>
-<translation id="7514365320538308">Atsisiųsti</translation>
-<translation id="7529102961911894712">atgalinė nuoroda</translation>
-<translation id="7533959249147584474">Nepažymėtas grafinis elementas</translation>
-<translation id="7647456547678091388">patarimas</translation>
-<translation id="7661956066982048809">grafikos dokumentas</translation>
-<translation id="7673697353781729403">Valandos</translation>
-<translation id="7681220483256441252">rodyklė</translation>
-<translation id="7740050170769002709">HTML turinys</translation>
-<translation id="7745230546936012372">Jei norite gauti trūkstamus vaizdų aprašus, atidarykite kontekstinį meniu.</translation>
-<translation id="7750228210027921155">Vaizdas vaizde</translation>
-<translation id="775297008183122718">Neteisingas įrašas</translation>
-<translation id="7789962463072032349">pristabdyti</translation>
-<translation id="7802800022689234070">paskelbimo trikampis</translation>
-<translation id="7888071071722539607">Į el. pašto adresą įtraukite „<ph name="ATSIGN" />“. „<ph name="INVALIDADDRESS" />“ trūksta „<ph name="ATSIGN" />“.</translation>
-<translation id="7891486169920085145">skaidiklis</translation>
-<translation id="795667975304826397">Nepasirinktas joks failas</translation>
-<translation id="8053789581856978548">paieškos teksto laukas</translation>
-<translation id="8057695513531652401">pranešimas</translation>
-<translation id="8105797009065549151">pastabos nuoroda</translation>
-<translation id="811583516810654505">Gaunamas aprašas...</translation>
-<translation id="8117451130807776954">Ši savaitė</translation>
-<translation id="8199524924445686405">mmmm</translation>
-<translation id="8208673686607688524">vietos datos ir laiko rinkiklis</translation>
-<translation id="8261464734335370856">Netinkama rašyba</translation>
-<translation id="8284326494547611709">Subtitrai</translation>
-<translation id="835897206747267392">Neteisinga vertė.</translation>
-<translation id="8403857369060869934">praėjęs laikas: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">dalis</translation>
-<translation id="8433900881053900389">įrankių juosta</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> failai (-ų)</translation>
-<translation id="8451268428117625855">Pasirinkite failą.</translation>
-<translation id="8461852803063341183">akutė</translation>
-<translation id="8474886197722836894">dedikacija</translation>
-<translation id="8531739829932800271">spaudos klaidų sąrašas</translation>
-<translation id="8534579021159131403">Minutės</translation>
-<translation id="8541249477527128034">medijos valdiklis</translation>
-<translation id="8550857728288566671">grafikos simbolis</translation>
-<translation id="8583702881314752957">apibrėžimų sąrašas</translation>
-<translation id="8597182159515967513">antraštė</translation>
-<translation id="8603553056539299761">kairėn ir dešinėn – ieškoti</translation>
-<translation id="860475260694818407">turinys</translation>
-<translation id="8613126697340063924">valdyti nuotolinį atkūrimą</translation>
-<translation id="862370744433916922">paantraštė</translation>
-<translation id="8711688047404765493">išvestis</translation>
-<translation id="8750798805984357768">Pasirinkite vieną iš šių parinkčių.</translation>
-<translation id="8808573423886751634">skyrius</translation>
-<translation id="8845239796550121995">Dabar perduodama į TV</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Vaizdo įrašo atkūrimo klaida</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mėnuo</translation>
-<translation id="901493112792887934">dabartinis laikas sekundėmis</translation>
-<translation id="901834265349196618">El. paštas</translation>
-<translation id="9048119486235211610">naršymas</translation>
-<translation id="9062295712474918030">dokumentas</translation>
-<translation id="9062307380734144336">pasirinkite perjungti leidimo / pristabdymo veiksmus</translation>
-<translation id="9093215626363556771">išeiti iš vaizdo vaizde</translation>
-<translation id="9108370397979208512">matematika</translation>
-<translation id="9132465097189459683">Kita...</translation>
-<translation id="9138385573473225930">įspėjimas</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, nuo <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Vaizdas vaizde</translation>
-<translation id="9168329111483466115">išnaša</translation>
-<translation id="954003015749068518">įeiti į vaizdą vaizde</translation>
-<translation id="966787709310836684">meniu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_lv.xtb b/chromium/content/app/strings/translations/content_strings_lv.xtb
deleted file mode 100644
index b42b02cabe6..00000000000
--- a/chromium/content/app/strings/translations/content_strings_lv.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="lv">
-<translation id="1018939186200882850">izvēlnes vienums</translation>
-<translation id="10623998915015855">pārslēgšanas poga</translation>
-<translation id="1088086359088493902">Sekundes</translation>
-<translation id="1171774979989969504">Ievadiet e-pasta adresi.</translation>
-<translation id="1178581264944972037">Pauzēt</translation>
-<translation id="1188858454923323853">papildu</translation>
-<translation id="1206619573307042055">slīdošais teksts</translation>
-<translation id="1206693055195146388">slīdnis</translation>
-<translation id="1211441953136645838">beigu vēre</translation>
-<translation id="1281252709823657822">dialoglodziņš</translation>
-<translation id="1335095011850992622">pateicības</translation>
-<translation id="1342835525016946179">raksts</translation>
-<translation id="1359897965706325498">reklāmkarogs</translation>
-<translation id="1589122976691792535">reģions</translation>
-<translation id="1591562245178063882">Šis mēnesis</translation>
-<translation id="1637811476055996098">Izvēlēties failus</translation>
-<translation id="1650423536718072820">izvilkuma citāts</translation>
-<translation id="1727886345390570319">paslēpt slēgto parakstu izvēlni</translation>
-<translation id="1729654308190250600">Lūdzu, ievadiet e-pasta adresi.</translation>
-<translation id="1758486001363313524">Cits...</translation>
-<translation id="1806710327868736751">brīdinājuma dialoglodziņš</translation>
-<translation id="1821985195704844674">koka režģis</translation>
-<translation id="1822429046913737220">priekšpusdienā/pēcpusdienā</translation>
-<translation id="1832974991323546415">atskaņot attālinātā ierīcē</translation>
-<translation id="190587075670221089">dzēšana</translation>
-<translation id="1907737156431278478">piemērs</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">statuss</translation>
-<translation id="1938124657309484470">Vērtībai ir jābūt “<ph name="MAXIMUM_DATE_OR_TIME" />” vai agrākam datumam vai laikam.</translation>
-<translation id="1946271899482435442">Rādīt datumu atlasītāju</translation>
-<translation id="1993104285338243655">Mainīts uz spoguļošanu</translation>
-<translation id="2060505056492490888">Punkts (<ph name="DOT" />) atrodas nepareizā vietā (<ph name="INVALIDDOMAIN" />).</translation>
-<translation id="2148716181193084225">Šodien</translation>
-<translation id="2158401438286456825">lapu saraksts</translation>
-<translation id="2226276347425096477">Lūdzu, saīsiniet šo tekstu līdz <ph name="MAX_CHARACTERS" /> vai mazāk zīmēm (pašreiz tas ietver <ph name="CURRENT_LENGTH" /> rakstzīmes).</translation>
-<translation id="2246498165605549352">Lokāls fails</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. nedēļa, <ph name="YEAR" />. gads</translation>
-<translation id="2277199496770840904"><ph name="NUMBER" />. ieraksts</translation>
-<translation id="2291999235780842123">izvēles rūtiņa</translation>
-<translation id="2311842470354187719">lappuses pārtraukums</translation>
-<translation id="2335594187091864976">datuma un laika atlasītājs</translation>
-<translation id="245932805758469625">atlikušais video laiks sekundēs</translation>
-<translation id="248395913932153421">Diena</translation>
-<translation id="2507943997699731163">Aizpildiet šo lauku.</translation>
-<translation id="2508569020611168319">ciļņu saraksts</translation>
-<translation id="2561842179657104141">rādīt citas multivides vadīklas</translation>
-<translation id="2572483411312390101">atskaņot</translation>
-<translation id="2613802280814924224">Lūdzu, ievadiet derīgu vērtību. Tuvākā derīgā vērtība ir <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Iesniegt</translation>
-<translation id="2657045182931379222">grafiskais objekts</translation>
-<translation id="2674318244760992338">kājene</translation>
-<translation id="2709516037105925701">Automātiskā aizpilde</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Vērtībai ir jābūt “<ph name="MINIMUM_DATE_OR_TIME" />” vai vēlākam datumam vai laikam.</translation>
-<translation id="2759744352195237655">uznirstoša poga</translation>
-<translation id="2761667185364618470">Lai turpinātu, atzīmējiet šo izvēles rūtiņu.</translation>
-<translation id="2844350028562914727">detalizēta informācija</translation>
-<translation id="2896972712917208084">radiopogu grupa</translation>
-<translation id="2908441821576996758">Lūdzu, ievadiet ar komatu atdalītu e-pasta adrešu sarakstu.</translation>
-<translation id="2940813599313844715">objekts</translation>
-<translation id="2942448076852699108">iezīmētais saturs</translation>
-<translation id="3040011195152428237">saite</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Lūdzu, ievadiet derīgu vērtību. Šis lauks nav pabeigts, vai tajā ir norādīts nederīgs datums.</translation>
-<translation id="3078740164268491126">tabula</translation>
-<translation id="3086746722712840547">piezīme</translation>
-<translation id="310520048233152454">Ievadiet URL.</translation>
-<translation id="3175736971608411871">taimeris</translation>
-<translation id="3199563858620722075">kombinētais lodziņš</translation>
-<translation id="3450233048674729344">Vērtībai ir jābūt mazākai vai vienādai ar <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definīcija</translation>
-<translation id="3557673793733683882"><ph name="HEADING_LEVEL" />. virsraksts</translation>
-<translation id="3670698553867754311">nedēļas atlasītājs</translation>
-<translation id="3685101356851116974">Attēls bez iezīmes</translation>
-<translation id="3706100364254443312">slēdzis</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Iziet no režīma “Attēls attēlā”</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">vārds</translation>
-<translation id="3822383571486410024">Lūdzu, papildiniet šo tekstu līdz vismaz <ph name="MIN_CHARACTERS" /> rakstzīmēm (pašlaik tas ietver <ph name="CURRENT_LENGTH" /> rakstzīmes).</translation>
-<translation id="383465348367842624">Daļā, kas atrodas pirms zīmes <ph name="ATSIGN" />, nedrīkst būt ietverts simbols <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="3846214748874656680">Aizvērt pilnekrāna režīmu</translation>
-<translation id="3920932319529768807">nobeigums</translation>
-<translation id="3924558731517983934">lietojumprogramma</translation>
-<translation id="3944740393230681990">prologs</translation>
-<translation id="3960700977367013758">ritjosla</translation>
-<translation id="4103419683916926126">Milisekundes</translation>
-<translation id="4151657705144244502">grafiskais elements</translation>
-<translation id="4160057747563657758">tālrunis</translation>
-<translation id="4193965531860883258">priekšvārds</translation>
-<translation id="4201051445878709314">Rādīt iepriekšējo mēnesi</translation>
-<translation id="421884353938374759">krāsu izvēle</translation>
-<translation id="4248100235867064564">izvēļņu josla</translation>
-<translation id="4360991593054037559">Lūdzu, ievadiet derīgu vērtību. Divas tuvākās derīgās vērtības ir <ph name="VALID_VALUE_LOW" /> un <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Jautājumi un atbildes</translation>
-<translation id="4413860115965805769">izvēlnes poga</translation>
-<translation id="4444765639179266822">Izklausās: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">atsauce uz glosāriju</translation>
-<translation id="4522570452068850558">Informācija</translation>
-<translation id="4542388879936266156">atlikušais laiks: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">veidlapa</translation>
-<translation id="4661075872484491155">koks</translation>
-<translation id="4664250907885839816">Daļā, kas atrodas aiz zīmes <ph name="ATSIGN" />, nedrīkst būt ietverts simbols <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="4668956016107839909">pielikums</translation>
-<translation id="4718048029184481307">Tiek atskaņots režīmā “Attēls attēlā”</translation>
-<translation id="4742539557769756338">vāks</translation>
-<translation id="4748357248530471599">pārslēdz displeja izgriezuma apgabalu pilnekrāna režīmā</translation>
-<translation id="4757246831282535685">ciļņu panelis</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">meklēt</translation>
-<translation id="4812940957355064477">Lūdzu, ievadiet skaitli.</translation>
-<translation id="4912536737030637138">bibliogrāfijas ieraksts</translation>
-<translation id="4975562563186953947">Atlasīti <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Ieslēgt skaņu</translation>
-<translation id="49969490063480558">Lūdzu, ievadiet daļu, kas atrodas aiz zīmes <ph name="ATSIGN" />. “<ph name="INVALIDADDRESS" />” ir nepilna adrese.</translation>
-<translation id="5034860022980953847">norises indikators</translation>
-<translation id="5090250355906949916">video laika skalas slīdnis</translation>
-<translation id="5093189678851173835">epigrāfs</translation>
-<translation id="5117590920725113268">Rādīt nākamo mēnesi</translation>
-<translation id="512758898067543763">rindas virsraksts</translation>
-<translation id="5143125788380636750">epilogs</translation>
-<translation id="5164977714490026579">Vērtībai ir jābūt lielākai vai vienādai ar <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Lūdzu, ievadiet daļu, kas atrodas pirms zīmes <ph name="ATSIGN" />. “<ph name="INVALIDADDRESS" />” ir nepilna adrese.</translation>
-<translation id="5334352251556557839">Nevar atskaņot multividi.</translation>
-<translation id="5406322316791861025">cipars</translation>
-<translation id="5453733299334684579">koka vienums</translation>
-<translation id="5466621249238537318">Lūdzu, atlasiet vienu vai vairākus failus.</translation>
-<translation id="5468998798572797635">iziet no pilnekrāna režīma</translation>
-<translation id="5516424706154626233">datuma atlasītājs</translation>
-<translation id="5537725057119320332">Apraidīt</translation>
-<translation id="5546461542133609677">rādīt</translation>
-<translation id="561939826962581046">laiks</translation>
-<translation id="5630795885300617244">Veiciet dubultskārienu pa labi vai pa kreisi, lai izlaistu 10 s.</translation>
-<translation id="5631759159893697722">kopsavilkums</translation>
-<translation id="5643186887447432888">poga</translation>
-<translation id="5677946354068040947">citas opcijas</translation>
-<translation id="576709008726043716">ievads</translation>
-<translation id="57838592816432529">Izslēgt skaņu</translation>
-<translation id="5860033963881614850">Izsl.</translation>
-<translation id="588258955323874662">Pilnekrāna</translation>
-<translation id="5888666972993069672">Notiek apraide šajā ierīcē: <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">meklēšanas lodziņš</translation>
-<translation id="5939518447894949180">Atiestatīt</translation>
-<translation id="5966707198760109579">Nedēļa</translation>
-<translation id="5987525920412732405">skaitītājpoga</translation>
-<translation id="6011459053400940133">skaļuma slīdnis</translation>
-<translation id="6015796118275082299">Gads</translation>
-<translation id="6023896073578205740">sarakstlodziņš</translation>
-<translation id="6150588977291308318">bibliogrāfija</translation>
-<translation id="6164829606128959761">mērītājs</translation>
-<translation id="6166809985690652833">pēcvārds</translation>
-<translation id="6209276755895393898">Šķiet, ka tas ir: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosārijs</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Aizvērt režīmu “Attēls attēlā”</translation>
-<translation id="6398862346408813489">Rādīt mēneša atlases paneli</translation>
-<translation id="6404546809543547843">audio laika skalas slīdnis</translation>
-<translation id="6443871981718447451">rādīt slēgto parakstu izvēlni</translation>
-<translation id="6453774872122745852">pateicības</translation>
-<translation id="648732519525291180">laika atlasītājs</translation>
-<translation id="6550675742724504774">Opcijas</translation>
-<translation id="6572309429103589720">Nederīga gramatika</translation>
-<translation id="658823671542763450">atvērt pilnekrāna režīmā</translation>
-<translation id="663493177488814956">plūsma</translation>
-<translation id="6637586476836377253">žurnāls</translation>
-<translation id="6643016212128521049">Notīrīt</translation>
-<translation id="668171684555832681">Cits</translation>
-<translation id="6692633176391053278">pārslēdzējs</translation>
-<translation id="6709570249143506788">Slikta atskaņošanas kvalitāte</translation>
-<translation id="6755330956360078551">rīka padoms</translation>
-<translation id="6790428901817661496">Atskaņot</translation>
-<translation id="6820355525329141109">Nevarēja ielādēt spraudni.</translation>
-<translation id="6820615603175220800">bibliogrāfiskā atsauce</translation>
-<translation id="6843725295806269523">izslēgt skaņu</translation>
-<translation id="6885760532393684712">katalogs</translation>
-<translation id="689129560213475294">izdošanas ziņas</translation>
-<translation id="6934078000481955284">citāta bloks</translation>
-<translation id="6941933287844615239">lejupielādēt multivides failus</translation>
-<translation id="6981594929165378967">ievietošana</translation>
-<translation id="6989848892321993519">Lūdzu, papildiniet šo tekstu līdz vismaz <ph name="MIN_CHARACTERS" /> rakstzīmēm (pašlaik tas ietver 1 rakstzīmi).</translation>
-<translation id="7033340931668032222">augšup un lejup, lai mainītu skaļumu</translation>
-<translation id="709897737746224366">Pieskaņojiet vērtību prasītajam formātam.</translation>
-<translation id="7118469954320184356">Nav apraksta.</translation>
-<translation id="7139483182332611405">ievadraksts</translation>
-<translation id="7214187073215825913">informācija par saturu</translation>
-<translation id="7263440858009898357">Atlasiet vienumu sarakstā.</translation>
-<translation id="727747134524199931">slejas virsraksts</translation>
-<translation id="7320576522385648310">notiek ievietošana buferī</translation>
-<translation id="7353453495576941748">pateicība</translation>
-<translation id="7364796246159120393">Izvēlēties failu</translation>
-<translation id="739024184232394898">Cits...</translation>
-<translation id="7405738980073107433">beigu vēres</translation>
-<translation id="7410239719251593705">Šķiet, ka šis ir pieaugušajiem paredzēts saturs. Nav apraksta</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">cilne</translation>
-<translation id="7514365320538308">Lejupielādēt</translation>
-<translation id="7529102961911894712">atpakaļsaite</translation>
-<translation id="7533959249147584474">Grafika bez atzīmes</translation>
-<translation id="7647456547678091388">padoms</translation>
-<translation id="7661956066982048809">grafikas dokuments</translation>
-<translation id="7673697353781729403">Stundas</translation>
-<translation id="7681220483256441252">rādītājs</translation>
-<translation id="7740050170769002709">HTML saturs</translation>
-<translation id="7745230546936012372">Lai iegūtu trūkstošos attēlu aprakstus, atveriet kontekstizvēlni.</translation>
-<translation id="7750228210027921155">Attēls attēlā</translation>
-<translation id="775297008183122718">Nederīgs ieraksts</translation>
-<translation id="7789962463072032349">pauzēt</translation>
-<translation id="7802800022689234070">satura atklāšanas trijstūris</translation>
-<translation id="7888071071722539607">E-pasta adresē ietveriet zīmi <ph name="ATSIGN" />. Adresē “<ph name="INVALIDADDRESS" />” trūkst zīmes <ph name="ATSIGN" />.</translation>
-<translation id="7891486169920085145">sadalītājs</translation>
-<translation id="795667975304826397">Nav izvēlēts neviens fails</translation>
-<translation id="8053789581856978548">meklēšanas teksta lauks</translation>
-<translation id="8057695513531652401">paziņojums</translation>
-<translation id="8105797009065549151">vēres atsauce</translation>
-<translation id="811583516810654505">Notiek apraksta iegūšana...</translation>
-<translation id="8117451130807776954">Šī nedēļa</translation>
-<translation id="8199524924445686405">gggg</translation>
-<translation id="8208673686607688524">vietējā datuma un laika atlasītājs</translation>
-<translation id="8261464734335370856">Nederīga pareizrakstība</translation>
-<translation id="8284326494547611709">Paraksti</translation>
-<translation id="835897206747267392">Nederīga vērtība.</translation>
-<translation id="8403857369060869934">pagājušais laiks: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">daļa</translation>
-<translation id="8433900881053900389">rīkjosla</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> faili</translation>
-<translation id="8451268428117625855">Lūdzu, atlasiet failu.</translation>
-<translation id="8461852803063341183">radiopoga</translation>
-<translation id="8474886197722836894">veltījums</translation>
-<translation id="8531739829932800271">iespiedkļūdu saraksts</translation>
-<translation id="8534579021159131403">Minūtes</translation>
-<translation id="8541249477527128034">multivides vadība</translation>
-<translation id="8550857728288566671">grafiskais simbols</translation>
-<translation id="8583702881314752957">definīciju saraksts</translation>
-<translation id="8597182159515967513">Virsraksts</translation>
-<translation id="8603553056539299761">pa kreisi un pa labi, lai meklētu</translation>
-<translation id="860475260694818407">satura rādītājs</translation>
-<translation id="8613126697340063924">kontrolēt attālināto atskaņošanu</translation>
-<translation id="862370744433916922">apakšvirsraksts</translation>
-<translation id="8711688047404765493">izvade</translation>
-<translation id="8750798805984357768">Lūdzu, atlasiet vienu no šīm opcijām.</translation>
-<translation id="8808573423886751634">nodaļa</translation>
-<translation id="8845239796550121995">Pašlaik notiek apraide uz jūsu TV</translation>
-<translation id="8851136666856101339">galvenais</translation>
-<translation id="8875657656876809964">Videoklipa atskaņošanas kļūda</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mēnesis</translation>
-<translation id="901493112792887934">pašreizējais laiks sekundēs</translation>
-<translation id="901834265349196618">e-pasts</translation>
-<translation id="9048119486235211610">navigācija</translation>
-<translation id="9062295712474918030">dokuments</translation>
-<translation id="9062307380734144336">lai pārslēgtu no atskaņošanas uz pauzēšanu vai otrādi, atlasiet šo darbību</translation>
-<translation id="9093215626363556771">aizvērt režīmu “attēls attēlā”</translation>
-<translation id="9108370397979208512">matemātiska izteiksme</translation>
-<translation id="9132465097189459683">Cits...</translation>
-<translation id="9138385573473225930">brīdinājums</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, sākot no: <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Attēls attēlā</translation>
-<translation id="9168329111483466115">vēre</translation>
-<translation id="954003015749068518">atvērt režīmu “attēls attēlā”</translation>
-<translation id="966787709310836684">izvēlne</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ml.xtb b/chromium/content/app/strings/translations/content_strings_ml.xtb
deleted file mode 100644
index b3b8f47edd9..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ml.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ml">
-<translation id="1018939186200882850">മെനു ഇനം</translation>
-<translation id="10623998915015855">ടോഗിൾ ബട്ടൺ</translation>
-<translation id="1088086359088493902">സെക്കൻഡ്</translation>
-<translation id="1171774979989969504">ദയവായി ഒരു ഇമെയില്‍ വിലാസം നല്‍കുക.</translation>
-<translation id="1178581264944972037">അല്പംനിര്‍ത്തൂ</translation>
-<translation id="1188858454923323853">കോംപ്ലിമെന്ററി</translation>
-<translation id="1206619573307042055">മാർക്യൂ</translation>
-<translation id="1206693055195146388">സ്ലൈഡർ</translation>
-<translation id="1211441953136645838">അന്തിമ കുറിപ്പ്</translation>
-<translation id="1281252709823657822">ഡയലോഗ്</translation>
-<translation id="1335095011850992622">ക്രെഡിറ്റുകൾ</translation>
-<translation id="1342835525016946179">ലേഖനം</translation>
-<translation id="1359897965706325498">ബാനർ</translation>
-<translation id="1589122976691792535">പ്രദേശം</translation>
-<translation id="1591562245178063882">ഈ മാസം</translation>
-<translation id="1637811476055996098">ഫയലുകൾ തിരഞ്ഞെടുക്കുക</translation>
-<translation id="1650423536718072820">പുൾക്വോട്ട്</translation>
-<translation id="1727886345390570319">സബ്‌ടൈറ്റിൽ മെനു മറയ്ക്കുക</translation>
-<translation id="1729654308190250600">ശൂന്യമായിടാതെ, ഇമെയിൽ വിലാസം നൽകുക.</translation>
-<translation id="1758486001363313524">മറ്റുള്ളവ...</translation>
-<translation id="1806710327868736751">അലേർട്ട്_ഡയലോഗ്</translation>
-<translation id="1821985195704844674">ട്രീ ഗ്രിഡ്</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">റിമോട്ട് ഉപകരണത്തിൽ പ്ലേ ചെയ്യുക</translation>
-<translation id="190587075670221089">ഇല്ലാതാക്കൽ</translation>
-<translation id="1907737156431278478">ഉദാഹരണം</translation>
-<translation id="1921819250265091946">തീയതി</translation>
-<translation id="1930711995431081526">നില</translation>
-<translation id="1938124657309484470">മൂല്യം <ph name="MAXIMUM_DATE_OR_TIME" /> എന്നതോ അതിനുമുമ്പുള്ള തീയതിയോ ആയിരിക്കണം.</translation>
-<translation id="1946271899482435442">തീയതി തിരഞ്ഞെടുക്കൽ കാണിക്കുക</translation>
-<translation id="1993104285338243655">മിററിംഗിലേക്ക് മാറി</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />', '<ph name="INVALIDDOMAIN" />' എന്നതിൽ തെറ്റായ സ്ഥാനത്താണ് ഉപയോഗിച്ചിരിക്കുന്നത്.</translation>
-<translation id="2148716181193084225">ഇന്ന്</translation>
-<translation id="2158401438286456825">പേജ് ലിസ്റ്റ്</translation>
-<translation id="2226276347425096477">ഈ വാചകത്തെ <ph name="MAX_CHARACTERS" /> അല്ലെങ്കില്‍ അതില്‍‌ക്കുറവ് പ്രതീകങ്ങളായി ദയവായി കുറയ്ക്കുക (നിങ്ങള്‍ നിലവില്‍ <ph name="CURRENT_LENGTH" /> പ്രതീകങ്ങള്‍ ഉപയോഗിക്കുകയാണ്).</translation>
-<translation id="2246498165605549352">ലോക്കൽ ഫയൽ</translation>
-<translation id="2247351761944213033">ആഴ്‌ച <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ട്രാക്ക് <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">ചെക്ക്‌ ബോക്‌സ്</translation>
-<translation id="2311842470354187719">പേജ് ബ്രേക്ക്</translation>
-<translation id="2335594187091864976">തീയതിയും സമയ പിക്കറും</translation>
-<translation id="245932805758469625">വീഡിയോയുടെ അവശേഷിക്കുന്ന സമയം സെക്കൻഡിൽ</translation>
-<translation id="248395913932153421">ദിവസം</translation>
-<translation id="2507943997699731163">ദയവായി ഈ ഫീല്‍ഡ് പൂരിപ്പിക്കുക.</translation>
-<translation id="2508569020611168319">ടാബ് ലിസ്റ്റ്</translation>
-<translation id="2561842179657104141">കൂടുതൽ മീഡിയ നിയന്ത്രണങ്ങൾ കാണിക്കുക</translation>
-<translation id="2572483411312390101">പ്ലേ ചെയ്യുക</translation>
-<translation id="2613802280814924224">സാധുവായ ഒരു മൂല്യം നൽകുക. ഏറ്റവുമടുത്ത സാധുവായ മൂല്യം <ph name="VALID_VALUE" /> ആണ്.</translation>
-<translation id="2653659639078652383">സമര്‍പ്പിക്കൂ</translation>
-<translation id="2657045182931379222">ഗ്രാഫിക്‌സ് ഒബ്‌ജക്‌റ്റ്</translation>
-<translation id="2674318244760992338">അടിക്കുറിപ്പ്</translation>
-<translation id="2709516037105925701">സ്വയമേവ പൂരിപ്പിക്കൽ</translation>
-<translation id="2723001399770238859">ഓഡിയോ</translation>
-<translation id="2746543609216772311">മൂല്യം <ph name="MINIMUM_DATE_OR_TIME" /> എന്നതോ അതിനുശേഷമുള്ള തീയതിയോ ആയിരിക്കണം.</translation>
-<translation id="2759744352195237655">പോപ്പ് അപ്പ് ബട്ടൺ</translation>
-<translation id="2761667185364618470">നിങ്ങള്‍ തുടരാന്‍ താല്‍പ്പര്യപ്പെടുന്നെങ്കില്‍ ഈ ബോക്സ് ദയവായി പരിശോധിക്കുക.</translation>
-<translation id="2844350028562914727">വിശദാംശങ്ങൾ</translation>
-<translation id="2896972712917208084">റേഡിയോ ഗ്രൂപ്പ്</translation>
-<translation id="2908441821576996758">ഇമെയില്‍ വിലാസങ്ങളുടെ കോമയാല്‍ വേര്‍തിരിച്ച ഒരു പട്ടിക ദയവായി നല്‍കുക.</translation>
-<translation id="2940813599313844715">ഒബ്‌ജക്‌റ്റ്</translation>
-<translation id="2942448076852699108">ഹൈലൈറ്റുചെയ്‌തിരിക്കുന്ന ഉള്ളടക്കം</translation>
-<translation id="3040011195152428237">ലിങ്ക്</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">ഒരു സാധുതയുള്ള മൂല്യം നൽകുക. ഫീൽഡ് പൂർണ്ണമല്ല അല്ലെങ്കിൽ അസാധുവായ തീയതിയിലുള്ളതാണ്.</translation>
-<translation id="3078740164268491126">പട്ടിക</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">ദയവായി ഒരു URL നല്‍കുക.</translation>
-<translation id="3175736971608411871">ടൈമർ</translation>
-<translation id="3199563858620722075">കോമ്പോ ബോക്‌സ്</translation>
-<translation id="3450233048674729344">മൂല്യം <ph name="MAXIMUM" /> എന്നതില്‍ കുറവോ സമമോ ആയിരിക്കണം.</translation>
-<translation id="3486220673238053218">നിർവചനം</translation>
-<translation id="3557673793733683882">തലക്കെട്ട് <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">ആഴ്‌ച പിക്കർ</translation>
-<translation id="3685101356851116974">ലേബൽ ചെയ്യാത്ത ചിത്രം</translation>
-<translation id="3706100364254443312">സ്വിച്ച്</translation>
-<translation id="3732799496749320381">മാസം</translation>
-<translation id="3754210790023674521">ചിത്രത്തിനുള്ളിലെ ചിത്രത്തിന് പുറത്ത് കടക്കുക</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">പദം</translation>
-<translation id="3822383571486410024">ഈ ടെക്‌സ്റ്റിന്‍റെ ദൈർഘ്യം <ph name="MIN_CHARACTERS" /> അല്ലെങ്കിൽ അതിൽക്കൂടുതൽ പ്രതീകങ്ങൾ നൽകി കൂട്ടുക. (നിങ്ങൾ നിലവിൽ <ph name="CURRENT_LENGTH" /> പ്രതീകങ്ങളാണ് ഉപയോഗിക്കുന്നത്).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' എന്നതിനുശേഷം വരുന്ന ഒരു ഭാഗത്തിൽ '<ph name="INVALIDCHARACTER" />' ചിഹ്നം ഉണ്ടാകരുത്.</translation>
-<translation id="3846214748874656680">പൂർണ്ണ സ്‌ക്രീനിൽ നിന്ന് പുറത്തുകടക്കുക</translation>
-<translation id="3920932319529768807">ഉപസംഹാരം</translation>
-<translation id="3924558731517983934">ആപ്പ്</translation>
-<translation id="3944740393230681990">ആമുഖം</translation>
-<translation id="3960700977367013758">സ്‌ക്രോൾ ബാർ</translation>
-<translation id="4103419683916926126">മില്ലിസെക്കൻഡ്</translation>
-<translation id="4151657705144244502">ഗ്രാഫിക്</translation>
-<translation id="4160057747563657758">ടെലിഫോൺ</translation>
-<translation id="4193965531860883258">മുഖവുര</translation>
-<translation id="4201051445878709314">മുൻ മാസം കാണിക്കുക</translation>
-<translation id="421884353938374759">വർണ്ണ പിക്കർ</translation>
-<translation id="4248100235867064564">മെനു ബാർ</translation>
-<translation id="4360991593054037559">സാധുവായ മൂല്യം നൽകുക. സാധുവായ ഏറ്റവുമടുത്ത രണ്ട് മൂല്യങ്ങൾ <ph name="VALID_VALUE_LOW" />, <ph name="VALID_VALUE_HIGHER" /> എന്നിവയാണ്.</translation>
-<translation id="4384583879834880242">ചോദ്യോത്തരം</translation>
-<translation id="4413860115965805769">മെനു ബട്ടൺ</translation>
-<translation id="4444765639179266822">പറയാൻ ദൃശ്യമാകുന്നത്: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">പദസഞ്ചയ റെഫറൻസ്</translation>
-<translation id="4522570452068850558">വിശദാംശങ്ങൾ‌</translation>
-<translation id="4542388879936266156">അവശേഷിക്കുന്ന സമയം: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ഫോം</translation>
-<translation id="4661075872484491155">ട്രീ</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' എന്നതിനുശേഷം വരുന്ന ഭാഗത്തിൽ '<ph name="INVALIDCHARACTER" />' ചിഹ്നം ഉണ്ടാകരുത്.</translation>
-<translation id="4668956016107839909">അനുബന്ധം</translation>
-<translation id="4718048029184481307">ചിത്രത്തിനുള്ളിൽ ചിത്രത്തിൽ പ്ലേ ചെയ്യുന്നു</translation>
-<translation id="4742539557769756338">കവർ</translation>
-<translation id="4748357248530471599">ഡിസ്‌പ്ലേ കട്ടൗട്ട് പൂർണ്ണ സ്ക്രീൻ മാറ്റുക</translation>
-<translation id="4757246831282535685">ടാബ് പാനൽ</translation>
-<translation id="4763480195061959176">വീഡിയോ</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">ഒരു നമ്പർ നൽകുക.</translation>
-<translation id="4912536737030637138">ഗ്രന്ഥസൂചി എൻട്രി</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> തിരഞ്ഞെടുത്തു</translation>
-<translation id="4992066212339426712">അൺമ്യൂട്ടുചെയ്യുക</translation>
-<translation id="49969490063480558">'<ph name="ATSIGN" />' എന്നതിനുശേഷം ഒരു ഭാഗം നൽകുക.'<ph name="INVALIDADDRESS" />' അപൂർണ്ണമാണ്.</translation>
-<translation id="5034860022980953847">'പ്രോഗ്രസ്' ഇൻഡിക്കേറ്റർ</translation>
-<translation id="5090250355906949916">വീഡിയോ ടൈം സ്‌ക്രബർ</translation>
-<translation id="5093189678851173835">ശിലാലേഖ</translation>
-<translation id="5117590920725113268">അടുത്ത മാസം കാണിക്കുക</translation>
-<translation id="512758898067543763">വരി ശീർഷകം</translation>
-<translation id="5143125788380636750">ഉപസംഹാരം</translation>
-<translation id="5164977714490026579">മൂല്യം <ph name="MINIMUM" /> എന്നതില്‍ കൂടുതലോ സമമോ ആയിരിക്കണം.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">'<ph name="ATSIGN" />' എന്നതിനുശേഷം ഒരു ഭാഗം നൽകുക.'<ph name="INVALIDADDRESS" />' അപൂർണ്ണമാണ്.</translation>
-<translation id="5334352251556557839">മീഡിയ പ്ലേ ചെയ്യാനായില്ല.</translation>
-<translation id="5406322316791861025">ആകാരം</translation>
-<translation id="5453733299334684579">ട്രീ ഇനം</translation>
-<translation id="5466621249238537318">ഒന്നോ അതില്‍ക്കൂടുതലോ ഫയലുകള്‍ ദയവായി തിരഞ്ഞെടുക്കുക.</translation>
-<translation id="5468998798572797635">പൂർണ്ണ സ്‌ക്രീനിൽ നിന്ന് പുറത്തുകടക്കുക</translation>
-<translation id="5516424706154626233">തീയതി പിക്കർ</translation>
-<translation id="5537725057119320332">കാസ്‌റ്റ് ചെയ്യുക</translation>
-<translation id="5546461542133609677">ശബ്‌ദമുള്ളതാക്കുക</translation>
-<translation id="561939826962581046">സമയം</translation>
-<translation id="5630795885300617244">10 സെക്കൻഡ് ഒഴിവാക്കാൻ ഇടത്തോട്ടോ വലത്തോട്ടോ രണ്ടുതവണ ടാപ്പ് ചെയ്യുക</translation>
-<translation id="5631759159893697722">സംക്ഷേപം</translation>
-<translation id="5643186887447432888">ബട്ടൺ</translation>
-<translation id="5677946354068040947">കൂടുതൽ ഓപ്‌ഷനുകൾ</translation>
-<translation id="576709008726043716">ആമുഖം</translation>
-<translation id="57838592816432529">മ്യൂട്ട് ചെയ്യുക</translation>
-<translation id="5860033963881614850">ഓഫാക്കുക</translation>
-<translation id="588258955323874662">പൂര്‍‌ണ്ണസ്‌ക്രീന്‍</translation>
-<translation id="5888666972993069672"><ph name="DEVICE_FRIENDLY_NAME" /> എന്ന ഉപകരണത്തിലേക്ക് കാസ്‌റ്റുചെയ്യുന്നു</translation>
-<translation id="591047860372322273">സെർച്ച് ബോക്‌സ്</translation>
-<translation id="5939518447894949180">വീണ്ടും സജ്ജീകരിക്കുക</translation>
-<translation id="5966707198760109579">ആഴ്‌ച</translation>
-<translation id="5987525920412732405">സ്‌പിൻ ബട്ടൺ</translation>
-<translation id="6011459053400940133">വോളിയം സ്ലൈഡർ</translation>
-<translation id="6015796118275082299">വര്‍ഷം</translation>
-<translation id="6023896073578205740">ലിസ്റ്റ് ബോക്‌സ്</translation>
-<translation id="6150588977291308318">ഗ്രന്ഥസൂചി</translation>
-<translation id="6164829606128959761">മീറ്റർ</translation>
-<translation id="6166809985690652833">പിൻ കുറിപ്പ്</translation>
-<translation id="6209276755895393898">ഇങ്ങനെ ദൃശ്യമാകും: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">പദസഞ്ചയം</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">ചിത്രത്തിനുള്ളിലെ ചിത്രത്തിന് പുറത്ത് കടക്കുക</translation>
-<translation id="6398862346408813489">മാസം തിരഞ്ഞെടുക്കുന്ന പാനൽ കാണിക്കുക</translation>
-<translation id="6404546809543547843">ഓഡിയോ സമയ സ്‌ക്രബർ</translation>
-<translation id="6443871981718447451">സബ്‌ടൈറ്റിൽ മെനു കാണിക്കുക</translation>
-<translation id="6453774872122745852">കടപ്പാട്</translation>
-<translation id="648732519525291180">സമയ പിക്കർ</translation>
-<translation id="6550675742724504774">ഓപ്ഷനുകൾ</translation>
-<translation id="6572309429103589720">അസാധുവായ വ്യാകരണം</translation>
-<translation id="658823671542763450">പൂർണ്ണ സ്‌ക്രീനിലേക്ക് പോവുക</translation>
-<translation id="663493177488814956">ഫീഡ്</translation>
-<translation id="6637586476836377253">ലോഗ്</translation>
-<translation id="6643016212128521049">മായ്‌ക്കുക</translation>
-<translation id="668171684555832681">മറ്റുള്ളവ...</translation>
-<translation id="6692633176391053278">സ്റ്റെപ്പർ</translation>
-<translation id="6709570249143506788">മോശം പ്ലേബാക്ക് നിലവാരം</translation>
-<translation id="6755330956360078551">ടൂൾടിപ്പ്</translation>
-<translation id="6790428901817661496">പ്ലേചെയ്യുക</translation>
-<translation id="6820355525329141109">പ്ലഗിൻ ലോഡ് ചെയ്യാനായില്ല.</translation>
-<translation id="6820615603175220800">ഗ്രന്ഥസൂചി റെഫറൻസ്</translation>
-<translation id="6843725295806269523">നിശബ്‌ദമാക്കുക</translation>
-<translation id="6885760532393684712">ഡയറക്‌റ്ററി</translation>
-<translation id="689129560213475294">അച്ചടിമുദ്ര</translation>
-<translation id="6934078000481955284">ബ്ലോക്ക്‌കോട്ട്</translation>
-<translation id="6941933287844615239">മീഡിയ ഡൗൺലോഡ് ചെയ്യുക</translation>
-<translation id="6981594929165378967">ചേർക്കൽ</translation>
-<translation id="6989848892321993519">ഈ ടെക്‌സ്റ്റിന്‍റെ ദൈർഘ്യം <ph name="MIN_CHARACTERS" /> പ്രതീകങ്ങളോ അതിൽ കൂടുതലോ ആയി വർദ്ധിപ്പിക്കുക (നിങ്ങൾ നിലവിൽ ഒരു പ്രതീകം മാത്രമേ ഉപയോഗിക്കുന്നുള്ളൂ).</translation>
-<translation id="7033340931668032222">ശബ്‌ദം മാറ്റാൻ മുകളിലും താഴെയുമുള്ള ബട്ടണുകളിൽ അമർത്തുക</translation>
-<translation id="709897737746224366">അഭ്യര്‍ത്ഥി ച്ചഫോര്‍മാറ്റ് ദയവായി പൊരുത്തപ്പെടുത്തുക.</translation>
-<translation id="7118469954320184356">വിവരണം ലഭ്യമല്ല.</translation>
-<translation id="7139483182332611405">പീഠിക</translation>
-<translation id="7214187073215825913">ഉള്ളടക്ക വിവരങ്ങൾ</translation>
-<translation id="7263440858009898357">പട്ടികയിലെ ഒരു ഇനം ദയവായി തിരഞ്ഞെടുക്കുക</translation>
-<translation id="727747134524199931">കോളം പേര്</translation>
-<translation id="7320576522385648310">ബഫർ ചെയ്യൽ</translation>
-<translation id="7353453495576941748">ക്രെഡിറ്റ്</translation>
-<translation id="7364796246159120393">ഫയല്‍ തിരഞ്ഞെടുക്കൂ</translation>
-<translation id="739024184232394898">മറ്റുള്ളവ...</translation>
-<translation id="7405738980073107433">അന്തിമ കുറിപ്പുകൾ</translation>
-<translation id="7410239719251593705">മുതിർന്നവർക്കുള്ള ഉള്ളടക്കം അടങ്ങിയിരിക്കുന്നുണ്ടെന്ന് തോന്നുന്നു. വിവരണം ലഭ്യമല്ല.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">ടാബ്</translation>
-<translation id="7514365320538308">ഡൗൺലോഡ് ചെയ്യുക</translation>
-<translation id="7529102961911894712">ബാക്ക്‌ ലിങ്ക്</translation>
-<translation id="7533959249147584474">ലേബൽ ചെയ്യാത്ത ഗ്രാഫിക്</translation>
-<translation id="7647456547678091388">നുറുങ്ങ്</translation>
-<translation id="7661956066982048809">ഗ്രാഫിക്‌സ് ഡോക്യുമെന്റ്</translation>
-<translation id="7673697353781729403">മണിക്കൂര്‍‌</translation>
-<translation id="7681220483256441252">സൂചിക</translation>
-<translation id="7740050170769002709">HTML ഉള്ളടക്കം</translation>
-<translation id="7745230546936012372">വിട്ടുപോയ ചിത്ര വിവരണങ്ങൾ ലഭിക്കാൻ സന്ദർഭ മെനു തുറക്കുക.</translation>
-<translation id="7750228210027921155">ചിത്രത്തിനുള്ളിലെ ചിത്രം</translation>
-<translation id="775297008183122718">എൻട്രി അസാധുവാണ്</translation>
-<translation id="7789962463072032349">താല്‍‌ക്കാലികമായി നിര്‍‌ത്തുക</translation>
-<translation id="7802800022689234070">ഡിസ്‌ക്ലോഷർ ത്രികോണം</translation>
-<translation id="7888071071722539607">ഇമെയിൽ വിലാസത്തിൽ '<ph name="ATSIGN" />' ഉൾപ്പെടുത്തുക. '<ph name="INVALIDADDRESS" />' എന്നതിൽ ഒരു '<ph name="ATSIGN" />' കാണുന്നില്ല.</translation>
-<translation id="7891486169920085145">സ്‌പ്ലിറ്റർ</translation>
-<translation id="795667975304826397">ഒരു ഫയലും തിരഞ്ഞെടുത്തിട്ടില്ല</translation>
-<translation id="8053789581856978548">തിരയൽ ടെക്‌സ്റ്റ് ഫീൽഡ്</translation>
-<translation id="8057695513531652401">അറിയിപ്പ്</translation>
-<translation id="8105797009065549151">കുറിപ്പ് റെഫറൻസ്</translation>
-<translation id="811583516810654505">വിവരണം ലഭ്യമാക്കുന്നു...</translation>
-<translation id="8117451130807776954">ഈ ആഴ്‌ച</translation>
-<translation id="8199524924445686405">വർഷം</translation>
-<translation id="8208673686607688524">പ്രാദേശിക തീയതിയും സമയ പിക്കറും</translation>
-<translation id="8261464734335370856">അക്ഷരത്തെറ്റ്</translation>
-<translation id="8284326494547611709">അടിക്കുറിപ്പുകൾ</translation>
-<translation id="835897206747267392">അസാധുവായ മൂല്യം.</translation>
-<translation id="8403857369060869934">കഴിഞ്ഞ സമയം: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">ഭാഗം</translation>
-<translation id="8433900881053900389">ടൂൾബാർ</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ഫയലുകള്‍</translation>
-<translation id="8451268428117625855">ദയവായി ഒരു ഫയല്‍ തരം തിരഞ്ഞെടുക്കുക.</translation>
-<translation id="8461852803063341183">റേഡിയോ ബട്ടൺ</translation>
-<translation id="8474886197722836894">സമർപ്പണം</translation>
-<translation id="8531739829932800271">സംശോധന പട്ടിക</translation>
-<translation id="8534579021159131403">മിനിറ്റ്</translation>
-<translation id="8541249477527128034">മീഡിയ നിയന്ത്രണം</translation>
-<translation id="8550857728288566671">ഗ്രാഫിക്സ് ചിഹ്നം</translation>
-<translation id="8583702881314752957">നിർവചന ലിസ്റ്റ്</translation>
-<translation id="8597182159515967513">തലക്കെട്ട്</translation>
-<translation id="8603553056539299761">നീക്കാൻ ഇടത്തും വലത്തുമുള്ള ബട്ടണുകളിൽ അമർത്തുക</translation>
-<translation id="860475260694818407">ഉള്ളടക്ക പട്ടിക</translation>
-<translation id="8613126697340063924">വിദൂര പ്ലേബാക്ക് നിയന്ത്രിക്കുക</translation>
-<translation id="862370744433916922">ഉപശീർഷകം</translation>
-<translation id="8711688047404765493">ഔട്ട്‌പുട്ട്</translation>
-<translation id="8750798805984357768">ഈ ഓപ്ഷനുകളിലൊന്ന് ദയവായി തിരഞ്ഞെടുക്കുക.</translation>
-<translation id="8808573423886751634">അധ്യായം</translation>
-<translation id="8845239796550121995">ഇപ്പോൾ നിങ്ങളുടെ ടിവിയിൽ കാസ്‌റ്റുചെയ്യുന്നു</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">വീഡിയോ പ്ലേബാക്ക് പിശക്</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">മാസം</translation>
-<translation id="901493112792887934">നിലവിലെ സമയം നിമിഷങ്ങളിൽ</translation>
-<translation id="901834265349196618">ഇമെയില്‍</translation>
-<translation id="9048119486235211610">നാവിഗേഷൻ</translation>
-<translation id="9062295712474918030">പ്രമാണം</translation>
-<translation id="9062307380734144336">പ്ലേ ചെയ്യുക/തൽക്കാലം നിർത്തുക എന്നിവ മാറ്റാൻ തിരഞ്ഞെടുക്കുക</translation>
-<translation id="9093215626363556771">ചിത്രത്തിനുള്ളിലെ ചിത്രത്തിന് പുറത്ത് കടക്കുക</translation>
-<translation id="9108370397979208512">മാത്ത്</translation>
-<translation id="9132465097189459683">മറ്റുള്ളവ...</translation>
-<translation id="9138385573473225930">അലേർട്ട്</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" />-ന് ആരംഭിക്കുന്നു</translation>
-<translation id="916607977885256133">ചിത്രത്തിനുള്ളിൽ ചിത്രം</translation>
-<translation id="9168329111483466115">അടിക്കുറിപ്പ്</translation>
-<translation id="954003015749068518">ചിത്രത്തിനുള്ളിലെ ചിത്രത്തിലേക്ക് പ്രവേശിക്കുക</translation>
-<translation id="966787709310836684">മെനു</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_mr.xtb b/chromium/content/app/strings/translations/content_strings_mr.xtb
deleted file mode 100644
index 1896217f3ea..00000000000
--- a/chromium/content/app/strings/translations/content_strings_mr.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="mr">
-<translation id="1018939186200882850">मेनू आयटम</translation>
-<translation id="10623998915015855">टॉगल बटण</translation>
-<translation id="1088086359088493902">सेकंद</translation>
-<translation id="1171774979989969504">कृपया एक ईमेल ॲड्रेस एंटर करा.</translation>
-<translation id="1178581264944972037">विराम द्या</translation>
-<translation id="1188858454923323853">पूरक</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">स्लायडर</translation>
-<translation id="1211441953136645838">तळटीप</translation>
-<translation id="1281252709823657822">डायलॉग</translation>
-<translation id="1335095011850992622">श्रेय</translation>
-<translation id="1342835525016946179">लेख</translation>
-<translation id="1359897965706325498">बॅनर</translation>
-<translation id="1589122976691792535">प्रदेश</translation>
-<translation id="1591562245178063882">या महिन्यात</translation>
-<translation id="1637811476055996098">फायली निवडा</translation>
-<translation id="1650423536718072820">पुलकोट</translation>
-<translation id="1727886345390570319">सबटायटल मेनू लपवा</translation>
-<translation id="1729654308190250600">कृपया एक रिक्त नसलेला ईमेल ॲड्रेस एंटर करा.</translation>
-<translation id="1758486001363313524">अन्य...</translation>
-<translation id="1806710327868736751">सूचना_संवाद</translation>
-<translation id="1821985195704844674">ट्री ग्रीड</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">दूरस्थ डिव्हाइसवर प्ले करा</translation>
-<translation id="190587075670221089">हटवणे</translation>
-<translation id="1907737156431278478">उदाहरण</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">स्थिती</translation>
-<translation id="1938124657309484470">मूल्य <ph name="MAXIMUM_DATE_OR_TIME" /> किंवा आधीचे असणे आवश्यक आहे.</translation>
-<translation id="1946271899482435442">तारीख निवडक दाखवा</translation>
-<translation id="1993104285338243655">मिररिंगवर स्विच केले</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' '<ph name="INVALIDDOMAIN" />' मध्ये चुकीच्या स्थितीवर वापरले आहे.</translation>
-<translation id="2148716181193084225">आज</translation>
-<translation id="2158401438286456825">पेज सूची</translation>
-<translation id="2226276347425096477">कृपया हा मजकूर <ph name="MAX_CHARACTERS" /> वर्ण लहान किंवा कमी करा (तुम्ही सध्या <ph name="CURRENT_LENGTH" /> वर्ण वापरत आहात).</translation>
-<translation id="2246498165605549352">स्थानिक फाइल</translation>
-<translation id="2247351761944213033">आठवडा <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ट्रॅक <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">चेकबॉक्‍स</translation>
-<translation id="2311842470354187719">पेज ब्रेक</translation>
-<translation id="2335594187091864976">तारीख आणि वेळ निवडक</translation>
-<translation id="245932805758469625">व्हिडिओच्या शिल्लक सेकंदांची संख्या</translation>
-<translation id="248395913932153421">दिवस</translation>
-<translation id="2507943997699731163">कृपया हे फील्ड भरा.</translation>
-<translation id="2508569020611168319">टॅब सूची</translation>
-<translation id="2561842179657104141">आणखी मीडिया नियंत्रणे दर्शवा</translation>
-<translation id="2572483411312390101">प्ले करा</translation>
-<translation id="2613802280814924224">कृपया एक वैध मूल्य एंटर करा. जवळील वैध मूल्य <ph name="VALID_VALUE" /> आहे.</translation>
-<translation id="2653659639078652383">सबमिट करा</translation>
-<translation id="2657045182931379222">ग्राफिक्स ऑब्जेक्ट</translation>
-<translation id="2674318244760992338">अधोलेख</translation>
-<translation id="2709516037105925701">ऑटोफिल</translation>
-<translation id="2723001399770238859">ऑडिओ</translation>
-<translation id="2746543609216772311">मूल्य <ph name="MINIMUM_DATE_OR_TIME" /> किंवा नंतरचे असणे आवश्यक आहे.</translation>
-<translation id="2759744352195237655">पॉप अप बटण</translation>
-<translation id="2761667185364618470">कृपया तुम्ही पुढे चालू ठेवू इच्छित असल्यास हा बॉक्स पहा.</translation>
-<translation id="2844350028562914727">तपशील</translation>
-<translation id="2896972712917208084">रेडिओ गट</translation>
-<translation id="2908441821576996758">कृपया ईमेल पत्त्यांची स्वल्पविरामाद्वारे विभक्त सूची एंटर करा.</translation>
-<translation id="2940813599313844715">ऑब्जेक्ट</translation>
-<translation id="2942448076852699108">हायलाइट केलेला आशय</translation>
-<translation id="3040011195152428237">लिंक</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">कृपया एक वैध मूल्य एंटर करा. फील्ड अपूर्ण आहे किंवा चुकीची तारीख आहे.</translation>
-<translation id="3078740164268491126">सारणी</translation>
-<translation id="3086746722712840547">टीप</translation>
-<translation id="310520048233152454">कृपया एखादी URL एंटर करा.</translation>
-<translation id="3175736971608411871">टायमर</translation>
-<translation id="3199563858620722075">काँबो बॉक्स</translation>
-<translation id="3450233048674729344">मूल्य <ph name="MAXIMUM" /> पेक्षा कमी किंवा समान असावे.</translation>
-<translation id="3486220673238053218">परिभाषा</translation>
-<translation id="3557673793733683882">शीर्षक <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">आठवडा पिकर</translation>
-<translation id="3685101356851116974">लेबल न केलेली इमेज</translation>
-<translation id="3706100364254443312">स्विच करा</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">चित्रात-चित्र मधून बाहेर पडा</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">संज्ञा</translation>
-<translation id="3822383571486410024">कृपया हा मजकूर <ph name="MIN_CHARACTERS" /> वर्ण किंवा त्यापेक्षा अधिक मोठा करा (तुम्ही सध्‍या <ph name="CURRENT_LENGTH" /> वर्ण वापरत आहात).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' मागुन येणार्‍या भागामध्ये '<ph name="INVALIDCHARACTER" />' चिन्ह नसावे.</translation>
-<translation id="3846214748874656680">क्षेत्रेमधून बाहेर पडा</translation>
-<translation id="3920932319529768807">निष्कर्ष</translation>
-<translation id="3924558731517983934">ॲप्लिकेशन</translation>
-<translation id="3944740393230681990">उपोद्घात</translation>
-<translation id="3960700977367013758">स्क्रोल बार</translation>
-<translation id="4103419683916926126">मिलिसेकंद</translation>
-<translation id="4151657705144244502">ग्राफिक</translation>
-<translation id="4160057747563657758">टेलिफोन</translation>
-<translation id="4193965531860883258">प्रस्तावना</translation>
-<translation id="4201051445878709314">मागील महिना दर्शवा</translation>
-<translation id="421884353938374759">रंग निवडक</translation>
-<translation id="4248100235867064564">मेनू बार</translation>
-<translation id="4360991593054037559">कृपया एक वैध मूल्य एंटर करा. दोन जवळील वैध मूल्ये <ph name="VALID_VALUE_LOW" /> आणि <ph name="VALID_VALUE_HIGHER" /> आहेत.</translation>
-<translation id="4384583879834880242">प्रश्नोत्तरे</translation>
-<translation id="4413860115965805769">मेनू बटण</translation>
-<translation id="4444765639179266822">असे म्हणत असल्याचे दिसत आहे: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">शब्दावली संदर्भ</translation>
-<translation id="4522570452068850558">तपशील</translation>
-<translation id="4542388879936266156">शिल्लक वेळ: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">फॉर्म</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' चे फॉलो करणार्‍या भागामध्ये '<ph name="INVALIDCHARACTER" />' चिन्ह नसावे.</translation>
-<translation id="4668956016107839909">परिशिष्ट</translation>
-<translation id="4718048029184481307">चित्रात-चित्र मध्ये प्ले करत आहे</translation>
-<translation id="4742539557769756338">कव्हर</translation>
-<translation id="4748357248530471599">डिस्प्ले कटआउट फुलस्क्रीन टॉगल करा</translation>
-<translation id="4757246831282535685">टॅब पॅनेल</translation>
-<translation id="4763480195061959176">व्हिडिओ</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">कृपया एक नंबर एंटर करा.</translation>
-<translation id="4912536737030637138">ग्रंथसूची नोंद</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> निवडले</translation>
-<translation id="4992066212339426712">सशब्द करा</translation>
-<translation id="49969490063480558">कृपया '<ph name="ATSIGN" />' चे फॉलो करणारा भाग एंटर करा. '<ph name="INVALIDADDRESS" />' अपूर्ण आहे.</translation>
-<translation id="5034860022980953847">प्रगती सूचक</translation>
-<translation id="5090250355906949916">व्हिडिओ वेळ स्क्रबर</translation>
-<translation id="5093189678851173835">बोधवाक्य</translation>
-<translation id="5117590920725113268">पुढील महिना दर्शवा</translation>
-<translation id="512758898067543763">पंक्ती शीर्षलेख</translation>
-<translation id="5143125788380636750">उपसंहार</translation>
-<translation id="5164977714490026579">मूल्य <ph name="MINIMUM" /> पेक्षा मोठे किंवा समान असावे.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">कृपया '<ph name="ATSIGN" />' मागुन येणारा भाग एंटर करा. '<ph name="INVALIDADDRESS" />' अपूर्ण आहे.</translation>
-<translation id="5334352251556557839">मीडिया प्ले करता आला नाही.</translation>
-<translation id="5406322316791861025">आकृती</translation>
-<translation id="5453733299334684579">ट्री आयटम</translation>
-<translation id="5466621249238537318">कृपया एक किंवा अधिक फायली निवडा.</translation>
-<translation id="5468998798572797635">पूर्ण स्क्रीनमधून निर्गमन करा</translation>
-<translation id="5516424706154626233">तारीख निवडक</translation>
-<translation id="5537725057119320332">कास्ट करा</translation>
-<translation id="5546461542133609677">सशब्द करा</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">10 सेकंद वगळण्यासाठी डावीकडे किंवा उजवीकडे दोनदा टॅप करा</translation>
-<translation id="5631759159893697722">अमूर्त</translation>
-<translation id="5643186887447432888">बटण</translation>
-<translation id="5677946354068040947">अधिक पर्याय</translation>
-<translation id="576709008726043716">परिचय</translation>
-<translation id="57838592816432529">म्यूट करा</translation>
-<translation id="5860033963881614850">बंद</translation>
-<translation id="588258955323874662">क्षेत्रे</translation>
-<translation id="5888666972993069672">आता <ph name="DEVICE_FRIENDLY_NAME" /> वर कास्ट करत आहे</translation>
-<translation id="591047860372322273">सर्च बॉक्स</translation>
-<translation id="5939518447894949180">रीसेट करा</translation>
-<translation id="5966707198760109579">आठवडा</translation>
-<translation id="5987525920412732405">स्पिन बटण</translation>
-<translation id="6011459053400940133">व्हॉल्यूम स्लायडर</translation>
-<translation id="6015796118275082299">वर्ष</translation>
-<translation id="6023896073578205740">सूची बॉक्स</translation>
-<translation id="6150588977291308318">ग्रंथसूची</translation>
-<translation id="6164829606128959761">मीटर</translation>
-<translation id="6166809985690652833">अंतिम शब्द</translation>
-<translation id="6209276755895393898">असे असल्याचे दिसत आहे: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">शब्दावली</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">चित्रात-चित्र मधून बाहेर पडा</translation>
-<translation id="6398862346408813489">महिना निवड पॅनेल दाखवा</translation>
-<translation id="6404546809543547843">ऑडिओ वेळ स्क्रबर</translation>
-<translation id="6443871981718447451">सबटायटल मेनू दाखवा</translation>
-<translation id="6453774872122745852">श्रेयनिर्देश</translation>
-<translation id="648732519525291180">वेळ निवडक</translation>
-<translation id="6550675742724504774">पर्याय</translation>
-<translation id="6572309429103589720">चुकीचे व्याकरण</translation>
-<translation id="658823671542763450">फुल स्क्रीन एंटर करा</translation>
-<translation id="663493177488814956">फीड</translation>
-<translation id="6637586476836377253">लॉग</translation>
-<translation id="6643016212128521049">साफ करा</translation>
-<translation id="668171684555832681">अन्य...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">खराब प्लेबॅक गुणवत्ता</translation>
-<translation id="6755330956360078551">टूलटिप</translation>
-<translation id="6790428901817661496">प्ले करा</translation>
-<translation id="6820355525329141109">प्लग-इन लोड करणे शक्य झाले नाही.</translation>
-<translation id="6820615603175220800">ग्रंथसूची संदर्भ</translation>
-<translation id="6843725295806269523">म्यूट करा</translation>
-<translation id="6885760532393684712">डिरेक्टरी</translation>
-<translation id="689129560213475294">बोधचिन्ह</translation>
-<translation id="6934078000481955284">ब्लॉककोट</translation>
-<translation id="6941933287844615239">मीडिया डाउनलोड करा</translation>
-<translation id="6981594929165378967">घालणे</translation>
-<translation id="6989848892321993519">कृपया हा मजकूर <ph name="MIN_CHARACTERS" /> वर्ण किंवा त्यापेक्षा अधिक मोठा करा (तुम्ही सध्‍या 1 वर्ण वापरत आहात).</translation>
-<translation id="7033340931668032222">व्हॉल्यूम बदलण्यासाठी अप आणि डाउन बटण</translation>
-<translation id="709897737746224366">कृपया विनंती केलेले स्वरूपन जुळवा.</translation>
-<translation id="7118469954320184356">कोणतेही वर्णन उपलब्ध नाही.</translation>
-<translation id="7139483182332611405">प्रस्तावना</translation>
-<translation id="7214187073215825913">आशयाची माहिती</translation>
-<translation id="7263440858009898357">कृपया सूचीमधील आयटम निवडा.</translation>
-<translation id="727747134524199931">स्तंभ शीर्षलेख</translation>
-<translation id="7320576522385648310">बफर होत आहे</translation>
-<translation id="7353453495576941748">श्रेय</translation>
-<translation id="7364796246159120393">फाइल निवडा</translation>
-<translation id="739024184232394898">अन्य...</translation>
-<translation id="7405738980073107433">अंतिम नोंदी</translation>
-<translation id="7410239719251593705">प्रौढांसाठी असलेला आशय असल्याचे वाटत आहे. कोणतेही वर्णन उपलब्ध नाही.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">टॅब</translation>
-<translation id="7514365320538308">डाउनलोड करा</translation>
-<translation id="7529102961911894712">मागील लिंक</translation>
-<translation id="7533959249147584474">लेबल न केलेले ग्राफिक</translation>
-<translation id="7647456547678091388">टीप</translation>
-<translation id="7661956066982048809">ग्राफिक्स दस्तऐवज</translation>
-<translation id="7673697353781729403">तास</translation>
-<translation id="7681220483256441252">अनुक्रमणिका</translation>
-<translation id="7740050170769002709">HTML सामुग्री</translation>
-<translation id="7745230546936012372">नसलेले इमेज वर्णन मिळवण्यासाठी, संदर्भ मेनू उघडा.</translation>
-<translation id="7750228210027921155">चित्रात-चित्र</translation>
-<translation id="775297008183122718">अवैध प्रविष्टी</translation>
-<translation id="7789962463072032349">विराम द्या</translation>
-<translation id="7802800022689234070">त्रिकोण प्रकटन</translation>
-<translation id="7888071071722539607">कृपया ईमेल पत्त्यामध्ये '<ph name="ATSIGN" />' समाविष्ट करा. '<ph name="INVALIDADDRESS" />' '<ph name="ATSIGN" />' गमावत आहे.</translation>
-<translation id="7891486169920085145">विभाजक</translation>
-<translation id="795667975304826397">कोणतीही फाइल निवडलेली नाही</translation>
-<translation id="8053789581856978548">मजकूर फील्ड दर्शवा</translation>
-<translation id="8057695513531652401">सूचना</translation>
-<translation id="8105797009065549151">टीप संदर्भ</translation>
-<translation id="811583516810654505">वर्णन मिळवत आहे...</translation>
-<translation id="8117451130807776954">या आठवड्यात</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">स्थानिक तारीख आणि वेळ पिकर</translation>
-<translation id="8261464734335370856">चुकीचे शब्दलेखन</translation>
-<translation id="8284326494547611709">मथळे</translation>
-<translation id="835897206747267392">चुकीचे मूल्य.</translation>
-<translation id="8403857369060869934">गेलेला वेळ: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">भाग</translation>
-<translation id="8433900881053900389">टूलबार</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> फायली</translation>
-<translation id="8451268428117625855">कृपया एखादी फाइल निवडा.</translation>
-<translation id="8461852803063341183">रेडिओ बटण</translation>
-<translation id="8474886197722836894">अर्पणपत्रिका</translation>
-<translation id="8531739829932800271">शुद्धिपत्रक</translation>
-<translation id="8534579021159131403">मिनिटे</translation>
-<translation id="8541249477527128034">माध्यम नियंत्रण</translation>
-<translation id="8550857728288566671">ग्राफिक्स चिन्ह</translation>
-<translation id="8583702881314752957">परिभाषा सूची</translation>
-<translation id="8597182159515967513">शीर्षलेख</translation>
-<translation id="8603553056539299761">मिळवण्यासाठी डावे आणि उजवे बटण</translation>
-<translation id="860475260694818407">अनुक्रमणिका</translation>
-<translation id="8613126697340063924">दूरस्थ प्लेबॅक नियंत्रित करा</translation>
-<translation id="862370744433916922">उपशीर्षक</translation>
-<translation id="8711688047404765493">आउटपुट</translation>
-<translation id="8750798805984357768">कृपया या पर्यायांपैकी एक निवडा.</translation>
-<translation id="8808573423886751634">प्रकरण</translation>
-<translation id="8845239796550121995">आता तुमच्या टिव्हीवर कास्ट करत आहे</translation>
-<translation id="8851136666856101339">मुख्य</translation>
-<translation id="8875657656876809964">व्हिडिओ प्लेबॅक एरर</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">महिना</translation>
-<translation id="901493112792887934">वर्तमान वेळ सेकंदांमध्ये</translation>
-<translation id="901834265349196618">ईमेल</translation>
-<translation id="9048119486235211610">नेव्हिगेशन</translation>
-<translation id="9062295712474918030">दस्तऐवज</translation>
-<translation id="9062307380734144336">प्ले करणे थांबवणे टॉगल करण्यासाठी निवडा</translation>
-<translation id="9093215626363556771">चित्रात-चित्र मधून बाहेर पडा</translation>
-<translation id="9108370397979208512">गणित</translation>
-<translation id="9132465097189459683">अन्य...</translation>
-<translation id="9138385573473225930">सूचना</translation>
-<translation id="9155987714137265666"><ph name="WEEK_START_DATE" /> रोजी प्रारंभ होणारा, <ph name="WEEK" /></translation>
-<translation id="916607977885256133">चित्रात-चित्र</translation>
-<translation id="9168329111483466115">तळटीप</translation>
-<translation id="954003015749068518">चित्रात-चित्र एंटर करा</translation>
-<translation id="966787709310836684">मेनू</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ms.xtb b/chromium/content/app/strings/translations/content_strings_ms.xtb
deleted file mode 100644
index 644e5cd10a7..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ms.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ms">
-<translation id="1018939186200882850">item menu</translation>
-<translation id="10623998915015855">butang togol</translation>
-<translation id="1088086359088493902">Saat</translation>
-<translation id="1171774979989969504">Sila masukkan alamat e-mel.</translation>
-<translation id="1178581264944972037">Jeda</translation>
-<translation id="1188858454923323853">pelengkap</translation>
-<translation id="1206619573307042055">marki</translation>
-<translation id="1206693055195146388">peluncur</translation>
-<translation id="1211441953136645838">nota hujung</translation>
-<translation id="1281252709823657822">dialog</translation>
-<translation id="1335095011850992622">kredit</translation>
-<translation id="1342835525016946179">artikel</translation>
-<translation id="1359897965706325498">sepanduk</translation>
-<translation id="1589122976691792535">wilayah</translation>
-<translation id="1591562245178063882">Bulan ini</translation>
-<translation id="1637811476055996098">Pilih Fail</translation>
-<translation id="1650423536718072820">petikan tarik keluar</translation>
-<translation id="1727886345390570319">sembunyikan menu sari kata</translation>
-<translation id="1729654308190250600">Sila masukkan alamat e-mel bukan kosong.</translation>
-<translation id="1758486001363313524">Lain-lain...</translation>
-<translation id="1806710327868736751">dialog_makluman</translation>
-<translation id="1821985195704844674">grid pohon</translation>
-<translation id="1822429046913737220">PG / P/M</translation>
-<translation id="1832974991323546415">main pada peranti jauh</translation>
-<translation id="190587075670221089">pemadaman</translation>
-<translation id="1907737156431278478">contoh</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Nilai mestilah <ph name="MAXIMUM_DATE_OR_TIME" /> atau lebih awal.</translation>
-<translation id="1946271899482435442">Tunjukkan pemilih tarikh</translation>
-<translation id="1993104285338243655">Beralih kepada pencerminan</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' digunakan pada kedudukan yang salah dalam '<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">Hari ini</translation>
-<translation id="2158401438286456825">senarai halaman</translation>
-<translation id="2226276347425096477">Sila pendekkan teks ini menjadi <ph name="MAX_CHARACTERS" /> aksara atau kurang (anda kini menggunakan <ph name="CURRENT_LENGTH" /> aksara).</translation>
-<translation id="2246498165605549352">Fail Setempat</translation>
-<translation id="2247351761944213033">Minggu <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Lagu <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">kotak pilihan</translation>
-<translation id="2311842470354187719">pemisah halaman</translation>
-<translation id="2335594187091864976">pemilih tarikh dan masa</translation>
-<translation id="245932805758469625">bilangan saat baki video</translation>
-<translation id="248395913932153421">Hari</translation>
-<translation id="2507943997699731163">Sila isikan medan ini.</translation>
-<translation id="2508569020611168319">senarai tab</translation>
-<translation id="2561842179657104141">tunjukkan lagi kawalan media</translation>
-<translation id="2572483411312390101">main</translation>
-<translation id="2613802280814924224">Sila masukkan nilai yang sah. Nilai sah yang terdekat ialah <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Serah</translation>
-<translation id="2657045182931379222">objek grafik</translation>
-<translation id="2674318244760992338">pembawah</translation>
-<translation id="2709516037105925701">Autoisi</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Nilai mestilah <ph name="MINIMUM_DATE_OR_TIME" /> atau kemudian.</translation>
-<translation id="2759744352195237655">butang timbul</translation>
-<translation id="2761667185364618470">Sila tandakan kotak ini jika anda mahu teruskan.</translation>
-<translation id="2844350028562914727">butiran</translation>
-<translation id="2896972712917208084">kumpulan radio</translation>
-<translation id="2908441821576996758">Sila masukkan senarai alamat e-mel yang dipisahkan dengan koma.</translation>
-<translation id="2940813599313844715">objek</translation>
-<translation id="2942448076852699108">kandungan yang diserlahkan</translation>
-<translation id="3040011195152428237">pautan</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Sila masukkan nilai yang sah. Medan tidak lengkap atau mengandungi tarikh yang tidak sah.</translation>
-<translation id="3078740164268491126">jadual</translation>
-<translation id="3086746722712840547">nota</translation>
-<translation id="310520048233152454">Sila masukkan URL.</translation>
-<translation id="3175736971608411871">pemasa</translation>
-<translation id="3199563858620722075">kotak kombo</translation>
-<translation id="3450233048674729344">Nilai mestilah kurang daripada atau sama dengan <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">takrif</translation>
-<translation id="3557673793733683882">pengepala <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">pemilih minggu</translation>
-<translation id="3685101356851116974">Imej tidak berlabel</translation>
-<translation id="3706100364254443312">tukar</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Keluar daripada gambar dalam gambar</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">istilah</translation>
-<translation id="3822383571486410024">Sila panjangkan teks ini kepada <ph name="MIN_CHARACTERS" /> aksara atau lebih (anda sedang menggunakan <ph name="CURRENT_LENGTH" /> aksara).</translation>
-<translation id="383465348367842624">Bahagian yang diikuti oleh '<ph name="ATSIGN" />' tidak boleh mengandungi simbol '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="3846214748874656680">Keluar dari skrin penuh</translation>
-<translation id="3920932319529768807">kesimpulan</translation>
-<translation id="3924558731517983934">aplikasi</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">bar tatal</translation>
-<translation id="4103419683916926126">Milisaat</translation>
-<translation id="4151657705144244502">grafik</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">kata pengantar</translation>
-<translation id="4201051445878709314">Tunjukkan bulan sebelumnya</translation>
-<translation id="421884353938374759">pemilih warna</translation>
-<translation id="4248100235867064564">bar menu</translation>
-<translation id="4360991593054037559">Sila masukkan nilai yang sah. Dua nilai sah yang terdekat ialah <ph name="VALID_VALUE_LOW" /> dan <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Soal Jawab</translation>
-<translation id="4413860115965805769">butang menu</translation>
-<translation id="4444765639179266822">Nampaknya menyatakan: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">rujukan glosari</translation>
-<translation id="4522570452068850558">Butiran</translation>
-<translation id="4542388879936266156">masa yang tinggal: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">borang</translation>
-<translation id="4661075872484491155">pohon</translation>
-<translation id="4664250907885839816">Bahagian selepas '<ph name="ATSIGN" />' tidak boleh mengandungi simbol '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="4668956016107839909">lampiran</translation>
-<translation id="4718048029184481307">Memainkan video dalam gambar dalam gambar</translation>
-<translation id="4742539557769756338">muka depan</translation>
-<translation id="4748357248530471599">togol skrin penuh potongan paparan</translation>
-<translation id="4757246831282535685">panel tab</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Sila masukkan nombor.</translation>
-<translation id="4912536737030637138">masukan bibliografi</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> dipilih</translation>
-<translation id="4992066212339426712">Nyahredam</translation>
-<translation id="49969490063480558">Sila masukkan bahagian selepas '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' tidak lengkap.</translation>
-<translation id="5034860022980953847">penunjuk kemajuan</translation>
-<translation id="5090250355906949916">pembersih masa video</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Tunjukkan bulan seterusnya</translation>
-<translation id="512758898067543763">pengepala baris</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Nilai mesti lebih besar daripada atau sama dengan <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Sila masukkan bahagian diikuti oleh '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' tidak lengkap.</translation>
-<translation id="5334352251556557839">Tidak dapat memainkan media.</translation>
-<translation id="5406322316791861025">angka</translation>
-<translation id="5453733299334684579">item pohon</translation>
-<translation id="5466621249238537318">Sila pilih satu fail atau lebih.</translation>
-<translation id="5468998798572797635">keluar daripada skrin penuh</translation>
-<translation id="5516424706154626233">pemilih tarikh</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">nyahredam</translation>
-<translation id="561939826962581046">masa</translation>
-<translation id="5630795885300617244">Ketik dua kali ke kiri atau kanan untuk melangkau 10s</translation>
-<translation id="5631759159893697722">abstrak</translation>
-<translation id="5643186887447432888">butang</translation>
-<translation id="5677946354068040947">lagi pilihan</translation>
-<translation id="576709008726043716">pengenalan</translation>
-<translation id="57838592816432529">Redam</translation>
-<translation id="5860033963881614850">Dimatikan</translation>
-<translation id="588258955323874662">Skrin penuh</translation>
-<translation id="5888666972993069672">Sekarang menghantar ke <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">kotak carian</translation>
-<translation id="5939518447894949180">Tetapkan semula</translation>
-<translation id="5966707198760109579">Minggu</translation>
-<translation id="5987525920412732405">butang putar</translation>
-<translation id="6011459053400940133">peluncur kelantangan</translation>
-<translation id="6015796118275082299">Tahun</translation>
-<translation id="6023896073578205740">kotak senarai</translation>
-<translation id="6150588977291308318">bibliografi</translation>
-<translation id="6164829606128959761">meter</translation>
-<translation id="6166809985690652833">kata hujungan</translation>
-<translation id="6209276755895393898">Nampak seperti: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosari</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Keluar daripada Gambar dalam Gambar</translation>
-<translation id="6398862346408813489">Tunjukkan panel pilihan bulan</translation>
-<translation id="6404546809543547843">pembersih masa audio</translation>
-<translation id="6443871981718447451">tunjukkan menu sari kata</translation>
-<translation id="6453774872122745852">perakuan</translation>
-<translation id="648732519525291180">pemilih masa</translation>
-<translation id="6550675742724504774">Pilihan</translation>
-<translation id="6572309429103589720">Tatabahasa tidak sah</translation>
-<translation id="658823671542763450">memasuki skrin penuh</translation>
-<translation id="663493177488814956">suapan</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Kosongkan</translation>
-<translation id="668171684555832681">Lain-lain...</translation>
-<translation id="6692633176391053278">pelangkah</translation>
-<translation id="6709570249143506788">Mutu main balik teruk</translation>
-<translation id="6755330956360078551">tip alat</translation>
-<translation id="6790428901817661496">Mainkan</translation>
-<translation id="6820355525329141109">Tidak dapat memuatkan pemalam.</translation>
-<translation id="6820615603175220800">rujukan bibliografi</translation>
-<translation id="6843725295806269523">redam</translation>
-<translation id="6885760532393684712">direktori</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">petikan blok</translation>
-<translation id="6941933287844615239">muat turun media</translation>
-<translation id="6981594929165378967">penyisipan</translation>
-<translation id="6989848892321993519">Sila panjangkan teks ini kepada <ph name="MIN_CHARACTERS" /> aksara atau lebih (anda sedang menggunakan 1 aksara).</translation>
-<translation id="7033340931668032222">atas dan bawah untuk mengubah kelantangan</translation>
-<translation id="709897737746224366">Sila padankan dengan format yang diminta.</translation>
-<translation id="7118469954320184356">Perihalan tidak tersedia.</translation>
-<translation id="7139483182332611405">kata penghantar</translation>
-<translation id="7214187073215825913">maklumat kandungan</translation>
-<translation id="7263440858009898357">Sila pilih item dalam senarai.</translation>
-<translation id="727747134524199931">pengepala lajur</translation>
-<translation id="7320576522385648310">menimbal</translation>
-<translation id="7353453495576941748">kredit</translation>
-<translation id="7364796246159120393">Pilih Fail</translation>
-<translation id="739024184232394898">Lain-lain...</translation>
-<translation id="7405738980073107433">nota hujung</translation>
-<translation id="7410239719251593705">Nampaknya mengandungi kandungan dewasa. Perihalan tidak tersedia.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Muat Turun</translation>
-<translation id="7529102961911894712">pautan balik</translation>
-<translation id="7533959249147584474">Grafik tidak berlabel</translation>
-<translation id="7647456547678091388">petua</translation>
-<translation id="7661956066982048809">dokumen grafik</translation>
-<translation id="7673697353781729403">Jam</translation>
-<translation id="7681220483256441252">indeks</translation>
-<translation id="7740050170769002709">Kandungan HTML</translation>
-<translation id="7745230546936012372">Untuk mendapatkan perihalan imej yang tiada, buka menu konteks.</translation>
-<translation id="7750228210027921155">Gambar dalam gambar</translation>
-<translation id="775297008183122718">Entri tidak sah</translation>
-<translation id="7789962463072032349">jeda</translation>
-<translation id="7802800022689234070">segi tiga pendedahan</translation>
-<translation id="7888071071722539607">Sila masukkan '<ph name="ATSIGN" />' dalam alamat e-mel. '<ph name="INVALIDADDRESS" />' tiada '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">pemisah</translation>
-<translation id="795667975304826397">Tiada fail dipilih</translation>
-<translation id="8053789581856978548">medan teks carian</translation>
-<translation id="8057695513531652401">notis</translation>
-<translation id="8105797009065549151">rujukan nota</translation>
-<translation id="811583516810654505">Mendapatkan perihalan...</translation>
-<translation id="8117451130807776954">Minggu ini</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">pemilih tarikh dan masa setempat</translation>
-<translation id="8261464734335370856">Ejaan tidak sah</translation>
-<translation id="8284326494547611709">Kapsyen</translation>
-<translation id="835897206747267392">Nilai tidak sah.</translation>
-<translation id="8403857369060869934">masa berlalu: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">bahagian</translation>
-<translation id="8433900881053900389">bar alat</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> fail</translation>
-<translation id="8451268428117625855">Sila pilih fail.</translation>
-<translation id="8461852803063341183">butang radio</translation>
-<translation id="8474886197722836894">dedikasi</translation>
-<translation id="8531739829932800271">ralat</translation>
-<translation id="8534579021159131403">Minit</translation>
-<translation id="8541249477527128034">kawalan media</translation>
-<translation id="8550857728288566671">simbol grafik</translation>
-<translation id="8583702881314752957">senarai takrif</translation>
-<translation id="8597182159515967513">tajuk</translation>
-<translation id="8603553056539299761">kiri dan kanan untuk mencari</translation>
-<translation id="860475260694818407">isi kandungan</translation>
-<translation id="8613126697340063924">kawal main balik jauh</translation>
-<translation id="862370744433916922">sari kata</translation>
-<translation id="8711688047404765493">output</translation>
-<translation id="8750798805984357768">Sila pilih salah satu pilihan ini.</translation>
-<translation id="8808573423886751634">bab</translation>
-<translation id="8845239796550121995">Menghantar ke TV anda sekarang</translation>
-<translation id="8851136666856101339">utama</translation>
-<translation id="8875657656876809964">Ralat main balik video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Bulan</translation>
-<translation id="901493112792887934">masa semasa dalam saat</translation>
-<translation id="901834265349196618">e-mel</translation>
-<translation id="9048119486235211610">navigasi</translation>
-<translation id="9062295712474918030">dokumen</translation>
-<translation id="9062307380734144336">pilih untuk togol main jeda</translation>
-<translation id="9093215626363556771">keluar daripada gambar dalam gambar</translation>
-<translation id="9108370397979208512">matematik</translation>
-<translation id="9132465097189459683">Lain-lain...</translation>
-<translation id="9138385573473225930">makluman</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, bermula pada <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Gambar dalam Gambar</translation>
-<translation id="9168329111483466115">nota kaki</translation>
-<translation id="954003015749068518">masuk ke gambar dalam gambar</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_nl.xtb b/chromium/content/app/strings/translations/content_strings_nl.xtb
deleted file mode 100644
index 63ef10d3d87..00000000000
--- a/chromium/content/app/strings/translations/content_strings_nl.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="nl">
-<translation id="1018939186200882850">menu-item</translation>
-<translation id="10623998915015855">schakelknop</translation>
-<translation id="1088086359088493902">Seconden</translation>
-<translation id="1171774979989969504">Geef een e-mailadres op.</translation>
-<translation id="1178581264944972037">Onderbreken</translation>
-<translation id="1188858454923323853">aanvullend</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">schuifregelaar</translation>
-<translation id="1211441953136645838">eindnoot</translation>
-<translation id="1281252709823657822">dialoogvenster</translation>
-<translation id="1335095011850992622">bronvermelding</translation>
-<translation id="1342835525016946179">artikel</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">regio</translation>
-<translation id="1591562245178063882">Deze maand</translation>
-<translation id="1637811476055996098">Bestanden kiezen</translation>
-<translation id="1650423536718072820">pullquote</translation>
-<translation id="1727886345390570319">ondertitelingsmenu verbergen</translation>
-<translation id="1729654308190250600">Geef een e-mailadres op.</translation>
-<translation id="1758486001363313524">Anders...</translation>
-<translation id="1806710327868736751">dialoogvenster voor meldingen</translation>
-<translation id="1821985195704844674">boomstructuur</translation>
-<translation id="1822429046913737220">a.m./p.m.</translation>
-<translation id="1832974991323546415">afspelen op extern apparaat</translation>
-<translation id="190587075670221089">verwijdering</translation>
-<translation id="1907737156431278478">voorbeeld</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Waarde moet <ph name="MAXIMUM_DATE_OR_TIME" /> of eerder zijn.</translation>
-<translation id="1946271899482435442">Datumkiezer weergeven</translation>
-<translation id="1993104285338243655">Overgeschakeld naar mirroring</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' wordt op een verkeerde positie gebruikt in '<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">Vandaag</translation>
-<translation id="2158401438286456825">paginalijst</translation>
-<translation id="2226276347425096477">Kort deze tekst in tot <ph name="MAX_CHARACTERS" /> tekens of minder (je gebruikt momenteel <ph name="CURRENT_LENGTH" /> tekens).</translation>
-<translation id="2246498165605549352">Lokaal bestand</translation>
-<translation id="2247351761944213033">Week <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Track <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">selectievakje</translation>
-<translation id="2311842470354187719">pagina-einde</translation>
-<translation id="2335594187091864976">datum- en tijdkiezer</translation>
-<translation id="245932805758469625">aantal seconden van resterende video</translation>
-<translation id="248395913932153421">Dag</translation>
-<translation id="2507943997699731163">Vul dit veld in.</translation>
-<translation id="2508569020611168319">tabbladlijst</translation>
-<translation id="2561842179657104141">meer mediabedieningselementen weergeven</translation>
-<translation id="2572483411312390101">afspelen</translation>
-<translation id="2613802280814924224">Geef een geldige waarde op. De dichtstbijzijnde geldige waarde is <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Verzenden</translation>
-<translation id="2657045182931379222">grafisch object</translation>
-<translation id="2674318244760992338">voettekst</translation>
-<translation id="2709516037105925701">Automatisch aanvullen</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Waarde moet <ph name="MINIMUM_DATE_OR_TIME" /> of later zijn.</translation>
-<translation id="2759744352195237655">pop-upknop</translation>
-<translation id="2761667185364618470">Vink dit selectievakje aan als je wilt doorgaan.</translation>
-<translation id="2844350028562914727">details</translation>
-<translation id="2896972712917208084">groep met keuzerondjes</translation>
-<translation id="2908441821576996758">Voer een door komma's gescheiden lijst met e-mailadressen in.</translation>
-<translation id="2940813599313844715">object</translation>
-<translation id="2942448076852699108">gemarkeerde content</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Voer een geldige waarde in. Het veld is onvolledig of bevat een ongeldige datum.</translation>
-<translation id="3078740164268491126">tabel</translation>
-<translation id="3086746722712840547">opmerking</translation>
-<translation id="310520048233152454">Geef een URL op.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">keuzelijst met invoervak</translation>
-<translation id="3450233048674729344">Waarde moet kleiner dan of gelijk zijn aan <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definitie</translation>
-<translation id="3557673793733683882">koptekst <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">weekkiezer</translation>
-<translation id="3685101356851116974">Ongelabelde afbeelding</translation>
-<translation id="3706100364254443312">schakelaar</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Scherm-in-scherm afsluiten</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">term</translation>
-<translation id="3822383571486410024">Breid deze tekst uit tot <ph name="MIN_CHARACTERS" /> tekens of meer (je gebruikt momenteel <ph name="CURRENT_LENGTH" /> tekens).</translation>
-<translation id="383465348367842624">Het naamgedeelte vóór '<ph name="ATSIGN" />' mag niet het teken '<ph name="INVALIDCHARACTER" />' bevatten.</translation>
-<translation id="3846214748874656680">Volledig scherm sluiten</translation>
-<translation id="3920932319529768807">conclusie</translation>
-<translation id="3924558731517983934">app</translation>
-<translation id="3944740393230681990">proloog</translation>
-<translation id="3960700977367013758">scrollbar</translation>
-<translation id="4103419683916926126">Milliseconden</translation>
-<translation id="4151657705144244502">afbeelding</translation>
-<translation id="4160057747563657758">telefoon</translation>
-<translation id="4193965531860883258">voorwoord</translation>
-<translation id="4201051445878709314">Vorige maand weergeven</translation>
-<translation id="421884353938374759">kleurkiezer</translation>
-<translation id="4248100235867064564">menubalk</translation>
-<translation id="4360991593054037559">Geef een geldige waarde op. De twee dichtstbijzijnde geldige waarden zijn <ph name="VALID_VALUE_LOW" /> en <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Q&amp;A</translation>
-<translation id="4413860115965805769">menuknop</translation>
-<translation id="4444765639179266822">Lijkt het volgende te zeggen: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">woordenlijstreferentie</translation>
-<translation id="4522570452068850558">Details</translation>
-<translation id="4542388879936266156">resterende tijd: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulier</translation>
-<translation id="4661075872484491155">structuur</translation>
-<translation id="4664250907885839816">Het adresgedeelte na '<ph name="ATSIGN" />' mag niet het teken '<ph name="INVALIDCHARACTER" />' bevatten.</translation>
-<translation id="4668956016107839909">bijlage</translation>
-<translation id="4718048029184481307">Beeld-in-beeld afspelen</translation>
-<translation id="4742539557769756338">omslag</translation>
-<translation id="4748357248530471599">volledig scherm met display-cutout schakelen</translation>
-<translation id="4757246831282535685">deelvenster met tabblad</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">zoeken</translation>
-<translation id="4812940957355064477">Voer een getal in.</translation>
-<translation id="4912536737030637138">bibliografievermelding</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> geselecteerd</translation>
-<translation id="4992066212339426712">Dempen opheffen</translation>
-<translation id="49969490063480558">Geef een adresgedeelte op na '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' is onvolledig.</translation>
-<translation id="5034860022980953847">voortgangsindicator</translation>
-<translation id="5090250355906949916">scrollbar met tijd van de video</translation>
-<translation id="5093189678851173835">epigraaf</translation>
-<translation id="5117590920725113268">Volgende maand weergeven</translation>
-<translation id="512758898067543763">rijkop</translation>
-<translation id="5143125788380636750">epiloog</translation>
-<translation id="5164977714490026579">Waarde moet groter dan of gelijk zijn aan <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Geef een naamgedeelte op, gevolgd door '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' is onvolledig.</translation>
-<translation id="5334352251556557839">Kan media niet afspelen.</translation>
-<translation id="5406322316791861025">figuur</translation>
-<translation id="5453733299334684579">item in boomstructuur</translation>
-<translation id="5466621249238537318">Selecteer een of meer bestanden.</translation>
-<translation id="5468998798572797635">volledig scherm sluiten</translation>
-<translation id="5516424706154626233">datumkiezer</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">dempen opheffen</translation>
-<translation id="561939826962581046">tijd</translation>
-<translation id="5630795885300617244">Dubbeltik links of rechts om 10 seconden over te slaan</translation>
-<translation id="5631759159893697722">uittreksel</translation>
-<translation id="5643186887447432888">knop</translation>
-<translation id="5677946354068040947">meer opties</translation>
-<translation id="576709008726043716">inleiding</translation>
-<translation id="57838592816432529">Dempen</translation>
-<translation id="5860033963881614850">Uit</translation>
-<translation id="588258955323874662">Volledig scherm</translation>
-<translation id="5888666972993069672">Wordt nu gecast naar <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">zoekvak</translation>
-<translation id="5939518447894949180">Resetten</translation>
-<translation id="5966707198760109579">Week</translation>
-<translation id="5987525920412732405">draaiknop</translation>
-<translation id="6011459053400940133">volumeregelaar</translation>
-<translation id="6015796118275082299">Jaar</translation>
-<translation id="6023896073578205740">keuzelijst</translation>
-<translation id="6150588977291308318">bibliografie</translation>
-<translation id="6164829606128959761">meter</translation>
-<translation id="6166809985690652833">nawoord</translation>
-<translation id="6209276755895393898">Lijkt het volgende te zijn: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">woordenlijst</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Scherm-in-scherm afsluiten</translation>
-<translation id="6398862346408813489">Deelvenster voor maandselectie weergeven</translation>
-<translation id="6404546809543547843">scrollbar met audiotijd</translation>
-<translation id="6443871981718447451">ondertitelingsmenu weergeven</translation>
-<translation id="6453774872122745852">dankwoord</translation>
-<translation id="648732519525291180">tijdkiezer</translation>
-<translation id="6550675742724504774">Opties</translation>
-<translation id="6572309429103589720">Ongeldige grammatica</translation>
-<translation id="658823671542763450">volledig scherm openen</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">logboek</translation>
-<translation id="6643016212128521049">Wissen</translation>
-<translation id="668171684555832681">Anders...</translation>
-<translation id="6692633176391053278">stappenregelaar</translation>
-<translation id="6709570249143506788">Slechte afspeelkwaliteit</translation>
-<translation id="6755330956360078551">knopinfo</translation>
-<translation id="6790428901817661496">Spelen</translation>
-<translation id="6820355525329141109">Kan plug-in niet laden.</translation>
-<translation id="6820615603175220800">bibliografiereferentie</translation>
-<translation id="6843725295806269523">dempen</translation>
-<translation id="6885760532393684712">directory</translation>
-<translation id="689129560213475294">colofon</translation>
-<translation id="6934078000481955284">blok met geciteerde tekst</translation>
-<translation id="6941933287844615239">media downloaden</translation>
-<translation id="6981594929165378967">invoeging</translation>
-<translation id="6989848892321993519">Breid deze tekst uit tot <ph name="MIN_CHARACTERS" /> tekens of meer (je gebruikt momenteel één teken).</translation>
-<translation id="7033340931668032222">omhoog en omlaag om het volume te wijzigen</translation>
-<translation id="709897737746224366">Zorg dat de indeling voldoet aan de gevraagde indeling.</translation>
-<translation id="7118469954320184356">Geen beschrijving beschikbaar.</translation>
-<translation id="7139483182332611405">voorwoord</translation>
-<translation id="7214187073215825913">Gegevens over de content</translation>
-<translation id="7263440858009898357">Selecteer een item in de lijst.</translation>
-<translation id="727747134524199931">kolomkop</translation>
-<translation id="7320576522385648310">bufferen</translation>
-<translation id="7353453495576941748">bronvermelding</translation>
-<translation id="7364796246159120393">Bestand kiezen</translation>
-<translation id="739024184232394898">Anders...</translation>
-<translation id="7405738980073107433">eindnoten</translation>
-<translation id="7410239719251593705">Lijkt content voor volwassenen te bevatten. Geen beschrijving beschikbaar.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Downloaden</translation>
-<translation id="7529102961911894712">back link</translation>
-<translation id="7533959249147584474">Ongelabelde afbeelding</translation>
-<translation id="7647456547678091388">tip</translation>
-<translation id="7661956066982048809">grafisch document</translation>
-<translation id="7673697353781729403">Uur</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">HTML-content</translation>
-<translation id="7745230546936012372">Als je ontbrekende afbeeldingsbeschrijvingen wilt ophalen, open je het contextmenu.</translation>
-<translation id="7750228210027921155">Scherm-in-scherm</translation>
-<translation id="775297008183122718">Ongeldige invoer</translation>
-<translation id="7789962463072032349">onderbreken</translation>
-<translation id="7802800022689234070">driehoek voor samen-/uitvouwen</translation>
-<translation id="7888071071722539607">Gebruik een '<ph name="ATSIGN" />' in het e-mailadres. In '<ph name="INVALIDADDRESS" />' ontbreekt een '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">splitser</translation>
-<translation id="795667975304826397">Geen bestand gekozen</translation>
-<translation id="8053789581856978548">zoektekstveld</translation>
-<translation id="8057695513531652401">kennisgeving</translation>
-<translation id="8105797009065549151">opmerkingsreferentie</translation>
-<translation id="811583516810654505">Beschrijving ophalen…</translation>
-<translation id="8117451130807776954">Deze week</translation>
-<translation id="8199524924445686405">jjjj</translation>
-<translation id="8208673686607688524">lokale datum- en tijdkiezer</translation>
-<translation id="8261464734335370856">Ongeldige spelling</translation>
-<translation id="8284326494547611709">Ondertiteling</translation>
-<translation id="835897206747267392">Ongeldige waarde.</translation>
-<translation id="8403857369060869934">verstreken tijd: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">deel</translation>
-<translation id="8433900881053900389">werkbalk</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> bestanden</translation>
-<translation id="8451268428117625855">Selecteer een bestand.</translation>
-<translation id="8461852803063341183">keuzerondje</translation>
-<translation id="8474886197722836894">opgedragen aan</translation>
-<translation id="8531739829932800271">drukfouten</translation>
-<translation id="8534579021159131403">Minuten</translation>
-<translation id="8541249477527128034">mediacontrole</translation>
-<translation id="8550857728288566671">grafisch symbool</translation>
-<translation id="8583702881314752957">definitielijst</translation>
-<translation id="8597182159515967513">kop</translation>
-<translation id="8603553056539299761">naar links en rechts om te zoeken</translation>
-<translation id="860475260694818407">inhoudsopgave</translation>
-<translation id="8613126697340063924">afspelen bedienen op afstand</translation>
-<translation id="862370744433916922">ondertitel</translation>
-<translation id="8711688047404765493">uitvoer</translation>
-<translation id="8750798805984357768">Selecteer een van deze opties.</translation>
-<translation id="8808573423886751634">hoofdstuk</translation>
-<translation id="8845239796550121995">Wordt nu gecast naar je tv</translation>
-<translation id="8851136666856101339">hoofd</translation>
-<translation id="8875657656876809964">Fout bij afspelen video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" />  KB</translation>
-<translation id="8987927404178983737">Maand</translation>
-<translation id="901493112792887934">huidige tijd in seconden</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navigatie</translation>
-<translation id="9062295712474918030">document</translation>
-<translation id="9062307380734144336">selecteer om te schakelen tussen afspelen en pauzeren</translation>
-<translation id="9093215626363556771">scherm-in-scherm afsluiten</translation>
-<translation id="9108370397979208512">wiskunde</translation>
-<translation id="9132465097189459683">Anders...</translation>
-<translation id="9138385573473225930">melding</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, die begint op <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Scherm-in-scherm</translation>
-<translation id="9168329111483466115">voetnoot</translation>
-<translation id="954003015749068518">scherm-in-scherm openen</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_no.xtb b/chromium/content/app/strings/translations/content_strings_no.xtb
deleted file mode 100644
index 051aed7b305..00000000000
--- a/chromium/content/app/strings/translations/content_strings_no.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="no">
-<translation id="1018939186200882850">menyelement</translation>
-<translation id="10623998915015855">av/på-knapp</translation>
-<translation id="1088086359088493902">Sekunder</translation>
-<translation id="1171774979989969504">Skriv inn en e-postadresse.</translation>
-<translation id="1178581264944972037">Stans midlertidig</translation>
-<translation id="1188858454923323853">komplementær</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">glidebryter</translation>
-<translation id="1211441953136645838">sluttnote</translation>
-<translation id="1281252709823657822">dialog</translation>
-<translation id="1335095011850992622">anerkjennelser</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">område</translation>
-<translation id="1591562245178063882">Denne måneden</translation>
-<translation id="1637811476055996098">Velg filer</translation>
-<translation id="1650423536718072820">sitat</translation>
-<translation id="1727886345390570319">skjul menyen for teksting for hørselshemmede</translation>
-<translation id="1729654308190250600">Skriv inn en ikke-tom e-postadresse.</translation>
-<translation id="1758486001363313524">Andre</translation>
-<translation id="1806710327868736751">varseldialog</translation>
-<translation id="1821985195704844674">trerutenett</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">spill på ekstern enhet</translation>
-<translation id="190587075670221089">sletting</translation>
-<translation id="1907737156431278478">eksempel</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Verdien må være <ph name="MAXIMUM_DATE_OR_TIME" /> eller før.</translation>
-<translation id="1946271899482435442">Vis datovelgeren</translation>
-<translation id="1993104285338243655">Byttet til speiling</translation>
-<translation id="2060505056492490888">«<ph name="DOT" />» er brukt på feil sted i «<ph name="INVALIDDOMAIN" />».</translation>
-<translation id="2148716181193084225">I dag</translation>
-<translation id="2158401438286456825">sideliste</translation>
-<translation id="2226276347425096477">Forkort denne teksten til <ph name="MAX_CHARACTERS" /> tegn eller færre (for øyeblikket bruker du <ph name="CURRENT_LENGTH" /> tegn).</translation>
-<translation id="2246498165605549352">Lokal fil</translation>
-<translation id="2247351761944213033">Uke <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Spor <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">avmerkingsboks</translation>
-<translation id="2311842470354187719">sideskift</translation>
-<translation id="2335594187091864976">dato- og klokkeslettvelger</translation>
-<translation id="245932805758469625">antall sekunder med video som gjenstår</translation>
-<translation id="248395913932153421">Dag</translation>
-<translation id="2507943997699731163">Vennligst fyll ut dette feltet.</translation>
-<translation id="2508569020611168319">faneliste</translation>
-<translation id="2561842179657104141">vis flere mediakontroller</translation>
-<translation id="2572483411312390101">spill av</translation>
-<translation id="2613802280814924224">Skriv inn en gyldig verdi. Den nærmeste, gyldige verdien er <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Send</translation>
-<translation id="2657045182931379222">grafikkobjekt</translation>
-<translation id="2674318244760992338">fotnote</translation>
-<translation id="2709516037105925701">Autofyll</translation>
-<translation id="2723001399770238859">lyd</translation>
-<translation id="2746543609216772311">Verdien må være <ph name="MINIMUM_DATE_OR_TIME" /> eller senere.</translation>
-<translation id="2759744352195237655">forgrunnsknapp</translation>
-<translation id="2761667185364618470">Kryss av denne boksen hvis du vil fortsette.</translation>
-<translation id="2844350028562914727">detaljer</translation>
-<translation id="2896972712917208084">gruppe med alternativknapper</translation>
-<translation id="2908441821576996758">Skriv inn en liste over e-postadresser atskilt med komma.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">merket innhold</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Skriv inn en gyldig verdi. Feltet er ufullstendig, eller har en ugyldig dato.</translation>
-<translation id="3078740164268491126">tabell</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Skriv inn en nettadresse.</translation>
-<translation id="3175736971608411871">nedtelling</translation>
-<translation id="3199563858620722075">kombinasjonsfelt</translation>
-<translation id="3450233048674729344">Verdien må være mindre enn eller lik <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definisjon</translation>
-<translation id="3557673793733683882">overskrift <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">ukevelger</translation>
-<translation id="3685101356851116974">Umerket bilde</translation>
-<translation id="3706100364254443312">bryter</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Avslutt bilde-i-bilde</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">term</translation>
-<translation id="3822383571486410024">Du må forlenge denne teksten til <ph name="MIN_CHARACTERS" /> tegn eller mer (for øyeblikket bruker du <ph name="CURRENT_LENGTH" /> tegn).</translation>
-<translation id="383465348367842624">En del etterfulgt av «<ph name="ATSIGN" />» kan ikke inneholde symbolet «<ph name="INVALIDCHARACTER" />».</translation>
-<translation id="3846214748874656680">Avslutt fullskjermmodus</translation>
-<translation id="3920932319529768807">konklusjon</translation>
-<translation id="3924558731517983934">program</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">rullefelt</translation>
-<translation id="4103419683916926126">Millisekunder</translation>
-<translation id="4151657705144244502">grafikk</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">forord</translation>
-<translation id="4201051445878709314">Se forrige måned</translation>
-<translation id="421884353938374759">fargevelger</translation>
-<translation id="4248100235867064564">menyrad</translation>
-<translation id="4360991593054037559">Skriv inn en gyldig verdi. De to nærmeste, gyldige verdiene er <ph name="VALID_VALUE_LOW" /> og <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Spørsmål og svar</translation>
-<translation id="4413860115965805769">menyknapp</translation>
-<translation id="4444765639179266822">Det ser ut til at det står <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">ordlistereferanse</translation>
-<translation id="4522570452068850558">Detaljer</translation>
-<translation id="4542388879936266156">tid som gjenstår: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">skjema</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">En del etterfulgt av «<ph name="ATSIGN" />» kan ikke inneholde symbolet «<ph name="INVALIDCHARACTER" />».</translation>
-<translation id="4668956016107839909">vedlegg</translation>
-<translation id="4718048029184481307">Spiller av i bilde-i-bilde</translation>
-<translation id="4742539557769756338">omslag</translation>
-<translation id="4748357248530471599">slå av/på fullskjermsvisning av skjermutklipp</translation>
-<translation id="4757246831282535685">fanepanel</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">søk</translation>
-<translation id="4812940957355064477">Skriv inn et tall.</translation>
-<translation id="4912536737030637138">bibliografioppføring</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> er valgt</translation>
-<translation id="4992066212339426712">Slå på lyden</translation>
-<translation id="49969490063480558">Skriv inn en del etterfulgt av «<ph name="ATSIGN" />». «<ph name="INVALIDADDRESS" />» er ufullstendig.</translation>
-<translation id="5034860022980953847">fremdriftsindikator</translation>
-<translation id="5090250355906949916">videotidslinje</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Se neste måned</translation>
-<translation id="512758898067543763">radoverskrift</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Verdien må være større enn eller lik <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Skriv inn en del etterfulgt av «<ph name="ATSIGN" />». «<ph name="INVALIDADDRESS" />» er ufullstendig.</translation>
-<translation id="5334352251556557839">Kunne ikke spille innholdet.</translation>
-<translation id="5406322316791861025">figur</translation>
-<translation id="5453733299334684579">treelement</translation>
-<translation id="5466621249238537318">Velg én eller flere filer.</translation>
-<translation id="5468998798572797635">avslutt fullskjerm</translation>
-<translation id="5516424706154626233">datovelger</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">slå på lyden</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Dobbelttrykk på venstre eller høyre side for å hoppe 10 sekunder</translation>
-<translation id="5631759159893697722">abstrakt</translation>
-<translation id="5643186887447432888">knapp</translation>
-<translation id="5677946354068040947">flere alternativer</translation>
-<translation id="576709008726043716">innledning</translation>
-<translation id="57838592816432529">Kutt lyden</translation>
-<translation id="5860033963881614850">Av</translation>
-<translation id="588258955323874662">Fullskjerm</translation>
-<translation id="5888666972993069672">Caster nå til <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">søkefelt</translation>
-<translation id="5939518447894949180">Tilbakestill</translation>
-<translation id="5966707198760109579">Uke</translation>
-<translation id="5987525920412732405">verdisettingsknapp</translation>
-<translation id="6011459053400940133">glidebryter for volum</translation>
-<translation id="6015796118275082299">År</translation>
-<translation id="6023896073578205740">listefelt</translation>
-<translation id="6150588977291308318">bibliografi</translation>
-<translation id="6164829606128959761">måler</translation>
-<translation id="6166809985690652833">etterord</translation>
-<translation id="6209276755895393898">Dette ser ut til å være <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">ordliste</translation>
-<translation id="6281763101136022427">nettadresse</translation>
-<translation id="6310801910862476708">Avslutt bilde-i-bilde</translation>
-<translation id="6398862346408813489">Se panelet for valg av måned</translation>
-<translation id="6404546809543547843">lydtidslinje</translation>
-<translation id="6443871981718447451">vis menyen for teksting for hørselshemmede</translation>
-<translation id="6453774872122745852">omtale</translation>
-<translation id="648732519525291180">klokkeslettvelger</translation>
-<translation id="6550675742724504774">Alternativer</translation>
-<translation id="6572309429103589720">Grammatikkfeil</translation>
-<translation id="658823671542763450">gå til fullskjermmodus</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">logg</translation>
-<translation id="6643016212128521049">Tøm</translation>
-<translation id="668171684555832681">Annen</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Dårlig avspillingskvalitet</translation>
-<translation id="6755330956360078551">verktøytips</translation>
-<translation id="6790428901817661496">Spill av</translation>
-<translation id="6820355525329141109">Kunne ikke laste inn programtillegget.</translation>
-<translation id="6820615603175220800">bibliografireferanse</translation>
-<translation id="6843725295806269523">kutt lyd</translation>
-<translation id="6885760532393684712">katalog</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">blokksitat</translation>
-<translation id="6941933287844615239">last ned medier</translation>
-<translation id="6981594929165378967">innsetting</translation>
-<translation id="6989848892321993519">Øk lengden på denne teksten med minst <ph name="MIN_CHARACTERS" /> tegn (du bruker for øyeblikket 1 tegn).</translation>
-<translation id="7033340931668032222">opp og ned for å endre volum</translation>
-<translation id="709897737746224366">Sørg for samsvar med det forespurte formatet.</translation>
-<translation id="7118469954320184356">Ingen beskrivelse er tilgjengelig.</translation>
-<translation id="7139483182332611405">forord</translation>
-<translation id="7214187073215825913">innholdsinformasjon</translation>
-<translation id="7263440858009898357">Velg en artikkel i listen.</translation>
-<translation id="727747134524199931">kolonneoverskrift</translation>
-<translation id="7320576522385648310">bufring</translation>
-<translation id="7353453495576941748">anerkjennelse</translation>
-<translation id="7364796246159120393">Velg fil</translation>
-<translation id="739024184232394898">Andre</translation>
-<translation id="7405738980073107433">sluttnoter</translation>
-<translation id="7410239719251593705">Ser ut til å inneholde seksuelt innhold. Ingen beskrivelse er tilgjengelig.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Last ned</translation>
-<translation id="7529102961911894712">tilbakelink</translation>
-<translation id="7533959249147584474">Umerket grafikk</translation>
-<translation id="7647456547678091388">tips</translation>
-<translation id="7661956066982048809">grafikkdokument</translation>
-<translation id="7673697353781729403">Timer</translation>
-<translation id="7681220483256441252">stikkordregister</translation>
-<translation id="7740050170769002709">HTML-innhold</translation>
-<translation id="7745230546936012372">For å hente manglende bildebeskrivelser, åpne den kontekstuelle menyen.</translation>
-<translation id="7750228210027921155">Bilde i bilde</translation>
-<translation id="775297008183122718">Ugyldig oppføring</translation>
-<translation id="7789962463072032349">stans midlertidig</translation>
-<translation id="7802800022689234070">trekant for ekstra innhold</translation>
-<translation id="7888071071722539607">Inkluder en «<ph name="ATSIGN" />» i e-postadressen. «<ph name="INVALIDADDRESS" />» mangler en «<ph name="ATSIGN" />».</translation>
-<translation id="7891486169920085145">vindusdeler</translation>
-<translation id="795667975304826397">Ingen fil valgt</translation>
-<translation id="8053789581856978548">søketekstfelt</translation>
-<translation id="8057695513531652401">merknad</translation>
-<translation id="8105797009065549151">kommentarreferanse</translation>
-<translation id="811583516810654505">Henter beskrivelse …</translation>
-<translation id="8117451130807776954">Denne uken</translation>
-<translation id="8199524924445686405">åååå</translation>
-<translation id="8208673686607688524">lokaldato- og -klokkeslettvelger</translation>
-<translation id="8261464734335370856">Stavefeil</translation>
-<translation id="8284326494547611709">Teksting</translation>
-<translation id="835897206747267392">Ugyldig verdi</translation>
-<translation id="8403857369060869934">medgått tid: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">del</translation>
-<translation id="8433900881053900389">verktøyrad</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> filer</translation>
-<translation id="8451268428117625855">Velg en fil.</translation>
-<translation id="8461852803063341183">alternativknapp</translation>
-<translation id="8474886197722836894">dedikasjon</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutter</translation>
-<translation id="8541249477527128034">mediekontroll</translation>
-<translation id="8550857728288566671">grafikksymbol</translation>
-<translation id="8583702881314752957">definisjonsliste</translation>
-<translation id="8597182159515967513">overskrift</translation>
-<translation id="8603553056539299761">venstre og høyre for å hoppe</translation>
-<translation id="860475260694818407">innholdsfortegnelse</translation>
-<translation id="8613126697340063924">kontrollér ekstern avspilling</translation>
-<translation id="862370744433916922">undertittel</translation>
-<translation id="8711688047404765493">utdata</translation>
-<translation id="8750798805984357768">Velg ett av følgende alternativer.</translation>
-<translation id="8808573423886751634">kapittel</translation>
-<translation id="8845239796550121995">Caster til TV-en nå</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Feil ved videoavspilling</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Måned</translation>
-<translation id="901493112792887934">gjeldende tid i sekunder</translation>
-<translation id="901834265349196618">e-post</translation>
-<translation id="9048119486235211610">navigasjon</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">velg for å veksle mellom avspilling og pause</translation>
-<translation id="9093215626363556771">avslutt bilde-i-bilde</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Andre</translation>
-<translation id="9138385573473225930">varsel</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, med start <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Bilde i bilde</translation>
-<translation id="9168329111483466115">fotnote</translation>
-<translation id="954003015749068518">start bilde-i-bilde</translation>
-<translation id="966787709310836684">meny</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_pl.xtb b/chromium/content/app/strings/translations/content_strings_pl.xtb
deleted file mode 100644
index 3307ca2e6fa..00000000000
--- a/chromium/content/app/strings/translations/content_strings_pl.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="pl">
-<translation id="1018939186200882850">element menu</translation>
-<translation id="10623998915015855">przycisk przełączania</translation>
-<translation id="1088086359088493902">Sekundy</translation>
-<translation id="1171774979989969504">Wprowadź adres e-mail.</translation>
-<translation id="1178581264944972037">Wstrzymaj</translation>
-<translation id="1188858454923323853">pomocniczy</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">suwak</translation>
-<translation id="1211441953136645838">przypis końcowy</translation>
-<translation id="1281252709823657822">okno dialogowe</translation>
-<translation id="1335095011850992622">autorzy</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">baner</translation>
-<translation id="1589122976691792535">region</translation>
-<translation id="1591562245178063882">W tym miesiącu</translation>
-<translation id="1637811476055996098">Wybierz pliki</translation>
-<translation id="1650423536718072820">cytat</translation>
-<translation id="1727886345390570319">ukrywanie menu napisów</translation>
-<translation id="1729654308190250600">Podaj adres e-mail.</translation>
-<translation id="1758486001363313524">Inny...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">siatka drzewa</translation>
-<translation id="1822429046913737220">rano/po południu</translation>
-<translation id="1832974991323546415">odtwarzanie na urządzeniu zdalnym</translation>
-<translation id="190587075670221089">usunięcie</translation>
-<translation id="1907737156431278478">przykład</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">stan</translation>
-<translation id="1938124657309484470">Musisz podać wartość <ph name="MAXIMUM_DATE_OR_TIME" /> lub wcześniejszą.</translation>
-<translation id="1946271899482435442">Pokaż selektor dat</translation>
-<translation id="1993104285338243655">Przełączono na odbicie lustrzane</translation>
-<translation id="2060505056492490888">„<ph name="DOT" />” występuje w niewłaściwym miejscu w „<ph name="INVALIDDOMAIN" />”.</translation>
-<translation id="2148716181193084225">Dzisiaj</translation>
-<translation id="2158401438286456825">lista stron</translation>
-<translation id="2226276347425096477">Skróć ten tekst do maksymalnie <ph name="MAX_CHARACTERS" /> znaków (w tej chwili korzystasz z <ph name="CURRENT_LENGTH" /> znaków).</translation>
-<translation id="2246498165605549352">Plik lokalny</translation>
-<translation id="2247351761944213033">Tydzień <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Utwór <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">pole wyboru</translation>
-<translation id="2311842470354187719">podział strony</translation>
-<translation id="2335594187091864976">selektor daty i godziny</translation>
-<translation id="245932805758469625">pozostały czas filmu w sekundach</translation>
-<translation id="248395913932153421">Dzień</translation>
-<translation id="2507943997699731163">Wypełnij to pole.</translation>
-<translation id="2508569020611168319">lista kart</translation>
-<translation id="2561842179657104141">pokaż więcej opcji sterowania multimediami</translation>
-<translation id="2572483411312390101">odtwórz</translation>
-<translation id="2613802280814924224">Podaj prawidłową wartość. Najbliższa prawidłowa wartość to <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Prześlij</translation>
-<translation id="2657045182931379222">obiekt graficzny</translation>
-<translation id="2674318244760992338">stopka</translation>
-<translation id="2709516037105925701">Autouzupełnianie</translation>
-<translation id="2723001399770238859">dźwięk</translation>
-<translation id="2746543609216772311">Musisz podać wartość <ph name="MINIMUM_DATE_OR_TIME" /> lub późniejszą.</translation>
-<translation id="2759744352195237655">przycisk wyskakującego okienka</translation>
-<translation id="2761667185364618470">Zaznacz to pole, jeśli chcesz kontynuować.</translation>
-<translation id="2844350028562914727">szczegóły</translation>
-<translation id="2896972712917208084">grupa przycisków opcji</translation>
-<translation id="2908441821576996758">Podaj listę adresów e-mail rozdzielonych przecinkami.</translation>
-<translation id="2940813599313844715">obiekt</translation>
-<translation id="2942448076852699108">wyróżniona treść</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Wpisz prawidłową wartość. Pole jest niekompletne lub zawiera nieprawidłową datę.</translation>
-<translation id="3078740164268491126">tabela</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Wprowadź adres URL.</translation>
-<translation id="3175736971608411871">licznik czasu</translation>
-<translation id="3199563858620722075">pole złożone</translation>
-<translation id="3450233048674729344">Wartość nie może być większa niż <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definicja</translation>
-<translation id="3557673793733683882">nagłówek <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selektor tygodnia</translation>
-<translation id="3685101356851116974">Obraz bez etykiety</translation>
-<translation id="3706100364254443312">przełącznik</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Wyłącz tryb obrazu w obrazie</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">termin</translation>
-<translation id="3822383571486410024">Wydłuż ten tekst przynajmniej do <ph name="MIN_CHARACTERS" /> znaków (teraz używasz <ph name="CURRENT_LENGTH" /> znaków).</translation>
-<translation id="383465348367842624">Część przed znakiem „<ph name="ATSIGN" />” nie może zawierać symbolu „<ph name="INVALIDCHARACTER" />”.</translation>
-<translation id="3846214748874656680">Zamknij pełny ekran</translation>
-<translation id="3920932319529768807">podsumowanie</translation>
-<translation id="3924558731517983934">aplikacja</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">pasek przewijania</translation>
-<translation id="4103419683916926126">Milisekundy</translation>
-<translation id="4151657705144244502">grafika</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">przedmowa</translation>
-<translation id="4201051445878709314">Pokaż poprzedni miesiąc</translation>
-<translation id="421884353938374759">selektor kolorów</translation>
-<translation id="4248100235867064564">pasek menu</translation>
-<translation id="4360991593054037559">Podaj prawidłową wartość. Dwie najbliższe prawidłowe wartości to <ph name="VALID_VALUE_LOW" /> i <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Pytania i odpowiedzi</translation>
-<translation id="4413860115965805769">przycisk menu</translation>
-<translation id="4444765639179266822">Wygląda jak napis: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">odniesienie do słownika</translation>
-<translation id="4522570452068850558">Szczegóły</translation>
-<translation id="4542388879936266156">pozostało: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formularz</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Część po znaku „<ph name="ATSIGN" />” nie może zawierać symbolu „<ph name="INVALIDCHARACTER" />”.</translation>
-<translation id="4668956016107839909">dodatek</translation>
-<translation id="4718048029184481307">Odtwarzam w trybie obrazu w obrazie</translation>
-<translation id="4742539557769756338">okładka</translation>
-<translation id="4748357248530471599">przełącz z wycięcia w ekranie na tryb pełnoekranowy</translation>
-<translation id="4757246831282535685">panel karty</translation>
-<translation id="4763480195061959176">film</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Wpisz liczbę.</translation>
-<translation id="4912536737030637138">pozycja bibliograficzna</translation>
-<translation id="4975562563186953947">Wybrano: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Wyłącz wyciszenie</translation>
-<translation id="49969490063480558">Podaj część po znaku „<ph name="ATSIGN" />”. Adres „<ph name="INVALIDADDRESS" />” jest niepełny.</translation>
-<translation id="5034860022980953847">wskaźnik postępu</translation>
-<translation id="5090250355906949916">pasek czasu odtwarzania filmu</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Pokaż przyszły miesiąc</translation>
-<translation id="512758898067543763">nagłówek wiersza</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Wartość nie może być mniejsza niż <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Podaj część przed znakiem „<ph name="ATSIGN" />”. Adres „<ph name="INVALIDADDRESS" />” jest niepełny.</translation>
-<translation id="5334352251556557839">Nie można odtworzyć multimediów.</translation>
-<translation id="5406322316791861025">figura</translation>
-<translation id="5453733299334684579">element drzewa</translation>
-<translation id="5466621249238537318">Wybierz jeden lub kilka plików.</translation>
-<translation id="5468998798572797635">zamknij pełny ekran</translation>
-<translation id="5516424706154626233">selektor daty</translation>
-<translation id="5537725057119320332">Przesyłaj</translation>
-<translation id="5546461542133609677">wyłącz wyciszenie</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Kliknij dwukrotnie z lewej lub prawej, by przewinąć o 10 s</translation>
-<translation id="5631759159893697722">streszczenie</translation>
-<translation id="5643186887447432888">przycisk</translation>
-<translation id="5677946354068040947">więcej opcji</translation>
-<translation id="576709008726043716">wprowadzenie</translation>
-<translation id="57838592816432529">Wycisz</translation>
-<translation id="5860033963881614850">Wyłączone</translation>
-<translation id="588258955323874662">Pełny ekran</translation>
-<translation id="5888666972993069672">Przesyłam na urządzenie <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">pole wyszukiwania</translation>
-<translation id="5939518447894949180">Resetuj</translation>
-<translation id="5966707198760109579">Tydzień</translation>
-<translation id="5987525920412732405">przycisk przewijany</translation>
-<translation id="6011459053400940133">suwak głośności</translation>
-<translation id="6015796118275082299">Rok</translation>
-<translation id="6023896073578205740">pole listy</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">miernik</translation>
-<translation id="6166809985690652833">posłowie</translation>
-<translation id="6209276755895393898">Wygląda jak: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">słownik</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Wyłącz tryb obrazu w obrazie</translation>
-<translation id="6398862346408813489">Pokaż panel wyboru miesiąca</translation>
-<translation id="6404546809543547843">pasek czasu odtwarzania dźwięku</translation>
-<translation id="6443871981718447451">wyświetlanie menu napisów</translation>
-<translation id="6453774872122745852">podziękowania</translation>
-<translation id="648732519525291180">selektor godziny</translation>
-<translation id="6550675742724504774">Opcje</translation>
-<translation id="6572309429103589720">Nieprawidłowa gramatyka</translation>
-<translation id="658823671542763450">przejdź do pełnego ekranu</translation>
-<translation id="663493177488814956">kanał</translation>
-<translation id="6637586476836377253">dziennik</translation>
-<translation id="6643016212128521049">Wyczyść</translation>
-<translation id="668171684555832681">Inny...</translation>
-<translation id="6692633176391053278">element kroczący</translation>
-<translation id="6709570249143506788">Niska jakość odtwarzania</translation>
-<translation id="6755330956360078551">etykietka</translation>
-<translation id="6790428901817661496">Odtwórz</translation>
-<translation id="6820355525329141109">Nie można załadować wtyczki.</translation>
-<translation id="6820615603175220800">odniesienie bibliograficzne</translation>
-<translation id="6843725295806269523">wyciszenie</translation>
-<translation id="6885760532393684712">katalog</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">cytat blokowy</translation>
-<translation id="6941933287844615239">pobierz multimedia</translation>
-<translation id="6981594929165378967">wstawienie</translation>
-<translation id="6989848892321993519">Wydłuż ten tekst co najmniej do <ph name="MIN_CHARACTERS" /> znaków (teraz używasz jednego znaku).</translation>
-<translation id="7033340931668032222">klawisze w górę i w dół – zmiana głośności</translation>
-<translation id="709897737746224366">Podaj wartość w wymaganym formacie.</translation>
-<translation id="7118469954320184356">Brak opisu.</translation>
-<translation id="7139483182332611405">wstęp</translation>
-<translation id="7214187073215825913">informacje o treści</translation>
-<translation id="7263440858009898357">Wybierz element z listy.</translation>
-<translation id="727747134524199931">nagłówek kolumny</translation>
-<translation id="7320576522385648310">buforowanie</translation>
-<translation id="7353453495576941748">twórcy</translation>
-<translation id="7364796246159120393">Wybierz plik</translation>
-<translation id="739024184232394898">Inny...</translation>
-<translation id="7405738980073107433">przypisy końcowe</translation>
-<translation id="7410239719251593705">To wygląda na przeznaczone tylko dla dorosłych. Brak opisu.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Pobierz</translation>
-<translation id="7529102961911894712">link zwrotny</translation>
-<translation id="7533959249147584474">Grafika bez etykiety</translation>
-<translation id="7647456547678091388">Wskazówka</translation>
-<translation id="7661956066982048809">dokument graficzny</translation>
-<translation id="7673697353781729403">Godziny</translation>
-<translation id="7681220483256441252">indeks</translation>
-<translation id="7740050170769002709">Treść HTML</translation>
-<translation id="7745230546936012372">Aby uzyskać brakujące opisy obrazów, otwórz menu kontekstowe.</translation>
-<translation id="7750228210027921155">Obraz w obrazie</translation>
-<translation id="775297008183122718">Nieprawidłowy wpis</translation>
-<translation id="7789962463072032349">wstrzymaj</translation>
-<translation id="7802800022689234070">trójkąt rozwinięcia</translation>
-<translation id="7888071071722539607">Uwzględnij znak „<ph name="ATSIGN" />” w adresie e-mail. W adresie „<ph name="INVALIDADDRESS" />” brakuje znaku „<ph name="ATSIGN" />”.</translation>
-<translation id="7891486169920085145">podział</translation>
-<translation id="795667975304826397">Nie wybrano pliku</translation>
-<translation id="8053789581856978548">pole tekstowe wyszukiwania</translation>
-<translation id="8057695513531652401">uwaga</translation>
-<translation id="8105797009065549151">odsyłacz</translation>
-<translation id="811583516810654505">Pobieram opis...</translation>
-<translation id="8117451130807776954">W tym tygodniu</translation>
-<translation id="8199524924445686405">rrrr</translation>
-<translation id="8208673686607688524">selektor lokalnej daty i godziny</translation>
-<translation id="8261464734335370856">Nieprawidłowa pisownia</translation>
-<translation id="8284326494547611709">Napisy</translation>
-<translation id="835897206747267392">Nieprawidłowa wartość.</translation>
-<translation id="8403857369060869934">upłynęło: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">część</translation>
-<translation id="8433900881053900389">pasek narzędzi</translation>
-<translation id="8444882422881193423">Liczba plików: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Wybierz plik.</translation>
-<translation id="8461852803063341183">przycisk opcji</translation>
-<translation id="8474886197722836894">dedykacja</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minuty</translation>
-<translation id="8541249477527128034">sterowanie multimediami</translation>
-<translation id="8550857728288566671">symbol graficzny</translation>
-<translation id="8583702881314752957">lista definicji</translation>
-<translation id="8597182159515967513">nagłówek</translation>
-<translation id="8603553056539299761">klawisze w lewo i w prawo – przewijanie</translation>
-<translation id="860475260694818407">spis treści</translation>
-<translation id="8613126697340063924">sterowanie zdalnym odtwarzaniem</translation>
-<translation id="862370744433916922">podtytuł</translation>
-<translation id="8711688047404765493">dane wyjściowe</translation>
-<translation id="8750798805984357768">Wybierz jedną z opcji.</translation>
-<translation id="8808573423886751634">rozdział</translation>
-<translation id="8845239796550121995">Przesyłam na telewizor</translation>
-<translation id="8851136666856101339">główny</translation>
-<translation id="8875657656876809964">Błąd odtwarzania filmu</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Miesiąc</translation>
-<translation id="901493112792887934">bieżący czas w sekundach</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">nawigacja</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">wybierz, by odtworzyć treść lub wstrzymać odtwarzanie</translation>
-<translation id="9093215626363556771">wyłącz tryb obrazu w obrazie</translation>
-<translation id="9108370397979208512">matematyczny</translation>
-<translation id="9132465097189459683">Inny...</translation>
-<translation id="9138385573473225930">alert</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, początek <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Obraz w obrazie</translation>
-<translation id="9168329111483466115">przypis</translation>
-<translation id="954003015749068518">włącz tryb obrazu w obrazie</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_pt-BR.xtb b/chromium/content/app/strings/translations/content_strings_pt-BR.xtb
deleted file mode 100644
index 3206148c084..00000000000
--- a/chromium/content/app/strings/translations/content_strings_pt-BR.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="pt-BR">
-<translation id="1018939186200882850">item de menu</translation>
-<translation id="10623998915015855">botão "alternar"</translation>
-<translation id="1088086359088493902">Segundos</translation>
-<translation id="1171774979989969504">Insira um endereço de e-mail.</translation>
-<translation id="1178581264944972037">Pausar</translation>
-<translation id="1188858454923323853">complementar</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">controle deslizante</translation>
-<translation id="1211441953136645838">nota final</translation>
-<translation id="1281252709823657822">caixa de diálogo</translation>
-<translation id="1335095011850992622">créditos</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">região</translation>
-<translation id="1591562245178063882">Este mês</translation>
-<translation id="1637811476055996098">Escolher arquivos</translation>
-<translation id="1650423536718072820">citação</translation>
-<translation id="1727886345390570319">ocultar menu de closed captions</translation>
-<translation id="1729654308190250600">Insira um endereço de e-mail que não esteja vazio.</translation>
-<translation id="1758486001363313524">Outras...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">grade de árvore</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">reproduzir em dispositivo remoto</translation>
-<translation id="190587075670221089">exclusão</translation>
-<translation id="1907737156431278478">exemplo</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">O valor deve ser <ph name="MAXIMUM_DATE_OR_TIME" /> ou anterior.</translation>
-<translation id="1946271899482435442">Mostrar seletor de datas</translation>
-<translation id="1993104285338243655">Alterado para espelhamento</translation>
-<translation id="2060505056492490888">"<ph name="DOT" />" está sendo usado em uma posição incorreta em "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Hoje</translation>
-<translation id="2158401438286456825">lista de páginas</translation>
-<translation id="2226276347425096477">Reduza este texto para <ph name="MAX_CHARACTERS" /> caracteres ou menos (você está usando <ph name="CURRENT_LENGTH" /> caracteres).</translation>
-<translation id="2246498165605549352">Arquivo local</translation>
-<translation id="2247351761944213033">Semana <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Faixa <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">caixa de seleção</translation>
-<translation id="2311842470354187719">quebra de página</translation>
-<translation id="2335594187091864976">seletor de data e hora</translation>
-<translation id="245932805758469625">segundos restantes do vídeo</translation>
-<translation id="248395913932153421">Dia</translation>
-<translation id="2507943997699731163">Preencha este campo.</translation>
-<translation id="2508569020611168319">lista de guias</translation>
-<translation id="2561842179657104141">mostrar mais controles de mídia</translation>
-<translation id="2572483411312390101">reproduzir</translation>
-<translation id="2613802280814924224">Insira um valor válido. O valor válido mais próximo é <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Enviar</translation>
-<translation id="2657045182931379222">objeto gráfico</translation>
-<translation id="2674318244760992338">rodapé</translation>
-<translation id="2709516037105925701">Preenchimento automático</translation>
-<translation id="2723001399770238859">áudio</translation>
-<translation id="2746543609216772311">O valor deve ser <ph name="MINIMUM_DATE_OR_TIME" /> ou posterior.</translation>
-<translation id="2759744352195237655">botão pop-up</translation>
-<translation id="2761667185364618470">Marque esta caixa se deseja continuar.</translation>
-<translation id="2844350028562914727">detalhes</translation>
-<translation id="2896972712917208084">grupo de rádio</translation>
-<translation id="2908441821576996758">Insira uma lista de endereços de e-mail separados por vírgula.</translation>
-<translation id="2940813599313844715">objeto</translation>
-<translation id="2942448076852699108">conteúdo destacado</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Insira um valor válido. O campo está incompleto ou tem uma data inválida.</translation>
-<translation id="3078740164268491126">tabela</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Insira um URL.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">caixa de combinação</translation>
-<translation id="3450233048674729344">O valor deve ser menor ou igual a <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definição</translation>
-<translation id="3557673793733683882">cabeçalho <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">seletor de semana</translation>
-<translation id="3685101356851116974">Imagem sem etiqueta</translation>
-<translation id="3706100364254443312">alternar</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Sair do modo picture-in-picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">termo</translation>
-<translation id="3822383571486410024">Aumente este texto para <ph name="MIN_CHARACTERS" /> caracteres ou mais. No momento, você está usando <ph name="CURRENT_LENGTH" /> caracteres).</translation>
-<translation id="383465348367842624">Uma parte seguida por "<ph name="ATSIGN" />" não deve conter o símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Sair da tela cheia</translation>
-<translation id="3920932319529768807">conclusão</translation>
-<translation id="3924558731517983934">app</translation>
-<translation id="3944740393230681990">prólogo</translation>
-<translation id="3960700977367013758">barra de rolagem</translation>
-<translation id="4103419683916926126">Milésimos de segundo</translation>
-<translation id="4151657705144244502">gráfico</translation>
-<translation id="4160057747563657758">telefone</translation>
-<translation id="4193965531860883258">prefácio</translation>
-<translation id="4201051445878709314">Mostrar mês anterior</translation>
-<translation id="421884353938374759">Seletor de cores</translation>
-<translation id="4248100235867064564">barra de menu</translation>
-<translation id="4360991593054037559">Insira um valor válido. Os dois valores válidos mais próximos são <ph name="VALID_VALUE_LOW" /> e <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Perguntas e respostas</translation>
-<translation id="4413860115965805769">botão de menu</translation>
-<translation id="4444765639179266822">Parece dizer: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">referência de glossário</translation>
-<translation id="4522570452068850558">Saiba mais</translation>
-<translation id="4542388879936266156">tempo restante: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulário</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">A parte depois de "<ph name="ATSIGN" />" não deve conter o símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">apêndice</translation>
-<translation id="4718048029184481307">Vídeo no modo picture-in-picture</translation>
-<translation id="4742539557769756338">capa</translation>
-<translation id="4748357248530471599">ativa tela cheia com corte de tela</translation>
-<translation id="4757246831282535685">painel da guia</translation>
-<translation id="4763480195061959176">vídeo</translation>
-<translation id="479989351350248267">pesquisar</translation>
-<translation id="4812940957355064477">Insira um número.</translation>
-<translation id="4912536737030637138">entrada bibliográfica</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> selecionados</translation>
-<translation id="4992066212339426712">Ativar som</translation>
-<translation id="49969490063480558">Insira uma parte depois de "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" está incompleto.</translation>
-<translation id="5034860022980953847">indicador de progresso</translation>
-<translation id="5090250355906949916">barra de progressão de vídeo</translation>
-<translation id="5093189678851173835">epígrafe</translation>
-<translation id="5117590920725113268">Mostrar próximo mês</translation>
-<translation id="512758898067543763">cabeçalho de linha</translation>
-<translation id="5143125788380636750">epílogo</translation>
-<translation id="5164977714490026579">O valor deve ser maior ou igual a <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Insira uma parte seguida por "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" está incompleto.</translation>
-<translation id="5334352251556557839">Não foi possível abrir a mídia.</translation>
-<translation id="5406322316791861025">figura</translation>
-<translation id="5453733299334684579">item de árvore</translation>
-<translation id="5466621249238537318">Selecione um ou mais arquivos.</translation>
-<translation id="5468998798572797635">sair do modo tela cheia</translation>
-<translation id="5516424706154626233">seletor de data</translation>
-<translation id="5537725057119320332">Transmitir</translation>
-<translation id="5546461542133609677">ativar som</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Toque duas vezes na esquerda ou direita para pular 10 s</translation>
-<translation id="5631759159893697722">resumo</translation>
-<translation id="5643186887447432888">botão</translation>
-<translation id="5677946354068040947">mais opções</translation>
-<translation id="576709008726043716">introdução</translation>
-<translation id="57838592816432529">Desativar som</translation>
-<translation id="5860033963881614850">Desativado</translation>
-<translation id="588258955323874662">Tela inteira</translation>
-<translation id="5888666972993069672">Transmitindo agora para <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">caixa de pesquisa</translation>
-<translation id="5939518447894949180">Redefinir</translation>
-<translation id="5966707198760109579">Semana</translation>
-<translation id="5987525920412732405">botão de rotação</translation>
-<translation id="6011459053400940133">controle deslizante de volume</translation>
-<translation id="6015796118275082299">Ano</translation>
-<translation id="6023896073578205740">caixa de listagem</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">medidor</translation>
-<translation id="6166809985690652833">posfácio</translation>
-<translation id="6209276755895393898">Parece ser: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glossário</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Sair de picture-in-picture</translation>
-<translation id="6398862346408813489">Mostrar painel de seleção de mês</translation>
-<translation id="6404546809543547843">barra de progressão do áudio</translation>
-<translation id="6443871981718447451">mostrar menu de closed captions</translation>
-<translation id="6453774872122745852">agradecimentos</translation>
-<translation id="648732519525291180">seletor de hora</translation>
-<translation id="6550675742724504774">Opções</translation>
-<translation id="6572309429103589720">Gramática inválida</translation>
-<translation id="658823671542763450">entrar no modo tela cheia</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Limpar</translation>
-<translation id="668171684555832681">Outro...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Baixa qualidade de reprodução</translation>
-<translation id="6755330956360078551">dica</translation>
-<translation id="6790428901817661496">Reproduzir</translation>
-<translation id="6820355525329141109">Não foi possível carregar o plug-in.</translation>
-<translation id="6820615603175220800">referência bibliográfica</translation>
-<translation id="6843725295806269523">sem som</translation>
-<translation id="6885760532393684712">diretório</translation>
-<translation id="689129560213475294">colofão</translation>
-<translation id="6934078000481955284">bloco de texto</translation>
-<translation id="6941933287844615239">fazer o download da mídia</translation>
-<translation id="6981594929165378967">inserção</translation>
-<translation id="6989848892321993519">Aumente esse texto para <ph name="MIN_CHARACTERS" /> caracteres ou mais. No momento, você está usando 1 caractere.</translation>
-<translation id="7033340931668032222">para cima e para baixo para controlar o volume</translation>
-<translation id="709897737746224366">É preciso que o formato corresponda ao exigido.</translation>
-<translation id="7118469954320184356">Nenhuma descrição disponível.</translation>
-<translation id="7139483182332611405">prefácio</translation>
-<translation id="7214187073215825913">informações do conteúdo</translation>
-<translation id="7263440858009898357">Selecione um item da lista.</translation>
-<translation id="727747134524199931">cabeçalho da coluna</translation>
-<translation id="7320576522385648310">armazenando em buffer</translation>
-<translation id="7353453495576941748">crédito</translation>
-<translation id="7364796246159120393">Escolher arquivo</translation>
-<translation id="739024184232394898">Outras...</translation>
-<translation id="7405738980073107433">notas finais</translation>
-<translation id="7410239719251593705">Parece apresentar conteúdo adulto. Nenhuma descrição disponível.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Fazer o download</translation>
-<translation id="7529102961911894712">backlink</translation>
-<translation id="7533959249147584474">Elemento gráfico sem etiqueta</translation>
-<translation id="7647456547678091388">dica</translation>
-<translation id="7661956066982048809">documento gráfico</translation>
-<translation id="7673697353781729403">Horas</translation>
-<translation id="7681220483256441252">índice</translation>
-<translation id="7740050170769002709">Conteúdo HTML</translation>
-<translation id="7745230546936012372">Para ver descrições ausentes de imagens, abra o menu de contexto.</translation>
-<translation id="7750228210027921155">Picture-in-picture</translation>
-<translation id="775297008183122718">Entrada inválida</translation>
-<translation id="7789962463072032349">pausar</translation>
-<translation id="7802800022689234070">triângulo de divulgação</translation>
-<translation id="7888071071722539607">Inclua um "<ph name="ATSIGN" />" no endereço de e-mail. "<ph name="INVALIDADDRESS" />" está com um "<ph name="ATSIGN" />" faltando.</translation>
-<translation id="7891486169920085145">divisor</translation>
-<translation id="795667975304826397">Nenhum arquivo selecionado</translation>
-<translation id="8053789581856978548">campo de texto da pesquisa</translation>
-<translation id="8057695513531652401">aviso</translation>
-<translation id="8105797009065549151">referência de nota</translation>
-<translation id="811583516810654505">Buscando descrição...</translation>
-<translation id="8117451130807776954">Esta semana</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">seletor de data e hora local</translation>
-<translation id="8261464734335370856">Ortografia inválida</translation>
-<translation id="8284326494547611709">Legendas</translation>
-<translation id="835897206747267392">Valor inválido.</translation>
-<translation id="8403857369060869934">tempo decorrido: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">parte</translation>
-<translation id="8433900881053900389">barra de ferramentas</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> arquivos</translation>
-<translation id="8451268428117625855">Selecione um arquivo.</translation>
-<translation id="8461852803063341183">botão de opção</translation>
-<translation id="8474886197722836894">dedicatória</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutos</translation>
-<translation id="8541249477527128034">controle de mídia</translation>
-<translation id="8550857728288566671">símbolo gráfico</translation>
-<translation id="8583702881314752957">lista de definições</translation>
-<translation id="8597182159515967513">cabeçalho</translation>
-<translation id="8603553056539299761">direita e esquerda para procurar</translation>
-<translation id="860475260694818407">sumário</translation>
-<translation id="8613126697340063924">controlar reprodução remota</translation>
-<translation id="862370744433916922">subtítulo</translation>
-<translation id="8711688047404765493">saída</translation>
-<translation id="8750798805984357768">Selecione uma das opções.</translation>
-<translation id="8808573423886751634">capítulo</translation>
-<translation id="8845239796550121995">Reproduzindo agora na sua TV</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Erro na reprodução do vídeo</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mês</translation>
-<translation id="901493112792887934">tempo atual em segundos</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navegação</translation>
-<translation id="9062295712474918030">documento</translation>
-<translation id="9062307380734144336">selecione para tocar ou pausar</translation>
-<translation id="9093215626363556771">sair de picture-in-picture</translation>
-<translation id="9108370397979208512">matemática</translation>
-<translation id="9132465097189459683">Outras...</translation>
-<translation id="9138385573473225930">alerta</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, que começa em <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picture-in-picture</translation>
-<translation id="9168329111483466115">nota de rodapé</translation>
-<translation id="954003015749068518">entrar no modo picture-in-picture</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_pt-PT.xtb b/chromium/content/app/strings/translations/content_strings_pt-PT.xtb
deleted file mode 100644
index 96e5a72fd16..00000000000
--- a/chromium/content/app/strings/translations/content_strings_pt-PT.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="pt-PT">
-<translation id="1018939186200882850">item de menu</translation>
-<translation id="10623998915015855">botão alternar</translation>
-<translation id="1088086359088493902">Segundos</translation>
-<translation id="1171774979989969504">Introduza um endereço de email.</translation>
-<translation id="1178581264944972037">Pausa</translation>
-<translation id="1188858454923323853">complementar</translation>
-<translation id="1206619573307042055">painel rolante</translation>
-<translation id="1206693055195146388">controlo de deslize</translation>
-<translation id="1211441953136645838">nota final</translation>
-<translation id="1281252709823657822">caixa de diálogo</translation>
-<translation id="1335095011850992622">créditos</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">região</translation>
-<translation id="1591562245178063882">Este mês</translation>
-<translation id="1637811476055996098">Escolher Ficheiros</translation>
-<translation id="1650423536718072820">trecho em destaque</translation>
-<translation id="1727886345390570319">ocultar menu de legendas ocultas</translation>
-<translation id="1729654308190250600">Introduza um endereço de email que não esteja vazio.</translation>
-<translation id="1758486001363313524">Outra...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">grelha de árvore</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">reproduzir no dispositivo remoto</translation>
-<translation id="190587075670221089">eliminação</translation>
-<translation id="1907737156431278478">exemplo</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">estado</translation>
-<translation id="1938124657309484470">O valor tem de ser <ph name="MAXIMUM_DATE_OR_TIME" /> ou anterior.</translation>
-<translation id="1946271899482435442">Mostrar selecionador de data</translation>
-<translation id="1993104285338243655">Alterado para espelhamento.</translation>
-<translation id="2060505056492490888">"<ph name="DOT" />" está a ser utilizado numa posição errada em "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Hoje</translation>
-<translation id="2158401438286456825">lista de páginas</translation>
-<translation id="2226276347425096477">Encurte este texto para <ph name="MAX_CHARACTERS" /> caracteres ou menos (está atualmente a utilizar <ph name="CURRENT_LENGTH" /> caracteres).</translation>
-<translation id="2246498165605549352">Ficheiro local</translation>
-<translation id="2247351761944213033">Semana <ph name="WEEKNUMBER" />, de <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Faixa <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">caixa de verificação</translation>
-<translation id="2311842470354187719">quebra de página</translation>
-<translation id="2335594187091864976">selecionador de data e hora</translation>
-<translation id="245932805758469625">segundos restantes do vídeo</translation>
-<translation id="248395913932153421">Dia</translation>
-<translation id="2507943997699731163">Preencha este campo.</translation>
-<translation id="2508569020611168319">lista de separadores</translation>
-<translation id="2561842179657104141">mostrar mais controlos de multimédia</translation>
-<translation id="2572483411312390101">reproduzir</translation>
-<translation id="2613802280814924224">Introduza um valor válido. O valor válido mais próximo é <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Submeter</translation>
-<translation id="2657045182931379222">objeto de gráficos</translation>
-<translation id="2674318244760992338">rodapé</translation>
-<translation id="2709516037105925701">Preenchimento automático</translation>
-<translation id="2723001399770238859">áudio</translation>
-<translation id="2746543609216772311">O valor tem de ser <ph name="MINIMUM_DATE_OR_TIME" /> ou posterior.</translation>
-<translation id="2759744352195237655">botão pop-up</translation>
-<translation id="2761667185364618470">Selecione esta caixa se pretender continuar.</translation>
-<translation id="2844350028562914727">detalhes</translation>
-<translation id="2896972712917208084">grupo de botões de opção</translation>
-<translation id="2908441821576996758">Introduza uma lista de endereços de email separados por vírgula.</translation>
-<translation id="2940813599313844715">objeto</translation>
-<translation id="2942448076852699108">conteúdo realçado</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Introduza um valor válido. O campo está incompleto ou tem uma data inválida.</translation>
-<translation id="3078740164268491126">tabela</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Introduza um URL.</translation>
-<translation id="3175736971608411871">temporizador</translation>
-<translation id="3199563858620722075">caixa de combinação</translation>
-<translation id="3450233048674729344">O valor tem de ser inferior ou igual a <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definição</translation>
-<translation id="3557673793733683882">título <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selecionador de semanas</translation>
-<translation id="3685101356851116974">Imagem sem etiqueta</translation>
-<translation id="3706100364254443312">alternar</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Sair de ecrã no ecrã</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">termo</translation>
-<translation id="3822383571486410024">Aumente este texto para <ph name="MIN_CHARACTERS" /> carateres ou mais (está atualmente a utilizar <ph name="CURRENT_LENGTH" /> carateres).</translation>
-<translation id="383465348367842624">Uma parte seguida de "<ph name="ATSIGN" />" não deve conter o símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Sair do modo de ecrã inteiro</translation>
-<translation id="3920932319529768807">conclusão</translation>
-<translation id="3924558731517983934">aplicação</translation>
-<translation id="3944740393230681990">prólogo</translation>
-<translation id="3960700977367013758">barra de deslocamento</translation>
-<translation id="4103419683916926126">Milissegundos</translation>
-<translation id="4151657705144244502">gráfico</translation>
-<translation id="4160057747563657758">telefone</translation>
-<translation id="4193965531860883258">prefácio</translation>
-<translation id="4201051445878709314">Mostrar mês anterior</translation>
-<translation id="421884353938374759">seletor de cores</translation>
-<translation id="4248100235867064564">barra de menu</translation>
-<translation id="4360991593054037559">Introduza um valor válido. Os dois valores válidos mais próximos são <ph name="VALID_VALUE_LOW" /> e <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Perg e Resp</translation>
-<translation id="4413860115965805769">botão de menu</translation>
-<translation id="4444765639179266822">Parece indicar: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">referência do glossário</translation>
-<translation id="4522570452068850558">Detalhes</translation>
-<translation id="4542388879936266156">tempo restante: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulário</translation>
-<translation id="4661075872484491155">árvore</translation>
-<translation id="4664250907885839816">Uma parte a seguir a "<ph name="ATSIGN" />" não deve conter o símbolo "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">apêndice</translation>
-<translation id="4718048029184481307">A reproduzir em ecrã no ecrã…</translation>
-<translation id="4742539557769756338">capa</translation>
-<translation id="4748357248530471599">ativar/desativar o ecrã inteiro de recorte no ecrã</translation>
-<translation id="4757246831282535685">painel de separadores</translation>
-<translation id="4763480195061959176">vídeo</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Introduza um número.</translation>
-<translation id="4912536737030637138">entrada da bibliografia</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> selecionados</translation>
-<translation id="4992066212339426712">Reativar o som</translation>
-<translation id="49969490063480558">Introduza uma parte a seguir a "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" está incompleto.</translation>
-<translation id="5034860022980953847">indicador de progresso</translation>
-<translation id="5090250355906949916">controlo de arrasto do tempo do vídeo</translation>
-<translation id="5093189678851173835">epígrafe</translation>
-<translation id="5117590920725113268">Mostrar mês seguinte</translation>
-<translation id="512758898067543763">cabeçalho da linha</translation>
-<translation id="5143125788380636750">epílogo</translation>
-<translation id="5164977714490026579">O valor tem de ser superior ou igual a <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Introduza uma parte seguida de "<ph name="ATSIGN" />". "<ph name="INVALIDADDRESS" />" está incompleto.</translation>
-<translation id="5334352251556557839">Não é possível reproduzir multimédia.</translation>
-<translation id="5406322316791861025">figura</translation>
-<translation id="5453733299334684579">item de árvore</translation>
-<translation id="5466621249238537318">Selecione um ou mais ficheiros.</translation>
-<translation id="5468998798572797635">sair do modo de ecrã inteiro</translation>
-<translation id="5516424706154626233">selecionador de data</translation>
-<translation id="5537725057119320332">Transmitir</translation>
-<translation id="5546461542133609677">reativar som</translation>
-<translation id="561939826962581046">hora</translation>
-<translation id="5630795885300617244">Toque duas vezes à esquerda ou à direita para avançar 10 seg.</translation>
-<translation id="5631759159893697722">resumo</translation>
-<translation id="5643186887447432888">botão</translation>
-<translation id="5677946354068040947">mais opções</translation>
-<translation id="576709008726043716">introdução</translation>
-<translation id="57838592816432529">Desativar som</translation>
-<translation id="5860033963881614850">Desativado</translation>
-<translation id="588258955323874662">Ecrã inteiro</translation>
-<translation id="5888666972993069672">A transmitir agora para <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">caixa de pesquisa</translation>
-<translation id="5939518447894949180">Repor</translation>
-<translation id="5966707198760109579">Semana</translation>
-<translation id="5987525920412732405">botão giratório</translation>
-<translation id="6011459053400940133">controlo de deslize do volume</translation>
-<translation id="6015796118275082299">Ano</translation>
-<translation id="6023896073578205740">caixa de lista</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">contador</translation>
-<translation id="6166809985690652833">posfácio</translation>
-<translation id="6209276755895393898">Parece ser: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glossário</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Sair do modo ecrã no ecrã</translation>
-<translation id="6398862346408813489">Mostrar painel de seleção do mês</translation>
-<translation id="6404546809543547843">controlo de arrasto do tempo do áudio</translation>
-<translation id="6443871981718447451">mostrar menu de legendas ocultas</translation>
-<translation id="6453774872122745852">agradecimentos</translation>
-<translation id="648732519525291180">selecionador de hora</translation>
-<translation id="6550675742724504774">Opções</translation>
-<translation id="6572309429103589720">Gramática inválida.</translation>
-<translation id="658823671542763450">entrar no modo de ecrã inteiro</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Limpar</translation>
-<translation id="668171684555832681">Outros...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Má qualidade de reprodução.</translation>
-<translation id="6755330956360078551">sugestão</translation>
-<translation id="6790428901817661496">Reproduzir</translation>
-<translation id="6820355525329141109">Não foi possível carregar o plug-in.</translation>
-<translation id="6820615603175220800">referência bibliográfica</translation>
-<translation id="6843725295806269523">desativar som</translation>
-<translation id="6885760532393684712">diretório</translation>
-<translation id="689129560213475294">colofão</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">transferir multimédia</translation>
-<translation id="6981594929165378967">inserção</translation>
-<translation id="6989848892321993519">Aumente este texto para <ph name="MIN_CHARACTERS" /> ou mais carateres (atualmente, está a utilizar 1 caráter).</translation>
-<translation id="7033340931668032222">para cima e para baixo para alterar o volume</translation>
-<translation id="709897737746224366">Faça corresponder o formato pedido.</translation>
-<translation id="7118469954320184356">Nenhuma descrição disponível.</translation>
-<translation id="7139483182332611405">prefácio</translation>
-<translation id="7214187073215825913">informações sobre o conteúdo</translation>
-<translation id="7263440858009898357">Selecione um item na lista.</translation>
-<translation id="727747134524199931">cabeçalho da coluna</translation>
-<translation id="7320576522385648310">colocação no buffer</translation>
-<translation id="7353453495576941748">crédito</translation>
-<translation id="7364796246159120393">Escolher ficheiro</translation>
-<translation id="739024184232394898">Outra...</translation>
-<translation id="7405738980073107433">notas finais</translation>
-<translation id="7410239719251593705">Parece ser conteúdo para adultos. Nenhuma descrição disponível.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Transferir</translation>
-<translation id="7529102961911894712">backlink</translation>
-<translation id="7533959249147584474">Gráfico sem etiqueta</translation>
-<translation id="7647456547678091388">sugestão</translation>
-<translation id="7661956066982048809">documento de gráficos</translation>
-<translation id="7673697353781729403">Horas</translation>
-<translation id="7681220483256441252">índice</translation>
-<translation id="7740050170769002709">Conteúdo HTML</translation>
-<translation id="7745230546936012372">Para obter descrições de imagens em falta, abra o menu de contexto.</translation>
-<translation id="7750228210027921155">Ecrã no ecrã</translation>
-<translation id="775297008183122718">Entrada inválida</translation>
-<translation id="7789962463072032349">pausa</translation>
-<translation id="7802800022689234070">triângulo de divulgação</translation>
-<translation id="7888071071722539607">Inclua um "<ph name="ATSIGN" />" no endereço de email. Falta um "<ph name="ATSIGN" />" em "<ph name="INVALIDADDRESS" />".</translation>
-<translation id="7891486169920085145">divisor</translation>
-<translation id="795667975304826397">Nenhum ficheiro selecionado</translation>
-<translation id="8053789581856978548">campo de texto de pesquisa</translation>
-<translation id="8057695513531652401">aviso</translation>
-<translation id="8105797009065549151">referência de nota</translation>
-<translation id="811583516810654505">A obter descrição…</translation>
-<translation id="8117451130807776954">Esta semana</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">selecionador de data e hora locais</translation>
-<translation id="8261464734335370856">Ortografia inválida.</translation>
-<translation id="8284326494547611709">Legendas</translation>
-<translation id="835897206747267392">Valor inválido.</translation>
-<translation id="8403857369060869934">tempo decorrido: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">parte</translation>
-<translation id="8433900881053900389">barra de ferramentas</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ficheiros</translation>
-<translation id="8451268428117625855">Selecione um ficheiro.</translation>
-<translation id="8461852803063341183">botão de opção</translation>
-<translation id="8474886197722836894">dedicatória</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minutos</translation>
-<translation id="8541249477527128034">controlo multimédia</translation>
-<translation id="8550857728288566671">símbolo de gráficos</translation>
-<translation id="8583702881314752957">lista de definições</translation>
-<translation id="8597182159515967513">cabeçalho</translation>
-<translation id="8603553056539299761">para a esquerda e para a direita para procurar</translation>
-<translation id="860475260694818407">índice</translation>
-<translation id="8613126697340063924">controlar a reprodução remota</translation>
-<translation id="862370744433916922">legenda</translation>
-<translation id="8711688047404765493">saída</translation>
-<translation id="8750798805984357768">Selecione uma destas opções.</translation>
-<translation id="8808573423886751634">capítulo</translation>
-<translation id="8845239796550121995">A transmitir na sua TV…</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Erro de reprodução de vídeo.</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mês</translation>
-<translation id="901493112792887934">tempo atual em segundos</translation>
-<translation id="901834265349196618">email</translation>
-<translation id="9048119486235211610">navegação</translation>
-<translation id="9062295712474918030">documento</translation>
-<translation id="9062307380734144336">selecione para alternar entre reproduzir e colocar em pausa.</translation>
-<translation id="9093215626363556771">sair do modo ecrã no ecrã</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Outra...</translation>
-<translation id="9138385573473225930">alerta</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, a partir de <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Ecrã no ecrã</translation>
-<translation id="9168329111483466115">nota de rodapé</translation>
-<translation id="954003015749068518">entrar no modo ecrã no ecrã</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ro.xtb b/chromium/content/app/strings/translations/content_strings_ro.xtb
deleted file mode 100644
index 4ab20c8b16e..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ro.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ro">
-<translation id="1018939186200882850">element de meniu</translation>
-<translation id="10623998915015855">buton de comutare</translation>
-<translation id="1088086359088493902">Secunde</translation>
-<translation id="1171774979989969504">Introdu o adresă de e-mail.</translation>
-<translation id="1178581264944972037">Întrerupe</translation>
-<translation id="1188858454923323853">complementar</translation>
-<translation id="1206619573307042055">text derulant</translation>
-<translation id="1206693055195146388">glisor</translation>
-<translation id="1211441953136645838">notă de final</translation>
-<translation id="1281252709823657822">dialog</translation>
-<translation id="1335095011850992622">mulțumiri</translation>
-<translation id="1342835525016946179">articol</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">regiune</translation>
-<translation id="1591562245178063882">Luna aceasta</translation>
-<translation id="1637811476055996098">Alege fișierele</translation>
-<translation id="1650423536718072820">citat</translation>
-<translation id="1727886345390570319">ascunde meniul de subtitrări</translation>
-<translation id="1729654308190250600">Introduceți o adresă de e-mail concretă.</translation>
-<translation id="1758486001363313524">Altele...</translation>
-<translation id="1806710327868736751">dialog de alertă</translation>
-<translation id="1821985195704844674">grilă arbore</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">redă pe dispozitiv la distanță</translation>
-<translation id="190587075670221089">ștergere</translation>
-<translation id="1907737156431278478">exemplu</translation>
-<translation id="1921819250265091946">zz</translation>
-<translation id="1930711995431081526">stare</translation>
-<translation id="1938124657309484470">Valoarea pentru dată/oră trebuie să fie <ph name="MAXIMUM_DATE_OR_TIME" /> sau una anterioară.</translation>
-<translation id="1946271899482435442">Afișează selectorul de date</translation>
-<translation id="1993104285338243655">S-a comutat la oglindire</translation>
-<translation id="2060505056492490888">Semnul „<ph name="DOT" />” apare poziționat greșit în „<ph name="INVALIDDOMAIN" />”.</translation>
-<translation id="2148716181193084225">Astăzi</translation>
-<translation id="2158401438286456825">listă de pagini</translation>
-<translation id="2226276347425096477">Micșorează acest text la cel mult <ph name="MAX_CHARACTERS" /> caractere (în prezent utilizezi <ph name="CURRENT_LENGTH" /> caractere).</translation>
-<translation id="2246498165605549352">Fișier local</translation>
-<translation id="2247351761944213033">Săptămâna <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Melodia <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">casetă de selectare</translation>
-<translation id="2311842470354187719">sfârșit de pagină</translation>
-<translation id="2335594187091864976">selector pentru dată și oră</translation>
-<translation id="245932805758469625">numărul de secunde rămase din videoclip</translation>
-<translation id="248395913932153421">Zi</translation>
-<translation id="2507943997699731163">Completează acest câmp.</translation>
-<translation id="2508569020611168319">listă de file</translation>
-<translation id="2561842179657104141">afișează mai multe comenzi media</translation>
-<translation id="2572483411312390101">redați</translation>
-<translation id="2613802280814924224">Introduceți o valoare validă. Cea mai apropiată valoare validă este <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Trimite</translation>
-<translation id="2657045182931379222">obiect grafic</translation>
-<translation id="2674318244760992338">notă de subsol</translation>
-<translation id="2709516037105925701">Completare automată</translation>
-<translation id="2723001399770238859">audio</translation>
-<translation id="2746543609216772311">Valoarea pentru dată/oră trebuie să fie <ph name="MINIMUM_DATE_OR_TIME" /> sau una ulterioară.</translation>
-<translation id="2759744352195237655">buton pop-up</translation>
-<translation id="2761667185364618470">Bifeză caseta dacă vrei să continui.</translation>
-<translation id="2844350028562914727">detalii</translation>
-<translation id="2896972712917208084">grup butoane radio</translation>
-<translation id="2908441821576996758">Introdu o listă de adrese de e-mail separate prin virgulă.</translation>
-<translation id="2940813599313844715">obiect</translation>
-<translation id="2942448076852699108">conținut evidențiat</translation>
-<translation id="3040011195152428237">link</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Introduceți o valoare validă. Câmpul este incomplet sau conține o dată nevalidă.</translation>
-<translation id="3078740164268491126">tabel</translation>
-<translation id="3086746722712840547">notă</translation>
-<translation id="310520048233152454">Introdu o adresă URL.</translation>
-<translation id="3175736971608411871">temporizator</translation>
-<translation id="3199563858620722075">casetă combo</translation>
-<translation id="3450233048674729344">Valoarea trebuie să fie mai mică sau egală cu <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definiție</translation>
-<translation id="3557673793733683882">titlu <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">selector pentru săptămână</translation>
-<translation id="3685101356851116974">Imagine neetichetată</translation>
-<translation id="3706100364254443312">comutator</translation>
-<translation id="3732799496749320381">ll</translation>
-<translation id="3754210790023674521">Ieși din modul picture-in-picture</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">termen</translation>
-<translation id="3822383571486410024">Mărește acest text la cel puțin <ph name="MIN_CHARACTERS" /> caractere (în prezent folosești <ph name="CURRENT_LENGTH" /> caractere).</translation>
-<translation id="383465348367842624">Valoarea urmată de semnul „<ph name="ATSIGN" />” nu trebuie să conțină simbolul „<ph name="INVALIDCHARACTER" />”.</translation>
-<translation id="3846214748874656680">Ieși din ecranul complet</translation>
-<translation id="3920932319529768807">concluzie</translation>
-<translation id="3924558731517983934">aplicație</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">bară de derulare</translation>
-<translation id="4103419683916926126">Milisecunde</translation>
-<translation id="4151657705144244502">element grafic</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">cuvânt înainte</translation>
-<translation id="4201051445878709314">Afișează luna anterioară</translation>
-<translation id="421884353938374759">selector de culoare</translation>
-<translation id="4248100235867064564">bară de meniu</translation>
-<translation id="4360991593054037559">Introduceți o valoare validă. Cele mai apropiate valori valide sunt <ph name="VALID_VALUE_LOW" /> și <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Întrebări și răspunsuri</translation>
-<translation id="4413860115965805769">buton de meniu</translation>
-<translation id="4444765639179266822">Se pare că spune: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">trimitere la glosar</translation>
-<translation id="4522570452068850558">Detalii</translation>
-<translation id="4542388879936266156">timp rămas: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formular</translation>
-<translation id="4661075872484491155">arbore</translation>
-<translation id="4664250907885839816">Valoarea care urmează după semnul „<ph name="ATSIGN" />” nu trebuie să conțină simbolul „<ph name="INVALIDCHARACTER" />”.</translation>
-<translation id="4668956016107839909">anexă</translation>
-<translation id="4718048029184481307">Se redă în modul picture-in-picture</translation>
-<translation id="4742539557769756338">copertă</translation>
-<translation id="4748357248530471599">decupaj inclus în ecranul complet</translation>
-<translation id="4757246831282535685">panou de file</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">căutați</translation>
-<translation id="4812940957355064477">Introduceți un număr.</translation>
-<translation id="4912536737030637138">intrare bibliografică</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> selectate</translation>
-<translation id="4992066212339426712">Activează sunetul</translation>
-<translation id="49969490063480558">Introduceți o valoare după semnul „<ph name="ATSIGN" />”. Adresa „<ph name="INVALIDADDRESS" />” nu este completă.</translation>
-<translation id="5034860022980953847">indicator de progres</translation>
-<translation id="5090250355906949916">glisor pentru redare video</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Afișează luna următoare</translation>
-<translation id="512758898067543763">antet rând</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Valoarea trebuie să fie mai mare sau egală cu <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Introduceți o valoare urmată de semnul „<ph name="ATSIGN" />”. Adresa „<ph name="INVALIDADDRESS" />” nu este completă.</translation>
-<translation id="5334352251556557839">Nu se pot reda fișiere media.</translation>
-<translation id="5406322316791861025">cifră</translation>
-<translation id="5453733299334684579">element arbore</translation>
-<translation id="5466621249238537318">Selectează unul sau mai multe fișiere.</translation>
-<translation id="5468998798572797635">ieșiți din ecranul complet</translation>
-<translation id="5516424706154626233">selector dată</translation>
-<translation id="5537725057119320332">Proiectează</translation>
-<translation id="5546461542133609677">activați sunetul</translation>
-<translation id="561939826962581046">oră</translation>
-<translation id="5630795885300617244">Atinge de două ori spre stânga sau spre dreapta pentru a derula cu 10 secunde</translation>
-<translation id="5631759159893697722">rezumat</translation>
-<translation id="5643186887447432888">buton</translation>
-<translation id="5677946354068040947">mai multe opțiuni</translation>
-<translation id="576709008726043716">introducere</translation>
-<translation id="57838592816432529">Dezactivează sunetul</translation>
-<translation id="5860033963881614850">Dezactivat</translation>
-<translation id="588258955323874662">Ecran complet</translation>
-<translation id="5888666972993069672">Se proiectează acum pe <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">casetă de căutare</translation>
-<translation id="5939518447894949180">Resetează</translation>
-<translation id="5966707198760109579">Săptămână</translation>
-<translation id="5987525920412732405">buton incrementare/decrementare</translation>
-<translation id="6011459053400940133">glisor de volum</translation>
-<translation id="6015796118275082299">An</translation>
-<translation id="6023896073578205740">casetă listă</translation>
-<translation id="6150588977291308318">bibliografie</translation>
-<translation id="6164829606128959761">instrument de măsurare</translation>
-<translation id="6166809985690652833">postfață</translation>
-<translation id="6209276755895393898">Pare a fi: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosar</translation>
-<translation id="6281763101136022427">adresă URL</translation>
-<translation id="6310801910862476708">Ieși din modul Picture-in-Picture</translation>
-<translation id="6398862346408813489">Afișează panoul de selectare a lunii</translation>
-<translation id="6404546809543547843">glisor redare audio</translation>
-<translation id="6443871981718447451">afișează meniul de subtitrări</translation>
-<translation id="6453774872122745852">lista colaboratorilor</translation>
-<translation id="648732519525291180">selector oră</translation>
-<translation id="6550675742724504774">Opțiuni</translation>
-<translation id="6572309429103589720">Gramatică nevalidă</translation>
-<translation id="658823671542763450">deschideți în ecran complet</translation>
-<translation id="663493177488814956">feed</translation>
-<translation id="6637586476836377253">jurnal</translation>
-<translation id="6643016212128521049">Șterge</translation>
-<translation id="668171684555832681">Altele...</translation>
-<translation id="6692633176391053278">control numeric cu incrementare/decrementare</translation>
-<translation id="6709570249143506788">Calitate slabă a redării</translation>
-<translation id="6755330956360078551">balon explicativ</translation>
-<translation id="6790428901817661496">Redă</translation>
-<translation id="6820355525329141109">Nu s-a putut încărca pluginul.</translation>
-<translation id="6820615603175220800">referință bibliografică</translation>
-<translation id="6843725295806269523">dezactivați sunetul</translation>
-<translation id="6885760532393684712">director</translation>
-<translation id="689129560213475294">colofon</translation>
-<translation id="6934078000481955284">blockquote</translation>
-<translation id="6941933287844615239">descarcă conținut media</translation>
-<translation id="6981594929165378967">inserare</translation>
-<translation id="6989848892321993519">Mărește acest text la cel puțin <ph name="MIN_CHARACTERS" /> caractere (în prezent folosești 1 caracter).</translation>
-<translation id="7033340931668032222">în sus și în jos pentru a modifica volumul</translation>
-<translation id="709897737746224366">Respectă formatul solicitat.</translation>
-<translation id="7118469954320184356">Nu există nicio descriere disponibilă.</translation>
-<translation id="7139483182332611405">prefață</translation>
-<translation id="7214187073215825913">informații despre conținut</translation>
-<translation id="7263440858009898357">Selectează un articol din listă.</translation>
-<translation id="727747134524199931">antet coloană</translation>
-<translation id="7320576522385648310">Se încarcă în memoria temporară</translation>
-<translation id="7353453495576941748">mulțumire</translation>
-<translation id="7364796246159120393">Alege fișierul</translation>
-<translation id="739024184232394898">Altele...</translation>
-<translation id="7405738980073107433">note de final</translation>
-<translation id="7410239719251593705">Pare a avea conținut pentru adulți. Nu există nicio descriere disponibilă.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">filă</translation>
-<translation id="7514365320538308">Descarcă</translation>
-<translation id="7529102961911894712">backlink</translation>
-<translation id="7533959249147584474">Imagine neetichetată</translation>
-<translation id="7647456547678091388">sfat</translation>
-<translation id="7661956066982048809">document grafic</translation>
-<translation id="7673697353781729403">Ore</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">Conținut HTML</translation>
-<translation id="7745230546936012372">Pentru a obține descrierile lipsă ale imaginilor, deschide meniul contextual.</translation>
-<translation id="7750228210027921155">Picture-in-picture</translation>
-<translation id="775297008183122718">Intrare nevalidă</translation>
-<translation id="7789962463072032349">întrerupe</translation>
-<translation id="7802800022689234070">triunghi pentru afișare</translation>
-<translation id="7888071071722539607">Includeți semnul „<ph name="ATSIGN" />” în adresa de e-mail. Din adresa „<ph name="INVALIDADDRESS" />” lipsește semnul „<ph name="ATSIGN" />”.</translation>
-<translation id="7891486169920085145">element de divizare</translation>
-<translation id="795667975304826397">Nu ai ales niciun fișier</translation>
-<translation id="8053789581856978548">câmp pentru căutarea textului</translation>
-<translation id="8057695513531652401">anunț</translation>
-<translation id="8105797009065549151">trimitere la notă</translation>
-<translation id="811583516810654505">Se așteaptă descrierea…</translation>
-<translation id="8117451130807776954">Săptămâna aceasta</translation>
-<translation id="8199524924445686405">aaaa</translation>
-<translation id="8208673686607688524">selector pentru data și ora locală</translation>
-<translation id="8261464734335370856">Ortografie nevalidă</translation>
-<translation id="8284326494547611709">Subtitrări</translation>
-<translation id="835897206747267392">Valoare nevalidă.</translation>
-<translation id="8403857369060869934">timp scurs: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">parte</translation>
-<translation id="8433900881053900389">bară de instrumente</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> fișiere</translation>
-<translation id="8451268428117625855">Selectează un fișier.</translation>
-<translation id="8461852803063341183">buton radio</translation>
-<translation id="8474886197722836894">dedicație</translation>
-<translation id="8531739829932800271">erată</translation>
-<translation id="8534579021159131403">Minute</translation>
-<translation id="8541249477527128034">comandă media</translation>
-<translation id="8550857728288566671">simbol grafic</translation>
-<translation id="8583702881314752957">listă de definiții</translation>
-<translation id="8597182159515967513">antet</translation>
-<translation id="8603553056539299761">în stânga și în dreapta pentru a derula</translation>
-<translation id="860475260694818407">cuprins</translation>
-<translation id="8613126697340063924">controlează redarea la distanță</translation>
-<translation id="862370744433916922">subtitlu</translation>
-<translation id="8711688047404765493">ieșire</translation>
-<translation id="8750798805984357768">Selectează una dintre aceste opțiuni.</translation>
-<translation id="8808573423886751634">capitol</translation>
-<translation id="8845239796550121995">Acum se proiectează pe televizor</translation>
-<translation id="8851136666856101339">principal</translation>
-<translation id="8875657656876809964">Eroare de redare video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KO</translation>
-<translation id="8987927404178983737">Lună</translation>
-<translation id="901493112792887934">timp actual în secunde</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navigare</translation>
-<translation id="9062295712474918030">document</translation>
-<translation id="9062307380734144336">selectează pentru a comuta între redă și întrerupe</translation>
-<translation id="9093215626363556771">ieși din modul picture-in-picture</translation>
-<translation id="9108370397979208512">matematică</translation>
-<translation id="9132465097189459683">Altele...</translation>
-<translation id="9138385573473225930">alertă</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, începând de pe <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picture-in-Picture</translation>
-<translation id="9168329111483466115">notă de subsol</translation>
-<translation id="954003015749068518">intră în modul picture-in-picture</translation>
-<translation id="966787709310836684">meniu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ru.xtb b/chromium/content/app/strings/translations/content_strings_ru.xtb
deleted file mode 100644
index f5cd263c8ab..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ru.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ru">
-<translation id="1018939186200882850">элемент меню</translation>
-<translation id="10623998915015855">кнопка-переключатель</translation>
-<translation id="1088086359088493902">Секунды</translation>
-<translation id="1171774979989969504">Введите адрес электронной почты.</translation>
-<translation id="1178581264944972037">Пауза</translation>
-<translation id="1188858454923323853">дополнительно</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">ползунок</translation>
-<translation id="1211441953136645838">концевая сноска</translation>
-<translation id="1281252709823657822">диалоговое окно</translation>
-<translation id="1335095011850992622">выходные сведения</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">баннер</translation>
-<translation id="1589122976691792535">регион</translation>
-<translation id="1591562245178063882">В этом месяце</translation>
-<translation id="1637811476055996098">Выбрать файлы</translation>
-<translation id="1650423536718072820">цитата в виде врезки</translation>
-<translation id="1727886345390570319">скрыть меню субтитров</translation>
-<translation id="1729654308190250600">Введите адрес электронной почты.</translation>
-<translation id="1758486001363313524">Другое…</translation>
-<translation id="1806710327868736751">диалоговое окно оповещения</translation>
-<translation id="1821985195704844674">сетка в виде дерева</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">воспроизвести на удаленном устройстве</translation>
-<translation id="190587075670221089">удаление</translation>
-<translation id="1907737156431278478">пример</translation>
-<translation id="1921819250265091946">дд</translation>
-<translation id="1930711995431081526">статус</translation>
-<translation id="1938124657309484470">Максимальное значение должно быть <ph name="MAXIMUM_DATE_OR_TIME" />.</translation>
-<translation id="1946271899482435442">Показать окно выбора даты</translation>
-<translation id="1993104285338243655">Включено дублирование экрана</translation>
-<translation id="2060505056492490888">Недопустимое положение символа "<ph name="DOT" />" в адресе "<ph name="INVALIDDOMAIN" />".</translation>
-<translation id="2148716181193084225">Сегодня</translation>
-<translation id="2158401438286456825">список страниц</translation>
-<translation id="2226276347425096477">Длина текста не должна превышать <ph name="MAX_CHARACTERS" /> симв. (сейчас <ph name="CURRENT_LENGTH" /> симв.).</translation>
-<translation id="2246498165605549352">Локальный файл</translation>
-<translation id="2247351761944213033">Неделя <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Трек <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">флажок</translation>
-<translation id="2311842470354187719">разрыв страницы</translation>
-<translation id="2335594187091864976">окно выбора даты и времени</translation>
-<translation id="245932805758469625">оставшееся время до конца видео в секундах</translation>
-<translation id="248395913932153421">День</translation>
-<translation id="2507943997699731163">Заполните это поле.</translation>
-<translation id="2508569020611168319">список вкладок</translation>
-<translation id="2561842179657104141">ещё элементы управления</translation>
-<translation id="2572483411312390101">воспроизведение</translation>
-<translation id="2613802280814924224">Введите допустимое значение. Ближайшее допустимое значение: <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Отправить</translation>
-<translation id="2657045182931379222">графический объект</translation>
-<translation id="2674318244760992338">нижний колонтитул</translation>
-<translation id="2709516037105925701">Автозаполнение</translation>
-<translation id="2723001399770238859">аудио</translation>
-<translation id="2746543609216772311">Минимальное значение должно быть <ph name="MINIMUM_DATE_OR_TIME" />.</translation>
-<translation id="2759744352195237655">всплывающая кнопка</translation>
-<translation id="2761667185364618470">Чтобы продолжить, установите этот флажок.</translation>
-<translation id="2844350028562914727">подробные сведения</translation>
-<translation id="2896972712917208084">группа переключателей</translation>
-<translation id="2908441821576996758">Введите адреса электронной почты через запятую.</translation>
-<translation id="2940813599313844715">объект</translation>
-<translation id="2942448076852699108">выделенный контент</translation>
-<translation id="3040011195152428237">ссылка</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> МБ</translation>
-<translation id="3075154866155599887">Введите верное значение. Поле не заполнено или введена недействительная дата.</translation>
-<translation id="3078740164268491126">таблица</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Введите URL.</translation>
-<translation id="3175736971608411871">таймер</translation>
-<translation id="3199563858620722075">поле со списком</translation>
-<translation id="3450233048674729344">Значение должно быть меньше или равно <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">описание</translation>
-<translation id="3557673793733683882">заголовок <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">выбор недели</translation>
-<translation id="3685101356851116974">Изображение без описания</translation>
-<translation id="3706100364254443312">переключить</translation>
-<translation id="3732799496749320381">мм</translation>
-<translation id="3754210790023674521">Выйти из режима "Картинка в картинке"</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> ГБ</translation>
-<translation id="3808586225841795776">запрос</translation>
-<translation id="3822383571486410024">Минимально допустимое количество символов: <ph name="MIN_CHARACTERS" />. Длина текста сейчас: <ph name="CURRENT_LENGTH" />.</translation>
-<translation id="383465348367842624">Часть адреса до символа "<ph name="ATSIGN" />" не должна содержать символ "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Обычный режим</translation>
-<translation id="3920932319529768807">заключение</translation>
-<translation id="3924558731517983934">приложение</translation>
-<translation id="3944740393230681990">пролог</translation>
-<translation id="3960700977367013758">полоса прокрутки</translation>
-<translation id="4103419683916926126">Миллисекунды</translation>
-<translation id="4151657705144244502">изображение</translation>
-<translation id="4160057747563657758">телефон</translation>
-<translation id="4193965531860883258">предисловие</translation>
-<translation id="4201051445878709314">Показать предыдущий месяц</translation>
-<translation id="421884353938374759">color picker</translation>
-<translation id="4248100235867064564">панель меню</translation>
-<translation id="4360991593054037559">Введите допустимое значение. Ближайшие допустимые значения: <ph name="VALID_VALUE_LOW" /> и <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Вопросы и ответы</translation>
-<translation id="4413860115965805769">кнопка меню</translation>
-<translation id="4444765639179266822">Похоже, тут написано "<ph name="OCR_TEXT" />"</translation>
-<translation id="4446524499724042288">ссылка на словарную статью</translation>
-<translation id="4522570452068850558">Подробнее</translation>
-<translation id="4542388879936266156">осталось времени: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">форма</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Часть адреса после символа "<ph name="ATSIGN" />" не должна содержать символ "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">приложение</translation>
-<translation id="4718048029184481307">Воспроизведение в режиме "Картинка в картинке"</translation>
-<translation id="4742539557769756338">обложка</translation>
-<translation id="4748357248530471599">Переключить вырезанную область на полный экран</translation>
-<translation id="4757246831282535685">панель вкладок</translation>
-<translation id="4763480195061959176">видео</translation>
-<translation id="479989351350248267">поиск</translation>
-<translation id="4812940957355064477">Введите число.</translation>
-<translation id="4912536737030637138">запись в библиографии</translation>
-<translation id="4975562563186953947">Выбрано: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Включить звук</translation>
-<translation id="49969490063480558">Введите часть адреса после символа "<ph name="ATSIGN" />". Адрес "<ph name="INVALIDADDRESS" />" неполный.</translation>
-<translation id="5034860022980953847">индикатор хода выполнения</translation>
-<translation id="5090250355906949916">полоса воспроизведения видео</translation>
-<translation id="5093189678851173835">эпиграф</translation>
-<translation id="5117590920725113268">Показать следующий месяц</translation>
-<translation id="512758898067543763">заголовок строки</translation>
-<translation id="5143125788380636750">эпилог</translation>
-<translation id="5164977714490026579">Значение должно быть больше или равно <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> ПБ</translation>
-<translation id="5307600278924710095">Введите часть адреса до символа "<ph name="ATSIGN" />". Адрес "<ph name="INVALIDADDRESS" />" неполный.</translation>
-<translation id="5334352251556557839">Не удалось воспроизвести медиафайл.</translation>
-<translation id="5406322316791861025">фигура</translation>
-<translation id="5453733299334684579">элемент дерева</translation>
-<translation id="5466621249238537318">Выберите один или несколько файлов.</translation>
-<translation id="5468998798572797635">выход из полноэкранного режима</translation>
-<translation id="5516424706154626233">окно выбора даты</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">включение звука</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">Чтобы пропустить 10 секунд, нажмите дважды слева или справа.</translation>
-<translation id="5631759159893697722">аннотация</translation>
-<translation id="5643186887447432888">кнопка</translation>
-<translation id="5677946354068040947">дополнительные параметры</translation>
-<translation id="576709008726043716">введение</translation>
-<translation id="57838592816432529">Отключить звук</translation>
-<translation id="5860033963881614850">ВЫКЛ</translation>
-<translation id="588258955323874662">Полноэкранный режим</translation>
-<translation id="5888666972993069672">Транслируется на устройство "<ph name="DEVICE_FRIENDLY_NAME" />"</translation>
-<translation id="591047860372322273">Окно поиска</translation>
-<translation id="5939518447894949180">Сбросить</translation>
-<translation id="5966707198760109579">Неделя</translation>
-<translation id="5987525920412732405">кнопка счетчика</translation>
-<translation id="6011459053400940133">регулятор громкости</translation>
-<translation id="6015796118275082299">Год</translation>
-<translation id="6023896073578205740">список</translation>
-<translation id="6150588977291308318">библиография</translation>
-<translation id="6164829606128959761">счетчик</translation>
-<translation id="6166809985690652833">послесловие</translation>
-<translation id="6209276755895393898">Кажется, это "<ph name="DESCRIPTION" />"</translation>
-<translation id="6213469881011901533">словарь</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Выйти из режима "Картинка в картинке"</translation>
-<translation id="6398862346408813489">Показать панель выбора месяца</translation>
-<translation id="6404546809543547843">полоса воспроизведения</translation>
-<translation id="6443871981718447451">показать меню субтитров</translation>
-<translation id="6453774872122745852">благодарности</translation>
-<translation id="648732519525291180">окно выбора даты</translation>
-<translation id="6550675742724504774">Параметры</translation>
-<translation id="6572309429103589720">Грамматическая ошибка</translation>
-<translation id="658823671542763450">полноэкранный режим</translation>
-<translation id="663493177488814956">лента</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Удалить</translation>
-<translation id="668171684555832681">Другой...</translation>
-<translation id="6692633176391053278">счетчик</translation>
-<translation id="6709570249143506788">Плохое качество воспроизведения</translation>
-<translation id="6755330956360078551">подсказка</translation>
-<translation id="6790428901817661496">Воспроизвести</translation>
-<translation id="6820355525329141109">Не удалось загрузить плагин</translation>
-<translation id="6820615603175220800">ссылка на библиографию</translation>
-<translation id="6843725295806269523">отключить звук</translation>
-<translation id="6885760532393684712">каталог</translation>
-<translation id="689129560213475294">выпускные данные</translation>
-<translation id="6934078000481955284">цитата</translation>
-<translation id="6941933287844615239">скачать файл</translation>
-<translation id="6981594929165378967">вставка</translation>
-<translation id="6989848892321993519">Текст должен быть не короче <ph name="MIN_CHARACTERS" /> симв. Длина текста сейчас: 1 символ.</translation>
-<translation id="7033340931668032222">вверх и вниз для регулировки громкости</translation>
-<translation id="709897737746224366">Введите данные в указанном формате.</translation>
-<translation id="7118469954320184356">Нет описания.</translation>
-<translation id="7139483182332611405">вступление</translation>
-<translation id="7214187073215825913">информация о содержании</translation>
-<translation id="7263440858009898357">Выберите один из пунктов списка.</translation>
-<translation id="727747134524199931">заголовок столбца</translation>
-<translation id="7320576522385648310">Буферизация…</translation>
-<translation id="7353453495576941748">упоминание</translation>
-<translation id="7364796246159120393">Выберите файл</translation>
-<translation id="739024184232394898">Другое…</translation>
-<translation id="7405738980073107433">концевые сноски</translation>
-<translation id="7410239719251593705">Похоже, это контент для взрослых. Описания нет.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> ТБ</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Скачать</translation>
-<translation id="7529102961911894712">обратная ссылка</translation>
-<translation id="7533959249147584474">Графическое изображение без описания</translation>
-<translation id="7647456547678091388">совет</translation>
-<translation id="7661956066982048809">графический документ</translation>
-<translation id="7673697353781729403">Часы</translation>
-<translation id="7681220483256441252">указатель</translation>
-<translation id="7740050170769002709">HTML-содержание</translation>
-<translation id="7745230546936012372">Чтобы получить недостающие описания изображений, откройте контекстное меню.</translation>
-<translation id="7750228210027921155">Картинка в картинке</translation>
-<translation id="775297008183122718">Неверная запись</translation>
-<translation id="7789962463072032349">Пауза</translation>
-<translation id="7802800022689234070">треугольник развертывания</translation>
-<translation id="7888071071722539607">Адрес электронной почты должен содержать символ "<ph name="ATSIGN" />". В адресе "<ph name="INVALIDADDRESS" />" отсутствует символ "<ph name="ATSIGN" />".</translation>
-<translation id="7891486169920085145">разделитель</translation>
-<translation id="795667975304826397">Файл не выбран</translation>
-<translation id="8053789581856978548">поле поиска</translation>
-<translation id="8057695513531652401">примечание</translation>
-<translation id="8105797009065549151">ссылка на примечание</translation>
-<translation id="811583516810654505">Загружается описание...</translation>
-<translation id="8117451130807776954">На этой неделе</translation>
-<translation id="8199524924445686405">гггг</translation>
-<translation id="8208673686607688524">выбор местного времени и даты</translation>
-<translation id="8261464734335370856">Орфографическая ошибка</translation>
-<translation id="8284326494547611709">Титры</translation>
-<translation id="835897206747267392">Недопустимые данные.</translation>
-<translation id="8403857369060869934">прошло времени: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">часть</translation>
-<translation id="8433900881053900389">панель инструментов</translation>
-<translation id="8444882422881193423">Число файлов: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Выберите файл.</translation>
-<translation id="8461852803063341183">переключатель</translation>
-<translation id="8474886197722836894">посвящение</translation>
-<translation id="8531739829932800271">список опечаток</translation>
-<translation id="8534579021159131403">Минуты</translation>
-<translation id="8541249477527128034">управление мультимедиа</translation>
-<translation id="8550857728288566671">графический символ</translation>
-<translation id="8583702881314752957">список описаний</translation>
-<translation id="8597182159515967513">заголовок</translation>
-<translation id="8603553056539299761">вправо и влево для поиска</translation>
-<translation id="860475260694818407">оглавление</translation>
-<translation id="8613126697340063924">управлять воспроизведением на удаленных устройствах</translation>
-<translation id="862370744433916922">подзаголовок</translation>
-<translation id="8711688047404765493">выход</translation>
-<translation id="8750798805984357768">Выберите один из вариантов.</translation>
-<translation id="8808573423886751634">глава</translation>
-<translation id="8845239796550121995">Транслируется на телевизор</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Ошибка при воспроизведении видео</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> КБ</translation>
-<translation id="8987927404178983737">Месяц</translation>
-<translation id="901493112792887934">текущее время в секундах</translation>
-<translation id="901834265349196618">электронная почта</translation>
-<translation id="9048119486235211610">навигация</translation>
-<translation id="9062295712474918030">документ</translation>
-<translation id="9062307380734144336">Выберите, чтобы включить или поставить на паузу</translation>
-<translation id="9093215626363556771">выйти из режима "Картинка в картинке"</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Другое…</translation>
-<translation id="9138385573473225930">оповещение</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, начинается <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Картинка в картинке</translation>
-<translation id="9168329111483466115">сноска</translation>
-<translation id="954003015749068518">включить режим "Картинка в картинке"</translation>
-<translation id="966787709310836684">меню</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_sk.xtb b/chromium/content/app/strings/translations/content_strings_sk.xtb
deleted file mode 100644
index 4b1bb417366..00000000000
--- a/chromium/content/app/strings/translations/content_strings_sk.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="sk">
-<translation id="1018939186200882850">položka ponuky</translation>
-<translation id="10623998915015855">tlačidlo prepínania</translation>
-<translation id="1088086359088493902">Sekundy</translation>
-<translation id="1171774979989969504">Zadajte e-mailovú adresu.</translation>
-<translation id="1178581264944972037">Pozastaviť</translation>
-<translation id="1188858454923323853">doplnkové</translation>
-<translation id="1206619573307042055">pohyblivý prvok</translation>
-<translation id="1206693055195146388">posúvač</translation>
-<translation id="1211441953136645838">vysvetlivka</translation>
-<translation id="1281252709823657822">dialóg</translation>
-<translation id="1335095011850992622">titulky</translation>
-<translation id="1342835525016946179">článok</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">oblasť</translation>
-<translation id="1591562245178063882">Tento mesiac</translation>
-<translation id="1637811476055996098">Vybrať súbory</translation>
-<translation id="1650423536718072820">obsiahnutý citát</translation>
-<translation id="1727886345390570319">skryť ponuku skrytých titulkov</translation>
-<translation id="1729654308190250600">Zadajte e-mailovú adresu, ktorá nie je prázdna hodnota.</translation>
-<translation id="1758486001363313524">Iné...</translation>
-<translation id="1806710327868736751">dialóg_upozornenia</translation>
-<translation id="1821985195704844674">stromová mriežka</translation>
-<translation id="1822429046913737220">AM / PM</translation>
-<translation id="1832974991323546415">prehrať na vzdialenom zariadení</translation>
-<translation id="190587075670221089">odstránenie</translation>
-<translation id="1907737156431278478">príklad</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">stav</translation>
-<translation id="1938124657309484470">Hodnota musí byť <ph name="MAXIMUM_DATE_OR_TIME" /> alebo skôr.</translation>
-<translation id="1946271899482435442">Zobraziť výber dátumu</translation>
-<translation id="1993104285338243655">Prepnuté na zrkadlenie</translation>
-<translation id="2060505056492490888">Znak <ph name="DOT" /> je v doméne <ph name="INVALIDDOMAIN" /> použitý na nesprávnej pozícii.</translation>
-<translation id="2148716181193084225">Dnes</translation>
-<translation id="2158401438286456825">zoznam strán</translation>
-<translation id="2226276347425096477">Tento text musíte skrátiť na <ph name="MAX_CHARACTERS" /> znakov alebo menej (súčasný počet znakov: <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="2246498165605549352">Miestny súbor</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. týždeň, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Skladba <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">začiarkavacie políčko</translation>
-<translation id="2311842470354187719">zlom strany</translation>
-<translation id="2335594187091864976">výber dátumu a času</translation>
-<translation id="245932805758469625">počet sekúnd do konca videa</translation>
-<translation id="248395913932153421">Deň</translation>
-<translation id="2507943997699731163">Vyplňte toto pole.</translation>
-<translation id="2508569020611168319">zoznam kariet</translation>
-<translation id="2561842179657104141">zobraziť ďalšie ovládacie prvky médií</translation>
-<translation id="2572483411312390101">prehrať</translation>
-<translation id="2613802280814924224">Zadajte platnú hodnotu. Najbližšia platná hodnota je <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Odoslať</translation>
-<translation id="2657045182931379222">grafický objekt</translation>
-<translation id="2674318244760992338">päta</translation>
-<translation id="2709516037105925701">Automatické dopĺňanie</translation>
-<translation id="2723001399770238859">zvuk</translation>
-<translation id="2746543609216772311">Hodnota musí byť <ph name="MINIMUM_DATE_OR_TIME" /> alebo neskôr.</translation>
-<translation id="2759744352195237655">kontextové tlačidlo</translation>
-<translation id="2761667185364618470">Ak chcete pokračovať, začiarknite toto políčko.</translation>
-<translation id="2844350028562914727">podrobnosti</translation>
-<translation id="2896972712917208084">skupina prepínačov</translation>
-<translation id="2908441821576996758">Zadajte zoznam e-mailových adries oddelených čiarkou.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">zvýraznený obsah</translation>
-<translation id="3040011195152428237">odkaz</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Zadajte platnú hodnotu. Pole obsahuje neúplnú hodnotu alebo neplatný dátum.</translation>
-<translation id="3078740164268491126">tabuľka</translation>
-<translation id="3086746722712840547">poznámka</translation>
-<translation id="310520048233152454">Zadajte webovú adresu.</translation>
-<translation id="3175736971608411871">časovač</translation>
-<translation id="3199563858620722075">pole s výberom</translation>
-<translation id="3450233048674729344">Hodnota musí byť menšia alebo rovná hodnote <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definícia</translation>
-<translation id="3557673793733683882">nadpis <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">výber týždňa</translation>
-<translation id="3685101356851116974">Neoznačený obrázok</translation>
-<translation id="3706100364254443312">prepínač</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Ukončiť obraz v obraze</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">výraz</translation>
-<translation id="3822383571486410024">Predĺžte tento text aspoň na <ph name="MIN_CHARACTERS" /> alebo viac znakov (momentálny počet znakov je <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="383465348367842624">Časť pred znakom <ph name="ATSIGN" /> by nemala obsahovať symbol <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="3846214748874656680">Ukončiť režim celej obrazovky</translation>
-<translation id="3920932319529768807">záver</translation>
-<translation id="3924558731517983934">aplikácia</translation>
-<translation id="3944740393230681990">prológ</translation>
-<translation id="3960700977367013758">posúvač</translation>
-<translation id="4103419683916926126">Milisekundy</translation>
-<translation id="4151657705144244502">grafika</translation>
-<translation id="4160057747563657758">telefón</translation>
-<translation id="4193965531860883258">predhovor</translation>
-<translation id="4201051445878709314">Zobraziť predchádzajúci mesiac</translation>
-<translation id="421884353938374759">výber farieb</translation>
-<translation id="4248100235867064564">panel s ponukami</translation>
-<translation id="4360991593054037559">Zadajte platnú hodnotu. Najbližšie platné hodnoty sú <ph name="VALID_VALUE_LOW" /> a <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Otázky a odpovede</translation>
-<translation id="4413860115965805769">tlačidlo ponuky</translation>
-<translation id="4444765639179266822">Zrejme znamená: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">glosárový termín</translation>
-<translation id="4522570452068850558">Podrobnosti</translation>
-<translation id="4542388879936266156">zostávajúci čas: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulár</translation>
-<translation id="4661075872484491155">strom</translation>
-<translation id="4664250907885839816">Časť za znakom <ph name="ATSIGN" /> by nemala obsahovať symbol <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="4668956016107839909">príloha</translation>
-<translation id="4718048029184481307">Prehráva sa v režime obrazu v obraze</translation>
-<translation id="4742539557769756338">titulná strana</translation>
-<translation id="4748357248530471599">prepnúť výrez obrazovky na celú obrazovku</translation>
-<translation id="4757246831282535685">panel karty</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Zadajte číslo.</translation>
-<translation id="4912536737030637138">bibliografický záznam</translation>
-<translation id="4975562563186953947">Počet vybraných položiek: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Zapnúť zvuk</translation>
-<translation id="49969490063480558">Zadajte časť za znakom <ph name="ATSIGN" />. Adresa <ph name="INVALIDADDRESS" /> je neúplná.</translation>
-<translation id="5034860022980953847">indikátor priebehu</translation>
-<translation id="5090250355906949916">posúvač časovej osi videa</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Zobraziť ďalší mesiac</translation>
-<translation id="512758898067543763">hlavička riadka</translation>
-<translation id="5143125788380636750">epilóg</translation>
-<translation id="5164977714490026579">Hodnota musí byť väčšia alebo rovná hodnote <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Zadajte časť pred znakom <ph name="ATSIGN" />. Adresa <ph name="INVALIDADDRESS" /> je neúplná.</translation>
-<translation id="5334352251556557839">Nepodarilo sa prehrať médiá.</translation>
-<translation id="5406322316791861025">hodnota</translation>
-<translation id="5453733299334684579">položka stromu</translation>
-<translation id="5466621249238537318">Vyberte jeden alebo viac súborov.</translation>
-<translation id="5468998798572797635">ukončiť režim celej obrazovky</translation>
-<translation id="5516424706154626233">výber dátumu</translation>
-<translation id="5537725057119320332">Prenášať</translation>
-<translation id="5546461542133609677">obnoviť zvuk</translation>
-<translation id="561939826962581046">čas</translation>
-<translation id="5630795885300617244">Dvojitým klepnutím doľava alebo doprava preskočíte o 10 s</translation>
-<translation id="5631759159893697722">abstrakt</translation>
-<translation id="5643186887447432888">tlačidlo</translation>
-<translation id="5677946354068040947">ďalšie možnosti</translation>
-<translation id="576709008726043716">úvod</translation>
-<translation id="57838592816432529">Vypnúť zvuk</translation>
-<translation id="5860033963881614850">Vypnuté</translation>
-<translation id="588258955323874662">Celá obrazovka</translation>
-<translation id="5888666972993069672">Prenáša sa do zariadenia <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">vyhľadávacie pole</translation>
-<translation id="5939518447894949180">Resetovať</translation>
-<translation id="5966707198760109579">Týždeň</translation>
-<translation id="5987525920412732405">tlačidlo otáčania</translation>
-<translation id="6011459053400940133">posúvač hlasitosti</translation>
-<translation id="6015796118275082299">Rok</translation>
-<translation id="6023896073578205740">zoznamové pole</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">meter</translation>
-<translation id="6166809985690652833">doslov</translation>
-<translation id="6209276755895393898">Zrejme to bude: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosár</translation>
-<translation id="6281763101136022427">Webová adresa</translation>
-<translation id="6310801910862476708">Ukončiť obraz v obraze</translation>
-<translation id="6398862346408813489">Zobraziť panel na výber mesiaca</translation>
-<translation id="6404546809543547843">posúvač časovej osi zvuku</translation>
-<translation id="6443871981718447451">zobraziť ponuku skrytých titulkov</translation>
-<translation id="6453774872122745852">poďakovanie</translation>
-<translation id="648732519525291180">výber času</translation>
-<translation id="6550675742724504774">Možnosti</translation>
-<translation id="6572309429103589720">Neplatná gramatika</translation>
-<translation id="658823671542763450">prejsť do režimu celej obrazovky</translation>
-<translation id="663493177488814956">informačný kanál</translation>
-<translation id="6637586476836377253">denník</translation>
-<translation id="6643016212128521049">Vymazať</translation>
-<translation id="668171684555832681">Iný...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Nízka kvalita prehrávania</translation>
-<translation id="6755330956360078551">popis</translation>
-<translation id="6790428901817661496">Prehrať</translation>
-<translation id="6820355525329141109">Doplnok sa nepodarilo načítať.</translation>
-<translation id="6820615603175220800">bibliografický odkaz</translation>
-<translation id="6843725295806269523">stlmiť</translation>
-<translation id="6885760532393684712">adresár</translation>
-<translation id="689129560213475294">kolofón</translation>
-<translation id="6934078000481955284">značka blockquote</translation>
-<translation id="6941933287844615239">stiahnuť médiá</translation>
-<translation id="6981594929165378967">vloženie</translation>
-<translation id="6989848892321993519">Predĺžte tento text aspoň na <ph name="MIN_CHARACTERS" /> alebo viac znakov (momentálne používate jeden znak).</translation>
-<translation id="7033340931668032222">smery nahor a nadol slúžia na zmenu hlasitosti</translation>
-<translation id="709897737746224366">Zadajte hodnotu zodpovedajúcu požadovanému formátu.</translation>
-<translation id="7118469954320184356">Nie je k dispozícii žiadny popis.</translation>
-<translation id="7139483182332611405">predslov</translation>
-<translation id="7214187073215825913">informácie o obsahu</translation>
-<translation id="7263440858009898357">Vyberte položku zo zoznamu.</translation>
-<translation id="727747134524199931">hlavička stĺpca</translation>
-<translation id="7320576522385648310">ukladá sa do vyrovnávacej pamäte</translation>
-<translation id="7353453495576941748">poďakovanie</translation>
-<translation id="7364796246159120393">Vybrať súbor</translation>
-<translation id="739024184232394898">Iné...</translation>
-<translation id="7405738980073107433">vysvetlivky</translation>
-<translation id="7410239719251593705">Zrejme zahŕňa obsah pre dospelých. Nie je k dispozícii žiadny popis.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">karta</translation>
-<translation id="7514365320538308">Stiahnuť</translation>
-<translation id="7529102961911894712">spätný odkaz</translation>
-<translation id="7533959249147584474">Neoznačený obrázok</translation>
-<translation id="7647456547678091388">tip</translation>
-<translation id="7661956066982048809">grafický dokument</translation>
-<translation id="7673697353781729403">Hodiny</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">Obsah HTML</translation>
-<translation id="7745230546936012372">Ak chcete získať chýbajúce popisy obrázka, otvorte kontextovú ponuku.</translation>
-<translation id="7750228210027921155">Obraz v obraze</translation>
-<translation id="775297008183122718">Neplatný vstup</translation>
-<translation id="7789962463072032349">pozastaviť</translation>
-<translation id="7802800022689234070">trojuholníkové tlačidlo na zobrazenie skrytého obsahu</translation>
-<translation id="7888071071722539607">Uveďte v e-mailovej adrese znak <ph name="ATSIGN" />. V adrese <ph name="INVALIDADDRESS" /> znak <ph name="ATSIGN" /> chýba.</translation>
-<translation id="7891486169920085145">rozdeľovač</translation>
-<translation id="795667975304826397">Nie je vybratý žiadny súbor</translation>
-<translation id="8053789581856978548">textové pole pre vyhľadávanie</translation>
-<translation id="8057695513531652401">upozornenie</translation>
-<translation id="8105797009065549151">odkaz na poznámku</translation>
-<translation id="811583516810654505">Načítava sa popis…</translation>
-<translation id="8117451130807776954">Tento týždeň</translation>
-<translation id="8199524924445686405">rrrr</translation>
-<translation id="8208673686607688524">výber miestneho dátumu a času</translation>
-<translation id="8261464734335370856">Neplatný pravopis</translation>
-<translation id="8284326494547611709">Titulky</translation>
-<translation id="835897206747267392">Neplatná hodnota.</translation>
-<translation id="8403857369060869934">uplynutý čas: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">časť</translation>
-<translation id="8433900881053900389">panel s nástrojmi</translation>
-<translation id="8444882422881193423">Počet súborov: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Vyberte súbor.</translation>
-<translation id="8461852803063341183">prepínač</translation>
-<translation id="8474886197722836894">venovanie</translation>
-<translation id="8531739829932800271">erráta</translation>
-<translation id="8534579021159131403">Minúty</translation>
-<translation id="8541249477527128034">ovládanie médií</translation>
-<translation id="8550857728288566671">grafický symbol</translation>
-<translation id="8583702881314752957">zoznam definícií</translation>
-<translation id="8597182159515967513">nadpis</translation>
-<translation id="8603553056539299761">smery vľavo a vpravo slúžia na hľadanie</translation>
-<translation id="860475260694818407">obsah</translation>
-<translation id="8613126697340063924">ovládať vzdialené prehrávanie</translation>
-<translation id="862370744433916922">podnadpis</translation>
-<translation id="8711688047404765493">výstup</translation>
-<translation id="8750798805984357768">Vyberte jednu z týchto možností.</translation>
-<translation id="8808573423886751634">kapitola</translation>
-<translation id="8845239796550121995">Prenáša sa do televízora</translation>
-<translation id="8851136666856101339">hlavné</translation>
-<translation id="8875657656876809964">Chyba prehrávania videa</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Mesiac</translation>
-<translation id="901493112792887934">aktuálny čas v sekundách</translation>
-<translation id="901834265349196618">e-mail</translation>
-<translation id="9048119486235211610">navigácia</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">prepnutie medzi možnosťami Prehrať a Pozastaviť</translation>
-<translation id="9093215626363556771">ukončiť obraz v obraze</translation>
-<translation id="9108370397979208512">matematika</translation>
-<translation id="9132465097189459683">Iné...</translation>
-<translation id="9138385573473225930">upozornenie</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> začínajúci <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Obraz v obraze</translation>
-<translation id="9168329111483466115">poznámka pod čiarou</translation>
-<translation id="954003015749068518">zapnúť obraz v obraze</translation>
-<translation id="966787709310836684">ponuka</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_sl.xtb b/chromium/content/app/strings/translations/content_strings_sl.xtb
deleted file mode 100644
index 8f942296938..00000000000
--- a/chromium/content/app/strings/translations/content_strings_sl.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="sl">
-<translation id="1018939186200882850">menijski element</translation>
-<translation id="10623998915015855">preklopni gumb</translation>
-<translation id="1088086359088493902">Sekunde</translation>
-<translation id="1171774979989969504">Vnesite e-poštni naslov</translation>
-<translation id="1178581264944972037">Prekini</translation>
-<translation id="1188858454923323853">dopolnilno</translation>
-<translation id="1206619573307042055">potujoči napis</translation>
-<translation id="1206693055195146388">drsnik</translation>
-<translation id="1211441953136645838">končna opomba</translation>
-<translation id="1281252709823657822">pogovorno okno</translation>
-<translation id="1335095011850992622">seznam sodelujočih</translation>
-<translation id="1342835525016946179">člnk</translation>
-<translation id="1359897965706325498">pasica</translation>
-<translation id="1589122976691792535">območje</translation>
-<translation id="1591562245178063882">Ta mesec</translation>
-<translation id="1637811476055996098">Izberi datoteke</translation>
-<translation id="1650423536718072820">pojavni citat</translation>
-<translation id="1727886345390570319">skrij meni s podnapisi</translation>
-<translation id="1729654308190250600">Vnesite e-poštni naslov (polje ne sme biti prazno).</translation>
-<translation id="1758486001363313524">Drugo ...</translation>
-<translation id="1806710327868736751">pogovorno okno z opozorilom</translation>
-<translation id="1821985195704844674">drevesna mreža</translation>
-<translation id="1822429046913737220">Dopoldne/popoldne</translation>
-<translation id="1832974991323546415">predvajanje v oddaljeni napravi</translation>
-<translation id="190587075670221089">brisanje</translation>
-<translation id="1907737156431278478">primer</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">stanje</translation>
-<translation id="1938124657309484470">Vrednost mora biti <ph name="MAXIMUM_DATE_OR_TIME" /> ali prej.</translation>
-<translation id="1946271899482435442">Pokaži izbirnik datuma</translation>
-<translation id="1993104285338243655">Preklopljeno na zrcaljenje</translation>
-<translation id="2060505056492490888">»<ph name="DOT" />« je na napačnem mestu v »<ph name="INVALIDDOMAIN" />«.</translation>
-<translation id="2148716181193084225">Danes</translation>
-<translation id="2158401438286456825">seznam strani</translation>
-<translation id="2226276347425096477">Skrajšajte to besedilo na <ph name="MAX_CHARACTERS" /> znakov ali manj (trenutno uporabljate <ph name="CURRENT_LENGTH" /> znakov).</translation>
-<translation id="2246498165605549352">Lokalna datoteka</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. teden, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Besedilni posnetek <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">potrditveno polje</translation>
-<translation id="2311842470354187719">prelom strani</translation>
-<translation id="2335594187091864976">izbirnik datuma in ure</translation>
-<translation id="245932805758469625">preostale sekunde videoposnetka</translation>
-<translation id="248395913932153421">Dan</translation>
-<translation id="2507943997699731163">Izpolnite to polje</translation>
-<translation id="2508569020611168319">seznam zavihkov</translation>
-<translation id="2561842179657104141">prikaz več kontrolnikov za predstavnost</translation>
-<translation id="2572483411312390101">predvajanje</translation>
-<translation id="2613802280814924224">Vnesite veljavno vrednost. Najbližja veljavna vrednost je <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Pošlji</translation>
-<translation id="2657045182931379222">grafični predmet</translation>
-<translation id="2674318244760992338">noga</translation>
-<translation id="2709516037105925701">Samodejno izpolnjevanje</translation>
-<translation id="2723001399770238859">zvok</translation>
-<translation id="2746543609216772311">Vrednost mora biti <ph name="MINIMUM_DATE_OR_TIME" /> ali pozneje.</translation>
-<translation id="2759744352195237655">pojavni gumb</translation>
-<translation id="2761667185364618470">Potrdite to polje, če želite nadaljevati.</translation>
-<translation id="2844350028562914727">podrobnosti</translation>
-<translation id="2896972712917208084">skupina izbirnih gumbov</translation>
-<translation id="2908441821576996758">Vnesite seznam e-poštnih naslovov, ločenih z vejicami</translation>
-<translation id="2940813599313844715">predmet</translation>
-<translation id="2942448076852699108">označena vsebina</translation>
-<translation id="3040011195152428237">povezava</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Vnesite veljavno vrednost. Vnos v polje je nepopoln ali vsebuje neveljaven datum.</translation>
-<translation id="3078740164268491126">tabela</translation>
-<translation id="3086746722712840547">opmb</translation>
-<translation id="310520048233152454">Vnesite URL.</translation>
-<translation id="3175736971608411871">merilnik časa</translation>
-<translation id="3199563858620722075">kombinirano polje</translation>
-<translation id="3450233048674729344">Vrednost mora biti manjša od <ph name="MAXIMUM" /> ali enaka.</translation>
-<translation id="3486220673238053218">opredelitev</translation>
-<translation id="3557673793733683882">naslov <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">izbirnik tedna</translation>
-<translation id="3685101356851116974">Neoznačena slika</translation>
-<translation id="3706100364254443312">preklop</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Zapri način slike v sliki</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">izraz</translation>
-<translation id="3822383571486410024">Podaljšajte to besedilo na toliko znakov ali več: <ph name="MIN_CHARACTERS" /> (trenutno uporabljate toliko znakov: <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="383465348367842624">Del pred »<ph name="ATSIGN" />« ne sme vsebovati znaka »<ph name="INVALIDCHARACTER" />«.</translation>
-<translation id="3846214748874656680">Zapri celozaslonski način</translation>
-<translation id="3920932319529768807">sklep</translation>
-<translation id="3924558731517983934">aplikacija</translation>
-<translation id="3944740393230681990">uvod</translation>
-<translation id="3960700977367013758">drsni trak</translation>
-<translation id="4103419683916926126">Milisekunde</translation>
-<translation id="4151657705144244502">grafični element</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">predgovor</translation>
-<translation id="4201051445878709314">Prikaz prejšnjega meseca</translation>
-<translation id="421884353938374759">izbirnik barve</translation>
-<translation id="4248100235867064564">menijska vrstica</translation>
-<translation id="4360991593054037559">Vnesite veljavno vrednost. Najbližji veljavni vrednosti sta <ph name="VALID_VALUE_LOW" /> in <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Vprašanja</translation>
-<translation id="4413860115965805769">menijski gumb</translation>
-<translation id="4444765639179266822">Videti je, da piše: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">vnos v glosarju</translation>
-<translation id="4522570452068850558">Podrobnosti</translation>
-<translation id="4542388879936266156">preostali čas: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">obrazec</translation>
-<translation id="4661075872484491155">drevo</translation>
-<translation id="4664250907885839816">Del po »<ph name="ATSIGN" />« ne sme vsebovati znaka »<ph name="INVALIDCHARACTER" />«.</translation>
-<translation id="4668956016107839909">dodatek</translation>
-<translation id="4718048029184481307">Predvajanje v načinu slike v sliki</translation>
-<translation id="4742539557769756338">naslovnica</translation>
-<translation id="4748357248530471599">preklop celozaslonskega načina na zarezo zaslona</translation>
-<translation id="4757246831282535685">podokno z zavihki</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Vnesite številko.</translation>
-<translation id="4912536737030637138">bibliografski vnos</translation>
-<translation id="4975562563186953947">Št. izbranih: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Vklopi zvok</translation>
-<translation id="49969490063480558">Vnesite nekaj po znaku »<ph name="ATSIGN" />«. Naslov »<ph name="INVALIDADDRESS" />« je nepopoln.</translation>
-<translation id="5034860022980953847">kazalnik poteka</translation>
-<translation id="5090250355906949916">časovni krmilnik za predvajanje videoposnetka</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Prikaz naslednjega meseca</translation>
-<translation id="512758898067543763">glava vrstice</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Vrednost mora biti večja od <ph name="MINIMUM" /> ali enaka.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Vnesite nekaj in nato <ph name="ATSIGN" />. Naslov »<ph name="INVALIDADDRESS" />« je nepopoln.</translation>
-<translation id="5334352251556557839">Predstavnosti ni mogoče predvajati.</translation>
-<translation id="5406322316791861025">številka</translation>
-<translation id="5453733299334684579">element drevesa</translation>
-<translation id="5466621249238537318">Izberite eno ali več datotek.</translation>
-<translation id="5468998798572797635">izhod iz celozaslonskega načina</translation>
-<translation id="5516424706154626233">izbirnik datuma</translation>
-<translation id="5537725057119320332">Predvajanje</translation>
-<translation id="5546461542133609677">vklop zvoka</translation>
-<translation id="561939826962581046">čas</translation>
-<translation id="5630795885300617244">Dvakrat se dotaknite levo ali desno, da preskočite 10 s</translation>
-<translation id="5631759159893697722">izvleček</translation>
-<translation id="5643186887447432888">gumb</translation>
-<translation id="5677946354068040947">več možnosti</translation>
-<translation id="576709008726043716">uvod</translation>
-<translation id="57838592816432529">Izklopi zvok</translation>
-<translation id="5860033963881614850">Izklopljeno</translation>
-<translation id="588258955323874662">Celozaslonsko</translation>
-<translation id="5888666972993069672">Predvajanje v napravi <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">iskalno polje</translation>
-<translation id="5939518447894949180">Ponastavi</translation>
-<translation id="5966707198760109579">Teden</translation>
-<translation id="5987525920412732405">pomikalnik</translation>
-<translation id="6011459053400940133">drsnik za glasnost</translation>
-<translation id="6015796118275082299">Leto</translation>
-<translation id="6023896073578205740">polje s seznamom</translation>
-<translation id="6150588977291308318">bibliografija</translation>
-<translation id="6164829606128959761">merilnik</translation>
-<translation id="6166809985690652833">spremna beseda</translation>
-<translation id="6209276755895393898">Videti je kot: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">glosar</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Zapri način slike v sliki</translation>
-<translation id="6398862346408813489">Prikaz podokna za izbiro meseca</translation>
-<translation id="6404546809543547843">časovni krmilnik za predvajanje zvoka</translation>
-<translation id="6443871981718447451">pokaži meni s podnapisi</translation>
-<translation id="6453774872122745852">zahvala</translation>
-<translation id="648732519525291180">izbirnik ure</translation>
-<translation id="6550675742724504774">Možnosti</translation>
-<translation id="6572309429103589720">Neveljavna slovnica</translation>
-<translation id="658823671542763450">prehod v celozaslonski način</translation>
-<translation id="663493177488814956">vir</translation>
-<translation id="6637586476836377253">dnevn</translation>
-<translation id="6643016212128521049">Izbriši</translation>
-<translation id="668171684555832681">Drugo ...</translation>
-<translation id="6692633176391053278">kontrolnik</translation>
-<translation id="6709570249143506788">Slaba kakovost predvajanja</translation>
-<translation id="6755330956360078551">opis orodja</translation>
-<translation id="6790428901817661496">Predvajanje</translation>
-<translation id="6820355525329141109">Vtičnika ni bilo mogoče naložiti.</translation>
-<translation id="6820615603175220800">bibliografski viri</translation>
-<translation id="6843725295806269523">nemo</translation>
-<translation id="6885760532393684712">imenik</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">daljši citat</translation>
-<translation id="6941933287844615239">prenos predstavnosti</translation>
-<translation id="6981594929165378967">vstavljanje</translation>
-<translation id="6989848892321993519">Podaljšajte to besedilo na toliko znakov ali več: <ph name="MIN_CHARACTERS" /> (trenutno uporabljate en znak).</translation>
-<translation id="7033340931668032222">navzgor in navzdol za spreminjanje glasnosti</translation>
-<translation id="709897737746224366">Poskrbite za ujemanje z zahtevano obliko.</translation>
-<translation id="7118469954320184356">Ni opisa.</translation>
-<translation id="7139483182332611405">predgovor</translation>
-<translation id="7214187073215825913">podatki o vsebini</translation>
-<translation id="7263440858009898357">Izberite element s seznama.</translation>
-<translation id="727747134524199931">glava stolpca</translation>
-<translation id="7320576522385648310">medpomnjenje</translation>
-<translation id="7353453495576941748">zasluga</translation>
-<translation id="7364796246159120393">Izberite datoteko</translation>
-<translation id="739024184232394898">Drugo ...</translation>
-<translation id="7405738980073107433">končne opombe</translation>
-<translation id="7410239719251593705">Videti je, da vsebuje vsebino za odrasle. Ni opisa.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tabulatorka</translation>
-<translation id="7514365320538308">Prenos</translation>
-<translation id="7529102961911894712">povratna povezava</translation>
-<translation id="7533959249147584474">Neoznačena grafika</translation>
-<translation id="7647456547678091388">namig</translation>
-<translation id="7661956066982048809">grafični dokument</translation>
-<translation id="7673697353781729403">Ure</translation>
-<translation id="7681220483256441252">kazalo</translation>
-<translation id="7740050170769002709">Vsebina HTML</translation>
-<translation id="7745230546936012372">Če želite prejeti manjkajoče opise slike, odprite kontekstni meni.</translation>
-<translation id="7750228210027921155">Slika v sliki</translation>
-<translation id="775297008183122718">Neveljaven vnos</translation>
-<translation id="7789962463072032349">premor</translation>
-<translation id="7802800022689234070">trikotnik z dodatno vsebino</translation>
-<translation id="7888071071722539607">V e-poštnem naslovu mora biti znak »<ph name="ATSIGN" />«. V naslovu »<ph name="INVALIDADDRESS" />« manjka »<ph name="ATSIGN" />«.</translation>
-<translation id="7891486169920085145">razdelilnik</translation>
-<translation id="795667975304826397">Nobena datoteka ni izbrana</translation>
-<translation id="8053789581856978548">besedilno polje za iskanje</translation>
-<translation id="8057695513531652401">kritika</translation>
-<translation id="8105797009065549151">sklicevanje na opombo</translation>
-<translation id="811583516810654505">Pridobivanje opisa …</translation>
-<translation id="8117451130807776954">Ta teden</translation>
-<translation id="8199524924445686405">llll</translation>
-<translation id="8208673686607688524">izbirnik lokalnega datuma in ure</translation>
-<translation id="8261464734335370856">Neveljavno črkovanje</translation>
-<translation id="8284326494547611709">Napisi</translation>
-<translation id="835897206747267392">Neveljavna vrednost.</translation>
-<translation id="8403857369060869934">pretečeni čas: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">del</translation>
-<translation id="8433900881053900389">orodna vrstica</translation>
-<translation id="8444882422881193423">Število datotek: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Izberite datoteko.</translation>
-<translation id="8461852803063341183">izbirni gumb</translation>
-<translation id="8474886197722836894">posvetilo</translation>
-<translation id="8531739829932800271">popravki</translation>
-<translation id="8534579021159131403">Minute</translation>
-<translation id="8541249477527128034">nadziranje predstavnosti</translation>
-<translation id="8550857728288566671">grafični simbol</translation>
-<translation id="8583702881314752957">seznam opredelitev</translation>
-<translation id="8597182159515967513">naslov</translation>
-<translation id="8603553056539299761">levo in desno za iskanje</translation>
-<translation id="860475260694818407">kazalo</translation>
-<translation id="8613126697340063924">upravljanje oddaljenega predvajanja</translation>
-<translation id="862370744433916922">podnaslov</translation>
-<translation id="8711688047404765493">izhod</translation>
-<translation id="8750798805984357768">Izberite eno od teh možnosti.</translation>
-<translation id="8808573423886751634">poglavje</translation>
-<translation id="8845239796550121995">Predvajanje na televizorju</translation>
-<translation id="8851136666856101339">glavn</translation>
-<translation id="8875657656876809964">Napaka pri predvajanju videoposnetka</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Mesec</translation>
-<translation id="901493112792887934">trenutni čas v sekundah</translation>
-<translation id="901834265349196618">e-pošta</translation>
-<translation id="9048119486235211610">krmarjenje</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">izbira za preklop predvajanja/začasne zaustavitve</translation>
-<translation id="9093215626363556771">zapiranje načina slike v sliki</translation>
-<translation id="9108370397979208512">matematika</translation>
-<translation id="9132465097189459683">Drugo ...</translation>
-<translation id="9138385573473225930">opozorilo</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, začne se <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Slika v sliki</translation>
-<translation id="9168329111483466115">sprotna opomba</translation>
-<translation id="954003015749068518">odpiranje načina slike v sliki</translation>
-<translation id="966787709310836684">meni</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_sr.xtb b/chromium/content/app/strings/translations/content_strings_sr.xtb
deleted file mode 100644
index fa848aecb0e..00000000000
--- a/chromium/content/app/strings/translations/content_strings_sr.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="sr">
-<translation id="1018939186200882850">ставка менија</translation>
-<translation id="10623998915015855">дугме за укључивање/искључивање</translation>
-<translation id="1088086359088493902">Секунде</translation>
-<translation id="1171774979989969504">Унесите имејл адресу.</translation>
-<translation id="1178581264944972037">Паузирај</translation>
-<translation id="1188858454923323853">комплементарно</translation>
-<translation id="1206619573307042055">покретни текст</translation>
-<translation id="1206693055195146388">клизач</translation>
-<translation id="1211441953136645838">завршна напомена</translation>
-<translation id="1281252709823657822">дијалог</translation>
-<translation id="1335095011850992622">заслуге</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">банер</translation>
-<translation id="1589122976691792535">регион</translation>
-<translation id="1591562245178063882">Овај месец</translation>
-<translation id="1637811476055996098">Избор датотека</translation>
-<translation id="1650423536718072820">кратки цитат</translation>
-<translation id="1727886345390570319">сакријте мени опционалног титла</translation>
-<translation id="1729654308190250600">Унесите имејл адресу која није празна.</translation>
-<translation id="1758486001363313524">Друго...</translation>
-<translation id="1806710327868736751">дијалог обавештења</translation>
-<translation id="1821985195704844674">мрежа стабла</translation>
-<translation id="1822429046913737220">пре подне/по подне</translation>
-<translation id="1832974991323546415">пуштајте на удаљеном уређају</translation>
-<translation id="190587075670221089">брисање</translation>
-<translation id="1907737156431278478">пример</translation>
-<translation id="1921819250265091946">дд</translation>
-<translation id="1930711995431081526">статус</translation>
-<translation id="1938124657309484470">Вредност мора да буде <ph name="MAXIMUM_DATE_OR_TIME" /> или старија.</translation>
-<translation id="1946271899482435442">Прикажи бирач датума</translation>
-<translation id="1993104285338243655">Пребачено је на пресликавање</translation>
-<translation id="2060505056492490888">„<ph name="DOT" />“ је стављено на погрешно место у „<ph name="INVALIDDOMAIN" />“.</translation>
-<translation id="2148716181193084225">Данас</translation>
-<translation id="2158401438286456825">листа страница</translation>
-<translation id="2226276347425096477">Скратите овај текст на <ph name="MAX_CHARACTERS" /> знак(ов)а или мање (тренутно користите <ph name="CURRENT_LENGTH" /> знак(ов)а).</translation>
-<translation id="2246498165605549352">Локална датотека</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. недеља, <ph name="YEAR" />.</translation>
-<translation id="2277199496770840904"><ph name="NUMBER" />. песма</translation>
-<translation id="2291999235780842123">поље за потврду</translation>
-<translation id="2311842470354187719">прелом странице</translation>
-<translation id="2335594187091864976">бирач датума и времена</translation>
-<translation id="245932805758469625">број преосталих секунди видео снимка</translation>
-<translation id="248395913932153421">Дан</translation>
-<translation id="2507943997699731163">Попуните ово поље.</translation>
-<translation id="2508569020611168319">листа картица</translation>
-<translation id="2561842179657104141">прикажи више контрола за медије</translation>
-<translation id="2572483411312390101">пустите</translation>
-<translation id="2613802280814924224">Унесите важећу вредност. Најближа важећа вредност је <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Пошаљи</translation>
-<translation id="2657045182931379222">графички објекат</translation>
-<translation id="2674318244760992338">подножје</translation>
-<translation id="2709516037105925701">Аутоматско попуњавање</translation>
-<translation id="2723001399770238859">аудио</translation>
-<translation id="2746543609216772311">Вредност мора да буде <ph name="MINIMUM_DATE_OR_TIME" /> или новија.</translation>
-<translation id="2759744352195237655">искачуће дугме</translation>
-<translation id="2761667185364618470">Потврдите избор у овом пољу за потврду уколико желите да наставите.</translation>
-<translation id="2844350028562914727">детаљи</translation>
-<translation id="2896972712917208084">група дугмади за избор</translation>
-<translation id="2908441821576996758">Унесите листу имејл адреса раздвојених зарезима.</translation>
-<translation id="2940813599313844715">објекат</translation>
-<translation id="2942448076852699108">истакнути садржај</translation>
-<translation id="3040011195152428237">веза</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Унесите важећу вредност. Поље није попуњено или садржи неважећи датум.</translation>
-<translation id="3078740164268491126">табела</translation>
-<translation id="3086746722712840547">белешка</translation>
-<translation id="310520048233152454">Унесите URL адресу.</translation>
-<translation id="3175736971608411871">тајмер</translation>
-<translation id="3199563858620722075">комбиновани оквир</translation>
-<translation id="3450233048674729344">Вредност сме да буде највише <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">дефиниција</translation>
-<translation id="3557673793733683882">заглавље <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">бирач недеља</translation>
-<translation id="3685101356851116974">Неозначена слика</translation>
-<translation id="3706100364254443312">прекидач</translation>
-<translation id="3732799496749320381">мм</translation>
-<translation id="3754210790023674521">Изађи из режима слике у слици</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">термин</translation>
-<translation id="3822383571486410024">Продужите овај текст на <ph name="MIN_CHARACTERS" /> знак(ов)а или више (тренутно користите <ph name="CURRENT_LENGTH" /> знак(ов)а).</translation>
-<translation id="383465348367842624">Део пре „<ph name="ATSIGN" />“ не треба да садржи симбол „<ph name="INVALIDCHARACTER" />“.</translation>
-<translation id="3846214748874656680">Изађи из целог екрана</translation>
-<translation id="3920932319529768807">закључак</translation>
-<translation id="3924558731517983934">апликација</translation>
-<translation id="3944740393230681990">пролог</translation>
-<translation id="3960700977367013758">трака за померање</translation>
-<translation id="4103419683916926126">Милисекунде</translation>
-<translation id="4151657705144244502">графички елемент</translation>
-<translation id="4160057747563657758">број телефона</translation>
-<translation id="4193965531860883258">предговор</translation>
-<translation id="4201051445878709314">Прикажи претходни месец</translation>
-<translation id="421884353938374759">бирач боја</translation>
-<translation id="4248100235867064564">трака са менијима</translation>
-<translation id="4360991593054037559">Унесите важећу вредност. Две најближе важеће вредности су <ph name="VALID_VALUE_LOW" /> и <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Питања и одговори</translation>
-<translation id="4413860115965805769">дугме менија</translation>
-<translation id="4444765639179266822">Изгледа да пише: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">референца речника термина</translation>
-<translation id="4522570452068850558">Детаљи</translation>
-<translation id="4542388879936266156">преостало време: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">образац</translation>
-<translation id="4661075872484491155">стабло</translation>
-<translation id="4664250907885839816">Део после „<ph name="ATSIGN" />“ не треба да садржи симбол „<ph name="INVALIDCHARACTER" />“.</translation>
-<translation id="4668956016107839909">додатак</translation>
-<translation id="4718048029184481307">Репродукује се у режиму слике у слици</translation>
-<translation id="4742539557769756338">корицe</translation>
-<translation id="4748357248530471599">укључи/искључи цео екран без области изрезаног приказа</translation>
-<translation id="4757246831282535685">табла са картицама</translation>
-<translation id="4763480195061959176">видео</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Унесите број.</translation>
-<translation id="4912536737030637138">библиографска ставка</translation>
-<translation id="4975562563186953947">Изабрано: <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Укључи звук</translation>
-<translation id="49969490063480558">Унесите неки део после „<ph name="ATSIGN" />“. Адреса „<ph name="INVALIDADDRESS" />“ је непотпуна.</translation>
-<translation id="5034860022980953847">индикатор напретка</translation>
-<translation id="5090250355906949916">клизач за трајање видео снимка</translation>
-<translation id="5093189678851173835">натпис</translation>
-<translation id="5117590920725113268">Прикажи следећи месец</translation>
-<translation id="512758898067543763">заглавље реда</translation>
-<translation id="5143125788380636750">епилог</translation>
-<translation id="5164977714490026579">Вредност сме да буде најмање <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Унесите неки део пре „<ph name="ATSIGN" />“. Адреса „<ph name="INVALIDADDRESS" />“ је непотпуна.</translation>
-<translation id="5334352251556557839">Пуштање медија није успело.</translation>
-<translation id="5406322316791861025">цифра</translation>
-<translation id="5453733299334684579">ставка стабла</translation>
-<translation id="5466621249238537318">Изаберите једну или више датотека.</translation>
-<translation id="5468998798572797635">изађите из режима целог екрана</translation>
-<translation id="5516424706154626233">бирач датума</translation>
-<translation id="5537725057119320332">Пребацуј</translation>
-<translation id="5546461542133609677">укључите звук</translation>
-<translation id="561939826962581046">време</translation>
-<translation id="5630795885300617244">Двапут додирните лево или десно да бисте прескочили 10 сек</translation>
-<translation id="5631759159893697722">сажетак</translation>
-<translation id="5643186887447432888">дугме</translation>
-<translation id="5677946354068040947">још опција</translation>
-<translation id="576709008726043716">увод</translation>
-<translation id="57838592816432529">Искључи звук</translation>
-<translation id="5860033963881614850">Искључено</translation>
-<translation id="588258955323874662">Цеo екран</translation>
-<translation id="5888666972993069672">Тренутно се пребацује на <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">оквир за претрагу</translation>
-<translation id="5939518447894949180">Ресетуј</translation>
-<translation id="5966707198760109579">Недеља</translation>
-<translation id="5987525920412732405">дугме за промену вредности</translation>
-<translation id="6011459053400940133">клизач за јачину звука</translation>
-<translation id="6015796118275082299">Година</translation>
-<translation id="6023896073578205740">оквир са листом</translation>
-<translation id="6150588977291308318">библиографија</translation>
-<translation id="6164829606128959761">мерач</translation>
-<translation id="6166809985690652833">поговор</translation>
-<translation id="6209276755895393898">Изгледа да је ово: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">речник термина</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Изађи из режима слике у слици</translation>
-<translation id="6398862346408813489">Прикажи таблу за избор месеца</translation>
-<translation id="6404546809543547843">клизач за трајање аудио-садржаја</translation>
-<translation id="6443871981718447451">прикажите мени опционалног титла</translation>
-<translation id="6453774872122745852">признања</translation>
-<translation id="648732519525291180">бирач времена</translation>
-<translation id="6550675742724504774">Опције</translation>
-<translation id="6572309429103589720">Нетачна граматика</translation>
-<translation id="658823671542763450">пређите на режим целог екрана</translation>
-<translation id="663493177488814956">фид</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Обриши</translation>
-<translation id="668171684555832681">Друго...</translation>
-<translation id="6692633176391053278">контрола за промене у корацима</translation>
-<translation id="6709570249143506788">Лош квалитет снимка</translation>
-<translation id="6755330956360078551">објашњење</translation>
-<translation id="6790428901817661496">Пусти</translation>
-<translation id="6820355525329141109">Учитавање додатне компоненте није успело.</translation>
-<translation id="6820615603175220800">референца библиографије</translation>
-<translation id="6843725295806269523">искључи звук</translation>
-<translation id="6885760532393684712">каталог</translation>
-<translation id="689129560213475294">знак издавача</translation>
-<translation id="6934078000481955284">издвојени цитат</translation>
-<translation id="6941933287844615239">преузми медије</translation>
-<translation id="6981594929165378967">уметање</translation>
-<translation id="6989848892321993519">Продужите овај текст на бар <ph name="MIN_CHARACTERS" /> знак(ов)а (тренутно користите 1 знак).</translation>
-<translation id="7033340931668032222">горе и доле да бисте променили јачину звука</translation>
-<translation id="709897737746224366">Изаберите захтевани формат.</translation>
-<translation id="7118469954320184356">Опис није доступан.</translation>
-<translation id="7139483182332611405">предговор</translation>
-<translation id="7214187073215825913">информације о садржају</translation>
-<translation id="7263440858009898357">Изаберите ставку са листе.</translation>
-<translation id="727747134524199931">заглавље колоне</translation>
-<translation id="7320576522385648310">баферовање</translation>
-<translation id="7353453495576941748">заслуга</translation>
-<translation id="7364796246159120393">Одабери датотеку</translation>
-<translation id="739024184232394898">Друго...</translation>
-<translation id="7405738980073107433">завршне напомене</translation>
-<translation id="7410239719251593705">Изгледа да има садржај за одрасле. Опис није доступан.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Преузми</translation>
-<translation id="7529102961911894712">повратни линк</translation>
-<translation id="7533959249147584474">Неозначена слика</translation>
-<translation id="7647456547678091388">савет</translation>
-<translation id="7661956066982048809">графички документ</translation>
-<translation id="7673697353781729403">Сати</translation>
-<translation id="7681220483256441252">индекс</translation>
-<translation id="7740050170769002709">HTML садржај</translation>
-<translation id="7745230546936012372">Да бисте добили описе слика који недостају, отворите контекстуални мени.</translation>
-<translation id="7750228210027921155">Слика у слици</translation>
-<translation id="775297008183122718">Неважећи унос</translation>
-<translation id="7789962463072032349">паузирај</translation>
-<translation id="7802800022689234070">троугао за откривање</translation>
-<translation id="7888071071722539607">Уврстите „<ph name="ATSIGN" />“ у имејл адресу. У адреси е-поште „<ph name="INVALIDADDRESS" />“ недостаје „<ph name="ATSIGN" />“.</translation>
-<translation id="7891486169920085145">разделник</translation>
-<translation id="795667975304826397">Није одабрано</translation>
-<translation id="8053789581856978548">поље за текст претраге</translation>
-<translation id="8057695513531652401">обавештење</translation>
-<translation id="8105797009065549151">референца напомене</translation>
-<translation id="811583516810654505">Преузима се опис...</translation>
-<translation id="8117451130807776954">Ова недеља</translation>
-<translation id="8199524924445686405">гггг</translation>
-<translation id="8208673686607688524">бирач локалног датума и времена</translation>
-<translation id="8261464734335370856">Нетачан правопис</translation>
-<translation id="8284326494547611709">Титл</translation>
-<translation id="835897206747267392">Неважећа вредност.</translation>
-<translation id="8403857369060869934">протекло време: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">део</translation>
-<translation id="8433900881053900389">трака с алаткама</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> датотеке(а)</translation>
-<translation id="8451268428117625855">Изаберите датотеку.</translation>
-<translation id="8461852803063341183">дугме за избор</translation>
-<translation id="8474886197722836894">посвета</translation>
-<translation id="8531739829932800271">исправке и допуне</translation>
-<translation id="8534579021159131403">Минути</translation>
-<translation id="8541249477527128034">контрола за медије</translation>
-<translation id="8550857728288566671">графички симбол</translation>
-<translation id="8583702881314752957">листа дефиниција</translation>
-<translation id="8597182159515967513">наслов</translation>
-<translation id="8603553056539299761">улево и удесно да бисте премотали</translation>
-<translation id="860475260694818407">садржај</translation>
-<translation id="8613126697340063924">контролишите репродукцију на удаљеном уређају</translation>
-<translation id="862370744433916922">титл</translation>
-<translation id="8711688047404765493">излаз</translation>
-<translation id="8750798805984357768">Изаберите неку од ових опција.</translation>
-<translation id="8808573423886751634">поглавље</translation>
-<translation id="8845239796550121995">Тренутно се пребацује на ТВ</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Грешка при пуштању видео снимка</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Месец</translation>
-<translation id="901493112792887934">актуелно време у секундама</translation>
-<translation id="901834265349196618">имејл</translation>
-<translation id="9048119486235211610">навигација</translation>
-<translation id="9062295712474918030">документ</translation>
-<translation id="9062307380734144336">изаберите да бисте пуштали/паузирали</translation>
-<translation id="9093215626363556771">изађи из режима слике у слици</translation>
-<translation id="9108370397979208512">математички</translation>
-<translation id="9132465097189459683">Друго...</translation>
-<translation id="9138385573473225930">обавештење</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, од <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Слика у слици</translation>
-<translation id="9168329111483466115">фуснота</translation>
-<translation id="954003015749068518">уђи у режим слике у слици</translation>
-<translation id="966787709310836684">мени</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_sv.xtb b/chromium/content/app/strings/translations/content_strings_sv.xtb
deleted file mode 100644
index 35e8d1dfbb2..00000000000
--- a/chromium/content/app/strings/translations/content_strings_sv.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="sv">
-<translation id="1018939186200882850">menyalternativ</translation>
-<translation id="10623998915015855">växlingsknapp</translation>
-<translation id="1088086359088493902">Sekunder</translation>
-<translation id="1171774979989969504">Ange en e-postadress.</translation>
-<translation id="1178581264944972037">Paus</translation>
-<translation id="1188858454923323853">kompletterande</translation>
-<translation id="1206619573307042055">markör</translation>
-<translation id="1206693055195146388">skjutreglage</translation>
-<translation id="1211441953136645838">slutnot</translation>
-<translation id="1281252709823657822">dialogruta</translation>
-<translation id="1335095011850992622">medverkande</translation>
-<translation id="1342835525016946179">artikel</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">område</translation>
-<translation id="1591562245178063882">Den här månaden</translation>
-<translation id="1637811476055996098">Välj filer</translation>
-<translation id="1650423536718072820">utvalt citat</translation>
-<translation id="1727886345390570319">dölj textningsmenyn</translation>
-<translation id="1729654308190250600">Ange en e-postadress som inte är tom.</translation>
-<translation id="1758486001363313524">Annat ...</translation>
-<translation id="1806710327868736751">varningsdialogruta</translation>
-<translation id="1821985195704844674">träddiagram</translation>
-<translation id="1822429046913737220">FM/EM</translation>
-<translation id="1832974991323546415">spela på en fjärrenhet</translation>
-<translation id="190587075670221089">borttagning</translation>
-<translation id="1907737156431278478">exempel</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">status</translation>
-<translation id="1938124657309484470">Värdet måste vara <ph name="MAXIMUM_DATE_OR_TIME" /> eller tidigare.</translation>
-<translation id="1946271899482435442">Visa datumväljaren</translation>
-<translation id="1993104285338243655">Bytte till spegling</translation>
-<translation id="2060505056492490888"><ph name="DOT" /> används på fel plats i <ph name="INVALIDDOMAIN" />.</translation>
-<translation id="2148716181193084225">Idag</translation>
-<translation id="2158401438286456825">sidlista</translation>
-<translation id="2226276347425096477">Förkorta texten till <ph name="MAX_CHARACTERS" /> tecken eller mindre (nu är texten <ph name="CURRENT_LENGTH" /> tecken).</translation>
-<translation id="2246498165605549352">Lokal fil</translation>
-<translation id="2247351761944213033">Vecka <ph name="WEEKNUMBER" /> <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Spår <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">kryssruta</translation>
-<translation id="2311842470354187719">sidbrytning</translation>
-<translation id="2335594187091864976">datum- och tidsväljare</translation>
-<translation id="245932805758469625">antal sekunder kvar av videon</translation>
-<translation id="248395913932153421">Dag</translation>
-<translation id="2507943997699731163">Fyll i det här fältet.</translation>
-<translation id="2508569020611168319">fliklista</translation>
-<translation id="2561842179657104141">visa fler mediereglage</translation>
-<translation id="2572483411312390101">spela upp</translation>
-<translation id="2613802280814924224">Ange ett giltigt värde. Det närmast giltiga värdet är <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Skicka</translation>
-<translation id="2657045182931379222">grafiskt objekt</translation>
-<translation id="2674318244760992338">sidfot</translation>
-<translation id="2709516037105925701">Autofyll</translation>
-<translation id="2723001399770238859">ljud</translation>
-<translation id="2746543609216772311">Värdet måste vara <ph name="MINIMUM_DATE_OR_TIME" /> eller senare.</translation>
-<translation id="2759744352195237655">popup-knapp</translation>
-<translation id="2761667185364618470">Markera den här kryssrutan om du vill fortsätta.</translation>
-<translation id="2844350028562914727">detaljer</translation>
-<translation id="2896972712917208084">alternativknappsgrupp</translation>
-<translation id="2908441821576996758">Ange en kommaavgränsad lista med e-postadresser.</translation>
-<translation id="2940813599313844715">objekt</translation>
-<translation id="2942448076852699108">markerat innehåll</translation>
-<translation id="3040011195152428237">länk</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Ange ett giltigt värde. Fältet är ofullständigt eller innehåller ett ogiltigt datum.</translation>
-<translation id="3078740164268491126">tabell</translation>
-<translation id="3086746722712840547">anm</translation>
-<translation id="310520048233152454">Ange en webbadress.</translation>
-<translation id="3175736971608411871">timer</translation>
-<translation id="3199563858620722075">kombinationsruta</translation>
-<translation id="3450233048674729344">Värdet måste vara mindre än eller lika med <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">definition</translation>
-<translation id="3557673793733683882">rubrik <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">veckoväljare</translation>
-<translation id="3685101356851116974">Bild utan etikett</translation>
-<translation id="3706100364254443312">växel</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Avsluta bild-i-bild-läge</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">term</translation>
-<translation id="3822383571486410024">Lägg till minst <ph name="MIN_CHARACTERS" /> tecken (för närvarande har du angett <ph name="CURRENT_LENGTH" /> tecken).</translation>
-<translation id="383465348367842624">En del följt av <ph name="ATSIGN" /> får inte innehålla symbolen <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="3846214748874656680">Avsluta helskärmsläge</translation>
-<translation id="3920932319529768807">resultat</translation>
-<translation id="3924558731517983934">program</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">rullningslist</translation>
-<translation id="4103419683916926126">Millisekunder</translation>
-<translation id="4151657705144244502">bild</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">förord</translation>
-<translation id="4201051445878709314">Visa föregående månad</translation>
-<translation id="421884353938374759">färgval</translation>
-<translation id="4248100235867064564">menyfält</translation>
-<translation id="4360991593054037559">Ange ett giltigt värde. De två närmaste giltiga värdena är <ph name="VALID_VALUE_LOW" /> och <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Frågor och svar</translation>
-<translation id="4413860115965805769">menyknapp</translation>
-<translation id="4444765639179266822">Säger troligen: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">hänvisning till ordlista</translation>
-<translation id="4522570452068850558">Info</translation>
-<translation id="4542388879936266156">tid som återstår: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">formulär</translation>
-<translation id="4661075872484491155">träd</translation>
-<translation id="4664250907885839816">En del efter <ph name="ATSIGN" /> får inte innehålla symbolen <ph name="INVALIDCHARACTER" />.</translation>
-<translation id="4668956016107839909">bilaga</translation>
-<translation id="4718048029184481307">Spelas upp i bild-i-bild-läge</translation>
-<translation id="4742539557769756338">omslag</translation>
-<translation id="4748357248530471599">aktivera och inaktivera skärmutskärning i helskärm</translation>
-<translation id="4757246831282535685">flikpanel</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">sök</translation>
-<translation id="4812940957355064477">Ange ett nummer.</translation>
-<translation id="4912536737030637138">bibliografipost</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> valda</translation>
-<translation id="4992066212339426712">Slå på ljudet</translation>
-<translation id="49969490063480558">Ange en del följt av <ph name="ATSIGN" />. <ph name="INVALIDADDRESS" /> är ofullständig.</translation>
-<translation id="5034860022980953847">förloppsindikator</translation>
-<translation id="5090250355906949916">tidsreglage för video</translation>
-<translation id="5093189678851173835">epigraf</translation>
-<translation id="5117590920725113268">Visa nästa månad</translation>
-<translation id="512758898067543763">radrubrik</translation>
-<translation id="5143125788380636750">epilog</translation>
-<translation id="5164977714490026579">Värdet måste vara större än eller lika med <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Ange en del följt av <ph name="ATSIGN" />. <ph name="INVALIDADDRESS" /> är ofullständig.</translation>
-<translation id="5334352251556557839">Det går inte att spela upp media.</translation>
-<translation id="5406322316791861025">figur</translation>
-<translation id="5453733299334684579">trädobjekt</translation>
-<translation id="5466621249238537318">Välj en eller flera filer.</translation>
-<translation id="5468998798572797635">avsluta helskärmsläge</translation>
-<translation id="5516424706154626233">datumväljare</translation>
-<translation id="5537725057119320332">Casta</translation>
-<translation id="5546461542133609677">slå på ljudet</translation>
-<translation id="561939826962581046">tid</translation>
-<translation id="5630795885300617244">Hoppa över 10 s genom att trycka två gånger till vänster/höger</translation>
-<translation id="5631759159893697722">abstract</translation>
-<translation id="5643186887447432888">knapp</translation>
-<translation id="5677946354068040947">fler alternativ</translation>
-<translation id="576709008726043716">inledning</translation>
-<translation id="57838592816432529">Stäng av ljudet</translation>
-<translation id="5860033963881614850">Av</translation>
-<translation id="588258955323874662">Helskärm</translation>
-<translation id="5888666972993069672">Castar till <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">sökruta</translation>
-<translation id="5939518447894949180">Återställ</translation>
-<translation id="5966707198760109579">Vecka</translation>
-<translation id="5987525920412732405">snurrknapp</translation>
-<translation id="6011459053400940133">volymreglage</translation>
-<translation id="6015796118275082299">År</translation>
-<translation id="6023896073578205740">listruta</translation>
-<translation id="6150588977291308318">bibliografi</translation>
-<translation id="6164829606128959761">mätare</translation>
-<translation id="6166809985690652833">efterord</translation>
-<translation id="6209276755895393898">Det verkar vara: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">ordlista</translation>
-<translation id="6281763101136022427">webbadress</translation>
-<translation id="6310801910862476708">Avsluta bild-i-bild-läge</translation>
-<translation id="6398862346408813489">Visa panelen för val av månad</translation>
-<translation id="6404546809543547843">tidsreglage för ljud</translation>
-<translation id="6443871981718447451">visa textningsmenyn</translation>
-<translation id="6453774872122745852">författarens tack</translation>
-<translation id="648732519525291180">tidsväljare</translation>
-<translation id="6550675742724504774">Alternativ</translation>
-<translation id="6572309429103589720">Grammatikfel</translation>
-<translation id="658823671542763450">visa i helskärm</translation>
-<translation id="663493177488814956">flöde</translation>
-<translation id="6637586476836377253">logg</translation>
-<translation id="6643016212128521049">Rensa</translation>
-<translation id="668171684555832681">Annan...</translation>
-<translation id="6692633176391053278">knappreglage</translation>
-<translation id="6709570249143506788">Låg uppspelningskvalitet</translation>
-<translation id="6755330956360078551">beskrivning</translation>
-<translation id="6790428901817661496">Spela</translation>
-<translation id="6820355525329141109">Det gick inte att läsa in plugin-programmet.</translation>
-<translation id="6820615603175220800">bibliografisk referens</translation>
-<translation id="6843725295806269523">ljud av</translation>
-<translation id="6885760532393684712">katalog</translation>
-<translation id="689129560213475294">kolofon</translation>
-<translation id="6934078000481955284">citatblock</translation>
-<translation id="6941933287844615239">ladda ned media</translation>
-<translation id="6981594929165378967">infogning</translation>
-<translation id="6989848892321993519">Lägg till minst <ph name="MIN_CHARACTERS" /> tecken (för närvarande har du angett 1 tecken).</translation>
-<translation id="7033340931668032222">ändra volym med uppåt och nedåt</translation>
-<translation id="709897737746224366">Matcha det format som anges.</translation>
-<translation id="7118469954320184356">Det finns ingen tillgänglig beskrivning.</translation>
-<translation id="7139483182332611405">företal</translation>
-<translation id="7214187073215825913">innehållsinformation</translation>
-<translation id="7263440858009898357">Välj ett alternativ i listan.</translation>
-<translation id="727747134524199931">kolumnrubrik</translation>
-<translation id="7320576522385648310">buffrar</translation>
-<translation id="7353453495576941748">erkännande</translation>
-<translation id="7364796246159120393">Välj fil</translation>
-<translation id="739024184232394898">Annat ...</translation>
-<translation id="7405738980073107433">slutnoter</translation>
-<translation id="7410239719251593705">Verkar innehålla barnförbjudet innehåll. Det finns ingen tillgänglig beskrivning.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tabb</translation>
-<translation id="7514365320538308">Ladda ned</translation>
-<translation id="7529102961911894712">bakåtlänk</translation>
-<translation id="7533959249147584474">Bild utan etikett</translation>
-<translation id="7647456547678091388">tips</translation>
-<translation id="7661956066982048809">grafiskt dokument</translation>
-<translation id="7673697353781729403">Timmar</translation>
-<translation id="7681220483256441252">index</translation>
-<translation id="7740050170769002709">HTML-innehåll</translation>
-<translation id="7745230546936012372">Öppna snabbmenyn om du vill hämta en bildbeskrivning när en sådan saknas.</translation>
-<translation id="7750228210027921155">Bild-i-bild</translation>
-<translation id="775297008183122718">Ogiltig inmatning</translation>
-<translation id="7789962463072032349">paus</translation>
-<translation id="7802800022689234070">expanderingstriangel</translation>
-<translation id="7888071071722539607">Inkludera ett <ph name="ATSIGN" /> i e-postadressen. <ph name="INVALIDADDRESS" /> saknar ett <ph name="ATSIGN" />.</translation>
-<translation id="7891486169920085145">delare</translation>
-<translation id="795667975304826397">Ingen fil har valts</translation>
-<translation id="8053789581856978548">fält för söktext</translation>
-<translation id="8057695513531652401">anmärkning</translation>
-<translation id="8105797009065549151">referensnot</translation>
-<translation id="811583516810654505">Beskrivningen hämtas …</translation>
-<translation id="8117451130807776954">Den här veckan</translation>
-<translation id="8199524924445686405">åååå</translation>
-<translation id="8208673686607688524">datum- och tidsväljare för lokal tid</translation>
-<translation id="8261464734335370856">Stavfel</translation>
-<translation id="8284326494547611709">Textning</translation>
-<translation id="835897206747267392">Ogiltigt värde.</translation>
-<translation id="8403857369060869934">tid som gått: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">del</translation>
-<translation id="8433900881053900389">verktygsfält</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> filer</translation>
-<translation id="8451268428117625855">Välj en fil.</translation>
-<translation id="8461852803063341183">alternativknapp</translation>
-<translation id="8474886197722836894">tillägnan</translation>
-<translation id="8531739829932800271">errata</translation>
-<translation id="8534579021159131403">Minuter</translation>
-<translation id="8541249477527128034">mediekontroll</translation>
-<translation id="8550857728288566671">grafisk symbol</translation>
-<translation id="8583702881314752957">definitionslista</translation>
-<translation id="8597182159515967513">rubrik</translation>
-<translation id="8603553056539299761">sök med vänster och höger</translation>
-<translation id="860475260694818407">innehållsförteckning</translation>
-<translation id="8613126697340063924">styra fjärruppspelning</translation>
-<translation id="862370744433916922">undertext</translation>
-<translation id="8711688047404765493">utdata</translation>
-<translation id="8750798805984357768">Välj ett av följande alternativ.</translation>
-<translation id="8808573423886751634">kapitel</translation>
-<translation id="8845239796550121995">Castar nu till TV:n</translation>
-<translation id="8851136666856101339">huvud</translation>
-<translation id="8875657656876809964">Videouppspelningsfel</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> kB</translation>
-<translation id="8987927404178983737">Månad</translation>
-<translation id="901493112792887934">aktuell tid i sekunder</translation>
-<translation id="901834265349196618">e-post</translation>
-<translation id="9048119486235211610">navigering</translation>
-<translation id="9062295712474918030">dokument</translation>
-<translation id="9062307380734144336">välj för att spela upp och pausa</translation>
-<translation id="9093215626363556771">avsluta bild-i-bild-läge</translation>
-<translation id="9108370397979208512">matte</translation>
-<translation id="9132465097189459683">Annat ...</translation>
-<translation id="9138385573473225930">varning</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> som börjar den <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Bild-i-bild</translation>
-<translation id="9168329111483466115">fotnot</translation>
-<translation id="954003015749068518">öppna bild-i-bild-läge</translation>
-<translation id="966787709310836684">meny</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_sw.xtb b/chromium/content/app/strings/translations/content_strings_sw.xtb
deleted file mode 100644
index 2c52783d4ad..00000000000
--- a/chromium/content/app/strings/translations/content_strings_sw.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="sw">
-<translation id="1018939186200882850">kipengee cha menyu</translation>
-<translation id="10623998915015855">kitufe cha kugeuza</translation>
-<translation id="1088086359088493902">Sekunde</translation>
-<translation id="1171774979989969504">Tafadhali weka anwani ya barua pepe.</translation>
-<translation id="1178581264944972037">Sitisha</translation>
-<translation id="1188858454923323853">nyongeza</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">kitelezi</translation>
-<translation id="1211441953136645838">maelezo ya mwisho wa kitabu</translation>
-<translation id="1281252709823657822">kidirisha</translation>
-<translation id="1335095011850992622">walioshiriki</translation>
-<translation id="1342835525016946179">makala</translation>
-<translation id="1359897965706325498">bango</translation>
-<translation id="1589122976691792535">eneo</translation>
-<translation id="1591562245178063882">Mwezi huu</translation>
-<translation id="1637811476055996098">Chagua Faili</translation>
-<translation id="1650423536718072820">nukuu muhimu</translation>
-<translation id="1727886345390570319">kuficha menyu ya manukuu</translation>
-<translation id="1729654308190250600">Tafadhali jaza sehemu ya anwani ya barua pepe.</translation>
-<translation id="1758486001363313524">Nyingine...</translation>
-<translation id="1806710327868736751">kidirisha cha arifa</translation>
-<translation id="1821985195704844674">gridi ya mti</translation>
-<translation id="1822429046913737220">AM / PM</translation>
-<translation id="1832974991323546415">cheza kwenye kifaa cha mbali</translation>
-<translation id="190587075670221089">ufutaji</translation>
-<translation id="1907737156431278478">mfano</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">hali</translation>
-<translation id="1938124657309484470">Thamani lazima iwe <ph name="MAXIMUM_DATE_OR_TIME" /> au mapema.</translation>
-<translation id="1946271899482435442">Onyesha kiteua tarehe</translation>
-<translation id="1993104285338243655">Inatumia hali ya kuakisi</translation>
-<translation id="2060505056492490888">' <ph name="DOT" /> 'imetumika kwenye nafasi isiyostahili katika '<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">Leo</translation>
-<translation id="2158401438286456825">orodha ya kurasa</translation>
-<translation id="2226276347425096477">Tafadhali fupisha maandishi haya hadi vibambo <ph name="MAX_CHARACTERS" /> au chini (kwa sasa unatumia vibambo <ph name="CURRENT_LENGTH" /> ).</translation>
-<translation id="2246498165605549352">Faili ya Ndani</translation>
-<translation id="2247351761944213033">Wiki <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Wimbo wa <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">kisanduku cha kuteua</translation>
-<translation id="2311842470354187719">nafasi ya kugawa kurasa</translation>
-<translation id="2335594187091864976">mchumaji tarehe na wakati</translation>
-<translation id="245932805758469625">idadi ya sekunde za video zilizosalia</translation>
-<translation id="248395913932153421">Siku</translation>
-<translation id="2507943997699731163">Tafadhali jaza sehemu hii.</translation>
-<translation id="2508569020611168319">orodha ya vichupo</translation>
-<translation id="2561842179657104141">onyesha vidhibiti zaidi vya maudhui</translation>
-<translation id="2572483411312390101">cheza</translation>
-<translation id="2613802280814924224">Tafadhali ingiza thamani halali.Thamani halali ya karibu ni <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Wasilisha</translation>
-<translation id="2657045182931379222">kipengee cha michoro</translation>
-<translation id="2674318244760992338">kijachini</translation>
-<translation id="2709516037105925701">Kujaza Kiotomatiki</translation>
-<translation id="2723001399770238859">sauti</translation>
-<translation id="2746543609216772311">Thamani lazima iwe <ph name="MINIMUM_DATE_OR_TIME" /> au baadaye.</translation>
-<translation id="2759744352195237655">kitufe cha dirisha ibukizi</translation>
-<translation id="2761667185364618470">Tafadhali angalia kikasha hiki iwapo unataka kuendelea.</translation>
-<translation id="2844350028562914727">maelezo</translation>
-<translation id="2896972712917208084">kikundi cha vitufe</translation>
-<translation id="2908441821576996758">Tafadhali weka orodha ya anwani za barua pepe zilizotenganishwa kwa vikomo.</translation>
-<translation id="2940813599313844715">kitu</translation>
-<translation id="2942448076852699108">maudhui yaliyoangaziwa</translation>
-<translation id="3040011195152428237">kiungo</translation>
-<translation id="3049748772180311791">MB <ph name="QUANTITY" /></translation>
-<translation id="3075154866155599887">Tafadhali ingiza thamani halali. Uga umekamilika au una tarehe batili.</translation>
-<translation id="3078740164268491126">jedwali</translation>
-<translation id="3086746722712840547">dokezo</translation>
-<translation id="310520048233152454">Tafadhali ingiza URL.</translation>
-<translation id="3175736971608411871">kipima muda</translation>
-<translation id="3199563858620722075">kisanduku mseto</translation>
-<translation id="3450233048674729344">Lazima thamani iwe chache kuliko au sawa na <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">ufafanuzi</translation>
-<translation id="3557673793733683882">kichwa cha <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">kiteua wiki</translation>
-<translation id="3685101356851116974">Picha isiyo na lebo</translation>
-<translation id="3706100364254443312">badilisha</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Funga hali ya picha ndani ya picha</translation>
-<translation id="3757388668994797779">GB <ph name="QUANTITY" /></translation>
-<translation id="3808586225841795776">neno</translation>
-<translation id="3822383571486410024">Tafadhali refusha maandishi haya hadi herufi <ph name="MIN_CHARACTERS" /> au zaidi (kwa sasa unatumia herufi <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="383465348367842624">Sehemu inayofuatwa na '<ph name="ATSIGN" />' haipaswi kuwa na alama ya '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="3846214748874656680">Ondoka kwenye skrini nzima</translation>
-<translation id="3920932319529768807">hitimisho</translation>
-<translation id="3924558731517983934">programu</translation>
-<translation id="3944740393230681990">shairi la utangulizi</translation>
-<translation id="3960700977367013758">sehemu ya kusogeza</translation>
-<translation id="4103419683916926126">nukta</translation>
-<translation id="4151657705144244502">mchoro</translation>
-<translation id="4160057747563657758">simu</translation>
-<translation id="4193965531860883258">dibaji</translation>
-<translation id="4201051445878709314">Onyesha mwezi uliotangulia</translation>
-<translation id="421884353938374759">kiteua rangi</translation>
-<translation id="4248100235867064564">upau wa menyu</translation>
-<translation id="4360991593054037559">Tafadhali ingiza thamani halali. Thamani mbili halali za karibu ni <ph name="VALID_VALUE_LOW" /> na <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Maswali na Majibu</translation>
-<translation id="4413860115965805769">kitufe cha menyu</translation>
-<translation id="4444765639179266822">Inaonekana kusema: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">marejeleo ya farahasa</translation>
-<translation id="4522570452068850558">Maelezo</translation>
-<translation id="4542388879936266156">muda uliosalia: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">fomu</translation>
-<translation id="4661075872484491155">mti</translation>
-<translation id="4664250907885839816">Sehemu inayofuata '<ph name="ATSIGN" />' haipaswi kuwa na alama ya '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="4668956016107839909">kiambatisho</translation>
-<translation id="4718048029184481307">Inacheza katika hali ya picha ndani ya picha</translation>
-<translation id="4742539557769756338">jalada</translation>
-<translation id="4748357248530471599">tumia mkato kwenye skrini nzima</translation>
-<translation id="4757246831282535685">kisanduku cha kichupo</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">tafuta</translation>
-<translation id="4812940957355064477">Tafadhali ingiza nambari.</translation>
-<translation id="4912536737030637138">maelezo ya bibliografia</translation>
-<translation id="4975562563186953947">Vipengee <ph name="SELECTED_COUNT" /> vimechaguliwa</translation>
-<translation id="4992066212339426712">Rejesha sauti</translation>
-<translation id="49969490063480558">Tafadhali ingiza sehemu inayofuatia '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' haijakamilika.</translation>
-<translation id="5034860022980953847">kiashiria cha maendeleo</translation>
-<translation id="5090250355906949916">kitelezi cha muda wa video</translation>
-<translation id="5093189678851173835">epigrafu</translation>
-<translation id="5117590920725113268">Onyesha mwezi unaofuata</translation>
-<translation id="512758898067543763">kichwa cha safu mlalo</translation>
-<translation id="5143125788380636750">hitimisho</translation>
-<translation id="5164977714490026579">Lazima thamani iwe kubwa kuliko au sawa na <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650">PB <ph name="QUANTITY" /></translation>
-<translation id="5307600278924710095">Tafadhali ingiza sehemu ikifuatiwa na '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' haijakamilika.</translation>
-<translation id="5334352251556557839">Imeshindwa kucheza maudhui.</translation>
-<translation id="5406322316791861025">umbo</translation>
-<translation id="5453733299334684579">kipengee cha mti</translation>
-<translation id="5466621249238537318">Tafadhali chagua faili moja au zaidi.</translation>
-<translation id="5468998798572797635">Ondoka kwenye Skrini nzima</translation>
-<translation id="5516424706154626233">kichagua tarehe</translation>
-<translation id="5537725057119320332">Tuma</translation>
-<translation id="5546461542133609677">washa sauti</translation>
-<translation id="561939826962581046">wakati</translation>
-<translation id="5630795885300617244">Gusa mara mbili kushoto au kulia ili uruke kwa sekunde 10</translation>
-<translation id="5631759159893697722">ikisiri</translation>
-<translation id="5643186887447432888">kitufe</translation>
-<translation id="5677946354068040947">chaguo zaidi</translation>
-<translation id="576709008726043716">utangulizi</translation>
-<translation id="57838592816432529">Zima sauti</translation>
-<translation id="5860033963881614850">Kimezimwa</translation>
-<translation id="588258955323874662">Skrini nzima</translation>
-<translation id="5888666972993069672">Sasa inatuma kwenye <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">kisanduku cha kutafutia</translation>
-<translation id="5939518447894949180">Weka upya</translation>
-<translation id="5966707198760109579">Juma</translation>
-<translation id="5987525920412732405">kitufe cha kubadilishia</translation>
-<translation id="6011459053400940133">kitelezi cha sauti</translation>
-<translation id="6015796118275082299">Mwaka</translation>
-<translation id="6023896073578205740">kikasha cha orodha</translation>
-<translation id="6150588977291308318">bibliografia</translation>
-<translation id="6164829606128959761">mita</translation>
-<translation id="6166809985690652833">maelezo kuhusu kitabu</translation>
-<translation id="6209276755895393898">Inaonekana kuwa: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">faharasa</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Funga hali ya Picha ndani ya Picha</translation>
-<translation id="6398862346408813489">Onyesha kisanduku cha uchaguzi wa mwezi</translation>
-<translation id="6404546809543547843">kitelezi cha muda cha sauti</translation>
-<translation id="6443871981718447451">kuonyesha menyu ya manukuu</translation>
-<translation id="6453774872122745852">shukrani</translation>
-<translation id="648732519525291180">Kiteua wakati</translation>
-<translation id="6550675742724504774">Chaguo</translation>
-<translation id="6572309429103589720">Sarufi si sahihi</translation>
-<translation id="658823671542763450">ingia skrini kamili</translation>
-<translation id="663493177488814956">mipasho</translation>
-<translation id="6637586476836377253">kumbukumbu</translation>
-<translation id="6643016212128521049">Futa</translation>
-<translation id="668171684555832681">Mengine...</translation>
-<translation id="6692633176391053278">stepper</translation>
-<translation id="6709570249143506788">Ubora wa chini wa kucheza video</translation>
-<translation id="6755330956360078551">kidirisha cha vidokezo</translation>
-<translation id="6790428901817661496">Cheza</translation>
-<translation id="6820355525329141109">Haikuweza kupakia programu jalizi.</translation>
-<translation id="6820615603175220800">marejeleo ya bibliografia</translation>
-<translation id="6843725295806269523">nyamazisha</translation>
-<translation id="6885760532393684712">saraka</translation>
-<translation id="689129560213475294">kolofoni</translation>
-<translation id="6934078000481955284">nukuu la msingi</translation>
-<translation id="6941933287844615239">pakua maudhui</translation>
-<translation id="6981594929165378967">uwekaji</translation>
-<translation id="6989848892321993519">Tafadhali refusha maandishi haya hadi herufi <ph name="MIN_CHARACTERS" /> au zaidi (kwa sasa unatumia herufi 1).</translation>
-<translation id="7033340931668032222">juu na chini ili kubadilisha sauti</translation>
-<translation id="709897737746224366">Tafadhali linganisha umbizo lililoombwa.</translation>
-<translation id="7118469954320184356">Hakuna maelezo yanayopatikana.</translation>
-<translation id="7139483182332611405">dibaji</translation>
-<translation id="7214187073215825913">maelezo ya maudhui</translation>
-<translation id="7263440858009898357">Tafadhali chagua kipengee katika orodha.</translation>
-<translation id="727747134524199931">kijajuu cha safu wima</translation>
-<translation id="7320576522385648310">inaakibisha</translation>
-<translation id="7353453495576941748">aliyeshiriki</translation>
-<translation id="7364796246159120393">Chagua Faili</translation>
-<translation id="739024184232394898">Nyingine...</translation>
-<translation id="7405738980073107433">maelezo ya mwisho wa kitabu</translation>
-<translation id="7410239719251593705">Inaonekana kuwa na maudhui ya watu wazima. Hakuna maelezo yanayopatikana.</translation>
-<translation id="7460907917090416791">TB <ph name="QUANTITY" /></translation>
-<translation id="7491962110804786152">kichupo</translation>
-<translation id="7514365320538308">Pakua</translation>
-<translation id="7529102961911894712">kiungo rejeshi</translation>
-<translation id="7533959249147584474">Mchoro usiokuwa na lebo</translation>
-<translation id="7647456547678091388">kidokezo</translation>
-<translation id="7661956066982048809">hati ya picha</translation>
-<translation id="7673697353781729403">Saa</translation>
-<translation id="7681220483256441252">faharasa</translation>
-<translation id="7740050170769002709">Maudhui ya HTML</translation>
-<translation id="7745230546936012372">Ili upate ufafanuzi wa picha unaokosekana, fungua menyu.</translation>
-<translation id="7750228210027921155">Picha ndani ya picha</translation>
-<translation id="775297008183122718">Ingizo batili</translation>
-<translation id="7789962463072032349">Sitisha</translation>
-<translation id="7802800022689234070">pembe tatu ya ufafanuzi</translation>
-<translation id="7888071071722539607">Tafadhali jumuisha '<ph name="ATSIGN" />' katika anwani ya barua pepe. '<ph name="INVALIDADDRESS" />' inakosa '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">kitenganishi</translation>
-<translation id="795667975304826397">Hakuna faili iliyochaguliwa</translation>
-<translation id="8053789581856978548">sehemu ya maandishi ya utafutaji</translation>
-<translation id="8057695513531652401">ilani</translation>
-<translation id="8105797009065549151">marejeleo ya dokezo</translation>
-<translation id="811583516810654505">Inaleta ufafanuzi...</translation>
-<translation id="8117451130807776954">Wiki hii</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">kiteuzi cha saa na tarehe ya mahali ulipo</translation>
-<translation id="8261464734335370856">Maendelezo si sahihi</translation>
-<translation id="8284326494547611709">Manukuu</translation>
-<translation id="835897206747267392">Thamani batili.</translation>
-<translation id="8403857369060869934">muda uliopita: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">sehemu</translation>
-<translation id="8433900881053900389">upau wa vidhibiti</translation>
-<translation id="8444882422881193423">faili <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Tafadhali chagua faili.</translation>
-<translation id="8461852803063341183">kitufe cha mviringo</translation>
-<translation id="8474886197722836894">tabaruku</translation>
-<translation id="8531739829932800271">hitilafu katika uchapishaji</translation>
-<translation id="8534579021159131403">Dakika</translation>
-<translation id="8541249477527128034">udhibiti wa vyombo vya habari</translation>
-<translation id="8550857728288566671">ishara ya picha</translation>
-<translation id="8583702881314752957">orodha ya ufafanuzi</translation>
-<translation id="8597182159515967513">kichwa</translation>
-<translation id="8603553056539299761">kushoto na kulia ili kusogeza</translation>
-<translation id="860475260694818407">jedwali la yaliyomo</translation>
-<translation id="8613126697340063924">dhibiti kucheza kwa mbali</translation>
-<translation id="862370744433916922">kichwa kidogo</translation>
-<translation id="8711688047404765493">vifaa vya kutoa maudhui</translation>
-<translation id="8750798805984357768">Tafadhali chagua moja wapo ya chaguo hizi.</translation>
-<translation id="8808573423886751634">sura</translation>
-<translation id="8845239796550121995">Sasa inatuma kwenye TV yako</translation>
-<translation id="8851136666856101339">kuu</translation>
-<translation id="8875657656876809964">Hitilafu ya kucheza video</translation>
-<translation id="8901569739625249689">KB <ph name="QUANTITY" /></translation>
-<translation id="8987927404178983737">Mwezi</translation>
-<translation id="901493112792887934">muda wa sasa kwa sekunde</translation>
-<translation id="901834265349196618">Barua pepe</translation>
-<translation id="9048119486235211610">kuvinjari</translation>
-<translation id="9062295712474918030">hati</translation>
-<translation id="9062307380734144336">chagua ili ugeuze swichi ya kucheza au kusitisha</translation>
-<translation id="9093215626363556771">funga hali ya picha ndani ya picha</translation>
-<translation id="9108370397979208512">hisabati</translation>
-<translation id="9132465097189459683">Nyingine...</translation>
-<translation id="9138385573473225930">arifa</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, itaanza tarehe <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Picha ndani ya Picha</translation>
-<translation id="9168329111483466115">tanbihi</translation>
-<translation id="954003015749068518">washa hali ya picha ndani ya picha</translation>
-<translation id="966787709310836684">menyu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_ta.xtb b/chromium/content/app/strings/translations/content_strings_ta.xtb
deleted file mode 100644
index 4a11a821016..00000000000
--- a/chromium/content/app/strings/translations/content_strings_ta.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="ta">
-<translation id="1018939186200882850">மெனு உருப்படி</translation>
-<translation id="10623998915015855">நிலைமாற்றுவதற்கான பொத்தான்</translation>
-<translation id="1088086359088493902">வினாடிகள்</translation>
-<translation id="1171774979989969504">ஒரு மின்னஞ்சல் முகவரியை உள்ளிடவும்.</translation>
-<translation id="1178581264944972037">இடைநிறுத்து</translation>
-<translation id="1188858454923323853">ஈடுசெய்யக்கூடியது</translation>
-<translation id="1206619573307042055">மார்கியூ</translation>
-<translation id="1206693055195146388">ஸ்லைடர்</translation>
-<translation id="1211441953136645838">முடிவுக்குறிப்பு</translation>
-<translation id="1281252709823657822">உரையாடல்</translation>
-<translation id="1335095011850992622">பங்களித்தவர்கள்</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">பேனர்</translation>
-<translation id="1589122976691792535">மண்டலம்</translation>
-<translation id="1591562245178063882">இந்த மாதம்</translation>
-<translation id="1637811476055996098">கோப்புகளைத் தேர்வுசெய்க</translation>
-<translation id="1650423536718072820">pullquote</translation>
-<translation id="1727886345390570319">விரிவான வசனங்கள் மெனுவை மறைக்கும்</translation>
-<translation id="1729654308190250600">காலி அல்லாத மின்னஞ்சல் முகவரியை உள்ளிடவும்.</translation>
-<translation id="1758486001363313524">மற்றவை…</translation>
-<translation id="1806710327868736751">விழிப்பூட்டல்_உரையாடல்</translation>
-<translation id="1821985195704844674">ட்ரீ கிரிட்</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">தொலைநிலைச் சாதனத்தில் இயக்கு</translation>
-<translation id="190587075670221089">நீக்கும்</translation>
-<translation id="1907737156431278478">உதாரணம்</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">நிலை</translation>
-<translation id="1938124657309484470">மதிப்பு <ph name="MAXIMUM_DATE_OR_TIME" /> அல்லது அதற்கு முன்பு இருக்க வேண்டும்.</translation>
-<translation id="1946271899482435442">தேதித் தேர்ந்தெடுப்பானைக் காட்டும்</translation>
-<translation id="1993104285338243655">பிரதிபலித்தலுக்கு மாற்றியது</translation>
-<translation id="2060505056492490888"><ph name="INVALIDDOMAIN" /> இல் தவறான இடத்தில் '<ph name="DOT" />' பயன்படுத்தபட்டுள்ளது.</translation>
-<translation id="2148716181193084225">இன்று</translation>
-<translation id="2158401438286456825">பக்கப் பட்டியல்</translation>
-<translation id="2226276347425096477">இந்த உரையை <ph name="MAX_CHARACTERS" /> எழுத்துக்குறிகள் அல்லது அதற்கும் குறைவாக சுருக்கிடுங்கள் (நீங்கள் தற்போது <ph name="CURRENT_LENGTH" /> எழுத்துக்குறிகளைப் பயன்படுத்துகிறீர்கள்).</translation>
-<translation id="2246498165605549352">அகக் கோப்பு</translation>
-<translation id="2247351761944213033">வாரம் <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ட்ராக் <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">செக்பாக்ஸ்</translation>
-<translation id="2311842470354187719">பக்க முறிப்பு</translation>
-<translation id="2335594187091864976">தேதி மற்றும் நேரம் தேர்ந்தெடுப்பான்</translation>
-<translation id="245932805758469625">மீதமுள்ள வீடியோவின் வினாடிகள்</translation>
-<translation id="248395913932153421">நாள்</translation>
-<translation id="2507943997699731163">இந்தப் புலத்தை நிரப்புக.</translation>
-<translation id="2508569020611168319">தாவல் பட்டியல்</translation>
-<translation id="2561842179657104141">மேலும் மீடியா கட்டுப்பாடுகளைக் காட்டு</translation>
-<translation id="2572483411312390101">இயக்கு</translation>
-<translation id="2613802280814924224">சரியான மதிப்பை உள்ளிடவும்.  <ph name="VALID_VALUE" /> என்பது நெருக்கமாக உள்ள சரியான மதிப்பாகும்.</translation>
-<translation id="2653659639078652383">சமர்ப்பி</translation>
-<translation id="2657045182931379222">கிராஃபிக்ஸ் பொருள்</translation>
-<translation id="2674318244760992338">அடிக்குறிப்பு</translation>
-<translation id="2709516037105925701">தானாகநிரப்பு</translation>
-<translation id="2723001399770238859">ஆடியோ</translation>
-<translation id="2746543609216772311">மதிப்பானது <ph name="MINIMUM_DATE_OR_TIME" /> அல்லது அதற்குப் பின்பு இருக்க வேண்டும்.</translation>
-<translation id="2759744352195237655">பாப் அப் பொத்தான்</translation>
-<translation id="2761667185364618470">தொடர விரும்பினால், இந்தப் பெட்டியைத் தேர்ந்தெடுங்கள்.</translation>
-<translation id="2844350028562914727">விவரங்கள்</translation>
-<translation id="2896972712917208084">ரேடியோ குழு</translation>
-<translation id="2908441821576996758">காற்புள்ளியால் பிரிக்கப்பட்ட மின்னஞ்சல் முகவரிகளின் பட்டியலை உள்ளிடுக.</translation>
-<translation id="2940813599313844715">பொருள்</translation>
-<translation id="2942448076852699108">தனிப்படுத்தப்பட்ட உள்ளடக்கம்</translation>
-<translation id="3040011195152428237">இணைப்பு</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> மெ.பை</translation>
-<translation id="3075154866155599887">சரியான மதிப்பை உள்ளிடவும். இந்தப் புலம் முழுமையற்றதாக உள்ளது அல்லது தவறான தேதியைக் கொண்டுள்ளது.</translation>
-<translation id="3078740164268491126">அட்டவணை</translation>
-<translation id="3086746722712840547">குறிப்பு</translation>
-<translation id="310520048233152454">URL ஐ உள்ளிடுக.</translation>
-<translation id="3175736971608411871">டைமர்</translation>
-<translation id="3199563858620722075">சேர்க்கைப் பெட்டி</translation>
-<translation id="3450233048674729344">மதிப்பானது கண்டிப்பாக <ph name="MAXIMUM" /> ஐ விடக்குறைவாக அல்லது அதற்குச் சமமாக இருக்க வேண்டும்.</translation>
-<translation id="3486220673238053218">விளக்கம்</translation>
-<translation id="3557673793733683882">தலைப்பு <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">வாரத் தேர்வி</translation>
-<translation id="3685101356851116974">லேபிளிடப்படாத படம்</translation>
-<translation id="3706100364254443312">ஸ்விட்ச்</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">’பிக்ச்சர்-இன்-பிக்ச்சரில்' இருந்து வெளியேறு</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">சொல்</translation>
-<translation id="3822383571486410024">இந்த உரையை <ph name="MIN_CHARACTERS" /> எழுத்துக்குறிகள் அல்லது அதற்கும் அதிகமாக (தற்போது <ph name="CURRENT_LENGTH" /> எழுத்துக்குறிகளைப் பயன்படுத்துகிறீர்கள்) நீட்டிக்கவும்.</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />' ஐத் தொடர்ந்து வரும் பகுதியில் '<ph name="INVALIDCHARACTER" />' சின்னம் இருக்கக்கூடாது.</translation>
-<translation id="3846214748874656680">முழுத்திரை வேண்டாம்</translation>
-<translation id="3920932319529768807">முடிவு</translation>
-<translation id="3924558731517983934">ஆப்ஸ்</translation>
-<translation id="3944740393230681990">முன்னுரை</translation>
-<translation id="3960700977367013758">உருட்டல் பட்டி</translation>
-<translation id="4103419683916926126">மில்லிவினாடிகள்</translation>
-<translation id="4151657705144244502">கிராஃபிக்</translation>
-<translation id="4160057747563657758">தொலைபேசி</translation>
-<translation id="4193965531860883258">அறிமுகம்</translation>
-<translation id="4201051445878709314">முந்தைய மாதத்தைக் காட்டு</translation>
-<translation id="421884353938374759">வண்ணத் தேர்வி</translation>
-<translation id="4248100235867064564">மெனுப் பட்டி</translation>
-<translation id="4360991593054037559">சரியான மதிப்பை உள்ளிடவும். <ph name="VALID_VALUE_LOW" /> மற்றும் <ph name="VALID_VALUE_HIGHER" /> ஆகியவை மிக நெருக்கமான சரியான இரண்டு மதிப்புகளாகும்.</translation>
-<translation id="4384583879834880242">கேள்வி-பதில்</translation>
-<translation id="4413860115965805769">மெனு பொத்தான்</translation>
-<translation id="4444765639179266822"><ph name="OCR_TEXT" /> என்று சொல்வதாகத் தோன்றுகிறது</translation>
-<translation id="4446524499724042288">அருஞ்சொல் திரட்டு மேற்கோள்</translation>
-<translation id="4522570452068850558">விவரங்கள்</translation>
-<translation id="4542388879936266156">மீதமுள்ள நேரம்: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">படிவம்</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />' ஐத் தொடரும் பகுதியில், '<ph name="INVALIDCHARACTER" />' சின்னம் இருக்கக்கூடாது.</translation>
-<translation id="4668956016107839909">பிற்சேர்க்கை</translation>
-<translation id="4718048029184481307">’பிக்ச்சர்-இன்-பிக்ச்சர்' பயன்முறையில் பிளே ஆகிறது</translation>
-<translation id="4742539557769756338">அட்டை</translation>
-<translation id="4748357248530471599">டிஸ்ப்ளே கட்அவுட் முழுத்திரை நிலைமாற்ற பட்டன்</translation>
-<translation id="4757246831282535685">தாவல் பலகம்</translation>
-<translation id="4763480195061959176">வீடியோ</translation>
-<translation id="479989351350248267">தேடல்</translation>
-<translation id="4812940957355064477">எண்ணை உள்ளிடுக.</translation>
-<translation id="4912536737030637138">நூல்விவர அட்டவணை உள்ளீடு</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> தேர்ந்தெடுக்கப்பட்டன</translation>
-<translation id="4992066212339426712">ஒலி இயக்கு</translation>
-<translation id="49969490063480558">'<ph name="ATSIGN" />' ஐத் தொடர்ந்து ஒரு பகுதியை உள்ளிடவும். '<ph name="INVALIDADDRESS" />' முழுமைப்பெறாமல் உள்ளது.</translation>
-<translation id="5034860022980953847">செயல்நிலை காட்டி</translation>
-<translation id="5090250355906949916">வீடியோ நேர ஸ்க்ரப்பர்</translation>
-<translation id="5093189678851173835">கல்வெட்டு</translation>
-<translation id="5117590920725113268">அடுத்த மாதத்தைக் காட்டு</translation>
-<translation id="512758898067543763">வரிசை மேற்தலைப்பு</translation>
-<translation id="5143125788380636750">முடிவுரை</translation>
-<translation id="5164977714490026579">மதிப்பானது, கண்டிப்பாக <ph name="MINIMUM" /> ஐ விட அதிகமாக அல்லது அதற்குச் சமமாக இருக்க வேண்டும்.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> பெ.பை</translation>
-<translation id="5307600278924710095">'<ph name="ATSIGN" />' ஐத் தொடர்ந்து ஒரு பகுதியை உள்ளிடவும். '<ph name="INVALIDADDRESS" />' முழுமைப் பெறாமல் உள்ளது.</translation>
-<translation id="5334352251556557839">மீடியாவை இயக்க முடியவில்லை.</translation>
-<translation id="5406322316791861025">உருவம்</translation>
-<translation id="5453733299334684579">ட்ரீ உருப்படி</translation>
-<translation id="5466621249238537318">ஒன்று அல்லது அதற்குமேற்பட்ட கோப்புகளைத் தேர்ந்தெடுங்கள்.</translation>
-<translation id="5468998798572797635">முழுத்திரையிலிருந்து வெளியேறு</translation>
-<translation id="5516424706154626233">தேதி தேர்ந்தெடுப்பான்</translation>
-<translation id="5537725057119320332">அலைபரப்பு</translation>
-<translation id="5546461542133609677">ஒலி இயக்கு</translation>
-<translation id="561939826962581046">நேரம்</translation>
-<translation id="5630795885300617244">10வி தவிர்க்க, இடது அல்லது வலதுபுறம் இருமுறை தட்டவும்</translation>
-<translation id="5631759159893697722">சுருக்கம்</translation>
-<translation id="5643186887447432888">பொத்தான்</translation>
-<translation id="5677946354068040947">கூடுதல் விருப்பங்கள் பட்டன்</translation>
-<translation id="576709008726043716">அறிமுகம்</translation>
-<translation id="57838592816432529">ஒலியடக்கு</translation>
-<translation id="5860033963881614850">ஆஃப்</translation>
-<translation id="588258955323874662">முழுத்திரை</translation>
-<translation id="5888666972993069672">இப்போது <ph name="DEVICE_FRIENDLY_NAME" />க்கு அனுப்புகிறது</translation>
-<translation id="591047860372322273">தேடல் பெட்டி</translation>
-<translation id="5939518447894949180">மீட்டமை</translation>
-<translation id="5966707198760109579">வாரம்</translation>
-<translation id="5987525920412732405">சுழல் பொத்தான்</translation>
-<translation id="6011459053400940133">ஒலியளவு ஸ்லைடர்</translation>
-<translation id="6015796118275082299">ஆண்டு</translation>
-<translation id="6023896073578205740">பட்டியல் பெட்டி</translation>
-<translation id="6150588977291308318">நூல்விவர அட்டவணை</translation>
-<translation id="6164829606128959761">மீட்டர்</translation>
-<translation id="6166809985690652833">பின்னுரை</translation>
-<translation id="6209276755895393898"><ph name="DESCRIPTION" /> போலத் தோன்றுகிறது.</translation>
-<translation id="6213469881011901533">அருஞ்சொல் திரட்டு</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">பிக்ச்சர்-இன்-பிக்ச்சர் பயன்முறையிலிருந்து வெளியேறு</translation>
-<translation id="6398862346408813489">மாதம் தேர்ந்தெடுப்புப் பலகத்தைக் காட்டு</translation>
-<translation id="6404546809543547843">ஆடியோ நேர ஸ்கிரப்பர்</translation>
-<translation id="6443871981718447451">விரிவான வசனங்கள் மெனுவைக் காட்டும்</translation>
-<translation id="6453774872122745852">அங்கீகாரங்கள்</translation>
-<translation id="648732519525291180">நேரம் தேர்ந்தெடுப்பான்</translation>
-<translation id="6550675742724504774">விருப்பத்தேர்வுகள்</translation>
-<translation id="6572309429103589720">இலக்கணப்பிழை</translation>
-<translation id="658823671542763450">முழுத்திரைக்குச் செல்</translation>
-<translation id="663493177488814956">ஊட்டம்</translation>
-<translation id="6637586476836377253">பதிவு</translation>
-<translation id="6643016212128521049">அழி</translation>
-<translation id="668171684555832681">மற்றவை…</translation>
-<translation id="6692633176391053278">ஸ்டெப்பர்</translation>
-<translation id="6709570249143506788">மோசமான வீடியோவின் தரம்</translation>
-<translation id="6755330956360078551">உதவிக்குறிப்பு</translation>
-<translation id="6790428901817661496">இயக்கு</translation>
-<translation id="6820355525329141109">செருகுநிரல் ஏற்றப்படவில்லை.</translation>
-<translation id="6820615603175220800">நூல்விவர அட்டவணை மேற்கோள்</translation>
-<translation id="6843725295806269523">ஒலியடக்கு</translation>
-<translation id="6885760532393684712">கோப்பகம்</translation>
-<translation id="689129560213475294">முத்திரை</translation>
-<translation id="6934078000481955284">பிளாக்கோட்</translation>
-<translation id="6941933287844615239">மீடியாவைப் பதிவிறக்கு</translation>
-<translation id="6981594929165378967">செருகும்</translation>
-<translation id="6989848892321993519">இந்த உரையில் <ph name="MIN_CHARACTERS" /> அல்லது அதற்கு மேற்பட்ட எழுத்துக்குறிகளைப் பயன்படுத்தவும் (தற்போது 1 எழுத்துக்குறியைப் பயன்படுத்துகிறீர்கள்).</translation>
-<translation id="7033340931668032222">ஒலியளவை மாற்ற மேலும் கீழும் அசைக்கவும்</translation>
-<translation id="709897737746224366">கோரிய வடிவமைப்பில் தருக.</translation>
-<translation id="7118469954320184356">விவரம் எதுவுமில்லை.</translation>
-<translation id="7139483182332611405">முன்னுரை</translation>
-<translation id="7214187073215825913">உள்ளடக்கத் தகவல்</translation>
-<translation id="7263440858009898357">பட்டியலிலிருந்து ஒரு உருப்படியைத் தேர்ந்தெடுங்கள்.</translation>
-<translation id="727747134524199931">நெடுவரிசை மேற்தலைப்பு</translation>
-<translation id="7320576522385648310">ஏற்றுகிறது</translation>
-<translation id="7353453495576941748">பங்களித்தவர்</translation>
-<translation id="7364796246159120393">கோப்பைத் தேர்வு செய்க</translation>
-<translation id="739024184232394898">மற்றவை…</translation>
-<translation id="7405738980073107433">முடிவுக்குறிப்புகள்</translation>
-<translation id="7410239719251593705">வயதுவந்தோருக்கான உள்ளடக்கம் இருக்கலாம். விவரம் இல்லை.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> டெ.பை</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">பதிவிறக்கு</translation>
-<translation id="7529102961911894712">பின்னிணைப்பு</translation>
-<translation id="7533959249147584474">லேபிளிடப்படாத கிராஃபிக்</translation>
-<translation id="7647456547678091388">உதவிக்குறிப்பு</translation>
-<translation id="7661956066982048809">கிராஃபிக்ஸ் ஆவணம்</translation>
-<translation id="7673697353781729403">மணிநேரம்</translation>
-<translation id="7681220483256441252">பொருளடக்கம்</translation>
-<translation id="7740050170769002709">HTML உள்ளடக்கம்</translation>
-<translation id="7745230546936012372">சூழல் மெனுவைத் திறந்தால் மறைந்துள்ள படங்களின் விவரங்களைப் பெறலாம்.</translation>
-<translation id="7750228210027921155">பிக்ச்சர்-இன்-பிக்ச்சர்</translation>
-<translation id="775297008183122718">தவறான உள்ளீடு</translation>
-<translation id="7789962463072032349">இடைநிறுத்து</translation>
-<translation id="7802800022689234070">கூடுதல் உள்ளடக்க முக்கோணம்</translation>
-<translation id="7888071071722539607">மின்னஞ்சல் முகவரியில் '<ph name="ATSIGN" />' ஐச் சேர்க்கவும். '<ph name="ATSIGN" />' இல் '<ph name="INVALIDADDRESS" />' இல்லை.</translation>
-<translation id="7891486169920085145">பிரிப்பான்</translation>
-<translation id="795667975304826397">எந்த கோப்பும் தேர்ந்தெடுக்கப்படவில்லை</translation>
-<translation id="8053789581856978548">தேடல் உரைப் புலம்</translation>
-<translation id="8057695513531652401">அறிவிப்பு</translation>
-<translation id="8105797009065549151">குறிப்பு மேற்கோள்</translation>
-<translation id="811583516810654505">விளக்கத்தைப் பெறுகிறது...</translation>
-<translation id="8117451130807776954">இந்த வாரம்</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">உள்ளூர் தேதி &amp; நேரத் தேர்வி</translation>
-<translation id="8261464734335370856">எழுத்துப்பிழை</translation>
-<translation id="8284326494547611709">வசனங்கள்</translation>
-<translation id="835897206747267392">செல்லாத மதிப்பு.</translation>
-<translation id="8403857369060869934">முடிவடைந்த நேரம்: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">பகுதி</translation>
-<translation id="8433900881053900389">கருவிப்பட்டி</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> கோப்புகள்</translation>
-<translation id="8451268428117625855">ஒரு கோப்பை தேர்ந்தெடுக்கவும்.</translation>
-<translation id="8461852803063341183">ரேடியோ பட்டன்</translation>
-<translation id="8474886197722836894">அர்ப்பணம்</translation>
-<translation id="8531739829932800271">பிழைகள்</translation>
-<translation id="8534579021159131403">நிமிடங்கள்</translation>
-<translation id="8541249477527128034">மீடியா கட்டுப்பாடு</translation>
-<translation id="8550857728288566671">கிராஃபிக்ஸ் சின்னம்</translation>
-<translation id="8583702881314752957">விளக்கப் பட்டியல்</translation>
-<translation id="8597182159515967513">தலைப்பு</translation>
-<translation id="8603553056539299761">நகர்த்த இடது புறமும் வலது புறமும் அசைக்கவும்</translation>
-<translation id="860475260694818407">உள்ளடக்க அட்டவணை</translation>
-<translation id="8613126697340063924">தொலைநிலை இயக்கத்தைக் கட்டுப்படுத்தவும்</translation>
-<translation id="862370744433916922">துணை தலைப்பு</translation>
-<translation id="8711688047404765493">வெளியீடு</translation>
-<translation id="8750798805984357768">தயவுசெய்து இந்த விருப்பங்களில் ஒன்றைத் தேர்ந்தெடுங்கள்.</translation>
-<translation id="8808573423886751634">அத்தியாயம்</translation>
-<translation id="8845239796550121995">டிவிக்கு அனுப்புகிறது</translation>
-<translation id="8851136666856101339">முதன்மை</translation>
-<translation id="8875657656876809964">வீடியோ இயக்கப் பிழை</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> கி.பை.</translation>
-<translation id="8987927404178983737">மாதம்</translation>
-<translation id="901493112792887934">நடப்பு நேரம் வினாடிகளில்</translation>
-<translation id="901834265349196618">மின்னஞ்சல்</translation>
-<translation id="9048119486235211610">வழிசெலுத்தல்</translation>
-<translation id="9062295712474918030">ஆவணம்</translation>
-<translation id="9062307380734144336">பிளே செய்தல்/இடைநிறுத்துதலுக்கு இடையே நிலைமாற்றுவதற்குத் தேர்ந்தெடுக்கவும்</translation>
-<translation id="9093215626363556771">பிக்ச்சர்-இன்-பிக்ச்சர் பயன்முறையிலிருந்து வெளியேறும்</translation>
-<translation id="9108370397979208512">கணிதம்</translation>
-<translation id="9132465097189459683">மற்றவை…</translation>
-<translation id="9138385573473225930">விழிப்பூட்டல்</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" /> அன்று தொடங்குவது</translation>
-<translation id="916607977885256133">பிக்ச்சர்-இன்-பிக்ச்சர்</translation>
-<translation id="9168329111483466115">அடிக்குறிப்பு</translation>
-<translation id="954003015749068518">பிக்ச்சர்-இன்-பிக்ச்சர் பயன்முறைக்குச் செல்லும்</translation>
-<translation id="966787709310836684">மெனு</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_te.xtb b/chromium/content/app/strings/translations/content_strings_te.xtb
deleted file mode 100644
index bc26c1d2f9f..00000000000
--- a/chromium/content/app/strings/translations/content_strings_te.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="te">
-<translation id="1018939186200882850">మెను అంశం</translation>
-<translation id="10623998915015855">టోగుల్ బటన్</translation>
-<translation id="1088086359088493902">సెకన్లు</translation>
-<translation id="1171774979989969504">దయచేసి ఇమెయిల్ చిరునామాను ఎంటర్ చెయ్యండి.</translation>
-<translation id="1178581264944972037">పాజ్ చేయి</translation>
-<translation id="1188858454923323853">బహుమానపూర్వకం</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">స్లయిడర్</translation>
-<translation id="1211441953136645838">ఎండ్‌నోట్</translation>
-<translation id="1281252709823657822">డైలాగ్</translation>
-<translation id="1335095011850992622">సహకారులు</translation>
-<translation id="1342835525016946179">కథనం</translation>
-<translation id="1359897965706325498">బ్యానర్</translation>
-<translation id="1589122976691792535">ప్రాంతం</translation>
-<translation id="1591562245178063882">ఈ నెల</translation>
-<translation id="1637811476055996098">ఫైల్‌లను ఎంచుకోండి</translation>
-<translation id="1650423536718072820">పుల్‌కోట్</translation>
-<translation id="1727886345390570319">ఉపశీర్షికల మెనూని దాచు</translation>
-<translation id="1729654308190250600">దయచేసి ఖాళీ-కాని ఇమెయిల్ చిరునామాను నమోదు చేయండి.</translation>
-<translation id="1758486001363313524">ఇతర...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">వృక్షాంశ గ్రిడ్</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">రిమోట్ పరికరంలో ప్లే చేస్తుంది</translation>
-<translation id="190587075670221089">తొలగింపు</translation>
-<translation id="1907737156431278478">ఉదాహరణ</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">స్థితి</translation>
-<translation id="1938124657309484470">విలువ తప్పనిసరిగా <ph name="MAXIMUM_DATE_OR_TIME" /> లేదా అంతకంటే మునుపటిది అయి ఉండాలి.</translation>
-<translation id="1946271899482435442">తేదీ ఎంపికను చూపుతుంది</translation>
-<translation id="1993104285338243655">మిర్రరింగ్‌కు మార్చబడింది</translation>
-<translation id="2060505056492490888">'<ph name="INVALIDDOMAIN" />'లో '<ph name="DOT" />' తప్పు స్థానంలో ఉపయోగించబడింది.</translation>
-<translation id="2148716181193084225">ఈ రోజు</translation>
-<translation id="2158401438286456825">పేజీ జాబితా</translation>
-<translation id="2226276347425096477">దయచేసి ఈ వచనాన్ని <ph name="MAX_CHARACTERS" /> అక్షరాలకు లేదా అంతకంటే తక్కువకు తగ్గించండి (మీరు ప్రస్తుతం <ph name="CURRENT_LENGTH" /> అక్షరాలను ఉపయోగిస్తున్నారు).</translation>
-<translation id="2246498165605549352">స్థానిక ఫైల్</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />వ వారం, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">ట్రాక్ <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">చెక్‌బాక్స్</translation>
-<translation id="2311842470354187719">పేజీ విభజన</translation>
-<translation id="2335594187091864976">తేదీ మరియు సమయం ఎంపిక</translation>
-<translation id="245932805758469625">వీడియోలో మిగిలి ఉన్న సెకన్లు</translation>
-<translation id="248395913932153421">రోజు</translation>
-<translation id="2507943997699731163">దయచేసి ఈ ఫీల్డ్‌ను పూర్తి చేయండి.</translation>
-<translation id="2508569020611168319">ట్యాబ్ జాబితా</translation>
-<translation id="2561842179657104141">మరిన్ని మీడియా నియంత్రణలను చూపు</translation>
-<translation id="2572483411312390101">ప్లే చేయి</translation>
-<translation id="2613802280814924224">దయచేసి చెల్లుబాటు అయ్యే విలువను నమోదు చేయండి. <ph name="VALID_VALUE" /> అనేది సమీప చెల్లుబాటు విలువ.</translation>
-<translation id="2653659639078652383">సమర్పించు</translation>
-<translation id="2657045182931379222">గ్రాఫిక్స్ ఆబ్జెక్ట్</translation>
-<translation id="2674318244760992338">ఫుటర్</translation>
-<translation id="2709516037105925701">స్వయంపూర్తి</translation>
-<translation id="2723001399770238859">ఆడియో</translation>
-<translation id="2746543609216772311">విలువ తప్పనిసరిగా <ph name="MINIMUM_DATE_OR_TIME" /> లేదా అంతకంటే తదుపరిది అయి ఉండాలి.</translation>
-<translation id="2759744352195237655">పాప్ అప్ బటన్</translation>
-<translation id="2761667185364618470">మీరు కొనసాగాలనుకుంటే దయచేసి ఈ బాక్స్‌కి టిక్కు పెట్టండి.</translation>
-<translation id="2844350028562914727">వివరాలు</translation>
-<translation id="2896972712917208084">రేడియో సమూహం</translation>
-<translation id="2908441821576996758">దయచేసి కామాతో వేరు చేసిన ఇమెయిల్ చిరునామాల జాబితాను నమోదు చేయండి.</translation>
-<translation id="2940813599313844715">ఆబ్జెక్ట్</translation>
-<translation id="2942448076852699108">హైలైట్ చేయబడిన కంటెంట్</translation>
-<translation id="3040011195152428237">లింక్</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">దయచేసి చెల్లుబాటు అయ్యే విలువను నమోదు చేయండి. ఫీల్డ్ అసంపూర్ణంగా ఉంది లేదా ఇందులోని తేదీ చెల్లదు.</translation>
-<translation id="3078740164268491126">పట్టిక</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">దయచేసి ఒక URLని ఎంటర్ చేయండి.</translation>
-<translation id="3175736971608411871">టైమర్</translation>
-<translation id="3199563858620722075">కాంబో పెట్టె</translation>
-<translation id="3450233048674729344">విలువ ఖచ్చితంగా <ph name="MAXIMUM" /> కంటే తగ్గువగా లేదా సమానంగా ఉండాలి.</translation>
-<translation id="3486220673238053218">నిర్వచనం</translation>
-<translation id="3557673793733683882">ముఖ్య శీర్షిక <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">వారం ఎంపిక</translation>
-<translation id="3685101356851116974">లేబుల్ లేని చిత్రం</translation>
-<translation id="3706100364254443312">మార్పు</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">చిత్రంలో చిత్రం మోడ్ నుండి నిష్క్రమింపజేయి</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">పదం</translation>
-<translation id="3822383571486410024">దయచేసి ఈ వచనాన్ని <ph name="MIN_CHARACTERS" /> లేదా అంతకంటే ఎక్కువ అక్షరాలకు పొడిగించండి (ప్రస్తుతం మీరు <ph name="CURRENT_LENGTH" /> అక్షరాలను ఉపయోగిస్తున్నారు).</translation>
-<translation id="383465348367842624">'<ph name="ATSIGN" />'కి ముందు ఉన్న భాగంలో '<ph name="INVALIDCHARACTER" />' చిహ్నం ఉండకూడదు.</translation>
-<translation id="3846214748874656680">పూర్తి స్క్రీన్ నుండి నిష్క్రమించు</translation>
-<translation id="3920932319529768807">ముగింపు</translation>
-<translation id="3924558731517983934">అప్లికేషన్‌</translation>
-<translation id="3944740393230681990">ప్రారంభం</translation>
-<translation id="3960700977367013758">స్క్రోల్ బార్</translation>
-<translation id="4103419683916926126">మిల్లీసెకన్లు</translation>
-<translation id="4151657705144244502">గ్రాఫిక్</translation>
-<translation id="4160057747563657758">టెలిఫోన్</translation>
-<translation id="4193965531860883258">ముందుమాట</translation>
-<translation id="4201051445878709314">మునుపటి నెలను చూపుతుంది</translation>
-<translation id="421884353938374759">రంగు ఎంపిక</translation>
-<translation id="4248100235867064564">మెనూ బార్</translation>
-<translation id="4360991593054037559">దయచేసి చెల్లుబాటు అయ్యే విలువను నమోదు చేయండి. <ph name="VALID_VALUE_LOW" /> మరియు <ph name="VALID_VALUE_HIGHER" /> అనేవి రెండు సమీప చెల్లుబాటు విలువలు.</translation>
-<translation id="4384583879834880242">Q&amp;A</translation>
-<translation id="4413860115965805769">మెను బటన్</translation>
-<translation id="4444765639179266822">ఇది చెబుతున్నట్లుగా ఉంది: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">పదకోశ సూచన</translation>
-<translation id="4522570452068850558">వివరాలు</translation>
-<translation id="4542388879936266156">మిగిలి ఉన్న సమయం: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ఫారమ్</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">'<ph name="ATSIGN" />'కి తర్వాత ఉన్న భాగంలో '<ph name="INVALIDCHARACTER" />' చిహ్నం ఉండకూడదు.</translation>
-<translation id="4668956016107839909">అనుబంధం</translation>
-<translation id="4718048029184481307">చిత్రంలో చిత్రం మోడ్‌లో ప్లే అవుతోంది</translation>
-<translation id="4742539557769756338">ముఖచిత్రం</translation>
-<translation id="4748357248530471599">డిస్‌ప్లే కత్తిరింపు పూర్తి స్క్రీన్‌ని సక్రియం చేస్తుంది</translation>
-<translation id="4757246831282535685">ట్యాబ్ ప్యానెల్</translation>
-<translation id="4763480195061959176">వీడియో</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">దయచేసి సంఖ్యను నమోదు చేయండి.</translation>
-<translation id="4912536737030637138">వివరణపట్టి నమోదు</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> ఎంచుకోబడ్డాయి</translation>
-<translation id="4992066212339426712">అన్‌మ్యూట్ చేయి</translation>
-<translation id="49969490063480558">దయచేసి '<ph name="ATSIGN" />'కి తర్వాత ఉన్న భాగాన్ని నమోదు చేయండి. '<ph name="INVALIDADDRESS" />' అసంపూర్ణంగా ఉంది.</translation>
-<translation id="5034860022980953847">ప్రోగ్రెస్ సూచిక</translation>
-<translation id="5090250355906949916">వీడియో సమయ స్క్రబ్బర్</translation>
-<translation id="5093189678851173835">పరిచయ వాక్యం</translation>
-<translation id="5117590920725113268">తరువాత నెలను చూపుతుంది</translation>
-<translation id="512758898067543763">అడ్డు వరుస శీర్షిక</translation>
-<translation id="5143125788380636750">ఉపసంహారం</translation>
-<translation id="5164977714490026579">విలువ ఖచ్చితంగా <ph name="MINIMUM" /> కంటే ఎక్కువగా లేదా సమానంగా ఉండాలి.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">దయచేసి '<ph name="ATSIGN" />'కి ముందు ఉన్న భాగాన్ని నమోదు చేయండి. '<ph name="INVALIDADDRESS" />' అసంపూర్ణంగా ఉంది.</translation>
-<translation id="5334352251556557839">మీడియాను ప్లే చేయడం సాధ్యపడలేదు.</translation>
-<translation id="5406322316791861025">రూపం</translation>
-<translation id="5453733299334684579">వృక్షాంశం</translation>
-<translation id="5466621249238537318">దయచేసి ఒకటి లేదా మరిన్ని ఫైళ్ళను ఎంచుకోండి.</translation>
-<translation id="5468998798572797635">పూర్తి స్క్రీన్ నుండి నిష్క్రమించు</translation>
-<translation id="5516424706154626233">తేదీ ఎంపిక</translation>
-<translation id="5537725057119320332">Cast</translation>
-<translation id="5546461542133609677">అన్‌మ్యూట్ చేయి</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">10సె దాటవేయడానికి రెండుసార్లు ఎడమ లేదా కుడివైపుకి నొక్కండి</translation>
-<translation id="5631759159893697722">సంక్షేపం</translation>
-<translation id="5643186887447432888">బటన్</translation>
-<translation id="5677946354068040947">మరిన్ని ఎంపికలు</translation>
-<translation id="576709008726043716">పరిచయం</translation>
-<translation id="57838592816432529">మ్యూట్ చేయి</translation>
-<translation id="5860033963881614850">ఆఫ్ అయ్యింది</translation>
-<translation id="588258955323874662">పూర్తితెర</translation>
-<translation id="5888666972993069672">ఇప్పుడు <ph name="DEVICE_FRIENDLY_NAME" />కి ప్రసారం చేస్తోంది</translation>
-<translation id="591047860372322273">శోధన పెట్టె</translation>
-<translation id="5939518447894949180">రీసెట్ చేయి</translation>
-<translation id="5966707198760109579">వారం</translation>
-<translation id="5987525920412732405">స్పిన్ బటన్</translation>
-<translation id="6011459053400940133">వాల్యూమ్ స్లయిడర్</translation>
-<translation id="6015796118275082299">సంవత్సరం</translation>
-<translation id="6023896073578205740">జాబితా పెట్టె</translation>
-<translation id="6150588977291308318">వివరణపట్టి</translation>
-<translation id="6164829606128959761">మీటర్</translation>
-<translation id="6166809985690652833">చివరిమాట</translation>
-<translation id="6209276755895393898">వీరిలా కనిపిస్తున్నారు: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">పదకోశం</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">చిత్రంలో చిత్రం మోడ్ నుండి నిష్క్రమించు</translation>
-<translation id="6398862346408813489">నెల ఎంపిక ప్యానెల్‌ను చూపుతుంది</translation>
-<translation id="6404546809543547843">ఆడియో సమయ స్క్రబ్బర్</translation>
-<translation id="6443871981718447451">ఉపశీర్షికల మెనూని చూపు</translation>
-<translation id="6453774872122745852">గుర్తింపులు</translation>
-<translation id="648732519525291180">సమయం ఎంపిక</translation>
-<translation id="6550675742724504774">ఎంపికలు</translation>
-<translation id="6572309429103589720">చెల్లని వ్యాకరణం</translation>
-<translation id="658823671542763450">పూర్తి స్క్రీన్‌లోకి ప్రవేశించు</translation>
-<translation id="663493177488814956">ఫీడ్</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">క్లియర్ చేయి</translation>
-<translation id="668171684555832681">ఇతర...</translation>
-<translation id="6692633176391053278">స్టెప్పర్</translation>
-<translation id="6709570249143506788">ప్లేబ్యాక్ నాణ్యత బాగాలేదు</translation>
-<translation id="6755330956360078551">సాధన చిట్కా</translation>
-<translation id="6790428901817661496">ప్లే చేయి</translation>
-<translation id="6820355525329141109">ప్లగ్ఇన్‌‌ను లోడ్ చేయడం సాధ్యపడలేదు.</translation>
-<translation id="6820615603175220800">వివరణపట్టి సూచన</translation>
-<translation id="6843725295806269523">మ్యూట్ చేయి</translation>
-<translation id="6885760532393684712">డైరెక్టరీ</translation>
-<translation id="689129560213475294">ఆఖరిమాట</translation>
-<translation id="6934078000481955284">బ్లాక్‌కోట్</translation>
-<translation id="6941933287844615239">మీడియా అంశం డౌన్‌లోడ్ చేయి</translation>
-<translation id="6981594929165378967">చొప్పించడం</translation>
-<translation id="6989848892321993519">దయచేసి ఈ వచనాన్ని <ph name="MIN_CHARACTERS" /> లేదా అంతకంటే ఎక్కువ అక్షరాలకు పొడిగించండి (ప్రస్తుతం మీరు 1 అక్షరాన్ని ఉపయోగిస్తున్నారు).</translation>
-<translation id="7033340931668032222">వాల్యూమ్ మార్చడానికి కిందకు లేదా పైకి బటన్‌ను ఉపయోగించండి</translation>
-<translation id="709897737746224366">దయచేసి అభ్యర్థించిన ఆకృతీకరణను సరిపోల్చండి.</translation>
-<translation id="7118469954320184356">వివరణ అందుబాటులో లేదు.</translation>
-<translation id="7139483182332611405">ముందుమాట</translation>
-<translation id="7214187073215825913">కంటెంట్ సమాచారం</translation>
-<translation id="7263440858009898357">దయచేసి జాబితాలోని ఒక అంశాన్ని ఎంచుకోండి.</translation>
-<translation id="727747134524199931">నిలువు వరుస శీర్షిక</translation>
-<translation id="7320576522385648310">బఫర్ చేయడం</translation>
-<translation id="7353453495576941748">సహకారి</translation>
-<translation id="7364796246159120393">ఫైల్‌ను ఎంచుకోండి</translation>
-<translation id="739024184232394898">ఇతర...</translation>
-<translation id="7405738980073107433">ఎండ్‌నోట్‌లు</translation>
-<translation id="7410239719251593705">పెద్దలకు మాత్రమే విషయాలను కలిగి ఉండవచ్చు. వివరణ అందుబాటులో లేదు.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">డౌన్‌లోడ్ చేయి</translation>
-<translation id="7529102961911894712">వెనుకకు తీసుకువెళ్లే లింక్‌</translation>
-<translation id="7533959249147584474">లేబుల్ లేని గ్రాఫిక్</translation>
-<translation id="7647456547678091388">చిట్కా</translation>
-<translation id="7661956066982048809">గ్రాఫిక్స్ పత్రం</translation>
-<translation id="7673697353781729403">గంటలు</translation>
-<translation id="7681220483256441252">సూచిక</translation>
-<translation id="7740050170769002709">HTML కంటెంట్</translation>
-<translation id="7745230546936012372">అందించలేకపోయిన చిత్ర వివరణలను పొందడానికి, సందర్భ మెనూని తెరవండి.</translation>
-<translation id="7750228210027921155">చిత్రంలో చిత్రం</translation>
-<translation id="775297008183122718">నమోదు చెల్లదు</translation>
-<translation id="7789962463072032349">నిలిపివేయి</translation>
-<translation id="7802800022689234070">కంటెంట్‌ను విస్తరింపజేసే లేదా కుదించే త్రిభుజం</translation>
-<translation id="7888071071722539607">దయచేసి ఇమెయిల్ చిరునామాలో '<ph name="ATSIGN" />'ని చేర్చండి. '<ph name="INVALIDADDRESS" />'లో '<ph name="ATSIGN" />' లేదు.</translation>
-<translation id="7891486169920085145">విభజన</translation>
-<translation id="795667975304826397">ఫైల్ ఏదీ ఎంచుకోలేదు</translation>
-<translation id="8053789581856978548">శోధన వచనం ఫీల్డ్</translation>
-<translation id="8057695513531652401">గమనిక</translation>
-<translation id="8105797009065549151">గమనిక సూచన</translation>
-<translation id="811583516810654505">వివరణను పొందుతోంది...</translation>
-<translation id="8117451130807776954">ఈ వారం</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">స్థానిక తేదీ మరియు సమయం ఎంపిక</translation>
-<translation id="8261464734335370856">చెల్లని అక్షరక్రమం</translation>
-<translation id="8284326494547611709">ఉపశీర్షికలు</translation>
-<translation id="835897206747267392">చెల్లని విలువ.</translation>
-<translation id="8403857369060869934">గడిచిన సమయం: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">భాగం</translation>
-<translation id="8433900881053900389">సాధన పట్టీ</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ఫైళ్ళు</translation>
-<translation id="8451268428117625855">దయచేసి ఒక ఫైల్‌ని ఎంచుకోండి.</translation>
-<translation id="8461852803063341183">రేడియో బటన్</translation>
-<translation id="8474886197722836894">అంకితం</translation>
-<translation id="8531739829932800271">తప్పొప్పుల పట్టిక</translation>
-<translation id="8534579021159131403">నిమిషాలు</translation>
-<translation id="8541249477527128034">మీడియా నియంత్రణ</translation>
-<translation id="8550857728288566671">గ్రాఫిక్స్ చిహ్నం</translation>
-<translation id="8583702881314752957">నిర్వచన జాబితా</translation>
-<translation id="8597182159515967513">శీర్షిక</translation>
-<translation id="8603553056539299761">దాటవేయడానికి ఎడమ లేదా కుడి బటన్‌ను ఉపయోగించండి</translation>
-<translation id="860475260694818407">కంటెంట్‌ల‌ పట్టిక</translation>
-<translation id="8613126697340063924">రిమోట్ ప్లేబ్యాక్‌ను నియంత్రిస్తుంది</translation>
-<translation id="862370744433916922">ఉపశీర్షిక</translation>
-<translation id="8711688047404765493">అవుట్‌పుట్</translation>
-<translation id="8750798805984357768">దయచేసి ఈ ఎంపికలలో ఒకదాన్ని ఎంచుకోండి.</translation>
-<translation id="8808573423886751634">అధ్యాయం</translation>
-<translation id="8845239796550121995">ఇప్పుడు మీ టీవీలో ప్రసారం చేస్తోంది</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">వీడియో ప్లేబ్యాక్ ఎర్రర్</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">నెల</translation>
-<translation id="901493112792887934">సెకన్లలో ప్రస్తుత సమయం</translation>
-<translation id="901834265349196618">ఇమెయిల్</translation>
-<translation id="9048119486235211610">నావిగేషన్</translation>
-<translation id="9062295712474918030">పత్రం</translation>
-<translation id="9062307380734144336">ప్లే చేయడం, పాజ్ చేయడం టోగుల్ చేసేలా ఎంచుకోండి</translation>
-<translation id="9093215626363556771">చిత్రంలో చిత్రం మోడ్ నుండి నిష్క్రమింపజేస్తుంది</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">ఇతర...</translation>
-<translation id="9138385573473225930">హెచ్చరిక</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, <ph name="WEEK_START_DATE" /> నుండి ప్రారంభమవుతుంది</translation>
-<translation id="916607977885256133">చిత్రంలో చిత్రం</translation>
-<translation id="9168329111483466115">ఫుట్‌నోట్</translation>
-<translation id="954003015749068518">చిత్రంలో చిత్రం మోడ్‌లోకి ప్రవేశిస్తుంది</translation>
-<translation id="966787709310836684">మెను</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_th.xtb b/chromium/content/app/strings/translations/content_strings_th.xtb
deleted file mode 100644
index 3dcb3fbcf53..00000000000
--- a/chromium/content/app/strings/translations/content_strings_th.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="th">
-<translation id="1018939186200882850">รายการเมนู</translation>
-<translation id="10623998915015855">ปุ่มสลับ</translation>
-<translation id="1088086359088493902">วินาที</translation>
-<translation id="1171774979989969504">โปรดป้อนที่อยู่อีเมล</translation>
-<translation id="1178581264944972037">หยุดชั่วคราว</translation>
-<translation id="1188858454923323853">ส่วนเสริม</translation>
-<translation id="1206619573307042055">ตัวอักษรวิ่ง</translation>
-<translation id="1206693055195146388">แถบเลื่อน</translation>
-<translation id="1211441953136645838">อ้างอิงท้ายเรื่อง</translation>
-<translation id="1281252709823657822">กล่องโต้ตอบ</translation>
-<translation id="1335095011850992622">เครดิต</translation>
-<translation id="1342835525016946179">บทความ</translation>
-<translation id="1359897965706325498">แบนเนอร์</translation>
-<translation id="1589122976691792535">ภูมิภาค</translation>
-<translation id="1591562245178063882">เดือนนี้</translation>
-<translation id="1637811476055996098">เลือกไฟล์</translation>
-<translation id="1650423536718072820">การเน้นข้อความ</translation>
-<translation id="1727886345390570319">ซ่อนเมนูคำอธิบายภาพ</translation>
-<translation id="1729654308190250600">โปรดป้อนที่อยู่อีเมลที่ไม่ว่างเปล่า</translation>
-<translation id="1758486001363313524">อื่นๆ...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">แผนผังต้นไม้</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">เล่นในอุปกรณ์ระยะไกล</translation>
-<translation id="190587075670221089">การลบ</translation>
-<translation id="1907737156431278478">ตัวอย่าง</translation>
-<translation id="1921819250265091946">วว</translation>
-<translation id="1930711995431081526">สถานะ</translation>
-<translation id="1938124657309484470">ค่าต้องเป็น <ph name="MAXIMUM_DATE_OR_TIME" /> หรือก่อนหน้านั้น</translation>
-<translation id="1946271899482435442">แสดงเครื่องมือเลือกวันที่</translation>
-<translation id="1993104285338243655">เปลี่ยนเป็นการมิเรอร์</translation>
-<translation id="2060505056492490888">"<ph name="DOT" />" ถูกใช้งานในตำแหน่งที่ไม่ถูกต้องใน "<ph name="INVALIDDOMAIN" />"</translation>
-<translation id="2148716181193084225">วันนี้</translation>
-<translation id="2158401438286456825">รายการหน้า</translation>
-<translation id="2226276347425096477">โปรดย่อข้อความนี้ให้เหลือไม่เกิน <ph name="MAX_CHARACTERS" /> อักขระ (ขณะนี้ข้อความของคุณมี <ph name="CURRENT_LENGTH" /> อักขระ)</translation>
-<translation id="2246498165605549352">ไฟล์ในตัวเครื่อง</translation>
-<translation id="2247351761944213033">สัปดาห์ที่ <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">แทร็ก <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">ช่องทำเครื่องหมาย</translation>
-<translation id="2311842470354187719">ตัวแบ่งหน้า</translation>
-<translation id="2335594187091864976">เครื่องมือเลือกวันที่และเวลา</translation>
-<translation id="245932805758469625">จำนวนวินาทีที่เหลือของวิดีโอ</translation>
-<translation id="248395913932153421">วัน</translation>
-<translation id="2507943997699731163">โปรดกรอกฟิลด์นี้</translation>
-<translation id="2508569020611168319">รายการแท็บ</translation>
-<translation id="2561842179657104141">แสดงส่วนควบคุมสื่อเพิ่มเติม</translation>
-<translation id="2572483411312390101">เล่น</translation>
-<translation id="2613802280814924224">โปรดป้อนค่าที่ถูกต้อง ค่าใกล้เคียงที่สุดที่ถูกต้องคือ <ph name="VALID_VALUE" /></translation>
-<translation id="2653659639078652383">ส่ง</translation>
-<translation id="2657045182931379222">ออบเจ็กต์กราฟิก</translation>
-<translation id="2674318244760992338">ส่วนท้าย</translation>
-<translation id="2709516037105925701">ป้อนอัตโนมัติ</translation>
-<translation id="2723001399770238859">เสียง</translation>
-<translation id="2746543609216772311">ค่าต้องเป็น <ph name="MINIMUM_DATE_OR_TIME" /> หรือหลังจากนั้น</translation>
-<translation id="2759744352195237655">ปุ่มป๊อปอัป</translation>
-<translation id="2761667185364618470">โปรดเลือกช่องนี้หากคุณต้องการดำเนินการต่อ</translation>
-<translation id="2844350028562914727">รายละเอียด</translation>
-<translation id="2896972712917208084">กลุ่มตัวเลือก</translation>
-<translation id="2908441821576996758">โปรดป้อนรายการที่อยู่อีเมลโดยคั่นด้วยเครื่องหมายจุลภาค</translation>
-<translation id="2940813599313844715">ออบเจ็กต์</translation>
-<translation id="2942448076852699108">เนื้อหาที่ไฮไลต์</translation>
-<translation id="3040011195152428237">ลิงก์</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">โปรดป้อนค่าที่ถูกต้อง ฟิลด์นี้ไม่สมบูรณ์หรือมีวันที่ที่ไม่ถูกต้อง</translation>
-<translation id="3078740164268491126">ตาราง</translation>
-<translation id="3086746722712840547">หมายเหตุ</translation>
-<translation id="310520048233152454">โปรดป้อน URL</translation>
-<translation id="3175736971608411871">ตัวจับเวลา</translation>
-<translation id="3199563858620722075">ช่องตัวเลือกรวม</translation>
-<translation id="3450233048674729344">ค่าต้องน้อยกว่าหรือเท่ากับ <ph name="MAXIMUM" /></translation>
-<translation id="3486220673238053218">คำจำกัดความ</translation>
-<translation id="3557673793733683882">ส่วนหัว <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">เครื่องมือเลือกสัปดาห์</translation>
-<translation id="3685101356851116974">รูปภาพที่ไม่มีป้ายกำกับ</translation>
-<translation id="3706100364254443312">สวิตช์</translation>
-<translation id="3732799496749320381">ดด</translation>
-<translation id="3754210790023674521">ออกจากการแสดงภาพซ้อนภาพ</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">คีย์เวิร์ด</translation>
-<translation id="3822383571486410024">โปรดกรอกข้อความนี้ให้มีอักขระอย่างน้อย <ph name="MIN_CHARACTERS" /> ตัว (ตอนนี้คุณมี <ph name="CURRENT_LENGTH" /> ตัว)</translation>
-<translation id="383465348367842624">ส่วนที่ตามด้วย "<ph name="ATSIGN" />" ต้องไม่มีสัญลักษณ์ "<ph name="INVALIDCHARACTER" />"</translation>
-<translation id="3846214748874656680">ออกจากการแสดงเต็มหน้าจอ</translation>
-<translation id="3920932319529768807">บทสรุป</translation>
-<translation id="3924558731517983934">แอปพลิเคชัน</translation>
-<translation id="3944740393230681990">อารัมภบท</translation>
-<translation id="3960700977367013758">แถบเลื่อน</translation>
-<translation id="4103419683916926126">มิลลิวินาที</translation>
-<translation id="4151657705144244502">กราฟิก</translation>
-<translation id="4160057747563657758">โทรศัพท์</translation>
-<translation id="4193965531860883258">คำนำ</translation>
-<translation id="4201051445878709314">แสดงเดือนที่ผ่านมา</translation>
-<translation id="421884353938374759">ตัวเลือกสี</translation>
-<translation id="4248100235867064564">แถบเมนู</translation>
-<translation id="4360991593054037559">โปรดป้อนค่าที่ถูกต้อง ค่าใกล้เคียงที่สุดที่ถูกต้องสองรายการคือ <ph name="VALID_VALUE_LOW" /> และ <ph name="VALID_VALUE_HIGHER" /></translation>
-<translation id="4384583879834880242">ถามและตอบ</translation>
-<translation id="4413860115965805769">ปุ่มเมนู</translation>
-<translation id="4444765639179266822">ดูเหมือนจะพูดว่า <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">ข้อมูลอ้างอิงอภิธานศัพท์</translation>
-<translation id="4522570452068850558">รายละเอียด</translation>
-<translation id="4542388879936266156">เวลาที่เหลือ: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">ฟอร์ม</translation>
-<translation id="4661075872484491155">แผนผัง</translation>
-<translation id="4664250907885839816">ส่วนที่ต่อท้าย "<ph name="ATSIGN" />" ต้องไม่มีสัญลักษณ์ "<ph name="INVALIDCHARACTER" />"</translation>
-<translation id="4668956016107839909">ภาคผนวก</translation>
-<translation id="4718048029184481307">กำลังเล่นแบบการแสดงภาพซ้อนภาพ</translation>
-<translation id="4742539557769756338">หน้าปก</translation>
-<translation id="4748357248530471599">สลับเป็นแบบเต็มหน้าจอสำหรับหน้าจอรอยบาก</translation>
-<translation id="4757246831282535685">แผงแท็บ</translation>
-<translation id="4763480195061959176">วิดีโอ</translation>
-<translation id="479989351350248267">ค้นหา</translation>
-<translation id="4812940957355064477">โปรดป้อนตัวเลข</translation>
-<translation id="4912536737030637138">รายการบรรณานุกรม</translation>
-<translation id="4975562563186953947">เลือกไว้ <ph name="SELECTED_COUNT" /> รายการ</translation>
-<translation id="4992066212339426712">เปิดเสียง</translation>
-<translation id="49969490063480558">โปรดป้อนส่วนที่ต่อท้าย "<ph name="ATSIGN" />" "<ph name="INVALIDADDRESS" />" นั้นไม่สมบูรณ์</translation>
-<translation id="5034860022980953847">ตัวบอกสถานะความคืบหน้า</translation>
-<translation id="5090250355906949916">ตัวควบคุมเวลาของวิดีโอ</translation>
-<translation id="5093189678851173835">คำจารึก</translation>
-<translation id="5117590920725113268">แสดงเดือนถัดไป</translation>
-<translation id="512758898067543763">ส่วนหัวของแถว</translation>
-<translation id="5143125788380636750">ปัจฉิมบท</translation>
-<translation id="5164977714490026579">ค่าต้องมากกว่าหรือเท่ากับ <ph name="MINIMUM" /></translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">โปรดป้อนส่วนหนึ่งโดยตามด้วย "<ph name="ATSIGN" />" "<ph name="INVALIDADDRESS" />" นั้นไม่สมบูรณ์</translation>
-<translation id="5334352251556557839">เล่นสื่อไม่ได้</translation>
-<translation id="5406322316791861025">ตัวเลข</translation>
-<translation id="5453733299334684579">รายการแบบต้นไม้</translation>
-<translation id="5466621249238537318">โปรดเลือกอย่างน้อยหนึ่งไฟล์</translation>
-<translation id="5468998798572797635">ออกจากการแสดงแบบเต็มหน้าจอ</translation>
-<translation id="5516424706154626233">เครื่องมือเลือกวันที่</translation>
-<translation id="5537725057119320332">ส่ง</translation>
-<translation id="5546461542133609677">เปิดเสียง</translation>
-<translation id="561939826962581046">เวลา</translation>
-<translation id="5630795885300617244">แตะ 2 ครั้งที่ด้านขวาหรือซ้ายเพื่อข้ามทีละ 10 วินาที</translation>
-<translation id="5631759159893697722">บทคัดย่อ</translation>
-<translation id="5643186887447432888">ปุ่ม</translation>
-<translation id="5677946354068040947">ตัวเลือกเพิ่มเติม</translation>
-<translation id="576709008726043716">บทนำ</translation>
-<translation id="57838592816432529">ปิดเสียง</translation>
-<translation id="5860033963881614850">ปิด</translation>
-<translation id="588258955323874662">เต็มหน้าจอ</translation>
-<translation id="5888666972993069672">ขณะนี้กำลังแคสต์ไปที่ <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">ช่องค้นหา</translation>
-<translation id="5939518447894949180">รีเซ็ต</translation>
-<translation id="5966707198760109579">สัปดาห์</translation>
-<translation id="5987525920412732405">ปุ่มหมุน</translation>
-<translation id="6011459053400940133">แถบเลื่อนปรับระดับเสียง</translation>
-<translation id="6015796118275082299">ปี</translation>
-<translation id="6023896073578205740">ช่องรายการ</translation>
-<translation id="6150588977291308318">บรรณานุกรม</translation>
-<translation id="6164829606128959761">เมตร</translation>
-<translation id="6166809985690652833">คำแถลงท้ายเล่ม</translation>
-<translation id="6209276755895393898">ดูเหมือนเป็น<ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">อภิธานศัพท์</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">ออกจากการแสดงภาพซ้อนภาพ</translation>
-<translation id="6398862346408813489">แสดงแผงการเลือกเดือน</translation>
-<translation id="6404546809543547843">ตัวควบคุมเวลาของเสียง</translation>
-<translation id="6443871981718447451">แสดงเมนูคำอธิบายภาพ</translation>
-<translation id="6453774872122745852">กิตติกรรมประกาศ</translation>
-<translation id="648732519525291180">เครื่องมือเลือกเวลา</translation>
-<translation id="6550675742724504774">ตัวเลือก</translation>
-<translation id="6572309429103589720">ไวยากรณ์ไม่ถูกต้อง</translation>
-<translation id="658823671542763450">เข้าสู่โหมดเต็มหน้าจอ</translation>
-<translation id="663493177488814956">ฟีด</translation>
-<translation id="6637586476836377253">บันทึก</translation>
-<translation id="6643016212128521049">ล้าง</translation>
-<translation id="668171684555832681">อื่นๆ...</translation>
-<translation id="6692633176391053278">ตัวเพิ่ม/ลดระดับเสียง</translation>
-<translation id="6709570249143506788">คุณภาพการเล่นต่ำ</translation>
-<translation id="6755330956360078551">เคล็ดลับเครื่องมือ</translation>
-<translation id="6790428901817661496">เล่น</translation>
-<translation id="6820355525329141109">ไม่สามารถโหลดปลั๊กอิน</translation>
-<translation id="6820615603175220800">ข้อมูลอ้างอิงทางบรรณานุกรม</translation>
-<translation id="6843725295806269523">ปิดเสียง</translation>
-<translation id="6885760532393684712">ไดเรกทอรี</translation>
-<translation id="689129560213475294">ข้อมูลทางบรรณานุกรม</translation>
-<translation id="6934078000481955284">ข้อความที่ยกมา</translation>
-<translation id="6941933287844615239">ดาวน์โหลดสื่อ</translation>
-<translation id="6981594929165378967">การแทรก</translation>
-<translation id="6989848892321993519">โปรดกรอกข้อความนี้ให้มีอักขระอย่างน้อย <ph name="MIN_CHARACTERS" /> ตัว (ตอนนี้คุณมี 1 ตัว)</translation>
-<translation id="7033340931668032222">ขึ้นและลงเพื่อเปลี่ยนระดับเสียง</translation>
-<translation id="709897737746224366">โปรดจับคู่รูปแบบที่ร้องขอ</translation>
-<translation id="7118469954320184356">ไม่มีคำอธิบาย</translation>
-<translation id="7139483182332611405">ส่วนนำ</translation>
-<translation id="7214187073215825913">ข้อมูลเกี่ยวกับเนื้อหา</translation>
-<translation id="7263440858009898357">โปรดเลือกรายการจากหน้ารายการ</translation>
-<translation id="727747134524199931">ส่วนหัวคอลัมน์</translation>
-<translation id="7320576522385648310">กำลังบัฟเฟอร์</translation>
-<translation id="7353453495576941748">เครดิต</translation>
-<translation id="7364796246159120393">เลือกไฟล์</translation>
-<translation id="739024184232394898">อื่นๆ...</translation>
-<translation id="7405738980073107433">อ้างอิงท้ายเรื่อง</translation>
-<translation id="7410239719251593705">ดูเหมือนจะมีเนื้อหาสำหรับผู้ใหญ่ ไม่มีคำอธิบาย</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">แท็บ</translation>
-<translation id="7514365320538308">ดาวน์โหลด</translation>
-<translation id="7529102961911894712">ลิงก์กลับมาที่หน้า</translation>
-<translation id="7533959249147584474">กราฟิกที่ไม่มีป้ายกำกับ</translation>
-<translation id="7647456547678091388">เคล็ดลับ</translation>
-<translation id="7661956066982048809">เอกสารกราฟิก</translation>
-<translation id="7673697353781729403">ชั่วโมง</translation>
-<translation id="7681220483256441252">ดัชนี</translation>
-<translation id="7740050170769002709">เนื้อหา HTML</translation>
-<translation id="7745230546936012372">เปิดเมนูตามบริบทเพื่อดูคำอธิบายรูปภาพที่หายไป</translation>
-<translation id="7750228210027921155">การแสดงภาพซ้อนภาพ</translation>
-<translation id="775297008183122718">ป้อนข้อมูลไม่ถูกต้อง</translation>
-<translation id="7789962463072032349">หยุดชั่วคราว</translation>
-<translation id="7802800022689234070">สามเหลี่ยมซ่อนเนื้อหา</translation>
-<translation id="7888071071722539607">โปรดใส่ "<ph name="ATSIGN" />" ในที่อยู่อีเมล "<ph name="INVALIDADDRESS" />" ขาด "<ph name="ATSIGN" />"</translation>
-<translation id="7891486169920085145">ตัวแยก</translation>
-<translation id="795667975304826397">ไม่ได้เลือกไฟล์ใด</translation>
-<translation id="8053789581856978548">ช่องข้อความค้นหา</translation>
-<translation id="8057695513531652401">ประกาศ</translation>
-<translation id="8105797009065549151">ข้อมูลอ้างอิงหมายเหตุ</translation>
-<translation id="811583516810654505">กำลังโหลดคำอธิบาย...</translation>
-<translation id="8117451130807776954">สัปดาห์นี้</translation>
-<translation id="8199524924445686405">ปปปป</translation>
-<translation id="8208673686607688524">เครื่องมือเลือกวันที่และเวลาในท้องถิ่น</translation>
-<translation id="8261464734335370856">มีการสะกดผิด</translation>
-<translation id="8284326494547611709">คำบรรยาย</translation>
-<translation id="835897206747267392">ค่าไม่ถูกต้อง</translation>
-<translation id="8403857369060869934">เวลาที่ผ่านไป: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">ภาค</translation>
-<translation id="8433900881053900389">แถบเครื่องมือ</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> ไฟล์</translation>
-<translation id="8451268428117625855">โปรดเลือกไฟล์</translation>
-<translation id="8461852803063341183">ปุ่มตัวเลือก</translation>
-<translation id="8474886197722836894">คำอุทิศ</translation>
-<translation id="8531739829932800271">ข้อผิดพลาด</translation>
-<translation id="8534579021159131403">นาที</translation>
-<translation id="8541249477527128034">การควบคุมสื่อ</translation>
-<translation id="8550857728288566671">สัญลักษณ์กราฟิก</translation>
-<translation id="8583702881314752957">รายการคำจำกัดความ</translation>
-<translation id="8597182159515967513">ส่วนหัว</translation>
-<translation id="8603553056539299761">ซ้ายและขวาเพื่อกรอ</translation>
-<translation id="860475260694818407">สารบัญ</translation>
-<translation id="8613126697340063924">ควบคุมการเล่นระยะไกล</translation>
-<translation id="862370744433916922">คำบรรยาย</translation>
-<translation id="8711688047404765493">เอาต์พุต</translation>
-<translation id="8750798805984357768">โปรดเลือกตัวเลือกอย่างหนึ่งอย่างใดเหล่านี้</translation>
-<translation id="8808573423886751634">บท</translation>
-<translation id="8845239796550121995">ตอนนี้กำลังแคสต์ไปยัง TV</translation>
-<translation id="8851136666856101339">หลัก</translation>
-<translation id="8875657656876809964">ข้อผิดพลาดในการเล่นวิดีโอ</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">เดือน</translation>
-<translation id="901493112792887934">เวลาปัจจุบันเป็นวินาที</translation>
-<translation id="901834265349196618">อีเมล</translation>
-<translation id="9048119486235211610">การนำทาง</translation>
-<translation id="9062295712474918030">เอกสาร</translation>
-<translation id="9062307380734144336">เลือกเพื่อสลับระหว่างเล่นและหยุดชั่วคราว</translation>
-<translation id="9093215626363556771">ออกจากการแสดงภาพซ้อนภาพ</translation>
-<translation id="9108370397979208512">คณิตศาสตร์</translation>
-<translation id="9132465097189459683">อื่นๆ...</translation>
-<translation id="9138385573473225930">การแจ้งเตือน</translation>
-<translation id="9155987714137265666"><ph name="WEEK" /> เริ่มวันที่ <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">การแสดงภาพซ้อนภาพ</translation>
-<translation id="9168329111483466115">เชิงอรรถ</translation>
-<translation id="954003015749068518">เข้าสู่การแสดงภาพซ้อนภาพ</translation>
-<translation id="966787709310836684">เมนู</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_tr.xtb b/chromium/content/app/strings/translations/content_strings_tr.xtb
deleted file mode 100644
index b1ae21818ce..00000000000
--- a/chromium/content/app/strings/translations/content_strings_tr.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="tr">
-<translation id="1018939186200882850">menü öğesi</translation>
-<translation id="10623998915015855">geçiş düğmesi</translation>
-<translation id="1088086359088493902">Saniye</translation>
-<translation id="1171774979989969504">Lütfen e-posta adresi girin.</translation>
-<translation id="1178581264944972037">Duraklat</translation>
-<translation id="1188858454923323853">tamamlayıcı</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">kaydırma çubuğu</translation>
-<translation id="1211441953136645838">son not</translation>
-<translation id="1281252709823657822">iletişim kutusu</translation>
-<translation id="1335095011850992622">katkıda bulunanlar</translation>
-<translation id="1342835525016946179">article</translation>
-<translation id="1359897965706325498">banner</translation>
-<translation id="1589122976691792535">bölge</translation>
-<translation id="1591562245178063882">Bu ay</translation>
-<translation id="1637811476055996098">Dosyaları Seç</translation>
-<translation id="1650423536718072820">alıntı</translation>
-<translation id="1727886345390570319">altyazı menüsünü gizle</translation>
-<translation id="1729654308190250600">Lütfen e-posta adresini boş bırakmayın.</translation>
-<translation id="1758486001363313524">Diğer...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">ağaç tablo</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">uzaktan cihazda oynat</translation>
-<translation id="190587075670221089">silme</translation>
-<translation id="1907737156431278478">örnek</translation>
-<translation id="1921819250265091946">gg</translation>
-<translation id="1930711995431081526">durum</translation>
-<translation id="1938124657309484470">Değer <ph name="MAXIMUM_DATE_OR_TIME" /> veya daha geri olmalıdır.</translation>
-<translation id="1946271899482435442">Tarih seçiciyi göster</translation>
-<translation id="1993104285338243655">Yansıtmaya geçildi</translation>
-<translation id="2060505056492490888">"<ph name="DOT" />", "<ph name="INVALIDDOMAIN" />" adı içinde yanlış bir konumda kullanılmış.</translation>
-<translation id="2148716181193084225">Bugün</translation>
-<translation id="2158401438286456825">sayfa listesi</translation>
-<translation id="2226276347425096477">Lütfen bu metni <ph name="MAX_CHARACTERS" /> veya daha az karakter olacak şekilde kısaltın (şu anda <ph name="CURRENT_LENGTH" /> karakter kullanıyorsunuz).</translation>
-<translation id="2246498165605549352">Yerel Dosya</translation>
-<translation id="2247351761944213033"><ph name="WEEKNUMBER" />. hafta, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904"><ph name="NUMBER" />. parça</translation>
-<translation id="2291999235780842123">onay kutusu</translation>
-<translation id="2311842470354187719">sayfa sonu</translation>
-<translation id="2335594187091864976">tarih ve saat seçici</translation>
-<translation id="245932805758469625">saniye olarak videonun kalan süresi</translation>
-<translation id="248395913932153421">Gün</translation>
-<translation id="2507943997699731163">Lütfen bu alanı doldurun.</translation>
-<translation id="2508569020611168319">sekme listesi</translation>
-<translation id="2561842179657104141">diğer medya kontrollerini göster</translation>
-<translation id="2572483411312390101">oynat</translation>
-<translation id="2613802280814924224">Lütfen geçerli bir değer girin. En yakın geçerli değer şudur: <ph name="VALID_VALUE" /></translation>
-<translation id="2653659639078652383">Gönder</translation>
-<translation id="2657045182931379222">grafik nesnesi</translation>
-<translation id="2674318244760992338">altbilgi</translation>
-<translation id="2709516037105925701">Otomatik doldurma</translation>
-<translation id="2723001399770238859">ses</translation>
-<translation id="2746543609216772311">Değer <ph name="MINIMUM_DATE_OR_TIME" /> veya daha ileri olmalıdır.</translation>
-<translation id="2759744352195237655">pop-up düğmesi</translation>
-<translation id="2761667185364618470">İlerlemek istiyorsanız lütfen bu kutuyu işaretleyin.</translation>
-<translation id="2844350028562914727">ayrıntılar</translation>
-<translation id="2896972712917208084">radyo düğmesi grubu</translation>
-<translation id="2908441821576996758">Lütfen e-posta adreslerinin virgülle ayrılmış listesini girin.</translation>
-<translation id="2940813599313844715">nesne</translation>
-<translation id="2942448076852699108">vurgulanan içerik</translation>
-<translation id="3040011195152428237">bağlantı</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Lütfen geçerli bir tarih girin. Alan tam doldurulmamış veya geçersiz bir tarih var.</translation>
-<translation id="3078740164268491126">tablo</translation>
-<translation id="3086746722712840547">note</translation>
-<translation id="310520048233152454">Lütfen bir URL girin.</translation>
-<translation id="3175736971608411871">zamanlayıcı</translation>
-<translation id="3199563858620722075">birleşik kutu</translation>
-<translation id="3450233048674729344">Değer <ph name="MAXIMUM" /> veya daha küçük olmalıdır.</translation>
-<translation id="3486220673238053218">tanım</translation>
-<translation id="3557673793733683882">başlık <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">hafta seçici</translation>
-<translation id="3685101356851116974">Etiketsiz resim</translation>
-<translation id="3706100364254443312">anahtar</translation>
-<translation id="3732799496749320381">aa</translation>
-<translation id="3754210790023674521">Pencere içinde pencere modundan çık</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">terim</translation>
-<translation id="3822383571486410024">Lütfen bu metni <ph name="MIN_CHARACTERS" /> karakter veya daha fazla olacak şekilde uzatın (şu anda <ph name="CURRENT_LENGTH" /> karakter kullanıyorsunuz).</translation>
-<translation id="383465348367842624">Başında "<ph name="ATSIGN" />" bulunan kısımda "<ph name="INVALIDCHARACTER" />" simgesi bulunmamalıdır.</translation>
-<translation id="3846214748874656680">Tam ekran modundan çık</translation>
-<translation id="3920932319529768807">sonuç</translation>
-<translation id="3924558731517983934">uygulama</translation>
-<translation id="3944740393230681990">prolog</translation>
-<translation id="3960700977367013758">kaydırma çubuğu</translation>
-<translation id="4103419683916926126">Milisaniye</translation>
-<translation id="4151657705144244502">grafik</translation>
-<translation id="4160057747563657758">telefon</translation>
-<translation id="4193965531860883258">önsöz</translation>
-<translation id="4201051445878709314">Önceki ayı göster</translation>
-<translation id="421884353938374759">renk seçici</translation>
-<translation id="4248100235867064564">menü çubuğu</translation>
-<translation id="4360991593054037559">Lütfen geçerli bir değer girin. En yakın iki geçerli değer şunlardır: <ph name="VALID_VALUE_LOW" /> ve <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Soru-Cevap</translation>
-<translation id="4413860115965805769">menü düğmesi</translation>
-<translation id="4444765639179266822">Şöyle diyor olabilir: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">terimler sözlüğü referansı</translation>
-<translation id="4522570452068850558">Ayrıntılar</translation>
-<translation id="4542388879936266156">kalan süre: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">form</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">Başında "<ph name="ATSIGN" />" bulunan kısımda "<ph name="INVALIDCHARACTER" />" simgesi bulunmamalıdır.</translation>
-<translation id="4668956016107839909">ek</translation>
-<translation id="4718048029184481307">Pencere içinde pencere modunda oynatılıyor</translation>
-<translation id="4742539557769756338">kapak</translation>
-<translation id="4748357248530471599">ekran kesimi alanını tam ekran olarak değiştirin</translation>
-<translation id="4757246831282535685">sekme paneli</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">ara</translation>
-<translation id="4812940957355064477">Lütfen bir sayı girin.</translation>
-<translation id="4912536737030637138">kaynakça girişi</translation>
-<translation id="4975562563186953947"><ph name="SELECTED_COUNT" /> öğe seçildi</translation>
-<translation id="4992066212339426712">Sesi aç</translation>
-<translation id="49969490063480558">Lütfen "<ph name="ATSIGN" />" işaretinden sonra gelen kısmı ekleyin. "<ph name="INVALIDADDRESS" />", tam bir adres değil.</translation>
-<translation id="5034860022980953847">ilerleme durumu göstergesi</translation>
-<translation id="5090250355906949916">video süresi göstergesi</translation>
-<translation id="5093189678851173835">yazıt</translation>
-<translation id="5117590920725113268">Sonraki ayı göster</translation>
-<translation id="512758898067543763">satır başlığı</translation>
-<translation id="5143125788380636750">son söz</translation>
-<translation id="5164977714490026579">Değer <ph name="MINIMUM" /> veya daha büyük olmalıdır.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Lütfen başına "<ph name="ATSIGN" />" ekleyin. "<ph name="INVALIDADDRESS" />" adresi eksik.</translation>
-<translation id="5334352251556557839">Medya oynatılamıyor.</translation>
-<translation id="5406322316791861025">figür</translation>
-<translation id="5453733299334684579">ağaç öğesi</translation>
-<translation id="5466621249238537318">Lütfen bir veya daha fazla dosya seçin.</translation>
-<translation id="5468998798572797635">tam ekrandan çık</translation>
-<translation id="5516424706154626233">tarih seçici</translation>
-<translation id="5537725057119320332">Yayınla</translation>
-<translation id="5546461542133609677">sesi aç</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">10 sn. atlamak için sola veya sağa iki kez dokunun</translation>
-<translation id="5631759159893697722">özet</translation>
-<translation id="5643186887447432888">düğme</translation>
-<translation id="5677946354068040947">diğer seçenekler</translation>
-<translation id="576709008726043716">giriş</translation>
-<translation id="57838592816432529">Sesi kapat</translation>
-<translation id="5860033963881614850">Kapalı</translation>
-<translation id="588258955323874662">Tam ekran</translation>
-<translation id="5888666972993069672">Şimdi <ph name="DEVICE_FRIENDLY_NAME" /> adlı cihaza yayınlanıyor</translation>
-<translation id="591047860372322273">arama kutusu</translation>
-<translation id="5939518447894949180">Sıfırla</translation>
-<translation id="5966707198760109579">Hafta</translation>
-<translation id="5987525920412732405">dönme düğmesi</translation>
-<translation id="6011459053400940133">ses kaydırma çubuğu</translation>
-<translation id="6015796118275082299">Yıl</translation>
-<translation id="6023896073578205740">liste kutusu</translation>
-<translation id="6150588977291308318">kaynakça</translation>
-<translation id="6164829606128959761">ölçüm aracı</translation>
-<translation id="6166809985690652833">sonsöz</translation>
-<translation id="6209276755895393898">Resimdeki şu olabilir: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">terimler sözlüğü</translation>
-<translation id="6281763101136022427">URL</translation>
-<translation id="6310801910862476708">Pencere İçinde Pencereden Çık</translation>
-<translation id="6398862346408813489">Ay seçim panelini göster</translation>
-<translation id="6404546809543547843">ses zaman çizelgesi temizleyici</translation>
-<translation id="6443871981718447451">altyazı menüsünü göster</translation>
-<translation id="6453774872122745852">teşekkür</translation>
-<translation id="648732519525291180">zaman seçici</translation>
-<translation id="6550675742724504774">Seçenekler</translation>
-<translation id="6572309429103589720">Geçersiz dil bilgisi</translation>
-<translation id="658823671542763450">tam ekrana geç</translation>
-<translation id="663493177488814956">kartlar</translation>
-<translation id="6637586476836377253">log</translation>
-<translation id="6643016212128521049">Temizle</translation>
-<translation id="668171684555832681">Diğer...</translation>
-<translation id="6692633176391053278">stepper (adımlayıcı)</translation>
-<translation id="6709570249143506788">Oynatma kalitesi kötü</translation>
-<translation id="6755330956360078551">ipucu</translation>
-<translation id="6790428901817661496">Oynat</translation>
-<translation id="6820355525329141109">Eklenti yüklenemedi.</translation>
-<translation id="6820615603175220800">kaynakça referansı</translation>
-<translation id="6843725295806269523">sesi kapat</translation>
-<translation id="6885760532393684712">dizin</translation>
-<translation id="689129560213475294">künye</translation>
-<translation id="6934078000481955284">blok alıntı</translation>
-<translation id="6941933287844615239">medyayı indir</translation>
-<translation id="6981594929165378967">ekleme</translation>
-<translation id="6989848892321993519">Lütfen bu metni <ph name="MIN_CHARACTERS" /> karakter veya daha fazla olacak şekilde uzatın (şu anda 1 karakter kullanıyorsunuz).</translation>
-<translation id="7033340931668032222">sesi değiştirmek için yukarı ve aşağı</translation>
-<translation id="709897737746224366">Lütfen istenen biçimi eşleştirin.</translation>
-<translation id="7118469954320184356">Açıklama yok.</translation>
-<translation id="7139483182332611405">önsöz</translation>
-<translation id="7214187073215825913">içerik bilgisi</translation>
-<translation id="7263440858009898357">Lütfen listeden bir öğe seçin.</translation>
-<translation id="727747134524199931">sütun başlığı</translation>
-<translation id="7320576522385648310">arabelleğe alınıyor</translation>
-<translation id="7353453495576941748">katkıda bulunan</translation>
-<translation id="7364796246159120393">Dosya Seç</translation>
-<translation id="739024184232394898">Diğer...</translation>
-<translation id="7405738980073107433">son notlar</translation>
-<translation id="7410239719251593705">Yetişkinlere uygun içerik barındırdığı anlaşılıyor. Açıklama yok.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">İndir</translation>
-<translation id="7529102961911894712">geri bağlantı</translation>
-<translation id="7533959249147584474">Etiketlenmemiş grafik</translation>
-<translation id="7647456547678091388">ipucu</translation>
-<translation id="7661956066982048809">grafik dokümanı</translation>
-<translation id="7673697353781729403">Saat</translation>
-<translation id="7681220483256441252">dizin</translation>
-<translation id="7740050170769002709">HTML içeriği</translation>
-<translation id="7745230546936012372">Eksik resim açıklamalarını almak için içerik menüsünü açın.</translation>
-<translation id="7750228210027921155">Pencere içinde pencere</translation>
-<translation id="775297008183122718">Geçersiz giriş</translation>
-<translation id="7789962463072032349">duraklat</translation>
-<translation id="7802800022689234070">açıklama üçgeni</translation>
-<translation id="7888071071722539607">Lütfen e-posta adresine bir "<ph name="ATSIGN" />" işareti ekleyin. "<ph name="INVALIDADDRESS" />" adresinde "<ph name="ATSIGN" />" eksik.</translation>
-<translation id="7891486169920085145">ayırıcı</translation>
-<translation id="795667975304826397">Dosya seçilmedi</translation>
-<translation id="8053789581856978548">arama metni alanı</translation>
-<translation id="8057695513531652401">bildirim</translation>
-<translation id="8105797009065549151">not referansı</translation>
-<translation id="811583516810654505">Açıklama alınıyor...</translation>
-<translation id="8117451130807776954">Bu hafta</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">yerel tarih ve zaman seçici</translation>
-<translation id="8261464734335370856">Geçersiz yazım</translation>
-<translation id="8284326494547611709">Altyazılar</translation>
-<translation id="835897206747267392">Geçersiz değer.</translation>
-<translation id="8403857369060869934">geçen süre: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">bölüm</translation>
-<translation id="8433900881053900389">araç çubuğu</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> dosya</translation>
-<translation id="8451268428117625855">Lütfen bir dosya seçin.</translation>
-<translation id="8461852803063341183">radyo düğmesi</translation>
-<translation id="8474886197722836894">ithaf</translation>
-<translation id="8531739829932800271">yazım hataları</translation>
-<translation id="8534579021159131403">Dakika</translation>
-<translation id="8541249477527128034">medya kontrolü</translation>
-<translation id="8550857728288566671">grafik sembolü</translation>
-<translation id="8583702881314752957">tanım listesi</translation>
-<translation id="8597182159515967513">başlık</translation>
-<translation id="8603553056539299761">belirli bir yere gitmek için sol ve sağ</translation>
-<translation id="860475260694818407">içindekiler</translation>
-<translation id="8613126697340063924">uzaktan oynatmayı kontrol et</translation>
-<translation id="862370744433916922">alt başlık</translation>
-<translation id="8711688047404765493">çıkış</translation>
-<translation id="8750798805984357768">Lütfen bu seçeneklerden birini belirleyin.</translation>
-<translation id="8808573423886751634">bölüm</translation>
-<translation id="8845239796550121995">Şimdi TV'nize yayınlanıyor</translation>
-<translation id="8851136666856101339">main</translation>
-<translation id="8875657656876809964">Video oynatma hatası</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Ay</translation>
-<translation id="901493112792887934">saniye olarak geçerli süre</translation>
-<translation id="901834265349196618">e-posta</translation>
-<translation id="9048119486235211610">gezinme</translation>
-<translation id="9062295712474918030">doküman</translation>
-<translation id="9062307380734144336">Oynatmak/duraklatmak için seçin</translation>
-<translation id="9093215626363556771">pencere içinde pencere modundan çıkın</translation>
-<translation id="9108370397979208512">math</translation>
-<translation id="9132465097189459683">Diğer...</translation>
-<translation id="9138385573473225930">uyarı</translation>
-<translation id="9155987714137265666"><ph name="WEEK_START_DATE" /> tarihinde başlayan <ph name="WEEK" /></translation>
-<translation id="916607977885256133">Pencere içinde Pencere</translation>
-<translation id="9168329111483466115">dipnot</translation>
-<translation id="954003015749068518">pencere içinde pencere moduna gir</translation>
-<translation id="966787709310836684">menü</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_uk.xtb b/chromium/content/app/strings/translations/content_strings_uk.xtb
deleted file mode 100644
index b94f8cc1cc9..00000000000
--- a/chromium/content/app/strings/translations/content_strings_uk.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="uk">
-<translation id="1018939186200882850">пункт меню</translation>
-<translation id="10623998915015855">перемикач</translation>
-<translation id="1088086359088493902">Секунди</translation>
-<translation id="1171774979989969504">Введіть електронну адресу.</translation>
-<translation id="1178581264944972037">Пауза</translation>
-<translation id="1188858454923323853">додатково</translation>
-<translation id="1206619573307042055">область виділення</translation>
-<translation id="1206693055195146388">повзунок</translation>
-<translation id="1211441953136645838">кінцева виноска</translation>
-<translation id="1281252709823657822">діалогове вікно</translation>
-<translation id="1335095011850992622">подяки</translation>
-<translation id="1342835525016946179">стаття</translation>
-<translation id="1359897965706325498">банер</translation>
-<translation id="1589122976691792535">регіон</translation>
-<translation id="1591562245178063882">Цей місяць</translation>
-<translation id="1637811476055996098">Вибрати файли</translation>
-<translation id="1650423536718072820">цитата</translation>
-<translation id="1727886345390570319">сховати меню субтитрів</translation>
-<translation id="1729654308190250600">Введіть електронну адресу.</translation>
-<translation id="1758486001363313524">Інші...</translation>
-<translation id="1806710327868736751">вікно сповіщення</translation>
-<translation id="1821985195704844674">сітка дерева</translation>
-<translation id="1822429046913737220">д.п./п.п.</translation>
-<translation id="1832974991323546415">відтворити на віддаленому пристрої</translation>
-<translation id="190587075670221089">видалення</translation>
-<translation id="1907737156431278478">приклад</translation>
-<translation id="1921819250265091946">дд</translation>
-<translation id="1930711995431081526">статус</translation>
-<translation id="1938124657309484470">Має бути <ph name="MAXIMUM_DATE_OR_TIME" /> або раніша дата.</translation>
-<translation id="1946271899482435442">Показує засіб вибору дати</translation>
-<translation id="1993104285338243655">Змінено на дзеркалювання</translation>
-<translation id="2060505056492490888">Символ "<ph name="DOT" />" у "<ph name="INVALIDDOMAIN" />" використано неправильно.</translation>
-<translation id="2148716181193084225">Сьогодні</translation>
-<translation id="2158401438286456825">список сторінок</translation>
-<translation id="2226276347425096477">Скоротіть текст до такої кількості символів або менше: <ph name="MAX_CHARACTERS" /> (наразі використано символів: <ph name="CURRENT_LENGTH" />).</translation>
-<translation id="2246498165605549352">Локальний файл</translation>
-<translation id="2247351761944213033">Тиждень <ph name="WEEKNUMBER" />, <ph name="YEAR" /> р.</translation>
-<translation id="2277199496770840904">Композиція <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">прапорець</translation>
-<translation id="2311842470354187719">розрив сторінки</translation>
-<translation id="2335594187091864976">засіб вибору дати й часу</translation>
-<translation id="245932805758469625">кількість секунд до кінця відео</translation>
-<translation id="248395913932153421">День</translation>
-<translation id="2507943997699731163">Заповніть це поле.</translation>
-<translation id="2508569020611168319">cписок вкладок</translation>
-<translation id="2561842179657104141">показати більше елементів керування мультимедійним вмістом</translation>
-<translation id="2572483411312390101">відтворити</translation>
-<translation id="2613802280814924224">Введіть дійсне значення. Найближче дійсне значення: <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Надіслати</translation>
-<translation id="2657045182931379222">графічний об’єкт</translation>
-<translation id="2674318244760992338">нижній колонтитул</translation>
-<translation id="2709516037105925701">Автозаповнення</translation>
-<translation id="2723001399770238859">аудіо</translation>
-<translation id="2746543609216772311">Має бути <ph name="MINIMUM_DATE_OR_TIME" /> або пізніша дата.</translation>
-<translation id="2759744352195237655">кнопка спливаючої підказки</translation>
-<translation id="2761667185364618470">Поставте тут прапорець, якщо хочете продовжити.</translation>
-<translation id="2844350028562914727">деталі</translation>
-<translation id="2896972712917208084">група перемикачів</translation>
-<translation id="2908441821576996758">Введіть список електронних адрес, розділених комою.</translation>
-<translation id="2940813599313844715">об’єкт</translation>
-<translation id="2942448076852699108">виділений вміст</translation>
-<translation id="3040011195152428237">посилання</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> МБ</translation>
-<translation id="3075154866155599887">Введіть дійсне значення. Поле не заповнено або введено недійсну дату.</translation>
-<translation id="3078740164268491126">таблиця</translation>
-<translation id="3086746722712840547">примітка</translation>
-<translation id="310520048233152454">Введіть URL-адресу.</translation>
-<translation id="3175736971608411871">таймер</translation>
-<translation id="3199563858620722075">поле зі списком</translation>
-<translation id="3450233048674729344">Значення має бути меншим або дорівнювати <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">визначення</translation>
-<translation id="3557673793733683882">заголовок <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">засіб вибору тижня</translation>
-<translation id="3685101356851116974">Зображення без мітки</translation>
-<translation id="3706100364254443312">перемикач</translation>
-<translation id="3732799496749320381">мм</translation>
-<translation id="3754210790023674521">Вийти з режиму "Картинка в картинці"</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> ГБ</translation>
-<translation id="3808586225841795776">термін</translation>
-<translation id="3822383571486410024">У тексті має бути на менше <ph name="MIN_CHARACTERS" /> символів (ви ввели <ph name="CURRENT_LENGTH" /> символів).</translation>
-<translation id="383465348367842624">Частина перед знаком "<ph name="ATSIGN" />" не може містити символ "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="3846214748874656680">Вийти з повноекранного режиму</translation>
-<translation id="3920932319529768807">висновок</translation>
-<translation id="3924558731517983934">додаток</translation>
-<translation id="3944740393230681990">пролог</translation>
-<translation id="3960700977367013758">смуга прокрутки</translation>
-<translation id="4103419683916926126">Мілісекунди</translation>
-<translation id="4151657705144244502">зображення</translation>
-<translation id="4160057747563657758">номер телефону</translation>
-<translation id="4193965531860883258">передмова</translation>
-<translation id="4201051445878709314">Показати попередній місяць</translation>
-<translation id="421884353938374759">вибір кольору</translation>
-<translation id="4248100235867064564">панель меню</translation>
-<translation id="4360991593054037559">Введіть дійсне значення. Два найближчі дійсні значення: <ph name="VALID_VALUE_LOW" /> і <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Запитання</translation>
-<translation id="4413860115965805769">кнопка меню</translation>
-<translation id="4444765639179266822">Схоже, на зображенні написано "<ph name="OCR_TEXT" />"</translation>
-<translation id="4446524499724042288">посилання на глосарій</translation>
-<translation id="4522570452068850558">Деталі</translation>
-<translation id="4542388879936266156">залишилося часу: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">форма</translation>
-<translation id="4661075872484491155">дерево</translation>
-<translation id="4664250907885839816">Частина після знака "<ph name="ATSIGN" />" не може містити символ "<ph name="INVALIDCHARACTER" />".</translation>
-<translation id="4668956016107839909">додаток</translation>
-<translation id="4718048029184481307">Відтворюється в режимі "Картинка в картинці"</translation>
-<translation id="4742539557769756338">обкладинка</translation>
-<translation id="4748357248530471599">перемкнути виріз у повноекранному режимі</translation>
-<translation id="4757246831282535685">панель вкладок</translation>
-<translation id="4763480195061959176">відео</translation>
-<translation id="479989351350248267">пошук</translation>
-<translation id="4812940957355064477">Введіть число.</translation>
-<translation id="4912536737030637138">бібліографічний запис</translation>
-<translation id="4975562563186953947">Вибрано <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Увімкнути звук</translation>
-<translation id="49969490063480558">Введіть частину електронної адреси після знака "<ph name="ATSIGN" />". Електронна адреса "<ph name="INVALIDADDRESS" />" неповна.</translation>
-<translation id="5034860022980953847">індикатор перебігу</translation>
-<translation id="5090250355906949916">повзунок часу відтворення відео</translation>
-<translation id="5093189678851173835">епіграф</translation>
-<translation id="5117590920725113268">Показати наступний місяць</translation>
-<translation id="512758898067543763">заголовок рядка</translation>
-<translation id="5143125788380636750">епілог</translation>
-<translation id="5164977714490026579">Значення має бути більшим або дорівнювати <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> Пб</translation>
-<translation id="5307600278924710095">Введіть частину електронної адреси до знака "<ph name="ATSIGN" />". Електронна адреса "<ph name="INVALIDADDRESS" />" неповна.</translation>
-<translation id="5334352251556557839">Не вдалося відтворити медіавміст.</translation>
-<translation id="5406322316791861025">фігура</translation>
-<translation id="5453733299334684579">елемент дерева</translation>
-<translation id="5466621249238537318">Виберіть один або декілька файлів.</translation>
-<translation id="5468998798572797635">вийти з повноекранного режиму</translation>
-<translation id="5516424706154626233">засіб вибору дати</translation>
-<translation id="5537725057119320332">Трансляція екрана</translation>
-<translation id="5546461542133609677">увімкнути звук</translation>
-<translation id="561939826962581046">час</translation>
-<translation id="5630795885300617244">Двічі торкніться ліворуч або праворуч, щоб пропустити 10 с</translation>
-<translation id="5631759159893697722">автореферат</translation>
-<translation id="5643186887447432888">кнопка</translation>
-<translation id="5677946354068040947">більше опцій</translation>
-<translation id="576709008726043716">вступ</translation>
-<translation id="57838592816432529">Вимкнути звук</translation>
-<translation id="5860033963881614850">Вимк.</translation>
-<translation id="588258955323874662">Повноекранний режим</translation>
-<translation id="5888666972993069672">Транслюється на пристрій <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">вікно пошуку</translation>
-<translation id="5939518447894949180">Скинути</translation>
-<translation id="5966707198760109579">Тиждень</translation>
-<translation id="5987525920412732405">лічильник</translation>
-<translation id="6011459053400940133">повзунок гучності</translation>
-<translation id="6015796118275082299">Рік</translation>
-<translation id="6023896073578205740">вікно списку</translation>
-<translation id="6150588977291308318">бібліографія</translation>
-<translation id="6164829606128959761">вимірювач</translation>
-<translation id="6166809985690652833">післямова</translation>
-<translation id="6209276755895393898">Схоже, на цьому зображенні <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">глосарій</translation>
-<translation id="6281763101136022427">URL-адреса</translation>
-<translation id="6310801910862476708">Вийти з режиму "Картинка в картинці"</translation>
-<translation id="6398862346408813489">Показати панель вибору місяців</translation>
-<translation id="6404546809543547843">повзунок часу відтворення аудіо</translation>
-<translation id="6443871981718447451">показати меню субтитрів</translation>
-<translation id="6453774872122745852">слова подяки</translation>
-<translation id="648732519525291180">засіб вибору часу</translation>
-<translation id="6550675742724504774">Параметри</translation>
-<translation id="6572309429103589720">Граматична помилка</translation>
-<translation id="658823671542763450">увійти в повноекранний режим</translation>
-<translation id="663493177488814956">стрічка</translation>
-<translation id="6637586476836377253">журнал</translation>
-<translation id="6643016212128521049">Очистити</translation>
-<translation id="668171684555832681">Інший...</translation>
-<translation id="6692633176391053278">повторювач stepper</translation>
-<translation id="6709570249143506788">Низька якість відтворення</translation>
-<translation id="6755330956360078551">підказка</translation>
-<translation id="6790428901817661496">Відтворити</translation>
-<translation id="6820355525329141109">Не вдалося завантажити плагін.</translation>
-<translation id="6820615603175220800">посилання на бібліографію</translation>
-<translation id="6843725295806269523">вимкнути звук</translation>
-<translation id="6885760532393684712">каталог</translation>
-<translation id="689129560213475294">емблема видавництва</translation>
-<translation id="6934078000481955284">цитата</translation>
-<translation id="6941933287844615239">завантажити медіафайл</translation>
-<translation id="6981594929165378967">вставлення</translation>
-<translation id="6989848892321993519">У тексті має бути не менше стількох символів: <ph name="MIN_CHARACTERS" />. Наразі ви ввели 1 символ.</translation>
-<translation id="7033340931668032222">угору та вниз, щоб змінити гучність</translation>
-<translation id="709897737746224366">Виберіть потрібний формат.</translation>
-<translation id="7118469954320184356">Немає опису.</translation>
-<translation id="7139483182332611405">передмова</translation>
-<translation id="7214187073215825913">інформація про контент</translation>
-<translation id="7263440858009898357">Виберіть елемент зі списку.</translation>
-<translation id="727747134524199931">заголовок стовпця</translation>
-<translation id="7320576522385648310">буферизація</translation>
-<translation id="7353453495576941748">подяка</translation>
-<translation id="7364796246159120393">Вибрати файл</translation>
-<translation id="739024184232394898">Інші...</translation>
-<translation id="7405738980073107433">кінцеві виноски</translation>
-<translation id="7410239719251593705">Схоже, це вміст для дорослих. Немає опису.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> ТБ</translation>
-<translation id="7491962110804786152">вкладка</translation>
-<translation id="7514365320538308">Завантажити</translation>
-<translation id="7529102961911894712">зворотне посилання</translation>
-<translation id="7533959249147584474">Графічний об’єкт без мітки</translation>
-<translation id="7647456547678091388">порада</translation>
-<translation id="7661956066982048809">графічний документ</translation>
-<translation id="7673697353781729403">Години</translation>
-<translation id="7681220483256441252">покажчик</translation>
-<translation id="7740050170769002709">Вміст HTML</translation>
-<translation id="7745230546936012372">Щоб відсутні описи зображення з’явилися, відкрийте контекстне меню.</translation>
-<translation id="7750228210027921155">Картинка в картинці</translation>
-<translation id="775297008183122718">Недійсне введене значення</translation>
-<translation id="7789962463072032349">призупинити</translation>
-<translation id="7802800022689234070">трикутник відкривання</translation>
-<translation id="7888071071722539607">Електронна адреса має містити знак "<ph name="ATSIGN" />". В електронній адресі "<ph name="INVALIDADDRESS" />" знака "<ph name="ATSIGN" />" немає.</translation>
-<translation id="7891486169920085145">розділювач</translation>
-<translation id="795667975304826397">Файл не вибрано</translation>
-<translation id="8053789581856978548">текстове поле пошуку</translation>
-<translation id="8057695513531652401">примітка</translation>
-<translation id="8105797009065549151">посилання на примітку</translation>
-<translation id="811583516810654505">Завантажується опис…</translation>
-<translation id="8117451130807776954">Цей тиждень</translation>
-<translation id="8199524924445686405">рррр</translation>
-<translation id="8208673686607688524">засіб вибору місцевих дати й часу</translation>
-<translation id="8261464734335370856">Орфографічна помилка</translation>
-<translation id="8284326494547611709">Субтитри</translation>
-<translation id="835897206747267392">Недійсне значення</translation>
-<translation id="8403857369060869934">минуло часу: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">частина</translation>
-<translation id="8433900881053900389">панель інструментів</translation>
-<translation id="8444882422881193423">файлів: <ph name="NUMBER_OF_FILES" /></translation>
-<translation id="8451268428117625855">Виберіть файл.</translation>
-<translation id="8461852803063341183">перемикач</translation>
-<translation id="8474886197722836894">присвята</translation>
-<translation id="8531739829932800271">перелік описок</translation>
-<translation id="8534579021159131403">Хвилини</translation>
-<translation id="8541249477527128034">елемент керування мультимедіа</translation>
-<translation id="8550857728288566671">графічний символ</translation>
-<translation id="8583702881314752957">список визначень</translation>
-<translation id="8597182159515967513">заголовок</translation>
-<translation id="8603553056539299761">уліво та вправо, щоб шукати</translation>
-<translation id="860475260694818407">зміст</translation>
-<translation id="8613126697340063924">керувати віддаленим відтворенням</translation>
-<translation id="862370744433916922">підзаголовок</translation>
-<translation id="8711688047404765493">вихід</translation>
-<translation id="8750798805984357768">Виберіть один із запропонованих варіантів.</translation>
-<translation id="8808573423886751634">розділ</translation>
-<translation id="8845239796550121995">Транслюється на телевізор</translation>
-<translation id="8851136666856101339">головний</translation>
-<translation id="8875657656876809964">Помилка відтворення відео</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> КБ</translation>
-<translation id="8987927404178983737">Місяць</translation>
-<translation id="901493112792887934">поточний час у секундах</translation>
-<translation id="901834265349196618">електронна адреса</translation>
-<translation id="9048119486235211610">навігація</translation>
-<translation id="9062295712474918030">документ</translation>
-<translation id="9062307380734144336">Виберіть, щоб перемикати між опціями "відтворити" та "призупинити"</translation>
-<translation id="9093215626363556771">вийти з режиму "Картинка в картинці"</translation>
-<translation id="9108370397979208512">математика</translation>
-<translation id="9132465097189459683">Інші...</translation>
-<translation id="9138385573473225930">сповіщення</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, починається <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Картинка в картинці</translation>
-<translation id="9168329111483466115">виноска</translation>
-<translation id="954003015749068518">увімкнути режим "Картинка в картинці"</translation>
-<translation id="966787709310836684">меню</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_vi.xtb b/chromium/content/app/strings/translations/content_strings_vi.xtb
deleted file mode 100644
index c280083e035..00000000000
--- a/chromium/content/app/strings/translations/content_strings_vi.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="vi">
-<translation id="1018939186200882850">mục menu</translation>
-<translation id="10623998915015855">nút chuyển đổi</translation>
-<translation id="1088086359088493902">Giây</translation>
-<translation id="1171774979989969504">Vui lòng nhập địa chỉ email.</translation>
-<translation id="1178581264944972037">Tạm dừng</translation>
-<translation id="1188858454923323853">bổ sung</translation>
-<translation id="1206619573307042055">bảng chữ chạy</translation>
-<translation id="1206693055195146388">thanh trượt</translation>
-<translation id="1211441953136645838">chú thích cuối</translation>
-<translation id="1281252709823657822">hộp thoại</translation>
-<translation id="1335095011850992622">ghi nhận tác giả</translation>
-<translation id="1342835525016946179">bài viết</translation>
-<translation id="1359897965706325498">biểu ngữ</translation>
-<translation id="1589122976691792535">khu vực</translation>
-<translation id="1591562245178063882">Tháng này</translation>
-<translation id="1637811476055996098">Chọn tệp</translation>
-<translation id="1650423536718072820">đoạn trích dẫn</translation>
-<translation id="1727886345390570319">ẩn menu phụ đề chi tiết</translation>
-<translation id="1729654308190250600">Vui lòng nhập địa chỉ email không trống.</translation>
-<translation id="1758486001363313524">Khác...</translation>
-<translation id="1806710327868736751">alert_dialog</translation>
-<translation id="1821985195704844674">lưới dạng cây</translation>
-<translation id="1822429046913737220">SA/CH</translation>
-<translation id="1832974991323546415">phát trên thiết bị từ xa</translation>
-<translation id="190587075670221089">xóa</translation>
-<translation id="1907737156431278478">ví dụ</translation>
-<translation id="1921819250265091946">dd</translation>
-<translation id="1930711995431081526">trạng thái</translation>
-<translation id="1938124657309484470">Giá trị phải là <ph name="MAXIMUM_DATE_OR_TIME" /> hoặc sớm hơn.</translation>
-<translation id="1946271899482435442">Hiển thị bộ chọn ngày</translation>
-<translation id="1993104285338243655">Đã chuyển sang chế độ phản chiếu</translation>
-<translation id="2060505056492490888">'<ph name="DOT" />' bị sử dụng sai vị trí trong '<ph name="INVALIDDOMAIN" />'.</translation>
-<translation id="2148716181193084225">Hôm nay</translation>
-<translation id="2158401438286456825">danh sách trang</translation>
-<translation id="2226276347425096477">Hãy cắt ngắn văn bản này thành <ph name="MAX_CHARACTERS" /> ký tự hoặc ít hơn (bạn hiện đang sử dụng <ph name="CURRENT_LENGTH" /> ký tự).</translation>
-<translation id="2246498165605549352">Tệp trên máy</translation>
-<translation id="2247351761944213033">Tuần <ph name="WEEKNUMBER" />, <ph name="YEAR" /></translation>
-<translation id="2277199496770840904">Bản nhạc <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">hộp kiểm</translation>
-<translation id="2311842470354187719">ngắt trang</translation>
-<translation id="2335594187091864976">bộ chọn ngày và giờ</translation>
-<translation id="245932805758469625">số giây còn lại của video</translation>
-<translation id="248395913932153421">Ngày</translation>
-<translation id="2507943997699731163">Vui lòng điền vào trường này.</translation>
-<translation id="2508569020611168319">danh sách tab</translation>
-<translation id="2561842179657104141">hiển thị các kiểm soát phương tiện khác</translation>
-<translation id="2572483411312390101">phát</translation>
-<translation id="2613802280814924224">Vui lòng nhập giá trị hợp lệ. Giá trị hợp lệ gần nhất là <ph name="VALID_VALUE" />.</translation>
-<translation id="2653659639078652383">Gửi</translation>
-<translation id="2657045182931379222">đối tượng đồ họa</translation>
-<translation id="2674318244760992338">chân trang</translation>
-<translation id="2709516037105925701">Tự động điền</translation>
-<translation id="2723001399770238859">âm thanh</translation>
-<translation id="2746543609216772311">Giá trị phải là <ph name="MINIMUM_DATE_OR_TIME" /> hoặc muộn hơn.</translation>
-<translation id="2759744352195237655">nút cửa sổ bật lên</translation>
-<translation id="2761667185364618470">Vui lòng chọn hộp kiểm này nếu bạn muốn tiếp tục.</translation>
-<translation id="2844350028562914727">chi tiết</translation>
-<translation id="2896972712917208084">nhóm radio</translation>
-<translation id="2908441821576996758">Vui lòng nhập danh sách địa chỉ email được phân cách bằng dấu phẩy.</translation>
-<translation id="2940813599313844715">đối tượng</translation>
-<translation id="2942448076852699108">nội dung được đánh dấu</translation>
-<translation id="3040011195152428237">liên kết</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">Vui lòng nhập một giá trị hợp lệ. Trường không hoàn chỉnh hoặc có giá trị không hợp lệ.</translation>
-<translation id="3078740164268491126">bảng</translation>
-<translation id="3086746722712840547">ghi chú</translation>
-<translation id="310520048233152454">Vui lòng nhập URL.</translation>
-<translation id="3175736971608411871">bộ tính giờ</translation>
-<translation id="3199563858620722075">hộp kết hợp</translation>
-<translation id="3450233048674729344">Giá trị phải nhỏ hơn hoặc bằng <ph name="MAXIMUM" />.</translation>
-<translation id="3486220673238053218">định nghĩa</translation>
-<translation id="3557673793733683882">tiêu đề <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">bộ chọn tuần</translation>
-<translation id="3685101356851116974">Hình ảnh không có nhãn</translation>
-<translation id="3706100364254443312">chuyển</translation>
-<translation id="3732799496749320381">mm</translation>
-<translation id="3754210790023674521">Thoát chế độ hình trong hình</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">cụm từ</translation>
-<translation id="3822383571486410024">Hãy kéo dài văn bản này thành <ph name="MIN_CHARACTERS" /> ký tự trở lên (bạn hiện đang sử dụng <ph name="CURRENT_LENGTH" /> ký tự).</translation>
-<translation id="383465348367842624">Phần đứng trước '<ph name="ATSIGN" />' không được chứa biểu tượng '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="3846214748874656680">Thoát chế độ toàn màn hình</translation>
-<translation id="3920932319529768807">kết luận</translation>
-<translation id="3924558731517983934">ứng dụng</translation>
-<translation id="3944740393230681990">phần mở đầu</translation>
-<translation id="3960700977367013758">thanh cuộn</translation>
-<translation id="4103419683916926126">Mili giây</translation>
-<translation id="4151657705144244502">hình ảnh</translation>
-<translation id="4160057747563657758">điện thoại</translation>
-<translation id="4193965531860883258">lời tựa</translation>
-<translation id="4201051445878709314">Hiển thị tháng trước</translation>
-<translation id="421884353938374759">công cụ chọn màu</translation>
-<translation id="4248100235867064564">thanh menu</translation>
-<translation id="4360991593054037559">Vui lòng nhập giá trị hợp lệ. Hai giá trị hợp lệ gần nhất là <ph name="VALID_VALUE_LOW" /> và <ph name="VALID_VALUE_HIGHER" />.</translation>
-<translation id="4384583879834880242">Giải đáp</translation>
-<translation id="4413860115965805769">nút menu</translation>
-<translation id="4444765639179266822">Có vẻ như nội dung là: <ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">tham chiếu bảng thuật ngữ</translation>
-<translation id="4522570452068850558">Chi tiết</translation>
-<translation id="4542388879936266156">thời gian còn lại: <ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">biểu mẫu</translation>
-<translation id="4661075872484491155">cây</translation>
-<translation id="4664250907885839816">Phần đứng sau '<ph name="ATSIGN" />' không được chứa biểu tượng '<ph name="INVALIDCHARACTER" />'.</translation>
-<translation id="4668956016107839909">phụ lục</translation>
-<translation id="4718048029184481307">Đang phát ở chế độ hình trong hình</translation>
-<translation id="4742539557769756338">trang bìa</translation>
-<translation id="4748357248530471599">bật/tắt chế độ toàn màn hình có vết cắt</translation>
-<translation id="4757246831282535685">bảng điều khiển tab</translation>
-<translation id="4763480195061959176">video</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">Vui lòng nhập một số.</translation>
-<translation id="4912536737030637138">mục nhập danh mục</translation>
-<translation id="4975562563186953947">Đã chọn <ph name="SELECTED_COUNT" /></translation>
-<translation id="4992066212339426712">Bật âm thanh</translation>
-<translation id="49969490063480558">Vui lòng nhập phần đứng sau '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' không hoàn chỉnh.</translation>
-<translation id="5034860022980953847">chỉ báo tiến trình</translation>
-<translation id="5090250355906949916">thanh trượt thời gian trên video</translation>
-<translation id="5093189678851173835">lời đề từ</translation>
-<translation id="5117590920725113268">Hiển thị tháng tiếp theo</translation>
-<translation id="512758898067543763">tiêu đề hàng</translation>
-<translation id="5143125788380636750">lời kết</translation>
-<translation id="5164977714490026579">Giá trị phải lớn hơn hoặc bằng <ph name="MINIMUM" />.</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">Vui lòng nhập phần đứng trước '<ph name="ATSIGN" />'. '<ph name="INVALIDADDRESS" />' không hoàn chỉnh.</translation>
-<translation id="5334352251556557839">Không thể phát nội dung đa phương tiện.</translation>
-<translation id="5406322316791861025">hình dáng</translation>
-<translation id="5453733299334684579">mục dạng cây</translation>
-<translation id="5466621249238537318">Vui lòng chọn một hoặc nhiều tệp.</translation>
-<translation id="5468998798572797635">thoát khỏi chế độ toàn màn hình</translation>
-<translation id="5516424706154626233">bộ chọn ngày</translation>
-<translation id="5537725057119320332">Truyền</translation>
-<translation id="5546461542133609677">bật tiếng</translation>
-<translation id="561939826962581046">thời gian</translation>
-<translation id="5630795885300617244">Nhấn đúp vào bên trái hoặc phải để bỏ qua sau 10 giây</translation>
-<translation id="5631759159893697722">bản tóm tắt</translation>
-<translation id="5643186887447432888">nút</translation>
-<translation id="5677946354068040947">tùy chọn khác</translation>
-<translation id="576709008726043716">giới thiệu</translation>
-<translation id="57838592816432529">Tắt tiếng</translation>
-<translation id="5860033963881614850">Tắt</translation>
-<translation id="588258955323874662">Toàn màn hình</translation>
-<translation id="5888666972993069672">Hiện đang truyền tới <ph name="DEVICE_FRIENDLY_NAME" /></translation>
-<translation id="591047860372322273">hộp tìm kiếm</translation>
-<translation id="5939518447894949180">Đặt lại</translation>
-<translation id="5966707198760109579">Tuần</translation>
-<translation id="5987525920412732405">nút quay tròn</translation>
-<translation id="6011459053400940133">thanh trượt âm lượng</translation>
-<translation id="6015796118275082299">Năm</translation>
-<translation id="6023896073578205740">hộp danh sách</translation>
-<translation id="6150588977291308318">danh mục</translation>
-<translation id="6164829606128959761">thước đo</translation>
-<translation id="6166809985690652833">lời bạt</translation>
-<translation id="6209276755895393898">Có vẻ như là: <ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">bảng thuật ngữ</translation>
-<translation id="6281763101136022427">url</translation>
-<translation id="6310801910862476708">Thoát chế độ hình trong hình</translation>
-<translation id="6398862346408813489">Hiển thị bảng lựa chọn tháng</translation>
-<translation id="6404546809543547843">trình kiểm soát thời gian âm thanh</translation>
-<translation id="6443871981718447451">hiển thị menu phụ đề chi tiết</translation>
-<translation id="6453774872122745852">lời cảm ơn</translation>
-<translation id="648732519525291180">bộ chọn giờ</translation>
-<translation id="6550675742724504774">Tùy chọn</translation>
-<translation id="6572309429103589720">Ngữ pháp không hợp lệ</translation>
-<translation id="658823671542763450">vào chế độ toàn màn hình</translation>
-<translation id="663493177488814956">nguồn cấp dữ liệu</translation>
-<translation id="6637586476836377253">nhật ký</translation>
-<translation id="6643016212128521049">Xóa</translation>
-<translation id="668171684555832681">Khác...</translation>
-<translation id="6692633176391053278">điều khiển tăng/giảm</translation>
-<translation id="6709570249143506788">Chất lượng phát lại kém</translation>
-<translation id="6755330956360078551">chú giải công cụ</translation>
-<translation id="6790428901817661496">Phát</translation>
-<translation id="6820355525329141109">Không thể tải plugin.</translation>
-<translation id="6820615603175220800">tham chiếu danh mục</translation>
-<translation id="6843725295806269523">tắt tiếng</translation>
-<translation id="6885760532393684712">thư mục</translation>
-<translation id="689129560213475294">lời ghi cuối sách</translation>
-<translation id="6934078000481955284">khung trích dẫn</translation>
-<translation id="6941933287844615239">tải xuống phương tiện</translation>
-<translation id="6981594929165378967">chèn</translation>
-<translation id="6989848892321993519">Vui lòng kéo dài văn bản này thành <ph name="MIN_CHARACTERS" /> ký tự trở lên (bạn hiện đang sử dụng 1 ký tự).</translation>
-<translation id="7033340931668032222">lên và xuống để thay đổi âm lượng</translation>
-<translation id="709897737746224366">Vui lòng khớp với định dạng được yêu cầu.</translation>
-<translation id="7118469954320184356">Không có nội dung mô tả.</translation>
-<translation id="7139483182332611405">lời nói đầu</translation>
-<translation id="7214187073215825913">thông tin về nội dung</translation>
-<translation id="7263440858009898357">Vui lòng chọn một mục trong danh sách.</translation>
-<translation id="727747134524199931">tiêu đề cột</translation>
-<translation id="7320576522385648310">lưu vào bộ đệm</translation>
-<translation id="7353453495576941748">ghi nhận tác giả</translation>
-<translation id="7364796246159120393">Chọn tệp</translation>
-<translation id="739024184232394898">Khác...</translation>
-<translation id="7405738980073107433">chú thích cuối</translation>
-<translation id="7410239719251593705">Có vẻ chứa nội dung người lớn. Không có nội dung mô tả.</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">tab</translation>
-<translation id="7514365320538308">Tải xuống</translation>
-<translation id="7529102961911894712">liên kết ngược</translation>
-<translation id="7533959249147584474">Hình ảnh không có nhãn</translation>
-<translation id="7647456547678091388">mẹo</translation>
-<translation id="7661956066982048809">tài liệu đồ họa</translation>
-<translation id="7673697353781729403">Giờ</translation>
-<translation id="7681220483256441252">chú dẫn</translation>
-<translation id="7740050170769002709">Nội dung HTML</translation>
-<translation id="7745230546936012372">Để tải nội dung mô tả hình ảnh bị thiếu, hãy mở menu ngữ cảnh.</translation>
-<translation id="7750228210027921155">Hình trong hình</translation>
-<translation id="775297008183122718">Mục nhập không hợp lệ</translation>
-<translation id="7789962463072032349">tạm dừng</translation>
-<translation id="7802800022689234070">tam giác hiển thị</translation>
-<translation id="7888071071722539607">Vui lòng bao gồm '<ph name="ATSIGN" />' trong địa chỉ email. '<ph name="INVALIDADDRESS" />' bị thiếu '<ph name="ATSIGN" />'.</translation>
-<translation id="7891486169920085145">bộ chia</translation>
-<translation id="795667975304826397">Không có tệp nào được chọn</translation>
-<translation id="8053789581856978548">trường văn bản tìm kiếm</translation>
-<translation id="8057695513531652401">lưu ý</translation>
-<translation id="8105797009065549151">tham chiếu chú thích</translation>
-<translation id="811583516810654505">Đang tải nội dung mô tả...</translation>
-<translation id="8117451130807776954">Tuần này</translation>
-<translation id="8199524924445686405">yyyy</translation>
-<translation id="8208673686607688524">bộ chọn ngày và giờ địa phương</translation>
-<translation id="8261464734335370856">Chính tả không hợp lệ</translation>
-<translation id="8284326494547611709">Phụ đề</translation>
-<translation id="835897206747267392">Giá trị không hợp lệ.</translation>
-<translation id="8403857369060869934">thời gian trôi qua: <ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">phần</translation>
-<translation id="8433900881053900389">thanh công cụ</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> tệp</translation>
-<translation id="8451268428117625855">Vui lòng chọn một tệp.</translation>
-<translation id="8461852803063341183">nút radio</translation>
-<translation id="8474886197722836894">lời đề tặng</translation>
-<translation id="8531739829932800271">bản đính chính</translation>
-<translation id="8534579021159131403">Phút</translation>
-<translation id="8541249477527128034">kiểm soát phương tiện</translation>
-<translation id="8550857728288566671">biểu tượng đồ họa</translation>
-<translation id="8583702881314752957">danh sách định nghĩa</translation>
-<translation id="8597182159515967513">đầu đề</translation>
-<translation id="8603553056539299761">trái và phải để tìm kiếm</translation>
-<translation id="860475260694818407">mục lục</translation>
-<translation id="8613126697340063924">điều khiển phát lại từ xa</translation>
-<translation id="862370744433916922">phụ đề</translation>
-<translation id="8711688047404765493">thiết bị ra</translation>
-<translation id="8750798805984357768">Vui lòng chọn một trong các tùy chọn sau.</translation>
-<translation id="8808573423886751634">chương</translation>
-<translation id="8845239796550121995">Hiện đang truyền tới TV của bạn</translation>
-<translation id="8851136666856101339">chính</translation>
-<translation id="8875657656876809964">Lỗi phát lại video</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">Tháng</translation>
-<translation id="901493112792887934">thời gian hiện tại bằng giây</translation>
-<translation id="901834265349196618">email</translation>
-<translation id="9048119486235211610">điều hướng</translation>
-<translation id="9062295712474918030">tài liệu</translation>
-<translation id="9062307380734144336">chọn để phát/tạm dừng</translation>
-<translation id="9093215626363556771">thoát chế độ hình trong hình</translation>
-<translation id="9108370397979208512">toán học</translation>
-<translation id="9132465097189459683">Khác...</translation>
-<translation id="9138385573473225930">thông báo</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />, bắt đầu vào <ph name="WEEK_START_DATE" /></translation>
-<translation id="916607977885256133">Ảnh trong ảnh</translation>
-<translation id="9168329111483466115">chú thích cuối trang</translation>
-<translation id="954003015749068518">vào chế độ hình trong hình</translation>
-<translation id="966787709310836684">menu</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_zh-CN.xtb b/chromium/content/app/strings/translations/content_strings_zh-CN.xtb
deleted file mode 100644
index 3c232502013..00000000000
--- a/chromium/content/app/strings/translations/content_strings_zh-CN.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="zh-CN">
-<translation id="1018939186200882850">菜单项</translation>
-<translation id="10623998915015855">切换按钮</translation>
-<translation id="1088086359088493902">秒</translation>
-<translation id="1171774979989969504">请输入电子邮件地址。</translation>
-<translation id="1178581264944972037">暂停</translation>
-<translation id="1188858454923323853">补充内容</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">滑块</translation>
-<translation id="1211441953136645838">尾注</translation>
-<translation id="1281252709823657822">对话框</translation>
-<translation id="1335095011850992622">参与者名单</translation>
-<translation id="1342835525016946179">文章标记</translation>
-<translation id="1359897965706325498">横幅</translation>
-<translation id="1589122976691792535">区域</translation>
-<translation id="1591562245178063882">本月</translation>
-<translation id="1637811476055996098">选择文件</translation>
-<translation id="1650423536718072820">重要引述</translation>
-<translation id="1727886345390570319">隐藏字幕菜单</translation>
-<translation id="1729654308190250600">请输入有效的电子邮件地址。</translation>
-<translation id="1758486001363313524">其他...</translation>
-<translation id="1806710327868736751">提醒对话框</translation>
-<translation id="1821985195704844674">树状网格</translation>
-<translation id="1822429046913737220">上午/下午</translation>
-<translation id="1832974991323546415">在远程设备上播放</translation>
-<translation id="190587075670221089">删除</translation>
-<translation id="1907737156431278478">示例</translation>
-<translation id="1921819250265091946">日</translation>
-<translation id="1930711995431081526">状态</translation>
-<translation id="1938124657309484470">指定的值不得晚于<ph name="MAXIMUM_DATE_OR_TIME" />。</translation>
-<translation id="1946271899482435442">显示日期选择器</translation>
-<translation id="1993104285338243655">已切换到镜像</translation>
-<translation id="2060505056492490888">“<ph name="INVALIDDOMAIN" />”中“<ph name="DOT" />”的位置不正确。</translation>
-<translation id="2148716181193084225">今天</translation>
-<translation id="2158401438286456825">页面列表</translation>
-<translation id="2226276347425096477">请将该文本减少为 <ph name="MAX_CHARACTERS" /> 个字符或更少（您当前使用了 <ph name="CURRENT_LENGTH" /> 个字符）。</translation>
-<translation id="2246498165605549352">本地文件</translation>
-<translation id="2247351761944213033"><ph name="YEAR" /> 年第 <ph name="WEEKNUMBER" /> 周</translation>
-<translation id="2277199496770840904">字幕轨 <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">复选框</translation>
-<translation id="2311842470354187719">分页符</translation>
-<translation id="2335594187091864976">日期和时间选择器</translation>
-<translation id="245932805758469625">视频剩余时间（以秒为单位）</translation>
-<translation id="248395913932153421">日</translation>
-<translation id="2507943997699731163">请填写此字段。</translation>
-<translation id="2508569020611168319">标签列表</translation>
-<translation id="2561842179657104141">显示更多媒体控件</translation>
-<translation id="2572483411312390101">播放</translation>
-<translation id="2613802280814924224">请输入有效值。最接近的有效值为<ph name="VALID_VALUE" />。</translation>
-<translation id="2653659639078652383">提交</translation>
-<translation id="2657045182931379222">图形对象</translation>
-<translation id="2674318244760992338">页脚</translation>
-<translation id="2709516037105925701">自动填充</translation>
-<translation id="2723001399770238859">音频</translation>
-<translation id="2746543609216772311">指定的值不得早于<ph name="MINIMUM_DATE_OR_TIME" />。</translation>
-<translation id="2759744352195237655">弹出式按钮</translation>
-<translation id="2761667185364618470">如果要继续，请选中此框。</translation>
-<translation id="2844350028562914727">详细信息</translation>
-<translation id="2896972712917208084">单选按钮组</translation>
-<translation id="2908441821576996758">请输入用逗号分隔的电子邮件地址的列表。</translation>
-<translation id="2940813599313844715">对象</translation>
-<translation id="2942448076852699108">突出显示的内容</translation>
-<translation id="3040011195152428237">链接</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">请输入一个有效值。该字段不完整或存在无效日期。</translation>
-<translation id="3078740164268491126">表格</translation>
-<translation id="3086746722712840547">备注</translation>
-<translation id="310520048233152454">请输入网址。</translation>
-<translation id="3175736971608411871">定时器</translation>
-<translation id="3199563858620722075">组合框</translation>
-<translation id="3450233048674729344">值必须小于或等于 <ph name="MAXIMUM" />。</translation>
-<translation id="3486220673238053218">定义</translation>
-<translation id="3557673793733683882">标题 <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">星期选择器</translation>
-<translation id="3685101356851116974">未加标签的图片</translation>
-<translation id="3706100364254443312">切换</translation>
-<translation id="3732799496749320381">月</translation>
-<translation id="3754210790023674521">退出“画中画”模式</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">字词</translation>
-<translation id="3822383571486410024">请将该文本增加为 <ph name="MIN_CHARACTERS" /> 个字符或更多（您当前使用的是 <ph name="CURRENT_LENGTH" /> 个字符）。</translation>
-<translation id="383465348367842624">“<ph name="ATSIGN" />”前面的内容不应包含符号“<ph name="INVALIDCHARACTER" />”。</translation>
-<translation id="3846214748874656680">退出全屏模式</translation>
-<translation id="3920932319529768807">总结</translation>
-<translation id="3924558731517983934">应用</translation>
-<translation id="3944740393230681990">序言</translation>
-<translation id="3960700977367013758">滚动条</translation>
-<translation id="4103419683916926126">毫秒</translation>
-<translation id="4151657705144244502">图形</translation>
-<translation id="4160057747563657758">电话号码</translation>
-<translation id="4193965531860883258">前言</translation>
-<translation id="4201051445878709314">显示上一个月</translation>
-<translation id="421884353938374759">颜色选择器</translation>
-<translation id="4248100235867064564">菜单栏</translation>
-<translation id="4360991593054037559">请输入有效值。两个最接近的有效值分别为<ph name="VALID_VALUE_LOW" />和<ph name="VALID_VALUE_HIGHER" />。</translation>
-<translation id="4384583879834880242">问答</translation>
-<translation id="4413860115965805769">菜单按钮</translation>
-<translation id="4444765639179266822">似乎是说：<ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">词汇表参考资料</translation>
-<translation id="4522570452068850558">详细信息</translation>
-<translation id="4542388879936266156">剩余时间：<ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">表单</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">“<ph name="ATSIGN" />”后面的内容不应包含符号“<ph name="INVALIDCHARACTER" />”。</translation>
-<translation id="4668956016107839909">附录</translation>
-<translation id="4718048029184481307">以“画中画”模式播放</translation>
-<translation id="4742539557769756338">封面</translation>
-<translation id="4748357248530471599">开启/关闭全屏模式中的刘海屏</translation>
-<translation id="4757246831282535685">标签面板</translation>
-<translation id="4763480195061959176">视频</translation>
-<translation id="479989351350248267">搜索</translation>
-<translation id="4812940957355064477">请输入一个数字。</translation>
-<translation id="4912536737030637138">参考书目</translation>
-<translation id="4975562563186953947">选择了<ph name="SELECTED_COUNT" />项</translation>
-<translation id="4992066212339426712">取消静音</translation>
-<translation id="49969490063480558">请在“<ph name="ATSIGN" />”后面输入内容。“<ph name="INVALIDADDRESS" />”不完整。</translation>
-<translation id="5034860022980953847">进度指示器</translation>
-<translation id="5090250355906949916">视频时间进度条</translation>
-<translation id="5093189678851173835">题词</translation>
-<translation id="5117590920725113268">显示下一个月</translation>
-<translation id="512758898067543763">行标题</translation>
-<translation id="5143125788380636750">结语</translation>
-<translation id="5164977714490026579">值必须大于或等于 <ph name="MINIMUM" />。</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">请在“<ph name="ATSIGN" />”前面输入内容。“<ph name="INVALIDADDRESS" />”不完整。</translation>
-<translation id="5334352251556557839">无法播放媒体。</translation>
-<translation id="5406322316791861025">图表</translation>
-<translation id="5453733299334684579">树状目录项</translation>
-<translation id="5466621249238537318">请选择一个或多个文件。</translation>
-<translation id="5468998798572797635">退出全屏模式</translation>
-<translation id="5516424706154626233">日期选择器</translation>
-<translation id="5537725057119320332">投射</translation>
-<translation id="5546461542133609677">取消静音</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">在左侧或右侧点按两次即可跳过 10 秒</translation>
-<translation id="5631759159893697722">摘要</translation>
-<translation id="5643186887447432888">按钮</translation>
-<translation id="5677946354068040947">更多选项</translation>
-<translation id="576709008726043716">简介</translation>
-<translation id="57838592816432529">静音</translation>
-<translation id="5860033963881614850">关闭</translation>
-<translation id="588258955323874662">全屏</translation>
-<translation id="5888666972993069672">现正投射至“<ph name="DEVICE_FRIENDLY_NAME" />”</translation>
-<translation id="591047860372322273">搜索框</translation>
-<translation id="5939518447894949180">重置</translation>
-<translation id="5966707198760109579">周</translation>
-<translation id="5987525920412732405">微调按钮</translation>
-<translation id="6011459053400940133">音量滑块</translation>
-<translation id="6015796118275082299">年</translation>
-<translation id="6023896073578205740">列表框</translation>
-<translation id="6150588977291308318">参考书目</translation>
-<translation id="6164829606128959761">计量条</translation>
-<translation id="6166809985690652833">后记</translation>
-<translation id="6209276755895393898">似乎是：<ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">词汇表</translation>
-<translation id="6281763101136022427">网址</translation>
-<translation id="6310801910862476708">退出“画中画”模式</translation>
-<translation id="6398862346408813489">显示月份选择面板</translation>
-<translation id="6404546809543547843">音频时间进度条</translation>
-<translation id="6443871981718447451">显示字幕菜单</translation>
-<translation id="6453774872122745852">致谢</translation>
-<translation id="648732519525291180">时间选择器</translation>
-<translation id="6550675742724504774">选项</translation>
-<translation id="6572309429103589720">语法无效</translation>
-<translation id="658823671542763450">进入全屏模式</translation>
-<translation id="663493177488814956">Feed</translation>
-<translation id="6637586476836377253">日志</translation>
-<translation id="6643016212128521049">清除</translation>
-<translation id="668171684555832681">其他...</translation>
-<translation id="6692633176391053278">步进器</translation>
-<translation id="6709570249143506788">播放质量不佳</translation>
-<translation id="6755330956360078551">提示</translation>
-<translation id="6790428901817661496">播放</translation>
-<translation id="6820355525329141109">无法加载插件。</translation>
-<translation id="6820615603175220800">参考书目</translation>
-<translation id="6843725295806269523">静音</translation>
-<translation id="6885760532393684712">目录</translation>
-<translation id="689129560213475294">版权页</translation>
-<translation id="6934078000481955284">引用标记</translation>
-<translation id="6941933287844615239">下载媒体</translation>
-<translation id="6981594929165378967">插入</translation>
-<translation id="6989848892321993519">请将该内容增加到 <ph name="MIN_CHARACTERS" /> 个或更多字符（目前您使用了 1 个字符）。</translation>
-<translation id="7033340931668032222">上下键用于更改音量</translation>
-<translation id="709897737746224366">请与所请求的格式保持一致。</translation>
-<translation id="7118469954320184356">尚无说明。</translation>
-<translation id="7139483182332611405">序言</translation>
-<translation id="7214187073215825913">内容信息</translation>
-<translation id="7263440858009898357">请在列表中选择一项。</translation>
-<translation id="727747134524199931">列标题</translation>
-<translation id="7320576522385648310">正在缓冲</translation>
-<translation id="7353453495576941748">感谢</translation>
-<translation id="7364796246159120393">选择文件</translation>
-<translation id="739024184232394898">其他...</translation>
-<translation id="7405738980073107433">尾注</translation>
-<translation id="7410239719251593705">似乎包含成人内容。尚无说明。</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">标签</translation>
-<translation id="7514365320538308">下载</translation>
-<translation id="7529102961911894712">返回链接</translation>
-<translation id="7533959249147584474">未加标签的图片</translation>
-<translation id="7647456547678091388">提示</translation>
-<translation id="7661956066982048809">图形文档</translation>
-<translation id="7673697353781729403">小时</translation>
-<translation id="7681220483256441252">索引</translation>
-<translation id="7740050170769002709">HTML 内容</translation>
-<translation id="7745230546936012372">要获取缺失的图片说明，请打开上下文菜单。</translation>
-<translation id="7750228210027921155">画中画</translation>
-<translation id="775297008183122718">输入内容无效</translation>
-<translation id="7789962463072032349">暂停</translation>
-<translation id="7802800022689234070">开合三角标记</translation>
-<translation id="7888071071722539607">请在电子邮件地址中包括“<ph name="ATSIGN" />”。“<ph name="INVALIDADDRESS" />”中缺少“<ph name="ATSIGN" />”。</translation>
-<translation id="7891486169920085145">分离器</translation>
-<translation id="795667975304826397">未选择任何文件</translation>
-<translation id="8053789581856978548">搜索文本字段</translation>
-<translation id="8057695513531652401">通知</translation>
-<translation id="8105797009065549151">备注参考资料</translation>
-<translation id="811583516810654505">正在获取说明…</translation>
-<translation id="8117451130807776954">本周</translation>
-<translation id="8199524924445686405"> 年 </translation>
-<translation id="8208673686607688524">当地日期和时间选择器</translation>
-<translation id="8261464734335370856">拼写无效</translation>
-<translation id="8284326494547611709">字幕</translation>
-<translation id="835897206747267392">值无效。</translation>
-<translation id="8403857369060869934">已播放时间：<ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">部分</translation>
-<translation id="8433900881053900389">工具栏</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> 个文件</translation>
-<translation id="8451268428117625855">请选择一个文件。</translation>
-<translation id="8461852803063341183">单选按钮</translation>
-<translation id="8474886197722836894">献辞</translation>
-<translation id="8531739829932800271">勘误表</translation>
-<translation id="8534579021159131403">分钟</translation>
-<translation id="8541249477527128034">媒体控件</translation>
-<translation id="8550857728288566671">图形符号</translation>
-<translation id="8583702881314752957">定义列表</translation>
-<translation id="8597182159515967513">标题</translation>
-<translation id="8603553056539299761">左右键用于快进/快退</translation>
-<translation id="860475260694818407">目录</translation>
-<translation id="8613126697340063924">控制远程播放</translation>
-<translation id="862370744433916922">副标题</translation>
-<translation id="8711688047404765493">输出</translation>
-<translation id="8750798805984357768">请从这些选项中选择一个。</translation>
-<translation id="8808573423886751634">章节</translation>
-<translation id="8845239796550121995">现在正投射到您的电视上</translation>
-<translation id="8851136666856101339">主体内容</translation>
-<translation id="8875657656876809964">视频播放出错</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">月</translation>
-<translation id="901493112792887934">目前时间（以秒为单位）</translation>
-<translation id="901834265349196618">电子邮件</translation>
-<translation id="9048119486235211610">导航</translation>
-<translation id="9062295712474918030">文档</translation>
-<translation id="9062307380734144336">只需做出选择，即可在播放与暂停之间切换</translation>
-<translation id="9093215626363556771">退出“画中画”模式</translation>
-<translation id="9108370397979208512">数学</translation>
-<translation id="9132465097189459683">其他...</translation>
-<translation id="9138385573473225930">提醒</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />，从 <ph name="WEEK_START_DATE" />开始</translation>
-<translation id="916607977885256133">画中画</translation>
-<translation id="9168329111483466115">脚注</translation>
-<translation id="954003015749068518">进入“画中画”模式</translation>
-<translation id="966787709310836684">菜单</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app/strings/translations/content_strings_zh-TW.xtb b/chromium/content/app/strings/translations/content_strings_zh-TW.xtb
deleted file mode 100644
index 95c5641e4f6..00000000000
--- a/chromium/content/app/strings/translations/content_strings_zh-TW.xtb
+++ /dev/null
@@ -1,265 +0,0 @@
-<?xml version="1.0" ?>
-<!DOCTYPE translationbundle>
-<translationbundle lang="zh-TW">
-<translation id="1018939186200882850">選單項目</translation>
-<translation id="10623998915015855">切換按鈕</translation>
-<translation id="1088086359088493902">秒</translation>
-<translation id="1171774979989969504">請輸入電子郵件地址。</translation>
-<translation id="1178581264944972037">暫停</translation>
-<translation id="1188858454923323853">補充</translation>
-<translation id="1206619573307042055">marquee</translation>
-<translation id="1206693055195146388">滑桿</translation>
-<translation id="1211441953136645838">章節附註</translation>
-<translation id="1281252709823657822">對話方塊</translation>
-<translation id="1335095011850992622">參與名單</translation>
-<translation id="1342835525016946179">文章</translation>
-<translation id="1359897965706325498">橫幅</translation>
-<translation id="1589122976691792535">區域</translation>
-<translation id="1591562245178063882">本月</translation>
-<translation id="1637811476055996098">選擇檔案</translation>
-<translation id="1650423536718072820">重要引述</translation>
-<translation id="1727886345390570319">不要顯示隱藏式輔助字幕選單</translation>
-<translation id="1729654308190250600">請輸入電子郵件地址。</translation>
-<translation id="1758486001363313524">其他...</translation>
-<translation id="1806710327868736751">警示對話方塊</translation>
-<translation id="1821985195704844674">樹狀目錄網格</translation>
-<translation id="1822429046913737220">AM/PM</translation>
-<translation id="1832974991323546415">在遠端裝置上播放</translation>
-<translation id="190587075670221089">刪除</translation>
-<translation id="1907737156431278478">範例</translation>
-<translation id="1921819250265091946">日</translation>
-<translation id="1930711995431081526">狀態</translation>
-<translation id="1938124657309484470">必須輸入 <ph name="MAXIMUM_DATE_OR_TIME" /> 或之前的值。</translation>
-<translation id="1946271899482435442">顯示日期選擇器</translation>
-<translation id="1993104285338243655">已切換至鏡像模式</translation>
-<translation id="2060505056492490888">「<ph name="DOT" />」未放在「<ph name="INVALIDDOMAIN" />」的正確位置。</translation>
-<translation id="2148716181193084225">今天</translation>
-<translation id="2158401438286456825">頁面清單</translation>
-<translation id="2226276347425096477">請將這段文字刪減至 <ph name="MAX_CHARACTERS" /> 個字元以下 (目前的字元數為 <ph name="CURRENT_LENGTH" /> 個)。</translation>
-<translation id="2246498165605549352">本機檔案</translation>
-<translation id="2247351761944213033"><ph name="YEAR" /> 年，第 <ph name="WEEKNUMBER" /> 週</translation>
-<translation id="2277199496770840904">曲目 <ph name="NUMBER" /></translation>
-<translation id="2291999235780842123">核取方塊</translation>
-<translation id="2311842470354187719">分頁符號</translation>
-<translation id="2335594187091864976">日期和時間選擇器</translation>
-<translation id="245932805758469625">影片剩餘秒數</translation>
-<translation id="248395913932153421">日</translation>
-<translation id="2507943997699731163">請填寫這個欄位。</translation>
-<translation id="2508569020611168319">分頁清單</translation>
-<translation id="2561842179657104141">顯示更多媒體控制項</translation>
-<translation id="2572483411312390101">播放</translation>
-<translation id="2613802280814924224">請輸入有效值。最接近的有效值是 <ph name="VALID_VALUE" />。</translation>
-<translation id="2653659639078652383">提交</translation>
-<translation id="2657045182931379222">圖形物件</translation>
-<translation id="2674318244760992338">頁尾</translation>
-<translation id="2709516037105925701">自動填入</translation>
-<translation id="2723001399770238859">音訊</translation>
-<translation id="2746543609216772311">必須輸入 <ph name="MINIMUM_DATE_OR_TIME" /> 或之後的值。</translation>
-<translation id="2759744352195237655">彈出式按鈕</translation>
-<translation id="2761667185364618470">如果你要繼續執行，請勾選這個核取方塊。</translation>
-<translation id="2844350028562914727">詳細資料</translation>
-<translation id="2896972712917208084">圓形按鈕群組</translation>
-<translation id="2908441821576996758">請輸入以逗號分隔的電子郵件地址清單。</translation>
-<translation id="2940813599313844715">物件</translation>
-<translation id="2942448076852699108">醒目顯示的內容</translation>
-<translation id="3040011195152428237">連結</translation>
-<translation id="3049748772180311791"><ph name="QUANTITY" /> MB</translation>
-<translation id="3075154866155599887">欄位內容不完整或日期無效，請輸入有效的值。</translation>
-<translation id="3078740164268491126">表格</translation>
-<translation id="3086746722712840547">附註</translation>
-<translation id="310520048233152454">請輸入網址。</translation>
-<translation id="3175736971608411871">計時器</translation>
-<translation id="3199563858620722075">下拉式方塊</translation>
-<translation id="3450233048674729344">值必須小於或等於 <ph name="MAXIMUM" />。</translation>
-<translation id="3486220673238053218">定義</translation>
-<translation id="3557673793733683882">標題 <ph name="HEADING_LEVEL" /></translation>
-<translation id="3670698553867754311">週挑選器</translation>
-<translation id="3685101356851116974">未標示的圖片</translation>
-<translation id="3706100364254443312">切換</translation>
-<translation id="3732799496749320381">月</translation>
-<translation id="3754210790023674521">離開子母畫面</translation>
-<translation id="3757388668994797779"><ph name="QUANTITY" /> GB</translation>
-<translation id="3808586225841795776">字詞</translation>
-<translation id="3822383571486410024">請將這段文字加長到 <ph name="MIN_CHARACTERS" /> 個字元以上 (目前使用字元數：<ph name="CURRENT_LENGTH" />)。</translation>
-<translation id="383465348367842624">「<ph name="ATSIGN" />」後面的部分不應包含「<ph name="INVALIDCHARACTER" />」符號。</translation>
-<translation id="3846214748874656680">結束全螢幕</translation>
-<translation id="3920932319529768807">結論</translation>
-<translation id="3924558731517983934">應用程式</translation>
-<translation id="3944740393230681990">序言</translation>
-<translation id="3960700977367013758">捲軸</translation>
-<translation id="4103419683916926126">毫秒</translation>
-<translation id="4151657705144244502">圖形</translation>
-<translation id="4160057747563657758">電話</translation>
-<translation id="4193965531860883258">前言</translation>
-<translation id="4201051445878709314">顯示上一個月</translation>
-<translation id="421884353938374759">顏色選擇器</translation>
-<translation id="4248100235867064564">選單列</translation>
-<translation id="4360991593054037559">請輸入有效值。最接近的兩個有效值分別是 <ph name="VALID_VALUE_LOW" /> 和 <ph name="VALID_VALUE_HIGHER" />。</translation>
-<translation id="4384583879834880242">問與答</translation>
-<translation id="4413860115965805769">選單按鈕</translation>
-<translation id="4444765639179266822">圖片上的文字似乎是：<ph name="OCR_TEXT" /></translation>
-<translation id="4446524499724042288">詞彙解釋參考資料</translation>
-<translation id="4522570452068850558">詳細資訊</translation>
-<translation id="4542388879936266156">剩餘時間：<ph name="REMAINING_TIME" /></translation>
-<translation id="4597532268155981612">表單</translation>
-<translation id="4661075872484491155">tree</translation>
-<translation id="4664250907885839816">「<ph name="ATSIGN" />」後面的部分不應包含「<ph name="INVALIDCHARACTER" />」符號。</translation>
-<translation id="4668956016107839909">附錄</translation>
-<translation id="4718048029184481307">在子母畫面中播放</translation>
-<translation id="4742539557769756338">封面</translation>
-<translation id="4748357248530471599">切換螢幕凹口全螢幕模式</translation>
-<translation id="4757246831282535685">分頁面板</translation>
-<translation id="4763480195061959176">影片</translation>
-<translation id="479989351350248267">search</translation>
-<translation id="4812940957355064477">請輸入一個數字。</translation>
-<translation id="4912536737030637138">參考書目</translation>
-<translation id="4975562563186953947">已選取 <ph name="SELECTED_COUNT" /> 個項目</translation>
-<translation id="4992066212339426712">取消靜音</translation>
-<translation id="49969490063480558">請輸入「<ph name="ATSIGN" />」後面的部分。「<ph name="INVALIDADDRESS" />」不是完整值。</translation>
-<translation id="5034860022980953847">進度指標</translation>
-<translation id="5090250355906949916">影片時間拖曳工具</translation>
-<translation id="5093189678851173835">題詞</translation>
-<translation id="5117590920725113268">顯示下一個月</translation>
-<translation id="512758898067543763">列標題</translation>
-<translation id="5143125788380636750">結尾</translation>
-<translation id="5164977714490026579">值必須大於或等於 <ph name="MINIMUM" />。</translation>
-<translation id="520299402983819650"><ph name="QUANTITY" /> PB</translation>
-<translation id="5307600278924710095">請輸入「<ph name="ATSIGN" />」後面的部分。「<ph name="INVALIDADDRESS" />」不是完整值。</translation>
-<translation id="5334352251556557839">無法播放媒體。</translation>
-<translation id="5406322316791861025">圖表</translation>
-<translation id="5453733299334684579">樹狀目錄項目</translation>
-<translation id="5466621249238537318">請選取一或多個檔案。</translation>
-<translation id="5468998798572797635">退出全螢幕</translation>
-<translation id="5516424706154626233">日期選擇器</translation>
-<translation id="5537725057119320332">投放</translation>
-<translation id="5546461542133609677">取消靜音</translation>
-<translation id="561939826962581046">time</translation>
-<translation id="5630795885300617244">輕觸兩下左側或右側可跳過 10 秒</translation>
-<translation id="5631759159893697722">摘要</translation>
-<translation id="5643186887447432888">按鈕</translation>
-<translation id="5677946354068040947">更多選項</translation>
-<translation id="576709008726043716">簡介</translation>
-<translation id="57838592816432529">靜音</translation>
-<translation id="5860033963881614850">關閉</translation>
-<translation id="588258955323874662">全螢幕</translation>
-<translation id="5888666972993069672">正在投放到「<ph name="DEVICE_FRIENDLY_NAME" />」</translation>
-<translation id="591047860372322273">搜尋框</translation>
-<translation id="5939518447894949180">重設</translation>
-<translation id="5966707198760109579">週</translation>
-<translation id="5987525920412732405">微調按鈕</translation>
-<translation id="6011459053400940133">音量滑桿</translation>
-<translation id="6015796118275082299">年</translation>
-<translation id="6023896073578205740">清單方塊</translation>
-<translation id="6150588977291308318">參考書目</translation>
-<translation id="6164829606128959761">計量器</translation>
-<translation id="6166809985690652833">後記</translation>
-<translation id="6209276755895393898">圖片內容似乎是：<ph name="DESCRIPTION" /></translation>
-<translation id="6213469881011901533">詞彙解釋</translation>
-<translation id="6281763101136022427">網址</translation>
-<translation id="6310801910862476708">離開子母畫面</translation>
-<translation id="6398862346408813489">顯示月份選取面板</translation>
-<translation id="6404546809543547843">音訊時間點拖曳工具</translation>
-<translation id="6443871981718447451">顯示隱藏式輔助字幕選單</translation>
-<translation id="6453774872122745852">鳴謝</translation>
-<translation id="648732519525291180">時間選擇器</translation>
-<translation id="6550675742724504774">選項</translation>
-<translation id="6572309429103589720">文法錯誤</translation>
-<translation id="658823671542763450">進入全螢幕</translation>
-<translation id="663493177488814956">資訊提供</translation>
-<translation id="6637586476836377253">記錄</translation>
-<translation id="6643016212128521049">清除</translation>
-<translation id="668171684555832681">其他...</translation>
-<translation id="6692633176391053278">步進器</translation>
-<translation id="6709570249143506788">播放品質不佳</translation>
-<translation id="6755330956360078551">工具提示</translation>
-<translation id="6790428901817661496">播放</translation>
-<translation id="6820355525329141109">無法載入外掛程式。</translation>
-<translation id="6820615603175220800">參考書目資料</translation>
-<translation id="6843725295806269523">靜音</translation>
-<translation id="6885760532393684712">目錄</translation>
-<translation id="689129560213475294">版權頁標記</translation>
-<translation id="6934078000481955284">引用標記</translation>
-<translation id="6941933287844615239">下載媒體</translation>
-<translation id="6981594929165378967">插入</translation>
-<translation id="6989848892321993519">請將這段文字加長到 <ph name="MIN_CHARACTERS" /> 個字元以上 (目前已有 1 個字元)。</translation>
-<translation id="7033340931668032222">上下鍵可調整音量</translation>
-<translation id="709897737746224366">請符合要求的格式。</translation>
-<translation id="7118469954320184356">目前沒有說明。</translation>
-<translation id="7139483182332611405">前言</translation>
-<translation id="7214187073215825913">內容資訊</translation>
-<translation id="7263440858009898357">請選取一個清單中的項目。</translation>
-<translation id="727747134524199931">欄標題</translation>
-<translation id="7320576522385648310">緩衝處理中</translation>
-<translation id="7353453495576941748">參與名單</translation>
-<translation id="7364796246159120393">選擇檔案</translation>
-<translation id="739024184232394898">其他...</translation>
-<translation id="7405738980073107433">章節附註</translation>
-<translation id="7410239719251593705">圖片似乎含有成人內容。目前沒有說明。</translation>
-<translation id="7460907917090416791"><ph name="QUANTITY" /> TB</translation>
-<translation id="7491962110804786152">分頁</translation>
-<translation id="7514365320538308">下載</translation>
-<translation id="7529102961911894712">反向連結</translation>
-<translation id="7533959249147584474">未標示的圖片</translation>
-<translation id="7647456547678091388">提示</translation>
-<translation id="7661956066982048809">圖形文件</translation>
-<translation id="7673697353781729403">小時</translation>
-<translation id="7681220483256441252">索引</translation>
-<translation id="7740050170769002709">HTML 內容</translation>
-<translation id="7745230546936012372">如要為缺少說明的圖片取得說明，請開啟內容選單。</translation>
-<translation id="7750228210027921155">子母畫面</translation>
-<translation id="775297008183122718">無效的輸入值</translation>
-<translation id="7789962463072032349">暫停</translation>
-<translation id="7802800022689234070">顯示/隱藏三角標記</translation>
-<translation id="7888071071722539607">請在電子郵件地址中包含「<ph name="ATSIGN" />」。「<ph name="INVALIDADDRESS" />」未包含「<ph name="ATSIGN" />」。</translation>
-<translation id="7891486169920085145">分割器</translation>
-<translation id="795667975304826397">未選擇任何檔案</translation>
-<translation id="8053789581856978548">搜尋文字欄位</translation>
-<translation id="8057695513531652401">聲明</translation>
-<translation id="8105797009065549151">附註參考資料</translation>
-<translation id="811583516810654505">正在取得說明...</translation>
-<translation id="8117451130807776954">本週</translation>
-<translation id="8199524924445686405"> 年 </translation>
-<translation id="8208673686607688524">當地日期和時間挑選器</translation>
-<translation id="8261464734335370856">拼字錯誤</translation>
-<translation id="8284326494547611709">字幕</translation>
-<translation id="835897206747267392">無效的值。</translation>
-<translation id="8403857369060869934">經過時間：<ph name="ELAPSED_TIME" /></translation>
-<translation id="8415319359811155763">分輯</translation>
-<translation id="8433900881053900389">工具列</translation>
-<translation id="8444882422881193423"><ph name="NUMBER_OF_FILES" /> 個檔案</translation>
-<translation id="8451268428117625855">請選取檔案。</translation>
-<translation id="8461852803063341183">圓形按鈕</translation>
-<translation id="8474886197722836894">獻辭</translation>
-<translation id="8531739829932800271">勘誤表</translation>
-<translation id="8534579021159131403">分鐘</translation>
-<translation id="8541249477527128034">媒體控制</translation>
-<translation id="8550857728288566671">圖形符號</translation>
-<translation id="8583702881314752957">定義清單</translation>
-<translation id="8597182159515967513">標題</translation>
-<translation id="8603553056539299761">左右鍵可調整播放進度</translation>
-<translation id="860475260694818407">目錄</translation>
-<translation id="8613126697340063924">控制遠端播放</translation>
-<translation id="862370744433916922">副標題</translation>
-<translation id="8711688047404765493">輸出</translation>
-<translation id="8750798805984357768">請選取其中一個選項。</translation>
-<translation id="8808573423886751634">章節</translation>
-<translation id="8845239796550121995">正在投放到電視上</translation>
-<translation id="8851136666856101339">主要元素</translation>
-<translation id="8875657656876809964">影片播放錯誤</translation>
-<translation id="8901569739625249689"><ph name="QUANTITY" /> KB</translation>
-<translation id="8987927404178983737">月</translation>
-<translation id="901493112792887934">目前時間 (以秒為單位)</translation>
-<translation id="901834265349196618">電子郵件</translation>
-<translation id="9048119486235211610">導覽</translation>
-<translation id="9062295712474918030">文件</translation>
-<translation id="9062307380734144336">選取即可在播放/暫停之間切換</translation>
-<translation id="9093215626363556771">離開子母畫面</translation>
-<translation id="9108370397979208512">數學</translation>
-<translation id="9132465097189459683">其他...</translation>
-<translation id="9138385573473225930">警示</translation>
-<translation id="9155987714137265666"><ph name="WEEK" />，從 <ph name="WEEK_START_DATE" />開始</translation>
-<translation id="916607977885256133">子母畫面</translation>
-<translation id="9168329111483466115">註腳</translation>
-<translation id="954003015749068518">進入子母畫面</translation>
-<translation id="966787709310836684">選單</translation>
-</translationbundle>
\ No newline at end of file
diff --git a/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm b/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm
index 938854358e5..9743a058d3f 100644
--- a/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm
+++ b/chromium/content/app_shim_remote_cocoa/ns_view_bridge_factory_impl.mm
@@ -17,6 +17,8 @@
 #include "content/common/render_widget_host_ns_view.mojom.h"
 #include "content/common/web_contents_ns_view_bridge.mojom.h"
 #include "content/public/browser/native_web_keyboard_event.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/strong_associated_binding.h"
 #include "ui/accelerated_widget_mac/window_resize_helper_mac.h"
 #include "ui/base/cocoa/remote_accessibility_api.h"
@@ -30,19 +32,20 @@ class RenderWidgetHostNSViewBridgeOwner
     : public RenderWidgetHostNSViewHostHelper {
  public:
   explicit RenderWidgetHostNSViewBridgeOwner(
-      mojom::RenderWidgetHostNSViewHostAssociatedPtr client,
-      mojom::RenderWidgetHostNSViewAssociatedRequest bridge_request)
+      mojo::PendingAssociatedRemote<mojom::RenderWidgetHostNSViewHost> client,
+      mojo::PendingAssociatedReceiver<mojom::RenderWidgetHostNSView>
+          bridge_receiver)
       : host_(std::move(client)) {
     bridge_ = std::make_unique<remote_cocoa::RenderWidgetHostNSViewBridge>(
         host_.get(), this);
-    bridge_->BindRequest(std::move(bridge_request));
-    host_.set_connection_error_handler(
-        base::BindOnce(&RenderWidgetHostNSViewBridgeOwner::OnConnectionError,
+    bridge_->BindReceiver(std::move(bridge_receiver));
+    host_.set_disconnect_handler(
+        base::BindOnce(&RenderWidgetHostNSViewBridgeOwner::OnMojoDisconnect,
                        base::Unretained(this)));
   }
 
  private:
-  void OnConnectionError() { delete this; }
+  void OnMojoDisconnect() { delete this; }
 
   std::unique_ptr<content::InputEvent> TranslateEvent(
       const blink::WebInputEvent& web_event) {
@@ -119,7 +122,7 @@ class RenderWidgetHostNSViewBridgeOwner
     host_->SmartMagnify(TranslateEvent(web_event));
   }
 
-  mojom::RenderWidgetHostNSViewHostAssociatedPtr host_;
+  mojo::AssociatedRemote<mojom::RenderWidgetHostNSViewHost> host_;
   std::unique_ptr<RenderWidgetHostNSViewBridge> bridge_;
   base::scoped_nsobject<NSAccessibilityRemoteUIElement>
       remote_accessibility_element_;
@@ -130,21 +133,20 @@ class RenderWidgetHostNSViewBridgeOwner
 
 void CreateRenderWidgetHostNSView(
     mojo::ScopedInterfaceEndpointHandle host_handle,
-    mojo::ScopedInterfaceEndpointHandle view_request_handle) {
+    mojo::ScopedInterfaceEndpointHandle view_receiver_handle) {
   // Cast from the stub interface to the mojom::RenderWidgetHostNSViewHost
   // and mojom::RenderWidgetHostNSView private interfaces.
   // TODO(ccameron): Remove the need for this cast.
   // https://crbug.com/888290
-  mojom::RenderWidgetHostNSViewHostAssociatedPtr host(
-      mojo::AssociatedInterfacePtrInfo<mojom::RenderWidgetHostNSViewHost>(
-          std::move(host_handle), 0));
-  mojom::RenderWidgetHostNSViewAssociatedRequest ns_view_request(
-      std::move(view_request_handle));
+  mojo::PendingAssociatedRemote<mojom::RenderWidgetHostNSViewHost> host(
+      std::move(host_handle), 0);
 
   // Create a RenderWidgetHostNSViewBridgeOwner. The resulting object will be
   // destroyed when its underlying pipe is closed.
   ignore_result(new RenderWidgetHostNSViewBridgeOwner(
-      std::move(host), std::move(ns_view_request)));
+      std::move(host),
+      mojo::PendingAssociatedReceiver<mojom::RenderWidgetHostNSView>(
+          std::move(view_receiver_handle))));
 }
 
 void CreateWebContentsNSView(
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.h b/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.h
index 772b60e12cc..45ca8fb8839 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.h
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.h
@@ -12,7 +12,8 @@
 #import "content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h"
 #include "content/common/render_widget_host_ns_view.mojom.h"
 #include "content/public/common/widget_type.h"
-#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "ui/accelerated_widget_mac/display_ca_layer_tree.h"
 #include "ui/display/display_observer.h"
 
@@ -28,9 +29,10 @@ class RenderWidgetHostNSViewBridge : public mojom::RenderWidgetHostNSView,
                                RenderWidgetHostNSViewHostHelper* client_helper);
   ~RenderWidgetHostNSViewBridge() override;
 
-  // Bind to a remote request for a mojo interface.
-  void BindRequest(
-      mojom::RenderWidgetHostNSViewAssociatedRequest bridge_request);
+  // Bind to a remote receiver for a mojo interface.
+  void BindReceiver(
+      mojo::PendingAssociatedReceiver<mojom::RenderWidgetHostNSView>
+          bridge_receiver);
 
   // TODO(ccameron): RenderWidgetHostViewMac and other functions currently use
   // this method to communicate directly with RenderWidgetHostViewCocoa. The
@@ -91,8 +93,8 @@ class RenderWidgetHostNSViewBridge : public mojom::RenderWidgetHostNSView,
   // Cached copy of the tooltip text, to avoid redundant calls.
   base::string16 tooltip_text_;
 
-  // The binding for this object (only used when remotely instantiated).
-  mojo::AssociatedBinding<mojom::RenderWidgetHostNSView> binding_;
+  // The receiver for this object (only used when remotely instantiated).
+  mojo::AssociatedReceiver<mojom::RenderWidgetHostNSView> receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostNSViewBridge);
 };
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.mm b/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.mm
index e4ebe132c22..0a6f56105d8 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.mm
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_ns_view_bridge.mm
@@ -20,8 +20,7 @@ namespace remote_cocoa {
 
 RenderWidgetHostNSViewBridge::RenderWidgetHostNSViewBridge(
     mojom::RenderWidgetHostNSViewHost* host,
-    RenderWidgetHostNSViewHostHelper* host_helper)
-    : binding_(this) {
+    RenderWidgetHostNSViewHostHelper* host_helper) {
   display::Screen::GetScreen()->AddObserver(this);
 
   cocoa_view_.reset([[RenderWidgetHostViewCocoa alloc]
@@ -49,10 +48,11 @@ RenderWidgetHostNSViewBridge::~RenderWidgetHostNSViewBridge() {
   popup_window_.reset();
 }
 
-void RenderWidgetHostNSViewBridge::BindRequest(
-    mojom::RenderWidgetHostNSViewAssociatedRequest bridge_request) {
-  binding_.Bind(std::move(bridge_request),
-                ui::WindowResizeHelperMac::Get()->task_runner());
+void RenderWidgetHostNSViewBridge::BindReceiver(
+    mojo::PendingAssociatedReceiver<mojom::RenderWidgetHostNSView>
+        bridge_receiver) {
+  receiver_.Bind(std::move(bridge_receiver),
+                 ui::WindowResizeHelperMac::Get()->task_runner());
 }
 
 RenderWidgetHostViewCocoa* RenderWidgetHostNSViewBridge::GetNSView() {
@@ -72,7 +72,12 @@ void RenderWidgetHostNSViewBridge::SetParentWebContentsNSView(
   // done by WebContentsViewMac.
   [cocoa_view_ setFrame:[parent_ns_view bounds]];
   [cocoa_view_ setAutoresizingMask:NSViewWidthSizable | NSViewHeightSizable];
-  [parent_ns_view addSubview:cocoa_view_];
+  // Place the new view below all other views, matching the behavior in
+  // WebContentsViewMac::CreateViewForWidget.
+  // https://crbug.com/1017446
+  [parent_ns_view addSubview:cocoa_view_
+                  positioned:NSWindowBelow
+                  relativeTo:nil];
 }
 
 void RenderWidgetHostNSViewBridge::MakeFirstResponder() {
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h
index 6f7367995bc..9ca50d29c02 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h
@@ -16,6 +16,7 @@
 #include "content/browser/renderer_host/input/mouse_wheel_rails_filter_mac.h"
 #include "content/common/edit_command.h"
 #include "content/common/render_widget_host_ns_view.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #import "ui/base/cocoa/command_dispatcher.h"
 #import "ui/base/cocoa/tool_tip_base_view.h"
 #include "ui/base/ime/ime_text_span.h"
@@ -76,7 +77,7 @@ struct DidOverscrollParams;
 
   // Dummy host and host helper that are always valid (see above comments
   // about host_).
-  remote_cocoa::mojom::RenderWidgetHostNSViewHostPtr dummyHost_;
+  mojo::Remote<remote_cocoa::mojom::RenderWidgetHostNSViewHost> dummyHost_;
   std::unique_ptr<remote_cocoa::RenderWidgetHostNSViewHostHelper>
       dummyHostHelper_;
 
diff --git a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
index e692286b9c1..d8de080eb6a 100644
--- a/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
+++ b/chromium/content/app_shim_remote_cocoa/render_widget_host_view_cocoa.mm
@@ -10,6 +10,7 @@
 #include "base/debug/crash_logging.h"
 #import "base/mac/foundation_util.h"
 #include "base/mac/mac_util.h"
+#include "base/numerics/ranges.h"
 #include "base/stl_util.h"
 #include "base/strings/sys_string_conversions.h"
 #import "content/browser/accessibility/browser_accessibility_cocoa.h"
@@ -110,13 +111,13 @@ SkColor SkColorFromNSColor(NSColor* color) {
   CGFloat r, g, b, a;
   [color getRed:&r green:&g blue:&b alpha:&a];
 
-  return std::max(0, std::min(static_cast<int>(lroundf(255.0f * a)), 255))
+  return base::ClampToRange(static_cast<int>(lroundf(255.0f * a)), 0, 255)
              << 24 |
-         std::max(0, std::min(static_cast<int>(lroundf(255.0f * r)), 255))
+         base::ClampToRange(static_cast<int>(lroundf(255.0f * r)), 0, 255)
              << 16 |
-         std::max(0, std::min(static_cast<int>(lroundf(255.0f * g)), 255))
+         base::ClampToRange(static_cast<int>(lroundf(255.0f * g)), 0, 255)
              << 8 |
-         std::max(0, std::min(static_cast<int>(lroundf(255.0f * b)), 255));
+         base::ClampToRange(static_cast<int>(lroundf(255.0f * b)), 0, 255);
 }
 
 // Extract underline information from an attributed string. Mostly copied from
@@ -581,8 +582,7 @@ void ExtractUnderlines(NSAttributedString* string,
 - (void)setHostDisconnected {
   // Set the host to be an abandoned message pipe, and set the hostHelper
   // to forward messages to that host.
-  remote_cocoa::mojom::RenderWidgetHostNSViewHostRequest dummyHostRequest =
-      mojo::MakeRequest(&dummyHost_);
+  ignore_result(dummyHost_.BindNewPipeAndPassReceiver());
   dummyHostHelper_ = std::make_unique<DummyHostHelper>();
   host_ = dummyHost_.get();
   hostHelper_ = dummyHostHelper_.get();
@@ -598,7 +598,7 @@ void ExtractUnderlines(NSAttributedString* string,
 }
 
 - (bool)hostIsDisconnected {
-  return host_ == dummyHost_.get();
+  return host_ == (dummyHost_.is_bound() ? dummyHost_.get() : nullptr);
 }
 
 - (void)setShowingContextMenu:(BOOL)showing {
diff --git a/chromium/content/browser/BUILD.gn b/chromium/content/browser/BUILD.gn
index f10e1a8e588..0a1cdad2422 100644
--- a/chromium/content/browser/BUILD.gn
+++ b/chromium/content/browser/BUILD.gn
@@ -9,6 +9,7 @@ import("//build/config/linux/pangocairo/pangocairo.gni")
 import("//build/config/ui.gni")
 import("//chromeos/assistant/assistant.gni")
 import("//components/ui_devtools/devtools.gni")
+import("//content/common/features.gni")
 import("//gpu/vulkan/features.gni")
 import("//media/media_options.gni")
 import("//net/features.gni")
@@ -64,10 +65,12 @@ jumbo_source_set("browser") {
     "//components/offline_pages/core/request_header",
     "//components/os_crypt",
     "//components/payments/content/icon",
+    "//components/payments/mojom",
     "//components/rappor",
     "//components/services/filesystem:lib",
     "//components/services/leveldb:lib",
     "//components/services/quarantine:quarantine",
+    "//components/services/storage",
     "//components/tracing",
     "//components/tracing:startup_tracing",
     "//components/tracing/common:interfaces",
@@ -80,7 +83,6 @@ jumbo_source_set("browser") {
     "//components/viz/service/main",
     "//content:resources",
     "//content/app/resources",
-    "//content/app/strings",
     "//content/browser/background_fetch:background_fetch_proto",
     "//content/browser/background_sync:background_sync_proto",
     "//content/browser/cache_storage:cache_storage_proto",
@@ -154,8 +156,6 @@ jumbo_source_set("browser") {
     "//services/device/public/cpp/geolocation",
     "//services/device/public/mojom",
     "//services/device/public/mojom:generic_sensor",
-    "//services/file:lib",
-    "//services/file/public/mojom",
     "//services/media_session:lib",
     "//services/media_session/public/cpp",
     "//services/media_session/public/cpp:manifest",
@@ -165,10 +165,8 @@ jumbo_source_set("browser") {
     "//services/metrics/public/cpp:metrics_cpp",
     "//services/network:network_service",
     "//services/network/public/cpp",
-    "//services/network/public/cpp:manifest",
     "//services/network/public/mojom",
     "//services/resource_coordinator:lib",
-    "//services/resource_coordinator/public/cpp:manifest",
     "//services/resource_coordinator/public/cpp:resource_coordinator_cpp",
     "//services/service_manager",
     "//services/service_manager/embedder",
@@ -189,6 +187,7 @@ jumbo_source_set("browser") {
     "//services/viz/public/cpp/gpu",
     "//services/viz/public/mojom",
     "//skia",
+    "//skia/public/mojom",
     "//sql",
     "//storage/browser",
     "//storage/common",
@@ -199,6 +198,7 @@ jumbo_source_set("browser") {
     "//third_party/blink/public:scaled_resources",
     "//third_party/blink/public/common",
     "//third_party/blink/public/mojom:mojom_broadcastchannel_bindings",
+    "//third_party/blink/public/strings",
     "//third_party/boringssl",
     "//third_party/brotli:dec",
     "//third_party/icu",
@@ -502,6 +502,8 @@ jumbo_source_set("browser") {
     "background_sync/background_sync_proxy.h",
     "background_sync/background_sync_registration_helper.cc",
     "background_sync/background_sync_registration_helper.h",
+    "background_sync/background_sync_scheduler.cc",
+    "background_sync/background_sync_scheduler.h",
     "background_sync/background_sync_status.h",
     "background_sync/one_shot_background_sync_service_impl.cc",
     "background_sync/one_shot_background_sync_service_impl.h",
@@ -537,6 +539,7 @@ jumbo_source_set("browser") {
     "broadcast_channel/broadcast_channel_provider.h",
     "browser_child_process_host_impl.cc",
     "browser_child_process_host_impl.h",
+    "browser_child_process_host_impl_receiver_bindings.cc",
     "browser_context.cc",
     "browser_interface_binders.cc",
     "browser_interface_binders.h",
@@ -624,6 +627,7 @@ jumbo_source_set("browser") {
     "cache_storage/legacy/legacy_cache_storage_manager.cc",
     "cache_storage/legacy/legacy_cache_storage_manager.h",
     "cache_storage/scoped_writable_entry.h",
+    "can_commit_status.h",
     "child_process_launcher.cc",
     "child_process_launcher.h",
     "child_process_launcher_helper.cc",
@@ -678,10 +682,6 @@ jumbo_source_set("browser") {
     "devtools/devtools_agent_host_impl.h",
     "devtools/devtools_background_services_context_impl.cc",
     "devtools/devtools_background_services_context_impl.h",
-    "devtools/devtools_frame_metadata.cc",
-    "devtools/devtools_frame_metadata.h",
-    "devtools/devtools_frame_trace_recorder.cc",
-    "devtools/devtools_frame_trace_recorder.h",
     "devtools/devtools_http_handler.cc",
     "devtools/devtools_http_handler.h",
     "devtools/devtools_instrumentation.cc",
@@ -690,8 +690,6 @@ jumbo_source_set("browser") {
     "devtools/devtools_io_context.h",
     "devtools/devtools_manager.cc",
     "devtools/devtools_manager.h",
-    "devtools/devtools_network_interceptor.cc",
-    "devtools/devtools_network_interceptor.h",
     "devtools/devtools_pipe_handler.cc",
     "devtools/devtools_pipe_handler.h",
     "devtools/devtools_protocol_encoding.cc",
@@ -830,8 +828,6 @@ jumbo_source_set("browser") {
     "download/save_types.h",
     "field_trial_recorder.cc",
     "field_trial_recorder.h",
-    "file_url_loader_factory.cc",
-    "file_url_loader_factory.h",
     "fileapi/browser_file_system_helper.cc",
     "fileapi/browser_file_system_helper.h",
     "fileapi/file_system_manager_impl.cc",
@@ -845,8 +841,8 @@ jumbo_source_set("browser") {
     "font_list_async.cc",
     "frame_host/ancestor_throttle.cc",
     "frame_host/ancestor_throttle.h",
-    "frame_host/back_forward_cache.cc",
-    "frame_host/back_forward_cache.h",
+    "frame_host/back_forward_cache_impl.cc",
+    "frame_host/back_forward_cache_impl.h",
     "frame_host/back_forward_cache_metrics.cc",
     "frame_host/back_forward_cache_metrics.h",
     "frame_host/blocked_scheme_navigation_throttle.cc",
@@ -886,8 +882,6 @@ jumbo_source_set("browser") {
     "frame_host/navigation_controller_impl.h",
     "frame_host/navigation_entry_impl.cc",
     "frame_host/navigation_entry_impl.h",
-    "frame_host/navigation_handle_impl.cc",
-    "frame_host/navigation_handle_impl.h",
     "frame_host/navigation_request.cc",
     "frame_host/navigation_request.h",
     "frame_host/navigation_request_info.cc",
@@ -945,6 +939,8 @@ jumbo_source_set("browser") {
     "gpu/gpu_memory_buffer_manager_singleton.h",
     "gpu/gpu_process_host.cc",
     "gpu/gpu_process_host.h",
+    "gpu/peak_gpu_memory_tracker_impl.cc",
+    "gpu/peak_gpu_memory_tracker_impl.h",
     "gpu/shader_cache_factory.cc",
     "gpu/shader_cache_factory.h",
     "hid/hid_service.cc",
@@ -997,6 +993,8 @@ jumbo_source_set("browser") {
     "indexed_db/indexed_db_database_error.h",
     "indexed_db/indexed_db_dispatcher_host.cc",
     "indexed_db/indexed_db_dispatcher_host.h",
+    "indexed_db/indexed_db_execution_context_connection_tracker.cc",
+    "indexed_db/indexed_db_execution_context_connection_tracker.h",
     "indexed_db/indexed_db_factory.h",
     "indexed_db/indexed_db_factory_impl.cc",
     "indexed_db/indexed_db_factory_impl.h",
@@ -1087,10 +1085,10 @@ jumbo_source_set("browser") {
     "loader/cached_navigation_url_loader.h",
     "loader/cross_origin_read_blocking_checker.cc",
     "loader/cross_origin_read_blocking_checker.h",
-    "loader/data_pipe_to_source_stream.cc",
-    "loader/data_pipe_to_source_stream.h",
     "loader/download_utils_impl.cc",
     "loader/download_utils_impl.h",
+    "loader/file_url_loader_factory.cc",
+    "loader/file_url_loader_factory.h",
     "loader/merkle_integrity_source_stream.cc",
     "loader/merkle_integrity_source_stream.h",
     "loader/navigation_loader_interceptor.cc",
@@ -1109,8 +1107,6 @@ jumbo_source_set("browser") {
     "loader/shared_cors_origin_access_list_impl.h",
     "loader/single_request_url_loader_factory.cc",
     "loader/single_request_url_loader_factory.h",
-    "loader/source_stream_to_data_pipe.cc",
-    "loader/source_stream_to_data_pipe.h",
     "loader/webrtc_connections_observer.cc",
     "loader/webrtc_connections_observer.h",
     "locks/lock_manager.cc",
@@ -1178,6 +1174,8 @@ jumbo_source_set("browser") {
     "media/media_devices_util.h",
     "media/media_experiment_manager.cc",
     "media/media_experiment_manager.h",
+    "media/media_interface_factory_holder.cc",
+    "media/media_interface_factory_holder.h",
     "media/media_interface_proxy.cc",
     "media/media_interface_proxy.h",
     "media/media_internals.cc",
@@ -1548,6 +1546,7 @@ jumbo_source_set("browser") {
     "renderer_host/render_frame_metadata_provider_impl.h",
     "renderer_host/render_message_filter.cc",
     "renderer_host/render_message_filter.h",
+    "renderer_host/render_process_host_creation_observer.cc",
     "renderer_host/render_process_host_impl.cc",
     "renderer_host/render_process_host_impl.h",
     "renderer_host/render_view_host_delegate.cc",
@@ -1601,6 +1600,7 @@ jumbo_source_set("browser") {
     "resolve_proxy_msg_helper.h",
     "resource_context_impl.cc",
     "resource_context_impl.h",
+    "resource_coordinator_service.cc",
     "sandbox_host_linux.cc",
     "sandbox_host_linux.h",
     "sandbox_ipc_linux.cc",
@@ -1645,8 +1645,6 @@ jumbo_source_set("browser") {
     "screenlock_monitor/screenlock_monitor_device_source_win.cc",
     "screenlock_monitor/screenlock_monitor_source.cc",
     "screenlock_monitor/screenlock_monitor_source.h",
-    "service_manager/common_browser_interfaces.cc",
-    "service_manager/common_browser_interfaces.h",
     "service_manager/service_manager_context.cc",
     "service_manager/service_manager_context.h",
     "service_process_host_impl.cc",
@@ -1814,6 +1812,8 @@ jumbo_source_set("browser") {
     "tracing/background_tracing_rule.h",
     "tracing/file_tracing_provider_impl.cc",
     "tracing/file_tracing_provider_impl.h",
+    "tracing/memory_instrumentation_util.cc",
+    "tracing/memory_instrumentation_util.h",
     "tracing/perfetto_file_tracer.cc",
     "tracing/perfetto_file_tracer.h",
     "tracing/tracing_controller_impl.cc",
@@ -1855,12 +1855,18 @@ jumbo_source_set("browser") {
     "web_contents/web_drag_utils_win.h",
     "web_package/bundled_exchanges_handle.cc",
     "web_package/bundled_exchanges_handle.h",
+    "web_package/bundled_exchanges_handle_tracker.cc",
+    "web_package/bundled_exchanges_handle_tracker.h",
+    "web_package/bundled_exchanges_navigation_info.cc",
+    "web_package/bundled_exchanges_navigation_info.h",
     "web_package/bundled_exchanges_reader.cc",
     "web_package/bundled_exchanges_reader.h",
     "web_package/bundled_exchanges_source.cc",
     "web_package/bundled_exchanges_source.h",
     "web_package/bundled_exchanges_url_loader_factory.cc",
     "web_package/bundled_exchanges_url_loader_factory.h",
+    "web_package/bundled_exchanges_utils.cc",
+    "web_package/bundled_exchanges_utils.h",
     "web_package/prefetched_signed_exchange_cache.cc",
     "web_package/prefetched_signed_exchange_cache.h",
     "web_package/prefetched_signed_exchange_cache_adapter.cc",
@@ -1994,7 +2000,7 @@ jumbo_source_set("browser") {
     ]
   }
 
-  if (is_chromeos || is_android || is_chromecast) {
+  if (is_chromeos || is_android || is_chromecast || is_fuchsia) {
     defines += [ "ENABLE_PROTECTED_MEDIA_IDENTIFIER_PERMISSION" ]
   }
 
@@ -2066,8 +2072,7 @@ jumbo_source_set("browser") {
 
   # Desktop/Window/WebContents screen capture implementations, conditionally
   # built depending on the available implementations for each platform.
-  if (is_linux || is_mac || is_win) {
-    defines += [ "ENABLE_SCREEN_CAPTURE=1" ]
+  if (enable_screen_capture && !is_android) {
     sources += [
       "media/capture/desktop_capture_device.cc",
       "media/capture/desktop_capture_device.h",
@@ -2161,6 +2166,7 @@ jumbo_source_set("browser") {
       "plugin_service_impl.h",
       "ppapi_plugin_process_host.cc",
       "ppapi_plugin_process_host.h",
+      "ppapi_plugin_process_host_receiver_bindings.cc",
       "renderer_host/pepper/browser_ppapi_host_impl.cc",
       "renderer_host/pepper/browser_ppapi_host_impl.h",
       "renderer_host/pepper/content_browser_pepper_host_factory.cc",
@@ -2359,6 +2365,8 @@ jumbo_source_set("browser") {
       "android/web_contents_observer_proxy.h",
       "contacts/contacts_provider_android.cc",
       "contacts/contacts_provider_android.h",
+      "devtools/devtools_frame_trace_recorder.cc",
+      "devtools/devtools_frame_trace_recorder.h",
       "font_unique_name_lookup/font_unique_name_lookup.cc",
       "font_unique_name_lookup/font_unique_name_lookup.h",
       "font_unique_name_lookup/font_unique_name_lookup_service.cc",
@@ -2415,7 +2423,7 @@ jumbo_source_set("browser") {
       "//build/config/freetype",
       "//content/public/android:jni",
       "//device/gamepad/public/mojom",
-      "//gpu/ipc/common:android_texture_owner",
+      "//gpu/command_buffer/service:gles2",
       "//media",
       "//media/capture/content/android",
       "//media/capture/video/android",
@@ -2426,25 +2434,13 @@ jumbo_source_set("browser") {
       "//ui/android",
       "//ui/compositor",
       "//ui/compositor/host",
+      "//url:origin_android",
     ]
     if (enable_vulkan) {
       deps += [ "//gpu/vulkan/init" ]
     }
-    defines += [
-      "APPCACHE_USE_SIMPLE_CACHE",
-      "ENABLE_SCREEN_CAPTURE=1",
-    ]
+    defines += [ "APPCACHE_USE_SIMPLE_CACHE" ]
     libs += [ "jnigraphics" ]
-
-    if (notouch_build) {
-      # Similar to the bug below, there should be an API to let the embedder
-      # control this.
-      defines += [ "DISABLE_OVERSCROLL" ]
-    } else {
-      # TODO(crbug.com/986346): this define should not be required once debug URL
-      # triggering has been generalized.
-      defines += [ "ENABLE_ADDRESS_BAR" ]
-    }
   } else {
     # Not Android.
     sources += [
@@ -2461,8 +2457,6 @@ jumbo_source_set("browser") {
       "host_zoom_level_context.h",
       "host_zoom_map_impl.cc",
       "host_zoom_map_impl.h",
-      "host_zoom_map_observer.cc",
-      "host_zoom_map_observer.h",
 
       # The Serial API is not implemented on Android.
       "serial/serial_service.cc",
diff --git a/chromium/content/browser/DEPS b/chromium/content/browser/DEPS
index 4b372d3e098..98be8622960 100644
--- a/chromium/content/browser/DEPS
+++ b/chromium/content/browser/DEPS
@@ -17,6 +17,7 @@ include_rules = [
   "+components/services/leveldb",
   "+components/services/quarantine/test_support.h",
   "+components/services/quarantine/quarantine.h",
+  "+components/services/storage",
   "+components/session_manager/core",
   "+components/leveldb_proto/public",
   "+components/link_header_util",
@@ -110,32 +111,27 @@ include_rules = [
   "+third_party/blink/public/platform/web_screen_info.h",
   "+third_party/blink/public/platform/web_scroll_into_view_params.h",
   "+third_party/blink/public/platform/web_scroll_types.h",
-  "+third_party/blink/public/platform/web_security_style.h",
-  "+third_party/blink/public/platform/web_sudden_termination_disabler_type.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
   "+third_party/blink/public/platform/web_touch_event.h",
   "+third_party/blink/public/platform/web_text_input_type.h",
   "+third_party/blink/public/platform/mac/web_scrollbar_theme.h",
   "+third_party/blink/public/platform/modules/indexeddb/web_idb_database_exception.h",
-  "+third_party/blink/public/platform/modules/notifications/web_notification_constants.h",
   "+third_party/blink/public/platform/modules/service_worker/web_service_worker_error.h",
   "+third_party/blink/public/platform/modules/sms/sms_receiver.mojom.h",
   "+third_party/blink/public/public_buildflags.h",
+  "+third_party/blink/public/strings/grit/blink_strings.h",
   "+third_party/blink/public/web/web_ax_enums.h",
   "+third_party/blink/public/web/web_console_message.h",
   "+third_party/blink/public/web/web_context_menu_data.h",
   "+third_party/blink/public/web/web_device_emulation_params.h",
   "+third_party/blink/public/web/web_drag_status.h",
-  "+third_party/blink/public/web/web_fullscreen_options.h",
   "+third_party/blink/public/web/web_ime_text_span.h",
   "+third_party/blink/public/web/web_media_player_action.h",
-  "+third_party/blink/public/web/web_plugin_action.h",
   "+third_party/blink/public/web/web_serialized_script_value_version.h",
   "+third_party/blink/public/web/WebSharedWorkerCreationContextType.h",
   "+third_party/blink/public/web/WebSharedWorkerCreationErrors.h",
   "+third_party/blink/public/web/web_text_direction.h",
   "+third_party/blink/public/web/web_tree_scope_type.h",
-  "+third_party/blink/public/web/web_triggering_event_info.h",
 
   # DO NOT ADD ANY CHROME OR COMPONENTS INCLUDES HERE!!!
   # See https://sites.google.com/a/chromium.org/dev/developers/content-module
diff --git a/chromium/content/browser/OWNERS b/chromium/content/browser/OWNERS
index 71b938b1a13..2ab92541724 100644
--- a/chromium/content/browser/OWNERS
+++ b/chromium/content/browser/OWNERS
@@ -20,6 +20,10 @@ per-file child_process_security_policy_unittest.cc=mkwst@chromium.org
 per-file child_process_security_policy_unittest.cc=tsepez@chromium.org
 per-file browser_interface_binders.cc=set noparent
 per-file browser_interface_binders.cc=file://ipc/SECURITY_OWNERS
+per-file ppapi_plugin_process_host_receiver_bindings.cc=set noparent
+per-file ppapi_plugin_process_host_receiver_bindings.cc=file://ipc/SECURITY_OWNERS
+per-file browser_child_process_host_impl_receiver_bindings.cc=set noparent
+per-file browser_child_process_host_impl_receiver_bindings.cc=file://ipc/SECURITY_OWNERS
 
 per-file host_zoom_*=wjmaclean@chromium.org
 per-file find_request_manager*=paulmeyer@chromium.org
diff --git a/chromium/content/browser/about_url_loader_factory.cc b/chromium/content/browser/about_url_loader_factory.cc
index ed65bb574c1..d78311dc842 100644
--- a/chromium/content/browser/about_url_loader_factory.cc
+++ b/chromium/content/browser/about_url_loader_factory.cc
@@ -39,8 +39,8 @@ void AboutURLLoaderFactory::CreateLoaderAndStart(
 }
 
 void AboutURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest loader) {
-  bindings_.AddBinding(this, std::move(loader));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) {
+  receivers_.Add(this, std::move(loader));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/about_url_loader_factory.h b/chromium/content/browser/about_url_loader_factory.h
index 3b20b1ae5fd..68ab970fee4 100644
--- a/chromium/content/browser/about_url_loader_factory.h
+++ b/chromium/content/browser/about_url_loader_factory.h
@@ -6,7 +6,8 @@
 #define CONTENT_BROWSER_ABOUT_URL_LOADER_FACTORY_H_
 
 #include "base/macros.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace content {
@@ -29,9 +30,10 @@ class AboutURLLoaderFactory : public network::mojom::URLLoaderFactory {
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest loader) override;
+  void Clone(
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) override;
 
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   DISALLOW_COPY_AND_ASSIGN(AboutURLLoaderFactory);
 };
diff --git a/chromium/content/browser/accessibility/accessibility_action_browsertest.cc b/chromium/content/browser/accessibility/accessibility_action_browsertest.cc
index 65fe91d8cdd..dcc47de22f4 100644
--- a/chromium/content/browser/accessibility/accessibility_action_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_action_browsertest.cc
@@ -15,6 +15,7 @@
 #include "content/shell/browser/shell.h"
 #include "net/base/data_url.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "ui/accessibility/ax_enums.mojom.h"
 #include "ui/gfx/codec/png_codec.h"
 #include "url/gurl.h"
 
@@ -418,7 +419,8 @@ IN_PROC_BROWSER_TEST_F(AccessibilityActionBrowserTest, TextareaSetValue) {
   // We should do it with accessibility flags instead. http://crbug.com/672205
 #if !defined(OS_ANDROID)
   // Check that it really does contain two lines.
-  auto start_pos = target->CreatePositionAt(0);
+  auto start_pos =
+      target->CreatePositionAt(0, ax::mojom::TextAffinity::kDownstream);
   auto end_of_line_1 = start_pos->CreateNextLineEndPosition(
       ui::AXBoundaryBehavior::CrossBoundary);
   EXPECT_EQ(5, end_of_line_1->text_offset());
@@ -452,7 +454,8 @@ IN_PROC_BROWSER_TEST_F(AccessibilityActionBrowserTest,
   // We should do it with accessibility flags instead. http://crbug.com/672205
 #if !defined(OS_ANDROID)
   // Check that it really does contain two lines.
-  auto start_pos = target->CreatePositionAt(0);
+  auto start_pos =
+      target->CreatePositionAt(0, ax::mojom::TextAffinity::kDownstream);
   auto end_of_line_1 = start_pos->CreateNextLineEndPosition(
       ui::AXBoundaryBehavior::CrossBoundary);
   EXPECT_EQ(5, end_of_line_1->text_offset());
diff --git a/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc b/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc
index 98ff8df18bf..91b350046b9 100644
--- a/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_auralinux_browsertest.cc
@@ -824,6 +824,90 @@ IN_PROC_BROWSER_TEST_F(AccessibilityAuraLinuxBrowserTest,
   g_object_unref(div);
 }
 
+IN_PROC_BROWSER_TEST_F(AccessibilityAuraLinuxBrowserTest,
+                       TestTextSelectionAcrossElements) {
+  LoadInitialAccessibilityTreeFromHtml(std::string(
+      R"HTML(<!DOCTYPE html>
+          <html>
+          <body>
+            <div id="parent" contenteditable="true">
+              <div id="child1">Child 1</div>
+              <div id="child2">Child 2</div>
+            </div>
+          </body>
+          </html>)HTML"));
+
+  AtkObject* document = GetRendererAccessible();
+  EXPECT_EQ(1, atk_object_get_n_accessible_children(document));
+
+  AtkText* parent = ATK_TEXT(atk_object_ref_accessible_child(document, 0));
+  EXPECT_EQ(2, atk_object_get_n_accessible_children(ATK_OBJECT(parent)));
+  AtkText* child1 =
+      ATK_TEXT(atk_object_ref_accessible_child(ATK_OBJECT(parent), 0));
+  AtkText* child2 =
+      ATK_TEXT(atk_object_ref_accessible_child(ATK_OBJECT(parent), 1));
+  EXPECT_NE(nullptr, child1);
+  EXPECT_NE(nullptr, child2);
+
+  auto callback = G_CALLBACK(+[](AtkText*, bool* flag) { *flag = true; });
+  bool saw_selection_change_in_parent = false;
+  g_signal_connect(parent, "text-selection-changed", callback,
+                   &saw_selection_change_in_parent);
+  bool saw_selection_change_in_child1 = false;
+  g_signal_connect(child1, "text-selection-changed", callback,
+                   &saw_selection_change_in_child1);
+  bool saw_selection_change_in_child2 = false;
+  g_signal_connect(child2, "text-selection-changed", callback,
+                   &saw_selection_change_in_child2);
+
+  AccessibilityNotificationWaiter selection_waiter(
+      shell()->web_contents(), ui::kAXModeComplete,
+      ax::mojom::Event::kTextSelectionChanged);
+  ExecuteScript(
+      base::UTF8ToUTF16("let parent = document.getElementById('parent');"
+                        "let child1 = document.getElementById('child1');"
+                        "let child2 = document.getElementById('child2');"
+                        "let range = document.createRange();"
+                        "range.setStart(child1.firstChild, 3);"
+                        "range.setEnd(child1.firstChild, 5);"
+                        "parent.focus();"
+                        "document.getSelection().removeAllRanges();"
+                        "document.getSelection().addRange(range);"));
+  selection_waiter.WaitForNotification();
+
+  EXPECT_FALSE(saw_selection_change_in_parent);
+  EXPECT_TRUE(saw_selection_change_in_child1);
+  EXPECT_FALSE(saw_selection_change_in_child2);
+
+  saw_selection_change_in_parent = false;
+  saw_selection_change_in_child1 = false;
+  saw_selection_change_in_child2 = false;
+
+  EXPECT_TRUE(atk_text_remove_selection(parent, 0));
+  selection_waiter.WaitForNotification();
+
+  EXPECT_FALSE(saw_selection_change_in_parent);
+  EXPECT_TRUE(saw_selection_change_in_child1);
+  EXPECT_FALSE(saw_selection_change_in_child2);
+
+  saw_selection_change_in_parent = false;
+  saw_selection_change_in_child1 = false;
+  saw_selection_change_in_child2 = false;
+
+  ExecuteScript(
+      base::UTF8ToUTF16("let range2 = document.createRange();"
+                        "range2.setStart(child1.firstChild, 0);"
+                        "range2.setEnd(child2.firstChild, 3);"
+                        "parent.focus();"
+                        "document.getSelection().removeAllRanges();"
+                        "document.getSelection().addRange(range2);"));
+  selection_waiter.WaitForNotification();
+
+  EXPECT_TRUE(saw_selection_change_in_parent);
+  EXPECT_FALSE(saw_selection_change_in_child1);
+  EXPECT_FALSE(saw_selection_change_in_child2);
+}
+
 // TODO(crbug.com/981913): This flakes on linux.
 IN_PROC_BROWSER_TEST_F(
     AccessibilityAuraLinuxBrowserTest,
@@ -982,6 +1066,8 @@ IN_PROC_BROWSER_TEST_F(AccessibilityAuraLinuxBrowserTest,
   saw_caret_move_in_div = false;
 
   atk_text_set_caret_offset(anonymous_block, 3);
+  selection_waiter.WaitForNotification();
+
   EXPECT_FALSE(saw_caret_move_in_div);
   EXPECT_FALSE(saw_caret_move_in_text);
   EXPECT_FALSE(saw_caret_move_in_anonymous_block);
diff --git a/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc b/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc
index 807203b961d..2062bd20a02 100644
--- a/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc
+++ b/chromium/content/browser/accessibility/accessibility_event_recorder_auralinux.cc
@@ -63,7 +63,7 @@ class AccessibilityEventRecorderAuraLinux : public AccessibilityEventRecorder {
   AtspiEventListener* atspi_event_listener_ = nullptr;
   base::ProcessId pid_;
   base::StringPiece application_name_match_pattern_;
-  std::vector<unsigned int> atk_listener_ids_;
+  static std::vector<unsigned int> atk_listener_ids_;
   static AccessibilityEventRecorderAuraLinux* instance_;
 
   DISALLOW_COPY_AND_ASSIGN(AccessibilityEventRecorderAuraLinux);
@@ -72,6 +72,9 @@ class AccessibilityEventRecorderAuraLinux : public AccessibilityEventRecorder {
 // static
 AccessibilityEventRecorderAuraLinux*
     AccessibilityEventRecorderAuraLinux::instance_ = nullptr;
+std::vector<unsigned int>
+    content::AccessibilityEventRecorderAuraLinux::atk_listener_ids_ =
+        std::vector<unsigned int>();
 
 // static
 gboolean AccessibilityEventRecorderAuraLinux::OnATKEventReceived(
@@ -146,6 +149,8 @@ void AccessibilityEventRecorderAuraLinux::AddATKEventListener(
 }
 
 void AccessibilityEventRecorderAuraLinux::AddATKEventListeners() {
+  if (atk_listener_ids_.size() >= 1)
+    return;
   GObject* gobject = G_OBJECT(g_object_new(G_TYPE_OBJECT, nullptr, nullptr));
   g_object_unref(atk_no_op_object_new(gobject));
   g_object_unref(gobject);
@@ -222,12 +227,15 @@ void AccessibilityEventRecorderAuraLinux::ProcessATKEvent(
           base::NumberToString(g_value_get_double(&property_values->new_value));
     } else if (g_strcmp0(property_values->property_name, "accessible-name") ==
                0) {
+      const char* new_name = g_value_get_string(&property_values->new_value);
       log += "NAME-CHANGED:";
-      log += g_value_get_string(&property_values->new_value);
+      log += (new_name) ? new_name : "(null)";
     } else if (g_strcmp0(property_values->property_name,
                          "accessible-description") == 0) {
+      const char* new_description =
+          g_value_get_string(&property_values->new_value);
       log += "DESCRIPTION-CHANGED:";
-      log += g_value_get_string(&property_values->new_value);
+      log += (new_description) ? new_description : "(null)";
     } else {
       return;
     }
diff --git a/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc b/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc
index 27a2c8af027..5b946a0e6eb 100644
--- a/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc
+++ b/chromium/content/browser/accessibility/accessibility_event_recorder_uia_win.cc
@@ -13,6 +13,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/win/scoped_bstr.h"
 #include "base/win/scoped_com_initializer.h"
+#include "base/win/scoped_safearray.h"
 #include "base/win/scoped_variant.h"
 #include "base/win/windows_version.h"
 #include "content/browser/accessibility/accessibility_tree_formatter_utils_win.h"
@@ -301,14 +302,14 @@ AccessibilityEventRecorderUia::Thread::EventHandler::HandleFocusChangedEvent(
   if (!owner_)
     return S_OK;
 
-  base::win::ScopedBstr id;
-  sender->get_CurrentAutomationId(id.Receive());
-  base::win::ScopedVariant id_variant(id, id.Length());
+  base::win::ScopedSafearray id;
+  sender->GetRuntimeId(id.Receive());
+  base::win::ScopedVariant id_variant(id.Release());
 
   Microsoft::WRL::ComPtr<IUIAutomationElement> element_found;
   Microsoft::WRL::ComPtr<IUIAutomationCondition> condition;
 
-  owner_->uia_->CreatePropertyCondition(UIA_AutomationIdPropertyId, id_variant,
+  owner_->uia_->CreatePropertyCondition(UIA_RuntimeIdPropertyId, id_variant,
                                         &condition);
   CHECK(condition);
   root_->FindFirst(TreeScope::TreeScope_Subtree, condition.Get(),
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc
index 8663927c2e0..6cc514dd1c1 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_auralinux.cc
@@ -55,6 +55,7 @@ class AccessibilityTreeFormatterAuraLinux
   std::unique_ptr<base::DictionaryValue> BuildAccessibilityTreeWithNode(
       AtspiAccessible* node);
 
+  void AddTextProperties(AtkText* atk_text, base::DictionaryValue* dict);
   void AddValueProperties(AtkObject* atk_object, base::DictionaryValue* dict);
   void AddTableProperties(AtkObject* atk_object, base::DictionaryValue* dict);
   void AddTableCellProperties(const ui::AXPlatformNodeAuraLinux* node,
@@ -322,9 +323,56 @@ const char* const kRoleNames[] = {
     "math root",
     "subscript",
     "superscript",
-    "footnote",  // ATK_ROLE_FOOTNOTE = 122.
+    "footnote",           // ATK_ROLE_FOOTNOTE = 122.
+    "content deletion",   // ATK_ROLE_CONTENT_DELETION = 123.
+    "content insertion",  // ATK_ROLE_CONTENT_DELETION = 124.
 };
 
+void AccessibilityTreeFormatterAuraLinux::AddTextProperties(
+    AtkText* atk_text,
+    base::DictionaryValue* dict) {
+  auto text_values = std::make_unique<base::ListValue>();
+  int character_count = atk_text_get_character_count(atk_text);
+  text_values->AppendString(
+      base::StringPrintf("character_count=%i", character_count));
+
+  int caret_offset = atk_text_get_caret_offset(atk_text);
+  if (caret_offset != -1)
+    text_values->AppendString(
+        base::StringPrintf("caret_offset=%i", caret_offset));
+
+  int selection_start, selection_end;
+  char* selection_text =
+      atk_text_get_selection(atk_text, 0, &selection_start, &selection_end);
+  g_free(selection_text);
+  if (selection_start || selection_end) {
+    text_values->AppendString(
+        base::StringPrintf("selection_start=%i", selection_start));
+    text_values->AppendString(
+        base::StringPrintf("selection_end=%i", selection_end));
+  }
+
+  auto add_attribute_set_values = [](gpointer value, gpointer list) {
+    const AtkAttribute* attribute = static_cast<const AtkAttribute*>(value);
+    static_cast<base::ListValue*>(list)->AppendString(
+        base::StringPrintf("%s=%s", attribute->name, attribute->value));
+  };
+
+  int current_offset = 0, start_offset, end_offset;
+  while (current_offset < character_count) {
+    AtkAttributeSet* text_attributes = atk_text_get_run_attributes(
+        atk_text, current_offset, &start_offset, &end_offset);
+    text_values->AppendString(base::StringPrintf("offset=%i", start_offset));
+    g_slist_foreach(text_attributes, add_attribute_set_values,
+                    text_values.get());
+    atk_attribute_set_free(text_attributes);
+
+    current_offset = end_offset;
+  }
+
+  dict->Set("text", std::move(text_values));
+}
+
 void AccessibilityTreeFormatterAuraLinux::AddValueProperties(
     AtkObject* atk_object,
     base::DictionaryValue* dict) {
@@ -530,7 +578,7 @@ void AccessibilityTreeFormatterAuraLinux::AddProperties(
   }
   atk_attribute_set_free(attributes);
 
-  // Properties obtained via AtkValue.
+  AddTextProperties(ATK_TEXT(atk_object), dict);
   AddValueProperties(atk_object, dict);
   AddTableProperties(atk_object, dict);
   AddTableCellProperties(ax_platform_node, atk_object, dict);
@@ -601,8 +649,8 @@ const char* const ATK_OBJECT_ATTRIBUTES[] = {
     "container-live",
     "container-relevant",
     "current",
-    "dropeffect",
     "display",
+    "dropeffect",
     "explicit-name",
     "grabbed",
     "haspopup",
@@ -717,6 +765,15 @@ base::string16 AccessibilityTreeFormatterAuraLinux::ProcessTreeForOutput(
     }
   }
 
+  const base::ListValue* text_info;
+  if (node.GetList("text", &text_info)) {
+    for (auto it = text_info->begin(); it != text_info->end(); ++it) {
+      std::string cell_property;
+      if (it->GetAsString(&cell_property))
+        WriteAttribute(false, cell_property, &line);
+    }
+  }
+
   return line;
 }
 
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc
index 2acd70755d1..150cc775cad 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.cc
@@ -42,16 +42,14 @@ AccessibilityTreeFormatter::TestPass AccessibilityTreeFormatter::GetTestPass(
 
 base::string16 AccessibilityTreeFormatter::DumpAccessibilityTreeFromManager(
     BrowserAccessibilityManager* ax_mgr,
-    bool internal) {
+    bool internal,
+    std::vector<PropertyFilter> property_filters) {
   std::unique_ptr<AccessibilityTreeFormatter> formatter;
   if (internal)
     formatter = std::make_unique<AccessibilityTreeFormatterBlink>();
   else
     formatter = Create();
   base::string16 accessibility_contents_utf16;
-  std::vector<PropertyFilter> property_filters;
-  property_filters.push_back(
-      PropertyFilter(base::ASCIIToUTF16("*"), PropertyFilter::ALLOW));
   formatter->SetPropertyFilters(property_filters);
   formatter->FormatAccessibilityTree(ax_mgr->GetRoot(),
                                      &accessibility_contents_utf16);
diff --git a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h
index 5e78defa6c1..fc779030b74 100644
--- a/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h
+++ b/chromium/content/browser/accessibility/accessibility_tree_formatter_base.h
@@ -34,7 +34,7 @@ namespace content {
 class CONTENT_EXPORT AccessibilityTreeFormatterBase
     : public AccessibilityTreeFormatter {
  public:
-  explicit AccessibilityTreeFormatterBase();
+  AccessibilityTreeFormatterBase();
   ~AccessibilityTreeFormatterBase() override;
 
   // AccessibilityTreeFormatter overrides.
diff --git a/chromium/content/browser/accessibility/accessibility_win_browsertest.cc b/chromium/content/browser/accessibility/accessibility_win_browsertest.cc
index 62580ccf9f3..ecea63e3042 100644
--- a/chromium/content/browser/accessibility/accessibility_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/accessibility_win_browsertest.cc
@@ -3520,6 +3520,53 @@ IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest, TestAccNavigateInTables) {
   accessible_cell.Reset();
 }
 
+IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest, TestTreegridIsIATable) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  AccessibilityNotificationWaiter waiter(shell()->web_contents(),
+                                         ui::kAXModeComplete,
+                                         ax::mojom::Event::kLoadComplete);
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(
+                                 "/accessibility/aria/aria-treegrid.html")));
+  waiter.WaitForNotification();
+
+  Microsoft::WRL::ComPtr<IAccessible> document(GetRendererAccessible());
+  std::vector<base::win::ScopedVariant> document_children =
+      GetAllAccessibleChildren(document.Get());
+  // There are two treegrids in this test file. Use only the first one.
+  ASSERT_EQ(2u, document_children.size());
+
+  Microsoft::WRL::ComPtr<IAccessible2> table;
+  ASSERT_HRESULT_SUCCEEDED(QueryIAccessible2(
+      GetAccessibleFromVariant(document.Get(), document_children[0].AsInput())
+          .Get(),
+      &table));
+  LONG role = 0;
+  ASSERT_HRESULT_SUCCEEDED(table->role(&role));
+  ASSERT_EQ(ROLE_SYSTEM_OUTLINE, role);
+
+  // Retrieve the first cell.
+  Microsoft::WRL::ComPtr<IAccessibleTable2> table2;
+  Microsoft::WRL::ComPtr<IUnknown> cell;
+  Microsoft::WRL::ComPtr<IAccessible2> cell1;
+  EXPECT_HRESULT_SUCCEEDED(table.CopyTo(IID_PPV_ARGS(&table2)));
+  EXPECT_HRESULT_SUCCEEDED(table2->get_cellAt(0, 0, &cell));
+  EXPECT_HRESULT_SUCCEEDED(cell.CopyTo(IID_PPV_ARGS(&cell1)));
+
+  base::win::ScopedVariant childid_self(CHILDID_SELF);
+  Microsoft::WRL::ComPtr<IAccessibleTableCell> accessible_cell;
+  LONG row_index = -1;
+  LONG column_index = -1;
+  EXPECT_HRESULT_SUCCEEDED(cell1->role(&role));
+  EXPECT_EQ(ROLE_SYSTEM_CELL, role);
+  EXPECT_HRESULT_SUCCEEDED(cell1.CopyTo(IID_PPV_ARGS(&accessible_cell)));
+  EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_rowIndex(&row_index));
+  EXPECT_HRESULT_SUCCEEDED(accessible_cell->get_columnIndex(&column_index));
+  EXPECT_EQ(0, row_index);
+  EXPECT_EQ(0, column_index);
+  accessible_cell.Reset();
+}
+
 IN_PROC_BROWSER_TEST_F(AccessibilityWinBrowserTest, TestScrollTo) {
   LoadInitialAccessibilityTreeFromHtml(
       R"HTML(<!DOCTYPE html>
diff --git a/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc b/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc
index 33b5ff0abe1..248811936ab 100644
--- a/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/ax_platform_node_textprovider_win_browsertest.cc
@@ -54,7 +54,7 @@ class AXPlatformNodeTextProviderWinBrowserTest : public ContentBrowserTest {
     AccessibilityNotificationWaiter waiter(shell()->web_contents(),
                                            accessibility_mode,
                                            ax::mojom::Event::kLoadComplete);
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     waiter.WaitForNotification();
   }
 
diff --git a/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc b/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
index 565ccbc59fb..c1a71df4e66 100644
--- a/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
+++ b/chromium/content/browser/accessibility/ax_platform_node_textrangeprovider_win_browsertest.cc
@@ -382,6 +382,51 @@ class AXPlatformNodeTextRangeProviderWinBrowserTest
 };
 
 IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
+                       GetAttributeValue) {
+  LoadInitialAccessibilityTreeFromHtml(std::string(R"HTML(
+      <!DOCTYPE html>
+      <html>
+        <body>
+          <div style="font-size: 16px">
+            <span style="font-size: 12px">Text1</span>
+            Text2
+          </div>
+        </body>
+      </html>
+  )HTML"));
+
+  ComPtr<IUnknown> mix_attribute_value;
+  EXPECT_HRESULT_SUCCEEDED(
+      UiaGetReservedMixedAttributeValue(&mix_attribute_value));
+
+  auto* node = FindNode(ax::mojom::Role::kStaticText, "Text1");
+  ASSERT_NE(nullptr, node);
+  EXPECT_TRUE(node->PlatformIsLeaf());
+  EXPECT_EQ(0u, node->PlatformChildCount());
+
+  ComPtr<ITextRangeProvider> text_range_provider;
+  GetTextRangeProviderFromTextNode(*node, &text_range_provider);
+  ASSERT_NE(nullptr, text_range_provider.Get());
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"Text1");
+
+  base::win::ScopedVariant value;
+  EXPECT_HRESULT_SUCCEEDED(text_range_provider->GetAttributeValue(
+      UIA_FontSizeAttributeId, value.Receive()));
+  EXPECT_EQ(value.type(), VT_R8);
+  EXPECT_EQ(V_R8(value.ptr()), 12.0);
+
+  EXPECT_HRESULT_SUCCEEDED(
+      text_range_provider->ExpandToEnclosingUnit(TextUnit_Paragraph));
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"Text1 Text2");
+
+  EXPECT_HRESULT_SUCCEEDED(text_range_provider->GetAttributeValue(
+      UIA_FontSizeAttributeId, value.Receive()));
+  EXPECT_EQ(value.type(), VT_UNKNOWN);
+  EXPECT_EQ(V_UNKNOWN(value.ptr()), mix_attribute_value.Get())
+      << "expected 'mixed attribute value' interface pointer";
+}
+
+IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
                        GetBoundingRectangles) {
   LoadInitialAccessibilityTreeFromHtml(std::string(R"HTML(
       <!DOCTYPE html>
@@ -878,7 +923,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
       /*count*/ 1,
-      /*expected_text*/ (paragraphs[1] + paragraphs[2]).c_str(),
+      /*expected_text*/ (paragraphs[1] + L"\n" + paragraphs[2]).c_str(),
       /*expected_count*/ 1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_Start, TextUnit_Paragraph,
@@ -888,7 +933,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
       /*count*/ 1,
-      /*expected_text*/ (paragraphs[2] + paragraphs[3]).c_str(),
+      /*expected_text*/ (paragraphs[2] + L"\n" + paragraphs[3]).c_str(),
       /*expected_count*/ 1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_Start, TextUnit_Paragraph,
@@ -949,7 +994,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_Start, TextUnit_Paragraph,
       /*count*/ -1,
-      /*expected_text*/ (paragraphs[2] + paragraphs[3]).c_str(),
+      /*expected_text*/ (paragraphs[2] + L"\n" + paragraphs[3]).c_str(),
       /*expected_count*/ -1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
@@ -959,7 +1004,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_Start, TextUnit_Paragraph,
       /*count*/ -1,
-      /*expected_text*/ (paragraphs[1] + paragraphs[2]).c_str(),
+      /*expected_text*/ (paragraphs[1] + L"\n" + paragraphs[2]).c_str(),
       /*expected_count*/ -1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
@@ -1094,6 +1139,89 @@ IN_PROC_BROWSER_TEST_F(
       /*expected_count*/ -1);
 }
 
+IN_PROC_BROWSER_TEST_F(
+    AXPlatformNodeTextRangeProviderWinBrowserTest,
+    MoveEndpointByUnitParagraphCollapseConsecutiveParentChildLineBreakingObjects) {
+  LoadInitialAccessibilityTreeFromHtml(
+      R"HTML(<!DOCTYPE html>
+      <html>
+      <head>
+        <style>
+          div {
+            width: 100px;
+          }
+
+          code::before {
+            content: "[";
+          }
+
+          code::after {
+            content: "]";
+          }
+
+          /* This will create an empty anonymous layout block before the <b>
+             element. */
+          b::before {
+            content: "";
+            display: block;
+          }
+        </style>
+      </head>
+
+      <body>
+        <div>start</div>
+        <div>
+          text with <code>:before</code>
+          and <code>:after</code> content,
+          then a
+          <div>
+            <b>bold</b> element
+          </div>
+        </div>
+      </body>
+      </html>)HTML");
+  BrowserAccessibility* start_node =
+      FindNode(ax::mojom::Role::kStaticText, "start");
+  ASSERT_NE(nullptr, start_node);
+
+  std::vector<base::string16> paragraphs = {
+      L"start",
+      L"text with [:before] and [:after]content, then a",
+      L"bold element",
+  };
+
+  // Forward navigation.
+  ComPtr<ITextRangeProvider> text_range_provider;
+  GetTextRangeProviderFromTextNode(*start_node, &text_range_provider);
+  ASSERT_NE(nullptr, text_range_provider.Get());
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"start");
+
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
+      text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
+      /*count*/ 1,
+      /*expected_text*/ (paragraphs[0] + L"\n" + paragraphs[1]).c_str(),
+      /*expected_count*/ 1);
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
+      text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
+      /*count*/ 1,
+      /*expected_text*/
+      (paragraphs[0] + L"\n" + paragraphs[1] + L"\n" + paragraphs[2]).c_str(),
+      /*expected_count*/ 1);
+
+  // Reverse navigation.
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
+      text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
+      /*count*/ -1,
+      /*expected_text*/ (paragraphs[0] + L"\n" + paragraphs[1]).c_str(),
+      /*expected_count*/ -1);
+
+  EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
+      text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Paragraph,
+      /*count*/ -1,
+      /*expected_text*/ paragraphs[0].c_str(),
+      /*expected_count*/ -1);
+}
+
 IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
                        MoveEndpointByUnitParagraphPreservedWhiteSpace) {
   LoadInitialAccessibilityTreeFromHtml(
@@ -1409,7 +1537,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
                                    /*expected_count*/ -1);
 
   text_range_provider->ExpandToEnclosingUnit(TextUnit_Line);
-  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"Text in iframe\n");
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"Text in iframe");
 
   text_range_provider->ExpandToEnclosingUnit(TextUnit_Document);
   EXPECT_UIA_TEXTRANGE_EQ(text_range_provider,
@@ -1421,7 +1549,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
                   /*expected_count*/ 2);
   EXPECT_UIA_MOVE(text_range_provider, TextUnit_Word,
                   /*count*/ -1,
-                  /*expected_text*/ L"frame\n",
+                  /*expected_text*/ L"frame",
                   /*expected_count*/ -1);
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Character,
@@ -1575,7 +1703,7 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
 
   ASSERT_HRESULT_SUCCEEDED(
       text_range_provider->ExpandToEnclosingUnit(TextUnit_Format));
-  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"plain\ntext\n");
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"plain\ntext");
 
   EXPECT_UIA_MOVE_ENDPOINT_BY_UNIT(
       text_range_provider, TextPatternRangeEndpoint_End, TextUnit_Character,
@@ -1609,9 +1737,14 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
 
   AssertMoveByUnitForMarkup(TextUnit_Word,
                             "a <a>link with multiple words</a> and text after.",
-                            {L"a ", L"link ", L"with ", L"multiple ", L"words ",
+                            {L"a ", L"link ", L"with ", L"multiple ", L"words",
                              L"and ", L"text ", L"after."});
 
+  AssertMoveByUnitForMarkup(TextUnit_Word,
+                            "a <span aria-hidden='true'>span with ignored "
+                            "text</span> and text after.",
+                            {L"a ", L"and ", L"text ", L"after."});
+
   // AssertMoveByUnitForMarkup(
   //     TextUnit_Word, "<ul><li>item one</li><li>item two</li></ul>",
   //     {L"* ", L"item ", L"one\n", L"* ", L"item ", L"two"});
@@ -1675,4 +1808,56 @@ IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
       {L"before ", L"bold text", L"italic text", L" after"});
 }
 
+IN_PROC_BROWSER_TEST_F(AXPlatformNodeTextRangeProviderWinBrowserTest,
+                       BoundingRectangleOfWordBeforeListItemMarker) {
+  LoadInitialAccessibilityTreeFromHtml(
+      R"HTML(<!DOCTYPE html>
+      <html>
+        <body>
+          <p>Text before list</p>
+          <ul>
+            <li>First list item</li>
+            <li>Second list item</li>
+          </ul>
+        </body>
+      </html>)HTML");
+
+  BrowserAccessibility* text_before_list =
+      FindNode(ax::mojom::Role::kStaticText, "Text before list");
+  ASSERT_NE(nullptr, text_before_list);
+
+  ComPtr<ITextRangeProvider> text_range_provider;
+  GetTextRangeProviderFromTextNode(*text_before_list, &text_range_provider);
+  ASSERT_NE(nullptr, text_range_provider.Get());
+
+  EXPECT_UIA_MOVE(text_range_provider, TextUnit_Character,
+                  /*count*/ 12,
+                  /*expected_text*/ L"l",
+                  /*expected_count*/ 12);
+  text_range_provider->ExpandToEnclosingUnit(TextUnit_Word);
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"list");
+
+  base::win::ScopedSafearray rectangles;
+  ASSERT_HRESULT_SUCCEEDED(
+      text_range_provider->GetBoundingRectangles(rectangles.Receive()));
+
+  gfx::Vector2d view_offset =
+      text_before_list->manager()->GetViewBounds().OffsetFromOrigin();
+  std::vector<double> expected_values = {85 + view_offset.x(),
+                                         16 + view_offset.y(), 20, 17};
+  EXPECT_UIA_DOUBLE_SAFEARRAY_EQ(rectangles.Get(), expected_values);
+
+  EXPECT_UIA_MOVE(text_range_provider, TextUnit_Character,
+                  /*count*/ 17,
+                  /*expected_text*/ L"e",
+                  /*expected_count*/ 17);
+  text_range_provider->ExpandToEnclosingUnit(TextUnit_Word);
+  EXPECT_UIA_TEXTRANGE_EQ(text_range_provider, L"item");
+
+  ASSERT_HRESULT_SUCCEEDED(
+      text_range_provider->GetBoundingRectangles(rectangles.Receive()));
+  expected_values = {105 + view_offset.x(), 50 + view_offset.y(), 28, 17};
+  EXPECT_UIA_DOUBLE_SAFEARRAY_EQ(rectangles.Get(), expected_values);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility.cc b/chromium/content/browser/accessibility/browser_accessibility.cc
index 03a00a2c5f3..57b818bd741 100644
--- a/chromium/content/browser/accessibility/browser_accessibility.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility.cc
@@ -13,11 +13,12 @@
 #include "base/no_destructor.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
-#include "content/app/strings/grit/content_strings.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
 #include "content/common/accessibility_messages.h"
 #include "content/public/common/content_client.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
+#include "ui/accessibility/ax_enums.mojom.h"
 #include "ui/accessibility/ax_node_position.h"
 #include "ui/accessibility/ax_role_properties.h"
 #include "ui/accessibility/ax_tree_id.h"
@@ -139,6 +140,12 @@ bool BrowserAccessibility::CanFireEvents() const {
   return !PlatformIsChildOfLeafIncludingIgnored();
 }
 
+ui::AXPlatformNode* BrowserAccessibility::GetAXPlatformNode() const {
+  // Not all BrowserAccessibility subclasses can return an AXPlatformNode yet.
+  // So, here we just return nullptr.
+  return nullptr;
+}
+
 uint32_t BrowserAccessibility::PlatformChildCount() const {
   if (HasStringAttribute(ax::mojom::StringAttribute::kChildTreeId)) {
     if (PlatformGetRootOfChildTree())
@@ -1181,7 +1188,8 @@ BrowserAccessibility::CreatePositionAt(int offset,
 BrowserAccessibilityPosition::AXPositionInstance
 BrowserAccessibility::CreatePositionForSelectionAt(int offset) const {
   BrowserAccessibilityPositionInstance position =
-      CreatePositionAt(offset)->AsLeafTextPosition();
+      CreatePositionAt(offset, ax::mojom::TextAffinity::kDownstream)
+          ->AsLeafTextPosition();
   if (position->GetAnchor() &&
       position->GetAnchor()->GetRole() == ax::mojom::Role::kInlineTextBox) {
     return position->CreateParentPosition();
@@ -1597,9 +1605,26 @@ gfx::NativeViewAccessible BrowserAccessibility::GetFocus() {
 }
 
 ui::AXPlatformNode* BrowserAccessibility::GetFromNodeID(int32_t id) {
-  // Not all BrowserAccessibility subclasses can return an AXPlatformNode yet.
-  // So, here we just return nullptr.
-  return nullptr;
+  BrowserAccessibility* node = manager_->GetFromID(id);
+  if (!node)
+    return nullptr;
+
+  return node->GetAXPlatformNode();
+}
+
+ui::AXPlatformNode* BrowserAccessibility::GetFromTreeIDAndNodeID(
+    const ui::AXTreeID& ax_tree_id,
+    int32_t id) {
+  BrowserAccessibilityManager* manager =
+      BrowserAccessibilityManager::FromID(ax_tree_id);
+  if (!manager)
+    return nullptr;
+
+  BrowserAccessibility* node = manager->GetFromID(id);
+  if (!node)
+    return nullptr;
+
+  return node->GetAXPlatformNode();
 }
 
 int BrowserAccessibility::GetIndexInParent() {
@@ -1826,6 +1851,7 @@ base::string16 BrowserAccessibility::GetLocalizedStringForLandmarkType() const {
 
   switch (data.role) {
     case ax::mojom::Role::kBanner:
+    case ax::mojom::Role::kHeader:
       return content_client->GetLocalizedString(IDS_AX_ROLE_BANNER);
 
     case ax::mojom::Role::kComplementary:
@@ -1836,6 +1862,7 @@ base::string16 BrowserAccessibility::GetLocalizedStringForLandmarkType() const {
       return content_client->GetLocalizedString(IDS_AX_ROLE_CONTENT_INFO);
 
     case ax::mojom::Role::kRegion:
+    case ax::mojom::Role::kSection:
       if (data.HasStringAttribute(ax::mojom::StringAttribute::kName))
         return content_client->GetLocalizedString(IDS_AX_ROLE_REGION);
       FALLTHROUGH;
@@ -1886,12 +1913,30 @@ base::string16 BrowserAccessibility::GetLocalizedStringForRoleDescription()
     case ax::mojom::Role::kFigure:
       return content_client->GetLocalizedString(IDS_AX_ROLE_FIGURE);
 
+    case ax::mojom::Role::kFooter:
+    case ax::mojom::Role::kFooterAsNonLandmark:
+      return content_client->GetLocalizedString(IDS_AX_ROLE_FOOTER);
+
+    case ax::mojom::Role::kHeader:
+    case ax::mojom::Role::kHeaderAsNonLandmark:
+      return content_client->GetLocalizedString(IDS_AX_ROLE_HEADER);
+
+    case ax::mojom::Role::kMark:
+      return content_client->GetLocalizedString(IDS_AX_ROLE_MARK);
+
     case ax::mojom::Role::kMeter:
       return content_client->GetLocalizedString(IDS_AX_ROLE_METER);
 
     case ax::mojom::Role::kSearchBox:
       return content_client->GetLocalizedString(IDS_AX_ROLE_SEARCH_BOX);
 
+    case ax::mojom::Role::kSection: {
+      if (data.HasStringAttribute(ax::mojom::StringAttribute::kName))
+        return content_client->GetLocalizedString(IDS_AX_ROLE_SECTION);
+
+      return {};
+    }
+
     case ax::mojom::Role::kStatus:
       return content_client->GetLocalizedString(IDS_AX_ROLE_OUTPUT);
 
@@ -1953,6 +1998,10 @@ base::Optional<int> BrowserAccessibility::GetSetSize() const {
   return node()->GetSetSize();
 }
 
+std::string BrowserAccessibility::ToString() const {
+  return GetData().ToString();
+}
+
 bool BrowserAccessibility::SetHypertextSelection(int start_offset,
                                                  int end_offset) {
   manager()->SetSelection(
@@ -1974,4 +2023,166 @@ BrowserAccessibility* BrowserAccessibility::PlatformGetRootOfChildTree() const {
   return nullptr;
 }
 
+ui::TextAttributeList BrowserAccessibility::ComputeTextAttributes() const {
+  return ui::TextAttributeList();
+}
+
+std::string BrowserAccessibility::GetInheritedFontFamilyName() const {
+  return GetInheritedStringAttribute(ax::mojom::StringAttribute::kFontFamily);
+}
+
+ui::TextAttributeMap BrowserAccessibility::GetSpellingAndGrammarAttributes()
+    const {
+  ui::TextAttributeMap spelling_attributes;
+  if (IsTextOnlyObject()) {
+    const std::vector<int32_t>& marker_types =
+        GetIntListAttribute(ax::mojom::IntListAttribute::kMarkerTypes);
+    const std::vector<int>& marker_starts =
+        GetIntListAttribute(ax::mojom::IntListAttribute::kMarkerStarts);
+    const std::vector<int>& marker_ends =
+        GetIntListAttribute(ax::mojom::IntListAttribute::kMarkerEnds);
+    for (size_t i = 0; i < marker_types.size(); ++i) {
+      bool is_spelling_error =
+          (marker_types[i] &
+           static_cast<int32_t>(ax::mojom::MarkerType::kSpelling)) != 0;
+      bool is_grammar_error =
+          (marker_types[i] &
+           static_cast<int32_t>(ax::mojom::MarkerType::kGrammar)) != 0;
+
+      if (!is_spelling_error && !is_grammar_error)
+        continue;
+
+      ui::TextAttributeList start_attributes;
+      if (is_spelling_error && is_grammar_error)
+        start_attributes.push_back(
+            std::make_pair("invalid", "spelling,grammar"));
+      else if (is_spelling_error)
+        start_attributes.push_back(std::make_pair("invalid", "spelling"));
+      else if (is_grammar_error)
+        start_attributes.push_back(std::make_pair("invalid", "grammar"));
+
+      int start_offset = marker_starts[i];
+      int end_offset = marker_ends[i];
+      spelling_attributes[start_offset] = start_attributes;
+      spelling_attributes[end_offset] = ui::TextAttributeList();
+    }
+  }
+
+  if (IsPlainTextField()) {
+    int start_offset = 0;
+    for (BrowserAccessibility* static_text =
+             BrowserAccessibilityManager::NextTextOnlyObject(
+                 InternalGetFirstChild());
+         static_text; static_text = static_text->InternalGetNextSibling()) {
+      ui::TextAttributeMap text_spelling_attributes =
+          static_text->GetSpellingAndGrammarAttributes();
+      for (auto& attribute : text_spelling_attributes) {
+        spelling_attributes[start_offset + attribute.first] =
+            std::move(attribute.second);
+      }
+      start_offset += static_cast<int>(static_text->GetHypertext().length());
+    }
+  }
+
+  return spelling_attributes;
+}
+
+// static
+void BrowserAccessibility::MergeSpellingAndGrammarIntoTextAttributes(
+    const ui::TextAttributeMap& spelling_attributes,
+    int start_offset,
+    ui::TextAttributeMap* text_attributes) {
+  if (!text_attributes) {
+    NOTREACHED();
+    return;
+  }
+
+  ui::TextAttributeList prev_attributes;
+  for (const auto& spelling_attribute : spelling_attributes) {
+    int offset = start_offset + spelling_attribute.first;
+    auto iterator = text_attributes->find(offset);
+    if (iterator == text_attributes->end()) {
+      text_attributes->emplace(offset, prev_attributes);
+      iterator = text_attributes->find(offset);
+    } else {
+      prev_attributes = iterator->second;
+    }
+
+    ui::TextAttributeList& existing_attributes = iterator->second;
+    // There might be a spelling attribute already in the list of text
+    // attributes, originating from "aria-invalid", that is being overwritten
+    // by a spelling marker. If it already exists, prefer it over this
+    // automatically computed attribute.
+    if (!HasInvalidAttribute(existing_attributes)) {
+      // Does not exist -- insert our own.
+      existing_attributes.insert(existing_attributes.end(),
+                                 spelling_attribute.second.begin(),
+                                 spelling_attribute.second.end());
+    }
+  }
+}
+
+ui::TextAttributeMap BrowserAccessibility::ComputeTextAttributeMap(
+    const ui::TextAttributeList& default_attributes) const {
+  ui::TextAttributeMap attributes_map;
+  if (PlatformIsLeaf() || IsPlainTextField()) {
+    attributes_map[0] = default_attributes;
+    const ui::TextAttributeMap spelling_attributes =
+        GetSpellingAndGrammarAttributes();
+    MergeSpellingAndGrammarIntoTextAttributes(
+        spelling_attributes, 0 /* start_offset */, &attributes_map);
+    return attributes_map;
+  }
+
+  int start_offset = 0;
+  for (BrowserAccessibility::PlatformChildIterator it = PlatformChildrenBegin();
+       it != PlatformChildrenEnd(); ++it) {
+    auto* child = it.get();
+    DCHECK(child);
+    ui::TextAttributeList attributes(child->ComputeTextAttributes());
+
+    if (attributes_map.empty()) {
+      attributes_map[start_offset] = attributes;
+    } else {
+      // Only add the attributes for this child if we are at the start of a new
+      // style span.
+      ui::TextAttributeList previous_attributes =
+          attributes_map.rbegin()->second;
+      // Must check the size, otherwise if attributes is a subset of
+      // prev_attributes, they would appear to be equal.
+      if (attributes.size() != previous_attributes.size() ||
+          !std::equal(attributes.begin(), attributes.end(),
+                      previous_attributes.begin())) {
+        attributes_map[start_offset] = attributes;
+      }
+    }
+
+    if (child->IsTextOnlyObject()) {
+      const ui::TextAttributeMap spelling_attributes =
+          child->GetSpellingAndGrammarAttributes();
+      MergeSpellingAndGrammarIntoTextAttributes(spelling_attributes,
+                                                start_offset, &attributes_map);
+      start_offset += child->GetHypertext().length();
+    } else {
+      start_offset += 1;
+    }
+  }
+
+  return attributes_map;
+}
+
+// static
+bool BrowserAccessibility::HasInvalidAttribute(
+    const ui::TextAttributeList& attributes) {
+  return std::find_if(attributes.begin(), attributes.end(),
+                      [](const ui::TextAttribute& attribute) {
+                        return attribute.first == "invalid";
+                      }) != attributes.end();
+}
+
+std::ostream& operator<<(std::ostream& stream,
+                         const BrowserAccessibility& object) {
+  return stream << object.ToString();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility.h b/chromium/content/browser/accessibility/browser_accessibility.h
index bc086ef3737..90d1a968432 100644
--- a/chromium/content/browser/accessibility/browser_accessibility.h
+++ b/chromium/content/browser/accessibility/browser_accessibility.h
@@ -9,6 +9,7 @@
 
 #include <map>
 #include <memory>
+#include <ostream>
 #include <set>
 #include <string>
 #include <utility>
@@ -130,6 +131,10 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   // Returns true if this object can fire events.
   virtual bool CanFireEvents() const;
 
+  // Return the AXPlatformNode corresponding to this node, if applicable
+  // on this platform.
+  virtual ui::AXPlatformNode* GetAXPlatformNode() const;
+
   // Returns the number of children of this object, or 0 if PlatformIsLeaf()
   // returns true.
   virtual uint32_t PlatformChildCount() const;
@@ -417,7 +422,7 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   // Gets the text offsets where new lines start.
   std::vector<int> GetLineStartOffsets() const;
 
-  virtual gfx::NativeViewAccessible GetNativeViewAccessible();
+  gfx::NativeViewAccessible GetNativeViewAccessible() override;
 
   // AXPosition Support
 
@@ -469,6 +474,8 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   gfx::NativeViewAccessible HitTestSync(int x, int y) override;
   gfx::NativeViewAccessible GetFocus() override;
   ui::AXPlatformNode* GetFromNodeID(int32_t id) override;
+  ui::AXPlatformNode* GetFromTreeIDAndNodeID(const ui::AXTreeID& ax_tree_id,
+                                             int32_t id) override;
   int GetIndexInParent() override;
   gfx::AcceleratedWidget GetTargetForNativeAccessibilityEvent() override;
 
@@ -519,6 +526,9 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   base::string16 GetLocalizedStringForLandmarkType() const override;
   base::string16 GetLocalizedStringForRoleDescription() const override;
   base::string16 GetStyleNameAttributeAsLocalizedString() const override;
+  ui::TextAttributeMap ComputeTextAttributeMap(
+      const ui::TextAttributeList& default_attributes) const override;
+  std::string GetInheritedFontFamilyName() const override;
   bool ShouldIgnoreHoveredStateForTesting() override;
   bool IsOffscreen() const override;
   bool IsMinimized() const override;
@@ -536,6 +546,9 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   base::Optional<int> GetPosInSet() const override;
   base::Optional<int> GetSetSize() const override;
 
+  // Returns a string representation of this object for debugging purposes.
+  std::string ToString() const;
+
  protected:
   // The UIA tree formatter needs access to GetUniqueId() to identify the
   // starting point for tree dumps.
@@ -546,6 +559,8 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   using AXPlatformRange =
       ui::AXRange<BrowserAccessibilityPositionInstance::element_type>;
 
+  virtual ui::TextAttributeList ComputeTextAttributes() const;
+
   BrowserAccessibility();
 
   // The manager of this tree of accessibility objects.
@@ -605,12 +620,35 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   // If the node has a child tree, get the root node.
   BrowserAccessibility* PlatformGetRootOfChildTree() const;
 
+  // Returns a text attribute map indicating the offsets in the text of a leaf
+  // object, such as a text field or static text, where spelling and grammar
+  // errors are present.
+  ui::TextAttributeMap GetSpellingAndGrammarAttributes() const;
+
+  // Given a set of map of spelling text attributes and a start offset, merge
+  // them into the given map of existing text attributes. Merges the given
+  // spelling attributes, i.e. document marker information, into the given text
+  // attributes starting at the given character offset. This is required
+  // because document markers that are present on text leaves need to be
+  // propagated to their parent object for compatibility with Firefox.
+  static void MergeSpellingAndGrammarIntoTextAttributes(
+      const ui::TextAttributeMap& spelling_attributes,
+      int start_offset,
+      ui::TextAttributeMap* text_attributes);
+
+  // Return true is the list of text attributes already includes an invalid
+  // attribute originating from ARIA.
+  static bool HasInvalidAttribute(const ui::TextAttributeList& attributes);
+
   // A unique ID, since node IDs are frame-local.
   ui::AXUniqueId unique_id_;
 
   DISALLOW_COPY_AND_ASSIGN(BrowserAccessibility);
 };
 
+CONTENT_EXPORT std::ostream& operator<<(std::ostream& stream,
+                                        const BrowserAccessibility& object);
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_ACCESSIBILITY_BROWSER_ACCESSIBILITY_H_
diff --git a/chromium/content/browser/accessibility/browser_accessibility_android.cc b/chromium/content/browser/accessibility/browser_accessibility_android.cc
index b828f57a73c..63ac0dd07b5 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_android.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_android.cc
@@ -6,14 +6,15 @@
 
 #include "base/i18n/break_iterator.h"
 #include "base/lazy_instance.h"
+#include "base/numerics/ranges.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
-#include "content/app/strings/grit/content_strings.h"
 #include "content/browser/accessibility/browser_accessibility_manager_android.h"
 #include "content/common/accessibility_messages.h"
 #include "content/public/common/content_client.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_assistant_structure.h"
 #include "ui/accessibility/ax_role_properties.h"
@@ -220,10 +221,6 @@ bool BrowserAccessibilityAndroid::IsChecked() const {
 }
 
 bool BrowserAccessibilityAndroid::IsClickable() const {
-  // Explicitly disabled form controls shouldn't be clickable.
-  if (!IsEnabled())
-    return false;
-
   // If it has a custom default action verb except for
   // ax::mojom::DefaultActionVerb::kClickAncestor, it's definitely clickable.
   // ax::mojom::DefaultActionVerb::kClickAncestor is used when an element with a
@@ -234,9 +231,18 @@ bool BrowserAccessibilityAndroid::IsClickable() const {
     return true;
   }
 
-  // Otherwise return true if it's focusable, but skip web areas and iframes.
+  if (!IsEnabled()) {
+    // TalkBack won't announce a control as disabled unless it's also marked
+    // as clickable. In other words, Talkback wants to know if the control
+    // might be clickable, if it wasn't disabled.
+    return ui::IsControl(GetRole());
+  }
+
+  // Skip web areas and iframes, they're focusable but not clickable.
   if (IsIframe() || (GetRole() == ax::mojom::Role::kRootWebArea))
     return false;
+
+  // Otherwise it's clickable if it's focusable.
   return IsFocusable();
 }
 
@@ -290,7 +296,19 @@ bool BrowserAccessibilityAndroid::IsEditableText() const {
 }
 
 bool BrowserAccessibilityAndroid::IsEnabled() const {
-  return GetData().GetRestriction() != ax::mojom::Restriction::kDisabled;
+  switch (GetData().GetRestriction()) {
+    case ax::mojom::Restriction::kNone:
+      return true;
+    case ax::mojom::Restriction::kReadOnly:
+    case ax::mojom::Restriction::kDisabled:
+      // On Android, both Disabled and ReadOnly are treated the same.
+      // For both of them, we set AccessibilityNodeInfo.IsEnabled to false
+      // and we don't expose certain actions like SET_VALUE and PASTE.
+      return false;
+  }
+
+  NOTREACHED();
+  return true;
 }
 
 bool BrowserAccessibilityAndroid::IsExpanded() const {
@@ -564,8 +582,20 @@ base::string16 BrowserAccessibilityAndroid::GetRoleDescription() const {
     case ax::mojom::Role::kAnchor:
       // No role description.
       break;
-    case ax::mojom::Role::kAnnotation:
-      // No role description.
+    case ax::mojom::Role::kAnnotationAttribution:
+      message_id = IDS_AX_ROLE_ANNOTATION_ATTRIBUTION;
+      break;
+    case ax::mojom::Role::kAnnotationCommentary:
+      message_id = IDS_AX_ROLE_ANNOTATION_COMMENTARY;
+      break;
+    case ax::mojom::Role::kAnnotationPresence:
+      message_id = IDS_AX_ROLE_ANNOTATION_PRESENCE;
+      break;
+    case ax::mojom::Role::kAnnotationRevision:
+      message_id = IDS_AX_ROLE_ANNOTATION_REVISION;
+      break;
+    case ax::mojom::Role::kAnnotationSuggestion:
+      message_id = IDS_AX_ROLE_ANNOTATION_SUGGESTION;
       break;
     case ax::mojom::Role::kApplication:
       message_id = IDS_AX_ROLE_APPLICATION;
@@ -798,6 +828,9 @@ base::string16 BrowserAccessibilityAndroid::GetRoleDescription() const {
     case ax::mojom::Role::kFooter:
       message_id = IDS_AX_ROLE_FOOTER;
       break;
+    case ax::mojom::Role::kFooterAsNonLandmark:
+      // No role description.
+      break;
     case ax::mojom::Role::kForm:
       // No role description.
       break;
@@ -819,6 +852,12 @@ base::string16 BrowserAccessibilityAndroid::GetRoleDescription() const {
     case ax::mojom::Role::kGroup:
       // No role description.
       break;
+    case ax::mojom::Role::kHeader:
+      message_id = IDS_AX_ROLE_BANNER;
+      break;
+    case ax::mojom::Role::kHeaderAsNonLandmark:
+      // No role description.
+      break;
     case ax::mojom::Role::kHeading:
       // Note that code above this switch statement handles headings with
       // a level, returning a string like "heading level 1", etc.
@@ -971,6 +1010,13 @@ base::string16 BrowserAccessibilityAndroid::GetRoleDescription() const {
     case ax::mojom::Role::kRuby:
       // No role description.
       break;
+    case ax::mojom::Role::kRubyAnnotation:
+      // No role description.
+      break;
+    case ax::mojom::Role::kSection:
+      // A <section> element uses the 'region' ARIA role mapping.
+      message_id = IDS_AX_ROLE_REGION;
+      break;
     case ax::mojom::Role::kSvgRoot:
       message_id = IDS_AX_ROLE_GRAPHIC;
       break;
@@ -1118,6 +1164,13 @@ int BrowserAccessibilityAndroid::GetItemCount() const {
 
 bool BrowserAccessibilityAndroid::CanScrollForward() const {
   if (IsSlider()) {
+    // If it's not a native INPUT element, then increment and decrement
+    // won't work.
+    std::string html_tag =
+        GetStringAttribute(ax::mojom::StringAttribute::kHtmlTag);
+    if (html_tag != "input")
+      return false;
+
     float value = GetFloatAttribute(ax::mojom::FloatAttribute::kValueForRange);
     float max = GetFloatAttribute(ax::mojom::FloatAttribute::kMaxValueForRange);
     return value < max;
@@ -1128,6 +1181,13 @@ bool BrowserAccessibilityAndroid::CanScrollForward() const {
 
 bool BrowserAccessibilityAndroid::CanScrollBackward() const {
   if (IsSlider()) {
+    // If it's not a native INPUT element, then increment and decrement
+    // won't work.
+    std::string html_tag =
+        GetStringAttribute(ax::mojom::StringAttribute::kHtmlTag);
+    if (html_tag != "input")
+      return false;
+
     float value = GetFloatAttribute(ax::mojom::FloatAttribute::kValueForRange);
     float min = GetFloatAttribute(ax::mojom::FloatAttribute::kMinValueForRange);
     return value > min;
@@ -1231,22 +1291,22 @@ bool BrowserAccessibilityAndroid::Scroll(int direction) const {
     case UP:
       if (y_initial == y_min)
         return false;
-      y = std::min(std::max(y_initial - page_y, y_min), y_max);
+      y = base::ClampToRange(y_initial - page_y, y_min, y_max);
       break;
     case DOWN:
       if (y_initial == y_max)
         return false;
-      y = std::min(std::max(y_initial + page_y, y_min), y_max);
+      y = base::ClampToRange(y_initial + page_y, y_min, y_max);
       break;
     case LEFT:
       if (x_initial == x_min)
         return false;
-      x = std::min(std::max(x_initial - page_x, x_min), x_max);
+      x = base::ClampToRange(x_initial - page_x, x_min, x_max);
       break;
     case RIGHT:
       if (x_initial == x_max)
         return false;
-      x = std::min(std::max(x_initial + page_x, x_min), x_max);
+      x = base::ClampToRange(x_initial + page_x, x_min, x_max);
       break;
     default:
       NOTREACHED();
@@ -1653,8 +1713,11 @@ bool BrowserAccessibilityAndroid::IsIframe() const {
 
 bool BrowserAccessibilityAndroid::ShouldExposeValueAsName() const {
   switch (GetRole()) {
+    case ax::mojom::Role::kDate:
+    case ax::mojom::Role::kDateTime:
     case ax::mojom::Role::kTextField:
     case ax::mojom::Role::kTextFieldWithComboBox:
+    case ax::mojom::Role::kTime:
       return true;
     default:
       break;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc b/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc
index b53d7c37ada..d666a2018df 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_auralinux.cc
@@ -50,6 +50,13 @@ void BrowserAccessibilityAuraLinux::OnDataChanged() {
   node_->EnsureAtkObjectIsValid();
 }
 
+ui::AXPlatformNode* BrowserAccessibilityAuraLinux::GetAXPlatformNode() const {
+  if (!instance_active())
+    return nullptr;
+
+  return GetNode();
+}
+
 bool BrowserAccessibilityAuraLinux::IsNative() const {
   return true;
 }
@@ -62,15 +69,9 @@ base::string16 BrowserAccessibilityAuraLinux::GetHypertext() const {
   return GetNode()->AXPlatformNodeAuraLinux::GetHypertext();
 }
 
-ui::AXPlatformNode* BrowserAccessibilityAuraLinux::GetFromNodeID(int32_t id) {
-  if (!instance_active())
-    return nullptr;
-
-  BrowserAccessibility* accessibility = manager_->GetFromID(id);
-  if (!accessibility)
-    return nullptr;
-
-  return ToBrowserAccessibilityAuraLinux(accessibility)->GetNode();
+ui::TextAttributeList BrowserAccessibilityAuraLinux::ComputeTextAttributes()
+    const {
+  return GetNode()->ComputeTextAttributes();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_auralinux.h b/chromium/content/browser/accessibility/browser_accessibility_auralinux.h
index 182dc13c45a..8f23f512581 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_auralinux.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_auralinux.h
@@ -30,12 +30,14 @@ class BrowserAccessibilityAuraLinux : public BrowserAccessibility {
 
   // BrowserAccessibility methods.
   void OnDataChanged() override;
+  ui::AXPlatformNode* GetAXPlatformNode() const override;
   bool IsNative() const override;
   base::string16 GetText() const override;
   base::string16 GetHypertext() const override;
 
   gfx::NativeViewAccessible GetNativeViewAccessible() override;
-  ui::AXPlatformNode* GetFromNodeID(int32_t id) override;
+
+  ui::TextAttributeList ComputeTextAttributes() const override;
 
  private:
   // Give BrowserAccessibility::Create access to our constructor.
diff --git a/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc
index 91318c1bcbd..f461726832a 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_auralinux_unittest.cc
@@ -291,6 +291,19 @@ TEST_F(BrowserAccessibilityAuraLinuxTest, TestComplexHypertext) {
 
   g_object_unref(root_atk_object);
 
+  text1.SetName(text1_name + text1_name);
+  AXEventNotificationDetails event_bundle;
+  event_bundle.updates.resize(1);
+  event_bundle.updates[0].nodes.push_back(text1);
+  event_bundle.updates[0].nodes.push_back(root);
+  ASSERT_TRUE(manager->OnAccessibilityEvents(event_bundle));
+
+  // The hypertext offsets should reflect the new length of the static text.
+  verify_atk_link_text(combo_box_value.c_str(), 0, 28);
+  verify_atk_link_text(check_box_name.c_str(), 1, 44);
+  verify_atk_link_text(button_text_name.c_str(), 2, 45);
+  verify_atk_link_text(link_text_name.c_str(), 3, 46);
+
   manager.reset();
 }
 
@@ -592,4 +605,131 @@ TEST_F(BrowserAccessibilityAuraLinuxTest,
   manager.reset();
 }
 
+TEST_F(BrowserAccessibilityAuraLinuxTest,
+       TestExistingMisspellingsInSimpleTextFields) {
+  std::string value1("Testing .");
+  // The word "helo" is misspelled.
+  std::string value2("Helo there.");
+
+  int value1_length = value1.length();
+  int value2_length = value2.length();
+  int combo_box_value_length = value1_length + value2_length;
+
+  ui::AXNodeData root;
+  root.id = 1;
+  root.role = ax::mojom::Role::kRootWebArea;
+  root.AddState(ax::mojom::State::kFocusable);
+
+  ui::AXNodeData combo_box;
+  combo_box.id = 2;
+  combo_box.role = ax::mojom::Role::kTextFieldWithComboBox;
+  combo_box.AddState(ax::mojom::State::kEditable);
+  combo_box.AddState(ax::mojom::State::kFocusable);
+  combo_box.SetValue(value1 + value2);
+
+  ui::AXNodeData combo_box_div;
+  combo_box_div.id = 3;
+  combo_box_div.role = ax::mojom::Role::kGenericContainer;
+  combo_box_div.AddState(ax::mojom::State::kEditable);
+
+  ui::AXNodeData static_text1;
+  static_text1.id = 4;
+  static_text1.role = ax::mojom::Role::kStaticText;
+  static_text1.AddState(ax::mojom::State::kEditable);
+  static_text1.SetName(value1);
+
+  ui::AXNodeData static_text2;
+  static_text2.id = 5;
+  static_text2.role = ax::mojom::Role::kStaticText;
+  static_text2.AddState(ax::mojom::State::kEditable);
+  static_text2.SetName(value2);
+
+  std::vector<int32_t> marker_types;
+  marker_types.push_back(
+      static_cast<int32_t>(ax::mojom::MarkerType::kSpelling));
+  std::vector<int32_t> marker_starts;
+  marker_starts.push_back(0);
+  std::vector<int32_t> marker_ends;
+  marker_ends.push_back(4);
+  static_text2.AddIntListAttribute(ax::mojom::IntListAttribute::kMarkerTypes,
+                                   marker_types);
+  static_text2.AddIntListAttribute(ax::mojom::IntListAttribute::kMarkerStarts,
+                                   marker_starts);
+  static_text2.AddIntListAttribute(ax::mojom::IntListAttribute::kMarkerEnds,
+                                   marker_ends);
+
+  root.child_ids.push_back(combo_box.id);
+  combo_box.child_ids.push_back(combo_box_div.id);
+  combo_box_div.child_ids.push_back(static_text1.id);
+  combo_box_div.child_ids.push_back(static_text2.id);
+
+  std::unique_ptr<BrowserAccessibilityManager> manager(
+      BrowserAccessibilityManager::Create(
+          MakeAXTreeUpdate(root, combo_box, combo_box_div, static_text1,
+                           static_text2),
+          test_browser_accessibility_delegate_.get(),
+          new BrowserAccessibilityFactory()));
+
+  ASSERT_NE(nullptr, manager->GetRoot());
+  BrowserAccessibilityAuraLinux* ax_root =
+      ToBrowserAccessibilityAuraLinux(manager->GetRoot());
+  ASSERT_NE(nullptr, ax_root);
+  ASSERT_EQ(1U, ax_root->PlatformChildCount());
+
+  BrowserAccessibilityAuraLinux* ax_combo_box =
+      ToBrowserAccessibilityAuraLinux(ax_root->PlatformGetChild(0));
+  ASSERT_NE(nullptr, ax_combo_box);
+
+  AtkText* combo_box_text =
+      ATK_TEXT(ax_combo_box->GetNode()->GetNativeViewAccessible());
+  int start_offset, end_offset;
+
+  auto contains_spelling_attribute = [](AtkAttributeSet* attributes) {
+    const char* invalid_str =
+        atk_text_attribute_get_name(ATK_TEXT_ATTR_INVALID);
+    while (attributes) {
+      AtkAttribute* attribute = static_cast<AtkAttribute*>(attributes->data);
+      if (!g_strcmp0(attribute->name, invalid_str) &&
+          !g_strcmp0(attribute->value, "spelling"))
+        return true;
+      attributes = g_slist_next(attributes);
+    }
+
+    return false;
+  };
+
+  // Ensure that the first part of the value is not marked misspelled.
+  for (int offset = 0; offset < value1_length; ++offset) {
+    AtkAttributeSet* attributes = atk_text_get_run_attributes(
+        combo_box_text, offset, &start_offset, &end_offset);
+    EXPECT_FALSE(contains_spelling_attribute(attributes));
+    EXPECT_EQ(0, start_offset);
+    EXPECT_EQ(value1_length, end_offset);
+    atk_attribute_set_free(attributes);
+  }
+
+  // Ensure that "helo" is marked misspelled.
+  for (int offset = value1_length; offset < value1_length + 4; ++offset) {
+    AtkAttributeSet* attributes = atk_text_get_run_attributes(
+        combo_box_text, offset, &start_offset, &end_offset);
+    EXPECT_EQ(value1_length, start_offset);
+    EXPECT_EQ(value1_length + 4, end_offset);
+    EXPECT_TRUE(contains_spelling_attribute(attributes));
+    atk_attribute_set_free(attributes);
+  }
+
+  // Ensure that the last part of the value is not marked misspelled.
+  for (int offset = value1_length + 4; offset < combo_box_value_length;
+       ++offset) {
+    AtkAttributeSet* attributes = atk_text_get_run_attributes(
+        combo_box_text, offset, &start_offset, &end_offset);
+    EXPECT_FALSE(contains_spelling_attribute(attributes));
+    EXPECT_EQ(value1_length + 4, start_offset);
+    EXPECT_EQ(combo_box_value_length, end_offset);
+    atk_attribute_set_free(attributes);
+  }
+
+  manager.reset();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm b/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm
index 0a6c3c488c7..2851641d021 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm
+++ b/chromium/content/browser/accessibility/browser_accessibility_cocoa.mm
@@ -9,6 +9,8 @@
 #include <stdint.h>
 #include <string.h>
 
+#include <algorithm>
+#include <iterator>
 #include <map>
 #include <memory>
 #include <utility>
@@ -21,14 +23,16 @@
 #include "base/strings/string_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
-#include "content/app/strings/grit/content_strings.h"
+#include "base/trace_event/trace_event.h"
 #include "content/browser/accessibility/browser_accessibility_mac.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_manager_mac.h"
 #include "content/browser/accessibility/browser_accessibility_position.h"
 #include "content/browser/accessibility/one_shot_accessibility_tree_search.h"
 #include "content/public/common/content_client.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "third_party/skia/include/core/SkColor.h"
+#include "ui/accessibility/ax_enum_util.h"
 #include "ui/accessibility/ax_range.h"
 #include "ui/accessibility/ax_role_properties.h"
 #include "ui/accessibility/platform/ax_platform_node.h"
@@ -203,6 +207,18 @@ NSString* const
 NSString* const NSAccessibilityLengthForTextMarkerRangeParameterizedAttribute =
     @"AXLengthForTextMarkerRange";
 
+// Private attributes that can be used for testing text markers, e.g. in dump
+// tree tests.
+NSString* const
+    NSAccessibilityTextMarkerDebugDescriptionParameterizedAttribute =
+        @"AXTextMarkerDebugDescription";
+NSString* const
+    NSAccessibilityTextMarkerRangeDebugDescriptionParameterizedAttribute =
+        @"AXTextMarkerRangeDebugDescription";
+NSString* const
+    NSAccessibilityTextMarkerNodeDebugDescriptionParameterizedAttribute =
+        @"AXTextMarkerNodeDebugDescription";
+
 // Other private attributes.
 NSString* const NSAccessibilitySelectTextWithCriteriaParameterizedAttribute =
     @"AXSelectTextWithCriteria";
@@ -370,6 +386,38 @@ AXPlatformRange CreateAXPlatformRange(const BrowserAccessibility& start_object,
   return AXPlatformRange(std::move(anchor), std::move(focus));
 }
 
+AXPlatformRange GetSelectedRange(BrowserAccessibility& owner) {
+  const BrowserAccessibilityManager* manager = owner.manager();
+  if (!manager)
+    return {};
+
+  const ui::AXTree::Selection unignored_selection =
+      manager->ax_tree()->GetUnignoredSelection();
+  int32_t anchor_id = unignored_selection.anchor_object_id;
+  const BrowserAccessibility* anchor_object = manager->GetFromID(anchor_id);
+  if (!anchor_object)
+    return {};
+
+  int32_t focus_id = unignored_selection.focus_object_id;
+  const BrowserAccessibility* focus_object = manager->GetFromID(focus_id);
+  if (!focus_object)
+    return {};
+
+  // |anchor_offset| and / or |focus_offset| refer to a character offset if
+  // |anchor_object| / |focus_object| are text-only objects or native text
+  // fields. Otherwise, they should be treated as child indices.
+  int anchor_offset = unignored_selection.anchor_offset;
+  int focus_offset = unignored_selection.focus_offset;
+  DCHECK_GE(anchor_offset, 0);
+  DCHECK_GE(focus_offset, 0);
+
+  ax::mojom::TextAffinity anchor_affinity = unignored_selection.anchor_affinity;
+  ax::mojom::TextAffinity focus_affinity = unignored_selection.focus_affinity;
+
+  return CreateAXPlatformRange(*anchor_object, anchor_offset, anchor_affinity,
+                               *focus_object, focus_offset, focus_affinity);
+}
+
 void AddMisspelledTextAttributes(const AXPlatformRange& ax_range,
                                  NSMutableAttributedString* attributed_string) {
   int anchor_start_offset = 0;
@@ -571,10 +619,11 @@ bool InitializeAccessibilityTreeSearch(OneShotAccessibilityTreeSearch* search,
   if ([immediateDescendantsOnlyParameter isKindOfClass:[NSNumber class]])
     immediateDescendantsOnly = [immediateDescendantsOnlyParameter boolValue];
 
-  bool visibleOnly = false;
-  NSNumber* visibleOnlyParameter = [dictionary objectForKey:@"AXVisibleOnly"];
-  if ([visibleOnlyParameter isKindOfClass:[NSNumber class]])
-    visibleOnly = [visibleOnlyParameter boolValue];
+  bool onscreenOnly = false;
+  // AXVisibleOnly actually means onscreen objects only -- nothing scrolled off.
+  NSNumber* onscreenOnlyParameter = [dictionary objectForKey:@"AXVisibleOnly"];
+  if ([onscreenOnlyParameter isKindOfClass:[NSNumber class]])
+    onscreenOnly = [onscreenOnlyParameter boolValue];
 
   content::OneShotAccessibilityTreeSearch::Direction direction =
       content::OneShotAccessibilityTreeSearch::FORWARDS;
@@ -598,7 +647,7 @@ bool InitializeAccessibilityTreeSearch(OneShotAccessibilityTreeSearch* search,
 
   search->SetDirection(direction);
   search->SetImmediateDescendantsOnly(immediateDescendantsOnly);
-  search->SetVisibleOnly(visibleOnly);
+  search->SetOnscreenOnly(onscreenOnly);
   search->SetSearchText(searchText);
 
   // Mac uses resultsLimit == -1 for unlimited, that that's
@@ -826,11 +875,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 - (NSNumber*)ariaColumnIndex {
   if (![self instanceActive])
     return nil;
-  base::Optional<int> aria_col_index =
-      owner_->node()->GetTableCellAriaColIndex();
-  if (!aria_col_index)
+  base::Optional<int> ariaColIndex = owner_->node()->GetTableCellAriaColIndex();
+  if (!ariaColIndex)
     return nil;
-  return [NSNumber numberWithInt:*aria_col_index];
+  return [NSNumber numberWithInt:*ariaColIndex];
 }
 
 - (NSString*)ariaLive {
@@ -843,10 +891,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 - (NSNumber*)ariaPosInSet {
   if (![self instanceActive])
     return nil;
-  base::Optional<int> pos_in_set = owner_->node()->GetPosInSet();
-  if (!pos_in_set)
+  base::Optional<int> posInSet = owner_->node()->GetPosInSet();
+  if (!posInSet)
     return nil;
-  return [NSNumber numberWithInt:*pos_in_set];
+  return [NSNumber numberWithInt:*posInSet];
 }
 
 - (NSString*)ariaRelevant {
@@ -859,29 +907,28 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 - (NSNumber*)ariaRowCount {
   if (![self instanceActive])
     return nil;
-  base::Optional<int> aria_row_count = owner_->node()->GetTableAriaRowCount();
-  if (!aria_row_count)
+  base::Optional<int> ariaRowCount = owner_->node()->GetTableAriaRowCount();
+  if (!ariaRowCount)
     return nil;
-  return [NSNumber numberWithInt:*aria_row_count];
+  return [NSNumber numberWithInt:*ariaRowCount];
 }
 
 - (NSNumber*)ariaRowIndex {
   if (![self instanceActive])
     return nil;
-  base::Optional<int> aria_row_index =
-      owner_->node()->GetTableCellAriaRowIndex();
-  if (!aria_row_index)
+  base::Optional<int> ariaRowIndex = owner_->node()->GetTableCellAriaRowIndex();
+  if (!ariaRowIndex)
     return nil;
-  return [NSNumber numberWithInt:*aria_row_index];
+  return [NSNumber numberWithInt:*ariaRowIndex];
 }
 
 - (NSNumber*)ariaSetSize {
   if (![self instanceActive])
     return nil;
-  base::Optional<int> set_size = owner_->node()->GetSetSize();
-  if (!set_size)
+  base::Optional<int> setSize = owner_->node()->GetSetSize();
+  if (!setSize)
     return nil;
-  return [NSNumber numberWithInt:*set_size];
+  return [NSNumber numberWithInt:*setSize];
 }
 
 - (NSString*)autocompleteValue {
@@ -1396,25 +1443,24 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 - (NSNumber*)insertionPointLineNumber {
   if (![self instanceActive])
     return nil;
-
-  // TODO(nektar): Deprecate sel_start and sel_end attributes.
-  int selStart, selEnd;
-  if (!owner_->GetIntAttribute(ax::mojom::IntAttribute::kTextSelStart,
-                               &selStart) ||
-      !owner_->GetIntAttribute(ax::mojom::IntAttribute::kTextSelEnd, &selEnd)) {
+  if (!owner_->HasVisibleCaretOrSelection())
     return nil;
-  }
-
-  if (selStart > selEnd)
-    std::swap(selStart, selEnd);
 
-  const std::vector<int> line_breaks = owner_->GetLineStartOffsets();
-  for (int i = 0; i < static_cast<int>(line_breaks.size()); ++i) {
-    if (line_breaks[i] > selStart)
-      return [NSNumber numberWithInt:i];
-  }
+  const AXPlatformRange range = GetSelectedRange(*owner_);
+  // If the selection is not collapsed, then there is no visible caret.
+  if (!range.IsCollapsed())
+    return nil;
 
-  return [NSNumber numberWithInt:static_cast<int>(line_breaks.size())];
+  const BrowserAccessibilityPositionInstance caretPosition =
+      range.focus()->LowestCommonAncestor(*owner_->CreatePositionAt(0));
+  DCHECK(!caretPosition->IsNullPosition())
+      << "Calling HasVisibleCaretOrSelection() should have ensured that there "
+         "is a valid selection focus inside the current object.";
+  const std::vector<int> lineBreaks = owner_->GetLineStartOffsets();
+  auto iterator =
+      std::upper_bound(lineBreaks.begin(), lineBreaks.end(),
+                       caretPosition->AsTextPosition()->text_offset());
+  return @(std::distance(lineBreaks.begin(), iterator));
 }
 
 // Returns whether or not this node should be ignored in the
@@ -1649,7 +1695,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // Returns an enum indicating the role from owner_.
 // internal
 - (ax::mojom::Role)internalRole {
-  return static_cast<ax::mojom::Role>(owner_->GetRole());
+  if ([self instanceActive])
+    return static_cast<ax::mojom::Role>(owner_->GetRole());
+  return ax::mojom::Role::kNone;
 }
 
 - (BOOL)shouldExposeNameInDescription {
@@ -1783,31 +1831,32 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
 // Returns a string indicating the NSAccessibility role of this object.
 - (NSString*)role {
-  if (![self instanceActive])
+  if (![self instanceActive]) {
+    TRACE_EVENT0("accessibility", "BrowserAccessibilityCocoa::role nil");
     return nil;
+  }
 
+  NSString* cocoa_role = nil;
   ax::mojom::Role role = [self internalRole];
   if (role == ax::mojom::Role::kCanvas &&
       owner_->GetBoolAttribute(ax::mojom::BoolAttribute::kCanvasHasFallback)) {
-    return NSAccessibilityGroupRole;
-  }
-
-  if ((owner_->IsPlainTextField() &&
-       owner_->HasState(ax::mojom::State::kMultiline)) ||
-      owner_->IsRichTextField()) {
-    return NSAccessibilityTextAreaRole;
+    cocoa_role = NSAccessibilityGroupRole;
+  } else if ((owner_->IsPlainTextField() &&
+              owner_->HasState(ax::mojom::State::kMultiline)) ||
+             owner_->IsRichTextField()) {
+    cocoa_role = NSAccessibilityTextAreaRole;
+  } else if (role == ax::mojom::Role::kImage &&
+             owner_->HasExplicitlyEmptyName()) {
+    cocoa_role = NSAccessibilityUnknownRole;
+  } else if (owner_->IsWebAreaForPresentationalIframe()) {
+    cocoa_role = NSAccessibilityGroupRole;
+  } else {
+    cocoa_role = [AXPlatformNodeCocoa nativeRoleFromAXRole:role];
   }
 
-  if (role == ax::mojom::Role::kImage && owner_->HasExplicitlyEmptyName())
-    return NSAccessibilityUnknownRole;
-
-  // If this is a web area for a presentational iframe, give it a role of
-  // something other than WebArea so that the fact that it's a separate doc
-  // is not exposed to AT.
-  if (owner_->IsWebAreaForPresentationalIframe())
-    return NSAccessibilityGroupRole;
-
-  return [AXPlatformNodeCocoa nativeRoleFromAXRole:role];
+  TRACE_EVENT1("accessibility", "BrowserAccessibilityCocoa::role",
+               "role=", base::SysNSStringToUTF8(cocoa_role));
+  return cocoa_role;
 }
 
 // Returns a string indicating the role description of this object.
@@ -1830,7 +1879,6 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
   }
 
   NSString* role = [self role];
-
   ContentClient* content_client = content::GetContentClient();
 
   // The following descriptions are specific to webkit.
@@ -1868,6 +1916,21 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
   }
 
   switch ([self internalRole]) {
+    case ax::mojom::Role::kAnnotationAttribution:
+      return base::SysUTF16ToNSString(content_client->GetLocalizedString(
+          IDS_AX_ROLE_ANNOTATION_ATTRIBUTION));
+    case ax::mojom::Role::kAnnotationCommentary:
+      return base::SysUTF16ToNSString(content_client->GetLocalizedString(
+          IDS_AX_ROLE_ANNOTATION_COMMENTARY));
+    case ax::mojom::Role::kAnnotationPresence:
+      return base::SysUTF16ToNSString(
+          content_client->GetLocalizedString(IDS_AX_ROLE_ANNOTATION_PRESENCE));
+    case ax::mojom::Role::kAnnotationRevision:
+      return base::SysUTF16ToNSString(
+          content_client->GetLocalizedString(IDS_AX_ROLE_ANNOTATION_REVISION));
+    case ax::mojom::Role::kAnnotationSuggestion:
+      return base::SysUTF16ToNSString(content_client->GetLocalizedString(
+          IDS_AX_ROLE_ANNOTATION_SUGGESTION));
     case ax::mojom::Role::kArticle:
       return base::SysUTF16ToNSString(
           content_client->GetLocalizedString(IDS_AX_ROLE_ARTICLE));
@@ -1904,6 +1967,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
     case ax::mojom::Role::kForm:
       return base::SysUTF16ToNSString(
           content_client->GetLocalizedString(IDS_AX_ROLE_FORM));
+    case ax::mojom::Role::kHeader:
+      return base::SysUTF16ToNSString(
+          content_client->GetLocalizedString(IDS_AX_ROLE_BANNER));
     case ax::mojom::Role::kMain:
       return base::SysUTF16ToNSString(
           content_client->GetLocalizedString(IDS_AX_ROLE_MAIN_CONTENT));
@@ -1919,6 +1985,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
     case ax::mojom::Role::kRegion:
       return base::SysUTF16ToNSString(
           content_client->GetLocalizedString(IDS_AX_ROLE_REGION));
+    case ax::mojom::Role::kSection:
+      // A <section> element uses the 'region' ARIA role mapping.
+      return base::SysUTF16ToNSString(
+          content_client->GetLocalizedString(IDS_AX_ROLE_REGION));
     case ax::mojom::Role::kSpinButton:
       // This control is similar to what VoiceOver calls a "stepper".
       return base::SysUTF16ToNSString(
@@ -2080,79 +2150,44 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 - (NSString*)selectedText {
   if (![self instanceActive])
     return nil;
-
-  // TODO(nektar): Deprecate sel_start and sel_end attributes.
-  int selStart, selEnd;
-  if (!owner_->GetIntAttribute(ax::mojom::IntAttribute::kTextSelStart,
-                               &selStart) ||
-      !owner_->GetIntAttribute(ax::mojom::IntAttribute::kTextSelEnd, &selEnd)) {
+  if (!owner_->HasVisibleCaretOrSelection())
     return nil;
-  }
 
-  if (selStart > selEnd)
-    std::swap(selStart, selEnd);
-
-  int selLength = selEnd - selStart;
-  base::string16 value = owner_->GetValue();
-  return base::SysUTF16ToNSString(value.substr(selStart, selLength));
+  const AXPlatformRange range = GetSelectedRange(*owner_);
+  if (range.IsNull())
+    return nil;
+  return base::SysUTF16ToNSString(range.GetText());
 }
 
+// Returns range of text under the current object that is selected.
+//
 // Example, caret at offset 5:
-// AXSelectedTextRange:  “pos=5 len=0”
+// NSRange:  “pos=5 len=0”
 - (NSValue*)selectedTextRange {
   if (![self instanceActive])
     return nil;
-
-  // TODO(nektar): Deprecate sel_start and sel_end attributes.
-  int selStart, selEnd;
-  if (!owner_->GetIntAttribute(ax::mojom::IntAttribute::kTextSelStart,
-                               &selStart) ||
-      !owner_->GetIntAttribute(ax::mojom::IntAttribute::kTextSelEnd, &selEnd)) {
-    // TODO(accessibility) Incorrectly reaches this line in a rich text area.
+  if (!owner_->HasVisibleCaretOrSelection())
     return nil;
-  }
 
-  if (selStart > selEnd)
-    std::swap(selStart, selEnd);
+  const AXPlatformRange range = GetSelectedRange(*owner_).AsForwardRange();
+  if (range.IsNull())
+    return nil;
 
-  int selLength = selEnd - selStart;
+  const BrowserAccessibilityPositionInstance startPosition =
+      range.anchor()->LowestCommonAncestor(*owner_->CreatePositionAt(0));
+  DCHECK(!startPosition->IsNullPosition())
+      << "Calling HasVisibleCaretOrSelection() should have ensured that there "
+         "is a valid selection anchor inside the current object.";
+  int selStart = startPosition->AsTextPosition()->text_offset();
+  DCHECK_GE(selStart, 0);
+  int selLength = range.GetText().length();
   return [NSValue valueWithRange:NSMakeRange(selStart, selLength)];
 }
 
 - (id)selectedTextMarkerRange {
   if (![self instanceActive])
     return nil;
-
-  BrowserAccessibilityManager* manager = owner_->manager();
-  if (!manager)
-    return nil;
-
-  ui::AXTree::Selection unignored_selection =
-      manager->ax_tree()->GetUnignoredSelection();
-  int32_t anchorId = unignored_selection.anchor_object_id;
-  const BrowserAccessibility* anchorObject = manager->GetFromID(anchorId);
-  if (!anchorObject)
-    return nil;
-
-  int32_t focusId = unignored_selection.focus_object_id;
-  const BrowserAccessibility* focusObject = manager->GetFromID(focusId);
-  if (!focusObject)
-    return nil;
-
-  // |anchorOffset| and / or |focusOffset| refer to a character offset if
-  // |anchorObject| / |focusObject| are text-only objects. Otherwise, they
-  // should be treated as child indices.
-  int anchorOffset = unignored_selection.anchor_offset;
-  int focusOffset = unignored_selection.focus_offset;
-  if (anchorOffset < 0 || focusOffset < 0)
-    return nil;
-
-  ax::mojom::TextAffinity anchorAffinity = unignored_selection.anchor_affinity;
-  ax::mojom::TextAffinity focusAffinity = unignored_selection.focus_affinity;
-
-  return CreateTextMarkerRange(
-      CreateAXPlatformRange(*anchorObject, anchorOffset, anchorAffinity,
-                            *focusObject, focusOffset, focusAffinity));
+  return CreateTextMarkerRange(GetSelectedRange(*owner_));
 }
 
 - (NSValue*)size {
@@ -2499,6 +2534,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // Returns the accessibility value for the given attribute.  If the value isn't
 // supported this will return nil.
 - (id)accessibilityAttributeValue:(NSString*)attribute {
+  TRACE_EVENT2("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityAttributeValue",
+               "role=", ui::ToString([self internalRole]),
+               "attribute=", base::SysNSStringToUTF8(attribute));
   if (![self instanceActive])
     return nil;
 
@@ -2513,12 +2552,29 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // value isn't supported this will return nil.
 - (id)accessibilityAttributeValue:(NSString*)attribute
                      forParameter:(id)parameter {
+  if (parameter && [parameter isKindOfClass:[NSNumber self]]) {
+    TRACE_EVENT2(
+        "accessibility",
+        "BrowserAccessibilityCocoa::accessibilityAttributeValue:forParameter",
+        "role=", ui::ToString([self internalRole]), "attribute=",
+        base::SysNSStringToUTF8(attribute) +
+            " parameter=" + base::SysNSStringToUTF8([parameter stringValue]));
+  } else {
+    TRACE_EVENT2(
+        "accessibility",
+        "BrowserAccessibilityCocoa::accessibilityAttributeValue:forParameter",
+        "role=", ui::ToString([self internalRole]),
+        "attribute=", base::SysNSStringToUTF8(attribute));
+  }
+
   if (![self instanceActive])
     return nil;
 
-  const std::vector<int> line_breaks = owner_->GetLineStartOffsets();
+  const std::vector<int> lineBreaks = owner_->GetLineStartOffsets();
   base::string16 value = owner_->GetValue();
-  int len = static_cast<int>(value.size());
+  if (owner_->IsTextOnlyObject() && value.empty())
+    value = owner_->GetText();
+  int valueLength = static_cast<int>(value.size());
 
   if ([attribute isEqualToString:
                      NSAccessibilityStringForRangeParameterizedAttribute]) {
@@ -2533,22 +2589,21 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
   if ([attribute
           isEqualToString:NSAccessibilityLineForIndexParameterizedAttribute]) {
-    int index = [(NSNumber*)parameter intValue];
-    for (int i = 0; i < static_cast<int>(line_breaks.size()); ++i) {
-      if (line_breaks[i] > index)
-        return [NSNumber numberWithInt:i];
-    }
-    return [NSNumber numberWithInt:static_cast<int>(line_breaks.size())];
+    int lineIndex = [(NSNumber*)parameter intValue];
+    auto iterator =
+        std::upper_bound(lineBreaks.begin(), lineBreaks.end(), lineIndex);
+    return @(std::distance(lineBreaks.begin(), iterator));
   }
 
   if ([attribute
           isEqualToString:NSAccessibilityRangeForLineParameterizedAttribute]) {
-    int line_index = [(NSNumber*)parameter intValue];
-    int line_count = static_cast<int>(line_breaks.size()) + 1;
-    if (line_index < 0 || line_index >= line_count)
+    int lineIndex = [(NSNumber*)parameter intValue];
+    int lineCount = static_cast<int>(lineBreaks.size()) + 1;
+    if (lineIndex < 0 || lineIndex >= lineCount)
       return nil;
-    int start = line_index > 0 ? line_breaks[line_index - 1] : 0;
-    int end = line_index < line_count - 1 ? line_breaks[line_index] : len;
+    int start = (lineIndex > 0) ? lineBreaks[lineIndex - 1] : 0;
+    int end =
+        (lineIndex < (lineCount - 1)) ? lineBreaks[lineIndex] : valueLength;
     return [NSValue valueWithRange:NSMakeRange(start, end - start)];
   }
 
@@ -2565,11 +2620,11 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
     int column = [[array objectAtIndex:0] intValue];
     int row = [[array objectAtIndex:1] intValue];
 
-    ui::AXNode* cell_node = owner_->node()->GetTableCellFromCoords(row, column);
-    if (!cell_node)
+    ui::AXNode* cellNode = owner_->node()->GetTableCellFromCoords(row, column);
+    if (!cellNode)
       return nil;
 
-    BrowserAccessibility* cell = owner_->manager()->GetFromID(cell_node->id());
+    BrowserAccessibility* cell = owner_->manager()->GetFromID(cellNode->id());
     if (cell)
       return ToBrowserAccessibilityCocoa(cell);
   }
@@ -2693,21 +2748,42 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
         ui::AXBoundaryBehavior::CrossBoundary));
   }
 
-  if ([attribute
-          isEqualToString:
-              NSAccessibilityTextMarkerRangeForLineParameterizedAttribute]) {
+  if ([attribute isEqualToString:
+                     NSAccessibilityLineForTextMarkerParameterizedAttribute]) {
     BrowserAccessibilityPositionInstance position =
         CreatePositionFromTextMarker(parameter);
     if (position->IsNullPosition())
       return nil;
 
-    BrowserAccessibilityPositionInstance startPosition =
-        position->CreatePreviousLineStartPosition(
-            ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
-    BrowserAccessibilityPositionInstance endPosition =
-        position->CreateNextLineEndPosition(
-            ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
-    AXPlatformRange range(std::move(startPosition), std::move(endPosition));
+    int textOffset = position->AsTextPosition()->text_offset();
+    const auto iterator =
+        std::upper_bound(lineBreaks.begin(), lineBreaks.end(), textOffset);
+    return @(std::distance(lineBreaks.begin(), iterator));
+  }
+
+  if ([attribute
+          isEqualToString:
+              NSAccessibilityTextMarkerRangeForLineParameterizedAttribute]) {
+    int lineIndex = [(NSNumber*)parameter intValue];
+    int lineCount = static_cast<int>(lineBreaks.size()) + 1;
+    if (lineIndex < 0 || lineIndex >= lineCount)
+      return nil;
+
+    int lineStartOffset = (lineIndex > 0) ? lineBreaks[lineIndex - 1] : 0;
+    BrowserAccessibilityPositionInstance lineStartPosition = CreateTextPosition(
+        *owner_, lineStartOffset, ax::mojom::TextAffinity::kDownstream);
+    if (lineStartPosition->IsNullPosition())
+      return nil;
+
+    // Make sure that the line start position is really at the start of the
+    // current line.
+    lineStartPosition = lineStartPosition->CreatePreviousLineStartPosition(
+        ui::AXBoundaryBehavior::StopIfAlreadyAtBoundary);
+    BrowserAccessibilityPositionInstance lineEndPosition =
+        lineStartPosition->CreateNextLineEndPosition(
+            ui::AXBoundaryBehavior::StopAtAnchorBoundary);
+    AXPlatformRange range(std::move(lineStartPosition),
+                          std::move(lineEndPosition));
     return CreateTextMarkerRange(std::move(range));
   }
 
@@ -2721,10 +2797,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
     BrowserAccessibilityPositionInstance startLinePosition =
         endPosition->CreatePreviousLineStartPosition(
-            ui::AXBoundaryBehavior::CrossBoundary);
+            ui::AXBoundaryBehavior::StopAtLastAnchorBoundary);
     BrowserAccessibilityPositionInstance endLinePosition =
         endPosition->CreatePreviousLineEndPosition(
-            ui::AXBoundaryBehavior::CrossBoundary);
+            ui::AXBoundaryBehavior::StopAtLastAnchorBoundary);
     BrowserAccessibilityPositionInstance startPosition =
         *startLinePosition <= *endLinePosition ? std::move(endLinePosition)
                                                : std::move(startLinePosition);
@@ -2742,10 +2818,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
     BrowserAccessibilityPositionInstance startLinePosition =
         startPosition->CreateNextLineStartPosition(
-            ui::AXBoundaryBehavior::CrossBoundary);
+            ui::AXBoundaryBehavior::StopAtLastAnchorBoundary);
     BrowserAccessibilityPositionInstance endLinePosition =
         startPosition->CreateNextLineEndPosition(
-            ui::AXBoundaryBehavior::CrossBoundary);
+            ui::AXBoundaryBehavior::StopAtLastAnchorBoundary);
     BrowserAccessibilityPositionInstance endPosition =
         *startLinePosition <= *endLinePosition ? std::move(startLinePosition)
                                                : std::move(endLinePosition);
@@ -2945,14 +3021,14 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
     if (![parameter isKindOfClass:[NSArray class]])
       return nil;
 
-    NSArray* text_marker_array = parameter;
-    if ([text_marker_array count] != 2)
+    NSArray* textMarkerArray = parameter;
+    if ([textMarkerArray count] != 2)
       return nil;
 
     BrowserAccessibilityPositionInstance startPosition =
-        CreatePositionFromTextMarker([text_marker_array objectAtIndex:0]);
+        CreatePositionFromTextMarker([textMarkerArray objectAtIndex:0]);
     BrowserAccessibilityPositionInstance endPosition =
-        CreatePositionFromTextMarker([text_marker_array objectAtIndex:1]);
+        CreatePositionFromTextMarker([textMarkerArray objectAtIndex:1]);
     if (*startPosition <= *endPosition) {
       return CreateTextMarkerRange(
           AXPlatformRange(std::move(startPosition), std::move(endPosition)));
@@ -2964,6 +3040,32 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
   if ([attribute
           isEqualToString:
+              NSAccessibilityTextMarkerDebugDescriptionParameterizedAttribute]) {
+    BrowserAccessibilityPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    return base::SysUTF8ToNSString(position->ToString());
+  }
+
+  if ([attribute
+          isEqualToString:
+              NSAccessibilityTextMarkerRangeDebugDescriptionParameterizedAttribute]) {
+    AXPlatformRange range = CreateRangeFromTextMarkerRange(parameter);
+    return base::SysUTF8ToNSString(range.ToString());
+  }
+
+  if ([attribute
+          isEqualToString:
+              NSAccessibilityTextMarkerNodeDebugDescriptionParameterizedAttribute]) {
+    BrowserAccessibilityPositionInstance position =
+        CreatePositionFromTextMarker(parameter);
+    if (position->IsNullPosition())
+      return @"nil";
+    DCHECK(position->GetAnchor());
+    return base::SysUTF8ToNSString(position->GetAnchor()->ToString());
+  }
+
+  if ([attribute
+          isEqualToString:
               NSAccessibilityIndexForChildUIElementParameterizedAttribute]) {
     if (![parameter isKindOfClass:[BrowserAccessibilityCocoa class]])
       return nil;
@@ -2986,6 +3088,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // Returns an array of parameterized attributes names that this object will
 // respond to.
 - (NSArray*)accessibilityParameterizedAttributeNames {
+  TRACE_EVENT1(
+      "accessibility",
+      "BrowserAccessibilityCocoa::accessibilityParameterizedAttributeNames",
+      "role=", ui::ToString([self internalRole]));
   if (![self instanceActive])
     return nil;
 
@@ -3071,6 +3177,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
 // Returns an array of action names that this object will respond to.
 - (NSArray*)accessibilityActionNames {
+  TRACE_EVENT1("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityActionNames",
+               "role=", ui::ToString([self internalRole]));
   if (![self instanceActive])
     return nil;
 
@@ -3097,6 +3206,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
 // Returns the list of accessibility attributes that this object supports.
 - (NSArray*)accessibilityAttributeNames {
+  TRACE_EVENT1("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityAttributeNames",
+               "role=", ui::ToString([self internalRole]));
   if (![self instanceActive])
     return nil;
 
@@ -3123,6 +3235,7 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
                        NSAccessibilityStartTextMarkerAttribute,
                        NSAccessibilitySubroleAttribute,
                        NSAccessibilityTitleAttribute,
+                       NSAccessibilityTitleUIElementAttribute,
                        NSAccessibilityTopLevelUIElementAttribute,
                        NSAccessibilityValueAttribute,
                        NSAccessibilityVisitedAttribute,
@@ -3345,6 +3458,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
 // Returns the index of the child in this objects array of children.
 - (NSUInteger)accessibilityGetIndexOf:(id)child {
+  TRACE_EVENT1("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityGetIndexOf",
+               "role=", ui::ToString([self internalRole]));
   if (![self instanceActive])
     return 0;
 
@@ -3360,6 +3476,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // Returns whether or not the specified attribute can be set by the
 // accessibility API via |accessibilitySetValue:forAttribute:|.
 - (BOOL)accessibilityIsAttributeSettable:(NSString*)attribute {
+  TRACE_EVENT2("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityIsAttributeSettable",
+               "role=", ui::ToString([self internalRole]),
+               "attribute=", base::SysNSStringToUTF8(attribute));
   if (![self instanceActive])
     return NO;
 
@@ -3384,6 +3504,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // Returns whether or not this object should be ignored in the accessibility
 // tree.
 - (BOOL)accessibilityIsIgnored {
+  TRACE_EVENT1("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityIsIgnored",
+               "role=", ui::ToString([self internalRole]));
   if (![self instanceActive])
     return YES;
 
@@ -3393,6 +3516,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // Performs the given accessibility action on the webkit accessibility object
 // that backs this object.
 - (void)accessibilityPerformAction:(NSString*)action {
+  TRACE_EVENT2("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityPerformAction",
+               "role=", ui::ToString([self internalRole]),
+               "action=", base::SysNSStringToUTF8(action));
   if (![self instanceActive])
     return;
 
@@ -3436,6 +3563,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
 // Returns the description of the given action.
 - (NSString*)accessibilityActionDescription:(NSString*)action {
+  TRACE_EVENT2("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityActionDescription",
+               "role=", ui::ToString([self internalRole]),
+               "action=", base::SysNSStringToUTF8(action));
   if (![self instanceActive])
     return nil;
 
@@ -3446,6 +3577,11 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // This class does not support this.
 - (BOOL)accessibilitySetOverrideValue:(id)value
                          forAttribute:(NSString*)attribute {
+  TRACE_EVENT2(
+      "accessibility",
+      "BrowserAccessibilityCocoa::accessibilitySetOverrideValue:forAttribute",
+      "role=", ui::ToString([self internalRole]),
+      "attribute=", base::SysNSStringToUTF8(attribute));
   if (![self instanceActive])
     return NO;
   return NO;
@@ -3453,6 +3589,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 
 // Sets the value for an accessibility attribute via the accessibility API.
 - (void)accessibilitySetValue:(id)value forAttribute:(NSString*)attribute {
+  TRACE_EVENT2("accessibility",
+               "BrowserAccessibilityCocoa::accessibilitySetValue:forAttribute",
+               "role=", ui::ToString([self internalRole]),
+               "attribute=", base::SysNSStringToUTF8(attribute));
   if (![self instanceActive])
     return;
 
@@ -3477,6 +3617,10 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 // or one of its children, so this will never return nil unless this
 // object is invalid.
 - (id)accessibilityHitTest:(NSPoint)point {
+  TRACE_EVENT2("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityHitTest",
+               "role=", ui::ToString([self internalRole]),
+               "point=", base::SysNSStringToUTF8(NSStringFromPoint(point)));
   if (![self instanceActive])
     return nil;
 
@@ -3505,6 +3649,9 @@ NSString* const NSAccessibilityRequiredAttributeChrome = @"AXRequired";
 }
 
 - (BOOL)accessibilityNotifiesWhenDestroyed {
+  TRACE_EVENT1("accessibility",
+               "BrowserAccessibilityCocoa::accessibilityNotifiesWhenDestroyed",
+               "role=", ui::ToString([self internalRole]));
   // Indicate that BrowserAccessibilityCocoa will post a notification when it's
   // destroyed (see -detach). This allows VoiceOver to do some internal things
   // more efficiently.
diff --git a/chromium/content/browser/accessibility/browser_accessibility_com_win.cc b/chromium/content/browser/accessibility/browser_accessibility_com_win.cc
index 8fba7b5778f..8a610981db5 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_com_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_com_win.cc
@@ -22,7 +22,6 @@
 #include "content/common/accessibility_messages.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
-#include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/accessibility/ax_role_properties.h"
 #include "ui/base/win/accessibility_ids_win.h"
@@ -493,20 +492,7 @@ IFACEMETHODIMP BrowserAccessibilityComWin::get_offsetAtPoint(
     LONG y,
     IA2CoordinateType coord_type,
     LONG* offset) {
-  WIN_ACCESSIBILITY_API_HISTOGRAM(UMA_API_GET_OFFSET_AT_POINT);
-  AddAccessibilityModeFlags(kScreenReaderAndHTMLAccessibilityModes |
-                            ui::AXMode::kInlineTextBoxes);
-  if (!owner())
-    return E_FAIL;
-
-  if (!offset)
-    return E_INVALIDARG;
-
-  // TODO(dmazzoni): implement this. We're returning S_OK for now so that
-  // screen readers still return partially accurate results rather than
-  // completely failing.
-  *offset = 0;
-  return S_OK;
+  return AXPlatformNodeWin::get_offsetAtPoint(x, y, coord_type, offset);
 }
 
 IFACEMETHODIMP BrowserAccessibilityComWin::scrollSubstringTo(
@@ -607,12 +593,20 @@ IFACEMETHODIMP BrowserAccessibilityComWin::get_attributes(
   *end_offset =
       FindStartOfStyle(offset, ui::AXTextBoundaryDirection::kForwards);
 
-  base::string16 attributes_str;
-  const std::vector<base::string16>& attributes =
+  const ui::TextAttributeList& attributes =
       offset_to_text_attributes().find(*start_offset)->second;
 
-  for (const base::string16& attribute : attributes)
-    attributes_str += attribute + L';';
+  std::ostringstream attributes_stream;
+  for (const ui::TextAttribute& attribute : attributes) {
+    // Don't expose the default language value of "en-US".
+    // TODO(nektar): Determine if it's possible to check against the interface
+    // language.
+    if (attribute.first == "language" && attribute.second == "en-US")
+      continue;
+
+    attributes_stream << attribute.first << ":" << attribute.second << ";";
+  }
+  base::string16 attributes_str = base::UTF8ToUTF16(attributes_stream.str());
 
   // Returning an empty string is valid and indicates no attributes.
   // This is better than returning S_FALSE which the screen reader
@@ -1603,7 +1597,7 @@ STDMETHODIMP BrowserAccessibilityComWin::InternalQueryInterface(
       return E_NOINTERFACE;
     }
   } else if (iid == IID_IAccessibleTable || iid == IID_IAccessibleTable2) {
-    if (ia_role != ROLE_SYSTEM_TABLE) {
+    if (!ui::IsTableLike(accessibility->owner()->GetRole())) {
       *object = nullptr;
       return E_NOINTERFACE;
     }
@@ -1637,52 +1631,10 @@ void BrowserAccessibilityComWin::ComputeStylesIfNeeded() {
   if (!offset_to_text_attributes().empty())
     return;
 
-  std::map<int, std::vector<base::string16>> attributes_map;
-  if (owner()->PlatformIsLeaf() || owner()->IsPlainTextField()) {
-    attributes_map[0] = ComputeTextAttributes();
-    const std::map<int, std::vector<base::string16>> spelling_attributes =
-        GetSpellingAttributes();
-    MergeSpellingIntoTextAttributes(spelling_attributes, 0 /* start_offset */,
-                                    &attributes_map);
-    win_attributes_->offset_to_text_attributes.swap(attributes_map);
-    return;
-  }
-
-  int start_offset = 0;
-  for (BrowserAccessibility::PlatformChildIterator it =
-           owner()->PlatformChildrenBegin();
-       it != owner()->PlatformChildrenEnd(); ++it) {
-    auto* child = ToBrowserAccessibilityComWin(it.get());
-    DCHECK(child);
-    std::vector<base::string16> attributes(child->ComputeTextAttributes());
-
-    if (attributes_map.empty()) {
-      attributes_map[start_offset] = attributes;
-    } else {
-      // Only add the attributes for this child if we are at the start of a new
-      // style span.
-      std::vector<base::string16> previous_attributes =
-          attributes_map.rbegin()->second;
-      // Must check the size, otherwise if attributes is a subset of
-      // prev_attributes, they would appear to be equal.
-      if (attributes.size() != previous_attributes.size() ||
-          !std::equal(attributes.begin(), attributes.end(),
-                      previous_attributes.begin())) {
-        attributes_map[start_offset] = attributes;
-      }
-    }
-
-    if (child->owner()->IsTextOnlyObject()) {
-      const std::map<int, std::vector<base::string16>> spelling_attributes =
-          child->GetSpellingAttributes();
-      MergeSpellingIntoTextAttributes(spelling_attributes, start_offset,
-                                      &attributes_map);
-      start_offset += child->GetHypertext().length();
-    } else {
-      start_offset += 1;
-    }
-  }
-
+  ui::TextAttributeList default_attributes =
+      AXPlatformNodeWin::ComputeTextAttributes();
+  ui::TextAttributeMap attributes_map =
+      GetDelegate()->ComputeTextAttributeMap(default_attributes);
   win_attributes_->offset_to_text_attributes.swap(attributes_map);
 }
 
@@ -1813,196 +1765,11 @@ void BrowserAccessibilityComWin::Init(ui::AXPlatformNodeDelegate* delegate) {
   AXPlatformNodeWin::Init(delegate);
 }
 
-std::vector<base::string16> BrowserAccessibilityComWin::ComputeTextAttributes()
-    const {
-  std::vector<base::string16> attributes;
-
-  // We include list markers for now, but there might be other objects that are
-  // auto generated.
-  // TODO(nektar): Compute what objects are auto-generated in Blink.
-  if (owner()->GetRole() == ax::mojom::Role::kListMarker)
-    attributes.push_back(L"auto-generated:true");
-
-  int color;
-  if (owner()->GetIntAttribute(ax::mojom::IntAttribute::kBackgroundColor,
-                               &color)) {
-    unsigned int alpha = SkColorGetA(color);
-    unsigned int red = SkColorGetR(color);
-    unsigned int green = SkColorGetG(color);
-    unsigned int blue = SkColorGetB(color);
-    // Don't expose default value of pure white.
-    if (alpha && (red != 255 || green != 255 || blue != 255)) {
-      base::string16 color_value = L"rgb(" + base::NumberToString16(red) +
-                                   L',' + base::NumberToString16(green) + L',' +
-                                   base::NumberToString16(blue) + L')';
-      SanitizeStringAttributeForIA2(color_value, &color_value);
-      attributes.push_back(L"background-color:" + color_value);
-    }
-  }
-
-  if (owner()->GetIntAttribute(ax::mojom::IntAttribute::kColor, &color)) {
-    unsigned int red = SkColorGetR(color);
-    unsigned int green = SkColorGetG(color);
-    unsigned int blue = SkColorGetB(color);
-    // Don't expose default value of black.
-    if (red || green || blue) {
-      base::string16 color_value = L"rgb(" + base::NumberToString16(red) +
-                                   L',' + base::NumberToString16(green) + L',' +
-                                   base::NumberToString16(blue) + L')';
-      SanitizeStringAttributeForIA2(color_value, &color_value);
-      attributes.push_back(L"color:" + color_value);
-    }
-  }
-
-  base::string16 font_family(owner()->GetInheritedString16Attribute(
-      ax::mojom::StringAttribute::kFontFamily));
-  // Attribute has no default value.
-  if (!font_family.empty()) {
-    SanitizeStringAttributeForIA2(font_family, &font_family);
-    attributes.push_back(L"font-family:" + font_family);
-  }
-
-  float font_size;
-  // Attribute has no default value.
-  if (GetFloatAttribute(ax::mojom::FloatAttribute::kFontSize, &font_size)) {
-    // The IA2 Spec requires the value to be in pt, not in pixels.
-    // There are 72 points per inch.
-    // We assume that there are 96 pixels per inch on a standard display.
-    // TODO(nektar): Figure out the current value of pixels per inch.
-    float points = font_size * 72.0 / 96.0;
-    attributes.push_back(L"font-size:" + base::NumberToString16(points) +
-                         L"pt");
-  }
-
-  // TODO(nektar): Add Blink support for the following attributes:
-  // text-line-through-mode, text-line-through-width, text-outline:false,
-  // text-position:baseline, text-shadow:none, text-underline-mode:continuous.
-
-  int32_t text_style =
-      owner()->GetIntAttribute(ax::mojom::IntAttribute::kTextStyle);
-  if (text_style) {
-    if (GetData().HasTextStyle(ax::mojom::TextStyle::kBold))
-      attributes.push_back(L"font-weight:bold");
-    if (GetData().HasTextStyle(ax::mojom::TextStyle::kItalic))
-      attributes.push_back(L"font-style:italic");
-    if (GetData().HasTextStyle(ax::mojom::TextStyle::kLineThrough)) {
-      // TODO(nektar): Figure out a more specific value.
-      attributes.push_back(L"text-line-through-style:solid");
-    }
-    if (GetData().HasTextStyle(ax::mojom::TextStyle::kUnderline)) {
-      // TODO(nektar): Figure out a more specific value.
-      attributes.push_back(L"text-underline-style:solid");
-    }
-  }
-
-  // Screen readers look at the text attributes to determine if something is
-  // misspelled, so we need to propagate any spelling attributes from immediate
-  // parents of text-only objects.
-  base::string16 invalid_value = base::UTF8ToUTF16(GetInvalidValue());
-  if (!invalid_value.empty())
-    attributes.push_back(L"invalid:" + invalid_value);
-
-  base::string16 language = base::UTF8ToUTF16(owner()->node()->GetLanguage());
-  // Don't expose default value should of L"en-US".
-  if (!language.empty() && language != L"en-US") {
-    SanitizeStringAttributeForIA2(language, &language);
-    attributes.push_back(L"language:" + language);
-  }
-
-  auto text_direction = static_cast<ax::mojom::TextDirection>(
-      owner()->GetIntAttribute(ax::mojom::IntAttribute::kTextDirection));
-  switch (text_direction) {
-    case ax::mojom::TextDirection::kNone:
-    case ax::mojom::TextDirection::kLtr:
-      break;
-    case ax::mojom::TextDirection::kRtl:
-      attributes.push_back(L"writing-mode:rl");
-      break;
-    case ax::mojom::TextDirection::kTtb:
-      attributes.push_back(L"writing-mode:tb");
-      break;
-    case ax::mojom::TextDirection::kBtt:
-      // Not listed in the IA2 Spec.
-      attributes.push_back(L"writing-mode:bt");
-      break;
-  }
-
-  auto text_position = static_cast<ax::mojom::TextPosition>(
-      owner()->GetIntAttribute(ax::mojom::IntAttribute::kTextPosition));
-  switch (text_position) {
-    case ax::mojom::TextPosition::kNone:
-      break;
-    case ax::mojom::TextPosition::kSubscript:
-      attributes.push_back(L"text-position:sub");
-      break;
-    case ax::mojom::TextPosition::kSuperscript:
-      attributes.push_back(L"text-position:super");
-      break;
-  }
-
-  return attributes;
-}
-
 BrowserAccessibilityComWin* BrowserAccessibilityComWin::NewReference() {
   AddRef();
   return this;
 }
 
-std::map<int, std::vector<base::string16>>
-BrowserAccessibilityComWin::GetSpellingAttributes() {
-  std::map<int, std::vector<base::string16>> spelling_attributes;
-  if (owner()->IsTextOnlyObject()) {
-    const std::vector<int32_t>& marker_types =
-        owner()->GetIntListAttribute(ax::mojom::IntListAttribute::kMarkerTypes);
-    const std::vector<int>& marker_starts = owner()->GetIntListAttribute(
-        ax::mojom::IntListAttribute::kMarkerStarts);
-    const std::vector<int>& marker_ends =
-        owner()->GetIntListAttribute(ax::mojom::IntListAttribute::kMarkerEnds);
-    for (size_t i = 0; i < marker_types.size(); ++i) {
-      bool isSpellingError =
-          (marker_types[i] &
-           static_cast<int32_t>(ax::mojom::MarkerType::kSpelling)) != 0;
-      bool isGrammarError =
-          (marker_types[i] &
-           static_cast<int32_t>(ax::mojom::MarkerType::kGrammar)) != 0;
-      base::string16 invalid_str;
-      if (isSpellingError && isGrammarError)
-        invalid_str = L"invalid:spelling,grammar";
-      else if (isSpellingError)
-        invalid_str = L"invalid:spelling";
-      else if (isGrammarError)
-        invalid_str = L"invalid:grammar";
-      else
-        continue;
-      int start_offset = marker_starts[i];
-      int end_offset = marker_ends[i];
-      std::vector<base::string16> start_attributes;
-      start_attributes.push_back(invalid_str);
-      spelling_attributes[start_offset] = start_attributes;
-      spelling_attributes[end_offset] = std::vector<base::string16>();
-    }
-  }
-  if (owner()->IsPlainTextField()) {
-    int start_offset = 0;
-    for (BrowserAccessibility* static_text =
-             BrowserAccessibilityManager::NextTextOnlyObject(
-                 owner()->InternalGetFirstChild());
-         static_text; static_text = static_text->InternalGetNextSibling()) {
-      auto* text_win = ToBrowserAccessibilityComWin(static_text);
-      if (text_win) {
-        std::map<int, std::vector<base::string16>> text_spelling_attributes =
-            text_win->GetSpellingAttributes();
-        for (auto& attribute : text_spelling_attributes) {
-          spelling_attributes[start_offset + attribute.first] =
-              std::move(attribute.second);
-        }
-        start_offset += static_cast<int>(text_win->GetHypertext().length());
-      }
-    }
-  }
-  return spelling_attributes;
-}
-
 BrowserAccessibilityComWin* BrowserAccessibilityComWin::GetTargetFromChildID(
     const VARIANT& var_id) {
   if (!owner())
@@ -2054,56 +1821,6 @@ bool HasAttribute(const std::vector<base::string16>& existing_attributes,
   return false;
 }
 
-// static
-void BrowserAccessibilityComWin::MergeSpellingIntoTextAttributes(
-    const std::map<int, std::vector<base::string16>>& spelling_attributes,
-    int start_offset,
-    std::map<int, std::vector<base::string16>>* text_attributes) {
-  if (!text_attributes) {
-    NOTREACHED();
-    return;
-  }
-
-  std::vector<base::string16> prev_attributes;
-  for (const auto& spelling_attribute : spelling_attributes) {
-    int offset = start_offset + spelling_attribute.first;
-    auto iterator = text_attributes->find(offset);
-    if (iterator == text_attributes->end()) {
-      text_attributes->emplace(offset, prev_attributes);
-      iterator = text_attributes->find(offset);
-    } else {
-      prev_attributes = iterator->second;
-    }
-
-    std::vector<base::string16>& existing_attributes = iterator->second;
-    // There might be a spelling attribute already in the list of text
-    // attributes, originating from "aria-invalid", that is being overwritten
-    // by a spelling marker. If it already exists, prefer it over this
-    // automatically computed attribute.
-    if (!HasAttribute(existing_attributes, L"invalid:")) {
-      // Does not exist -- insert our own.
-      existing_attributes.insert(existing_attributes.end(),
-                                 spelling_attribute.second.begin(),
-                                 spelling_attribute.second.end());
-    }
-  }
-}
-
-// Static
-void BrowserAccessibilityComWin::SanitizeStringAttributeForIA2(
-    const base::string16& input,
-    base::string16* output) {
-  DCHECK(output);
-  // According to the IA2 Spec, these characters need to be escaped with a
-  // backslash: backslash, colon, comma, equals and semicolon.
-  // Note that backslash must be replaced first.
-  base::ReplaceChars(input, L"\\", L"\\\\", output);
-  base::ReplaceChars(*output, L":", L"\\:", output);
-  base::ReplaceChars(*output, L",", L"\\,", output);
-  base::ReplaceChars(*output, L"=", L"\\=", output);
-  base::ReplaceChars(*output, L";", L"\\;", output);
-}
-
 void BrowserAccessibilityComWin::SetIA2HypertextSelection(LONG start_offset,
                                                           LONG end_offset) {
   HandleSpecialTextOffset(&start_offset);
diff --git a/chromium/content/browser/accessibility/browser_accessibility_com_win.h b/chromium/content/browser/accessibility/browser_accessibility_com_win.h
index d6a27896c9a..26b25e0e449 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_com_win.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_com_win.h
@@ -8,10 +8,13 @@
 #include <oleacc.h>
 #include <stddef.h>
 #include <stdint.h>
+
+#include <map>
+#include <memory>
+#include <string>
 #include <vector>
 
 #include "base/compiler_specific.h"
-#include "base/gtest_prod_util.h"
 #include "base/macros.h"
 #include "base/win/atl.h"
 #include "content/browser/accessibility/browser_accessibility.h"
@@ -392,8 +395,7 @@ class __declspec(uuid("562072fe-3390-43b1-9e2c-dd4118f5ac79"))
 
   // Public accessors (these do not have COM accessible accessors)
   const base::string16& role_name() const { return win_attributes_->role_name; }
-  const std::map<int, std::vector<base::string16>>& offset_to_text_attributes()
-      const {
+  const ui::TextAttributeMap& offset_to_text_attributes() const {
     return win_attributes_->offset_to_text_attributes;
   }
 
@@ -419,18 +421,13 @@ class __declspec(uuid("562072fe-3390-43b1-9e2c-dd4118f5ac79"))
   void Init(ui::AXPlatformNodeDelegate* delegate) override;
 
   // Returns the IA2 text attributes for this object.
-  std::vector<base::string16> ComputeTextAttributes() const;
+  ui::TextAttributeList ComputeTextAttributes() const;
 
   // Add one to the reference count and return the same object. Always
   // use this method when returning a BrowserAccessibilityComWin object as
   // an output parameter to a COM interface, never use it otherwise.
   BrowserAccessibilityComWin* NewReference();
 
-  // Returns a list of IA2 attributes indicating the offsets in the text of a
-  // leaf object, such as a text field or static text, where spelling errors are
-  // present.
-  std::map<int, std::vector<base::string16>> GetSpellingAttributes();
-
   // Many MSAA methods take a var_id parameter indicating that the operation
   // should be performed on a particular child ID, rather than this object.
   // This method tries to figure out the target object from |var_id| and
@@ -444,27 +441,6 @@ class __declspec(uuid("562072fe-3390-43b1-9e2c-dd4118f5ac79"))
   HRESULT GetStringAttributeAsBstr(ax::mojom::StringAttribute attribute,
                                    BSTR* value_bstr);
 
-  // Merges the given spelling attributes, i.e. document marker information,
-  // into the given text attributes starting at the given character offset. This
-  // is required for two reasons: 1. Document markers that are present on text
-  // leaves need to be propagated to their parent object for compatibility with
-  // Firefox. 2. Spelling markers need to overwrite any aria-invalid="false" in
-  // the text attributes.
-  static void MergeSpellingIntoTextAttributes(
-      const std::map<int, std::vector<base::string16>>& spelling_attributes,
-      int start_offset,
-      std::map<int, std::vector<base::string16>>* text_attributes);
-
-  // Escapes characters in string attributes as required by the IA2 Spec.
-  // It's okay for input to be the same as output.
-  CONTENT_EXPORT static void SanitizeStringAttributeForIA2(
-      const base::string16& input,
-      base::string16* output);
-  FRIEND_TEST_ALL_PREFIXES(BrowserAccessibilityTest,
-                           TestSanitizeStringAttributeForIA2);
-  FRIEND_TEST_ALL_PREFIXES(BrowserAccessibilityWinTest,
-                           TestSanitizeStringAttributeForIA2);
-
   // Sets the selection given a start and end offset in IA2 Hypertext.
   void SetIA2HypertextSelection(LONG start_offset, LONG end_offset);
 
@@ -516,7 +492,7 @@ class __declspec(uuid("562072fe-3390-43b1-9e2c-dd4118f5ac79"))
     std::vector<base::string16> ia2_attributes;
 
     // Maps each style span to its start offset in hypertext.
-    std::map<int, std::vector<base::string16>> offset_to_text_attributes;
+    ui::TextAttributeMap offset_to_text_attributes;
   };
 
   BrowserAccessibilityWin* owner_;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_mac.mm b/chromium/content/browser/accessibility/browser_accessibility_mac.mm
index d97c51e9cc7..966036fb0ee 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_mac.mm
+++ b/chromium/content/browser/accessibility/browser_accessibility_mac.mm
@@ -62,18 +62,20 @@ uint32_t BrowserAccessibilityMac::PlatformChildCount() const {
 
 BrowserAccessibility* BrowserAccessibilityMac::PlatformGetChild(
     uint32_t child_index) const {
-  uint32_t child_count = BrowserAccessibility::PlatformChildCount();
-  if (child_index < child_count)
+  if (child_index < BrowserAccessibility::PlatformChildCount())
     return BrowserAccessibility::PlatformGetChild(child_index);
 
+  if (child_index >= PlatformChildCount())
+    return nullptr;
+
   // If this is a table, include the extra fake nodes generated by
   // AXTableInfo, for the column nodes and the table header container, all of
   // which are only important on macOS.
   const std::vector<ui::AXNode*>* extra_mac_nodes = node()->GetExtraMacNodes();
-  if (!extra_mac_nodes)
+  if (!extra_mac_nodes || extra_mac_nodes->empty())
     return nullptr;
 
-  child_index -= child_count;
+  child_index -= BrowserAccessibility::PlatformChildCount();
   if (child_index < extra_mac_nodes->size())
     return manager_->GetFromAXNode((*extra_mac_nodes)[child_index]);
 
@@ -86,7 +88,7 @@ BrowserAccessibility* BrowserAccessibilityMac::PlatformGetFirstChild() const {
 
 BrowserAccessibility* BrowserAccessibilityMac::PlatformGetLastChild() const {
   const std::vector<ui::AXNode*>* extra_mac_nodes = node()->GetExtraMacNodes();
-  if (extra_mac_nodes && extra_mac_nodes->size())
+  if (extra_mac_nodes && !extra_mac_nodes->empty())
     return manager_->GetFromAXNode(extra_mac_nodes->back());
   return BrowserAccessibility::PlatformGetLastChild();
 }
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager.cc b/chromium/content/browser/accessibility/browser_accessibility_manager.cc
index c5675aebb40..264ae2a80fe 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager.cc
@@ -11,6 +11,7 @@
 
 #include "base/debug/crash_logging.h"
 #include "base/logging.h"
+#include "base/metrics/user_metrics.h"
 #include "base/no_destructor.h"
 #include "build/build_config.h"
 #include "content/browser/accessibility/browser_accessibility.h"
@@ -635,9 +636,14 @@ void BrowserAccessibilityManager::SetFocus(const BrowserAccessibility& node) {
   if (!delegate_)
     return;
 
+  base::RecordAction(
+      base::UserMetricsAction("Accessibility.NativeApi.SetFocus"));
+
   ui::AXActionData action_data;
   action_data.action = ax::mojom::Action::kFocus;
   action_data.target_node_id = node.GetId();
+  if (!delegate_->AccessibilityViewHasFocus())
+    delegate_->AccessibilityViewSetFocus();
   delegate_->AccessibilityPerformAction(action_data);
 }
 
@@ -691,6 +697,9 @@ void BrowserAccessibilityManager::DoDefaultAction(
   if (!delegate_)
     return;
 
+  base::RecordAction(
+      base::UserMetricsAction("Accessibility.NativeApi.DoDefault"));
+
   ui::AXActionData action_data;
   action_data.action = ax::mojom::Action::kDoDefault;
   action_data.target_node_id = node.GetId();
@@ -747,6 +756,9 @@ void BrowserAccessibilityManager::ScrollToMakeVisible(
   if (!delegate_)
     return;
 
+  base::RecordAction(
+      base::UserMetricsAction("Accessibility.NativeApi.ScrollToMakeVisible"));
+
   ui::AXActionData action_data;
   action_data.target_node_id = node.GetId();
   action_data.action = ax::mojom::Action::kScrollToMakeVisible;
@@ -852,6 +864,9 @@ void BrowserAccessibilityManager::HitTest(const gfx::Point& point) {
   if (!delegate_)
     return;
 
+  base::RecordAction(
+      base::UserMetricsAction("Accessibility.NativeApi.HitTest"));
+
   ui::AXActionData action_data;
   action_data.action = ax::mojom::Action::kHitTest;
   action_data.target_point = point;
@@ -897,8 +912,7 @@ BrowserAccessibility* BrowserAccessibilityManager::PreviousInTreeOrder(
 
   // For android, this needs to be handled carefully. If not, there is a chance
   // of getting into infinite loop.
-  if (can_wrap_to_last_element &&
-      object->GetRole() == ax::mojom::Role::kRootWebArea &&
+  if (can_wrap_to_last_element && object->manager()->GetRoot() == object &&
       object->PlatformChildCount() != 0) {
     return object->PlatformDeepestLastChild();
   }
@@ -1283,20 +1297,6 @@ ui::AXNode* BrowserAccessibilityManager::GetNodeFromTree(
   return nullptr;
 }
 
-ui::AXPlatformNodeDelegate* BrowserAccessibilityManager::GetDelegate(
-    const ui::AXTreeID tree_id,
-    const int32_t node_id) const {
-  auto* manager = BrowserAccessibilityManager::FromID(tree_id);
-  if (!manager)
-    return nullptr;
-
-  BrowserAccessibility* wrapper = manager->GetFromID(node_id);
-  if (wrapper)
-    return wrapper;
-
-  return nullptr;
-}
-
 AXTreeID BrowserAccessibilityManager::GetTreeID() const {
   return ax_tree_id();
 }
@@ -1347,15 +1347,6 @@ ui::AXNode* BrowserAccessibilityManager::GetParentNodeFromParentTreeAsAXNode()
   return nullptr;
 }
 
-ui::AXPlatformNodeDelegate* BrowserAccessibilityManager::GetRootDelegate(
-    const ui::AXTreeID tree_id) const {
-  auto* manager = BrowserAccessibilityManager::FromID(tree_id);
-  if (!manager)
-    return nullptr;
-
-  return manager->GetRoot();
-}
-
 BrowserAccessibilityManager* BrowserAccessibilityManager::GetRootManager()
     const {
   BrowserAccessibility* parent = GetParentNodeFromParentTree();
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager.h b/chromium/content/browser/accessibility/browser_accessibility_manager.h
index a65464b3151..69b1ce5be6d 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager.h
@@ -82,6 +82,7 @@ class CONTENT_EXPORT BrowserAccessibilityDelegate {
 
   virtual void AccessibilityPerformAction(const ui::AXActionData& data) = 0;
   virtual bool AccessibilityViewHasFocus() const = 0;
+  virtual void AccessibilityViewSetFocus() = 0;
   virtual gfx::Rect AccessibilityGetViewBounds() const = 0;
   virtual float AccessibilityGetDeviceScaleFactor() const = 0;
   virtual void AccessibilityFatalError() = 0;
@@ -411,10 +412,6 @@ class CONTENT_EXPORT BrowserAccessibilityManager : public ui::AXTreeObserver,
   // AXTreeManager implementation.
   ui::AXNode* GetNodeFromTree(ui::AXTreeID tree_id,
                               int32_t node_id) const override;
-  ui::AXPlatformNodeDelegate* GetDelegate(const ui::AXTreeID tree_id,
-                                          const int32_t node_id) const override;
-  ui::AXPlatformNodeDelegate* GetRootDelegate(
-      const ui::AXTreeID tree_id) const override;
   AXTreeID GetTreeID() const override;
   AXTreeID GetParentTreeID() const override;
   ui::AXNode* GetRootAsAXNode() const override;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h
index d6b054719ec..7ee8c62e7b3 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_auralinux.h
@@ -25,6 +25,9 @@ class CONTENT_EXPORT BrowserAccessibilityManagerAuraLinux
   ~BrowserAccessibilityManagerAuraLinux() override;
 
   static ui::AXTreeUpdate GetEmptyDocument();
+  static BrowserAccessibility* FindCommonAncestor(
+      BrowserAccessibility* object1,
+      BrowserAccessibility* object2);
 
   // Implementation of BrowserAccessibilityManager methods.
   void FireFocusEvent(BrowserAccessibility* node) override;
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc
index d72194964c9..76b55393a89 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_unittest.cc
@@ -1114,6 +1114,7 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousInTreeOrder) {
             manager->PreviousInTreeOrder(node3_accessible, false));
   EXPECT_EQ(root_accessible,
             manager->PreviousInTreeOrder(node2_accessible, false));
+  EXPECT_EQ(nullptr, manager->PreviousInTreeOrder(root_accessible, false));
 
   EXPECT_EQ(nullptr, manager->PreviousInTreeOrder(nullptr, true));
   EXPECT_EQ(node4_accessible,
@@ -1124,6 +1125,8 @@ TEST_F(BrowserAccessibilityManagerTest, TestNextPreviousInTreeOrder) {
             manager->PreviousInTreeOrder(node3_accessible, true));
   EXPECT_EQ(root_accessible,
             manager->PreviousInTreeOrder(node2_accessible, true));
+  EXPECT_EQ(node5_accessible,
+            manager->PreviousInTreeOrder(root_accessible, true));
 
   EXPECT_EQ(ax::mojom::TreeOrder::kEqual,
             BrowserAccessibilityManager::CompareNodes(*root_accessible,
diff --git a/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc b/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
index 1a10aa92c39..3f515b87dfe 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_manager_win.cc
@@ -242,9 +242,17 @@ void BrowserAccessibilityManagerWin::FireGeneratedEvent(
       if (node->IsIgnored()) {
         FireWinAccessibilityEvent(EVENT_OBJECT_HIDE, node);
         FireUiaStructureChangedEvent(StructureChangeType_ChildRemoved, node);
+        if (node->GetRole() == ax::mojom::Role::kMenu) {
+          FireWinAccessibilityEvent(EVENT_SYSTEM_MENUPOPUPEND, node);
+          FireUiaAccessibilityEvent(UIA_MenuClosedEventId, node);
+        }
       } else {
         FireWinAccessibilityEvent(EVENT_OBJECT_SHOW, node);
         FireUiaStructureChangedEvent(StructureChangeType_ChildAdded, node);
+        if (node->GetRole() == ax::mojom::Role::kMenu) {
+          FireWinAccessibilityEvent(EVENT_SYSTEM_MENUPOPUPSTART, node);
+          FireUiaAccessibilityEvent(UIA_MenuOpenedEventId, node);
+        }
       }
       aria_properties_events_.insert(node);
       break;
@@ -411,11 +419,15 @@ void BrowserAccessibilityManagerWin::FireWinAccessibilityEvent(
     return;
   if (!ShouldFireEventForNode(node))
     return;
-  // Suppress events when |IGNORED_CHANGED| except for related SHOW / HIDE
+  // Suppress events when |IGNORED_CHANGED| except for related SHOW / HIDE.
+  // Also include MENUPOPUPSTART / MENUPOPUPEND since a change in the ignored
+  // state may show / hide a popup by exposing it to the tree or not.
   if (base::Contains(ignored_changed_nodes_, node)) {
     switch (win_event_type) {
       case EVENT_OBJECT_HIDE:
       case EVENT_OBJECT_SHOW:
+      case EVENT_SYSTEM_MENUPOPUPEND:
+      case EVENT_SYSTEM_MENUPOPUPSTART:
         break;
       default:
         return;
@@ -443,9 +455,20 @@ void BrowserAccessibilityManagerWin::FireUiaAccessibilityEvent(
     return;
   if (!ShouldFireEventForNode(node))
     return;
-  // Suppress events when |IGNORED_CHANGED|
-  if (node->IsIgnored() || base::Contains(ignored_changed_nodes_, node))
+  // Suppress events when |IGNORED_CHANGED| except for MenuClosed / MenuOpen
+  // since a change in the ignored state may show / hide a popup by exposing
+  // it to the tree or not.
+  if (base::Contains(ignored_changed_nodes_, node)) {
+    switch (uia_event) {
+      case UIA_MenuClosedEventId:
+      case UIA_MenuOpenedEventId:
+        break;
+      default:
+        return;
+    }
+  } else if (node->IsIgnored()) {
     return;
+  }
 
   ::UiaRaiseAutomationEvent(ToBrowserAccessibilityWin(node)->GetCOM(),
                             uia_event);
diff --git a/chromium/content/browser/accessibility/browser_accessibility_position.cc b/chromium/content/browser/accessibility/browser_accessibility_position.cc
index 2ff9d322dad..7624d613890 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_position.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_position.cc
@@ -29,15 +29,16 @@ base::string16 BrowserAccessibilityPosition::GetText() const {
   return GetAnchor()->GetText();
 }
 
-void BrowserAccessibilityPosition::AnchorChild(int child_index,
-                                               AXTreeID* tree_id,
-                                               int32_t* child_id) const {
+void BrowserAccessibilityPosition::AnchorChild(
+    int child_index,
+    AXTreeID* tree_id,
+    ui::AXNode::AXID* child_id) const {
   DCHECK(tree_id);
   DCHECK(child_id);
 
   if (!GetAnchor() || child_index < 0 || child_index >= AnchorChildCount()) {
     *tree_id = ui::AXTreeIDUnknown();
-    *child_id = INVALID_ANCHOR_ID;
+    *child_id = ui::AXNode::kInvalidAXID;
     return;
   }
 
@@ -79,14 +80,15 @@ BrowserAccessibilityPosition::GetAncestorAnchors() const {
   return anchors;
 }
 
-void BrowserAccessibilityPosition::AnchorParent(AXTreeID* tree_id,
-                                                int32_t* parent_id) const {
+void BrowserAccessibilityPosition::AnchorParent(
+    AXTreeID* tree_id,
+    ui::AXNode::AXID* parent_id) const {
   DCHECK(tree_id);
   DCHECK(parent_id);
 
   if (!GetAnchor() || !GetAnchor()->PlatformGetParent()) {
     *tree_id = ui::AXTreeIDUnknown();
-    *parent_id = AXPosition::INVALID_ANCHOR_ID;
+    *parent_id = ui::AXNode::kInvalidAXID;
     return;
   }
 
@@ -97,9 +99,8 @@ void BrowserAccessibilityPosition::AnchorParent(AXTreeID* tree_id,
 
 BrowserAccessibility* BrowserAccessibilityPosition::GetNodeInTree(
     AXTreeID tree_id,
-    int32_t node_id) const {
-  if (tree_id == ui::AXTreeIDUnknown() ||
-      node_id == AXPosition::INVALID_ANCHOR_ID) {
+    ui::AXNode::AXID node_id) const {
+  if (tree_id == ui::AXTreeIDUnknown() || node_id == ui::AXNode::kInvalidAXID) {
     return nullptr;
   }
 
@@ -112,19 +113,14 @@ BrowserAccessibility* BrowserAccessibilityPosition::GetNodeInTree(
 // On some platforms, most objects are represented in the text of their parents
 // with a special (embedded object) character and not with their actual text
 // contents.
-int BrowserAccessibilityPosition::MaxTextOffsetInParent() const {
+bool BrowserAccessibilityPosition::IsEmbeddedObjectInParent() const {
 #if defined(OS_WIN) || BUILDFLAG(USE_ATK)
-  if (IsNullPosition())
-    return INVALID_OFFSET;
-  if (GetAnchor()->IsTextOnlyObject())
-    return MaxTextOffset();
   // Not all objects in the internal accessibility tree are exposed to platform
   // APIs.
-  if (GetAnchor()->PlatformIsChildOfLeaf())
-    return MaxTextOffset();
-  return 1;
+  return !IsNullPosition() && !GetAnchor()->IsTextOnlyObject() &&
+         !GetAnchor()->PlatformIsChildOfLeaf();
 #else
-  return MaxTextOffset();
+  return false;
 #endif
 }
 
@@ -194,30 +190,31 @@ std::vector<int32_t> BrowserAccessibilityPosition::GetWordEndOffsets() const {
       ax::mojom::IntListAttribute::kWordEnds);
 }
 
-int32_t BrowserAccessibilityPosition::GetNextOnLineID(int32_t node_id) const {
+ui::AXNode::AXID BrowserAccessibilityPosition::GetNextOnLineID(
+    ui::AXNode::AXID node_id) const {
   if (IsNullPosition())
-    return INVALID_ANCHOR_ID;
+    return ui::AXNode::kInvalidAXID;
   BrowserAccessibility* node = GetNodeInTree(tree_id(), node_id);
   int next_on_line_id;
   if (!node || !node->GetIntAttribute(ax::mojom::IntAttribute::kNextOnLineId,
                                       &next_on_line_id)) {
-    return INVALID_ANCHOR_ID;
+    return ui::AXNode::kInvalidAXID;
   }
-  return static_cast<int32_t>(next_on_line_id);
+  return static_cast<ui::AXNode::AXID>(next_on_line_id);
 }
 
-int32_t BrowserAccessibilityPosition::GetPreviousOnLineID(
-    int32_t node_id) const {
+ui::AXNode::AXID BrowserAccessibilityPosition::GetPreviousOnLineID(
+    ui::AXNode::AXID node_id) const {
   if (IsNullPosition())
-    return INVALID_ANCHOR_ID;
+    return ui::AXNode::kInvalidAXID;
   BrowserAccessibility* node = GetNodeInTree(tree_id(), node_id);
   int previous_on_line_id;
   if (!node ||
       !node->GetIntAttribute(ax::mojom::IntAttribute::kPreviousOnLineId,
                              &previous_on_line_id)) {
-    return INVALID_ANCHOR_ID;
+    return ui::AXNode::kInvalidAXID;
   }
-  return static_cast<int32_t>(previous_on_line_id);
+  return static_cast<ui::AXNode::AXID>(previous_on_line_id);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_position.h b/chromium/content/browser/accessibility/browser_accessibility_position.h
index 73d5b2fc17b..a221f847d66 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_position.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_position.h
@@ -39,22 +39,23 @@ class CONTENT_EXPORT BrowserAccessibilityPosition
       default;
   void AnchorChild(int child_index,
                    AXTreeID* tree_id,
-                   int32_t* child_id) const override;
+                   ui::AXNode::AXID* child_id) const override;
   int AnchorChildCount() const override;
   int AnchorIndexInParent() const override;
   base::stack<BrowserAccessibility*> GetAncestorAnchors() const override;
-  void AnchorParent(AXTreeID* tree_id, int32_t* parent_id) const override;
+  void AnchorParent(AXTreeID* tree_id,
+                    ui::AXNode::AXID* parent_id) const override;
   BrowserAccessibility* GetNodeInTree(AXTreeID tree_id,
-                                      int32_t node_id) const override;
-  int MaxTextOffsetInParent() const override;
+                                      ui::AXNode::AXID node_id) const override;
+  bool IsEmbeddedObjectInParent() const override;
 
   bool IsInLineBreakingObject() const override;
   ax::mojom::Role GetRole() const override;
   ui::AXNodeTextStyles GetTextStyles() const override;
   std::vector<int32_t> GetWordStartOffsets() const override;
   std::vector<int32_t> GetWordEndOffsets() const override;
-  int32_t GetNextOnLineID(int32_t node_id) const override;
-  int32_t GetPreviousOnLineID(int32_t node_id) const override;
+  ui::AXNode::AXID GetNextOnLineID(ui::AXNode::AXID node_id) const override;
+  ui::AXNode::AXID GetPreviousOnLineID(ui::AXNode::AXID node_id) const override;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_win.cc b/chromium/content/browser/accessibility/browser_accessibility_win.cc
index e2c2d9041f0..cf17b46f4bc 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_win.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_win.cc
@@ -40,6 +40,13 @@ void BrowserAccessibilityWin::UpdatePlatformAttributes() {
   GetCOM()->UpdateStep3FireEvents(false);
 }
 
+ui::AXPlatformNode* BrowserAccessibilityWin::GetAXPlatformNode() const {
+  if (!instance_active())
+    return nullptr;
+
+  return GetCOM();
+}
+
 bool BrowserAccessibilityWin::IsNative() const {
   return true;
 }
@@ -60,18 +67,6 @@ gfx::NativeViewAccessible BrowserAccessibilityWin::GetNativeViewAccessible() {
   return GetCOM();
 }
 
-ui::AXPlatformNode* BrowserAccessibilityWin::GetFromNodeID(int32_t id) {
-  if (!instance_active())
-    return nullptr;
-
-  BrowserAccessibility* accessibility = manager_->GetFromID(id);
-  if (!accessibility)
-    return nullptr;
-
-  auto* accessibility_win = ToBrowserAccessibilityWin(accessibility);
-  return accessibility_win->GetCOM();
-}
-
 BrowserAccessibilityComWin* BrowserAccessibilityWin::GetCOM() const {
   DCHECK(browser_accessibility_com_);
   return browser_accessibility_com_;
@@ -88,4 +83,8 @@ const BrowserAccessibilityWin* ToBrowserAccessibilityWin(
   return static_cast<const BrowserAccessibilityWin*>(obj);
 }
 
+ui::TextAttributeList BrowserAccessibilityWin::ComputeTextAttributes() const {
+  return GetCOM()->AXPlatformNodeWin::ComputeTextAttributes();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/browser_accessibility_win.h b/chromium/content/browser/accessibility/browser_accessibility_win.h
index 955c88de7d3..4065cab6c4b 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_win.h
+++ b/chromium/content/browser/accessibility/browser_accessibility_win.h
@@ -25,16 +25,19 @@ class CONTENT_EXPORT BrowserAccessibilityWin : public BrowserAccessibility {
   //
   // BrowserAccessibility methods.
   //
+  ui::AXPlatformNode* GetAXPlatformNode() const override;
   bool IsNative() const override;
   void OnLocationChanged() override;
   base::string16 GetText() const override;
   base::string16 GetHypertext() const override;
 
   gfx::NativeViewAccessible GetNativeViewAccessible() override;
-  ui::AXPlatformNode* GetFromNodeID(int32_t id) override;
 
   class BrowserAccessibilityComWin* GetCOM() const;
 
+ protected:
+  ui::TextAttributeList ComputeTextAttributes() const override;
+
  private:
   CComObject<BrowserAccessibilityComWin>* browser_accessibility_com_;
   // Give BrowserAccessibility::Create access to our constructor.
diff --git a/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc b/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc
index 18806588558..e92df9a8f7d 100644
--- a/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc
+++ b/chromium/content/browser/accessibility/browser_accessibility_win_unittest.cc
@@ -2292,13 +2292,6 @@ TEST_F(BrowserAccessibilityWinTest, TestInheritedStringAttributes) {
                          ax::mojom::StringAttribute::kFontFamily));
 }
 
-TEST_F(BrowserAccessibilityWinTest, TestSanitizeStringAttributeForIA2) {
-  base::string16 input(L"\\:=,;");
-  base::string16 output;
-  BrowserAccessibilityComWin::SanitizeStringAttributeForIA2(input, &output);
-  EXPECT_EQ(L"\\\\\\:\\=\\,\\;", output);
-}
-
 TEST_F(BrowserAccessibilityWinTest, UniqueIdWinInvalidAfterDeletingTree) {
   ui::AXNodeData root_node;
   root_node.id = 1;
diff --git a/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc b/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
index 6333e2171ce..ba8209fab26 100644
--- a/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
+++ b/chromium/content/browser/accessibility/cross_platform_accessibility_browsertest.cc
@@ -671,7 +671,7 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
       };
 
   // For testing purposes, assume we get en-US localized strings.
-  TestLocalizedLandmarkType(0, ax::mojom::Role::kBanner, "header",
+  TestLocalizedLandmarkType(0, ax::mojom::Role::kHeader, "header",
                             base::ASCIIToUTF16("banner"));
   TestLocalizedLandmarkType(1, ax::mojom::Role::kComplementary, "aside",
                             base::ASCIIToUTF16("complementary"));
@@ -680,8 +680,8 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
   TestLocalizedLandmarkType(3, ax::mojom::Role::kForm, "form");
   TestLocalizedLandmarkType(4, ax::mojom::Role::kMain, "main");
   TestLocalizedLandmarkType(5, ax::mojom::Role::kNavigation, "nav");
-  TestLocalizedLandmarkType(6, ax::mojom::Role::kRegion, "");
-  TestLocalizedLandmarkType(7, ax::mojom::Role::kRegion, "section",
+  TestLocalizedLandmarkType(6, ax::mojom::Role::kSection, "");
+  TestLocalizedLandmarkType(7, ax::mojom::Role::kSection, "section",
                             base::ASCIIToUTF16("region"));
 
   TestLocalizedLandmarkType(8, ax::mojom::Role::kBanner, "banner",
@@ -710,6 +710,8 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
       "<audio controls></audio>"
       "<details></details>"
       "<figure></figure>"
+      "<footer></footer>"
+      "<header></header>"
       "<input>"
       "<input type='color'>"
       "<input type='date'>"
@@ -718,17 +720,20 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
       "<input type='tel'>"
       "<input type='url'>"
       "<input type='week'>"
+      "<mark></mark>"
       "<meter></meter>"
       "<output></output>"
+      "<section></section>"
+      "<section aria-label='section'></section>"
       "<time></time>"
       "<div role='contentinfo' aria-label='contentinfo'></div>");
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   waiter.WaitForNotification();
 
   BrowserAccessibility* root = GetManager()->GetRoot();
   ASSERT_NE(nullptr, root);
-  ASSERT_EQ(16u, root->PlatformChildCount());
+  ASSERT_EQ(21u, root->PlatformChildCount());
 
   auto TestLocalizedRoleDescription =
       [root](int child_index,
@@ -745,19 +750,24 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
   TestLocalizedRoleDescription(1, base::ASCIIToUTF16("audio"));
   TestLocalizedRoleDescription(2, base::ASCIIToUTF16("details"));
   TestLocalizedRoleDescription(3, base::ASCIIToUTF16("figure"));
-  TestLocalizedRoleDescription(4, base::ASCIIToUTF16(""));
-  TestLocalizedRoleDescription(5, base::ASCIIToUTF16("color picker"));
-  TestLocalizedRoleDescription(6, base::ASCIIToUTF16("date picker"));
+  TestLocalizedRoleDescription(4, base::ASCIIToUTF16("footer"));
+  TestLocalizedRoleDescription(5, base::ASCIIToUTF16("header"));
+  TestLocalizedRoleDescription(6, base::ASCIIToUTF16(""));
+  TestLocalizedRoleDescription(7, base::ASCIIToUTF16("color picker"));
+  TestLocalizedRoleDescription(8, base::ASCIIToUTF16("date picker"));
   TestLocalizedRoleDescription(
-      7, base::ASCIIToUTF16("local date and time picker"));
-  TestLocalizedRoleDescription(8, base::ASCIIToUTF16("email"));
-  TestLocalizedRoleDescription(9, base::ASCIIToUTF16("telephone"));
-  TestLocalizedRoleDescription(10, base::ASCIIToUTF16("url"));
-  TestLocalizedRoleDescription(11, base::ASCIIToUTF16("week picker"));
-  TestLocalizedRoleDescription(12, base::ASCIIToUTF16("meter"));
-  TestLocalizedRoleDescription(13, base::ASCIIToUTF16("output"));
-  TestLocalizedRoleDescription(14, base::ASCIIToUTF16("time"));
-  TestLocalizedRoleDescription(15, base::ASCIIToUTF16("content information"));
+      9, base::ASCIIToUTF16("local date and time picker"));
+  TestLocalizedRoleDescription(10, base::ASCIIToUTF16("email"));
+  TestLocalizedRoleDescription(11, base::ASCIIToUTF16("telephone"));
+  TestLocalizedRoleDescription(12, base::ASCIIToUTF16("url"));
+  TestLocalizedRoleDescription(13, base::ASCIIToUTF16("week picker"));
+  TestLocalizedRoleDescription(14, base::ASCIIToUTF16("highlight"));
+  TestLocalizedRoleDescription(15, base::ASCIIToUTF16("meter"));
+  TestLocalizedRoleDescription(16, base::ASCIIToUTF16("output"));
+  TestLocalizedRoleDescription(17, base::ASCIIToUTF16(""));
+  TestLocalizedRoleDescription(18, base::ASCIIToUTF16("section"));
+  TestLocalizedRoleDescription(19, base::ASCIIToUTF16("time"));
+  TestLocalizedRoleDescription(20, base::ASCIIToUTF16("content information"));
 }
 
 IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
@@ -799,17 +809,16 @@ IN_PROC_BROWSER_TEST_F(CrossPlatformAccessibilityBrowserTest,
                                              ax::mojom::Role::kStaticText);
 
   BrowserAccessibility* mark_node = para_node->PlatformGetChild(1);
-  TestGetStyleNameAttributeAsLocalizedString(
-      mark_node, ax::mojom::Role::kMark,
-      base::ASCIIToUTF16("highlighted content"));
+  TestGetStyleNameAttributeAsLocalizedString(mark_node, ax::mojom::Role::kMark,
+                                             base::ASCIIToUTF16("highlight"));
 
   // Android doesn't always have a child in this case.
   if (mark_node->PlatformChildCount() > 0u) {
     BrowserAccessibility* mark_text_node = mark_node->PlatformGetChild(0);
     ASSERT_EQ(0u, mark_text_node->PlatformChildCount());
-    TestGetStyleNameAttributeAsLocalizedString(
-        mark_text_node, ax::mojom::Role::kStaticText,
-        base::ASCIIToUTF16("highlighted content"));
+    TestGetStyleNameAttributeAsLocalizedString(mark_text_node,
+                                               ax::mojom::Role::kStaticText,
+                                               base::ASCIIToUTF16("highlight"));
   }
 }
 
diff --git a/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc b/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc
index 77155bd0dc4..6d01281b072 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.cc
@@ -40,6 +40,7 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "ui/accessibility/accessibility_features.h"
 
 namespace content {
 
@@ -102,14 +103,25 @@ void DumpAccessibilityTestBase::SetUpOnMainThread() {
 }
 
 void DumpAccessibilityTestBase::SetUp() {
+  std::vector<base::Feature> enabled_features;
+  std::vector<base::Feature> disabled_features;
+
+  // Enable exposing "display: none" nodes to the browser process for testing.
+  enabled_features.emplace_back(
+      features::kEnableAccessibilityExposeARIAAnnotations);
+
+  // Enable exposing ARIA Annotation roles.
+  enabled_features.emplace_back(
+      features::kEnableAccessibilityExposeDisplayNone);
+
   // TODO(dmazzoni): DumpAccessibilityTree expectations are based on the
   // assumption that the accessibility labels feature is off. (There are
   // also several tests that explicitly enable the feature.) It'd be better
   // if DumpAccessibilityTree tests assumed that the feature is on by
   // default instead.  http://crbug.com/940330
-  scoped_feature_list_.InitAndDisableFeature(
-      features::kExperimentalAccessibilityLabels);
+  disabled_features.emplace_back(features::kExperimentalAccessibilityLabels);
 
+  scoped_feature_list_.InitWithFeatures(enabled_features, disabled_features);
   ContentBrowserTest::SetUp();
 }
 
@@ -133,6 +145,7 @@ DumpAccessibilityTestBase::DumpUnfilteredAccessibilityTreeAsString() {
 void DumpAccessibilityTestBase::ParseHtmlForExtraDirectives(
     const std::string& test_html,
     std::vector<std::string>* wait_for,
+    std::vector<std::string>* execute,
     std::vector<std::string>* run_until,
     std::vector<std::string>* default_action_on) {
   for (const std::string& line : base::SplitString(
@@ -142,6 +155,7 @@ void DumpAccessibilityTestBase::ParseHtmlForExtraDirectives(
     const std::string& deny_str = formatter_->GetDenyString();
     const std::string& deny_node_str = formatter_->GetDenyNodeString();
     const std::string& wait_str = "@WAIT-FOR:";
+    const std::string& execute_str = "@EXECUTE-AND-WAIT-FOR:";
     const std::string& until_str = "@RUN-UNTIL-EVENT:";
     const std::string& default_action_on_str = "@DEFAULT-ACTION-ON:";
     if (base::StartsWith(line, allow_empty_str, base::CompareCase::SENSITIVE)) {
@@ -169,6 +183,9 @@ void DumpAccessibilityTestBase::ParseHtmlForExtraDirectives(
       }
     } else if (base::StartsWith(line, wait_str, base::CompareCase::SENSITIVE)) {
       wait_for->push_back(line.substr(wait_str.size()));
+    } else if (base::StartsWith(line, execute_str,
+                                base::CompareCase::SENSITIVE)) {
+      execute->push_back(line.substr(execute_str.size()));
     } else if (base::StartsWith(line, until_str,
                                 base::CompareCase::SENSITIVE)) {
       run_until->push_back(line.substr(until_str.size()));
@@ -255,13 +272,14 @@ void DumpAccessibilityTestBase::RunTestForPlatform(
 
   // Parse filters and other directives in the test file.
   std::vector<std::string> wait_for;
+  std::vector<std::string> execute;
   std::vector<std::string> run_until;
   std::vector<std::string> default_action_on;
   property_filters_.clear();
   node_filters_.clear();
   formatter_->AddDefaultFilters(&property_filters_);
   AddDefaultFilters(&property_filters_);
-  ParseHtmlForExtraDirectives(html_contents, &wait_for, &run_until,
+  ParseHtmlForExtraDirectives(html_contents, &wait_for, &execute, &run_until,
                               &default_action_on);
 
   // Get the test URL.
@@ -374,6 +392,35 @@ void DumpAccessibilityTestBase::RunTestForPlatform(
   // Call the subclass to dump the output.
   std::vector<std::string> actual_lines = Dump(run_until);
 
+  // Execute and wait for specified string
+  for (const auto& function_name : execute) {
+    DLOG(INFO) << "executing: " << function_name;
+    base::Value result =
+        ExecuteScriptAndGetValue(web_contents->GetMainFrame(), function_name);
+    const std::string& str = result.is_string() ? result.GetString() : "";
+    // If no string is specified, do not wait.
+    bool wait_for_string = str != "";
+    while (wait_for_string) {
+      // Loop until specified string is found.
+      base::string16 tree_dump = DumpUnfilteredAccessibilityTreeAsString();
+      if (base::UTF16ToUTF8(tree_dump).find(str) != std::string::npos) {
+        wait_for_string = false;
+        // Append an additional dump if the specified string was found.
+        std::vector<std::string> additional_dump = Dump(run_until);
+        actual_lines.emplace_back("=== Start Continuation ===");
+        actual_lines.insert(actual_lines.end(), additional_dump.begin(),
+                            additional_dump.end());
+        break;
+      }
+      // Block until the next accessibility notification in any frame.
+      VLOG(1) << "Still waiting on this text to be found: " << str;
+      VLOG(1) << "Waiting until the next accessibility event";
+      AccessibilityNotificationWaiter accessibility_waiter(
+          web_contents, ui::AXMode(), ax::mojom::Event::kNone);
+      accessibility_waiter.WaitForNotification();
+    }
+  }
+
   // Validate against the expectation file.
   bool matches_expectation = test_helper.ValidateAgainstExpectation(
       file_path, expected_file, actual_lines, *expected_lines);
diff --git a/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.h b/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.h
index b731dc28337..45da92bb90d 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.h
+++ b/chromium/content/browser/accessibility/dump_accessibility_browsertest_base.h
@@ -90,6 +90,7 @@ class DumpAccessibilityTestBase : public ContentBrowserTest,
   // @WAIT-FOR: directives.
   void ParseHtmlForExtraDirectives(const std::string& test_html,
                                    std::vector<std::string>* wait_for,
+                                   std::vector<std::string>* execute,
                                    std::vector<std::string>* run_until,
                                    std::vector<std::string>* default_action_on);
 
diff --git a/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc b/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc
index 256c77a264c..b13efa6010f 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_events_browsertest.cc
@@ -256,6 +256,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
 }
 
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
+                       AccessibilityEventsAriaComboBoxSelect) {
+  RunEventTest(FILE_PATH_LITERAL("aria-combo-box-select.html"));
+}
+
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityEventsTest,
                        AccessibilityEventsAriaControlsChanged) {
   RunEventTest(FILE_PATH_LITERAL("aria-controls-changed.html"));
 }
diff --git a/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc b/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
index bbf0eb200f2..7cc2d01d065 100644
--- a/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
+++ b/chromium/content/browser/accessibility/dump_accessibility_tree_browsertest.cc
@@ -236,6 +236,15 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCSSFontFamily) {
   RunCSSTest(FILE_PATH_LITERAL("font-family.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCSSFontSize) {
+  RunCSSTest(FILE_PATH_LITERAL("font-size.html"));
+}
+
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityCSSDisplayToNone) {
+  RunCSSTest(FILE_PATH_LITERAL("display-to-none.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityCSSDisplayToInline) {
   RunCSSTest(FILE_PATH_LITERAL("display-to-inline.html"));
@@ -277,6 +286,21 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityCSSVisibility) {
   RunCSSTest(FILE_PATH_LITERAL("visibility.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityCSSVisibilityToHidden) {
+  RunCSSTest(FILE_PATH_LITERAL("visibility-to-hidden.html"));
+}
+
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityCSSVisibilityToCollapsed) {
+  RunCSSTest(FILE_PATH_LITERAL("visibility-to-collapsed.html"));
+}
+
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityCSSVisibilityToVisible) {
+  RunCSSTest(FILE_PATH_LITERAL("visibility-to-visible.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityA) {
   RunHtmlTest(FILE_PATH_LITERAL("a.html"));
 }
@@ -307,6 +331,11 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityAddress) {
   RunHtmlTest(FILE_PATH_LITERAL("address.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
+                       AccessibilityAnnotationRoles) {
+  RunAriaTest(FILE_PATH_LITERAL("annotation-roles.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityArea) {
   RunHtmlTest(FILE_PATH_LITERAL("area.html"));
 }
@@ -1667,9 +1696,7 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityLabel) {
   RunHtmlTest(FILE_PATH_LITERAL("label.html"));
 }
 
-// TODO(http://crubg/1000965): flaky.
-IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
-                       DISABLED_AccessibilityLabelUpdates) {
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityLabelUpdates) {
   RunHtmlTest(FILE_PATH_LITERAL("label-updates.html"));
 }
 
@@ -1809,6 +1836,10 @@ IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityOptgroup) {
   RunHtmlTest(FILE_PATH_LITERAL("optgroup.html"));
 }
 
+IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest, AccessibilityOpenModal) {
+  RunHtmlTest(FILE_PATH_LITERAL("open-modal.html"));
+}
+
 IN_PROC_BROWSER_TEST_P(DumpAccessibilityTreeTest,
                        AccessibilityOptionindatalist) {
   RunHtmlTest(FILE_PATH_LITERAL("option-in-datalist.html"));
diff --git a/chromium/content/browser/accessibility/fullscreen_browsertest.cc b/chromium/content/browser/accessibility/fullscreen_browsertest.cc
index 3d3fb9d39cf..fbb8dd242ef 100644
--- a/chromium/content/browser/accessibility/fullscreen_browsertest.cc
+++ b/chromium/content/browser/accessibility/fullscreen_browsertest.cc
@@ -51,9 +51,10 @@ class FakeFullscreenDelegate : public WebContentsDelegate {
   FakeFullscreenDelegate() = default;
   ~FakeFullscreenDelegate() override = default;
 
-  void EnterFullscreenModeForTab(WebContents*,
-                                 const GURL&,
-                                 const blink::WebFullscreenOptions&) override {
+  void EnterFullscreenModeForTab(
+      WebContents*,
+      const GURL&,
+      const blink::mojom::FullscreenOptions&) override {
     is_fullscreen_ = true;
   }
 
diff --git a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc
index c1bdf2c8645..467b27936a2 100644
--- a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc
+++ b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.cc
@@ -44,7 +44,7 @@ OneShotAccessibilityTreeSearch::OneShotAccessibilityTreeSearch(
       result_limit_(UNLIMITED_RESULTS),
       immediate_descendants_only_(false),
       can_wrap_to_last_element_(false),
-      visible_only_(false),
+      onscreen_only_(false),
       did_search_(false) {}
 
 OneShotAccessibilityTreeSearch::~OneShotAccessibilityTreeSearch() {}
@@ -82,9 +82,9 @@ void OneShotAccessibilityTreeSearch::SetCanWrapToLastElement(
   can_wrap_to_last_element_ = can_wrap_to_last_element;
 }
 
-void OneShotAccessibilityTreeSearch::SetVisibleOnly(bool visible_only) {
+void OneShotAccessibilityTreeSearch::SetOnscreenOnly(bool onscreen_only) {
   DCHECK(!did_search_);
-  visible_only_ = visible_only;
+  onscreen_only_ = onscreen_only;
 }
 
 void OneShotAccessibilityTreeSearch::SetSearchText(const std::string& text) {
@@ -177,10 +177,17 @@ void OneShotAccessibilityTreeSearch::SearchByWalkingTree() {
     if (Matches(node))
       matches_.push_back(node);
 
-    if (direction_ == FORWARDS)
+    if (direction_ == FORWARDS) {
       node = tree_->NextInTreeOrder(node);
-    else
+    } else {
+      // This needs to be handled carefully. If not, there is a chance of
+      // getting into infinite loop.
+      if (can_wrap_to_last_element_ && !stop_node &&
+          node->manager()->GetRoot() == node) {
+        stop_node = node;
+      }
       node = tree_->PreviousInTreeOrder(node, can_wrap_to_last_element_);
+    }
   }
 }
 
@@ -190,11 +197,11 @@ bool OneShotAccessibilityTreeSearch::Matches(BrowserAccessibility* node) {
       return false;
   }
 
-  if (visible_only_) {
-    if (node->HasState(ax::mojom::State::kInvisible) || node->IsOffscreen()) {
-      return false;
-    }
-  }
+  if (node->HasState(ax::mojom::State::kInvisible))
+    return false;  // Programmatically hidden, e.g. aria-hidden or via CSS.
+
+  if (onscreen_only_ && node->IsOffscreen())
+    return false;  // Partly scrolled offscreen.
 
   if (!search_text_.empty()) {
     base::string16 search_text_lower =
@@ -366,8 +373,9 @@ bool AccessibilityLandmarkPredicate(BrowserAccessibility* start,
     case ax::mojom::Role::kContentInfo:
     case ax::mojom::Role::kMain:
     case ax::mojom::Role::kNavigation:
-    case ax::mojom::Role::kSearch:
     case ax::mojom::Role::kRegion:
+    case ax::mojom::Role::kSearch:
+    case ax::mojom::Role::kSection:
       return true;
     default:
       return false;
diff --git a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h
index 7b68dc02adb..27128a08c3a 100644
--- a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h
+++ b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search.h
@@ -111,8 +111,9 @@ class CONTENT_EXPORT OneShotAccessibilityTreeSearch {
   // If true, wraps to the last element.
   void SetCanWrapToLastElement(bool can_wrap_to_last_element);
 
-  // If true, only considers nodes that aren't invisible or offscreen.
-  void SetVisibleOnly(bool visible_only);
+  // If true, only considers nodes that aren't offscreen.
+  // Programmatically hidden elements are always skipped.
+  void SetOnscreenOnly(bool onscreen_only);
 
   // Restricts the matches to only nodes where |text| is found as a
   // substring of any of that node's accessible text, including its
@@ -142,7 +143,7 @@ class CONTENT_EXPORT OneShotAccessibilityTreeSearch {
   int result_limit_;
   bool immediate_descendants_only_;
   bool can_wrap_to_last_element_;
-  bool visible_only_;
+  bool onscreen_only_;
   std::string search_text_;
 
   std::vector<AccessibilityMatchPredicate> predicates_;
diff --git a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc
index 17de1b23bb6..5ef3ad02073 100644
--- a/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc
+++ b/chromium/content/browser/accessibility/one_shot_accessibility_tree_search_unittest.cc
@@ -46,7 +46,8 @@ class TestBrowserAccessibilityManager : public BrowserAccessibilityManager {
 #define MAYBE_OneShotAccessibilityTreeSearchTest \
   OneShotAccessibilityTreeSearchTest
 #endif
-class MAYBE_OneShotAccessibilityTreeSearchTest : public testing::Test {
+class MAYBE_OneShotAccessibilityTreeSearchTest
+    : public testing::TestWithParam<bool> {
  public:
   MAYBE_OneShotAccessibilityTreeSearchTest() {}
   ~MAYBE_OneShotAccessibilityTreeSearchTest() override {}
@@ -69,9 +70,6 @@ void MAYBE_OneShotAccessibilityTreeSearchTest::SetUp() {
   root.role = ax::mojom::Role::kRootWebArea;
   root.relative_bounds.bounds = gfx::RectF(0, 0, 800, 600);
   root.AddBoolAttribute(ax::mojom::BoolAttribute::kClipsChildren, true);
-  root.child_ids.push_back(2);
-  root.child_ids.push_back(3);
-  root.child_ids.push_back(6);
 
   ui::AXNodeData heading;
   heading.id = 2;
@@ -79,41 +77,93 @@ void MAYBE_OneShotAccessibilityTreeSearchTest::SetUp() {
   heading.role = ax::mojom::Role::kHeading;
   heading.relative_bounds.bounds = gfx::RectF(0, 0, 800, 50);
 
+  ui::AXNodeData table;
+  table.id = 3;
+  table.role = ax::mojom::Role::kTable;
+  table.AddIntAttribute(ax::mojom::IntAttribute::kTableRowCount, 1);
+  table.AddIntAttribute(ax::mojom::IntAttribute::kTableColumnCount, 2);
+
+  ui::AXNodeData table_row;
+  table_row.id = 4;
+  table_row.role = ax::mojom::Role::kRow;
+  table_row.AddIntAttribute(ax::mojom::IntAttribute::kTableRowIndex, 0);
+
+  ui::AXNodeData table_column_header_1;
+  table_column_header_1.id = 5;
+  table_column_header_1.role = ax::mojom::Role::kColumnHeader;
+  table_column_header_1.SetName("Cell1");
+  table_column_header_1.AddIntAttribute(
+      ax::mojom::IntAttribute::kTableCellRowIndex, 0);
+  table_column_header_1.AddIntAttribute(
+      ax::mojom::IntAttribute::kTableCellColumnIndex, 0);
+
+  ui::AXNodeData table_column_header_2;
+  table_column_header_2.id = 6;
+  table_column_header_2.role = ax::mojom::Role::kColumnHeader;
+  table_column_header_2.SetName("Cell2");
+  table_column_header_2.AddIntAttribute(
+      ax::mojom::IntAttribute::kTableCellRowIndex, 0);
+  table_column_header_2.AddIntAttribute(
+      ax::mojom::IntAttribute::kTableCellColumnIndex, 1);
+
   ui::AXNodeData list;
-  list.id = 3;
+  list.id = 7;
   list.role = ax::mojom::Role::kList;
   list.relative_bounds.bounds = gfx::RectF(0, 50, 500, 500);
-  list.child_ids.push_back(4);
-  list.child_ids.push_back(5);
 
   ui::AXNodeData list_item_1;
-  list_item_1.id = 4;
+  list_item_1.id = 8;
   list_item_1.SetName("Autobots");
   list_item_1.role = ax::mojom::Role::kListItem;
   list_item_1.relative_bounds.bounds = gfx::RectF(10, 10, 200, 30);
 
   ui::AXNodeData list_item_2;
-  list_item_2.id = 5;
+  list_item_2.id = 9;
   list_item_2.SetName("Decepticons");
   list_item_2.role = ax::mojom::Role::kListItem;
   list_item_2.relative_bounds.bounds = gfx::RectF(10, 40, 200, 60);
 
   ui::AXNodeData footer;
-  footer.id = 6;
+  footer.id = 10;
   footer.SetName("Footer");
   footer.role = ax::mojom::Role::kFooter;
   footer.relative_bounds.bounds = gfx::RectF(0, 650, 100, 800);
 
-  tree_.reset(new TestBrowserAccessibilityManager(
-      MakeAXTreeUpdate(root, heading, list, list_item_1, list_item_2, footer)));
+  table_row.child_ids = {table_column_header_1.id, table_column_header_2.id};
+  table.child_ids = {table_row.id};
+  list.child_ids = {list_item_1.id, list_item_2.id};
+  root.child_ids = {heading.id, table.id, list.id, footer.id};
+
+  tree_.reset(new TestBrowserAccessibilityManager(MakeAXTreeUpdate(
+      root, heading, table, table_row, table_column_header_1,
+      table_column_header_2, list, list_item_1, list_item_2, footer)));
 }
 
 TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, GetAll) {
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
-  ASSERT_EQ(6U, search.CountMatches());
+  ASSERT_EQ(10U, search.CountMatches());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, NoCycle) {
+TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, BackwardsWrapFromRoot) {
+  OneShotAccessibilityTreeSearch search(tree_->GetRoot());
+  search.SetDirection(OneShotAccessibilityTreeSearch::BACKWARDS);
+  search.SetResultLimit(100);
+  search.SetCanWrapToLastElement(true);
+  ASSERT_EQ(10U, search.CountMatches());
+  EXPECT_EQ(1, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(10, search.GetMatchAtIndex(1)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(2)->GetId());
+  EXPECT_EQ(8, search.GetMatchAtIndex(3)->GetId());
+  EXPECT_EQ(7, search.GetMatchAtIndex(4)->GetId());
+  EXPECT_EQ(6, search.GetMatchAtIndex(5)->GetId());
+  EXPECT_EQ(5, search.GetMatchAtIndex(6)->GetId());
+  EXPECT_EQ(4, search.GetMatchAtIndex(7)->GetId());
+  EXPECT_EQ(3, search.GetMatchAtIndex(8)->GetId());
+  EXPECT_EQ(2, search.GetMatchAtIndex(9)->GetId());
+}
+
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, NoCycle) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   // If you set a result limit of 1, you won't get the root node back as
   // the first match.
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
@@ -122,15 +172,18 @@ TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, NoCycle) {
   EXPECT_NE(1, search.GetMatchAtIndex(0)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, ForwardsWithStartNode) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, ForwardsWithStartNode) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
-  search.SetStartNode(tree_->GetFromID(4));
-  ASSERT_EQ(2U, search.CountMatches());
-  EXPECT_EQ(5, search.GetMatchAtIndex(0)->GetId());
-  EXPECT_EQ(6, search.GetMatchAtIndex(1)->GetId());
+  search.SetStartNode(tree_->GetFromID(7));
+  ASSERT_EQ(3U, search.CountMatches());
+  EXPECT_EQ(8, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(1)->GetId());
+  EXPECT_EQ(10, search.GetMatchAtIndex(2)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, BackwardsWithStartNode) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, BackwardsWithStartNode) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.SetStartNode(tree_->GetFromID(4));
   search.SetDirection(OneShotAccessibilityTreeSearch::BACKWARDS);
@@ -140,8 +193,9 @@ TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, BackwardsWithStartNode) {
   EXPECT_EQ(1, search.GetMatchAtIndex(2)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest,
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest,
        BackwardsWithStartNodeForAndroid) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.SetStartNode(tree_->GetFromID(4));
   search.SetDirection(OneShotAccessibilityTreeSearch::BACKWARDS);
@@ -153,101 +207,147 @@ TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest,
   EXPECT_EQ(1, search.GetMatchAtIndex(2)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest,
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest,
        ForwardsWithStartNodeAndScope) {
-  OneShotAccessibilityTreeSearch search(tree_->GetFromID(4));
-  search.SetStartNode(tree_->GetFromID(5));
-  ASSERT_EQ(1U, search.CountMatches());
-  EXPECT_EQ(6, search.GetMatchAtIndex(0)->GetId());
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
+  OneShotAccessibilityTreeSearch search(tree_->GetFromID(7));
+  search.SetStartNode(tree_->GetFromID(8));
+  ASSERT_EQ(2U, search.CountMatches());
+  EXPECT_EQ(9, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(10, search.GetMatchAtIndex(1)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, ResultLimitZero) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, ResultLimitZero) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.SetResultLimit(0);
   ASSERT_EQ(0U, search.CountMatches());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, ResultLimitFive) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, ResultLimitFive) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.SetResultLimit(5);
   ASSERT_EQ(5U, search.CountMatches());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, DescendantsOnlyOfRoot) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, DescendantsOnlyOfRoot) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.SetStartNode(tree_->GetFromID(1));
   search.SetImmediateDescendantsOnly(true);
-  ASSERT_EQ(3U, search.CountMatches());
+  ASSERT_EQ(4U, search.CountMatches());
   EXPECT_EQ(2, search.GetMatchAtIndex(0)->GetId());
   EXPECT_EQ(3, search.GetMatchAtIndex(1)->GetId());
-  EXPECT_EQ(6, search.GetMatchAtIndex(2)->GetId());
+  EXPECT_EQ(7, search.GetMatchAtIndex(2)->GetId());
+  EXPECT_EQ(10, search.GetMatchAtIndex(3)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, DescendantsOnlyOfNode) {
-  OneShotAccessibilityTreeSearch search(tree_->GetFromID(3));
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, DescendantsOnlyOfNode) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
+  OneShotAccessibilityTreeSearch search(tree_->GetFromID(7));
   search.SetImmediateDescendantsOnly(true);
   ASSERT_EQ(2U, search.CountMatches());
-  EXPECT_EQ(4, search.GetMatchAtIndex(0)->GetId());
-  EXPECT_EQ(5, search.GetMatchAtIndex(1)->GetId());
+  EXPECT_EQ(8, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(1)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest,
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest,
        DescendantsOnlyOfNodeWithStartNode) {
-  OneShotAccessibilityTreeSearch search(tree_->GetFromID(3));
-  search.SetStartNode(tree_->GetFromID(4));
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
+  OneShotAccessibilityTreeSearch search(tree_->GetFromID(7));
+  search.SetStartNode(tree_->GetFromID(8));
   search.SetImmediateDescendantsOnly(true);
   ASSERT_EQ(1U, search.CountMatches());
-  EXPECT_EQ(5, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(0)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest,
-       DescendantsOnlyOfNodeWithStartNode2) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest,
+       DescendantsOnlyOfNodeWithStartNodeBackwardsTableCell) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetFromID(3));
   search.SetStartNode(tree_->GetFromID(5));
+  search.SetDirection(OneShotAccessibilityTreeSearch::BACKWARDS);
   search.SetImmediateDescendantsOnly(true);
   ASSERT_EQ(0U, search.CountMatches());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest,
-       DescendantsOnlyOfNodeWithStartNodeBackwards) {
-  OneShotAccessibilityTreeSearch search(tree_->GetFromID(3));
-  search.SetStartNode(tree_->GetFromID(5));
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest,
+       DescendantsOnlyOfNodeWithStartNodeBackwardsListItem) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
+  OneShotAccessibilityTreeSearch search(tree_->GetFromID(7));
+  search.SetStartNode(tree_->GetFromID(9));
   search.SetImmediateDescendantsOnly(true);
   search.SetDirection(OneShotAccessibilityTreeSearch::BACKWARDS);
   ASSERT_EQ(1U, search.CountMatches());
-  EXPECT_EQ(4, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(8, search.GetMatchAtIndex(0)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, VisibleOnly) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, OnscreenOnly) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
-  search.SetVisibleOnly(true);
-  ASSERT_EQ(5U, search.CountMatches());
+  search.SetOnscreenOnly(true);
+  ASSERT_EQ(7U, search.CountMatches());
   EXPECT_EQ(1, search.GetMatchAtIndex(0)->GetId());
   EXPECT_EQ(2, search.GetMatchAtIndex(1)->GetId());
   EXPECT_EQ(3, search.GetMatchAtIndex(2)->GetId());
   EXPECT_EQ(4, search.GetMatchAtIndex(3)->GetId());
-  EXPECT_EQ(5, search.GetMatchAtIndex(4)->GetId());
+  EXPECT_EQ(7, search.GetMatchAtIndex(4)->GetId());
+  EXPECT_EQ(8, search.GetMatchAtIndex(5)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(6)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, CaseInsensitiveStringMatch) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, CaseInsensitiveStringMatch) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.SetSearchText("eCEptiCOn");
   ASSERT_EQ(1U, search.CountMatches());
+  EXPECT_EQ(9, search.GetMatchAtIndex(0)->GetId());
+}
+
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, OnePredicateTableCell) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
+  OneShotAccessibilityTreeSearch search(tree_->GetRoot());
+  search.AddPredicate(
+      [](BrowserAccessibility* start, BrowserAccessibility* current) {
+        return current->GetRole() == ax::mojom::Role::kColumnHeader;
+      });
+  ASSERT_EQ(2U, search.CountMatches());
   EXPECT_EQ(5, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(6, search.GetMatchAtIndex(1)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, OnePredicate) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, OnePredicateListItem) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.AddPredicate(
       [](BrowserAccessibility* start, BrowserAccessibility* current) {
         return current->GetRole() == ax::mojom::Role::kListItem;
       });
   ASSERT_EQ(2U, search.CountMatches());
+  EXPECT_EQ(8, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(1)->GetId());
+}
+
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, TwoPredicatesTableRowAndCell) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
+  OneShotAccessibilityTreeSearch search(tree_->GetRoot());
+  search.AddPredicate(
+      [](BrowserAccessibility* start, BrowserAccessibility* current) {
+        return (current->GetRole() == ax::mojom::Role::kRow ||
+                current->GetRole() == ax::mojom::Role::kColumnHeader);
+      });
+  search.AddPredicate(
+      [](BrowserAccessibility* start, BrowserAccessibility* current) {
+        return (current->GetId() % 2 == 0);
+      });
+  ASSERT_EQ(2U, search.CountMatches());
   EXPECT_EQ(4, search.GetMatchAtIndex(0)->GetId());
-  EXPECT_EQ(5, search.GetMatchAtIndex(1)->GetId());
+  EXPECT_EQ(6, search.GetMatchAtIndex(1)->GetId());
 }
 
-TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, TwoPredicates) {
+TEST_P(MAYBE_OneShotAccessibilityTreeSearchTest, TwoPredicatesListItem) {
+  tree_->ax_tree()->SetEnableExtraMacNodes(GetParam());
   OneShotAccessibilityTreeSearch search(tree_->GetRoot());
   search.AddPredicate(
       [](BrowserAccessibility* start, BrowserAccessibility* current) {
@@ -259,8 +359,16 @@ TEST_F(MAYBE_OneShotAccessibilityTreeSearchTest, TwoPredicates) {
         return (current->GetId() % 2 == 1);
       });
   ASSERT_EQ(2U, search.CountMatches());
-  EXPECT_EQ(3, search.GetMatchAtIndex(0)->GetId());
-  EXPECT_EQ(5, search.GetMatchAtIndex(1)->GetId());
+  EXPECT_EQ(7, search.GetMatchAtIndex(0)->GetId());
+  EXPECT_EQ(9, search.GetMatchAtIndex(1)->GetId());
 }
 
+INSTANTIATE_TEST_SUITE_P(EnableExtraMacNodes,
+                         MAYBE_OneShotAccessibilityTreeSearchTest,
+                         testing::Values(true));
+
+INSTANTIATE_TEST_SUITE_P(DisableExtraMacNodes,
+                         MAYBE_OneShotAccessibilityTreeSearchTest,
+                         testing::Values(false));
+
 }  // namespace content
diff --git a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc
index 4679bc67562..65ec2ada0af 100644
--- a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc
+++ b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.cc
@@ -18,6 +18,8 @@ bool TestBrowserAccessibilityDelegate::AccessibilityViewHasFocus() const {
   return false;
 }
 
+void TestBrowserAccessibilityDelegate::AccessibilityViewSetFocus() {}
+
 gfx::Rect TestBrowserAccessibilityDelegate::AccessibilityGetViewBounds() const {
   return gfx::Rect();
 }
diff --git a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h
index d42f436ed32..1d5d743f6fc 100644
--- a/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h
+++ b/chromium/content/browser/accessibility/test_browser_accessibility_delegate.h
@@ -15,6 +15,7 @@ class TestBrowserAccessibilityDelegate : public BrowserAccessibilityDelegate {
 
   void AccessibilityPerformAction(const ui::AXActionData& data) override;
   bool AccessibilityViewHasFocus() const override;
+  void AccessibilityViewSetFocus() override;
   gfx::Rect AccessibilityGetViewBounds() const override;
   float AccessibilityGetDeviceScaleFactor() const override;
   void AccessibilityFatalError() override;
diff --git a/chromium/content/browser/accessibility/web_contents_accessibility_android.cc b/chromium/content/browser/accessibility/web_contents_accessibility_android.cc
index 17277079e72..1ad1431bdc9 100644
--- a/chromium/content/browser/accessibility/web_contents_accessibility_android.cc
+++ b/chromium/content/browser/accessibility/web_contents_accessibility_android.cc
@@ -11,6 +11,7 @@
 #include "base/feature_list.h"
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/numerics/ranges.h"
 #include "content/browser/accessibility/browser_accessibility_android.h"
 #include "content/browser/accessibility/browser_accessibility_manager_android.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
@@ -195,16 +196,17 @@ base::LazyInstance<base::string16>::Leaky g_all_search_keys =
 
 bool SectionPredicate(BrowserAccessibility* start, BrowserAccessibility* node) {
   switch (node->GetRole()) {
-    case ax::mojom::Role::kArticle:
     case ax::mojom::Role::kApplication:
+    case ax::mojom::Role::kArticle:
     case ax::mojom::Role::kBanner:
     case ax::mojom::Role::kComplementary:
     case ax::mojom::Role::kContentInfo:
     case ax::mojom::Role::kHeading:
     case ax::mojom::Role::kMain:
     case ax::mojom::Role::kNavigation:
-    case ax::mojom::Role::kSearch:
     case ax::mojom::Role::kRegion:
+    case ax::mojom::Role::kSearch:
+    case ax::mojom::Role::kSection:
       return true;
     default:
       return false;
@@ -691,7 +693,7 @@ jboolean WebContentsAccessibilityAndroid::PopulateAccessibilityNodeInfo(
       node->CanScrollLeft(), node->CanScrollRight(), node->IsClickable(),
       node->IsEditableText(), node->IsEnabled(), node->IsFocusable(),
       node->IsFocused(), node->IsCollapsed(), node->IsExpanded(),
-      node->HasNonEmptyValue());
+      node->HasNonEmptyValue(), !node->GetInnerText().empty());
   Java_WebContentsAccessibilityImpl_setAccessibilityNodeInfoClassName(
       env, obj, info,
       base::android::ConvertUTF8ToJavaString(env, node->GetClassName()));
@@ -932,7 +934,7 @@ jboolean WebContentsAccessibilityAndroid::AdjustSlider(
   // Slider does not move if the delta value is less than 1.
   delta = ((delta < 1) ? 1 : delta);
   value += (increment ? delta : -delta);
-  value = std::max(std::min(value, max), min);
+  value = base::ClampToRange(value, min, max);
   if (value != original_value) {
     node->manager()->SetValue(*node, base::NumberToString(value));
     return true;
@@ -979,7 +981,7 @@ jint WebContentsAccessibilityAndroid::FindElementType(
   // SetCanWrapToLastElement needs to be set as true after talkback pushes its
   // corresponding change for b/29103330.
   tree_search.SetCanWrapToLastElement(false);
-  tree_search.SetVisibleOnly(false);
+  tree_search.SetOnscreenOnly(false);
   tree_search.AddPredicate(predicate);
 
   if (tree_search.CountMatches() == 0)
diff --git a/chromium/content/browser/android/background_sync_network_observer_android.cc b/chromium/content/browser/android/background_sync_network_observer_android.cc
index 26a2a796883..9682d6573ed 100644
--- a/chromium/content/browser/android/background_sync_network_observer_android.cc
+++ b/chromium/content/browser/android/background_sync_network_observer_android.cc
@@ -8,6 +8,7 @@
 #include "base/task/post_task.h"
 #include "content/public/android/content_jni_headers/BackgroundSyncNetworkObserver_jni.h"
 #include "content/public/browser/browser_task_traits.h"
+#include "content/public/browser/service_worker_context.h"
 
 using base::android::JavaParamRef;
 
@@ -17,11 +18,11 @@ namespace content {
 scoped_refptr<BackgroundSyncNetworkObserverAndroid::Observer>
 BackgroundSyncNetworkObserverAndroid::Observer::Create(
     base::RepeatingCallback<void(network::mojom::ConnectionType)> callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   scoped_refptr<BackgroundSyncNetworkObserverAndroid::Observer> observer(
       new BackgroundSyncNetworkObserverAndroid::Observer(callback));
-  base::PostTask(
-      FROM_HERE, {BrowserThread::UI},
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
       base::BindOnce(&BackgroundSyncNetworkObserverAndroid::Observer::Init,
                      observer));
   return observer;
@@ -51,8 +52,8 @@ void BackgroundSyncNetworkObserverAndroid::Observer::
                                 const JavaParamRef<jobject>& jcaller,
                                 jint new_connection_type) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
+  RunOrPostTaskOnThread(
+      FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
       base::BindOnce(callback_, static_cast<network::mojom::ConnectionType>(
                                     new_connection_type)));
 }
@@ -60,21 +61,21 @@ void BackgroundSyncNetworkObserverAndroid::Observer::
 BackgroundSyncNetworkObserverAndroid::Observer::Observer(
     base::RepeatingCallback<void(network::mojom::ConnectionType)> callback)
     : callback_(callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 }
 
 BackgroundSyncNetworkObserverAndroid::BackgroundSyncNetworkObserverAndroid(
     const base::Closure& network_changed_callback)
     : BackgroundSyncNetworkObserver(network_changed_callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
-  observer_ = Observer::Create(
-      base::Bind(&BackgroundSyncNetworkObserverAndroid::OnConnectionChanged,
-                 weak_ptr_factory_.GetWeakPtr()));
+  observer_ = Observer::Create(base::BindRepeating(
+      &BackgroundSyncNetworkObserverAndroid::OnConnectionChanged,
+      weak_ptr_factory_.GetWeakPtr()));
 }
 
 BackgroundSyncNetworkObserverAndroid::~BackgroundSyncNetworkObserverAndroid() {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 }
 
 void BackgroundSyncNetworkObserverAndroid::RegisterWithNetworkConnectionTracker(
diff --git a/chromium/content/browser/android/content_url_loader_factory.cc b/chromium/content/browser/android/content_url_loader_factory.cc
index d3ebb187972..b6336926fac 100644
--- a/chromium/content/browser/android/content_url_loader_factory.cc
+++ b/chromium/content/browser/android/content_url_loader_factory.cc
@@ -14,10 +14,14 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/macros.h"
+#include "base/strings/stringprintf.h"
 #include "base/time/time.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/file_url_loader.h"
 #include "content/public/common/content_client.h"
+#include "content/public/common/resource_type.h"
+#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/data_pipe_producer.h"
 #include "mojo/public/cpp/system/file_data_source.h"
@@ -160,6 +164,32 @@ class ContentURLLoader : public network::mojom::URLLoader {
 
     // Set the mimetype of the response.
     GetMimeType(request, path, &head.mime_type);
+    if (head.mime_type.empty() ||
+        head.mime_type == "application/octet-stream") {
+      // When a bundled exchanges file is downloaded with
+      // "content-type: application/webbundle;v=b1" header, Chrome saves it as
+      // "application/webbundle" MIME type. The MIME type is stored to Android's
+      // DownloadManager. If the file is opened from a URI which is under
+      // DownloadManager's control and the ContentProvider can get the MIME
+      // type, |head.mime_type| is set to "application/webbundle". But otherwise
+      // ContentResolver.getType() returns null or the default type
+      // [1]"application/octet-stream" even if the file extension is ".wbn".
+      // (eg: opening the file from "Internal Storage")
+      // This is because the Media type of BundledHTTPExchanges isn't registered
+      // to the IANA registry (https://www.iana.org/assignments/media-types/),
+      // and it is not listed in the mime.types files [2][3] which was referd by
+      // MimeTypeMap.getMimeTypeFromExtension().
+      // So we set the MIME type if the file extension is ".wbn" by calling
+      // bundled_exchanges_utils::GetBundledExchangesFileMimeTypeFromFile().
+      // [1]
+      // https://android.googlesource.com/platform/frameworks/base/+/1b817f6/core/java/android/content/ContentResolver.java#481
+      // [2] https://android.googlesource.com/platform/external/mime-support/
+      // [3]
+      // https://android.googlesource.com/platform/libcore/+/master/luni/src/main/java/libcore/net/android.mime.types
+      bundled_exchanges_utils::GetBundledExchangesFileMimeTypeFromFile(
+          path, &head.mime_type);
+    }
+
     if (!head.mime_type.empty()) {
       head.headers = base::MakeRefCounted<net::HttpResponseHeaders>("");
       head.headers->AddHeader(
@@ -259,8 +289,8 @@ void ContentURLLoaderFactory::CreateLoaderAndStart(
 }
 
 void ContentURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest loader) {
-  bindings_.AddBinding(this, std::move(loader));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) {
+  receivers_.Add(this, std::move(loader));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/android/content_url_loader_factory.h b/chromium/content/browser/android/content_url_loader_factory.h
index 8cbe8c63054..c5bce0ff3cf 100644
--- a/chromium/content/browser/android/content_url_loader_factory.h
+++ b/chromium/content/browser/android/content_url_loader_factory.h
@@ -8,7 +8,8 @@
 #include "base/macros.h"
 #include "base/sequenced_task_runner.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace content {
@@ -34,10 +35,11 @@ class CONTENT_EXPORT ContentURLLoaderFactory
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest loader) override;
+  void Clone(
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) override;
 
   const scoped_refptr<base::SequencedTaskRunner> task_runner_;
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   DISALLOW_COPY_AND_ASSIGN(ContentURLLoaderFactory);
 };
diff --git a/chromium/content/browser/android/ime_adapter_android.cc b/chromium/content/browser/android/ime_adapter_android.cc
index a9f36349d44..1bc59a6c355 100644
--- a/chromium/content/browser/android/ime_adapter_android.cc
+++ b/chromium/content/browser/android/ime_adapter_android.cc
@@ -319,6 +319,7 @@ void ImeAdapterAndroid::CommitText(JNIEnv* env,
 
   rwhi->ImeCommitText(text16, ime_text_spans, gfx::Range::InvalidRange(),
                       relative_cursor_pos);
+  rwhi->OnImeTextCommittedEvent(text16);
 }
 
 void ImeAdapterAndroid::FinishComposingText(JNIEnv* env,
diff --git a/chromium/content/browser/android/nfc_host.cc b/chromium/content/browser/android/nfc_host.cc
index 1c611470a9c..c445a89b8f8 100644
--- a/chromium/content/browser/android/nfc_host.cc
+++ b/chromium/content/browser/android/nfc_host.cc
@@ -32,14 +32,14 @@ NFCHost::NFCHost(WebContents* web_contents)
 
   service_manager::Connector* connector = content::GetSystemConnector();
   if (connector) {
-    connector->BindInterface(device::mojom::kServiceName,
-                             mojo::MakeRequest(&nfc_provider_));
+    connector->Connect(device::mojom::kServiceName,
+                       nfc_provider_.BindNewPipeAndPassReceiver());
   }
 }
 
-void NFCHost::GetNFC(device::mojom::NFCRequest request) {
+void NFCHost::GetNFC(mojo::PendingReceiver<device::mojom::NFC> receiver) {
   // Connect to an NFC object, associating it with |id_|.
-  nfc_provider_->GetNFCForHost(id_, std::move(request));
+  nfc_provider_->GetNFCForHost(id_, std::move(receiver));
 }
 
 NFCHost::~NFCHost() {}
diff --git a/chromium/content/browser/android/nfc_host.h b/chromium/content/browser/android/nfc_host.h
index 50a87e086fd..9c9c40405b5 100644
--- a/chromium/content/browser/android/nfc_host.h
+++ b/chromium/content/browser/android/nfc_host.h
@@ -7,6 +7,8 @@
 
 #include "base/android/jni_android.h"
 #include "content/public/browser/web_contents.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/device/public/mojom/nfc_provider.mojom.h"
 
 namespace content {
@@ -19,7 +21,7 @@ class NFCHost {
   explicit NFCHost(WebContents* web_contents);
   ~NFCHost();
 
-  void GetNFC(device::mojom::NFCRequest request);
+  void GetNFC(mojo::PendingReceiver<device::mojom::NFC> receiver);
 
  private:
   // This instance's ID (passed to the NFC implementation via |nfc_provider_|
@@ -29,7 +31,7 @@ class NFCHost {
   // The WebContents that owns this instance.
   WebContents* web_contents_;
 
-  device::mojom::NFCProviderPtr nfc_provider_;
+  mojo::Remote<device::mojom::NFCProvider> nfc_provider_;
 
   DISALLOW_COPY_AND_ASSIGN(NFCHost);
 };
diff --git a/chromium/content/browser/android/scoped_surface_request_manager.cc b/chromium/content/browser/android/scoped_surface_request_manager.cc
index 8faf9be088d..9fe2f6b45d2 100644
--- a/chromium/content/browser/android/scoped_surface_request_manager.cc
+++ b/chromium/content/browser/android/scoped_surface_request_manager.cc
@@ -8,7 +8,7 @@
 #include "base/task/post_task.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
-#include "gpu/ipc/common/android/texture_owner.h"
+#include "gpu/command_buffer/service/texture_owner.h"
 
 namespace content {
 
@@ -21,14 +21,15 @@ ScopedSurfaceRequestManager* ScopedSurfaceRequestManager::GetInstance() {
 
 base::UnguessableToken
 ScopedSurfaceRequestManager::RegisterScopedSurfaceRequest(
-    const ScopedSurfaceRequestCB& request_cb) {
+    ScopedSurfaceRequestCB request_cb) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!request_cb.is_null());
 
   base::UnguessableToken request_token = base::UnguessableToken::Create();
 
   DCHECK(!request_callbacks_.count(request_token));
-  request_callbacks_.insert(std::make_pair(request_token, request_cb));
+  request_callbacks_.insert(
+      std::make_pair(request_token, std::move(request_cb)));
 
   return request_token;
 }
@@ -49,7 +50,7 @@ ScopedSurfaceRequestManager::GetAndUnregisterInternal(
 
   auto it = request_callbacks_.find(request_token);
   if (it != request_callbacks_.end()) {
-    request = it->second;
+    request = std::move(it->second);
     request_callbacks_.erase(it);
   }
 
@@ -84,7 +85,7 @@ void ScopedSurfaceRequestManager::CompleteRequestOnUiThread(
       GetAndUnregisterInternal(request_token);
 
   if (!request.is_null())
-    request.Run(std::move(surface));
+    std::move(request).Run(std::move(surface));
 }
 
 ScopedSurfaceRequestManager::ScopedSurfaceRequestManager() {}
diff --git a/chromium/content/browser/android/scoped_surface_request_manager.h b/chromium/content/browser/android/scoped_surface_request_manager.h
index f426b65bc7d..455a8f6f028 100644
--- a/chromium/content/browser/android/scoped_surface_request_manager.h
+++ b/chromium/content/browser/android/scoped_surface_request_manager.h
@@ -21,7 +21,8 @@ class CONTENT_EXPORT ScopedSurfaceRequestManager
  public:
   static ScopedSurfaceRequestManager* GetInstance();
 
-  using ScopedSurfaceRequestCB = base::Callback<void(gl::ScopedJavaSurface)>;
+  using ScopedSurfaceRequestCB =
+      base::OnceCallback<void(gl::ScopedJavaSurface)>;
 
   // Registers a request, and returns the |request_token| that should be used to
   // call Fulfill at a later time. The caller is responsible for unregistering
@@ -30,7 +31,7 @@ class CONTENT_EXPORT ScopedSurfaceRequestManager
   // ScopedJavaSurface (as passing an empty surface is a valid operation).
   // Must be called on the UI thread.
   base::UnguessableToken RegisterScopedSurfaceRequest(
-      const ScopedSurfaceRequestCB& request_cb);
+      ScopedSurfaceRequestCB request_cb);
 
   // Unregisters a request registered under |request_token| if it exists,
   // no-ops otherwise.
diff --git a/chromium/content/browser/android/scoped_surface_request_manager_unittest.cc b/chromium/content/browser/android/scoped_surface_request_manager_unittest.cc
index e2230a0932a..13ca6898f2c 100644
--- a/chromium/content/browser/android/scoped_surface_request_manager_unittest.cc
+++ b/chromium/content/browser/android/scoped_surface_request_manager_unittest.cc
@@ -8,7 +8,7 @@
 #include "base/callback_forward.h"
 #include "base/run_loop.h"
 #include "content/public/test/browser_task_environment.h"
-#include "gpu/ipc/common/android/mock_texture_owner.h"
+#include "gpu/command_buffer/service/mock_texture_owner.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/gl/android/scoped_java_surface.h"
 #include "ui/gl/android/surface_texture.h"
@@ -29,12 +29,16 @@ class ScopedSurfaceRequestManagerUnitTest : public testing::Test {
 
     mock_texture_owner = base::MakeRefCounted<NiceMock<gpu::MockTextureOwner>>(
         0, nullptr, nullptr);
-    dummy_request_ =
-        base::Bind(&ScopedSurfaceRequestManagerUnitTest::DummyCallback,
-                   base::Unretained(this));
-    specific_logging_request_ =
-        base::Bind(&ScopedSurfaceRequestManagerUnitTest::LoggingCallback,
-                   base::Unretained(this), kSpecificCallbackId);
+  }
+
+  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB CreateNoopCallback() {
+    return base::BindOnce(&ScopedSurfaceRequestManagerUnitTest::DummyCallback,
+                          base::Unretained(this));
+  }
+
+  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB CreateLoggingCallback() {
+    return base::BindOnce(&ScopedSurfaceRequestManagerUnitTest::LoggingCallback,
+                          base::Unretained(this), kSpecificCallbackId);
   }
 
   // No-op callback.
@@ -46,8 +50,6 @@ class ScopedSurfaceRequestManagerUnitTest : public testing::Test {
     last_received_request_ = request_id;
   }
 
-  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB dummy_request_;
-  ScopedSurfaceRequestManager::ScopedSurfaceRequestCB specific_logging_request_;
   scoped_refptr<NiceMock<gpu::MockTextureOwner>> mock_texture_owner;
 
   int last_received_request_;
@@ -66,7 +68,7 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest, RegisterRequest_ShouldSucceed) {
   EXPECT_EQ(0, manager_->request_count_for_testing());
 
   base::UnguessableToken token =
-      manager_->RegisterScopedSurfaceRequest(dummy_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
 
   EXPECT_EQ(1, manager_->request_count_for_testing());
   EXPECT_FALSE(token.is_empty());
@@ -77,9 +79,9 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest, RegisterRequest_ShouldSucceed) {
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        RegisterMultipleRequests_ShouldSucceed) {
   base::UnguessableToken token1 =
-      manager_->RegisterScopedSurfaceRequest(dummy_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
   base::UnguessableToken token2 =
-      manager_->RegisterScopedSurfaceRequest(dummy_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
 
   EXPECT_EQ(2, manager_->request_count_for_testing());
   EXPECT_NE(token1, token2);
@@ -94,7 +96,7 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest, VerifySingleton_ShouldSucceed) {
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        GetRegisteredRequest_ShouldSucceed) {
   base::UnguessableToken token =
-      manager_->RegisterScopedSurfaceRequest(dummy_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
   EXPECT_EQ(1, manager_->request_count_for_testing());
 
   manager_->UnregisterScopedSurfaceRequest(token);
@@ -106,8 +108,8 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest,
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        GetRegisteredRequestFromMultipleRequests_ShouldSucceed) {
   base::UnguessableToken token =
-      manager_->RegisterScopedSurfaceRequest(dummy_request_);
-  manager_->RegisterScopedSurfaceRequest(dummy_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
+  manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
   EXPECT_EQ(2, manager_->request_count_for_testing());
 
   manager_->UnregisterScopedSurfaceRequest(token);
@@ -128,7 +130,7 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest,
 // other registered callbacks.
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        GetUnregisteredRequestFromMultipleRequests_ShouldReturnNullCallback) {
-  manager_->RegisterScopedSurfaceRequest(dummy_request_);
+  manager_->RegisterScopedSurfaceRequest(CreateNoopCallback());
 
   manager_->UnregisterScopedSurfaceRequest(dummy_token_);
 
@@ -139,7 +141,7 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest,
 // does nothing, and does not affect other callbacks.
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        FulfillUnregisteredRequest_ShouldDoNothing) {
-  manager_->RegisterScopedSurfaceRequest(specific_logging_request_);
+  manager_->RegisterScopedSurfaceRequest(CreateLoggingCallback());
 
   manager_->FulfillScopedSurfaceRequest(
       dummy_token_, mock_texture_owner->CreateJavaSurface());
@@ -153,12 +155,12 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest,
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        FulfillRegisteredRequest_ShouldSucceed) {
   base::UnguessableToken specific_token =
-      manager_->RegisterScopedSurfaceRequest(specific_logging_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateLoggingCallback());
 
   const uint64_t kOtherCallbackId = 5678;
   manager_->RegisterScopedSurfaceRequest(
-      base::Bind(&ScopedSurfaceRequestManagerUnitTest::LoggingCallback,
-                 base::Unretained(this), kOtherCallbackId));
+      base::BindOnce(&ScopedSurfaceRequestManagerUnitTest::LoggingCallback,
+                     base::Unretained(this), kOtherCallbackId));
 
   manager_->FulfillScopedSurfaceRequest(
       specific_token, mock_texture_owner->CreateJavaSurface());
@@ -174,7 +176,7 @@ TEST_F(ScopedSurfaceRequestManagerUnitTest,
 TEST_F(ScopedSurfaceRequestManagerUnitTest,
        ForwardSurfaceOwner_ShouldFulfillRequest) {
   base::UnguessableToken token =
-      manager_->RegisterScopedSurfaceRequest(specific_logging_request_);
+      manager_->RegisterScopedSurfaceRequest(CreateLoggingCallback());
 
   manager_->ForwardSurfaceOwnerForSurfaceRequest(token,
                                                  mock_texture_owner.get());
diff --git a/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc b/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc
index 2fa5bb83c66..79d2cedc907 100644
--- a/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc
+++ b/chromium/content/browser/android/selection/composited_touch_handle_drawable.cc
@@ -7,6 +7,7 @@
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/macros.h"
+#include "base/numerics/ranges.h"
 #include "cc/layers/ui_resource_layer.h"
 #include "content/public/browser/android/compositor.h"
 #include "ui/android/handle_view_resources.h"
@@ -84,10 +85,9 @@ void CompositedTouchHandleDrawable::SetOrigin(const gfx::PointF& origin) {
 
 void CompositedTouchHandleDrawable::SetAlpha(float alpha) {
   DCHECK(layer_->parent());
-  alpha = std::max(0.f, std::min(1.f, alpha));
-  bool hidden = alpha <= 0;
+  alpha = base::ClampToRange(alpha, 0.0f, 1.0f);
   layer_->SetOpacity(alpha);
-  layer_->SetHideLayerAndSubtree(hidden);
+  layer_->SetHideLayerAndSubtree(!alpha);
 }
 
 gfx::RectF CompositedTouchHandleDrawable::GetVisibleBounds() const {
diff --git a/chromium/content/browser/android/text_suggestion_host_android.cc b/chromium/content/browser/android/text_suggestion_host_android.cc
index 6e0cabe5ecd..f5f7870516c 100644
--- a/chromium/content/browser/android/text_suggestion_host_android.cc
+++ b/chromium/content/browser/android/text_suggestion_host_android.cc
@@ -40,17 +40,16 @@ void TextSuggestionHostAndroid::Create(JNIEnv* env, WebContents* web_contents) {
   text_suggestion_host->Initialize();
 }
 
-TextSuggestionHostAndroid::TextSuggestionHostAndroid(
-    JNIEnv* env,
-    WebContents* web_contents)
+TextSuggestionHostAndroid::TextSuggestionHostAndroid(JNIEnv* env,
+                                                     WebContents* web_contents)
     : RenderWidgetHostConnector(web_contents),
       WebContentsObserver(web_contents),
       rwhva_(nullptr),
-      suggestion_menu_timeout_(
-          base::Bind(&TextSuggestionHostAndroid::OnSuggestionMenuTimeout,
-                     base::Unretained(this))) {
-  registry_.AddInterface(base::Bind(&TextSuggestionHostMojoImplAndroid::Create,
-                                    base::Unretained(this)));
+      suggestion_menu_timeout_(base::BindRepeating(
+          &TextSuggestionHostAndroid::OnSuggestionMenuTimeout,
+          base::Unretained(this))) {
+  registry_.AddInterface(base::BindRepeating(
+      &TextSuggestionHostMojoImplAndroid::Create, base::Unretained(this)));
 }
 
 TextSuggestionHostAndroid::~TextSuggestionHostAndroid() {
diff --git a/chromium/content/browser/android/web_contents_observer_proxy.cc b/chromium/content/browser/android/web_contents_observer_proxy.cc
index 1359ea20bbe..017ebf94b12 100644
--- a/chromium/content/browser/android/web_contents_observer_proxy.cc
+++ b/chromium/content/browser/android/web_contents_observer_proxy.cc
@@ -14,7 +14,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/trace_event/trace_event.h"
 #include "content/browser/android/navigation_handle_proxy.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/android/content_jni_headers/WebContentsObserverProxy_jni.h"
@@ -131,18 +131,14 @@ void WebContentsObserverProxy::DidStartNavigation(
     NavigationHandle* navigation_handle) {
   Java_WebContentsObserverProxy_didStartNavigation(
       AttachCurrentThread(), java_observer_,
-      static_cast<NavigationHandleImpl*>(navigation_handle)
-          ->navigation_request()
-          ->java_navigation_handle());
+      NavigationRequest::From(navigation_handle)->java_navigation_handle());
 }
 
 void WebContentsObserverProxy::DidRedirectNavigation(
     NavigationHandle* navigation_handle) {
   Java_WebContentsObserverProxy_didRedirectNavigation(
       AttachCurrentThread(), java_observer_,
-      static_cast<NavigationHandleImpl*>(navigation_handle)
-          ->navigation_request()
-          ->java_navigation_handle());
+      NavigationRequest::From(navigation_handle)->java_navigation_handle());
 }
 
 void WebContentsObserverProxy::DidFinishNavigation(
@@ -152,9 +148,7 @@ void WebContentsObserverProxy::DidFinishNavigation(
 
   Java_WebContentsObserverProxy_didFinishNavigation(
       AttachCurrentThread(), java_observer_,
-      static_cast<NavigationHandleImpl*>(navigation_handle)
-          ->navigation_request()
-          ->java_navigation_handle());
+      NavigationRequest::From(navigation_handle)->java_navigation_handle());
 }
 
 void WebContentsObserverProxy::DidFinishLoad(RenderFrameHost* render_frame_host,
@@ -171,7 +165,7 @@ void WebContentsObserverProxy::DidFinishLoad(RenderFrameHost* render_frame_host,
       !render_frame_host->GetParent());
 }
 
-void WebContentsObserverProxy::DocumentLoadedInFrame(
+void WebContentsObserverProxy::DOMContentLoaded(
     RenderFrameHost* render_frame_host) {
   JNIEnv* env = AttachCurrentThread();
   Java_WebContentsObserverProxy_documentLoadedInFrame(
@@ -272,11 +266,6 @@ void WebContentsObserverProxy::ViewportFitChanged(
       env, java_observer_, as_jint(static_cast<int>(value)));
 }
 
-void WebContentsObserverProxy::DidReloadLoFiImages() {
-  JNIEnv* env = AttachCurrentThread();
-  Java_WebContentsObserverProxy_didReloadLoFiImages(env, java_observer_);
-}
-
 void WebContentsObserverProxy::OnWebContentsFocused(RenderWidgetHost*) {
   JNIEnv* env = AttachCurrentThread();
   Java_WebContentsObserverProxy_onWebContentsFocused(env, java_observer_);
diff --git a/chromium/content/browser/android/web_contents_observer_proxy.h b/chromium/content/browser/android/web_contents_observer_proxy.h
index 0f22990b08e..83302ad7813 100644
--- a/chromium/content/browser/android/web_contents_observer_proxy.h
+++ b/chromium/content/browser/android/web_contents_observer_proxy.h
@@ -50,7 +50,7 @@ class WebContentsObserverProxy : public WebContentsObserver {
 
   void DidFinishLoad(RenderFrameHost* render_frame_host,
                      const GURL& validated_url) override;
-  void DocumentLoadedInFrame(RenderFrameHost* render_frame_host) override;
+  void DOMContentLoaded(RenderFrameHost* render_frame_host) override;
   void NavigationEntryCommitted(
       const LoadCommittedDetails& load_details) override;
   void NavigationEntriesDeleted() override;
@@ -63,7 +63,6 @@ class WebContentsObserverProxy : public WebContentsObserver {
   void MediaEffectivelyFullscreenChanged(bool is_fullscreen) override;
   void SetToBaseURLForDataURLIfNeeded(std::string* url);
   void ViewportFitChanged(blink::mojom::ViewportFit value) override;
-  void DidReloadLoFiImages() override;
   void OnWebContentsFocused(RenderWidgetHost*) override;
   void OnWebContentsLostFocus(RenderWidgetHost*) override;
 
diff --git a/chromium/content/browser/appcache/README.md b/chromium/content/browser/appcache/README.md
index dde134d32ef..d50b48e9aeb 100644
--- a/chromium/content/browser/appcache/README.md
+++ b/chromium/content/browser/appcache/README.md
@@ -36,7 +36,7 @@ pages.
 
 AppCache aims for comparable ease by automatically updating its locally cached
 copy of the manifest and its resources whenever a page is visited. This comes
-with some significant caveats.
+with some significant caveats:
 
 1. AppCache bails early in the update process if the manifest hasn't changed
    (byte for byte). This behavior is intended to save network bandwidth.
@@ -72,7 +72,7 @@ the same manifest, and therefore use the same cached resources.
 Manifest sharing is particularly complex when combined with implicit caching.
 An AppCache manifest is not required to list the HTML pages that refer to it
 via an `<html manifest>` attribute. (Listing the pages is however recommended.)
-This allowance introduces the following complexities.
+This allowance introduces the following complexities:
 
 1. When a browser encounters an HTML page that refers to a manifest it hasn't
    seen before, the browser creates an implicit resource entry for the HTML
@@ -109,13 +109,20 @@ downloading two manifests and all the resources associated with them.
 
 ## Data Model
 
-AppCache uses the following terms.
+AppCache uses the following terms:
 
 * A **manifest** is a list of URLs to resources. The listed resources should be
   be sufficient for the page to be used while offline.
 * An **application cache** contains one version of a manifest and all the
   resources associated with it. This includes the resources explicitly listed in
   the manifest, and the implicitly cached HTML pages that refer to the manifest.
+  The HTTP responses are stored in a disk_cache (//net term), then all other
+  AppCache information is stored in a per-profile SQLite database that points
+  into the disk_cache.  The disk_cache scope is per-profile.
+* A **response** represents the headers and body for a given server response.
+  This response is first served by a server and may then be stored and retrieved
+  in the disk_cache.  The application cache in the SQLite database updates each
+  entry to track the associated response id in the disk_cache for that entry.
 * An **application cache group** is a collection of all the application caches
   that have the same manifest.
 * A **cache host** is a name used to refer to a Document (HTML page) when the
@@ -124,14 +131,16 @@ AppCache uses the following terms.
 
 ### Application Cache
 
-An application cache has the following components.
+An application cache has the following components:
 
 1. **Entries** that identify resources to be cached.
 2. **Namespaces** that direct the loading of sub-resource URLs for a page
    associated with the cache.
 3. **Flags** that influence the cache's behavior.
 
-Entries have the following types.
+All of these components are stored in and retrieved from a SQLite database.
+
+Entries have the following types:
 
 * **manifest** - the AppCache manifest; the absolute URL of this entry is used
   to identify the group that this application cache belongs to
@@ -145,8 +154,11 @@ Explicit and fallback entries can also be marked as **foreign**. A foreign entry
 indicates a document whose `<html manifest>` attribute does not point to this
 cache's manifest.
 
+Each entry can refer to its response, which allows AppCache to know where to
+find a given entry's cached response data in its disk or memory cache.
+
 Namespaces are conceptually patterns that match resource URLs. AppCache supports
-the following namespaces.
+the following namespaces:
 
 * **fallback** - URLs matching the namespace are first fetched from the network.
   If the fetch fails, a cached fallback resource is used instead. Fallback
@@ -171,7 +183,7 @@ expressions that match URLs. This extension is invoked by adding the `isPattern`
 keyword after the namespace in the manifest.
 ***
 
-An application cache has the following flags.
+An application cache has the following flags:
 
 * **completeness** - the application cache is *complete* when all the resources
   in the manifest have been fetched and cached, and *incomplete* otherwise
diff --git a/chromium/content/browser/appcache/appcache_fuzzer.cc b/chromium/content/browser/appcache/appcache_fuzzer.cc
index 24bf6e52944..016cc3619a5 100644
--- a/chromium/content/browser/appcache/appcache_fuzzer.cc
+++ b/chromium/content/browser/appcache/appcache_fuzzer.cc
@@ -14,6 +14,7 @@
 #include "content/browser/appcache/chrome_appcache_service.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/test/browser_task_environment.h"
+#include "content/public/test/test_browser_context.h"
 #include "content/test/test_content_browser_client.h"
 #include "content/test/test_content_client.h"
 #include "mojo/core/embedder/embedder.h"
@@ -47,11 +48,11 @@ struct Env {
     appcache_service = base::MakeRefCounted<ChromeAppCacheService>(
         /*proxy=*/nullptr, /*partition=*/nullptr);
 
-    base::PostTask(FROM_HERE, {BrowserThread::UI},
-                   base::BindOnce(&ChromeAppCacheService::Initialize,
-                                  appcache_service, base::FilePath(),
-                                  /*browser_context=*/nullptr,
-                                  /*special_storage_policy=*/nullptr));
+    base::PostTask(
+        FROM_HERE, {BrowserThread::UI},
+        base::BindOnce(&ChromeAppCacheService::Initialize, appcache_service,
+                       base::FilePath(), &test_browser_context,
+                       /*special_storage_policy=*/nullptr));
     task_environment.RunUntilIdle();
   }
 
@@ -59,6 +60,7 @@ struct Env {
   scoped_refptr<ChromeAppCacheService> appcache_service;
   std::unique_ptr<TestContentClient> test_content_client;
   std::unique_ptr<TestContentBrowserClient> test_content_browser_client;
+  TestBrowserContext test_browser_context;
 
   // used by ICU integration.
   base::AtExitManager at_exit_manager;
@@ -100,7 +102,7 @@ void DoRequest(network::TestURLLoaderFactory* factory,
   network::URLLoaderCompletionStatus status;
   status.error_code = net::OK;
 
-  network::ResourceResponseHead response;
+  auto response = network::mojom::URLResponseHead::New();
 
   std::string headers = "HTTP/1.1 ";
   headers += std::to_string(code);
@@ -114,7 +116,7 @@ void DoRequest(network::TestURLLoaderFactory* factory,
   }
   HeadersToRaw(&headers);
 
-  response.headers = base::MakeRefCounted<net::HttpResponseHeaders>(headers);
+  response->headers = base::MakeRefCounted<net::HttpResponseHeaders>(headers);
 
   // To simplify the fuzzer, we respond to all requests with a manifest.
   // When we're performing a manifest fetch, this data will affect the
@@ -124,7 +126,7 @@ void DoRequest(network::TestURLLoaderFactory* factory,
   content += "\n# ";
 
   factory->SimulateResponseForPendingRequest(
-      GURL(GetUrl(url)), status, response, content,
+      GURL(GetUrl(url)), status, std::move(response), content,
       network::TestURLLoaderFactory::kUrlMatchPrefix);
 }
 
diff --git a/chromium/content/browser/appcache/appcache_group.cc b/chromium/content/browser/appcache/appcache_group.cc
index be53ed16154..8120f407456 100644
--- a/chromium/content/browser/appcache/appcache_group.cc
+++ b/chromium/content/browser/appcache/appcache_group.cc
@@ -232,7 +232,7 @@ bool AppCacheGroup::FindObserver(
 void AppCacheGroup::ScheduleUpdateRestart(int delay_ms) {
   DCHECK(restart_update_task_.IsCancelled());
   restart_update_task_.Reset(
-      base::Bind(&AppCacheGroup::RunQueuedUpdates, this));
+      base::BindOnce(&AppCacheGroup::RunQueuedUpdates, this));
   base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
       FROM_HERE, restart_update_task_.callback(),
       base::TimeDelta::FromMilliseconds(delay_ms));
diff --git a/chromium/content/browser/appcache/appcache_group.h b/chromium/content/browser/appcache/appcache_group.h
index a058f600772..63c1bb5e017 100644
--- a/chromium/content/browser/appcache/appcache_group.h
+++ b/chromium/content/browser/appcache/appcache_group.h
@@ -191,7 +191,7 @@ class CONTENT_EXPORT AppCacheGroup
   // Updates that have been queued for the next run.
   QueuedUpdates queued_updates_;
   base::ObserverList<UpdateObserver>::Unchecked queued_observers_;
-  base::CancelableClosure restart_update_task_;
+  base::CancelableOnceClosure restart_update_task_;
   std::unique_ptr<HostObserver> host_observer_;
 
   // True if we're in our destructor.
diff --git a/chromium/content/browser/appcache/appcache_group_unittest.cc b/chromium/content/browser/appcache/appcache_group_unittest.cc
index 53db23a755e..786eee3da7d 100644
--- a/chromium/content/browser/appcache/appcache_group_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_group_unittest.cc
@@ -12,6 +12,7 @@
 #include "content/browser/appcache/appcache_host.h"
 #include "content/browser/appcache/appcache_update_job.h"
 #include "content/browser/appcache/mock_appcache_service.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -46,7 +47,8 @@ class TestAppCacheFrontend : public blink::mojom::AppCacheFrontend {
                   const std::string& message) override {}
 
   void SetSubresourceFactory(
-      network::mojom::URLLoaderFactoryPtr url_loader_factory) override {}
+      mojo::PendingRemote<network::mojom::URLLoaderFactory> url_loader_factory)
+      override {}
 
   mojo::PendingRemote<blink::mojom::AppCacheFrontend> Bind(
       const base::UnguessableToken& host_id) {
diff --git a/chromium/content/browser/appcache/appcache_host.cc b/chromium/content/browser/appcache/appcache_host.cc
index ff96d9995f5..9830a3b91c2 100644
--- a/chromium/content/browser/appcache/appcache_host.cc
+++ b/chromium/content/browser/appcache/appcache_host.cc
@@ -64,6 +64,8 @@ bool CanAccessDocumentURL(int process_id, const GURL& document_url) {
          document_url.IsAboutSrcdoc() ||  // <iframe srcdoc= ...> case.
          document_url.IsAboutBlank() ||   // <iframe src="javascript:''"> case.
          document_url == GURL("data:,") ||  // CSP blocked_urls.
+         (document_url.SchemeIsBlob() &&    // <iframe src="blob:null/xx"> case.
+          url::Origin::Create(document_url).opaque()) ||
          security_policy->CanAccessDataForOrigin(process_id,
                                                  document_url) ||
          !security_policy->HasSecurityState(process_id);  // process shutdown.
@@ -177,7 +179,7 @@ void AppCacheHost::SelectCache(const GURL& document_url,
   if (main_resource_blocked_)
     OnContentBlocked(blocked_manifest_url_);
 
-  // 6.9.6 The application cache selection algorithm.
+  // 7.9.5 The application cache selection algorithm.
   // The algorithm is started here and continues in FinishCacheSelection,
   // after cache or group loading is complete.
   // Note: Foreign entries are detected on the client side and
@@ -467,7 +469,7 @@ void AppCacheHost::FinishCacheSelection(
     mojo::ReportBadMessageCallback bad_message_callback) {
   DCHECK(!associated_cache());
 
-  // 6.9.6 The application cache selection algorithm
+  // 7.9.5 The application cache selection algorithm
   if (cache) {
     // If document was loaded from an application cache, Associate document
     // with the application cache from which it was loaded. Invoke the
@@ -623,14 +625,14 @@ void AppCacheHost::MaybePassSubresourceFactory() {
   if (subresource_url_factory_.get())
     return;
 
-  network::mojom::URLLoaderFactoryPtr factory_ptr = nullptr;
-
+  mojo::PendingRemote<network::mojom::URLLoaderFactory> factory_remote;
   AppCacheSubresourceURLFactory::CreateURLLoaderFactory(GetWeakPtr(),
-                                                        &factory_ptr);
+                                                        &factory_remote);
 
-  // We may not have bound |factory_ptr| if the storage partition has shut down.
-  if (factory_ptr)
-    frontend()->SetSubresourceFactory(std::move(factory_ptr));
+  // We may not have bound |factory_remote| if the storage partition has shut
+  // down.
+  if (factory_remote)
+    frontend()->SetSubresourceFactory(std::move(factory_remote));
 }
 
 void AppCacheHost::SetAppCacheSubresourceFactory(
diff --git a/chromium/content/browser/appcache/appcache_host.h b/chromium/content/browser/appcache/appcache_host.h
index 08587995981..48d0253c9e7 100644
--- a/chromium/content/browser/appcache/appcache_host.h
+++ b/chromium/content/browser/appcache/appcache_host.h
@@ -179,7 +179,7 @@ class CONTENT_EXPORT AppCacheHost : public blink::mojom::AppCacheHost,
   }
   // SetProcessId may only be called once, and only if kInvalidUniqueID was
   // passed to the AppCacheHost's constructor (e.g. in a scenario where
-  // NavigationHandleImpl needs to delay specifying the |process_id| until
+  // NavigationRequest needs to delay specifying the |process_id| until
   // ReadyToCommit time).
   void SetProcessId(int process_id);
 
diff --git a/chromium/content/browser/appcache/appcache_host_unittest.cc b/chromium/content/browser/appcache/appcache_host_unittest.cc
index 03a387468db..83c91c3b0aa 100644
--- a/chromium/content/browser/appcache/appcache_host_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_host_unittest.cc
@@ -92,7 +92,8 @@ class AppCacheHostTest : public testing::Test {
                     const std::string& message) override {}
 
     void SetSubresourceFactory(
-        network::mojom::URLLoaderFactoryPtr url_loader_factory) override {}
+        mojo::PendingRemote<network::mojom::URLLoaderFactory>
+            url_loader_factory) override {}
 
     // WebContentsObserver:
     void AppCacheAccessed(const GURL& manifest_url,
@@ -141,6 +142,7 @@ class AppCacheHostTest : public testing::Test {
 
     int GetInUseCount(const url::Origin& origin) { return inuse_[origin]; }
 
+    bool is_empty() const { return inuse_.empty(); }
     void reset() { inuse_.clear(); }
 
     // Map from origin to count of inuse notifications.
@@ -210,39 +212,65 @@ TEST_F(AppCacheHostTest, Basic) {
 }
 
 TEST_F(AppCacheHostTest, SelectNoCache) {
-  scoped_refptr<MockQuotaManagerProxy> mock_quota_proxy =
-      base::MakeRefCounted<MockQuotaManagerProxy>();
-  service_.set_quota_manager_proxy(mock_quota_proxy.get());
-
-  // Reset our mock frontend
-  mock_frontend_.last_cache_id_ = -333;
-  mock_frontend_.last_status_ =
-      blink::mojom::AppCacheStatus::APPCACHE_STATUS_OBSOLETE;
-
-  const GURL kDocAndOriginUrl(GURL("http://whatever/").GetOrigin());
-  const url::Origin kOrigin(url::Origin::Create(kDocAndOriginUrl));
-  {
-    AppCacheHost host(kHostIdForTest, kProcessIdForTest, kRenderFrameIdForTest,
-                      mojo::NullRemote(), &service_);
-    host.set_frontend_for_testing(&mock_frontend_);
-    host.SelectCache(kDocAndOriginUrl, blink::mojom::kAppCacheNoCacheId,
-                     GURL());
-    EXPECT_EQ(1, mock_quota_proxy->GetInUseCount(kOrigin));
-
-    // We should have received an OnCacheSelected msg
-    EXPECT_EQ(blink::mojom::kAppCacheNoCacheId, mock_frontend_.last_cache_id_);
-    EXPECT_EQ(blink::mojom::AppCacheStatus::APPCACHE_STATUS_UNCACHED,
-              mock_frontend_.last_status_);
+  // Lock process to |kProcessLockURL| so we can only accept URLs from
+  // that site.
+  const GURL kProcessLockURL("http://whatever/");
+  ChildProcessSecurityPolicyImpl::GetInstance()->LockToOrigin(
+      IsolationContext(&browser_context_), kProcessIdForTest, kProcessLockURL);
 
-    // Otherwise, see that it respond as if there is no cache selected.
-    EXPECT_EQ(kHostIdForTest, host.host_id());
-    EXPECT_EQ(&service_, host.service());
-    EXPECT_EQ(nullptr, host.associated_cache());
-    EXPECT_FALSE(host.is_selection_pending());
-    EXPECT_TRUE(host.preferred_manifest_url().is_empty());
+  const std::vector<GURL> kDocumentURLs = {
+      GURL("http://whatever/"),
+      GURL("blob:http://whatever/6f7dc725-2131-4f8b-85ed-4f43d175324e"),
+      GURL("about:blank"), GURL("about:srcdoc"),
+      GURL("blob:null/6f7dc725-2131-4f8b-85ed-4f43d175324e")};
+  for (const GURL& document_url : kDocumentURLs) {
+    scoped_refptr<MockQuotaManagerProxy> mock_quota_proxy =
+        base::MakeRefCounted<MockQuotaManagerProxy>();
+    service_.set_quota_manager_proxy(mock_quota_proxy.get());
+
+    // Reset our mock frontend
+    mock_frontend_.last_cache_id_ = -333;
+    mock_frontend_.last_status_ =
+        blink::mojom::AppCacheStatus::APPCACHE_STATUS_OBSOLETE;
+
+    const url::Origin kOrigin(url::Origin::Create(document_url));
+    {
+      AppCacheHost host(kHostIdForTest, kProcessIdForTest,
+                        kRenderFrameIdForTest, mojo::NullRemote(), &service_);
+      host.set_frontend_for_testing(&mock_frontend_);
+
+      {
+        mojo::test::BadMessageObserver bad_message_observer;
+        host.SelectCache(document_url, blink::mojom::kAppCacheNoCacheId,
+                         GURL());
+
+        base::RunLoop().RunUntilIdle();
+        EXPECT_FALSE(bad_message_observer.got_bad_message());
+      }
+
+      if (kOrigin.opaque()) {
+        EXPECT_TRUE(mock_quota_proxy->is_empty());
+      } else {
+        EXPECT_EQ(1, mock_quota_proxy->GetInUseCount(kOrigin))
+            << " document_url " << document_url;
+      }
+
+      // We should have received an OnCacheSelected msg
+      EXPECT_EQ(blink::mojom::kAppCacheNoCacheId,
+                mock_frontend_.last_cache_id_);
+      EXPECT_EQ(blink::mojom::AppCacheStatus::APPCACHE_STATUS_UNCACHED,
+                mock_frontend_.last_status_);
+
+      // Otherwise, see that it respond as if there is no cache selected.
+      EXPECT_EQ(kHostIdForTest, host.host_id());
+      EXPECT_EQ(&service_, host.service());
+      EXPECT_EQ(nullptr, host.associated_cache());
+      EXPECT_FALSE(host.is_selection_pending());
+      EXPECT_TRUE(host.preferred_manifest_url().is_empty());
+    }
+    EXPECT_EQ(0, mock_quota_proxy->GetInUseCount(kOrigin));
+    service_.set_quota_manager_proxy(nullptr);
   }
-  EXPECT_EQ(0, mock_quota_proxy->GetInUseCount(kOrigin));
-  service_.set_quota_manager_proxy(nullptr);
 }
 
 TEST_F(AppCacheHostTest, ForeignEntry) {
@@ -477,9 +505,9 @@ TEST_F(AppCacheHostTest, SelectCacheAllowed) {
   mock_frontend_.content_blocked_ = false;
   mock_frontend_.appcache_accessed_ = false;
 
-  const GURL kDocAndOriginUrl(GURL("http://whatever/").GetOrigin());
+  const GURL kDocAndOriginUrl("http://whatever/");
   const url::Origin kOrigin(url::Origin::Create(kDocAndOriginUrl));
-  const GURL kManifestUrl(GURL("http://whatever/cache.manifest"));
+  const GURL kManifestUrl("http://whatever/cache.manifest");
   {
     AppCacheHost host(kHostIdForTest, kProcessIdForTest, kRenderFrameIdForTest,
                       mojo::NullRemote(), &service_);
@@ -648,7 +676,20 @@ TEST_F(AppCacheHostTest, SelectCacheURLsForWrongSite) {
               bad_message_observer.WaitForBadMessage());
   }
 
-  // Verify that a document URL from the wrong site triggers a bad message.
+  // Verify that a document URL with an inner hostname from the wrong site
+  // triggers a bad message.
+  {
+    const GURL kDocumentURL = kProcessLockURL;
+    mojo::test::BadMessageObserver bad_message_observer;
+    host_remote->SelectCache(
+        kDocumentURL, blink::mojom::kAppCacheNoCacheId,
+        GURL("blob:http://whatever/6f7dc725-2131-4f8b-85ed-4f43d175324e"));
+
+    EXPECT_EQ("ACH_SELECT_CACHE_MANIFEST_URL_ACCESS_NOT_ALLOWED",
+              bad_message_observer.WaitForBadMessage());
+  }
+
+  // Verify that a manifest URL from the wrong site triggers a bad message.
   {
     const GURL kDocumentURL = kProcessLockURL;
     const GURL kManifestURL("http://whatever/");
diff --git a/chromium/content/browser/appcache/appcache_request_handler.cc b/chromium/content/browser/appcache/appcache_request_handler.cc
index 248005afd0e..e536498899a 100644
--- a/chromium/content/browser/appcache/appcache_request_handler.cc
+++ b/chromium/content/browser/appcache/appcache_request_handler.cc
@@ -17,6 +17,7 @@
 #include "content/browser/appcache/appcache_subresource_url_factory.h"
 #include "content/browser/appcache/appcache_url_loader_job.h"
 #include "content/browser/navigation_subresource_loader_params.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/url_request/url_request.h"
 #include "net/url_request/url_request_job.h"
 #include "third_party/blink/public/common/features.h"
@@ -146,18 +147,18 @@ AppCacheJob* AppCacheRequestHandler::MaybeLoadFallbackForRedirect(
 
   std::unique_ptr<AppCacheJob> job;
   if (found_fallback_entry_.has_response_id()) {
-    // 6.9.6, step 4: If this results in a redirect to another origin,
+    // 7.9.6, step 4: If this results in a redirect to another origin,
     // get the resource of the fallback entry.
     job = CreateJob(network_delegate);
     DeliverAppCachedResponse(found_fallback_entry_, found_cache_id_,
                              found_manifest_url_, true,
                              found_namespace_entry_url_);
   } else if (!found_network_namespace_) {
-    // 6.9.6, step 6: Fail the resource load.
+    // 7.9.6, step 6: Fail the resource load.
     job = CreateJob(network_delegate);
     DeliverErrorResponse();
   } else {
-    // 6.9.6 step 3 and 5: Fetch the resource normally.
+    // 7.9.6 step 3 and 5: Fetch the resource normally.
   }
 
   return job.release();
@@ -173,7 +174,7 @@ AppCacheJob* AppCacheRequestHandler::MaybeLoadFallbackForResponse(
     return nullptr;
 
   if (request_->IsCancelled()) {
-    // 6.9.6, step 4: But not if the user canceled the download.
+    // 7.9.6, step 4: But not if the user canceled the download.
     return nullptr;
   }
 
@@ -201,7 +202,7 @@ AppCacheJob* AppCacheRequestHandler::MaybeLoadFallbackForResponse(
       return nullptr;
   }
 
-  // 6.9.6, step 4: If this results in a 4xx or 5xx status code
+  // 7.9.6, step 4: If this results in a 4xx or 5xx status code
   // or there were network errors, get the resource of the fallback entry.
 
   std::unique_ptr<AppCacheJob> job = CreateJob(network_delegate);
@@ -441,7 +442,7 @@ std::unique_ptr<AppCacheJob> AppCacheRequestHandler::MaybeLoadSubResource(
 }
 
 void AppCacheRequestHandler::ContinueMaybeLoadSubResource() {
-  // 6.9.6 Changes to the networking model
+  // 7.9.6 Changes to the networking model
   // If the resource is not to be fetched using the HTTP GET mechanism or
   // equivalent ... then fetch the resource normally.
   DCHECK(job_.get());
@@ -543,7 +544,8 @@ bool AppCacheRequestHandler::MaybeCreateLoaderForResponse(
     network::mojom::URLLoaderPtr* loader,
     network::mojom::URLLoaderClientRequest* client_request,
     ThrottlingURLLoader* url_loader,
-    bool* skip_other_interceptors) {
+    bool* skip_other_interceptors,
+    bool* will_return_unsafe_redirect) {
   // The sync interface of this method is inherited from the
   // NavigationLoaderInterceptor class. The LoaderCallback created here is
   // invoked synchronously in fallback cases, and only when there really is
@@ -588,14 +590,13 @@ AppCacheRequestHandler::MaybeCreateSubresourceLoaderParams() {
     return base::nullopt;
 
   // The factory is destroyed when the renderer drops the connection.
-  // TODO(crbug.com/955171): Replace this with Remote.
-  network::mojom::URLLoaderFactoryPtr factory_ptr;
+  mojo::PendingRemote<network::mojom::URLLoaderFactory> factory_remote;
 
   AppCacheSubresourceURLFactory::CreateURLLoaderFactory(appcache_host_,
-                                                        &factory_ptr);
+                                                        &factory_remote);
 
   SubresourceLoaderParams params;
-  params.pending_appcache_loader_factory = factory_ptr.PassInterface();
+  params.pending_appcache_loader_factory = std::move(factory_remote);
   return base::Optional<SubresourceLoaderParams>(std::move(params));
 }
 
diff --git a/chromium/content/browser/appcache/appcache_request_handler.h b/chromium/content/browser/appcache/appcache_request_handler.h
index 6d095b238ed..964b7963477 100644
--- a/chromium/content/browser/appcache/appcache_request_handler.h
+++ b/chromium/content/browser/appcache/appcache_request_handler.h
@@ -72,7 +72,8 @@ class CONTENT_EXPORT AppCacheRequestHandler
       network::mojom::URLLoaderPtr* loader,
       network::mojom::URLLoaderClientRequest* client_request,
       ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors) override;
+      bool* skip_other_interceptors,
+      bool* will_return_unsafe_redirect) override;
   base::Optional<SubresourceLoaderParams> MaybeCreateSubresourceLoaderParams()
       override;
 
diff --git a/chromium/content/browser/appcache/appcache_storage.h b/chromium/content/browser/appcache/appcache_storage.h
index 50515fada9f..9d9aed4e3e2 100644
--- a/chromium/content/browser/appcache/appcache_storage.h
+++ b/chromium/content/browser/appcache/appcache_storage.h
@@ -49,36 +49,38 @@ class CONTENT_EXPORT AppCacheStorage {
     Delegate(const Delegate&) = delete;
     Delegate& operator=(const Delegate&) = delete;
 
-    // If retrieval fails, 'collection' will be NULL.
+    // If retrieval fails, |collection| will be null.
     virtual void OnAllInfo(AppCacheInfoCollection* collection) {}
 
-    // If a load fails the 'cache' will be NULL.
+    // If the load fails, |cache| will be null.
     virtual void OnCacheLoaded(AppCache* cache, int64_t cache_id) {}
 
-    // If a load fails the 'group' will be NULL.
+    // If the load fails, |group| will be null.
     virtual void OnGroupLoaded(
         AppCacheGroup* group, const GURL& manifest_url) {}
 
-    // If successfully stored 'success' will be true.
+    // If successfully stored, |success| will be true.
     virtual void OnGroupAndNewestCacheStored(
         AppCacheGroup* group, AppCache* newest_cache, bool success,
         bool would_exceed_quota) {}
 
-    // If the operation fails, success will be false.
+    // If the operation fails, |success| will be false.
     virtual void OnGroupMadeObsolete(AppCacheGroup* group,
                                      bool success,
                                      int response_code) {}
 
-    // If a load fails the 'response_info' will be NULL.
+    // If a load fails, |response_info| will be null.
     virtual void OnResponseInfoLoaded(AppCacheResponseInfo* response_info,
                                       int64_t response_id) {}
 
-    // If no response is found, entry.response_id() and
-    // fallback_entry.response_id() will be kAppCacheNoResponseId.
-    // If the response is the entry for an intercept or fallback
-    // namespace, the url of the namespece entry is returned.
-    // If a response is found, the cache id and manifest url of the
-    // containing cache and group are also returned.
+    // If no response is found, |entry|'s response_id() and |fallback_entry|'s
+    // response_id() will be kAppCacheNoResponseId.
+    //
+    // If the response is the entry for an intercept or fallback namespace,
+    // |namespace_entry_url| refers to the entry. Otherwise, it is empty.
+    //
+    // If a response is found, |cache_id|, |group_id|, and |manifest_url|
+    // identify the cache containing the response.
     virtual void OnMainResponseFound(const GURL& url,
                                      const AppCacheEntry& entry,
                                      const GURL& namespace_entry_url,
diff --git a/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc b/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc
index 41c5b0ebf03..3b411826b93 100644
--- a/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_storage_impl_unittest.cc
@@ -1517,7 +1517,8 @@ class AppCacheStorageImplTest : public testing::Test {
     void LogMessage(blink::mojom::ConsoleMessageLevel log_level,
                     const std::string& message) override {}
     void SetSubresourceFactory(
-        network::mojom::URLLoaderFactoryPtr url_loader_factory) override {}
+        mojo::PendingRemote<network::mojom::URLLoaderFactory>
+            url_loader_factory) override {}
 
     bool error_event_was_raised_;
   };
diff --git a/chromium/content/browser/appcache/appcache_subresource_url_factory.cc b/chromium/content/browser/appcache/appcache_subresource_url_factory.cc
index 46f01aa3e13..186b991f70f 100644
--- a/chromium/content/browser/appcache/appcache_subresource_url_factory.cc
+++ b/chromium/content/browser/appcache/appcache_subresource_url_factory.cc
@@ -21,8 +21,6 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
-#include "mojo/public/cpp/bindings/interface_ptr.h"
 #include "mojo/public/cpp/bindings/message.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_request.h"
@@ -331,8 +329,8 @@ AppCacheSubresourceURLFactory::AppCacheSubresourceURLFactory(
     base::WeakPtr<AppCacheHost> host)
     : network_loader_factory_(std::move(network_loader_factory)),
       appcache_host_(host) {
-  bindings_.set_connection_error_handler(
-      base::BindRepeating(&AppCacheSubresourceURLFactory::OnConnectionError,
+  receivers_.set_disconnect_handler(
+      base::BindRepeating(&AppCacheSubresourceURLFactory::OnMojoDisconnect,
                           base::Unretained(this)));
 }
 
@@ -341,7 +339,7 @@ AppCacheSubresourceURLFactory::~AppCacheSubresourceURLFactory() {}
 // static
 void AppCacheSubresourceURLFactory::CreateURLLoaderFactory(
     base::WeakPtr<AppCacheHost> host,
-    network::mojom::URLLoaderFactoryPtr* loader_factory) {
+    mojo::PendingRemote<network::mojom::URLLoaderFactory>* loader_factory) {
   DCHECK(host.get());
   scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory;
   // The partition has shutdown, return without binding |loader_factory|.
@@ -356,7 +354,7 @@ void AppCacheSubresourceURLFactory::CreateURLLoaderFactory(
   // Please see OnConnectionError() for details.
   auto* impl = new AppCacheSubresourceURLFactory(
       std::move(network_loader_factory), host);
-  impl->Clone(mojo::MakeRequest(loader_factory));
+  impl->Clone(loader_factory->InitWithNewPipeAndPassReceiver());
 
   // Save the factory in the host to ensure that we don't create it again when
   // the cache is selected, etc.
@@ -416,8 +414,8 @@ void AppCacheSubresourceURLFactory::CreateLoaderAndStart(
 }
 
 void AppCacheSubresourceURLFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
-  bindings_.AddBinding(this, std::move(request));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
 base::WeakPtr<AppCacheSubresourceURLFactory>
@@ -425,8 +423,8 @@ AppCacheSubresourceURLFactory::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
 
-void AppCacheSubresourceURLFactory::OnConnectionError() {
-  if (bindings_.empty())
+void AppCacheSubresourceURLFactory::OnMojoDisconnect() {
+  if (receivers_.empty())
     delete this;
 }
 
diff --git a/chromium/content/browser/appcache/appcache_subresource_url_factory.h b/chromium/content/browser/appcache/appcache_subresource_url_factory.h
index 097ae617c7a..fd5879f5f72 100644
--- a/chromium/content/browser/appcache/appcache_subresource_url_factory.h
+++ b/chromium/content/browser/appcache/appcache_subresource_url_factory.h
@@ -8,7 +8,9 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "url/gurl.h"
@@ -36,7 +38,7 @@ class CONTENT_EXPORT AppCacheSubresourceURLFactory
   // requests.
   static void CreateURLLoaderFactory(
       base::WeakPtr<AppCacheHost> host,
-      network::mojom::URLLoaderFactoryPtr* loader_factory);
+      mojo::PendingRemote<network::mojom::URLLoaderFactory>* loader_factory);
 
   // network::mojom::URLLoaderFactory implementation.
   void CreateLoaderAndStart(network::mojom::URLLoaderRequest url_loader_request,
@@ -47,7 +49,8 @@ class CONTENT_EXPORT AppCacheSubresourceURLFactory
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
   base::WeakPtr<AppCacheSubresourceURLFactory> GetWeakPtr();
 
@@ -59,9 +62,9 @@ class CONTENT_EXPORT AppCacheSubresourceURLFactory
   AppCacheSubresourceURLFactory(
       scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory,
       base::WeakPtr<AppCacheHost> host);
-  void OnConnectionError();
+  void OnMojoDisconnect();
 
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
   scoped_refptr<network::SharedURLLoaderFactory> network_loader_factory_;
   base::WeakPtr<AppCacheHost> appcache_host_;
   base::WeakPtrFactory<AppCacheSubresourceURLFactory> weak_factory_{this};
diff --git a/chromium/content/browser/appcache/appcache_update_job.cc b/chromium/content/browser/appcache/appcache_update_job.cc
index 5774492b46a..0f0d1492217 100644
--- a/chromium/content/browser/appcache/appcache_update_job.cc
+++ b/chromium/content/browser/appcache/appcache_update_job.cc
@@ -81,9 +81,10 @@ bool CanUseExistingResource(const net::HttpResponseInfo* http_info) {
   // 1) If a cached response contains a Last-Modified header,
   // AppCacheUpdateJob::URLFetcher::AddConditionalHeaders() adds an
   // If-Modified-Since header, so the server may return an HTTP 304 Not Modified
-  // response. AppCacheUpdateJob::HandleUrlFetchCompleted() reuses the existing
-  // cache entry when a 304 is received, even though the HTTP specification
-  // mandates updating the cached headers with the headers in the 304 response.
+  // response. AppCacheUpdateJob::HandleResourceFetchCompleted() reuses the
+  // existing cache entry when a 304 is received, even though the HTTP
+  // specification mandates updating the cached headers with the headers in the
+  // 304 response.
   //
   // This deviation from the HTTP specification is Web-observable when AppCache
   // resources are served with Last-Modified and Cache-Control: max-age headers.
@@ -350,7 +351,7 @@ void AppCacheUpdateJob::HandleCacheFailure(
     const blink::mojom::AppCacheErrorDetails& error_details,
     ResultType result,
     const GURL& failed_resource_url) {
-  // 6.9.4 cache failure steps 2-8.
+  // 7.9.4 cache failure steps 2-8.
   DCHECK(internal_state_ != CACHE_FAILURE);
   DCHECK(!error_details.message.empty());
   DCHECK(result != UPDATE_OK);
@@ -502,7 +503,7 @@ void AppCacheUpdateJob::ContinueHandleManifestFetchCompleted(bool changed) {
 
     // Wait for pending master entries to download.
     FetchMasterEntries();
-    MaybeCompleteUpdate();  // if not done, run async 6.9.4 step 7 substeps
+    MaybeCompleteUpdate();  // if not done, run async 7.9.4 step 7 substeps
     return;
   }
 
@@ -526,7 +527,7 @@ void AppCacheUpdateJob::ContinueHandleManifestFetchCompleted(bool changed) {
     return;
   }
 
-  // Proceed with update process. Section 6.9.4 steps 8-20.
+  // Proceed with update process. Section 7.9.4 steps 8-20.
   internal_state_ = DOWNLOADING;
   inprogress_cache_ =
       base::MakeRefCounted<AppCache>(storage_, storage_->NewCacheId());
@@ -605,7 +606,7 @@ void AppCacheUpdateJob::HandleResourceFetchCompleted(URLFetcher* url_fetcher,
     //   if (!manifestAttribute) skip it
 
     // Foreign entries will be detected during cache selection.
-    // Note: 6.9.4, step 17.9 possible optimization: if resource is HTML or XML
+    // Note: 7.9.4, step 17.9 possible optimization: if resource is HTML or XML
     // file whose root element is an html element with a manifest attribute
     // whose value doesn't match the manifest url of the application cache
     // being processed, mark the entry as being foreign.
@@ -707,7 +708,7 @@ void AppCacheUpdateJob::HandleNewMasterEntryFetchCompleted(
   DCHECK(found != pending_master_entries_.end());
   std::vector<AppCacheHost*>& hosts = found->second;
 
-  // Section 6.9.4. No update case: step 7.3, else step 22.
+  // Section 7.9.4. No update case: step 7.3, else step 22.
   if (response_code / 100 == 2) {
     // Add fetched master entry to the appropriate cache.
     AppCache* cache = inprogress_cache_.get() ? inprogress_cache_.get()
@@ -760,7 +761,7 @@ void AppCacheUpdateJob::HandleNewMasterEntryFetchCompleted(
       pending_master_entries_.erase(found);
       --master_entries_completed_;
 
-      // Section 6.9.4, step 22.3.
+      // Section 7.9.4, step 22.3.
       if (update_type_ == CACHE_ATTEMPT && pending_master_entries_.empty()) {
         HandleCacheFailure(
             blink::mojom::AppCacheErrorDetails(
@@ -1086,7 +1087,7 @@ void AppCacheUpdateJob::AddUrlToFileList(const GURL& url, int type) {
 void AppCacheUpdateJob::FetchUrls() {
   DCHECK_EQ(internal_state_, DOWNLOADING);
 
-  // Fetch each URL in the list according to section 6.9.4 step 17.1-17.3.
+  // Fetch each URL in the list according to section 7.9.4 step 18.1-18.3.
   // Fetch up to the concurrent limit. Other fetches will be triggered as each
   // each fetch completes.
   while (pending_url_fetches_.size() < kMaxConcurrentUrlFetches &&
@@ -1378,7 +1379,7 @@ void AppCacheUpdateJob::MaybeCompleteUpdate() {
           storage_->StoreEvictionTimes(group_);
       }
       group_->SetUpdateAppCacheStatus(AppCacheGroup::IDLE);
-      // 6.9.4 steps 7.3-7.7.
+      // 7.9.4 steps 7.3-7.7.
       NotifyAllAssociatedHosts(
           blink::mojom::AppCacheEventID::APPCACHE_NO_UPDATE_EVENT);
       DiscardDuplicateResponses();
diff --git a/chromium/content/browser/appcache/appcache_update_job_unittest.cc b/chromium/content/browser/appcache/appcache_update_job_unittest.cc
index 9f6092b94e3..a4a1fde5cee 100644
--- a/chromium/content/browser/appcache/appcache_update_job_unittest.cc
+++ b/chromium/content/browser/appcache/appcache_update_job_unittest.cc
@@ -35,6 +35,7 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/url_loader_interceptor.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/net_errors.h"
@@ -292,7 +293,8 @@ class MockFrontend : public blink::mojom::AppCacheFrontend {
                   const std::string& message) override {}
 
   void SetSubresourceFactory(
-      network::mojom::URLLoaderFactoryPtr url_loader_factory) override {}
+      mojo::PendingRemote<network::mojom::URLLoaderFactory> url_loader_factory)
+      override {}
 
   void AddExpectedEvent(blink::mojom::AppCacheEventID event_id) {
     DCHECK(!ignore_progress_events_ ||
diff --git a/chromium/content/browser/appcache/chrome_appcache_service.cc b/chromium/content/browser/appcache/chrome_appcache_service.cc
index 8535a96015e..497e6aaec1b 100644
--- a/chromium/content/browser/appcache/chrome_appcache_service.cc
+++ b/chromium/content/browser/appcache/chrome_appcache_service.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "net/base/net_errors.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
diff --git a/chromium/content/browser/back_forward_cache_browsertest.cc b/chromium/content/browser/back_forward_cache_browsertest.cc
index 1df8c0f88dd..0c9ae5dc257 100644
--- a/chromium/content/browser/back_forward_cache_browsertest.cc
+++ b/chromium/content/browser/back_forward_cache_browsertest.cc
@@ -3,17 +3,22 @@
 // found in the LICENSE file.
 
 #include "base/command_line.h"
+#include "base/metrics/metrics_hashes.h"
 #include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/test_mock_time_task_runner.h"
 #include "base/time/time.h"
+#include "build/build_config.h"
 #include "components/network_session_configurator/common/network_switches.h"
-#include "content/browser/frame_host/back_forward_cache.h"
+#include "content/browser/frame_host/back_forward_cache_impl.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/back_forward_cache_util.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -29,10 +34,12 @@
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "services/device/public/cpp/test/scoped_geolocation_overrider.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
 
 using testing::Each;
+using testing::ElementsAre;
 using testing::Not;
 
 namespace content {
@@ -50,13 +57,18 @@ class BackForwardCacheBrowserTest : public ContentBrowserTest {
         switches::kUseFakeUIForMediaStream);
     base::CommandLine::ForCurrentProcess()->AppendSwitch(
         switches::kIgnoreCertificateErrors);
-    feature_list_.InitWithFeatures(FeaturesToEnable(), {});
+    base::CommandLine::ForCurrentProcess()->AppendSwitch(
+        switches::kEnableExperimentalWebPlatformFeatures);
+    feature_list_.InitAndEnableFeatureWithParameters(
+        features::kBackForwardCache, GetFeatureParams());
 
     ContentBrowserTest::SetUpCommandLine(command_line);
   }
 
-  virtual std::vector<base::Feature> FeaturesToEnable() {
-    return std::vector<base::Feature>({features::kBackForwardCache});
+  virtual base::FieldTrialParams GetFeatureParams() {
+    // Set a very long TTL before expiration (longer than the test timeout) so
+    // tests that are expecting deletion don't pass when they shouldn't.
+    return {{"TimeToLiveInBackForwardCacheInSeconds", "3600"}};
   }
 
   void SetUpOnMainThread() override {
@@ -72,8 +84,100 @@ class BackForwardCacheBrowserTest : public ContentBrowserTest {
     return web_contents()->GetFrameTree()->root()->current_frame_host();
   }
 
+  RenderFrameHostManager* render_frame_host_manager() {
+    return web_contents()->GetFrameTree()->root()->render_manager();
+  }
+
+  std::string DepictFrameTree(FrameTreeNode* node) {
+    return visualizer_.DepictFrameTree(node);
+  }
+
+  void ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome outcome,
+                     base::Location location) {
+    base::HistogramBase::Sample sample = base::HistogramBase::Sample(outcome);
+    AddSampleToBuckets(&expected_outcomes_, sample);
+
+    EXPECT_EQ(expected_outcomes_,
+              histogram_tester_.GetAllSamples(
+                  "BackForwardCache.HistoryNavigationOutcome"))
+        << location.ToString();
+  }
+
+  void ExpectOutcomeIsEmpty(base::Location location) {
+    EXPECT_THAT(histogram_tester_.GetAllSamples(
+                    "BackForwardCache.HistoryNavigationOutcome"),
+                ElementsAre())
+        << location.ToString();
+  }
+
+  void ExpectDisabledWithReason(const std::string& reason,
+                                base::Location location) {
+    base::HistogramBase::Sample sample =
+        base::HistogramBase::Sample(base::HashMetricName(reason));
+    AddSampleToBuckets(&expected_disabled_reasons_, sample);
+
+    EXPECT_EQ(expected_disabled_reasons_,
+              histogram_tester_.GetAllSamples(
+                  "BackForwardCache.HistoryNavigationOutcome."
+                  "DisabledForRenderFrameHostReason"))
+        << location.ToString();
+  }
+
+  void ExpectEvicted(BackForwardCacheMetrics::EvictedReason reason,
+                     base::Location location) {
+    base::HistogramBase::Sample sample = base::HistogramBase::Sample(reason);
+    AddSampleToBuckets(&expected_eviction_reasons_, sample);
+
+    EXPECT_EQ(expected_eviction_reasons_,
+              histogram_tester_.GetAllSamples(
+                  "BackForwardCache.HistoryNavigationOutcome.EvictedReason"))
+        << location.ToString();
+  }
+
+  void ExpectEvictedIsEmpty(base::Location location) {
+    EXPECT_THAT(histogram_tester_.GetAllSamples(
+                    "BackForwardCache.HistoryNavigationOutcome.EvictedReason"),
+                ElementsAre())
+        << location.ToString();
+  }
+
+  void ExpectEvictedAfterCommitted(
+      std::vector<BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason>
+          reasons,
+      base::Location location) {
+    for (BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason reason :
+         reasons) {
+      base::HistogramBase::Sample sample = base::HistogramBase::Sample(reason);
+      AddSampleToBuckets(&expected_eviction_after_committing_, sample);
+    }
+
+    EXPECT_EQ(expected_eviction_after_committing_,
+              histogram_tester_.GetAllSamples(
+                  "BackForwardCache.EvictedAfterDocumentRestoredReason"))
+        << location.ToString();
+  }
+
  private:
+  void AddSampleToBuckets(std::vector<base::Bucket>* buckets,
+                          base::HistogramBase::Sample sample) {
+    auto it = std::find_if(
+        buckets->begin(), buckets->end(),
+        [sample](const base::Bucket& bucket) { return bucket.min == sample; });
+    if (it == buckets->end()) {
+      buckets->push_back(base::Bucket(sample, 1));
+    } else {
+      it->count++;
+    }
+  }
+
   base::test::ScopedFeatureList feature_list_;
+
+  FrameTreeVisualizer visualizer_;
+  base::HistogramTester histogram_tester_;
+  std::vector<base::Bucket> expected_outcomes_;
+  std::vector<base::Bucket> expected_disabled_reasons_;
+  std::vector<base::Bucket> expected_eviction_reasons_;
+  std::vector<base::Bucket> expected_eviction_after_committing_;
 };
 
 // Match RenderFrameHostImpl* that are in the BackForwardCache.
@@ -156,6 +260,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Basic) {
   EXPECT_EQ(rfh_a->GetVisibilityState(), PageVisibilityState::kVisible);
   EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
   EXPECT_EQ(rfh_b->GetVisibilityState(), PageVisibilityState::kHidden);
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // Navigate from A to B and go back.
@@ -190,6 +297,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BasicDocumentInitiated) {
   EXPECT_EQ(rfh_a, current_frame_host());
   EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
   EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // Navigate from back and forward repeatedly.
@@ -219,6 +329,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
   EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
 
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+
   // 4) Go forward to B.
   web_contents()->GetController().GoForward();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
@@ -227,6 +340,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
   EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
 
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+
   // 5) Go back to A.
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
@@ -235,6 +351,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
   EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
 
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+
   // 6) Go forward to B.
   web_contents()->GetController().GoForward();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
@@ -245,6 +364,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // The current page can't enter the BackForwardCache if another page can script
@@ -345,6 +467,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BasicIframe) {
   EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
   EXPECT_FALSE(rfh_b->is_in_back_forward_cache());
   EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // Ensure flushing the BackForwardCache works properly.
@@ -365,19 +490,18 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, BackForwardCacheFlush) {
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
 
   // 3) Flush A.
-  web_contents()->GetController().back_forward_cache().Flush();
-  EXPECT_TRUE(delete_observer_rfh_a.deleted());
+  web_contents()->GetController().GetBackForwardCache().Flush();
+  EXPECT_TRUE(delete_observer_rfh_a.deleted());  // Flush is synchronous.
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
 
   // 4) Go back to a new A.
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_TRUE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
 
   // 5) Flush B.
-  web_contents()->GetController().back_forward_cache().Flush();
-  EXPECT_TRUE(delete_observer_rfh_b.deleted());
+  web_contents()->GetController().GetBackForwardCache().Flush();
+  EXPECT_TRUE(delete_observer_rfh_b.deleted());  // Flush is synchronous.
 }
 
 // Check the visible URL in the omnibox is properly updated when restoring a
@@ -404,9 +528,51 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, VisibleURL) {
   EXPECT_EQ(url_b, web_contents()->GetVisibleURL());
 }
 
+// Test only 1 document is kept in the at a time BackForwardCache.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       CacheSizeLimitedToOneDocumentPerTab) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  const GURL url_c(embedded_test_server()->GetURL("c.com", "/title1.html"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  // BackForwardCache is empty.
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  // BackForwardCache contains only rfh_a.
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_c));
+  // BackForwardCache contains only rfh_b.
+  delete_observer_rfh_a.WaitUntilDeleted();
+  EXPECT_FALSE(delete_observer_rfh_b.deleted());
+
+  // If/when the cache size is increased, this can be tested iteratively, see
+  // deleted code in: https://crrev.com/c/1782902.
+
+  web_contents()->GetController().GoToOffset(-2);
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kNotRestored,
+                FROM_HERE);
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kCacheLimit, FROM_HERE);
+}
+
 // Test documents are evicted from the BackForwardCache at some point.
-IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CacheEviction) {
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       CacheEvictionWithIncreasedCacheSize) {
   ASSERT_TRUE(embedded_test_server()->Start());
+
+  // The number of document the BackForwardCache can hold per tab.
+  static constexpr size_t kBackForwardCacheLimit = 5;
+  web_contents()
+      ->GetController()
+      .GetBackForwardCache()
+      .set_cache_size_limit_for_testing(kBackForwardCacheLimit);
+
   const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
   const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
 
@@ -418,9 +584,6 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CacheEviction) {
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
 
-  // The number of document the BackForwardCache can hold per tab.
-  static constexpr size_t kBackForwardCacheLimit = 3;
-
   for (size_t i = 2; i < kBackForwardCacheLimit; ++i) {
     EXPECT_TRUE(NavigateToURL(shell(), i % 2 ? url_b : url_a));
     // After |i+1| navigations, |i| documents went into the BackForwardCache.
@@ -468,6 +631,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, SubframeSurviveCache1) {
   // Even after a new IPC round trip with the renderer, b2 must still be alive.
   EXPECT_EQ("I am alive", EvalJs(b2, "window.alive"));
   EXPECT_FALSE(b2_observer.deleted());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // Similar to BackForwardCacheBrowserTest.SubframeSurviveCache*
@@ -508,6 +674,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, SubframeSurviveCache2) {
   // Even after a new IPC round trip with the renderer, b2 must still be alive.
   EXPECT_EQ("I am alive", EvalJs(b2, "window.alive"));
   EXPECT_FALSE(b2_observer.deleted());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // Similar to BackForwardCacheBrowserTest.tSubframeSurviveCache*
@@ -552,6 +721,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, SubframeSurviveCache3) {
   EXPECT_EQ("I am alive", EvalJs(b2, "window.alive"));
   EXPECT_FALSE(b2_observer.deleted());
 
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+
   // 4) Go forward to b3(a4).
   web_contents()->GetController().GoForward();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
@@ -563,11 +735,21 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, SubframeSurviveCache3) {
   // Even after a new IPC round trip with the renderer, a4 must still be alive.
   EXPECT_EQ("I am alive", EvalJs(a4, "window.alive"));
   EXPECT_FALSE(a4_observer.deleted());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
 }
 
 // Similar to BackForwardCacheBrowserTest.SubframeSurviveCache*
 // Test case: a1(b2) -> b3 -> a4 -> b5 -> a1(b2).
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, SubframeSurviveCache4) {
+  // Increase the cache size so that a1(b2) is still in the cache when we
+  // reach b5.
+  web_contents()
+      ->GetController()
+      .GetBackForwardCache()
+      .set_cache_size_limit_for_testing(3);
+
   ASSERT_TRUE(embedded_test_server()->Start());
   const GURL url_ab(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
@@ -680,6 +862,9 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // Page B should be deleted (not cached).
   delete_observer_rfh_b.WaitUntilDeleted();
 
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+
   // 4. Navigate from a cacheable page to a cacheable page (A->C).
   EXPECT_TRUE(NavigateToURL(shell(), url_c));
   EXPECT_EQ(web_contents()->GetLastCommittedURL(), url_c);
@@ -698,6 +883,159 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // Page C should be in the cache.
   EXPECT_FALSE(delete_observer_rfh_c.deleted());
   EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       ProxiesAreStoredAndRestored) {
+  // This test makes assumption about where iframe processes live.
+  if (!AreAllSitesIsolatedForTesting())
+    return;
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // During a navigation, the document being navigated *away from* can either be
+  // deleted or stored into the BackForwardCache. The document being navigated
+  // *to* can either be new or restored from the BackForwardCache.
+  //
+  // This test covers every combination:
+  //
+  //  1. Navigate to a cacheable page (()->A)
+  //  2. Navigate to an uncacheable page (A->B)
+  //  3. Go Back to a cached page (B->A)
+  //  4. Navigate to a cacheable page (A->C)
+  //  5. Go Back to a cached page (C->A)
+  //
+  // +-+-------+----------------+---------------+
+  // |#|nav    | curr_document  | dest_document |
+  // +-+-------+----------------+---------------|
+  // |1|(()->A)| N/A            | new           |
+  // |2|(A->B) | cached         | new           |
+  // |3|(B->A) | deleted        | restored      |
+  // |4|(A->C) | cached         | new           |
+  // |5|(C->A) | cached         | restored      |
+  // +-+-------+----------------+---------------+
+  //
+  // We use pages with cross process iframes to verify that proxy storage and
+  // retrieval works well in every possible combination.
+
+  const GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(i,j)"));
+  const GURL url_b(embedded_test_server()->GetURL(
+      "b.com", "/back_forward_cache/page_with_dedicated_worker.html"));
+  const GURL url_c(embedded_test_server()->GetURL(
+      "c.com", "/cross_site_iframe_factory.html?c(k,l,m)"));
+
+  NavigationControllerImpl& controller = web_contents()->GetController();
+  BackForwardCacheImpl& cache = controller.GetBackForwardCache();
+
+  // 1. Navigate to a cacheable page (A).
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  EXPECT_EQ(2u, render_frame_host_manager()->GetProxyCount());
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+  std::string frame_tree_a = DepictFrameTree(rfh_a->frame_tree_node());
+
+  // 2. Navigate from a cacheable page to an uncacheable page (A->B).
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  EXPECT_EQ(0u, render_frame_host_manager()->GetProxyCount());
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
+
+  // Page A should be in the cache.
+  EXPECT_FALSE(delete_observer_rfh_a.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+
+  // Verify proxies are stored as well.
+  auto* cached_entry = cache.GetEntry(rfh_a->nav_entry_id());
+  EXPECT_EQ(2u, cached_entry->proxy_hosts.size());
+
+  // 3. Navigate from an uncacheable to a cached page page (B->A).
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  // Note: We still have a transition proxy that will be used to perform the
+  // frame SwapOut. It gets deleted with rfh_b below.
+  EXPECT_EQ(3u, render_frame_host_manager()->GetProxyCount());
+
+  // Page B should be deleted (not cached).
+  delete_observer_rfh_b.WaitUntilDeleted();
+  EXPECT_EQ(2u, render_frame_host_manager()->GetProxyCount());
+
+  // Page A should still have the correct frame tree.
+  EXPECT_EQ(frame_tree_a,
+            DepictFrameTree(current_frame_host()->frame_tree_node()));
+
+  // 4. Navigate from a cacheable page to a cacheable page (A->C).
+  EXPECT_TRUE(NavigateToURL(shell(), url_c));
+  EXPECT_EQ(3u, render_frame_host_manager()->GetProxyCount());
+  RenderFrameHostImpl* rfh_c = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_c(rfh_c);
+
+  // Page A should be in the cache.
+  EXPECT_FALSE(delete_observer_rfh_a.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+
+  // Verify proxies are stored as well.
+  cached_entry = cache.GetEntry(rfh_a->nav_entry_id());
+  EXPECT_EQ(2u, cached_entry->proxy_hosts.size());
+
+  // 5. Navigate from a cacheable page to a cached page (C->A).
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(2u, render_frame_host_manager()->GetProxyCount());
+
+  // Page A should still have the correct frame tree.
+  EXPECT_EQ(frame_tree_a,
+            DepictFrameTree(current_frame_host()->frame_tree_node()));
+
+  // Page C should be in the cache.
+  EXPECT_FALSE(delete_observer_rfh_c.deleted());
+  EXPECT_TRUE(rfh_c->is_in_back_forward_cache());
+
+  // Verify proxies are stored as well.
+  cached_entry = cache.GetEntry(rfh_c->nav_entry_id());
+  EXPECT_EQ(3u, cached_entry->proxy_hosts.size());
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       RestoredProxiesAreFunctional) {
+  // This test makes assumption about where iframe processes live.
+  if (!AreAllSitesIsolatedForTesting())
+    return;
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // Page A is cacheable, while page B is not.
+  const GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(z)"));
+  const GURL url_b(embedded_test_server()->GetURL(
+      "b.com", "/back_forward_cache/page_with_dedicated_worker.html"));
+  const GURL test_url(embedded_test_server()->GetURL("c.com", "/title1.html"));
+
+  NavigationControllerImpl& controller = web_contents()->GetController();
+
+  // 1. Navigate to a cacheable page (A).
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+
+  // 2. Navigate from a cacheable page to an uncacheable page (A->B).
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  // 3. Navigate from an uncacheable to a cached page page (B->A).
+  // This restores the top frame's proxy in the z.com (iframe's) process.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // 4. Verify that the main frame's z.com proxy is still functional.
+  RenderFrameHostImpl* iframe =
+      rfh_a->frame_tree_node()->child_at(0)->current_frame_host();
+  EXPECT_TRUE(ExecJs(iframe, "top.location.href = '" + test_url.spec() + "';"));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // We expect to have navigated through the proxy.
+  EXPECT_EQ(test_url, controller.GetLastCommittedEntry()->GetURL());
 }
 
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
@@ -718,6 +1056,31 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   delete_observer_rfh_a.WaitUntilDeleted();
 }
 
+// TODO(https://crbug.com/154571): Shared workers are not available on Android.
+#if defined(OS_ANDROID)
+#define MAYBE_PageWithSharedWorkerNotCached \
+  DISABLED_PageWithSharedWorkerNotCached
+#else
+#define MAYBE_PageWithSharedWorkerNotCached PageWithSharedWorkerNotCached
+#endif
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       MAYBE_PageWithSharedWorkerNotCached) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL(
+          "a.com", "/back_forward_cache/page_with_shared_worker.html")));
+  RenderFrameDeletedObserver delete_observer_rfh_a(current_frame_host());
+
+  // Navigate away.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
+
+  // The page with the unsupported feature should be deleted (not cached).
+  delete_observer_rfh_a.WaitUntilDeleted();
+}
+
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
                        SubframeWithDisallowedFeatureNotCached) {
   ASSERT_TRUE(embedded_test_server()->Start());
@@ -1033,17 +1396,17 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
 
   // Disable the BackForwardCache.
-  web_contents()->GetController().back_forward_cache().DisableForTesting(
-      BackForwardCache::TEST_ASSUMES_NO_CACHING);
+  web_contents()->GetController().GetBackForwardCache().DisableForTesting(
+      BackForwardCacheImpl::TEST_ASSUMES_NO_CACHING);
 
   // Navigate to a page that would normally be cacheable.
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
   RenderFrameDeletedObserver delete_observer_rfh_a(current_frame_host());
 
   // Navigate away.
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
 
   // The page should be deleted (not cached).
   delete_observer_rfh_a.WaitUntilDeleted();
@@ -1080,6 +1443,14 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // RenderFrameHost A is evicted from the BackForwardCache:
   delete_observer_rfh_a.WaitUntilDeleted();
+
+  // 4) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kNotRestored,
+                FROM_HERE);
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kJavaScriptExecution,
+                FROM_HERE);
 }
 
 // Similar to BackForwardCacheBrowserTest.EvictionOnJavaScriptExecution.
@@ -1118,6 +1489,14 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // The A(B) page is evicted. So A and B are removed:
   delete_observer_rfh_a.WaitUntilDeleted();
   delete_observer_rfh_b.WaitUntilDeleted();
+
+  // 4) Go back to A(B).
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kNotRestored,
+                FROM_HERE);
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kJavaScriptExecution,
+                FROM_HERE);
 }
 
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
@@ -1152,6 +1531,14 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // RenderFrameHost A is evicted from the BackForwardCache:
   delete_observer_rfh_a.WaitUntilDeleted();
+
+  // 5) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kNotRestored,
+                FROM_HERE);
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kJavaScriptExecution,
+                FROM_HERE);
 }
 
 // Similar to BackForwardCacheBrowserTest.EvictionOnJavaScriptExecution, but
@@ -1235,6 +1622,17 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
   EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
   EXPECT_NE("initial document", EvalJs(rfh_a, "window.foo"));
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kRestored,
+                FROM_HERE);
+  ExpectEvictedAfterCommitted(
+      {
+          BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason::
+              kRestored,
+          BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason::
+              kByJavaScript,
+      },
+      FROM_HERE);
 }
 
 // Tests the events are fired when going back from the cache.
@@ -1335,11 +1733,6 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   RenderFrameHostImpl* rfh_b = current_frame_host();
   RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
 
-  // TODO(https://crbug.com/1000324): This shouldn't be deleted. Fix this bug
-  // and re-enable the rest of this test.
-  delete_observer_rfh_a.WaitUntilDeleted();
-  return;
-
   EXPECT_FALSE(delete_observer_rfh_a.deleted());
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
   EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
@@ -1493,10 +1886,15 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // rfh_a should have been deleted, and page A navigated to normally.
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_TRUE(delete_observer_rfh_a.deleted());
+  delete_observer_rfh_a.WaitUntilDeleted();
   RenderFrameHostImpl* rfh_a2 = current_frame_host();
   EXPECT_NE(rfh_a2, rfh_b);
   EXPECT_EQ(rfh_a2->GetLastCommittedURL(), url_a);
+
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kNotRestored,
+                FROM_HERE);
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kJavaScriptExecution,
+                FROM_HERE);
 }
 
 // Test that if the renderer process crashes while a document is in the
@@ -1528,11 +1926,19 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
 
   // The cached RenderFrameHost should be destroyed (not kept in the cache).
   crash_observer.Wait();
-  EXPECT_TRUE(delete_observer_rfh_a.deleted());
+  delete_observer_rfh_a.WaitUntilDeleted();
 
   // rfh_b should still be the current frame.
   EXPECT_EQ(current_frame_host(), rfh_b);
   EXPECT_FALSE(delete_observer_rfh_b.deleted());
+
+  // 4) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcome(BackForwardCacheMetrics::HistoryNavigationOutcome::kNotRestored,
+                FROM_HERE);
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kRendererProcessKilled,
+                FROM_HERE);
 }
 
 // The test is simulating a race condition. The scheduler tracked features are
@@ -1581,39 +1987,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // 2) Navigate to B.
   EXPECT_TRUE(NavigateToURL(shell(), url_b));
 
-  // TODO(https://crbug.com/996267): Evict the document and wait for its
-  // destruction here instead.
-
-  auto old_document_using_webgl = [rfh_a]() {
-    return rfh_a->scheduler_tracked_features() &
-           (1 << static_cast<uint32_t>(
-                blink::scheduler::WebSchedulerTrackedFeature::kWebGL));
-  };
-
-  // Wait for WebGL to be used in the old document.
-  while (!old_document_using_webgl()) {
-    base::RunLoop loop;
-    base::PostDelayedTask(FROM_HERE, loop.QuitClosure(),
-                          base::TimeDelta::FromMilliseconds(50));
-    loop.Run();
-  }
-
-  // The scheduler tracked features have been updated. The document shouldn't
-  // stay in the BackForwardCache anymore.  TODO(arthursonzogni): Evict the
-  // page.
-  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
-  EXPECT_FALSE(
-      web_contents()->GetController().back_forward_cache().CanStoreDocument(
-          rfh_a));
-
-  // 3) Go back to A.
-  web_contents()->GetController().GoBack();
-  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-
-  // TODO(https://crbug.com/996267): The document should have been evicted
-  // instead of being restored.
-  EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_EQ(current_frame_host(), rfh_a);
+  // rfh_a should be evicted from the cache and destroyed.
+  delete_observer_rfh_a.WaitUntilDeleted();
 }
 
 // A fetch request starts during the "freeze" event. The current behavior is to
@@ -1662,27 +2037,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, FetchWhileStoring) {
   // 3) Go back to A.
   web_contents()->GetController().GoBack();
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  EXPECT_FALSE(delete_observer_rfh_a.deleted());
-  EXPECT_EQ(current_frame_host(), rfh_a);
-
-  // TODO(https://crbug.com/996267). Consider evicting the page or closing the
-  // connection.
-  EXPECT_EQ("TheResponse", EvalJs(rfh_a, R"(
-    new Promise(async resolve => {
-      if (my_fetch == undefined) {
-        resolve("undefined");
-        return;
-      }
-
-      try {
-        response = await my_fetch;
-        text = await response.text();
-        resolve(text);
-      } catch (exception) {
-        resolve("error");
-      }
-    });
-  )"));
+  delete_observer_rfh_a.WaitUntilDeleted();
 }
 
 // Only HTTP/HTTPS main document can enter the BackForwardCache.
@@ -1809,6 +2164,8 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // The page is controlled by a service worker, so it shouldn't have been
   // cached.
   deleted.WaitUntilDeleted();
+
+  ExpectOutcomeIsEmpty(FROM_HERE);
 }
 
 class BackForwardCacheBrowserTestWithServiceWorkerEnabled
@@ -1818,11 +2175,8 @@ class BackForwardCacheBrowserTestWithServiceWorkerEnabled
   ~BackForwardCacheBrowserTestWithServiceWorkerEnabled() override {}
 
  protected:
-  std::vector<base::Feature> FeaturesToEnable() override {
-    std::vector<base::Feature> result =
-        BackForwardCacheBrowserTest::FeaturesToEnable();
-    result.push_back(kBackForwardCacheWithServiceWorker);
-    return result;
+  base::FieldTrialParams GetFeatureParams() override {
+    return {{"service_worker_supported", "true"}};
   }
 };
 
@@ -1889,6 +2243,7 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, CachePagesWithBeacon) {
   EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
 }
 
+// Regression test for https://crbug.com/993337.
 IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
                        NavigateToTwoPagesOnSameSite) {
   ASSERT_TRUE(embedded_test_server()->Start());
@@ -1902,17 +2257,708 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
   // 2) Navigate to A2.
   EXPECT_TRUE(NavigateToURL(shell(), url_a2));
   RenderFrameHostImpl* rfh_a2 = current_frame_host();
+  RenderFrameDeletedObserver delete_rfh_a2(current_frame_host());
 
   // 3) Navigate to B1.
   EXPECT_TRUE(NavigateToURL(shell(), url_b1));
   EXPECT_TRUE(rfh_a2->is_in_back_forward_cache());
+  RenderFrameHostImpl* rfh_b1 = current_frame_host();
 
   // 4) Do a history navigation back to A1.
-  // TODO(https://crbug.com/993337): This causes "Check failed: !frame_widget_".
-  RenderProcessHost* process = rfh_a2->GetProcess();
-  RenderProcessHostWatcher crash_observer(
-      process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
   web_contents()->GetController().GoToIndex(0);
-  crash_observer.Wait();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_TRUE(rfh_b1->is_in_back_forward_cache());
+
+  // As a result, rfh_a2 is deleted. The history navigation tried to restore an
+  // entry using the same BrowsingInstance. They both can't live together.
+  delete_rfh_a2.WaitUntilDeleted();
+}
+
+class GeolocationBackForwardCacheBrowserTest
+    : public BackForwardCacheBrowserTest {
+ protected:
+  GeolocationBackForwardCacheBrowserTest() : geo_override_(0.0, 0.0) {}
+
+  device::ScopedGeolocationOverrider geo_override_;
+};
+
+// Test that a page which has queried geolocation in the past, but have no
+// active geolocation query, can be bfcached.
+IN_PROC_BROWSER_TEST_F(GeolocationBackForwardCacheBrowserTest,
+                       CacheAfterGeolocationRequest) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+
+  // Query current position, and wait for the query to complete.
+  EXPECT_EQ("received", EvalJs(rfh_a, R"(
+      new Promise(resolve => {
+        navigator.geolocation.getCurrentPosition(() => resolve('received'));
+      });
+  )"));
+
+  RenderFrameDeletedObserver deleted(rfh_a);
+
+  // 2) Navigate away.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  // The page has no inflight geolocation request when we navigated away,
+  // so it should have been cached.
+  EXPECT_FALSE(deleted.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+}
+
+// Test that a page which has an inflight geolocation query can be bfcached,
+// and verify that the page does not observe any geolocation while the page
+// was inside bfcache.
+IN_PROC_BROWSER_TEST_F(GeolocationBackForwardCacheBrowserTest,
+                       CancelGeolocationRequestInFlight) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+
+  // Continuously query current geolocation.
+  EXPECT_TRUE(ExecJs(rfh_a, R"(
+    window.longitude_log = [];
+    window.err_log = [];
+    window.wait_for_first_position = new Promise(resolve => {
+      navigator.geolocation.watchPosition(
+        pos => {
+          window.longitude_log.push(pos.coords.longitude);
+          resolve("resolved");
+        },
+        err => window.err_log.push(err)
+      );
+    })
+  )"));
+  geo_override_.UpdateLocation(0.0, 0.0);
+  EXPECT_EQ("resolved", EvalJs(rfh_a, "window.wait_for_first_position"));
+
+  // Pause resolving Geoposition queries to keep the request inflight.
+  geo_override_.Pause();
+  geo_override_.UpdateLocation(1.0, 1.0);
+  EXPECT_EQ(1u, geo_override_.GetGeolocationInstanceCount());
+
+  // 2) Navigate away.
+  base::RunLoop loop_until_close;
+  geo_override_.SetGeolocationCloseCallback(loop_until_close.QuitClosure());
+
+  RenderFrameDeletedObserver deleted(rfh_a);
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  loop_until_close.Run();
+
+  // The page has no inflight geolocation request when we navigated away,
+  // so it should have been cached.
+  EXPECT_FALSE(deleted.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+
+  // Resume resolving Geoposition queries.
+  geo_override_.Resume();
+
+  // We update the location while the page is BFCached, but this location should
+  // not be observed.
+  geo_override_.UpdateLocation(2.0, 2.0);
+
+  // 3) Navigate back to A.
+
+  // The location when navigated back can be observed
+  geo_override_.UpdateLocation(3.0, 3.0);
+
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(rfh_a, current_frame_host());
+  EXPECT_FALSE(rfh_a->is_in_back_forward_cache());
+
+  // Wait for an update after the user navigates back to A.
+  EXPECT_EQ("resolved", EvalJs(rfh_a, R"(
+    window.wait_for_position_after_resume = new Promise(resolve => {
+      navigator.geolocation.watchPosition(
+        pos => {
+          window.longitude_log.push(pos.coords.longitude);
+          resolve("resolved");
+        },
+        err => window.err_log.push(err)
+      );
+    })
+  )"));
+
+  EXPECT_LE(0, EvalJs(rfh_a, "longitude_log.indexOf(0.0)").ExtractInt())
+      << "Geoposition before the page is put into BFCache should be visible";
+  EXPECT_EQ(-1, EvalJs(rfh_a, "longitude_log.indexOf(1.0)").ExtractInt())
+      << "Geoposition while the page is put into BFCache should be invisible";
+  EXPECT_EQ(-1, EvalJs(rfh_a, "longitude_log.indexOf(2.0)").ExtractInt())
+      << "Geoposition while the page is put into BFCache should be invisible";
+  EXPECT_LT(0, EvalJs(rfh_a, "longitude_log.indexOf(3.0)").ExtractInt())
+      << "Geoposition when the page is restored from BFCache should be visible";
+  EXPECT_EQ(0, EvalJs(rfh_a, "err_log.length"))
+      << "watchPosition API should have reported no errors";
+}
+
+// Test that documents are evicted correctly from BackForwardCache after time to
+// live.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, TimedEviction) {
+  // Inject mock time task runner to be used in the eviction timer, so we can,
+  // check for the functionality we are interested before and after the time to
+  // live. We don't replace ThreadTaskRunnerHandle::Get to ensure that it
+  // doesn't affect other unrelated callsites.
+  scoped_refptr<base::TestMockTimeTaskRunner> task_runner =
+      base::MakeRefCounted<base::TestMockTimeTaskRunner>();
+
+  web_contents()->GetController().GetBackForwardCache().SetTaskRunnerForTesting(
+      task_runner);
+
+  base::TimeDelta time_to_live_in_back_forward_cache =
+      BackForwardCacheImpl::GetTimeToLiveInBackForwardCache();
+  // This should match the value we set in GetFeatureParams.
+  EXPECT_EQ(time_to_live_in_back_forward_cache,
+            base::TimeDelta::FromSeconds(3600));
+
+  base::TimeDelta delta = base::TimeDelta::FromMilliseconds(1);
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+
+  // 3) Fast forward to just before eviction is due.
+  task_runner->FastForwardBy(time_to_live_in_back_forward_cache - delta);
+
+  // 4) Confirm A is still in BackForwardCache.
+  ASSERT_FALSE(delete_observer_rfh_a.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+
+  // 5) Fast forward to when eviction is due.
+  task_runner->FastForwardBy(delta);
+
+  // 6) Confirm A is evicted.
+  EXPECT_TRUE(rfh_a->is_evicted_from_back_forward_cache());
+  delete_observer_rfh_a.WaitUntilDeleted();
+  EXPECT_EQ(current_frame_host(), rfh_b);
+
+  // 7) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectEvicted(BackForwardCacheMetrics::EvictedReason::kTimeout, FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(
+    BackForwardCacheBrowserTest,
+    DisableBackForwardCachePreventsDocumentsFromBeingCached) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  const url::Origin origin_a = url::Origin::Create(url_a);
+  const url::Origin origin_b = url::Origin::Create(url_b);
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+  BackForwardCache::DisableForRenderFrameHost(
+      rfh_a, "DisabledByBackForwardCacheBrowserTest");
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  delete_observer_rfh_a.WaitUntilDeleted();
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectDisabledWithReason("DisabledByBackForwardCacheBrowserTest", FROM_HERE);
+  ExpectEvictedIsEmpty(FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       DisableBackForwardIsNoOpIfRfhIsGone) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  const url::Origin origin_a = url::Origin::Create(url_a);
+  const url::Origin origin_b = url::Origin::Create(url_b);
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+  GlobalFrameRoutingId rfh_a_id = rfh_a->GetGlobalFrameRoutingId();
+  BackForwardCache::DisableForRenderFrameHost(
+      rfh_a_id, "DisabledByBackForwardCacheBrowserTest");
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  delete_observer_rfh_a.WaitUntilDeleted();
+
+  // This should not die
+  BackForwardCache::DisableForRenderFrameHost(
+      rfh_a_id, "DisabledByBackForwardCacheBrowserTest");
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectDisabledWithReason("DisabledByBackForwardCacheBrowserTest", FROM_HERE);
+  ExpectEvictedIsEmpty(FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       DisableBackForwardCacheIframe) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  GURL url_c(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameHostImpl* rfh_b = rfh_a->child_at(0)->current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+  RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
+
+  BackForwardCache::DisableForRenderFrameHost(
+      rfh_b, "DisabledByBackForwardCacheBrowserTest");
+
+  // 2) Navigate to C. A and B are deleted.
+  EXPECT_TRUE(NavigateToURL(shell(), url_c));
+  delete_observer_rfh_a.WaitUntilDeleted();
+  delete_observer_rfh_b.WaitUntilDeleted();
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectEvictedIsEmpty(FROM_HERE);
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       DisableBackForwardEvictsIfAlreadyInCache) {
+  base::HistogramTester histogram_tester;
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  const url::Origin origin_a = url::Origin::Create(url_a);
+  const url::Origin origin_b = url::Origin::Create(url_b);
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_FALSE(rfh_a->is_evicted_from_back_forward_cache());
+
+  BackForwardCache::DisableForRenderFrameHost(
+      rfh_a, "DisabledByBackForwardCacheBrowserTest");
+
+  EXPECT_TRUE(rfh_a->is_evicted_from_back_forward_cache());
+  delete_observer_rfh_a.WaitUntilDeleted();
+
+  // 3) Go back to A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectDisabledWithReason("DisabledByBackForwardCacheBrowserTest", FROM_HERE);
+  ExpectEvictedIsEmpty(FROM_HERE);
+}
+
+// Confirm that same-document navigation and not history-navigation does not
+// record metrics.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, MetricsNotRecorded) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  const GURL url_b2(embedded_test_server()->GetURL("b.com", "/title1.html#2"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // 3) Navigate to B#2 (same document navigation).
+  EXPECT_TRUE(ExecJs(shell(), JsReplace("location = $1", url_b2.spec())));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // 4) Go back to B.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcomeIsEmpty(FROM_HERE);
+
+  // 5) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  ExpectOutcomeIsEmpty(FROM_HERE);
+}
+
+// Test for functionality of domain specific controls in back-forward cache.
+class BackForwardCacheBrowserTestWithDomainControlEnabled
+    : public BackForwardCacheBrowserTest {
+ protected:
+  base::FieldTrialParams GetFeatureParams() override {
+    // Sets the allowed websites for testing, additionally adding the params
+    // used by BackForwardCacheBrowserTest.
+    std::map<std::string, std::string> domain_control_params = {
+        {"allowed_websites",
+         "https://a.allowed/back_forward_cache/, "
+         "https://b.allowed/back_forward_cache/allowed_path.html"}};
+    std::map<std::string, std::string> browser_test_params =
+        BackForwardCacheBrowserTest::GetFeatureParams();
+    domain_control_params.insert(browser_test_params.begin(),
+                                 browser_test_params.end());
+    return domain_control_params;
+  }
+};
+
+// Check the RenderFrameHost allowed to enter the BackForwardCache are the ones
+// matching with the "allowed_websites" feature params.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithDomainControlEnabled,
+                       CachePagesWithMatchedURLs) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL(
+      "a.allowed", "/back_forward_cache/allowed_path.html"));
+  const GURL url_b(embedded_test_server()->GetURL(
+      "b.allowed", "/back_forward_cache/allowed_path.html?query=bar"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
+
+  // 3) Check if rfh_a is stored in back-forward cache, since it matches to
+  // the list of allowed urls, it should be stored.
+  EXPECT_FALSE(delete_observer_rfh_a.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+
+  // 4) Now go back to the last stored page, which in our case should be A.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(rfh_a, current_frame_host());
+
+  // 5) Check if rfh_b is stored in back-forward cache, since it matches to
+  // the list of allowed urls, it should be stored.
+  EXPECT_FALSE(delete_observer_rfh_b.deleted());
+  EXPECT_TRUE(rfh_b->is_in_back_forward_cache());
 }
+
+// We don't want to allow websites which doesn't match "allowed_websites" of
+// feature params to be stored in back-forward cache.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTestWithDomainControlEnabled,
+                       DoNotCachePagesWithUnMatchedURLs) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL(
+      "a.disallowed", "/back_forward_cache/disallowed_path.html"));
+  const GURL url_b(embedded_test_server()->GetURL(
+      "b.allowed", "/back_forward_cache/disallowed_path.html"));
+  const GURL url_c(embedded_test_server()->GetURL(
+      "c.disallowed", "/back_forward_cache/disallowed_path.html"));
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  RenderFrameHostImpl* rfh_b = current_frame_host();
+  RenderFrameDeletedObserver delete_observer_rfh_b(rfh_b);
+
+  // 3) Since url of A doesn't match to the the list of allowed urls it should
+  // not be stored in back-forward cache.
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  delete_observer_rfh_a.WaitUntilDeleted();
+
+  // 4) Navigate to C.
+  EXPECT_TRUE(NavigateToURL(shell(), url_c));
+
+  // 5) Since url of B doesn't match to the the list of allowed urls it should
+  // not be stored in back-forward cache.
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  delete_observer_rfh_b.WaitUntilDeleted();
+}
+
+// Check the BackForwardCache is disabled when the WebUSB feature is used.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, WebUSB) {
+  // WebUSB requires HTTPS.
+  net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
+  https_server.AddDefaultHandlers(GetTestDataFilePath());
+  https_server.SetSSLConfig(net::EmbeddedTestServer::CERT_OK);
+  ASSERT_TRUE(https_server.Start());
+
+  // Main document.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(https_server.GetURL("a.com", "/title1.html"));
+
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+
+    EXPECT_FALSE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 devices", content::EvalJs(current_frame_host(), R"(
+        new Promise(async resolve => {
+          let devices = await navigator.usb.getDevices();
+          resolve("Found " + devices.length + " devices");
+        });
+    )"));
+    EXPECT_TRUE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        current_frame_host()->GetProcess()->GetID(),
+        current_frame_host()->GetRoutingID(), "WebUSB"));
+  }
+
+  // Nested document.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(
+        https_server.GetURL("c.com", "/cross_site_iframe_factory.html?c(d)"));
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    RenderFrameHostImpl* rfh_c = current_frame_host();
+    RenderFrameHostImpl* rfh_d = rfh_c->child_at(0)->current_frame_host();
+
+    EXPECT_FALSE(rfh_c->is_back_forward_cache_disallowed());
+    EXPECT_FALSE(rfh_d->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 devices", content::EvalJs(rfh_c, R"(
+        new Promise(async resolve => {
+          let devices = await navigator.usb.getDevices();
+          resolve("Found " + devices.length + " devices");
+        });
+    )"));
+    EXPECT_TRUE(rfh_c->is_back_forward_cache_disallowed());
+    EXPECT_FALSE(rfh_d->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        rfh_c->GetProcess()->GetID(), rfh_c->GetRoutingID(), "WebUSB"));
+  }
+
+  // Worker.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(https_server.GetURL("e.com", "/title1.html"));
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    EXPECT_FALSE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 devices", content::EvalJs(current_frame_host(), R"(
+        new Promise(async resolve => {
+          const worker = new Worker("/back_forward_cache/webusb/worker.js");
+          worker.onmessage = message => resolve(message.data);
+          worker.postMessage("Run");
+        });
+    )"));
+    EXPECT_TRUE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        current_frame_host()->GetProcess()->GetID(),
+        current_frame_host()->GetRoutingID(), "WebUSB"));
+  }
+
+  // Nested worker.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(https_server.GetURL("f.com", "/title1.html"));
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    EXPECT_FALSE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 devices", content::EvalJs(current_frame_host(), R"(
+        new Promise(async resolve => {
+          const worker = new Worker(
+            "/back_forward_cache/webusb/nested-worker.js");
+          worker.onmessage = message => resolve(message.data);
+          worker.postMessage("Run");
+        });
+    )"));
+    EXPECT_TRUE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        current_frame_host()->GetProcess()->GetID(),
+        current_frame_host()->GetRoutingID(), "WebUSB"));
+  }
+}
+
+#if !defined(OS_ANDROID)
+// Check that the back-forward cache is disabled when the Serial API is used.
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Serial) {
+  // Serial API requires HTTPS.
+  net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
+  https_server.AddDefaultHandlers(GetTestDataFilePath());
+  https_server.SetSSLConfig(net::EmbeddedTestServer::CERT_OK);
+  ASSERT_TRUE(https_server.Start());
+
+  // Main document.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(https_server.GetURL("a.com", "/title1.html"));
+
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+
+    EXPECT_FALSE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 ports", content::EvalJs(current_frame_host(), R"(
+        new Promise(async resolve => {
+          let ports = await navigator.serial.getPorts();
+          resolve("Found " + ports.length + " ports");
+        });
+    )"));
+    EXPECT_TRUE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        current_frame_host()->GetProcess()->GetID(),
+        current_frame_host()->GetRoutingID(), "Serial"));
+  }
+
+  // Nested document.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(
+        https_server.GetURL("c.com", "/cross_site_iframe_factory.html?c(d)"));
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    RenderFrameHostImpl* rfh_c = current_frame_host();
+    RenderFrameHostImpl* rfh_d = rfh_c->child_at(0)->current_frame_host();
+
+    EXPECT_FALSE(rfh_c->is_back_forward_cache_disallowed());
+    EXPECT_FALSE(rfh_d->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 ports", content::EvalJs(rfh_c, R"(
+        new Promise(async resolve => {
+          let ports = await navigator.serial.getPorts();
+          resolve("Found " + ports.length + " ports");
+        });
+    )"));
+    EXPECT_TRUE(rfh_c->is_back_forward_cache_disallowed());
+    EXPECT_FALSE(rfh_d->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        rfh_c->GetProcess()->GetID(), rfh_c->GetRoutingID(), "Serial"));
+  }
+
+  // Worker.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(https_server.GetURL("e.com", "/title1.html"));
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    EXPECT_FALSE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 ports", content::EvalJs(current_frame_host(), R"(
+        new Promise(async resolve => {
+          const worker = new Worker("/back_forward_cache/serial/worker.js");
+          worker.onmessage = message => resolve(message.data);
+          worker.postMessage("Run");
+        });
+    )"));
+    EXPECT_TRUE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        current_frame_host()->GetProcess()->GetID(),
+        current_frame_host()->GetRoutingID(), "Serial"));
+  }
+
+  // Nested worker.
+  {
+    content::BackForwardCacheDisabledTester tester;
+    GURL url(https_server.GetURL("f.com", "/title1.html"));
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    EXPECT_FALSE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_EQ("Found 0 ports", content::EvalJs(current_frame_host(), R"(
+        new Promise(async resolve => {
+          const worker = new Worker(
+            "/back_forward_cache/serial/nested-worker.js");
+          worker.onmessage = message => resolve(message.data);
+          worker.postMessage("Run");
+        });
+    )"));
+    EXPECT_TRUE(current_frame_host()->is_back_forward_cache_disallowed());
+    EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+        current_frame_host()->GetProcess()->GetID(),
+        current_frame_host()->GetRoutingID(), "Serial"));
+  }
+}
+#endif
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, Encoding) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url_a(embedded_test_server()->GetURL(
+      "a.com", "/back_forward_cache/charset_windows-1250.html"));
+  const GURL url_b(embedded_test_server()->GetURL(
+      "b.com", "/back_forward_cache/charset_utf-8.html"));
+  const url::Origin origin_a = url::Origin::Create(url_a);
+  const url::Origin origin_b = url::Origin::Create(url_b);
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  RenderFrameHostImpl* rfh_a = current_frame_host();
+  EXPECT_EQ(web_contents()->GetEncoding(), "windows-1250");
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+  EXPECT_EQ(web_contents()->GetEncoding(), "UTF-8");
+
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(web_contents()->GetEncoding(), "windows-1250");
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest, RestoreWhilePendingCommit) {
+  net::test_server::ControllableHttpResponse response(embedded_test_server(),
+                                                      "/main_document");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const GURL url1(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  const GURL url2(embedded_test_server()->GetURL("b.com", "/title2.html"));
+  const GURL url3(embedded_test_server()->GetURL("c.com", "/main_document"));
+
+  // Load a page and navigate away from it, so it is stored in the back-forward
+  // cache.
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+  RenderFrameHost* rfh1 = current_frame_host();
+  EXPECT_TRUE(NavigateToURL(shell(), url2));
+
+  // Try to navigate to a new page, but leave it in a pending state.
+  shell()->LoadURL(url3);
+  response.WaitForRequest();
+
+  // Navigate back and restore page from the cache, cancelling the previous
+  // navigation.
+  web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(rfh1, current_frame_host());
+}
+
+IN_PROC_BROWSER_TEST_F(BackForwardCacheBrowserTest,
+                       DoesNotCacheCrossSiteHttpPost) {
+  SetupCrossSiteRedirector(embedded_test_server());
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // Note we do a cross-site post because same-site navigations of any kind
+  // aren't cached currently.
+  GURL form_url(embedded_test_server()->GetURL(
+      "a.com", "/form_that_posts_cross_site.html"));
+  GURL redirect_target_url(embedded_test_server()->GetURL("x.com", "/echoall"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+
+  // Navigate to the page with form that posts via 307 redirection to
+  // |redirect_target_url| (cross-site from |form_url|).
+  EXPECT_TRUE(NavigateToURL(shell(), form_url));
+
+  // Submit the form.
+  TestNavigationObserver form_post_observer(shell()->web_contents(), 1);
+  EXPECT_TRUE(ExecJs(shell(), "document.getElementById('text-form').submit()"));
+  form_post_observer.Wait();
+
+  // Verify that we arrived at the expected, redirected location.
+  EXPECT_EQ(redirect_target_url,
+            shell()->web_contents()->GetLastCommittedURL());
+  RenderFrameDeletedObserver delete_observer_rfh(current_frame_host());
+
+  // Navigate away. |redirect_target_url|'s page should not be cached.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  delete_observer_rfh.WaitUntilDeleted();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/background_fetch/background_fetch_data_manager_unittest.cc b/chromium/content/browser/background_fetch/background_fetch_data_manager_unittest.cc
index b02e676f7f3..d6b8e589061 100644
--- a/chromium/content/browser/background_fetch/background_fetch_data_manager_unittest.cc
+++ b/chromium/content/browser/background_fetch/background_fetch_data_manager_unittest.cc
@@ -37,6 +37,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/test/test_utils.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe_drainer.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "storage/browser/blob/blob_data_builder.h"
@@ -337,8 +338,8 @@ class BackgroundFetchDataManagerTest
     run_loop.Run();
 
     if (blob && blob->blob) {
-      blink::mojom::BlobPtr blob_ptr(std::move(blob->blob));
-      return CopyBody(blob_ptr.get());
+      mojo::Remote<blink::mojom::Blob> blob_remote(std::move(blob->blob));
+      return CopyBody(blob_remote.get());
     }
 
     return std::string();
@@ -478,7 +479,7 @@ class BackgroundFetchDataManagerTest
     match_options->ignore_search = true;
     cache_storage.value()->MatchCache(
         kExampleUniqueId, BackgroundFetchSettledFetch::CloneRequest(request),
-        std::move(match_options),
+        std::move(match_options), CacheStorageSchedulerPriority::kNormal,
         /* trace_id= */ 0,
         base::BindOnce(&BackgroundFetchDataManagerTest::DidMatchCache,
                        base::Unretained(this), run_loop.QuitClosure(),
@@ -872,7 +873,7 @@ class BackgroundFetchDataManagerTest
     blob->size = blob_handle->size();
     storage::BlobImpl::Create(
         std::make_unique<storage::BlobDataHandle>(*blob_handle),
-        MakeRequest(&blob->blob));
+        blob->blob.InitWithNewPipeAndPassReceiver());
     return blob;
   }
 
@@ -1880,7 +1881,7 @@ TEST_F(BackgroundFetchDataManagerTest, MatchRequestsWithBody) {
   EXPECT_EQ(request->blob->size, upload_data.size());
 
   ASSERT_TRUE(request->blob->blob);
-  blink::mojom::BlobPtr blob(std::move(request->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(std::move(request->blob->blob));
   EXPECT_EQ(CopyBody(blob.get()), upload_data);
 }
 
diff --git a/chromium/content/browser/background_fetch/storage/cache_entry_handler_impl.cc b/chromium/content/browser/background_fetch/storage/cache_entry_handler_impl.cc
index c0ae740e7df..d9c3b5d465d 100644
--- a/chromium/content/browser/background_fetch/storage/cache_entry_handler_impl.cc
+++ b/chromium/content/browser/background_fetch/storage/cache_entry_handler_impl.cc
@@ -5,6 +5,7 @@
 #include "content/browser/background_fetch/storage/cache_entry_handler_impl.h"
 
 #include "base/guid.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
 
 namespace content {
@@ -20,17 +21,17 @@ std::unique_ptr<PutContext> CacheEntryHandlerImpl::CreatePutContext(
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::FetchAPIResponsePtr response,
     int64_t trace_id) {
-  blink::mojom::BlobPtr response_blob;
+  mojo::PendingRemote<blink::mojom::Blob> response_blob;
   uint64_t response_blob_size = blink::BlobUtils::kUnknownSize;
-  blink::mojom::BlobPtr request_blob;
+  mojo::PendingRemote<blink::mojom::Blob> request_blob;
   uint64_t request_blob_size = blink::BlobUtils::kUnknownSize;
 
   if (response->blob) {
-    response_blob.Bind(std::move(response->blob->blob));
+    response_blob = std::move(response->blob->blob);
     response_blob_size = response->blob->size;
   }
   if (request->blob) {
-    request_blob.Bind(std::move(request->blob->blob));
+    request_blob = std::move(request->blob->blob);
     request_blob_size = request->blob->size;
   }
 
diff --git a/chromium/content/browser/background_fetch/storage/mark_request_complete_task.cc b/chromium/content/browser/background_fetch/storage/mark_request_complete_task.cc
index 147722b4e80..87cf3c73e3e 100644
--- a/chromium/content/browser/background_fetch/storage/mark_request_complete_task.cc
+++ b/chromium/content/browser/background_fetch/storage/mark_request_complete_task.cc
@@ -45,7 +45,7 @@ blink::mojom::SerializedBlobPtr MakeBlob(
   blob->size = response_blob_handle->size();
 
   storage::BlobImpl::Create(std::move(response_blob_handle),
-                            MakeRequest(&blob->blob));
+                            blob->blob.InitWithNewPipeAndPassReceiver());
   return blob;
 }
 
diff --git a/chromium/content/browser/background_sync/background_sync_base_browsertest.cc b/chromium/content/browser/background_sync/background_sync_base_browsertest.cc
index ddb2f04a2a6..55d68da7b4e 100644
--- a/chromium/content/browser/background_sync/background_sync_base_browsertest.cc
+++ b/chromium/content/browser/background_sync/background_sync_base_browsertest.cc
@@ -215,7 +215,7 @@ void BackgroundSyncBaseBrowserTest::SetTestClock(base::SimpleTestClock* clock) {
     SetTestClockOnCoreThread(sync_context, clock);
   } else {
     base::RunLoop run_loop;
-    base::PostTaskWithTraitsAndReply(
+    base::PostTaskAndReply(
         FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
         base::BindOnce(&BackgroundSyncBaseBrowserTest::SetTestClockOnCoreThread,
                        base::Unretained(this), base::Unretained(sync_context),
diff --git a/chromium/content/browser/background_sync/background_sync_manager.cc b/chromium/content/browser/background_sync/background_sync_manager.cc
index a93f4dddc0e..49942e3c559 100644
--- a/chromium/content/browser/background_sync/background_sync_manager.cc
+++ b/chromium/content/browser/background_sync/background_sync_manager.cc
@@ -407,6 +407,7 @@ void BackgroundSyncManager::Register(
     op_scheduler_.ScheduleOperation(
         id, CacheStorageSchedulerMode::kExclusive,
         CacheStorageSchedulerOp::kBackgroundSync,
+        CacheStorageSchedulerPriority::kNormal,
         base::BindOnce(
             &BackgroundSyncManager::RegisterCheckIfHasMainFrame,
             weak_ptr_factory_.GetWeakPtr(), sw_registration_id,
@@ -420,6 +421,7 @@ void BackgroundSyncManager::Register(
     op_scheduler_.ScheduleOperation(
         id, CacheStorageSchedulerMode::kExclusive,
         CacheStorageSchedulerOp::kBackgroundSync,
+        CacheStorageSchedulerPriority::kNormal,
         base::BindOnce(
             &BackgroundSyncManager::RegisterImpl,
             weak_ptr_factory_.GetWeakPtr(), sw_registration_id,
@@ -445,6 +447,7 @@ void BackgroundSyncManager::UnregisterPeriodicSync(
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &BackgroundSyncManager::UnregisterPeriodicSyncImpl,
           weak_ptr_factory_.GetWeakPtr(), sw_registration_id, tag,
@@ -461,6 +464,7 @@ void BackgroundSyncManager::DidResolveRegistration(
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&BackgroundSyncManager::DidResolveRegistrationImpl,
                      weak_ptr_factory_.GetWeakPtr(),
                      std::move(registration_info), id));
@@ -499,6 +503,7 @@ void BackgroundSyncManager::GetRegistrations(
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &BackgroundSyncManager::GetRegistrationsImpl,
           weak_ptr_factory_.GetWeakPtr(), sync_type, sw_registration_id,
@@ -516,6 +521,7 @@ void BackgroundSyncManager::OnRegistrationDeleted(int64_t sw_registration_id,
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&BackgroundSyncManager::OnRegistrationDeletedImpl,
                      weak_ptr_factory_.GetWeakPtr(), sw_registration_id,
                      MakeEmptyCompletion(id)));
@@ -531,6 +537,7 @@ void BackgroundSyncManager::OnStorageWiped() {
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&BackgroundSyncManager::OnStorageWipedImpl,
                      weak_ptr_factory_.GetWeakPtr(), MakeEmptyCompletion(id)));
 }
@@ -588,7 +595,7 @@ BackgroundSyncManager::BackgroundSyncManager(
     : op_scheduler_(CacheStorageSchedulerClient::kBackgroundSync,
                     base::ThreadTaskRunnerHandle::Get()),
       service_worker_context_(std::move(service_worker_context)),
-      proxy_(service_worker_context_),
+      proxy_(std::make_unique<BackgroundSyncProxy>(service_worker_context_)),
       devtools_context_(std::move(devtools_context)),
       parameters_(std::make_unique<BackgroundSyncParameters>()),
       disabled_(false),
@@ -621,6 +628,7 @@ void BackgroundSyncManager::Init() {
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&BackgroundSyncManager::InitImpl,
                      weak_ptr_factory_.GetWeakPtr(), MakeEmptyCompletion(id)));
 }
@@ -738,7 +746,7 @@ void BackgroundSyncManager::InitDidGetDataFromBackend(
                   base::DoNothing::Once());
   FireReadyEvents(BackgroundSyncType::PERIODIC, /* reschedule= */ true,
                   base::DoNothing::Once());
-  proxy_.SendSuspendedPeriodicSyncOrigins(
+  proxy_->SendSuspendedPeriodicSyncOrigins(
       std::move(suspended_periodic_sync_origins));
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, std::move(callback));
 }
@@ -1407,36 +1415,6 @@ void BackgroundSyncManager::DispatchPeriodicSyncEvent(
   }
 }
 
-base::CancelableOnceClosure& BackgroundSyncManager::get_delayed_task(
-    BackgroundSyncType sync_type) {
-  if (sync_type == BackgroundSyncType::ONE_SHOT)
-    return delayed_one_shot_sync_task_;
-  return delayed_periodic_sync_task_;
-}
-
-void BackgroundSyncManager::ScheduleDelayedTask(BackgroundSyncType sync_type,
-                                                base::TimeDelta delay) {
-  base::OnceClosure callback = get_delayed_task(sync_type).callback();
-
-  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
-      FROM_HERE, std::move(callback), delay);
-}
-
-void BackgroundSyncManager::ResetAndScheduleDelayedSyncTask(
-    BackgroundSyncType sync_type,
-    base::TimeDelta soonest_wakeup_delta) {
-  if (soonest_wakeup_delta.is_max() || soonest_wakeup_delta.is_zero())
-    return;
-
-  auto fire_events_callback = base::BindOnce(
-      &BackgroundSyncManager::FireReadyEvents, weak_ptr_factory_.GetWeakPtr(),
-      sync_type, /* reschedule= */ true, base::DoNothing::Once(),
-      /* keepalive= */ nullptr);
-
-  get_delayed_task(sync_type).Reset(std::move(fire_events_callback));
-  ScheduleDelayedTask(sync_type, soonest_wakeup_delta);
-}
-
 void BackgroundSyncManager::HasMainFrameProviderHost(const url::Origin& origin,
                                                      BoolCallback callback) {
   service_worker_context_->HasMainFrameProviderHost(origin.GetURL(),
@@ -1720,6 +1698,7 @@ void BackgroundSyncManager::RevivePeriodicSyncRegistrations(
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&BackgroundSyncManager::ReviveOriginImpl,
                      weak_ptr_factory_.GetWeakPtr(), std::move(origin),
                      MakeEmptyCompletion(id)));
@@ -1860,11 +1839,16 @@ void BackgroundSyncManager::ScheduleDelayedProcessingOfRegistrations(
     blink::mojom::BackgroundSyncType sync_type) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
-  ResetAndScheduleDelayedSyncTask(
+  auto fire_events_callback = base::BindOnce(
+      &BackgroundSyncManager::FireReadyEvents, weak_ptr_factory_.GetWeakPtr(),
+      sync_type, /* reschedule= */ true, base::DoNothing::Once(),
+      /* keepalive= */ nullptr);
+
+  proxy_->ScheduleDelayedProcessing(
       sync_type,
       GetSoonestWakeupDelta(sync_type,
-                            /* last_browser_wakeup_time= */ base::Time()));
-  proxy_.ScheduleBrowserWakeUp(sync_type);
+                            /* last_browser_wakeup_time= */ base::Time()),
+      std::move(fire_events_callback));
 }
 
 void BackgroundSyncManager::FireReadyEvents(
@@ -1884,23 +1868,24 @@ void BackgroundSyncManager::FireReadyEvents(
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
-      base::BindOnce(
-          &BackgroundSyncManager::FireReadyEventsImpl,
-          weak_ptr_factory_.GetWeakPtr(), sync_type, reschedule,
-          op_scheduler_.WrapCallbackToRunNext(id, std::move(callback)),
-          std::move(keepalive)));
+      CacheStorageSchedulerPriority::kNormal,
+      base::BindOnce(&BackgroundSyncManager::FireReadyEventsImpl,
+                     weak_ptr_factory_.GetWeakPtr(), sync_type, reschedule, id,
+                     std::move(callback), std::move(keepalive)));
 }
 
 void BackgroundSyncManager::FireReadyEventsImpl(
     blink::mojom::BackgroundSyncType sync_type,
     bool reschedule,
+    int scheduler_id,
     base::OnceClosure callback,
     std::unique_ptr<BackgroundSyncEventKeepAlive> keepalive) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
   if (disabled_) {
-    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                  std::move(callback));
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        op_scheduler_.WrapCallbackToRunNext(scheduler_id, std::move(callback)));
     return;
   }
 
@@ -1942,27 +1927,46 @@ void BackgroundSyncManager::FireReadyEventsImpl(
     // called from a wakeup task.
     if (reschedule)
       ScheduleOrCancelDelayedProcessing(sync_type);
-    base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE,
-                                                  std::move(callback));
+    base::ThreadTaskRunnerHandle::Get()->PostTask(
+        FROM_HERE,
+        op_scheduler_.WrapCallbackToRunNext(scheduler_id, std::move(callback)));
     return;
   }
 
   base::TimeTicks start_time = base::TimeTicks::Now();
 
-  // Fire the sync event of the ready registrations and run |callback| once
-  // they're all done.
+  // If we've been called from a wake up task, potentially keep the browser
+  // awake till all events have completed. If not, we only do so until all
+  // events have been fired.
+  // To allow the |op_scheduler_| to process other tasks after sync events
+  // have been fired, mark this task complete after firing events.
+  base::OnceClosure events_fired_callback, events_completed_callback;
+  bool keep_browser_awake_till_events_complete =
+      !reschedule && parameters_->keep_browser_awake_till_events_complete;
+  if (keep_browser_awake_till_events_complete) {
+    events_fired_callback = MakeEmptyCompletion(scheduler_id);
+    events_completed_callback = std::move(callback);
+  } else {
+    events_fired_callback =
+        op_scheduler_.WrapCallbackToRunNext(scheduler_id, std::move(callback));
+    events_completed_callback = base::DoNothing::Once();
+  }
+
+  // Fire the sync event of the ready registrations and run
+  // |events_fired_closure| once they're all done.
   base::RepeatingClosure events_fired_barrier_closure = base::BarrierClosure(
       to_fire.size(),
       base::BindOnce(&BackgroundSyncManager::FireReadyEventsAllEventsFiring,
                      weak_ptr_factory_.GetWeakPtr(), sync_type, reschedule,
-                     std::move(callback)));
+                     std::move(events_fired_callback)));
 
   // Record the total time taken after all events have run to completion.
   base::RepeatingClosure events_completed_barrier_closure =
       base::BarrierClosure(
           to_fire.size(),
-          base::BindOnce(&OnAllSyncEventsCompleted, sync_type, start_time,
-                         !reschedule, to_fire.size()));
+          base::BindOnce(&BackgroundSyncManager::OnAllSyncEventsCompleted,
+                         sync_type, start_time, !reschedule, to_fire.size(),
+                         std::move(events_completed_callback)));
 
   for (auto& registration_info : to_fire) {
     const BackgroundSyncRegistration* registration =
@@ -2061,6 +2065,7 @@ void BackgroundSyncManager::FireReadyEventsAllEventsFiring(
 
   if (reschedule)
     ScheduleOrCancelDelayedProcessing(sync_type);
+
   base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, std::move(callback));
 }
 
@@ -2094,6 +2099,7 @@ void BackgroundSyncManager::EventComplete(
   op_scheduler_.ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kBackgroundSync,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &BackgroundSyncManager::EventCompleteImpl,
           weak_ptr_factory_.GetWeakPtr(), std::move(registration_info),
@@ -2302,11 +2308,13 @@ void BackgroundSyncManager::OnAllSyncEventsCompleted(
     BackgroundSyncType sync_type,
     const base::TimeTicks& start_time,
     bool from_wakeup_task,
-    int number_of_batched_sync_events) {
+    int number_of_batched_sync_events,
+    base::OnceClosure callback) {
   // Record the combined time taken by all sync events.
   BackgroundSyncMetrics::RecordBatchSyncEventComplete(
       sync_type, base::TimeTicks::Now() - start_time, from_wakeup_task,
       number_of_batched_sync_events);
+  base::ThreadTaskRunnerHandle::Get()->PostTask(FROM_HERE, std::move(callback));
 }
 
 void BackgroundSyncManager::OnRegistrationDeletedImpl(
@@ -2331,6 +2339,14 @@ void BackgroundSyncManager::OnStorageWipedImpl(base::OnceClosure callback) {
 void BackgroundSyncManager::OnNetworkChanged() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
+#if defined(OS_ANDROID)
+  if (parameters_->rely_on_android_network_detection)
+    return;
+#endif
+
+  if (!AreOptionConditionsMet())
+    return;
+
   FireReadyEvents(BackgroundSyncType::ONE_SHOT, /* reschedule= */ true,
                   base::DoNothing::Once());
   FireReadyEvents(BackgroundSyncType::PERIODIC, /* reschedule= */ true,
diff --git a/chromium/content/browser/background_sync/background_sync_manager.h b/chromium/content/browser/background_sync/background_sync_manager.h
index c7f6b032767..a37efa84abb 100644
--- a/chromium/content/browser/background_sync/background_sync_manager.h
+++ b/chromium/content/browser/background_sync/background_sync_manager.h
@@ -125,6 +125,11 @@ class CONTENT_EXPORT BackgroundSyncManager
     clock_ = clock;
   }
 
+  void set_proxy_for_testing(std::unique_ptr<BackgroundSyncProxy> proxy) {
+    DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+    proxy_ = std::move(proxy);
+  }
+
   // Called from DevTools
   void EmulateDispatchSyncEvent(
       const std::string& tag,
@@ -142,7 +147,7 @@ class CONTENT_EXPORT BackgroundSyncManager
   // Scans the list of available events and fires those of type |sync_type| that
   // are ready to fire. For those that can't yet be fired, wakeup alarms are
   // set. Once all of this is done, invokes |callback|.
-  void FireReadyEvents(
+  virtual void FireReadyEvents(
       blink::mojom::BackgroundSyncType sync_type,
       bool reschedule,
       base::OnceClosure callback,
@@ -208,8 +213,6 @@ class CONTENT_EXPORT BackgroundSyncManager
       const std::string& tag,
       scoped_refptr<ServiceWorkerVersion> active_version,
       ServiceWorkerVersion::StatusCallback callback);
-  virtual void ScheduleDelayedTask(blink::mojom::BackgroundSyncType sync_type,
-                                   base::TimeDelta delay);
   virtual void HasMainFrameProviderHost(const url::Origin& origin,
                                         BoolCallback callback);
 
@@ -336,16 +339,18 @@ class CONTENT_EXPORT BackgroundSyncManager
   void ScheduleDelayedProcessingOfRegistrations(
       blink::mojom::BackgroundSyncType sync_type);
 
-  base::CancelableOnceClosure& get_delayed_task(
-      blink::mojom::BackgroundSyncType sync_type);
-
-  void ResetAndScheduleDelayedSyncTask(
-      blink::mojom::BackgroundSyncType sync_type,
-      base::TimeDelta soonest_wakeup_delta);
-
+  // Fires ready events for |sync_type|.
+  // |reschedule| is true when it's ok to schedule background processing from
+  // this method, false otherwise.
+  // |scheduler_id| is an id unique to the |op_scheduler_| task. It's passed to
+  // correctly mark this operation as finished with the |op_scheduler_| and run
+  // the next operation scheduled.
+  // |keepalive| is used to keep the browser alive until the first attempt to
+  // fire a sync event has been made.
   void FireReadyEventsImpl(
       blink::mojom::BackgroundSyncType sync_type,
       bool reschedule,
+      int scheduler_id,
       base::OnceClosure callback,
       std::unique_ptr<BackgroundSyncEventKeepAlive> keepalive);
 
@@ -390,7 +395,8 @@ class CONTENT_EXPORT BackgroundSyncManager
       blink::mojom::BackgroundSyncType sync_type,
       const base::TimeTicks& start_time,
       bool from_wakeup_task,
-      int number_of_batched_sync_events);
+      int number_of_batched_sync_events,
+      base::OnceClosure callback);
 
   // OnRegistrationDeleted callbacks
   void OnRegistrationDeletedImpl(int64_t sw_registration_id,
@@ -458,7 +464,7 @@ class CONTENT_EXPORT BackgroundSyncManager
 
   CacheStorageScheduler op_scheduler_;
   scoped_refptr<ServiceWorkerContextWrapper> service_worker_context_;
-  BackgroundSyncProxy proxy_;
+  std::unique_ptr<BackgroundSyncProxy> proxy_;
 
   scoped_refptr<DevToolsBackgroundServicesContextImpl> devtools_context_;
   std::unique_ptr<BackgroundSyncParameters> parameters_;
@@ -470,9 +476,6 @@ class CONTENT_EXPORT BackgroundSyncManager
   int num_firing_registrations_one_shot_;
   int num_firing_registrations_periodic_;
 
-  base::CancelableOnceClosure delayed_one_shot_sync_task_;
-  base::CancelableOnceClosure delayed_periodic_sync_task_;
-
   bool delayed_processing_scheduled_one_shot_sync_ = false;
   bool delayed_processing_scheduled_periodic_sync_ = false;
 
diff --git a/chromium/content/browser/background_sync/background_sync_manager_unittest.cc b/chromium/content/browser/background_sync/background_sync_manager_unittest.cc
index a77ec770759..5f69942eb7d 100644
--- a/chromium/content/browser/background_sync/background_sync_manager_unittest.cc
+++ b/chromium/content/browser/background_sync/background_sync_manager_unittest.cc
@@ -44,6 +44,7 @@
 #include "content/test/mock_background_sync_controller.h"
 #include "content/test/test_background_sync_context.h"
 #include "content/test/test_background_sync_manager.h"
+#include "content/test/test_background_sync_proxy.h"
 #include "services/network/test/test_network_connection_tracker.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -250,6 +251,11 @@ class BackgroundSyncManagerTest
         background_sync_context_->background_sync_manager());
   }
 
+  TestBackgroundSyncProxy* test_proxy() {
+    return static_cast<TestBackgroundSyncProxy*>(
+        test_background_sync_manager()->proxy_.get());
+  }
+
   base::TimeDelta GetSoonestWakeupDelta(
       blink::mojom::BackgroundSyncType sync_type,
       base::Time last_browser_wakeup_for_periodic_sync) {
@@ -291,6 +297,8 @@ class BackgroundSyncManagerTest
         background_sync_context_.get());
 
     test_background_sync_manager()->set_clock(&test_clock_);
+    test_background_sync_manager()->set_proxy_for_testing(
+        std::make_unique<TestBackgroundSyncProxy>(helper_->context_wrapper()));
 
     // Many tests do not expect the sync event to fire immediately after
     // register (and cleanup up the sync registrations).  Tests can control when
@@ -640,6 +648,19 @@ class BackgroundSyncManagerTest
     SetupBackgroundSyncManager();
   }
 
+  void SetRelyOnAndroidNetworkDetectionAndRestartManager(
+      bool rely_on_android_network_detection) {
+#if defined(OS_ANDROID)
+    BackgroundSyncParameters* parameters =
+        GetController()->background_sync_parameters();
+    parameters->rely_on_android_network_detection =
+        rely_on_android_network_detection;
+
+    // Restart BackgroundSyncManager so that it updates its parameters.
+    SetupBackgroundSyncManager();
+#endif
+  }
+
   void SetPeriodicSyncEventsMinIntervalAndRestartManager(
       base::TimeDelta periodic_sync_events_min_interval) {
     BackgroundSyncParameters* parameters =
@@ -651,17 +672,69 @@ class BackgroundSyncManagerTest
     SetupBackgroundSyncManager();
   }
 
+  void SetKeepBrowserAwakeTillEventsCompleteAndRestartManager(
+      bool keep_browser_awake_till_events_complete) {
+    BackgroundSyncParameters* parameters =
+        GetController()->background_sync_parameters();
+    parameters->keep_browser_awake_till_events_complete =
+        keep_browser_awake_till_events_complete;
+    SetupBackgroundSyncManager();
+  }
+
   void FireReadyEvents() { test_background_sync_manager()->OnNetworkChanged(); }
 
   bool AreOptionConditionsMet() {
     return test_background_sync_manager()->AreOptionConditionsMet();
   }
 
+  bool IsDelayedTaskScheduledOneShotSync() {
+    return test_proxy()->IsDelayedTaskSet(
+        blink::mojom::BackgroundSyncType::ONE_SHOT);
+  }
+
+  bool IsDelayedTaskScheduledPeriodicSync() {
+    return test_proxy()->IsDelayedTaskSet(
+        blink::mojom::BackgroundSyncType::PERIODIC);
+  }
+
+  bool IsBrowserWakeupForOneShotSyncScheduled() {
+    return IsDelayedTaskScheduledOneShotSync();
+  }
+
+  bool IsBrowserWakeupForPeriodicSyncScheduled() {
+    return IsDelayedTaskScheduledPeriodicSync();
+  }
+
+  base::TimeDelta delayed_one_shot_sync_task_delta() {
+    return test_proxy()->GetDelay(blink::mojom::BackgroundSyncType::ONE_SHOT);
+  }
+
+  base::TimeDelta delayed_periodic_sync_task_delta() {
+    return test_proxy()->GetDelay(blink::mojom::BackgroundSyncType::PERIODIC);
+  }
+
+  bool EqualsSoonestOneShotWakeupDelta(base::TimeDelta compare_to) {
+    return delayed_one_shot_sync_task_delta() == compare_to;
+  }
+
+  bool EqualsSoonestPeriodicSyncWakeupDelta(base::TimeDelta compare_to) {
+    return delayed_periodic_sync_task_delta() == compare_to;
+  }
+
+  void RunOneShotSyncDelayedTask() {
+    test_proxy()->RunDelayedTask(blink::mojom::BackgroundSyncType::ONE_SHOT);
+  }
+
+  void RunPeriodicSyncDelayedTask() {
+    test_proxy()->RunDelayedTask(blink::mojom::BackgroundSyncType::PERIODIC);
+  }
+
   BrowserTaskEnvironment task_environment_;
   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
   StoragePartitionImpl* storage_partition_impl_;
   scoped_refptr<BackgroundSyncContextImpl> background_sync_context_;
   base::SimpleTestClock test_clock_;
+  std::unique_ptr<TestBackgroundSyncProxy> test_proxy_;
 
   int64_t sw_registration_id_1_;
   int64_t sw_registration_id_2_;
@@ -1320,6 +1393,33 @@ TEST_F(BackgroundSyncManagerTest, ReregisterMidSyncFirstAttemptFails) {
   EXPECT_FALSE(GetRegistration(sync_options_1_));
 }
 
+TEST_F(BackgroundSyncManagerTest, RunCallbackAfterEventsComplete) {
+  SetKeepBrowserAwakeTillEventsCompleteAndRestartManager(
+      /* keep_browser_awake_till_events_complete= */ true);
+  InitDelayedSyncEventTest();
+
+  // This ensures other invocations of FireReadyEvents won't complete the
+  // registration.
+  test_background_sync_manager()->SuspendFiringEvents();
+
+  EXPECT_TRUE(Register(sync_options_1_));
+
+  bool callback_called = false;
+  test_background_sync_manager()->ResumeFiringEvents();
+  test_background_sync_manager()->FireReadyEvents(
+      blink::mojom::BackgroundSyncType::ONE_SHOT,
+      /* reschedule= */ false,
+      base::BindOnce([](bool* callback_called) { *callback_called = true; },
+                     &callback_called));
+
+  base::RunLoop().RunUntilIdle();
+
+  ASSERT_FALSE(callback_called);
+  std::move(sync_fired_callback_).Run(blink::ServiceWorkerStatusCode::kOk);
+  base::RunLoop().RunUntilIdle();
+  EXPECT_TRUE(callback_called);
+}
+
 TEST_F(BackgroundSyncManagerTest, ReregisterMidSyncFirstAttemptSucceeds) {
   InitDelayedSyncEventTest();
   RegisterAndVerifySyncEventDelayed(sync_options_1_);
@@ -1624,42 +1724,38 @@ TEST_F(BackgroundSyncManagerTest, NotifyBackgroundSyncRegistered) {
             GetController()->registration_origin());
 }
 
-TEST_F(BackgroundSyncManagerTest, WakeBrowserCalledForOneShotSync) {
+// TODO(crbug.com/996166): Update and enable when browser wake up logic has been
+// updated to not schedule a wakeup with delay of 0.
+TEST_F(BackgroundSyncManagerTest, DISABLED_WakeBrowserCalledForOneShotSync) {
   SetupBackgroundSyncManager();
   InitDelayedSyncEventTest();
 
   // The BackgroundSyncManager should declare in initialization
   // that it doesn't need to be woken up since it has no registrations.
   EXPECT_EQ(0, GetController()->run_in_background_count());
-  EXPECT_FALSE(
-      test_background_sync_manager()->IsBrowserWakeupForOneShotSyncScheduled());
+  EXPECT_FALSE(IsBrowserWakeupForOneShotSyncScheduled());
 
   SetNetwork(network::mojom::ConnectionType::CONNECTION_NONE);
-  EXPECT_FALSE(
-      test_background_sync_manager()->IsBrowserWakeupForOneShotSyncScheduled());
+  EXPECT_FALSE(IsBrowserWakeupForOneShotSyncScheduled());
 
   // Register a one-shot but it can't fire due to lack of network, wake up is
   // required.
   Register(sync_options_1_);
-  EXPECT_TRUE(
-      test_background_sync_manager()->IsBrowserWakeupForOneShotSyncScheduled());
+  EXPECT_TRUE(IsBrowserWakeupForOneShotSyncScheduled());
 
   // Start the event but it will pause mid-sync due to
   // InitDelayedSyncEventTest() above.
   SetNetwork(network::mojom::ConnectionType::CONNECTION_WIFI);
-  EXPECT_TRUE(
-      test_background_sync_manager()->IsBrowserWakeupForOneShotSyncScheduled());
-  EXPECT_TRUE(test_background_sync_manager()->EqualsSoonestOneShotWakeupDelta(
-      test_background_sync_manager()
-          ->background_sync_parameters()
-          ->min_sync_recovery_time));
+  EXPECT_TRUE(IsBrowserWakeupForOneShotSyncScheduled());
+  EXPECT_TRUE(EqualsSoonestOneShotWakeupDelta(test_background_sync_manager()
+                                                  ->background_sync_parameters()
+                                                  ->min_sync_recovery_time));
 
   // Finish the sync.
   ASSERT_TRUE(sync_fired_callback_);
   std::move(sync_fired_callback_).Run(blink::ServiceWorkerStatusCode::kOk);
   base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(
-      test_background_sync_manager()->IsBrowserWakeupForOneShotSyncScheduled());
+  EXPECT_FALSE(IsBrowserWakeupForOneShotSyncScheduled());
 }
 
 TEST_F(BackgroundSyncManagerTest, WakeBrowserCalledForPeriodicSync) {
@@ -1669,8 +1765,7 @@ TEST_F(BackgroundSyncManagerTest, WakeBrowserCalledForPeriodicSync) {
   // The BackgroundSyncManager should declare in initialization
   // that it doesn't need to be woken up since it has no registrations.
   EXPECT_EQ(0, GetController()->run_in_background_periodic_sync_count());
-  EXPECT_FALSE(test_background_sync_manager()
-                   ->IsBrowserWakeupForPeriodicSyncScheduled());
+  EXPECT_FALSE(IsBrowserWakeupForPeriodicSyncScheduled());
 
   SetNetwork(network::mojom::ConnectionType::CONNECTION_NONE);
 
@@ -1679,11 +1774,8 @@ TEST_F(BackgroundSyncManagerTest, WakeBrowserCalledForPeriodicSync) {
   base::TimeDelta thirteen_hours = base::TimeDelta::FromHours(13);
   sync_options_1_.min_interval = thirteen_hours.InMilliseconds();
   Register(sync_options_1_);
-  EXPECT_TRUE(test_background_sync_manager()
-                  ->IsBrowserWakeupForPeriodicSyncScheduled());
-  EXPECT_TRUE(
-      test_background_sync_manager()->EqualsSoonestPeriodicSyncWakeupDelta(
-          thirteen_hours));
+  EXPECT_TRUE(IsBrowserWakeupForPeriodicSyncScheduled());
+  EXPECT_TRUE(EqualsSoonestPeriodicSyncWakeupDelta(thirteen_hours));
 
   // Advance clock.
   test_clock_.Advance(
@@ -1692,24 +1784,19 @@ TEST_F(BackgroundSyncManagerTest, WakeBrowserCalledForPeriodicSync) {
   // Start the event but it will pause mid-sync due to
   // InitDelayedPeriodicSyncEventTest() above.
   SetNetwork(network::mojom::ConnectionType::CONNECTION_WIFI);
-  EXPECT_TRUE(test_background_sync_manager()
-                  ->IsBrowserWakeupForPeriodicSyncScheduled());
+  EXPECT_TRUE(IsBrowserWakeupForPeriodicSyncScheduled());
   EXPECT_TRUE(
-      test_background_sync_manager()->EqualsSoonestPeriodicSyncWakeupDelta(
-          test_background_sync_manager()
-              ->background_sync_parameters()
-              ->min_sync_recovery_time));
+      EqualsSoonestPeriodicSyncWakeupDelta(test_background_sync_manager()
+                                               ->background_sync_parameters()
+                                               ->min_sync_recovery_time));
 
   // Finish the sync.
   ASSERT_TRUE(periodic_sync_fired_callback_);
   std::move(periodic_sync_fired_callback_)
       .Run(blink::ServiceWorkerStatusCode::kOk);
   base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(test_background_sync_manager()
-                  ->IsBrowserWakeupForPeriodicSyncScheduled());
-  EXPECT_TRUE(
-      test_background_sync_manager()->EqualsSoonestPeriodicSyncWakeupDelta(
-          thirteen_hours));
+  EXPECT_TRUE(IsBrowserWakeupForPeriodicSyncScheduled());
+  EXPECT_TRUE(EqualsSoonestPeriodicSyncWakeupDelta(thirteen_hours));
 }
 
 TEST_F(BackgroundSyncManagerTest, GetSoonestWakeupDeltaConsidersSyncType) {
@@ -1840,6 +1927,23 @@ TEST_F(BackgroundSyncManagerTest, StaggeredPeriodicSyncRegistrations) {
             one_hour);
 }
 
+TEST_F(BackgroundSyncManagerTest, RelyOnAndroidNetworkDetection) {
+  SetRelyOnAndroidNetworkDetectionAndRestartManager(
+      /* rely_on_android_network_detection= */ true);
+  InitSyncEventTest();
+  SetNetwork(network::mojom::ConnectionType::CONNECTION_NONE);
+  EXPECT_TRUE(Register(sync_options_1_));
+  SetNetwork(network::mojom::ConnectionType::CONNECTION_WIFI);
+  base::RunLoop().RunUntilIdle();
+#if defined(OS_ANDROID)
+  EXPECT_EQ(0, sync_events_called_);
+  EXPECT_TRUE(GetRegistration(sync_options_1_));
+#else
+  EXPECT_EQ(1, sync_events_called_);
+  EXPECT_FALSE(GetRegistration(sync_options_1_));
+#endif
+}
+
 TEST_F(BackgroundSyncManagerTest, OneAttempt) {
   SetMaxSyncAttemptsAndRestartManager(1);
   InitFailedSyncEventTest();
@@ -1871,7 +1975,7 @@ TEST_F(BackgroundSyncManagerTest, TwoFailedAttemptsForPeriodicSync) {
   // Since this one failed, a wakeup/delayed task will be scheduled for retries
   // after five minutes.
   EXPECT_EQ(base::TimeDelta::FromMinutes(5),
-            test_background_sync_manager()->delayed_periodic_sync_task_delta());
+            delayed_periodic_sync_task_delta());
   test_clock_.Advance(base::TimeDelta::FromMinutes(5));
   FireReadyEvents();
   base::RunLoop().RunUntilIdle();
@@ -1903,19 +2007,16 @@ TEST_F(BackgroundSyncManagerTest, TwoAttempts) {
   // The first run will fail but it will setup a timer to try again.
   EXPECT_TRUE(Register(sync_options_1_));
   EXPECT_TRUE(GetRegistration(sync_options_1_));
-  EXPECT_TRUE(
-      test_background_sync_manager()->IsDelayedTaskScheduledOneShotSync());
+  EXPECT_TRUE(IsDelayedTaskScheduledOneShotSync());
 
   // Make sure the delay is reasonable.
   EXPECT_LT(base::TimeDelta::FromMinutes(1),
-            test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-  EXPECT_GT(base::TimeDelta::FromHours(1),
-            test_background_sync_manager()->delayed_one_shot_sync_task_delta());
+            delayed_one_shot_sync_task_delta());
+  EXPECT_GT(base::TimeDelta::FromHours(1), delayed_one_shot_sync_task_delta());
 
   // Fire again and this time it should permanently fail.
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-  test_background_sync_manager()->RunOneShotSyncDelayedTask();
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
+  RunOneShotSyncDelayedTask();
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(GetRegistration(sync_options_1_));
 }
@@ -1927,26 +2028,21 @@ TEST_F(BackgroundSyncManagerTest, ThreeAttempts) {
   // The first run will fail but it will setup a timer to try again.
   EXPECT_TRUE(Register(sync_options_1_));
   EXPECT_TRUE(GetRegistration(sync_options_1_));
-  EXPECT_TRUE(
-      test_background_sync_manager()->IsDelayedTaskScheduledOneShotSync());
+  EXPECT_TRUE(IsDelayedTaskScheduledOneShotSync());
 
   // The second run will fail but it will setup a timer to try again.
-  base::TimeDelta first_delta =
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta();
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-  test_background_sync_manager()->RunOneShotSyncDelayedTask();
+  base::TimeDelta first_delta = delayed_one_shot_sync_task_delta();
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
+  RunOneShotSyncDelayedTask();
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(GetRegistration(sync_options_1_));
 
   // Verify that the delta grows for each attempt.
-  EXPECT_LT(first_delta,
-            test_background_sync_manager()->delayed_one_shot_sync_task_delta());
+  EXPECT_LT(first_delta, delayed_one_shot_sync_task_delta());
 
   // The third run will permanently fail.
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-  test_background_sync_manager()->RunOneShotSyncDelayedTask();
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
+  RunOneShotSyncDelayedTask();
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(GetRegistration(sync_options_1_));
 }
@@ -1958,23 +2054,21 @@ TEST_F(BackgroundSyncManagerTest, WaitsFullDelayTime) {
   // The first run will fail but it will setup a timer to try again.
   EXPECT_TRUE(Register(sync_options_1_));
   EXPECT_TRUE(GetRegistration(sync_options_1_));
-  EXPECT_TRUE(
-      test_background_sync_manager()->IsDelayedTaskScheduledOneShotSync());
+  EXPECT_TRUE(IsDelayedTaskScheduledOneShotSync());
 
   // Fire again one second before it's ready to retry. Expect it to reschedule
   // the delay timer for one more second.
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta() -
-      base::TimeDelta::FromSeconds(1));
+  test_clock_.Advance(delayed_one_shot_sync_task_delta() -
+                      base::TimeDelta::FromSeconds(1));
   FireReadyEvents();
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(GetRegistration(sync_options_1_));
   EXPECT_EQ(base::TimeDelta::FromSeconds(1),
-            test_background_sync_manager()->delayed_one_shot_sync_task_delta());
+            delayed_one_shot_sync_task_delta());
 
   // Fire one second later and it should fail permanently.
   test_clock_.Advance(base::TimeDelta::FromSeconds(1));
-  test_background_sync_manager()->RunOneShotSyncDelayedTask();
+  RunOneShotSyncDelayedTask();
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(GetRegistration(sync_options_1_));
 }
@@ -1988,8 +2082,7 @@ TEST_F(BackgroundSyncManagerTest, RetryOnBrowserRestart) {
   EXPECT_TRUE(GetRegistration(sync_options_1_));
 
   // Simulate restarting the browser after sufficient time has passed.
-  base::TimeDelta delta =
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta();
+  base::TimeDelta delta = delayed_one_shot_sync_task_delta();
   CreateBackgroundSyncManager();
   InitFailedSyncEventTest();
   test_clock_.Advance(delta);
@@ -2007,8 +2100,7 @@ TEST_F(BackgroundSyncManagerTest, RescheduleOnBrowserRestart) {
   EXPECT_TRUE(GetRegistration(sync_options_1_));
 
   // Simulate restarting the browser before the retry timer has expired.
-  base::TimeDelta delta =
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta();
+  base::TimeDelta delta = delayed_one_shot_sync_task_delta();
   CreateBackgroundSyncManager();
   InitFailedSyncEventTest();
   test_clock_.Advance(delta - base::TimeDelta::FromSeconds(1));
@@ -2016,7 +2108,7 @@ TEST_F(BackgroundSyncManagerTest, RescheduleOnBrowserRestart) {
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(GetRegistration(sync_options_1_));
   EXPECT_EQ(base::TimeDelta::FromSeconds(1),
-            test_background_sync_manager()->delayed_one_shot_sync_task_delta());
+            delayed_one_shot_sync_task_delta());
 }
 
 TEST_F(BackgroundSyncManagerTest, RetryIfClosedMidSync) {
@@ -2024,8 +2116,7 @@ TEST_F(BackgroundSyncManagerTest, RetryIfClosedMidSync) {
 
   RegisterAndVerifySyncEventDelayed(sync_options_1_);
   // The time delta is the recovery timer.
-  base::TimeDelta delta =
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta();
+  base::TimeDelta delta = delayed_one_shot_sync_task_delta();
 
   // Simulate restarting the browser after the recovery time, the event should
   // fire once and then fail permanently.
@@ -2045,25 +2136,20 @@ TEST_F(BackgroundSyncManagerTest, AllTestsEventuallyFire) {
   EXPECT_TRUE(Register(sync_options_1_));
 
   // Run it a second time.
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-  test_background_sync_manager()->RunOneShotSyncDelayedTask();
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
+  RunOneShotSyncDelayedTask();
   base::RunLoop().RunUntilIdle();
 
-  base::TimeDelta delay_delta =
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta();
+  base::TimeDelta delay_delta = delayed_one_shot_sync_task_delta();
 
   // Create a second registration, which will fail and setup a timer.
   EXPECT_TRUE(Register(sync_options_2_));
-  EXPECT_GT(delay_delta,
-            test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-
-  while (test_background_sync_manager()->IsDelayedTaskScheduledOneShotSync()) {
-    test_clock_.Advance(
-        test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-    test_background_sync_manager()->RunOneShotSyncDelayedTask();
-    EXPECT_FALSE(
-        test_background_sync_manager()->IsDelayedTaskScheduledOneShotSync());
+  EXPECT_GT(delay_delta, delayed_one_shot_sync_task_delta());
+
+  while (IsDelayedTaskScheduledOneShotSync()) {
+    test_clock_.Advance(delayed_one_shot_sync_task_delta());
+    RunOneShotSyncDelayedTask();
+    EXPECT_FALSE(IsDelayedTaskScheduledOneShotSync());
     base::RunLoop().RunUntilIdle();
   }
 
@@ -2080,9 +2166,8 @@ TEST_F(BackgroundSyncManagerTest, LastChance) {
   EXPECT_TRUE(GetRegistration(sync_options_1_));
 
   // Run it again.
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
-  test_background_sync_manager()->RunOneShotSyncDelayedTask();
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
+  RunOneShotSyncDelayedTask();
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(GetRegistration(sync_options_1_));
   EXPECT_TRUE(test_background_sync_manager()->last_chance());
@@ -2231,16 +2316,14 @@ TEST_F(BackgroundSyncManagerTest, EventsLoggedForRegistration) {
     // The first run will fail but it will setup a timer to try again.
     EXPECT_TRUE(Register(sync_options_1_));
     EXPECT_TRUE(GetRegistration(sync_options_1_));
-    EXPECT_TRUE(
-        test_background_sync_manager()->IsDelayedTaskScheduledOneShotSync());
+    EXPECT_TRUE(IsDelayedTaskScheduledOneShotSync());
   }
 
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
   {
     // Expect another "Fail" event.
+    RunOneShotSyncDelayedTask();
     EXPECT_CALL(*this, OnEventReceived(_)).Times(1);
-    test_background_sync_manager()->RunOneShotSyncDelayedTask();
     base::RunLoop().RunUntilIdle();
     EXPECT_TRUE(GetRegistration(sync_options_1_));
   }
@@ -2248,12 +2331,11 @@ TEST_F(BackgroundSyncManagerTest, EventsLoggedForRegistration) {
   // The event should succeed now.
   InitSyncEventTest();
 
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_one_shot_sync_task_delta());
+  test_clock_.Advance(delayed_one_shot_sync_task_delta());
   {
     // Expect a "Completion" event.
     EXPECT_CALL(*this, OnEventReceived(_)).Times(1);
-    test_background_sync_manager()->RunOneShotSyncDelayedTask();
+    RunOneShotSyncDelayedTask();
     base::RunLoop().RunUntilIdle();
     EXPECT_FALSE(GetRegistration(sync_options_1_));
   }
@@ -2274,17 +2356,15 @@ TEST_F(BackgroundSyncManagerTest, EventsLoggedForPeriodicSyncRegistration) {
 
     EXPECT_TRUE(Register(sync_options_1_));
     EXPECT_TRUE(GetRegistration(sync_options_1_));
-    EXPECT_TRUE(
-        test_background_sync_manager()->IsDelayedTaskScheduledPeriodicSync());
+    EXPECT_TRUE(IsDelayedTaskScheduledPeriodicSync());
   }
 
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_periodic_sync_task_delta());
+  test_clock_.Advance(delayed_periodic_sync_task_delta());
   {
     // Expect a "Fired" event. Dispatch is mocked out, so that event is not
     // registered by this test.
     EXPECT_CALL(*this, OnEventReceived(_)).Times(1);
-    test_background_sync_manager()->RunPeriodicSyncDelayedTask();
+    RunPeriodicSyncDelayedTask();
     base::RunLoop().RunUntilIdle();
     EXPECT_TRUE(GetRegistration(sync_options_1_));
   }
@@ -2292,12 +2372,11 @@ TEST_F(BackgroundSyncManagerTest, EventsLoggedForPeriodicSyncRegistration) {
   // The event should succeed now.
   InitSyncEventTest();
 
-  test_clock_.Advance(
-      test_background_sync_manager()->delayed_periodic_sync_task_delta());
+  test_clock_.Advance(delayed_periodic_sync_task_delta());
   {
     // Expect a "GotDelay" event.
     EXPECT_CALL(*this, OnEventReceived(_)).Times(1);
-    test_background_sync_manager()->RunPeriodicSyncDelayedTask();
+    RunPeriodicSyncDelayedTask();
     base::RunLoop().RunUntilIdle();
     EXPECT_TRUE(GetRegistration(sync_options_1_));
   }
@@ -2316,7 +2395,6 @@ TEST_F(BackgroundSyncManagerTest, UkmRecordedAtCompletion) {
 
     EXPECT_TRUE(Register(sync_options_1_));
 
-    test_background_sync_manager()->RunOneShotSyncDelayedTask();
     base::RunLoop().RunUntilIdle();
 
     EXPECT_FALSE(GetRegistration(sync_options_1_));
@@ -2336,7 +2414,6 @@ TEST_F(BackgroundSyncManagerTest, UkmRecordedAtCompletion) {
 
     EXPECT_TRUE(Register(sync_options_2_));
 
-    test_background_sync_manager()->RunOneShotSyncDelayedTask();
     base::RunLoop().RunUntilIdle();
 
     EXPECT_FALSE(GetRegistration(sync_options_2_));
diff --git a/chromium/content/browser/background_sync/background_sync_proxy.cc b/chromium/content/browser/background_sync/background_sync_proxy.cc
index 1f01e16ae21..67f31ad7401 100644
--- a/chromium/content/browser/background_sync/background_sync_proxy.cc
+++ b/chromium/content/browser/background_sync/background_sync_proxy.cc
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "base/task/post_task.h"
 #include "base/task/task_traits.h"
+#include "content/browser/background_sync/background_sync_scheduler.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/background_sync_context.h"
@@ -51,17 +52,35 @@ class BackgroundSyncProxy::Core {
     return storage_partition_impl->browser_context();
   }
 
-  // TODO(crbug.com/982378): Schedule a task to periodically revive suspended
-  // periodic Background Sync registrations.
-  void ScheduleBrowserWakeUp(blink::mojom::BackgroundSyncType sync_type) {
+  void ScheduleDelayedProcessing(blink::mojom::BackgroundSyncType sync_type,
+                                 base::TimeDelta delay,
+                                 base::OnceClosure delayed_task) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
     if (!browser_context())
       return;
 
+    auto* scheduler = BackgroundSyncScheduler::GetFor(browser_context());
+    DCHECK(scheduler);
+    if (delay == base::TimeDelta::Max()) {
+      scheduler->CancelDelayedProcessing(
+          service_worker_context_->storage_partition(), sync_type);
+    } else {
+      scheduler->ScheduleDelayedProcessing(
+          service_worker_context_->storage_partition(), sync_type, delay,
+          base::BindOnce(
+              [](base::OnceClosure delayed_task) {
+                RunOrPostTaskOnThread(FROM_HERE,
+                                      ServiceWorkerContext::GetCoreThreadId(),
+                                      std::move(delayed_task));
+              },
+              std::move(delayed_task)));
+    }
+
+    // TODO(crbug.com/996166): Remove this call once the logic to schedule
+    // browser wakeup has moved to BackgroundTaskScheduler.
     auto* controller = browser_context()->GetBackgroundSyncController();
     DCHECK(controller);
-
     controller->ScheduleBrowserWakeUp(sync_type);
   }
 
@@ -97,14 +116,17 @@ BackgroundSyncProxy::BackgroundSyncProxy(
 
 BackgroundSyncProxy::~BackgroundSyncProxy() = default;
 
-void BackgroundSyncProxy::ScheduleBrowserWakeUp(
-    blink::mojom::BackgroundSyncType sync_type) {
+void BackgroundSyncProxy::ScheduleDelayedProcessing(
+    blink::mojom::BackgroundSyncType sync_type,
+    base::TimeDelta delay,
+    base::OnceClosure delayed_task) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
   // Schedule Chrome wakeup.
-  RunOrPostTaskOnThread(FROM_HERE, BrowserThread::UI,
-                        base::BindOnce(&Core::ScheduleBrowserWakeUp,
-                                       ui_core_weak_ptr_, sync_type));
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&Core::ScheduleDelayedProcessing, ui_core_weak_ptr_,
+                     sync_type, delay, std::move(delayed_task)));
 }
 
 void BackgroundSyncProxy::SendSuspendedPeriodicSyncOrigins(
diff --git a/chromium/content/browser/background_sync/background_sync_proxy.h b/chromium/content/browser/background_sync/background_sync_proxy.h
index ff73ce2f640..8f988706166 100644
--- a/chromium/content/browser/background_sync/background_sync_proxy.h
+++ b/chromium/content/browser/background_sync/background_sync_proxy.h
@@ -31,9 +31,12 @@ class CONTENT_EXPORT BackgroundSyncProxy {
  public:
   explicit BackgroundSyncProxy(
       scoped_refptr<ServiceWorkerContextWrapper> service_worker_context);
-  ~BackgroundSyncProxy();
+  virtual ~BackgroundSyncProxy();
 
-  void ScheduleBrowserWakeUp(blink::mojom::BackgroundSyncType sync_type);
+  virtual void ScheduleDelayedProcessing(
+      blink::mojom::BackgroundSyncType sync_type,
+      base::TimeDelta delay,
+      base::OnceClosure delayed_task);
   void SendSuspendedPeriodicSyncOrigins(
       std::set<url::Origin> suspended_origins);
 
diff --git a/chromium/content/browser/background_sync/background_sync_scheduler.cc b/chromium/content/browser/background_sync/background_sync_scheduler.cc
new file mode 100644
index 00000000000..9615aecd035
--- /dev/null
+++ b/chromium/content/browser/background_sync/background_sync_scheduler.cc
@@ -0,0 +1,97 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/background_sync/background_sync_scheduler.h"
+
+#include "base/memory/scoped_refptr.h"
+#include "base/supports_user_data.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/browser/storage_partition.h"
+
+namespace {
+
+const char kBackgroundSyncSchedulerKey[] = "background-sync-scheduler";
+
+}  // namespace
+
+namespace content {
+
+using DelayedProcessingInfo =
+    std::map<StoragePartition*, std::unique_ptr<base::OneShotTimer>>;
+
+// static
+BackgroundSyncScheduler* BackgroundSyncScheduler::GetFor(
+    BrowserContext* browser_context) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(browser_context);
+
+  if (!browser_context->GetUserData(kBackgroundSyncSchedulerKey)) {
+    scoped_refptr<BackgroundSyncScheduler> scheduler =
+        base::MakeRefCounted<BackgroundSyncScheduler>();
+    browser_context->SetUserData(
+        kBackgroundSyncSchedulerKey,
+        std::make_unique<base::UserDataAdapter<BackgroundSyncScheduler>>(
+            scheduler.get()));
+  }
+
+  return base::UserDataAdapter<BackgroundSyncScheduler>::Get(
+      browser_context, kBackgroundSyncSchedulerKey);
+}
+
+BackgroundSyncScheduler::BackgroundSyncScheduler() = default;
+
+BackgroundSyncScheduler::~BackgroundSyncScheduler() {
+  for (auto& one_shot_processing_info : delayed_processing_info_one_shot_)
+    one_shot_processing_info.second->Stop();
+
+  for (auto& periodic_processing_info : delayed_processing_info_one_shot_)
+    periodic_processing_info.second->Stop();
+}
+
+void BackgroundSyncScheduler::ScheduleDelayedProcessing(
+    StoragePartition* storage_partition,
+    blink::mojom::BackgroundSyncType sync_type,
+    base::TimeDelta delay,
+    base::OnceClosure delayed_task) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  DCHECK(storage_partition);
+
+  auto& delayed_processing_info = GetDelayedProcessingInfo(sync_type);
+  delayed_processing_info.emplace(storage_partition,
+                                  std::make_unique<base::OneShotTimer>());
+
+  if (!delay.is_zero() && !delay.is_max()) {
+    delayed_processing_info[storage_partition]->Start(FROM_HERE, delay,
+                                                      std::move(delayed_task));
+  }
+
+  // TODO(crbug.com/996166) Move logic to schedule a browser wakeup task on
+  // Android from BackgroundSycnProxy to here.
+}
+
+void BackgroundSyncScheduler::CancelDelayedProcessing(
+    StoragePartition* storage_partition,
+    blink::mojom::BackgroundSyncType sync_type) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  DCHECK(storage_partition);
+
+  auto& delayed_processing_info = GetDelayedProcessingInfo(sync_type);
+  delayed_processing_info.erase(storage_partition);
+
+  // TODO(crbug.com/996166) Move logic to cancel a browser wakeup task on
+  // Android from BackgroundSycnProxy to here.
+}
+
+DelayedProcessingInfo& BackgroundSyncScheduler::GetDelayedProcessingInfo(
+    blink::mojom::BackgroundSyncType sync_type) {
+  if (sync_type == blink::mojom::BackgroundSyncType::ONE_SHOT)
+    return delayed_processing_info_one_shot_;
+  else
+    return delayed_processing_info_periodic_;
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/background_sync/background_sync_scheduler.h b/chromium/content/browser/background_sync/background_sync_scheduler.h
new file mode 100644
index 00000000000..f9718951222
--- /dev/null
+++ b/chromium/content/browser/background_sync/background_sync_scheduler.h
@@ -0,0 +1,69 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_BACKGROUND_SYNC_BACKGROUND_SYNC_SCHEDULER_H_
+#define CONTENT_BROWSER_BACKGROUND_SYNC_BACKGROUND_SYNC_SCHEDULER_H_
+
+#include <map>
+
+#include "base/macros.h"
+#include "base/memory/ref_counted.h"
+#include "base/time/time.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
+#include "third_party/blink/public/mojom/background_sync/background_sync.mojom.h"
+
+namespace content {
+
+class StoragePartition;
+
+// This contains the logic to schedule delayed processing of (periodic)
+// Background Sync registrations.
+// It keeps track of all storage partitions, and the soonest time we should
+// attempt to fire (periodic)sync events for it.
+class CONTENT_EXPORT BackgroundSyncScheduler
+    : public base::RefCountedThreadSafe<BackgroundSyncScheduler,
+                                        BrowserThread::DeleteOnUIThread> {
+ public:
+  static BackgroundSyncScheduler* GetFor(BrowserContext* browser_context);
+
+  BackgroundSyncScheduler();
+
+  // Schedules delayed_processing for |sync_type| for |storage_partition|.
+  // On non-Android platforms, runs |delayed_task| after |delay| has passed.
+  // TODO(crbug.com/996166): Add logic to schedule browser wakeup on Android.
+  // Must be called on the UI thread.
+  virtual void ScheduleDelayedProcessing(
+      StoragePartition* storage_partition,
+      blink::mojom::BackgroundSyncType sync_type,
+      base::TimeDelta delay,
+      base::OnceClosure delayed_task);
+
+  // Cancels delayed_processing for |sync_type| for |storage_partition|.
+  // Must be called on the UI thread.
+  virtual void CancelDelayedProcessing(
+      StoragePartition* storage_partition,
+      blink::mojom::BackgroundSyncType sync_type);
+
+ private:
+  virtual ~BackgroundSyncScheduler();
+
+  friend struct BrowserThread::DeleteOnThread<BrowserThread::UI>;
+  friend class base::DeleteHelper<BackgroundSyncScheduler>;
+
+  std::map<StoragePartition*, std::unique_ptr<base::OneShotTimer>>&
+  GetDelayedProcessingInfo(blink::mojom::BackgroundSyncType sync_type);
+
+  std::map<StoragePartition*, std::unique_ptr<base::OneShotTimer>>
+      delayed_processing_info_one_shot_;
+  std::map<StoragePartition*, std::unique_ptr<base::OneShotTimer>>
+      delayed_processing_info_periodic_;
+
+  DISALLOW_COPY_AND_ASSIGN(BackgroundSyncScheduler);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_BACKGROUND_SYNC_BACKGROUND_SYNC_SCHEDULER_H_
diff --git a/chromium/content/browser/background_sync/background_sync_scheduler_unittest.cc b/chromium/content/browser/background_sync/background_sync_scheduler_unittest.cc
new file mode 100644
index 00000000000..ea472f79618
--- /dev/null
+++ b/chromium/content/browser/background_sync/background_sync_scheduler_unittest.cc
@@ -0,0 +1,186 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/background_sync/background_sync_scheduler.h"
+
+#include <map>
+#include <vector>
+
+#include "base/bind.h"
+#include "base/callback_forward.h"
+#include "base/run_loop.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/test/task_environment.h"
+#include "base/time/time.h"
+#include "content/browser/background_sync/background_sync_scheduler.h"
+#include "content/browser/storage_partition_impl.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
+#include "content/public/test/browser_task_environment.h"
+#include "content/public/test/test_browser_context.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace content {
+
+namespace {
+
+const char kUrl_1[] = "https://example.com";
+const char kUrl_2[] = "https://whereswaldo.com";
+
+class TestBrowserClient : public ContentBrowserClient {
+ public:
+  TestBrowserClient() = default;
+  ~TestBrowserClient() override = default;
+
+  void GetStoragePartitionConfigForSite(BrowserContext* browser_context,
+                                        const GURL& site,
+                                        bool can_be_default,
+                                        std::string* partition_domain,
+                                        std::string* partition_name,
+                                        bool* in_memory) override {
+    *partition_domain = "PartitionDomain" + site.spec();
+    *partition_name = "Partition" + site.spec();
+    *in_memory = false;
+  }
+};
+
+}  // namespace
+
+class BackgroundSyncSchedulerTest : public testing::Test {
+ public:
+  BackgroundSyncSchedulerTest()
+      : task_environment_(BrowserTaskEnvironment::MainThreadType::UI) {}
+
+  void ScheduleDelayedProcessing(const GURL& url,
+                                 blink::mojom::BackgroundSyncType sync_type,
+                                 base::TimeDelta delay,
+                                 base::OnceClosure delayed_task) {
+    auto* scheduler = BackgroundSyncScheduler::GetFor(&test_browser_context_);
+    DCHECK(scheduler);
+    auto* storage_partition =
+        BrowserContext::GetStoragePartitionForSite(&test_browser_context_, url);
+    DCHECK(storage_partition);
+
+    scheduler->ScheduleDelayedProcessing(storage_partition, sync_type, delay,
+                                         std::move(delayed_task));
+  }
+
+  void CancelDelayedProcessing(const GURL& url,
+                               blink::mojom::BackgroundSyncType sync_type) {
+    auto* scheduler = BackgroundSyncScheduler::GetFor(&test_browser_context_);
+    DCHECK(scheduler);
+    auto* storage_partition =
+        BrowserContext::GetStoragePartitionForSite(&test_browser_context_, url);
+    DCHECK(storage_partition);
+
+    scheduler->CancelDelayedProcessing(storage_partition, sync_type);
+  }
+
+  void SetUp() override {
+    original_client_ = SetBrowserClientForTesting(&browser_client_);
+  }
+
+  void TearDown() override { SetBrowserClientForTesting(original_client_); }
+
+ protected:
+  BrowserTaskEnvironment task_environment_;
+  TestBrowserClient browser_client_;
+  ContentBrowserClient* original_client_;
+  TestBrowserContext test_browser_context_;
+};
+
+TEST_F(BackgroundSyncSchedulerTest, ScheduleInvokesCallback) {
+  base::RunLoop run_loop;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromMilliseconds(1), run_loop.QuitClosure());
+  run_loop.Run();
+}
+
+TEST_F(BackgroundSyncSchedulerTest, ZeroDelayScheduleDoesNotInvokeCallback) {
+  bool was_called = false;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta(),
+      base::BindOnce([](bool* was_called) { *was_called = true; },
+                     &was_called));
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(was_called);
+}
+
+TEST_F(BackgroundSyncSchedulerTest, MaxDelayScheduleDoesNotInvokeCallback) {
+  bool was_called = false;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::Max(),
+      base::BindOnce([](bool* was_called) { *was_called = true; },
+                     &was_called));
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(was_called);
+}
+
+TEST_F(BackgroundSyncSchedulerTest, CancelDoesNotInvokeCallback) {
+  bool was_called = false;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromMinutes(1),
+      base::BindOnce([](bool* was_called) { *was_called = true; },
+                     &was_called));
+  base::RunLoop().RunUntilIdle();
+  ASSERT_FALSE(was_called);
+
+  CancelDelayedProcessing(GURL(kUrl_1),
+                          blink::mojom::BackgroundSyncType::ONE_SHOT);
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(was_called);
+}
+
+TEST_F(BackgroundSyncSchedulerTest, SchedulingTwiceOverwritesTimer) {
+  bool was_called = false;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromSeconds(1),
+      base::BindOnce([](bool* was_called) { *was_called = true; },
+                     &was_called));
+  base::RunLoop().RunUntilIdle();
+  ASSERT_FALSE(was_called);
+
+  base::RunLoop run_loop;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromMilliseconds(1), run_loop.QuitClosure());
+  run_loop.Run();
+
+  EXPECT_FALSE(was_called);
+}
+
+TEST_F(BackgroundSyncSchedulerTest, MultipleStoragePartitions) {
+  base::RunLoop run_loop_1, run_loop_2;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromSeconds(1), run_loop_1.QuitClosure());
+
+  ScheduleDelayedProcessing(
+      GURL(kUrl_2), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromMilliseconds(1), run_loop_2.QuitClosure());
+
+  run_loop_1.Run();
+  run_loop_2.Run();
+}
+
+TEST_F(BackgroundSyncSchedulerTest, ScheduleBothTypesOfSync) {
+  base::RunLoop run_loop_1, run_loop_2;
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::ONE_SHOT,
+      base::TimeDelta::FromMilliseconds(1), run_loop_1.QuitClosure());
+  ScheduleDelayedProcessing(
+      GURL(kUrl_1), blink::mojom::BackgroundSyncType::PERIODIC,
+      base::TimeDelta::FromMilliseconds(1), run_loop_2.QuitClosure());
+  run_loop_1.Run();
+  run_loop_2.Run();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/bad_message.h b/chromium/content/browser/bad_message.h
index 2674c960c62..e89257ad46d 100644
--- a/chromium/content/browser/bad_message.h
+++ b/chromium/content/browser/bad_message.h
@@ -119,7 +119,7 @@ enum BadMessageReason {
   OBSOLETE_WC_RENDERER_DID_NAVIGATE_BAD_SECURITY_INFO = 92,
   OBSOLETE_BDH_DUPLICATE_REQUEST_DEVICE_ID = 93,
   CSDH_INVALID_ORIGIN = 94,
-  RDH_ILLEGAL_ORIGIN = 95,
+  OBSOLETE_RDH_ILLEGAL_ORIGIN = 95,
   OBSOLETE_RDH_UNAUTHORIZED_HEADER_REQUEST = 96,
   RDH_INVALID_URL = 97,
   OBSOLETE_BDH_CHARACTERISTIC_ALREADY_SUBSCRIBED = 98,
@@ -245,6 +245,7 @@ enum BadMessageReason {
   AUTH_INVALID_ICON_URL = 217,
   MDDH_INVALID_STREAM_SELECTION_INFO = 218,
   REGISTER_PROTOCOL_HANDLER_INVALID_URL = 219,
+  NC_SAME_DOCUMENT_POST_COMMIT_ERROR = 220,
 
   // Please add new elements here. The naming convention is abbreviated class
   // name (e.g. RenderFrameHost becomes RFH) plus a unique description of the
diff --git a/chromium/content/browser/battery_monitor_browsertest.cc b/chromium/content/browser/battery_monitor_browsertest.cc
index 60d32b2c225..7eafea53cd3 100644
--- a/chromium/content/browser/battery_monitor_browsertest.cc
+++ b/chromium/content/browser/battery_monitor_browsertest.cc
@@ -13,7 +13,8 @@
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/device/public/mojom/battery_monitor.mojom.h"
 #include "services/device/public/mojom/battery_status.mojom.h"
 #include "services/device/public/mojom/constants.mojom.h"
@@ -25,12 +26,12 @@ namespace {
 
 class MockBatteryMonitor : public device::mojom::BatteryMonitor {
  public:
-  MockBatteryMonitor() : binding_(this) {}
+  MockBatteryMonitor() = default;
   ~MockBatteryMonitor() override = default;
 
-  void Bind(device::mojom::BatteryMonitorRequest request) {
-    DCHECK(!binding_.is_bound());
-    binding_.Bind(std::move(request));
+  void Bind(mojo::PendingReceiver<device::mojom::BatteryMonitor> receiver) {
+    DCHECK(!receiver_.is_bound());
+    receiver_.Bind(std::move(receiver));
   }
 
   void DidChange(const device::mojom::BatteryStatus& battery_status) {
@@ -46,7 +47,7 @@ class MockBatteryMonitor : public device::mojom::BatteryMonitor {
   void QueryNextStatus(QueryNextStatusCallback callback) override {
     if (!callback_.is_null()) {
       DVLOG(1) << "Overlapped call to QueryNextStatus!";
-      binding_.Close();
+      receiver_.reset();
       return;
     }
     callback_ = std::move(callback);
@@ -63,7 +64,7 @@ class MockBatteryMonitor : public device::mojom::BatteryMonitor {
   QueryNextStatusCallback callback_;
   device::mojom::BatteryStatus status_;
   bool status_to_report_ = false;
-  mojo::Binding<device::mojom::BatteryMonitor> binding_;
+  mojo::Receiver<device::mojom::BatteryMonitor> receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(MockBatteryMonitor);
 };
@@ -77,8 +78,8 @@ class BatteryMonitorTest : public ContentBrowserTest {
     // it.
     service_manager::ServiceBinding::OverrideInterfaceBinderForTesting(
         device::mojom::kServiceName,
-        base::Bind(&MockBatteryMonitor::Bind,
-                   base::Unretained(mock_battery_monitor_.get())));
+        base::BindRepeating(&MockBatteryMonitor::Bind,
+                            base::Unretained(mock_battery_monitor_.get())));
   }
 
   ~BatteryMonitorTest() override {
diff --git a/chromium/content/browser/blob_storage/blob_url_browsertest.cc b/chromium/content/browser/blob_storage/blob_url_browsertest.cc
index 8547cd2bf56..6e913b29acb 100644
--- a/chromium/content/browser/blob_storage/blob_url_browsertest.cc
+++ b/chromium/content/browser/blob_storage/blob_url_browsertest.cc
@@ -40,7 +40,7 @@ class BlobUrlBrowserTest : public ContentBrowserTest {
 IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest, LinkToUniqueOriginBlob) {
   // Use a data URL to obtain a test page in a unique origin. The page
   // contains a link to a "blob:null/SOME-GUID-STRING" URL.
-  NavigateToURL(
+  EXPECT_TRUE(NavigateToURL(
       shell(),
       GURL("data:text/html,<body><script>"
            "var link = document.body.appendChild(document.createElement('a'));"
@@ -48,7 +48,7 @@ IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest, LinkToUniqueOriginBlob) {
            "link.href = URL.createObjectURL(new Blob(['potato']));"
            "link.target = '_blank';"
            "link.id = 'click_me';"
-           "</script></body>"));
+           "</script></body>")));
 
   // Click the link.
   ShellAddedObserver new_shell_observer;
@@ -75,7 +75,7 @@ IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest, LinkToSameOriginBlob) {
   // Using an http page, click a link that opens a popup to a same-origin blob.
   GURL url = embedded_test_server()->GetURL("chromium.org", "/title1.html");
   url::Origin origin = url::Origin::Create(url);
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   ShellAddedObserver new_shell_observer;
   EXPECT_TRUE(ExecuteScript(
@@ -108,7 +108,7 @@ IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest, LinkToSameOriginBlobWithAuthority) {
   // that has a spoofy authority section applied. This should be blocked.
   GURL url = embedded_test_server()->GetURL("chromium.org", "/title1.html");
   url::Origin origin = url::Origin::Create(url);
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   ShellAddedObserver new_shell_observer;
   EXPECT_TRUE(ExecuteScript(
@@ -146,7 +146,7 @@ IN_PROC_BROWSER_TEST_F(BlobUrlBrowserTest, ReplaceStateToAddAuthorityToBlob) {
   // an authority to the inner URL, which would be spoofy.
   GURL url = embedded_test_server()->GetURL("chromium.org", "/title1.html");
   url::Origin origin = url::Origin::Create(url);
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   ShellAddedObserver new_shell_observer;
   EXPECT_TRUE(ExecuteScript(
diff --git a/chromium/content/browser/blob_storage/blob_url_unittest.cc b/chromium/content/browser/blob_storage/blob_url_unittest.cc
index b6124bbe5cd..d226e8720d6 100644
--- a/chromium/content/browser/blob_storage/blob_url_unittest.cc
+++ b/chromium/content/browser/blob_storage/blob_url_unittest.cc
@@ -216,7 +216,9 @@ class BlobURLTest : public testing::Test {
       EXPECT_TRUE(mojo::BlockingCopyToString(
           url_loader_client.response_body_release(), &response_));
     }
-    response_headers_ = url_loader_client.response_head().headers;
+    response_headers_ = url_loader_client.response_head()
+                            ? url_loader_client.response_head()->headers
+                            : nullptr;
     response_metadata_ = url_loader_client.cached_metadata();
     response_error_code_ = url_loader_client.completion_status().error_code;
 
diff --git a/chromium/content/browser/blob_storage/chrome_blob_storage_context.cc b/chromium/content/browser/blob_storage/chrome_blob_storage_context.cc
index 0d5a04d7af7..c1bc20a5fea 100644
--- a/chromium/content/browser/blob_storage/chrome_blob_storage_context.cc
+++ b/chromium/content/browser/blob_storage/chrome_blob_storage_context.cc
@@ -24,6 +24,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_features.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
 #include "storage/browser/blob/blob_data_builder.h"
@@ -72,11 +73,11 @@ class BlobHandleImpl : public BlobHandle {
 
   std::string GetUUID() override { return handle_->uuid(); }
 
-  blink::mojom::BlobPtr PassBlob() override {
-    blink::mojom::BlobPtr result;
+  mojo::PendingRemote<blink::mojom::Blob> PassBlob() override {
+    mojo::PendingRemote<blink::mojom::Blob> result;
     storage::BlobImpl::Create(
         std::make_unique<storage::BlobDataHandle>(*handle_),
-        MakeRequest(&result));
+        result.InitWithNewPipeAndPassReceiver());
     return result;
   }
 
@@ -188,21 +189,23 @@ ChromeBlobStorageContext::URLLoaderFactoryForToken(
     BrowserContext* browser_context,
     mojo::PendingRemote<blink::mojom::BlobURLToken> token) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  network::mojom::URLLoaderFactoryPtr blob_url_loader_factory_ptr;
+  mojo::PendingRemote<network::mojom::URLLoaderFactory>
+      blob_url_loader_factory_remote;
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           [](scoped_refptr<ChromeBlobStorageContext> context,
-             network::mojom::URLLoaderFactoryRequest request,
+             mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
              mojo::PendingRemote<blink::mojom::BlobURLToken> token) {
             storage::BlobURLLoaderFactory::Create(
                 std::move(token), context->context()->AsWeakPtr(),
-                std::move(request));
+                std::move(receiver));
           },
           base::WrapRefCounted(GetFor(browser_context)),
-          MakeRequest(&blob_url_loader_factory_ptr), std::move(token)));
+          blob_url_loader_factory_remote.InitWithNewPipeAndPassReceiver(),
+          std::move(token)));
   return base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
-      std::move(blob_url_loader_factory_ptr));
+      std::move(blob_url_loader_factory_remote));
 }
 
 // static
@@ -211,29 +214,32 @@ ChromeBlobStorageContext::URLLoaderFactoryForUrl(
     BrowserContext* browser_context,
     const GURL& url) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  network::mojom::URLLoaderFactoryPtr blob_url_loader_factory_ptr;
+  mojo::PendingRemote<network::mojom::URLLoaderFactory>
+      blob_url_loader_factory_remote;
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           [](scoped_refptr<ChromeBlobStorageContext> context,
-             network::mojom::URLLoaderFactoryRequest request, const GURL& url) {
-            auto blob_handle =
-                context->context()->GetBlobDataFromPublicURL(url);
-            storage::BlobURLLoaderFactory::Create(std::move(blob_handle), url,
-                                                  std::move(request));
+             mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
+             const GURL& url) {
+            auto blob_remote = context->context()->GetBlobFromPublicURL(url);
+            storage::BlobURLLoaderFactory::Create(
+                std::move(blob_remote), url, context->context()->AsWeakPtr(),
+                std::move(receiver));
           },
           base::WrapRefCounted(GetFor(browser_context)),
-          MakeRequest(&blob_url_loader_factory_ptr), url));
+          blob_url_loader_factory_remote.InitWithNewPipeAndPassReceiver(),
+          url));
   return base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
-      std::move(blob_url_loader_factory_ptr));
+      std::move(blob_url_loader_factory_remote));
 }
 
 // static
-blink::mojom::BlobPtr ChromeBlobStorageContext::GetBlobPtr(
+mojo::PendingRemote<blink::mojom::Blob> ChromeBlobStorageContext::GetBlobRemote(
     BrowserContext* browser_context,
     const std::string& uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  blink::mojom::BlobPtr blob_ptr;
+  mojo::PendingRemote<blink::mojom::Blob> blob_remote;
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
@@ -244,9 +250,9 @@ blink::mojom::BlobPtr ChromeBlobStorageContext::GetBlobPtr(
             if (handle)
               storage::BlobImpl::Create(std::move(handle), std::move(receiver));
           },
-          base::WrapRefCounted(GetFor(browser_context)), MakeRequest(&blob_ptr),
-          uuid));
-  return blob_ptr;
+          base::WrapRefCounted(GetFor(browser_context)),
+          blob_remote.InitWithNewPipeAndPassReceiver(), uuid));
+  return blob_remote;
 }
 
 ChromeBlobStorageContext::~ChromeBlobStorageContext() = default;
diff --git a/chromium/content/browser/blob_storage/chrome_blob_storage_context.h b/chromium/content/browser/blob_storage/chrome_blob_storage_context.h
index 19457bb65cf..8182634c71c 100644
--- a/chromium/content/browser/blob_storage/chrome_blob_storage_context.h
+++ b/chromium/content/browser/blob_storage/chrome_blob_storage_context.h
@@ -16,6 +16,7 @@
 #include "base/sequenced_task_runner_helpers.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "storage/browser/blob/blob_data_handle.h"
 #include "third_party/blink/public/mojom/blob/blob_url_store.mojom.h"
@@ -89,8 +90,9 @@ class CONTENT_EXPORT ChromeBlobStorageContext
       const GURL& url);
 
   // Must be called on the UI thread.
-  static blink::mojom::BlobPtr GetBlobPtr(BrowserContext* browser_context,
-                                          const std::string& uuid);
+  static mojo::PendingRemote<blink::mojom::Blob> GetBlobRemote(
+      BrowserContext* browser_context,
+      const std::string& uuid);
 
  protected:
   virtual ~ChromeBlobStorageContext();
diff --git a/chromium/content/browser/bluetooth/bluetooth_blocklist.cc b/chromium/content/browser/bluetooth/bluetooth_blocklist.cc
index db5a6968df7..d044a46c0fc 100644
--- a/chromium/content/browser/bluetooth/bluetooth_blocklist.cc
+++ b/chromium/content/browser/bluetooth/bluetooth_blocklist.cc
@@ -9,6 +9,7 @@
 #include "base/optional.h"
 #include "base/strings/string_split.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 
 using device::BluetoothUUID;
 
diff --git a/chromium/content/browser/bluetooth/bluetooth_device_chooser_controller.cc b/chromium/content/browser/bluetooth/bluetooth_device_chooser_controller.cc
index 00749ef8748..c3799de9f44 100644
--- a/chromium/content/browser/bluetooth/bluetooth_device_chooser_controller.cc
+++ b/chromium/content/browser/bluetooth/bluetooth_device_chooser_controller.cc
@@ -10,6 +10,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/containers/flat_set.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -159,28 +160,32 @@ bool MatchesFilters(
 std::unique_ptr<device::BluetoothDiscoveryFilter> ComputeScanFilter(
     const base::Optional<
         std::vector<blink::mojom::WebBluetoothLeScanFilterPtr>>& filters) {
-  std::unordered_set<BluetoothUUID, device::BluetoothUUIDHash> services;
+  // There isn't much support for GATT over BR/EDR from neither platforms nor
+  // devices so performing a Dual scan will find devices that the API is not
+  // able to interact with. To avoid wasting power and confusing users with
+  // devices they are not able to interact with, we only perform an LE Scan.
+  auto discovery_filter = std::make_unique<device::BluetoothDiscoveryFilter>(
+      device::BLUETOOTH_TRANSPORT_LE);
 
   if (filters) {
     for (const auto& filter : filters.value()) {
-      if (!filter->services) {
-        continue;
+      device::BluetoothDiscoveryFilter::DeviceInfoFilter device_filter;
+      bool useful_filter = false;
+      if (filter->services) {
+        device_filter.uuids =
+            base::flat_set<device::BluetoothUUID>(filter->services.value());
+        useful_filter = true;
+      }
+      if (filter->name) {
+        device_filter.name = filter->name.value();
+        useful_filter = true;
       }
-      for (const auto& service : filter->services.value()) {
-        services.insert(service);
+      if (useful_filter) {
+        discovery_filter->AddDeviceFilter(device_filter);
       }
     }
   }
 
-  // There isn't much support for GATT over BR/EDR from neither platforms nor
-  // devices so performing a Dual scan will find devices that the API is not
-  // able to interact with. To avoid wasting power and confusing users with
-  // devices they are not able to interact with, we only perform an LE Scan.
-  auto discovery_filter = std::make_unique<device::BluetoothDiscoveryFilter>(
-      device::BLUETOOTH_TRANSPORT_LE);
-  for (const BluetoothUUID& service : services) {
-    discovery_filter->AddUUID(service);
-  }
   return discovery_filter;
 }
 
@@ -235,10 +240,11 @@ BluetoothDeviceChooserController::BluetoothDeviceChooserController(
       discovery_session_timer_(
           FROM_HERE,
           base::TimeDelta::FromSeconds(scan_duration_),
-          base::Bind(&BluetoothDeviceChooserController::StopDeviceDiscovery,
-                     // base::Timer guarantees it won't call back after its
-                     // destructor starts.
-                     base::Unretained(this))) {
+          base::BindRepeating(
+              &BluetoothDeviceChooserController::StopDeviceDiscovery,
+              // base::Timer guarantees it won't call back after its
+              // destructor starts.
+              base::Unretained(this))) {
   CHECK(adapter_);
 }
 
@@ -313,9 +319,9 @@ void BluetoothDeviceChooserController::GetDevice(
     return;
   }
 
-  BluetoothChooser::EventHandler chooser_event_handler =
-      base::Bind(&BluetoothDeviceChooserController::OnBluetoothChooserEvent,
-                 base::Unretained(this));
+  BluetoothChooser::EventHandler chooser_event_handler = base::BindRepeating(
+      &BluetoothDeviceChooserController::OnBluetoothChooserEvent,
+      base::Unretained(this));
 
   if (WebContentsDelegate* delegate = web_contents_->GetDelegate()) {
     chooser_ = delegate->RunBluetoothChooser(render_frame_host_,
diff --git a/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.cc b/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.cc
index b53f58e9979..b870c0cb2d5 100644
--- a/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.cc
+++ b/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.cc
@@ -9,18 +9,20 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents.h"
 #include "device/bluetooth/bluetooth_gatt_connection.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 
 namespace content {
 
 struct GATTConnectionAndServerClient {
   GATTConnectionAndServerClient(
       std::unique_ptr<device::BluetoothGattConnection> connection,
-      blink::mojom::WebBluetoothServerClientAssociatedPtr client)
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> client)
       : gatt_connection(std::move(connection)),
         server_client(std::move(client)) {}
 
   std::unique_ptr<device::BluetoothGattConnection> gatt_connection;
-  blink::mojom::WebBluetoothServerClientAssociatedPtr server_client;
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> server_client;
 };
 
 FrameConnectedBluetoothDevices::FrameConnectedBluetoothDevices(
@@ -47,7 +49,7 @@ bool FrameConnectedBluetoothDevices::IsConnectedToDeviceWithId(
 void FrameConnectedBluetoothDevices::Insert(
     const blink::WebBluetoothDeviceId& device_id,
     std::unique_ptr<device::BluetoothGattConnection> connection,
-    blink::mojom::WebBluetoothServerClientAssociatedPtr client) {
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> client) {
   if (device_id_to_connection_map_.find(device_id) !=
       device_id_to_connection_map_.end()) {
     // It's possible for WebBluetoothServiceImpl to issue two successive
diff --git a/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.h b/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.h
index 2da3e3cabf7..f259b4d19de 100644
--- a/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.h
+++ b/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices.h
@@ -11,6 +11,7 @@
 
 #include "base/optional.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "third_party/blink/public/common/bluetooth/web_bluetooth_device_id.h"
 #include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 #include "url/origin.h"
@@ -43,9 +44,10 @@ class CONTENT_EXPORT FrameConnectedBluetoothDevices final {
 
   // If a connection doesn't exist already for |device_id|, adds a connection to
   // the map and increases the WebContents count of connected devices.
-  void Insert(const blink::WebBluetoothDeviceId& device_id,
-              std::unique_ptr<device::BluetoothGattConnection> connection,
-              blink::mojom::WebBluetoothServerClientAssociatedPtr client);
+  void Insert(
+      const blink::WebBluetoothDeviceId& device_id,
+      std::unique_ptr<device::BluetoothGattConnection> connection,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> client);
 
   // Deletes the BluetoothGattConnection for |device_id| and decrements the
   // WebContents count of connected devices if |device_id| had a connection.
diff --git a/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc b/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
index 6d89ce4b99a..e24ed2b2e75 100644
--- a/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
+++ b/chromium/content/browser/bluetooth/frame_connected_bluetooth_devices_unittest.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/bluetooth/frame_connected_bluetooth_devices.h"
 
+#include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "content/browser/bluetooth/web_bluetooth_service_impl.h"
 #include "content/test/test_render_view_host.h"
@@ -12,9 +13,10 @@
 #include "device/bluetooth/test/mock_bluetooth_adapter.h"
 #include "device/bluetooth/test/mock_bluetooth_device.h"
 #include "device/bluetooth/test/mock_bluetooth_gatt_connection.h"
-#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 
 namespace content {
 
@@ -38,9 +40,10 @@ const blink::WebBluetoothDeviceId kDeviceId1("111111111111111111111A==");
 constexpr char kDeviceAddress1[] = "1";
 constexpr char kDeviceName1[] = "Device1";
 
-blink::mojom::WebBluetoothServerClientAssociatedPtr CreateServerClient() {
-  blink::mojom::WebBluetoothServerClientAssociatedPtr client;
-  mojo::MakeRequestAssociatedWithDedicatedPipe(&client);
+mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient>
+CreateServerClient() {
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> client;
+  ignore_result(client.BindNewEndpointAndPassDedicatedReceiverForTesting());
   return client;
 }
 
diff --git a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc
index 5df2ce1283e..5c2980a995d 100644
--- a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc
+++ b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.cc
@@ -11,6 +11,7 @@
 #include "content/browser/bluetooth/web_bluetooth_service_impl.h"
 
 #include <algorithm>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
@@ -32,10 +33,16 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
+#include "content/public/common/content_client.h"
 #include "device/bluetooth/bluetooth_adapter_factory_wrapper.h"
 #include "device/bluetooth/bluetooth_remote_gatt_characteristic.h"
 #include "device/bluetooth/bluetooth_remote_gatt_descriptor.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "third_party/blink/public/common/bluetooth/web_bluetooth_device_id.h"
+#include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 
 using device::BluetoothAdapterFactoryWrapper;
 using device::BluetoothUUID;
@@ -213,22 +220,23 @@ struct CacheQueryResult {
 struct GATTNotifySessionAndCharacteristicClient {
   GATTNotifySessionAndCharacteristicClient(
       std::unique_ptr<device::BluetoothGattNotifySession> session,
-      blink::mojom::WebBluetoothCharacteristicClientAssociatedPtr client)
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothCharacteristicClient>
+          client)
       : gatt_notify_session(std::move(session)),
         characteristic_client(std::move(client)) {}
 
   std::unique_ptr<device::BluetoothGattNotifySession> gatt_notify_session;
-  blink::mojom::WebBluetoothCharacteristicClientAssociatedPtr
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothCharacteristicClient>
       characteristic_client;
 };
 
 WebBluetoothServiceImpl::WebBluetoothServiceImpl(
     RenderFrameHost* render_frame_host,
-    blink::mojom::WebBluetoothServiceRequest request)
+    mojo::PendingReceiver<blink::mojom::WebBluetoothService> receiver)
     : WebContentsObserver(WebContents::FromRenderFrameHost(render_frame_host)),
       connected_devices_(new FrameConnectedBluetoothDevices(render_frame_host)),
       render_frame_host_(render_frame_host),
-      binding_(this, std::move(request)) {
+      receiver_(this, std::move(receiver)) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   CHECK(web_contents());
 }
@@ -240,7 +248,7 @@ WebBluetoothServiceImpl::~WebBluetoothServiceImpl() {
 
 void WebBluetoothServiceImpl::SetClientConnectionErrorHandler(
     base::OnceClosure closure) {
-  binding_.set_connection_error_handler(std::move(closure));
+  receiver_.set_disconnect_handler(std::move(closure));
 }
 
 blink::mojom::WebBluetoothResult
@@ -335,7 +343,7 @@ void WebBluetoothServiceImpl::OnBluetoothScanningPromptEvent(
 }
 
 WebBluetoothServiceImpl::ScanningClient::ScanningClient(
-    blink::mojom::WebBluetoothScanClientAssociatedPtr client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     RequestScanningStartCallback callback,
     BluetoothDeviceScanningPromptController* prompt_controller)
@@ -344,7 +352,7 @@ WebBluetoothServiceImpl::ScanningClient::ScanningClient(
       callback_(std::move(callback)),
       prompt_controller_(prompt_controller) {
   DCHECK(options_->filters.has_value() || options_->accept_all_advertisements);
-  client_.set_connection_error_handler(base::BindRepeating(
+  client_.set_disconnect_handler(base::BindRepeating(
       &ScanningClient::DisconnectionHandler, base::Unretained(this)));
 }
 
@@ -680,7 +688,8 @@ void WebBluetoothServiceImpl::RequestDevice(
 
 void WebBluetoothServiceImpl::RemoteServerConnect(
     const blink::WebBluetoothDeviceId& device_id,
-    blink::mojom::WebBluetoothServerClientAssociatedPtrInfo client,
+    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothServerClient>
+        client,
     RemoteServerConnectCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -714,9 +723,8 @@ void WebBluetoothServiceImpl::RemoteServerConnect(
   // abstraction allows to check for pending connections.
   // http://crbug.com/583544
   const base::TimeTicks start_time = base::TimeTicks::Now();
-  blink::mojom::WebBluetoothServerClientAssociatedPtr
-      web_bluetooth_server_client;
-  web_bluetooth_server_client.Bind(std::move(client));
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient>
+      web_bluetooth_server_client(std::move(client));
 
   // TODO(crbug.com/730593): Remove AdaptCallbackForRepeating() by updating
   // the callee interface.
@@ -1038,7 +1046,8 @@ void WebBluetoothServiceImpl::RemoteCharacteristicWriteValue(
 
 void WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications(
     const std::string& characteristic_instance_id,
-    blink::mojom::WebBluetoothCharacteristicClientAssociatedPtrInfo client,
+    mojo::PendingAssociatedRemote<
+        blink::mojom::WebBluetoothCharacteristicClient> client,
     RemoteCharacteristicStartNotificationsCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -1075,9 +1084,8 @@ void WebBluetoothServiceImpl::RemoteCharacteristicStartNotifications(
     return;
   }
 
-  blink::mojom::WebBluetoothCharacteristicClientAssociatedPtr
-      characteristic_client;
-  characteristic_client.Bind(std::move(client));
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothCharacteristicClient>
+      characteristic_client(std::move(client));
 
   // TODO(crbug.com/730593): Remove AdaptCallbackForRepeating() by updating
   // the callee interface.
@@ -1200,13 +1208,14 @@ void WebBluetoothServiceImpl::RemoteDescriptorWriteValue(
 }
 
 void WebBluetoothServiceImpl::RequestScanningStart(
-    blink::mojom::WebBluetoothScanClientAssociatedPtrInfo client_info,
+    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient>
+        client_info,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     RequestScanningStartCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  blink::mojom::WebBluetoothScanClientAssociatedPtr client;
-  client.Bind(std::move(client_info));
+  mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client(
+      std::move(client_info));
 
   if (!GetAdapter()) {
     if (BluetoothAdapterFactoryWrapper::Get().IsLowEnergySupported()) {
@@ -1228,7 +1237,7 @@ void WebBluetoothServiceImpl::RequestScanningStart(
 }
 
 void WebBluetoothServiceImpl::RequestScanningStartImpl(
-    blink::mojom::WebBluetoothScanClientAssociatedPtr client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     RequestScanningStartCallback callback,
     scoped_refptr<device::BluetoothAdapter> adapter) {
@@ -1307,7 +1316,7 @@ void WebBluetoothServiceImpl::RequestScanningStartImpl(
 }
 
 void WebBluetoothServiceImpl::OnStartDiscoverySession(
-    blink::mojom::WebBluetoothScanClientAssociatedPtr client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
     std::unique_ptr<device::BluetoothDiscoverySession> session) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -1489,7 +1498,7 @@ void WebBluetoothServiceImpl::OnGetDeviceFailed(
 void WebBluetoothServiceImpl::OnCreateGATTConnectionSuccess(
     const blink::WebBluetoothDeviceId& device_id,
     base::TimeTicks start_time,
-    blink::mojom::WebBluetoothServerClientAssociatedPtr client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> client,
     RemoteServerConnectCallback callback,
     std::unique_ptr<device::BluetoothGattConnection> connection) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -1550,7 +1559,8 @@ void WebBluetoothServiceImpl::OnCharacteristicWriteValueFailed(
 }
 
 void WebBluetoothServiceImpl::OnStartNotifySessionSuccess(
-    blink::mojom::WebBluetoothCharacteristicClientAssociatedPtr client,
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothCharacteristicClient>
+        client,
     RemoteCharacteristicStartNotificationsCallback callback,
     std::unique_ptr<device::BluetoothGattNotifySession> notify_session) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -1757,7 +1767,7 @@ device::BluetoothAdapter* WebBluetoothServiceImpl::GetAdapter() {
 void WebBluetoothServiceImpl::CrashRendererAndClosePipe(
     bad_message::BadMessageReason reason) {
   bad_message::ReceivedBadMessage(GetRenderProcessHost(), reason);
-  binding_.Close();
+  receiver_.reset();
 }
 
 url::Origin WebBluetoothServiceImpl::GetOrigin() {
@@ -1819,8 +1829,8 @@ bool WebBluetoothServiceImpl::AreScanFiltersAllowed(
 
 void WebBluetoothServiceImpl::ClearState() {
   // Releasing the adapter will drop references to callbacks that have not yet
-  // been executed. The binding must be closed first so that this is allowed.
-  binding_.Close();
+  // been executed. The receiver must be closed first so that this is allowed.
+  receiver_.reset();
 
   characteristic_id_to_notify_session_.clear();
   pending_primary_services_requests_.clear();
diff --git a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h
index 56fd7a85d71..b59857c686c 100644
--- a/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h
+++ b/chromium/content/browser/bluetooth/web_bluetooth_service_impl.h
@@ -24,8 +24,10 @@
 #include "device/bluetooth/bluetooth_gatt_notify_session.h"
 #include "device/bluetooth/bluetooth_remote_gatt_characteristic.h"
 #include "device/bluetooth/bluetooth_remote_gatt_service.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/interface_ptr_set.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 
 namespace url {
@@ -62,9 +64,10 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
       public device::BluetoothAdapter::Observer {
  public:
   // |render_frame_host|: The RFH that owns this instance.
-  // |request|: The instance will be bound to this request's pipe.
-  WebBluetoothServiceImpl(RenderFrameHost* render_frame_host,
-                          blink::mojom::WebBluetoothServiceRequest request);
+  // |receiver|: The instance will be bound to this receiver's pipe.
+  WebBluetoothServiceImpl(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingReceiver<blink::mojom::WebBluetoothService> receiver);
   ~WebBluetoothServiceImpl() override;
 
   void CrashRendererAndClosePipe(bad_message::BadMessageReason reason);
@@ -107,10 +110,11 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
 
   class ScanningClient {
    public:
-    ScanningClient(blink::mojom::WebBluetoothScanClientAssociatedPtr client,
-                   blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
-                   RequestScanningStartCallback callback,
-                   BluetoothDeviceScanningPromptController* prompt_controller);
+    ScanningClient(
+        mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
+        blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
+        RequestScanningStartCallback callback,
+        BluetoothDeviceScanningPromptController* prompt_controller);
     ~ScanningClient();
     bool SendEvent(blink::mojom::WebBluetoothScanResultPtr result);
 
@@ -142,7 +146,7 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
 
     bool disconnected_ = false;
     bool allow_send_event_ = false;
-    mojo::AssociatedInterfacePtr<blink::mojom::WebBluetoothScanClient> client_;
+    mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client_;
     blink::mojom::WebBluetoothRequestLEScanOptionsPtr options_;
     RequestScanningStartCallback callback_;
     BluetoothDeviceScanningPromptController* prompt_controller_;
@@ -192,7 +196,8 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
                      RequestDeviceCallback callback) override;
   void RemoteServerConnect(
       const blink::WebBluetoothDeviceId& device_id,
-      blink::mojom::WebBluetoothServerClientAssociatedPtrInfo client,
+      mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothServerClient>
+          client,
       RemoteServerConnectCallback callback) override;
   void RemoteServerDisconnect(
       const blink::WebBluetoothDeviceId& device_id) override;
@@ -215,7 +220,8 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
       RemoteCharacteristicWriteValueCallback callback) override;
   void RemoteCharacteristicStartNotifications(
       const std::string& characteristic_instance_id,
-      blink::mojom::WebBluetoothCharacteristicClientAssociatedPtrInfo client,
+      mojo::PendingAssociatedRemote<
+          blink::mojom::WebBluetoothCharacteristicClient> client,
       RemoteCharacteristicStartNotificationsCallback callback) override;
   void RemoteCharacteristicStopNotifications(
       const std::string& characteristic_instance_id,
@@ -233,7 +239,8 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
       const std::vector<uint8_t>& value,
       RemoteDescriptorWriteValueCallback callback) override;
   void RequestScanningStart(
-      blink::mojom::WebBluetoothScanClientAssociatedPtrInfo client,
+      mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient>
+          client,
       blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
       RequestScanningStartCallback callback) override;
 
@@ -243,13 +250,13 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
       scoped_refptr<device::BluetoothAdapter> adapter);
 
   void RequestScanningStartImpl(
-      blink::mojom::WebBluetoothScanClientAssociatedPtr client,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
       blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
       RequestScanningStartCallback callback,
       scoped_refptr<device::BluetoothAdapter> adapter);
 
   void OnStartDiscoverySession(
-      blink::mojom::WebBluetoothScanClientAssociatedPtr client,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothScanClient> client,
       blink::mojom::WebBluetoothRequestLEScanOptionsPtr options,
       std::unique_ptr<device::BluetoothDiscoverySession> session);
 
@@ -276,7 +283,7 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
   void OnCreateGATTConnectionSuccess(
       const blink::WebBluetoothDeviceId& device_id,
       base::TimeTicks start_time,
-      blink::mojom::WebBluetoothServerClientAssociatedPtr client,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothServerClient> client,
       RemoteServerConnectCallback callback,
       std::unique_ptr<device::BluetoothGattConnection> connection);
   void OnCreateGATTConnectionFailed(
@@ -301,7 +308,8 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
 
   // Callbacks for BluetoothRemoteGattCharacteristic::StartNotifySession.
   void OnStartNotifySessionSuccess(
-      blink::mojom::WebBluetoothCharacteristicClientAssociatedPtr client,
+      mojo::AssociatedRemote<blink::mojom::WebBluetoothCharacteristicClient>
+          client,
       RemoteCharacteristicStartNotificationsCallback callback,
       std::unique_ptr<device::BluetoothGattNotifySession> notify_session);
   void OnStartNotifySessionFailed(
@@ -416,10 +424,10 @@ class CONTENT_EXPORT WebBluetoothServiceImpl
   // packets.
   bool accept_all_advertisements_ = false;
 
-  // The lifetime of this instance is exclusively managed by the RFH that
-  // owns it so we use a "Binding" as opposed to a "StrongBinding" which deletes
+  // The lifetime of this instance is exclusively managed by the RFH that owns
+  // it so we use a "Receiver" as opposed to a "SelfOwnedReceiver" which deletes
   // the service on pipe connection errors.
-  mojo::Binding<blink::mojom::WebBluetoothService> binding_;
+  mojo::Receiver<blink::mojom::WebBluetoothService> receiver_;
 
   base::WeakPtrFactory<WebBluetoothServiceImpl> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc b/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
index 1c7e6a610f7..35f3d4393e5 100644
--- a/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
+++ b/chromium/content/browser/bluetooth/web_bluetooth_service_impl_unittest.cc
@@ -13,8 +13,11 @@
 #include "content/test/test_web_contents.h"
 #include "device/bluetooth/bluetooth_adapter_factory_wrapper.h"
 #include "device/bluetooth/test/mock_bluetooth_adapter.h"
-#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 
 using testing::Return;
 
@@ -87,10 +90,11 @@ class FakeWebBluetoothScanClientImpl : blink::mojom::WebBluetoothScanClient {
   // blink::mojom::WebBluetoothScanClient:
   void ScanEvent(blink::mojom::WebBluetoothScanResultPtr result) override {}
 
-  void BindRequest(
-      blink::mojom::WebBluetoothScanClientAssociatedRequest request) {
-    binding_.Bind(std::move(request));
-    binding_.set_connection_error_handler(
+  void BindReceiver(
+      mojo::PendingAssociatedReceiver<blink::mojom::WebBluetoothScanClient>
+          receiver) {
+    receiver_.Bind(std::move(receiver));
+    receiver_.set_disconnect_handler(
         base::BindOnce(&FakeWebBluetoothScanClientImpl::OnConnectionError,
                        base::Unretained(this)));
   }
@@ -100,7 +104,8 @@ class FakeWebBluetoothScanClientImpl : blink::mojom::WebBluetoothScanClient {
   bool on_connection_error_called() { return on_connection_error_called_; }
 
  private:
-  mojo::AssociatedBinding<blink::mojom::WebBluetoothScanClient> binding_{this};
+  mojo::AssociatedReceiver<blink::mojom::WebBluetoothScanClient> receiver_{
+      this};
   bool on_connection_error_called_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(FakeWebBluetoothScanClientImpl);
@@ -149,8 +154,8 @@ class WebBluetoothServiceImplTest : public RenderViewHostImplTestHarness {
   blink::mojom::RequestScanningStartResultPtr RequestScanningStart(
       const blink::mojom::WebBluetoothLeScanFilter& filter,
       FakeWebBluetoothScanClientImpl* client_impl) {
-    blink::mojom::WebBluetoothScanClientAssociatedPtrInfo client_info;
-    client_impl->BindRequest(mojo::MakeRequest(&client_info));
+    mojo::PendingAssociatedRemote<blink::mojom::WebBluetoothScanClient> client;
+    client_impl->BindReceiver(client.InitWithNewEndpointAndPassReceiver());
     auto options = blink::mojom::WebBluetoothRequestLEScanOptions::New();
     options->filters.emplace();
     auto filter_ptr = blink::mojom::WebBluetoothLeScanFilter::New(filter);
@@ -158,7 +163,7 @@ class WebBluetoothServiceImplTest : public RenderViewHostImplTestHarness {
     base::RunLoop loop;
     blink::mojom::RequestScanningStartResultPtr result;
     service_->RequestScanningStart(
-        std::move(client_info), std::move(options),
+        std::move(client), std::move(options),
         base::BindLambdaForTesting(
             [&](blink::mojom::RequestScanningStartResultPtr p) {
               result = std::move(p);
diff --git a/chromium/content/browser/broadcast_channel/broadcast_channel_provider.cc b/chromium/content/browser/broadcast_channel/broadcast_channel_provider.cc
index 34a5df1317b..d9caeaa64ad 100644
--- a/chromium/content/browser/broadcast_channel/broadcast_channel_provider.cc
+++ b/chromium/content/browser/broadcast_channel/broadcast_channel_provider.cc
@@ -34,7 +34,8 @@ class BroadcastChannelProvider::Connection
   const url::Origin& origin() const { return origin_; }
   const std::string& name() const { return name_; }
 
-  void set_connection_error_handler(const base::Closure& error_handler) {
+  void set_connection_error_handler(
+      const base::RepeatingClosure& error_handler) {
     receiver_.set_disconnect_handler(error_handler);
     client_.set_disconnect_handler(error_handler);
   }
@@ -98,8 +99,8 @@ void BroadcastChannelProvider::ConnectToChannel(
   std::unique_ptr<Connection> c(new Connection(origin, name, std::move(client),
                                                std::move(connection), this));
   c->set_connection_error_handler(
-      base::Bind(&BroadcastChannelProvider::UnregisterConnection,
-                 base::Unretained(this), c.get()));
+      base::BindRepeating(&BroadcastChannelProvider::UnregisterConnection,
+                          base::Unretained(this), c.get()));
   connections_[origin].insert(std::make_pair(name, std::move(c)));
 }
 
diff --git a/chromium/content/browser/browser_child_process_host_impl.cc b/chromium/content/browser/browser_child_process_host_impl.cc
index af58856b335..3f64880f938 100644
--- a/chromium/content/browser/browser_child_process_host_impl.cc
+++ b/chromium/content/browser/browser_child_process_host_impl.cc
@@ -19,6 +19,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/metrics/persistent_histogram_allocator.h"
 #include "base/metrics/persistent_memory_allocator.h"
+#include "base/no_destructor.h"
 #include "base/stl_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
@@ -43,7 +44,10 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/resource_coordinator_service.h"
+#include "content/public/browser/system_connector.h"
 #include "content/public/common/connection_filter.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
@@ -55,9 +59,18 @@
 #include "net/websockets/websocket_channel.h"
 #include "services/service_manager/embedder/switches.h"
 #include "services/service_manager/public/cpp/constants.h"
+#include "services/tracing/public/cpp/trace_startup.h"
 
 #if defined(OS_MACOSX)
 #include "content/browser/child_process_task_port_provider_mac.h"
+#include "content/browser/sandbox_support_mac_impl.h"
+#include "content/common/sandbox_support_mac.mojom.h"
+#endif
+
+#if defined(OS_WIN)
+#include "content/browser/renderer_host/dwrite_font_proxy_impl_win.h"
+#include "content/public/common/font_cache_dispatcher_win.h"
+#include "content/public/common/font_cache_win.mojom.h"
 #endif
 
 namespace content {
@@ -100,6 +113,24 @@ void NotifyProcessKilled(const ChildProcessData& data,
     observer.BrowserChildProcessKilled(data, info);
 }
 
+memory_instrumentation::mojom::ProcessType GetCoordinatorClientProcessType(
+    ProcessType process_type) {
+  switch (process_type) {
+    case PROCESS_TYPE_RENDERER:
+      return memory_instrumentation::mojom::ProcessType::RENDERER;
+    case PROCESS_TYPE_UTILITY:
+      return memory_instrumentation::mojom::ProcessType::UTILITY;
+    case PROCESS_TYPE_GPU:
+      return memory_instrumentation::mojom::ProcessType::GPU;
+    case PROCESS_TYPE_PPAPI_PLUGIN:
+    case PROCESS_TYPE_PPAPI_BROKER:
+      return memory_instrumentation::mojom::ProcessType::PLUGIN;
+    default:
+      NOTREACHED();
+      return memory_instrumentation::mojom::ProcessType::OTHER;
+  }
+}
+
 }  // namespace
 
 BrowserChildProcessHost* BrowserChildProcessHost::Create(
@@ -217,24 +248,7 @@ void BrowserChildProcessHostImpl::CopyFeatureAndFieldTrialFlags(
 // static
 void BrowserChildProcessHostImpl::CopyTraceStartupFlags(
     base::CommandLine* cmd_line) {
-  if (tracing::TraceStartupConfig::GetInstance()->IsEnabled()) {
-    const auto trace_config =
-        tracing::TraceStartupConfig::GetInstance()->GetTraceConfig();
-    if (!trace_config.IsArgumentFilterEnabled()) {
-      // The only trace option that we can pass through switches is the record
-      // mode. Other trace options should have the default value.
-      //
-      // TODO(chiniforooshan): Add other trace options to switches if, for
-      // example, they are used in a telemetry test that needs startup trace
-      // events from renderer processes.
-      cmd_line->AppendSwitchASCII(switches::kTraceStartup,
-                                  trace_config.ToCategoryFilterString());
-      cmd_line->AppendSwitchASCII(
-          switches::kTraceStartupRecordMode,
-          base::trace_event::TraceConfig::TraceRecordModeToStr(
-              trace_config.GetTraceRecordMode()));
-    }
-  }
+  tracing::PropagateTracingFlagsToChildProcessCmdLine(cmd_line);
 }
 
 void BrowserChildProcessHostImpl::Launch(
@@ -317,7 +331,6 @@ void BrowserChildProcessHostImpl::LaunchWithoutExtraCommandLineSwitches(
       service_manager::switches::kDisableInProcessStackTraces,
       switches::kDisableBestEffortTasks,
       switches::kDisableLogging,
-      switches::kDisablePerfetto,
       switches::kEnableLogging,
       switches::kIPCConnectionTimeout,
       switches::kLogBestEffortTasks,
@@ -369,11 +382,6 @@ void BrowserChildProcessHostImpl::BindInterface(
   child_connection_->BindInterface(interface_name, std::move(interface_pipe));
 }
 
-void BrowserChildProcessHostImpl::BindHostReceiver(
-    mojo::GenericPendingReceiver receiver) {
-  delegate_->BindHostReceiver(std::move(receiver));
-}
-
 void BrowserChildProcessHostImpl::HistogramBadMessageTerminated(
     ProcessType process_type) {
   UMA_HISTOGRAM_ENUMERATION("ChildProcess.BadMessgeTerminated", process_type,
@@ -652,6 +660,31 @@ void BrowserChildProcessHostImpl::OnProcessLaunched() {
   }
 }
 
+void BrowserChildProcessHostImpl::RegisterCoordinatorClient(
+    mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator> receiver,
+    mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
+        client_process) {
+  base::PostTask(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(
+          [](mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator>
+                 receiver,
+             mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
+                 client_process,
+             memory_instrumentation::mojom::ProcessType process_type,
+             base::ProcessId process_id,
+             base::Optional<std::string> service_name) {
+            GetMemoryInstrumentationCoordinatorController()
+                ->RegisterClientProcess(std::move(receiver),
+                                        std::move(client_process), process_type,
+                                        process_id, std::move(service_name));
+          },
+          std::move(receiver), std::move(client_process),
+          GetCoordinatorClientProcessType(
+              static_cast<ProcessType>(data_.process_type)),
+          child_process_->GetProcess().Pid(), delegate_->GetServiceName()));
+}
+
 bool BrowserChildProcessHostImpl::IsProcessLaunched() const {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
diff --git a/chromium/content/browser/browser_child_process_host_impl.h b/chromium/content/browser/browser_child_process_host_impl.h
index fecea704477..62f6f764490 100644
--- a/chromium/content/browser/browser_child_process_host_impl.h
+++ b/chromium/content/browser/browser_child_process_host_impl.h
@@ -25,6 +25,7 @@
 #include "content/public/browser/child_process_data.h"
 #include "content/public/common/child_process_host_delegate.h"
 #include "mojo/public/cpp/system/invitation.h"
+#include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
 
 #if defined(OS_WIN)
 #include "base/win/object_watcher.h"
@@ -50,7 +51,8 @@ class CONTENT_EXPORT BrowserChildProcessHostImpl
 #if defined(OS_WIN)
       public base::win::ObjectWatcher::Delegate,
 #endif
-      public ChildProcessLauncher::Client {
+      public ChildProcessLauncher::Client,
+      public memory_instrumentation::mojom::CoordinatorConnector {
  public:
   BrowserChildProcessHostImpl(content::ProcessType process_type,
                               BrowserChildProcessHostDelegate* delegate,
@@ -164,6 +166,13 @@ class CONTENT_EXPORT BrowserChildProcessHostImpl
   bool CanUseWarmUpConnection() override;
 #endif
 
+  // memory_instrumentation::mojom::CoordinatorConnector implementation:
+  void RegisterCoordinatorClient(
+      mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator>
+          receiver,
+      mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
+          client_process) override;
+
   // Returns true if the process has successfully launched. Must only be called
   // on the IO thread.
   bool IsProcessLaunched() const;
@@ -182,6 +191,8 @@ class CONTENT_EXPORT BrowserChildProcessHostImpl
   std::string metrics_name_;
   BrowserChildProcessHostDelegate* delegate_;
   std::unique_ptr<ChildProcessHost> child_process_host_;
+  mojo::Receiver<memory_instrumentation::mojom::CoordinatorConnector>
+      coordinator_connector_receiver_{this};
 
   mojo::OutgoingInvitation mojo_invitation_;
   std::unique_ptr<ChildConnection> child_connection_;
diff --git a/chromium/content/browser/browser_child_process_host_impl_receiver_bindings.cc b/chromium/content/browser/browser_child_process_host_impl_receiver_bindings.cc
new file mode 100644
index 00000000000..52ed31e30d8
--- /dev/null
+++ b/chromium/content/browser/browser_child_process_host_impl_receiver_bindings.cc
@@ -0,0 +1,114 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file exposes services in the browser to child processes.
+
+#include "content/browser/browser_child_process_host_impl.h"
+
+#include "base/bind.h"
+#include "base/no_destructor.h"
+#include "base/task/post_task.h"
+#include "build/build_config.h"
+#include "components/discardable_memory/public/mojom/discardable_shared_memory_manager.mojom.h"
+#include "components/discardable_memory/service/discardable_shared_memory_manager.h"
+#include "content/public/browser/browser_child_process_host_delegate.h"
+#include "content/public/browser/browser_task_traits.h"
+#include "content/public/browser/system_connector.h"
+#include "services/device/public/mojom/constants.mojom.h"
+#include "services/device/public/mojom/power_monitor.mojom.h"
+
+#if defined(OS_MACOSX)
+#include "content/browser/sandbox_support_mac_impl.h"
+#include "content/common/sandbox_support_mac.mojom.h"
+#endif
+
+#if defined(OS_WIN)
+#include "content/browser/renderer_host/dwrite_font_proxy_impl_win.h"
+#include "content/public/common/font_cache_dispatcher_win.h"
+#include "content/public/common/font_cache_win.mojom.h"
+#endif
+
+namespace content {
+namespace {
+
+BrowserChildProcessHost::BindHostReceiverInterceptor&
+GetBindHostReceiverInterceptor() {
+  static base::NoDestructor<
+      BrowserChildProcessHost::BindHostReceiverInterceptor>
+      interceptor;
+  return *interceptor;
+}
+
+}  // namespace
+
+void BrowserChildProcessHostImpl::BindHostReceiver(
+    mojo::GenericPendingReceiver receiver) {
+  const auto& interceptor = GetBindHostReceiverInterceptor();
+  if (interceptor) {
+    interceptor.Run(this, &receiver);
+    if (!receiver)
+      return;
+  }
+
+  if (auto r =
+          receiver.As<memory_instrumentation::mojom::CoordinatorConnector>()) {
+    // Well-behaved child processes do not bind this interface more than once.
+    if (!coordinator_connector_receiver_.is_bound())
+      coordinator_connector_receiver_.Bind(std::move(r));
+    return;
+  }
+
+#if defined(OS_MACOSX)
+  if (auto r = receiver.As<mojom::SandboxSupportMac>()) {
+    static base::NoDestructor<SandboxSupportMacImpl> sandbox_support;
+    sandbox_support->BindReceiver(std::move(r));
+    return;
+  }
+#endif
+
+#if defined(OS_WIN)
+  if (auto r = receiver.As<mojom::FontCacheWin>()) {
+    FontCacheDispatcher::Create(std::move(r));
+    return;
+  }
+
+  if (auto r = receiver.As<blink::mojom::DWriteFontProxy>()) {
+    base::CreateSequencedTaskRunner({base::ThreadPool(),
+                                     base::TaskPriority::USER_BLOCKING,
+                                     base::MayBlock()})
+        ->PostTask(FROM_HERE,
+                   base::BindOnce(&DWriteFontProxyImpl::Create, std::move(r)));
+    return;
+  }
+#endif
+
+  if (auto r = receiver.As<
+               discardable_memory::mojom::DiscardableSharedMemoryManager>()) {
+    discardable_memory::DiscardableSharedMemoryManager::Get()->Bind(
+        std::move(r));
+    return;
+  }
+
+  if (auto r = receiver.As<device::mojom::PowerMonitor>()) {
+    base::PostTask(
+        FROM_HERE, {BrowserThread::UI},
+        base::BindOnce(
+            [](mojo::PendingReceiver<device::mojom::PowerMonitor> r) {
+              GetSystemConnector()->Connect(device::mojom::kServiceName,
+                                            std::move(r));
+            },
+            std::move(r)));
+    return;
+  }
+
+  delegate_->BindHostReceiver(std::move(receiver));
+}
+
+// static
+void BrowserChildProcessHost::InterceptBindHostReceiverForTesting(
+    BindHostReceiverInterceptor callback) {
+  GetBindHostReceiverInterceptor() = std::move(callback);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/browser_context.cc b/chromium/content/browser/browser_context.cc
index 9e5b73896b8..99b29aa3671 100644
--- a/chromium/content/browser/browser_context.cc
+++ b/chromium/content/browser/browser_context.cc
@@ -42,7 +42,6 @@
 #include "content/browser/media/browser_feature_provider.h"
 #include "content/browser/permissions/permission_controller_impl.h"
 #include "content/browser/push_messaging/push_messaging_router.h"
-#include "content/browser/service_manager/common_browser_interfaces.h"
 #include "content/browser/storage_partition_impl_map.h"
 #include "content/common/child_process_host_impl.h"
 #include "content/public/browser/blob_handle.h"
@@ -54,12 +53,14 @@
 #include "content/public/browser/shared_cors_origin_access_list.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/system_connector.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "media/base/media_switches.h"
 #include "media/capabilities/in_memory_video_decode_stats_db_impl.h"
 #include "media/capabilities/video_decode_stats_db_impl.h"
+#include "media/learning/common/media_learning_tasks.h"
 #include "media/learning/impl/learning_session_impl.h"
 #include "media/mojo/services/video_decode_perf_history.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -67,9 +68,6 @@
 #include "net/url_request/url_request_context.h"
 #include "services/content/public/mojom/constants.mojom.h"
 #include "services/content/service.h"
-#include "services/file/file_service.h"
-#include "services/file/public/mojom/constants.mojom.h"
-#include "services/file/user_id_map.h"
 #include "services/network/public/cpp/features.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/service.h"
@@ -104,52 +102,6 @@ class ServiceInstanceGroupHolder : public base::SupportsUserData::Data {
   DISALLOW_COPY_AND_ASSIGN(ServiceInstanceGroupHolder);
 };
 
-// The file service runs on the IO thread but we want to limit its lifetime to
-// that of the BrowserContext which creates it. This provides thread-safe access
-// to the relevant state on the IO thread.
-class FileServiceIOThreadState
-    : public base::RefCountedThreadSafe<FileServiceIOThreadState> {
- public:
-  explicit FileServiceIOThreadState(
-      scoped_refptr<base::SingleThreadTaskRunner> io_task_runner)
-      : io_task_runner_(std::move(io_task_runner)) {}
-
-  void StartOnIOThread(service_manager::mojom::ServiceRequest request) {
-    DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
-    file_service_ = std::make_unique<file::FileService>(std::move(request));
-  }
-
-  void ShutDown() {
-    io_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&FileServiceIOThreadState::ShutDownOnIOThread, this));
-  }
-
- private:
-  friend class base::RefCountedThreadSafe<FileServiceIOThreadState>;
-
-  ~FileServiceIOThreadState() { DCHECK(!file_service_); }
-
-  void ShutDownOnIOThread() { file_service_.reset(); }
-
-  const scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
-  std::unique_ptr<file::FileService> file_service_;
-
-  DISALLOW_COPY_AND_ASSIGN(FileServiceIOThreadState);
-};
-
-class FileServiceHolder : public base::SupportsUserData::Data {
- public:
-  explicit FileServiceHolder(scoped_refptr<FileServiceIOThreadState> state)
-      : state_(std::move(state)) {}
-  ~FileServiceHolder() override { state_->ShutDown(); }
-
- private:
-  const scoped_refptr<FileServiceIOThreadState> state_;
-
-  DISALLOW_COPY_AND_ASSIGN(FileServiceHolder);
-};
-
 class ContentServiceDelegateHolder : public base::SupportsUserData::Data {
  public:
   explicit ContentServiceDelegateHolder(BrowserContext* browser_context)
@@ -167,7 +119,6 @@ class ContentServiceDelegateHolder : public base::SupportsUserData::Data {
 // Key names on BrowserContext.
 const char kBrowsingDataRemoverKey[] = "browsing-data-remover";
 const char kContentServiceDelegateKey[] = "content-service-delegate";
-const char kFileServiceKey[] = "file-service";
 const char kDownloadManagerKeyName[] = "download_manager";
 const char kPermissionControllerKey[] = "permission-controller";
 const char kServiceManagerConnection[] = "service-manager-connection";
@@ -498,11 +449,11 @@ BrowserContext::BlobContextGetter BrowserContext::GetBlobStorageContext(
 }
 
 // static
-blink::mojom::BlobPtr BrowserContext::GetBlobPtr(
+mojo::PendingRemote<blink::mojom::Blob> BrowserContext::GetBlobRemote(
     BrowserContext* browser_context,
     const std::string& uuid) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return ChromeBlobStorageContext::GetBlobPtr(browser_context, uuid);
+  return ChromeBlobStorageContext::GetBlobRemote(browser_context, uuid);
 }
 
 // static
@@ -635,13 +586,6 @@ void BrowserContext::SetDownloadManagerForTesting(
 void BrowserContext::Initialize(BrowserContext* browser_context,
                                 const base::FilePath& path) {
   const base::Token new_group = base::Token::CreateRandom();
-  ServiceInstanceGroupHolder* holder = static_cast<ServiceInstanceGroupHolder*>(
-      browser_context->GetUserData(kServiceInstanceGroup));
-  if (holder) {
-    file::ForgetServiceInstanceGroupUserDirAssociation(
-        holder->instance_group());
-  }
-  file::AssociateServiceInstanceGroupWithUserDir(new_group, path);
   RemoveBrowserContextFromInstanceGroupMap(browser_context);
   GetTokenToContextMap()[new_group] = browser_context;
   browser_context->SetUserData(
@@ -677,23 +621,6 @@ void BrowserContext::Initialize(BrowserContext* browser_context,
         kContentServiceDelegateKey,
         std::make_unique<ContentServiceDelegateHolder>(browser_context));
 
-    scoped_refptr<FileServiceIOThreadState> file_service_io_thread_state =
-        base::MakeRefCounted<FileServiceIOThreadState>(
-            base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
-    connection->AddServiceRequestHandler(
-        file::mojom::kServiceName,
-        base::BindRepeating(
-            [](scoped_refptr<FileServiceIOThreadState> io_thread_state,
-               service_manager::mojom::ServiceRequest request) {
-              io_thread_state->StartOnIOThread(std::move(request));
-            },
-            file_service_io_thread_state));
-
-    browser_context->SetUserData(kFileServiceKey,
-                                 std::make_unique<FileServiceHolder>(
-                                     std::move(file_service_io_thread_state)));
-
-    RegisterCommonBrowserInterfaces(connection);
     connection->Start();
   }
 }
@@ -823,6 +750,15 @@ media::learning::LearningSession* BrowserContext::GetLearningSession() {
         std::make_unique<media::learning::LearningSessionImpl>(
             base::SequencedTaskRunnerHandle::Get());
 
+    // Register all the LearningTasks.
+    auto cb = base::BindRepeating(
+        [](media::learning::LearningSessionImpl* session,
+           const media::learning::LearningTask& task) {
+          session->RegisterTask(task);
+        },
+        new_learning_session.get());
+    media::learning::MediaLearningTasks::Register(std::move(cb));
+
     learning_session = new_learning_session.get();
 
     SetUserData(kLearningSession, std::move(new_learning_session));
@@ -852,6 +788,10 @@ SharedCorsOriginAccessList* BrowserContext::GetSharedCorsOriginAccessList() {
   return empty_list->get();
 }
 
+bool BrowserContext::ShouldEnableOutOfBlinkCors() {
+  return base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors);
+}
+
 NativeFileSystemPermissionContext*
 BrowserContext::GetNativeFileSystemPermissionContext() {
   return nullptr;
diff --git a/chromium/content/browser/browser_interface_binders.cc b/chromium/content/browser/browser_interface_binders.cc
index f9d3d6f5135..f6eabd0faaf 100644
--- a/chromium/content/browser/browser_interface_binders.cc
+++ b/chromium/content/browser/browser_interface_binders.cc
@@ -4,21 +4,152 @@
 
 #include "content/browser/browser_interface_binders.h"
 
+#include "base/feature_list.h"
+#include "build/build_config.h"
 #include "content/browser/background_fetch/background_fetch_service_impl.h"
+#include "content/browser/browser_main_loop.h"
+#include "content/browser/content_index/content_index_service_impl.h"
+#include "content/browser/cookie_store/cookie_store_context.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/gpu/gpu_process_host.h"
+#include "content/browser/image_capture/image_capture_impl.h"
+#include "content/browser/keyboard_lock/keyboard_lock_service_impl.h"
+#include "content/browser/media/session/media_session_service_impl.h"
+#include "content/browser/picture_in_picture/picture_in_picture_service_impl.h"
+#include "content/browser/renderer_host/media/media_devices_dispatcher_host.h"
+#include "content/browser/renderer_host/media/media_stream_dispatcher_host.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/screen_enumeration/screen_enumeration_impl.h"
 #include "content/browser/service_worker/service_worker_provider_host.h"
+#include "content/browser/speech/speech_recognition_dispatcher_host.h"
+#include "content/browser/wake_lock/wake_lock_service_impl.h"
 #include "content/browser/worker_host/dedicated_worker_host.h"
 #include "content/browser/worker_host/shared_worker_host.h"
+#include "content/public/browser/browser_context.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/shared_worker_instance.h"
+#include "content/public/browser/webvr_service_provider.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
+#include "device/gamepad/gamepad_monitor.h"
+#include "device/gamepad/public/mojom/gamepad.mojom.h"
+#include "device/vr/public/mojom/vr_service.mojom.h"
+#include "media/capture/mojom/image_capture.mojom.h"
+#include "media/mojo/mojom/video_decode_perf_history.mojom.h"
+#include "media/mojo/services/video_decode_perf_history.h"
+#include "services/device/public/mojom/constants.mojom.h"
+#include "services/device/public/mojom/sensor_provider.mojom.h"
+#include "services/device/public/mojom/vibration_manager.mojom.h"
+#include "services/service_manager/public/cpp/connector.h"
+#include "services/shape_detection/public/mojom/barcodedetection_provider.mojom.h"
+#include "services/shape_detection/public/mojom/facedetection_provider.mojom.h"
+#include "services/shape_detection/public/mojom/shape_detection_service.mojom.h"
+#include "services/shape_detection/public/mojom/textdetection.mojom.h"
+#include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
+#include "third_party/blink/public/mojom/background_fetch/background_fetch.mojom.h"
+#include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
+#include "third_party/blink/public/mojom/content_index/content_index.mojom.h"
+#include "third_party/blink/public/mojom/cookie_store/cookie_store.mojom.h"
+#include "third_party/blink/public/mojom/credentialmanager/credential_manager.mojom.h"
+#include "third_party/blink/public/mojom/filesystem/file_system.mojom.h"
+#include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
+#include "third_party/blink/public/mojom/keyboard_lock/keyboard_lock.mojom.h"
+#include "third_party/blink/public/mojom/locks/lock_manager.mojom.h"
+#include "third_party/blink/public/mojom/mediasession/media_session.mojom.h"
+#include "third_party/blink/public/mojom/mediastream/media_devices.mojom.h"
+#include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
+#include "third_party/blink/public/mojom/payments/payment_app.mojom.h"
+#include "third_party/blink/public/mojom/permissions/permission.mojom.h"
+#include "third_party/blink/public/mojom/picture_in_picture/picture_in_picture.mojom.h"
+#include "third_party/blink/public/mojom/presentation/presentation.mojom.h"
+#include "third_party/blink/public/mojom/sms/sms_receiver.mojom.h"
+#include "third_party/blink/public/mojom/speech/speech_recognizer.mojom.h"
 #include "third_party/blink/public/mojom/speech/speech_synthesis.mojom.h"
+#include "third_party/blink/public/mojom/usb/web_usb_service.mojom.h"
+#include "third_party/blink/public/mojom/wake_lock/wake_lock.mojom.h"
 #include "third_party/blink/public/mojom/webaudio/audio_context_manager.mojom.h"
+#include "third_party/blink/public/mojom/webauthn/authenticator.mojom.h"
+#include "third_party/blink/public/mojom/webauthn/virtual_authenticator.mojom.h"
+
+#if !defined(OS_ANDROID)
+#include "base/command_line.h"
+#include "content/browser/installedapp/installed_app_provider_impl_default.h"
+#include "content/public/common/content_switches.h"
+#include "third_party/blink/public/mojom/hid/hid.mojom.h"
+#include "third_party/blink/public/mojom/installedapp/installed_app_provider.mojom.h"
+#include "third_party/blink/public/mojom/serial/serial.mojom.h"
+#endif
+
+#if defined(OS_ANDROID)
+#include "services/device/public/mojom/nfc.mojom.h"
+#include "third_party/blink/public/mojom/hid/hid.mojom.h"
+#endif
 
 namespace content {
 namespace internal {
 
+namespace {
+
+// Forwards service receivers to Service Manager since the renderer cannot
+// launch out-of-process services on is own.
+template <typename Interface>
+void ForwardServiceReceiver(const char* service_name,
+                            RenderFrameHostImpl* host,
+                            mojo::PendingReceiver<Interface> receiver) {
+  auto* connector =
+      BrowserContext::GetConnectorFor(host->GetProcess()->GetBrowserContext());
+  connector->Connect(service_name, std::move(receiver));
+}
+
+void BindShapeDetectionServiceOnIOThread(
+    mojo::PendingReceiver<shape_detection::mojom::ShapeDetectionService>
+        receiver) {
+  auto* gpu = GpuProcessHost::Get();
+  if (gpu)
+    gpu->RunService(std::move(receiver));
+}
+
+shape_detection::mojom::ShapeDetectionService* GetShapeDetectionService() {
+  static base::NoDestructor<
+      mojo::Remote<shape_detection::mojom::ShapeDetectionService>>
+      remote;
+  if (!*remote) {
+    base::PostTask(FROM_HERE, {BrowserThread::IO},
+                   base::BindOnce(&BindShapeDetectionServiceOnIOThread,
+                                  remote->BindNewPipeAndPassReceiver()));
+    remote->reset_on_disconnect();
+  }
+
+  return remote->get();
+}
+
+void BindBarcodeDetectionProvider(
+    mojo::PendingReceiver<shape_detection::mojom::BarcodeDetectionProvider>
+        receiver) {
+  GetShapeDetectionService()->BindBarcodeDetectionProvider(std::move(receiver));
+}
+
+void BindFaceDetectionProvider(
+    mojo::PendingReceiver<shape_detection::mojom::FaceDetectionProvider>
+        receiver) {
+  GetShapeDetectionService()->BindFaceDetectionProvider(std::move(receiver));
+}
+
+void BindTextDetection(
+    mojo::PendingReceiver<shape_detection::mojom::TextDetection> receiver) {
+  GetShapeDetectionService()->BindTextDetection(std::move(receiver));
+}
+
+#if !defined(OS_ANDROID)
+bool AreExperimentalWebPlatformFeaturesEnabled() {
+  auto* command_line = base::CommandLine::ForCurrentProcess();
+  return command_line->HasSwitch(
+      switches::kEnableExperimentalWebPlatformFeatures);
+}
+#endif
+}  // namespace
+
 // Documents/frames
 void PopulateFrameBinders(RenderFrameHostImpl* host,
                           service_manager::BinderMap* map) {
@@ -28,17 +159,135 @@ void PopulateFrameBinders(RenderFrameHostImpl* host,
   map->Add<blink::mojom::AudioContextManager>(base::BindRepeating(
       &RenderFrameHostImpl::GetAudioContextManager, base::Unretained(host)));
 
+  map->Add<blink::mojom::ContactsManager>(base::BindRepeating(
+      &RenderFrameHostImpl::GetContactsManager, base::Unretained(host)));
+
   map->Add<blink::mojom::FileSystemManager>(base::BindRepeating(
       &RenderFrameHostImpl::GetFileSystemManager, base::Unretained(host)));
 
   map->Add<blink::mojom::IdleManager>(base::BindRepeating(
       &RenderFrameHostImpl::GetIdleManager, base::Unretained(host)));
 
+  map->Add<blink::mojom::PermissionService>(base::BindRepeating(
+      &RenderFrameHostImpl::CreatePermissionService, base::Unretained(host)));
+
+  map->Add<blink::mojom::PresentationService>(base::BindRepeating(
+      &RenderFrameHostImpl::GetPresentationService, base::Unretained(host)));
+
+  map->Add<blink::mojom::SpeechRecognizer>(
+      base::BindRepeating(&SpeechRecognitionDispatcherHost::Create,
+                          host->GetProcess()->GetID(), host->GetRoutingID()),
+      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
+
   map->Add<blink::mojom::SpeechSynthesis>(base::BindRepeating(
       &RenderFrameHostImpl::GetSpeechSynthesis, base::Unretained(host)));
 
   map->Add<blink::mojom::ScreenEnumeration>(
       base::BindRepeating(&ScreenEnumerationImpl::Create));
+
+  if (base::FeatureList::IsEnabled(features::kSmsReceiver)) {
+    map->Add<blink::mojom::SmsReceiver>(base::BindRepeating(
+        &RenderFrameHostImpl::BindSmsReceiverReceiver, base::Unretained(host)));
+  }
+
+  map->Add<blink::mojom::WebUsbService>(base::BindRepeating(
+      &RenderFrameHostImpl::CreateWebUsbService, base::Unretained(host)));
+
+  map->Add<blink::mojom::LockManager>(base::BindRepeating(
+      &RenderFrameHostImpl::CreateLockManager, base::Unretained(host)));
+
+  map->Add<blink::mojom::IDBFactory>(base::BindRepeating(
+      &RenderFrameHostImpl::CreateIDBFactory, base::Unretained(host)));
+
+  map->Add<blink::mojom::FileChooser>(base::BindRepeating(
+      &RenderFrameHostImpl::GetFileChooser, base::Unretained(host)));
+
+  map->Add<device::mojom::GamepadMonitor>(
+      base::BindRepeating(&device::GamepadMonitor::Create));
+
+  map->Add<device::mojom::SensorProvider>(base::BindRepeating(
+      &RenderFrameHostImpl::GetSensorProvider, base::Unretained(host)));
+
+  map->Add<device::mojom::VibrationManager>(base::BindRepeating(
+      &ForwardServiceReceiver<device::mojom::VibrationManager>,
+      device::mojom::kServiceName, base::Unretained(host)));
+
+  map->Add<payments::mojom::PaymentManager>(base::BindRepeating(
+      &RenderFrameHostImpl::CreatePaymentManager, base::Unretained(host)));
+
+  map->Add<blink::mojom::WebBluetoothService>(base::BindRepeating(
+      &RenderFrameHostImpl::CreateWebBluetoothService, base::Unretained(host)));
+
+  map->Add<blink::mojom::PushMessaging>(base::BindRepeating(
+      &RenderFrameHostImpl::GetPushMessaging, base::Unretained(host)));
+
+  map->Add<blink::mojom::CredentialManager>(base::BindRepeating(
+      &RenderFrameHostImpl::GetCredentialManager, base::Unretained(host)));
+
+  map->Add<blink::mojom::Authenticator>(base::BindRepeating(
+      &RenderFrameHostImpl::GetAuthenticator, base::Unretained(host)));
+
+  map->Add<blink::test::mojom::VirtualAuthenticatorManager>(
+      base::BindRepeating(&RenderFrameHostImpl::GetVirtualAuthenticatorManager,
+                          base::Unretained(host)));
+
+  // BrowserMainLoop::GetInstance() may be null on unit tests.
+  if (BrowserMainLoop::GetInstance()) {
+    // BrowserMainLoop, which owns MediaStreamManager, is alive for the lifetime
+    // of Mojo communication (see BrowserMainLoop::ShutdownThreadsAndCleanUp(),
+    // which shuts down Mojo). Hence, passing that MediaStreamManager instance
+    // as a raw pointer here is safe.
+    MediaStreamManager* media_stream_manager =
+        BrowserMainLoop::GetInstance()->media_stream_manager();
+
+    map->Add<blink::mojom::MediaDevicesDispatcherHost>(
+        base::BindRepeating(&MediaDevicesDispatcherHost::Create,
+                            host->GetProcess()->GetID(), host->GetRoutingID(),
+                            base::Unretained(media_stream_manager)),
+        base::CreateSingleThreadTaskRunner(BrowserThread::IO));
+
+    map->Add<blink::mojom::MediaStreamDispatcherHost>(
+        base::BindRepeating(&MediaStreamDispatcherHost::Create,
+                            host->GetProcess()->GetID(), host->GetRoutingID(),
+                            base::Unretained(media_stream_manager)),
+        base::CreateSingleThreadTaskRunner(BrowserThread::IO));
+  }
+
+  map->Add<media::mojom::ImageCapture>(
+      base::BindRepeating(&ImageCaptureImpl::Create));
+
+  map->Add<media::mojom::VideoDecodePerfHistory>(
+      base::BindRepeating(&RenderProcessHost::BindVideoDecodePerfHistory,
+                          base::Unretained(host->GetProcess())));
+
+  map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
+      base::BindRepeating(&BindBarcodeDetectionProvider));
+
+  map->Add<shape_detection::mojom::FaceDetectionProvider>(
+      base::BindRepeating(&BindFaceDetectionProvider));
+
+  map->Add<shape_detection::mojom::TextDetection>(
+      base::BindRepeating(&BindTextDetection));
+
+#if defined(OS_ANDROID)
+  if (base::FeatureList::IsEnabled(features::kWebNfc)) {
+    map->Add<device::mojom::NFC>(base::BindRepeating(
+        &RenderFrameHostImpl::BindNFCReceiver, base::Unretained(host)));
+  }
+#else
+  map->Add<blink::mojom::HidService>(base::BindRepeating(
+      &RenderFrameHostImpl::GetHidService, base::Unretained(host)));
+
+  // The default (no-op) implementation of InstalledAppProvider. On Android, the
+  // real implementation is provided in Java.
+  map->Add<blink::mojom::InstalledAppProvider>(
+      base::BindRepeating(&InstalledAppProviderImplDefault::Create));
+
+  if (AreExperimentalWebPlatformFeaturesEnabled()) {
+    map->Add<blink::mojom::SerialService>(base::BindRepeating(
+        &RenderFrameHostImpl::BindSerialService, base::Unretained(host)));
+  }
+#endif  // !defined(OS_ANDROID)
 }
 
 void PopulateBinderMapWithContext(
@@ -46,6 +295,21 @@ void PopulateBinderMapWithContext(
     service_manager::BinderMapWithContext<RenderFrameHost*>* map) {
   map->Add<blink::mojom::BackgroundFetchService>(
       base::BindRepeating(&BackgroundFetchServiceImpl::CreateForFrame));
+  map->Add<blink::mojom::CookieStore>(
+      base::BindRepeating(&CookieStoreContext::CreateServiceForFrame));
+  map->Add<blink::mojom::ContentIndexService>(
+      base::BindRepeating(&ContentIndexServiceImpl::CreateForFrame));
+  map->Add<blink::mojom::KeyboardLockService>(
+      base::BindRepeating(&KeyboardLockServiceImpl::CreateMojoService));
+  map->Add<blink::mojom::MediaSessionService>(
+      base::BindRepeating(&MediaSessionServiceImpl::Create));
+  map->Add<blink::mojom::PictureInPictureService>(
+      base::BindRepeating(&PictureInPictureServiceImpl::Create));
+  map->Add<blink::mojom::WakeLockService>(
+      base::BindRepeating(&WakeLockServiceImpl::Create));
+  map->Add<device::mojom::VRService>(
+      base::BindRepeating(&WebvrServiceProvider::BindWebvrService));
+
   GetContentClient()->browser()->RegisterBrowserInterfaceBindersForFrame(map);
 }
 
@@ -73,11 +337,44 @@ void PopulateDedicatedWorkerBinders(DedicatedWorkerHost* host,
       &DedicatedWorkerHost::CreateIdleManager, base::Unretained(host)));
   map->Add<blink::mojom::ScreenEnumeration>(
       base::BindRepeating(&ScreenEnumerationImpl::Create));
+
+  if (base::FeatureList::IsEnabled(features::kSmsReceiver)) {
+    map->Add<blink::mojom::SmsReceiver>(base::BindRepeating(
+        &DedicatedWorkerHost::BindSmsReceiverReceiver, base::Unretained(host)));
+  }
+  map->Add<blink::mojom::WebUsbService>(base::BindRepeating(
+      &DedicatedWorkerHost::CreateWebUsbService, base::Unretained(host)));
+  map->Add<media::mojom::VideoDecodePerfHistory>(
+      base::BindRepeating(&DedicatedWorkerHost::BindVideoDecodePerfHistory,
+                          base::Unretained(host)));
+  map->Add<payments::mojom::PaymentManager>(base::BindRepeating(
+      &DedicatedWorkerHost::CreatePaymentManager, base::Unretained(host)));
+  map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
+      base::BindRepeating(&BindBarcodeDetectionProvider));
+  map->Add<shape_detection::mojom::FaceDetectionProvider>(
+      base::BindRepeating(&BindFaceDetectionProvider));
+  map->Add<shape_detection::mojom::TextDetection>(
+      base::BindRepeating(&BindTextDetection));
+  map->Add<blink::mojom::IDBFactory>(base::BindRepeating(
+      &DedicatedWorkerHost::CreateIDBFactory, base::Unretained(host)));
+
+#if !defined(OS_ANDROID)
+  if (AreExperimentalWebPlatformFeaturesEnabled()) {
+    map->Add<blink::mojom::SerialService>(base::BindRepeating(
+        &DedicatedWorkerHost::BindSerialService, base::Unretained(host)));
+  }
+#endif  // !defined(OS_ANDROID)
 }
 
 void PopulateBinderMapWithContext(
     DedicatedWorkerHost* host,
     service_manager::BinderMapWithContext<const url::Origin&>* map) {
+  map->Add<blink::mojom::LockManager>(base::BindRepeating(
+      &RenderProcessHost::CreateLockManager,
+      base::Unretained(host->GetProcessHost()), MSG_ROUTING_NONE));
+  map->Add<blink::mojom::PermissionService>(
+      base::BindRepeating(&RenderProcessHost::CreatePermissionService,
+                          base::Unretained(host->GetProcessHost())));
 }
 
 void PopulateBinderMap(DedicatedWorkerHost* host,
@@ -98,6 +395,18 @@ void PopulateSharedWorkerBinders(SharedWorkerHost* host,
       &SharedWorkerHost::CreateAppCacheBackend, base::Unretained(host)));
   map->Add<blink::mojom::ScreenEnumeration>(
       base::BindRepeating(&ScreenEnumerationImpl::Create));
+  map->Add<media::mojom::VideoDecodePerfHistory>(base::BindRepeating(
+      &SharedWorkerHost::BindVideoDecodePerfHistory, base::Unretained(host)));
+  map->Add<payments::mojom::PaymentManager>(base::BindRepeating(
+      &SharedWorkerHost::CreatePaymentManager, base::Unretained(host)));
+  map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
+      base::BindRepeating(&BindBarcodeDetectionProvider));
+  map->Add<shape_detection::mojom::FaceDetectionProvider>(
+      base::BindRepeating(&BindFaceDetectionProvider));
+  map->Add<shape_detection::mojom::TextDetection>(
+      base::BindRepeating(&BindTextDetection));
+  map->Add<blink::mojom::IDBFactory>(base::BindRepeating(
+      &SharedWorkerHost::CreateIDBFactory, base::Unretained(host)));
 }
 
 void PopulateBinderMapWithContext(
@@ -107,6 +416,12 @@ void PopulateBinderMapWithContext(
   map->Add<blink::mojom::FileSystemManager>(
       base::BindRepeating(&RenderProcessHost::BindFileSystemManager,
                           base::Unretained(host->GetProcessHost())));
+  map->Add<blink::mojom::LockManager>(base::BindRepeating(
+      &RenderProcessHost::CreateLockManager,
+      base::Unretained(host->GetProcessHost()), MSG_ROUTING_NONE));
+  map->Add<blink::mojom::PermissionService>(
+      base::BindRepeating(&RenderProcessHost::CreatePermissionService,
+                          base::Unretained(host->GetProcessHost())));
 }
 
 void PopulateBinderMap(SharedWorkerHost* host,
@@ -126,6 +441,33 @@ void PopulateServiceWorkerBinders(ServiceWorkerProviderHost* host,
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   map->Add<blink::mojom::ScreenEnumeration>(
       base::BindRepeating(&ScreenEnumerationImpl::Create));
+
+  map->Add<blink::mojom::LockManager>(base::BindRepeating(
+      &ServiceWorkerProviderHost::CreateLockManager, base::Unretained(host)));
+
+  map->Add<blink::mojom::IDBFactory>(base::BindRepeating(
+      &ServiceWorkerProviderHost::CreateIDBFactory, base::Unretained(host)));
+
+  map->Add<blink::mojom::PermissionService>(
+      base::BindRepeating(&ServiceWorkerProviderHost::CreatePermissionService,
+                          base::Unretained(host)));
+
+  map->Add<media::mojom::VideoDecodePerfHistory>(base::BindRepeating(
+      &ServiceWorkerProviderHost::BindVideoDecodePerfHistory,
+      base::Unretained(host)));
+
+  map->Add<payments::mojom::PaymentManager>(
+      base::BindRepeating(&ServiceWorkerProviderHost::CreatePaymentManager,
+                          base::Unretained(host)));
+
+  map->Add<shape_detection::mojom::BarcodeDetectionProvider>(
+      base::BindRepeating(&BindBarcodeDetectionProvider));
+
+  map->Add<shape_detection::mojom::FaceDetectionProvider>(
+      base::BindRepeating(&BindFaceDetectionProvider));
+
+  map->Add<shape_detection::mojom::TextDetection>(
+      base::BindRepeating(&BindTextDetection));
 }
 
 void PopulateBinderMapWithContext(
@@ -139,10 +481,20 @@ void PopulateBinderMapWithContext(
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     map->Add<blink::mojom::BackgroundFetchService>(
         base::BindRepeating(&BackgroundFetchServiceImpl::CreateForWorker));
+    map->Add<blink::mojom::ContentIndexService>(
+        base::BindRepeating(&ContentIndexServiceImpl::CreateForWorker));
+    map->Add<blink::mojom::CookieStore>(
+        base::BindRepeating(&CookieStoreContext::CreateServiceForWorker));
   } else {
     map->Add<blink::mojom::BackgroundFetchService>(
         base::BindRepeating(&BackgroundFetchServiceImpl::CreateForWorker),
-        base::CreateSingleThreadTaskRunnerWithTraits(BrowserThread::UI));
+        base::CreateSingleThreadTaskRunner(BrowserThread::UI));
+    map->Add<blink::mojom::ContentIndexService>(
+        base::BindRepeating(&ContentIndexServiceImpl::CreateForWorker),
+        base::CreateSingleThreadTaskRunner(BrowserThread::UI));
+    map->Add<blink::mojom::CookieStore>(
+        base::BindRepeating(&CookieStoreContext::CreateServiceForWorker),
+        base::CreateSingleThreadTaskRunner(BrowserThread::UI));
   }
 }
 
diff --git a/chromium/content/browser/browser_main_loop.cc b/chromium/content/browser/browser_main_loop.cc
index 3f0931ad906..8e0720f9508 100644
--- a/chromium/content/browser/browser_main_loop.cc
+++ b/chromium/content/browser/browser_main_loop.cc
@@ -21,6 +21,7 @@
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/memory/memory_pressure_monitor.h"
+#include "base/memory/ptr_util.h"
 #include "base/message_loop/message_loop.h"
 #include "base/message_loop/message_loop_current.h"
 #include "base/metrics/field_trial.h"
@@ -79,6 +80,7 @@
 #include "content/browser/media/media_internals.h"
 #include "content/browser/media/media_keys_listener_manager_impl.h"
 #include "content/browser/net/browser_online_state_observer.h"
+#include "content/browser/network_service_instance_impl.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/scheduler/browser_task_executor.h"
@@ -102,6 +104,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/gpu_data_manager_observer.h"
+#include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/system_connector.h"
@@ -366,14 +369,20 @@ std::unique_ptr<base::MemoryPressureMonitor> CreateMemoryPressureMonitor(
   if (command_line.HasSwitch(switches::kBrowserTest))
     return nullptr;
 
+  std::unique_ptr<util::MultiSourceMemoryPressureMonitor> monitor;
+
 #if defined(OS_CHROMEOS)
   if (chromeos::switches::MemoryPressureHandlingEnabled())
-    return std::make_unique<util::MultiSourceMemoryPressureMonitor>();
+    monitor = std::make_unique<util::MultiSourceMemoryPressureMonitor>();
 #elif defined(OS_MACOSX) || defined(OS_WIN)
-  return std::make_unique<util::MultiSourceMemoryPressureMonitor>();
+  monitor = std::make_unique<util::MultiSourceMemoryPressureMonitor>();
 #endif
   // No memory monitor on other platforms...
-  return nullptr;
+
+  if (monitor)
+    monitor->Start();
+
+  return monitor;
 }
 
 #if defined(OS_CHROMEOS)
@@ -705,8 +714,7 @@ void BrowserMainLoop::PostMainMessageLoopStart() {
     TRACE_EVENT0("startup", "BrowserMainLoop::Subsystem:NetworkChangeNotifier");
     // On Android if reduced mode started network service this would already be
     //  created.
-    if (!net::NetworkChangeNotifier::HasNetworkChangeNotifier())
-      network_change_notifier_ = net::NetworkChangeNotifier::Create();
+    network_change_notifier_ = net::NetworkChangeNotifier::CreateIfNeeded();
   }
   {
     TRACE_EVENT0("startup", "BrowserMainLoop::Subsystem:ScreenlockMonitor");
@@ -883,23 +891,23 @@ void BrowserMainLoop::CreateStartupTasks() {
   startup_task_runner_ = std::make_unique<StartupTaskRunner>(
       base::OnceCallback<void(int)>(), base::ThreadTaskRunnerHandle::Get());
 #endif
-  StartupTask pre_create_threads =
-      base::Bind(&BrowserMainLoop::PreCreateThreads, base::Unretained(this));
+  StartupTask pre_create_threads = base::BindOnce(
+      &BrowserMainLoop::PreCreateThreads, base::Unretained(this));
   startup_task_runner_->AddTask(std::move(pre_create_threads));
 
   StartupTask create_threads =
-      base::Bind(&BrowserMainLoop::CreateThreads, base::Unretained(this));
+      base::BindOnce(&BrowserMainLoop::CreateThreads, base::Unretained(this));
   startup_task_runner_->AddTask(std::move(create_threads));
 
-  StartupTask post_create_threads =
-      base::Bind(&BrowserMainLoop::PostCreateThreads, base::Unretained(this));
+  StartupTask post_create_threads = base::BindOnce(
+      &BrowserMainLoop::PostCreateThreads, base::Unretained(this));
   startup_task_runner_->AddTask(std::move(post_create_threads));
 
-  StartupTask browser_thread_started = base::Bind(
+  StartupTask browser_thread_started = base::BindOnce(
       &BrowserMainLoop::BrowserThreadsStarted, base::Unretained(this));
   startup_task_runner_->AddTask(std::move(browser_thread_started));
 
-  StartupTask pre_main_message_loop_run = base::Bind(
+  StartupTask pre_main_message_loop_run = base::BindOnce(
       &BrowserMainLoop::PreMainMessageLoopRun, base::Unretained(this));
   startup_task_runner_->AddTask(std::move(pre_main_message_loop_run));
 
@@ -1083,6 +1091,8 @@ void BrowserMainLoop::ShutdownThreadsAndCleanUp() {
 
   memory_pressure_monitor_.reset();
 
+  ShutDownNetworkService();
+
 #if defined(OS_MACOSX)
   BrowserCompositorMac::DisableRecyclingForShutdown();
 #endif
@@ -1193,13 +1203,13 @@ viz::ServerSharedBitmapManager* BrowserMainLoop::GetServerSharedBitmapManager()
 #endif
 
 void BrowserMainLoop::GetCompositingModeReporter(
-    viz::mojom::CompositingModeReporterRequest request) {
+    mojo::PendingReceiver<viz::mojom::CompositingModeReporter> receiver) {
 #if defined(OS_ANDROID)
   // Android doesn't support non-gpu compositing modes, and doesn't make a
   // CompositingModeReporter.
   return;
 #else
-  compositing_mode_reporter_impl_->BindRequest(std::move(request));
+  compositing_mode_reporter_impl_->BindReceiver(std::move(receiver));
 #endif
 }
 
@@ -1416,8 +1426,8 @@ int BrowserMainLoop::BrowserThreadsStarted() {
     // The default is to delay the secondary GPU process for 120 seconds.
     bool delayed = !parsed_command_line_.HasSwitch(
         switches::kNoDelayForDX12VulkanInfoCollection);
-    GpuDataManagerImpl::GetInstance()->RequestGpuSupportedRuntimeVersion(
-        delayed);
+    GpuDataManagerImpl::GetInstance()->RequestDxdiagDx12VulkanGpuInfoIfNeeded(
+        kGpuInfoRequestDx12Vulkan, delayed);
   }
 
 #endif
diff --git a/chromium/content/browser/browser_main_loop.h b/chromium/content/browser/browser_main_loop.h
index 306dfc80bf5..7af714d9c57 100644
--- a/chromium/content/browser/browser_main_loop.h
+++ b/chromium/content/browser/browser_main_loop.h
@@ -217,9 +217,9 @@ class CONTENT_EXPORT BrowserMainLoop {
   viz::ServerSharedBitmapManager* GetServerSharedBitmapManager() const;
 #endif
 
-  // Fulfills a mojo pointer to the singleton CompositingModeReporter.
+  // Binds a receiver to the singleton CompositingModeReporter.
   void GetCompositingModeReporter(
-      viz::mojom::CompositingModeReporterRequest request);
+      mojo::PendingReceiver<viz::mojom::CompositingModeReporter> receiver);
 
 #if defined(OS_MACOSX) && !defined(OS_IOS)
   media::DeviceMonitorMac* device_monitor_mac() const {
diff --git a/chromium/content/browser/browser_main_loop_unittest.cc b/chromium/content/browser/browser_main_loop_unittest.cc
index b26e641f772..b7a796057ad 100644
--- a/chromium/content/browser/browser_main_loop_unittest.cc
+++ b/chromium/content/browser/browser_main_loop_unittest.cc
@@ -75,6 +75,7 @@ TEST_F(BrowserMainLoopTest, CreateThreadsInSingleProcess) {
                     {base::ThreadPool(), base::TaskPriority::USER_VISIBLE}),
             base::SysInfo::NumberOfProcessors() - 1);
   browser_main_loop.ShutdownThreadsAndCleanUp();
+  BrowserTaskExecutor::ResetForTesting();
 }
 
 TEST_F(BrowserMainLoopTest,
@@ -104,6 +105,7 @@ TEST_F(BrowserMainLoopTest,
   content::RunAllPendingInMessageLoop(BrowserThread::IO);
 
   browser_main_loop.ShutdownThreadsAndCleanUp();
+  BrowserTaskExecutor::ResetForTesting();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/browser_main_runner_impl.cc b/chromium/content/browser/browser_main_runner_impl.cc
index ec00bd53ac2..b9b31076a8c 100644
--- a/chromium/content/browser/browser_main_runner_impl.cc
+++ b/chromium/content/browser/browser_main_runner_impl.cc
@@ -28,6 +28,7 @@
 #include "content/public/common/main_function_params.h"
 #include "third_party/skia/include/core/SkGraphics.h"
 #include "ui/base/ime/init/input_method_initializer.h"
+#include "ui/gfx/font_util.h"
 
 #if defined(OS_ANDROID)
 #include "content/browser/android/tracing_controller_android.h"
@@ -36,7 +37,6 @@
 #if defined(OS_WIN)
 #include "base/win/windows_version.h"
 #include "ui/base/win/scoped_ole_initializer.h"
-#include "ui/gfx/win/direct_write.h"
 #endif
 
 namespace content {
@@ -91,9 +91,10 @@ int BrowserMainRunnerImpl::Initialize(const MainFunctionParams& parameters) {
     // (Text Services Framework) module can interact with the message pump
     // on Windows 8 Metro mode.
     ole_initializer_.reset(new ui::ScopedOleInitializer);
-    gfx::win::InitializeDirectWrite();
 #endif  // OS_WIN
 
+    gfx::InitializeFonts();
+
     main_loop_.reset(
         new BrowserMainLoop(parameters, std::move(scoped_execution_fence_)));
 
diff --git a/chromium/content/browser/browser_thread_unittest.cc b/chromium/content/browser/browser_thread_unittest.cc
index 4ec26451713..1bd0d55c4ac 100644
--- a/chromium/content/browser/browser_thread_unittest.cc
+++ b/chromium/content/browser/browser_thread_unittest.cc
@@ -43,17 +43,18 @@ using StrictMockTask =
 class SequenceManagerThreadDelegate : public base::Thread::Delegate {
  public:
   SequenceManagerThreadDelegate() {
-    sequence_manager_ =
+    ui_sequence_manager_ =
         base::sequence_manager::internal::SequenceManagerImpl::CreateUnbound(
             base::sequence_manager::SequenceManager::Settings());
     auto browser_ui_thread_scheduler =
         BrowserUIThreadScheduler::CreateForTesting(
-            sequence_manager_.get(), sequence_manager_->GetRealTimeDomain());
+            ui_sequence_manager_.get(),
+            ui_sequence_manager_->GetRealTimeDomain());
 
     default_task_runner_ =
         browser_ui_thread_scheduler->GetHandle()->GetDefaultTaskRunner();
 
-    sequence_manager_->SetDefaultTaskRunner(default_task_runner_);
+    ui_sequence_manager_->SetDefaultTaskRunner(default_task_runner_);
 
     BrowserTaskExecutor::CreateForTesting(
         std::move(browser_ui_thread_scheduler),
@@ -71,13 +72,14 @@ class SequenceManagerThreadDelegate : public base::Thread::Delegate {
   }
 
   void BindToCurrentThread(base::TimerSlack timer_slack) override {
-    sequence_manager_->BindToMessagePump(
+    ui_sequence_manager_->BindToMessagePump(
         base::MessagePump::Create(base::MessagePumpType::DEFAULT));
-    sequence_manager_->SetTimerSlack(timer_slack);
+    ui_sequence_manager_->SetTimerSlack(timer_slack);
+    BrowserTaskExecutor::BindToUIThreadForTesting();
   }
 
  private:
-  std::unique_ptr<base::sequence_manager::SequenceManager> sequence_manager_;
+  std::unique_ptr<base::sequence_manager::SequenceManager> ui_sequence_manager_;
   scoped_refptr<base::SingleThreadTaskRunner> default_task_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(SequenceManagerThreadDelegate);
@@ -116,6 +118,7 @@ class BrowserThreadTest : public testing::Test {
 
     BrowserThreadImpl::ResetGlobalsForTesting(BrowserThread::UI);
     BrowserThreadImpl::ResetGlobalsForTesting(BrowserThread::IO);
+    BrowserTaskExecutor::ResetForTesting();
   }
 
   // Prepares this BrowserThreadTest for Release() to be invoked. |on_release|
@@ -284,7 +287,7 @@ TEST_F(BrowserThreadTest, PostTaskAndReply) {
   run_loop.Run();
 }
 
-TEST_F(BrowserThreadTest, RunsTasksInCurrentSequencedDuringShutdown) {
+TEST_F(BrowserThreadTest, RunsTasksInCurrentSequenceDuringShutdown) {
   bool did_shutdown = false;
   base::RunLoop loop;
   UIThreadDestructionObserver observer(&did_shutdown, loop.QuitClosure());
diff --git a/chromium/content/browser/browser_url_handler_impl.cc b/chromium/content/browser/browser_url_handler_impl.cc
index 5f6d1f29938..13dadc21794 100644
--- a/chromium/content/browser/browser_url_handler_impl.cc
+++ b/chromium/content/browser/browser_url_handler_impl.cc
@@ -11,6 +11,7 @@
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/webui/web_ui_impl.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "url/gurl.h"
diff --git a/chromium/content/browser/browsing_data/browsing_data_browsertest_utils.cc b/chromium/content/browser/browsing_data/browsing_data_browsertest_utils.cc
index b0b12d413aa..61ee6f49e8e 100644
--- a/chromium/content/browser/browsing_data/browsing_data_browsertest_utils.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_browsertest_utils.cc
@@ -15,16 +15,17 @@
 #include "components/network_session_configurator/common/network_switches.h"
 #include "content/browser/browsing_data/browsing_data_test_utils.h"
 #include "content/public/browser/browser_task_traits.h"
+#include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/storage_usage_info.h"
-#include "content/public/browser/system_connector.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
-#include "content/public/common/service_names.mojom.h"
 #include "content/public/test/content_browser_test_utils.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/url_util.h"
 #include "net/test/embedded_test_server/http_response.h"
+#include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/network_service_test.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -104,7 +105,7 @@ void AddServiceWorker(const std::string& origin,
       FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
       base::BindOnce(&ServiceWorkerContextWrapper::RegisterServiceWorker,
                      base::Unretained(service_worker_context), js_url, options,
-                     base::Bind(&AddServiceWorkerCallback)));
+                     base::BindOnce(&AddServiceWorkerCallback)));
 
   // Wait for its activation.
   base::RunLoop run_loop;
@@ -131,8 +132,8 @@ std::vector<StorageUsageInfo> GetServiceWorkers(
       base::BindOnce(
           &ServiceWorkerContextWrapper::GetAllOriginsInfo,
           base::Unretained(service_worker_context),
-          base::Bind(&GetServiceWorkersCallback, run_loop.QuitClosure(),
-                     base::Unretained(&service_workers))));
+          base::BindOnce(&GetServiceWorkersCallback, run_loop.QuitClosure(),
+                         base::Unretained(&service_workers))));
   run_loop.Run();
 
   return service_workers;
@@ -163,9 +164,9 @@ void SetResponseContent(const GURL& url,
 }
 
 void SetUpMockCertVerifier(int32_t default_result) {
-  network::mojom::NetworkServiceTestPtr network_service_test;
-  GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                      &network_service_test);
+  mojo::Remote<network::mojom::NetworkServiceTest> network_service_test;
+  GetNetworkService()->BindTestInterface(
+      network_service_test.BindNewPipeAndPassReceiver());
 
   base::RunLoop run_loop(base::RunLoop::Type::kNestableTasksAllowed);
   network_service_test->MockCertVerifierSetDefaultResult(
diff --git a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc
index fd1a877a071..c1a83d3ee7e 100644
--- a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl.cc
@@ -81,8 +81,9 @@ BrowsingDataFilterBuilder::Create(Mode mode) {
 }
 
 // static
-base::Callback<bool(const GURL&)> BrowsingDataFilterBuilder::BuildNoopFilter() {
-  return base::Bind([](const GURL&) { return true; });
+base::RepeatingCallback<bool(const GURL&)>
+BrowsingDataFilterBuilder::BuildNoopFilter() {
+  return base::BindRepeating([](const GURL&) { return true; });
 }
 
 BrowsingDataFilterBuilderImpl::BrowsingDataFilterBuilderImpl(Mode mode)
diff --git a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc
index 515fcf72459..b30d0638a4f 100644
--- a/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_filter_builder_impl_unittest.cc
@@ -46,7 +46,7 @@ struct TestCase {
 };
 
 void RunTestCase(TestCase test_case,
-                 const base::Callback<bool(const GURL&)>& filter) {
+                 const base::RepeatingCallback<bool(const GURL&)>& filter) {
   GURL url(test_case.url);
   EXPECT_TRUE(url.is_valid()) << test_case.url << " is not valid.";
   EXPECT_EQ(test_case.should_match, filter.Run(GURL(test_case.url)))
@@ -97,7 +97,7 @@ void RunTestCase(TestCase test_case,
 
 void RunTestCase(
     TestCase test_case,
-    const base::Callback<bool(const std::string&)>& filter) {
+    const base::RepeatingCallback<bool(const std::string&)>& filter) {
   std::string channel_id_server_id = test_case.url;
   EXPECT_EQ(test_case.should_match, filter.Run(channel_id_server_id))
       << channel_id_server_id << " should "
@@ -108,7 +108,7 @@ void RunTestCase(
 
 TEST(BrowsingDataFilterBuilderImplTest, Noop) {
   // An no-op filter matches everything.
-  base::Callback<bool(const GURL&)> filter =
+  base::RepeatingCallback<bool(const GURL&)> filter =
       BrowsingDataFilterBuilder::BuildNoopFilter();
 
   TestCase test_cases[] = {
@@ -131,7 +131,8 @@ TEST(BrowsingDataFilterBuilderImplTest,
   builder.AddRegisterableDomain(std::string(kIPAddress));
   builder.AddRegisterableDomain(std::string(kUnknownRegistryDomain));
   builder.AddRegisterableDomain(std::string(kInternalHostname));
-  base::Callback<bool(const GURL&)> filter = builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter =
+      builder.BuildGeneralFilter();
 
   TestCase test_cases[] = {
       // We match any URL on the specified domains.
@@ -176,7 +177,8 @@ TEST(BrowsingDataFilterBuilderImplTest,
   builder.AddRegisterableDomain(std::string(kIPAddress));
   builder.AddRegisterableDomain(std::string(kUnknownRegistryDomain));
   builder.AddRegisterableDomain(std::string(kInternalHostname));
-  base::Callback<bool(const GURL&)> filter = builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter =
+      builder.BuildGeneralFilter();
 
   TestCase test_cases[] = {
       // We match any URL that are not on the specified domains.
@@ -359,7 +361,7 @@ TEST(BrowsingDataFilterBuilderImplTest,
   builder.AddRegisterableDomain(std::string(kIPAddress));
   builder.AddRegisterableDomain(std::string(kUnknownRegistryDomain));
   builder.AddRegisterableDomain(std::string(kInternalHostname));
-  base::Callback<bool(const std::string&)> filter =
+  base::RepeatingCallback<bool(const std::string&)> filter =
       builder.BuildPluginFilter();
 
   TestCase test_cases[] = {
@@ -394,7 +396,7 @@ TEST(BrowsingDataFilterBuilderImplTest,
   builder.AddRegisterableDomain(std::string(kIPAddress));
   builder.AddRegisterableDomain(std::string(kUnknownRegistryDomain));
   builder.AddRegisterableDomain(std::string(kInternalHostname));
-  base::Callback<bool(const std::string&)> filter =
+  base::RepeatingCallback<bool(const std::string&)> filter =
       builder.BuildPluginFilter();
 
   TestCase test_cases[] = {
@@ -425,7 +427,8 @@ TEST(BrowsingDataFilterBuilderImplTest, OriginWhitelist) {
       BrowsingDataFilterBuilderImpl::WHITELIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://www.google.com")));
   builder.AddOrigin(url::Origin::Create(GURL("http://www.example.com")));
-  base::Callback<bool(const GURL&)> filter = builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter =
+      builder.BuildGeneralFilter();
 
   TestCase test_cases[] = {
       // Whitelist matches any URL on the specified origins.
@@ -456,7 +459,8 @@ TEST(BrowsingDataFilterBuilderImplTest, OriginBlacklist) {
       BrowsingDataFilterBuilderImpl::BLACKLIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://www.google.com")));
   builder.AddOrigin(url::Origin::Create(GURL("http://www.example.com")));
-  base::Callback<bool(const GURL&)> filter = builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter =
+      builder.BuildGeneralFilter();
 
   TestCase test_cases[] = {
       // URLS on explicitly specified origins are not matched.
@@ -488,7 +492,8 @@ TEST(BrowsingDataFilterBuilderImplTest, CombinedWhitelist) {
       BrowsingDataFilterBuilderImpl::WHITELIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://google.com")));
   builder.AddRegisterableDomain("example.com");
-  base::Callback<bool(const GURL&)> filter = builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter =
+      builder.BuildGeneralFilter();
 
   TestCase test_cases[] = {
       // Whitelist matches any URL on the specified origins.
@@ -511,7 +516,8 @@ TEST(BrowsingDataFilterBuilderImplTest, CombinedBlacklist) {
       BrowsingDataFilterBuilderImpl::BLACKLIST);
   builder.AddOrigin(url::Origin::Create(GURL("https://google.com")));
   builder.AddRegisterableDomain("example.com");
-  base::Callback<bool(const GURL&)> filter = builder.BuildGeneralFilter();
+  base::RepeatingCallback<bool(const GURL&)> filter =
+      builder.BuildGeneralFilter();
 
   TestCase test_cases[] = {
       // URLS on explicitly specified origins are not matched.
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc b/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc
index f5da2215ed7..5fb07a0f068 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl.cc
@@ -36,6 +36,7 @@
 #include "storage/browser/quota/special_storage_policy.h"
 #include "url/gurl.h"
 #include "url/origin.h"
+#include "url/url_util.h"
 
 using base::UserMetricsAction;
 
@@ -360,7 +361,12 @@ void BrowsingDataRemoverImpl::RemoveImpl(
     storage_partition_remove_mask |=
         StoragePartition::REMOVE_DATA_MASK_BACKGROUND_FETCH;
   }
-
+  if (remove_mask & DATA_TYPE_CACHE) {
+    // Tell the shader disk cache to clear.
+    base::RecordAction(UserMetricsAction("ClearBrowsingData_ShaderCache"));
+    storage_partition_remove_mask |=
+        StoragePartition::REMOVE_DATA_MASK_SHADER_CACHE;
+  }
   // Content Decryption Modules used by Encrypted Media store licenses in a
   // private filesystem. These are different than content licenses used by
   // Flash (which are deleted father down in this method).
@@ -447,11 +453,6 @@ void BrowsingDataRemoverImpl::RemoveImpl(
 
     // Clears the PrefetchedSignedExchangeCache of all RenderFrameHostImpls.
     RenderFrameHostImpl::ClearAllPrefetchedSignedExchangeCache();
-
-    // Tell the shader disk cache to clear.
-    base::RecordAction(UserMetricsAction("ClearBrowsingData_ShaderCache"));
-    storage_partition_remove_mask |=
-        StoragePartition::REMOVE_DATA_MASK_SHADER_CACHE;
   }
 
 #if BUILDFLAG(ENABLE_REPORTING)
@@ -500,8 +501,8 @@ void BrowsingDataRemoverImpl::RemoveObserver(Observer* observer) {
 }
 
 void BrowsingDataRemoverImpl::SetWouldCompleteCallbackForTesting(
-    const base::Callback<void(const base::Closure& continue_to_completion)>&
-        callback) {
+    const base::RepeatingCallback<
+        void(base::OnceClosure continue_to_completion)>& callback) {
   would_complete_callback_ = callback;
 }
 
@@ -612,7 +613,7 @@ void BrowsingDataRemoverImpl::OnTaskComplete(TracingDataType data_type) {
 
   if (!would_complete_callback_.is_null()) {
     would_complete_callback_.Run(
-        base::Bind(&BrowsingDataRemoverImpl::Notify, GetWeakPtr()));
+        base::BindOnce(&BrowsingDataRemoverImpl::Notify, GetWeakPtr()));
     return;
   }
 
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl.h b/chromium/content/browser/browsing_data/browsing_data_remover_impl.h
index 8879c0f9058..6984b7c1344 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl.h
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl.h
@@ -73,8 +73,8 @@ class CONTENT_EXPORT BrowsingDataRemoverImpl
   void RemoveObserver(Observer* observer) override;
 
   void SetWouldCompleteCallbackForTesting(
-      const base::Callback<void(const base::Closure& continue_to_completion)>&
-          callback) override;
+      const base::RepeatingCallback<
+          void(base::OnceClosure continue_to_completion)>& callback) override;
 
   const base::Time& GetLastUsedBeginTime() override;
   const base::Time& GetLastUsedEndTime() override;
@@ -212,7 +212,7 @@ class CONTENT_EXPORT BrowsingDataRemoverImpl
   // If non-null, the |would_complete_callback_| is called each time an instance
   // is about to complete a browsing data removal process, and has the ability
   // to artificially delay completion. Used for testing.
-  base::Callback<void(const base::Closure& continue_to_completion)>
+  base::RepeatingCallback<void(base::OnceClosure continue_to_completion)>
       would_complete_callback_;
 
   // Records which tasks of a deletion are currently active.
diff --git a/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc b/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
index 6c1db542612..d31cb4f0071 100644
--- a/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_remover_impl_unittest.cc
@@ -1215,6 +1215,14 @@ TEST_F(BrowsingDataRemoverImplTest, RemoveCodeCache) {
   EXPECT_TRUE(removal_data.remove_code_cache);
 }
 
+TEST_F(BrowsingDataRemoverImplTest, RemoveShaderCache) {
+  BlockUntilBrowsingDataRemoved(base::Time(), base::Time::Max(),
+                                BrowsingDataRemover::DATA_TYPE_CACHE, false);
+  StoragePartitionRemovalData removal_data = GetStoragePartitionRemovalData();
+  EXPECT_EQ(removal_data.remove_mask,
+            StoragePartition::REMOVE_DATA_MASK_SHADER_CACHE);
+}
+
 class MultipleTasksObserver {
  public:
   // A simple implementation of BrowsingDataRemover::Observer.
diff --git a/chromium/content/browser/browsing_data/browsing_data_test_utils.cc b/chromium/content/browser/browsing_data/browsing_data_test_utils.cc
index 8d9f84e3ea3..c4e6d79215c 100644
--- a/chromium/content/browser/browsing_data/browsing_data_test_utils.cc
+++ b/chromium/content/browser/browsing_data/browsing_data_test_utils.cc
@@ -31,6 +31,7 @@ void CreateCookieForTest(
     const std::string& cookie_domain,
     net::CookieSameSite same_site,
     net::CookieOptions::SameSiteCookieContext cookie_context,
+    bool is_cookie_secure,
     BrowserContext* browser_context) {
   base::RunLoop run_loop;
   net::CookieOptions options;
@@ -39,8 +40,9 @@ void CreateCookieForTest(
   GetCookieManager(browser_context)
       ->SetCanonicalCookie(
           net::CanonicalCookie(cookie_name, "1", cookie_domain, "/",
-                               base::Time(), base::Time(), base::Time(), false,
-                               false, same_site, net::COOKIE_PRIORITY_LOW),
+                               base::Time(), base::Time(), base::Time(),
+                               is_cookie_secure, false, same_site,
+                               net::COOKIE_PRIORITY_LOW),
           "https", options,
           base::BindLambdaForTesting([&](CookieInclusionStatus result) {
             result_out = result.IsInclude();
diff --git a/chromium/content/browser/browsing_data/browsing_data_test_utils.h b/chromium/content/browser/browsing_data/browsing_data_test_utils.h
index 780715c6656..096ddab670b 100644
--- a/chromium/content/browser/browsing_data/browsing_data_test_utils.h
+++ b/chromium/content/browser/browsing_data/browsing_data_test_utils.h
@@ -21,6 +21,7 @@ void CreateCookieForTest(
     const std::string& cookie_domain,
     net::CookieSameSite same_site,
     net::CookieOptions::SameSiteCookieContext cookie_context,
+    bool is_cookie_secure,
     BrowserContext* browser_context);
 
 std::vector<net::CanonicalCookie> GetAllCookies(
diff --git a/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc b/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
index f6156fab1a2..81af7d6e157 100644
--- a/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
+++ b/chromium/content/browser/browsing_data/clear_site_data_handler_browsertest.cc
@@ -176,7 +176,7 @@ class ClearSiteDataHandlerBrowserTest : public ContentBrowserTest {
 
     base::RunLoop run_loop;
     cookie_manager->SetCanonicalCookie(
-        *cookie, url.scheme(), net::CookieOptions(),
+        *cookie, url.scheme(), net::CookieOptions::MakeAllInclusive(),
         base::BindOnce(&ClearSiteDataHandlerBrowserTest::AddCookieCallback,
                        run_loop.QuitClosure()));
     run_loop.Run();
@@ -368,7 +368,8 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
     AddQuery(&urls[0], "redirect", urls[1].spec());
 
     // Navigate to the first url of the redirect chain.
-    NavigateToURL(shell(), urls[0]);
+    EXPECT_TRUE(
+        NavigateToURL(shell(), urls[0], urls[2] /* expected_commit_url */));
 
     // We reached the end of the redirect chain.
     EXPECT_EQ(urls[2], shell()->web_contents()->GetURL());
@@ -425,7 +426,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
         "\" />"
         "</body></html>";
     AddQuery(&page_with_image, "html", content_with_image);
-    NavigateToURL(shell(), page_with_image);
+    EXPECT_TRUE(NavigateToURL(shell(), page_with_image));
 
     delegate()->VerifyAndClearExpectations();
   }
@@ -438,7 +439,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, InsecureNavigation) {
   AddQuery(&url, "header", kClearCookiesHeader);
   ASSERT_FALSE(url.SchemeIsCryptographic());
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // We do not expect any calls to have been made.
   delegate()->VerifyAndClearExpectations();
@@ -493,10 +494,10 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTestWithAutoupgradesDisabled,
   AddQuery(&secure_page, "html", content_with_insecure_image);
 
   // Insecure resource on an insecure page does not execute Clear-Site-Data.
-  NavigateToURL(shell(), insecure_page);
+  EXPECT_TRUE(NavigateToURL(shell(), insecure_page));
 
   // Insecure resource on a secure page does not execute Clear-Site-Data.
-  NavigateToURL(shell(), secure_page);
+  EXPECT_TRUE(NavigateToURL(shell(), secure_page));
 
   // We do not expect any calls to have been made.
   delegate()->VerifyAndClearExpectations();
@@ -511,13 +512,13 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTestWithAutoupgradesDisabled,
   // Secure resource on an insecure page does execute Clear-Site-Data.
   delegate()->ExpectClearSiteDataCookiesCall(url::Origin::Create(secure_image));
 
-  NavigateToURL(shell(), secure_page);
+  EXPECT_TRUE(NavigateToURL(shell(), secure_page));
   delegate()->VerifyAndClearExpectations();
 
   // Secure resource on a secure page does execute Clear-Site-Data.
   delegate()->ExpectClearSiteDataCookiesCall(url::Origin::Create(secure_image));
 
-  NavigateToURL(shell(), secure_page);
+  EXPECT_TRUE(NavigateToURL(shell(), secure_page));
   delegate()->VerifyAndClearExpectations();
 }
 
@@ -534,7 +535,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, ServiceWorker) {
   // the page title.
   GURL url = origin1;
   AddQuery(&url, "file", "worker_setup.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   WaitForTitle(shell(), "service worker is ready");
 
   // The service worker will now serve a page containing several images, which
@@ -567,7 +568,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, ServiceWorker) {
   AddQuery(&url, "origin2", origin2.spec());
   AddQuery(&url, "origin3", origin3.spec());
   AddQuery(&url, "origin4", origin4.spec());
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   WaitForTitle(shell(), "done");
   delegate()->VerifyAndClearExpectations();
 }
@@ -632,7 +633,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, MAYBE_Credentials) {
     if (test_case.should_run)
       delegate()->ExpectClearSiteDataCookiesCall(url::Origin::Create(resource));
 
-    NavigateToURL(shell(), page);
+    EXPECT_TRUE(NavigateToURL(shell(), page));
     WaitForTitle(shell(), "done");
     delegate()->VerifyAndClearExpectations();
   }
@@ -675,7 +676,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, CredentialsOnRedirect) {
   GURL page = https_server()->GetURL("origin1.com", "/");
   AddQuery(&page, "html", content);
 
-  NavigateToURL(shell(), page);
+  EXPECT_TRUE(NavigateToURL(shell(), page));
   WaitForTitle(shell(), "done");
   delegate()->VerifyAndClearExpectations();
 }
@@ -707,7 +708,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest, Types) {
         url::Origin::Create(url), test_case.remove_cookies,
         test_case.remove_storage, test_case.remove_cache);
 
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
 
     delegate()->VerifyAndClearExpectations();
   }
@@ -728,7 +729,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
   // Let Clear-Site-Data delete the "cookies" of "origin1.com".
   GURL url = https_server()->GetURL("origin1.com", "/clear-site-data");
   AddQuery(&url, "header", kClearCookiesHeader);
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // Only the "origin2.com" eTLD now has cookies.
   cookies = GetCookies();
@@ -759,7 +760,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
   // of the scope.
   GURL url = server->GetURL("origin1.com", "/anything-in-the-scope");
   AddQuery(&url, "header", "\"storage\"");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   service_workers =
       browsing_data_browsertest_utils::GetServiceWorkers(partition);
   EXPECT_EQ(2u, service_workers.size());
@@ -770,7 +771,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
   // The header will be respected and the worker deleted.
   url = server->GetURL("origin1.com", "/resource");
   AddQuery(&url, "header", "\"storage\"");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // Only "origin2.com" now has a service worker.
   service_workers =
@@ -810,7 +811,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
   // Let Clear-Site-Data delete the "cache" of HTTPS host 2.
   GURL url = GetURLForHTTPSHost2("/clear-site-data");
   AddQuery(&url, "header", "\"cache\"");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // Only HTTPS host 1 now has cache entries.
   EXPECT_TRUE(TestCacheEntry(url1));
@@ -834,7 +835,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
                        ClearSiteDataDuringServiceWorkerInstall) {
   GURL url = embedded_test_server()->GetURL("127.0.0.1", "/");
   AddQuery(&url, "file", "worker_test.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   delegate()->ExpectClearSiteDataCall(url::Origin::Create(url), false, true,
                                       false);
   SetClearSiteDataHeader("\"storage\"");
@@ -849,7 +850,7 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
                        ClearSiteDataDuringServiceWorkerUpdate) {
   GURL url = embedded_test_server()->GetURL("127.0.0.1", "/");
   AddQuery(&url, "file", "worker_test.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   // Install a service worker.
   EXPECT_TRUE(RunScriptAndGetBool("installServiceWorker()"));
   delegate()->VerifyAndClearExpectations();
@@ -860,8 +861,8 @@ IN_PROC_BROWSER_TEST_F(ClearSiteDataHandlerBrowserTest,
   base::RunLoop loop;
   auto* remover = BrowserContext::GetBrowsingDataRemover(browser_context());
   remover->SetWouldCompleteCallbackForTesting(
-      base::BindLambdaForTesting([&](const base::RepeatingClosure& callback) {
-        callback.Run();
+      base::BindLambdaForTesting([&](base::OnceClosure callback) {
+        std::move(callback).Run();
         loop.Quit();
       }));
 
diff --git a/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc b/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc
index 1f2013341b4..7cad567d627 100644
--- a/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc
+++ b/chromium/content/browser/browsing_data/conditional_cache_deletion_helper_browsertest.cc
@@ -41,13 +41,6 @@ class ConditionalCacheDeletionHelperBrowserTest : public ContentBrowserTest {
 
   void TearDownOnMainThread() override {}
 
-  void CreateCacheEntry(const std::set<GURL>& urls) {
-    for (auto& url : urls) {
-      ASSERT_EQ(net::OK, LoadBasicRequest(
-                             storage_partition()->GetNetworkContext(), url));
-    }
-  }
-
   bool TestCacheEntry(const GURL& url) {
     return LoadBasicRequest(storage_partition()->GetNetworkContext(), url,
                             0 /* process_id */, 0 /* render_frame_id */,
@@ -55,6 +48,38 @@ class ConditionalCacheDeletionHelperBrowserTest : public ContentBrowserTest {
                                 net::LOAD_SKIP_CACHE_VALIDATION) == net::OK;
   }
 
+  void CreateCacheEntries(const std::set<GURL>& urls) {
+    for (auto& url : urls) {
+      ASSERT_EQ(net::OK, LoadBasicRequest(
+                             storage_partition()->GetNetworkContext(), url));
+    }
+
+    // Wait for the entries to be written. There is no callback for this action
+    // being completed, only scheduled. Therefore, we need to continuously poll
+    // every |tiny_timeout|. However, wait at most |action_timeout| for this
+    // action to be performed.
+    base::Time start = base::Time::Now();
+    bool all_entries_written = false;
+
+    while (base::Time::Now() - start < TestTimeouts::action_timeout()) {
+      all_entries_written = true;
+      for (auto& url : urls) {
+        if (!TestCacheEntry(url)) {
+          all_entries_written = false;
+          break;
+        }
+      }
+
+      if (all_entries_written)
+        break;
+
+      base::PlatformThread::Sleep(TestTimeouts::tiny_timeout());
+    }
+
+    ASSERT_TRUE(all_entries_written)
+        << "Unable to write cache entries. The deletion test can't proceed.";
+  }
+
   void CompareRemainingKeys(const std::set<GURL>& expected_urls,
                             const std::set<GURL>& erase_urls) {
     for (auto& url : expected_urls)
@@ -89,21 +114,14 @@ class ConditionalCacheDeletionHelperBrowserTest : public ContentBrowserTest {
 
 // Tests that ConditionalCacheDeletionHelper only deletes those cache entries
 // that match the condition.
-// Disabled on Android due to flakiness. See https://crbug.com/978891.
-#if defined(OS_ANDROID)
-#define MAYBE_Condition DISABLED_Condition
-#else
-#define MAYBE_Condition Condition
-#endif
-IN_PROC_BROWSER_TEST_F(ConditionalCacheDeletionHelperBrowserTest,
-                       MAYBE_Condition) {
+IN_PROC_BROWSER_TEST_F(ConditionalCacheDeletionHelperBrowserTest, Condition) {
   std::set<GURL> urls = {
       embedded_test_server()->GetURL("foo.com", "/title1.html"),
       embedded_test_server()->GetURL("bar.com", "/title1.html"),
       embedded_test_server()->GetURL("baz.com", "/title1.html"),
       embedded_test_server()->GetURL("qux.com", "/title1.html")};
 
-  CreateCacheEntry(urls);
+  CreateCacheEntries(urls);
 
   std::set<GURL> erase_urls = {
       embedded_test_server()->GetURL("bar.com", "/title1.html"),
@@ -130,20 +148,11 @@ IN_PROC_BROWSER_TEST_F(ConditionalCacheDeletionHelperBrowserTest,
 
 // Tests that ConditionalCacheDeletionHelper correctly constructs a condition
 // for time and URL.
-//
-// Note: This test depends on the timing in cache backends and can be flaky
-// if those backends are slow.
-//
-// It previously flaked on Mac 10.11 (crbug.com/646119) and on Linux/ChromeOS
-// (crbug.com/624836) but it seems to be stable now.
-
-// Disabled on Android due to flakiness. See https://crbug.com/978891.
-#if defined(OS_ANDROID)
+// crbug.com/1010102: fails on win.
+#if defined(OS_WIN)
 #define MAYBE_TimeAndURL DISABLED_TimeAndURL
 #else
-// https://crbug.com/911171: this test depends on the timing of the cache,
-// which changes if it's running out-of-process.
-#define MAYBE_TimeAndURL DISABLED_TimeAndURL
+#define MAYBE_TimeAndURL TimeAndURL
 #endif
 IN_PROC_BROWSER_TEST_F(ConditionalCacheDeletionHelperBrowserTest,
                        MAYBE_TimeAndURL) {
@@ -152,9 +161,9 @@ IN_PROC_BROWSER_TEST_F(ConditionalCacheDeletionHelperBrowserTest,
       embedded_test_server()->GetURL("foo.com", "/title1.html"),
       embedded_test_server()->GetURL("example.com", "/title1.html"),
       embedded_test_server()->GetURL("bar.com", "/title1.html")};
-  CreateCacheEntry(urls);
+  CreateCacheEntries(urls);
 
-  // Wait some milliseconds for the cache to write the entries.
+  // Wait a short time after writing the entries.
   // This assures that future entries will have timestamps strictly greater than
   // the ones we just added.
   base::PlatformThread::Sleep(TestTimeouts::tiny_timeout());
@@ -166,7 +175,7 @@ IN_PROC_BROWSER_TEST_F(ConditionalCacheDeletionHelperBrowserTest,
       embedded_test_server()->GetURL("example.com", "/title2.html"),
       embedded_test_server()->GetURL("example.com", "/title3.html"),
       embedded_test_server()->GetURL("example2.com", "/simple_page.html")};
-  CreateCacheEntry(newer_urls);
+  CreateCacheEntries(newer_urls);
 
   // Create a condition for entries with the "http://example.com" origin
   // created after waiting.
diff --git a/chromium/content/browser/browsing_data/same_site_data_remover_impl.cc b/chromium/content/browser/browsing_data/same_site_data_remover_impl.cc
index 4787f6ae45d..e6e40013b9e 100644
--- a/chromium/content/browser/browsing_data/same_site_data_remover_impl.cc
+++ b/chromium/content/browser/browsing_data/same_site_data_remover_impl.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/same_site_data_remover.h"
 #include "content/public/browser/storage_partition.h"
 #include "net/cookies/canonical_cookie.h"
+#include "net/cookies/cookie_constants.h"
 #include "net/cookies/cookie_monster.h"
 #include "net/cookies/cookie_util.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
@@ -26,14 +27,18 @@ namespace content {
 
 namespace {
 
-void OnGetAllCookies(base::OnceClosure closure,
-                     network::mojom::CookieManager* cookie_manager,
-                     std::set<std::string>* same_site_none_domains,
-                     const std::vector<net::CanonicalCookie>& cookies) {
+void OnGetAllCookiesWithAccessSemantics(
+    base::OnceClosure closure,
+    network::mojom::CookieManager* cookie_manager,
+    std::set<std::string>* same_site_none_domains,
+    const std::vector<net::CanonicalCookie>& cookies,
+    const std::vector<net::CookieAccessSemantics>& access_semantics_list) {
+  DCHECK(cookies.size() == access_semantics_list.size());
   base::RepeatingClosure barrier =
       base::BarrierClosure(cookies.size(), std::move(closure));
-  for (const auto& cookie : cookies) {
-    if (cookie.IsEffectivelySameSiteNone()) {
+  for (size_t i = 0; i < cookies.size(); ++i) {
+    const net::CanonicalCookie& cookie = cookies[i];
+    if (cookie.IsEffectivelySameSiteNone(access_semantics_list[i])) {
       same_site_none_domains->emplace(cookie.Domain());
       cookie_manager->DeleteCanonicalCookie(
           cookie, base::BindOnce([](const base::RepeatingClosure& callback,
@@ -94,9 +99,9 @@ void SameSiteDataRemoverImpl::DeleteSameSiteNoneCookies(
   same_site_none_domains_.clear();
   auto* cookie_manager =
       storage_partition_->GetCookieManagerForBrowserProcess();
-  cookie_manager->GetAllCookies(
-      base::BindOnce(&OnGetAllCookies, std::move(closure), cookie_manager,
-                     &same_site_none_domains_));
+  cookie_manager->GetAllCookiesWithAccessSemantics(
+      base::BindOnce(&OnGetAllCookiesWithAccessSemantics, std::move(closure),
+                     cookie_manager, &same_site_none_domains_));
 }
 
 void SameSiteDataRemoverImpl::ClearStoragePartitionData(
diff --git a/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc b/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc
index 39d23fa646b..42d8c75c01b 100644
--- a/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc
+++ b/chromium/content/browser/browsing_data/same_site_data_remover_impl_browsertest.cc
@@ -99,7 +99,7 @@ IN_PROC_BROWSER_TEST_F(SameSiteDataRemoverBrowserTest,
   CreateCookieForTest("TestCookie", "www.google.com",
                       net::CookieSameSite::NO_RESTRICTION,
                       net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
-                      GetBrowserContext());
+                      true /* is_cookie_secure */, GetBrowserContext());
   browsing_data_browsertest_utils::AddServiceWorker(
       "www.google.com", storage_partition, GetHttpsServer());
 
@@ -122,7 +122,7 @@ IN_PROC_BROWSER_TEST_F(SameSiteDataRemoverBrowserTest,
   CreateCookieForTest("TestCookie", "www.google.com",
                       net::CookieSameSite::NO_RESTRICTION,
                       net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
-                      GetBrowserContext());
+                      true /* is_cookie_secure */, GetBrowserContext());
   browsing_data_browsertest_utils::AddServiceWorker(
       "www.google.com", storage_partition, GetHttpsServer());
 
diff --git a/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc b/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
index 1cf53595727..58e281eea1d 100644
--- a/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
+++ b/chromium/content/browser/browsing_data/same_site_data_remover_impl_unittest.cc
@@ -107,13 +107,14 @@ class SameSiteDataRemoverImplTest : public testing::Test {
 TEST_F(SameSiteDataRemoverImplTest, TestRemoveSameSiteNoneCookies) {
   BrowserContext* browser_context = GetBrowserContext();
 
-  CreateCookieForTest(
-      "TestCookie1", "www.google.com", net::CookieSameSite::NO_RESTRICTION,
-      net::CookieOptions::SameSiteCookieContext::CROSS_SITE, browser_context);
+  CreateCookieForTest("TestCookie1", "www.google.com",
+                      net::CookieSameSite::NO_RESTRICTION,
+                      net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
+                      true /* is_cookie_secure */, browser_context);
   CreateCookieForTest("TestCookie2", "www.gmail.google.com",
                       net::CookieSameSite::NO_RESTRICTION,
                       net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
-                      browser_context);
+                      true /* is_cookie_secure */, browser_context);
 
   DeleteSameSiteNoneCookies();
 
@@ -127,14 +128,15 @@ TEST_F(SameSiteDataRemoverImplTest, TestRemoveSameSiteNoneCookies) {
 
 TEST_F(SameSiteDataRemoverImplTest, TestRemoveOnlySameSiteNoneCookies) {
   BrowserContext* browser_context = GetBrowserContext();
-  CreateCookieForTest(
-      "TestCookie1", "www.google.com", net::CookieSameSite::NO_RESTRICTION,
-      net::CookieOptions::SameSiteCookieContext::CROSS_SITE, browser_context);
+  CreateCookieForTest("TestCookie1", "www.google.com",
+                      net::CookieSameSite::NO_RESTRICTION,
+                      net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
+                      true /* is_cookie_secure */, browser_context);
   // The second cookie has SameSite value STRICT_MODE instead of NO_RESTRICTION.
   CreateCookieForTest(
       "TestCookie2", "www.gmail.google.com", net::CookieSameSite::STRICT_MODE,
       net::CookieOptions::SameSiteCookieContext::SAME_SITE_STRICT,
-      browser_context);
+      true /* is_cookie_secure */, browser_context);
 
   DeleteSameSiteNoneCookies();
 
@@ -149,15 +151,16 @@ TEST_F(SameSiteDataRemoverImplTest, TestRemoveOnlySameSiteNoneCookies) {
 
 TEST_F(SameSiteDataRemoverImplTest, TestRemoveSameDomainCookies) {
   BrowserContext* browser_context = GetBrowserContext();
-  CreateCookieForTest(
-      "TestCookie1", "www.google.com", net::CookieSameSite::NO_RESTRICTION,
-      net::CookieOptions::SameSiteCookieContext::CROSS_SITE, browser_context);
+  CreateCookieForTest("TestCookie1", "www.google.com",
+                      net::CookieSameSite::NO_RESTRICTION,
+                      net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
+                      true /* is_cookie_secure */, browser_context);
   // The second cookie has the same domain as the first cookie, but also has
   // SameSite value STRICT_MODE instead of NO_RESTRICTION.
   CreateCookieForTest(
       "TestCookie2", "www.google.com", net::CookieSameSite::STRICT_MODE,
       net::CookieOptions::SameSiteCookieContext::SAME_SITE_STRICT,
-      browser_context);
+      false /* is_cookie_secure */, browser_context);
 
   DeleteSameSiteNoneCookies();
 
@@ -175,11 +178,11 @@ TEST_F(SameSiteDataRemoverImplTest, TestKeepSameSiteCookies) {
   CreateCookieForTest("TestCookie1", "www.google.com",
                       net::CookieSameSite::LAX_MODE,
                       net::CookieOptions::SameSiteCookieContext::SAME_SITE_LAX,
-                      browser_context);
+                      false /* is_cookie_secure */, browser_context);
   CreateCookieForTest(
       "TestCookie2", "www.gmail.google.com", net::CookieSameSite::STRICT_MODE,
       net::CookieOptions::SameSiteCookieContext::SAME_SITE_STRICT,
-      browser_context);
+      false /* is_cookie_secure */, browser_context);
 
   DeleteSameSiteNoneCookies();
 
@@ -202,7 +205,7 @@ TEST_F(SameSiteDataRemoverImplTest, TestCookieRemovalUnaffectedByParameters) {
   bool result_out = false;
   cookie_manager->SetCanonicalCookie(
       net::CanonicalCookie("TestCookie1", "20", "google.com", "/",
-                           base::Time::Now(), base::Time(), base::Time(), false,
+                           base::Time::Now(), base::Time(), base::Time(), true,
                            true, net::CookieSameSite::NO_RESTRICTION,
                            net::COOKIE_PRIORITY_HIGH),
       "https", options,
@@ -252,9 +255,10 @@ TEST_F(SameSiteDataRemoverImplTest, TestStoragePartitionDataRemoval) {
   GetSameSiteDataRemoverImpl()->OverrideStoragePartitionForTesting(
       &storage_partition);
 
-  CreateCookieForTest(
-      "TestCookie1", ".google.com", net::CookieSameSite::NO_RESTRICTION,
-      net::CookieOptions::SameSiteCookieContext::CROSS_SITE, browser_context);
+  CreateCookieForTest("TestCookie1", ".google.com",
+                      net::CookieSameSite::NO_RESTRICTION,
+                      net::CookieOptions::SameSiteCookieContext::CROSS_SITE,
+                      true /* is_cookie_secure */, browser_context);
   DeleteSameSiteNoneCookies();
 
   ClearStoragePartitionData();
diff --git a/chromium/content/browser/builtin_service_manifests.cc b/chromium/content/browser/builtin_service_manifests.cc
index 8f9164d6a9d..805496dbf67 100644
--- a/chromium/content/browser/builtin_service_manifests.cc
+++ b/chromium/content/browser/builtin_service_manifests.cc
@@ -13,8 +13,8 @@
 #include "content/public/app/content_renderer_manifest.h"
 #include "content/public/app/content_utility_manifest.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/network_service_util.h"
 #include "content/public/common/service_names.mojom.h"
 #include "media/mojo/buildflags.h"
 #include "media/mojo/services/cdm_manifest.h"
@@ -24,8 +24,6 @@
 #include "services/device/public/cpp/manifest.h"
 #include "services/media_session/public/cpp/manifest.h"
 #include "services/metrics/public/cpp/manifest.h"
-#include "services/network/public/cpp/manifest.h"
-#include "services/resource_coordinator/public/cpp/manifest.h"
 #include "services/service_manager/public/cpp/manifest_builder.h"
 #include "services/tracing/manifest.h"
 
@@ -64,16 +62,11 @@ const std::vector<service_manager::Manifest>& GetBuiltinServiceManifests() {
           media::GetCdmManifest(),
 #endif
           media::GetMediaManifest(),
+          media::GetMediaRendererManifest(),
           data_decoder::GetManifest(),
           device::GetManifest(),
           media_session::GetManifest(),
           metrics::GetManifest(),
-          network::GetManifest(
-              IsInProcessNetworkService()
-                  ? service_manager::Manifest::ExecutionMode::kInProcessBuiltin
-                  : service_manager::Manifest::ExecutionMode::
-                        kOutOfProcessBuiltin),
-          resource_coordinator::GetManifest(),
           tracing::GetManifest(),
       }};
   return *manifests;
diff --git a/chromium/content/browser/byte_stream.h b/chromium/content/browser/byte_stream.h
index 1ac82cac43d..f85ffcc9316 100644
--- a/chromium/content/browser/byte_stream.h
+++ b/chromium/content/browser/byte_stream.h
@@ -75,7 +75,7 @@ namespace content {
 //          &reader);         // Presumed passed to FILE thread for reading.
 //
 //      // Setup callback for writing.
-//      writer->RegisterCallback(base::Bind(&SpaceAvailable, this));
+//      writer->RegisterCallback(base::BindRepeating(&SpaceAvailable, this));
 //
 //      // Do initial round of writing.
 //      SpaceAvailable();
@@ -102,7 +102,7 @@ namespace content {
 //
 //    void ReceivingClass::Initialize() {
 //      // Initialization
-//      reader->RegisterCallback(base::Bind(&DataAvailable, obj));
+//      reader->RegisterCallback(base::BindRepeating(&DataAvailable, obj));
 //    }
 //
 //    // Called whenever there's something to read.
diff --git a/chromium/content/browser/cache_storage/cache_storage.h b/chromium/content/browser/cache_storage/cache_storage.h
index 74ec14469b7..07eccad6ab7 100644
--- a/chromium/content/browser/cache_storage/cache_storage.h
+++ b/chromium/content/browser/cache_storage/cache_storage.h
@@ -78,6 +78,7 @@ class CONTENT_EXPORT CacheStorage {
   virtual void MatchCache(const std::string& cache_name,
                           blink::mojom::FetchAPIRequestPtr request,
                           blink::mojom::CacheQueryOptionsPtr match_options,
+                          CacheStorageSchedulerPriority priority,
                           int64_t trace_id,
                           CacheStorageCache::ResponseCallback callback) = 0;
 
@@ -87,6 +88,7 @@ class CONTENT_EXPORT CacheStorage {
   // blink::mojom::CacheStorageError::kErrorNotFound.
   virtual void MatchAllCaches(blink::mojom::FetchAPIRequestPtr request,
                               blink::mojom::CacheQueryOptionsPtr match_options,
+                              CacheStorageSchedulerPriority priority,
                               int64_t trace_id,
                               CacheStorageCache::ResponseCallback callback) = 0;
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc
index 38c51352e37..5f2be1ad860 100644
--- a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.cc
@@ -29,12 +29,12 @@ CacheStorageBlobToDiskCache::~CacheStorageBlobToDiskCache() = default;
 void CacheStorageBlobToDiskCache::StreamBlobToCache(
     ScopedWritableEntry entry,
     int disk_cache_body_index,
-    blink::mojom::BlobPtr blob,
+    mojo::PendingRemote<blink::mojom::Blob> blob_remote,
     uint64_t blob_size,
     EntryAndBoolCallback callback) {
   DCHECK(entry);
   DCHECK_LE(0, disk_cache_body_index);
-  DCHECK(blob);
+  DCHECK(blob_remote);
   DCHECK(!consumer_handle_.is_valid());
   DCHECK(!pending_read_);
 
@@ -56,6 +56,7 @@ void CacheStorageBlobToDiskCache::StreamBlobToCache(
   entry_ = std::move(entry);
   callback_ = std::move(callback);
 
+  mojo::Remote<blink::mojom::Blob> blob(std::move(blob_remote));
   blob->ReadAll(std::move(producer_handle),
                 client_receiver_.BindNewPipeAndPassRemote());
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.h b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.h
index e12b0fec598..f1811d6a77f 100644
--- a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.h
+++ b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache.h
@@ -14,6 +14,7 @@
 #include "content/browser/cache_storage/scoped_writable_entry.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/cpp/net_adapters.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 
@@ -32,12 +33,12 @@ class CONTENT_EXPORT CacheStorageBlobToDiskCache
   CacheStorageBlobToDiskCache();
   ~CacheStorageBlobToDiskCache() override;
 
-  // Writes the body of |blob| to |entry| with index
+  // Writes the body of |blob_remote| to |entry| with index
   // |disk_cache_body_index|. |entry| is passed to the callback once complete.
   // Only call this once per instantiation of CacheStorageBlobToDiskCache.
   void StreamBlobToCache(ScopedWritableEntry entry,
                          int disk_cache_body_index,
-                         blink::mojom::BlobPtr blob,
+                         mojo::PendingRemote<blink::mojom::Blob> blob_remote,
                          uint64_t blob_size,
                          EntryAndBoolCallback callback);
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache_unittest.cc
index dd052dded23..a5b4728bce4 100644
--- a/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_blob_to_disk_cache_unittest.cc
@@ -120,13 +120,13 @@ class CacheStorageBlobToDiskCacheTest : public testing::Test {
   }
 
   bool Stream() {
-    blink::mojom::BlobPtr blob_ptr;
+    mojo::PendingRemote<blink::mojom::Blob> blob_remote;
     storage::BlobImpl::Create(
         std::make_unique<storage::BlobDataHandle>(*blob_handle_),
-        MakeRequest(&blob_ptr));
+        blob_remote.InitWithNewPipeAndPassReceiver());
 
     cache_storage_blob_to_disk_cache_->StreamBlobToCache(
-        std::move(disk_cache_entry_), kCacheEntryIndex, std::move(blob_ptr),
+        std::move(disk_cache_entry_), kCacheEntryIndex, std::move(blob_remote),
         blob_handle_->size(),
         base::BindOnce(&CacheStorageBlobToDiskCacheTest::StreamCallback,
                        base::Unretained(this)));
diff --git a/chromium/content/browser/cache_storage/cache_storage_cache.h b/chromium/content/browser/cache_storage/cache_storage_cache.h
index e9147612a0f..3f06519e729 100644
--- a/chromium/content/browser/cache_storage/cache_storage_cache.h
+++ b/chromium/content/browser/cache_storage/cache_storage_cache.h
@@ -13,6 +13,7 @@
 
 #include "base/callback.h"
 #include "content/browser/cache_storage/cache_storage_cache_handle.h"
+#include "content/browser/cache_storage/cache_storage_scheduler_types.h"
 #include "content/common/content_export.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
 #include "url/origin.h"
@@ -77,6 +78,7 @@ class CONTENT_EXPORT CacheStorageCache {
   // Returns ERROR_TYPE_NOT_FOUND if not found.
   virtual void Match(blink::mojom::FetchAPIRequestPtr request,
                      blink::mojom::CacheQueryOptionsPtr match_options,
+                     CacheStorageSchedulerPriority priority,
                      int64_t trace_id,
                      ResponseCallback callback) = 0;
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.cc b/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.cc
index abc075a293b..6c332f6295c 100644
--- a/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.cc
@@ -257,9 +257,9 @@ CacheStorageCacheEntryHandler::DiskCacheBlobEntry::~DiskCacheBlobEntry() {
 
 PutContext::PutContext(blink::mojom::FetchAPIRequestPtr request,
                        blink::mojom::FetchAPIResponsePtr response,
-                       blink::mojom::BlobPtr blob,
+                       mojo::PendingRemote<blink::mojom::Blob> blob,
                        uint64_t blob_size,
-                       blink::mojom::BlobPtr side_data_blob,
+                       mojo::PendingRemote<blink::mojom::Blob> side_data_blob,
                        uint64_t side_data_blob_size,
                        int64_t trace_id)
     : request(std::move(request)),
@@ -285,18 +285,18 @@ class CacheStorageCacheEntryHandlerImpl : public CacheStorageCacheEntryHandler {
       blink::mojom::FetchAPIResponsePtr response,
       int64_t trace_id) override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    blink::mojom::BlobPtr blob;
+    mojo::PendingRemote<blink::mojom::Blob> blob;
     uint64_t blob_size = blink::BlobUtils::kUnknownSize;
-    blink::mojom::BlobPtr side_data_blob;
+    mojo::PendingRemote<blink::mojom::Blob> side_data_blob;
     uint64_t side_data_blob_size = blink::BlobUtils::kUnknownSize;
 
     if (response->blob) {
-      blob.Bind(std::move(response->blob->blob));
+      blob = std::move(response->blob->blob);
       blob_size = response->blob->size;
     }
-    if (response->side_data_blob) {
-      side_data_blob.Bind(std::move(response->side_data_blob->blob));
-      side_data_blob_size = response->side_data_blob->size;
+    if (response->side_data_blob_for_cache_put) {
+      side_data_blob = std::move(response->side_data_blob_for_cache_put->blob);
+      side_data_blob_size = response->side_data_blob_for_cache_put->size;
     }
 
     return std::make_unique<PutContext>(
@@ -307,9 +307,20 @@ class CacheStorageCacheEntryHandlerImpl : public CacheStorageCacheEntryHandler {
   void PopulateResponseBody(scoped_refptr<DiskCacheBlobEntry> blob_entry,
                             blink::mojom::FetchAPIResponse* response) override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+    // First create the blob and store it in the field for the main body
+    // loading.
     response->blob = CreateBlobWithSideData(
         std::move(blob_entry), CacheStorageCache::INDEX_RESPONSE_BODY,
         CacheStorageCache::INDEX_SIDE_DATA);
+
+    // Then clone the blob to the |side_data_blob| field for loading code_cache.
+    mojo::Remote<blink::mojom::Blob> blob_remote(
+        std::move(response->blob->blob));
+    blob_remote->Clone(response->blob->blob.InitWithNewPipeAndPassReceiver());
+    response->side_data_blob = blink::mojom::SerializedBlob::New(
+        response->blob->uuid, response->blob->content_type,
+        response->blob->size, blob_remote.Unbind());
   }
 
   void PopulateRequestBody(scoped_refptr<DiskCacheBlobEntry> blob_entry,
@@ -397,13 +408,14 @@ CacheStorageCacheEntryHandler::CreateBlobWithSideData(
   if (BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     FinalizeBlobOnIOThread(blob_context_, std::move(blob_entry),
                            disk_cache_index, side_data_disk_cache_index,
-                           blob->uuid, MakeRequest(&blob->blob));
+                           blob->uuid,
+                           blob->blob.InitWithNewPipeAndPassReceiver());
   } else {
     base::PostTask(FROM_HERE, {BrowserThread::IO},
                    base::BindOnce(&FinalizeBlobOnIOThread, blob_context_,
                                   std::move(blob_entry), disk_cache_index,
                                   side_data_disk_cache_index, blob->uuid,
-                                  MakeRequest(&blob->blob)));
+                                  blob->blob.InitWithNewPipeAndPassReceiver()));
   }
 
   return blob;
diff --git a/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.h b/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.h
index 17fa43cb439..4450a5a3f21 100644
--- a/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.h
+++ b/chromium/content/browser/cache_storage/cache_storage_cache_entry_handler.h
@@ -17,6 +17,7 @@
 #include "content/browser/cache_storage/cache_storage_cache_handle.h"
 #include "content/browser/cache_storage/scoped_writable_entry.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/disk_cache/disk_cache.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
@@ -36,9 +37,9 @@ struct PutContext {
 
   PutContext(blink::mojom::FetchAPIRequestPtr request,
              blink::mojom::FetchAPIResponsePtr response,
-             blink::mojom::BlobPtr blob,
+             mojo::PendingRemote<blink::mojom::Blob> blob,
              uint64_t blob_size,
-             blink::mojom::BlobPtr side_data_blob,
+             mojo::PendingRemote<blink::mojom::Blob> side_data_blob,
              uint64_t side_data_blob_size,
              int64_t trace_id);
 
@@ -47,9 +48,9 @@ struct PutContext {
   // Provided by the constructor.
   blink::mojom::FetchAPIRequestPtr request;
   blink::mojom::FetchAPIResponsePtr response;
-  blink::mojom::BlobPtr blob;
+  mojo::PendingRemote<blink::mojom::Blob> blob;
   uint64_t blob_size;
-  blink::mojom::BlobPtr side_data_blob;
+  mojo::PendingRemote<blink::mojom::Blob> side_data_blob;
   uint64_t side_data_blob_size;
   int64_t trace_id;
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc
index e1681d559c1..2194ee54bdb 100644
--- a/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_cache_unittest.cc
@@ -39,7 +39,8 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_utils.h"
 #include "crypto/symmetric_key.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/data_pipe_drainer.h"
 #include "net/base/test_completion_callback.h"
@@ -460,7 +461,7 @@ class CacheStorageCacheTest : public testing::Test {
     blob_handle_ = BuildBlobHandle("blob-id:myblob", expected_blob_data_);
     storage::BlobImpl::Create(
         std::make_unique<storage::BlobDataHandle>(*blob_handle_),
-        MakeRequest(&blob_ptr_));
+        blob_remote_.BindNewPipeAndPassReceiver());
 
     // Use a mock LegacyCacheStorage object so we can use real
     // CacheStorageCacheHandle reference counting.  A LegacyCacheStorage
@@ -500,8 +501,8 @@ class CacheStorageCacheTest : public testing::Test {
     auto blob = blink::mojom::SerializedBlob::New();
     blob->uuid = blob_handle_->uuid();
     blob->size = expected_blob_data_.size();
-    // Use cloned blob pointer for all responses with blob body.
-    blob_ptr_->Clone(mojo::MakeRequest(&blob->blob));
+    // Use cloned blob remote for all responses with blob body.
+    blob_remote_->Clone(blob->blob.InitWithNewPipeAndPassReceiver());
 
     blink::mojom::FetchAPIResponsePtr response = CreateNoBodyResponse();
     response->url_list = {kBodyUrl};
@@ -526,7 +527,9 @@ class CacheStorageCacheTest : public testing::Test {
         nullptr /* blob */, blink::mojom::ServiceWorkerResponseError::kUnknown,
         response_time_, std::string() /* cache_storage_cache_name */,
         std::vector<std::string>() /* cors_exposed_header_names */,
-        nullptr /* side_data_blob */);
+        nullptr /* side_data_blob */,
+        nullptr /* side_data_blob_for_cache_put */,
+        nullptr /* content_security_policy */);
   }
 
   std::unique_ptr<storage::BlobDataHandle> BuildBlobHandle(
@@ -540,12 +543,16 @@ class CacheStorageCacheTest : public testing::Test {
 
   void CopySideDataToResponse(storage::BlobDataHandle* side_data_blob_handle,
                               blink::mojom::FetchAPIResponse* response) {
-    response->side_data_blob = blink::mojom::SerializedBlob::New();
-    response->side_data_blob->uuid = side_data_blob_handle->uuid();
-    response->side_data_blob->size = side_data_blob_handle->size();
+    response->side_data_blob_for_cache_put =
+        blink::mojom::SerializedBlob::New();
+    response->side_data_blob_for_cache_put->uuid =
+        side_data_blob_handle->uuid();
+    response->side_data_blob_for_cache_put->size =
+        side_data_blob_handle->size();
     storage::BlobImpl::Create(
         std::make_unique<storage::BlobDataHandle>(*side_data_blob_handle),
-        MakeRequest(&response->side_data_blob->blob));
+        response->side_data_blob_for_cache_put->blob
+            .InitWithNewPipeAndPassReceiver());
   }
 
   blink::mojom::FetchAPIRequestPtr CopyFetchRequest(
@@ -605,7 +612,7 @@ class CacheStorageCacheTest : public testing::Test {
 
     cache_->Match(
         CopyFetchRequest(request), std::move(match_options),
-        /* trace_id = */ 0,
+        CacheStorageSchedulerPriority::kNormal, /* trace_id = */ 0,
         base::BindOnce(&CacheStorageCacheTest::ResponseAndErrorCallback,
                        base::Unretained(this), base::Unretained(loop.get())));
     loop->Run();
@@ -861,7 +868,7 @@ class CacheStorageCacheTest : public testing::Test {
   blink::mojom::FetchAPIRequestPtr body_head_request_;
   std::unique_ptr<storage::BlobDataHandle> blob_handle_;
   // Holds a Mojo connection to the BlobImpl containing |blob_handle_|.
-  blink::mojom::BlobPtr blob_ptr_;
+  mojo::Remote<blink::mojom::Blob> blob_remote_;
   base::Time response_time_;
   std::string expected_blob_data_;
 
@@ -1137,7 +1144,8 @@ TEST_P(CacheStorageCacheTestP, MatchBody) {
   EXPECT_TRUE(Match(body_request_));
   EXPECT_TRUE(ResponseMetadataEqual(*SetCacheName(CreateBlobBodyResponse()),
                                     *callback_response_));
-  blink::mojom::BlobPtr blob(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(
+      std::move(callback_response_->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
 }
 
@@ -1173,7 +1181,7 @@ TEST_P(CacheStorageCacheTestP, MatchAll_Body) {
   ASSERT_EQ(1u, responses.size());
   EXPECT_TRUE(ResponseMetadataEqual(*SetCacheName(CreateBlobBodyResponse()),
                                     *responses[0]));
-  blink::mojom::BlobPtr blob(std::move(responses[0]->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(std::move(responses[0]->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
 }
 
@@ -1191,7 +1199,7 @@ TEST_P(CacheStorageCacheTestP, MatchAll_TwoResponsesThenOne) {
   EXPECT_FALSE(responses[0]->blob);
   EXPECT_TRUE(ResponseMetadataEqual(*SetCacheName(CreateBlobBodyResponse()),
                                     *responses[1]));
-  blink::mojom::BlobPtr blob(std::move(responses[1]->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(std::move(responses[1]->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
 
   responses.clear();
@@ -1260,7 +1268,7 @@ TEST_P(CacheStorageCacheTestP, GetAllMatchedEntries_RequestsIncluded) {
   auto& response = cache_entries[0].second;
   EXPECT_TRUE(ResponseMetadataEqual(*SetCacheName(CreateBlobBodyResponse()),
                                     *response));
-  blink::mojom::BlobPtr blob(std::move(response->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(std::move(response->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
 }
 
@@ -1435,7 +1443,7 @@ TEST_P(CacheStorageCacheTestP, MatchAll_Head) {
   ASSERT_EQ(1u, responses.size());
   EXPECT_TRUE(ResponseMetadataEqual(*SetCacheName(CreateBlobBodyResponse()),
                                     *responses[0]));
-  blink::mojom::BlobPtr blob(std::move(responses[0]->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(std::move(responses[0]->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
 }
 
@@ -1673,7 +1681,8 @@ TEST_P(CacheStorageCacheTestP, PutWithSideData) {
 
   EXPECT_TRUE(Match(body_request_));
   ASSERT_TRUE(callback_response_->blob);
-  blink::mojom::BlobPtr blob(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(
+      std::move(callback_response_->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
   EXPECT_TRUE(ResponseSideDataEqual(expected_side_data, blob.get()));
 }
@@ -1716,7 +1725,8 @@ TEST_P(CacheStorageCacheTestP, PutWithSideData_QuotaExceededSkipSideData) {
 
   EXPECT_TRUE(Match(body_request_));
   ASSERT_TRUE(callback_response_->blob);
-  blink::mojom::BlobPtr blob(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(
+      std::move(callback_response_->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob.get()));
   // The side data should not be written.
   EXPECT_TRUE(ResponseSideDataEqual("", blob.get()));
@@ -1737,7 +1747,7 @@ TEST_P(CacheStorageCacheTestP, PutWithSideData_BadMessage) {
   operation->operation_type = blink::mojom::OperationType::kPut;
   operation->request = BackgroundFetchSettledFetch::CloneRequest(body_request_);
   operation->response = std::move(response);
-  operation->response->side_data_blob->size =
+  operation->response->side_data_blob_for_cache_put->size =
       std::numeric_limits<uint64_t>::max();
 
   std::vector<blink::mojom::BatchOperationPtr> operations;
@@ -1766,7 +1776,8 @@ TEST_P(CacheStorageCacheTestP, WriteSideData) {
 
   EXPECT_TRUE(Match(body_request_));
   ASSERT_TRUE(callback_response_->blob);
-  blink::mojom::BlobPtr blob1(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob1(
+      std::move(callback_response_->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob1.get()));
   EXPECT_TRUE(ResponseSideDataEqual(expected_side_data1, blob1.get()));
 
@@ -1777,7 +1788,8 @@ TEST_P(CacheStorageCacheTestP, WriteSideData) {
                             expected_side_data2.length()));
   EXPECT_TRUE(Match(body_request_));
   ASSERT_TRUE(callback_response_->blob);
-  blink::mojom::BlobPtr blob2(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob2(
+      std::move(callback_response_->blob->blob));
   EXPECT_TRUE(ResponseBodiesEqual(expected_blob_data_, blob2.get()));
   EXPECT_TRUE(ResponseSideDataEqual(expected_side_data2, blob2.get()));
 
@@ -2204,7 +2216,8 @@ TEST_P(CacheStorageCacheTestP, GetSizeThenClose) {
   EXPECT_TRUE(Put(body_request_, CreateBlobBodyResponse()));
   // Get a reference to the response in the cache.
   EXPECT_TRUE(Match(body_request_));
-  blink::mojom::BlobPtr blob(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(
+      std::move(callback_response_->blob->blob));
   callback_response_ = nullptr;
 
   int64_t cache_size = Size();
@@ -2232,8 +2245,9 @@ TEST_P(CacheStorageCacheTestP, UnfinishedPutsShouldNotBeReusable) {
   auto blob = blink::mojom::SerializedBlob::New();
   blob->uuid = "mock blob";
   blob->size = 100;
-  mojo::MakeStrongBinding(std::make_unique<SlowBlob>(run_loop.QuitClosure()),
-                          MakeRequest(&blob->blob));
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<SlowBlob>(run_loop.QuitClosure()),
+      blob->blob.InitWithNewPipeAndPassReceiver());
   blink::mojom::FetchAPIResponsePtr response = CreateNoBodyResponse();
   response->url_list = {kBodyUrl};
   response->blob = std::move(blob);
@@ -2274,7 +2288,8 @@ TEST_P(CacheStorageCacheTestP, BlobReferenceDelaysClose) {
   EXPECT_TRUE(Put(body_request_, CreateBlobBodyResponse()));
   // Get a reference to the response in the cache.
   EXPECT_TRUE(Match(body_request_));
-  blink::mojom::BlobPtr blob(std::move(callback_response_->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(
+      std::move(callback_response_->blob->blob));
   callback_response_ = nullptr;
 
   base::RunLoop loop;
@@ -2392,7 +2407,7 @@ TEST_P(CacheStorageCacheTestP, SelfRefsDuringMatch) {
 
   std::unique_ptr<base::RunLoop> loop(new base::RunLoop());
   cache_->Match(CopyFetchRequest(body_request_), /* match_options = */ nullptr,
-                /* trace_id = */ 0,
+                CacheStorageSchedulerPriority::kNormal, /* trace_id = */ 0,
                 base::BindOnce(&CacheStorageCacheTest::ResponseAndErrorCallback,
                                base::Unretained(this), loop.get()));
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc b/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc
index 02fa30cc933..1905ee839ad 100644
--- a/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.cc
@@ -5,6 +5,7 @@
 #include "content/browser/cache_storage/cache_storage_dispatcher_host.h"
 
 #include "base/bind.h"
+#include "base/feature_list.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
@@ -18,9 +19,12 @@
 #include "content/browser/cache_storage/cache_storage_manager.h"
 #include "content/browser/cache_storage/cache_storage_trace_utils.h"
 #include "content/common/background_fetch/background_fetch_types.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/origin_util.h"
 #include "content/public/common/referrer_type_converters.h"
 #include "mojo/public/cpp/bindings/message.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "third_party/blink/public/common/blob/blob_utils.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -63,6 +67,43 @@ bool ValidBatchOperations(
   return true;
 }
 
+blink::mojom::MatchResultPtr EagerlyReadResponseBody(
+    blink::mojom::FetchAPIResponsePtr response) {
+  if (!response->blob ||
+      !base::FeatureList::IsEnabled(features::kCacheStorageEagerReading)) {
+    return blink::mojom::MatchResult::NewResponse(std::move(response));
+  }
+
+  MojoCreateDataPipeOptions options;
+  options.struct_size = sizeof(MojoCreateDataPipeOptions);
+  options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
+  options.element_num_bytes = 1;
+  options.capacity_num_bytes =
+      blink::BlobUtils::GetDataPipeCapacity(response->blob->size);
+
+  mojo::ScopedDataPipeProducerHandle producer_handle;
+  mojo::ScopedDataPipeConsumerHandle consumer_handle;
+  MojoResult rv = CreateDataPipe(&options, &producer_handle, &consumer_handle);
+  if (rv != MOJO_RESULT_OK)
+    return blink::mojom::MatchResult::NewResponse(std::move(response));
+
+  mojo::PendingRemote<blink::mojom::BlobReaderClient> reader_client;
+  auto pending_receiver = reader_client.InitWithNewPipeAndPassReceiver();
+
+  mojo::Remote<blink::mojom::Blob> blob(std::move(response->blob->blob));
+  blob->ReadAll(std::move(producer_handle), std::move(reader_client));
+
+  // Clear the main body blob entry.  There should still be a |side_data_blob|
+  // value for reading code cache, however.
+  response->blob = nullptr;
+  DCHECK(response->side_data_blob);
+
+  return blink::mojom::MatchResult::NewEagerResponse(
+      blink::mojom::EagerResponse::New(std::move(response),
+                                       std::move(consumer_handle),
+                                       std::move(pending_receiver)));
+}
+
 }  // namespace
 
 // Implements the mojom interface CacheStorageCache. It's owned by
@@ -79,6 +120,7 @@ class CacheStorageDispatcherHost::CacheImpl
   // blink::mojom::CacheStorageCache implementation:
   void Match(blink::mojom::FetchAPIRequestPtr request,
              blink::mojom::CacheQueryOptionsPtr match_options,
+             bool in_related_fetch_event,
              int64_t trace_id,
              MatchCallback callback) override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -97,7 +139,8 @@ class CacheStorageDispatcherHost::CacheImpl
 
     auto cb = base::BindOnce(
         [](base::TimeTicks start_time, bool ignore_search,
-           bool cache_initialized, int64_t trace_id,
+           bool in_related_fetch_event, bool cache_initialized,
+           int64_t trace_id,
            blink::mojom::CacheStorageCache::MatchCallback callback,
            blink::mojom::CacheStorageError error,
            blink::mojom::FetchAPIResponsePtr response) {
@@ -112,6 +155,11 @@ class CacheStorageDispatcherHost::CacheImpl
             UMA_HISTOGRAM_LONG_TIMES(
                 "ServiceWorkerCache.Cache.Browser.Match.Initialized", elapsed);
           }
+          if (in_related_fetch_event) {
+            UMA_HISTOGRAM_LONG_TIMES(
+                "ServiceWorkerCache.Cache.Browser.Match.RelatedFetchEvent",
+                elapsed);
+          }
           if (error == CacheStorageError::kErrorNotFound) {
             UMA_HISTOGRAM_LONG_TIMES(
                 "ServiceWorkerCache.Cache.Browser.Match.Miss", elapsed);
@@ -135,19 +183,35 @@ class CacheStorageDispatcherHost::CacheImpl
               TRACE_ID_GLOBAL(trace_id),
               TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "response",
               CacheStorageTracedValue(response));
-          std::move(callback).Run(
-              blink::mojom::MatchResult::NewResponse(std::move(response)));
+
+          blink::mojom::MatchResultPtr result;
+          if (in_related_fetch_event) {
+            result = EagerlyReadResponseBody(std::move(response));
+          } else {
+            result =
+                blink::mojom::MatchResult::NewResponse(std::move(response));
+          }
+          std::move(callback).Run(std::move(result));
         },
-        base::TimeTicks::Now(), match_options->ignore_search, cache_initialized,
-        trace_id, std::move(callback));
+        base::TimeTicks::Now(), match_options->ignore_search,
+        in_related_fetch_event, cache_initialized, trace_id,
+        std::move(callback));
 
     if (!cache) {
       std::move(cb).Run(CacheStorageError::kErrorNotFound, nullptr);
       return;
     }
 
-    cache->Match(std::move(request), std::move(match_options), trace_id,
-                 std::move(cb));
+    CacheStorageSchedulerPriority priority =
+        CacheStorageSchedulerPriority::kNormal;
+    if (in_related_fetch_event &&
+        base::FeatureList::IsEnabled(
+            features::kCacheStorageHighPriorityMatch)) {
+      priority = CacheStorageSchedulerPriority::kHigh;
+    }
+
+    cache->Match(std::move(request), std::move(match_options), priority,
+                 trace_id, std::move(cb));
   }
 
   void MatchAll(blink::mojom::FetchAPIRequestPtr request,
@@ -329,30 +393,6 @@ class CacheStorageDispatcherHost::CacheImpl
             mojo::GetBadMessageCallback()));
   }
 
-  void SetSideData(const GURL& url,
-                   base::Time response_time,
-                   base::span<const uint8_t> side_data,
-                   int64_t trace_id,
-                   SetSideDataCallback callback) override {
-    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    TRACE_EVENT_WITH_FLOW1("CacheStorage",
-                           "CacheStorageDispatcherHost::CacheImpl::SetSideData",
-                           TRACE_ID_GLOBAL(trace_id),
-                           TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT,
-                           "url", url.spec());
-    content::CacheStorageCache* cache = cache_handle_.value();
-    if (!cache) {
-      std::move(callback).Run(blink::mojom::CacheStorageError::kErrorNotFound);
-      return;
-    }
-    scoped_refptr<net::IOBuffer> buffer =
-        base::MakeRefCounted<net::IOBuffer>(side_data.size());
-    if (!side_data.empty())
-      memcpy(buffer->data(), &side_data.front(), side_data.size());
-    cache->WriteSideData(std::move(callback), url, response_time, trace_id,
-                         std::move(buffer), side_data.size());
-  }
-
   CacheStorageCacheHandle cache_handle_;
   SEQUENCE_CHECKER(sequence_checker_);
   DISALLOW_COPY_AND_ASSIGN(CacheImpl);
@@ -494,6 +534,7 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
 
   void Match(blink::mojom::FetchAPIRequestPtr request,
              blink::mojom::MultiCacheQueryOptionsPtr match_options,
+             bool in_related_fetch_event,
              int64_t trace_id,
              blink::mojom::CacheStorage::MatchCallback callback) override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -505,7 +546,8 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
                            "options", CacheStorageTracedValue(match_options));
 
     auto cb = BindOnce(
-        [](base::TimeTicks start_time, bool match_all_caches, int64_t trace_id,
+        [](base::TimeTicks start_time, bool match_all_caches,
+           bool in_related_fetch_event, int64_t trace_id,
            blink::mojom::CacheStorage::MatchCallback callback,
            CacheStorageError error,
            blink::mojom::FetchAPIResponsePtr response) {
@@ -536,11 +578,18 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
               TRACE_ID_GLOBAL(trace_id),
               TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "response",
               CacheStorageTracedValue(response));
-          std::move(callback).Run(
-              blink::mojom::MatchResult::NewResponse(std::move(response)));
+
+          blink::mojom::MatchResultPtr result;
+          if (in_related_fetch_event) {
+            result = EagerlyReadResponseBody(std::move(response));
+          } else {
+            result =
+                blink::mojom::MatchResult::NewResponse(std::move(response));
+          }
+          std::move(callback).Run(std::move(result));
         },
-        base::TimeTicks::Now(), !match_options->cache_name, trace_id,
-        std::move(callback));
+        base::TimeTicks::Now(), !match_options->cache_name,
+        in_related_fetch_event, trace_id, std::move(callback));
 
     content::CacheStorage* cache_storage = GetOrCreateCacheStorage();
     if (!cache_storage) {
@@ -548,16 +597,20 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
       return;
     }
 
+    CacheStorageSchedulerPriority priority =
+        in_related_fetch_event ? CacheStorageSchedulerPriority::kHigh
+                               : CacheStorageSchedulerPriority::kNormal;
+
     if (!match_options->cache_name) {
       cache_storage->MatchAllCaches(std::move(request),
                                     std::move(match_options->query_options),
-                                    trace_id, std::move(cb));
+                                    priority, trace_id, std::move(cb));
       return;
     }
     std::string cache_name = base::UTF16ToUTF8(*match_options->cache_name);
     cache_storage->MatchCache(std::move(cache_name), std::move(request),
-                              std::move(match_options->query_options), trace_id,
-                              std::move(cb));
+                              std::move(match_options->query_options), priority,
+                              trace_id, std::move(cb));
   }
 
   void Open(const base::string16& cache_name,
@@ -597,15 +650,16 @@ class CacheStorageDispatcherHost::CacheStorageImpl final
                 return;
               }
 
-              blink::mojom::CacheStorageCacheAssociatedPtrInfo ptr_info;
-              auto request = mojo::MakeRequest(&ptr_info);
+              mojo::PendingAssociatedRemote<blink::mojom::CacheStorageCache>
+                  pending_remote;
               auto cache_impl =
                   std::make_unique<CacheImpl>(std::move(cache_handle));
-              self->owner_->AddCacheBinding(std::move(cache_impl),
-                                            std::move(request));
+              self->owner_->AddCacheReceiver(
+                  std::move(cache_impl),
+                  pending_remote.InitWithNewEndpointAndPassReceiver());
 
-              std::move(callback).Run(
-                  blink::mojom::OpenResult::NewCache(std::move(ptr_info)));
+              std::move(callback).Run(blink::mojom::OpenResult::NewCache(
+                  std::move(pending_remote)));
             },
             weak_factory_.GetWeakPtr(), base::TimeTicks::Now(), trace_id,
             std::move(callback));
@@ -662,11 +716,11 @@ void CacheStorageDispatcherHost::AddReceiver(
   receivers_.Add(std::move(impl), std::move(receiver));
 }
 
-void CacheStorageDispatcherHost::AddCacheBinding(
+void CacheStorageDispatcherHost::AddCacheReceiver(
     std::unique_ptr<CacheImpl> cache_impl,
-    blink::mojom::CacheStorageCacheAssociatedRequest request) {
+    mojo::PendingAssociatedReceiver<blink::mojom::CacheStorageCache> receiver) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  cache_bindings_.AddBinding(std::move(cache_impl), std::move(request));
+  cache_receivers_.Add(std::move(cache_impl), std::move(receiver));
 }
 
 CacheStorageHandle CacheStorageDispatcherHost::OpenCacheStorage(
diff --git a/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.h b/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.h
index 9d9a7f3ee2d..e75222e7b1e 100644
--- a/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.h
+++ b/chromium/content/browser/cache_storage/cache_storage_dispatcher_host.h
@@ -8,8 +8,9 @@
 #include <stdint.h>
 
 #include "content/browser/cache_storage/cache_storage_handle.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/strong_associated_binding_set.h"
+#include "mojo/public/cpp/bindings/unique_associated_receiver_set.h"
 #include "mojo/public/cpp/bindings/unique_receiver_set.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
 
@@ -47,16 +48,17 @@ class CacheStorageDispatcherHost {
   class CacheImpl;
   friend class CacheImpl;
 
-  void AddCacheBinding(
+  void AddCacheReceiver(
       std::unique_ptr<CacheImpl> cache_impl,
-      blink::mojom::CacheStorageCacheAssociatedRequest request);
+      mojo::PendingAssociatedReceiver<blink::mojom::CacheStorageCache>
+          receiver);
   CacheStorageHandle OpenCacheStorage(const url::Origin& origin);
 
   scoped_refptr<CacheStorageContextImpl> context_;
 
   mojo::UniqueReceiverSet<blink::mojom::CacheStorage> receivers_;
-  mojo::StrongAssociatedBindingSet<blink::mojom::CacheStorageCache>
-      cache_bindings_;
+  mojo::UniqueAssociatedReceiverSet<blink::mojom::CacheStorageCache>
+      cache_receivers_;
 
   SEQUENCE_CHECKER(sequence_checker_);
   DISALLOW_COPY_AND_ASSIGN(CacheStorageDispatcherHost);
diff --git a/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc
index 150fe4cf26d..e8e0a41d15f 100644
--- a/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_manager_unittest.cc
@@ -42,6 +42,7 @@
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_utils.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/disk_cache/disk_cache.h"
@@ -543,7 +544,7 @@ class CacheStorageManagerTest : public testing::Test {
         cache_manager_->OpenCacheStorage(origin, owner);
     cache_storage.value()->MatchCache(
         cache_name, std::move(request), std::move(match_options),
-        /* trace_id = */ 0,
+        CacheStorageSchedulerPriority::kNormal, /* trace_id = */ 0,
         base::BindOnce(&CacheStorageManagerTest::CacheMatchCallback,
                        base::Unretained(this), base::Unretained(&loop)));
     loop.Run();
@@ -573,7 +574,7 @@ class CacheStorageManagerTest : public testing::Test {
         cache_manager_->OpenCacheStorage(origin, owner);
     cache_storage.value()->MatchAllCaches(
         std::move(request), std::move(match_options),
-        /* trace_id = */ 0,
+        CacheStorageSchedulerPriority::kNormal, /* trace_id = */ 0,
         base::BindOnce(&CacheStorageManagerTest::CacheMatchCallback,
                        base::Unretained(this), base::Unretained(&loop)));
     loop.Run();
@@ -634,14 +635,14 @@ class CacheStorageManagerTest : public testing::Test {
     std::unique_ptr<storage::BlobDataHandle> blob_data_handle =
         blob_storage_context_->AddFinishedBlob(std::move(blob_data));
 
-    blink::mojom::BlobPtrInfo blob_ptr_info;
+    mojo::PendingRemote<blink::mojom::Blob> blob_remote;
     storage::BlobImpl::Create(std::move(blob_data_handle),
-                              MakeRequest(&blob_ptr_info));
+                              blob_remote.InitWithNewPipeAndPassReceiver());
 
     auto blob = blink::mojom::SerializedBlob::New();
     blob->uuid = blob_uuid;
     blob->size = request->url.spec().size();
-    blob->blob = std::move(blob_ptr_info);
+    blob->blob = std::move(blob_remote);
 
     base::RunLoop loop;
     CachePutWithStatusCodeAndBlobInternal(cache, std::move(request),
@@ -666,7 +667,9 @@ class CacheStorageManagerTest : public testing::Test {
         std::move(blob), blink::mojom::ServiceWorkerResponseError::kUnknown,
         base::Time(), std::string() /* cache_storage_cache_name */,
         std::vector<std::string>() /* cors_exposed_header_names */,
-        nullptr /* side_data_blob */);
+        nullptr /* side_data_blob */,
+        nullptr /* side_data_blob_for_cache_put */,
+        nullptr /* content_security_policy */);
 
     blink::mojom::BatchOperationPtr operation =
         blink::mojom::BatchOperation::New();
@@ -711,7 +714,8 @@ class CacheStorageManagerTest : public testing::Test {
     request->url = url;
     base::RunLoop loop;
     cache->Match(
-        std::move(request), nullptr, /* trace_id = */ 0,
+        std::move(request), nullptr, CacheStorageSchedulerPriority::kNormal,
+        /* trace_id = */ 0,
         base::BindOnce(&CacheStorageManagerTest::CacheMatchCallback,
                        base::Unretained(this), base::Unretained(&loop)));
     loop.Run();
@@ -2341,10 +2345,9 @@ TEST_P(CacheStorageManagerTestP, SlowPutCompletesWithoutExternalRef) {
   // Provide a fake blob implementation that delays completion.  This will
   // allow us to pause the writing operation so we can drop the external
   // reference.
-  auto blob_request = mojo::MakeRequest(&blob->blob);
   base::RunLoop blob_loop;
-  DelayedBlob delayed_blob(std::move(blob_request), body_data,
-                           blob_loop.QuitClosure());
+  DelayedBlob delayed_blob(blob->blob.InitWithNewPipeAndPassReceiver(),
+                           body_data, blob_loop.QuitClosure());
 
   // Begin the operation to write the blob into the cache.
   base::RunLoop cache_loop;
diff --git a/chromium/content/browser/cache_storage/cache_storage_operation.cc b/chromium/content/browser/cache_storage/cache_storage_operation.cc
index 99cd3b51c15..7be85256def 100644
--- a/chromium/content/browser/cache_storage/cache_storage_operation.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_operation.cc
@@ -18,6 +18,7 @@ CacheStorageOperation::CacheStorageOperation(
     CacheStorageSchedulerClient client_type,
     CacheStorageSchedulerMode mode,
     CacheStorageSchedulerOp op_type,
+    CacheStorageSchedulerPriority priority,
     scoped_refptr<base::SequencedTaskRunner> task_runner)
     : closure_(std::move(closure)),
       creation_ticks_(base::TimeTicks::Now()),
@@ -25,6 +26,7 @@ CacheStorageOperation::CacheStorageOperation(
       client_type_(client_type),
       mode_(mode),
       op_type_(op_type),
+      priority_(priority),
       task_runner_(std::move(task_runner)) {}
 
 CacheStorageOperation::~CacheStorageOperation() {
diff --git a/chromium/content/browser/cache_storage/cache_storage_operation.h b/chromium/content/browser/cache_storage/cache_storage_operation.h
index 91e07fe6865..2f776582759 100644
--- a/chromium/content/browser/cache_storage/cache_storage_operation.h
+++ b/chromium/content/browser/cache_storage/cache_storage_operation.h
@@ -25,6 +25,7 @@ class CONTENT_EXPORT CacheStorageOperation {
                         CacheStorageSchedulerClient client_type,
                         CacheStorageSchedulerMode mode,
                         CacheStorageSchedulerOp op_type,
+                        CacheStorageSchedulerPriority priority,
                         scoped_refptr<base::SequencedTaskRunner> task_runner);
 
   ~CacheStorageOperation();
@@ -36,6 +37,7 @@ class CONTENT_EXPORT CacheStorageOperation {
   CacheStorageSchedulerId id() const { return id_; }
   CacheStorageSchedulerMode mode() const { return mode_; }
   CacheStorageSchedulerOp op_type() const { return op_type_; }
+  CacheStorageSchedulerPriority priority() const { return priority_; }
   base::WeakPtr<CacheStorageOperation> AsWeakPtr() {
     return weak_ptr_factory_.GetWeakPtr();
   }
@@ -59,6 +61,7 @@ class CONTENT_EXPORT CacheStorageOperation {
   const CacheStorageSchedulerClient client_type_;
   const CacheStorageSchedulerMode mode_;
   const CacheStorageSchedulerOp op_type_;
+  const CacheStorageSchedulerPriority priority_;
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
   base::WeakPtrFactory<CacheStorageOperation> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/cache_storage/cache_storage_operation_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_operation_unittest.cc
index b02f6cfffdb..32c7e25b394 100644
--- a/chromium/content/browser/cache_storage/cache_storage_operation_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_operation_unittest.cc
@@ -41,7 +41,7 @@ class CacheStorageOperationTest : public testing::Test {
         base::BindOnce(&TestTask::Run, base::Unretained(&task_)),
         /* id = */ 0, CacheStorageSchedulerClient::kStorage,
         CacheStorageSchedulerMode::kExclusive, CacheStorageSchedulerOp::kTest,
-        mock_task_runner_);
+        CacheStorageSchedulerPriority::kNormal, mock_task_runner_);
   }
 
   base::HistogramTester histogram_tester_;
diff --git a/chromium/content/browser/cache_storage/cache_storage_scheduler.cc b/chromium/content/browser/cache_storage/cache_storage_scheduler.cc
index 5e0685cdf9d..cc20f191e8f 100644
--- a/chromium/content/browser/cache_storage/cache_storage_scheduler.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_scheduler.cc
@@ -13,6 +13,7 @@
 #include "base/metrics/field_trial_params.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/sequenced_task_runner.h"
+#include "build/build_config.h"
 #include "content/browser/cache_storage/cache_storage_histogram_utils.h"
 #include "content/browser/cache_storage/cache_storage_operation.h"
 #include "content/public/common/content_features.h"
@@ -21,15 +22,49 @@ namespace content {
 
 namespace {
 
+// Maximum parallel shared operations.  This constant was selected via
+// experimentation.  We tried 4, 16, and 64 for the limit.  16 was clearly
+// better than 4, but 64 was did not provide significant further benefit.
+// TODO(crbug/1007994): Enable parallel shared operations on android after
+//                      performance regressions are addressed.
+#if defined(OS_ANDROID)
+constexpr int kDefaultMaxSharedOps = 1;
+#else
+constexpr int kDefaultMaxSharedOps = 16;
+#endif
+
 const base::FeatureParam<int> kCacheStorageMaxSharedOps{
-    &features::kCacheStorageParallelOps, "max_shared_ops", 1};
+    &features::kCacheStorageParallelOps, "max_shared_ops",
+    kDefaultMaxSharedOps};
+
+bool OpPointerLessThan(const std::unique_ptr<CacheStorageOperation>& left,
+                       const std::unique_ptr<CacheStorageOperation>& right) {
+  DCHECK(left);
+  DCHECK(right);
+  // We want to prioritize high priority operations, but otherwise sort
+  // by creation order.  Since the first created operations will have a lower
+  // identifier value we reverse the logic of the id comparison.
+  //
+  // Note, there might be a slight mis-ordering when the 64-bit id values
+  // rollover, but this should not be critical and will happen very rarely.
+  if (left->priority() < right->priority()) {
+    return true;
+  }
+  if (left->priority() > right->priority()) {
+    return false;
+  }
+  return left->id() > right->id();
+}
 
 }  // namespace
 
 CacheStorageScheduler::CacheStorageScheduler(
     CacheStorageSchedulerClient client_type,
     scoped_refptr<base::SequencedTaskRunner> task_runner)
-    : task_runner_(std::move(task_runner)), client_type_(client_type) {}
+    : task_runner_(std::move(task_runner)), client_type_(client_type) {
+  std::make_heap(pending_operations_.begin(), pending_operations_.end(),
+                 &OpPointerLessThan);
+}
 
 CacheStorageScheduler::~CacheStorageScheduler() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -40,17 +75,22 @@ CacheStorageSchedulerId CacheStorageScheduler::CreateId() {
   return next_id_++;
 }
 
-void CacheStorageScheduler::ScheduleOperation(CacheStorageSchedulerId id,
-                                              CacheStorageSchedulerMode mode,
-                                              CacheStorageSchedulerOp op_type,
-                                              base::OnceClosure closure) {
+void CacheStorageScheduler::ScheduleOperation(
+    CacheStorageSchedulerId id,
+    CacheStorageSchedulerMode mode,
+    CacheStorageSchedulerOp op_type,
+    CacheStorageSchedulerPriority priority,
+    base::OnceClosure closure) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   RecordCacheStorageSchedulerUMA(CacheStorageSchedulerUMA::kQueueLength,
                                  client_type_, op_type,
                                  pending_operations_.size());
 
   pending_operations_.push_back(std::make_unique<CacheStorageOperation>(
-      std::move(closure), id, client_type_, mode, op_type, task_runner_));
+      std::move(closure), id, client_type_, mode, op_type, priority,
+      task_runner_));
+  std::push_heap(pending_operations_.begin(), pending_operations_.end(),
+                 &OpPointerLessThan);
   MaybeRunOperation();
 }
 
@@ -124,7 +164,9 @@ void CacheStorageScheduler::MaybeRunOperation() {
 
   running_operations_.emplace(next_operation->id(),
                               std::move(pending_operations_.front()));
-  pending_operations_.pop_front();
+  std::pop_heap(pending_operations_.begin(), pending_operations_.end(),
+                &OpPointerLessThan);
+  pending_operations_.pop_back();
 
   RecordCacheStorageSchedulerUMA(
       CacheStorageSchedulerUMA::kQueueDuration, client_type_,
diff --git a/chromium/content/browser/cache_storage/cache_storage_scheduler.h b/chromium/content/browser/cache_storage/cache_storage_scheduler.h
index 6bd9a574ad2..a9d2580b5fa 100644
--- a/chromium/content/browser/cache_storage/cache_storage_scheduler.h
+++ b/chromium/content/browser/cache_storage/cache_storage_scheduler.h
@@ -5,8 +5,8 @@
 #ifndef CONTENT_BROWSER_CACHE_STORAGE_CACHE_STORAGE_SCHEDULER_H_
 #define CONTENT_BROWSER_CACHE_STORAGE_CACHE_STORAGE_SCHEDULER_H_
 
-#include <list>
 #include <map>
+#include <vector>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ -45,6 +45,7 @@ class CONTENT_EXPORT CacheStorageScheduler {
   void ScheduleOperation(CacheStorageSchedulerId id,
                          CacheStorageSchedulerMode mode,
                          CacheStorageSchedulerOp op_type,
+                         CacheStorageSchedulerPriority priority,
                          base::OnceClosure closure);
 
   // Call this after each operation completes. It cleans up the operation
@@ -95,7 +96,12 @@ class CONTENT_EXPORT CacheStorageScheduler {
   }
 
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
-  std::list<std::unique_ptr<CacheStorageOperation>> pending_operations_;
+
+  // Managed as a heap using std::push_heap and std::pop_heap.  We do not
+  // use std::priority_queue since it does not support moving the contained
+  // unique_ptr out when the operation begins execution.
+  std::vector<std::unique_ptr<CacheStorageOperation>> pending_operations_;
+
   std::map<CacheStorageSchedulerId, std::unique_ptr<CacheStorageOperation>>
       running_operations_;
   const CacheStorageSchedulerClient client_type_;
diff --git a/chromium/content/browser/cache_storage/cache_storage_scheduler_types.h b/chromium/content/browser/cache_storage/cache_storage_scheduler_types.h
index 45f92452055..67079551dd1 100644
--- a/chromium/content/browser/cache_storage/cache_storage_scheduler_types.h
+++ b/chromium/content/browser/cache_storage/cache_storage_scheduler_types.h
@@ -51,6 +51,11 @@ enum class CacheStorageSchedulerOp {
   kWriteSideData = 15,
 };
 
+enum class CacheStorageSchedulerPriority {
+  kNormal = 0,
+  kHigh = 1,
+};
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_CACHE_STORAGE_CACHE_STORAGE_SCHEDULER_TYPES_H_
diff --git a/chromium/content/browser/cache_storage/cache_storage_scheduler_unittest.cc b/chromium/content/browser/cache_storage/cache_storage_scheduler_unittest.cc
index 15e730d1815..fcb048ebbcb 100644
--- a/chromium/content/browser/cache_storage/cache_storage_scheduler_unittest.cc
+++ b/chromium/content/browser/cache_storage/cache_storage_scheduler_unittest.cc
@@ -83,7 +83,7 @@ TEST_F(CacheStorageSchedulerTest, ScheduleOne) {
   scheduler_.SetDoneStartingClosure(done_loop.QuitClosure());
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   task1_.run_loop().Run();
   done_loop.Run();
@@ -95,7 +95,7 @@ TEST_F(CacheStorageSchedulerTest, ScheduledOperations) {
   scheduler_.SetDoneStartingClosure(done_loop.QuitClosure());
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   EXPECT_TRUE(scheduler_.ScheduledOperations());
   task1_.run_loop().Run();
@@ -115,13 +115,13 @@ TEST_F(CacheStorageSchedulerTest, ScheduleTwoExclusive) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
 
   // Should only run the first exclusive op.
@@ -151,13 +151,13 @@ TEST_F(CacheStorageSchedulerTest, ScheduleTwoShared) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
 
   // Should run both shared ops in paralle.
@@ -199,13 +199,13 @@ TEST_F(CacheStorageSchedulerTest, ScheduleOneExclusiveOneShared) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
 
   // Should only run the first exclusive op.
@@ -238,13 +238,13 @@ TEST_F(CacheStorageSchedulerTest, ScheduleOneSharedOneExclusive) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
 
   // Should only run the first shared op.
@@ -277,17 +277,17 @@ TEST_F(CacheStorageSchedulerTest, ScheduleTwoSharedOneExclusive) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task3_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task3_)));
 
   // Should run the two shared ops in parallel.
@@ -337,17 +337,17 @@ TEST_F(CacheStorageSchedulerTest, ScheduleOneExclusiveTwoShared) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task3_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task3_)));
 
   // Should only run the first exclusive op.
@@ -395,17 +395,17 @@ TEST_F(CacheStorageSchedulerTest, ScheduleOneSharedOneExclusiveOneShared) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task3_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task3_)));
 
   // Should only run the first shared op.
@@ -455,13 +455,13 @@ TEST_F(CacheStorageSchedulerTest, ScheduleTwoSharedNotParallel) {
 
   scheduler_.ScheduleOperation(
       task1_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
   base::RunLoop done_loop1;
   scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
   scheduler_.ScheduleOperation(
       task2_.id(), CacheStorageSchedulerMode::kShared,
-      CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
 
   // Should only run one shared op since the max shared is set to 1.
@@ -484,5 +484,54 @@ TEST_F(CacheStorageSchedulerTest, ScheduleTwoSharedNotParallel) {
   EXPECT_FALSE(scheduler_.IsRunningExclusiveOperation());
 }
 
+TEST_F(CacheStorageSchedulerTest, ScheduleByPriorityTwoNormalOneHigh) {
+  scheduler_.ScheduleOperation(
+      task1_.id(), CacheStorageSchedulerMode::kExclusive,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
+      base::BindOnce(&TestTask::Run, base::Unretained(&task1_)));
+  base::RunLoop done_loop1;
+  scheduler_.SetDoneStartingClosure(done_loop1.QuitClosure());
+  scheduler_.ScheduleOperation(
+      task2_.id(), CacheStorageSchedulerMode::kExclusive,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kNormal,
+      base::BindOnce(&TestTask::Run, base::Unretained(&task2_)));
+  scheduler_.ScheduleOperation(
+      task3_.id(), CacheStorageSchedulerMode::kExclusive,
+      CacheStorageSchedulerOp::kTest, CacheStorageSchedulerPriority::kHigh,
+      base::BindOnce(&TestTask::Run, base::Unretained(&task3_)));
+
+  // Should run the first normal priority op because the queue was empty
+  // when it was added.
+  task1_.run_loop().Run();
+  done_loop1.Run();
+  EXPECT_EQ(1, task1_.callback_count());
+  EXPECT_EQ(0, task2_.callback_count());
+  EXPECT_EQ(0, task3_.callback_count());
+
+  base::RunLoop done_loop3;
+  scheduler_.SetDoneStartingClosure(done_loop3.QuitClosure());
+
+  // Should run the high priority op next.
+  task1_.Done();
+  task3_.run_loop().Run();
+  done_loop3.Run();
+  EXPECT_EQ(1, task1_.callback_count());
+  EXPECT_EQ(0, task2_.callback_count());
+  EXPECT_EQ(1, task3_.callback_count());
+
+  base::RunLoop done_loop2;
+  scheduler_.SetDoneStartingClosure(done_loop2.QuitClosure());
+
+  // Should run the final normal priority op after the high priority op
+  // completes.
+  task3_.Done();
+  EXPECT_TRUE(scheduler_.ScheduledOperations());
+  task2_.run_loop().Run();
+  done_loop2.Run();
+  EXPECT_EQ(1, task1_.callback_count());
+  EXPECT_EQ(1, task2_.callback_count());
+  EXPECT_EQ(1, task3_.callback_count());
+}
+
 }  // namespace cache_storage_scheduler_unittest
 }  // namespace content
diff --git a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc
index 936f7260141..9c7397522a6 100644
--- a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc
+++ b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.cc
@@ -96,6 +96,7 @@ class CrossSequenceCacheStorage::Inner {
   void MatchCache(const std::string& cache_name,
                   blink::mojom::FetchAPIRequestPtr request,
                   blink::mojom::CacheQueryOptionsPtr match_options,
+                  CacheStorageSchedulerPriority priority,
                   int64_t trace_id,
                   CacheStorageCache::ResponseCallback callback) {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -105,12 +106,13 @@ class CrossSequenceCacheStorage::Inner {
       return;
     }
     handle_.value()->MatchCache(cache_name, std::move(request),
-                                std::move(match_options), trace_id,
+                                std::move(match_options), priority, trace_id,
                                 std::move(callback));
   }
 
   void MatchAllCaches(blink::mojom::FetchAPIRequestPtr request,
                       blink::mojom::CacheQueryOptionsPtr match_options,
+                      CacheStorageSchedulerPriority priority,
                       int64_t trace_id,
                       CacheStorageCache::ResponseCallback callback) {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -120,8 +122,8 @@ class CrossSequenceCacheStorage::Inner {
       return;
     }
     handle_.value()->MatchAllCaches(std::move(request),
-                                    std::move(match_options), trace_id,
-                                    std::move(callback));
+                                    std::move(match_options), priority,
+                                    trace_id, std::move(callback));
   }
 
   void WriteToCache(const std::string& cache_name,
@@ -250,22 +252,24 @@ void CrossSequenceCacheStorage::MatchCache(
     const std::string& cache_name,
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     CacheStorageCache::ResponseCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   inner_.Post(FROM_HERE, &Inner::MatchCache, cache_name, std::move(request),
-              std::move(match_options), trace_id,
+              std::move(match_options), priority, trace_id,
               WrapCallbackForCurrentSequence(std::move(callback)));
 }
 
 void CrossSequenceCacheStorage::MatchAllCaches(
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     CacheStorageCache::ResponseCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   inner_.Post(FROM_HERE, &Inner::MatchAllCaches, std::move(request),
-              std::move(match_options), trace_id,
+              std::move(match_options), priority, trace_id,
               WrapCallbackForCurrentSequence(std::move(callback)));
 }
 
diff --git a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h
index fc32d531007..101fd2cc93c 100644
--- a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h
+++ b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage.h
@@ -51,10 +51,12 @@ class CrossSequenceCacheStorage
   void MatchCache(const std::string& cache_name,
                   blink::mojom::FetchAPIRequestPtr request,
                   blink::mojom::CacheQueryOptionsPtr match_options,
+                  CacheStorageSchedulerPriority priority,
                   int64_t trace_id,
                   CacheStorageCache::ResponseCallback callback) override;
   void MatchAllCaches(blink::mojom::FetchAPIRequestPtr request,
                       blink::mojom::CacheQueryOptionsPtr match_options,
+                      CacheStorageSchedulerPriority priority,
                       int64_t trace_id,
                       CacheStorageCache::ResponseCallback callback) override;
   void WriteToCache(const std::string& cache_name,
diff --git a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.cc b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.cc
index dc2c5c95e11..c72f9ab240e 100644
--- a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.cc
+++ b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.cc
@@ -24,6 +24,7 @@ class CrossSequenceCacheStorageCache::Inner {
 
   void Match(blink::mojom::FetchAPIRequestPtr request,
              blink::mojom::CacheQueryOptionsPtr match_options,
+             CacheStorageSchedulerPriority priority,
              int64_t trace_id,
              ResponseCallback callback) {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -33,7 +34,7 @@ class CrossSequenceCacheStorageCache::Inner {
       return;
     }
     handle_.value()->Match(std::move(request), std::move(match_options),
-                           trace_id, std::move(callback));
+                           priority, trace_id, std::move(callback));
   }
 
   void MatchAll(blink::mojom::FetchAPIRequestPtr request,
@@ -168,11 +169,12 @@ bool CrossSequenceCacheStorageCache::IsUnreferenced() const {
 void CrossSequenceCacheStorageCache::Match(
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     ResponseCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   inner_.Post(FROM_HERE, &Inner::Match, std::move(request),
-              std::move(match_options), trace_id,
+              std::move(match_options), priority, trace_id,
               WrapCallbackForCurrentSequence(std::move(callback)));
 }
 
diff --git a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.h b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.h
index 36dc9c2a09f..09d1f2ea556 100644
--- a/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.h
+++ b/chromium/content/browser/cache_storage/cross_sequence/cross_sequence_cache_storage_cache.h
@@ -41,6 +41,7 @@ class CrossSequenceCacheStorageCache
   bool IsUnreferenced() const override;
   void Match(blink::mojom::FetchAPIRequestPtr request,
              blink::mojom::CacheQueryOptionsPtr match_options,
+             CacheStorageSchedulerPriority priority,
              int64_t trace_id,
              ResponseCallback callback) override;
 
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc
index b1a4d62c923..406195f5d66 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.cc
@@ -631,6 +631,7 @@ void LegacyCacheStorage::OpenCache(const std::string& cache_name,
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive, CacheStorageSchedulerOp::kOpen,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::OpenCacheImpl, weak_factory_.GetWeakPtr(),
           cache_name, trace_id,
@@ -652,6 +653,7 @@ void LegacyCacheStorage::HasCache(const std::string& cache_name,
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kHas,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::HasCacheImpl, weak_factory_.GetWeakPtr(),
           cache_name, trace_id,
@@ -673,7 +675,7 @@ void LegacyCacheStorage::DoomCache(const std::string& cache_name,
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kDelete,
+      CacheStorageSchedulerOp::kDelete, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::DoomCacheImpl, weak_factory_.GetWeakPtr(),
           cache_name, trace_id,
@@ -694,6 +696,7 @@ void LegacyCacheStorage::EnumerateCaches(int64_t trace_id,
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kKeys,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::EnumerateCachesImpl, weak_factory_.GetWeakPtr(),
           trace_id,
@@ -704,6 +707,7 @@ void LegacyCacheStorage::MatchCache(
     const std::string& cache_name,
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     CacheStorageCache::ResponseCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -718,15 +722,18 @@ void LegacyCacheStorage::MatchCache(
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kMatch,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::MatchCacheImpl, weak_factory_.GetWeakPtr(),
-          cache_name, std::move(request), std::move(match_options), trace_id,
+          cache_name, std::move(request), std::move(match_options), priority,
+          trace_id,
           scheduler_->WrapCallbackToRunNext(id, std::move(callback))));
 }
 
 void LegacyCacheStorage::MatchAllCaches(
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     CacheStorageCache::ResponseCallback callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -742,9 +749,10 @@ void LegacyCacheStorage::MatchAllCaches(
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared,
       CacheStorageSchedulerOp::kMatchAll,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::MatchAllCachesImpl, weak_factory_.GetWeakPtr(),
-          std::move(request), std::move(match_options), trace_id,
+          std::move(request), std::move(match_options), priority, trace_id,
           scheduler_->WrapCallbackToRunNext(id, std::move(callback))));
 }
 
@@ -769,6 +777,7 @@ void LegacyCacheStorage::WriteToCache(
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kPut,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::WriteToCacheImpl, weak_factory_.GetWeakPtr(),
           cache_name, std::move(request), std::move(response), trace_id,
@@ -788,6 +797,7 @@ void LegacyCacheStorage::GetSizeThenCloseAllCaches(SizeCallback callback) {
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared,
       CacheStorageSchedulerOp::kSizeThenClose,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::GetSizeThenCloseAllCachesImpl,
           weak_factory_.GetWeakPtr(),
@@ -803,6 +813,7 @@ void LegacyCacheStorage::Size(LegacyCacheStorage::SizeCallback callback) {
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kSize,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::SizeImpl, weak_factory_.GetWeakPtr(),
           scheduler_->WrapCallbackToRunNext(id, std::move(callback))));
@@ -840,6 +851,7 @@ void LegacyCacheStorage::WriteIndex(base::OnceCallback<void(bool)> callback) {
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kWriteIndex,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorage::WriteIndexImpl, weak_factory_.GetWeakPtr(),
           scheduler_->WrapCallbackToRunNext(id, std::move(callback))));
@@ -914,9 +926,9 @@ void LegacyCacheStorage::CacheUnreferenced(LegacyCacheStorageCache* cache) {
 
 CacheStorageSchedulerId LegacyCacheStorage::StartAsyncOperationForTesting() {
   auto id = scheduler_->CreateId();
-  scheduler_->ScheduleOperation(id, CacheStorageSchedulerMode::kExclusive,
-                                CacheStorageSchedulerOp::kTest,
-                                base::DoNothing());
+  scheduler_->ScheduleOperation(
+      id, CacheStorageSchedulerMode::kExclusive, CacheStorageSchedulerOp::kTest,
+      CacheStorageSchedulerPriority::kNormal, base::DoNothing());
   return id;
 }
 
@@ -939,7 +951,7 @@ void LegacyCacheStorage::LazyInit() {
   init_id_ = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       init_id_, CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kInit,
+      CacheStorageSchedulerOp::kInit, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&LegacyCacheStorage::LazyInitImpl,
                      weak_factory_.GetWeakPtr()));
 }
@@ -1175,6 +1187,7 @@ void LegacyCacheStorage::MatchCacheImpl(
     const std::string& cache_name,
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     CacheStorageCache::ResponseCallback callback) {
   TRACE_EVENT_WITH_FLOW2("CacheStorage", "LegacyCacheStorage::MatchCacheImpl",
@@ -1195,7 +1208,7 @@ void LegacyCacheStorage::MatchCacheImpl(
   // match is done.
   CacheStorageCache* cache_ptr = cache_handle.value();
   cache_ptr->Match(
-      std::move(request), std::move(match_options), trace_id,
+      std::move(request), std::move(match_options), priority, trace_id,
       base::BindOnce(&LegacyCacheStorage::MatchCacheDidMatch,
                      weak_factory_.GetWeakPtr(), std::move(cache_handle),
                      trace_id, std::move(callback)));
@@ -1217,6 +1230,7 @@ void LegacyCacheStorage::MatchCacheDidMatch(
 void LegacyCacheStorage::MatchAllCachesImpl(
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     CacheStorageCache::ResponseCallback callback) {
   TRACE_EVENT_WITH_FLOW0("CacheStorage",
@@ -1242,7 +1256,7 @@ void LegacyCacheStorage::MatchAllCachesImpl(
     CacheStorageCache* cache_ptr = cache_handle.value();
     cache_ptr->Match(
         BackgroundFetchSettledFetch::CloneRequest(request),
-        match_options ? match_options->Clone() : nullptr, trace_id,
+        match_options ? match_options->Clone() : nullptr, priority, trace_id,
         base::BindOnce(&LegacyCacheStorage::MatchAllCachesDidMatch,
                        weak_factory_.GetWeakPtr(), std::move(cache_handle),
                        &match_responses->at(idx), barrier_closure, trace_id));
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h
index 2e68fe9bc7e..726c1165177 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage.h
@@ -100,11 +100,13 @@ class CONTENT_EXPORT LegacyCacheStorage : public CacheStorage,
   void MatchCache(const std::string& cache_name,
                   blink::mojom::FetchAPIRequestPtr request,
                   blink::mojom::CacheQueryOptionsPtr match_options,
+                  CacheStorageSchedulerPriority priority,
                   int64_t trace_id,
                   CacheStorageCache::ResponseCallback callback) override;
 
   void MatchAllCaches(blink::mojom::FetchAPIRequestPtr request,
                       blink::mojom::CacheQueryOptionsPtr match_options,
+                      CacheStorageSchedulerPriority priority,
                       int64_t trace_id,
                       CacheStorageCache::ResponseCallback callback) override;
 
@@ -215,6 +217,7 @@ class CONTENT_EXPORT LegacyCacheStorage : public CacheStorage,
   void MatchCacheImpl(const std::string& cache_name,
                       blink::mojom::FetchAPIRequestPtr request,
                       blink::mojom::CacheQueryOptionsPtr match_options,
+                      CacheStorageSchedulerPriority priority,
                       int64_t trace_id,
                       CacheStorageCache::ResponseCallback callback);
   void MatchCacheDidMatch(CacheStorageCacheHandle cache_handle,
@@ -226,6 +229,7 @@ class CONTENT_EXPORT LegacyCacheStorage : public CacheStorage,
   // The MatchAllCaches callbacks are below.
   void MatchAllCachesImpl(blink::mojom::FetchAPIRequestPtr request,
                           blink::mojom::CacheQueryOptionsPtr match_options,
+                          CacheStorageSchedulerPriority priority,
                           int64_t trace_id,
                           CacheStorageCache::ResponseCallback callback);
   void MatchAllCachesDidMatch(CacheStorageCacheHandle cache_handle,
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc
index 100ee7815bb..19a1289f285 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.cc
@@ -47,6 +47,7 @@
 #include "content/public/common/referrer_type_converters.h"
 #include "crypto/hmac.h"
 #include "crypto/symmetric_key.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/completion_repeating_callback.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
@@ -355,7 +356,8 @@ blink::mojom::FetchAPIResponsePtr CreateResponse(
       std::vector<std::string>(
           metadata.response().cors_exposed_header_names().begin(),
           metadata.response().cors_exposed_header_names().end()),
-      nullptr /* side_data_blob */);
+      nullptr /* side_data_blob */, nullptr /* side_data_blob_for_cache_put */,
+      nullptr /* content_security_policy */);
 }
 
 // The size of opaque (non-cors) resource responses are padded in order
@@ -522,6 +524,7 @@ bool LegacyCacheStorageCache::IsUnreferenced() const {
 void LegacyCacheStorageCache::Match(
     blink::mojom::FetchAPIRequestPtr request,
     blink::mojom::CacheQueryOptionsPtr match_options,
+    CacheStorageSchedulerPriority priority,
     int64_t trace_id,
     ResponseCallback callback) {
   if (backend_state_ == BACKEND_CLOSED) {
@@ -533,6 +536,7 @@ void LegacyCacheStorageCache::Match(
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kMatch,
+      priority,
       base::BindOnce(
           &LegacyCacheStorageCache::MatchImpl, weak_ptr_factory_.GetWeakPtr(),
           std::move(request), std::move(match_options), trace_id,
@@ -555,6 +559,7 @@ void LegacyCacheStorageCache::MatchAll(
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared,
       CacheStorageSchedulerOp::kMatchAll,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::MatchAllImpl,
           weak_ptr_factory_.GetWeakPtr(), std::move(request),
@@ -641,9 +646,10 @@ void LegacyCacheStorageCache::BatchOperation(
   for (const auto& operation : operations) {
     if (operation->operation_type == blink::mojom::OperationType::kPut) {
       safe_space_required += CalculateRequiredSafeSpaceForPut(operation);
-      safe_side_data_size += (operation->response->side_data_blob
-                                  ? operation->response->side_data_blob->size
-                                  : 0);
+      safe_side_data_size +=
+          (operation->response->side_data_blob_for_cache_put
+               ? operation->response->side_data_blob_for_cache_put->size
+               : 0);
     }
   }
   if (!safe_space_required.IsValid() || !safe_side_data_size.IsValid()) {
@@ -754,7 +760,7 @@ void LegacyCacheStorageCache::BatchDidGetUsageAndQuota(
     switch (operation->operation_type) {
       case blink::mojom::OperationType::kPut:
         if (skip_side_data) {
-          operation->response->side_data_blob = nullptr;
+          operation->response->side_data_blob_for_cache_put = nullptr;
           Put(std::move(operation), trace_id, completion_callback);
         } else {
           Put(std::move(operation), trace_id, completion_callback);
@@ -822,6 +828,7 @@ void LegacyCacheStorageCache::Keys(blink::mojom::FetchAPIRequestPtr request,
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kKeys,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::KeysImpl, weak_ptr_factory_.GetWeakPtr(),
           std::move(request), std::move(options), trace_id,
@@ -835,7 +842,7 @@ void LegacyCacheStorageCache::Close(base::OnceClosure callback) {
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kClose,
+      CacheStorageSchedulerOp::kClose, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::CloseImpl, weak_ptr_factory_.GetWeakPtr(),
           scheduler_->WrapCallbackToRunNext(id, std::move(callback))));
@@ -852,6 +859,7 @@ void LegacyCacheStorageCache::Size(SizeCallback callback) {
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared, CacheStorageSchedulerOp::kSize,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::SizeImpl, weak_ptr_factory_.GetWeakPtr(),
           scheduler_->WrapCallbackToRunNext(id, std::move(callback))));
@@ -868,6 +876,7 @@ void LegacyCacheStorageCache::GetSizeThenClose(SizeCallback callback) {
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kSizeThenClose,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::SizeImpl, weak_ptr_factory_.GetWeakPtr(),
           base::BindOnce(
@@ -1356,6 +1365,7 @@ void LegacyCacheStorageCache::WriteSideDataDidGetQuota(
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
       CacheStorageSchedulerOp::kWriteSideData,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&LegacyCacheStorageCache::WriteSideDataImpl,
                      weak_ptr_factory_.GetWeakPtr(),
                      scheduler_->WrapCallbackToRunNext(id, std::move(callback)),
@@ -1557,6 +1567,7 @@ void LegacyCacheStorageCache::Put(blink::mojom::FetchAPIRequestPtr request,
 
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive, CacheStorageSchedulerOp::kPut,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(&LegacyCacheStorageCache::PutImpl,
                      weak_ptr_factory_.GetWeakPtr(), std::move(put_context)));
 }
@@ -1779,7 +1790,7 @@ void LegacyCacheStorageCache::PutWriteBlobToCache(
                          TRACE_ID_GLOBAL(put_context->trace_id),
                          TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 
-  blink::mojom::BlobPtr blob;
+  mojo::PendingRemote<blink::mojom::Blob> blob;
   int64_t blob_size = 0;
 
   switch (disk_cache_body_index) {
@@ -1971,6 +1982,7 @@ void LegacyCacheStorageCache::GetAllMatchedEntries(
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kShared,
       CacheStorageSchedulerOp::kGetAllMatched,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::GetAllMatchedEntriesImpl,
           weak_ptr_factory_.GetWeakPtr(), std::move(request),
@@ -2056,7 +2068,7 @@ void LegacyCacheStorageCache::Delete(blink::mojom::BatchOperationPtr operation,
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive,
-      CacheStorageSchedulerOp::kDelete,
+      CacheStorageSchedulerOp::kDelete, CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::DeleteImpl, weak_ptr_factory_.GetWeakPtr(),
           std::move(request), std::move(operation->match_options),
@@ -2263,6 +2275,7 @@ void LegacyCacheStorageCache::InitBackend() {
   auto id = scheduler_->CreateId();
   scheduler_->ScheduleOperation(
       id, CacheStorageSchedulerMode::kExclusive, CacheStorageSchedulerOp::kInit,
+      CacheStorageSchedulerPriority::kNormal,
       base::BindOnce(
           &LegacyCacheStorageCache::CreateBackend,
           weak_ptr_factory_.GetWeakPtr(),
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.h b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.h
index d84b230cadd..1a287f7ed67 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.h
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_cache.h
@@ -91,6 +91,7 @@ class CONTENT_EXPORT LegacyCacheStorageCache : public CacheStorageCache {
 
   void Match(blink::mojom::FetchAPIRequestPtr request,
              blink::mojom::CacheQueryOptionsPtr match_options,
+             CacheStorageSchedulerPriority priority,
              int64_t trace_id,
              ResponseCallback callback) override;
 
diff --git a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc
index 537640fe300..268a1e91abf 100644
--- a/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc
+++ b/chromium/content/browser/cache_storage/legacy/legacy_cache_storage_manager.cc
@@ -70,7 +70,11 @@ int64_t GetCacheStorageSize(const base::FilePath& base_path,
   // have a modified time older than the index's modified time.  Modifying
   // the index should update the directories time as well.  Therefore we
   // should be guaranteed that the time is equal here.
-  DCHECK_EQ(base_path_time, index_time);
+  //
+  // In practice, though, there can be a few microseconds difference on
+  // some operating systems so we can't do an exact DCHECK here.  Instead
+  // we do a fuzzy DCHECK allowing some microseconds difference.
+  DCHECK_LE((index_time - base_path_time).magnitude().InMicroseconds(), 10);
 
   int64_t storage_size = 0;
   for (int i = 0, max = index.cache_size(); i < max; ++i) {
diff --git a/chromium/content/browser/can_commit_status.h b/chromium/content/browser/can_commit_status.h
new file mode 100644
index 00000000000..1e5334998fc
--- /dev/null
+++ b/chromium/content/browser/can_commit_status.h
@@ -0,0 +1,20 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_CAN_COMMIT_STATUS_H_
+#define CONTENT_BROWSER_CAN_COMMIT_STATUS_H_
+
+namespace content {
+// Status type used by functions that check whether it is ok to commit
+// a particular combination of URL and Origin to a specific process.
+// It indicates that a commit is allowed or signals whether the URL or
+// origin prevented the commit.
+enum class CanCommitStatus {
+  CAN_COMMIT_ORIGIN_AND_URL,
+  CANNOT_COMMIT_ORIGIN,
+  CANNOT_COMMIT_URL
+};
+
+}  // namespace content
+#endif  // CONTENT_BROWSER_CAN_COMMIT_STATUS_H_
diff --git a/chromium/content/browser/child_process_launcher_helper_android.cc b/chromium/content/browser/child_process_launcher_helper_android.cc
index 555756972af..fd90d21bdf9 100644
--- a/chromium/content/browser/child_process_launcher_helper_android.cc
+++ b/chromium/content/browser/child_process_launcher_helper_android.cc
@@ -83,6 +83,12 @@ ChildProcessLauncherHelper::GetFilesToMap() {
   base::MemoryMappedFile::Region icu_region;
   int fd = base::i18n::GetIcuDataFileHandle(&icu_region);
   files_to_register->ShareWithRegion(kAndroidICUDataDescriptor, fd, icu_region);
+  base::MemoryMappedFile::Region icu_extra_region;
+  int extra_fd = base::i18n::GetIcuExtraDataFileHandle(&icu_extra_region);
+  if (extra_fd != -1) {
+    files_to_register->ShareWithRegion(kAndroidICUExtraDataDescriptor, extra_fd,
+                                       icu_extra_region);
+  }
 #endif  // ICU_UTIL_DATA_IMPL == ICU_UTIL_DATA_FILE
 
   return files_to_register;
diff --git a/chromium/content/browser/child_process_security_policy_browsertest.cc b/chromium/content/browser/child_process_security_policy_browsertest.cc
index 810e975b253..93f0f9284ff 100644
--- a/chromium/content/browser/child_process_security_policy_browsertest.cc
+++ b/chromium/content/browser/child_process_security_policy_browsertest.cc
@@ -50,7 +50,7 @@ IN_PROC_BROWSER_TEST_F(ChildProcessSecurityPolicyInProcessBrowserTest, NoLeak) {
   GURL url = GetTestUrl("", "simple_page.html");
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   {
     base::AutoLock lock(policy->lock_);
     EXPECT_EQ(RenderProcessHostImpl::IsSpareProcessKeptAtAllTimes() ? 2u : 1u,
diff --git a/chromium/content/browser/child_process_security_policy_impl.cc b/chromium/content/browser/child_process_security_policy_impl.cc
index 97d3cc6af29..770929b84a3 100644
--- a/chromium/content/browser/child_process_security_policy_impl.cc
+++ b/chromium/content/browser/child_process_security_policy_impl.cc
@@ -16,6 +16,7 @@
 #include "base/macros.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
+#include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
 #include "content/browser/bad_message.h"
@@ -32,6 +33,7 @@
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/filename_util.h"
 #include "net/base/url_util.h"
@@ -329,18 +331,22 @@ class ChildProcessSecurityPolicyImpl::SecurityState {
     return false;
   }
 
-  bool CanAccessDataForOrigin(const GURL& site_url) {
-    if (origin_lock_.is_empty())
-      return true;
-    return origin_lock_ == site_url;
-  }
-
   void LockToOrigin(const GURL& gurl, BrowsingInstanceId browsing_instance_id) {
     DCHECK(origin_lock_.is_empty());
+    DCHECK_NE(SiteInstanceImpl::GetDefaultSiteURL(), gurl);
     origin_lock_ = gurl;
     lowest_browsing_instance_id_ = browsing_instance_id;
   }
 
+  void SetLowestBrowsingInstanceId(
+      BrowsingInstanceId new_browsing_instance_id_to_include) {
+    DCHECK(!new_browsing_instance_id_to_include.is_null());
+    if (lowest_browsing_instance_id_.is_null() ||
+        (new_browsing_instance_id_to_include < lowest_browsing_instance_id_)) {
+      lowest_browsing_instance_id_ = new_browsing_instance_id_to_include;
+    }
+  }
+
   const GURL& origin_lock() { return origin_lock_; }
 
   BrowsingInstanceId lowest_browsing_instance_id() {
@@ -943,8 +949,7 @@ bool ChildProcessSecurityPolicyImpl::CanRedirectToURL(const GURL& url) {
 }
 
 bool ChildProcessSecurityPolicyImpl::CanCommitURL(int child_id,
-                                                  const GURL& url,
-                                                  bool check_origin_locks) {
+                                                  const GURL& url) {
   if (!url.is_valid())
     return false;  // Can't commit invalid URLs.
 
@@ -962,17 +967,13 @@ bool ChildProcessSecurityPolicyImpl::CanCommitURL(int child_id,
       return false;
 
     url::Origin origin = url::Origin::Create(url);
-    return origin.opaque() ||
-           CanCommitURL(child_id, GURL(origin.Serialize()), check_origin_locks);
+    return origin.opaque() || CanCommitURL(child_id, GURL(origin.Serialize()));
   }
 
   // With site isolation, a URL from a site may only be committed in a process
   // dedicated to that site.  This check will ensure that |url| can't commit if
-  // the process is locked to a different site.  Note that this check is only
-  // effective for processes that are locked to a site, but even with strict
-  // site isolation, currently not all processes are locked (e.g., extensions
-  // or <webview> tags - see ShouldLockToOrigin()).
-  if (check_origin_locks && !CanAccessDataForOrigin(child_id, url))
+  // the process is locked to a different site.
+  if (!CanAccessDataForOrigin(child_id, url))
     return false;
 
   {
@@ -997,43 +998,6 @@ bool ChildProcessSecurityPolicyImpl::CanCommitURL(int child_id,
   }
 }
 
-bool ChildProcessSecurityPolicyImpl::CanCommitURL(int child_id,
-                                                  const GURL& url) {
-  return CanCommitURL(child_id, url, true /* check_origin_lock */);
-}
-
-bool ChildProcessSecurityPolicyImpl::CanSetAsOriginHeader(int child_id,
-                                                          const GURL& url) {
-  if (!url.is_valid())
-    return false;  // Can't set invalid URLs as origin headers.
-
-  // about:srcdoc cannot be used as an origin
-  if (url.IsAboutSrcdoc())
-    return false;
-
-  // If this process can commit |url|, it can use |url| as an origin for
-  // outbound requests.
-  //
-  // TODO(alexmos): This should eventually also check the origin lock, but
-  // currently this is not done due to certain corner cases involving HTML
-  // imports and web tests that simulate requests from isolated worlds.  See
-  // https://crbug.com/515309.
-  if (CanCommitURL(child_id, url, false /* check_origin_lock */))
-    return true;
-
-  // Allow schemes which may come from scripts executing in isolated worlds;
-  // XHRs issued by such scripts reflect the script origin rather than the
-  // document origin.
-  {
-    base::AutoLock lock(lock_);
-    if (base::Contains(schemes_okay_to_appear_as_origin_headers_,
-                       url.scheme())) {
-      return true;
-    }
-  }
-  return false;
-}
-
 bool ChildProcessSecurityPolicyImpl::CanReadFile(int child_id,
                                                  const base::FilePath& file) {
   return HasPermissionsForFile(child_id, file, READ_FILE_GRANT);
@@ -1236,14 +1200,6 @@ bool ChildProcessSecurityPolicyImpl::CanDeleteFileSystemFile(
                                          DELETE_FILE_GRANT);
 }
 
-bool ChildProcessSecurityPolicyImpl::CanAccessDataForWebSocket(
-    int child_id,
-    const GURL& url) {
-  DCHECK(url.SchemeIsWSOrWSS());
-  GURL url_to_check = net::ChangeWebSocketSchemeToHttpScheme(url);
-  return CanAccessDataForOrigin(child_id, url_to_check);
-}
-
 bool ChildProcessSecurityPolicyImpl::HasWebUIBindings(int child_id) {
   base::AutoLock lock(lock_);
 
@@ -1272,6 +1228,94 @@ bool ChildProcessSecurityPolicyImpl::ChildProcessHasPermissionsForFile(
   return state->second->HasPermissionsForFile(file, permissions);
 }
 
+CanCommitStatus ChildProcessSecurityPolicyImpl::CanCommitOriginAndUrl(
+    int child_id,
+    const IsolationContext& isolation_context,
+    const url::Origin& origin,
+    const GURL& url) {
+  const url::Origin url_origin = url::Origin::Resolve(url, origin);
+  if (!CanAccessDataForOrigin(child_id, url_origin)) {
+    // Allow opaque origins w/o precursors to commit.
+    // TODO(acolwell): Investigate all cases that trigger this path and fix
+    // them so we have precursor information. Remove this logic once that has
+    // been completed.
+    if (url_origin.opaque() &&
+        url_origin.GetTupleOrPrecursorTupleIfOpaque().IsInvalid()) {
+      return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+    }
+
+    // Check for special cases, like blob:null/ and data: URLs, where the
+    // origin does not contain information to match against the process lock,
+    // but using the whole URL can result in a process lock match.
+    const GURL expected_origin_lock =
+        SiteInstanceImpl::DetermineProcessLockURL(isolation_context, url);
+    const GURL actual_origin_lock = GetOriginLock(child_id);
+    if (actual_origin_lock == expected_origin_lock)
+      return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+
+    // Allow about: pages to commit in a process that does not match the opaque
+    // origin's precursor information.
+    // TODO(acolwell): Remove this once process selection for about: URLs has
+    // been fixed to always match the precursor info.
+    if (url_origin.opaque() && (url.IsAboutBlank() || url.IsAboutSrcdoc()) &&
+        !actual_origin_lock.is_empty()) {
+      return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+    }
+    return CanCommitStatus::CANNOT_COMMIT_URL;
+  }
+
+  if (!CanAccessDataForOrigin(child_id, origin)) {
+    // Allow opaque origins w/o precursors to commit.
+    // TODO(acolwell): Investigate all cases that trigger this path and fix
+    // them so we have precursor information. Remove this logic once that has
+    // been completed.
+    if (origin.opaque() &&
+        origin.GetTupleOrPrecursorTupleIfOpaque().IsInvalid()) {
+      return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+    }
+    return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
+  }
+
+  // Ensure that the origin derived from |url| is consistent with |origin|.
+  // Note: We can't use origin.IsSameOriginWith() here because opaque origins
+  // with precursors may have different nonce values.
+  const auto url_tuple_or_precursor_tuple =
+      url_origin.GetTupleOrPrecursorTupleIfOpaque();
+  const auto origin_tuple_or_precursor_tuple =
+      origin.GetTupleOrPrecursorTupleIfOpaque();
+
+  if (!url_tuple_or_precursor_tuple.IsInvalid() &&
+      !origin_tuple_or_precursor_tuple.IsInvalid() &&
+      origin_tuple_or_precursor_tuple != url_tuple_or_precursor_tuple) {
+    // Allow a WebView specific exception for origins that have a data scheme.
+    // WebView converts data: URLs into non-opaque data:// origins which is
+    // different than what all other builds do. This causes the consistency
+    // check to fail because we try to compare a data:// origin with an opaque
+    // origin that contains precursor info.
+    if (url_tuple_or_precursor_tuple.scheme() == url::kDataScheme &&
+        url::AllowNonStandardSchemesForAndroidWebView()) {
+      return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+    }
+
+    // Allow "no access" schemes to commit even though |url_origin| and
+    // |origin| tuples don't match. We have to allow this because Blink's
+    // SecurityOrigin::CreateWithReferenceOrigin() and url::Origin::Resolve()
+    // handle "no access" URLs differently. CreateWithReferenceOrigin() treats
+    // "no access" like data: URLs and returns an opaque origin with |origin|
+    // as a precursor. Resolve() returns a non-opaque origin consisting of the
+    // scheme and host portions of the original URL.
+    //
+    // TODO(1020201): Make CreateWithReferenceOrigin() & Resolve() consistent
+    // with each other and then remove this exception.
+    if (base::Contains(url::GetNoAccessSchemes(), url.scheme()))
+      return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+
+    return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
+  }
+
+  return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
+}
+
 bool ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin(
     int child_id,
     const url::Origin& origin) {
@@ -1320,43 +1364,99 @@ bool ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin(
 bool ChildProcessSecurityPolicyImpl::CanAccessDataForOrigin(int child_id,
                                                             const GURL& url) {
   DCHECK(IsRunningOnExpectedThread());
-
   base::AutoLock lock(lock_);
+
   SecurityState* security_state = GetSecurityState(child_id);
+  BrowserOrResourceContext browser_or_resource_context;
+  if (security_state)
+    browser_or_resource_context = security_state->GetBrowserOrResourceContext();
 
-  // Determine the BrowsingInstance ID for calculating the expected process
-  // lock URL.
   GURL expected_process_lock;
-  BrowserOrResourceContext context;
-  if (security_state) {
-    context = security_state->GetBrowserOrResourceContext();
-    if (context) {
-      BrowsingInstanceId browsing_instance_id =
-          security_state->lowest_browsing_instance_id();
-      expected_process_lock = SiteInstanceImpl::DetermineProcessLockURL(
-          IsolationContext(browsing_instance_id, context), url);
+  if (security_state && browser_or_resource_context) {
+    IsolationContext isolation_context(
+        security_state->lowest_browsing_instance_id(),
+        browser_or_resource_context);
+    expected_process_lock =
+        SiteInstanceImpl::DetermineProcessLockURL(isolation_context, url);
+
+    GURL actual_process_lock = security_state->origin_lock();
+    if (!actual_process_lock.is_empty()) {
+      // Jail-style enforcement - a process with a lock can only access data
+      // from origins that require exactly the same lock.
+      if (actual_process_lock == expected_process_lock)
+        return true;
+    } else {
+      // Citadel-style enforcement - an unlocked process should not be able to
+      // access data from origins that require a lock.
+#if !defined(OS_ANDROID)
+      // TODO(lukasza): https://crbug.com/566091: Once remote NTP is capable of
+      // embedding OOPIFs, start enforcing citadel-style checks on desktop
+      // platforms.
+      // TODO(lukasza): https://crbug.com/614463: Enforce isolation within
+      // GuestView (once OOPIFs are supported within GuestView).
+      return true;
+#else
+      // TODO(acolwell, lukasza): https://crbug.com/764958: Make it possible to
+      // call ShouldLockToOrigin (and GetSiteForURL?) on the IO thread.
+      if (BrowserThread::CurrentlyOn(BrowserThread::IO))
+        return true;
+      DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+      // TODO(lukasza): Consider making the checks below IO-thread-friendly, by
+      // storing |is_unused| inside SecurityState.
+      RenderProcessHost* process = RenderProcessHostImpl::FromID(child_id);
+      if (process) {  // |process| can be null in unittests
+        // Unlocked process can be legitimately used when navigating from an
+        // unused process (about:blank, NTP on Android) to an isolated origin.
+        // See also https://crbug.com/945399.  Returning |true| below will allow
+        // such navigations to succeed (i.e. pass CanCommitOriginAndUrl checks).
+        // We don't expect unused processes to be used outside of navigations
+        // (e.g. when checking CanAccessDataForOrigin for localStorage, etc.).
+        if (process->IsUnused())
+          return true;
+      }
+
+      // TODO(alexmos, lukasza): https://crbug.com/764958: Consider making
+      // ShouldLockToOrigin work with |expected_process_lock| instead of
+      // |site_url|.
+      GURL site_url = SiteInstanceImpl::GetSiteForURL(isolation_context, url);
+
+      // A process with no lock can only access data from origins that do not
+      // require a locked process.
+      bool should_lock_target =
+          SiteInstanceImpl::ShouldLockToOrigin(isolation_context, site_url);
+      if (!should_lock_target)
+        return true;
+#endif
     }
   }
 
-  bool can_access =
-      context && security_state &&
-      security_state->CanAccessDataForOrigin(expected_process_lock);
-  if (!can_access) {
-    // Returning false here will result in a renderer kill.  Set some crash
-    // keys that will help understand the circumstances of that kill.
-    std::string killed_process_origin_lock;
-    if (!security_state) {
-      killed_process_origin_lock = "(child id not found)";
-    } else if (!context) {
-      killed_process_origin_lock = "(context is null)";
-    } else {
-      killed_process_origin_lock = security_state->origin_lock().spec();
-    }
-    LogCanAccessDataForOriginCrashKeys(expected_process_lock.spec(),
-                                       killed_process_origin_lock,
-                                       url.GetOrigin().spec());
+  // Returning false here will result in a renderer kill.  Set some crash
+  // keys that will help understand the circumstances of that kill.
+  std::string killed_process_origin_lock;
+  if (!security_state) {
+    killed_process_origin_lock = "(child id not found)";
+  } else if (!browser_or_resource_context) {
+    killed_process_origin_lock = "(context is null)";
+  } else if (security_state->origin_lock().is_empty()) {
+    killed_process_origin_lock = "(no lock - citadel-enforcement)";
+  } else {
+    killed_process_origin_lock = security_state->origin_lock().spec();
   }
-  return can_access;
+  LogCanAccessDataForOriginCrashKeys(expected_process_lock.spec(),
+                                     killed_process_origin_lock,
+                                     url.GetOrigin().spec());
+  return false;
+}
+
+void ChildProcessSecurityPolicyImpl::IncludeIsolationContext(
+    int child_id,
+    const IsolationContext& isolation_context) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  base::AutoLock lock(lock_);
+  auto* state = GetSecurityState(child_id);
+  DCHECK(state);
+  state->SetLowestBrowsingInstanceId(isolation_context.browsing_instance_id());
 }
 
 void ChildProcessSecurityPolicyImpl::LockToOrigin(
diff --git a/chromium/content/browser/child_process_security_policy_impl.h b/chromium/content/browser/child_process_security_policy_impl.h
index 7df496559df..dedc4f1c191 100644
--- a/chromium/content/browser/child_process_security_policy_impl.h
+++ b/chromium/content/browser/child_process_security_policy_impl.h
@@ -20,6 +20,7 @@
 #include "base/memory/singleton.h"
 #include "base/synchronization/lock.h"
 #include "base/thread_annotations.h"
+#include "content/browser/can_commit_status.h"
 #include "content/browser/isolated_origin_util.h"
 #include "content/browser/isolation_context.h"
 #include "content/public/browser/child_process_security_policy.h"
@@ -115,6 +116,19 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   // Identical to the above method, but takes url::Origin as input.
   bool CanAccessDataForOrigin(int child_id, const url::Origin& origin);
 
+  // Determines if the combination of |origin| & |url| is safe to commit to
+  // the process associated with |child_id|.
+  //
+  // Returns CAN_COMMIT_ORIGIN_AND_URL if it is safe to commit the |origin| and
+  // |url| combination to the process associated with |child_id|.
+  // Returns CANNOT_COMMIT_URL if |url| is not safe to commit.
+  // Returns CANNOT_COMMIT_ORIGIN if |origin| is not safe to commit.
+  CanCommitStatus CanCommitOriginAndUrl(
+      int child_id,
+      const IsolationContext& isolation_context,
+      const url::Origin& origin,
+      const GURL& url);
+
   // This function will check whether |origin| requires process isolation
   // within |isolation_context|, and if so, it will return true and put the
   // most specific matching isolated origin into |result|.
@@ -219,24 +233,6 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   // Revoke read raw cookies permission.
   void RevokeReadRawCookies(int child_id);
 
-  // A version of the public ChildProcessSecurityPolicy::CanCommitURL() which
-  // takes an additional bool |check_origin_lock|, specifying whether to
-  // reject |url| if it does not match the origin lock on process |child_id|.
-  // Passing true for |check_origin_lock| provides stronger enforcement with
-  // strict site isolation; it is only set to false by features (e.g., Origin
-  // header validation) that aren't yet ready for this enforcement. This
-  // function should *not* be used by new features; use the public
-  // ChildProcessSecurityPolicy::CanCommitURL() instead, which internally calls
-  // this with |check_origin_lock| being true.
-  //
-  // TODO(alexmos): Remove |check_origin_lock| and check origin locks
-  // unconditionally once https://crbug.com/515309 is fixed.
-  bool CanCommitURL(int child_id, const GURL& url, bool check_origin_lock);
-
-  // Whether the given origin is valid for an origin header. Valid origin
-  // headers are commitable URLs.
-  bool CanSetAsOriginHeader(int child_id, const GURL& url);
-
   // Explicit permissions checks for FileSystemURL specified files.
   bool CanReadFileSystemFile(int child_id,
                              const storage::FileSystemURL& filesystem_url);
@@ -252,13 +248,15 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
   bool CanDeleteFileSystemFile(int child_id,
                                const storage::FileSystemURL& filesystem_url);
 
-  // True if cookie headers may be exposed to renderer |child_id| for |url| for
-  // display in DevTools. |url| should be a WebSocket URL.
-  bool CanAccessDataForWebSocket(int child_id, const GURL& url);
-
   // Returns true if the specified child_id has been granted ReadRawCookies.
   bool CanReadRawCookies(int child_id);
 
+  // Notifies security state of |child_id| about the IsolationContext it will
+  // host.  The main side effect is proper setting of the lowest
+  // BrowsingInstanceId associated with the security state.
+  void IncludeIsolationContext(int child_id,
+                               const IsolationContext& isolation_context);
+
   // Sets the process identified by |child_id| as only permitted to access data
   // for the origin specified by |lock_url|. Most callers should use
   // RenderProcessHostImpl::LockToOrigin instead of calling this directly.
diff --git a/chromium/content/browser/child_process_security_policy_unittest.cc b/chromium/content/browser/child_process_security_policy_unittest.cc
index c693be0e99a..4ec1e64e251 100644
--- a/chromium/content/browser/child_process_security_policy_unittest.cc
+++ b/chromium/content/browser/child_process_security_policy_unittest.cc
@@ -9,13 +9,16 @@
 #include "base/bind_helpers.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
+#include "base/memory/ref_counted.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/mock_log.h"
+#include "build/build_config.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/isolated_origin_util.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
@@ -64,6 +67,31 @@ class ChildProcessSecurityPolicyTestBrowserClient
   std::set<std::string> schemes_;
 };
 
+bool IsCitadelProtectionEnabled() {
+#if !defined(OS_ANDROID)
+  // TODO(lukasza): https://crbug.com/566091: Once remote NTP is capable of
+  // embedding OOPIFs, start enforcing citadel-style checks on desktop
+  // platforms.
+  return false;
+#else
+  return true;
+#endif
+}
+
+void LockProcessIfNeeded(int process_id,
+                         BrowserContext* browser_context,
+                         const GURL& url) {
+  scoped_refptr<SiteInstanceImpl> site_instance =
+      SiteInstanceImpl::CreateForURL(browser_context, url);
+  if (site_instance->RequiresDedicatedProcess() &&
+      SiteInstanceImpl::ShouldLockToOrigin(site_instance->GetIsolationContext(),
+                                           site_instance->GetSiteURL())) {
+    ChildProcessSecurityPolicyImpl::GetInstance()->LockToOrigin(
+        site_instance->GetIsolationContext(), process_id,
+        site_instance->GetSiteURL());
+  }
+}
+
 }  // namespace
 
 class ChildProcessSecurityPolicyTest : public testing::Test {
@@ -277,21 +305,24 @@ TEST_F(ChildProcessSecurityPolicyTest, StandardSchemesTest) {
   EXPECT_TRUE(p->CanRedirectToURL(GURL("data:text/html,<b>Hi</b>")));
   EXPECT_TRUE(
       p->CanRedirectToURL(GURL("filesystem:http://localhost/temporary/a.gif")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("http://www.google.com/")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("https://www.paypal.com/")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("ftp://ftp.gnu.org/")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
-  EXPECT_TRUE(p->CanCommitURL(
-      kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
-  EXPECT_TRUE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("http://www.google.com/")));
-  EXPECT_TRUE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("https://www.paypal.com/")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("ftp://ftp.gnu.org/")));
-  EXPECT_TRUE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("data:text/html,<b>Hi</b>")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(
-      kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
+  if (AreAllSitesIsolatedForTesting() && IsCitadelProtectionEnabled()) {
+    // A non-locked process cannot access URLs below (because with
+    // site-per-process all the URLs need to be isolated).
+    EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("http://www.google.com/")));
+    EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("https://www.paypal.com/")));
+    EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("ftp://ftp.gnu.org/")));
+    EXPECT_FALSE(
+        p->CanCommitURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
+    EXPECT_FALSE(p->CanCommitURL(
+        kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
+  } else {
+    EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("http://www.google.com/")));
+    EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("https://www.paypal.com/")));
+    EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("ftp://ftp.gnu.org/")));
+    EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
+    EXPECT_TRUE(p->CanCommitURL(
+        kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
+  }
 
   // Dangerous to request, commit, or set as origin header.
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
@@ -307,11 +338,6 @@ TEST_F(ChildProcessSecurityPolicyTest, StandardSchemesTest) {
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GetWebUIURL("foo/bar")));
   EXPECT_FALSE(
       p->CanCommitURL(kRendererID, GURL("view-source:http://www.google.com/")));
-  EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GetWebUIURL("foo/bar")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(
-      kRendererID, GURL("view-source:http://www.google.com/")));
   EXPECT_FALSE(p->CanRedirectToURL(GURL(kUnreachableWebDataURL)));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL(kUnreachableWebDataURL)));
 
@@ -322,7 +348,9 @@ TEST_F(ChildProcessSecurityPolicyTest, BlobSchemeTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
+  GURL localhost_url("http://localhost/");
   p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), localhost_url);
 
   EXPECT_TRUE(
       p->CanRequestURL(kRendererID, GURL("blob:http://localhost/some-guid")));
@@ -401,18 +429,12 @@ TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:BlAnK")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("aBouT:blank")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("about:blank")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:BlAnK")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:BlAnK")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:blank")));
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:srcdoc")));
   EXPECT_FALSE(p->CanRedirectToURL(GURL("about:srcdoc")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:srcdoc")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:srcdoc")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:SRCDOC")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:SRCDOC")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:SRCDOC")));
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache")));
@@ -426,10 +448,6 @@ TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:cache")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:hang")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:version")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:crash")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:cache")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:hang")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:version")));
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:version")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh")));
@@ -441,17 +459,12 @@ TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:CrASh")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("abOuT:cAChe")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBoUt:version")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBoUt:version")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:CrASh")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("abOuT:cAChe")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBoUt:version")));
 
   // Requests for about: pages should be denied.
   p->GrantCommitURL(kRendererID, GURL("about:crash"));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanRedirectToURL(GURL("about:crash")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:crash")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:crash")));
 
   p->Remove(kRendererID);
 }
@@ -465,14 +478,10 @@ TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) {
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')")));
   EXPECT_FALSE(p->CanRedirectToURL(GURL("javascript:alert('xss')")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("javascript:alert('xss')")));
-  EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("javascript:alert('xss')")));
   p->GrantCommitURL(kRendererID, GURL("javascript:alert('xss')"));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')")));
   EXPECT_FALSE(p->CanRedirectToURL(GURL("javascript:alert('xss')")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("javascript:alert('xss')")));
-  EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("javascript:alert('xss')")));
 
   p->Remove(kRendererID);
 }
@@ -488,21 +497,29 @@ TEST_F(ChildProcessSecurityPolicyTest, RegisterWebSafeSchemeTest) {
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("asdf:rockers")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("asdf:rockers")));
 
   // Once we register "asdf", we default to deny.
   RegisterTestScheme("asdf");
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("asdf:rockers")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("asdf:rockers")));
 
   // We can allow new schemes by adding them to the whitelist.
   p->RegisterWebSafeScheme("asdf");
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("asdf:rockers")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("asdf:rockers")));
+  if (AreAllSitesIsolatedForTesting() && IsCitadelProtectionEnabled()) {
+    // With site-per-process, all URLs (including the one below) will ask to be
+    // hosted in isolated processes.  Since |p| is not locked, CanCommitURL
+    // should return false.
+    EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
+
+    // After locking the process, CanCommitURL should start returning true.
+    LockProcessIfNeeded(kRendererID, browser_context(), GURL("asdf:rockers"));
+    EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
+  } else {
+    EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
+  }
 
   // Cleanup.
   p->Remove(kRendererID);
@@ -512,18 +529,17 @@ TEST_F(ChildProcessSecurityPolicyTest, CanServiceCommandsTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
+  GURL file_url("file:///etc/passwd");
   p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), file_url);
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
-  EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   p->GrantCommitURL(kRendererID, GURL("file:///etc/passwd"));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
 
   // We should forget our state if we repeat a renderer id.
   p->Remove(kRendererID);
@@ -531,8 +547,6 @@ TEST_F(ChildProcessSecurityPolicyTest, CanServiceCommandsTest) {
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
-  EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   p->Remove(kRendererID);
 }
 
@@ -568,29 +582,15 @@ TEST_F(ChildProcessSecurityPolicyTest, ViewSource) {
   EXPECT_FALSE(p->CanCommitURL(
       kRendererID, GURL("view-source:view-source:http://www.google.com/")));
 
-  // View source URLs should not be setable as origin headers
-  EXPECT_FALSE(p->CanSetAsOriginHeader(
-      kRendererID, GURL("view-source:http://www.google.com/")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID,
-                                       GURL("view-source:file:///etc/passwd")));
-  EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(
-      kRendererID, GURL("view-source:view-source:http://www.google.com/")));
-
   p->GrantCommitURL(kRendererID, GURL("view-source:file:///etc/passwd"));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(
-      p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
-  EXPECT_FALSE(
       p->CanRequestURL(kRendererID, GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(p->CanRedirectToURL(GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID,
                                GURL("view-source:file:///etc/passwd")));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID,
-                                       GURL("view-source:file:///etc/passwd")));
   p->Remove(kRendererID);
 }
 
@@ -605,7 +605,6 @@ TEST_F(ChildProcessSecurityPolicyTest, GoogleChromeScheme) {
   EXPECT_FALSE(p->CanRequestURL(kRendererID, test_url));
   EXPECT_FALSE(p->CanRedirectToURL(test_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, test_url));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, test_url));
 
   p->Remove(kRendererID);
 }
@@ -622,6 +621,7 @@ TEST_F(ChildProcessSecurityPolicyTest, GrantCommitURLToNonStandardScheme) {
   RegisterTestScheme("httpxml");
 
   p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), url);
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url2));
@@ -629,8 +629,6 @@ TEST_F(ChildProcessSecurityPolicyTest, GrantCommitURLToNonStandardScheme) {
   EXPECT_TRUE(p->CanRedirectToURL(url2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url2));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url2));
 
   // GrantCommitURL with a non-standard scheme should grant commit access to the
   // entire scheme.
@@ -642,8 +640,6 @@ TEST_F(ChildProcessSecurityPolicyTest, GrantCommitURLToNonStandardScheme) {
   EXPECT_TRUE(p->CanRedirectToURL(url2));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url2));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url2));
 
   p->Remove(kRendererID);
 }
@@ -652,18 +648,18 @@ TEST_F(ChildProcessSecurityPolicyTest, SpecificFile) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
-  p->Add(kRendererID, browser_context());
-
   GURL icon_url("file:///tmp/foo.png");
   GURL sensitive_url("file:///etc/passwd");
+
+  p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), sensitive_url);
+
   EXPECT_FALSE(p->CanRequestURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, sensitive_url));
   EXPECT_TRUE(p->CanRedirectToURL(icon_url));
   EXPECT_TRUE(p->CanRedirectToURL(sensitive_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, sensitive_url));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, icon_url));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, sensitive_url));
 
   p->GrantRequestSpecificFileURL(kRendererID, icon_url);
   EXPECT_TRUE(p->CanRequestURL(kRendererID, icon_url));
@@ -672,8 +668,6 @@ TEST_F(ChildProcessSecurityPolicyTest, SpecificFile) {
   EXPECT_TRUE(p->CanRedirectToURL(sensitive_url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, sensitive_url));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, icon_url));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, sensitive_url));
 
   p->GrantCommitURL(kRendererID, icon_url);
   EXPECT_TRUE(p->CanRequestURL(kRendererID, icon_url));
@@ -682,8 +676,6 @@ TEST_F(ChildProcessSecurityPolicyTest, SpecificFile) {
   EXPECT_TRUE(p->CanRedirectToURL(sensitive_url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, icon_url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, sensitive_url));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, icon_url));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, sensitive_url));
 
   p->Remove(kRendererID);
 }
@@ -775,6 +767,8 @@ TEST_F(ChildProcessSecurityPolicyTest, FilePermissionGrantingAndRevoking) {
       storage::FILE_PERMISSION_USE_FILE_PERMISSION);
 
   p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), GURL("http://foo/"));
+
   base::FilePath file(TEST_PATH("/dir/testfile"));
   file = file.NormalizePathSeparators();
   storage::FileSystemURL url = storage::FileSystemURL::CreateForTest(
@@ -825,6 +819,8 @@ TEST_F(ChildProcessSecurityPolicyTest, FilePermissionGrantingAndRevoking) {
   // Test having no permissions upon re-adding same renderer ID.
   p->Add(kRendererID, browser_context());
   CheckHasNoFileSystemFilePermission(p, file, url);
+  LockProcessIfNeeded(kRendererID, browser_context(), GURL("http://foo/"));
+  CheckHasNoFileSystemFilePermission(p, file, url);
 
   // Cleanup.
   p->Remove(kRendererID);
@@ -967,6 +963,7 @@ TEST_F(ChildProcessSecurityPolicyTest, CanServiceWebUIBindings) {
   const url::Origin origin = url::Origin::Create(url);
   {
     p->Add(kRendererID, browser_context());
+    LockProcessIfNeeded(kRendererID, browser_context(), url);
 
     EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
 
@@ -1002,8 +999,10 @@ TEST_F(ChildProcessSecurityPolicyTest, CanServiceWebUIBindings) {
 
     p->Remove(kRendererID);
   }
+
   {
     p->Add(kRendererID, browser_context());
+    LockProcessIfNeeded(kRendererID, browser_context(), url);
 
     EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
 
@@ -1039,8 +1038,10 @@ TEST_F(ChildProcessSecurityPolicyTest, CanServiceWebUIBindings) {
 
     p->Remove(kRendererID);
   }
+
   {
     p->Add(kRendererID, browser_context());
+    LockProcessIfNeeded(kRendererID, browser_context(), url);
 
     EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
 
@@ -1127,6 +1128,7 @@ TEST_F(ChildProcessSecurityPolicyTest, RemoveRace_CanAccessDataForOrigin) {
   GURL url("file:///etc/passwd");
 
   p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), url);
 
   base::WaitableEvent ready_for_remove_event;
   base::WaitableEvent remove_called_event;
@@ -1246,11 +1248,21 @@ TEST_F(ChildProcessSecurityPolicyTest, CanAccessDataForOrigin_URL) {
   p->Add(kRendererID, &browser_context);
 
   // Verify unlocked origin permissions.
-  EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, file_url));
-  EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, foo_http_url));
-  EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, foo_blob_url));
-  EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, foo_filesystem_url));
-  EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, bar_http_url));
+  if (AreAllSitesIsolatedForTesting() && IsCitadelProtectionEnabled()) {
+    // A non-locked process cannot access URLs below (because with
+    // site-per-process all the URLs need to be isolated).
+    EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, file_url));
+    EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, foo_http_url));
+    EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, foo_blob_url));
+    EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, foo_filesystem_url));
+    EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, bar_http_url));
+  } else {
+    EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, file_url));
+    EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, foo_http_url));
+    EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, foo_blob_url));
+    EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, foo_filesystem_url));
+    EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, bar_http_url));
+  }
 
   // Isolate |http_url| so we can't get a default SiteInstance.
   p->AddIsolatedOrigins({url::Origin::Create(foo_http_url)},
@@ -1260,8 +1272,7 @@ TEST_F(ChildProcessSecurityPolicyTest, CanAccessDataForOrigin_URL) {
   scoped_refptr<SiteInstanceImpl> foo_instance =
       SiteInstanceImpl::CreateForURL(&browser_context, foo_http_url);
   EXPECT_FALSE(foo_instance->IsDefaultSiteInstance());
-  p->LockToOrigin(foo_instance->GetIsolationContext(), kRendererID,
-                  foo_instance->GetSiteURL());
+  LockProcessIfNeeded(kRendererID, &browser_context, foo_http_url);
 
   // Verify that file access is no longer allowed.
   EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, file_url));
@@ -1346,8 +1357,18 @@ TEST_F(ChildProcessSecurityPolicyTest, CanAccessDataForOrigin_Origin) {
   p->Add(kRendererID, &browser_context);
 
   // Verify unlocked process permissions.
-  for (const auto& origin : all_origins)
-    EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, origin)) << origin;
+  for (const auto& origin : all_origins) {
+    if (AreAllSitesIsolatedForTesting() && IsCitadelProtectionEnabled()) {
+      if (origin.opaque() &&
+          origin.GetTupleOrPrecursorTupleIfOpaque().IsInvalid()) {
+        EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, origin)) << origin;
+      } else {
+        EXPECT_FALSE(p->CanAccessDataForOrigin(kRendererID, origin)) << origin;
+      }
+    } else {
+      EXPECT_TRUE(p->CanAccessDataForOrigin(kRendererID, origin)) << origin;
+    }
+  }
 
   // Isolate |foo_origin| so we can't get a default SiteInstance.
   p->AddIsolatedOrigins({foo_origin}, IsolatedOriginSource::TEST,
@@ -1357,8 +1378,7 @@ TEST_F(ChildProcessSecurityPolicyTest, CanAccessDataForOrigin_Origin) {
   scoped_refptr<SiteInstanceImpl> foo_instance =
       SiteInstanceImpl::CreateForURL(&browser_context, foo_origin.GetURL());
   EXPECT_FALSE(foo_instance->IsDefaultSiteInstance());
-  p->LockToOrigin(foo_instance->GetIsolationContext(), kRendererID,
-                  foo_instance->GetSiteURL());
+  LockProcessIfNeeded(kRendererID, &browser_context, foo_origin.GetURL());
 
   // Verify that access is no longer allowed for origins that are not associated
   // with foo.com.
@@ -1388,12 +1408,13 @@ TEST_F(ChildProcessSecurityPolicyTest, OriginGranting) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
-  p->Add(kRendererID, browser_context());
-
   GURL url_foo1(GetWebUIURL("foo/resource1"));
   GURL url_foo2(GetWebUIURL("foo/resource2"));
   GURL url_bar(GetWebUIURL("bar/resource3"));
 
+  p->Add(kRendererID, browser_context());
+  LockProcessIfNeeded(kRendererID, browser_context(), url_foo1);
+
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_foo1));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_bar));
@@ -1403,9 +1424,6 @@ TEST_F(ChildProcessSecurityPolicyTest, OriginGranting) {
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_bar));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->GrantRequestOrigin(kRendererID, url::Origin::Create(url_foo1));
 
@@ -1418,9 +1436,6 @@ TEST_F(ChildProcessSecurityPolicyTest, OriginGranting) {
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_bar));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->GrantCommitOrigin(kRendererID, url::Origin::Create(url_foo1));
 
@@ -1433,9 +1448,6 @@ TEST_F(ChildProcessSecurityPolicyTest, OriginGranting) {
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_bar));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   // Make sure this doesn't overwrite the earlier commit grants.
   p->GrantRequestOrigin(kRendererID, url::Origin::Create(url_foo1));
@@ -1449,9 +1461,6 @@ TEST_F(ChildProcessSecurityPolicyTest, OriginGranting) {
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_bar));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
-  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->Remove(kRendererID);
 }
diff --git a/chromium/content/browser/child_process_task_port_provider_mac_unittest.cc b/chromium/content/browser/child_process_task_port_provider_mac_unittest.cc
index 9c5be3693f2..4021e9a2873 100644
--- a/chromium/content/browser/child_process_task_port_provider_mac_unittest.cc
+++ b/chromium/content/browser/child_process_task_port_provider_mac_unittest.cc
@@ -12,7 +12,9 @@
 #include "base/synchronization/waitable_event.h"
 #include "base/task/post_task.h"
 #include "base/test/task_environment.h"
+#include "base/test/test_timeouts.h"
 #include "content/common/child_process.mojom.h"
+#include "ipc/ipc_buildflags.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -49,7 +51,6 @@ class ChildProcessTaskPortProviderTest : public testing::Test,
   ChildProcessTaskPortProviderTest()
       : event_(base::WaitableEvent::ResetPolicy::AUTOMATIC) {
     provider_.AddObserver(this);
-    last_seqno_ = GetNotificationPortSequenceNumber();
   }
   ~ChildProcessTaskPortProviderTest() override {
     provider_.RemoveObserver(this);
@@ -57,14 +58,15 @@ class ChildProcessTaskPortProviderTest : public testing::Test,
 
   void WaitForTaskPort() { event_.Wait(); }
 
-  // There is no observer callback for when a process dies, so use the kernel's
-  // sequence number on the notification port receive right to determine if the
-  // DEAD_NAME notification has been delivered. If the seqno is different, then
-  // assume it is.
-  void WaitForNotificationPortSeqnoChange() {
-    base::RunLoop run_loop;
-    CheckSequenceNumberAndQuitIfChanged(run_loop.QuitWhenIdleClosure());
-    run_loop.Run();
+  // There is no observer callback for when a process dies, so spin the run loop
+  // until the desired exit |condition| is met.
+  void WaitForCondition(base::RepeatingCallback<bool(void)> condition) {
+    base::TimeTicks start = base::TimeTicks::Now();
+    do {
+      base::RunLoop().RunUntilIdle();
+      if (condition.Run())
+        break;
+    } while ((base::TimeTicks::Now() - start) < TestTimeouts::action_timeout());
   }
 
   mach_port_urefs_t GetSendRightRefCount(mach_port_t send_right) {
@@ -95,37 +97,10 @@ class ChildProcessTaskPortProviderTest : public testing::Test,
   }
 
  private:
-  mach_port_seqno_t GetNotificationPortSequenceNumber() {
-    mach_port_status_t status;
-    mach_msg_type_number_t count = sizeof(status);
-    kern_return_t kr = mach_port_get_attributes(
-        mach_task_self(), provider_.notification_port_.get(),
-        MACH_PORT_RECEIVE_STATUS, reinterpret_cast<mach_port_info_t>(&status),
-        &count);
-    EXPECT_EQ(KERN_SUCCESS, kr);
-    return status.mps_seqno;
-  }
-
-  void CheckSequenceNumberAndQuitIfChanged(base::OnceClosure quit_closure) {
-    mach_port_seqno_t seqno = GetNotificationPortSequenceNumber();
-    if (seqno == last_seqno_) {
-      task_environment_.GetMainThreadTaskRunner()->PostDelayedTask(
-          FROM_HERE,
-          base::BindOnce(&ChildProcessTaskPortProviderTest::
-                             CheckSequenceNumberAndQuitIfChanged,
-                         base::Unretained(this), std::move(quit_closure)),
-          base::TimeDelta::FromMilliseconds(10));
-    } else {
-      last_seqno_ = seqno;
-      std::move(quit_closure).Run();
-    }
-  }
-
   base::test::TaskEnvironment task_environment_;
   ChildProcessTaskPortProvider provider_;
   base::WaitableEvent event_;
   std::vector<base::ProcessHandle> received_processes_;
-  mach_port_seqno_t last_seqno_;
 };
 
 static constexpr mach_port_t kMachPortNull = MACH_PORT_NULL;
@@ -167,7 +142,11 @@ TEST_F(ChildProcessTaskPortProviderTest, ChildLifecycle) {
   // "Kill" the process and verify that the association is deleted.
   receive_right.reset();
 
-  WaitForNotificationPortSeqnoChange();
+  WaitForCondition(base::BindRepeating(
+      [](ChildProcessTaskPortProvider* provider) -> bool {
+        return provider->TaskForPid(99) == MACH_PORT_NULL;
+      },
+      base::Unretained(provider())));
 
   EXPECT_EQ(kMachPortNull, provider()->TaskForPid(99));
 
@@ -176,8 +155,7 @@ TEST_F(ChildProcessTaskPortProviderTest, ChildLifecycle) {
   EXPECT_EQ(1u, GetDeadNameRefCount(send_right.get()));
 }
 
-// Test is flaky. See https://crbug.com/986288.
-TEST_F(ChildProcessTaskPortProviderTest, DISABLED_DeadTaskPort) {
+TEST_F(ChildProcessTaskPortProviderTest, DeadTaskPort) {
   EXPECT_EQ(kMachPortNull, provider()->TaskForPid(6));
 
   // Create a fake task port for the fake process.
@@ -237,7 +215,11 @@ TEST_F(ChildProcessTaskPortProviderTest, DISABLED_DeadTaskPort) {
 
   // Clean up the second receive right.
   receive_right2.reset();
-  WaitForNotificationPortSeqnoChange();
+  WaitForCondition(base::BindRepeating(
+      [](ChildProcessTaskPortProvider* provider) -> bool {
+        return provider->TaskForPid(123) == MACH_PORT_NULL;
+      },
+      base::Unretained(provider())));
   EXPECT_EQ(kMachPortNull, provider()->TaskForPid(123));
 }
 
diff --git a/chromium/content/browser/client_hints/client_hints.cc b/chromium/content/browser/client_hints/client_hints.cc
index 5b3266273de..ed270d8c61f 100644
--- a/chromium/content/browser/client_hints/client_hints.cc
+++ b/chromium/content/browser/client_hints/client_hints.cc
@@ -20,13 +20,13 @@
 #include "content/public/browser/host_zoom_map.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/page_zoom.h"
 #include "net/base/url_util.h"
 #include "net/nqe/effective_connection_type.h"
 #include "net/nqe/network_quality_estimator_params.h"
 #include "services/network/public/cpp/network_quality_tracker.h"
 #include "third_party/blink/public/common/client_hints/client_hints.h"
 #include "third_party/blink/public/common/device_memory/approximated_device_memory.h"
+#include "third_party/blink/public/common/page/page_zoom.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/public/platform/web_client_hints_type.h"
 #include "ui/display/display.h"
@@ -137,7 +137,7 @@ double GetZoomFactor(content::BrowserContext* context, const GURL& url) {
                      ->GetDefaultZoomLevel();
   }
 
-  return content::ZoomLevelToZoomFactor(zoom_level);
+  return blink::PageZoomLevelToZoomFactor(zoom_level);
 #endif
 }
 
diff --git a/chromium/content/browser/code_cache/generated_code_cache.cc b/chromium/content/browser/code_cache/generated_code_cache.cc
index 42ab33968a2..69e2c5991d5 100644
--- a/chromium/content/browser/code_cache/generated_code_cache.cc
+++ b/chromium/content/browser/code_cache/generated_code_cache.cc
@@ -68,10 +68,38 @@ std::string GetCacheKey(const GURL& resource_url, const GURL& origin_lock) {
 }
 
 constexpr int kResponseTimeSizeInBytes = sizeof(int64_t);
+constexpr int kDataSizeInBytes = sizeof(uint32_t);
+constexpr int kHeaderSizeInBytes = kResponseTimeSizeInBytes + kDataSizeInBytes;
+// This is the threshold for storing the header and cached code in stream 0,
+// which is read into memory on opening an entry. JavaScript code caching stores
+// time stamps with no data, or timestamps with just a tag, and we observe many
+// 8 and 16 byte reads and writes. Make the threshold larger to speed up many
+// code entries too.
+constexpr int kSmallDataLimit = 4096;
+
+void WriteSmallDataHeader(scoped_refptr<net::IOBufferWithSize> buffer,
+                          const base::Time& response_time,
+                          uint32_t data_size) {
+  DCHECK_LE(kHeaderSizeInBytes, buffer->size());
+  int64_t serialized_time =
+      response_time.ToDeltaSinceWindowsEpoch().InMicroseconds();
+  memcpy(buffer->data(), &serialized_time, kResponseTimeSizeInBytes);
+  // Copy size to small data buffer.
+  memcpy(buffer->data() + kResponseTimeSizeInBytes, &data_size,
+         kDataSizeInBytes);
+}
+
+void ReadSmallDataHeader(scoped_refptr<net::IOBufferWithSize> buffer,
+                         base::Time* response_time,
+                         uint32_t* data_size) {
+  DCHECK_LE(kHeaderSizeInBytes, buffer->size());
+  int64_t raw_response_time = *(reinterpret_cast<int64_t*>(buffer->data()));
+  *response_time = base::Time::FromDeltaSinceWindowsEpoch(
+      base::TimeDelta::FromMicroseconds(raw_response_time));
+  *data_size =
+      *(reinterpret_cast<uint32_t*>(buffer->data() + kResponseTimeSizeInBytes));
+}
 
-static_assert(mojo_base::BigBuffer::kMaxInlineBytes >=
-                  2 * kResponseTimeSizeInBytes,
-              "Buffer may not be large enough for response time");
 static_assert(mojo_base::BigBuffer::kMaxInlineBytes <=
                   std::numeric_limits<int>::max(),
               "Buffer size calculations may overflow int");
@@ -80,6 +108,11 @@ static_assert(mojo_base::BigBuffer::kMaxInlineBytes <=
 // as an IOBuffer allows us to avoid a copy. For large code, this can be slow.
 class BigIOBuffer : public net::IOBufferWithSize {
  public:
+  explicit BigIOBuffer(mojo_base::BigBuffer buffer)
+      : net::IOBufferWithSize(nullptr, buffer.size()),
+        buffer_(std::move(buffer)) {
+    data_ = reinterpret_cast<char*>(buffer_.data());
+  }
   explicit BigIOBuffer(size_t size) : net::IOBufferWithSize(nullptr, size) {
     buffer_ = mojo_base::BigBuffer(size);
     data_ = reinterpret_cast<char*>(buffer_.data());
@@ -127,89 +160,82 @@ void GeneratedCodeCache::CollectStatistics(
 }
 
 // Stores the information about a pending request while disk backend is
-// being initialized.
+// being initialized or another request for the same key is live.
 class GeneratedCodeCache::PendingOperation {
  public:
-  static std::unique_ptr<PendingOperation> CreateWritePendingOp(
-      std::string key,
-      scoped_refptr<net::IOBufferWithSize>);
-  static std::unique_ptr<PendingOperation> CreateFetchPendingOp(
-      std::string key,
-      const ReadDataCallback&);
-  static std::unique_ptr<PendingOperation> CreateDeletePendingOp(
-      std::string key);
-  static std::unique_ptr<PendingOperation> CreateGetBackendPendingOp(
-      GetBackendCallback callback);
+  PendingOperation(Operation op,
+                   const std::string& key,
+                   scoped_refptr<net::IOBufferWithSize> small_buffer,
+                   scoped_refptr<BigIOBuffer> large_buffer)
+      : op_(op),
+        key_(key),
+        small_buffer_(small_buffer),
+        large_buffer_(large_buffer) {
+    DCHECK_EQ(Operation::kWrite, op_);
+  }
+
+  PendingOperation(Operation op,
+                   const std::string& key,
+                   ReadDataCallback read_callback)
+      : op_(op), key_(key), read_callback_(std::move(read_callback)) {
+    DCHECK_EQ(Operation::kFetch, op_);
+  }
+
+  PendingOperation(Operation op, const std::string& key) : op_(op), key_(key) {
+    DCHECK_EQ(Operation::kDelete, op_);
+  }
+
+  PendingOperation(Operation op, GetBackendCallback backend_callback)
+      : op_(op), backend_callback_(std::move(backend_callback)) {
+    DCHECK_EQ(Operation::kGetBackend, op_);
+  }
 
   ~PendingOperation();
 
   Operation operation() const { return op_; }
   const std::string& key() const { return key_; }
-  const scoped_refptr<net::IOBufferWithSize> data() const { return data_; }
-  ReadDataCallback ReleaseReadCallback() { return std::move(read_callback_); }
-  GetBackendCallback ReleaseCallback() { return std::move(callback_); }
+  scoped_refptr<net::IOBufferWithSize> small_buffer() { return small_buffer_; }
+  scoped_refptr<BigIOBuffer> large_buffer() { return large_buffer_; }
+  ReadDataCallback TakeReadCallback() { return std::move(read_callback_); }
+  GetBackendCallback TakeBackendCallback() {
+    return std::move(backend_callback_);
+  }
 
- private:
-  PendingOperation(Operation op,
-                   std::string key,
-                   scoped_refptr<net::IOBufferWithSize>,
-                   const ReadDataCallback&,
-                   GetBackendCallback);
+  // These are called by Fetch operations to hold the buffers we create once the
+  // entry is opened.
+  void set_small_buffer(scoped_refptr<net::IOBufferWithSize> small_buffer) {
+    DCHECK_EQ(Operation::kFetch, op_);
+    small_buffer_ = small_buffer;
+  }
+  void set_large_buffer(scoped_refptr<BigIOBuffer> large_buffer) {
+    DCHECK_EQ(Operation::kFetch, op_);
+    large_buffer_ = large_buffer;
+  }
+
+  // These are called by write and fetch operations to track buffer completions
+  // and signal when the operation has finished, and whether it was successful.
+  bool succeeded() const { return succeeded_; }
 
+  bool AddBufferCompletion(bool succeeded) {
+    DCHECK(op_ == Operation::kWrite || op_ == Operation::kFetch);
+    if (!succeeded)
+      succeeded_ = false;
+    DCHECK_GT(2, completions_);
+    completions_++;
+    return completions_ == 2;
+  }
+
+ private:
   const Operation op_;
   const std::string key_;
-  const scoped_refptr<net::IOBufferWithSize> data_;
+  scoped_refptr<net::IOBufferWithSize> small_buffer_;
+  scoped_refptr<BigIOBuffer> large_buffer_;
   ReadDataCallback read_callback_;
-  GetBackendCallback callback_;
+  GetBackendCallback backend_callback_;
+  int completions_ = 0;
+  bool succeeded_ = true;
 };
 
-std::unique_ptr<GeneratedCodeCache::PendingOperation>
-GeneratedCodeCache::PendingOperation::CreateWritePendingOp(
-    std::string key,
-    scoped_refptr<net::IOBufferWithSize> buffer) {
-  return base::WrapUnique(
-      new PendingOperation(Operation::kWrite, std::move(key), buffer,
-                           ReadDataCallback(), GetBackendCallback()));
-}
-
-std::unique_ptr<GeneratedCodeCache::PendingOperation>
-GeneratedCodeCache::PendingOperation::CreateFetchPendingOp(
-    std::string key,
-    const ReadDataCallback& read_callback) {
-  return base::WrapUnique(new PendingOperation(
-      Operation::kFetch, std::move(key), scoped_refptr<net::IOBufferWithSize>(),
-      read_callback, GetBackendCallback()));
-}
-
-std::unique_ptr<GeneratedCodeCache::PendingOperation>
-GeneratedCodeCache::PendingOperation::CreateDeletePendingOp(std::string key) {
-  return base::WrapUnique(
-      new PendingOperation(Operation::kDelete, std::move(key),
-                           scoped_refptr<net::IOBufferWithSize>(),
-                           ReadDataCallback(), GetBackendCallback()));
-}
-
-std::unique_ptr<GeneratedCodeCache::PendingOperation>
-GeneratedCodeCache::PendingOperation::CreateGetBackendPendingOp(
-    GetBackendCallback callback) {
-  return base::WrapUnique(
-      new PendingOperation(Operation::kGetBackend, std::string(),
-                           scoped_refptr<net::IOBufferWithSize>(),
-                           ReadDataCallback(), std::move(callback)));
-}
-
-GeneratedCodeCache::PendingOperation::PendingOperation(
-    Operation op,
-    std::string key,
-    scoped_refptr<net::IOBufferWithSize> buffer,
-    const ReadDataCallback& read_callback,
-    GetBackendCallback callback)
-    : op_(op),
-      key_(std::move(key)),
-      data_(buffer),
-      read_callback_(read_callback),
-      callback_(std::move(callback)) {}
-
 GeneratedCodeCache::PendingOperation::~PendingOperation() = default;
 
 GeneratedCodeCache::GeneratedCodeCache(const base::FilePath& path,
@@ -233,53 +259,53 @@ void GeneratedCodeCache::GetBackend(GetBackendCallback callback) {
       std::move(callback).Run(backend_.get());
       return;
     case kInitializing:
-      pending_ops_.push_back(
-          GeneratedCodeCache::PendingOperation::CreateGetBackendPendingOp(
-              std::move(callback)));
+      pending_ops_.emplace(std::make_unique<PendingOperation>(
+          Operation::kGetBackend, std::move(callback)));
       return;
   }
 }
 
-void GeneratedCodeCache::WriteData(const GURL& url,
-                                   const GURL& origin_lock,
-                                   const base::Time& response_time,
-                                   base::span<const uint8_t> data) {
-  // Silently ignore the requests.
+void GeneratedCodeCache::WriteEntry(const GURL& url,
+                                    const GURL& origin_lock,
+                                    const base::Time& response_time,
+                                    mojo_base::BigBuffer data) {
   if (backend_state_ == kFailed) {
+    // Silently fail the request.
     CollectStatistics(CacheEntryStatus::kError);
     return;
   }
 
-  // Append the response time to the metadata. Code caches store
-  // response_time + generated code as a single entry.
-  scoped_refptr<net::IOBufferWithSize> buffer =
-      base::MakeRefCounted<net::IOBufferWithSize>(data.size() +
-                                                  kResponseTimeSizeInBytes);
-  int64_t serialized_time =
-      response_time.ToDeltaSinceWindowsEpoch().InMicroseconds();
-  memcpy(buffer->data(), &serialized_time, kResponseTimeSizeInBytes);
-  if (!data.empty())
-    memcpy(buffer->data() + kResponseTimeSizeInBytes, data.data(), data.size());
+  // If data is small, combine the header and data into a single write.
+  scoped_refptr<net::IOBufferWithSize> small_buffer;
+  scoped_refptr<BigIOBuffer> large_buffer;
+  uint32_t data_size = static_cast<uint32_t>(data.size());
+  if (data_size <= kSmallDataLimit) {
+    small_buffer = base::MakeRefCounted<net::IOBufferWithSize>(
+        kHeaderSizeInBytes + data.size());
+    // Copy |data| into the small buffer.
+    memcpy(small_buffer->data() + kHeaderSizeInBytes, data.data(), data.size());
+    // We write 0 bytes and truncate stream 1 to clear any stale data.
+    large_buffer = base::MakeRefCounted<BigIOBuffer>(mojo_base::BigBuffer());
+  } else {
+    small_buffer =
+        base::MakeRefCounted<net::IOBufferWithSize>(kHeaderSizeInBytes);
+    large_buffer = base::MakeRefCounted<BigIOBuffer>(std::move(data));
+  }
+  WriteSmallDataHeader(small_buffer, response_time, data_size);
 
+  // Create the write operation.
   std::string key = GetCacheKey(url, origin_lock);
-  // If there is an in progress operation corresponding to this key. Enqueue it
-  // so we can issue once the in-progress operation finishes.
-  if (EnqueueAsPendingOperation(
-          key, GeneratedCodeCache::PendingOperation::CreateWritePendingOp(
-                   key, buffer))) {
-    return;
-  }
+  auto op = std::make_unique<PendingOperation>(Operation::kWrite, key,
+                                               small_buffer, large_buffer);
 
   if (backend_state_ != kInitialized) {
     // Insert it into the list of pending operations while the backend is
     // still being opened.
-    pending_ops_.push_back(
-        GeneratedCodeCache::PendingOperation::CreateWritePendingOp(
-            std::move(key), buffer));
+    pending_ops_.emplace(std::move(op));
     return;
   }
 
-  WriteDataImpl(key, buffer);
+  EnqueueOperationAndIssueIfNext(std::move(op));
 }
 
 void GeneratedCodeCache::FetchEntry(const GURL& url,
@@ -287,50 +313,42 @@ void GeneratedCodeCache::FetchEntry(const GURL& url,
                                     ReadDataCallback read_data_callback) {
   if (backend_state_ == kFailed) {
     CollectStatistics(CacheEntryStatus::kError);
-    // Silently ignore the requests.
+    // Fail the request.
     std::move(read_data_callback).Run(base::Time(), mojo_base::BigBuffer());
     return;
   }
 
   std::string key = GetCacheKey(url, origin_lock);
-  // If there is an in progress operation corresponding to this key. Enqueue it
-  // so we can issue once the in-progress operation finishes.
-  if (EnqueueAsPendingOperation(
-          key, GeneratedCodeCache::PendingOperation::CreateFetchPendingOp(
-                   key, read_data_callback))) {
-    return;
-  }
-
+  auto op = std::make_unique<PendingOperation>(Operation::kFetch, key,
+                                               std::move(read_data_callback));
   if (backend_state_ != kInitialized) {
     // Insert it into the list of pending operations while the backend is
     // still being opened.
-    pending_ops_.push_back(
-        GeneratedCodeCache::PendingOperation::CreateFetchPendingOp(
-            std::move(key), read_data_callback));
+    pending_ops_.emplace(std::move(op));
     return;
   }
 
-  FetchEntryImpl(key, read_data_callback);
+  EnqueueOperationAndIssueIfNext(std::move(op));
 }
 
 void GeneratedCodeCache::DeleteEntry(const GURL& url, const GURL& origin_lock) {
-  // Silently ignore the requests.
   if (backend_state_ == kFailed) {
+    // Silently fail.
     CollectStatistics(CacheEntryStatus::kError);
     return;
   }
 
   std::string key = GetCacheKey(url, origin_lock);
+  auto op = std::make_unique<PendingOperation>(Operation::kDelete, key);
+
   if (backend_state_ != kInitialized) {
     // Insert it into the list of pending operations while the backend is
     // still being opened.
-    pending_ops_.push_back(
-        GeneratedCodeCache::PendingOperation::CreateDeletePendingOp(
-            std::move(key)));
+    pending_ops_.emplace(std::move(op));
     return;
   }
 
-  DeleteEntryImpl(key);
+  EnqueueOperationAndIssueIfNext(std::move(op));
 }
 
 void GeneratedCodeCache::CreateBackend() {
@@ -361,261 +379,320 @@ void GeneratedCodeCache::DidCreateBackend(
     int rv) {
   if (rv != net::OK) {
     backend_state_ = kFailed;
-    // Process pending operations to process any required callbacks.
-    IssuePendingOperations();
-    return;
+  } else {
+    backend_ = std::move(backend_ptr->data);
+    backend_state_ = kInitialized;
   }
-
-  backend_ = std::move(backend_ptr->data);
-  backend_state_ = kInitialized;
   IssuePendingOperations();
 }
 
 void GeneratedCodeCache::IssuePendingOperations() {
-  // Issue all the pending operations that were received when creating
-  // the backend.
-  for (auto const& op : pending_ops_) {
-    IssueOperation(op.get());
+  // Issue any operations that were received while creating the backend.
+  while (!pending_ops_.empty()) {
+    // Take ownership of the next PendingOperation here. |op| will either be
+    // moved onto a queue in active_entries_map_ or issued and completed in
+    // |DoPendingGetBackend|.
+    std::unique_ptr<PendingOperation> op = std::move(pending_ops_.front());
+    pending_ops_.pop();
+    // Properly enqueue/dequeue ops for Write, Fetch, and Delete.
+    if (op->operation() != Operation::kGetBackend) {
+      EnqueueOperationAndIssueIfNext(std::move(op));
+    } else {
+      // There is no queue for get backend operations. Issue them immediately.
+      IssueOperation(op.get());
+    }
   }
-  pending_ops_.clear();
 }
 
 void GeneratedCodeCache::IssueOperation(PendingOperation* op) {
   switch (op->operation()) {
     case kFetch:
-      FetchEntryImpl(op->key(), op->ReleaseReadCallback());
+      FetchEntryImpl(op);
       break;
     case kWrite:
-      WriteDataImpl(op->key(), op->data());
+      WriteEntryImpl(op);
       break;
     case kDelete:
-      DeleteEntryImpl(op->key());
+      DeleteEntryImpl(op);
       break;
     case kGetBackend:
-      DoPendingGetBackend(op->ReleaseCallback());
+      DoPendingGetBackend(op);
       break;
   }
 }
 
-void GeneratedCodeCache::WriteDataImpl(
-    const std::string& key,
-    scoped_refptr<net::IOBufferWithSize> buffer) {
+void GeneratedCodeCache::WriteEntryImpl(PendingOperation* op) {
+  DCHECK_EQ(Operation::kWrite, op->operation());
   if (backend_state_ != kInitialized) {
-    IssueQueuedOperationForEntry(key);
+    // Silently fail the request.
+    CloseOperationAndIssueNext(op);
     return;
   }
 
-  disk_cache::EntryResultCallback callback =
-      base::BindOnce(&GeneratedCodeCache::CompleteForWriteData,
-                     weak_ptr_factory_.GetWeakPtr(), buffer, key);
+  disk_cache::EntryResult result = backend_->OpenOrCreateEntry(
+      op->key(), net::LOW,
+      base::BindOnce(&GeneratedCodeCache::OpenCompleteForWrite,
+                     weak_ptr_factory_.GetWeakPtr(), op));
 
-  disk_cache::EntryResult result =
-      backend_->OpenOrCreateEntry(key, net::LOW, std::move(callback));
   if (result.net_error() != net::ERR_IO_PENDING) {
-    CompleteForWriteData(buffer, key, std::move(result));
+    OpenCompleteForWrite(op, std::move(result));
   }
 }
 
-void GeneratedCodeCache::CompleteForWriteData(
-    scoped_refptr<net::IOBufferWithSize> buffer,
-    const std::string& key,
+void GeneratedCodeCache::OpenCompleteForWrite(
+    PendingOperation* op,
     disk_cache::EntryResult entry_result) {
+  DCHECK_EQ(Operation::kWrite, op->operation());
   if (entry_result.net_error() != net::OK) {
     CollectStatistics(CacheEntryStatus::kError);
-    IssueQueuedOperationForEntry(key);
+    CloseOperationAndIssueNext(op);
     return;
   }
 
-  int result = net::ERR_FAILED;
-  bool opened = entry_result.opened();
-  {
-    disk_cache::ScopedEntryPtr disk_entry(entry_result.ReleaseEntry());
+  if (entry_result.opened()) {
+    CollectStatistics(CacheEntryStatus::kUpdate);
+  } else {
+    CollectStatistics(CacheEntryStatus::kCreate);
+  }
 
-    if (opened) {
-      CollectStatistics(CacheEntryStatus::kUpdate);
-    } else {
-      CollectStatistics(CacheEntryStatus::kCreate);
-    }
-    // This call will truncate the data. This is safe to do since we read the
-    // entire data at the same time currently. If we want to read in parts we
-    // have to doom the entry first.
-    result = disk_entry->WriteData(
-        kDataIndex, 0, buffer.get(), buffer->size(),
-        base::BindOnce(&GeneratedCodeCache::WriteDataCompleted,
-                       weak_ptr_factory_.GetWeakPtr(), key),
-        true);
+  disk_cache::ScopedEntryPtr entry(entry_result.ReleaseEntry());
+  // There should be a valid entry if the open was successful.
+  DCHECK(entry);
+
+  // Write the small data first, truncating.
+  auto small_buffer = op->small_buffer();
+  int result = entry->WriteData(
+      kSmallDataStream, 0, small_buffer.get(), small_buffer->size(),
+      base::BindOnce(&GeneratedCodeCache::WriteSmallBufferComplete,
+                     weak_ptr_factory_.GetWeakPtr(), op),
+      true);
+
+  if (result != net::ERR_IO_PENDING) {
+    WriteSmallBufferComplete(op, result);
   }
+
+  // Write the large data, truncating.
+  auto large_buffer = op->large_buffer();
+  result = entry->WriteData(
+      kLargeDataStream, 0, large_buffer.get(), large_buffer->size(),
+      base::BindOnce(&GeneratedCodeCache::WriteLargeBufferComplete,
+                     weak_ptr_factory_.GetWeakPtr(), op),
+      true);
+
   if (result != net::ERR_IO_PENDING) {
-    WriteDataCompleted(key, result);
+    WriteLargeBufferComplete(op, result);
+  }
+}
+
+void GeneratedCodeCache::WriteSmallBufferComplete(PendingOperation* op,
+                                                  int rv) {
+  DCHECK_EQ(Operation::kWrite, op->operation());
+  if (op->AddBufferCompletion(rv == op->small_buffer()->size())) {
+    WriteComplete(op);
+  }
+}
+
+void GeneratedCodeCache::WriteLargeBufferComplete(PendingOperation* op,
+                                                  int rv) {
+  DCHECK_EQ(Operation::kWrite, op->operation());
+  if (op->AddBufferCompletion(rv == op->large_buffer()->size())) {
+    WriteComplete(op);
   }
 }
 
-void GeneratedCodeCache::WriteDataCompleted(const std::string& key, int rv) {
-  if (rv < 0) {
+void GeneratedCodeCache::WriteComplete(PendingOperation* op) {
+  DCHECK_EQ(Operation::kWrite, op->operation());
+  if (!op->succeeded()) {
+    // The write failed; record the failure and doom the entry here.
     CollectStatistics(CacheEntryStatus::kWriteFailed);
-    // The write failed; we should delete the entry.
-    DeleteEntryImpl(key);
+    DoomEntry(op);
   }
-  IssueQueuedOperationForEntry(key);
+  CloseOperationAndIssueNext(op);
 }
 
-void GeneratedCodeCache::FetchEntryImpl(const std::string& key,
-                                        ReadDataCallback read_data_callback) {
+void GeneratedCodeCache::FetchEntryImpl(PendingOperation* op) {
+  DCHECK_EQ(Operation::kFetch, op->operation());
   if (backend_state_ != kInitialized) {
-    std::move(read_data_callback).Run(base::Time(), mojo_base::BigBuffer());
-    IssueQueuedOperationForEntry(key);
+    op->TakeReadCallback().Run(base::Time(), mojo_base::BigBuffer());
+    CloseOperationAndIssueNext(op);
     return;
   }
 
-  disk_cache::EntryResultCallback callback =
-      base::BindOnce(&GeneratedCodeCache::OpenCompleteForReadData,
-                     weak_ptr_factory_.GetWeakPtr(), read_data_callback, key);
-
   // This is a part of loading cycle and hence should run with a high priority.
-  disk_cache::EntryResult result =
-      backend_->OpenEntry(key, net::HIGHEST, std::move(callback));
+  disk_cache::EntryResult result = backend_->OpenEntry(
+      op->key(), net::HIGHEST,
+      base::BindOnce(&GeneratedCodeCache::OpenCompleteForRead,
+                     weak_ptr_factory_.GetWeakPtr(), op));
   if (result.net_error() != net::ERR_IO_PENDING) {
-    OpenCompleteForReadData(read_data_callback, key, std::move(result));
+    OpenCompleteForRead(op, std::move(result));
   }
 }
 
-void GeneratedCodeCache::OpenCompleteForReadData(
-    ReadDataCallback read_data_callback,
-    const std::string& key,
+void GeneratedCodeCache::OpenCompleteForRead(
+    PendingOperation* op,
     disk_cache::EntryResult entry_result) {
+  DCHECK_EQ(Operation::kFetch, op->operation());
   if (entry_result.net_error() != net::OK) {
     CollectStatistics(CacheEntryStatus::kMiss);
-    std::move(read_data_callback).Run(base::Time(), mojo_base::BigBuffer());
-    IssueQueuedOperationForEntry(key);
+    op->TakeReadCallback().Run(base::Time(), mojo_base::BigBuffer());
+    CloseOperationAndIssueNext(op);
     return;
   }
 
-  disk_cache::ScopedEntryPtr disk_entry(entry_result.ReleaseEntry());
+  disk_cache::ScopedEntryPtr entry(entry_result.ReleaseEntry());
   // There should be a valid entry if the open was successful.
-  DCHECK(disk_entry);
-
-  int entry_size = disk_entry->GetDataSize(kDataIndex);
-  // Use a BigIOBuffer backed to read and transfer the entry without copying.
-  // We have to read the data in two parts, response time and code, if we don't
-  // want to copy. Use the same buffer to read the response time and the code.
-  int code_size =
-      std::max(kResponseTimeSizeInBytes, entry_size - kResponseTimeSizeInBytes);
-  // Release the disk entry to pass it to |ReadResponseTimeComplete|.
-  disk_cache::Entry* entry = disk_entry.release();
-  scoped_refptr<net::IOBufferWithSize> buffer =
-      base::MakeRefCounted<BigIOBuffer>(static_cast<size_t>(code_size));
-  net::CompletionOnceCallback callback = base::BindOnce(
-      &GeneratedCodeCache::ReadResponseTimeComplete,
-      weak_ptr_factory_.GetWeakPtr(), key, read_data_callback, buffer, entry);
-  int result = entry->ReadData(kDataIndex, 0, buffer.get(),
-                               kResponseTimeSizeInBytes, std::move(callback));
+  DCHECK(entry);
+
+  int small_size = entry->GetDataSize(kSmallDataStream);
+  scoped_refptr<net::IOBufferWithSize> small_buffer =
+      base::MakeRefCounted<net::IOBufferWithSize>(small_size);
+  op->set_small_buffer(small_buffer);
+  int large_size = entry->GetDataSize(kLargeDataStream);
+  scoped_refptr<BigIOBuffer> large_buffer =
+      base::MakeRefCounted<BigIOBuffer>(large_size);
+  op->set_large_buffer(large_buffer);
+
+  // Read the small data first.
+  int result = entry->ReadData(
+      kSmallDataStream, 0, small_buffer.get(), small_buffer->size(),
+      base::BindOnce(&GeneratedCodeCache::ReadSmallBufferComplete,
+                     weak_ptr_factory_.GetWeakPtr(), op));
+
   if (result != net::ERR_IO_PENDING) {
-    ReadResponseTimeComplete(key, read_data_callback, buffer, entry, result);
+    ReadSmallBufferComplete(op, result);
   }
-}
 
-void GeneratedCodeCache::ReadResponseTimeComplete(
-    const std::string& key,
-    ReadDataCallback read_data_callback,
-    scoped_refptr<net::IOBufferWithSize> buffer,
-    disk_cache::Entry* entry,
-    int rv) {
-  DCHECK(entry);
-  disk_cache::ScopedEntryPtr disk_entry(entry);
-  if (rv != kResponseTimeSizeInBytes) {
-    CollectStatistics(CacheEntryStatus::kMiss);
-    std::move(read_data_callback).Run(base::Time(), mojo_base::BigBuffer());
-  } else {
-    // This is considered a cache hit, since response time was read.
-    CollectStatistics(CacheEntryStatus::kHit);
-    int64_t raw_response_time = *(reinterpret_cast<int64_t*>(buffer->data()));
-    net::CompletionOnceCallback callback = base::BindOnce(
-        &GeneratedCodeCache::ReadCodeComplete, weak_ptr_factory_.GetWeakPtr(),
-        key, read_data_callback, buffer, raw_response_time);
-    int result =
-        disk_entry->ReadData(kDataIndex, kResponseTimeSizeInBytes, buffer.get(),
-                             buffer->size(), std::move(callback));
-    if (result != net::ERR_IO_PENDING) {
-      ReadCodeComplete(key, read_data_callback, buffer, raw_response_time,
-                       result);
-    }
+  // Skip the large read if data is in the small read.
+  if (large_size == 0)
+    return;
+
+  // Read the large data.
+  result = entry->ReadData(
+      kLargeDataStream, 0, large_buffer.get(), large_buffer->size(),
+      base::BindOnce(&GeneratedCodeCache::ReadLargeBufferComplete,
+                     weak_ptr_factory_.GetWeakPtr(), op));
+  if (result != net::ERR_IO_PENDING) {
+    ReadLargeBufferComplete(op, result);
   }
 }
 
-void GeneratedCodeCache::ReadCodeComplete(
-    const std::string& key,
-    ReadDataCallback callback,
-    scoped_refptr<net::IOBufferWithSize> buffer,
-    int64_t raw_response_time,
-    int rv) {
-  base::Time response_time = base::Time::FromDeltaSinceWindowsEpoch(
-      base::TimeDelta::FromMicroseconds(raw_response_time));
-  if (rv != buffer->size()) {
-    // Trim the buffer in the unlikely case that code size is less than
-    // kResponseTimeSizeInBytes. On error, return an empty buffer with the
-    // response time, so the renderer can clear the metadata.
-    mojo_base::BigBuffer trimmed_buffer =
-        rv > 0 ? mojo_base::BigBuffer(base::make_span(
-                     reinterpret_cast<const uint8_t*>(buffer->data()),
-                     static_cast<size_t>(rv)))
-               : mojo_base::BigBuffer();
-    std::move(callback).Run(response_time, std::move(trimmed_buffer));
+void GeneratedCodeCache::ReadSmallBufferComplete(PendingOperation* op, int rv) {
+  DCHECK_EQ(Operation::kFetch, op->operation());
+  bool succeeded = rv == op->small_buffer()->size() && rv >= kHeaderSizeInBytes;
+  CollectStatistics(succeeded ? CacheEntryStatus::kHit
+                              : CacheEntryStatus::kMiss);
+
+  if (op->AddBufferCompletion(succeeded))
+    ReadComplete(op);
+
+  // Small reads must finish now since no large read is pending.
+  if (op->large_buffer()->size() == 0)
+    ReadLargeBufferComplete(op, 0);
+}
+
+void GeneratedCodeCache::ReadLargeBufferComplete(PendingOperation* op, int rv) {
+  DCHECK_EQ(Operation::kFetch, op->operation());
+  if (op->AddBufferCompletion(rv == op->large_buffer()->size()))
+    ReadComplete(op);
+}
+
+void GeneratedCodeCache::ReadComplete(PendingOperation* op) {
+  DCHECK_EQ(Operation::kFetch, op->operation());
+  if (!op->succeeded()) {
+    op->TakeReadCallback().Run(base::Time(), mojo_base::BigBuffer());
+    // Doom this entry since it is inaccessible.
+    DoomEntry(op);
   } else {
-    std::move(callback).Run(
-        response_time, static_cast<BigIOBuffer*>(buffer.get())->TakeBuffer());
+    base::Time response_time;
+    uint32_t data_size = 0;
+    ReadSmallDataHeader(op->small_buffer(), &response_time, &data_size);
+    if (data_size <= kSmallDataLimit) {
+      // Small data, copy the data from the small buffer.
+      DCHECK_EQ(0, op->large_buffer()->size());
+      mojo_base::BigBuffer data(data_size);
+      memcpy(data.data(), op->small_buffer()->data() + kHeaderSizeInBytes,
+             data_size);
+      op->TakeReadCallback().Run(response_time, std::move(data));
+    } else {
+      op->TakeReadCallback().Run(response_time,
+                                 op->large_buffer()->TakeBuffer());
+    }
   }
-  IssueQueuedOperationForEntry(key);
+  CloseOperationAndIssueNext(op);
 }
 
-void GeneratedCodeCache::DeleteEntryImpl(const std::string& key) {
-  if (backend_state_ != kInitialized)
-    return;
+void GeneratedCodeCache::DeleteEntryImpl(PendingOperation* op) {
+  DCHECK(op->operation() == Operation::kDelete);
+  DoomEntry(op);
+  CloseOperationAndIssueNext(op);
+}
 
+void GeneratedCodeCache::DoomEntry(PendingOperation* op) {
+  // Write, Fetch, and Delete may all doom an entry.
+  DCHECK_NE(Operation::kGetBackend, op->operation());
+  // Entries shouldn't be doomed if the backend hasn't been initialized.
+  DCHECK_EQ(kInitialized, backend_state_);
   CollectStatistics(CacheEntryStatus::kClear);
-  backend_->DoomEntry(key, net::LOWEST, net::CompletionOnceCallback());
+  backend_->DoomEntry(op->key(), net::LOWEST, net::CompletionOnceCallback());
 }
 
-void GeneratedCodeCache::IssueQueuedOperationForEntry(const std::string& key) {
+void GeneratedCodeCache::IssueNextOperation(const std::string& key) {
   auto it = active_entries_map_.find(key);
-  DCHECK(it != active_entries_map_.end());
-
-  // If no more queued entries then remove the entry to indicate that there are
-  // no in-progress operations for this key.
-  if (it->second.empty()) {
-    active_entries_map_.erase(it);
+  if (it == active_entries_map_.end())
     return;
-  }
 
-  std::unique_ptr<PendingOperation> op = std::move(it->second.front());
-  // Pop it before issuing the operation. Still retain the queue even if it is
-  // empty to indicate that there is a in-progress operation.
-  it->second.pop();
-  IssueOperation(op.get());
+  DCHECK(!it->second.empty());
+  IssueOperation(it->second.front().get());
+}
+
+void GeneratedCodeCache::CloseOperationAndIssueNext(PendingOperation* op) {
+  // Dequeue op, keeping it alive long enough to issue another op.
+  std::unique_ptr<PendingOperation> keep_alive = DequeueOperation(op);
+  IssueNextOperation(op->key());
 }
 
-bool GeneratedCodeCache::EnqueueAsPendingOperation(
-    const std::string& key,
+void GeneratedCodeCache::EnqueueOperationAndIssueIfNext(
     std::unique_ptr<PendingOperation> op) {
-  auto it = active_entries_map_.find(key);
-  if (it != active_entries_map_.end()) {
-    it->second.emplace(std::move(op));
-    return true;
-  }
+  // GetBackend ops have no key and shouldn't be enqueued here.
+  DCHECK_NE(Operation::kGetBackend, op->operation());
+  auto it = active_entries_map_.find(op->key());
+  bool can_issue = false;
+  if (it == active_entries_map_.end()) {
+    it = active_entries_map_.emplace(op->key(), PendingOperationQueue()).first;
+    can_issue = true;
+  }
+  const std::string& key = op->key();
+  it->second.emplace(std::move(op));
+  if (can_issue)
+    IssueNextOperation(key);
+}
 
-  // Create a entry to indicate there is a in-progress operation for this key.
-  active_entries_map_[key] = base::queue<std::unique_ptr<PendingOperation>>();
-  return false;
+std::unique_ptr<GeneratedCodeCache::PendingOperation>
+GeneratedCodeCache::DequeueOperation(PendingOperation* op) {
+  auto it = active_entries_map_.find(op->key());
+  DCHECK(it != active_entries_map_.end());
+  DCHECK(!it->second.empty());
+  std::unique_ptr<PendingOperation> result = std::move(it->second.front());
+  // |op| should be at the front.
+  DCHECK_EQ(op, result.get());
+  it->second.pop();
+  // Delete the queue if it becomes empty.
+  if (it->second.empty()) {
+    active_entries_map_.erase(it);
+  }
+  return result;
 }
 
-void GeneratedCodeCache::DoPendingGetBackend(GetBackendCallback user_callback) {
+void GeneratedCodeCache::DoPendingGetBackend(PendingOperation* op) {
+  // |op| is kept alive in |IssuePendingOperations| for the duration of this
+  // call. We shouldn't access |op| after returning from this function.
+  DCHECK_EQ(kGetBackend, op->operation());
   if (backend_state_ == kInitialized) {
-    std::move(user_callback).Run(backend_.get());
-    return;
+    op->TakeBackendCallback().Run(backend_.get());
+  } else {
+    DCHECK_EQ(backend_state_, kFailed);
+    op->TakeBackendCallback().Run(nullptr);
   }
-
-  DCHECK_EQ(backend_state_, kFailed);
-  std::move(user_callback).Run(nullptr);
-  return;
 }
 
 void GeneratedCodeCache::SetLastUsedTimeForTest(
diff --git a/chromium/content/browser/code_cache/generated_code_cache.h b/chromium/content/browser/code_cache/generated_code_cache.h
index c8e11d26f96..71304e0f9a4 100644
--- a/chromium/content/browser/code_cache/generated_code_cache.h
+++ b/chromium/content/browser/code_cache/generated_code_cache.h
@@ -88,10 +88,10 @@ class CONTENT_EXPORT GeneratedCodeCache {
   // Writes data to the cache. If there is an entry corresponding to
   // <|resource_url|, |origin_lock|> this overwrites the existing data. If
   // there is no entry it creates a new one.
-  void WriteData(const GURL& resource_url,
-                 const GURL& origin_lock,
-                 const base::Time& response_time,
-                 base::span<const uint8_t> data);
+  void WriteEntry(const GURL& resource_url,
+                  const GURL& origin_lock,
+                  const base::Time& response_time,
+                  mojo_base::BigBuffer data);
 
   // Fetch entry corresponding to <resource_url, origin_lock> from the cache
   // and return it using the ReadDataCallback.
@@ -122,7 +122,7 @@ class CONTENT_EXPORT GeneratedCodeCache {
   enum Operation { kFetch, kWrite, kDelete, kGetBackend };
 
   // Data streams corresponding to each entry.
-  enum { kDataIndex = 1 };
+  enum { kSmallDataStream = 0, kLargeDataStream = 1 };
 
   // Creates a simple_disk_cache backend.
   void CreateBackend();
@@ -130,47 +130,43 @@ class CONTENT_EXPORT GeneratedCodeCache {
       scoped_refptr<base::RefCountedData<ScopedBackendPtr>> backend_ptr,
       int rv);
 
-  // The requests that are received while tha backend is being initialized
-  // are recorded in pending operations list. This function issues all pending
-  // operations.
+  // Issues ops that were received while the backend was being initialized.
   void IssuePendingOperations();
+  void IssueOperation(PendingOperation* op);
 
-  // Write entry to cache
-  void WriteDataImpl(const std::string& key,
-                     scoped_refptr<net::IOBufferWithSize> buffer);
-  void CompleteForWriteData(scoped_refptr<net::IOBufferWithSize> buffer,
-                            const std::string& key,
+  // Writes entry to cache.
+  void WriteEntryImpl(PendingOperation* op);
+  void OpenCompleteForWrite(PendingOperation* op,
                             disk_cache::EntryResult result);
-  void WriteDataCompleted(const std::string& key, int rv);
-
-  // Fetch entry from cache
-  void FetchEntryImpl(const std::string& key, ReadDataCallback);
-  void OpenCompleteForReadData(ReadDataCallback callback,
-                               const std::string& key,
-                               disk_cache::EntryResult result);
-  void ReadResponseTimeComplete(const std::string& key,
-                                ReadDataCallback callback,
-                                scoped_refptr<net::IOBufferWithSize> buffer,
-                                disk_cache::Entry* entry,
-                                int rv);
-  void ReadCodeComplete(const std::string& key,
-                        ReadDataCallback callback,
-                        scoped_refptr<net::IOBufferWithSize> buffer,
-                        int64_t raw_response_time,
-                        int rv);
-
-  // Delete entry from cache
-  void DeleteEntryImpl(const std::string& key);
-
-  // Issues the queued operation at the front of the queue for the given |key|.
-  void IssueQueuedOperationForEntry(const std::string& key);
-  // Enqueues into the list if there is an in-progress operation. Otherwise
-  // creates an entry to indicate there is an active operation.
-  bool EnqueueAsPendingOperation(const std::string& key,
-                                 std::unique_ptr<PendingOperation> op);
-  void IssueOperation(PendingOperation* op);
+  void WriteSmallBufferComplete(PendingOperation* op, int rv);
+  void WriteLargeBufferComplete(PendingOperation* op, int rv);
+  void WriteComplete(PendingOperation* op);
+
+  // Fetches entry from cache.
+  void FetchEntryImpl(PendingOperation* op);
+  void OpenCompleteForRead(PendingOperation* op,
+                           disk_cache::EntryResult result);
+  void ReadSmallBufferComplete(PendingOperation* op, int rv);
+  void ReadLargeBufferComplete(PendingOperation* op, int rv);
+  void ReadComplete(PendingOperation* op);
+
+  // Deletes entry from cache.
+  void DeleteEntryImpl(PendingOperation* op);
+
+  void DoomEntry(PendingOperation* op);
+
+  // Issues the next operation on the queue for |key|.
+  void IssueNextOperation(const std::string& key);
+  // Removes |op| and issues the next operation on its queue.
+  void CloseOperationAndIssueNext(PendingOperation* op);
+
+  // Enqueues the operation issues it if there are no pending operations for
+  // its key.
+  void EnqueueOperationAndIssueIfNext(std::unique_ptr<PendingOperation> op);
+  // Dequeues the operation and transfers ownership to caller.
+  std::unique_ptr<PendingOperation> DequeueOperation(PendingOperation* op);
 
-  void DoPendingGetBackend(GetBackendCallback callback);
+  void DoPendingGetBackend(PendingOperation* op);
 
   void OpenCompleteForSetLastUsedForTest(
       base::Time time,
@@ -182,11 +178,12 @@ class CONTENT_EXPORT GeneratedCodeCache {
   std::unique_ptr<disk_cache::Backend> backend_;
   BackendState backend_state_;
 
-  std::vector<std::unique_ptr<PendingOperation>> pending_ops_;
+  // Queue for operations received while initializing the backend.
+  using PendingOperationQueue = base::queue<std::unique_ptr<PendingOperation>>;
+  PendingOperationQueue pending_ops_;
 
-  // Map from key to queue ops.
-  std::map<std::string, base::queue<std::unique_ptr<PendingOperation>>>
-      active_entries_map_;
+  // Map from key to queue of pending operations.
+  std::map<std::string, PendingOperationQueue> active_entries_map_;
 
   base::FilePath path_;
   int max_size_bytes_;
diff --git a/chromium/content/browser/code_cache/generated_code_cache_unittest.cc b/chromium/content/browser/code_cache/generated_code_cache_unittest.cc
index 5f1ff6d0f41..953ae5aa99b 100644
--- a/chromium/content/browser/code_cache/generated_code_cache_unittest.cc
+++ b/chromium/content/browser/code_cache/generated_code_cache_unittest.cc
@@ -17,6 +17,7 @@ namespace content {
 
 class GeneratedCodeCacheTest : public testing::Test {
  public:
+  static const int kLargeSizeInBytes = 8192;
   static const int kMaxSizeInBytes = 1024 * 1024;
   static constexpr char kInitialUrl[] = "http://example.com/script.js";
   static constexpr char kInitialOrigin[] = "http://example.com";
@@ -41,6 +42,10 @@ class GeneratedCodeCacheTest : public testing::Test {
     generated_code_cache_ = std::make_unique<GeneratedCodeCache>(
         cache_path_, kMaxSizeInBytes, cache_type);
 
+    GeneratedCodeCache::GetBackendCallback callback = base::BindOnce(
+        &GeneratedCodeCacheTest::GetBackendCallback, base::Unretained(this));
+    generated_code_cache_->GetBackend(std::move(callback));
+
     GURL url(kInitialUrl);
     GURL origin_lock = GURL(kInitialOrigin);
     WriteToCache(url, origin_lock, kInitialData, base::Time::Now());
@@ -61,8 +66,8 @@ class GeneratedCodeCacheTest : public testing::Test {
                     const std::string& data,
                     base::Time response_time) {
     std::vector<uint8_t> vector_data(data.begin(), data.end());
-    generated_code_cache_->WriteData(url, origin_lock, response_time,
-                                     vector_data);
+    generated_code_cache_->WriteEntry(url, origin_lock, response_time,
+                                      vector_data);
   }
 
   void DeleteFromCache(const GURL& url, const GURL& origin_lock) {
@@ -76,6 +81,16 @@ class GeneratedCodeCacheTest : public testing::Test {
     generated_code_cache_->FetchEntry(url, origin_lock, callback);
   }
 
+  void DoomAll() {
+    net::CompletionOnceCallback callback = base::BindOnce(
+        &GeneratedCodeCacheTest::DoomAllCallback, base::Unretained(this));
+    backend_->DoomAllEntries(std::move(callback));
+  }
+
+  void GetBackendCallback(disk_cache::Backend* backend) { backend_ = backend; }
+
+  void DoomAllCallback(int rv) {}
+
   void FetchEntryCallback(const base::Time& response_time,
                           mojo_base::BigBuffer data) {
     if (data.size() == 0) {
@@ -100,6 +115,7 @@ class GeneratedCodeCacheTest : public testing::Test {
   bool received_;
   bool received_null_;
   base::FilePath cache_path_;
+  disk_cache::Backend* backend_;
 };
 
 constexpr char GeneratedCodeCacheTest::kInitialUrl[];
@@ -153,6 +169,23 @@ TEST_F(GeneratedCodeCacheTest, WriteEntry) {
   EXPECT_EQ(response_time, received_response_time_);
 }
 
+TEST_F(GeneratedCodeCacheTest, WriteLargeEntry) {
+  GURL new_url("http://example1.com/script.js");
+  GURL origin_lock = GURL(kInitialOrigin);
+
+  InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
+  std::string large_data(kLargeSizeInBytes, 'x');
+  base::Time response_time = base::Time::Now();
+  WriteToCache(new_url, origin_lock, large_data, response_time);
+  task_environment_.RunUntilIdle();
+  FetchFromCache(new_url, origin_lock);
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(received_);
+  EXPECT_EQ(large_data, received_data_);
+  EXPECT_EQ(response_time, received_response_time_);
+}
+
 TEST_F(GeneratedCodeCacheTest, DeleteEntry) {
   GURL url(kInitialUrl);
   GURL origin_lock = GURL(kInitialOrigin);
@@ -200,6 +233,28 @@ TEST_F(GeneratedCodeCacheTest, WriteEntryFailure) {
   EXPECT_EQ(base::Time(), received_response_time_);
 }
 
+TEST_F(GeneratedCodeCacheTest, WriteEntryFailureOutOfOrder) {
+  GURL url(kInitialUrl);
+  GURL origin_lock = GURL(kInitialOrigin);
+
+  InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
+  // Dooming adds pending activity for all entries. This makes the following
+  // write block for stream 0, while the stream 1 write fails synchronously. The
+  // two callbacks are received in reverse order.
+  DoomAll();
+  base::Time response_time = base::Time::Now();
+  std::string too_big_data(kMaxSizeInBytes * 8, 0);
+  WriteToCache(url, origin_lock, too_big_data, response_time);
+  task_environment_.RunUntilIdle();
+  FetchFromCache(url, origin_lock);
+  task_environment_.RunUntilIdle();
+
+  // Fetch should return empty data, with invalid response time.
+  ASSERT_TRUE(received_);
+  ASSERT_TRUE(received_null_);
+  EXPECT_EQ(base::Time(), received_response_time_);
+}
+
 TEST_F(GeneratedCodeCacheTest, FetchEntryPendingOp) {
   GURL url(kInitialUrl);
   GURL origin_lock = GURL(kInitialOrigin);
@@ -229,6 +284,23 @@ TEST_F(GeneratedCodeCacheTest, WriteEntryPendingOp) {
   EXPECT_EQ(response_time, received_response_time_);
 }
 
+TEST_F(GeneratedCodeCacheTest, WriteLargeEntryPendingOp) {
+  GURL new_url("http://example1.com/script1.js");
+  GURL origin_lock = GURL(kInitialOrigin);
+
+  InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
+  std::string large_data(kLargeSizeInBytes, 'x');
+  base::Time response_time = base::Time::Now();
+  WriteToCache(new_url, origin_lock, large_data, response_time);
+  task_environment_.RunUntilIdle();
+  FetchFromCache(new_url, origin_lock);
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(received_);
+  EXPECT_EQ(large_data, received_data_);
+  EXPECT_EQ(response_time, received_response_time_);
+}
+
 TEST_F(GeneratedCodeCacheTest, DeleteEntryPendingOp) {
   GURL url(kInitialUrl);
   GURL origin_lock = GURL(kInitialOrigin);
@@ -259,6 +331,63 @@ TEST_F(GeneratedCodeCacheTest, UpdateDataOfExistingEntry) {
   EXPECT_EQ(response_time, received_response_time_);
 }
 
+TEST_F(GeneratedCodeCacheTest, UpdateDataOfSmallExistingEntry) {
+  GURL url(kInitialUrl);
+  GURL origin_lock = GURL(kInitialOrigin);
+
+  InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
+  std::string new_data(kLargeSizeInBytes, 'x');
+  base::Time response_time = base::Time::Now();
+  WriteToCache(url, origin_lock, new_data, response_time);
+  task_environment_.RunUntilIdle();
+  FetchFromCache(url, origin_lock);
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(received_);
+  EXPECT_EQ(new_data, received_data_);
+  EXPECT_EQ(response_time, received_response_time_);
+}
+
+TEST_F(GeneratedCodeCacheTest, UpdateDataOfLargeExistingEntry) {
+  GURL url(kInitialUrl);
+  GURL origin_lock = GURL(kInitialOrigin);
+
+  InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
+  std::string large_data(kLargeSizeInBytes, 'x');
+  base::Time response_time = base::Time::Now();
+  WriteToCache(url, origin_lock, large_data, response_time);
+  std::string new_data = large_data + "Overwrite";
+  response_time = base::Time::Now();
+  WriteToCache(url, origin_lock, new_data, response_time);
+  task_environment_.RunUntilIdle();
+  FetchFromCache(url, origin_lock);
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(received_);
+  EXPECT_EQ(new_data, received_data_);
+  EXPECT_EQ(response_time, received_response_time_);
+}
+
+TEST_F(GeneratedCodeCacheTest, TruncateDataOfLargeExistingEntry) {
+  GURL url(kInitialUrl);
+  GURL origin_lock = GURL(kInitialOrigin);
+
+  InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
+  std::string large_data(kLargeSizeInBytes, 'x');
+  base::Time response_time = base::Time::Now();
+  WriteToCache(url, origin_lock, large_data, response_time);
+  std::string new_data = "SerializedCodeForScriptOverwrite";
+  response_time = base::Time::Now();
+  WriteToCache(url, origin_lock, new_data, response_time);
+  task_environment_.RunUntilIdle();
+  FetchFromCache(url, origin_lock);
+  task_environment_.RunUntilIdle();
+
+  ASSERT_TRUE(received_);
+  EXPECT_EQ(new_data, received_data_);
+  EXPECT_EQ(response_time, received_response_time_);
+}
+
 TEST_F(GeneratedCodeCacheTest, FetchFailsForNonexistingOrigin) {
   InitializeCache(GeneratedCodeCache::CodeCacheType::kJavaScript);
   GURL new_origin_lock = GURL("http://not-example.com");
diff --git a/chromium/content/browser/compositor/gpu_browser_compositor_output_surface.cc b/chromium/content/browser/compositor/gpu_browser_compositor_output_surface.cc
index 1a4e35b842d..b5091a567dc 100644
--- a/chromium/content/browser/compositor/gpu_browser_compositor_output_surface.cc
+++ b/chromium/content/browser/compositor/gpu_browser_compositor_output_surface.cc
@@ -28,6 +28,7 @@ GpuBrowserCompositorOutputSurface::GpuBrowserCompositorOutputSurface(
     gpu::SurfaceHandle surface_handle)
     : BrowserCompositorOutputSurface(std::move(context)),
       surface_handle_(surface_handle) {
+  capabilities_.only_invalidates_damage_rect = false;
   if (capabilities_.uses_default_gl_framebuffer) {
     capabilities_.flipped_output_surface =
         context_provider()->ContextCapabilities().flips_vertically;
diff --git a/chromium/content/browser/compositor/gpu_process_transport_factory.cc b/chromium/content/browser/compositor/gpu_process_transport_factory.cc
index cc5bbfbe0ff..a66cb2fdba4 100644
--- a/chromium/content/browser/compositor/gpu_process_transport_factory.cc
+++ b/chromium/content/browser/compositor/gpu_process_transport_factory.cc
@@ -67,7 +67,6 @@
 #include "third_party/khronos/GLES2/gl2.h"
 #include "ui/base/ui_base_switches_util.h"
 #include "ui/compositor/compositor.h"
-#include "ui/compositor/host/external_begin_frame_controller_client_impl.h"
 #include "ui/compositor/layer.h"
 #include "ui/display/display_switches.h"
 #include "ui/display/types/display_snapshot.h"
@@ -115,7 +114,7 @@ viz::FrameSinkManagerImpl* GetFrameSinkManager() {
   return content::BrowserMainLoop::GetInstance()->GetFrameSinkManager();
 }
 
-#if defined(USE_X11)
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
 class HostDisplayClient : public viz::HostDisplayClient {
  public:
   explicit HostDisplayClient(ui::Compositor* compositor)
@@ -156,8 +155,6 @@ struct GpuProcessTransportFactory::PerCompositorData {
   std::unique_ptr<viz::SyntheticBeginFrameSource> synthetic_begin_frame_source;
   std::unique_ptr<viz::ExternalBeginFrameSourceMojo>
       external_begin_frame_source_mojo;
-  std::unique_ptr<ui::ExternalBeginFrameControllerClientImpl>
-      external_begin_frame_controller_client;
   ReflectorImpl* reflector = nullptr;
   std::unique_ptr<viz::Display> display;
   std::unique_ptr<viz::mojom::DisplayClient> display_client;
@@ -216,7 +213,7 @@ GpuProcessTransportFactory::CreateSoftwareOutputDevice(
     scoped_refptr<base::SequencedTaskRunner> task_runner) {
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
   if (command_line->HasSwitch(switches::kHeadless))
-    return base::WrapUnique(new viz::SoftwareOutputDevice);
+    return std::make_unique<viz::SoftwareOutputDevice>();
 
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 #if defined(USE_OZONE)
@@ -225,15 +222,16 @@ GpuProcessTransportFactory::CreateSoftwareOutputDevice(
   std::unique_ptr<ui::PlatformWindowSurface> platform_window_surface =
       factory->CreatePlatformWindowSurface(widget);
   std::unique_ptr<ui::SurfaceOzoneCanvas> surface_ozone =
-      factory->CreateCanvasForWidget(widget);
+      factory->CreateCanvasForWidget(widget, task_runner.get());
   CHECK(surface_ozone);
   return std::make_unique<viz::SoftwareOutputDeviceOzone>(
       std::move(platform_window_surface), std::move(surface_ozone));
 #elif defined(USE_X11)
-  return std::make_unique<viz::SoftwareOutputDeviceX11>(widget);
+  return std::make_unique<viz::SoftwareOutputDeviceX11>(widget,
+                                                        task_runner.get());
 #else
   NOTREACHED();
-  return std::unique_ptr<viz::SoftwareOutputDevice>();
+  return nullptr;
 #endif
 }
 
@@ -422,22 +420,15 @@ void GpuProcessTransportFactory::EstablishedGpuChannel(
   std::unique_ptr<viz::SyntheticBeginFrameSource> synthetic_begin_frame_source;
   std::unique_ptr<viz::ExternalBeginFrameSourceMojo>
       external_begin_frame_source_mojo;
-  std::unique_ptr<ui::ExternalBeginFrameControllerClientImpl>
-      external_begin_frame_controller_client;
-
   viz::BeginFrameSource* begin_frame_source = nullptr;
-  if (compositor->external_begin_frame_client()) {
-    external_begin_frame_controller_client =
-        std::make_unique<ui::ExternalBeginFrameControllerClientImpl>(
-            compositor->external_begin_frame_client());
+  if (compositor->use_external_begin_frame_control()) {
     // We don't bind the controller mojo interface, since we only use the
     // ExternalBeginFrameSourceMojo directly and not via mojo (plus, as it
     // is an associated interface, binding it would require a separate pipe).
     viz::mojom::ExternalBeginFrameControllerAssociatedRequest request = nullptr;
     external_begin_frame_source_mojo =
         std::make_unique<viz::ExternalBeginFrameSourceMojo>(
-            std::move(request),
-            external_begin_frame_controller_client->GetBoundPtr(),
+            GetFrameSinkManager(), std::move(request),
             viz::BeginFrameSource::kNotRestartableId);
     begin_frame_source = external_begin_frame_source_mojo.get();
   } else if (disable_frame_rate_limit_) {
@@ -482,8 +473,6 @@ void GpuProcessTransportFactory::EstablishedGpuChannel(
   data->synthetic_begin_frame_source = std::move(synthetic_begin_frame_source);
   data->external_begin_frame_source_mojo =
       std::move(external_begin_frame_source_mojo);
-  data->external_begin_frame_controller_client =
-      std::move(external_begin_frame_controller_client);
   if (data->external_begin_frame_source_mojo)
     data->external_begin_frame_source_mojo->SetDisplay(data->display.get());
 
@@ -718,14 +707,17 @@ void GpuProcessTransportFactory::SetDisplayVSyncParameters(
 
 void GpuProcessTransportFactory::IssueExternalBeginFrame(
     ui::Compositor* compositor,
-    const viz::BeginFrameArgs& args) {
+    const viz::BeginFrameArgs& args,
+    bool force,
+    base::OnceCallback<void(const viz::BeginFrameAck&)> callback) {
   auto it = per_compositor_data_.find(compositor);
   if (it == per_compositor_data_.end())
     return;
   PerCompositorData* data = it->second.get();
   DCHECK(data);
   DCHECK(data->external_begin_frame_source_mojo);
-  data->external_begin_frame_source_mojo->IssueExternalBeginFrame(args);
+  data->external_begin_frame_source_mojo->IssueExternalBeginFrame(
+      args, force, std::move(callback));
 }
 
 void GpuProcessTransportFactory::SetOutputIsSecure(ui::Compositor* compositor,
diff --git a/chromium/content/browser/compositor/gpu_process_transport_factory.h b/chromium/content/browser/compositor/gpu_process_transport_factory.h
index 9d32cbc6695..09aca9081a8 100644
--- a/chromium/content/browser/compositor/gpu_process_transport_factory.h
+++ b/chromium/content/browser/compositor/gpu_process_transport_factory.h
@@ -97,8 +97,11 @@ class GpuProcessTransportFactory : public ui::ContextFactory,
   void SetDisplayVSyncParameters(ui::Compositor* compositor,
                                  base::TimeTicks timebase,
                                  base::TimeDelta interval) override;
-  void IssueExternalBeginFrame(ui::Compositor* compositor,
-                               const viz::BeginFrameArgs& args) override;
+  void IssueExternalBeginFrame(
+      ui::Compositor* compositor,
+      const viz::BeginFrameArgs& args,
+      bool force,
+      base::OnceCallback<void(const viz::BeginFrameAck&)> callback) override;
   void SetOutputIsSecure(ui::Compositor* compositor, bool secure) override;
   void AddVSyncParameterObserver(
       ui::Compositor* compositor,
diff --git a/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.cc b/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.cc
index c5fb634511e..180465993e4 100644
--- a/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.cc
+++ b/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.cc
@@ -120,6 +120,12 @@ void GpuSurfacelessBrowserCompositorOutputSurface::BindFramebuffer() {
   }
 }
 
+gfx::Rect
+GpuSurfacelessBrowserCompositorOutputSurface::GetCurrentFramebufferDamage()
+    const {
+  return buffer_queue_->CurrentBufferDamage();
+}
+
 GLenum GpuSurfacelessBrowserCompositorOutputSurface::
     GetFramebufferCopyTextureFormat() {
   return buffer_queue_->internal_format();
@@ -182,7 +188,6 @@ unsigned GpuSurfacelessBrowserCompositorOutputSurface::UpdateGpuFence() {
 void GpuSurfacelessBrowserCompositorOutputSurface::SetDrawRectangle(
     const gfx::Rect& damage) {
   GpuBrowserCompositorOutputSurface::SetDrawRectangle(damage);
-  buffer_queue_->CopyDamageForCurrentSurface(damage);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.h b/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.h
index 8f7878800cb..036c1266639 100644
--- a/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.h
+++ b/chromium/content/browser/compositor/gpu_surfaceless_browser_compositor_output_surface.h
@@ -36,6 +36,7 @@ class GpuSurfacelessBrowserCompositorOutputSurface
   // viz::OutputSurface implementation.
   void SwapBuffers(viz::OutputSurfaceFrame frame) override;
   void BindFramebuffer() override;
+  gfx::Rect GetCurrentFramebufferDamage() const override;
   uint32_t GetFramebufferCopyTextureFormat() override;
   void Reshape(const gfx::Size& size,
                float device_scale_factor,
@@ -46,6 +47,7 @@ class GpuSurfacelessBrowserCompositorOutputSurface
   unsigned GetOverlayTextureId() const override;
   gfx::BufferFormat GetOverlayBufferFormat() const override;
   unsigned UpdateGpuFence() override;
+
   void SetDrawRectangle(const gfx::Rect& damage) override;
 
   // BrowserCompositorOutputSurface implementation.
diff --git a/chromium/content/browser/compositor/reflector_impl_unittest.cc b/chromium/content/browser/compositor/reflector_impl_unittest.cc
index 2ba96ac8895..bb09bf4ac1a 100644
--- a/chromium/content/browser/compositor/reflector_impl_unittest.cc
+++ b/chromium/content/browser/compositor/reflector_impl_unittest.cc
@@ -25,7 +25,7 @@
 #include "ui/compositor/test/test_context_factories.h"
 
 #if defined(USE_OZONE)
-#include "components/viz/service/display/overlay_candidate.h"
+#include "components/viz/service/display/overlay_candidate_list.h"
 #include "components/viz/service/display_embedder/overlay_candidate_validator_ozone.h"
 #include "ui/ozone/public/overlay_candidates_ozone.h"
 #endif  // defined(USE_OZONE)
diff --git a/chromium/content/browser/compositor/software_browser_compositor_output_surface.cc b/chromium/content/browser/compositor/software_browser_compositor_output_surface.cc
index 31b6c038bc7..68027b8f5a4 100644
--- a/chromium/content/browser/compositor/software_browser_compositor_output_surface.cc
+++ b/chromium/content/browser/compositor/software_browser_compositor_output_surface.cc
@@ -73,9 +73,9 @@ void SoftwareBrowserCompositorOutputSurface::SwapBuffers(
 
   gfx::VSyncProvider* vsync_provider = software_device()->GetVSyncProvider();
   if (vsync_provider) {
-    vsync_provider->GetVSyncParameters(
-        base::Bind(&SoftwareBrowserCompositorOutputSurface::UpdateVSyncCallback,
-                   weak_factory_.GetWeakPtr()));
+    vsync_provider->GetVSyncParameters(base::BindOnce(
+        &SoftwareBrowserCompositorOutputSurface::UpdateVSyncCallback,
+        weak_factory_.GetWeakPtr()));
   }
 
   software_device()->OnSwapBuffers(base::BindOnce(
@@ -89,7 +89,7 @@ void SoftwareBrowserCompositorOutputSurface::SwapBuffersCallback(
     const gfx::Size& pixel_size) {
   latency_tracker_.OnGpuSwapBuffersCompleted(latency_info);
   client_->DidReceiveSwapBuffersAck({swap_time, swap_time});
-#if defined(USE_X11)
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
   if (needs_swap_size_notifications_)
     client_->DidSwapWithSize(pixel_size);
 #endif
@@ -129,7 +129,7 @@ unsigned SoftwareBrowserCompositorOutputSurface::UpdateGpuFence() {
   return 0;
 }
 
-#if defined(USE_X11)
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
 void SoftwareBrowserCompositorOutputSurface::SetNeedsSwapSizeNotifications(
     bool needs_swap_size_notifications) {
   needs_swap_size_notifications_ = needs_swap_size_notifications;
diff --git a/chromium/content/browser/compositor/software_browser_compositor_output_surface.h b/chromium/content/browser/compositor/software_browser_compositor_output_surface.h
index 45fed95852e..164289b4ad0 100644
--- a/chromium/content/browser/compositor/software_browser_compositor_output_surface.h
+++ b/chromium/content/browser/compositor/software_browser_compositor_output_surface.h
@@ -39,7 +39,7 @@ class CONTENT_EXPORT SoftwareBrowserCompositorOutputSurface
   gfx::BufferFormat GetOverlayBufferFormat() const override;
   uint32_t GetFramebufferCopyTextureFormat() override;
   unsigned UpdateGpuFence() override;
-#if defined(USE_X11)
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
   void SetNeedsSwapSizeNotifications(
       bool needs_swap_size_notifications) override;
 #endif
@@ -55,7 +55,7 @@ class CONTENT_EXPORT SoftwareBrowserCompositorOutputSurface
   base::TimeDelta refresh_interval_;
   ui::LatencyTracker latency_tracker_;
 
-#if defined(USE_X11)
+#if defined(OS_LINUX) && !defined(OS_CHROMEOS)
   bool needs_swap_size_notifications_ = false;
 #endif
 
diff --git a/chromium/content/browser/compositor/viz_process_transport_factory.cc b/chromium/content/browser/compositor/viz_process_transport_factory.cc
index f9dbd30fbf8..22635f8b04f 100644
--- a/chromium/content/browser/compositor/viz_process_transport_factory.cc
+++ b/chromium/content/browser/compositor/viz_process_transport_factory.cc
@@ -34,6 +34,8 @@
 #include "gpu/command_buffer/client/gles2_interface.h"
 #include "gpu/command_buffer/client/raster_interface.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/compositor/reflector.h"
@@ -127,16 +129,19 @@ VizProcessTransportFactory::~VizProcessTransportFactory() {
 }
 
 void VizProcessTransportFactory::ConnectHostFrameSinkManager() {
-  viz::mojom::FrameSinkManagerPtr frame_sink_manager;
-  viz::mojom::FrameSinkManagerRequest frame_sink_manager_request =
-      mojo::MakeRequest(&frame_sink_manager);
-  viz::mojom::FrameSinkManagerClientPtr frame_sink_manager_client;
-  viz::mojom::FrameSinkManagerClientRequest frame_sink_manager_client_request =
-      mojo::MakeRequest(&frame_sink_manager_client);
+  mojo::PendingRemote<viz::mojom::FrameSinkManager> frame_sink_manager;
+  mojo::PendingReceiver<viz::mojom::FrameSinkManager>
+      frame_sink_manager_receiver =
+          frame_sink_manager.InitWithNewPipeAndPassReceiver();
+  mojo::PendingRemote<viz::mojom::FrameSinkManagerClient>
+      frame_sink_manager_client;
+  mojo::PendingReceiver<viz::mojom::FrameSinkManagerClient>
+      frame_sink_manager_client_receiver =
+          frame_sink_manager_client.InitWithNewPipeAndPassReceiver();
 
   // Setup HostFrameSinkManager with interface endpoints.
   context_factory_private_.GetHostFrameSinkManager()->BindAndSetManager(
-      std::move(frame_sink_manager_client_request),
+      std::move(frame_sink_manager_client_receiver),
       context_factory_private_.resize_task_runner(),
       std::move(frame_sink_manager));
 
@@ -144,8 +149,8 @@ void VizProcessTransportFactory::ConnectHostFrameSinkManager() {
     // Hop to the IO thread, then send the other side of interface to viz
     // process.
     auto connect_on_io_thread =
-        [](viz::mojom::FrameSinkManagerRequest request,
-           viz::mojom::FrameSinkManagerClientPtrInfo client) {
+        [](mojo::PendingReceiver<viz::mojom::FrameSinkManager> receiver,
+           mojo::PendingRemote<viz::mojom::FrameSinkManagerClient> client) {
           // There should always be a GpuProcessHost instance, and GPU process,
           // for running the compositor thread. The exception is during shutdown
           // the GPU process won't be restarted and GpuProcessHost::Get() can
@@ -153,13 +158,13 @@ void VizProcessTransportFactory::ConnectHostFrameSinkManager() {
           auto* gpu_process_host = GpuProcessHost::Get();
           if (gpu_process_host) {
             gpu_process_host->gpu_host()->ConnectFrameSinkManager(
-                std::move(request), std::move(client));
+                std::move(receiver), std::move(client));
           }
         };
     base::PostTask(FROM_HERE, {BrowserThread::IO},
                    base::BindOnce(connect_on_io_thread,
-                                  std::move(frame_sink_manager_request),
-                                  frame_sink_manager_client.PassInterface()));
+                                  std::move(frame_sink_manager_receiver),
+                                  std::move(frame_sink_manager_client)));
   } else {
     DCHECK(!viz_compositor_thread_);
 
@@ -176,9 +181,8 @@ void VizProcessTransportFactory::ConnectHostFrameSinkManager() {
     params->use_activation_deadline = activation_deadline_in_frames.has_value();
     params->activation_deadline_in_frames =
         activation_deadline_in_frames.value_or(0u);
-    params->frame_sink_manager = std::move(frame_sink_manager_request);
-    params->frame_sink_manager_client =
-        frame_sink_manager_client.PassInterface();
+    params->frame_sink_manager = std::move(frame_sink_manager_receiver);
+    params->frame_sink_manager_client = std::move(frame_sink_manager_client);
     viz_compositor_thread_->CreateFrameSinkManager(std::move(params));
   }
 }
diff --git a/chromium/content/browser/compositor/viz_process_transport_factory.h b/chromium/content/browser/compositor/viz_process_transport_factory.h
index d324bf02e35..5550113ec21 100644
--- a/chromium/content/browser/compositor/viz_process_transport_factory.h
+++ b/chromium/content/browser/compositor/viz_process_transport_factory.h
@@ -13,7 +13,6 @@
 #include "components/viz/service/main/viz_compositor_thread_runner_impl.h"
 #include "content/browser/compositor/image_transport_factory.h"
 #include "gpu/command_buffer/common/context_result.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.h"
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom.h"
 #include "ui/compositor/compositor.h"
diff --git a/chromium/content/browser/content_index/content_index_service_impl.cc b/chromium/content/browser/content_index/content_index_service_impl.cc
index feab6d28877..314dc6abf27 100644
--- a/chromium/content/browser/content_index/content_index_service_impl.cc
+++ b/chromium/content/browser/content_index/content_index_service_impl.cc
@@ -19,18 +19,40 @@
 namespace content {
 
 // static
-void ContentIndexServiceImpl::Create(
-    mojo::PendingReceiver<blink::mojom::ContentIndexService> receiver,
-    RenderProcessHost* render_process_host,
-    const url::Origin& origin) {
+void ContentIndexServiceImpl::CreateForFrame(
+    RenderFrameHost* render_frame_host,
+    mojo::PendingReceiver<blink::mojom::ContentIndexService> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
+  RenderProcessHost* render_process_host = render_frame_host->GetProcess();
+  DCHECK(render_process_host);
+  auto* storage_partition = static_cast<StoragePartitionImpl*>(
+      render_process_host->GetStoragePartition());
+
+  mojo::MakeSelfOwnedReceiver(std::make_unique<ContentIndexServiceImpl>(
+                                  render_frame_host->GetLastCommittedOrigin(),
+                                  storage_partition->GetContentIndexContext()),
+                              std::move(receiver));
+}
+
+// static
+void ContentIndexServiceImpl::CreateForWorker(
+    const ServiceWorkerVersionInfo& info,
+    mojo::PendingReceiver<blink::mojom::ContentIndexService> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  RenderProcessHost* render_process_host =
+      RenderProcessHost::FromID(info.process_id);
+
+  if (!render_process_host)
+    return;
+
   auto* storage_partition = static_cast<StoragePartitionImpl*>(
       render_process_host->GetStoragePartition());
 
   mojo::MakeSelfOwnedReceiver(
       std::make_unique<ContentIndexServiceImpl>(
-          origin, storage_partition->GetContentIndexContext()),
+          info.script_origin, storage_partition->GetContentIndexContext()),
       std::move(receiver));
 }
 
diff --git a/chromium/content/browser/content_index/content_index_service_impl.h b/chromium/content/browser/content_index/content_index_service_impl.h
index 172936ac29e..863bbe66ab4 100644
--- a/chromium/content/browser/content_index/content_index_service_impl.h
+++ b/chromium/content/browser/content_index/content_index_service_impl.h
@@ -15,17 +15,21 @@ class GURL;
 
 namespace content {
 
-class RenderProcessHost;
+class RenderFrameHost;
+struct ServiceWorkerVersionInfo;
 
 // Lazily constructed by the corresponding renderer when the Content Index API
 // is triggered.
 class CONTENT_EXPORT ContentIndexServiceImpl
     : public blink::mojom::ContentIndexService {
  public:
-  static void Create(
-      mojo::PendingReceiver<blink::mojom::ContentIndexService> receiver,
-      RenderProcessHost* render_process_host,
-      const url::Origin& origin);
+  static void CreateForFrame(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingReceiver<blink::mojom::ContentIndexService> receiver);
+
+  static void CreateForWorker(
+      const ServiceWorkerVersionInfo& info,
+      mojo::PendingReceiver<blink::mojom::ContentIndexService> receiver);
 
   ContentIndexServiceImpl(
       const url::Origin& origin,
diff --git a/chromium/content/browser/content_service_delegate_impl.cc b/chromium/content/browser/content_service_delegate_impl.cc
index f792a5e76cd..10c1cca800a 100644
--- a/chromium/content/browser/content_service_delegate_impl.cc
+++ b/chromium/content/browser/content_service_delegate_impl.cc
@@ -51,7 +51,7 @@ class NavigableContentsDelegateImpl : public content::NavigableContentsDelegate,
     renderer_prefs->can_accept_load_drops = false;
     renderer_prefs->browser_handles_all_top_level_requests =
         params.suppress_navigations;
-    web_contents_->GetRenderViewHost()->SyncRendererPrefs();
+    web_contents_->SyncRendererPrefs();
   }
 
   ~NavigableContentsDelegateImpl() override {
@@ -104,25 +104,18 @@ class NavigableContentsDelegateImpl : public content::NavigableContentsDelegate,
   }
 
   // WebContentsDelegate:
-  bool ShouldCreateWebContents(
-      content::WebContents* web_contents,
-      content::RenderFrameHost* opener,
+  bool IsWebContentsCreationOverridden(
       content::SiteInstance* source_site_instance,
-      int32_t route_id,
-      int32_t main_frame_route_id,
-      int32_t main_frame_widget_route_id,
       content::mojom::WindowContainerType window_container_type,
       const GURL& opener_url,
       const std::string& frame_name,
-      const GURL& target_url,
-      const std::string& partition_id,
-      content::SessionStorageNamespace* session_storage_namespace) override {
+      const GURL& target_url) override {
     // This method is invoked when attempting to open links in a new tab, e.g.:
     // <a href="https://www.google.com/" target="_blank">Link</a>
     client_->DidSuppressNavigation(target_url,
                                    WindowOpenDisposition::NEW_FOREGROUND_TAB,
                                    /*from_user_gesture=*/true);
-    return false;
+    return true;
   }
 
   WebContents* OpenURLFromTab(WebContents* source,
diff --git a/chromium/content/browser/cookie_store/cookie_change_subscription.cc b/chromium/content/browser/cookie_store/cookie_change_subscription.cc
index 4d61fbf4dc4..ff5de3f6999 100644
--- a/chromium/content/browser/cookie_store/cookie_change_subscription.cc
+++ b/chromium/content/browser/cookie_store/cookie_change_subscription.cc
@@ -158,7 +158,8 @@ void CookieChangeSubscription::Serialize(
 }
 
 bool CookieChangeSubscription::ShouldObserveChangeTo(
-    const net::CanonicalCookie& cookie) const {
+    const net::CanonicalCookie& cookie,
+    net::CookieAccessSemantics access_semantics) const {
   switch (match_type_) {
     case ::network::mojom::CookieMatchType::EQUALS:
       if (cookie.Name() != name_)
@@ -174,7 +175,8 @@ bool CookieChangeSubscription::ShouldObserveChangeTo(
   net_options.set_same_site_cookie_context(
       net::CookieOptions::SameSiteCookieContext::SAME_SITE_STRICT);
 
-  return cookie.IncludeForRequestURL(url_, net_options).IsInclude();
+  return cookie.IncludeForRequestURL(url_, net_options, access_semantics)
+      .IsInclude();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/cookie_store/cookie_change_subscription.h b/chromium/content/browser/cookie_store/cookie_change_subscription.h
index c2c4839a26d..8276cd20144 100644
--- a/chromium/content/browser/cookie_store/cookie_change_subscription.h
+++ b/chromium/content/browser/cookie_store/cookie_change_subscription.h
@@ -98,7 +98,8 @@ class CookieChangeSubscription
       blink::mojom::CookieChangeSubscription* mojo_subscription) const;
 
   // True if the subscription covers a change to the given cookie.
-  bool ShouldObserveChangeTo(const net::CanonicalCookie& cookie) const;
+  bool ShouldObserveChangeTo(const net::CanonicalCookie& cookie,
+                             net::CookieAccessSemantics access_semantics) const;
 
  private:
   const GURL url_;
diff --git a/chromium/content/browser/cookie_store/cookie_store_context.cc b/chromium/content/browser/cookie_store/cookie_store_context.cc
index 592bd1b2200..1e3776b6b0e 100644
--- a/chromium/content/browser/cookie_store/cookie_store_context.cc
+++ b/chromium/content/browser/cookie_store/cookie_store_context.cc
@@ -7,8 +7,10 @@
 #include "base/bind.h"
 #include "base/task/post_task.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
+#include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/storage_partition.h"
 
@@ -20,9 +22,9 @@ CookieStoreContext::CookieStoreContext()
               {ServiceWorkerContext::GetCoreThreadId()})) {}
 
 CookieStoreContext::~CookieStoreContext() {
-  // The destructor must be called on the core thread, because it runs
-  // cookie_store_manager_'s destructor, and the latter is only accessed on the
-  // core thread.
+  // The destructor must be called on the service worker core thread, because it
+  // runs cookie_store_manager_'s destructor, and the latter is only accessed on
+  // the core thread.
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 }
 
@@ -77,18 +79,48 @@ void CookieStoreContext::ListenToCookieChanges(
               std::move(success_callback))));
 }
 
-void CookieStoreContext::CreateService(
-    mojo::PendingReceiver<blink::mojom::CookieStore> receiver,
-    const url::Origin& origin) {
+// static
+void CookieStoreContext::CreateServiceForFrame(
+    RenderFrameHost* render_frame_host,
+    mojo::PendingReceiver<blink::mojom::CookieStore> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(render_frame_host);
+  RenderProcessHost* render_process_host = render_frame_host->GetProcess();
+  DCHECK(render_process_host);
+
+  StoragePartitionImpl* storage_partition = static_cast<StoragePartitionImpl*>(
+      render_process_host->GetStoragePartition());
+  storage_partition->GetCookieStoreContext()->CreateServiceForTesting(
+      render_frame_host->GetLastCommittedOrigin(), std::move(receiver));
+}
+
+// static
+void CookieStoreContext::CreateServiceForWorker(
+    const ServiceWorkerVersionInfo& info,
+    mojo::PendingReceiver<blink::mojom::CookieStore> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* render_process_host =
+      RenderProcessHost::FromID(info.process_id);
+  if (render_process_host == nullptr)
+    return;
+
+  StoragePartitionImpl* storage_partition = static_cast<StoragePartitionImpl*>(
+      render_process_host->GetStoragePartition());
+  storage_partition->GetCookieStoreContext()->CreateServiceForTesting(
+      info.script_origin, std::move(receiver));
+}
+
+void CookieStoreContext::CreateServiceForTesting(
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::CookieStore> receiver) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 #if DCHECK_IS_ON()
   DCHECK(initialize_called_) << __func__ << " called before Initialize()";
 #endif  // DCHECK_IS_ON()
-
   RunOrPostTaskOnThread(
       FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
       base::BindOnce(&CookieStoreContext::CreateServiceOnCoreThread, this,
-                     std::move(receiver), origin));
+                     origin, std::move(receiver)));
 }
 
 void CookieStoreContext::InitializeOnCoreThread(
@@ -113,8 +145,8 @@ void CookieStoreContext::ListenToCookieChangesOnCoreThread(
 }
 
 void CookieStoreContext::CreateServiceOnCoreThread(
-    mojo::PendingReceiver<blink::mojom::CookieStore> receiver,
-    const url::Origin& origin) {
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::CookieStore> receiver) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(cookie_store_manager_);
 
diff --git a/chromium/content/browser/cookie_store/cookie_store_context.h b/chromium/content/browser/cookie_store/cookie_store_context.h
index 9c11fb49cb1..6c74ae05703 100644
--- a/chromium/content/browser/cookie_store/cookie_store_context.h
+++ b/chromium/content/browser/cookie_store/cookie_store_context.h
@@ -18,7 +18,9 @@
 namespace content {
 
 class CookieStoreManager;
+class RenderFrameHost;
 class ServiceWorkerContextWrapper;
+struct ServiceWorkerVersionInfo;
 
 // UI thread handle to a CookieStoreManager.
 //
@@ -64,10 +66,26 @@ class CONTENT_EXPORT CookieStoreContext
   void ListenToCookieChanges(::network::mojom::NetworkContext* network_context,
                              base::OnceCallback<void(bool)> success_callback);
 
-  // Routes a mojo receiver to the CookieStoreManager on the service worker core
-  // thread.
-  void CreateService(mojo::PendingReceiver<blink::mojom::CookieStore> receiver,
-                     const url::Origin& origin);
+  // Routes a mojo receiver to the CookieStoreManager.
+  //
+  // Production code should use the CreateServiceFor*() helpers below.
+  void CreateServiceForTesting(
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::CookieStore> receiver);
+
+  // Routes a mojo receiver from a Frame to the CookieStoreManager.
+  //
+  // Must be called on the UI thread.
+  static void CreateServiceForFrame(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingReceiver<blink::mojom::CookieStore> receiver);
+
+  // Routes a mojo receiver from a Service Worker to the CookieStoreManager.
+  //
+  // Must be called on the UI thread.
+  static void CreateServiceForWorker(
+      const ServiceWorkerVersionInfo& info,
+      mojo::PendingReceiver<blink::mojom::CookieStore> receiver);
 
  private:
   friend class base::RefCountedDeleteOnSequence<CookieStoreContext>;
@@ -84,8 +102,8 @@ class CONTENT_EXPORT CookieStoreContext
       base::OnceCallback<void(bool)> success_callback);
 
   void CreateServiceOnCoreThread(
-      mojo::PendingReceiver<blink::mojom::CookieStore> receiver,
-      const url::Origin& origin);
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::CookieStore> receiver);
 
   // Only accessed on the service worker core thread.
   std::unique_ptr<CookieStoreManager> cookie_store_manager_;
diff --git a/chromium/content/browser/cookie_store/cookie_store_manager.cc b/chromium/content/browser/cookie_store/cookie_store_manager.cc
index 2f8a925ece7..63dea530747 100644
--- a/chromium/content/browser/cookie_store/cookie_store_manager.cc
+++ b/chromium/content/browser/cookie_store/cookie_store_manager.cc
@@ -444,16 +444,14 @@ void CookieStoreManager::OnStorageWiped() {
   subscriptions_by_registration_.clear();
 }
 
-void CookieStoreManager::OnCookieChange(
-    const net::CanonicalCookie& cookie,
-    ::network::mojom::CookieChangeCause cause) {
+void CookieStoreManager::OnCookieChange(const net::CookieChangeInfo& change) {
   // Waiting for on-disk subscriptions to be loaded ensures that changes are
   // delivered to all service workers that subscribed to them in previous
   // browser sessions. Without waiting, workers might miss cookie changes.
   if (!done_loading_subscriptions_) {
     subscriptions_loaded_callbacks_.emplace_back(
         base::BindOnce(&CookieStoreManager::OnCookieChange,
-                       weak_factory_.GetWeakPtr(), cookie, cause));
+                       weak_factory_.GetWeakPtr(), change));
     return;
   }
 
@@ -464,7 +462,7 @@ void CookieStoreManager::OnCookieChange(
   //               net::CookieMonsterChangeDispatcher::DomainKey. Extract that
   //               implementation into net/cookies.cookie_util.h and call it.
   std::string url_key = net::registry_controlled_domains::GetDomainAndRegistry(
-      cookie.Domain(),
+      change.cookie.Domain(),
       net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES);
   auto it = subscriptions_by_url_key_.find(url_key);
   if (it == subscriptions_by_url_key_.end())
@@ -475,7 +473,8 @@ void CookieStoreManager::OnCookieChange(
            subscriptions.head();
        node != subscriptions.end(); node = node->next()) {
     const CookieChangeSubscription* subscription = node->value();
-    if (subscription->ShouldObserveChangeTo(cookie)) {
+    if (subscription->ShouldObserveChangeTo(change.cookie,
+                                            change.access_semantics)) {
       interested_registration_ids.insert(
           subscription->service_worker_registration_id());
     }
@@ -487,8 +486,7 @@ void CookieStoreManager::OnCookieChange(
         registration_id,
         base::BindOnce(
             [](base::WeakPtr<CookieStoreManager> manager,
-               const net::CanonicalCookie& cookie,
-               ::network::mojom::CookieChangeCause cause,
+               const net::CookieChangeInfo& change,
                blink::ServiceWorkerStatusCode find_status,
                scoped_refptr<ServiceWorkerRegistration> registration) {
               if (find_status != blink::ServiceWorkerStatusCode::kOk)
@@ -497,17 +495,15 @@ void CookieStoreManager::OnCookieChange(
               DCHECK(registration);
               if (!manager)
                 return;
-              manager->DispatchChangeEvent(std::move(registration), cookie,
-                                           cause);
+              manager->DispatchChangeEvent(std::move(registration), change);
             },
-            weak_factory_.GetWeakPtr(), cookie, cause));
+            weak_factory_.GetWeakPtr(), change));
   }
 }
 
 void CookieStoreManager::DispatchChangeEvent(
     scoped_refptr<ServiceWorkerRegistration> registration,
-    const net::CanonicalCookie& cookie,
-    ::network::mojom::CookieChangeCause cause) {
+    const net::CookieChangeInfo& change) {
   scoped_refptr<ServiceWorkerVersion> active_version =
       registration->active_version();
   if (active_version->running_status() != EmbeddedWorkerStatus::RUNNING) {
@@ -515,7 +511,7 @@ void CookieStoreManager::DispatchChangeEvent(
         ServiceWorkerMetrics::EventType::COOKIE_CHANGE,
         base::BindOnce(&CookieStoreManager::DidStartWorkerForChangeEvent,
                        weak_factory_.GetWeakPtr(), std::move(registration),
-                       cookie, cause));
+                       change));
     return;
   }
 
@@ -523,17 +519,16 @@ void CookieStoreManager::DispatchChangeEvent(
       ServiceWorkerMetrics::EventType::COOKIE_CHANGE, base::DoNothing());
 
   active_version->endpoint()->DispatchCookieChangeEvent(
-      cookie, cause, active_version->CreateSimpleEventCallback(request_id));
+      change, active_version->CreateSimpleEventCallback(request_id));
 }
 
 void CookieStoreManager::DidStartWorkerForChangeEvent(
     scoped_refptr<ServiceWorkerRegistration> registration,
-    const net::CanonicalCookie& cookie,
-    ::network::mojom::CookieChangeCause cause,
+    const net::CookieChangeInfo& change,
     blink::ServiceWorkerStatusCode start_worker_status) {
   if (start_worker_status != blink::ServiceWorkerStatusCode::kOk)
     return;
-  DispatchChangeEvent(std::move(registration), cookie, cause);
+  DispatchChangeEvent(std::move(registration), change);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/cookie_store/cookie_store_manager.h b/chromium/content/browser/cookie_store/cookie_store_manager.h
index 5d193b0406f..12fc6a5d853 100644
--- a/chromium/content/browser/cookie_store/cookie_store_manager.h
+++ b/chromium/content/browser/cookie_store/cookie_store_manager.h
@@ -96,8 +96,7 @@ class CookieStoreManager : public ServiceWorkerContextCoreObserver,
   void OnStorageWiped() override;
 
   // ::network::mojom::CookieChangeListener
-  void OnCookieChange(const net::CanonicalCookie& cookie,
-                      ::network::mojom::CookieChangeCause cause) override;
+  void OnCookieChange(const net::CookieChangeInfo& change) override;
 
  private:
   // Updates internal state with the result of loading disk subscription data.
@@ -132,20 +131,17 @@ class CookieStoreManager : public ServiceWorkerContextCoreObserver,
   //
   // Must only be called after the on-disk subscription data is successfully
   // loaded.
-  void DispatchCookieChange(const net::CanonicalCookie& cookie,
-                            ::network::mojom::CookieChangeCause cause);
+  void DispatchCookieChange(const net::CookieChangeInfo& change);
 
   // Sends a cookie change event to one service worker.
   void DispatchChangeEvent(
       scoped_refptr<ServiceWorkerRegistration> registration,
-      const net::CanonicalCookie& cookie,
-      ::network::mojom::CookieChangeCause cause);
+      const net::CookieChangeInfo& change);
 
   // Called after a service worker was started so it can get a cookie change.
   void DidStartWorkerForChangeEvent(
       scoped_refptr<ServiceWorkerRegistration> registration,
-      const net::CanonicalCookie& cookie,
-      ::network::mojom::CookieChangeCause cause,
+      const net::CookieChangeInfo& change,
       blink::ServiceWorkerStatusCode start_worker_status);
 
   // Used to efficiently implement OnRegistrationDeleted().
diff --git a/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc b/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc
index 2a5b2d9ac1b..3c2e0e4acb2 100644
--- a/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc
+++ b/chromium/content/browser/cookie_store/cookie_store_manager_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/test/bind_test_util.h"
+#include "base/test/scoped_feature_list.h"
 #include "content/browser/cookie_store/cookie_store_context.h"
 #include "content/browser/cookie_store/cookie_store_manager.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
@@ -18,6 +19,8 @@
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
+#include "net/base/features.h"
+#include "net/cookies/cookie_constants.h"
 #include "services/network/public/cpp/features.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
@@ -80,6 +83,8 @@ const char kExampleScope[] = "https://example.com/a";
 const char kExampleWorkerScript[] = "https://example.com/a/script.js";
 const char kGoogleScope[] = "https://google.com/a";
 const char kGoogleWorkerScript[] = "https://google.com/a/script.js";
+const char kLegacyScope[] = "https://legacy.com/a";
+const char kLegacyWorkerScript[] = "https://legacy.com/a/script.js";
 
 // Mocks a service worker that uses the cookieStore API.
 class CookieStoreWorkerTestHelper : public EmbeddedWorkerTestHelper {
@@ -155,10 +160,9 @@ class CookieStoreWorkerTestHelper : public EmbeddedWorkerTestHelper {
     }
 
     void DispatchCookieChangeEvent(
-        const net::CanonicalCookie& cookie,
-        ::network::mojom::CookieChangeCause cause,
+        const net::CookieChangeInfo& change,
         DispatchCookieChangeEventCallback callback) override {
-      worker_helper_->changes_.emplace_back(cookie, cause);
+      worker_helper_->changes_.emplace_back(change);
       std::move(callback).Run(
           blink::mojom::ServiceWorkerEventStatus::COMPLETED);
     }
@@ -196,11 +200,7 @@ class CookieStoreWorkerTestHelper : public EmbeddedWorkerTestHelper {
   }
 
   // The data in the CookieChangeEvents received by the worker.
-  std::vector<
-      std::pair<net::CanonicalCookie, ::network::mojom::CookieChangeCause>>&
-  changes() {
-    return changes_;
-  }
+  std::vector<net::CookieChangeInfo>& changes() { return changes_; }
 
  private:
   // Used to add cookie change subscriptions during OnInstallEvent().
@@ -213,9 +213,7 @@ class CookieStoreWorkerTestHelper : public EmbeddedWorkerTestHelper {
   base::RunLoop* quit_on_activate_ = nullptr;
 
   // Collects the changes reported to OnCookieChangeEvent().
-  std::vector<
-      std::pair<net::CanonicalCookie, ::network::mojom::CookieChangeCause>>
-      changes_;
+  std::vector<net::CookieChangeInfo> changes_;
 };
 
 }  // namespace
@@ -227,7 +225,13 @@ class CookieStoreManagerTest
       public testing::WithParamInterface<bool /* reset_context */> {
  public:
   CookieStoreManagerTest()
-      : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {}
+      : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {
+    // Enable SameSiteByDefaultCookies because the default CookieAccessSemantics
+    // setting is based on the state of this feature, and we want a consistent
+    // expected value in the tests for domains without a custom setting.
+    feature_list_.InitAndEnableFeature(
+        net::features::kSameSiteByDefaultCookies);
+  }
 
   void SetUp() override {
     // Use an on-disk service worker storage to test saving and loading.
@@ -248,8 +252,10 @@ class CookieStoreManagerTest
     // called by ResetServiceWorkerContext().
     example_service_.reset();
     google_service_.reset();
+    legacy_service_.reset();
     example_service_remote_.reset();
     google_service_remote_.reset();
+    legacy_service_remote_.reset();
     cookie_manager_.reset();
     cookie_store_context_ = nullptr;
     storage_partition_impl_.reset();
@@ -281,17 +287,35 @@ class CookieStoreManagerTest
     network_context->GetCookieManager(
         cookie_manager_.BindNewPipeAndPassReceiver());
 
-    cookie_store_context_->CreateService(
-        example_service_remote_.BindNewPipeAndPassReceiver(),
-        url::Origin::Create(GURL(kExampleScope)));
+    cookie_store_context_->CreateServiceForTesting(
+        url::Origin::Create(GURL(kExampleScope)),
+        example_service_remote_.BindNewPipeAndPassReceiver());
     example_service_ =
         std::make_unique<CookieStoreSync>(example_service_remote_.get());
 
-    cookie_store_context_->CreateService(
-        google_service_remote_.BindNewPipeAndPassReceiver(),
-        url::Origin::Create(GURL(kGoogleScope)));
+    cookie_store_context_->CreateServiceForTesting(
+        url::Origin::Create(GURL(kGoogleScope)),
+        google_service_remote_.BindNewPipeAndPassReceiver());
     google_service_ =
         std::make_unique<CookieStoreSync>(google_service_remote_.get());
+
+    cookie_store_context_->CreateServiceForTesting(
+        url::Origin::Create(GURL(kLegacyScope)),
+        legacy_service_remote_.BindNewPipeAndPassReceiver());
+    legacy_service_ =
+        std::make_unique<CookieStoreSync>(legacy_service_remote_.get());
+
+    // Set Legacy cookie access setting for legacy.com to test
+    // CookieAccessSemantics.
+    std::vector<ContentSettingPatternSource> legacy_settings;
+    legacy_settings.emplace_back(
+        ContentSettingsPattern::FromString("[*.]legacy.com"),
+        ContentSettingsPattern::FromString("*"),
+        base::Value(ContentSetting::CONTENT_SETTING_ALLOW), std::string(),
+        false /* incognito */);
+    cookie_manager_->SetContentSettingsForLegacyCookieAccess(
+        std::move(legacy_settings));
+    cookie_manager_.FlushForTesting();
   }
 
   int64_t RegisterServiceWorker(const char* scope, const char* script_url) {
@@ -323,10 +347,8 @@ class CookieStoreManagerTest
   bool SetCanonicalCookie(const net::CanonicalCookie& cookie) {
     base::RunLoop run_loop;
     bool success = false;
-    net::CookieOptions options;
-    options.set_include_httponly();
     cookie_manager_->SetCanonicalCookie(
-        cookie, "https", options,
+        cookie, "https", net::CookieOptions::MakeAllInclusive(),
         base::BindLambdaForTesting(
             [&](net::CanonicalCookie::CookieInclusionStatus service_status) {
               success = service_status.IsInclude();
@@ -346,7 +368,7 @@ class CookieStoreManagerTest
                         const char* path) {
     return SetCanonicalCookie(net::CanonicalCookie(
         name, value, domain, path, base::Time(), base::Time(), base::Time(),
-        /* secure = */ false,
+        /* secure = */ true,
         /* httponly = */ false, net::CookieSameSite::NO_RESTRICTION,
         net::COOKIE_PRIORITY_DEFAULT));
   }
@@ -357,6 +379,7 @@ class CookieStoreManagerTest
 
  protected:
   BrowserTaskEnvironment task_environment_;
+  base::test::ScopedFeatureList feature_list_;
   base::ScopedTempDir user_data_directory_;
   std::unique_ptr<CookieStoreWorkerTestHelper> worker_test_helper_;
   std::unique_ptr<StoragePartitionImpl> storage_partition_impl_;
@@ -364,8 +387,9 @@ class CookieStoreManagerTest
   mojo::Remote<::network::mojom::CookieManager> cookie_manager_;
 
   mojo::Remote<blink::mojom::CookieStore> example_service_remote_,
-      google_service_remote_;
-  std::unique_ptr<CookieStoreSync> example_service_, google_service_;
+      google_service_remote_, legacy_service_remote_;
+  std::unique_ptr<CookieStoreSync> example_service_, google_service_,
+      legacy_service_;
 };
 
 const int64_t CookieStoreManagerTest::kInvalidRegistrationId;
@@ -758,12 +782,59 @@ TEST_P(CookieStoreManagerTest, OneCookieChange) {
   task_environment_.RunUntilIdle();
 
   ASSERT_EQ(1u, worker_test_helper_->changes().size());
-  EXPECT_EQ("cookie-name", worker_test_helper_->changes()[0].first.Name());
-  EXPECT_EQ("cookie-value", worker_test_helper_->changes()[0].first.Value());
-  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].first.Domain());
-  EXPECT_EQ("/", worker_test_helper_->changes()[0].first.Path());
-  EXPECT_EQ(::network::mojom::CookieChangeCause::INSERTED,
-            worker_test_helper_->changes()[0].second);
+  EXPECT_EQ("cookie-name", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // example.com does not have a custom access semantics setting, so it defaults
+  // to NONLEGACY, because the FeatureList has SameSiteByDefaultCookies enabled.
+  EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
+}
+
+// Same as above except this tests that the LEGACY access semantics for
+// legacy.com cookies is correctly reflected in the change info.
+TEST_P(CookieStoreManagerTest, OneCookieChangeLegacy) {
+  std::vector<CookieStoreSync::Subscriptions> batches;
+  batches.emplace_back();
+
+  CookieStoreSync::Subscriptions& subscriptions = batches.back();
+  subscriptions.emplace_back(blink::mojom::CookieChangeSubscription::New());
+  subscriptions.back()->name = "";
+  subscriptions.back()->match_type =
+      ::network::mojom::CookieMatchType::STARTS_WITH;
+  subscriptions.back()->url = GURL(kLegacyScope);
+
+  worker_test_helper_->SetOnInstallSubscriptions(std::move(batches),
+                                                 legacy_service_remote_.get());
+  int64_t registration_id =
+      RegisterServiceWorker(kLegacyScope, kLegacyWorkerScript);
+  ASSERT_NE(registration_id, kInvalidRegistrationId);
+
+  base::Optional<CookieStoreSync::Subscriptions> all_subscriptions_opt =
+      legacy_service_->GetSubscriptions(registration_id);
+  ASSERT_TRUE(all_subscriptions_opt.has_value());
+  ASSERT_EQ(1u, all_subscriptions_opt.value().size());
+
+  if (reset_context_during_test())
+    ResetServiceWorkerContext();
+
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name", "cookie-value", "legacy.com", "/"));
+  task_environment_.RunUntilIdle();
+
+  ASSERT_EQ(1u, worker_test_helper_->changes().size());
+  EXPECT_EQ("cookie-name", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("legacy.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // legacy.com has a custom Legacy setting.
+  EXPECT_EQ(net::CookieAccessSemantics::LEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
 }
 
 TEST_P(CookieStoreManagerTest, CookieChangeNameStartsWith) {
@@ -802,12 +873,16 @@ TEST_P(CookieStoreManagerTest, CookieChangeNameStartsWith) {
   task_environment_.RunUntilIdle();
 
   ASSERT_EQ(1u, worker_test_helper_->changes().size());
-  EXPECT_EQ("cookie-name-2", worker_test_helper_->changes()[0].first.Name());
-  EXPECT_EQ("cookie-value-2", worker_test_helper_->changes()[0].first.Value());
-  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].first.Domain());
-  EXPECT_EQ("/", worker_test_helper_->changes()[0].first.Path());
-  EXPECT_EQ(::network::mojom::CookieChangeCause::INSERTED,
-            worker_test_helper_->changes()[0].second);
+  EXPECT_EQ("cookie-name-2", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-2", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // example.com does not have a custom access semantics setting, so it defaults
+  // to NONLEGACY, because the FeatureList has SameSiteByDefaultCookies enabled.
+  EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
 
   worker_test_helper_->changes().clear();
   ASSERT_TRUE(SetSessionCookie("cookie-name-22", "cookie-value-22",
@@ -815,12 +890,83 @@ TEST_P(CookieStoreManagerTest, CookieChangeNameStartsWith) {
   task_environment_.RunUntilIdle();
 
   ASSERT_EQ(1u, worker_test_helper_->changes().size());
-  EXPECT_EQ("cookie-name-22", worker_test_helper_->changes()[0].first.Name());
-  EXPECT_EQ("cookie-value-22", worker_test_helper_->changes()[0].first.Value());
-  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].first.Domain());
-  EXPECT_EQ("/", worker_test_helper_->changes()[0].first.Path());
-  EXPECT_EQ(::network::mojom::CookieChangeCause::INSERTED,
-            worker_test_helper_->changes()[0].second);
+  EXPECT_EQ("cookie-name-22", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-22",
+            worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // example.com does not have a custom access semantics setting, so it defaults
+  // to NONLEGACY, because the FeatureList has SameSiteByDefaultCookies enabled.
+  EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
+}
+
+// Same as above except this tests that the LEGACY access semantics for
+// legacy.com cookies is correctly reflected in the change info.
+TEST_P(CookieStoreManagerTest, CookieChangeNameStartsWithLegacy) {
+  std::vector<CookieStoreSync::Subscriptions> batches;
+  batches.emplace_back();
+
+  CookieStoreSync::Subscriptions& subscriptions = batches.back();
+  subscriptions.emplace_back(blink::mojom::CookieChangeSubscription::New());
+  subscriptions.back()->name = "cookie-name-2";
+  subscriptions.back()->match_type =
+      ::network::mojom::CookieMatchType::STARTS_WITH;
+  subscriptions.back()->url = GURL(kLegacyScope);
+
+  worker_test_helper_->SetOnInstallSubscriptions(std::move(batches),
+                                                 legacy_service_remote_.get());
+  int64_t registration_id =
+      RegisterServiceWorker(kLegacyScope, kLegacyWorkerScript);
+  ASSERT_NE(registration_id, kInvalidRegistrationId);
+
+  base::Optional<CookieStoreSync::Subscriptions> all_subscriptions_opt =
+      legacy_service_->GetSubscriptions(registration_id);
+  ASSERT_TRUE(all_subscriptions_opt.has_value());
+  ASSERT_EQ(1u, all_subscriptions_opt.value().size());
+
+  if (reset_context_during_test())
+    ResetServiceWorkerContext();
+
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name-1", "cookie-value-1", "legacy.com", "/"));
+  task_environment_.RunUntilIdle();
+  EXPECT_EQ(0u, worker_test_helper_->changes().size());
+
+  worker_test_helper_->changes().clear();
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name-2", "cookie-value-2", "legacy.com", "/"));
+  task_environment_.RunUntilIdle();
+
+  ASSERT_EQ(1u, worker_test_helper_->changes().size());
+  EXPECT_EQ("cookie-name-2", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-2", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("legacy.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // legacy.com has a custom Legacy setting.
+  EXPECT_EQ(net::CookieAccessSemantics::LEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
+
+  worker_test_helper_->changes().clear();
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name-22", "cookie-value-22", "legacy.com", "/"));
+  task_environment_.RunUntilIdle();
+
+  ASSERT_EQ(1u, worker_test_helper_->changes().size());
+  EXPECT_EQ("cookie-name-22", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-22",
+            worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("legacy.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // legacy.com has a custom Legacy setting.
+  EXPECT_EQ(net::CookieAccessSemantics::LEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
 }
 
 TEST_P(CookieStoreManagerTest, CookieChangeUrl) {
@@ -865,12 +1011,16 @@ TEST_P(CookieStoreManagerTest, CookieChangeUrl) {
   task_environment_.RunUntilIdle();
 
   ASSERT_EQ(1u, worker_test_helper_->changes().size());
-  EXPECT_EQ("cookie-name-3", worker_test_helper_->changes()[0].first.Name());
-  EXPECT_EQ("cookie-value-3", worker_test_helper_->changes()[0].first.Value());
-  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].first.Domain());
-  EXPECT_EQ("/", worker_test_helper_->changes()[0].first.Path());
-  EXPECT_EQ(::network::mojom::CookieChangeCause::INSERTED,
-            worker_test_helper_->changes()[0].second);
+  EXPECT_EQ("cookie-name-3", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-3", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // example.com does not have a custom access semantics setting, so it defaults
+  // to NONLEGACY, because the FeatureList has SameSiteByDefaultCookies enabled.
+  EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
 
   worker_test_helper_->changes().clear();
   ASSERT_TRUE(
@@ -878,12 +1028,87 @@ TEST_P(CookieStoreManagerTest, CookieChangeUrl) {
   task_environment_.RunUntilIdle();
 
   ASSERT_EQ(1u, worker_test_helper_->changes().size());
-  EXPECT_EQ("cookie-name-4", worker_test_helper_->changes()[0].first.Name());
-  EXPECT_EQ("cookie-value-4", worker_test_helper_->changes()[0].first.Value());
-  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].first.Domain());
-  EXPECT_EQ("/a", worker_test_helper_->changes()[0].first.Path());
-  EXPECT_EQ(::network::mojom::CookieChangeCause::INSERTED,
-            worker_test_helper_->changes()[0].second);
+  EXPECT_EQ("cookie-name-4", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-4", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/a", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // example.com does not have a custom access semantics setting, so it defaults
+  // to NONLEGACY, because the FeatureList has SameSiteByDefaultCookies enabled.
+  EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
+}
+
+// Same as above except this tests that the LEGACY access semantics for
+// legacy.com cookies is correctly reflected in the change info.
+TEST_P(CookieStoreManagerTest, CookieChangeUrlLegacy) {
+  std::vector<CookieStoreSync::Subscriptions> batches;
+  batches.emplace_back();
+
+  CookieStoreSync::Subscriptions& subscriptions = batches.back();
+  subscriptions.emplace_back(blink::mojom::CookieChangeSubscription::New());
+  subscriptions.back()->name = "";
+  subscriptions.back()->match_type =
+      ::network::mojom::CookieMatchType::STARTS_WITH;
+  subscriptions.back()->url = GURL(kLegacyScope);
+
+  worker_test_helper_->SetOnInstallSubscriptions(std::move(batches),
+                                                 legacy_service_remote_.get());
+  int64_t registration_id =
+      RegisterServiceWorker(kLegacyScope, kLegacyWorkerScript);
+  ASSERT_NE(registration_id, kInvalidRegistrationId);
+
+  base::Optional<CookieStoreSync::Subscriptions> all_subscriptions_opt =
+      legacy_service_->GetSubscriptions(registration_id);
+  ASSERT_TRUE(all_subscriptions_opt.has_value());
+  ASSERT_EQ(1u, all_subscriptions_opt.value().size());
+
+  if (reset_context_during_test())
+    ResetServiceWorkerContext();
+
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name-1", "cookie-value-1", "google.com", "/"));
+  task_environment_.RunUntilIdle();
+  ASSERT_EQ(0u, worker_test_helper_->changes().size());
+
+  worker_test_helper_->changes().clear();
+  ASSERT_TRUE(SetSessionCookie("cookie-name-2", "cookie-value-2", "legacy.com",
+                               "/a/subpath"));
+  task_environment_.RunUntilIdle();
+  EXPECT_EQ(0u, worker_test_helper_->changes().size());
+
+  worker_test_helper_->changes().clear();
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name-3", "cookie-value-3", "legacy.com", "/"));
+  task_environment_.RunUntilIdle();
+
+  ASSERT_EQ(1u, worker_test_helper_->changes().size());
+  EXPECT_EQ("cookie-name-3", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-3", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("legacy.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // legacy.com has a custom Legacy setting.
+  EXPECT_EQ(net::CookieAccessSemantics::LEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
+
+  worker_test_helper_->changes().clear();
+  ASSERT_TRUE(
+      SetSessionCookie("cookie-name-4", "cookie-value-4", "legacy.com", "/a"));
+  task_environment_.RunUntilIdle();
+
+  ASSERT_EQ(1u, worker_test_helper_->changes().size());
+  EXPECT_EQ("cookie-name-4", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-4", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("legacy.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/a", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // legacy.com has a custom Legacy setting.
+  EXPECT_EQ(net::CookieAccessSemantics::LEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
 }
 
 TEST_P(CookieStoreManagerTest, HttpOnlyCookieChange) {
@@ -930,12 +1155,73 @@ TEST_P(CookieStoreManagerTest, HttpOnlyCookieChange) {
   task_environment_.RunUntilIdle();
 
   ASSERT_EQ(1u, worker_test_helper_->changes().size());
-  EXPECT_EQ("cookie-name-2", worker_test_helper_->changes()[0].first.Name());
-  EXPECT_EQ("cookie-value-2", worker_test_helper_->changes()[0].first.Value());
-  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].first.Domain());
-  EXPECT_EQ("/", worker_test_helper_->changes()[0].first.Path());
-  EXPECT_EQ(::network::mojom::CookieChangeCause::INSERTED,
-            worker_test_helper_->changes()[0].second);
+  EXPECT_EQ("cookie-name-2", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-2", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("example.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // example.com does not have a custom access semantics setting, so it defaults
+  // to NONLEGACY, because the FeatureList has SameSiteByDefaultCookies enabled.
+  EXPECT_EQ(net::CookieAccessSemantics::NONLEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
+}
+
+// Same as above except this tests that the LEGACY access semantics for
+// legacy.com cookies is correctly reflected in the change info.
+TEST_P(CookieStoreManagerTest, HttpOnlyCookieChangeLegacy) {
+  std::vector<CookieStoreSync::Subscriptions> batches;
+  batches.emplace_back();
+
+  CookieStoreSync::Subscriptions& subscriptions = batches.back();
+  subscriptions.emplace_back(blink::mojom::CookieChangeSubscription::New());
+  subscriptions.back()->name = "";
+  subscriptions.back()->match_type =
+      ::network::mojom::CookieMatchType::STARTS_WITH;
+  subscriptions.back()->url = GURL(kLegacyScope);
+
+  worker_test_helper_->SetOnInstallSubscriptions(std::move(batches),
+                                                 legacy_service_remote_.get());
+  int64_t registration_id =
+      RegisterServiceWorker(kLegacyScope, kLegacyWorkerScript);
+  ASSERT_NE(registration_id, kInvalidRegistrationId);
+
+  base::Optional<CookieStoreSync::Subscriptions> all_subscriptions_opt =
+      legacy_service_->GetSubscriptions(registration_id);
+  ASSERT_TRUE(all_subscriptions_opt.has_value());
+  ASSERT_EQ(1u, all_subscriptions_opt.value().size());
+
+  if (reset_context_during_test())
+    ResetServiceWorkerContext();
+
+  ASSERT_TRUE(SetCanonicalCookie(net::CanonicalCookie(
+      "cookie-name-1", "cookie-value-1", "legacy.com", "/", base::Time(),
+      base::Time(), base::Time(),
+      /* secure = */ false,
+      /* httponly = */ true, net::CookieSameSite::NO_RESTRICTION,
+      net::COOKIE_PRIORITY_DEFAULT)));
+  task_environment_.RunUntilIdle();
+  EXPECT_EQ(0u, worker_test_helper_->changes().size());
+
+  worker_test_helper_->changes().clear();
+  ASSERT_TRUE(SetCanonicalCookie(net::CanonicalCookie(
+      "cookie-name-2", "cookie-value-2", "legacy.com", "/", base::Time(),
+      base::Time(), base::Time(),
+      /* secure = */ false,
+      /* httponly = */ false, net::CookieSameSite::NO_RESTRICTION,
+      net::COOKIE_PRIORITY_DEFAULT)));
+  task_environment_.RunUntilIdle();
+
+  ASSERT_EQ(1u, worker_test_helper_->changes().size());
+  EXPECT_EQ("cookie-name-2", worker_test_helper_->changes()[0].cookie.Name());
+  EXPECT_EQ("cookie-value-2", worker_test_helper_->changes()[0].cookie.Value());
+  EXPECT_EQ("legacy.com", worker_test_helper_->changes()[0].cookie.Domain());
+  EXPECT_EQ("/", worker_test_helper_->changes()[0].cookie.Path());
+  EXPECT_EQ(net::CookieChangeCause::INSERTED,
+            worker_test_helper_->changes()[0].cause);
+  // legacy.com has a custom Legacy setting.
+  EXPECT_EQ(net::CookieAccessSemantics::LEGACY,
+            worker_test_helper_->changes()[0].access_semantics);
 }
 
 TEST_P(CookieStoreManagerTest, GetSubscriptionsFromWrongOrigin) {
@@ -968,7 +1254,7 @@ TEST_P(CookieStoreManagerTest, GetSubscriptionsFromWrongOrigin) {
   EXPECT_FALSE(wrong_subscriptions_opt.has_value());
 }
 
-INSTANTIATE_TEST_SUITE_P(CookieStoreManagerTest,
+INSTANTIATE_TEST_SUITE_P(,
                          CookieStoreManagerTest,
                          testing::Bool() /* reset_storage_during_test */);
 
diff --git a/chromium/content/browser/data_url_loader_factory.cc b/chromium/content/browser/data_url_loader_factory.cc
index 906ae87aa2c..79f80147432 100644
--- a/chromium/content/browser/data_url_loader_factory.cc
+++ b/chromium/content/browser/data_url_loader_factory.cc
@@ -100,8 +100,8 @@ void DataURLLoaderFactory::CreateLoaderAndStart(
 }
 
 void DataURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest loader) {
-  bindings_.AddBinding(this, std::move(loader));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) {
+  receivers_.Add(this, std::move(loader));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/data_url_loader_factory.h b/chromium/content/browser/data_url_loader_factory.h
index c2a6d7f0e4e..2c48848f913 100644
--- a/chromium/content/browser/data_url_loader_factory.h
+++ b/chromium/content/browser/data_url_loader_factory.h
@@ -6,7 +6,8 @@
 #define CONTENT_BROWSER_DATA_URL_LOADER_FACTORY_H_
 
 #include "base/macros.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace content {
@@ -33,11 +34,12 @@ class DataURLLoaderFactory : public network::mojom::URLLoaderFactory {
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest loader) override;
+  void Clone(
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) override;
 
   GURL url_;
 
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   DISALLOW_COPY_AND_ASSIGN(DataURLLoaderFactory);
 };
diff --git a/chromium/content/browser/database_browsertest.cc b/chromium/content/browser/database_browsertest.cc
index 688dc1911aa..c29c1e8e72d 100644
--- a/chromium/content/browser/database_browsertest.cc
+++ b/chromium/content/browser/database_browsertest.cc
@@ -31,7 +31,7 @@ class DatabaseTest : public ContentBrowserTest {
   }
 
   void Navigate(Shell* shell) {
-    NavigateToURL(shell, GetTestUrl("", "simple_database.html"));
+    EXPECT_TRUE(NavigateToURL(shell, GetTestUrl("", "simple_database.html")));
   }
 
   void CreateTable(Shell* shell) {
diff --git a/chromium/content/browser/device_sensors/device_sensor_browsertest.cc b/chromium/content/browser/device_sensors/device_sensor_browsertest.cc
index f3d12aa78df..12534d1a022 100644
--- a/chromium/content/browser/device_sensors/device_sensor_browsertest.cc
+++ b/chromium/content/browser/device_sensors/device_sensor_browsertest.cc
@@ -24,8 +24,7 @@
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_javascript_dialog_manager.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/buffer.h"
 #include "net/dns/mock_host_resolver.h"
 #include "services/device/public/cpp/generic_sensor/platform_sensor_configuration.h"
@@ -104,8 +103,9 @@ class DeviceSensorBrowserTest : public ContentBrowserTest {
   std::unique_ptr<net::EmbeddedTestServer> https_embedded_test_server_;
 
  private:
-  void BindSensorProvider(device::mojom::SensorProviderRequest request) {
-    sensor_provider_->Bind(std::move(request));
+  void BindSensorProvider(
+      mojo::PendingReceiver<device::mojom::SensorProvider> receiver) {
+    sensor_provider_->Bind(std::move(receiver));
   }
 };
 
diff --git a/chromium/content/browser/devtools/OWNERS b/chromium/content/browser/devtools/OWNERS
index 6f34e236d0a..914bb54e218 100644
--- a/chromium/content/browser/devtools/OWNERS
+++ b/chromium/content/browser/devtools/OWNERS
@@ -1,5 +1,6 @@
 caseq@chromium.org
 alph@chromium.org
+yangguo@chromium.org
 
 per-file *background_service*=rayankans@chromium.org
 
diff --git a/chromium/content/browser/devtools/devtools_background_services_context_impl.cc b/chromium/content/browser/devtools/devtools_background_services_context_impl.cc
index 2b12d6d92e9..8d979290e13 100644
--- a/chromium/content/browser/devtools/devtools_background_services_context_impl.cc
+++ b/chromium/content/browser/devtools/devtools_background_services_context_impl.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/service_worker_context.h"
+#include "content/public/common/content_client.h"
 #include "url/origin.h"
 
 namespace content {
diff --git a/chromium/content/browser/devtools/devtools_background_services_context_impl_unittest.cc b/chromium/content/browser/devtools/devtools_background_services_context_impl_unittest.cc
index 5a5927997de..b9d013d0817 100644
--- a/chromium/content/browser/devtools/devtools_background_services_context_impl_unittest.cc
+++ b/chromium/content/browser/devtools/devtools_background_services_context_impl_unittest.cc
@@ -13,6 +13,7 @@
 #include "content/browser/devtools/devtools_background_services.pb.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
 #include "testing/gmock/include/gmock/gmock.h"
diff --git a/chromium/content/browser/devtools/devtools_frame_metadata.cc b/chromium/content/browser/devtools/devtools_frame_metadata.cc
deleted file mode 100644
index bf07a5e8dc9..00000000000
--- a/chromium/content/browser/devtools/devtools_frame_metadata.cc
+++ /dev/null
@@ -1,30 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/devtools/devtools_frame_metadata.h"
-
-#include "build/build_config.h"
-#include "cc/trees/render_frame_metadata.h"
-
-namespace content {
-
-#if defined(OS_ANDROID)
-DevToolsFrameMetadata::DevToolsFrameMetadata(
-    const cc::RenderFrameMetadata& metadata)
-    : device_scale_factor(metadata.device_scale_factor),
-      page_scale_factor(metadata.page_scale_factor),
-      root_scroll_offset(
-          metadata.root_scroll_offset.value_or(gfx::Vector2dF())),
-      top_controls_height(metadata.top_controls_height),
-      top_controls_shown_ratio(metadata.top_controls_shown_ratio),
-      scrollable_viewport_size(metadata.scrollable_viewport_size) {}
-#else
-// On non-Android, this class should never be created.
-DevToolsFrameMetadata::DevToolsFrameMetadata(
-    const cc::RenderFrameMetadata& metadata) {
-  NOTREACHED();
-}
-#endif  // defined(OS_ANDROID)
-
-}  // namespace content
diff --git a/chromium/content/browser/devtools/devtools_frame_metadata.h b/chromium/content/browser/devtools/devtools_frame_metadata.h
deleted file mode 100644
index f9922b0040f..00000000000
--- a/chromium/content/browser/devtools/devtools_frame_metadata.h
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_FRAME_METADATA_H_
-#define CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_FRAME_METADATA_H_
-
-#include "ui/gfx/geometry/size_f.h"
-#include "ui/gfx/geometry/vector2d_f.h"
-
-namespace cc {
-class RenderFrameMetadata;
-}
-
-namespace content {
-
-// A subset of the information in RenderFrameMetadata used in DevTools with
-// Android WebView.
-// TODO(crbug.com/985009): Replace with RenderFrameMetadata.
-struct DevToolsFrameMetadata {
- public:
-  explicit DevToolsFrameMetadata(const cc::RenderFrameMetadata& metadata);
-
-  float device_scale_factor;
-  float page_scale_factor;
-  gfx::Vector2dF root_scroll_offset;
-  float top_controls_height;
-  float top_controls_shown_ratio;
-  gfx::SizeF scrollable_viewport_size;
-};
-
-}  // namespace content
-
-#endif  //  CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_FRAME_METADATA_H_
diff --git a/chromium/content/browser/devtools/devtools_frame_trace_recorder.cc b/chromium/content/browser/devtools/devtools_frame_trace_recorder.cc
index 3a9fca06bd3..be04f844535 100644
--- a/chromium/content/browser/devtools/devtools_frame_trace_recorder.cc
+++ b/chromium/content/browser/devtools/devtools_frame_trace_recorder.cc
@@ -13,7 +13,8 @@
 #include "base/bind.h"
 #include "base/memory/ref_counted.h"
 #include "base/trace_event/trace_event_impl.h"
-#include "content/browser/devtools/devtools_frame_metadata.h"
+#include "build/build_config.h"
+#include "cc/trees/render_frame_metadata.h"
 #include "content/browser/devtools/devtools_traceable_screenshot.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
@@ -31,7 +32,7 @@ void FrameCaptured(base::TimeTicks timestamp, const SkBitmap& bitmap) {
   if (bitmap.drawsNothing())
     return;
   if (DevToolsTraceableScreenshot::GetNumberOfInstances() >=
-      DevToolsFrameTraceRecorder::kMaximumNumberOfScreenshots) {
+      DevToolsTraceableScreenshot::kMaximumNumberOfScreenshots) {
     return;
   }
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID_AND_TIMESTAMP(
@@ -42,13 +43,13 @@ void FrameCaptured(base::TimeTicks timestamp, const SkBitmap& bitmap) {
 }
 
 void CaptureFrame(RenderFrameHostImpl* host,
-                  const DevToolsFrameMetadata& metadata) {
+                  const cc::RenderFrameMetadata& metadata) {
   RenderWidgetHostViewBase* view =
       static_cast<RenderWidgetHostViewBase*>(host->GetView());
   if (!view)
     return;
   if (DevToolsTraceableScreenshot::GetNumberOfInstances() >=
-      DevToolsFrameTraceRecorder::kMaximumNumberOfScreenshots) {
+      DevToolsTraceableScreenshot::kMaximumNumberOfScreenshots) {
     return;
   }
 
@@ -82,7 +83,7 @@ DevToolsFrameTraceRecorder::~DevToolsFrameTraceRecorder() { }
 
 void DevToolsFrameTraceRecorder::OnSynchronousSwapCompositorFrame(
     RenderFrameHostImpl* host,
-    const DevToolsFrameMetadata& metadata) {
+    const cc::RenderFrameMetadata& metadata) {
   if (!host || !ScreenshotCategoryEnabled()) {
     return;
   }
diff --git a/chromium/content/browser/devtools/devtools_frame_trace_recorder.h b/chromium/content/browser/devtools/devtools_frame_trace_recorder.h
index 0b43c995254..968a3c9a69d 100644
--- a/chromium/content/browser/devtools/devtools_frame_trace_recorder.h
+++ b/chromium/content/browser/devtools/devtools_frame_trace_recorder.h
@@ -9,20 +9,22 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 
+namespace cc {
+class RenderFrameMetadata;
+}
+
 namespace content {
 
 class RenderFrameHostImpl;
-struct DevToolsFrameMetadata;
 
 class DevToolsFrameTraceRecorder {
  public:
   DevToolsFrameTraceRecorder();
   ~DevToolsFrameTraceRecorder();
 
-  void OnSynchronousSwapCompositorFrame(RenderFrameHostImpl* host,
-                                        const DevToolsFrameMetadata& metadata);
-
-  static constexpr int kMaximumNumberOfScreenshots = 450;
+  void OnSynchronousSwapCompositorFrame(
+      RenderFrameHostImpl* host,
+      const cc::RenderFrameMetadata& metadata);
 
  private:
   DISALLOW_COPY_AND_ASSIGN(DevToolsFrameTraceRecorder);
diff --git a/chromium/content/browser/devtools/devtools_http_handler_unittest.cc b/chromium/content/browser/devtools/devtools_http_handler_unittest.cc
index 833a6400886..b7e81e863c0 100644
--- a/chromium/content/browser/devtools/devtools_http_handler_unittest.cc
+++ b/chromium/content/browser/devtools/devtools_http_handler_unittest.cc
@@ -25,6 +25,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/devtools_manager_delegate.h"
 #include "content/public/browser/devtools_socket_factory.h"
+#include "content/public/common/content_client.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
 #include "net/base/completion_once_callback.h"
diff --git a/chromium/content/browser/devtools/devtools_instrumentation.cc b/chromium/content/browser/devtools/devtools_instrumentation.cc
index 9eab8df7348..4ed8ea4fe2e 100644
--- a/chromium/content/browser/devtools/devtools_instrumentation.cc
+++ b/chromium/content/browser/devtools/devtools_instrumentation.cc
@@ -4,6 +4,7 @@
 #include "content/browser/devtools/devtools_instrumentation.h"
 
 #include "content/browser/devtools/browser_devtools_agent_host.h"
+#include "content/browser/devtools/devtools_url_loader_interceptor.h"
 #include "content/browser/devtools/protocol/emulation_handler.h"
 #include "content/browser/devtools/protocol/fetch_handler.h"
 #include "content/browser/devtools/protocol/network_handler.h"
@@ -13,7 +14,6 @@
 #include "content/browser/devtools/render_frame_devtools_agent_host.h"
 #include "content/browser/devtools/service_worker_devtools_agent_host.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/web_package/signed_exchange_envelope.h"
@@ -51,6 +51,22 @@ void DispatchToAgents(int frame_tree_node_id,
     DispatchToAgents(ftn, method, std::forward<Args>(args)...);
 }
 
+template <typename Handler, typename... MethodArgs, typename... Args>
+void DispatchToWorkerAgents(int32_t worker_process_id,
+                            int32_t worker_route_id,
+                            void (Handler::*method)(MethodArgs...),
+                            Args&&... args) {
+  ServiceWorkerDevToolsAgentHost* service_worker_host =
+      ServiceWorkerDevToolsManager::GetInstance()
+          ->GetDevToolsAgentHostForWorker(worker_process_id, worker_route_id);
+  if (!service_worker_host)
+    return;
+  for (auto* h : Handler::ForAgentHost(service_worker_host))
+    (h->*method)(std::forward<Args>(args)...);
+
+  // TODO(crbug.com/1004979): Look for shared worker hosts here as well.
+}
+
 FrameTreeNode* GetFtnForNetworkRequest(int process_id, int routing_id) {
   // Navigation requests start in the browser, before process_id is assigned, so
   // the id is set to 0. In these situations, the routing_id is the frame tree
@@ -130,16 +146,34 @@ void OnSignedExchangeReceived(
                    envelope, certificate, ssl_info, errors);
 }
 
+namespace inspector_will_send_navigation_request_event {
+std::unique_ptr<base::trace_event::TracedValue> Data(
+    const base::UnguessableToken& request_id) {
+  auto value = std::make_unique<base::trace_event::TracedValue>();
+  value->SetString("requestId", request_id.ToString());
+  return value;
+}
+}  // namespace inspector_will_send_navigation_request_event
+
 void OnSignedExchangeCertificateRequestSent(
     FrameTreeNode* frame_tree_node,
     const base::UnguessableToken& request_id,
     const base::UnguessableToken& loader_id,
     const network::ResourceRequest& request,
     const GURL& signed_exchange_url) {
+  // Make sure both back-ends yield the same timestamp.
+  auto timestamp = base::TimeTicks::Now();
   DispatchToAgents(frame_tree_node, &protocol::NetworkHandler::RequestSent,
                    request_id.ToString(), loader_id.ToString(), request,
                    protocol::Network::Initiator::TypeEnum::SignedExchange,
-                   signed_exchange_url);
+                   signed_exchange_url, timestamp);
+
+  auto value = std::make_unique<base::trace_event::TracedValue>();
+  value->SetString("requestId", request_id.ToString());
+  TRACE_EVENT_INSTANT_WITH_TIMESTAMP1(
+      "devtools.timeline", "ResourceWillSendRequest", TRACE_EVENT_SCOPE_PROCESS,
+      timestamp, "data",
+      inspector_will_send_navigation_request_event::Data(request_id));
 }
 
 void OnSignedExchangeCertificateResponseReceived(
@@ -164,9 +198,10 @@ void OnSignedExchangeCertificateRequestCompleted(
 }
 
 std::vector<std::unique_ptr<NavigationThrottle>> CreateNavigationThrottles(
-    NavigationHandleImpl* navigation_handle) {
+    NavigationHandle* navigation_handle) {
   std::vector<std::unique_ptr<NavigationThrottle>> result;
-  FrameTreeNode* frame_tree_node = navigation_handle->frame_tree_node();
+  FrameTreeNode* frame_tree_node =
+      NavigationRequest::From(navigation_handle)->frame_tree_node();
 
   DevToolsAgentHostImpl* agent_host =
       RenderFrameDevToolsAgentHost::GetFor(frame_tree_node);
@@ -180,9 +215,12 @@ std::vector<std::unique_ptr<NavigationThrottle>> CreateNavigationThrottles(
                    ->GetFrameTree()
                    ->root();
     } else {
-      return result;
+      parent = frame_tree_node->original_opener();
     }
   }
+  if (!parent)
+    return result;
+
   agent_host = RenderFrameDevToolsAgentHost::GetFor(parent);
   if (agent_host) {
     for (auto* target_handler :
@@ -356,9 +394,16 @@ bool WillCreateURLLoaderFactory(
 
 void OnNavigationRequestWillBeSent(
     const NavigationRequest& navigation_request) {
+  // Make sure both back-ends yield the same timestamp.
+  auto timestamp = base::TimeTicks::Now();
   DispatchToAgents(navigation_request.frame_tree_node(),
                    &protocol::NetworkHandler::NavigationRequestWillBeSent,
-                   navigation_request);
+                   navigation_request, timestamp);
+  TRACE_EVENT_INSTANT_WITH_TIMESTAMP1(
+      "devtools.timeline", "ResourceWillSendRequest", TRACE_EVENT_SCOPE_PROCESS,
+      timestamp, "data",
+      inspector_will_send_navigation_request_event::Data(
+          navigation_request.devtools_navigation_token()));
 }
 
 // Notify the provided agent host of a certificate error. Returns true if one of
@@ -422,11 +467,22 @@ void OnRequestWillBeSentExtraInfo(
     const net::CookieStatusList& request_cookie_list,
     const std::vector<network::mojom::HttpRawHeaderPairPtr>& request_headers) {
   FrameTreeNode* ftn = GetFtnForNetworkRequest(process_id, routing_id);
-  if (!ftn)
+  if (ftn) {
+    DispatchToAgents(ftn,
+                     &protocol::NetworkHandler::OnRequestWillBeSentExtraInfo,
+                     devtools_request_id, request_cookie_list, request_headers);
     return;
+  }
 
-  DispatchToAgents(ftn, &protocol::NetworkHandler::OnRequestWillBeSentExtraInfo,
-                   devtools_request_id, request_cookie_list, request_headers);
+  // In the case of service worker network requests, there is no
+  // FrameTreeNode to use so instead we use the "routing_id" created with the
+  // worker and sent to the renderer process to send as the render_frame_id in
+  // the renderer's network::ResourceRequest which gets plubmed to here as
+  // routing_id.
+  DispatchToWorkerAgents(
+      process_id, routing_id,
+      &protocol::NetworkHandler::OnRequestWillBeSentExtraInfo,
+      devtools_request_id, request_cookie_list, request_headers);
 }
 
 void OnResponseReceivedExtraInfo(
@@ -437,12 +493,19 @@ void OnResponseReceivedExtraInfo(
     const std::vector<network::mojom::HttpRawHeaderPairPtr>& response_headers,
     const base::Optional<std::string>& response_headers_text) {
   FrameTreeNode* ftn = GetFtnForNetworkRequest(process_id, routing_id);
-  if (!ftn)
+  if (ftn) {
+    DispatchToAgents(ftn,
+                     &protocol::NetworkHandler::OnResponseReceivedExtraInfo,
+                     devtools_request_id, response_cookie_list,
+                     response_headers, response_headers_text);
     return;
+  }
 
-  DispatchToAgents(ftn, &protocol::NetworkHandler::OnResponseReceivedExtraInfo,
-                   devtools_request_id, response_cookie_list, response_headers,
-                   response_headers_text);
+  // See comment on DispatchToWorkerAgents in OnRequestWillBeSentExtraInfo.
+  DispatchToWorkerAgents(process_id, routing_id,
+                         &protocol::NetworkHandler::OnResponseReceivedExtraInfo,
+                         devtools_request_id, response_cookie_list,
+                         response_headers, response_headers_text);
 }
 
 }  // namespace devtools_instrumentation
diff --git a/chromium/content/browser/devtools/devtools_instrumentation.h b/chromium/content/browser/devtools/devtools_instrumentation.h
index 2207045d28b..0825bf79f7d 100644
--- a/chromium/content/browser/devtools/devtools_instrumentation.h
+++ b/chromium/content/browser/devtools/devtools_instrumentation.h
@@ -37,7 +37,7 @@ namespace content {
 class SignedExchangeEnvelope;
 class FrameTreeNode;
 class FileSelectListener;
-class NavigationHandleImpl;
+class NavigationHandle;
 class NavigationRequest;
 class NavigationThrottle;
 class RenderFrameHostImpl;
@@ -129,7 +129,7 @@ void OnResponseReceivedExtraInfo(
     const base::Optional<std::string>& response_headers_text);
 
 std::vector<std::unique_ptr<NavigationThrottle>> CreateNavigationThrottles(
-    NavigationHandleImpl* navigation_handle);
+    NavigationHandle* navigation_handle);
 
 // Asks any interested agents to handle the given certificate error. Returns
 // |true| if the error was handled, |false| otherwise.
diff --git a/chromium/content/browser/devtools/devtools_manager.cc b/chromium/content/browser/devtools/devtools_manager.cc
index 49bb469207f..776022c5666 100644
--- a/chromium/content/browser/devtools/devtools_manager.cc
+++ b/chromium/content/browser/devtools/devtools_manager.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/devtools_socket_factory.h"
+#include "content/public/common/content_client.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/devtools/devtools_network_interceptor.cc b/chromium/content/browser/devtools/devtools_network_interceptor.cc
deleted file mode 100644
index 97597512e38..00000000000
--- a/chromium/content/browser/devtools/devtools_network_interceptor.cc
+++ /dev/null
@@ -1,109 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/devtools/devtools_network_interceptor.h"
-#include "base/strings/pattern.h"
-#include "content/browser/devtools/protocol/network_handler.h"
-#include "url/gurl.h"
-
-namespace content {
-
-DevToolsNetworkInterceptor::AuthChallengeResponse::AuthChallengeResponse(
-    ResponseType response_type)
-    : response_type(response_type) {
-  DCHECK_NE(kProvideCredentials, response_type);
-}
-
-DevToolsNetworkInterceptor::AuthChallengeResponse::AuthChallengeResponse(
-    const base::string16& username,
-    const base::string16& password)
-    : response_type(kProvideCredentials), credentials(username, password) {}
-
-InterceptedRequestInfo::InterceptedRequestInfo()
-    : is_navigation(false), response_error_code(net::OK) {}
-
-InterceptedRequestInfo::~InterceptedRequestInfo() = default;
-
-DevToolsNetworkInterceptor::FilterEntry::FilterEntry(
-    const base::UnguessableToken& target_id,
-    std::vector<Pattern> patterns,
-    RequestInterceptedCallback callback)
-    : target_id(target_id),
-      patterns(std::move(patterns)),
-      callback(std::move(callback)) {}
-
-DevToolsNetworkInterceptor::FilterEntry::FilterEntry(FilterEntry&&) {}
-DevToolsNetworkInterceptor::FilterEntry::~FilterEntry() {}
-
-DevToolsNetworkInterceptor::Modifications::Modifications() = default;
-
-DevToolsNetworkInterceptor::Modifications::Modifications(
-    net::Error error_reason)
-    : error_reason(std::move(error_reason)) {}
-
-DevToolsNetworkInterceptor::Modifications::Modifications(
-    scoped_refptr<net::HttpResponseHeaders> response_headers,
-    scoped_refptr<base::RefCountedMemory> response_body)
-    : response_headers(std::move(response_headers)),
-      response_body(std::move(response_body)) {}
-
-DevToolsNetworkInterceptor::Modifications::Modifications(
-    std::unique_ptr<AuthChallengeResponse> auth_challenge_response)
-    : auth_challenge_response(std::move(auth_challenge_response)) {}
-
-DevToolsNetworkInterceptor::Modifications::Modifications(
-    protocol::Maybe<std::string> modified_url,
-    protocol::Maybe<std::string> modified_method,
-    protocol::Maybe<std::string> modified_post_data,
-    std::unique_ptr<HeadersVector> modified_headers)
-    : modified_url(std::move(modified_url)),
-      modified_method(std::move(modified_method)),
-      modified_post_data(std::move(modified_post_data)),
-      modified_headers(std::move(modified_headers)) {}
-
-DevToolsNetworkInterceptor::Modifications::Modifications(
-    base::Optional<net::Error> error_reason,
-    scoped_refptr<net::HttpResponseHeaders> response_headers,
-    scoped_refptr<base::RefCountedMemory> response_body,
-    size_t body_offset,
-    protocol::Maybe<std::string> modified_url,
-    protocol::Maybe<std::string> modified_method,
-    protocol::Maybe<std::string> modified_post_data,
-    std::unique_ptr<HeadersVector> modified_headers,
-    std::unique_ptr<AuthChallengeResponse> auth_challenge_response)
-    : error_reason(std::move(error_reason)),
-      response_headers(std::move(response_headers)),
-      response_body(std::move(response_body)),
-      body_offset(body_offset),
-      modified_url(std::move(modified_url)),
-      modified_method(std::move(modified_method)),
-      modified_post_data(std::move(modified_post_data)),
-      modified_headers(std::move(modified_headers)),
-      auth_challenge_response(std::move(auth_challenge_response)) {}
-
-DevToolsNetworkInterceptor::Modifications::~Modifications() {}
-
-DevToolsNetworkInterceptor::Pattern::~Pattern() = default;
-
-DevToolsNetworkInterceptor::Pattern::Pattern(const Pattern& other) = default;
-
-DevToolsNetworkInterceptor::Pattern::Pattern(
-    const std::string& url_pattern,
-    base::flat_set<ResourceType> resource_types,
-    InterceptionStage interception_stage)
-    : url_pattern(url_pattern),
-      resource_types(std::move(resource_types)),
-      interception_stage(interception_stage) {}
-
-bool DevToolsNetworkInterceptor::Pattern::Matches(
-    const std::string& url,
-    ResourceType resource_type) const {
-  if (!resource_types.empty() &&
-      resource_types.find(resource_type) == resource_types.end()) {
-    return false;
-  }
-  return base::MatchPattern(url, url_pattern);
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/devtools/devtools_network_interceptor.h b/chromium/content/browser/devtools/devtools_network_interceptor.h
deleted file mode 100644
index ca735f46b22..00000000000
--- a/chromium/content/browser/devtools/devtools_network_interceptor.h
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_INTERCEPTOR_H_
-#define CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_INTERCEPTOR_H_
-
-#include "base/callback.h"
-#include "base/containers/flat_set.h"
-#include "base/optional.h"
-#include "base/unguessable_token.h"
-#include "content/browser/devtools/protocol/network.h"
-#include "content/public/common/resource_type.h"
-#include "mojo/public/cpp/system/data_pipe.h"
-#include "net/base/auth.h"
-#include "net/base/net_errors.h"
-
-namespace net {
-class AuthChallengeInfo;
-class HttpResponseHeaders;
-}  // namespace net
-
-namespace content {
-
-struct InterceptedRequestInfo {
-  InterceptedRequestInfo();
-  ~InterceptedRequestInfo();
-
-  std::string interception_id;
-  base::UnguessableToken frame_id;
-  ResourceType resource_type;
-  bool is_navigation;
-  int response_error_code;
-  std::unique_ptr<protocol::Network::Request> network_request;
-  std::unique_ptr<net::AuthChallengeInfo> auth_challenge;
-  scoped_refptr<net::HttpResponseHeaders> response_headers;
-  protocol::Maybe<bool> is_download;
-  protocol::Maybe<protocol::String> redirect_url;
-  protocol::Maybe<protocol::String> renderer_request_id;
-};
-
-class DevToolsNetworkInterceptor {
- public:
-  virtual ~DevToolsNetworkInterceptor() = default;
-
-  using RequestInterceptedCallback =
-      base::RepeatingCallback<void(std::unique_ptr<InterceptedRequestInfo>)>;
-  using ContinueInterceptedRequestCallback =
-      protocol::Network::Backend::ContinueInterceptedRequestCallback;
-  using GetResponseBodyForInterceptionCallback =
-      protocol::Network::Backend::GetResponseBodyForInterceptionCallback;
-  using TakeResponseBodyPipeCallback =
-      base::OnceCallback<void(protocol::Response,
-                              mojo::ScopedDataPipeConsumerHandle,
-                              const std::string& mime_type)>;
-
-  struct AuthChallengeResponse {
-    enum ResponseType {
-      kDefault,
-      kCancelAuth,
-      kProvideCredentials,
-    };
-
-    explicit AuthChallengeResponse(ResponseType response_type);
-    AuthChallengeResponse(const base::string16& username,
-                          const base::string16& password);
-
-    const ResponseType response_type;
-    const net::AuthCredentials credentials;
-
-    DISALLOW_COPY_AND_ASSIGN(AuthChallengeResponse);
-  };
-
-  struct Modifications {
-    using HeadersVector = std::vector<std::pair<std::string, std::string>>;
-
-    Modifications();
-    explicit Modifications(net::Error error_reason);
-    explicit Modifications(
-        std::unique_ptr<AuthChallengeResponse> auth_challenge_response);
-    Modifications(scoped_refptr<net::HttpResponseHeaders> response_headers,
-                  scoped_refptr<base::RefCountedMemory> response_body);
-    Modifications(protocol::Maybe<std::string> modified_url,
-                  protocol::Maybe<std::string> modified_method,
-                  protocol::Maybe<std::string> modified_post_data,
-                  std::unique_ptr<HeadersVector> modified_headers);
-    Modifications(
-        base::Optional<net::Error> error_reason,
-        scoped_refptr<net::HttpResponseHeaders> response_headers,
-        scoped_refptr<base::RefCountedMemory> response_body,
-        size_t body_offset,
-        protocol::Maybe<std::string> modified_url,
-        protocol::Maybe<std::string> modified_method,
-        protocol::Maybe<std::string> modified_post_data,
-        std::unique_ptr<HeadersVector> modified_headers,
-        std::unique_ptr<AuthChallengeResponse> auth_challenge_response);
-    ~Modifications();
-
-    // If none of the following are set then the request will be allowed to
-    // continue unchanged.
-    base::Optional<net::Error> error_reason;   // Finish with error.
-    // If either of the below fields is set, complete the request by
-    // responding with the provided headers and body.
-    scoped_refptr<net::HttpResponseHeaders> response_headers;
-    scoped_refptr<base::RefCountedMemory> response_body;
-    size_t body_offset = 0;
-
-    // Optionally modify before sending to network.
-    protocol::Maybe<std::string> modified_url;
-    protocol::Maybe<std::string> modified_method;
-    protocol::Maybe<std::string> modified_post_data;
-    std::unique_ptr<HeadersVector> modified_headers;
-    // AuthChallengeResponse is mutually exclusive with the above.
-    std::unique_ptr<AuthChallengeResponse> auth_challenge_response;
-  };
-
-  enum InterceptionStage {
-    DONT_INTERCEPT = 0,
-    REQUEST = (1 << 0),
-    RESPONSE = (1 << 1),
-    // Note: Both is not sent from front-end. It is used if both Request
-    // and HeadersReceived was found it upgrades it to Both.
-    BOTH = (REQUEST | RESPONSE),
-  };
-
-  struct Pattern {
-   public:
-    ~Pattern();
-    Pattern(const Pattern& other);
-    Pattern(const std::string& url_pattern,
-            base::flat_set<ResourceType> resource_types,
-            InterceptionStage interception_stage);
-
-    bool Matches(const std::string& url, ResourceType resource_type) const;
-
-    const std::string url_pattern;
-    const base::flat_set<ResourceType> resource_types;
-    const InterceptionStage interception_stage;
-  };
-
-  struct FilterEntry {
-    FilterEntry(const base::UnguessableToken& target_id,
-                std::vector<Pattern> patterns,
-                RequestInterceptedCallback callback);
-    FilterEntry(FilterEntry&&);
-    ~FilterEntry();
-
-    const base::UnguessableToken target_id;
-    std::vector<Pattern> patterns;
-    const RequestInterceptedCallback callback;
-
-    DISALLOW_COPY_AND_ASSIGN(FilterEntry);
-  };
-
-  virtual void AddFilterEntry(std::unique_ptr<FilterEntry> entry) = 0;
-  virtual void RemoveFilterEntry(const FilterEntry* entry) = 0;
-  virtual void UpdatePatterns(FilterEntry* entry,
-                              std::vector<Pattern> patterns) = 0;
-  virtual void GetResponseBody(
-      std::string interception_id,
-      std::unique_ptr<GetResponseBodyForInterceptionCallback> callback) = 0;
-  virtual void ContinueInterceptedRequest(
-      std::string interception_id,
-      std::unique_ptr<Modifications> modifications,
-      std::unique_ptr<ContinueInterceptedRequestCallback> callback) = 0;
-};
-
-inline DevToolsNetworkInterceptor::InterceptionStage& operator|=(
-    DevToolsNetworkInterceptor::InterceptionStage& a,
-    const DevToolsNetworkInterceptor::InterceptionStage& b) {
-  a = static_cast<DevToolsNetworkInterceptor::InterceptionStage>(a | b);
-  return a;
-}
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_NETWORK_INTERCEPTOR_H_
diff --git a/chromium/content/browser/devtools/devtools_session.cc b/chromium/content/browser/devtools/devtools_session.cc
index c4ff84372a8..ab21cb146b8 100644
--- a/chromium/content/browser/devtools/devtools_session.cc
+++ b/chromium/content/browser/devtools/devtools_session.cc
@@ -57,6 +57,8 @@ bool TerminateOnCrossProcessNavigation(const std::string& method) {
 const char kMethod[] = "method";
 const char kResumeMethod[] = "Runtime.runIfWaitingForDebugger";
 const char kSessionId[] = "sessionId";
+
+// Clients match against this error message verbatim (http://crbug.com/1001678).
 const char kTargetClosedMessage[] = "Inspected target navigated or closed";
 }  // namespace
 
@@ -135,42 +137,44 @@ void DevToolsSession::AttachToAgent(blink::mojom::DevToolsAgent* agent) {
   session_.set_disconnect_handler(base::BindOnce(
       &DevToolsSession::MojoConnectionDestroyed, base::Unretained(this)));
 
-  // If we auto attached to a new oopif the session is not suspended but the
-  // render frame host may be updated during navigation, so outstanding messages
-  // are resent to the new host.
-  if (!suspended_sending_messages_to_agent_) {
-    for (const auto& pair : waiting_for_response_messages_) {
-      int call_id = pair.first;
-      const WaitingMessage& message = pair.second;
-      DispatchProtocolMessageToAgent(call_id, message.method, message.message);
-    }
-  } else {
-    std::vector<SuspendedMessage> new_suspended_messages;
-    new_suspended_messages.reserve(waiting_for_response_messages_.size());
-    for (const auto& pair : waiting_for_response_messages_) {
-      int call_id = pair.first;
-      const WaitingMessage& message = pair.second;
-      if (TerminateOnCrossProcessNavigation(message.method)) {
-        // We'll not receive any responses from the old agent, so send errors to
-        // the client.
+  // Set cookie to an empty struct to reattach next time instead of attaching.
+  if (!session_state_cookie_)
+    session_state_cookie_ = blink::mojom::DevToolsSessionState::New();
+
+  // We're attaching to a new agent while suspended; therefore, messages that
+  // have been sent previously either need to be terminated or re-sent once we
+  // resume, as we will not get any responses from the old agent at this point.
+  if (suspended_sending_messages_to_agent_) {
+    for (auto it = pending_messages_.begin(); it != pending_messages_.end();) {
+      const Message& message = *it;
+      if (waiting_for_response_.count(message.call_id) &&
+          TerminateOnCrossProcessNavigation(message.method)) {
+        // Send error to the client and remove the message from pending.
         auto error = protocol::InternalResponse::createErrorResponse(
-            call_id, protocol::DispatchResponse::kServerError,
+            message.call_id, protocol::DispatchResponse::kServerError,
             kTargetClosedMessage);
-        sendProtocolResponse(call_id, std::move(error));
+        sendProtocolResponse(message.call_id, std::move(error));
+        it = pending_messages_.erase(it);
       } else {
-        new_suspended_messages.push_back(
-            {call_id, message.method, message.message});
+        // We'll send or re-send the message in ResumeSendingMessagesToAgent.
+        ++it;
       }
     }
-    suspended_messages_.insert(suspended_messages_.begin(),
-                               new_suspended_messages.begin(),
-                               new_suspended_messages.end());
-    waiting_for_response_messages_.clear();
+    waiting_for_response_.clear();
+    return;
   }
 
-  // Set cookie to an empty struct to reattach next time instead of attaching.
-  if (!session_state_cookie_)
-    session_state_cookie_ = blink::mojom::DevToolsSessionState::New();
+  // The session is not suspended but the render frame host may be updated
+  // during navigation because:
+  // - auto attached to a new OOPIF
+  // - cross-process navigation in the main frame
+  // Therefore, we re-send outstanding messages to the new host.
+  for (const Message& message : pending_messages_) {
+    if (waiting_for_response_.count(message.call_id)) {
+      DispatchProtocolMessageToAgent(message.call_id, message.method,
+                                     message.message);
+    }
+  }
 }
 
 void DevToolsSession::MojoConnectionDestroyed() {
@@ -267,13 +271,13 @@ void DevToolsSession::fallThrough(int call_id,
   // In browser-only mode, we should've handled everything in dispatcher.
   DCHECK(!browser_only_);
 
-  if (suspended_sending_messages_to_agent_) {
-    suspended_messages_.push_back({call_id, method, message});
+  auto it = pending_messages_.insert(pending_messages_.end(),
+                                     {call_id, method, message});
+  if (suspended_sending_messages_to_agent_)
     return;
-  }
 
   DispatchProtocolMessageToAgent(call_id, method, message);
-  waiting_for_response_messages_[call_id] = {method, message};
+  waiting_for_response_[call_id] = it;
 }
 
 void DevToolsSession::DispatchProtocolMessageToAgent(
@@ -303,13 +307,15 @@ void DevToolsSession::SuspendSendingMessagesToAgent() {
 void DevToolsSession::ResumeSendingMessagesToAgent() {
   DCHECK(!browser_only_);
   suspended_sending_messages_to_agent_ = false;
-  for (const SuspendedMessage& message : suspended_messages_) {
+  for (auto it = pending_messages_.begin(); it != pending_messages_.end();
+       ++it) {
+    const Message& message = *it;
+    if (waiting_for_response_.count(message.call_id))
+      continue;
     DispatchProtocolMessageToAgent(message.call_id, message.method,
                                    message.message);
-    waiting_for_response_messages_[message.call_id] = {message.method,
-                                                       message.message};
+    waiting_for_response_[message.call_id] = it;
   }
-  suspended_messages_.clear();
 }
 
 // The following methods handle responses or notifications coming from
@@ -363,7 +369,13 @@ void DevToolsSession::DispatchProtocolResponse(
     int call_id,
     blink::mojom::DevToolsSessionStatePtr updates) {
   ApplySessionStateUpdates(std::move(updates));
-  waiting_for_response_messages_.erase(call_id);
+  auto it = waiting_for_response_.find(call_id);
+  // TODO(johannes): Consider shutting down renderer instead of just
+  // dropping the message. See shutdownForBadMessage().
+  if (it == waiting_for_response_.end())
+    return;
+  pending_messages_.erase(it->second);
+  waiting_for_response_.erase(it);
   DispatchProtocolResponseOrNotification(client_, agent_host_,
                                          std::move(message));
   // |this| may be deleted at this point.
diff --git a/chromium/content/browser/devtools/devtools_session.h b/chromium/content/browser/devtools/devtools_session.h
index 4f57d301408..c10a9260718 100644
--- a/chromium/content/browser/devtools/devtools_session.h
+++ b/chromium/content/browser/devtools/devtools_session.h
@@ -5,10 +5,10 @@
 #ifndef CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_SESSION_H_
 #define CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_SESSION_H_
 
+#include <list>
 #include <map>
 #include <memory>
 #include <string>
-#include <vector>
 
 #include "base/containers/flat_map.h"
 #include "base/memory/weak_ptr.h"
@@ -115,22 +115,17 @@ class DevToolsSession : public protocol::FrontendChannel,
   HandlersMap handlers_;
   std::unique_ptr<protocol::UberDispatcher> dispatcher_;
 
-  // These messages were queued after suspending, not sent to the agent,
-  // and will be sent after resuming.
-  struct SuspendedMessage {
-    int call_id;
-    std::string method;
-    std::string message;
-  };
-  std::vector<SuspendedMessage> suspended_messages_;
   bool suspended_sending_messages_to_agent_ = false;
 
-  // These messages have been sent to agent, but did not get a response yet.
-  struct WaitingMessage {
+  struct Message {
+    int call_id;
     std::string method;
     std::string message;
   };
-  std::map<int, WaitingMessage> waiting_for_response_messages_;
+  // Messages that were sent to the agent or queued after suspending.
+  std::list<Message> pending_messages_;
+  // Pending messages that were sent and are thus waiting for a response.
+  base::flat_map<int, std::list<Message>::iterator> waiting_for_response_;
 
   // |session_state_cookie_| always corresponds to a state before
   // any of the waiting for response messages have been handled.
diff --git a/chromium/content/browser/devtools/devtools_traceable_screenshot.h b/chromium/content/browser/devtools/devtools_traceable_screenshot.h
index bd6afd2271b..0f90cb1c83b 100644
--- a/chromium/content/browser/devtools/devtools_traceable_screenshot.h
+++ b/chromium/content/browser/devtools/devtools_traceable_screenshot.h
@@ -15,6 +15,8 @@ namespace content {
 class DevToolsTraceableScreenshot
     : public base::trace_event::ConvertableToTraceFormat {
  public:
+  static constexpr int kMaximumNumberOfScreenshots = 450;
+
   static base::subtle::Atomic32 GetNumberOfInstances();
 
   DevToolsTraceableScreenshot(const SkBitmap& bitmap);
diff --git a/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc b/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc
index be645e1d147..6b7d04e1d0c 100644
--- a/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc
+++ b/chromium/content/browser/devtools/devtools_url_loader_interceptor.cc
@@ -7,19 +7,17 @@
 #include "base/base64.h"
 #include "base/bind.h"
 #include "base/no_destructor.h"
+#include "base/strings/pattern.h"
 #include "base/strings/stringprintf.h"
-#include "base/task/post_task.h"
 #include "base/time/time.h"
 #include "base/unguessable_token.h"
-#include "content/browser/devtools/cross_thread_protocol_callback.h"
 #include "content/browser/devtools/protocol/network.h"
 #include "content/browser/devtools/protocol/network_handler.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/loader/download_utils_impl.h"
 #include "content/public/browser/browser_task_traits.h"
-#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_partition.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/system/data_pipe_drainer.h"
 #include "net/base/load_flags.h"
 #include "net/base/mime_sniffer.h"
@@ -32,20 +30,101 @@
 
 namespace content {
 
-namespace {
+InterceptedRequestInfo::InterceptedRequestInfo() = default;
 
-using RequestInterceptedCallback =
-    DevToolsNetworkInterceptor::RequestInterceptedCallback;
-using ContinueInterceptedRequestCallback =
-    DevToolsNetworkInterceptor::ContinueInterceptedRequestCallback;
-using GetResponseBodyCallback =
-    DevToolsNetworkInterceptor::GetResponseBodyForInterceptionCallback;
-using TakeResponseBodyPipeCallback =
-    DevToolsNetworkInterceptor::TakeResponseBodyPipeCallback;
-using Modifications = DevToolsNetworkInterceptor::Modifications;
-using InterceptionStage = DevToolsNetworkInterceptor::InterceptionStage;
-using protocol::Response;
-using GlobalRequestId = std::tuple<int32_t, int32_t, int32_t>;
+InterceptedRequestInfo::~InterceptedRequestInfo() = default;
+
+DevToolsURLLoaderInterceptor::AuthChallengeResponse::AuthChallengeResponse(
+    ResponseType response_type)
+    : response_type(response_type) {
+  DCHECK_NE(kProvideCredentials, response_type);
+}
+
+DevToolsURLLoaderInterceptor::AuthChallengeResponse::AuthChallengeResponse(
+    const base::string16& username,
+    const base::string16& password)
+    : response_type(kProvideCredentials), credentials(username, password) {}
+
+DevToolsURLLoaderInterceptor::FilterEntry::FilterEntry(
+    const base::UnguessableToken& target_id,
+    std::vector<Pattern> patterns,
+    RequestInterceptedCallback callback)
+    : target_id(target_id),
+      patterns(std::move(patterns)),
+      callback(std::move(callback)) {}
+
+DevToolsURLLoaderInterceptor::FilterEntry::FilterEntry(FilterEntry&&) = default;
+DevToolsURLLoaderInterceptor::FilterEntry::~FilterEntry() = default;
+
+DevToolsURLLoaderInterceptor::Modifications::Modifications() = default;
+
+DevToolsURLLoaderInterceptor::Modifications::Modifications(
+    net::Error error_reason)
+    : error_reason(error_reason) {}
+
+DevToolsURLLoaderInterceptor::Modifications::Modifications(
+    scoped_refptr<net::HttpResponseHeaders> response_headers,
+    scoped_refptr<base::RefCountedMemory> response_body)
+    : response_headers(std::move(response_headers)),
+      response_body(std::move(response_body)) {}
+
+DevToolsURLLoaderInterceptor::Modifications::Modifications(
+    std::unique_ptr<AuthChallengeResponse> auth_challenge_response)
+    : auth_challenge_response(std::move(auth_challenge_response)) {}
+
+DevToolsURLLoaderInterceptor::Modifications::Modifications(
+    protocol::Maybe<std::string> modified_url,
+    protocol::Maybe<std::string> modified_method,
+    protocol::Maybe<std::string> modified_post_data,
+    std::unique_ptr<HeadersVector> modified_headers)
+    : modified_url(std::move(modified_url)),
+      modified_method(std::move(modified_method)),
+      modified_post_data(std::move(modified_post_data)),
+      modified_headers(std::move(modified_headers)) {}
+
+DevToolsURLLoaderInterceptor::Modifications::Modifications(
+    base::Optional<net::Error> error_reason,
+    scoped_refptr<net::HttpResponseHeaders> response_headers,
+    scoped_refptr<base::RefCountedMemory> response_body,
+    size_t body_offset,
+    protocol::Maybe<std::string> modified_url,
+    protocol::Maybe<std::string> modified_method,
+    protocol::Maybe<std::string> modified_post_data,
+    std::unique_ptr<HeadersVector> modified_headers,
+    std::unique_ptr<AuthChallengeResponse> auth_challenge_response)
+    : error_reason(std::move(error_reason)),
+      response_headers(std::move(response_headers)),
+      response_body(std::move(response_body)),
+      body_offset(body_offset),
+      modified_url(std::move(modified_url)),
+      modified_method(std::move(modified_method)),
+      modified_post_data(std::move(modified_post_data)),
+      modified_headers(std::move(modified_headers)),
+      auth_challenge_response(std::move(auth_challenge_response)) {}
+
+DevToolsURLLoaderInterceptor::Modifications::~Modifications() = default;
+
+DevToolsURLLoaderInterceptor::Pattern::~Pattern() = default;
+
+DevToolsURLLoaderInterceptor::Pattern::Pattern(const Pattern& other) = default;
+
+DevToolsURLLoaderInterceptor::Pattern::Pattern(
+    const std::string& url_pattern,
+    base::flat_set<ResourceType> resource_types,
+    InterceptionStage interception_stage)
+    : url_pattern(url_pattern),
+      resource_types(std::move(resource_types)),
+      interception_stage(interception_stage) {}
+
+bool DevToolsURLLoaderInterceptor::Pattern::Matches(
+    const std::string& url,
+    ResourceType resource_type) const {
+  if (!resource_types.empty() &&
+      resource_types.find(resource_type) == resource_types.end()) {
+    return false;
+  }
+  return base::MatchPattern(url, url_pattern);
+}
 
 struct CreateLoaderParameters {
   CreateLoaderParameters(
@@ -67,6 +146,21 @@ struct CreateLoaderParameters {
   const net::MutableNetworkTrafficAnnotationTag traffic_annotation;
 };
 
+namespace {
+
+using RequestInterceptedCallback =
+    DevToolsURLLoaderInterceptor::RequestInterceptedCallback;
+using ContinueInterceptedRequestCallback =
+    DevToolsURLLoaderInterceptor::ContinueInterceptedRequestCallback;
+using GetResponseBodyCallback =
+    DevToolsURLLoaderInterceptor::GetResponseBodyForInterceptionCallback;
+using TakeResponseBodyPipeCallback =
+    DevToolsURLLoaderInterceptor::TakeResponseBodyPipeCallback;
+using Modifications = DevToolsURLLoaderInterceptor::Modifications;
+using InterceptionStage = DevToolsURLLoaderInterceptor::InterceptionStage;
+using protocol::Response;
+using GlobalRequestId = std::tuple<int32_t, int32_t, int32_t>;
+
 class BodyReader : public mojo::DataPipeDrainer::Client {
  public:
   explicit BodyReader(base::OnceClosure download_complete_callback)
@@ -75,11 +169,10 @@ class BodyReader : public mojo::DataPipeDrainer::Client {
 
   void StartReading(mojo::ScopedDataPipeConsumerHandle body);
 
-  using GetBodyCallback = CrossThreadProtocolCallback<GetResponseBodyCallback>;
-  void AddCallback(GetBodyCallback callback) {
+  void AddCallback(std::unique_ptr<GetResponseBodyCallback> callback) {
     if (data_complete_) {
       DCHECK(callbacks_.empty());
-      callback.sendSuccess(encoded_body_, true);
+      callback->sendSuccess(encoded_body_, true);
       return;
     }
     callbacks_.push_back(std::move(callback));
@@ -94,7 +187,7 @@ class BodyReader : public mojo::DataPipeDrainer::Client {
 
   void CancelWithError(std::string error) {
     for (auto& cb : callbacks_)
-      cb.sendFailure(Response::Error(error));
+      cb->sendFailure(Response::Error(error));
     callbacks_.clear();
   }
 
@@ -108,7 +201,7 @@ class BodyReader : public mojo::DataPipeDrainer::Client {
   void OnDataComplete() override;
 
   std::unique_ptr<mojo::DataPipeDrainer> body_pipe_drainer_;
-  std::vector<GetBodyCallback> callbacks_;
+  std::vector<std::unique_ptr<GetResponseBodyCallback>> callbacks_;
   base::OnceClosure download_complete_callback_;
   scoped_refptr<base::RefCountedString> body_;
   std::string encoded_body_;
@@ -130,7 +223,7 @@ void BodyReader::OnDataComplete() {
   // TODO(caseq): only encode if necessary.
   base::Base64Encode(body_->data(), &encoded_body_);
   for (auto& cb : callbacks_)
-    cb.sendSuccess(encoded_body_, true);
+    cb->sendSuccess(encoded_body_, true);
   callbacks_.clear();
   std::move(download_complete_callback_).Run();
 }
@@ -148,6 +241,8 @@ struct ResponseMetadata {
   network::URLLoaderCompletionStatus status;
 };
 
+}  // namespace
+
 class InterceptionJob : public network::mojom::URLLoaderClient,
                         public network::mojom::URLLoader {
  public:
@@ -159,7 +254,7 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
   }
 
   InterceptionJob(
-      DevToolsURLLoaderInterceptor::Impl* interceptor,
+      DevToolsURLLoaderInterceptor* interceptor,
       const std::string& id,
       const base::UnguessableToken& frame_token,
       int32_t process_id,
@@ -171,12 +266,11 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
       network::mojom::URLLoaderFactoryPtr target_factory,
       mojo::PendingRemote<network::mojom::CookieManager> cookie_manager);
 
-  void GetResponseBody(
-      CrossThreadProtocolCallback<GetResponseBodyCallback> callback);
+  void GetResponseBody(std::unique_ptr<GetResponseBodyCallback> callback);
   void TakeResponseBodyPipe(TakeResponseBodyPipeCallback callback);
   void ContinueInterceptedRequest(
       std::unique_ptr<Modifications> modifications,
-      CrossThreadProtocolCallback<ContinueInterceptedRequestCallback> callback);
+      std::unique_ptr<ContinueInterceptedRequestCallback> callback);
   void Detach();
 
   void OnAuthRequest(
@@ -185,7 +279,6 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
 
  private:
   static std::map<GlobalRequestId, InterceptionJob*>& GetInterceptionJobMap() {
-    DCHECK_CURRENTLY_ON(content::BrowserThread::IO);
     static base::NoDestructor<std::map<GlobalRequestId, InterceptionJob*>> inst;
     return *inst;
   }
@@ -199,7 +292,7 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
 
   Response InnerContinueRequest(std::unique_ptr<Modifications> modifications);
   void ProcessAuthResponse(
-      const DevToolsNetworkInterceptor::AuthChallengeResponse&
+      const DevToolsURLLoaderInterceptor::AuthChallengeResponse&
           auth_challenge_response);
   Response ProcessResponseOverride(
       scoped_refptr<net::HttpResponseHeaders> headers,
@@ -266,7 +359,7 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
   const base::UnguessableToken frame_token_;
   const bool report_upload_;
 
-  DevToolsURLLoaderInterceptor::Impl* interceptor_;
+  DevToolsURLLoaderInterceptor* interceptor_;
   InterceptionStage stage_;
 
   std::unique_ptr<CreateLoaderParameters> create_loader_params_;
@@ -312,120 +405,40 @@ class InterceptionJob : public network::mojom::URLLoaderClient,
   DISALLOW_COPY_AND_ASSIGN(InterceptionJob);
 };
 
-}  // namespace
-
-class DevToolsURLLoaderInterceptor::Impl
-    : public base::SupportsWeakPtr<DevToolsURLLoaderInterceptor::Impl> {
- public:
-  explicit Impl(RequestInterceptedCallback callback)
-      : request_intercepted_callback_(callback), handle_auth_(false) {}
-  ~Impl() {
-    for (auto const& entry : jobs_)
-      entry.second->Detach();
-  }
-
-  void CreateJob(
-      const base::UnguessableToken& frame_token,
-      int32_t process_id,
-      bool is_download,
-      const base::Optional<std::string>& renderer_request_id,
-      std::unique_ptr<CreateLoaderParameters> create_params,
-      network::mojom::URLLoaderRequest loader_request,
-      network::mojom::URLLoaderClientPtr client,
-      network::mojom::URLLoaderFactoryPtr target_factory,
-      mojo::PendingRemote<network::mojom::CookieManager> cookie_manager) {
-    DCHECK(!frame_token.is_empty());
-
-    static int last_id = 0;
-
-    std::string id = base::StringPrintf("interception-job-%d", ++last_id);
-    // This class will manage its own life time to match the loader client.
-    new InterceptionJob(this, std::move(id), frame_token, process_id,
-                        renderer_request_id, std::move(create_params),
-                        is_download, std::move(loader_request),
-                        std::move(client), std::move(target_factory),
-                        std::move(cookie_manager));
-  }
-
-  void SetPatterns(std::vector<DevToolsNetworkInterceptor::Pattern> patterns,
-                   bool handle_auth) {
-    patterns_ = std::move(patterns);
-    handle_auth_ = handle_auth;
-  }
-
-  InterceptionStage GetInterceptionStage(const GURL& url,
-                                         ResourceType resource_type) const {
-    InterceptionStage stage = InterceptionStage::DONT_INTERCEPT;
-    std::string unused;
-    std::string url_str =
-        protocol::NetworkHandler::ExtractFragment(url, &unused);
-    for (const auto& pattern : patterns_) {
-      if (pattern.Matches(url_str, resource_type))
-        stage |= pattern.interception_stage;
-    }
-    return stage;
-  }
-
-  void GetResponseBody(
-      const std::string& interception_id,
-      CrossThreadProtocolCallback<GetResponseBodyCallback> callback) {
-    if (InterceptionJob* job = FindJob(interception_id, &callback))
-      job->GetResponseBody(std::move(callback));
-  }
-
-  void TakeResponseBodyPipe(
-      const std::string& interception_id,
-      DevToolsNetworkInterceptor::TakeResponseBodyPipeCallback callback) {
-    auto it = jobs_.find(interception_id);
-    if (it == jobs_.end()) {
-      base::PostTask(
-          FROM_HERE, {BrowserThread::UI},
-          base::BindOnce(
-              std::move(callback),
-              protocol::Response::InvalidParams("Invalid InterceptionId."),
-              mojo::ScopedDataPipeConsumerHandle(), std::string()));
-      return;
-    }
-    it->second->TakeResponseBodyPipe(std::move(callback));
-  }
+void DevToolsURLLoaderInterceptor::CreateJob(
+    const base::UnguessableToken& frame_token,
+    int32_t process_id,
+    bool is_download,
+    const base::Optional<std::string>& renderer_request_id,
+    std::unique_ptr<CreateLoaderParameters> create_params,
+    network::mojom::URLLoaderRequest loader_request,
+    network::mojom::URLLoaderClientPtr client,
+    network::mojom::URLLoaderFactoryPtr target_factory,
+    mojo::PendingRemote<network::mojom::CookieManager> cookie_manager) {
+  DCHECK(!frame_token.is_empty());
 
-  void ContinueInterceptedRequest(
-      const std::string& interception_id,
-      std::unique_ptr<Modifications> modifications,
-      CrossThreadProtocolCallback<ContinueInterceptedRequestCallback>
-          callback) {
-    if (InterceptionJob* job = FindJob(interception_id, &callback)) {
-      job->ContinueInterceptedRequest(std::move(modifications),
-                                      std::move(callback));
-    }
-  }
+  static int last_id = 0;
 
- private:
-  friend class content::InterceptionJob;
-
-  template <typename Callback>
-  InterceptionJob* FindJob(const std::string& id,
-                           CrossThreadProtocolCallback<Callback>* callback) {
-    auto it = jobs_.find(id);
-    if (it != jobs_.end())
-      return it->second;
-    callback->sendFailure(
-        protocol::Response::InvalidParams("Invalid InterceptionId."));
-    return nullptr;
-  }
+  std::string id = base::StringPrintf("interception-job-%d", ++last_id);
+  // This class will manage its own life time to match the loader client.
+  new InterceptionJob(this, std::move(id), frame_token, process_id,
+                      renderer_request_id, std::move(create_params),
+                      is_download, std::move(loader_request), std::move(client),
+                      std::move(target_factory), std::move(cookie_manager));
+}
 
-  void RemoveJob(const std::string& id) { jobs_.erase(id); }
-  void AddJob(const std::string& id, InterceptionJob* job) {
-    jobs_.emplace(id, job);
+InterceptionStage DevToolsURLLoaderInterceptor::GetInterceptionStage(
+    const GURL& url,
+    ResourceType resource_type) const {
+  InterceptionStage stage = InterceptionStage::DONT_INTERCEPT;
+  std::string unused;
+  std::string url_str = protocol::NetworkHandler::ExtractFragment(url, &unused);
+  for (const auto& pattern : patterns_) {
+    if (pattern.Matches(url_str, resource_type))
+      stage |= pattern.interception_stage;
   }
-
-  std::map<std::string, InterceptionJob*> jobs_;
-  RequestInterceptedCallback request_intercepted_callback_;
-  std::vector<DevToolsNetworkInterceptor::Pattern> patterns_;
-  bool handle_auth_;
-
-  DISALLOW_COPY_AND_ASSIGN(Impl);
-};
+  return stage;
+}
 
 class DevToolsURLLoaderFactoryProxy : public network::mojom::URLLoaderFactory {
  public:
@@ -433,10 +446,10 @@ class DevToolsURLLoaderFactoryProxy : public network::mojom::URLLoaderFactory {
       const base::UnguessableToken& frame_token,
       int32_t process_id,
       bool is_download,
-      network::mojom::URLLoaderFactoryRequest loader_request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader_receiver,
       network::mojom::URLLoaderFactoryPtrInfo target_factory_info,
       mojo::PendingRemote<network::mojom::CookieManager> cookie_manager,
-      base::WeakPtr<DevToolsURLLoaderInterceptor::Impl> interceptor);
+      base::WeakPtr<DevToolsURLLoaderInterceptor> interceptor);
   ~DevToolsURLLoaderFactoryProxy() override;
 
  private:
@@ -449,12 +462,9 @@ class DevToolsURLLoaderFactoryProxy : public network::mojom::URLLoaderFactory {
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
-  void StartOnIO(
-      network::mojom::URLLoaderFactoryRequest loader_request,
-      network::mojom::URLLoaderFactoryPtrInfo target_factory_info,
-      mojo::PendingRemote<network::mojom::CookieManager> cookie_manager);
   void OnProxyBindingError();
   void OnTargetFactoryError();
 
@@ -464,31 +474,40 @@ class DevToolsURLLoaderFactoryProxy : public network::mojom::URLLoaderFactory {
 
   network::mojom::URLLoaderFactoryPtr target_factory_;
   mojo::Remote<network::mojom::CookieManager> cookie_manager_;
-  base::WeakPtr<DevToolsURLLoaderInterceptor::Impl> interceptor_;
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  base::WeakPtr<DevToolsURLLoaderInterceptor> interceptor_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   SEQUENCE_CHECKER(sequence_checker_);
 };
 
+// This class owns itself and will delete self when any mojo
+// connection is broken.
 DevToolsURLLoaderFactoryProxy::DevToolsURLLoaderFactoryProxy(
     const base::UnguessableToken& frame_token,
     int32_t process_id,
     bool is_download,
-    network::mojom::URLLoaderFactoryRequest loader_request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader_receiver,
     network::mojom::URLLoaderFactoryPtrInfo target_factory_info,
     mojo::PendingRemote<network::mojom::CookieManager> cookie_manager,
-    base::WeakPtr<DevToolsURLLoaderInterceptor::Impl> interceptor)
+    base::WeakPtr<DevToolsURLLoaderInterceptor> interceptor)
     : frame_token_(frame_token),
       process_id_(process_id),
       is_download_(is_download),
       interceptor_(std::move(interceptor)) {
-  DETACH_FROM_SEQUENCE(sequence_checker_);
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&DevToolsURLLoaderFactoryProxy::StartOnIO,
-                     base::Unretained(this), std::move(loader_request),
-                     std::move(target_factory_info),
-                     std::move(cookie_manager)));
+  target_factory_.Bind(std::move(target_factory_info));
+  target_factory_.set_connection_error_handler(
+      base::BindOnce(&DevToolsURLLoaderFactoryProxy::OnTargetFactoryError,
+                     base::Unretained(this)));
+
+  receivers_.Add(this, std::move(loader_receiver));
+  receivers_.set_disconnect_handler(
+      base::BindRepeating(&DevToolsURLLoaderFactoryProxy::OnProxyBindingError,
+                          base::Unretained(this)));
+
+  cookie_manager_.Bind(std::move(cookie_manager));
+  cookie_manager_.set_disconnect_handler(
+      base::BindOnce(&DevToolsURLLoaderFactoryProxy::OnTargetFactoryError,
+                     base::Unretained(this)));
 }
 
 DevToolsURLLoaderFactoryProxy::~DevToolsURLLoaderFactoryProxy() {}
@@ -503,7 +522,7 @@ void DevToolsURLLoaderFactoryProxy::CreateLoaderAndStart(
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  DevToolsURLLoaderInterceptor::Impl* interceptor = interceptor_.get();
+  DevToolsURLLoaderInterceptor* interceptor = interceptor_.get();
   if (!interceptor_ || request.url.SchemeIs(url::kDataScheme)) {
     target_factory_->CreateLoaderAndStart(
         std::move(loader), routing_id, request_id, options, request,
@@ -523,30 +542,10 @@ void DevToolsURLLoaderFactoryProxy::CreateLoaderAndStart(
       std::move(factory_clone), std::move(cookie_manager_clone));
 }
 
-void DevToolsURLLoaderFactoryProxy::StartOnIO(
-    network::mojom::URLLoaderFactoryRequest loader_request,
-    network::mojom::URLLoaderFactoryPtrInfo target_factory_info,
-    mojo::PendingRemote<network::mojom::CookieManager> cookie_manager) {
-  target_factory_.Bind(std::move(target_factory_info));
-  target_factory_.set_connection_error_handler(
-      base::BindOnce(&DevToolsURLLoaderFactoryProxy::OnTargetFactoryError,
-                     base::Unretained(this)));
-
-  bindings_.AddBinding(this, std::move(loader_request));
-  bindings_.set_connection_error_handler(
-      base::BindRepeating(&DevToolsURLLoaderFactoryProxy::OnProxyBindingError,
-                          base::Unretained(this)));
-
-  cookie_manager_.Bind(std::move(cookie_manager));
-  cookie_manager_.set_disconnect_handler(
-      base::BindOnce(&DevToolsURLLoaderFactoryProxy::OnTargetFactoryError,
-                     base::Unretained(this)));
-}
-
 void DevToolsURLLoaderFactoryProxy::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  bindings_.AddBinding(this, std::move(request));
+  receivers_.Add(this, std::move(receiver));
 }
 
 void DevToolsURLLoaderFactoryProxy::OnTargetFactoryError() {
@@ -554,7 +553,7 @@ void DevToolsURLLoaderFactoryProxy::OnTargetFactoryError() {
 }
 
 void DevToolsURLLoaderFactoryProxy::OnProxyBindingError() {
-  if (bindings_.empty())
+  if (receivers_.empty())
     delete this;
 }
 
@@ -574,52 +573,49 @@ void DevToolsURLLoaderInterceptor::HandleAuthRequest(
 
 DevToolsURLLoaderInterceptor::DevToolsURLLoaderInterceptor(
     RequestInterceptedCallback callback)
-    : enabled_(false),
-      impl_(new DevToolsURLLoaderInterceptor::Impl(std::move(callback)),
-            base::OnTaskRunnerDeleter(
-                base::CreateSingleThreadTaskRunner({BrowserThread::IO}))),
-      weak_impl_(impl_->AsWeakPtr()) {}
+    : request_intercepted_callback_(std::move(callback)), weak_factory_(this) {}
 
-DevToolsURLLoaderInterceptor::~DevToolsURLLoaderInterceptor() = default;
+DevToolsURLLoaderInterceptor::~DevToolsURLLoaderInterceptor() {
+  for (auto const& entry : jobs_)
+    entry.second->Detach();
+}
 
 void DevToolsURLLoaderInterceptor::SetPatterns(
-    std::vector<DevToolsNetworkInterceptor::Pattern> patterns,
+    std::vector<DevToolsURLLoaderInterceptor::Pattern> patterns,
     bool handle_auth) {
-  enabled_ = !!patterns.size();
-  DCHECK(enabled_ || !handle_auth);
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&Impl::SetPatterns, base::Unretained(impl_.get()),
-                     std::move(patterns), handle_auth));
+  patterns_ = std::move(patterns);
+  handle_auth_ = handle_auth;
+  DCHECK(patterns_.size() || !handle_auth);
 }
 
 void DevToolsURLLoaderInterceptor::GetResponseBody(
     const std::string& interception_id,
     std::unique_ptr<GetResponseBodyCallback> callback) {
-  base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&Impl::GetResponseBody,
-                                base::Unretained(impl_.get()), interception_id,
-                                WrapForAnotherThread(std::move(callback))));
+  if (InterceptionJob* job = FindJob(interception_id, &callback))
+    job->GetResponseBody(std::move(callback));
 }
 
 void DevToolsURLLoaderInterceptor::TakeResponseBodyPipe(
     const std::string& interception_id,
-    DevToolsNetworkInterceptor::TakeResponseBodyPipeCallback callback) {
-  base::PostTask(
-      FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&Impl::TakeResponseBodyPipe, base::Unretained(impl_.get()),
-                     interception_id, std::move(callback)));
+    DevToolsURLLoaderInterceptor::TakeResponseBodyPipeCallback callback) {
+  auto it = jobs_.find(interception_id);
+  if (it == jobs_.end()) {
+    std::move(callback).Run(
+        protocol::Response::InvalidParams("Invalid InterceptionId."),
+        mojo::ScopedDataPipeConsumerHandle(), base::EmptyString());
+    return;
+  }
+  it->second->TakeResponseBodyPipe(std::move(callback));
 }
 
 void DevToolsURLLoaderInterceptor::ContinueInterceptedRequest(
     const std::string& interception_id,
     std::unique_ptr<Modifications> modifications,
     std::unique_ptr<ContinueInterceptedRequestCallback> callback) {
-  base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&Impl::ContinueInterceptedRequest,
-                                base::Unretained(impl_.get()), interception_id,
-                                std::move(modifications),
-                                WrapForAnotherThread(std::move(callback))));
+  if (InterceptionJob* job = FindJob(interception_id, &callback)) {
+    job->ContinueInterceptedRequest(std::move(modifications),
+                                    std::move(callback));
+  }
 }
 
 bool DevToolsURLLoaderInterceptor::CreateProxyForInterception(
@@ -627,14 +623,13 @@ bool DevToolsURLLoaderInterceptor::CreateProxyForInterception(
     const base::UnguessableToken& frame_token,
     bool is_navigation,
     bool is_download,
-    mojo::PendingReceiver<network::mojom::URLLoaderFactory>* receiver) const {
-  if (!enabled_)
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory>* receiver) {
+  if (patterns_.empty())
     return false;
 
-  // TODO(crbug.com/955171): Replace these with PendingReceiver and
-  // PendingRemote.
-  network::mojom::URLLoaderFactoryRequest original_request =
+  mojo::PendingReceiver<network::mojom::URLLoaderFactory> original_receiver =
       std::move(*receiver);
+  // TODO(crbug.com/955171): Replace |target_ptr_info| with PendingRemote.
   network::mojom::URLLoaderFactoryPtrInfo target_ptr_info;
   *receiver = MakeRequest(&target_ptr_info);
   mojo::PendingRemote<network::mojom::CookieManager> cookie_manager;
@@ -642,13 +637,14 @@ bool DevToolsURLLoaderInterceptor::CreateProxyForInterception(
   rph->GetStoragePartition()->GetNetworkContext()->GetCookieManager(
       cookie_manager.InitWithNewPipeAndPassReceiver());
   new DevToolsURLLoaderFactoryProxy(
-      frame_token, process_id, is_download, std::move(original_request),
-      std::move(target_ptr_info), std::move(cookie_manager), weak_impl_);
+      frame_token, process_id, is_download, std::move(original_receiver),
+      std::move(target_ptr_info), std::move(cookie_manager),
+      weak_factory_.GetWeakPtr());
   return true;
 }
 
 InterceptionJob::InterceptionJob(
-    DevToolsURLLoaderInterceptor::Impl* interceptor,
+    DevToolsURLLoaderInterceptor* interceptor,
     const std::string& id,
     const base::UnguessableToken& frame_token,
     int process_id,
@@ -733,10 +729,10 @@ bool InterceptionJob::CanGetResponseBody(std::string* error_reason) {
 }
 
 void InterceptionJob::GetResponseBody(
-    CrossThreadProtocolCallback<GetResponseBodyCallback> callback) {
+    std::unique_ptr<GetResponseBodyCallback> callback) {
   std::string error_reason;
   if (!CanGetResponseBody(&error_reason)) {
-    callback.sendFailure(Response::Error(std::move(error_reason)));
+    callback->sendFailure(Response::Error(std::move(error_reason)));
     return;
   }
   if (!body_reader_) {
@@ -752,11 +748,9 @@ void InterceptionJob::TakeResponseBodyPipe(
     TakeResponseBodyPipeCallback callback) {
   std::string error_reason;
   if (!CanGetResponseBody(&error_reason)) {
-    base::PostTask(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(std::move(callback),
-                       Response::Error(std::move(error_reason)),
-                       mojo::ScopedDataPipeConsumerHandle(), std::string()));
+    std::move(callback).Run(Response::Error(std::move(error_reason)),
+                            mojo::ScopedDataPipeConsumerHandle(),
+                            base::EmptyString());
     return;
   }
   DCHECK_EQ(state_, State::kResponseReceived);
@@ -769,13 +763,13 @@ void InterceptionJob::TakeResponseBodyPipe(
 
 void InterceptionJob::ContinueInterceptedRequest(
     std::unique_ptr<Modifications> modifications,
-    CrossThreadProtocolCallback<ContinueInterceptedRequestCallback> callback) {
+    std::unique_ptr<ContinueInterceptedRequestCallback> callback) {
   Response response = InnerContinueRequest(std::move(modifications));
   // |this| may be destroyed at this point.
   if (response.isSuccess())
-    callback.sendSuccess();
+    callback->sendSuccess();
   else
-    callback.sendFailure(std::move(response));
+    callback->sendFailure(std::move(response));
 }
 
 void InterceptionJob::Detach() {
@@ -923,15 +917,16 @@ void InterceptionJob::ApplyModificationsToRequest(
 }
 
 void InterceptionJob::ProcessAuthResponse(
-    const DevToolsNetworkInterceptor::AuthChallengeResponse& response) {
+    const DevToolsURLLoaderInterceptor::AuthChallengeResponse& response) {
   switch (response.response_type) {
-    case DevToolsNetworkInterceptor::AuthChallengeResponse::kDefault:
+    case DevToolsURLLoaderInterceptor::AuthChallengeResponse::kDefault:
       std::move(pending_auth_callback_).Run(true, base::nullopt);
       break;
-    case DevToolsNetworkInterceptor::AuthChallengeResponse::kCancelAuth:
+    case DevToolsURLLoaderInterceptor::AuthChallengeResponse::kCancelAuth:
       std::move(pending_auth_callback_).Run(false, base::nullopt);
       break;
-    case DevToolsNetworkInterceptor::AuthChallengeResponse::kProvideCredentials:
+    case DevToolsURLLoaderInterceptor::AuthChallengeResponse::
+        kProvideCredentials:
       std::move(pending_auth_callback_).Run(false, response.credentials);
       break;
   }
@@ -1041,7 +1036,8 @@ void InterceptionJob::ProcessSetCookies(const net::HttpResponseHeaders& headers,
       net::cookie_util::ComputeSameSiteContextForResponse(
           create_loader_params_->request.url,
           create_loader_params_->request.site_for_cookies,
-          create_loader_params_->request.request_initiator));
+          create_loader_params_->request.request_initiator,
+          create_loader_params_->request.attach_same_site_cookies));
 
   // |this| might be deleted here if |cookies| is empty!
   auto on_cookie_set = base::BindRepeating(
@@ -1070,9 +1066,8 @@ void InterceptionJob::ProcessRedirectByClient(const GURL& redirect_url) {
   response_metadata_->redirect_info = std::make_unique<net::RedirectInfo>(
       net::RedirectInfo::ComputeRedirectInfo(
           request.method, request.url, request.site_for_cookies,
-          request.top_frame_origin, first_party_url_policy,
-          request.referrer_policy, request.referrer.spec(),
-          headers.response_code(), redirect_url,
+          first_party_url_policy, request.referrer_policy,
+          request.referrer.spec(), headers.response_code(), redirect_url,
           net::RedirectUtil::GetReferrerPolicyHeader(&headers),
           false /* insecure_scheme_was_upgraded */, true /* copy_fragment */));
 
@@ -1210,9 +1205,7 @@ void InterceptionJob::NotifyClientWithCookies(
           create_loader_params_->request, cookie_line);
 
   waiting_for_resolution_ = true;
-  base::PostTask(FROM_HERE, {BrowserThread::UI},
-                 base::BindOnce(interceptor_->request_intercepted_callback_,
-                                std::move(request_info)));
+  interceptor_->request_intercepted_callback_.Run(std::move(request_info));
 }
 
 void InterceptionJob::Shutdown() {
@@ -1358,11 +1351,9 @@ void InterceptionJob::OnStartLoadingResponseBody(
   if (pending_response_body_pipe_callback_) {
     DCHECK_EQ(State::kResponseTaken, state_);
     DCHECK(!body_reader_);
-    base::PostTask(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(std::move(pending_response_body_pipe_callback_),
-                       Response::OK(), std::move(body),
-                       response_metadata_->head.mime_type));
+    std::move(pending_response_body_pipe_callback_)
+        .Run(Response::OK(), std::move(body),
+             response_metadata_->head.mime_type);
     return;
   }
   DCHECK_EQ(State::kResponseReceived, state_);
@@ -1428,8 +1419,8 @@ void DevToolsURLLoaderFactoryAdapter::CreateLoaderAndStart(
 }
 
 void DevToolsURLLoaderFactoryAdapter::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
-  factory_->Clone(std::move(request));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
+  factory_->Clone(std::move(receiver));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/devtools/devtools_url_loader_interceptor.h b/chromium/content/browser/devtools/devtools_url_loader_interceptor.h
index bf0e6aad652..6189168ef71 100644
--- a/chromium/content/browser/devtools/devtools_url_loader_interceptor.h
+++ b/chromium/content/browser/devtools/devtools_url_loader_interceptor.h
@@ -5,17 +5,158 @@
 #ifndef CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_URL_LOADER_INTERCEPTOR_H_
 #define CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_URL_LOADER_INTERCEPTOR_H_
 
+#include "base/callback.h"
+#include "base/containers/flat_set.h"
 #include "base/memory/weak_ptr.h"
-#include "content/browser/devtools/devtools_network_interceptor.h"
+#include "base/optional.h"
+#include "base/unguessable_token.h"
+#include "content/browser/devtools/protocol/network.h"
+#include "content/public/common/resource_type.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/system/data_pipe.h"
+#include "net/base/auth.h"
+#include "net/base/net_errors.h"
+#include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
+namespace net {
+class AuthChallengeInfo;
+class HttpResponseHeaders;
+}  // namespace net
+
 namespace content {
 
+class InterceptionJob;
 class RenderProcessHost;
+struct CreateLoaderParameters;
+
+struct InterceptedRequestInfo {
+  InterceptedRequestInfo();
+  ~InterceptedRequestInfo();
+
+  std::string interception_id;
+  base::UnguessableToken frame_id;
+  ResourceType resource_type;
+  bool is_navigation = false;
+  int response_error_code = net::OK;
+  std::unique_ptr<protocol::Network::Request> network_request;
+  std::unique_ptr<net::AuthChallengeInfo> auth_challenge;
+  scoped_refptr<net::HttpResponseHeaders> response_headers;
+  protocol::Maybe<bool> is_download;
+  protocol::Maybe<protocol::String> redirect_url;
+  protocol::Maybe<protocol::String> renderer_request_id;
+};
 
 class DevToolsURLLoaderInterceptor {
  public:
-  class Impl;
+  using RequestInterceptedCallback =
+      base::RepeatingCallback<void(std::unique_ptr<InterceptedRequestInfo>)>;
+  using ContinueInterceptedRequestCallback =
+      protocol::Network::Backend::ContinueInterceptedRequestCallback;
+  using GetResponseBodyForInterceptionCallback =
+      protocol::Network::Backend::GetResponseBodyForInterceptionCallback;
+  using TakeResponseBodyPipeCallback =
+      base::OnceCallback<void(protocol::Response,
+                              mojo::ScopedDataPipeConsumerHandle,
+                              const std::string& mime_type)>;
+
+  struct AuthChallengeResponse {
+    enum ResponseType {
+      kDefault,
+      kCancelAuth,
+      kProvideCredentials,
+    };
+
+    explicit AuthChallengeResponse(ResponseType response_type);
+    AuthChallengeResponse(const base::string16& username,
+                          const base::string16& password);
+
+    const ResponseType response_type;
+    const net::AuthCredentials credentials;
+
+    DISALLOW_COPY_AND_ASSIGN(AuthChallengeResponse);
+  };
+
+  struct Modifications {
+    using HeadersVector = std::vector<std::pair<std::string, std::string>>;
+
+    Modifications();
+    explicit Modifications(net::Error error_reason);
+    explicit Modifications(
+        std::unique_ptr<AuthChallengeResponse> auth_challenge_response);
+    Modifications(scoped_refptr<net::HttpResponseHeaders> response_headers,
+                  scoped_refptr<base::RefCountedMemory> response_body);
+    Modifications(protocol::Maybe<std::string> modified_url,
+                  protocol::Maybe<std::string> modified_method,
+                  protocol::Maybe<std::string> modified_post_data,
+                  std::unique_ptr<HeadersVector> modified_headers);
+    Modifications(
+        base::Optional<net::Error> error_reason,
+        scoped_refptr<net::HttpResponseHeaders> response_headers,
+        scoped_refptr<base::RefCountedMemory> response_body,
+        size_t body_offset,
+        protocol::Maybe<std::string> modified_url,
+        protocol::Maybe<std::string> modified_method,
+        protocol::Maybe<std::string> modified_post_data,
+        std::unique_ptr<HeadersVector> modified_headers,
+        std::unique_ptr<AuthChallengeResponse> auth_challenge_response);
+    ~Modifications();
+
+    // If none of the following are set then the request will be allowed to
+    // continue unchanged.
+    base::Optional<net::Error> error_reason;  // Finish with error.
+    // If either of the below fields is set, complete the request by
+    // responding with the provided headers and body.
+    scoped_refptr<net::HttpResponseHeaders> response_headers;
+    scoped_refptr<base::RefCountedMemory> response_body;
+    size_t body_offset = 0;
+
+    // Optionally modify before sending to network.
+    protocol::Maybe<std::string> modified_url;
+    protocol::Maybe<std::string> modified_method;
+    protocol::Maybe<std::string> modified_post_data;
+    std::unique_ptr<HeadersVector> modified_headers;
+    // AuthChallengeResponse is mutually exclusive with the above.
+    std::unique_ptr<AuthChallengeResponse> auth_challenge_response;
+  };
+
+  enum InterceptionStage {
+    DONT_INTERCEPT = 0,
+    REQUEST = (1 << 0),
+    RESPONSE = (1 << 1),
+    // Note: Both is not sent from front-end. It is used if both Request
+    // and HeadersReceived was found it upgrades it to Both.
+    BOTH = (REQUEST | RESPONSE),
+  };
+
+  struct Pattern {
+   public:
+    ~Pattern();
+    Pattern(const Pattern& other);
+    Pattern(const std::string& url_pattern,
+            base::flat_set<ResourceType> resource_types,
+            InterceptionStage interception_stage);
+
+    bool Matches(const std::string& url, ResourceType resource_type) const;
+
+    const std::string url_pattern;
+    const base::flat_set<ResourceType> resource_types;
+    const InterceptionStage interception_stage;
+  };
+
+  struct FilterEntry {
+    FilterEntry(const base::UnguessableToken& target_id,
+                std::vector<Pattern> patterns,
+                RequestInterceptedCallback callback);
+    FilterEntry(FilterEntry&&);
+    ~FilterEntry();
+
+    const base::UnguessableToken target_id;
+    std::vector<Pattern> patterns;
+    const RequestInterceptedCallback callback;
+
+    DISALLOW_COPY_AND_ASSIGN(FilterEntry);
+  };
 
   using HandleAuthRequestCallback =
       base::OnceCallback<void(bool use_fallback,
@@ -27,27 +168,20 @@ class DevToolsURLLoaderInterceptor {
                                 const net::AuthChallengeInfo& auth_info,
                                 HandleAuthRequestCallback callback);
 
-  explicit DevToolsURLLoaderInterceptor(
-      DevToolsNetworkInterceptor::RequestInterceptedCallback callback);
+  explicit DevToolsURLLoaderInterceptor(RequestInterceptedCallback callback);
   ~DevToolsURLLoaderInterceptor();
 
-  void SetPatterns(std::vector<DevToolsNetworkInterceptor::Pattern> patterns,
-                   bool handle_auth);
+  void SetPatterns(std::vector<Pattern> patterns, bool handle_auth);
 
   void GetResponseBody(
       const std::string& interception_id,
-      std::unique_ptr<
-          DevToolsNetworkInterceptor::GetResponseBodyForInterceptionCallback>
-          callback);
-  void TakeResponseBodyPipe(
-      const std::string& interception_id,
-      DevToolsNetworkInterceptor::TakeResponseBodyPipeCallback callback);
+      std::unique_ptr<GetResponseBodyForInterceptionCallback> callback);
+  void TakeResponseBodyPipe(const std::string& interception_id,
+                            TakeResponseBodyPipeCallback callback);
   void ContinueInterceptedRequest(
       const std::string& interception_id,
-      std::unique_ptr<DevToolsNetworkInterceptor::Modifications> modifications,
-      std::unique_ptr<
-          DevToolsNetworkInterceptor::ContinueInterceptedRequestCallback>
-          callback);
+      std::unique_ptr<Modifications> modifications,
+      std::unique_ptr<ContinueInterceptedRequestCallback> callback);
 
   bool CreateProxyForInterception(
       RenderProcessHost* rph,
@@ -55,12 +189,49 @@ class DevToolsURLLoaderInterceptor {
       bool is_navigation,
       bool is_download,
       mojo::PendingReceiver<network::mojom::URLLoaderFactory>*
-          target_factory_receiver) const;
+          target_factory_receiver);
 
  private:
-  bool enabled_;
-  std::unique_ptr<Impl, base::OnTaskRunnerDeleter> impl_;
-  base::WeakPtr<Impl> weak_impl_;
+  friend class InterceptionJob;
+  friend class DevToolsURLLoaderFactoryProxy;
+
+  void CreateJob(
+      const base::UnguessableToken& frame_token,
+      int32_t process_id,
+      bool is_download,
+      const base::Optional<std::string>& renderer_request_id,
+      std::unique_ptr<CreateLoaderParameters> create_params,
+      network::mojom::URLLoaderRequest loader_request,
+      network::mojom::URLLoaderClientPtr client,
+      network::mojom::URLLoaderFactoryPtr target_factory,
+      mojo::PendingRemote<network::mojom::CookieManager> cookie_manager);
+
+  InterceptionStage GetInterceptionStage(const GURL& url,
+                                         ResourceType resource_type) const;
+
+  template <typename Callback>
+  InterceptionJob* FindJob(const std::string& id,
+                           std::unique_ptr<Callback>* callback) {
+    auto it = jobs_.find(id);
+    if (it != jobs_.end())
+      return it->second;
+    (*callback)->sendFailure(
+        protocol::Response::InvalidParams("Invalid InterceptionId."));
+    return nullptr;
+  }
+
+  void RemoveJob(const std::string& id) { jobs_.erase(id); }
+  void AddJob(const std::string& id, InterceptionJob* job) {
+    jobs_.emplace(id, job);
+  }
+
+  const RequestInterceptedCallback request_intercepted_callback_;
+
+  std::vector<Pattern> patterns_;
+  bool handle_auth_ = false;
+  std::map<std::string, InterceptionJob*> jobs_;
+
+  base::WeakPtrFactory<DevToolsURLLoaderInterceptor> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(DevToolsURLLoaderInterceptor);
 };
@@ -89,11 +260,19 @@ class DevToolsURLLoaderFactoryAdapter
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
   network::mojom::URLLoaderFactoryPtr factory_;
 };
 
+inline DevToolsURLLoaderInterceptor::InterceptionStage& operator|=(
+    DevToolsURLLoaderInterceptor::InterceptionStage& a,
+    const DevToolsURLLoaderInterceptor::InterceptionStage& b) {
+  a = static_cast<DevToolsURLLoaderInterceptor::InterceptionStage>(a | b);
+  return a;
+}
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_DEVTOOLS_DEVTOOLS_URL_LOADER_INTERCEPTOR_H_
diff --git a/chromium/content/browser/devtools/devtools_video_consumer_unittest.cc b/chromium/content/browser/devtools/devtools_video_consumer_unittest.cc
index 2701b054b3e..ee5038fdf55 100644
--- a/chromium/content/browser/devtools/devtools_video_consumer_unittest.cc
+++ b/chromium/content/browser/devtools/devtools_video_consumer_unittest.cc
@@ -13,7 +13,10 @@
 #include "media/base/limits.h"
 #include "media/capture/mojom/video_capture_types.mojom.h"
 #include "mojo/public/cpp/base/shared_memory_utils.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 using testing::_;
@@ -35,17 +38,17 @@ constexpr viz::FrameSinkId kInitialFrameSinkId = viz::FrameSinkId(1, 1);
 // Mock for the FrameSinkVideoCapturer running in the VIZ process.
 class MockFrameSinkVideoCapturer : public viz::mojom::FrameSinkVideoCapturer {
  public:
-  MockFrameSinkVideoCapturer() : binding_(this) {}
+  MockFrameSinkVideoCapturer() {}
 
-  bool is_bound() const { return binding_.is_bound(); }
+  bool is_bound() const { return receiver_.is_bound(); }
 
   void Bind(viz::mojom::FrameSinkVideoCapturerRequest request) {
-    DCHECK(!binding_.is_bound());
-    binding_.Bind(std::move(request));
+    DCHECK(!receiver_.is_bound());
+    receiver_.Bind(std::move(request));
   }
 
   void Reset() {
-    binding_.Close();
+    receiver_.reset();
     consumer_.reset();
   }
 
@@ -83,22 +86,25 @@ class MockFrameSinkVideoCapturer : public viz::mojom::FrameSinkVideoCapturer {
     MockChangeTarget(frame_sink_id_);
   }
   MOCK_METHOD1(MockChangeTarget, void(const viz::FrameSinkId& frame_sink_id));
-  void Start(viz::mojom::FrameSinkVideoConsumerPtr consumer) final {
+  void Start(
+      mojo::PendingRemote<viz::mojom::FrameSinkVideoConsumer> consumer) final {
     DCHECK(!consumer_);
-    consumer_ = std::move(consumer);
+    consumer_.Bind(std::move(consumer));
     MockStart(consumer_.get());
   }
   MOCK_METHOD1(MockStart, void(viz::mojom::FrameSinkVideoConsumer* consumer));
   void Stop() final {
-    binding_.Close();
+    receiver_.reset();
     consumer_.reset();
     MockStop();
   }
   MOCK_METHOD0(MockStop, void());
   MOCK_METHOD0(RequestRefreshFrame, void());
-  MOCK_METHOD2(CreateOverlay,
-               void(int32_t stacking_index,
-                    viz::mojom::FrameSinkVideoCaptureOverlayRequest request));
+  MOCK_METHOD2(
+      CreateOverlay,
+      void(int32_t stacking_index,
+           mojo::PendingReceiver<viz::mojom::FrameSinkVideoCaptureOverlay>
+               receiver));
 
   // Const accessors to get the cached variables.
   base::TimeDelta min_capture_period() const { return min_capture_period_; }
@@ -115,9 +121,9 @@ class MockFrameSinkVideoCapturer : public viz::mojom::FrameSinkVideoCapturer {
   gfx::Size min_frame_size_;
   gfx::Size max_frame_size_;
   viz::FrameSinkId frame_sink_id_;
-  viz::mojom::FrameSinkVideoConsumerPtr consumer_;
+  mojo::Remote<viz::mojom::FrameSinkVideoConsumer> consumer_;
 
-  mojo::Binding<viz::mojom::FrameSinkVideoCapturer> binding_;
+  mojo::Receiver<viz::mojom::FrameSinkVideoCapturer> receiver_{this};
 };
 
 // Represents the FrameSinkVideoConsumerFrameCallbacks instance in the VIZ
@@ -125,17 +131,18 @@ class MockFrameSinkVideoCapturer : public viz::mojom::FrameSinkVideoCapturer {
 class MockFrameSinkVideoConsumerFrameCallbacks
     : public viz::mojom::FrameSinkVideoConsumerFrameCallbacks {
  public:
-  MockFrameSinkVideoConsumerFrameCallbacks() : binding_(this) {}
+  MockFrameSinkVideoConsumerFrameCallbacks() {}
 
   void Bind(viz::mojom::FrameSinkVideoConsumerFrameCallbacksRequest request) {
-    binding_.Bind(std::move(request));
+    receiver_.Bind(std::move(request));
   }
 
   MOCK_METHOD0(Done, void());
   MOCK_METHOD1(ProvideFeedback, void(double utilization));
 
  private:
-  mojo::Binding<viz::mojom::FrameSinkVideoConsumerFrameCallbacks> binding_;
+  mojo::Receiver<viz::mojom::FrameSinkVideoConsumerFrameCallbacks> receiver_{
+      this};
 };
 
 // Mock for the classes like TracingHandler that receive frames from
@@ -233,7 +240,7 @@ class DevToolsVideoConsumerTest : public testing::Test {
             weak_factory_.GetWeakPtr()));
   }
 
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   base::WeakPtrFactory<DevToolsVideoConsumerTest> weak_factory_{this};
 };
 
diff --git a/chromium/content/browser/devtools/inspector_fuzzer.cc b/chromium/content/browser/devtools/inspector_fuzzer.cc
index 4c45d1e8499..37fe4738c71 100644
--- a/chromium/content/browser/devtools/inspector_fuzzer.cc
+++ b/chromium/content/browser/devtools/inspector_fuzzer.cc
@@ -12,22 +12,20 @@
 
 // Entry point for LibFuzzer.
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
-  using namespace inspector_protocol_encoding;
-
   if (size > 64 * 1024) {
     return 0;
   }
 
-  span<uint8_t> fuzz{data, size};
+  inspector_protocol_encoding::span<uint8_t> fuzz{data, size};
 
   // We need to handle whatever the parser parses. So, we handle the parsed
   // stuff with another CBOR encoder, just because it's conveniently available.
   std::vector<uint8_t> encoded;
-  Status status;
-  std::unique_ptr<StreamingParserHandler> encoder =
-      cbor::NewCBOREncoder(&encoded, &status);
+  inspector_protocol_encoding::Status status;
+  std::unique_ptr<inspector_protocol_encoding::StreamingParserHandler> encoder =
+      inspector_protocol_encoding::cbor::NewCBOREncoder(&encoded, &status);
 
-  cbor::ParseCBOR(fuzz, encoder.get());
+  inspector_protocol_encoding::cbor::ParseCBOR(fuzz, encoder.get());
 
   return 0;
 }
diff --git a/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc b/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
index ba450b560e6..15a5fd0dca6 100644
--- a/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
+++ b/chromium/content/browser/devtools/protocol/devtools_protocol_browsertest.cc
@@ -2408,9 +2408,9 @@ IN_PROC_BROWSER_TEST_F(DevToolsDownloadContentTest, MAYBE_MultiDownload) {
 
   // Allow the first request to finish.
   std::unique_ptr<DownloadTestObserver> observer2(CreateWaiter(shell(), 1));
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL(
-                    content::SlowDownloadHttpResponse::kFinishDownloadUrl));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL(
+                   content::SlowDownloadHttpResponse::kFinishDownloadUrl)));
   observer2->WaitForFinished();  // Wait for the third request.
   EXPECT_EQ(
       1u, observer2->NumDownloadsSeenInState(download::DownloadItem::COMPLETE));
diff --git a/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.cc b/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.cc
index 532f432f15e..423a324c3f1 100644
--- a/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.cc
+++ b/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.cc
@@ -32,11 +32,6 @@ DevToolsProtocolTest::DevToolsProtocolTest()
 
 DevToolsProtocolTest::~DevToolsProtocolTest() = default;
 
-void DevToolsProtocolTest::SetUpCommandLine(base::CommandLine* command_line) {
-  ContentBrowserTest::SetUpCommandLine(command_line);
-  command_line->AppendSwitch(switches::kAllowPreCommitInput);
-}
-
 void DevToolsProtocolTest::SetUpOnMainThread() {
   host_resolver()->AddRule("*", "127.0.0.1");
 }
@@ -144,7 +139,7 @@ DevToolsProtocolTest::WaitForNotification(const std::string& notification,
   return std::move(waiting_for_notification_params_);
 }
 
-blink::WebSecurityStyle DevToolsProtocolTest::GetSecurityStyle(
+blink::SecurityStyle DevToolsProtocolTest::GetSecurityStyle(
     content::WebContents* web_contents,
     content::SecurityStyleExplanations* security_style_explanations) {
   security_style_explanations->secure_explanations.push_back(
@@ -152,7 +147,7 @@ blink::WebSecurityStyle DevToolsProtocolTest::GetSecurityStyle(
           "an explanation title", "an explanation summary",
           "an explanation description", cert_,
           blink::WebMixedContentContextType::kNotMixedContent));
-  return blink::kWebSecurityStyleNeutral;
+  return blink::SecurityStyle::kNeutral;
 }
 
 std::unique_ptr<base::DictionaryValue>
diff --git a/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.h b/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.h
index a2a7d60215d..784d674cd71 100644
--- a/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.h
+++ b/chromium/content/browser/devtools/protocol/devtools_protocol_test_support.h
@@ -26,8 +26,6 @@ class DevToolsProtocolTest : public ContentBrowserTest,
   DevToolsProtocolTest();
   ~DevToolsProtocolTest() override;
 
-  void SetUpCommandLine(base::CommandLine* command_line) override;
-
   void SetUpOnMainThread() override;
 
  protected:
@@ -38,7 +36,7 @@ class DevToolsProtocolTest : public ContentBrowserTest,
                               int32_t line_no,
                               const base::string16& source_id) override;
 
-  blink::WebSecurityStyle GetSecurityStyle(
+  blink::SecurityStyle GetSecurityStyle(
       content::WebContents* web_contents,
       content::SecurityStyleExplanations* security_style_explanations) override;
 
diff --git a/chromium/content/browser/devtools/protocol/emulation_handler.cc b/chromium/content/browser/devtools/protocol/emulation_handler.cc
index 18b6e546804..b2ffbf81c4c 100644
--- a/chromium/content/browser/devtools/protocol/emulation_handler.cc
+++ b/chromium/content/browser/devtools/protocol/emulation_handler.cc
@@ -103,7 +103,7 @@ Response EmulationHandler::Disable() {
 
 Response EmulationHandler::SetGeolocationOverride(
     Maybe<double> latitude, Maybe<double> longitude, Maybe<double> accuracy) {
-  if (!GetWebContents())
+  if (!host_)
     return Response::InternalError();
 
   auto* geolocation_context = GetWebContents()->GetGeolocationContext();
@@ -126,7 +126,7 @@ Response EmulationHandler::SetGeolocationOverride(
 }
 
 Response EmulationHandler::ClearGeolocationOverride() {
-  if (!GetWebContents())
+  if (!host_)
     return Response::InternalError();
 
   auto* geolocation_context = GetWebContents()->GetGeolocationContext();
@@ -148,10 +148,11 @@ Response EmulationHandler::CanEmulate(bool* result) {
   *result = false;
 #else
   *result = true;
-  if (WebContentsImpl* web_contents = GetWebContents())
-    *result &= !web_contents->GetVisibleURL().SchemeIs(kChromeDevToolsScheme);
-  if (host_ && host_->GetRenderWidgetHost())
-    *result &= !host_->GetRenderWidgetHost()->auto_resize_enabled();
+  if (host_) {
+    if (GetWebContents()->GetVisibleURL().SchemeIs(kChromeDevToolsScheme) ||
+        host_->GetRenderWidgetHost()->auto_resize_enabled())
+      *result = false;
+  }
 #endif  // defined(OS_ANDROID)
   return Response::OK();
 }
@@ -173,9 +174,7 @@ Response EmulationHandler::SetDeviceMetricsOverride(
   const static double max_scale = 10;
   const static int max_orientation_angle = 360;
 
-  RenderWidgetHostImpl* widget_host =
-      host_ ? host_->GetRenderWidgetHost() : nullptr;
-  if (!widget_host)
+  if (!host_)
     return Response::Error("Target does not support metrics override");
 
   if (screen_width.fromMaybe(0) < 0 || screen_height.fromMaybe(0) < 0 ||
@@ -243,7 +242,7 @@ Response EmulationHandler::SetDeviceMetricsOverride(
     params.viewport_offset.y = viewport.fromJust()->GetY();
 
     ScreenInfo screen_info;
-    widget_host->GetScreenInfo(&screen_info);
+    host_->GetRenderWidgetHost()->GetScreenInfo(&screen_info);
     double dpfactor = device_scale_factor ? device_scale_factor /
                                                 screen_info.device_scale_factor
                                           : 1;
@@ -289,17 +288,16 @@ Response EmulationHandler::SetDeviceMetricsOverride(
 Response EmulationHandler::ClearDeviceMetricsOverride() {
   if (!device_emulation_enabled_)
     return Response::OK();
-  if (GetWebContents())
-    GetWebContents()->ClearDeviceEmulationSize();
-  else
+  if (!host_)
     return Response::Error("Can't find the associated web contents");
+  GetWebContents()->ClearDeviceEmulationSize();
   device_emulation_enabled_ = false;
   device_emulation_params_ = blink::WebDeviceEmulationParams();
   UpdateDeviceEmulationState();
   // Renderer should answer after emulation was disabled, so that the response
   // is only sent to the client once updates were applied.
   // Unless the renderer has crashed.
-  if (GetWebContents() && GetWebContents()->IsCrashed())
+  if (GetWebContents()->IsCrashed())
     return Response::OK();
   return Response::FallThrough();
 }
@@ -308,11 +306,9 @@ Response EmulationHandler::SetVisibleSize(int width, int height) {
   if (width < 0 || height < 0)
     return Response::InvalidParams("Width and height must be non-negative");
 
-  if (GetWebContents())
-    GetWebContents()->SetDeviceEmulationSize(gfx::Size(width, height));
-  else
+  if (!host_)
     return Response::Error("Can't find the associated web contents");
-
+  GetWebContents()->SetDeviceEmulationSize(gfx::Size(width, height));
   return Response::OK();
 }
 
@@ -340,23 +336,21 @@ blink::WebDeviceEmulationParams EmulationHandler::GetDeviceEmulationParams() {
 void EmulationHandler::SetDeviceEmulationParams(
     const blink::WebDeviceEmulationParams& params) {
   bool enabled = params != blink::WebDeviceEmulationParams();
-  device_emulation_enabled_ = enabled;
-  device_emulation_params_ = params;
-  UpdateDeviceEmulationState();
+  if (params != device_emulation_params_) {
+    device_emulation_enabled_ = enabled;
+    device_emulation_params_ = params;
+    UpdateDeviceEmulationState();
+  }
 }
 
 WebContentsImpl* EmulationHandler::GetWebContents() {
-  return host_ ?
-      static_cast<WebContentsImpl*>(WebContents::FromRenderFrameHost(host_)) :
-      nullptr;
+  DCHECK(host_);  // Only call if |host_| is set.
+  return static_cast<WebContentsImpl*>(WebContents::FromRenderFrameHost(host_));
 }
 
 void EmulationHandler::UpdateTouchEventEmulationState() {
-  if (!host_ || !host_->GetRenderWidgetHost())
-    return;
-  if (host_->GetParent() && !host_->IsCrossProcessSubframe())
+  if (!host_)
     return;
-
   // We only have a single TouchEmulator for all frames, so let the main frame's
   // EmulationHandler enable/disable it.
   if (!host_->frame_tree_node()->IsMainFrame())
@@ -373,17 +367,16 @@ void EmulationHandler::UpdateTouchEventEmulationState() {
     if (auto* touch_emulator = host_->GetRenderWidgetHost()->GetTouchEmulator())
       touch_emulator->Disable();
   }
-  if (GetWebContents()) {
-    GetWebContents()->SetForceDisableOverscrollContent(
-        touch_emulation_enabled_);
-  }
+  GetWebContents()->SetForceDisableOverscrollContent(touch_emulation_enabled_);
 }
 
 void EmulationHandler::UpdateDeviceEmulationState() {
-  if (!host_ || !host_->GetRenderWidgetHost())
+  if (!host_)
     return;
-  if (host_->GetParent() && !host_->IsCrossProcessSubframe())
+  // Device emulation only happens on the main frame.
+  if (!host_->frame_tree_node()->IsMainFrame())
     return;
+
   // TODO(eseckler): Once we change this to mojo, we should wait for an ack to
   // these messages from the renderer. The renderer should send the ack once the
   // emulation params were applied. That way, we can avoid having to handle
diff --git a/chromium/content/browser/devtools/protocol/fetch_handler.cc b/chromium/content/browser/devtools/protocol/fetch_handler.cc
index 28f654d9a93..fad1d3ccb74 100644
--- a/chromium/content/browser/devtools/protocol/fetch_handler.cc
+++ b/chromium/content/browser/devtools/protocol/fetch_handler.cc
@@ -44,23 +44,23 @@ void FetchHandler::Wire(UberDispatcher* dispatcher) {
   Fetch::Dispatcher::wire(dispatcher, this);
 }
 
-DevToolsNetworkInterceptor::InterceptionStage RequestStageToInterceptorStage(
+DevToolsURLLoaderInterceptor::InterceptionStage RequestStageToInterceptorStage(
     const Fetch::RequestStage& stage) {
   if (stage == Fetch::RequestStageEnum::Request)
-    return DevToolsNetworkInterceptor::REQUEST;
+    return DevToolsURLLoaderInterceptor::REQUEST;
   if (stage == Fetch::RequestStageEnum::Response)
-    return DevToolsNetworkInterceptor::RESPONSE;
+    return DevToolsURLLoaderInterceptor::RESPONSE;
   NOTREACHED();
-  return DevToolsNetworkInterceptor::REQUEST;
+  return DevToolsURLLoaderInterceptor::REQUEST;
 }
 
 Response ToInterceptionPatterns(
     const Maybe<Array<Fetch::RequestPattern>>& maybe_patterns,
-    std::vector<DevToolsNetworkInterceptor::Pattern>* result) {
+    std::vector<DevToolsURLLoaderInterceptor::Pattern>* result) {
   result->clear();
   if (!maybe_patterns.isJust()) {
     result->emplace_back("*", base::flat_set<ResourceType>(),
-                         DevToolsNetworkInterceptor::REQUEST);
+                         DevToolsURLLoaderInterceptor::REQUEST);
     return Response::OK();
   }
   Array<Fetch::RequestPattern>& patterns = *maybe_patterns.fromJust();
@@ -103,7 +103,7 @@ void FetchHandler::Enable(Maybe<Array<Fetch::RequestPattern>> patterns,
         std::make_unique<DevToolsURLLoaderInterceptor>(base::BindRepeating(
             &FetchHandler::RequestIntercepted, weak_factory_.GetWeakPtr()));
   }
-  std::vector<DevToolsNetworkInterceptor::Pattern> interception_patterns;
+  std::vector<DevToolsURLLoaderInterceptor::Pattern> interception_patterns;
   Response response = ToInterceptionPatterns(patterns, &interception_patterns);
   if (!response.isSuccess()) {
     callback->sendFailure(response);
@@ -130,7 +130,7 @@ Response FetchHandler::Disable() {
 
 namespace {
 using ContinueInterceptedRequestCallback =
-    DevToolsNetworkInterceptor::ContinueInterceptedRequestCallback;
+    DevToolsURLLoaderInterceptor::ContinueInterceptedRequestCallback;
 
 template <typename Callback, typename Base, typename... Args>
 class CallbackWrapper : public Base {
@@ -186,7 +186,7 @@ void FetchHandler::FailRequest(const String& requestId,
     return;
   }
   auto modifications =
-      std::make_unique<DevToolsNetworkInterceptor::Modifications>(reason);
+      std::make_unique<DevToolsURLLoaderInterceptor::Modifications>(reason);
   interceptor_->ContinueInterceptedRequest(requestId, std::move(modifications),
                                            WrapCallback(std::move(callback)));
 }
@@ -194,7 +194,8 @@ void FetchHandler::FailRequest(const String& requestId,
 void FetchHandler::FulfillRequest(
     const String& requestId,
     int responseCode,
-    std::unique_ptr<Array<Fetch::HeaderEntry>> responseHeaders,
+    Maybe<Array<Fetch::HeaderEntry>> responseHeaders,
+    Maybe<Binary> binaryResponseHeaders,
     Maybe<Binary> body,
     Maybe<String> responsePhrase,
     std::unique_ptr<FulfillRequestCallback> callback) {
@@ -209,14 +210,19 @@ void FetchHandler::FulfillRequest(
                 static_cast<net::HttpStatusCode>(responseCode));
   if (status_phrase.empty()) {
     callback->sendFailure(
-        Response::Error("Invalid http status code or phrase"));
+        Response::InvalidParams("Invalid http status code or phrase"));
     return;
   }
   std::string headers =
       base::StringPrintf("HTTP/1.1 %d %s", responseCode, status_phrase.c_str());
   headers.append(1, '\0');
-  if (responseHeaders) {
-    for (const std::unique_ptr<Fetch::HeaderEntry>& entry : *responseHeaders) {
+  if (responseHeaders.isJust()) {
+    if (binaryResponseHeaders.isJust()) {
+      callback->sendFailure(Response::InvalidParams(
+          "Only one of responseHeaders or binaryHeaders may be present"));
+      return;
+    }
+    for (const auto& entry : *responseHeaders.fromJust()) {
       if (!ValidateHeaders(entry.get(), callback.get()))
         return;
       headers.append(entry->GetName());
@@ -224,10 +230,16 @@ void FetchHandler::FulfillRequest(
       headers.append(entry->GetValue());
       headers.append(1, '\0');
     }
+  } else if (binaryResponseHeaders.isJust()) {
+    Binary response_headers = binaryResponseHeaders.fromJust();
+    headers.append(reinterpret_cast<const char*>(response_headers.data()),
+                   response_headers.size());
+    if (headers.back() != '\0')
+      headers.append(1, '\0');
   }
   headers.append(1, '\0');
   auto modifications =
-      std::make_unique<DevToolsNetworkInterceptor::Modifications>(
+      std::make_unique<DevToolsURLLoaderInterceptor::Modifications>(
           base::MakeRefCounted<net::HttpResponseHeaders>(headers),
           body.isJust() ? body.fromJust().bytes() : nullptr);
   interceptor_->ContinueInterceptedRequest(requestId, std::move(modifications),
@@ -245,11 +257,11 @@ void FetchHandler::ContinueRequest(
     callback->sendFailure(Response::Error("Fetch domain is not enabled"));
     return;
   }
-  std::unique_ptr<DevToolsNetworkInterceptor::Modifications::HeadersVector>
+  std::unique_ptr<DevToolsURLLoaderInterceptor::Modifications::HeadersVector>
       request_headers;
   if (headers.isJust()) {
     request_headers = std::make_unique<
-        DevToolsNetworkInterceptor::Modifications::HeadersVector>();
+        DevToolsURLLoaderInterceptor::Modifications::HeadersVector>();
     for (const std::unique_ptr<Fetch::HeaderEntry>& entry :
          *headers.fromJust()) {
       if (!ValidateHeaders(entry.get(), callback.get()))
@@ -258,7 +270,7 @@ void FetchHandler::ContinueRequest(
     }
   }
   auto modifications =
-      std::make_unique<DevToolsNetworkInterceptor::Modifications>(
+      std::make_unique<DevToolsURLLoaderInterceptor::Modifications>(
           std::move(url), std::move(method), std::move(postData),
           std::move(request_headers));
   interceptor_->ContinueInterceptedRequest(requestId, std::move(modifications),
@@ -275,7 +287,7 @@ void FetchHandler::ContinueWithAuth(
     return;
   }
   using AuthChallengeResponse =
-      DevToolsNetworkInterceptor::AuthChallengeResponse;
+      DevToolsURLLoaderInterceptor::AuthChallengeResponse;
   std::unique_ptr<AuthChallengeResponse> auth_response;
   std::string type = authChallengeResponse->GetResponse();
   if (type == Network::AuthChallengeResponse::ResponseEnum::Default) {
@@ -295,7 +307,7 @@ void FetchHandler::ContinueWithAuth(
     return;
   }
   auto modifications =
-      std::make_unique<DevToolsNetworkInterceptor::Modifications>(
+      std::make_unique<DevToolsURLLoaderInterceptor::Modifications>(
           std::move(auth_response));
   interceptor_->ContinueInterceptedRequest(requestId, std::move(modifications),
                                            WrapCallback(std::move(callback)));
@@ -306,7 +318,7 @@ void FetchHandler::GetResponseBody(
     std::unique_ptr<GetResponseBodyCallback> callback) {
   auto weapped_callback = std::make_unique<CallbackWrapper<
       GetResponseBodyCallback,
-      DevToolsNetworkInterceptor::GetResponseBodyForInterceptionCallback,
+      DevToolsURLLoaderInterceptor::GetResponseBodyForInterceptionCallback,
       const std::string&, bool>>(std::move(callback));
   interceptor_->GetResponseBody(requestId, std::move(weapped_callback));
 }
diff --git a/chromium/content/browser/devtools/protocol/fetch_handler.h b/chromium/content/browser/devtools/protocol/fetch_handler.h
index a874a8202bb..27adeb1e1c1 100644
--- a/chromium/content/browser/devtools/protocol/fetch_handler.h
+++ b/chromium/content/browser/devtools/protocol/fetch_handler.h
@@ -57,7 +57,8 @@ class FetchHandler : public DevToolsDomainHandler, public Fetch::Backend {
   void FulfillRequest(
       const String& fetchId,
       int responseCode,
-      std::unique_ptr<Array<Fetch::HeaderEntry>> responseHeaders,
+      Maybe<Array<Fetch::HeaderEntry>> responseHeaders,
+      Maybe<Binary> binaryResponseHeaders,
       Maybe<Binary> body,
       Maybe<String> responsePhrase,
       std::unique_ptr<FulfillRequestCallback> callback) override;
diff --git a/chromium/content/browser/devtools/protocol/network_handler.cc b/chromium/content/browser/devtools/protocol/network_handler.cc
index e72f1348870..e8e3e5f5573 100644
--- a/chromium/content/browser/devtools/protocol/network_handler.cc
+++ b/chromium/content/browser/devtools/protocol/network_handler.cc
@@ -6,6 +6,7 @@
 
 #include <stddef.h>
 #include <stdint.h>
+#include <memory>
 
 #include "base/barrier_closure.h"
 #include "base/base64.h"
@@ -128,7 +129,6 @@ std::unique_ptr<Network::Cookie> BuildCookie(
           .SetSession(!cookie.IsPersistent())
           .Build();
 
-  DCHECK(net::IsValidSameSiteValue(cookie.SameSite()));
   switch (cookie.SameSite()) {
     case net::CookieSameSite::STRICT_MODE:
       devtools_cookie->SetSameSite(Network::CookieSameSiteEnum::Strict);
@@ -142,7 +142,7 @@ std::unique_ptr<Network::Cookie> BuildCookie(
     case net::CookieSameSite::NO_RESTRICTION:
       devtools_cookie->SetSameSite(Network::CookieSameSiteEnum::None);
       break;
-    default:
+    case net::CookieSameSite::UNSPECIFIED:
       break;
   }
   return devtools_cookie;
@@ -411,15 +411,15 @@ String securityState(const GURL& url, const net::CertStatus& cert_status) {
   return Security::SecurityStateEnum::Secure;
 }
 
-DevToolsNetworkInterceptor::InterceptionStage ToInterceptorStage(
+DevToolsURLLoaderInterceptor::InterceptionStage ToInterceptorStage(
     const protocol::Network::InterceptionStage& interceptor_stage) {
   if (interceptor_stage == protocol::Network::InterceptionStageEnum::Request)
-    return DevToolsNetworkInterceptor::REQUEST;
+    return DevToolsURLLoaderInterceptor::REQUEST;
   if (interceptor_stage ==
       protocol::Network::InterceptionStageEnum::HeadersReceived)
-    return DevToolsNetworkInterceptor::RESPONSE;
+    return DevToolsURLLoaderInterceptor::RESPONSE;
   NOTREACHED();
-  return DevToolsNetworkInterceptor::REQUEST;
+  return DevToolsURLLoaderInterceptor::REQUEST;
 }
 
 double timeDelta(base::TimeTicks time,
@@ -567,120 +567,131 @@ std::unique_ptr<Array<Network::SignedExchangeError>> BuildSignedExchangeErrors(
   return signed_exchange_errors;
 }
 
-// TODO(crbug.com/993843): Make this return an array of reasons, not just the
-// first one.
-base::Optional<Network::SetCookieBlockedReason>
+std::unique_ptr<Array<Network::SetCookieBlockedReason>>
 GetProtocolBlockedSetCookieReason(
     net::CanonicalCookie::CookieInclusionStatus status) {
+  std::unique_ptr<Array<Network::SetCookieBlockedReason>> blockedReasons =
+      std::make_unique<Array<Network::SetCookieBlockedReason>>();
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_SECURE_ONLY)) {
-    return Network::SetCookieBlockedReasonEnum::SecureOnly;
+    blockedReasons->push_back(Network::SetCookieBlockedReasonEnum::SecureOnly);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_SAMESITE_STRICT)) {
-    return Network::SetCookieBlockedReasonEnum::SameSiteStrict;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::SameSiteStrict);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_SAMESITE_LAX)) {
-    return Network::SetCookieBlockedReasonEnum::SameSiteLax;
+    blockedReasons->push_back(Network::SetCookieBlockedReasonEnum::SameSiteLax);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_SAMESITE_EXTENDED)) {
-    return Network::SetCookieBlockedReasonEnum::SameSiteExtended;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::SameSiteExtended);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::
               EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX)) {
-    return Network::SetCookieBlockedReasonEnum::SameSiteUnspecifiedTreatedAsLax;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::SameSiteUnspecifiedTreatedAsLax);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_SAMESITE_NONE_INSECURE)) {
-    return Network::SetCookieBlockedReasonEnum::SameSiteNoneInsecure;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::SameSiteNoneInsecure);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_USER_PREFERENCES)) {
-    return Network::SetCookieBlockedReasonEnum::UserPreferences;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::UserPreferences);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_FAILURE_TO_STORE)) {
-    return Network::SetCookieBlockedReasonEnum::SyntaxError;
+    blockedReasons->push_back(Network::SetCookieBlockedReasonEnum::SyntaxError);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_NONCOOKIEABLE_SCHEME)) {
-    return Network::SetCookieBlockedReasonEnum::SchemeNotSupported;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::SchemeNotSupported);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_OVERWRITE_SECURE)) {
-    return Network::SetCookieBlockedReasonEnum::OverwriteSecure;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::OverwriteSecure);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_INVALID_DOMAIN)) {
-    return Network::SetCookieBlockedReasonEnum::InvalidDomain;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::InvalidDomain);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_INVALID_PREFIX)) {
-    return Network::SetCookieBlockedReasonEnum::InvalidPrefix;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::InvalidPrefix);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_UNKNOWN_ERROR)) {
-    return Network::SetCookieBlockedReasonEnum::UnknownError;
+    blockedReasons->push_back(
+        Network::SetCookieBlockedReasonEnum::UnknownError);
   }
 
-  // EXCLUDE_HTTP_ONLY, EXCLUDE_NOT_ON_PATH, EXCLUDE_DOMAIN_MISMATCH,
-  // EXCLUDE_OVERWRITE_HTTP_ONLY, or no exclusion reasons.
-  return base::nullopt;
+  return blockedReasons;
 }
 
-// TODO(crbug.com/993843): Make this return an array of reasons, not just the
-// first one.
-base::Optional<Network::CookieBlockedReason> GetProtocolBlockedCookieReason(
+std::unique_ptr<Array<Network::CookieBlockedReason>>
+GetProtocolBlockedCookieReason(
     net::CanonicalCookie::CookieInclusionStatus status) {
+  std::unique_ptr<Array<Network::CookieBlockedReason>> blockedReasons =
+      std::make_unique<Array<Network::CookieBlockedReason>>();
+
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_SECURE_ONLY)) {
-    return Network::CookieBlockedReasonEnum::SecureOnly;
+    blockedReasons->push_back(Network::CookieBlockedReasonEnum::SecureOnly);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_NOT_ON_PATH)) {
-    return Network::CookieBlockedReasonEnum::NotOnPath;
+    blockedReasons->push_back(Network::CookieBlockedReasonEnum::NotOnPath);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_DOMAIN_MISMATCH)) {
-    return Network::CookieBlockedReasonEnum::DomainMismatch;
+    blockedReasons->push_back(Network::CookieBlockedReasonEnum::DomainMismatch);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_SAMESITE_STRICT)) {
-    return Network::CookieBlockedReasonEnum::SameSiteStrict;
+    blockedReasons->push_back(Network::CookieBlockedReasonEnum::SameSiteStrict);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_SAMESITE_LAX)) {
-    return Network::CookieBlockedReasonEnum::SameSiteLax;
+    blockedReasons->push_back(Network::CookieBlockedReasonEnum::SameSiteLax);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_SAMESITE_EXTENDED)) {
-    return Network::CookieBlockedReasonEnum::SameSiteExtended;
+    blockedReasons->push_back(
+        Network::CookieBlockedReasonEnum::SameSiteExtended);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::
               EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX)) {
-    return Network::CookieBlockedReasonEnum::SameSiteUnspecifiedTreatedAsLax;
+    blockedReasons->push_back(
+        Network::CookieBlockedReasonEnum::SameSiteUnspecifiedTreatedAsLax);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_SAMESITE_NONE_INSECURE)) {
-    return Network::CookieBlockedReasonEnum::SameSiteNoneInsecure;
+    blockedReasons->push_back(
+        Network::CookieBlockedReasonEnum::SameSiteNoneInsecure);
   }
   if (status.HasExclusionReason(net::CanonicalCookie::CookieInclusionStatus::
                                     EXCLUDE_USER_PREFERENCES)) {
-    return Network::CookieBlockedReasonEnum::UserPreferences;
+    blockedReasons->push_back(
+        Network::CookieBlockedReasonEnum::UserPreferences);
   }
   if (status.HasExclusionReason(
           net::CanonicalCookie::CookieInclusionStatus::EXCLUDE_UNKNOWN_ERROR)) {
-    return Network::CookieBlockedReasonEnum::UnknownError;
+    blockedReasons->push_back(Network::CookieBlockedReasonEnum::UnknownError);
   }
 
-  // EXCLUDE_FAILURE_TO_STORE, EXCLUDE_NONCOOKIEABLE_SCHEME,
-  // EXCLUDE_OVERWRITE_SECURE, EXCLUDE_INVALID_DOMAIN, EXCLUDE_INVALID_PREFIX,
-  // EXCLUDE_OVERWRITE_HTTP_ONLY, EXCLUDE_HTTP_ONLY, or no exclusion reasons.
-  return base::nullopt;
+  return blockedReasons;
 }
 
 std::unique_ptr<Array<Network::BlockedSetCookieWithReason>>
@@ -689,14 +700,14 @@ BuildProtocolBlockedSetCookies(const net::CookieAndLineStatusList& net_list) {
       std::make_unique<Array<Network::BlockedSetCookieWithReason>>();
 
   for (const net::CookieAndLineWithStatus& cookie : net_list) {
-    base::Optional<Network::SetCookieBlockedReason> blocked_reason =
+    std::unique_ptr<Array<Network::SetCookieBlockedReason>> blocked_reasons =
         GetProtocolBlockedSetCookieReason(cookie.status);
-    if (!blocked_reason.has_value())
+    if (!blocked_reasons->size())
       continue;
 
     protocol_list->push_back(
         Network::BlockedSetCookieWithReason::Create()
-            .SetBlockedReason(blocked_reason.value())
+            .SetBlockedReasons(std::move(blocked_reasons))
             .SetCookieLine(cookie.cookie_string)
             .SetCookie(cookie.cookie.has_value()
                            ? BuildCookie(cookie.cookie.value())
@@ -712,13 +723,13 @@ BuildProtocolBlockedCookies(const net::CookieStatusList& net_list) {
       std::make_unique<Array<Network::BlockedCookieWithReason>>();
 
   for (const net::CookieWithStatus& cookie : net_list) {
-    base::Optional<Network::CookieBlockedReason> blocked_reason =
+    std::unique_ptr<Array<Network::CookieBlockedReason>> blocked_reasons =
         GetProtocolBlockedCookieReason(cookie.status);
-    if (!blocked_reason.has_value())
+    if (!blocked_reasons->size())
       continue;
 
     protocol_list->push_back(Network::BlockedCookieWithReason::Create()
-                                 .SetBlockedReason(blocked_reason.value())
+                                 .SetBlockedReasons(std::move(blocked_reasons))
                                  .SetCookie(BuildCookie(cookie.cookie))
                                  .Build());
   }
@@ -1510,7 +1521,8 @@ Maybe<String> GetBlockedReasonFor(
 }  // namespace
 
 void NetworkHandler::NavigationRequestWillBeSent(
-    const NavigationRequest& nav_request) {
+    const NavigationRequest& nav_request,
+    base::TimeTicks timestamp) {
   if (!enabled_)
     return;
 
@@ -1571,8 +1583,7 @@ void NetworkHandler::NavigationRequestWillBeSent(
                     .Build();
   }
   std::string id = nav_request.devtools_navigation_token().ToString();
-  double current_ticks =
-      (base::TimeTicks::Now() - base::TimeTicks()).InSecondsF();
+  double current_ticks = timestamp.since_origin().InSecondsF();
   double current_wall_time = base::Time::Now().ToDoubleT();
   std::string frame_token =
       nav_request.frame_tree_node()->devtools_frame_token().ToString();
@@ -1587,7 +1598,8 @@ void NetworkHandler::RequestSent(const std::string& request_id,
                                  const std::string& loader_id,
                                  const network::ResourceRequest& request,
                                  const char* initiator_type,
-                                 const base::Optional<GURL>& initiator_url) {
+                                 const base::Optional<GURL>& initiator_url,
+                                 base::TimeTicks timestamp) {
   if (!enabled_)
     return;
   std::unique_ptr<DictionaryValue> headers_dict(DictionaryValue::create());
@@ -1612,10 +1624,8 @@ void NetworkHandler::RequestSent(const std::string& request_id,
     request_object->SetUrlFragment(url_fragment);
   frontend_->RequestWillBeSent(
       request_id, loader_id, url_without_fragment, std::move(request_object),
-      base::TimeTicks::Now().ToInternalValue() /
-          static_cast<double>(base::Time::kMicrosecondsPerSecond),
-      base::Time::Now().ToDoubleT(), std::move(initiator),
-      std::unique_ptr<Network::Response>(),
+      timestamp.since_origin().InSecondsF(), base::Time::Now().ToDoubleT(),
+      std::move(initiator), std::unique_ptr<Network::Response>(),
       std::string(Network::ResourceTypeEnum::Other),
       Maybe<std::string>() /* frame_id */, request.has_user_gesture);
 }
@@ -1746,7 +1756,7 @@ DispatchResponse NetworkHandler::SetRequestInterception(
     return Response::OK();
   }
 
-  std::vector<DevToolsNetworkInterceptor::Pattern> interceptor_patterns;
+  std::vector<DevToolsURLLoaderInterceptor::Pattern> interceptor_patterns;
   for (const std::unique_ptr<protocol::Network::RequestPattern>& pattern :
        *patterns) {
     base::flat_set<ResourceType> resource_types;
@@ -1822,13 +1832,13 @@ void NetworkHandler::ContinueInterceptedRequest(
     }
   }
 
-  std::unique_ptr<DevToolsNetworkInterceptor::Modifications::HeadersVector>
+  std::unique_ptr<DevToolsURLLoaderInterceptor::Modifications::HeadersVector>
       override_headers;
   if (opt_headers.isJust()) {
     std::unique_ptr<protocol::DictionaryValue> headers =
         opt_headers.fromJust()->toValue();
     override_headers = std::make_unique<
-        DevToolsNetworkInterceptor::Modifications::HeadersVector>();
+        DevToolsURLLoaderInterceptor::Modifications::HeadersVector>();
     for (size_t i = 0; i < headers->size(); ++i) {
       const protocol::DictionaryValue::Entry& entry = headers->at(i);
       std::string value;
@@ -1840,7 +1850,7 @@ void NetworkHandler::ContinueInterceptedRequest(
     }
   }
   using AuthChallengeResponse =
-      DevToolsNetworkInterceptor::AuthChallengeResponse;
+      DevToolsURLLoaderInterceptor::AuthChallengeResponse;
   std::unique_ptr<AuthChallengeResponse> override_auth;
   if (auth_challenge_response.isJust()) {
     std::string type = auth_challenge_response.fromJust()->GetResponse();
@@ -1866,7 +1876,7 @@ void NetworkHandler::ContinueInterceptedRequest(
   }
 
   auto modifications =
-      std::make_unique<DevToolsNetworkInterceptor::Modifications>(
+      std::make_unique<DevToolsURLLoaderInterceptor::Modifications>(
           std::move(error), std::move(response_headers),
           std::move(response_body), body_offset, std::move(url),
           std::move(method), std::move(post_data), std::move(override_headers),
diff --git a/chromium/content/browser/devtools/protocol/network_handler.h b/chromium/content/browser/devtools/protocol/network_handler.h
index 6c0d4f88eeb..cb1504baa13 100644
--- a/chromium/content/browser/devtools/protocol/network_handler.h
+++ b/chromium/content/browser/devtools/protocol/network_handler.h
@@ -14,9 +14,9 @@
 #include "base/memory/weak_ptr.h"
 #include "base/optional.h"
 #include "base/unguessable_token.h"
-#include "content/browser/devtools/devtools_url_loader_interceptor.h"
 #include "content/browser/devtools/protocol/devtools_domain_handler.h"
 #include "content/browser/devtools/protocol/network.h"
+#include "content/public/common/resource_type.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/net_errors.h"
 #include "net/cookies/canonical_cookie.h"
@@ -38,6 +38,7 @@ namespace content {
 class BrowserContext;
 class DevToolsAgentHostImpl;
 class DevToolsIOContext;
+class DevToolsURLLoaderInterceptor;
 class RenderFrameHostImpl;
 class RenderProcessHost;
 class NavigationRequest;
@@ -157,12 +158,14 @@ class NetworkHandler : public DevToolsDomainHandler,
   void ApplyOverrides(net::HttpRequestHeaders* headers,
                       bool* skip_service_worker,
                       bool* disable_cache);
-  void NavigationRequestWillBeSent(const NavigationRequest& nav_request);
+  void NavigationRequestWillBeSent(const NavigationRequest& nav_request,
+                                   base::TimeTicks timestamp);
   void RequestSent(const std::string& request_id,
                    const std::string& loader_id,
                    const network::ResourceRequest& request,
                    const char* initiator_type,
-                   const base::Optional<GURL>& initiator_url);
+                   const base::Optional<GURL>& initiator_url,
+                   base::TimeTicks timestamp);
   void ResponseReceived(const std::string& request_id,
                         const std::string& loader_id,
                         const GURL& url,
diff --git a/chromium/content/browser/devtools/protocol/page_handler.cc b/chromium/content/browser/devtools/protocol/page_handler.cc
index 0b4097cda6f..975f5f703b1 100644
--- a/chromium/content/browser/devtools/protocol/page_handler.cc
+++ b/chromium/content/browser/devtools/protocol/page_handler.cc
@@ -271,7 +271,7 @@ void PageHandler::Wire(UberDispatcher* dispatcher) {
 }
 
 void PageHandler::OnSynchronousSwapCompositorFrame(
-    const DevToolsFrameMetadata& frame_metadata) {
+    const cc::RenderFrameMetadata& frame_metadata) {
   // Cache |frame_metadata_| as InnerSwapCompositorFrame may also be called on
   // screencast start.
   frame_metadata_ = frame_metadata;
@@ -514,9 +514,9 @@ void PageHandler::NavigationReset(NavigationRequest* navigation_request) {
     return;
   std::string frame_id =
       navigation_request->frame_tree_node()->devtools_frame_token().ToString();
-  bool success = navigation_request->net_error() == net::OK;
+  bool success = navigation_request->GetNetErrorCode() == net::OK;
   std::string error_string =
-      net::ErrorToString(navigation_request->net_error());
+      net::ErrorToString(navigation_request->GetNetErrorCode());
   navigate_callback->second->sendSuccess(
       frame_id,
       Maybe<std::string>(
@@ -1102,8 +1102,8 @@ void PageHandler::InnerSwapCompositorFrame() {
       BuildScreencastFrameMetadata(
           surface_size, frame_metadata_->device_scale_factor,
           frame_metadata_->page_scale_factor,
-          frame_metadata_->root_scroll_offset, top_controls_height,
-          top_controls_shown_ratio);
+          frame_metadata_->root_scroll_offset.value_or(gfx::Vector2dF()),
+          top_controls_height, top_controls_shown_ratio);
   if (!page_metadata)
     return;
 
diff --git a/chromium/content/browser/devtools/protocol/page_handler.h b/chromium/content/browser/devtools/protocol/page_handler.h
index aa3ae1e834f..388e89eff9c 100644
--- a/chromium/content/browser/devtools/protocol/page_handler.h
+++ b/chromium/content/browser/devtools/protocol/page_handler.h
@@ -18,7 +18,7 @@
 #include "base/scoped_observer.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
-#include "content/browser/devtools/devtools_frame_metadata.h"
+#include "cc/trees/render_frame_metadata.h"
 #include "content/browser/devtools/devtools_video_consumer.h"
 #include "content/browser/devtools/protocol/devtools_domain_handler.h"
 #include "content/browser/devtools/protocol/devtools_download_manager_delegate.h"
@@ -77,7 +77,7 @@ class PageHandler : public DevToolsDomainHandler,
                    RenderFrameHostImpl* frame_host) override;
   // Instrumentation signals.
   void OnSynchronousSwapCompositorFrame(
-      const DevToolsFrameMetadata& frame_metadata);
+      const cc::RenderFrameMetadata& frame_metadata);
   void DidAttachInterstitialPage();
   void DidDetachInterstitialPage();
   bool screencast_enabled() const { return enabled_ && screencast_enabled_; }
@@ -218,7 +218,7 @@ class PageHandler : public DevToolsDomainHandler,
   int screencast_max_height_;
   int capture_every_nth_frame_;
   int capture_retry_count_;
-  base::Optional<DevToolsFrameMetadata> frame_metadata_;
+  base::Optional<cc::RenderFrameMetadata> frame_metadata_;
   int session_id_;
   int frame_counter_;
   int frames_in_flight_;
diff --git a/chromium/content/browser/devtools/protocol/security_handler.cc b/chromium/content/browser/devtools/protocol/security_handler.cc
index 6a46ce4af9e..de2460abf98 100644
--- a/chromium/content/browser/devtools/protocol/security_handler.cc
+++ b/chromium/content/browser/devtools/protocol/security_handler.cc
@@ -12,8 +12,10 @@
 #include "base/base64.h"
 #include "content/browser/devtools/devtools_agent_host_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/security_style_explanations.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
@@ -30,15 +32,15 @@ using Explanations = protocol::Array<Security::SecurityStateExplanation>;
 namespace {
 
 std::string SecurityStyleToProtocolSecurityState(
-    blink::WebSecurityStyle security_style) {
+    blink::SecurityStyle security_style) {
   switch (security_style) {
-    case blink::kWebSecurityStyleUnknown:
+    case blink::SecurityStyle::kUnknown:
       return Security::SecurityStateEnum::Unknown;
-    case blink::kWebSecurityStyleNeutral:
+    case blink::SecurityStyle::kNeutral:
       return Security::SecurityStateEnum::Neutral;
-    case blink::kWebSecurityStyleInsecure:
+    case blink::SecurityStyle::kInsecure:
       return Security::SecurityStateEnum::Insecure;
-    case blink::kWebSecurityStyleSecure:
+    case blink::SecurityStyle::kSecure:
       return Security::SecurityStateEnum::Secure;
     default:
       NOTREACHED();
@@ -147,7 +149,7 @@ void SecurityHandler::DidChangeVisibleSecurityState() {
     return;
 
   SecurityStyleExplanations security_style_explanations;
-  blink::WebSecurityStyle security_style =
+  blink::SecurityStyle security_style =
       web_contents()->GetDelegate()->GetSecurityStyle(
           web_contents(), &security_style_explanations);
 
@@ -192,8 +194,12 @@ void SecurityHandler::DidChangeVisibleSecurityState() {
 }
 
 void SecurityHandler::DidFinishNavigation(NavigationHandle* navigation_handle) {
-  if (cert_error_override_mode_ == CertErrorOverrideMode::kHandleEvents)
+  if (cert_error_override_mode_ == CertErrorOverrideMode::kHandleEvents) {
+    BackForwardCache::DisableForRenderFrameHost(
+        navigation_handle->GetPreviousRenderFrameHostId(),
+        "content::protocol::SecurityHandler");
     FlushPendingCertificateErrorNotifications();
+  }
 }
 
 void SecurityHandler::FlushPendingCertificateErrorNotifications() {
diff --git a/chromium/content/browser/devtools/protocol/system_info_handler.cc b/chromium/content/browser/devtools/protocol/system_info_handler.cc
index 670bfaf5cdb..1f6266beff2 100644
--- a/chromium/content/browser/devtools/protocol/system_info_handler.cc
+++ b/chromium/content/browser/devtools/protocol/system_info_handler.cc
@@ -47,9 +47,11 @@ std::unique_ptr<SystemInfo::Size> GfxSizeToSystemInfoSize(
 }
 // Give the GPU process a few seconds to provide GPU info.
 // Linux Debug builds need more time -- see Issue 796437.
-// Windows builds need more time -- see Issue 873112.
-#if (defined(OS_LINUX) && !defined(NDEBUG)) || defined(OS_WIN)
+// Windows builds need more time -- see Issue 873112 and 1004472.
+#if (defined(OS_LINUX) && !defined(NDEBUG))
 const int kGPUInfoWatchdogTimeoutMs = 20000;
+#elif defined(OS_WIN)
+const int kGPUInfoWatchdogTimeoutMs = 30000;
 #else
 const int kGPUInfoWatchdogTimeoutMs = 5000;
 #endif
@@ -121,13 +123,18 @@ class AuxGPUInfoEnumerator : public gpu::GPUInfo::Enumerator {
 
 std::unique_ptr<GPUDevice> GPUDeviceToProtocol(
     const gpu::GPUInfo::GPUDevice& device) {
-  return GPUDevice::Create().SetVendorId(device.vendor_id)
-                            .SetDeviceId(device.device_id)
-                            .SetVendorString(device.vendor_string)
-                            .SetDeviceString(device.device_string)
-                            .SetDriverVendor(device.driver_vendor)
-                            .SetDriverVersion(device.driver_version)
-                            .Build();
+  return GPUDevice::Create()
+      .SetVendorId(device.vendor_id)
+      .SetDeviceId(device.device_id)
+#if defined(OS_WIN)
+      .SetSubSysId(device.sub_sys_id)
+      .SetRevision(device.revision)
+#endif
+      .SetVendorString(device.vendor_string)
+      .SetDeviceString(device.device_string)
+      .SetDriverVendor(device.driver_vendor)
+      .SetDriverVersion(device.driver_version)
+      .Build();
 }
 
 std::unique_ptr<SystemInfo::VideoDecodeAcceleratorCapability>
@@ -288,10 +295,16 @@ class SystemInfoHandlerGpuObserver : public content::GpuDataManagerObserver {
   }
 
   void OnGpuInfoUpdate() override {
-    if (GpuDataManagerImpl::GetInstance()->IsGpuFeatureInfoAvailable() &&
-        GpuDataManagerImpl::GetInstance()->IsDx12VulkanVersionAvailable()) {
-      UnregisterAndSendResponse();
-    }
+    if (!GpuDataManagerImpl::GetInstance()->IsGpuFeatureInfoAvailable())
+      return;
+    base::CommandLine* command = base::CommandLine::ForCurrentProcess();
+    // Only wait for DX12/Vulkan info if requested at Chrome start up.
+    if (!command->HasSwitch(
+            switches::kDisableGpuProcessForDX12VulkanInfoCollection) &&
+        command->HasSwitch(switches::kNoDelayForDX12VulkanInfoCollection) &&
+        !GpuDataManagerImpl::GetInstance()->IsDx12VulkanVersionAvailable())
+      return;
+    UnregisterAndSendResponse();
   }
 
   void OnGpuProcessCrashed(base::TerminationStatus exit_code) override {
diff --git a/chromium/content/browser/devtools/protocol/target_auto_attacher.cc b/chromium/content/browser/devtools/protocol/target_auto_attacher.cc
index 1f807940c13..83843a6630e 100644
--- a/chromium/content/browser/devtools/protocol/target_auto_attacher.cc
+++ b/chromium/content/browser/devtools/protocol/target_auto_attacher.cc
@@ -10,7 +10,6 @@
 #include "content/browser/devtools/service_worker_devtools_agent_host.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -208,12 +207,12 @@ bool TargetAutoAttacher::ShouldThrottleFramesNavigation() {
 }
 
 DevToolsAgentHost* TargetAutoAttacher::AutoAttachToFrame(
-    NavigationHandleImpl* navigation_handle) {
+    NavigationRequest* navigation_request) {
   if (!ShouldThrottleFramesNavigation())
     return nullptr;
 
-  FrameTreeNode* frame_tree_node = navigation_handle->frame_tree_node();
-  RenderFrameHostImpl* new_host = navigation_handle->GetRenderFrameHost();
+  FrameTreeNode* frame_tree_node = navigation_request->frame_tree_node();
+  RenderFrameHostImpl* new_host = navigation_request->GetRenderFrameHost();
 
   // |new_host| can be nullptr for navigation that doesn't commmit
   // (e.g. download). Skip possibly detaching the old agent host so the DevTools
@@ -224,6 +223,20 @@ DevToolsAgentHost* TargetAutoAttacher::AutoAttachToFrame(
   scoped_refptr<DevToolsAgentHost> agent_host =
       RenderFrameDevToolsAgentHost::FindForDangling(frame_tree_node);
 
+  // Process the window.open auto-attaches for new targets.
+  if (frame_tree_node->original_opener()) {
+    if (!agent_host) {
+      agent_host =
+          RenderFrameDevToolsAgentHost::CreateForCrossProcessNavigation(
+              navigation_request);
+    }
+    if (auto_attached_hosts_.find(agent_host) != auto_attached_hosts_.end())
+      return nullptr;
+    attach_callback_.Run(agent_host.get(), wait_for_debugger_on_start_);
+    auto_attached_hosts_.insert(agent_host);
+    return wait_for_debugger_on_start_ ? agent_host.get() : nullptr;
+  }
+
   bool old_cross_process = !!agent_host;
   bool is_portal_main_frame =
       frame_tree_node->IsMainFrame() &&
@@ -237,8 +250,7 @@ DevToolsAgentHost* TargetAutoAttacher::AutoAttachToFrame(
 
   if (new_cross_process) {
     agent_host = RenderFrameDevToolsAgentHost::CreateForCrossProcessNavigation(
-        navigation_handle);
-    DCHECK(auto_attached_hosts_.find(agent_host) == auto_attached_hosts_.end());
+        navigation_request);
     attach_callback_.Run(agent_host.get(), wait_for_debugger_on_start_);
     auto_attached_hosts_.insert(agent_host);
     return wait_for_debugger_on_start_ ? agent_host.get() : nullptr;
diff --git a/chromium/content/browser/devtools/protocol/target_auto_attacher.h b/chromium/content/browser/devtools/protocol/target_auto_attacher.h
index e958bc0bc64..ed03537b6f1 100644
--- a/chromium/content/browser/devtools/protocol/target_auto_attacher.h
+++ b/chromium/content/browser/devtools/protocol/target_auto_attacher.h
@@ -13,7 +13,7 @@ namespace content {
 
 class DevToolsAgentHostImpl;
 class DevToolsRendererChannel;
-class NavigationHandleImpl;
+class NavigationRequest;
 class RenderFrameHostImpl;
 
 namespace protocol {
@@ -40,7 +40,7 @@ class TargetAutoAttacher : public ServiceWorkerDevToolsManager::Observer {
   void AgentHostClosed(DevToolsAgentHost* host);
 
   bool ShouldThrottleFramesNavigation();
-  DevToolsAgentHost* AutoAttachToFrame(NavigationHandleImpl* navigation_handle);
+  DevToolsAgentHost* AutoAttachToFrame(NavigationRequest* navigation_request);
   void ChildWorkerCreated(DevToolsAgentHostImpl* agent_host,
                           bool waiting_for_debugger);
 
diff --git a/chromium/content/browser/devtools/protocol/target_handler.cc b/chromium/content/browser/devtools/protocol/target_handler.cc
index 693edd134a0..5f7a1c7bb57 100644
--- a/chromium/content/browser/devtools/protocol/target_handler.cc
+++ b/chromium/content/browser/devtools/protocol/target_handler.cc
@@ -17,7 +17,7 @@
 #include "content/browser/devtools/browser_devtools_agent_host.h"
 #include "content/browser/devtools/devtools_agent_host_impl.h"
 #include "content/browser/devtools/devtools_manager.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/devtools_agent_host_client.h"
 #include "content/public/browser/navigation_throttle.h"
@@ -91,6 +91,10 @@ static std::string TerminationStatusToString(base::TerminationStatus status) {
       return "failed to launch";
     case base::TERMINATION_STATUS_OOM:
       return "oom";
+#if defined(OS_WIN)
+    case base::TERMINATION_STATUS_INTEGRITY_FAILURE:
+      return "integrity failure";
+#endif
     case base::TERMINATION_STATUS_MAX_ENUM:
       break;
   }
@@ -417,7 +421,7 @@ NavigationThrottle::ThrottleCheckResult TargetHandler::Throttle::MaybeAttach() {
   if (!target_handler_)
     return PROCEED;
   agent_host_ = target_handler_->auto_attacher_.AutoAttachToFrame(
-      static_cast<NavigationHandleImpl*>(navigation_handle()));
+      NavigationRequest::From(navigation_handle()));
   if (!agent_host_.get())
     return PROCEED;
   target_handler_->auto_attached_sessions_[agent_host_.get()]->SetThrottle(
@@ -472,7 +476,7 @@ void TargetHandler::SetRenderer(int process_host_id,
 }
 
 Response TargetHandler::Disable() {
-  SetAutoAttachInternal(false, false, false, base::DoNothing());
+  SetAutoAttachInternal(false, false, false, false, base::DoNothing());
   SetDiscoverTargets(false);
   auto_attached_sessions_.clear();
   attached_sessions_.clear();
@@ -487,6 +491,11 @@ std::unique_ptr<NavigationThrottle> TargetHandler::CreateThrottleForNavigation(
     NavigationHandle* navigation_handle) {
   if (!auto_attacher_.ShouldThrottleFramesNavigation())
     return nullptr;
+  FrameTreeNode* frame_tree_node =
+      NavigationRequest::From(navigation_handle)->frame_tree_node();
+  bool is_window_open = frame_tree_node->original_opener();
+  if (is_window_open && !attach_to_window_open_)
+    return nullptr;
   return std::make_unique<Throttle>(weak_factory_.GetWeakPtr(),
                                     navigation_handle);
 }
@@ -505,8 +514,10 @@ void TargetHandler::ClearThrottles() {
 void TargetHandler::SetAutoAttachInternal(bool auto_attach,
                                           bool wait_for_debugger_on_start,
                                           bool flatten,
+                                          bool window_open,
                                           base::OnceClosure callback) {
   flatten_auto_attach_ = flatten;
+  attach_to_window_open_ = window_open;
   auto_attacher_.SetAutoAttach(auto_attach, wait_for_debugger_on_start,
                                std::move(callback));
   if (!auto_attacher_.ShouldThrottleFramesNavigation())
@@ -574,9 +585,11 @@ void TargetHandler::SetAutoAttach(
     bool auto_attach,
     bool wait_for_debugger_on_start,
     Maybe<bool> flatten,
+    Maybe<bool> window_open,
     std::unique_ptr<SetAutoAttachCallback> callback) {
   SetAutoAttachInternal(
       auto_attach, wait_for_debugger_on_start, flatten.fromMaybe(false),
+      window_open.fromMaybe(false),
       base::BindOnce(&SetAutoAttachCallback::sendSuccess, std::move(callback)));
 }
 
diff --git a/chromium/content/browser/devtools/protocol/target_handler.h b/chromium/content/browser/devtools/protocol/target_handler.h
index 26361d369bb..ea0dd51cfb0 100644
--- a/chromium/content/browser/devtools/protocol/target_handler.h
+++ b/chromium/content/browser/devtools/protocol/target_handler.h
@@ -63,6 +63,7 @@ class TargetHandler : public DevToolsDomainHandler,
   void SetAutoAttach(bool auto_attach,
                      bool wait_for_debugger_on_start,
                      Maybe<bool> flatten,
+                     Maybe<bool> window_open,
                      std::unique_ptr<SetAutoAttachCallback> callback) override;
   Response SetRemoteLocations(
       std::unique_ptr<protocol::Array<Target::RemoteLocation>>) override;
@@ -114,6 +115,7 @@ class TargetHandler : public DevToolsDomainHandler,
   void SetAutoAttachInternal(bool auto_attach,
                              bool wait_for_debugger_on_start,
                              bool flatten,
+                             bool window_open,
                              base::OnceClosure callback);
 
   // DevToolsAgentHostObserver implementation.
@@ -129,6 +131,7 @@ class TargetHandler : public DevToolsDomainHandler,
   std::unique_ptr<Target::Frontend> frontend_;
   TargetAutoAttacher auto_attacher_;
   bool flatten_auto_attach_ = false;
+  bool attach_to_window_open_ = false;
   bool discover_;
   std::map<std::string, std::unique_ptr<Session>> attached_sessions_;
   std::map<DevToolsAgentHost*, Session*> auto_attached_sessions_;
diff --git a/chromium/content/browser/devtools/protocol/tracing_handler.cc b/chromium/content/browser/devtools/protocol/tracing_handler.cc
index dbfab953f3c..8358a12af8c 100644
--- a/chromium/content/browser/devtools/protocol/tracing_handler.cc
+++ b/chromium/content/browser/devtools/protocol/tracing_handler.cc
@@ -27,7 +27,6 @@
 #include "build/build_config.h"
 #include "components/tracing/common/trace_startup_config.h"
 #include "content/browser/devtools/devtools_agent_host_impl.h"
-#include "content/browser/devtools/devtools_frame_trace_recorder.h"
 #include "content/browser/devtools/devtools_io_context.h"
 #include "content/browser/devtools/devtools_protocol_encoding.h"
 #include "content/browser/devtools/devtools_stream_file.h"
@@ -35,7 +34,7 @@
 #include "content/browser/devtools/devtools_video_consumer.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
@@ -122,8 +121,7 @@ class DevToolsTraceEndpointProxy : public TracingController::TraceDataEndpoint {
     if (TracingHandler* h = tracing_handler_.get())
       h->OnTraceDataCollected(std::move(chunk));
   }
-  void ReceiveTraceFinalContents(
-      std::unique_ptr<const base::DictionaryValue> metadata) override {
+  void ReceivedTraceFinalContents() override {
     if (TracingHandler* h = tracing_handler_.get())
       h->OnTraceComplete();
   }
@@ -152,13 +150,12 @@ class DevToolsStreamEndpoint : public TracingController::TraceDataEndpoint {
     stream_->Append(std::move(chunk));
   }
 
-  void ReceiveTraceFinalContents(
-      std::unique_ptr<const base::DictionaryValue> metadata) override {
+  void ReceivedTraceFinalContents() override {
     if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
       base::PostTask(
           FROM_HERE, {BrowserThread::UI},
-          base::BindOnce(&DevToolsStreamEndpoint::ReceiveTraceFinalContents,
-                         this, std::move(metadata)));
+          base::BindOnce(&DevToolsStreamEndpoint::ReceivedTraceFinalContents,
+                         this));
       return;
     }
     if (TracingHandler* h = tracing_handler_.get())
@@ -249,46 +246,6 @@ class TracingHandler::TracingSession {
   DISALLOW_COPY_AND_ASSIGN(TracingSession);
 };
 
-class TracingHandler::LegacyTracingSession
-    : public TracingHandler::TracingSession {
- public:
-  void EnableTracing(const base::trace_event::TraceConfig& chrome_config,
-                     base::OnceClosure on_recording_enabled_callback) override {
-    DCHECK(!TracingController::GetInstance()->IsTracing());
-    TracingController::GetInstance()->StartTracing(
-        chrome_config, std::move(on_recording_enabled_callback));
-  }
-
-  void AdoptStartupTracingSession() override {
-    // Nothing to do for legacy tracing here (tracing is already active).
-    DCHECK(TracingController::GetInstance()->IsTracing());
-  }
-
-  void ChangeTraceConfig(
-      const base::trace_event::TraceConfig& chrome_config) override {
-    TracingController::GetInstance()->StartTracing(
-        chrome_config, TracingController::StartTracingDoneCallback());
-  }
-
-  void DisableTracing(bool use_proto_format,
-                      const std::string& agent_label,
-                      const scoped_refptr<TracingController::TraceDataEndpoint>&
-                          endpoint) override {
-    DCHECK(!use_proto_format);
-    TracingController::GetInstance()->StopTracing(endpoint, agent_label);
-  }
-
-  void GetBufferUsage(base::OnceCallback<void(float percent_full,
-                                              size_t approximate_event_count)>
-                          on_buffer_usage_callback) override {
-    TracingController::GetInstance()->GetTraceBufferUsage(
-        std::move(on_buffer_usage_callback));
-  }
-
-  bool HasTracingFailed() override { return false; }
-  bool HasDataLossOccurred() override { return false; }
-};
-
 class TracingHandler::PerfettoTracingSession
     : public TracingHandler::TracingSession,
       public tracing::mojom::TracingSessionClient,
@@ -311,8 +268,9 @@ class TracingHandler::PerfettoTracingSession
     perfetto::TraceConfig perfetto_config =
         CreatePerfettoConfiguration(chrome_config);
 
-    tracing::mojom::TracingSessionClientPtr tracing_session_client;
-    binding_.Bind(mojo::MakeRequest(&tracing_session_client));
+    mojo::PendingRemote<tracing::mojom::TracingSessionClient>
+        tracing_session_client;
+    binding_.Bind(tracing_session_client.InitWithNewPipeAndPassReceiver());
     binding_.set_connection_error_handler(
         base::BindOnce(&PerfettoTracingSession::OnTracingSessionFailed,
                        base::Unretained(this)));
@@ -364,7 +322,7 @@ class TracingHandler::PerfettoTracingSession
     if (!tracing_session_host_) {
       if (endpoint_) {
         // Will delete |this|.
-        endpoint_->ReceiveTraceFinalContents(nullptr);
+        endpoint_->ReceivedTraceFinalContents();
       }
       return;
     }
@@ -384,6 +342,7 @@ class TracingHandler::PerfettoTracingSession
           this, std::move(consumer_handle));
       tracing_session_host_->DisableTracingAndEmitJson(
           agent_label_, std::move(producer_handle),
+          /*privacy_filtering_enabled=*/false,
           base::BindOnce(&PerfettoTracingSession::OnReadBuffersComplete,
                          base::Unretained(this)));
     } else {
@@ -484,7 +443,7 @@ class TracingHandler::PerfettoTracingSession
     if (endpoint_) {
       // TODO(oysteine): Signal to the client that tracing failed.
       // Will delete |this|.
-      endpoint_->ReceiveTraceFinalContents(nullptr);
+      endpoint_->ReceivedTraceFinalContents();
     }
   }
 
@@ -531,7 +490,7 @@ class TracingHandler::PerfettoTracingSession
     if (!endpoint_)
       return;
     // Will delete |this|.
-    endpoint_->ReceiveTraceFinalContents(nullptr);
+    endpoint_->ReceivedTraceFinalContents();
   }
 
   mojo::Binding<tracing::mojom::TracingSessionClient> binding_{this};
@@ -556,11 +515,11 @@ class TracingHandler::PerfettoTracingSession
 #endif
 };
 
-TracingHandler::TracingHandler(FrameTreeNode* frame_tree_node_,
+TracingHandler::TracingHandler(FrameTreeNode* frame_tree_node,
                                DevToolsIOContext* io_context)
     : DevToolsDomainHandler(Tracing::Metainfo::domainName),
       io_context_(io_context),
-      frame_tree_node_(frame_tree_node_),
+      frame_tree_node_(frame_tree_node),
       did_initiate_recording_(false),
       return_as_stream_(false),
       gzip_compression_(false),
@@ -586,7 +545,6 @@ TracingHandler::TracingHandler(FrameTreeNode* frame_tree_node_,
     return;
   }
 
-  DCHECK(tracing::TracingUsesPerfettoBackend());
   session_ = std::make_unique<PerfettoTracingSession>();
   session_->AdoptStartupTracingSession();
   g_any_agent_tracing = true;
@@ -743,12 +701,6 @@ void TracingHandler::Start(Maybe<std::string> categories,
   bool proto_format =
       transfer_format.fromMaybe("") == Tracing::StreamFormatEnum::Proto;
 
-  if (proto_format && !tracing::TracingUsesPerfettoBackend()) {
-    callback->sendFailure(Response::Error(
-        "Proto format is only supported with the perfetto backend."));
-    return;
-  }
-
   if (proto_format && !return_as_stream) {
     callback->sendFailure(Response::Error(
         "Proto format is only supported when using stream transfer mode."));
@@ -821,11 +773,7 @@ void TracingHandler::StartTracingWithGpuPid(
 
   SetupProcessFilter(gpu_pid, nullptr);
 
-  if (tracing::TracingUsesPerfettoBackend()) {
-    session_ = std::make_unique<PerfettoTracingSession>();
-  } else {
-    session_ = std::make_unique<LegacyTracingSession>();
-  }
+  session_ = std::make_unique<PerfettoTracingSession>();
   session_->EnableTracing(
       trace_config_,
       base::BindOnce(&TracingHandler::OnRecordingEnabled,
@@ -884,16 +832,6 @@ void TracingHandler::OnProcessReady(RenderProcessHost* process_host) {
 }
 
 Response TracingHandler::End() {
-  // Startup tracing triggered by --trace-config-file is a special case, where
-  // tracing is started automatically upon browser startup and can be stopped
-  // via DevTools.
-  // TODO(eseckler): Remove this when we remove the legacy tracing backend.
-  if (!tracing::TracingUsesPerfettoBackend() && IsStartupTracingActive()) {
-    DCHECK(!session_ && !did_initiate_recording_);
-    session_ = std::make_unique<LegacyTracingSession>();
-    session_->AdoptStartupTracingSession();
-  }
-
   if (!session_)
     return Response::Error("Tracing is not started");
 
@@ -972,19 +910,25 @@ void TracingHandler::OnCategoriesReceived(
 }
 
 void TracingHandler::RequestMemoryDump(
+    Maybe<bool> deterministic,
     std::unique_ptr<RequestMemoryDumpCallback> callback) {
   if (!IsTracing()) {
     callback->sendFailure(Response::Error("Tracing is not started"));
     return;
   }
 
+  auto determinism = deterministic.fromMaybe(false)
+                         ? base::trace_event::MemoryDumpDeterminism::FORCE_GC
+                         : base::trace_event::MemoryDumpDeterminism::NONE;
+
   auto on_memory_dump_finished =
       base::BindOnce(&TracingHandler::OnMemoryDumpFinished,
                      weak_factory_.GetWeakPtr(), std::move(callback));
+
   memory_instrumentation::MemoryInstrumentation::GetInstance()
       ->RequestGlobalDumpAndAppendToTrace(
           base::trace_event::MemoryDumpType::EXPLICITLY_TRIGGERED,
-          base::trace_event::MemoryDumpLevelOfDetail::DETAILED,
+          base::trace_event::MemoryDumpLevelOfDetail::DETAILED, determinism,
           std::move(on_memory_dump_finished));
 }
 
@@ -1011,7 +955,7 @@ void TracingHandler::OnFrameFromVideoConsumer(
   ++number_of_screenshots_from_video_consumer_;
   DCHECK(video_consumer_);
   if (number_of_screenshots_from_video_consumer_ >=
-      DevToolsFrameTraceRecorder::kMaximumNumberOfScreenshots) {
+      DevToolsTraceableScreenshot::kMaximumNumberOfScreenshots) {
     video_consumer_->StopCapture();
   }
 }
@@ -1081,19 +1025,19 @@ void TracingHandler::EmitFrameTree() {
 }
 
 void TracingHandler::ReadyToCommitNavigation(
-    NavigationHandleImpl* navigation_handle) {
+    NavigationRequest* navigation_request) {
   if (!did_initiate_recording_)
     return;
   auto data = std::make_unique<base::trace_event::TracedValue>();
-  FillFrameData(data.get(), navigation_handle->frame_tree_node(),
-                navigation_handle->GetRenderFrameHost(),
-                navigation_handle->GetURL());
+  FillFrameData(data.get(), navigation_request->frame_tree_node(),
+                navigation_request->GetRenderFrameHost(),
+                navigation_request->GetURL());
   TRACE_EVENT_INSTANT1(TRACE_DISABLED_BY_DEFAULT("devtools.timeline"),
                        "FrameCommittedInBrowser", TRACE_EVENT_SCOPE_THREAD,
                        "data", std::move(data));
 
   SetupProcessFilter(base::kNullProcessId,
-                     navigation_handle->GetRenderFrameHost());
+                     navigation_request->GetRenderFrameHost());
   session_->ChangeTraceConfig(trace_config_);
 }
 
diff --git a/chromium/content/browser/devtools/protocol/tracing_handler.h b/chromium/content/browser/devtools/protocol/tracing_handler.h
index 34ebb5dce05..5dcfe36006d 100644
--- a/chromium/content/browser/devtools/protocol/tracing_handler.h
+++ b/chromium/content/browser/devtools/protocol/tracing_handler.h
@@ -37,7 +37,7 @@ class DevToolsAgentHostImpl;
 class DevToolsVideoConsumer;
 class DevToolsIOContext;
 class FrameTreeNode;
-class NavigationHandleImpl;
+class NavigationRequest;
 class RenderFrameHost;
 class RenderProcessHost;
 
@@ -73,11 +73,12 @@ class TracingHandler : public DevToolsDomainHandler, public Tracing::Backend {
   Response End() override;
   void GetCategories(std::unique_ptr<GetCategoriesCallback> callback) override;
   void RequestMemoryDump(
+      Maybe<bool> deterministic,
       std::unique_ptr<RequestMemoryDumpCallback> callback) override;
   Response RecordClockSyncMarker(const std::string& sync_id) override;
 
   bool did_initiate_recording() { return did_initiate_recording_; }
-  void ReadyToCommitNavigation(NavigationHandleImpl* navigation_handle);
+  void ReadyToCommitNavigation(NavigationRequest* navigation_request);
   void FrameDeleted(RenderFrameHostImpl* frame_host);
 
  private:
diff --git a/chromium/content/browser/devtools/protocol/webauthn_handler.cc b/chromium/content/browser/devtools/protocol/webauthn_handler.cc
index 27c60e733b4..c16b6567ee5 100644
--- a/chromium/content/browser/devtools/protocol/webauthn_handler.cc
+++ b/chromium/content/browser/devtools/protocol/webauthn_handler.cc
@@ -152,12 +152,15 @@ Response WebAuthnHandler::AddVirtualAuthenticator(
       transport == device::FidoTransportProtocol::kInternal
           ? device::AuthenticatorAttachment::kPlatform
           : device::AuthenticatorAttachment::kCrossPlatform,
-      options->GetHasResidentKey(), options->GetHasUserVerification());
+      options->GetHasResidentKey(false /* default */),
+      options->GetHasUserVerification(false /* default */));
   if (!authenticator)
     return Response::Error(kErrorCreatingAuthenticator);
 
   authenticator->SetUserPresence(
       options->GetAutomaticPresenceSimulation(true /* default */));
+  authenticator->set_user_verified(
+      options->GetIsUserVerified(false /* default */));
 
   *out_authenticator_id = authenticator->unique_id();
   return Response::OK();
diff --git a/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc b/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc
index cb520b75e72..031a1e7a0ad 100644
--- a/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc
+++ b/chromium/content/browser/devtools/render_frame_devtools_agent_host.cc
@@ -18,7 +18,6 @@
 #include "build/build_config.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/devtools/devtools_frame_trace_recorder.h"
 #include "content/browser/devtools/devtools_manager.h"
 #include "content/browser/devtools/devtools_renderer_channel.h"
 #include "content/browser/devtools/devtools_session.h"
@@ -41,7 +40,6 @@
 #include "content/browser/devtools/protocol/storage_handler.h"
 #include "content/browser/devtools/protocol/target_handler.h"
 #include "content/browser/devtools/protocol/tracing_handler.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
@@ -50,6 +48,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/web_package/signed_exchange_envelope.h"
 #include "content/common/view_messages.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -63,6 +62,7 @@
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom.h"
 
 #if defined(OS_ANDROID)
+#include "content/browser/devtools/devtools_frame_trace_recorder.h"
 #include "content/browser/renderer_host/compositor_impl_android.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
@@ -143,16 +143,16 @@ scoped_refptr<DevToolsAgentHost> RenderFrameDevToolsAgentHost::GetOrCreateFor(
 // static
 scoped_refptr<DevToolsAgentHost>
 RenderFrameDevToolsAgentHost::CreateForCrossProcessNavigation(
-    NavigationHandleImpl* handle) {
+    NavigationRequest* request) {
   // Note that this method does not use FrameTreeNode::current_frame_host(),
   // since it is used while the frame host may not be set as current yet,
   // for example right before commit time. Instead target frame from the
   // navigation handle is used. When this method is invoked it's already known
   // that the navigation will commit to the new frame host.
-  FrameTreeNode* frame_tree_node = handle->frame_tree_node();
+  FrameTreeNode* frame_tree_node = request->frame_tree_node();
   DCHECK(!FindAgentHost(frame_tree_node));
   return new RenderFrameDevToolsAgentHost(frame_tree_node,
-                                          handle->GetRenderFrameHost());
+                                          request->GetRenderFrameHost());
 }
 
 // static
@@ -333,16 +333,13 @@ bool RenderFrameDevToolsAgentHost::AttachSession(DevToolsSession* session) {
 #endif  // !defined(OS_ANDROID)
 
   if (sessions().empty()) {
-    bool use_video_capture_api = true;
 #ifdef OS_ANDROID
-    // Video capture API cannot be used on Android WebView.
+    // With video capture API snapshots happen in TracingHandler. However, the
+    // video capture API cannot be used with Android WebView so
+    // DevToolsFrameTraceRecorder takes snapshots.
     if (!CompositorImpl::IsInitialized())
-      use_video_capture_api = false;
-#endif
-    // When video capture API is used, don't instantiate
-    // DevToolsFrameTraceRecorder. Taking snapshots happens in TracingHandler.
-    if (!use_video_capture_api)
       frame_trace_recorder_ = std::make_unique<DevToolsFrameTraceRecorder>();
+#endif
     UpdateRawHeadersAccess(nullptr, frame_host_);
 #if defined(OS_ANDROID)
     GetWakeLock()->RequestWakeLock();
@@ -354,7 +351,9 @@ bool RenderFrameDevToolsAgentHost::AttachSession(DevToolsSession* session) {
 void RenderFrameDevToolsAgentHost::DetachSession(DevToolsSession* session) {
   // Destroying session automatically detaches in renderer.
   if (sessions().empty()) {
+#if defined(OS_ANDROID)
     frame_trace_recorder_.reset();
+#endif
     UpdateRawHeadersAccess(frame_host_, nullptr);
 #if defined(OS_ANDROID)
     GetWakeLock()->CancelWakeLock();
@@ -389,17 +388,16 @@ RenderFrameDevToolsAgentHost::~RenderFrameDevToolsAgentHost() {
 
 void RenderFrameDevToolsAgentHost::ReadyToCommitNavigation(
     NavigationHandle* navigation_handle) {
-  NavigationHandleImpl* handle =
-      static_cast<NavigationHandleImpl*>(navigation_handle);
+  NavigationRequest* request = NavigationRequest::From(navigation_handle);
   for (auto* tracing : protocol::TracingHandler::ForAgentHost(this))
-    tracing->ReadyToCommitNavigation(handle);
+    tracing->ReadyToCommitNavigation(request);
 
-  if (handle->frame_tree_node() != frame_tree_node_) {
-    if (ShouldForceCreation() && handle->GetRenderFrameHost() &&
-        handle->GetRenderFrameHost()->IsCrossProcessSubframe()) {
+  if (request->frame_tree_node() != frame_tree_node_) {
+    if (ShouldForceCreation() && request->GetRenderFrameHost() &&
+        request->GetRenderFrameHost()->IsCrossProcessSubframe()) {
       // An agent may have been created earlier if auto attach is on.
-      if (!FindAgentHost(handle->frame_tree_node()))
-        CreateForCrossProcessNavigation(handle);
+      if (!FindAgentHost(request->frame_tree_node()))
+        CreateForCrossProcessNavigation(request);
     }
     return;
   }
@@ -408,30 +406,36 @@ void RenderFrameDevToolsAgentHost::ReadyToCommitNavigation(
   // renderer process. To ensure consistent view over protocol, disconnect them
   // right now.
   GetRendererChannel()->ForceDetachWorkerSessions();
-  UpdateFrameHost(handle->GetRenderFrameHost());
+  UpdateFrameHost(request->GetRenderFrameHost());
   // UpdateFrameHost may destruct |this|.
 }
 
 void RenderFrameDevToolsAgentHost::DidFinishNavigation(
     NavigationHandle* navigation_handle) {
-  NavigationHandleImpl* handle =
-      static_cast<NavigationHandleImpl*>(navigation_handle);
-  if (handle->frame_tree_node() != frame_tree_node_)
+  NavigationRequest* request = NavigationRequest::From(navigation_handle);
+  if (request->frame_tree_node() != frame_tree_node_)
     return;
-  navigation_handles_.erase(handle);
-  if (handle->HasCommitted())
+  navigation_requests_.erase(request);
+  if (request->HasCommitted())
     NotifyNavigated();
 
   // UpdateFrameHost may destruct |this|.
   scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
   UpdateFrameHost(frame_tree_node_->current_frame_host());
 
-  if (navigation_handles_.empty()) {
+  if (navigation_requests_.empty()) {
     for (DevToolsSession* session : sessions())
       session->ResumeSendingMessagesToAgent();
   }
   for (auto* target : protocol::TargetHandler::ForAgentHost(this))
     target->DidFinishNavigation();
+
+  // RenderFrameDevToolsAgentHost is associated with frame_tree_node, while
+  // documents in the back-forward cache share a node, therefore we can't cache
+  // them. TODO(1001087): add support long-term.
+  content::BackForwardCache::DisableForRenderFrameHost(
+      navigation_handle->GetPreviousRenderFrameHostId(),
+      "RenderFrameDevToolsAgentHost");
 }
 
 void RenderFrameDevToolsAgentHost::UpdateFrameHost(
@@ -476,15 +480,14 @@ void RenderFrameDevToolsAgentHost::UpdateFrameHost(
 
 void RenderFrameDevToolsAgentHost::DidStartNavigation(
     NavigationHandle* navigation_handle) {
-  NavigationHandleImpl* handle =
-      static_cast<NavigationHandleImpl*>(navigation_handle);
-  if (handle->frame_tree_node() != frame_tree_node_)
+  NavigationRequest* request = NavigationRequest::From(navigation_handle);
+  if (request->frame_tree_node() != frame_tree_node_)
     return;
-  if (navigation_handles_.empty()) {
+  if (navigation_requests_.empty()) {
     for (DevToolsSession* session : sessions())
       session->SuspendSendingMessagesToAgent();
   }
-  navigation_handles_.insert(handle);
+  navigation_requests_.insert(request);
 }
 
 void RenderFrameDevToolsAgentHost::RenderFrameHostChanged(
@@ -583,10 +586,13 @@ void RenderFrameDevToolsAgentHost::DidDetachInterstitialPage() {
 void RenderFrameDevToolsAgentHost::OnVisibilityChanged(
     content::Visibility visibility) {
 #if defined(OS_ANDROID)
-  if (visibility == content::Visibility::HIDDEN)
-    GetWakeLock()->CancelWakeLock();
-  else
-    GetWakeLock()->RequestWakeLock();
+  if (!sessions().empty()) {
+    if (visibility == content::Visibility::HIDDEN) {
+      GetWakeLock()->CancelWakeLock();
+    } else {
+      GetWakeLock()->RequestWakeLock();
+    }
+  }
 #endif
 }
 
@@ -598,7 +604,7 @@ void RenderFrameDevToolsAgentHost::OnPageScaleFactorChanged(
 }
 
 void RenderFrameDevToolsAgentHost::DisconnectWebContents() {
-  navigation_handles_.clear();
+  navigation_requests_.clear();
   SetFrameTreeNode(nullptr);
   // UpdateFrameHost may destruct |this|.
   scoped_refptr<RenderFrameDevToolsAgentHost> protect(this);
@@ -730,9 +736,10 @@ base::TimeTicks RenderFrameDevToolsAgentHost::GetLastActivityTime() {
   return base::TimeTicks();
 }
 
+#if defined(OS_ANDROID)
 void RenderFrameDevToolsAgentHost::SignalSynchronousSwapCompositorFrame(
     RenderFrameHost* frame_host,
-    const DevToolsFrameMetadata& frame_metadata) {
+    const cc::RenderFrameMetadata& frame_metadata) {
   scoped_refptr<RenderFrameDevToolsAgentHost> dtah(FindAgentHost(
       static_cast<RenderFrameHostImpl*>(frame_host)->frame_tree_node()));
   if (dtah) {
@@ -746,7 +753,7 @@ void RenderFrameDevToolsAgentHost::SignalSynchronousSwapCompositorFrame(
 }
 
 void RenderFrameDevToolsAgentHost::SynchronousSwapCompositorFrame(
-    const DevToolsFrameMetadata& frame_metadata) {
+    const cc::RenderFrameMetadata& frame_metadata) {
   for (auto* page : protocol::PageHandler::ForAgentHost(this))
     page->OnSynchronousSwapCompositorFrame(frame_metadata);
 
@@ -760,6 +767,7 @@ void RenderFrameDevToolsAgentHost::SynchronousSwapCompositorFrame(
                                                             frame_metadata);
   }
 }
+#endif
 
 void RenderFrameDevToolsAgentHost::UpdateRendererChannel(bool force) {
   mojo::PendingAssociatedRemote<blink::mojom::DevToolsAgent> agent_remote;
diff --git a/chromium/content/browser/devtools/render_frame_devtools_agent_host.h b/chromium/content/browser/devtools/render_frame_devtools_agent_host.h
index 4fbdf6a7901..3ebf652e8dc 100644
--- a/chromium/content/browser/devtools/render_frame_devtools_agent_host.h
+++ b/chromium/content/browser/devtools/render_frame_devtools_agent_host.h
@@ -28,14 +28,17 @@
 #include "ui/android/view_android.h"
 #endif  // OS_ANDROID
 
+namespace cc {
+class RenderFrameMetadata;
+}
+
 namespace content {
 
 class BrowserContext;
 class DevToolsFrameTraceRecorder;
 class FrameTreeNode;
-class NavigationHandleImpl;
+class NavigationRequest;
 class RenderFrameHostImpl;
-struct DevToolsFrameMetadata;
 
 class CONTENT_EXPORT RenderFrameDevToolsAgentHost
     : public DevToolsAgentHostImpl,
@@ -59,15 +62,18 @@ class CONTENT_EXPORT RenderFrameDevToolsAgentHost
   // This method is called when new frame is created during cross process
   // navigation.
   static scoped_refptr<DevToolsAgentHost> CreateForCrossProcessNavigation(
-      NavigationHandleImpl* handle);
+      NavigationRequest* request);
   static scoped_refptr<DevToolsAgentHost> FindForDangling(
       FrameTreeNode* frame_tree_node);
 
   static void WebContentsCreated(WebContents* web_contents);
 
+#if defined(OS_ANDROID)
   static void SignalSynchronousSwapCompositorFrame(
       RenderFrameHost* frame_host,
-      const DevToolsFrameMetadata& frame_metadata);
+      const cc::RenderFrameMetadata& frame_metadata);
+#endif
+
   FrameTreeNode* frame_tree_node() { return frame_tree_node_; }
 
   // DevToolsAgentHost overrides.
@@ -129,20 +135,20 @@ class CONTENT_EXPORT RenderFrameDevToolsAgentHost
 
 #if defined(OS_ANDROID)
   device::mojom::WakeLock* GetWakeLock();
+  void SynchronousSwapCompositorFrame(
+      const cc::RenderFrameMetadata& frame_metadata);
 #endif
 
-  void SynchronousSwapCompositorFrame(
-      const DevToolsFrameMetadata& frame_metadata);
   void UpdateResourceLoaderFactories();
 
-  std::unique_ptr<DevToolsFrameTraceRecorder> frame_trace_recorder_;
 #if defined(OS_ANDROID)
+  std::unique_ptr<DevToolsFrameTraceRecorder> frame_trace_recorder_;
   mojo::Remote<device::mojom::WakeLock> wake_lock_;
 #endif
 
   // The active host we are talking to.
   RenderFrameHostImpl* frame_host_ = nullptr;
-  base::flat_set<NavigationHandleImpl*> navigation_handles_;
+  base::flat_set<NavigationRequest*> navigation_requests_;
   bool render_frame_alive_ = false;
   void* active_file_chooser_interceptor_ = nullptr;
 
diff --git a/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc b/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc
index 7908a8ed13c..bd29fac2adc 100644
--- a/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc
+++ b/chromium/content/browser/devtools/render_frame_devtools_agent_host_browsertest.cc
@@ -7,8 +7,10 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/devtools_agent_host.h"
 #include "content/public/browser/devtools_agent_host_client.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/url_constants.h"
+#include "content/public/test/back_forward_cache_util.h"
 #include "content/public/test/browser_test_base.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -170,4 +172,32 @@ IN_PROC_BROWSER_TEST_F(RenderFrameDevToolsAgentHostBrowserTest,
   devtools_agent_host->DetachClient(&devtools_agent_host_client);
 }
 
+IN_PROC_BROWSER_TEST_F(RenderFrameDevToolsAgentHostBrowserTest,
+                       DevToolsDisableBackForwardCache) {
+  content::BackForwardCacheDisabledTester tester;
+  EXPECT_TRUE(embedded_test_server()->Start());
+
+  // Navigate to a page.
+  const GURL a_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), a_url));
+  content::RenderFrameHost* main_frame =
+      shell()->web_contents()->GetMainFrame();
+  int process_id = main_frame->GetProcess()->GetID();
+  int frame_routing_id = main_frame->GetRoutingID();
+
+  // Open DevTools.
+  scoped_refptr<DevToolsAgentHost> devtools_agent_host =
+      DevToolsAgentHost::GetOrCreateFor(shell()->web_contents());
+  StubDevToolsAgentHostClient devtools_agent_host_client;
+  devtools_agent_host->AttachClient(&devtools_agent_host_client);
+
+  // Navigate away from the page. This should block bfcache.
+  const GURL b_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), b_url));
+  EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+      process_id, frame_routing_id, "RenderFrameDevToolsAgentHost"));
+
+  devtools_agent_host->DetachClient(&devtools_agent_host_client);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/devtools/service_worker_devtools_manager.cc b/chromium/content/browser/devtools/service_worker_devtools_manager.cc
index 678fa854965..5acc20c7f88 100644
--- a/chromium/content/browser/devtools/service_worker_devtools_manager.cc
+++ b/chromium/content/browser/devtools/service_worker_devtools_manager.cc
@@ -188,11 +188,12 @@ void ServiceWorkerDevToolsManager::NavigationPreloadRequestSent(
   auto it = live_hosts_.find(worker_id);
   if (it == live_hosts_.end())
     return;
+  auto timestamp = base::TimeTicks::Now();
   for (auto* network :
        protocol::NetworkHandler::ForAgentHost(it->second.get())) {
     network->RequestSent(request_id, std::string(), request,
                          protocol::Network::Initiator::TypeEnum::Preload,
-                         base::nullopt /* initiator_url */);
+                         base::nullopt /* initiator_url */, timestamp);
   }
 }
 
diff --git a/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc b/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc
index c40de12c83b..353f2e16a38 100644
--- a/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc
+++ b/chromium/content/browser/devtools/site_per_process_devtools_browsertest.cc
@@ -69,7 +69,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessDevToolsBrowserTest,
                        MAYBE_CrossSiteIframeAgentHost) {
   DevToolsAgentHost::List list;
   GURL main_url(embedded_test_server()->GetURL("/site_per_process_main.html"));
-  NavigateToURL(shell(), main_url);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root =
@@ -140,7 +140,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessDevToolsBrowserTest,
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessDevToolsBrowserTest, AgentHostForFrames) {
   GURL main_url(embedded_test_server()->GetURL("/site_per_process_main.html"));
-  NavigateToURL(shell(), main_url);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   scoped_refptr<DevToolsAgentHost> page_agent =
       DevToolsAgentHost::GetOrCreateFor(shell()->web_contents());
@@ -179,7 +179,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessDevToolsBrowserTest, AgentHostForFrames) {
 IN_PROC_BROWSER_TEST_F(SitePerProcessDevToolsBrowserTest,
     AgentHostForPageEqualsOneForMainFrame) {
   GURL main_url(embedded_test_server()->GetURL("/site_per_process_main.html"));
-  NavigateToURL(shell(), main_url);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root =
diff --git a/chromium/content/browser/display_cutout/display_cutout_browsertest.cc b/chromium/content/browser/display_cutout/display_cutout_browsertest.cc
index 3a2b94a484c..db17ecfa980 100644
--- a/chromium/content/browser/display_cutout/display_cutout_browsertest.cc
+++ b/chromium/content/browser/display_cutout/display_cutout_browsertest.cc
@@ -22,6 +22,7 @@
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
@@ -83,21 +84,20 @@ class TestWebContentsObserver : public WebContentsObserver {
   DISALLOW_COPY_AND_ASSIGN(TestWebContentsObserver);
 };
 
-// Used for forcing a specific |blink::WebDisplayMode| during a test.
+// Used for forcing a specific |blink::mojom::DisplayMode| during a test.
 class DisplayCutoutWebContentsDelegate : public WebContentsDelegate {
  public:
-  blink::WebDisplayMode GetDisplayMode(
+  blink::mojom::DisplayMode GetDisplayMode(
       const WebContents* web_contents) override {
     return display_mode_;
   }
 
-  void SetDisplayMode(blink::WebDisplayMode display_mode) {
+  void SetDisplayMode(blink::mojom::DisplayMode display_mode) {
     display_mode_ = display_mode;
   }
 
  private:
-  blink::WebDisplayMode display_mode_ =
-      blink::WebDisplayMode::kWebDisplayModeBrowser;
+  blink::mojom::DisplayMode display_mode_ = blink::mojom::DisplayMode::kBrowser;
 };
 
 const char kTestHTML[] =
@@ -159,8 +159,9 @@ class DisplayCutoutBrowserTest : public ContentBrowserTest {
   }
 
   void SendSafeAreaToFrame(int top, int left, int bottom, int right) {
-    blink::mojom::DisplayCutoutClientAssociatedPtr client;
-    MainFrame()->GetRemoteAssociatedInterfaces()->GetInterface(&client);
+    mojo::AssociatedRemote<blink::mojom::DisplayCutoutClient> client;
+    MainFrame()->GetRemoteAssociatedInterfaces()->GetInterface(
+        client.BindNewEndpointAndPassReceiver());
     client->SetSafeArea(
         blink::mojom::DisplayCutoutSafeArea::New(top, left, bottom, right));
   }
@@ -433,7 +434,7 @@ IN_PROC_BROWSER_TEST_F(DisplayCutoutBrowserTest, WebDisplayMode_Fullscreen) {
   // Inject the custom delegate used for this test.
   std::unique_ptr<DisplayCutoutWebContentsDelegate> delegate(
       new DisplayCutoutWebContentsDelegate());
-  delegate->SetDisplayMode(blink::WebDisplayMode::kWebDisplayModeFullscreen);
+  delegate->SetDisplayMode(blink::mojom::DisplayMode::kFullscreen);
   web_contents_impl()->SetDelegate(delegate.get());
   EXPECT_EQ(delegate.get(), web_contents_impl()->GetDelegate());
 
@@ -448,7 +449,7 @@ IN_PROC_BROWSER_TEST_F(DisplayCutoutBrowserTest, WebDisplayMode_Standalone) {
   // Inject the custom delegate used for this test.
   std::unique_ptr<DisplayCutoutWebContentsDelegate> delegate(
       new DisplayCutoutWebContentsDelegate());
-  delegate->SetDisplayMode(blink::WebDisplayMode::kWebDisplayModeStandalone);
+  delegate->SetDisplayMode(blink::mojom::DisplayMode::kStandalone);
   web_contents_impl()->SetDelegate(delegate.get());
   EXPECT_EQ(delegate.get(), web_contents_impl()->GetDelegate());
 
diff --git a/chromium/content/browser/display_cutout/display_cutout_host_impl.cc b/chromium/content/browser/display_cutout/display_cutout_host_impl.cc
index 5d61832fc4e..4410e4ac76f 100644
--- a/chromium/content/browser/display_cutout/display_cutout_host_impl.cc
+++ b/chromium/content/browser/display_cutout/display_cutout_host_impl.cc
@@ -7,6 +7,7 @@
 #include "content/browser/display_cutout/display_cutout_constants.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/navigation_handle.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 
@@ -72,8 +73,8 @@ void DisplayCutoutHostImpl::DidFinishNavigation(
   // |RenderFrameHost|.
   RenderWidgetHostImpl* rwh =
       web_contents_impl_->GetRenderViewHost()->GetWidget();
-  blink::WebDisplayMode mode = web_contents_impl_->GetDisplayMode(rwh);
-  if (mode == blink::WebDisplayMode::kWebDisplayModeFullscreen)
+  blink::mojom::DisplayMode mode = web_contents_impl_->GetDisplayMode(rwh);
+  if (mode == blink::mojom::DisplayMode::kFullscreen)
     SetCurrentRenderFrameHost(web_contents_impl_->GetMainFrame());
 }
 
@@ -146,8 +147,8 @@ void DisplayCutoutHostImpl::SendSafeAreaToFrame(RenderFrameHost* rfh,
   if (!provider)
     return;
 
-  blink::mojom::DisplayCutoutClientAssociatedPtr client;
-  provider->GetInterface(&client);
+  mojo::AssociatedRemote<blink::mojom::DisplayCutoutClient> client;
+  provider->GetInterface(client.BindNewEndpointAndPassReceiver());
   client->SetSafeArea(blink::mojom::DisplayCutoutSafeArea::New(
       insets.top(), insets.left(), insets.bottom(), insets.right()));
 }
diff --git a/chromium/content/browser/do_not_track_browsertest.cc b/chromium/content/browser/do_not_track_browsertest.cc
index 4177c35c318..07e7cc074d0 100644
--- a/chromium/content/browser/do_not_track_browsertest.cc
+++ b/chromium/content/browser/do_not_track_browsertest.cc
@@ -8,6 +8,7 @@
 #include "build/build_config.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -150,7 +151,7 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, Redirect) {
     return;
   // We don't check the result NavigateToURL as it returns true only if the
   // final URL is equal to the passed URL.
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url, final_url /* expected_commit_url */));
   ExpectPageTextEq("1");
 }
 
@@ -175,8 +176,8 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, Worker) {
   ASSERT_TRUE(embedded_test_server()->Start());
   if (!EnableDoNotTrack())
     return;
-  NavigateToURL(shell(),
-                GetURL("/workers/create_worker.html?worker_url=/capture"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GetURL("/workers/create_worker.html?worker_url=/capture")));
   loop.Run();
 
   EXPECT_TRUE(header_map.find("DNT") != header_map.end());
@@ -206,9 +207,9 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, MAYBE_SharedWorker) {
   ASSERT_TRUE(embedded_test_server()->Start());
   if (!EnableDoNotTrack())
     return;
-  NavigateToURL(
+  EXPECT_TRUE(NavigateToURL(
       shell(),
-      GetURL("/workers/create_shared_worker.html?worker_url=/capture"));
+      GetURL("/workers/create_shared_worker.html?worker_url=/capture")));
   loop.Run();
 
   EXPECT_TRUE(header_map.find("DNT") != header_map.end());
@@ -231,7 +232,8 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, ServiceWorker_Register) {
   ASSERT_TRUE(embedded_test_server()->Start());
   if (!EnableDoNotTrack())
     return;
-  NavigateToURL(shell(), GetURL("/service_worker/create_service_worker.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GetURL("/service_worker/create_service_worker.html")));
 
   EXPECT_EQ("DONE", EvalJs(shell(), "register('/capture');"));
   loop.Run();
@@ -260,7 +262,8 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, ServiceWorker_Update) {
 
   // Register a service worker, trigger update, then wait until the handler sees
   // the second request.
-  NavigateToURL(shell(), GetURL("/service_worker/create_service_worker.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GetURL("/service_worker/create_service_worker.html")));
   EXPECT_EQ("DONE", EvalJs(shell(), "register('/capture');"));
   EXPECT_EQ("DONE", EvalJs(shell(), "update();"));
   loop.Run();
@@ -279,7 +282,8 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, FetchFromWorker) {
   ASSERT_TRUE(embedded_test_server()->Start());
   if (!EnableDoNotTrack())
     return;
-  NavigateToURL(shell(), GetURL("/workers/fetch_from_worker.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetURL("/workers/fetch_from_worker.html")));
   EXPECT_EQ("1", EvalJs(shell(), "fetch_from_worker('/echoheader?DNT');"));
 }
 
@@ -296,7 +300,8 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, MAYBE_FetchFromSharedWorker) {
   ASSERT_TRUE(embedded_test_server()->Start());
   if (!EnableDoNotTrack())
     return;
-  NavigateToURL(shell(), GetURL("/workers/fetch_from_shared_worker.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetURL("/workers/fetch_from_shared_worker.html")));
 
   EXPECT_EQ("1",
             EvalJs(shell(), "fetch_from_shared_worker('/echoheader?DNT');"));
@@ -307,8 +312,8 @@ IN_PROC_BROWSER_TEST_F(DoNotTrackTest, FetchFromServiceWorker) {
   ASSERT_TRUE(embedded_test_server()->Start());
   if (!EnableDoNotTrack())
     return;
-  NavigateToURL(shell(),
-                GetURL("/service_worker/fetch_from_service_worker.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GetURL("/service_worker/fetch_from_service_worker.html")));
 
   EXPECT_EQ("ready", EvalJs(shell(), "setup();"));
   EXPECT_EQ("1",
diff --git a/chromium/content/browser/dom_storage/DEPS b/chromium/content/browser/dom_storage/DEPS
index 743a2f3baec..2e448d8668f 100644
--- a/chromium/content/browser/dom_storage/DEPS
+++ b/chromium/content/browser/dom_storage/DEPS
@@ -1,3 +1,4 @@
 include_rules = [
+  "+components/services/storage",
   "+third_party/leveldatabase",
 ]
diff --git a/chromium/content/browser/dom_storage/dom_storage_context_wrapper.cc b/chromium/content/browser/dom_storage/dom_storage_context_wrapper.cc
index c7e290ad738..1ad997ac00c 100644
--- a/chromium/content/browser/dom_storage/dom_storage_context_wrapper.cc
+++ b/chromium/content/browser/dom_storage/dom_storage_context_wrapper.cc
@@ -34,6 +34,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "sql/database.h"
+#include "storage/browser/quota/special_storage_policy.h"
 #include "third_party/blink/public/common/features.h"
 #include "url/origin.h"
 
@@ -102,7 +103,6 @@ void GotMojoSessionStorageUsage(
 }  // namespace
 
 scoped_refptr<DOMStorageContextWrapper> DOMStorageContextWrapper::Create(
-    service_manager::Connector* connector,
     const base::FilePath& profile_path,
     const base::FilePath& local_partition_path,
     storage::SpecialStoragePolicy* special_storage_policy) {
@@ -129,15 +129,19 @@ scoped_refptr<DOMStorageContextWrapper> DOMStorageContextWrapper::Create(
   base::FilePath new_localstorage_path =
       profile_path.empty()
           ? base::FilePath()
-          : local_partition_path.AppendASCII(kLocalStorageDirectory);
+          : base::FilePath().AppendASCII(kLocalStorageDirectory);
   LocalStorageContextMojo* mojo_local_state = new LocalStorageContextMojo(
-      mojo_task_runner, connector,
+      data_path, mojo_task_runner,
       new DOMStorageWorkerPoolTaskRunner(std::move(primary_sequence),
                                          std::move(commit_sequence)),
       legacy_localstorage_path, new_localstorage_path, special_storage_policy);
   SessionStorageContextMojo* mojo_session_state = nullptr;
   mojo_session_state = new SessionStorageContextMojo(
-      mojo_task_runner, connector,
+      data_path,
+      base::CreateSequencedTaskRunner(
+          {base::MayBlock(), base::ThreadPool(),
+           base::TaskShutdownBehavior::BLOCK_SHUTDOWN}),
+      mojo_task_runner,
 #if defined(OS_ANDROID)
       // On Android there is no support for session storage restoring, and
       // since the restoring code is responsible for database cleanup, we must
@@ -148,7 +152,7 @@ scoped_refptr<DOMStorageContextWrapper> DOMStorageContextWrapper::Create(
           ? SessionStorageContextMojo::BackingMode::kNoDisk
           : SessionStorageContextMojo::BackingMode::kRestoreDiskState,
 #endif
-      local_partition_path, std::string(kSessionStorageDirectory));
+      std::string(kSessionStorageDirectory));
 
   return base::WrapRefCounted(new DOMStorageContextWrapper(
       std::move(legacy_localstorage_path), mojo_task_runner, mojo_local_state,
@@ -432,16 +436,14 @@ void DOMStorageContextWrapper::OpenSessionStorage(
                      std::move(receiver)));
 }
 
-void DOMStorageContextWrapper::SetLocalStorageDatabaseForTesting(
-    mojo::PendingAssociatedRemote<leveldb::mojom::LevelDBDatabase> database) {
-  // base::Unretained is safe here, because the mojo_state_ won't be deleted
-  // until a ShutdownAndDelete task has been ran on the mojo_task_runner_, and
-  // as soon as that task is posted, mojo_state_ is set to null, preventing
-  // further tasks from being queued.
+void DOMStorageContextWrapper::SetLocalStorageDatabaseOpenCallbackForTesting(
+    LocalStorageDatabaseOpenCallback callback) {
   mojo_task_runner_->PostTask(
       FROM_HERE,
-      base::BindOnce(&LocalStorageContextMojo::SetDatabaseForTesting,
-                     base::Unretained(mojo_state_), std::move(database)));
+      base::BindOnce(
+          &LocalStorageContextMojo::SetDatabaseOpenCallbackForTesting,
+          base::Unretained(mojo_state_),
+          base::BindOnce(std::move(callback), mojo_state_)));
 }
 
 scoped_refptr<SessionStorageNamespaceImpl>
diff --git a/chromium/content/browser/dom_storage/dom_storage_context_wrapper.h b/chromium/content/browser/dom_storage/dom_storage_context_wrapper.h
index c2f7caaacef..5ab6db92ccf 100644
--- a/chromium/content/browser/dom_storage/dom_storage_context_wrapper.h
+++ b/chromium/content/browser/dom_storage/dom_storage_context_wrapper.h
@@ -8,6 +8,7 @@
 #include <map>
 #include <string>
 
+#include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/memory/memory_pressure_listener.h"
 #include "base/memory/ref_counted.h"
@@ -27,10 +28,6 @@ namespace base {
 class FilePath;
 }
 
-namespace service_manager {
-class Connector;
-}
-
 namespace storage {
 class SpecialStoragePolicy;
 }
@@ -64,7 +61,6 @@ class CONTENT_EXPORT DOMStorageContextWrapper
 
   // If |profile_path| is empty, nothing will be saved to disk.
   static scoped_refptr<DOMStorageContextWrapper> Create(
-      service_manager::Connector* connector,
       const base::FilePath& profile_path,
       const base::FilePath& local_partition_path,
       storage::SpecialStoragePolicy* special_storage_policy);
@@ -109,8 +105,10 @@ class CONTENT_EXPORT DOMStorageContextWrapper
       mojo::ReportBadMessageCallback bad_message_callback,
       mojo::PendingReceiver<blink::mojom::SessionStorageNamespace> receiver);
 
-  void SetLocalStorageDatabaseForTesting(
-      mojo::PendingAssociatedRemote<leveldb::mojom::LevelDBDatabase> database);
+  using LocalStorageDatabaseOpenCallback =
+      base::OnceCallback<void(LocalStorageContextMojo*)>;
+  void SetLocalStorageDatabaseOpenCallbackForTesting(
+      LocalStorageDatabaseOpenCallback callback);
 
   SessionStorageContextMojo* mojo_session_state() {
     return mojo_session_state_;
diff --git a/chromium/content/browser/dom_storage/dom_storage_context_wrapper_unittest.cc b/chromium/content/browser/dom_storage/dom_storage_context_wrapper_unittest.cc
index 856a0605546..89243ca4528 100644
--- a/chromium/content/browser/dom_storage/dom_storage_context_wrapper_unittest.cc
+++ b/chromium/content/browser/dom_storage/dom_storage_context_wrapper_unittest.cc
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
+#include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
 #include "base/test/test_simple_task_runner.h"
@@ -29,14 +30,17 @@ class DOMStorageContextWrapperTest : public testing::Test {
   void SetUp() override {
     storage_policy_ = new MockSpecialStoragePolicy();
     fake_mojo_task_runner_ = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+    auto* session_storage_context = new SessionStorageContextMojo(
+        /*partition_path=*/base::FilePath(),
+        base::CreateSequencedTaskRunner(
+            {base::MayBlock(), base::ThreadPool(),
+             base::TaskShutdownBehavior::BLOCK_SHUTDOWN}),
+        fake_mojo_task_runner_, SessionStorageContextMojo::BackingMode::kNoDisk,
+        /*leveldb_name=*/"");
+    session_storage_context->PretendToConnectForTesting();
     context_ = new DOMStorageContextWrapper(
         /*legacy_local_storage_path=*/base::FilePath(), fake_mojo_task_runner_,
-        /*mojo_local_storage_context=*/nullptr,
-        new SessionStorageContextMojo(
-            fake_mojo_task_runner_, /*connector=*/nullptr,
-            SessionStorageContextMojo::BackingMode::kNoDisk,
-            /*local_partition_directory=*/base::FilePath(),
-            /*leveldb_name=*/""));
+        /*mojo_local_storage_context=*/nullptr, session_storage_context);
   }
 
   void TearDown() override {
@@ -56,6 +60,11 @@ class DOMStorageContextWrapperTest : public testing::Test {
 };
 
 TEST_F(DOMStorageContextWrapperTest, BadMessageScheduling) {
+  // This is a regression test for https://crbug.com/916523, which verifies that
+  // when SessionStorageContextMojo invokes its bad-message callback on the
+  // main task runner rather than SessionStorageContextMojo's internal task
+  // runner. This is necessary because the bad-message callback is associated
+  // with StoragePartitionImpl's ReceiverSet which lives on the main thread.
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace_remote;
   bool called = false;
   // This call is invalid because |CreateSessionNamespace| was never called on
diff --git a/chromium/content/browser/dom_storage/local_storage_context_mojo.cc b/chromium/content/browser/dom_storage/local_storage_context_mojo.cc
index 759feabdd69..26141788cdd 100644
--- a/chromium/content/browser/dom_storage/local_storage_context_mojo.cc
+++ b/chromium/content/browser/dom_storage/local_storage_context_mojo.cc
@@ -19,19 +19,22 @@
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/string_piece.h"
 #include "base/strings/stringprintf.h"
 #include "base/system/sys_info.h"
+#include "base/task/post_task.h"
 #include "base/trace_event/memory_dump_manager.h"
 #include "build/build_config.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/dom_storage_types.h"
 #include "content/browser/dom_storage/local_storage_database.pb.h"
 #include "content/browser/dom_storage/storage_area_impl.h"
 #include "content/public/browser/storage_usage_info.h"
-#include "services/file/public/mojom/constants.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "sql/database.h"
 #include "storage/browser/quota/special_storage_policy.h"
 #include "storage/common/database/database_identifier.h"
@@ -55,9 +58,7 @@ namespace content {
 
 namespace {
 
-const char kVersionKey[] = "VERSION";
-const char kOriginSeparator = '\x00';
-const char kDataPrefix[] = "_";
+constexpr base::StringPiece kVersionKey = "VERSION";
 const uint8_t kMetaPrefix[] = {'M', 'E', 'T', 'A', ':'};
 const int64_t kMinSchemaVersion = 1;
 const int64_t kCurrentLocalStorageSchemaVersion = 1;
@@ -79,9 +80,9 @@ const size_t kMaxLocalStorageCacheSize = 20 * 1024 * 1024;
 static const uint8_t kUTF16Format = 0;
 static const uint8_t kLatin1Format = 1;
 
-std::vector<uint8_t> CreateMetaDataKey(const url::Origin& origin) {
+storage::DomStorageDatabase::Key CreateMetaDataKey(const url::Origin& origin) {
   auto serialized_origin = leveldb::StdStringToUint8Vector(origin.Serialize());
-  std::vector<uint8_t> key;
+  storage::DomStorageDatabase::Key key;
   key.reserve(base::size(kMetaPrefix) + serialized_origin.size());
   key.insert(key.end(), kMetaPrefix, kMetaPrefix + base::size(kMetaPrefix));
   key.insert(key.end(), serialized_origin.begin(), serialized_origin.end());
@@ -91,15 +92,16 @@ std::vector<uint8_t> CreateMetaDataKey(const url::Origin& origin) {
 void SuccessResponse(base::OnceClosure callback, bool success) {
   std::move(callback).Run();
 }
-void DatabaseErrorResponse(base::OnceClosure callback,
-                           leveldb::mojom::DatabaseError error) {
+
+void IgnoreStatus(base::OnceClosure callback, leveldb::Status status) {
   std::move(callback).Run();
 }
 
 void MigrateStorageHelper(
     base::FilePath db_path,
     const scoped_refptr<base::SingleThreadTaskRunner> reply_task_runner,
-    base::Callback<void(std::unique_ptr<StorageAreaImpl::ValueMap>)> callback) {
+    base::OnceCallback<void(std::unique_ptr<StorageAreaImpl::ValueMap>)>
+        callback) {
   DOMStorageDatabase db(db_path);
   DOMStorageValuesMap map;
   db.ReadAllValues(&map);
@@ -118,20 +120,36 @@ void CallMigrationCalback(StorageAreaImpl::ValueMapCallback callback,
   std::move(callback).Run(std::move(data));
 }
 
-void AddDeleteOriginOperations(
-    std::vector<leveldb::mojom::BatchedOperationPtr>* operations,
-    const url::Origin& origin) {
-  leveldb::mojom::BatchedOperationPtr item =
-      leveldb::mojom::BatchedOperation::New();
-  item->type = leveldb::mojom::BatchOperationType::DELETE_PREFIXED_KEY;
-  item->key = leveldb::StdStringToUint8Vector(kDataPrefix + origin.Serialize() +
-                                              kOriginSeparator);
-  operations->push_back(std::move(item));
-
-  item = leveldb::mojom::BatchedOperation::New();
-  item->type = leveldb::mojom::BatchOperationType::DELETE_KEY;
-  item->key = CreateMetaDataKey(origin);
-  operations->push_back(std::move(item));
+storage::DomStorageDatabase::Key MakeOriginPrefix(const url::Origin& origin) {
+  const char kDataPrefix = '_';
+  const std::string serialized_origin = origin.Serialize();
+  const char kOriginSeparator = '\x00';
+
+  storage::DomStorageDatabase::Key prefix;
+  prefix.reserve(serialized_origin.size() + 2);
+  prefix.push_back(kDataPrefix);
+  prefix.insert(prefix.end(), serialized_origin.begin(),
+                serialized_origin.end());
+  prefix.push_back(kOriginSeparator);
+  return prefix;
+}
+
+void DeleteOrigins(leveldb::LevelDBDatabaseImpl* database,
+                   std::vector<url::Origin> origins,
+                   base::OnceCallback<void(leveldb::Status)> callback) {
+  database->RunDatabaseTask(
+      base::BindOnce(
+          [](std::vector<url::Origin> origins,
+             const storage::DomStorageDatabase& db) {
+            leveldb::WriteBatch batch;
+            for (const auto& origin : origins) {
+              db.DeletePrefixed(MakeOriginPrefix(origin), &batch);
+              batch.Delete(leveldb_env::MakeSlice(CreateMetaDataKey(origin)));
+            }
+            return db.Commit(&batch);
+          },
+          std::move(origins)),
+      std::move(callback));
 }
 
 enum class CachePurgeReason {
@@ -204,8 +222,7 @@ class LocalStorageContextMojo::StorageAreaHolder final
     }
 #endif
     area_ = std::make_unique<StorageAreaImpl>(
-        context_->database_ ? context_->database_.get() : nullptr,
-        kDataPrefix + origin_.Serialize() + kOriginSeparator, this, options);
+        context_->database_.get(), MakeOriginPrefix(origin_), this, options);
     area_ptr_ = area_.get();
   }
 
@@ -219,49 +236,45 @@ class LocalStorageContextMojo::StorageAreaHolder final
     storage_area()->ScheduleImmediateCommit();
   }
 
-  std::vector<leveldb::mojom::BatchedOperationPtr> PrepareToCommit() override {
-    std::vector<leveldb::mojom::BatchedOperationPtr> operations;
-
+  void PrepareToCommit(std::vector<storage::DomStorageDatabase::KeyValuePair>*
+                           extra_entries_to_add,
+                       std::vector<storage::DomStorageDatabase::Key>*
+                           extra_keys_to_delete) override {
     // Write schema version if not already done so before.
     if (!context_->database_initialized_) {
-      leveldb::mojom::BatchedOperationPtr item =
-          leveldb::mojom::BatchedOperation::New();
-      item->type = leveldb::mojom::BatchOperationType::PUT_KEY;
-      item->key = leveldb::StdStringToUint8Vector(kVersionKey);
-      item->value = leveldb::StdStringToUint8Vector(
-          base::NumberToString(kCurrentLocalStorageSchemaVersion));
-      operations.push_back(std::move(item));
+      const std::string version =
+          base::NumberToString(kCurrentLocalStorageSchemaVersion);
+      extra_entries_to_add->emplace_back(
+          storage::DomStorageDatabase::Key(kVersionKey.begin(),
+                                           kVersionKey.end()),
+          storage::DomStorageDatabase::Value(version.begin(), version.end()));
       context_->database_initialized_ = true;
     }
 
-    leveldb::mojom::BatchedOperationPtr item =
-        leveldb::mojom::BatchedOperation::New();
-    item->type = leveldb::mojom::BatchOperationType::PUT_KEY;
-    item->key = CreateMetaDataKey(origin_);
+    storage::DomStorageDatabase::Key metadata_key = CreateMetaDataKey(origin_);
     if (storage_area()->empty()) {
-      item->type = leveldb::mojom::BatchOperationType::DELETE_KEY;
+      extra_keys_to_delete->push_back(std::move(metadata_key));
     } else {
-      item->type = leveldb::mojom::BatchOperationType::PUT_KEY;
       LocalStorageOriginMetaData data;
       data.set_last_modified(base::Time::Now().ToInternalValue());
       data.set_size_bytes(storage_area()->storage_used());
-      item->value = leveldb::StdStringToUint8Vector(data.SerializeAsString());
+      std::string serialized_data = data.SerializeAsString();
+      extra_entries_to_add->emplace_back(
+          std::move(metadata_key),
+          storage::DomStorageDatabase::Value(serialized_data.begin(),
+                                             serialized_data.end()));
     }
-    operations.push_back(std::move(item));
-
-    return operations;
   }
 
-  void DidCommit(leveldb::mojom::DatabaseError error) override {
+  void DidCommit(leveldb::Status status) override {
     UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.CommitResult",
-                              leveldb::GetLevelDBStatusUMAValue(error),
+                              leveldb_env::GetLevelDBStatusUMAValue(status),
                               leveldb_env::LEVELDB_STATUS_MAX);
 
     // Delete any old database that might still exist if we successfully wrote
     // data to LevelDB, and our LevelDB is actually disk backed.
-    if (error == leveldb::mojom::DatabaseError::OK && !deleted_old_data_ &&
-        !context_->subdirectory_.empty() && context_->task_runner_ &&
-        !context_->old_localstorage_path_.empty()) {
+    if (status.ok() && !deleted_old_data_ && !context_->directory_.empty() &&
+        context_->task_runner_ && !context_->old_localstorage_path_.empty()) {
       deleted_old_data_ = true;
       context_->task_runner_->PostShutdownBlockingTask(
           FROM_HERE, DOMStorageTaskRunner::PRIMARY_SEQUENCE,
@@ -269,7 +282,7 @@ class LocalStorageContextMojo::StorageAreaHolder final
                          sql_db_path()));
     }
 
-    context_->OnCommitResult(error);
+    context_->OnCommitResult(status);
   }
 
   void MigrateData(StorageAreaImpl::ValueMapCallback callback) override {
@@ -279,7 +292,7 @@ class LocalStorageContextMojo::StorageAreaHolder final
           base::BindOnce(
               &MigrateStorageHelper, sql_db_path(),
               base::ThreadTaskRunnerHandle::Get(),
-              base::Bind(&CallMigrationCalback, base::Passed(&callback))));
+              base::BindOnce(&CallMigrationCalback, base::Passed(&callback))));
       return;
     }
     std::move(callback).Run(nullptr);
@@ -337,11 +350,12 @@ class LocalStorageContextMojo::StorageAreaHolder final
     return changes;
   }
 
-  void OnMapLoaded(leveldb::mojom::DatabaseError error) override {
-    if (error != leveldb::mojom::DatabaseError::OK)
+  void OnMapLoaded(leveldb::Status status) override {
+    if (!status.ok()) {
       UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.MapLoadError",
-                                leveldb::GetLevelDBStatusUMAValue(error),
+                                leveldb_env::GetLevelDBStatusUMAValue(status),
                                 leveldb_env::LEVELDB_STATUS_MAX);
+    }
   }
 
   void Bind(mojo::PendingReceiver<blink::mojom::StorageArea> receiver) {
@@ -396,15 +410,19 @@ url::Origin LocalStorageContextMojo::OriginFromLegacyDatabaseFileName(
 }
 
 LocalStorageContextMojo::LocalStorageContextMojo(
+    const base::FilePath& partition_directory,
     scoped_refptr<base::SequencedTaskRunner> task_runner,
-    service_manager::Connector* connector,
     scoped_refptr<DOMStorageTaskRunner> legacy_task_runner,
     const base::FilePath& old_localstorage_path,
     const base::FilePath& subdirectory,
     scoped_refptr<storage::SpecialStoragePolicy> special_storage_policy)
-    : connector_(connector ? connector->Clone() : nullptr),
-      subdirectory_(subdirectory),
+    : directory_(subdirectory.empty()
+                     ? base::FilePath()
+                     : partition_directory.Append(subdirectory)),
       special_storage_policy_(std::move(special_storage_policy)),
+      leveldb_task_runner_(base::CreateSequencedTaskRunner(
+          {base::ThreadPool(), base::MayBlock(),
+           base::TaskShutdownBehavior::BLOCK_SHUTDOWN})),
       memory_dump_id_(base::StringPrintf("LocalStorage/0x%" PRIXPTR,
                                          reinterpret_cast<uintptr_t>(this))),
       task_runner_(std::move(legacy_task_runner)),
@@ -447,11 +465,11 @@ void LocalStorageContextMojo::DeleteStorage(const url::Origin& origin,
         "\n", base::BindOnce(&SuccessResponse, std::move(callback)));
     found->second->storage_area()->ScheduleImmediateCommit();
   } else if (database_) {
-    std::vector<leveldb::mojom::BatchedOperationPtr> operations;
-    AddDeleteOriginOperations(&operations, origin);
-    database_->Write(
-        std::move(operations),
-        base::BindOnce(&DatabaseErrorResponse, std::move(callback)));
+    DeleteOrigins(
+        database_.get(), {std::move(origin)},
+        base::BindOnce([](base::OnceClosure callback,
+                          leveldb::Status) { std::move(callback).Run(); },
+                       std::move(callback)));
   } else {
     std::move(callback).Run();
   }
@@ -470,8 +488,7 @@ void LocalStorageContextMojo::PerformStorageCleanup(
     // an area is not ready to commit its changes, nothing breaks but the
     // rewrite doesn't remove all traces of old data.
     Flush();
-    database_->RewriteDB(
-        base::BindOnce(&DatabaseErrorResponse, std::move(callback)));
+    database_->RewriteDB(base::BindOnce(&IgnoreStatus, std::move(callback)));
   } else {
     std::move(callback).Run();
   }
@@ -502,7 +519,7 @@ void LocalStorageContextMojo::ShutdownAndDelete() {
   // Nothing to do if no connection to the database was ever finished.
   if (connection_state_ != CONNECTION_FINISHED) {
     connection_state_ = CONNECTION_SHUTDOWN;
-    OnShutdownComplete(leveldb::mojom::DatabaseError::OK);
+    OnShutdownComplete(leveldb::Status::OK());
     return;
   }
 
@@ -523,7 +540,7 @@ void LocalStorageContextMojo::ShutdownAndDelete() {
   // Respect the content policy settings about what to
   // keep and what to discard.
   if (force_keep_session_state_) {
-    OnShutdownComplete(leveldb::mojom::DatabaseError::OK);
+    OnShutdownComplete(leveldb::Status::OK());
     return;  // Keep everything.
   }
 
@@ -536,7 +553,7 @@ void LocalStorageContextMojo::ShutdownAndDelete() {
         base::BindOnce(&LocalStorageContextMojo::OnGotStorageUsageForShutdown,
                        base::Unretained(this)));
   } else {
-    OnShutdownComplete(leveldb::mojom::DatabaseError::OK);
+    OnShutdownComplete(leveldb::Status::OK());
   }
 }
 
@@ -595,15 +612,6 @@ void LocalStorageContextMojo::PurgeUnusedAreasIfNeeded() {
   RecordCachePurgedHistogram(purge_reason, purged_size_kib);
 }
 
-void LocalStorageContextMojo::SetDatabaseForTesting(
-    mojo::PendingAssociatedRemote<leveldb::mojom::LevelDBDatabase> database) {
-  DCHECK_EQ(connection_state_, NO_CONNECTION);
-  connection_state_ = CONNECTION_IN_PROGRESS;
-  database_.reset();
-  database_.Bind(std::move(database));
-  OnDatabaseOpened(true, leveldb::mojom::DatabaseError::OK);
-}
-
 bool LocalStorageContextMojo::OnMemoryDump(
     const base::trace_event::MemoryDumpArgs& args,
     base::trace_event::ProcessMemoryDump* pmd) {
@@ -676,6 +684,11 @@ std::vector<uint8_t> LocalStorageContextMojo::MigrateString(
   return result;
 }
 
+void LocalStorageContextMojo::SetDatabaseOpenCallbackForTesting(
+    base::OnceClosure callback) {
+  RunWhenConnected(std::move(callback));
+}
+
 LocalStorageContextMojo::~LocalStorageContextMojo() {
   DCHECK_EQ(connection_state_, CONNECTION_SHUTDOWN);
   base::trace_event::MemoryDumpManager::GetInstance()->UnregisterDumpProvider(
@@ -685,7 +698,7 @@ LocalStorageContextMojo::~LocalStorageContextMojo() {
 void LocalStorageContextMojo::RunWhenConnected(base::OnceClosure callback) {
   DCHECK_NE(connection_state_, CONNECTION_SHUTDOWN);
 
-  // If we don't have a filesystem_connection_, we'll need to establish one.
+  // If we don't have a database connection, we'll need to establish one.
   if (connection_state_ == NO_CONNECTION) {
     connection_state_ = CONNECTION_IN_PROGRESS;
     InitiateConnection();
@@ -702,100 +715,46 @@ void LocalStorageContextMojo::RunWhenConnected(base::OnceClosure callback) {
 
 void LocalStorageContextMojo::InitiateConnection(bool in_memory_only) {
   DCHECK_EQ(connection_state_, CONNECTION_IN_PROGRESS);
-  // Unit tests might not always have a Connector, use in-memory only if that
-  // happens.
-  if (!connector_) {
-    OnDatabaseOpened(false, leveldb::mojom::DatabaseError::OK);
-    return;
-  }
 
-  if (!subdirectory_.empty() && !in_memory_only) {
-    // We were given a subdirectory to write to. Get it and use a disk backed
-    // database.
-    connector_->BindInterface(file::mojom::kServiceName, &file_system_);
-    file_system_->GetSubDirectory(
-        subdirectory_.AsUTF8Unsafe(), MakeRequest(&directory_),
-        base::BindOnce(&LocalStorageContextMojo::OnDirectoryOpened,
-                       weak_ptr_factory_.GetWeakPtr()));
-  } else {
-    // We were not given a subdirectory. Use a memory backed database.
-    leveldb_service_.reset();
-    connector_->Connect(file::mojom::kServiceName,
-                        leveldb_service_.BindNewPipeAndPassReceiver());
-
-    database_.reset();
-    leveldb_service_->OpenInMemory(
-        memory_dump_id_, "local-storage",
-        database_.BindNewEndpointAndPassReceiver(),
+  if (!directory_.empty() && directory_.IsAbsolute() && !in_memory_only) {
+    // We were given a subdirectory to write to, so use a disk-backed database.
+    leveldb_env::Options options;
+    options.create_if_missing = true;
+    options.max_open_files = 0;  // use minimum
+    // Default write_buffer_size is 4 MB but that might leave a 3.999
+    // memory allocation in RAM from a log file recovery.
+    options.write_buffer_size = 64 * 1024;
+    options.block_cache = leveldb_chrome::GetSharedWebBlockCache();
+
+    in_memory_ = false;
+    database_ = leveldb::LevelDBDatabaseImpl::OpenDirectory(
+        std::move(options), directory_, "leveldb", memory_dump_id_,
+        leveldb_task_runner_,
         base::BindOnce(&LocalStorageContextMojo::OnDatabaseOpened,
-                       weak_ptr_factory_.GetWeakPtr(), true));
-  }
-}
-
-void LocalStorageContextMojo::OnMojoConnectionDestroyed() {
-  UMA_HISTOGRAM_BOOLEAN("LocalStorageContext.OnConnectionDestroyed", true);
-  LOG(ERROR) << "Lost connection to database";
-  // We're about to set database_ to null, so delete the StorageAreaImpls
-  // that might still be using the old database.
-  for (const auto& it : areas_)
-    it.second->storage_area()->CancelAllPendingRequests();
-  areas_.clear();
-  database_.reset();
-  // TODO(dullweber): Should we try to recover? E.g. try to reopen and if this
-  // fails, call DeleteAndRecreateDatabase().
-}
-
-void LocalStorageContextMojo::OnDirectoryOpened(base::File::Error err) {
-  if (err != base::File::Error::FILE_OK) {
-    // We failed to open the directory; continue with startup so that we create
-    // the |areas_|.
-    UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.DirectoryOpenError", -err,
-                              -base::File::FILE_ERROR_MAX);
-    LogDatabaseOpenResult(OpenResult::DIRECTORY_OPEN_FAILED);
-    OnDatabaseOpened(false, leveldb::mojom::DatabaseError::OK);
+                       weak_ptr_factory_.GetWeakPtr()));
     return;
   }
 
-  // Now that we have a directory, connect to the LevelDB service and get our
-  // database.
-  leveldb_service_.reset();
-  connector_->Connect(file::mojom::kServiceName,
-                      leveldb_service_.BindNewPipeAndPassReceiver());
-
-  // We might still need to use the directory, so create a clone.
-  filesystem::mojom::DirectoryPtr directory_clone;
-  directory_->Clone(MakeRequest(&directory_clone));
-
-  leveldb_env::Options options;
-  options.create_if_missing = true;
-  options.max_open_files = 0;  // use minimum
-  // Default write_buffer_size is 4 MB but that might leave a 3.999
-  // memory allocation in RAM from a log file recovery.
-  options.write_buffer_size = 64 * 1024;
-  options.block_cache = leveldb_chrome::GetSharedWebBlockCache();
-
-  database_.reset();
-  leveldb_service_->OpenWithOptions(
-      std::move(options), std::move(directory_clone), "leveldb",
-      memory_dump_id_, database_.BindNewEndpointAndPassReceiver(),
+  // We were not given a subdirectory. Use a memory backed database.
+  in_memory_ = true;
+  database_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
+      memory_dump_id_, "local-storage", leveldb_task_runner_,
       base::BindOnce(&LocalStorageContextMojo::OnDatabaseOpened,
-                     weak_ptr_factory_.GetWeakPtr(), false));
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
-void LocalStorageContextMojo::OnDatabaseOpened(
-    bool in_memory,
-    leveldb::mojom::DatabaseError status) {
-  if (status != leveldb::mojom::DatabaseError::OK) {
+void LocalStorageContextMojo::OnDatabaseOpened(leveldb::Status status) {
+  if (!status.ok()) {
     UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.DatabaseOpenError",
-                              leveldb::GetLevelDBStatusUMAValue(status),
+                              leveldb_env::GetLevelDBStatusUMAValue(status),
                               leveldb_env::LEVELDB_STATUS_MAX);
-    if (in_memory) {
+    if (in_memory_) {
       UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.DatabaseOpenError.Memory",
-                                leveldb::GetLevelDBStatusUMAValue(status),
+                                leveldb_env::GetLevelDBStatusUMAValue(status),
                                 leveldb_env::LEVELDB_STATUS_MAX);
     } else {
       UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.DatabaseOpenError.Disk",
-                                leveldb::GetLevelDBStatusUMAValue(status),
+                                leveldb_env::GetLevelDBStatusUMAValue(status),
                                 leveldb_env::LEVELDB_STATUS_MAX);
     }
     LogDatabaseOpenResult(OpenResult::DATABASE_OPEN_FAILED);
@@ -807,11 +766,8 @@ void LocalStorageContextMojo::OnDatabaseOpened(
 
   // Verify DB schema version.
   if (database_) {
-    database_.set_disconnect_handler(
-        base::BindOnce(&LocalStorageContextMojo::OnMojoConnectionDestroyed,
-                       weak_ptr_factory_.GetWeakPtr()));
     database_->Get(
-        leveldb::StdStringToUint8Vector(kVersionKey),
+        std::vector<uint8_t>(kVersionKey.begin(), kVersionKey.end()),
         base::BindOnce(&LocalStorageContextMojo::OnGotDatabaseVersion,
                        weak_ptr_factory_.GetWeakPtr()));
     return;
@@ -821,12 +777,12 @@ void LocalStorageContextMojo::OnDatabaseOpened(
 }
 
 void LocalStorageContextMojo::OnGotDatabaseVersion(
-    leveldb::mojom::DatabaseError status,
+    leveldb::Status status,
     const std::vector<uint8_t>& value) {
-  if (status == leveldb::mojom::DatabaseError::NOT_FOUND) {
+  if (status.IsNotFound()) {
     // New database, nothing more to do. Current version will get written
     // when first data is committed.
-  } else if (status == leveldb::mojom::DatabaseError::OK) {
+  } else if (status.ok()) {
     // Existing database, check if version number matches current schema
     // version.
     int64_t db_version;
@@ -844,7 +800,7 @@ void LocalStorageContextMojo::OnGotDatabaseVersion(
   } else {
     // Other read error. Possibly database corruption.
     UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.ReadVersionError",
-                              leveldb::GetLevelDBStatusUMAValue(status),
+                              leveldb_env::GetLevelDBStatusUMAValue(status),
                               leveldb_env::LEVELDB_STATUS_MAX);
     LogDatabaseOpenResult(OpenResult::VERSION_READ_ERROR);
     DeleteAndRecreateDatabase(
@@ -857,12 +813,6 @@ void LocalStorageContextMojo::OnGotDatabaseVersion(
 
 void LocalStorageContextMojo::OnConnectionFinished() {
   DCHECK_EQ(connection_state_, CONNECTION_IN_PROGRESS);
-  if (!database_) {
-    directory_.reset();
-    file_system_.reset();
-    leveldb_service_.reset();
-  }
-
   // If connection was opened successfully, reset tried_to_recreate_during_open_
   // to enable recreating the database on future errors.
   if (database_)
@@ -898,7 +848,7 @@ void LocalStorageContextMojo::DeleteAndRecreateDatabase(
 
   // If tried to recreate database on disk already, try again but this time
   // in memory.
-  if (tried_to_recreate_during_open_ && !subdirectory_.empty()) {
+  if (tried_to_recreate_during_open_ && !in_memory_) {
     recreate_in_memory = true;
   } else if (tried_to_recreate_during_open_) {
     // Give up completely, run without any database.
@@ -908,17 +858,10 @@ void LocalStorageContextMojo::DeleteAndRecreateDatabase(
 
   tried_to_recreate_during_open_ = true;
 
-  // Unit tests might not have a bound file_service_, in which case there is
-  // nothing to retry.
-  if (!file_system_.is_bound()) {
-    OnConnectionFinished();
-    return;
-  }
-
   // Destroy database, and try again.
-  if (directory_.is_bound()) {
-    leveldb_service_->Destroy(
-        std::move(directory_), "leveldb",
+  if (!in_memory_) {
+    storage::DomStorageDatabase::Destroy(
+        directory_, "leveldb", leveldb_task_runner_,
         base::BindOnce(&LocalStorageContextMojo::OnDBDestroyed,
                        weak_ptr_factory_.GetWeakPtr(), recreate_in_memory));
   } else {
@@ -928,11 +871,10 @@ void LocalStorageContextMojo::DeleteAndRecreateDatabase(
   }
 }
 
-void LocalStorageContextMojo::OnDBDestroyed(
-    bool recreate_in_memory,
-    leveldb::mojom::DatabaseError status) {
+void LocalStorageContextMojo::OnDBDestroyed(bool recreate_in_memory,
+                                            leveldb::Status status) {
   UMA_HISTOGRAM_ENUMERATION("LocalStorageContext.DestroyDBResult",
-                            leveldb::GetLevelDBStatusUMAValue(status),
+                            leveldb_env::GetLevelDBStatusUMAValue(status),
                             leveldb_env::LEVELDB_STATUS_MAX);
   // We're essentially ignoring the status here. Even if destroying failed we
   // still want to go ahead and try to recreate.
@@ -991,7 +933,7 @@ void LocalStorageContextMojo::RetrieveStorageUsage(
 
 void LocalStorageContextMojo::OnGotMetaData(
     GetStorageUsageCallback callback,
-    leveldb::mojom::DatabaseError status,
+    leveldb::Status status,
     std::vector<leveldb::mojom::KeyValuePtr> data) {
   std::vector<StorageUsageInfo> result;
   std::set<url::Origin> origins;
@@ -1033,28 +975,25 @@ void LocalStorageContextMojo::OnGotMetaData(
 
 void LocalStorageContextMojo::OnGotStorageUsageForShutdown(
     std::vector<StorageUsageInfo> usage) {
-  std::vector<leveldb::mojom::BatchedOperationPtr> operations;
+  std::vector<url::Origin> origins_to_delete;
   for (const auto& info : usage) {
     if (special_storage_policy_->IsStorageProtected(info.origin.GetURL()))
       continue;
     if (!special_storage_policy_->IsStorageSessionOnly(info.origin.GetURL()))
       continue;
-
-    AddDeleteOriginOperations(&operations, info.origin);
+    origins_to_delete.push_back(info.origin);
   }
 
-  if (!operations.empty()) {
-    database_->Write(
-        std::move(operations),
-        base::BindOnce(&LocalStorageContextMojo::OnShutdownComplete,
-                       base::Unretained(this)));
+  if (!origins_to_delete.empty()) {
+    DeleteOrigins(database_.get(), std::move(origins_to_delete),
+                  base::BindOnce(&LocalStorageContextMojo::OnShutdownComplete,
+                                 base::Unretained(this)));
   } else {
-    OnShutdownComplete(leveldb::mojom::DatabaseError::OK);
+    OnShutdownComplete(leveldb::Status::OK());
   }
 }
 
-void LocalStorageContextMojo::OnShutdownComplete(
-    leveldb::mojom::DatabaseError error) {
+void LocalStorageContextMojo::OnShutdownComplete(leveldb::Status status) {
   delete this;
 }
 
@@ -1069,12 +1008,11 @@ void LocalStorageContextMojo::GetStatistics(size_t* total_cache_size,
   }
 }
 
-void LocalStorageContextMojo::OnCommitResult(
-    leveldb::mojom::DatabaseError error) {
+void LocalStorageContextMojo::OnCommitResult(leveldb::Status status) {
   DCHECK(connection_state_ == CONNECTION_FINISHED ||
          connection_state_ == CONNECTION_SHUTDOWN)
       << connection_state_;
-  if (error == leveldb::mojom::DatabaseError::OK) {
+  if (status.ok()) {
     commit_error_count_ = 0;
     return;
   }
diff --git a/chromium/content/browser/dom_storage/local_storage_context_mojo.h b/chromium/content/browser/dom_storage/local_storage_context_mojo.h
index 952080795b8..87aacf47090 100644
--- a/chromium/content/browser/dom_storage/local_storage_context_mojo.h
+++ b/chromium/content/browser/dom_storage/local_storage_context_mojo.h
@@ -15,8 +15,12 @@
 #include "base/files/file_path.h"
 #include "base/memory/ref_counted.h"
 #include "base/sequenced_task_runner.h"
+#include "base/threading/sequence_bound.h"
+#include "base/trace_event/memory_allocator_dump.h"
 #include "base/trace_event/memory_dump_provider.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/dom_storage_task_runner.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
@@ -24,14 +28,9 @@
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/file/public/mojom/file_system.mojom.h"
 #include "third_party/blink/public/mojom/dom_storage/storage_area.mojom.h"
 #include "url/origin.h"
 
-namespace service_manager {
-class Connector;
-}
-
 namespace storage {
 class SpecialStoragePolicy;
 }
@@ -61,8 +60,8 @@ class CONTENT_EXPORT LocalStorageContextMojo
       const base::FilePath& file_name);
 
   LocalStorageContextMojo(
+      const base::FilePath& partition_directory,
       scoped_refptr<base::SequencedTaskRunner> task_runner,
-      service_manager::Connector* connector,
       scoped_refptr<DOMStorageTaskRunner> legacy_task_runner,
       const base::FilePath& old_localstorage_path,
       const base::FilePath& subdirectory,
@@ -99,9 +98,6 @@ class CONTENT_EXPORT LocalStorageContextMojo
   // Clears unused storage areas, when thresholds are reached.
   void PurgeUnusedAreasIfNeeded();
 
-  void SetDatabaseForTesting(
-      mojo::PendingAssociatedRemote<leveldb::mojom::LevelDBDatabase> database);
-
   // base::trace_event::MemoryDumpProvider implementation.
   bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
                     base::trace_event::ProcessMemoryDump* pmd) override;
@@ -113,6 +109,17 @@ class CONTENT_EXPORT LocalStorageContextMojo
     return task_runner_;
   }
 
+  // Access the underlying DomStorageDatabase. May be null if the database is
+  // not yet open.
+  const base::SequenceBound<storage::DomStorageDatabase>&
+  GetDatabaseForTesting() const {
+    return database_->database();
+  }
+
+  // Wait for the database to be opened, or for opening to fail. If the database
+  // is already opened, |callback| is invoked immediately.
+  void SetDatabaseOpenCallbackForTesting(base::OnceClosure callback);
+
  private:
   friend class DOMStorageBrowserTest;
 
@@ -127,15 +134,12 @@ class CONTENT_EXPORT LocalStorageContextMojo
 
   // Part of our asynchronous directory opening called from RunWhenConnected().
   void InitiateConnection(bool in_memory_only = false);
-  void OnDirectoryOpened(base::File::Error err);
-  void OnDatabaseOpened(bool in_memory, leveldb::mojom::DatabaseError status);
-  void OnGotDatabaseVersion(leveldb::mojom::DatabaseError status,
+  void OnDatabaseOpened(leveldb::Status status);
+  void OnGotDatabaseVersion(leveldb::Status status,
                             const std::vector<uint8_t>& value);
   void OnConnectionFinished();
   void DeleteAndRecreateDatabase(const char* histogram_name);
-  void OnDBDestroyed(bool recreate_in_memory,
-                     leveldb::mojom::DatabaseError status);
-  void OnMojoConnectionDestroyed();
+  void OnDBDestroyed(bool recreate_in_memory, leveldb::Status status);
 
   // The (possibly delayed) implementation of OpenLocalStorage(). Can be called
   // directly from that function, or through |on_database_open_callbacks_|.
@@ -148,14 +152,14 @@ class CONTENT_EXPORT LocalStorageContextMojo
   // directly from that function, or through |on_database_open_callbacks_|.
   void RetrieveStorageUsage(GetStorageUsageCallback callback);
   void OnGotMetaData(GetStorageUsageCallback callback,
-                     leveldb::mojom::DatabaseError status,
+                     leveldb::Status status,
                      std::vector<leveldb::mojom::KeyValuePtr> data);
 
   void OnGotStorageUsageForShutdown(std::vector<StorageUsageInfo> usage);
-  void OnShutdownComplete(leveldb::mojom::DatabaseError error);
+  void OnShutdownComplete(leveldb::Status status);
 
   void GetStatistics(size_t* total_cache_size, size_t* unused_area_count);
-  void OnCommitResult(leveldb::mojom::DatabaseError error);
+  void OnCommitResult(leveldb::Status status);
 
   // These values are written to logs.  New enum values can be added, but
   // existing enums must never be renumbered or deleted and reused.
@@ -170,8 +174,7 @@ class CONTENT_EXPORT LocalStorageContextMojo
 
   void LogDatabaseOpenResult(OpenResult result);
 
-  std::unique_ptr<service_manager::Connector> connector_;
-  const base::FilePath subdirectory_;
+  const base::FilePath directory_;
 
   enum ConnectionState {
     NO_CONNECTION,
@@ -184,14 +187,13 @@ class CONTENT_EXPORT LocalStorageContextMojo
   bool force_keep_session_state_ = false;
   scoped_refptr<storage::SpecialStoragePolicy> special_storage_policy_;
 
-  file::mojom::FileSystemPtr file_system_;
-  filesystem::mojom::DirectoryPtr directory_;
+  const scoped_refptr<base::SequencedTaskRunner> leveldb_task_runner_;
 
   base::trace_event::MemoryAllocatorDumpGuid memory_dump_id_;
 
-  mojo::Remote<leveldb::mojom::LevelDBService> leveldb_service_;
-  mojo::AssociatedRemote<leveldb::mojom::LevelDBDatabase> database_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> database_;
   bool tried_to_recreate_during_open_ = false;
+  bool in_memory_ = false;
 
   std::vector<base::OnceClosure> on_database_opened_callbacks_;
 
diff --git a/chromium/content/browser/dom_storage/local_storage_context_mojo_unittest.cc b/chromium/content/browser/dom_storage/local_storage_context_mojo_unittest.cc
index e78437e20df..ca133bff19d 100644
--- a/chromium/content/browser/dom_storage/local_storage_context_mojo_unittest.cc
+++ b/chromium/content/browser/dom_storage/local_storage_context_mojo_unittest.cc
@@ -6,6 +6,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/containers/span.h"
 #include "base/files/file_enumerator.h"
 #include "base/files/file_util.h"
 #include "base/files/scoped_temp_dir.h"
@@ -18,23 +19,17 @@
 #include "content/browser/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/dom_storage_task_runner.h"
 #include "content/browser/dom_storage/dom_storage_types.h"
-#include "content/browser/dom_storage/test/fake_leveldb_database_error_on_write.h"
-#include "content/browser/dom_storage/test/fake_leveldb_service.h"
-#include "content/browser/dom_storage/test/mojo_test_with_file_service.h"
 #include "content/browser/dom_storage/test/storage_area_test_util.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/storage_usage_info.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_utils.h"
-#include "content/test/fake_leveldb_database.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_associated_receiver.h"
-#include "services/file/public/mojom/constants.mojom.h"
-#include "services/file/user_id_map.h"
 #include "storage/browser/test/mock_special_storage_policy.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/leveldatabase/env_chromium.h"
@@ -46,8 +41,6 @@ using leveldb::Uint8VectorToStdString;
 namespace content {
 
 namespace {
-using test::FakeLevelDBService;
-using test::FakeLevelDBDatabaseErrorOnWrite;
 
 void GetStorageUsageCallback(const base::RepeatingClosure& callback,
                              std::vector<StorageUsageInfo>* out_result,
@@ -109,9 +102,7 @@ class TestLevelDBObserver : public blink::mojom::StorageAreaObserver {
 class LocalStorageContextMojoTest : public testing::Test {
  public:
   LocalStorageContextMojoTest()
-      : db_(&mock_data_),
-        db_receiver_(&db_),
-        task_runner_(new MockDOMStorageTaskRunner(
+      : task_runner_(new MockDOMStorageTaskRunner(
             base::ThreadTaskRunnerHandle::Get().get())),
         mock_special_storage_policy_(new MockSpecialStoragePolicy()) {
     EXPECT_TRUE(temp_path_.CreateUniqueTempDir());
@@ -120,41 +111,93 @@ class LocalStorageContextMojoTest : public testing::Test {
   ~LocalStorageContextMojoTest() override {
     if (context_)
       ShutdownContext();
+
+    // Ensure any opened database is really closed before attempting to delete
+    // its storage path.
+    RunUntilIdle();
+
+    EXPECT_TRUE(temp_path_.Delete());
   }
 
   LocalStorageContextMojo* context() {
     if (!context_) {
       context_ = new LocalStorageContextMojo(
-          base::ThreadTaskRunnerHandle::Get(), nullptr, task_runner_,
-          temp_path_.GetPath(), base::FilePath(FILE_PATH_LITERAL("leveldb")),
+          temp_path_.GetPath(), base::ThreadTaskRunnerHandle::Get(),
+          task_runner_, temp_path_.GetPath(),
+          base::FilePath(FILE_PATH_LITERAL("leveldb")),
           special_storage_policy());
-      mojo::AssociatedRemote<leveldb::mojom::LevelDBDatabase> database_remote;
-      auto receiver =
-          database_remote.BindNewEndpointAndPassDedicatedReceiverForTesting();
-      context_->SetDatabaseForTesting(database_remote.Unbind());
-      db_receiver_.Bind(std::move(receiver));
     }
+
     return context_;
   }
 
   void ShutdownContext() {
     context_->ShutdownAndDelete();
     context_ = nullptr;
-    base::RunLoop().RunUntilIdle();
+    RunUntilIdle();
   }
 
   MockSpecialStoragePolicy* special_storage_policy() {
     return mock_special_storage_policy_.get();
   }
 
-  const std::map<std::vector<uint8_t>, std::vector<uint8_t>>& mock_data() {
-    return mock_data_;
+  void WaitForDatabaseOpen() {
+    base::RunLoop loop;
+    context()->SetDatabaseOpenCallbackForTesting(loop.QuitClosure());
+    loop.Run();
   }
 
-  void clear_mock_data() { mock_data_.clear(); }
+  void SetDatabaseEntry(base::StringPiece key, base::StringPiece value) {
+    WaitForDatabaseOpen();
+    base::RunLoop loop;
+    context()->GetDatabaseForTesting().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          leveldb::Status status =
+              db.Put(base::as_bytes(base::make_span(key)),
+                     base::as_bytes(base::make_span(value)));
+          ASSERT_TRUE(status.ok());
+          loop.Quit();
+        }));
+    loop.Run();
+  }
+
+  void ClearDatabase() {
+    WaitForDatabaseOpen();
+    base::RunLoop loop;
+    context()->GetDatabaseForTesting().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          leveldb::WriteBatch batch;
+          leveldb::Status status = db.DeletePrefixed({}, &batch);
+          ASSERT_TRUE(status.ok());
+          status = db.Commit(&batch);
+          ASSERT_TRUE(status.ok());
+          loop.Quit();
+        }));
+    loop.Run();
+  }
+
+  std::map<std::string, std::string> GetDatabaseContents() {
+    std::vector<storage::DomStorageDatabase::KeyValuePair> entries;
+    WaitForDatabaseOpen();
+    base::RunLoop loop;
+    context()->GetDatabaseForTesting().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          leveldb::Status status = db.GetPrefixed({}, &entries);
+          ASSERT_TRUE(status.ok());
+          loop.Quit();
+        }));
+    loop.Run();
+
+    std::map<std::string, std::string> contents;
+    for (auto& entry : entries) {
+      contents.emplace(std::string(entry.key.begin(), entry.key.end()),
+                       std::string(entry.value.begin(), entry.value.end()));
+    }
 
-  void set_mock_data(const std::string& key, const std::string& value) {
-    mock_data_[StdStringToUint8Vector(key)] = StdStringToUint8Vector(value);
+    return contents;
   }
 
   std::vector<StorageUsageInfo> GetStorageUsageSync() {
@@ -181,16 +224,75 @@ class LocalStorageContextMojoTest : public testing::Test {
                    : base::nullopt;
   }
 
-  void CloseBinding() { db_receiver_.reset(); }
+  const base::FilePath& temp_path() const { return temp_path_.GetPath(); }
 
-  base::FilePath TempPath() { return temp_path_.GetPath(); }
+  // Pumps both the main-thread sequence and the background database sequence
+  // until both are idle.
+  void RunUntilIdle() { task_environment_.RunUntilIdle(); }
+
+  void DoTestPut(LocalStorageContextMojo* context,
+                 const std::vector<uint8_t>& key,
+                 const std::vector<uint8_t>& value) {
+    mojo::Remote<blink::mojom::StorageArea> area;
+    bool success = false;
+    base::RunLoop run_loop;
+    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
+                              area.BindNewPipeAndPassReceiver());
+    area->Put(key, value, base::nullopt, "source",
+              test::MakeSuccessCallback(run_loop.QuitClosure(), &success));
+    run_loop.Run();
+    EXPECT_TRUE(success);
+    area.reset();
+    RunUntilIdle();
+  }
+
+  bool DoTestGet(LocalStorageContextMojo* context,
+                 const std::vector<uint8_t>& key,
+                 std::vector<uint8_t>* result) {
+    mojo::Remote<blink::mojom::StorageArea> area;
+    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
+                              area.BindNewPipeAndPassReceiver());
+
+    base::RunLoop run_loop;
+    std::vector<blink::mojom::KeyValuePtr> data;
+    bool success = false;
+    bool done = false;
+    area->GetAll(
+        test::GetAllCallback::CreateAndBind(&done, run_loop.QuitClosure()),
+        test::MakeGetAllCallback(&success, &data));
+    run_loop.Run();
+    EXPECT_TRUE(done);
+    EXPECT_TRUE(success);
+
+    for (auto& entry : data) {
+      if (key == entry->key) {
+        *result = std::move(entry->value);
+        return true;
+      }
+    }
+    result->clear();
+    return false;
+  }
+
+  base::FilePath FirstEntryInDir() {
+    base::FileEnumerator enumerator(
+        temp_path(), false /* recursive */,
+        base::FileEnumerator::FILES | base::FileEnumerator::DIRECTORIES);
+    return enumerator.Next();
+  }
 
  private:
+  // testing::Test:
+  void TearDown() override {
+    // Some of these tests close message pipes which serve as master interfaces
+    // to other associated interfaces; this in turn schedules tasks to invoke
+    // the associated interfaces' error handlers, and local storage code relies
+    // on those handlers running in order to avoid memory leaks at shutdown.
+    RunUntilIdle();
+  }
+
   BrowserTaskEnvironment task_environment_;
   base::ScopedTempDir temp_path_;
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> mock_data_;
-  FakeLevelDBDatabase db_;
-  mojo::AssociatedReceiver<leveldb::mojom::LevelDBDatabase> db_receiver_;
 
   scoped_refptr<MockDOMStorageTaskRunner> task_runner_;
 
@@ -208,14 +310,15 @@ TEST_F(LocalStorageContextMojoTest, Basic) {
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
                               area.BindNewPipeAndPassReceiver());
+
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Should have three rows of data, one for the version, one for the actual
   // data and one for metadata.
-  ASSERT_EQ(3u, mock_data().size());
+  EXPECT_EQ(3u, GetDatabaseContents().size());
 }
 
 TEST_F(LocalStorageContextMojoTest, OriginsAreIndependent) {
@@ -227,6 +330,7 @@ TEST_F(LocalStorageContextMojoTest, OriginsAreIndependent) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key1, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
@@ -234,8 +338,8 @@ TEST_F(LocalStorageContextMojoTest, OriginsAreIndependent) {
   area->Put(key2, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
-  base::RunLoop().RunUntilIdle();
-  ASSERT_EQ(5u, mock_data().size());
+  RunUntilIdle();
+  EXPECT_EQ(5u, GetDatabaseContents().size());
 }
 
 TEST_F(LocalStorageContextMojoTest, WrapperOutlivesMojoConnection) {
@@ -250,13 +354,14 @@ TEST_F(LocalStorageContextMojoTest, WrapperOutlivesMojoConnection) {
   context()->OpenLocalStorage(kOrigin, area.BindNewPipeAndPassReceiver());
   context()->OpenLocalStorage(kOrigin, dummy_area.BindNewPipeAndPassReceiver());
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
+
   area.reset();
   dummy_area.reset();
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Clear all the data from the backing database.
-  EXPECT_FALSE(mock_data().empty());
-  clear_mock_data();
+  EXPECT_FALSE(GetDatabaseContents().empty());
+  ClearDatabase();
 
   // Data should still be readable, because despite closing the area
   // connection above, the actual area instance should have been kept alive.
@@ -278,12 +383,13 @@ TEST_F(LocalStorageContextMojoTest, OpeningWrappersPurgesInactiveWrappers) {
   context()->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
                               area.BindNewPipeAndPassReceiver());
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
+
   area.reset();
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Clear all the data from the backing database.
-  EXPECT_FALSE(mock_data().empty());
-  clear_mock_data();
+  EXPECT_FALSE(GetDatabaseContents().empty());
+  ClearDatabase();
 
   // Now open many new areas (for different origins) to trigger clean up.
   for (int i = 1; i <= 100; ++i) {
@@ -293,21 +399,28 @@ TEST_F(LocalStorageContextMojoTest, OpeningWrappersPurgesInactiveWrappers) {
     area.reset();
   }
 
+  RunUntilIdle();
+
   // And make sure caches were actually cleared.
   EXPECT_EQ(base::nullopt, DoTestGet(key));
 }
 
 TEST_F(LocalStorageContextMojoTest, ValidVersion) {
-  set_mock_data("VERSION", "1");
-  set_mock_data(std::string("_http://foobar.com") + '\x00' + "key", "value");
+  SetDatabaseEntry("VERSION", "1");
+  SetDatabaseEntry(std::string("_http://foobar.com") + '\x00' + "key", "value");
+  ShutdownContext();
 
   EXPECT_EQ(StdStringToUint8Vector("value"),
             DoTestGet(StdStringToUint8Vector("key")));
 }
 
 TEST_F(LocalStorageContextMojoTest, InvalidVersion) {
-  set_mock_data("VERSION", "foobar");
-  set_mock_data(std::string("_http://foobar.com") + '\x00' + "key", "value");
+  SetDatabaseEntry("VERSION", "foobar");
+  SetDatabaseEntry(std::string("_http://foobar.com") + '\x00' + "key", "value");
+
+  // Force the context to reload the database, which should fail due to invalid
+  // version data.
+  ShutdownContext();
 
   EXPECT_EQ(base::nullopt, DoTestGet(StdStringToUint8Vector("key")));
 }
@@ -315,8 +428,8 @@ TEST_F(LocalStorageContextMojoTest, InvalidVersion) {
 TEST_F(LocalStorageContextMojoTest, VersionOnlyWrittenOnCommit) {
   EXPECT_EQ(base::nullopt, DoTestGet(StdStringToUint8Vector("key")));
 
-  base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(mock_data().empty());
+  RunUntilIdle();
+  EXPECT_TRUE(GetDatabaseContents().empty());
 }
 
 TEST_F(LocalStorageContextMojoTest, GetStorageUsage_NoData) {
@@ -335,6 +448,7 @@ TEST_F(LocalStorageContextMojoTest, GetStorageUsage_Data) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key1, value, base::nullopt, "source", base::DoNothing());
   area->Put(key2, value, base::nullopt, "source", base::DoNothing());
   area.reset();
@@ -343,25 +457,12 @@ TEST_F(LocalStorageContextMojoTest, GetStorageUsage_Data) {
   area->Put(key2, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
-  // GetStorageUsage only includes committed data, but still returns all origins
-  // that used localstorage with zero size.
-  std::vector<StorageUsageInfo> info = GetStorageUsageSync();
-  ASSERT_EQ(2u, info.size());
-  if (info[0].origin == origin2)
-    std::swap(info[0], info[1]);
-  EXPECT_EQ(origin1, info[0].origin);
-  EXPECT_EQ(origin2, info[1].origin);
-  EXPECT_LE(before_write, info[0].last_modified);
-  EXPECT_LE(before_write, info[1].last_modified);
-  EXPECT_EQ(0u, info[0].total_size_bytes);
-  EXPECT_EQ(0u, info[1].total_size_bytes);
-
   // Make sure all data gets committed to disk.
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   base::Time after_write = base::Time::Now();
 
-  info = GetStorageUsageSync();
+  std::vector<StorageUsageInfo> info = GetStorageUsageSync();
   ASSERT_EQ(2u, info.size());
   if (info[0].origin == origin2)
     std::swap(info[0], info[1]);
@@ -382,6 +483,7 @@ TEST_F(LocalStorageContextMojoTest, MetaDataClearedOnDelete) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
   area.reset();
   context()->OpenLocalStorage(origin2, area.BindNewPipeAndPassReceiver());
@@ -392,18 +494,17 @@ TEST_F(LocalStorageContextMojoTest, MetaDataClearedOnDelete) {
   area.reset();
 
   // Make sure all data gets committed to disk.
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Data from origin2 should exist, including meta-data, but nothing should
   // exist for origin1.
-  EXPECT_EQ(3u, mock_data().size());
-  for (const auto& it : mock_data()) {
-    if (Uint8VectorToStdString(it.first) == "VERSION")
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(3u, contents.size());
+  for (const auto& entry : contents) {
+    if (entry.first == "VERSION")
       continue;
-    EXPECT_EQ(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin1.Serialize()));
-    EXPECT_NE(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin2.Serialize()));
+    EXPECT_EQ(std::string::npos, entry.first.find(origin1.Serialize()));
+    EXPECT_NE(std::string::npos, entry.first.find(origin2.Serialize()));
   }
 }
 
@@ -415,6 +516,7 @@ TEST_F(LocalStorageContextMojoTest, MetaDataClearedOnDeleteAll) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
   area.reset();
   context()->OpenLocalStorage(origin2, area.BindNewPipeAndPassReceiver());
@@ -426,60 +528,30 @@ TEST_F(LocalStorageContextMojoTest, MetaDataClearedOnDeleteAll) {
   area.reset();
 
   // Make sure all data gets committed to disk.
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Data from origin2 should exist, including meta-data, but nothing should
   // exist for origin1.
-  EXPECT_EQ(3u, mock_data().size());
-  for (const auto& it : mock_data()) {
-    if (Uint8VectorToStdString(it.first) == "VERSION")
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(3u, contents.size());
+  for (const auto& entry : contents) {
+    if (entry.first == "VERSION")
       continue;
-    EXPECT_EQ(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin1.Serialize()));
-    EXPECT_NE(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin2.Serialize()));
+    EXPECT_EQ(std::string::npos, entry.first.find(origin1.Serialize()));
+    EXPECT_NE(std::string::npos, entry.first.find(origin2.Serialize()));
   }
 }
 
-TEST_F(LocalStorageContextMojoTest, MojoConnectionDisconnects) {
-  url::Origin origin1 = url::Origin::Create(GURL("http://foobar.com"));
-  auto key = StdStringToUint8Vector("key");
-  auto value = StdStringToUint8Vector("value");
-
-  {
-    mojo::Remote<blink::mojom::StorageArea> area;
-    context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
-    area->Put(key, value, base::nullopt, "source", base::DoNothing());
-    area.reset();
-  }
-  EXPECT_EQ(value, DoTestGet(key));
-
-  // Close the database connection.
-  CloseBinding();
-  base::RunLoop().RunUntilIdle();
-
-  // We can't access the data anymore.
-  EXPECT_EQ(base::nullopt, DoTestGet(key));
-
-  // Check that local storage still works without a database.
-  {
-    mojo::Remote<blink::mojom::StorageArea> area;
-    context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
-    area->Put(key, value, base::nullopt, "source", base::DoNothing());
-    area.reset();
-  }
-  EXPECT_EQ(value, DoTestGet(key));
-}
-
 TEST_F(LocalStorageContextMojoTest, DeleteStorage) {
-  set_mock_data("VERSION", "1");
-  set_mock_data(std::string("_http://foobar.com") + '\x00' + "key", "value");
+  SetDatabaseEntry("VERSION", "1");
+  SetDatabaseEntry(std::string("_http://foobar.com") + '\x00' + "key", "value");
+  ShutdownContext();
 
   base::RunLoop run_loop;
   context()->DeleteStorage(url::Origin::Create(GURL("http://foobar.com")),
                            run_loop.QuitClosure());
   run_loop.Run();
-  EXPECT_EQ(1u, mock_data().size());
+  EXPECT_EQ(1u, GetDatabaseContents().size());
 }
 
 TEST_F(LocalStorageContextMojoTest, DeleteStorageWithoutConnection) {
@@ -490,6 +562,7 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageWithoutConnection) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
@@ -498,22 +571,21 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageWithoutConnection) {
   area.reset();
 
   // Make sure all data gets committed to disk.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(mock_data().empty());
+  RunUntilIdle();
+  EXPECT_FALSE(GetDatabaseContents().empty());
 
   context()->DeleteStorage(origin1, base::DoNothing());
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Data from origin2 should exist, including meta-data, but nothing should
   // exist for origin1.
-  EXPECT_EQ(3u, mock_data().size());
-  for (const auto& it : mock_data()) {
-    if (Uint8VectorToStdString(it.first) == "VERSION")
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(3u, contents.size());
+  for (const auto& entry : contents) {
+    if (entry.first == "VERSION")
       continue;
-    EXPECT_EQ(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin1.Serialize()));
-    EXPECT_NE(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin2.Serialize()));
+    EXPECT_EQ(std::string::npos, entry.first.find(origin1.Serialize()));
+    EXPECT_NE(std::string::npos, entry.first.find(origin2.Serialize()));
   }
 }
 
@@ -525,6 +597,7 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageNotifiesWrapper) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
@@ -533,16 +606,16 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageNotifiesWrapper) {
   area.reset();
 
   // Make sure all data gets committed to disk.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(mock_data().empty());
+  RunUntilIdle();
+  EXPECT_FALSE(GetDatabaseContents().empty());
 
   TestLevelDBObserver observer;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
   area->AddObserver(observer.Bind());
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   context()->DeleteStorage(origin1, base::DoNothing());
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   ASSERT_EQ(1u, observer.observations().size());
   EXPECT_EQ(TestLevelDBObserver::Observation::kDeleteAll,
@@ -550,14 +623,13 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageNotifiesWrapper) {
 
   // Data from origin2 should exist, including meta-data, but nothing should
   // exist for origin1.
-  EXPECT_EQ(3u, mock_data().size());
-  for (const auto& it : mock_data()) {
-    if (Uint8VectorToStdString(it.first) == "VERSION")
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(3u, contents.size());
+  for (const auto& entry : contents) {
+    if (entry.first == "VERSION")
       continue;
-    EXPECT_EQ(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin1.Serialize()));
-    EXPECT_NE(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin2.Serialize()));
+    EXPECT_EQ(std::string::npos, entry.first.find(origin1.Serialize()));
+    EXPECT_NE(std::string::npos, entry.first.find(origin2.Serialize()));
   }
 }
 
@@ -569,6 +641,7 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageWithPendingWrites) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key, value, base::nullopt, "source", base::DoNothing());
   area.reset();
 
@@ -577,18 +650,18 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageWithPendingWrites) {
   area.reset();
 
   // Make sure all data gets committed to disk.
-  base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(mock_data().empty());
+  RunUntilIdle();
+  EXPECT_FALSE(GetDatabaseContents().empty());
 
   TestLevelDBObserver observer;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
   area->AddObserver(observer.Bind());
   area->Put(StdStringToUint8Vector("key2"), value, base::nullopt, "source",
             base::DoNothing());
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   context()->DeleteStorage(origin1, base::DoNothing());
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   ASSERT_EQ(2u, observer.observations().size());
   EXPECT_EQ(TestLevelDBObserver::Observation::kAdd,
@@ -598,14 +671,13 @@ TEST_F(LocalStorageContextMojoTest, DeleteStorageWithPendingWrites) {
 
   // Data from origin2 should exist, including meta-data, but nothing should
   // exist for origin1.
-  EXPECT_EQ(3u, mock_data().size());
-  for (const auto& it : mock_data()) {
-    if (Uint8VectorToStdString(it.first) == "VERSION")
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(3u, contents.size());
+  for (const auto& entry : contents) {
+    if (entry.first == "VERSION")
       continue;
-    EXPECT_EQ(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin1.Serialize()));
-    EXPECT_NE(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin2.Serialize()));
+    EXPECT_EQ(std::string::npos, entry.first.find(origin1.Serialize()));
+    EXPECT_NE(std::string::npos, entry.first.find(origin2.Serialize()));
   }
 }
 
@@ -618,7 +690,7 @@ TEST_F(LocalStorageContextMojoTest, Migration) {
   key2.push_back(0xd83d);
   key2.push_back(0xde00);
 
-  base::FilePath old_db_path = TempPath().Append(
+  base::FilePath old_db_path = temp_path().Append(
       LocalStorageContextMojo::LegacyDatabaseFileNameFromOrigin(origin1));
   {
     DOMStorageDatabase db(old_db_path);
@@ -640,15 +712,21 @@ TEST_F(LocalStorageContextMojoTest, Migration) {
   area->Get(std::vector<uint8_t>(), base::DoNothing());
   area.reset();
   dummy_area.reset();
-  base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(mock_data().empty());
+  RunUntilIdle();
+
+  EXPECT_TRUE(GetDatabaseContents().empty());
 
   // Opening origin1 and accessing its data should migrate its storage.
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
   context()->OpenLocalStorage(origin1, dummy_area.BindNewPipeAndPassReceiver());
-  area->Get(std::vector<uint8_t>(), base::DoNothing());
-  base::RunLoop().RunUntilIdle();
-  EXPECT_FALSE(mock_data().empty());
+
+  base::RunLoop loop;
+  area->Get(std::vector<uint8_t>(),
+            base::BindLambdaForTesting(
+                [&](bool, const std::vector<uint8_t>&) { loop.Quit(); }));
+  loop.Run();
+
+  EXPECT_FALSE(GetDatabaseContents().empty());
 
   {
     std::vector<uint8_t> result;
@@ -681,19 +759,19 @@ static std::string EncodeKeyAsUTF16(const std::string& origin,
 }
 
 TEST_F(LocalStorageContextMojoTest, FixUp) {
-  set_mock_data("VERSION", "1");
+  SetDatabaseEntry("VERSION", "1");
   // Add mock data for the "key" key, with both possible encodings for key.
   // We expect the value of the correctly encoded key to take precedence over
   // the incorrectly encoded key (and expect the incorrectly encoded key to be
   // deleted.
-  set_mock_data(std::string("_http://foobar.com") + '\x00' + "\x01key",
-                "value1");
-  set_mock_data(
+  SetDatabaseEntry(std::string("_http://foobar.com") + '\x00' + "\x01key",
+                   "value1");
+  SetDatabaseEntry(
       EncodeKeyAsUTF16("http://foobar.com", base::ASCIIToUTF16("key")),
       "value2");
   // Also add mock data for the "foo" key, this time only with the incorrec
   // encoding. This should be updated to the correct encoding.
-  set_mock_data(
+  SetDatabaseEntry(
       EncodeKeyAsUTF16("http://foobar.com", base::ASCIIToUTF16("foo")),
       "value3");
 
@@ -724,11 +802,10 @@ TEST_F(LocalStorageContextMojoTest, FixUp) {
 
   // Expect 4 rows in the database: VERSION, meta-data for the origin, and two
   // rows of actual data.
-  EXPECT_EQ(4u, mock_data().size());
-  EXPECT_EQ(leveldb::StdStringToUint8Vector("value1"),
-            mock_data().rbegin()->second);
-  EXPECT_EQ(leveldb::StdStringToUint8Vector("value3"),
-            std::next(mock_data().rbegin())->second);
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(4u, contents.size());
+  EXPECT_EQ("value1", contents.rbegin()->second);
+  EXPECT_EQ("value3", std::next(contents.rbegin())->second);
 }
 
 TEST_F(LocalStorageContextMojoTest, ShutdownClearsData) {
@@ -740,6 +817,7 @@ TEST_F(LocalStorageContextMojoTest, ShutdownClearsData) {
 
   mojo::Remote<blink::mojom::StorageArea> area;
   context()->OpenLocalStorage(origin1, area.BindNewPipeAndPassReceiver());
+
   area->Put(key1, value, base::nullopt, "source", base::DoNothing());
   area->Put(key2, value, base::nullopt, "source", base::DoNothing());
   area.reset();
@@ -749,98 +827,26 @@ TEST_F(LocalStorageContextMojoTest, ShutdownClearsData) {
   area.reset();
 
   // Make sure all data gets committed to the DB.
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   special_storage_policy()->AddSessionOnly(origin1.GetURL());
   ShutdownContext();
 
   // Data from origin2 should exist, including meta-data, but nothing should
   // exist for origin1.
-  EXPECT_EQ(3u, mock_data().size());
-  for (const auto& it : mock_data()) {
-    if (Uint8VectorToStdString(it.first) == "VERSION")
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(3u, contents.size());
+  for (const auto& entry : contents) {
+    if (entry.first == "VERSION")
       continue;
-    EXPECT_EQ(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin1.Serialize()));
-    EXPECT_NE(std::string::npos,
-              Uint8VectorToStdString(it.first).find(origin2.Serialize()));
+    EXPECT_EQ(std::string::npos, entry.first.find(origin1.Serialize()));
+    EXPECT_NE(std::string::npos, entry.first.find(origin2.Serialize()));
   }
 }
 
-class LocalStorageContextMojoTestWithService
-    : public test::MojoTestWithFileService {
- public:
-  LocalStorageContextMojoTestWithService() {}
-  ~LocalStorageContextMojoTestWithService() override {}
-
- protected:
-  void DoTestPut(LocalStorageContextMojo* context,
-                 const std::vector<uint8_t>& key,
-                 const std::vector<uint8_t>& value) {
-    mojo::Remote<blink::mojom::StorageArea> area;
-    bool success = false;
-    base::RunLoop run_loop;
-    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
-                              area.BindNewPipeAndPassReceiver());
-    area->Put(key, value, base::nullopt, "source",
-              test::MakeSuccessCallback(run_loop.QuitClosure(), &success));
-    run_loop.Run();
-    EXPECT_TRUE(success);
-    area.reset();
-    RunUntilIdle();
-  }
-
-  bool DoTestGet(LocalStorageContextMojo* context,
-                 const std::vector<uint8_t>& key,
-                 std::vector<uint8_t>* result) {
-    mojo::Remote<blink::mojom::StorageArea> area;
-    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
-                              area.BindNewPipeAndPassReceiver());
-
-    base::RunLoop run_loop;
-    std::vector<blink::mojom::KeyValuePtr> data;
-    bool success = false;
-    bool done = false;
-    area->GetAll(
-        test::GetAllCallback::CreateAndBind(&done, run_loop.QuitClosure()),
-        test::MakeGetAllCallback(&success, &data));
-    run_loop.Run();
-    EXPECT_TRUE(done);
-    EXPECT_TRUE(success);
-
-    for (auto& entry : data) {
-      if (key == entry->key) {
-        *result = std::move(entry->value);
-        return true;
-      }
-    }
-    result->clear();
-    return false;
-  }
-
-  base::FilePath FirstEntryInDir() {
-    base::FileEnumerator enumerator(
-        temp_path(), false /* recursive */,
-        base::FileEnumerator::FILES | base::FileEnumerator::DIRECTORIES);
-    return enumerator.Next();
-  }
-
- private:
-  // testing::Test:
-  void TearDown() override {
-    // Some of these tests close message pipes which serve as master interfaces
-    // to other associated interfaces; this in turn schedules tasks to invoke
-    // the associated interfaces' error handlers, and local storage code relies
-    // on those handlers running in order to avoid memory leaks at shutdown.
-    RunUntilIdle();
-  }
-
-  DISALLOW_COPY_AND_ASSIGN(LocalStorageContextMojoTestWithService);
-};
-
-TEST_F(LocalStorageContextMojoTestWithService, InMemory) {
+TEST_F(LocalStorageContextMojoTest, InMemory) {
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      base::FilePath(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), base::FilePath(), nullptr);
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
@@ -861,16 +867,16 @@ TEST_F(LocalStorageContextMojoTestWithService, InMemory) {
   EXPECT_TRUE(FirstEntryInDir().empty());
 
   // Re-opening should get fresh data.
-  context = new LocalStorageContextMojo(base::ThreadTaskRunnerHandle::Get(),
-                                        connector(), nullptr, base::FilePath(),
-                                        base::FilePath(), nullptr);
+  context = new LocalStorageContextMojo(
+      base::FilePath(), base::ThreadTaskRunnerHandle::Get(), nullptr,
+      base::FilePath(), base::FilePath(), nullptr);
   EXPECT_FALSE(DoTestGet(context, key, &result));
   context->ShutdownAndDelete();
 }
 
-TEST_F(LocalStorageContextMojoTestWithService, InMemoryInvalidPath) {
+TEST_F(LocalStorageContextMojoTest, InMemoryInvalidPath) {
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      base::FilePath(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), base::FilePath(FILE_PATH_LITERAL("../../")), nullptr);
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
@@ -892,10 +898,10 @@ TEST_F(LocalStorageContextMojoTestWithService, InMemoryInvalidPath) {
   EXPECT_TRUE(FirstEntryInDir().empty());
 }
 
-TEST_F(LocalStorageContextMojoTestWithService, OnDisk) {
+TEST_F(LocalStorageContextMojoTest, OnDisk) {
   base::FilePath test_path(FILE_PATH_LITERAL("test_path"));
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), test_path, nullptr);
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
@@ -913,20 +919,20 @@ TEST_F(LocalStorageContextMojoTestWithService, OnDisk) {
   EXPECT_EQ(test_path, FirstEntryInDir().BaseName());
 
   // Should be able to re-open.
-  context = new LocalStorageContextMojo(base::ThreadTaskRunnerHandle::Get(),
-                                        connector(), nullptr, base::FilePath(),
-                                        test_path, nullptr);
+  context = new LocalStorageContextMojo(
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
+      base::FilePath(), test_path, nullptr);
   EXPECT_TRUE(DoTestGet(context, key, &result));
   EXPECT_EQ(value, result);
   context->ShutdownAndDelete();
 }
 
-TEST_F(LocalStorageContextMojoTestWithService, InvalidVersionOnDisk) {
+TEST_F(LocalStorageContextMojoTest, InvalidVersionOnDisk) {
   base::FilePath test_path(FILE_PATH_LITERAL("test_path"));
 
   // Create context and add some data to it.
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), test_path, nullptr);
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
@@ -953,8 +959,10 @@ TEST_F(LocalStorageContextMojoTestWithService, InvalidVersionOnDisk) {
   }
 
   // Make sure data is gone.
-  context = new LocalStorageContextMojo(base::ThreadTaskRunnerHandle::Get(),
-                                        connector(), nullptr, base::FilePath(),
+  context = new LocalStorageContextMojo(temp_path(),
+                                        base::ThreadTaskRunnerHandle::Get(),
+                                        nullptr, base::FilePath(),
+
                                         test_path, nullptr);
   EXPECT_FALSE(DoTestGet(context, key, &result));
 
@@ -966,20 +974,20 @@ TEST_F(LocalStorageContextMojoTestWithService, InvalidVersionOnDisk) {
   RunUntilIdle();
 
   // Data should have been preserved now.
-  context = new LocalStorageContextMojo(base::ThreadTaskRunnerHandle::Get(),
-                                        connector(), nullptr, base::FilePath(),
-                                        test_path, nullptr);
+  context = new LocalStorageContextMojo(
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
+      base::FilePath(), test_path, nullptr);
   EXPECT_TRUE(DoTestGet(context, key, &result));
   EXPECT_EQ(value, result);
   context->ShutdownAndDelete();
 }
 
-TEST_F(LocalStorageContextMojoTestWithService, CorruptionOnDisk) {
+TEST_F(LocalStorageContextMojoTest, CorruptionOnDisk) {
   base::FilePath test_path(FILE_PATH_LITERAL("test_path"));
 
   // Create context and add some data to it.
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), test_path, nullptr);
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
@@ -1004,9 +1012,9 @@ TEST_F(LocalStorageContextMojoTestWithService, CorruptionOnDisk) {
   }
 
   // Make sure data is gone.
-  context = new LocalStorageContextMojo(base::ThreadTaskRunnerHandle::Get(),
-                                        connector(), nullptr, base::FilePath(),
-                                        test_path, nullptr);
+  context = new LocalStorageContextMojo(
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
+      base::FilePath(), test_path, nullptr);
   EXPECT_FALSE(DoTestGet(context, key, &result));
 
   // Write data again.
@@ -1017,46 +1025,46 @@ TEST_F(LocalStorageContextMojoTestWithService, CorruptionOnDisk) {
   RunUntilIdle();
 
   // Data should have been preserved now.
-  context = new LocalStorageContextMojo(base::ThreadTaskRunnerHandle::Get(),
-                                        connector(), nullptr, base::FilePath(),
-                                        test_path, nullptr);
+  context = new LocalStorageContextMojo(
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
+      base::FilePath(), test_path, nullptr);
   EXPECT_TRUE(DoTestGet(context, key, &result));
   EXPECT_EQ(value, result);
   context->ShutdownAndDelete();
 }
 
-TEST_F(LocalStorageContextMojoTestWithService, RecreateOnCommitFailure) {
-  FakeLevelDBService mock_leveldb_service;
-  file_service()->GetBinderMapForTesting().Add(
-      base::BindRepeating(&test::FakeLevelDBService::Bind,
-                          base::Unretained(&mock_leveldb_service)));
-
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> test_data;
-
+TEST_F(LocalStorageContextMojoTest, RecreateOnCommitFailure) {
   base::FilePath test_path(FILE_PATH_LITERAL("test_path"));
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), test_path, nullptr);
 
+  base::Optional<base::RunLoop> open_loop;
+  base::Optional<base::RunLoop> destruction_loop;
+  size_t num_database_open_requests = 0;
+  context->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
+
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
 
+  open_loop.emplace();
+
   // Open three connections to the database. Two to the same origin, and a third
   // to a different origin.
   mojo::Remote<blink::mojom::StorageArea> area1;
   mojo::Remote<blink::mojom::StorageArea> area2;
   mojo::Remote<blink::mojom::StorageArea> area3;
-  {
-    base::RunLoop loop;
-    mock_leveldb_service.SetOnOpenCallback(loop.QuitClosure());
-    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
-                              area1.BindNewPipeAndPassReceiver());
-    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
-                              area2.BindNewPipeAndPassReceiver());
-    context->OpenLocalStorage(url::Origin::Create(GURL("http://example.com")),
-                              area3.BindNewPipeAndPassReceiver());
-    loop.Run();
-  }
+
+  context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
+                            area1.BindNewPipeAndPassReceiver());
+  context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
+                            area2.BindNewPipeAndPassReceiver());
+  context->OpenLocalStorage(url::Origin::Create(GURL("http://example.com")),
+                            area3.BindNewPipeAndPassReceiver());
+  open_loop->Run();
 
   // Add observers to the first two connections.
   TestLevelDBObserver observer1;
@@ -1064,43 +1072,50 @@ TEST_F(LocalStorageContextMojoTestWithService, RecreateOnCommitFailure) {
   TestLevelDBObserver observer2;
   area2->AddObserver(observer2.Bind());
 
-  // Verify one attempt was made to open the database, and connect that request
-  // with a database implementation that always fails on write.
-  ASSERT_EQ(1u, mock_leveldb_service.open_requests().size());
-  auto& open_request = mock_leveldb_service.open_requests()[0];
-  auto mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<FakeLevelDBDatabaseErrorOnWrite>(&test_data),
-      std::move(open_request.receiver));
-  std::move(open_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  mock_leveldb_service.open_requests().clear();
-
-  // Setup a RunLoop so we can wait until LocalStorageContextMojo tries to
-  // reconnect to the database, which should happen after several commit
-  // errors.
-  base::RunLoop reopen_loop;
-  mock_leveldb_service.SetOnOpenCallback(reopen_loop.QuitClosure());
+  // Verify one attempt was made to open the database.
+  ASSERT_EQ(1u, num_database_open_requests);
+
+  // This loop will be Quit if and when the current database instance is
+  // destroyed, which should happen after many commit failures.
+  destruction_loop.emplace();
+
+  bool first_database_destroyed = false;
+  context->GetDatabaseForTesting().PostTaskWithThisObject(
+      FROM_HERE,
+      base::BindLambdaForTesting([&](storage::DomStorageDatabase* db) {
+        db->MakeAllCommitsFailForTesting();
+        db->SetDestructionCallbackForTesting(base::BindLambdaForTesting([&] {
+          first_database_destroyed = true;
+          destruction_loop->Quit();
+        }));
+      }));
+
+  // Also prepare for another database connection, this time without making
+  // commits fail.
+  open_loop.emplace();
+  num_database_open_requests = 0;
+  context->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
 
   // Start a put operation on the third connection before starting to commit
   // a lot of data on the first origin. This put operation should result in a
-  // pending commit that will get cancelled when the database connection is
-  // closed.
+  // pending commit that will get cancelled when the database is destroyed.
   area3->Put(key, value, base::nullopt, "source",
              base::BindOnce([](bool success) { EXPECT_TRUE(success); }));
 
   // Repeatedly write data to the database, to trigger enough commit errors.
   size_t values_written = 0;
   while (area1.is_connected()) {
-    base::RunLoop put_loop;
     // Every write needs to be different to make sure there actually is a
-    // change to commit.
     value[0]++;
-    area1.set_disconnect_handler(put_loop.QuitClosure());
     area1->Put(key, value, base::nullopt, "source",
                base::BindLambdaForTesting([&](bool success) {
                  EXPECT_TRUE(success);
+                 values_written++;
                }));
-    put_loop.RunUntilIdle();
-    values_written++;
+    RunUntilIdle();
     // And we need to flush after every change. Otherwise changes get batched up
     // and only one commit is done some time later.
     context->FlushOriginForTesting(
@@ -1108,23 +1123,17 @@ TEST_F(LocalStorageContextMojoTestWithService, RecreateOnCommitFailure) {
   }
   area1.reset();
 
-  // Make sure all messages to the DB have been processed (Flush above merely
-  // schedules a commit, but there is no guarantee about those having been
-  // processed yet).
-  mock_leveldb_service.FlushBindingsForTesting();
-  if (mock_db)
-    mock_db->FlushForTesting();
-  // At this point enough commit failures should have happened to cause the
-  // connection to the database to have been severed.
-  EXPECT_FALSE(mock_db);
-
-  // The connection to the second area should have closed as well.
-  EXPECT_FALSE(area2.is_connected());
+  // Wait for LocalStorageContextMojo to try to reconnect to the database, and
+  // Enough commit failures should happen during this loop to cause the database
+  // to be destroyed.
+  destruction_loop->Run();
+  EXPECT_TRUE(first_database_destroyed);
 
-  // And the old database should have been destroyed.
-  EXPECT_EQ(1u, mock_leveldb_service.destroy_requests().size());
+  // The connection to the second area should end up closed as well.
+  area2.FlushForTesting();
+  EXPECT_FALSE(area2.is_connected());
 
-  // Reconnect area1 to the database, and try to read a value.
+  // Reconnect |area1| to the database, and try to read a value.
   context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
                             area1.BindNewPipeAndPassReceiver());
   base::RunLoop delete_loop;
@@ -1137,16 +1146,9 @@ TEST_F(LocalStorageContextMojoTestWithService, RecreateOnCommitFailure) {
                   delete_loop.Quit();
                 }));
 
-  // Wait for LocalStorageContextMojo to try to reconnect to the database, and
-  // connect that new request to a properly functioning database.
-  reopen_loop.Run();
-  ASSERT_EQ(1u, mock_leveldb_service.open_requests().size());
-  auto& reopen_request = mock_leveldb_service.open_requests()[0];
-  mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<FakeLevelDBDatabase>(&test_data),
-      std::move(reopen_request.receiver));
-  std::move(reopen_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  mock_leveldb_service.open_requests().clear();
+  // The new database should be ready to go.
+  open_loop->Run();
+  ASSERT_EQ(1u, num_database_open_requests);
 
   // And deleting the value from the new area should have failed (as the
   // database is empty).
@@ -1160,7 +1162,6 @@ TEST_F(LocalStorageContextMojoTestWithService, RecreateOnCommitFailure) {
     std::vector<uint8_t> result;
     EXPECT_TRUE(DoTestGet(context, key, &result));
     EXPECT_EQ(value, result);
-    EXPECT_FALSE(test_data.empty());
   }
 
   // Observers should have seen one Add event and a number of Change events for
@@ -1172,66 +1173,65 @@ TEST_F(LocalStorageContextMojoTestWithService, RecreateOnCommitFailure) {
               observer2.observations()[i].type);
     EXPECT_EQ(Uint8VectorToStdString(key), observer2.observations()[i].key);
   }
-}
 
-TEST_F(LocalStorageContextMojoTestWithService,
-       DontRecreateOnRepeatedCommitFailure) {
-  FakeLevelDBService mock_leveldb_service;
-  file_service()->GetBinderMapForTesting().Add(
-      base::BindRepeating(&test::FakeLevelDBService::Bind,
-                          base::Unretained(&mock_leveldb_service)));
-
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> test_data;
+  context->ShutdownAndDelete();
+}
 
+TEST_F(LocalStorageContextMojoTest, DontRecreateOnRepeatedCommitFailure) {
   base::FilePath test_path(FILE_PATH_LITERAL("test_path"));
   auto* context = new LocalStorageContextMojo(
-      base::ThreadTaskRunnerHandle::Get(), connector(), nullptr,
+      temp_path(), base::ThreadTaskRunnerHandle::Get(), nullptr,
       base::FilePath(), test_path, nullptr);
 
+  // Ensure that the opened database always fails on write.
+  base::Optional<base::RunLoop> open_loop;
+  size_t num_database_open_requests = 0;
+  size_t num_databases_destroyed = 0;
+  context->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
+  open_loop.emplace();
+
   auto key = StdStringToUint8Vector("key");
   auto value = StdStringToUint8Vector("value");
 
   // Open a connection to the database.
   mojo::Remote<blink::mojom::StorageArea> area;
-  {
-    base::RunLoop loop;
-    mock_leveldb_service.SetOnOpenCallback(loop.QuitClosure());
-    context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
-                              area.BindNewPipeAndPassReceiver());
-    loop.Run();
-  }
-
-  // Verify one attempt was made to open the database, and connect that request
-  // with a database implementation that always fails on write.
-  ASSERT_EQ(1u, mock_leveldb_service.open_requests().size());
-  auto& open_request = mock_leveldb_service.open_requests()[0];
-  auto mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<FakeLevelDBDatabaseErrorOnWrite>(&test_data),
-      std::move(open_request.receiver));
-  std::move(open_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  mock_leveldb_service.open_requests().clear();
-
-  // Setup a RunLoop so we can wait until LocalStorageContextMojo tries to
+  context->OpenLocalStorage(url::Origin::Create(GURL("http://foobar.com")),
+                            area.BindNewPipeAndPassReceiver());
+  open_loop->Run();
+
+  // Ensure that all commits fail on the database, and that we observe its
+  // destruction.
+  context->GetDatabaseForTesting().PostTaskWithThisObject(
+      FROM_HERE,
+      base::BindLambdaForTesting([&](storage::DomStorageDatabase* db) {
+        db->MakeAllCommitsFailForTesting();
+        db->SetDestructionCallbackForTesting(
+            base::BindLambdaForTesting([&] { ++num_databases_destroyed; }));
+      }));
+
+  // Verify one attempt was made to open the database.
+  ASSERT_EQ(1u, num_database_open_requests);
+
+  // Setup a new RunLoop so we can wait until LocalStorageContextMojo tries to
   // reconnect to the database, which should happen after several commit
   // errors.
-  base::RunLoop reopen_loop;
-  mock_leveldb_service.SetOnOpenCallback(reopen_loop.QuitClosure());
+  open_loop.emplace();
 
   // Repeatedly write data to the database, to trigger enough commit errors.
   base::Optional<std::vector<uint8_t>> old_value;
   while (area.is_connected()) {
-    base::RunLoop put_loop;
     // Every write needs to be different to make sure there actually is a
     // change to commit.
     value[0]++;
-    area.set_disconnect_handler(put_loop.QuitClosure());
     area->Put(key, value, old_value, "source",
               base::BindLambdaForTesting([&](bool success) {
                 EXPECT_TRUE(success);
-                put_loop.Quit();
               }));
     old_value = std::vector<uint8_t>(value);
-    put_loop.RunUntilIdle();
+    RunUntilIdle();
     // And we need to flush after every change. Otherwise changes get batched up
     // and only one commit is done some time later.
     context->FlushOriginForTesting(
@@ -1239,29 +1239,20 @@ TEST_F(LocalStorageContextMojoTestWithService,
   }
   area.reset();
 
-  // Make sure all messages to the DB have been processed (Flush above merely
-  // schedules a commit, but there is no guarantee about those having been
-  // processed yet).
-  if (mock_db)
-    mock_db->FlushForTesting();
-  // At this point enough commit failures should have happened to cause the
-  // connection to the database to have been severed.
-  EXPECT_FALSE(mock_db);
-
   // Wait for LocalStorageContextMojo to try to reconnect to the database, and
   // connect that new request with a database implementation that always fails
   // on write.
-  reopen_loop.Run();
-  ASSERT_EQ(1u, mock_leveldb_service.open_requests().size());
-  auto& reopen_request = mock_leveldb_service.open_requests()[0];
-  mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<FakeLevelDBDatabaseErrorOnWrite>(&test_data),
-      std::move(reopen_request.receiver));
-  std::move(reopen_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  mock_leveldb_service.open_requests().clear();
-
-  // The old database should also have been destroyed.
-  EXPECT_EQ(1u, mock_leveldb_service.destroy_requests().size());
+  context->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
+  open_loop->Run();
+  EXPECT_EQ(2u, num_database_open_requests);
+  EXPECT_EQ(1u, num_databases_destroyed);
+  context->GetDatabaseForTesting().PostTaskWithThisObject(
+      FROM_HERE, base::BindOnce([](storage::DomStorageDatabase* db) {
+        db->MakeAllCommitsFailForTesting();
+      }));
 
   // Reconnect a area to the database, and repeatedly write data to it again.
   // This time all should just keep getting written, and commit errors are
@@ -1270,30 +1261,26 @@ TEST_F(LocalStorageContextMojoTestWithService,
                             area.BindNewPipeAndPassReceiver());
   old_value = base::nullopt;
   for (int i = 0; i < 64; ++i) {
-    base::RunLoop put_loop;
     // Every write needs to be different to make sure there actually is a
     // change to commit.
     value[0]++;
-    area.set_disconnect_handler(put_loop.QuitClosure());
     area->Put(key, value, old_value, "source",
               base::BindLambdaForTesting([&](bool success) {
                 EXPECT_TRUE(success);
-                put_loop.Quit();
               }));
-    put_loop.RunUntilIdle();
+    RunUntilIdle();
     old_value = value;
     // And we need to flush after every change. Otherwise changes get batched up
     // and only one commit is done some time later.
     context->FlushOriginForTesting(
         url::Origin::Create(GURL("http://foobar.com")));
   }
-  // Make sure all messages to the DB have been processed (Flush above merely
-  // schedules a commit, but there is no guarantee about those having been
-  // processed yet).
-  if (mock_db)
-    mock_db->FlushForTesting();
-  EXPECT_TRUE(mock_db);
+
+  // Should still be connected after all that.
+  RunUntilIdle();
   EXPECT_TRUE(area.is_connected());
+
+  context->ShutdownAndDelete();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/dom_storage/session_storage_area_impl_unittest.cc b/chromium/content/browser/dom_storage/session_storage_area_impl_unittest.cc
index f259db91016..e7058d9a54f 100644
--- a/chromium/content/browser/dom_storage/session_storage_area_impl_unittest.cc
+++ b/chromium/content/browser/dom_storage/session_storage_area_impl_unittest.cc
@@ -16,14 +16,13 @@
 #include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
-#include "components/services/leveldb/leveldb_service_impl.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
 #include "content/browser/dom_storage/session_storage_data_map.h"
 #include "content/browser/dom_storage/session_storage_metadata.h"
 #include "content/browser/dom_storage/test/storage_area_test_util.h"
 #include "content/public/test/browser_task_environment.h"
-#include "content/test/fake_leveldb_database.h"
 #include "content/test/gmock_util.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
@@ -35,21 +34,14 @@
 #include "url/gurl.h"
 
 namespace content {
+
 namespace {
+
 using leveldb::StdStringToUint8Vector;
 using leveldb::Uint8VectorToStdString;
-using leveldb::mojom::DatabaseError;
-
-template <typename Interface, typename Impl>
-void CreateSelfOwnedreceiverOnTaskRunner(
-    scoped_refptr<base::SequencedTaskRunner> runner,
-    mojo::PendingReceiver<Interface> pending_receiver,
-    std::unique_ptr<Impl> interface) {
-  runner->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          base::IgnoreResult(&mojo::MakeSelfOwnedReceiver<Interface, Impl>),
-          std::move(interface), std::move(pending_receiver), runner));
+
+MATCHER(OKStatus, "Equality matcher for type OK leveldb::Status") {
+  return arg.ok();
 }
 
 class MockListener : public SessionStorageDataMap::Listener {
@@ -60,7 +52,7 @@ class MockListener : public SessionStorageDataMap::Listener {
                void(const std::vector<uint8_t>& map_id,
                     SessionStorageDataMap* map));
   MOCK_METHOD1(OnDataMapDestruction, void(const std::vector<uint8_t>& map_id));
-  MOCK_METHOD1(OnCommitResult, void(DatabaseError error));
+  MOCK_METHOD1(OnCommitResult, void(leveldb::Status));
 };
 
 class SessionStorageAreaImplTest : public testing::Test {
@@ -70,17 +62,10 @@ class SessionStorageAreaImplTest : public testing::Test {
         test_namespace_id2_(base::GenerateGUID()),
         test_origin1_(url::Origin::Create(GURL("https://host1.com:1/"))),
         test_origin2_(url::Origin::Create(GURL("https://host2.com:2/"))) {
-    auto file_runner =
-        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()});
-    CreateSelfOwnedreceiverOnTaskRunner(
-        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()}),
-        leveldb_service_.BindNewPipeAndPassReceiver(),
-        std::make_unique<leveldb::LevelDBServiceImpl>(std::move(file_runner)));
-
-    leveldb_service_->OpenInMemory(
+    leveldb_database_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
         base::nullopt, "SessionStorageAreaImplTestDatabase",
-        leveldb_database_.BindNewEndpointAndPassReceiver(), base::DoNothing());
-
+        base::CreateSequencedTaskRunner({base::ThreadPool(), base::MayBlock()}),
+        base::DoNothing());
     leveldb_database_->Put(StdStringToUint8Vector("map-0-key1"),
                            StdStringToUint8Vector("data1"), base::DoNothing());
 
@@ -115,8 +100,7 @@ class SessionStorageAreaImplTest : public testing::Test {
   const std::string test_namespace_id2_;
   const url::Origin test_origin1_;
   const url::Origin test_origin2_;
-  mojo::Remote<leveldb::mojom::LevelDBService> leveldb_service_;
-  mojo::AssociatedRemote<leveldb::mojom::LevelDBDatabase> leveldb_database_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> leveldb_database_;
   SessionStorageMetadata metadata_;
 
   testing::StrictMock<MockListener> listener_;
@@ -250,7 +234,7 @@ TEST_F(SessionStorageAreaImplTest, Cloning) {
   EXPECT_CALL(listener_,
               OnDataMapCreation(StdStringToUint8Vector("1"), testing::_))
       .Times(1);
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK))
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
       .Times(testing::AnyNumber());
   EXPECT_TRUE(test::PutSync(ss_leveldb2.get(), StdStringToUint8Vector("key2"),
                             StdStringToUint8Vector("data2"), base::nullopt,
@@ -370,7 +354,7 @@ TEST_F(SessionStorageAreaImplTest, DeleteAllOnShared) {
       .Times(1);
   // There should be no commits, as we don't actually have to change any data.
   // |ss_leveldb_impl1| should just switch to a new, empty map.
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK)).Times(0);
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus())).Times(0);
   EXPECT_TRUE(test::DeleteAllSync(ss_leveldb1.get(), "source"));
 
   // The maps were forked on the above call.
@@ -400,7 +384,7 @@ TEST_F(SessionStorageAreaImplTest, DeleteAllWithoutBinding) {
       GetRegisterNewAreaMapCallback());
 
   base::RunLoop loop;
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK))
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
       .WillOnce(base::test::RunClosure(loop.QuitClosure()));
   EXPECT_TRUE(test::DeleteAllSync(ss_leveldb_impl1.get(), "source"));
   ss_leveldb_impl1->data_map()->storage_area()->ScheduleImmediateCommit();
@@ -446,7 +430,7 @@ TEST_F(SessionStorageAreaImplTest, DeleteAllWithoutBindingOnShared) {
       .Times(1);
   // There should be no commits, as we don't actually have to change any data.
   // |ss_leveldb_impl1| should just switch to a new, empty map.
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK)).Times(0);
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus())).Times(0);
   EXPECT_TRUE(test::DeleteAllSync(ss_leveldb_impl1.get(), "source"));
 
   // The maps were forked on the above call.
diff --git a/chromium/content/browser/dom_storage/session_storage_context_mojo.cc b/chromium/content/browser/dom_storage/session_storage_context_mojo.cc
index 11bf3803446..e61963638c5 100644
--- a/chromium/content/browser/dom_storage/session_storage_context_mojo.cc
+++ b/chromium/content/browser/dom_storage/session_storage_context_mojo.cc
@@ -13,6 +13,7 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/compiler_specific.h"
+#include "base/containers/span.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
@@ -20,17 +21,19 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/system/sys_info.h"
+#include "base/task/post_task.h"
 #include "base/trace_event/memory_dump_manager.h"
 #include "build/build_config.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/dom_storage_types.h"
 #include "content/browser/dom_storage/session_storage_area_impl.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl_mojo.h"
 #include "content/browser/dom_storage/storage_area_impl.h"
 #include "content/public/browser/session_storage_usage_info.h"
-#include "services/file/public/mojom/constants.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/leveldatabase/env_chromium.h"
 #include "third_party/leveldatabase/leveldb_chrome.h"
@@ -93,21 +96,21 @@ void RecordSessionStorageCachePurgedHistogram(
 }
 
 void SessionStorageErrorResponse(base::OnceClosure callback,
-                                 leveldb::mojom::DatabaseError error) {
+                                 leveldb::Status status) {
   std::move(callback).Run();
 }
 }  // namespace
 
 SessionStorageContextMojo::SessionStorageContextMojo(
+    const base::FilePath& partition_directory,
+    scoped_refptr<base::SequencedTaskRunner> blocking_task_runner,
     scoped_refptr<base::SequencedTaskRunner> memory_dump_task_runner,
-    service_manager::Connector* connector,
     BackingMode backing_mode,
-    base::FilePath local_partition_directory,
     std::string leveldb_name)
-    : connector_(connector ? connector->Clone() : nullptr),
-      backing_mode_(backing_mode),
-      partition_directory_path_(std::move(local_partition_directory)),
+    : backing_mode_(backing_mode),
       leveldb_name_(std::move(leveldb_name)),
+      partition_directory_(partition_directory),
+      leveldb_task_runner_(std::move(blocking_task_runner)),
       memory_dump_id_(base::StringPrintf("SessionStorage/0x%" PRIXPTR,
                                          reinterpret_cast<uintptr_t>(this))),
       is_low_end_device_(base::SysInfo::IsLowEndDevice()) {
@@ -144,8 +147,7 @@ void SessionStorageContextMojo::OpenSessionStorage(
   if (found->second->state() ==
       SessionStorageNamespaceImplMojo::State::kNotPopulated) {
     found->second->PopulateFromMetadata(
-        database_ ? database_.get() : nullptr,
-        metadata_.GetOrCreateNamespaceEntry(namespace_id));
+        database_.get(), metadata_.GetOrCreateNamespaceEntry(namespace_id));
   }
 
   PurgeUnusedAreasIfNeeded();
@@ -220,7 +222,7 @@ void SessionStorageContextMojo::CloneSessionNamespace(
           database_->Write(
               std::move(save_operations),
               base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
-                             base::Unretained(this)));
+                             weak_ptr_factory_.GetWeakPtr()));
         }
       }
       // If there is no sign of a source namespace, just run with an empty
@@ -325,7 +327,7 @@ void SessionStorageContextMojo::DeleteStorage(const url::Origin& origin,
       database_->Write(
           std::move(delete_operations),
           base::BindOnce(&SessionStorageContextMojo::OnCommitResultWithCallback,
-                         base::Unretained(this), std::move(callback)));
+                         weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
     } else {
       std::move(callback).Run();
     }
@@ -362,7 +364,7 @@ void SessionStorageContextMojo::ShutdownAndDelete() {
   // Nothing to do if no connection to the database was ever finished.
   if (connection_state_ != CONNECTION_FINISHED) {
     connection_state_ = CONNECTION_SHUTDOWN;
-    OnShutdownComplete(leveldb::mojom::DatabaseError::OK);
+    OnShutdownComplete(leveldb::Status::OK());
     return;
   }
   connection_state_ = CONNECTION_SHUTDOWN;
@@ -379,7 +381,7 @@ void SessionStorageContextMojo::ShutdownAndDelete() {
     area->CancelAllPendingRequests();
   }
 
-  OnShutdownComplete(leveldb::mojom::DatabaseError::OK);
+  OnShutdownComplete(leveldb::Status::OK());
 }
 
 void SessionStorageContextMojo::PurgeMemory() {
@@ -465,7 +467,7 @@ void SessionStorageContextMojo::ScavengeUnusedNamespaces(
   if (!delete_operations.empty()) {
     database_->Write(std::move(delete_operations),
                      base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
-                                    base::Unretained(this)));
+                                    weak_ptr_factory_.GetWeakPtr()));
   }
   protected_namespaces_from_scavenge_.clear();
   if (done)
@@ -519,13 +521,8 @@ bool SessionStorageContextMojo::OnMemoryDump(
   return true;
 }
 
-void SessionStorageContextMojo::SetDatabaseForTesting(
-    mojo::PendingAssociatedRemote<leveldb::mojom::LevelDBDatabase> database) {
-  DCHECK_EQ(connection_state_, NO_CONNECTION);
-  connection_state_ = CONNECTION_IN_PROGRESS;
-  database_.reset();
-  database_.Bind(std::move(database));
-  OnDatabaseOpened(true, leveldb::mojom::DatabaseError::OK);
+void SessionStorageContextMojo::PretendToConnectForTesting() {
+  OnDatabaseOpened(leveldb::Status::OK());
 }
 
 void SessionStorageContextMojo::FlushAreaForTesting(
@@ -539,6 +536,11 @@ void SessionStorageContextMojo::FlushAreaForTesting(
   it->second->FlushOriginForTesting(origin);
 }
 
+void SessionStorageContextMojo::SetDatabaseOpenCallbackForTesting(
+    base::OnceClosure callback) {
+  RunWhenConnected(std::move(callback));
+}
+
 scoped_refptr<SessionStorageMetadata::MapData>
 SessionStorageContextMojo::RegisterNewAreaMap(
     SessionStorageMetadata::NamespaceEntry namespace_entry,
@@ -550,7 +552,7 @@ SessionStorageContextMojo::RegisterNewAreaMap(
   if (database_) {
     database_->Write(std::move(save_operations),
                      base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
-                                    base::Unretained(this)));
+                                    weak_ptr_factory_.GetWeakPtr()));
   }
   return map_entry;
 }
@@ -569,13 +571,12 @@ void SessionStorageContextMojo::OnDataMapDestruction(
   data_maps_.erase(map_prefix);
 }
 
-void SessionStorageContextMojo::OnCommitResult(
-    leveldb::mojom::DatabaseError error) {
+void SessionStorageContextMojo::OnCommitResult(leveldb::Status status) {
   DCHECK_EQ(connection_state_, CONNECTION_FINISHED);
   UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.CommitResult",
-                            leveldb::GetLevelDBStatusUMAValue(error),
+                            leveldb_env::GetLevelDBStatusUMAValue(status),
                             leveldb_env::LEVELDB_STATUS_MAX);
-  if (error == leveldb::mojom::DatabaseError::OK) {
+  if (status.ok()) {
     commit_error_count_ = 0;
     return;
   }
@@ -599,8 +600,8 @@ void SessionStorageContextMojo::OnCommitResult(
 
 void SessionStorageContextMojo::OnCommitResultWithCallback(
     base::OnceClosure callback,
-    leveldb::mojom::DatabaseError error) {
-  OnCommitResult(error);
+    leveldb::Status status) {
+  OnCommitResult(status);
   std::move(callback).Run();
 }
 
@@ -637,18 +638,18 @@ void SessionStorageContextMojo::RegisterShallowClonedNamespace(
   if (database_) {
     database_->Write(std::move(save_operations),
                      base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
-                                    base::Unretained(this)));
+                                    weak_ptr_factory_.GetWeakPtr()));
   }
 
   if (found) {
-    it->second->PopulateAsClone(database_ ? database_.get() : nullptr,
-                                namespace_entry, clone_from_areas);
+    it->second->PopulateAsClone(database_.get(), namespace_entry,
+                                clone_from_areas);
     return;
   }
 
   auto namespace_impl = CreateSessionStorageNamespaceImplMojo(new_namespace_id);
-  namespace_impl->PopulateAsClone(database_ ? database_.get() : nullptr,
-                                  namespace_entry, clone_from_areas);
+  namespace_impl->PopulateAsClone(database_.get(), namespace_entry,
+                                  clone_from_areas);
   namespaces_.emplace(std::piecewise_construct,
                       std::forward_as_tuple(new_namespace_id),
                       std::forward_as_tuple(std::move(namespace_impl)));
@@ -673,7 +674,7 @@ void SessionStorageContextMojo::DoDatabaseDelete(
   if (database_) {
     database_->Write(std::move(delete_operations),
                      base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
-                                    base::Unretained(this)));
+                                    weak_ptr_factory_.GetWeakPtr()));
   }
 }
 
@@ -701,109 +702,54 @@ void SessionStorageContextMojo::RunWhenConnected(base::OnceClosure callback) {
 
 void SessionStorageContextMojo::InitiateConnection(bool in_memory_only) {
   DCHECK_EQ(connection_state_, CONNECTION_IN_PROGRESS);
-  // Unit tests might not always have a Connector, use in-memory only if that
-  // happens.
-  if (!connector_) {
-    OnDatabaseOpened(false, leveldb::mojom::DatabaseError::OK);
-    return;
-  }
 
-  if (backing_mode_ != BackingMode::kNoDisk && !in_memory_only) {
-    // We were given a subdirectory to write to. Get it and use a disk backed
-    // database.
-    connector_->BindInterface(file::mojom::kServiceName, &file_system_);
-    file_system_->GetSubDirectory(
-        partition_directory_path_.AsUTF8Unsafe(),
-        MakeRequest(&partition_directory_),
-        base::BindOnce(&SessionStorageContextMojo::OnDirectoryOpened,
-                       weak_ptr_factory_.GetWeakPtr()));
-  } else {
-    // We were not given a subdirectory. Use a memory backed database.
-    leveldb_service_.reset();
-    connector_->Connect(file::mojom::kServiceName,
-                        leveldb_service_.BindNewPipeAndPassReceiver());
-
-    database_.reset();
-    leveldb_service_->OpenInMemory(
-        memory_dump_id_, "SessionStorageDatabase",
-        database_.BindNewEndpointAndPassReceiver(),
-        base::BindOnce(&SessionStorageContextMojo::OnDatabaseOpened,
-                       weak_ptr_factory_.GetWeakPtr(), true));
-  }
-}
+  if (backing_mode_ != BackingMode::kNoDisk && !in_memory_only &&
+      !partition_directory_.empty()) {
+    // We were given a subdirectory to write to, so use a disk backed database.
+    if (backing_mode_ == BackingMode::kClearDiskStateOnOpen) {
+      storage::DomStorageDatabase::Destroy(partition_directory_, leveldb_name_,
+                                           leveldb_task_runner_,
+                                           base::DoNothing());
+    }
 
-void SessionStorageContextMojo::OnDirectoryOpened(base::File::Error err) {
-  if (err != base::File::FILE_OK) {
-    // We failed to open the directory; continue with startup so that we create
-    // the data maps.
-    UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.DirectoryOpenError", -err,
-                              -base::File::FILE_ERROR_MAX);
-    LogDatabaseOpenResult(OpenResult::kDirectoryOpenFailed);
-    OnDatabaseOpened(false, leveldb::mojom::DatabaseError::OK);
+    leveldb_env::Options options;
+    options.create_if_missing = true;
+    options.max_open_files = 0;  // use minimum
+    // Default write_buffer_size is 4 MB but that might leave a 3.999
+    // memory allocation in RAM from a log file recovery.
+    options.write_buffer_size = 64 * 1024;
+    options.block_cache = leveldb_chrome::GetSharedWebBlockCache();
+
+    in_memory_ = false;
+    database_ = leveldb::LevelDBDatabaseImpl::OpenDirectory(
+        std::move(options), partition_directory_, leveldb_name_,
+        memory_dump_id_, leveldb_task_runner_,
+        base::BindOnce(&SessionStorageContextMojo::OnDatabaseOpened,
+                       weak_ptr_factory_.GetWeakPtr()));
     return;
   }
 
-  // Now that we have a directory, connect to the LevelDB service and get our
-  // database.
-  leveldb_service_.reset();
-  connector_->Connect(file::mojom::kServiceName,
-                      leveldb_service_.BindNewPipeAndPassReceiver());
-
-  // We might still need to use the directory, so create a clone.
-  filesystem::mojom::DirectoryPtr partition_directory_clone;
-  partition_directory_->Clone(MakeRequest(&partition_directory_clone));
-
-  if (backing_mode_ == BackingMode::kClearDiskStateOnOpen) {
-    filesystem::mojom::DirectoryPtr partition_directory_clone_for_deletion;
-    partition_directory_->Clone(
-        MakeRequest(&partition_directory_clone_for_deletion));
-    leveldb_service_->Destroy(std::move(partition_directory_clone_for_deletion),
-                              leveldb_name_, base::DoNothing());
-  }
-
-  leveldb_env::Options options;
-  options.create_if_missing = true;
-  options.max_open_files = 0;  // use minimum
-  // Default write_buffer_size is 4 MB but that might leave a 3.999
-  // memory allocation in RAM from a log file recovery.
-  options.write_buffer_size = 64 * 1024;
-  options.block_cache = leveldb_chrome::GetSharedWebBlockCache();
-
-  database_.reset();
-  leveldb_service_->OpenWithOptions(
-      std::move(options), std::move(partition_directory_clone), leveldb_name_,
-      memory_dump_id_, database_.BindNewEndpointAndPassReceiver(),
+  // We were not given a subdirectory. Use a memory backed database.
+  in_memory_ = true;
+  database_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
+      memory_dump_id_, "SessionStorageDatabase", leveldb_task_runner_,
       base::BindOnce(&SessionStorageContextMojo::OnDatabaseOpened,
-                     weak_ptr_factory_.GetWeakPtr(), false));
-}
-
-void SessionStorageContextMojo::OnMojoConnectionDestroyed() {
-  UMA_HISTOGRAM_BOOLEAN("SessionStorageContext.OnConnectionDestroyed", true);
-  for (const auto& it : data_maps_)
-    it.second->storage_area()->CancelAllPendingRequests();
-
-  for (const auto& namespace_pair : namespaces_)
-    namespace_pair.second->Reset();
-
-  DCHECK(data_maps_.empty());
-  database_.reset();
+                     weak_ptr_factory_.GetWeakPtr()));
 }
 
-void SessionStorageContextMojo::OnDatabaseOpened(
-    bool in_memory,
-    leveldb::mojom::DatabaseError status) {
-  if (status != leveldb::mojom::DatabaseError::OK) {
+void SessionStorageContextMojo::OnDatabaseOpened(leveldb::Status status) {
+  if (!status.ok()) {
     UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.DatabaseOpenError",
-                              leveldb::GetLevelDBStatusUMAValue(status),
+                              leveldb_env::GetLevelDBStatusUMAValue(status),
                               leveldb_env::LEVELDB_STATUS_MAX);
-    if (in_memory) {
+    if (in_memory_) {
       UMA_HISTOGRAM_ENUMERATION(
           "SessionStorageContext.DatabaseOpenError.Memory",
-          leveldb::GetLevelDBStatusUMAValue(status),
+          leveldb_env::GetLevelDBStatusUMAValue(status),
           leveldb_env::LEVELDB_STATUS_MAX);
     } else {
       UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.DatabaseOpenError.Disk",
-                                leveldb::GetLevelDBStatusUMAValue(status),
+                                leveldb_env::GetLevelDBStatusUMAValue(status),
                                 leveldb_env::LEVELDB_STATUS_MAX);
     }
     LogDatabaseOpenResult(OpenResult::kDatabaseOpenFailed);
@@ -815,81 +761,76 @@ void SessionStorageContextMojo::OnDatabaseOpened(
   }
 
   if (!database_) {
+    // Some tests only simulate database connection without a database being
+    // present.
     OnConnectionFinished();
     return;
   }
 
-  database_.set_disconnect_handler(
-      base::BindOnce(&SessionStorageContextMojo::OnMojoConnectionDestroyed,
-                     weak_ptr_factory_.GetWeakPtr()));
-
-  std::vector<uint8_t> database_version(
-      SessionStorageMetadata::kDatabaseVersionBytes,
-      std::end(SessionStorageMetadata::kDatabaseVersionBytes));
-  std::vector<uint8_t> namespace_prefix(
-      SessionStorageMetadata::kNamespacePrefixBytes,
-      std::end(SessionStorageMetadata::kNamespacePrefixBytes));
-  std::vector<uint8_t> next_map_id_key(
-      SessionStorageMetadata::kNextMapIdKeyBytes,
-      std::end(SessionStorageMetadata::kNextMapIdKeyBytes));
-
-  std::vector<leveldb::mojom::GetManyRequestPtr> requests;
-  requests.emplace_back(
-      leveldb::mojom::GetManyRequest::NewKey(std::move(database_version)));
-  requests.emplace_back(leveldb::mojom::GetManyRequest::NewKeyPrefix(
-      std::move(namespace_prefix)));
-  requests.emplace_back(
-      leveldb::mojom::GetManyRequest::NewKey(std::move(next_map_id_key)));
-
-  database_->GetMany(
-      std::move(requests),
+  database_->RunDatabaseTask(
+      base::BindOnce([](const storage::DomStorageDatabase& db) {
+        DatabaseMetadataResult result;
+        result.version_status = db.Get(
+            base::make_span(SessionStorageMetadata::kDatabaseVersionBytes),
+            &result.version);
+        result.next_map_id_status =
+            db.Get(base::make_span(SessionStorageMetadata::kNextMapIdKeyBytes),
+                   &result.next_map_id);
+        result.namespaces_status = db.GetPrefixed(
+            base::make_span(SessionStorageMetadata::kNamespacePrefixBytes),
+            &result.namespaces);
+        return result;
+      }),
       base::BindOnce(&SessionStorageContextMojo::OnGotDatabaseMetadata,
                      weak_ptr_factory_.GetWeakPtr()));
 }
 
-void SessionStorageContextMojo::OnGotDatabaseMetadata(
-    std::vector<leveldb::mojom::GetManyResultPtr> results) {
-  DCHECK_EQ(results.size(), 3U);
+SessionStorageContextMojo::DatabaseMetadataResult::DatabaseMetadataResult() =
+    default;
 
-  std::vector<leveldb::mojom::BatchedOperationPtr> migration_operations;
+SessionStorageContextMojo::DatabaseMetadataResult::DatabaseMetadataResult(
+    DatabaseMetadataResult&&) = default;
 
-  OpenResult open_result;
-  const char* histogram_name;
+SessionStorageContextMojo::DatabaseMetadataResult::~DatabaseMetadataResult() =
+    default;
 
-  std::tie(open_result, histogram_name) =
-      ParseDatabaseVersion(results[0], &migration_operations);
-  if (open_result != OpenResult::kSuccess) {
-    LogDatabaseOpenResult(open_result);
-    DeleteAndRecreateDatabase(histogram_name);
+void SessionStorageContextMojo::OnGotDatabaseMetadata(
+    DatabaseMetadataResult result) {
+  std::vector<leveldb::mojom::BatchedOperationPtr> migration_operations;
+
+  MetadataParseResult version_parse =
+      ParseDatabaseVersion(&result, &migration_operations);
+  if (version_parse.open_result != OpenResult::kSuccess) {
+    LogDatabaseOpenResult(version_parse.open_result);
+    DeleteAndRecreateDatabase(version_parse.histogram_name);
     return;
   }
 
-  std::tie(open_result, histogram_name) =
-      ParseNamespaces(results[1], std::move(migration_operations));
-  if (open_result != OpenResult::kSuccess) {
-    LogDatabaseOpenResult(open_result);
-    DeleteAndRecreateDatabase(histogram_name);
+  MetadataParseResult namespaces_parse =
+      ParseNamespaces(&result, std::move(migration_operations));
+  if (namespaces_parse.open_result != OpenResult::kSuccess) {
+    LogDatabaseOpenResult(namespaces_parse.open_result);
+    DeleteAndRecreateDatabase(namespaces_parse.histogram_name);
     return;
   }
 
-  std::tie(open_result, histogram_name) = ParseNextMapId(results[2]);
-  if (open_result != OpenResult::kSuccess) {
-    LogDatabaseOpenResult(open_result);
-    DeleteAndRecreateDatabase(histogram_name);
+  MetadataParseResult next_map_id_parse = ParseNextMapId(&result);
+  if (next_map_id_parse.open_result != OpenResult::kSuccess) {
+    LogDatabaseOpenResult(next_map_id_parse.open_result);
+    DeleteAndRecreateDatabase(next_map_id_parse.histogram_name);
     return;
   }
 
   OnConnectionFinished();
 }
 
-SessionStorageContextMojo::OpenResultAndHistogramName
+SessionStorageContextMojo::MetadataParseResult
 SessionStorageContextMojo::ParseDatabaseVersion(
-    const leveldb::mojom::GetManyResultPtr& result,
+    DatabaseMetadataResult* result,
     std::vector<leveldb::mojom::BatchedOperationPtr>* migration_operations) {
-  if (result->is_key_value()) {
-    const std::vector<uint8_t>& value = result->get_key_value();
-
-    if (!metadata_.ParseDatabaseVersion(value, migration_operations)) {
+  if (result->version_status.ok()) {
+    if (!metadata_.ParseDatabaseVersion(std::move(result->version),
+                                        migration_operations)) {
       return {OpenResult::kInvalidVersion,
               "SessionStorageContext.OpenResultAfterInvalidVersion"};
     }
@@ -897,91 +838,91 @@ SessionStorageContextMojo::ParseDatabaseVersion(
     return {OpenResult::kSuccess, ""};
   }
 
-  // Failed to get DatabaseVersion, |result| contains error status
-  leveldb::mojom::DatabaseError status = result->get_status();
-
-  if (status == leveldb::mojom::DatabaseError::NOT_FOUND) {
+  if (result->version_status.IsNotFound()) {
     // treat as v0 or new database
     metadata_.ParseDatabaseVersion(base::nullopt, migration_operations);
     return {OpenResult::kSuccess, ""};
   }
 
   // Other read error, Possibly database corruption
-  UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.ReadVersionError",
-                            leveldb::GetLevelDBStatusUMAValue(status),
-                            leveldb_env::LEVELDB_STATUS_MAX);
+  UMA_HISTOGRAM_ENUMERATION(
+      "SessionStorageContext.ReadVersionError",
+      leveldb_env::GetLevelDBStatusUMAValue(result->version_status),
+      leveldb_env::LEVELDB_STATUS_MAX);
   return {OpenResult::kVersionReadError,
           "SessionStorageContext.OpenResultAfterReadVersionError"};
 }
 
-SessionStorageContextMojo::OpenResultAndHistogramName
+SessionStorageContextMojo::MetadataParseResult
 SessionStorageContextMojo::ParseNamespaces(
-    const leveldb::mojom::GetManyResultPtr& result,
+    DatabaseMetadataResult* result,
     std::vector<leveldb::mojom::BatchedOperationPtr> migration_operations) {
   DCHECK_EQ(connection_state_, CONNECTION_IN_PROGRESS);
 
-  if (result->is_status()) {
+  if (!result->namespaces_status.ok()) {
     UMA_HISTOGRAM_ENUMERATION(
         "SessionStorageContext.ReadNamespacesError",
-        leveldb::GetLevelDBStatusUMAValue(result->get_status()),
+        leveldb_env::GetLevelDBStatusUMAValue(result->namespaces_status),
         leveldb_env::LEVELDB_STATUS_MAX);
     return {OpenResult::kNamespacesReadError,
             "SessionStorageContext.OpenResultAfterReadNamespacesError"};
   }
 
-  DCHECK(result->is_key_prefix_values());
-
   bool parsing_success = metadata_.ParseNamespaces(
-      std::move(result->get_key_prefix_values()), &migration_operations);
+      std::move(result->namespaces), &migration_operations);
 
   if (!parsing_success) {
     UMA_HISTOGRAM_ENUMERATION(
         "SessionStorageContext.ReadNamespacesError",
-        leveldb::GetLevelDBStatusUMAValue(leveldb::mojom::DatabaseError::OK),
+        leveldb_env::GetLevelDBStatusUMAValue(leveldb::Status::OK()),
         leveldb_env::LEVELDB_STATUS_MAX);
     return {OpenResult::kNamespacesReadError,
             "SessionStorageContext.OpenResultAfterReadNamespacesError"};
   }
 
   if (!migration_operations.empty()) {
-    database_->Write(std::move(migration_operations),
-                     base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
-                                    base::Unretained(this)));
+    // In tests this write may happen synchronously, which is problematic since
+    // the OnCommitResult callback can be invoked before the database is fully
+    // initialized. There's no harm in deferring in other situations, so we just
+    // always defer here.
+    database_->Write(
+        std::move(migration_operations),
+        base::BindOnce(
+            [](base::OnceCallback<void(leveldb::Status)> callback,
+               scoped_refptr<base::SequencedTaskRunner> callback_task_runner,
+               leveldb::Status status) {
+              callback_task_runner->PostTask(
+                  FROM_HERE, base::BindOnce(std::move(callback), status));
+            },
+            base::BindOnce(&SessionStorageContextMojo::OnCommitResult,
+                           weak_ptr_factory_.GetWeakPtr()),
+            base::SequencedTaskRunnerHandle::Get()));
   }
 
   return {OpenResult::kSuccess, ""};
 }
 
-SessionStorageContextMojo::OpenResultAndHistogramName
-SessionStorageContextMojo::ParseNextMapId(
-    const leveldb::mojom::GetManyResultPtr& result) {
-  if (result->is_status()) {
-    leveldb::mojom::DatabaseError status = result->get_status();
-
-    if (status == leveldb::mojom::DatabaseError::NOT_FOUND) {
+SessionStorageContextMojo::MetadataParseResult
+SessionStorageContextMojo::ParseNextMapId(DatabaseMetadataResult* result) {
+  if (!result->next_map_id_status.ok()) {
+    if (result->next_map_id_status.IsNotFound())
       return {OpenResult::kSuccess, ""};
-    }
 
     // Other read error. Possibly database corruption.
-    UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.ReadNextMapIdError",
-                              leveldb::GetLevelDBStatusUMAValue(status),
-                              leveldb_env::LEVELDB_STATUS_MAX);
+    UMA_HISTOGRAM_ENUMERATION(
+        "SessionStorageContext.ReadNextMapIdError",
+        leveldb_env::GetLevelDBStatusUMAValue(result->next_map_id_status),
+        leveldb_env::LEVELDB_STATUS_MAX);
     return {OpenResult::kNamespacesReadError,
             "SessionStorageContext.OpenResultAfterReadNextMapIdError"};
   }
 
-  DCHECK(result->is_key_value());
-  metadata_.ParseNextMapId(result->get_key_value());
+  metadata_.ParseNextMapId(std::move(result->next_map_id));
   return {OpenResult::kSuccess, ""};
 }
 
 void SessionStorageContextMojo::OnConnectionFinished() {
   DCHECK(!database_ || connection_state_ == CONNECTION_IN_PROGRESS);
-  if (!database_) {
-    partition_directory_.reset();
-    file_system_.reset();
-    leveldb_service_.reset();
-  }
 
   // If connection was opened successfully, reset tried_to_recreate_during_open_
   // to enable recreating the database on future errors.
@@ -1023,7 +964,7 @@ void SessionStorageContextMojo::DeleteAndRecreateDatabase(
 
   // If tried to recreate database on disk already, try again but this time
   // in memory.
-  if (tried_to_recreate_during_open_ && backing_mode_ != BackingMode::kNoDisk) {
+  if (tried_to_recreate_during_open_ && !in_memory_) {
     recreate_in_memory = true;
   } else if (tried_to_recreate_during_open_) {
     // Give up completely, run without any database.
@@ -1033,19 +974,12 @@ void SessionStorageContextMojo::DeleteAndRecreateDatabase(
 
   tried_to_recreate_during_open_ = true;
 
-  // Unit tests might not have a bound file_service_, in which case there is
-  // nothing to retry.
-  if (!file_system_.is_bound()) {
-    OnConnectionFinished();
-    return;
-  }
-
   protected_namespaces_from_scavenge_.clear();
 
   // Destroy database, and try again.
-  if (partition_directory_.is_bound()) {
-    leveldb_service_->Destroy(
-        std::move(partition_directory_), leveldb_name_,
+  if (!in_memory_) {
+    storage::DomStorageDatabase::Destroy(
+        partition_directory_, leveldb_name_, leveldb_task_runner_,
         base::BindOnce(&SessionStorageContextMojo::OnDBDestroyed,
                        weak_ptr_factory_.GetWeakPtr(), recreate_in_memory));
   } else {
@@ -1055,19 +989,17 @@ void SessionStorageContextMojo::DeleteAndRecreateDatabase(
   }
 }
 
-void SessionStorageContextMojo::OnDBDestroyed(
-    bool recreate_in_memory,
-    leveldb::mojom::DatabaseError status) {
+void SessionStorageContextMojo::OnDBDestroyed(bool recreate_in_memory,
+                                              leveldb::Status status) {
   UMA_HISTOGRAM_ENUMERATION("SessionStorageContext.DestroyDBResult",
-                            leveldb::GetLevelDBStatusUMAValue(status),
+                            leveldb_env::GetLevelDBStatusUMAValue(status),
                             leveldb_env::LEVELDB_STATUS_MAX);
   // We're essentially ignoring the status here. Even if destroying failed we
   // still want to go ahead and try to recreate.
   InitiateConnection(recreate_in_memory);
 }
 
-void SessionStorageContextMojo::OnShutdownComplete(
-    leveldb::mojom::DatabaseError error) {
+void SessionStorageContextMojo::OnShutdownComplete(leveldb::Status status) {
   delete this;
 }
 
diff --git a/chromium/content/browser/dom_storage/session_storage_context_mojo.h b/chromium/content/browser/dom_storage/session_storage_context_mojo.h
index 42aa3ef78e8..af56e1f6639 100644
--- a/chromium/content/browser/dom_storage/session_storage_context_mojo.h
+++ b/chromium/content/browser/dom_storage/session_storage_context_mojo.h
@@ -18,18 +18,18 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/optional.h"
+#include "base/threading/sequence_bound.h"
+#include "base/trace_event/memory_allocator_dump.h"
 #include "base/trace_event/memory_dump_provider.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/session_storage_data_map.h"
 #include "content/browser/dom_storage/session_storage_metadata.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl_mojo.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/session_storage_usage_info.h"
-#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/message.h"
-#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/remote.h"
-#include "services/file/public/mojom/file_system.mojom.h"
 #include "third_party/blink/public/mojom/dom_storage/session_storage_namespace.mojom.h"
 #include "url/origin.h"
 
@@ -37,10 +37,6 @@ namespace base {
 class SequencedTaskRunner;
 }  // namespace base
 
-namespace service_manager {
-class Connector;
-}  // namespace service_manager
-
 namespace content {
 struct SessionStorageUsageInfo;
 
@@ -81,10 +77,10 @@ class CONTENT_EXPORT SessionStorageContextMojo
   };
 
   SessionStorageContextMojo(
-      scoped_refptr<base::SequencedTaskRunner> task_runner,
-      service_manager::Connector* connector,
+      const base::FilePath& partition_directory,
+      scoped_refptr<base::SequencedTaskRunner> blocking_task_runner,
+      scoped_refptr<base::SequencedTaskRunner> memory_dump_task_runner,
       BackingMode backing_option,
-      base::FilePath local_partition_directory,
       std::string leveldb_name);
 
   void OpenSessionStorage(
@@ -139,17 +135,24 @@ class CONTENT_EXPORT SessionStorageContextMojo
   bool OnMemoryDump(const base::trace_event::MemoryDumpArgs& args,
                     base::trace_event::ProcessMemoryDump* pmd) override;
 
-  // Sets the database for testing.
-  void SetDatabaseForTesting(
-      mojo::PendingAssociatedRemote<leveldb::mojom::LevelDBDatabase> database);
+  void PretendToConnectForTesting();
 
-  leveldb::mojom::LevelDBDatabase* DatabaseForTesting() {
-    return database_.get();
-  }
+  leveldb::LevelDBDatabaseImpl* DatabaseForTesting() { return database_.get(); }
 
   void FlushAreaForTesting(const std::string& namespace_id,
                            const url::Origin& origin);
 
+  // Access the underlying DomStorageDatabase. May be null if the database is
+  // not yet open.
+  const base::SequenceBound<storage::DomStorageDatabase>&
+  GetDatabaseForTesting() const {
+    return database_->database();
+  }
+
+  // Wait for the database to be opened, or for opening to fail. If the database
+  // is already opened, |callback| is invoked immediately.
+  void SetDatabaseOpenCallbackForTesting(base::OnceClosure callback);
+
  private:
   friend class DOMStorageBrowserTest;
   FRIEND_TEST_ALL_PREFIXES(SessionStorageContextMojoTest,
@@ -178,9 +181,9 @@ class CONTENT_EXPORT SessionStorageContextMojo
   void OnDataMapCreation(const std::vector<uint8_t>& map_prefix,
                          SessionStorageDataMap* map) override;
   void OnDataMapDestruction(const std::vector<uint8_t>& map_prefix) override;
-  void OnCommitResult(leveldb::mojom::DatabaseError error) override;
+  void OnCommitResult(leveldb::Status status) override;
   void OnCommitResultWithCallback(base::OnceClosure callback,
-                                  leveldb::mojom::DatabaseError error);
+                                  leveldb::Status status);
 
   // SessionStorageNamespaceImplMojo::Delegate implementation:
   scoped_refptr<SessionStorageDataMap> MaybeGetExistingDataMapForId(
@@ -203,33 +206,46 @@ class CONTENT_EXPORT SessionStorageContextMojo
 
   // Part of our asynchronous directory opening called from RunWhenConnected().
   void InitiateConnection(bool in_memory_only = false);
-  void OnDirectoryOpened(base::File::Error err);
-  void OnDatabaseOpened(bool in_memory, leveldb::mojom::DatabaseError status);
+  void OnDatabaseOpened(leveldb::Status status);
 
-  void OnGotDatabaseMetadata(
-      std::vector<leveldb::mojom::GetManyResultPtr> results);
+  struct DatabaseMetadataResult {
+    DatabaseMetadataResult();
+    DatabaseMetadataResult(DatabaseMetadataResult&&);
+    DatabaseMetadataResult(const DatabaseMetadataResult&) = delete;
+    ~DatabaseMetadataResult();
 
-  using OpenResultAndHistogramName = std::tuple<OpenResult, const char*>;
-  OpenResultAndHistogramName ParseDatabaseVersion(
-      const leveldb::mojom::GetManyResultPtr& result,
+    storage::DomStorageDatabase::Value version;
+    leveldb::Status version_status;
+
+    storage::DomStorageDatabase::Value next_map_id;
+    leveldb::Status next_map_id_status;
+
+    std::vector<storage::DomStorageDatabase::KeyValuePair> namespaces;
+    leveldb::Status namespaces_status;
+  };
+  void OnGotDatabaseMetadata(DatabaseMetadataResult result);
+
+  struct MetadataParseResult {
+    OpenResult open_result;
+    const char* histogram_name;
+  };
+  MetadataParseResult ParseDatabaseVersion(
+      DatabaseMetadataResult* result,
       std::vector<leveldb::mojom::BatchedOperationPtr>* migration_operations);
-  OpenResultAndHistogramName ParseNamespaces(
-      const leveldb::mojom::GetManyResultPtr& result,
+  MetadataParseResult ParseNamespaces(
+      DatabaseMetadataResult* result,
       std::vector<leveldb::mojom::BatchedOperationPtr> migration_operations);
-  OpenResultAndHistogramName ParseNextMapId(
-      const leveldb::mojom::GetManyResultPtr& result);
+  MetadataParseResult ParseNextMapId(DatabaseMetadataResult* result);
 
   void OnConnectionFinished();
   void DeleteAndRecreateDatabase(const char* histogram_name);
-  void OnDBDestroyed(bool recreate_in_memory,
-                     leveldb::mojom::DatabaseError status);
-  void OnMojoConnectionDestroyed();
+  void OnDBDestroyed(bool recreate_in_memory, leveldb::Status status);
 
   void OnGotMetaData(GetStorageUsageCallback callback,
-                     leveldb::mojom::DatabaseError status,
+                     leveldb::Status status,
                      std::vector<leveldb::mojom::KeyValuePtr> data);
 
-  void OnShutdownComplete(leveldb::mojom::DatabaseError error);
+  void OnShutdownComplete(leveldb::Status status);
 
   void GetStatistics(size_t* total_cache_size, size_t* unused_areas_count);
 
@@ -240,9 +256,7 @@ class CONTENT_EXPORT SessionStorageContextMojo
   // the metadata, make sure it is destroyed last on destruction.
   SessionStorageMetadata metadata_;
 
-  std::unique_ptr<service_manager::Connector> connector_;
   BackingMode backing_mode_;
-  base::FilePath partition_directory_path_;
   std::string leveldb_name_;
 
   enum ConnectionState {
@@ -253,13 +267,13 @@ class CONTENT_EXPORT SessionStorageContextMojo
   } connection_state_ = NO_CONNECTION;
   bool database_initialized_ = false;
 
-  file::mojom::FileSystemPtr file_system_;
-  filesystem::mojom::DirectoryPtr partition_directory_;
+  const base::FilePath partition_directory_;
+  const scoped_refptr<base::SequencedTaskRunner> leveldb_task_runner_;
 
   base::trace_event::MemoryAllocatorDumpGuid memory_dump_id_;
 
-  mojo::Remote<leveldb::mojom::LevelDBService> leveldb_service_;
-  mojo::AssociatedRemote<leveldb::mojom::LevelDBDatabase> database_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> database_;
+  bool in_memory_ = false;
   bool tried_to_recreate_during_open_ = false;
 
   std::vector<base::OnceClosure> on_database_opened_callbacks_;
diff --git a/chromium/content/browser/dom_storage/session_storage_context_mojo_unittest.cc b/chromium/content/browser/dom_storage/session_storage_context_mojo_unittest.cc
index 6034142669a..c877da434b3 100644
--- a/chromium/content/browser/dom_storage/session_storage_context_mojo_unittest.cc
+++ b/chromium/content/browser/dom_storage/session_storage_context_mojo_unittest.cc
@@ -12,20 +12,20 @@
 #include "base/files/file_enumerator.h"
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
 #include "base/guid.h"
 #include "base/memory/ref_counted.h"
 #include "base/sequenced_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
 #include "components/services/leveldb/public/cpp/util.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/dom_storage/dom_storage_types.h"
 #include "content/browser/dom_storage/session_storage_database.h"
-#include "content/browser/dom_storage/test/fake_leveldb_database_error_on_write.h"
-#include "content/browser/dom_storage/test/fake_leveldb_service.h"
-#include "content/browser/dom_storage/test/mojo_test_with_file_service.h"
 #include "content/browser/dom_storage/test/storage_area_test_util.h"
 #include "content/public/browser/session_storage_usage_info.h"
+#include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_utils.h"
 #include "mojo/core/embedder/embedder.h"
@@ -34,7 +34,6 @@
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_associated_receiver.h"
-#include "services/file/public/mojom/constants.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features.h"
 
@@ -43,7 +42,6 @@ namespace {
 using leveldb::StdStringToUint8Vector;
 using leveldb::String16ToUint8Vector;
 using leveldb::Uint8VectorToStdString;
-using leveldb::mojom::DatabaseError;
 using leveldb::mojom::KeyValuePtr;
 
 static const char kSessionStorageDirectory[] = "Session Storage";
@@ -56,13 +54,19 @@ void GetStorageUsageCallback(base::OnceClosure callback,
   std::move(callback).Run();
 }
 
-class SessionStorageContextMojoTest : public test::MojoTestWithFileService {
+class SessionStorageContextMojoTest : public testing::Test {
  public:
-  SessionStorageContextMojoTest() {}
+  SessionStorageContextMojoTest() { CHECK(temp_dir_.CreateUniqueTempDir()); }
 
   ~SessionStorageContextMojoTest() override {
     if (context_)
       ShutdownContext();
+
+    // There may be pending tasks to clean up files in the temp dir. Make sure
+    // they run so temp dir deletion can succeed.
+    RunUntilIdle();
+
+    EXPECT_TRUE(temp_dir_.Delete());
   }
 
   void SetUp() override {
@@ -97,8 +101,9 @@ class SessionStorageContextMojoTest : public test::MojoTestWithFileService {
   SessionStorageContextMojo* context() {
     if (!context_) {
       context_ = new SessionStorageContextMojo(
-          base::SequencedTaskRunnerHandle::Get(), connector(), backing_mode_,
-          base::FilePath(), kSessionStorageDirectory);
+          temp_path(), blocking_task_runner_,
+          base::SequencedTaskRunnerHandle::Get(), backing_mode_,
+          kSessionStorageDirectory);
     }
     return context_;
   }
@@ -106,7 +111,7 @@ class SessionStorageContextMojoTest : public test::MojoTestWithFileService {
   void ShutdownContext() {
     context_->ShutdownAndDelete();
     context_ = nullptr;
-    base::RunLoop().RunUntilIdle();
+    RunUntilIdle();
   }
 
   std::vector<SessionStorageUsageInfo> GetStorageUsageSync() {
@@ -163,12 +168,21 @@ class SessionStorageContextMojoTest : public test::MojoTestWithFileService {
   }
 
  protected:
+  const base::FilePath& temp_path() const { return temp_dir_.GetPath(); }
+  void RunUntilIdle() { task_environment_.RunUntilIdle(); }
+
   bool bad_message_called_ = false;
 
  private:
+  BrowserTaskEnvironment task_environment_;
+  base::ScopedTempDir temp_dir_;
   TestBrowserContext browser_context_;
   SessionStorageContextMojo::BackingMode backing_mode_ =
       SessionStorageContextMojo::BackingMode::kRestoreDiskState;
+  scoped_refptr<base::SequencedTaskRunner> blocking_task_runner_{
+      base::CreateSequencedTaskRunner(
+          {base::MayBlock(), base::ThreadPool(),
+           base::TaskShutdownBehavior::BLOCK_SHUTDOWN})};
   SessionStorageContextMojo* context_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(SessionStorageContextMojoTest);
@@ -642,10 +656,15 @@ TEST_F(SessionStorageContextMojoTest, RecreateOnCommitFailure) {
   url::Origin origin2 = url::Origin::Create(GURL("http://asf.com"));
   url::Origin origin3 = url::Origin::Create(GURL("http://example.com"));
 
-  test::FakeLevelDBService fake_leveldb_service;
-  file_service()->GetBinderMapForTesting().Add(
-      base::BindRepeating(&test::FakeLevelDBService::Bind,
-                          base::Unretained(&fake_leveldb_service)));
+  base::Optional<base::RunLoop> open_loop;
+  size_t num_database_open_requests = 0;
+  size_t num_databases_destroyed = 0;
+  context()->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
+
+  open_loop.emplace();
 
   // Open three connections to the database.
   mojo::AssociatedRemote<blink::mojom::StorageArea> area_o1;
@@ -653,34 +672,39 @@ TEST_F(SessionStorageContextMojoTest, RecreateOnCommitFailure) {
   mojo::AssociatedRemote<blink::mojom::StorageArea> area_o3;
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   context()->CreateSessionNamespace(namespace_id);
-  {
-    base::RunLoop loop;
-    fake_leveldb_service.SetOnOpenCallback(loop.QuitClosure());
-    context()->OpenSessionStorage(kTestProcessId, namespace_id,
-                                  GetBadMessageCallback(),
-                                  ss_namespace.BindNewPipeAndPassReceiver());
-    ss_namespace->OpenArea(origin1, area_o1.BindNewEndpointAndPassReceiver());
-    ss_namespace->OpenArea(origin2, area_o2.BindNewEndpointAndPassReceiver());
-    ss_namespace->OpenArea(origin3, area_o3.BindNewEndpointAndPassReceiver());
-    loop.Run();
-  }
 
-  // Verify one attempt was made to open the database, and connect that request
-  // with a database implementation that always fails on write.
-  ASSERT_EQ(1u, fake_leveldb_service.open_requests().size());
-  auto& open_request = fake_leveldb_service.open_requests()[0];
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> test_data;
-  auto mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<test::FakeLevelDBDatabaseErrorOnWrite>(&test_data),
-      std::move(open_request.receiver));
-  std::move(open_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  fake_leveldb_service.open_requests().clear();
-
-  // Setup a RunLoop so we can wait until LocalStorageContextMojo tries to
+  context()->OpenSessionStorage(kTestProcessId, namespace_id,
+                                GetBadMessageCallback(),
+                                ss_namespace.BindNewPipeAndPassReceiver());
+  ss_namespace->OpenArea(origin1, area_o1.BindNewEndpointAndPassReceiver());
+  ss_namespace->OpenArea(origin2, area_o2.BindNewEndpointAndPassReceiver());
+  ss_namespace->OpenArea(origin3, area_o3.BindNewEndpointAndPassReceiver());
+  open_loop->Run();
+
+  // Ensure that the first opened database always fails to write data.
+  context()->GetDatabaseForTesting().PostTaskWithThisObject(
+      FROM_HERE,
+      base::BindLambdaForTesting([&](storage::DomStorageDatabase* db) {
+        db->MakeAllCommitsFailForTesting();
+        db->SetDestructionCallbackForTesting(
+            base::BindLambdaForTesting([&] { ++num_databases_destroyed; }));
+      }));
+
+  // Verify one attempt was made to open the database.
+  ASSERT_EQ(1u, num_database_open_requests);
+
+  // Setup a new RunLoop so we can wait until LocalStorageContextMojo tries to
   // reconnect to the database, which should happen after several commit
   // errors.
-  base::RunLoop reopen_loop;
-  fake_leveldb_service.SetOnOpenCallback(reopen_loop.QuitClosure());
+  open_loop.emplace();
+
+  // Also prepare for another database connection, next time providing a
+  // functioning database.
+  open_loop.emplace();
+  context()->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
 
   // Start a put operation on the third connection before starting to commit
   // a lot of data on the first origin. This put operation should result in a
@@ -695,43 +719,35 @@ TEST_F(SessionStorageContextMojoTest, RecreateOnCommitFailure) {
   int i = 0;
   while (area_o1.is_connected()) {
     ++i;
-    base::RunLoop put_loop;
     // Every write needs to be different to make sure there actually is a
     // change to commit.
     std::vector<uint8_t> old_value = value;
     value[0]++;
-    area_o1.set_disconnect_handler(put_loop.QuitClosure());
-
     area_o1->Put(leveldb::StringPieceToUint8Vector("key"), value, base::nullopt,
                  "source", base::BindLambdaForTesting([&](bool success) {
                    EXPECT_TRUE(success);
                  }));
     area_o1.FlushForTesting();
-    put_loop.RunUntilIdle();
+    RunUntilIdle();
     // And we need to flush after every change. Otherwise changes get batched up
     // and only one commit is done some time later.
     context()->FlushAreaForTesting(namespace_id, origin1);
   }
   area_o1.reset();
 
-  // Make sure all messages to the DB have been processed (Flush above merely
-  // schedules a commit, but there is no guarantee about those having been
-  // processed yet).
-  fake_leveldb_service.FlushBindingsForTesting();
-  if (mock_db)
-    mock_db->FlushForTesting();
-  // At this point enough commit failures should have happened to cause the
-  // connection to the database to have been severed.
-  EXPECT_FALSE(mock_db);
+  // Wait for a new database to be opened, which should happen after the first
+  // database is destroyed due to failures.
+  open_loop->Run();
+  EXPECT_EQ(1u, num_databases_destroyed);
+  EXPECT_EQ(2u, num_database_open_requests);
 
   // The connection to the second area should have closed as well.
+  area_o2.FlushForTesting();
+  ss_namespace.FlushForTesting();
   EXPECT_FALSE(area_o2.is_connected());
   EXPECT_FALSE(ss_namespace.is_connected());
 
-  // And the old database should have been destroyed.
-  EXPECT_EQ(1u, fake_leveldb_service.destroy_requests().size());
-
-  // Reconnect area_o1 to the database, and try to read a value.
+  // Reconnect area_o1 to the new database, and try to read a value.
   ss_namespace.reset();
   context()->OpenSessionStorage(kTestProcessId, namespace_id,
                                 GetBadMessageCallback(),
@@ -748,17 +764,6 @@ TEST_F(SessionStorageContextMojoTest, RecreateOnCommitFailure) {
                     delete_loop.Quit();
                   }));
 
-  // Wait for LocalStorageContextMojo to try to reconnect to the database, and
-  // connect that new request to a properly functioning database.
-  reopen_loop.Run();
-  ASSERT_EQ(1u, fake_leveldb_service.open_requests().size());
-  auto& reopen_request = fake_leveldb_service.open_requests()[0];
-  mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<FakeLevelDBDatabase>(&test_data),
-      std::move(reopen_request.receiver));
-  std::move(reopen_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  fake_leveldb_service.open_requests().clear();
-
   // And deleting the value from the new area should have failed (as the
   // database is empty).
   delete_loop.Run();
@@ -780,58 +785,63 @@ TEST_F(SessionStorageContextMojoTest, DontRecreateOnRepeatedCommitFailure) {
   std::string namespace_id = base::GenerateGUID();
   url::Origin origin1 = url::Origin::Create(GURL("http://foobar.com"));
 
-  test::FakeLevelDBService fake_leveldb_service;
-  file_service()->GetBinderMapForTesting().Add(
-      base::BindRepeating(&test::FakeLevelDBService::Bind,
-                          base::Unretained(&fake_leveldb_service)));
-
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> test_data;
+  base::Optional<base::RunLoop> open_loop;
+  size_t num_database_open_requests = 0;
+  size_t num_databases_destroyed = 0;
+  context()->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+  }));
+  open_loop.emplace();
 
   // Open three connections to the database.
   mojo::AssociatedRemote<blink::mojom::StorageArea> area;
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   context()->CreateSessionNamespace(namespace_id);
-  {
-    base::RunLoop loop;
-    fake_leveldb_service.SetOnOpenCallback(loop.QuitClosure());
-    context()->OpenSessionStorage(kTestProcessId, namespace_id,
-                                  GetBadMessageCallback(),
-                                  ss_namespace.BindNewPipeAndPassReceiver());
-    ss_namespace->OpenArea(origin1, area.BindNewEndpointAndPassReceiver());
-    loop.Run();
-  }
 
-  // Verify one attempt was made to open the database, and connect that request
-  // with a database implementation that always fails on write.
-  ASSERT_EQ(1u, fake_leveldb_service.open_requests().size());
-  auto& open_request = fake_leveldb_service.open_requests()[0];
-  auto mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<test::FakeLevelDBDatabaseErrorOnWrite>(&test_data),
-      std::move(open_request.receiver));
-  std::move(open_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  fake_leveldb_service.open_requests().clear();
-
-  // Setup a RunLoop so we can wait until LocalStorageContextMojo tries to
+  context()->OpenSessionStorage(kTestProcessId, namespace_id,
+                                GetBadMessageCallback(),
+                                ss_namespace.BindNewPipeAndPassReceiver());
+  ss_namespace->OpenArea(origin1, area.BindNewEndpointAndPassReceiver());
+  open_loop->Run();
+
+  // Ensure that this database always fails to write data.
+  context()->GetDatabaseForTesting().PostTaskWithThisObject(
+      FROM_HERE,
+      base::BindLambdaForTesting([&](storage::DomStorageDatabase* db) {
+        db->MakeAllCommitsFailForTesting();
+        db->SetDestructionCallbackForTesting(
+            base::BindLambdaForTesting([&] { ++num_databases_destroyed; }));
+      }));
+
+  // Verify one attempt was made to open the database.
+  EXPECT_EQ(1u, num_database_open_requests);
+
+  // Setup a new RunLoop so we can wait until LocalStorageContextMojo tries to
   // reconnect to the database, which should happen after several commit
   // errors.
-  base::RunLoop reopen_loop;
-  fake_leveldb_service.SetOnOpenCallback(reopen_loop.QuitClosure());
+  open_loop.emplace();
+  context()->SetDatabaseOpenCallbackForTesting(base::BindLambdaForTesting([&] {
+    ++num_database_open_requests;
+    open_loop->Quit();
+
+    // Ensure that this database also always fails to write data.
+    context()->GetDatabaseForTesting().Post(
+        FROM_HERE, &storage::DomStorageDatabase::MakeAllCommitsFailForTesting);
+  }));
 
   // Repeatedly write data to the database, to trigger enough commit errors.
   auto value = leveldb::StringPieceToUint8Vector("avalue");
   base::Optional<std::vector<uint8_t>> old_value = base::nullopt;
   while (area.is_connected()) {
-    base::RunLoop put_loop;
     // Every write needs to be different to make sure there actually is a
     // change to commit.
-    area.set_disconnect_handler(put_loop.QuitClosure());
     area->Put(leveldb::StringPieceToUint8Vector("key"), value, old_value,
               "source", base::BindLambdaForTesting([&](bool success) {
                 EXPECT_TRUE(success);
-                put_loop.Quit();
               }));
     area.FlushForTesting();
-    put_loop.RunUntilIdle();
+    RunUntilIdle();
     // And we need to flush after every change. Otherwise changes get batched up
     // and only one commit is done some time later.
     context()->FlushAreaForTesting(namespace_id, origin1);
@@ -841,29 +851,13 @@ TEST_F(SessionStorageContextMojoTest, DontRecreateOnRepeatedCommitFailure) {
   }
   area.reset();
 
-  // Make sure all messages to the DB have been processed (Flush above merely
-  // schedules a commit, but there is no guarantee about those having been
-  // processed yet).
-  if (mock_db)
-    mock_db->FlushForTesting();
-  // At this point enough commit failures should have happened to cause the
-  // connection to the database to have been severed.
-  EXPECT_FALSE(mock_db);
-
   // Wait for LocalStorageContextMojo to try to reconnect to the database, and
   // connect that new request with a database implementation that always fails
   // on write.
-  reopen_loop.Run();
-  ASSERT_EQ(1u, fake_leveldb_service.open_requests().size());
-  auto& reopen_request = fake_leveldb_service.open_requests()[0];
-  mock_db = mojo::MakeSelfOwnedAssociatedReceiver(
-      std::make_unique<test::FakeLevelDBDatabaseErrorOnWrite>(&test_data),
-      std::move(reopen_request.receiver));
-  std::move(reopen_request.callback).Run(leveldb::mojom::DatabaseError::OK);
-  fake_leveldb_service.open_requests().clear();
-
-  // The old database should also have been destroyed.
-  EXPECT_EQ(1u, fake_leveldb_service.destroy_requests().size());
+  open_loop->Run();
+
+  EXPECT_EQ(2u, num_database_open_requests);
+  EXPECT_EQ(1u, num_databases_destroyed);
 
   // Reconnect a area to the database, and repeatedly write data to it again.
   // This time all should just keep getting written, and commit errors are
@@ -876,17 +870,14 @@ TEST_F(SessionStorageContextMojoTest, DontRecreateOnRepeatedCommitFailure) {
 
   old_value = base::nullopt;
   for (int i = 0; i < 64; ++i) {
-    base::RunLoop put_loop;
     // Every write needs to be different to make sure there actually is a
     // change to commit.
-    area.set_disconnect_handler(put_loop.QuitClosure());
     area->Put(leveldb::StringPieceToUint8Vector("key"), value, old_value,
               "source", base::BindLambdaForTesting([&](bool success) {
                 EXPECT_TRUE(success);
-                put_loop.Quit();
               }));
     area.FlushForTesting();
-    put_loop.RunUntilIdle();
+    RunUntilIdle();
     // And we need to flush after every change. Otherwise changes get batched up
     // and only one commit is done some time later.
     context()->FlushAreaForTesting(namespace_id, origin1);
@@ -894,15 +885,13 @@ TEST_F(SessionStorageContextMojoTest, DontRecreateOnRepeatedCommitFailure) {
     old_value = value;
     value[0]++;
   }
-  // Make sure all messages to the DB have been processed (Flush above merely
-  // schedules a commit, but there is no guarantee about those having been
-  // processed yet).
-  if (mock_db)
-    mock_db->FlushForTesting();
-  EXPECT_TRUE(mock_db);
+
+  // Should still be connected after all that.
+  RunUntilIdle();
   EXPECT_TRUE(area.is_connected());
 
   context()->DeleteSessionNamespace(namespace_id, false);
+  ShutdownContext();
 }
 
 TEST_F(SessionStorageContextMojoTest, GetUsage) {
@@ -931,84 +920,6 @@ TEST_F(SessionStorageContextMojoTest, GetUsage) {
   loop.Run();
 }
 
-// Tests that a SessionStorageContext still works if the database is
-// disconnected.
-TEST_F(SessionStorageContextMojoTest, MojoConnectionDisconnects) {
-  std::string namespace_id = base::GenerateGUID();
-  url::Origin origin = url::Origin::Create(GURL("http://foobar.com"));
-  auto key = StdStringToUint8Vector("key");
-  auto value = StdStringToUint8Vector("value");
-
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> test_data;
-  FakeLevelDBDatabase db(&test_data);
-
-  mojo::AssociatedReceiver<leveldb::mojom::LevelDBDatabase> db_receiver(&db);
-  mojo::AssociatedRemote<leveldb::mojom::LevelDBDatabase> database_remote;
-  auto receiver =
-      database_remote.BindNewEndpointAndPassDedicatedReceiverForTesting();
-  context()->SetDatabaseForTesting(database_remote.Unbind());
-  db_receiver.Bind(std::move(receiver));
-
-  // Put some data.
-  context()->CreateSessionNamespace(namespace_id);
-  mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
-  context()->OpenSessionStorage(kTestProcessId, namespace_id,
-                                GetBadMessageCallback(),
-                                ss_namespace.BindNewPipeAndPassReceiver());
-  mojo::AssociatedRemote<blink::mojom::StorageArea> area;
-  ss_namespace->OpenArea(origin, area.BindNewEndpointAndPassReceiver());
-  EXPECT_TRUE(test::PutSync(area.get(), key, value, base::nullopt, "source"));
-  std::vector<uint8_t> result;
-
-  std::vector<blink::mojom::KeyValuePtr> data;
-  ASSERT_TRUE(test::GetAllSync(area.get(), &data));
-  EXPECT_EQ(1ul, data.size());
-  area.reset();
-  ss_namespace.reset();
-
-  // Close the database connection.
-  db_receiver.reset();
-  base::RunLoop().RunUntilIdle();
-
-  context()->CreateSessionNamespace(namespace_id);
-  context()->OpenSessionStorage(kTestProcessId, namespace_id,
-                                GetBadMessageCallback(),
-                                ss_namespace.BindNewPipeAndPassReceiver());
-  ss_namespace->OpenArea(origin, area.BindNewEndpointAndPassReceiver());
-
-  // We can't access the data anymore.
-  ASSERT_TRUE(test::GetAllSync(area.get(), &data));
-  EXPECT_EQ(0ul, data.size());
-
-  // Check that session storage still works without a database.
-  EXPECT_TRUE(test::PutSync(area.get(), key, value, base::nullopt, "source"));
-  ASSERT_TRUE(test::GetAllSync(area.get(), &data));
-  EXPECT_EQ(1ul, data.size());
-
-  context()->DeleteStorage(origin, namespace_id, base::DoNothing());
-  ASSERT_TRUE(test::GetAllSync(area.get(), &data));
-  EXPECT_EQ(0ul, data.size());
-
-  EXPECT_TRUE(test::PutSync(area.get(), key, value, base::nullopt, "source"));
-  ASSERT_TRUE(test::GetAllSync(area.get(), &data));
-  EXPECT_EQ(1ul, data.size());
-  area.reset();
-  ss_namespace.reset();
-
-  context()->DeleteSessionNamespace(namespace_id, true);
-  context()->ScavengeUnusedNamespaces(base::DoNothing());
-  ShutdownContext();
-
-  context()->CreateSessionNamespace(namespace_id);
-  context()->OpenSessionStorage(kTestProcessId, namespace_id,
-                                GetBadMessageCallback(),
-                                ss_namespace.BindNewPipeAndPassReceiver());
-  ss_namespace->OpenArea(origin, area.BindNewEndpointAndPassReceiver());
-
-  ASSERT_TRUE(test::GetAllSync(area.get(), &data));
-  EXPECT_EQ(0ul, data.size());
-}
-
 TEST_F(SessionStorageContextMojoTest, DeleteStorage) {
   std::string namespace_id1 = base::GenerateGUID();
   url::Origin origin1 = url::Origin::Create(GURL("http://foobar.com"));
@@ -1085,9 +996,9 @@ TEST_F(SessionStorageContextMojoTest, PurgeInactiveWrappers) {
   base::RunLoop loop;
   context()->DatabaseForTesting()->DeletePrefixed(
       leveldb::StringPieceToUint8Vector("map"),
-      base::BindLambdaForTesting([&](DatabaseError status) {
+      base::BindLambdaForTesting([&](leveldb::Status status) {
         loop.Quit();
-        EXPECT_EQ(DatabaseError::OK, status);
+        EXPECT_TRUE(status.ok());
       }));
   loop.Run();
 
@@ -1099,7 +1010,7 @@ TEST_F(SessionStorageContextMojoTest, PurgeInactiveWrappers) {
     ss_namespace1->OpenArea(url::Origin::Create(GURL(base::StringPrintf(
                                 "http://example.com:%d", i))),
                             area.BindNewEndpointAndPassReceiver());
-    base::RunLoop().RunUntilIdle();
+    RunUntilIdle();
     ss_namespace1.reset();
     area.reset();
   }
@@ -1114,6 +1025,7 @@ TEST_F(SessionStorageContextMojoTest, PurgeInactiveWrappers) {
   EXPECT_EQ(0ul, data.size());
 }
 
+// TODO(https://crbug.com/1008697): Flakes when verifying no data found.
 TEST_F(SessionStorageContextMojoTest, ClearDiskState) {
   SetBackingMode(SessionStorageContextMojo::BackingMode::kClearDiskStateOnOpen);
   std::string namespace_id1 = base::GenerateGUID();
@@ -1315,7 +1227,7 @@ TEST_F(SessionStorageContextMojoTest, PurgeMemoryDoesNotCrashOrHang) {
   area_n2.reset();
   ss_namespace2.reset();
 
-  base::RunLoop().RunUntilIdle();
+  RunUntilIdle();
 
   // Verify this doesn't crash or hang.
   context()->PurgeMemory();
diff --git a/chromium/content/browser/dom_storage/session_storage_data_map.cc b/chromium/content/browser/dom_storage/session_storage_data_map.cc
index 33ced0c4acf..1df59039ddd 100644
--- a/chromium/content/browser/dom_storage/session_storage_data_map.cc
+++ b/chromium/content/browser/dom_storage/session_storage_data_map.cc
@@ -7,6 +7,7 @@
 #include "base/system/sys_info.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "components/services/leveldb/public/cpp/util.h"
 #include "content/browser/dom_storage/dom_storage_types.h"
 
 namespace content {
@@ -15,7 +16,7 @@ namespace content {
 scoped_refptr<SessionStorageDataMap> SessionStorageDataMap::CreateFromDisk(
     Listener* listener,
     scoped_refptr<SessionStorageMetadata::MapData> map_data,
-    leveldb::mojom::LevelDBDatabase* database) {
+    leveldb::LevelDBDatabaseImpl* database) {
   return base::WrapRefCounted(new SessionStorageDataMap(
       listener, std::move(map_data), database, false));
 }
@@ -24,7 +25,7 @@ scoped_refptr<SessionStorageDataMap> SessionStorageDataMap::CreateFromDisk(
 scoped_refptr<SessionStorageDataMap> SessionStorageDataMap::CreateEmpty(
     Listener* listener,
     scoped_refptr<SessionStorageMetadata::MapData> map_data,
-    leveldb::mojom::LevelDBDatabase* database) {
+    leveldb::LevelDBDatabaseImpl* database) {
   return base::WrapRefCounted(
       new SessionStorageDataMap(listener, std::move(map_data), database, true));
 }
@@ -38,19 +39,14 @@ scoped_refptr<SessionStorageDataMap> SessionStorageDataMap::CreateClone(
       listener, std::move(map_data), std::move(clone_from)));
 }
 
-std::vector<leveldb::mojom::BatchedOperationPtr>
-SessionStorageDataMap::PrepareToCommit() {
-  return std::vector<leveldb::mojom::BatchedOperationPtr>();
-}
-
-void SessionStorageDataMap::DidCommit(leveldb::mojom::DatabaseError error) {
-  listener_->OnCommitResult(error);
+void SessionStorageDataMap::DidCommit(leveldb::Status status) {
+  listener_->OnCommitResult(status);
 }
 
 SessionStorageDataMap::SessionStorageDataMap(
     Listener* listener,
     scoped_refptr<SessionStorageMetadata::MapData> map_data,
-    leveldb::mojom::LevelDBDatabase* database,
+    leveldb::LevelDBDatabaseImpl* database,
     bool is_empty)
     : listener_(listener),
       map_data_(std::move(map_data)),
@@ -99,7 +95,7 @@ void SessionStorageDataMap::RemoveBindingReference() {
   storage_area()->ScheduleImmediateCommit();
 }
 
-void SessionStorageDataMap::OnMapLoaded(leveldb::mojom::DatabaseError) {
+void SessionStorageDataMap::OnMapLoaded(leveldb::Status) {
   clone_from_data_map_.reset();
 }
 
diff --git a/chromium/content/browser/dom_storage/session_storage_data_map.h b/chromium/content/browser/dom_storage/session_storage_data_map.h
index bc1f2c50359..8649d80337d 100644
--- a/chromium/content/browser/dom_storage/session_storage_data_map.h
+++ b/chromium/content/browser/dom_storage/session_storage_data_map.h
@@ -16,6 +16,10 @@
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
 
+namespace leveldb {
+class LevelDBDatabaseImpl;
+}
+
 namespace content {
 
 // Holds the StorageArea for a session storage data map. Every
@@ -38,18 +42,18 @@ class CONTENT_EXPORT SessionStorageDataMap final
     virtual void OnDataMapCreation(const std::vector<uint8_t>& map_id,
                                    SessionStorageDataMap* map) = 0;
     virtual void OnDataMapDestruction(const std::vector<uint8_t>& map_id) = 0;
-    virtual void OnCommitResult(leveldb::mojom::DatabaseError error) = 0;
+    virtual void OnCommitResult(leveldb::Status status) = 0;
   };
 
   static scoped_refptr<SessionStorageDataMap> CreateFromDisk(
       Listener* listener,
       scoped_refptr<SessionStorageMetadata::MapData> map_data,
-      leveldb::mojom::LevelDBDatabase* database);
+      leveldb::LevelDBDatabaseImpl* database);
 
   static scoped_refptr<SessionStorageDataMap> CreateEmpty(
       Listener* listener,
       scoped_refptr<SessionStorageMetadata::MapData> map_data,
-      leveldb::mojom::LevelDBDatabase* database);
+      leveldb::LevelDBDatabaseImpl* database);
 
   static scoped_refptr<SessionStorageDataMap> CreateClone(
       Listener* listener,
@@ -73,9 +77,7 @@ class CONTENT_EXPORT SessionStorageDataMap final
   // Note: this is irrelevant, as the parent area is handling binding.
   void OnNoBindings() override {}
 
-  std::vector<leveldb::mojom::BatchedOperationPtr> PrepareToCommit() override;
-
-  void DidCommit(leveldb::mojom::DatabaseError error) override;
+  void DidCommit(leveldb::Status status) override;
 
  private:
   friend class base::RefCounted<SessionStorageDataMap>;
@@ -83,7 +85,7 @@ class CONTENT_EXPORT SessionStorageDataMap final
   SessionStorageDataMap(
       Listener* listener,
       scoped_refptr<SessionStorageMetadata::MapData> map_entry,
-      leveldb::mojom::LevelDBDatabase* database,
+      leveldb::LevelDBDatabaseImpl* database,
       bool is_empty);
   SessionStorageDataMap(
       Listener* listener,
@@ -91,7 +93,7 @@ class CONTENT_EXPORT SessionStorageDataMap final
       scoped_refptr<SessionStorageDataMap> forking_from);
   ~SessionStorageDataMap() override;
 
-  void OnMapLoaded(leveldb::mojom::DatabaseError error) override;
+  void OnMapLoaded(leveldb::Status status) override;
 
   static StorageAreaImpl::Options GetOptions();
 
diff --git a/chromium/content/browser/dom_storage/session_storage_data_map_unittest.cc b/chromium/content/browser/dom_storage/session_storage_data_map_unittest.cc
index bc2ce77c70e..0fef0cb5302 100644
--- a/chromium/content/browser/dom_storage/session_storage_data_map_unittest.cc
+++ b/chromium/content/browser/dom_storage/session_storage_data_map_unittest.cc
@@ -8,12 +8,16 @@
 #include <vector>
 
 #include "base/bind.h"
+#include "base/containers/span.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
+#include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/public/test/browser_task_environment.h"
-#include "content/test/fake_leveldb_database.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_associated_receiver.h"
@@ -22,10 +26,20 @@
 #include "url/gurl.h"
 
 namespace content {
+
 namespace {
+
 using leveldb::StdStringToUint8Vector;
 using leveldb::Uint8VectorToStdString;
 
+MATCHER(OKStatus, "Equality matcher for type OK leveldb::Status") {
+  return arg.ok();
+}
+
+base::span<const uint8_t> MakeBytes(base::StringPiece str) {
+  return base::as_bytes(base::make_span(str));
+}
+
 class MockListener : public SessionStorageDataMap::Listener {
  public:
   MockListener() {}
@@ -34,7 +48,7 @@ class MockListener : public SessionStorageDataMap::Listener {
                void(const std::vector<uint8_t>& map_id,
                     SessionStorageDataMap* map));
   MOCK_METHOD1(OnDataMapDestruction, void(const std::vector<uint8_t>& map_id));
-  MOCK_METHOD1(OnCommitResult, void(leveldb::mojom::DatabaseError error));
+  MOCK_METHOD1(OnCommitResult, void(leveldb::Status status));
 };
 
 void GetAllDataCallback(bool* success_out,
@@ -79,23 +93,58 @@ class GetAllCallback : public blink::mojom::StorageAreaGetAllCallback {
 class SessionStorageDataMapTest : public testing::Test {
  public:
   SessionStorageDataMapTest()
-      : test_origin_(url::Origin::Create(GURL("http://host1.com:1"))),
-        database_(&mock_data_) {
-    // Should show up in first map.
-    mock_data_[StdStringToUint8Vector("map-1-key1")] =
-        StdStringToUint8Vector("data1");
-    // Dummy data to verify we don't delete everything.
-    mock_data_[StdStringToUint8Vector("map-3-key1")] =
-        StdStringToUint8Vector("data3");
+      : test_origin_(url::Origin::Create(GURL("http://host1.com:1"))) {
+    base::RunLoop loop;
+    database_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
+        base::nullopt, "SessionStorageDataMapTest",
+        base::CreateSequencedTaskRunner({base::MayBlock(), base::ThreadPool()}),
+        base::BindLambdaForTesting([&](leveldb::Status status) {
+          ASSERT_TRUE(status.ok());
+          loop.Quit();
+        }));
+    loop.Run();
+
+    database_->database().PostTaskWithThisObject(
+        FROM_HERE, base::BindOnce([](const storage::DomStorageDatabase& db) {
+          // Should show up in first map.
+          leveldb::Status status =
+              db.Put(MakeBytes("map-1-key1"), MakeBytes("data1"));
+          ASSERT_TRUE(status.ok());
+
+          // Dummy data to verify we don't delete everything.
+          status = db.Put(MakeBytes("map-3-key1"), MakeBytes("data3"));
+          ASSERT_TRUE(status.ok());
+        }));
+  }
+
+  ~SessionStorageDataMapTest() override = default;
+
+  std::map<std::string, std::string> GetDatabaseContents() {
+    std::vector<storage::DomStorageDatabase::KeyValuePair> entries;
+    base::RunLoop loop;
+    database_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          leveldb::Status status = db.GetPrefixed({}, &entries);
+          ASSERT_TRUE(status.ok());
+          loop.Quit();
+        }));
+    loop.Run();
+
+    std::map<std::string, std::string> contents;
+    for (auto& entry : entries) {
+      contents.emplace(std::string(entry.key.begin(), entry.key.end()),
+                       std::string(entry.value.begin(), entry.value.end()));
+    }
+
+    return contents;
   }
-  ~SessionStorageDataMapTest() override {}
 
  protected:
   BrowserTaskEnvironment task_environment_;
   testing::StrictMock<MockListener> listener_;
   url::Origin test_origin_;
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> mock_data_;
-  FakeLevelDBDatabase database_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> database_;
 };
 
 }  // namespace
@@ -110,7 +159,7 @@ TEST_F(SessionStorageDataMapTest, BasicEmptyCreation) {
           &listener_,
           base::MakeRefCounted<SessionStorageMetadata::MapData>(1,
                                                                 test_origin_),
-          &database_);
+          database_.get());
 
   bool success;
   std::vector<blink::mojom::KeyValuePtr> data;
@@ -131,7 +180,7 @@ TEST_F(SessionStorageDataMapTest, BasicEmptyCreation) {
 
   // Test data is not cleared on deletion.
   map = nullptr;
-  EXPECT_EQ(2u, mock_data_.size());
+  EXPECT_EQ(2u, GetDatabaseContents().size());
 }
 
 TEST_F(SessionStorageDataMapTest, ExplicitlyEmpty) {
@@ -142,7 +191,7 @@ TEST_F(SessionStorageDataMapTest, ExplicitlyEmpty) {
   scoped_refptr<SessionStorageDataMap> map = SessionStorageDataMap::CreateEmpty(
       &listener_,
       base::MakeRefCounted<SessionStorageMetadata::MapData>(1, test_origin_),
-      &database_);
+      database_.get());
 
   bool success;
   std::vector<blink::mojom::KeyValuePtr> data;
@@ -161,7 +210,7 @@ TEST_F(SessionStorageDataMapTest, ExplicitlyEmpty) {
 
   // Test data is not cleared on deletion.
   map = nullptr;
-  EXPECT_EQ(2u, mock_data_.size());
+  EXPECT_EQ(2u, GetDatabaseContents().size());
 }
 
 TEST_F(SessionStorageDataMapTest, Clone) {
@@ -174,14 +223,13 @@ TEST_F(SessionStorageDataMapTest, Clone) {
           &listener_,
           base::MakeRefCounted<SessionStorageMetadata::MapData>(1,
                                                                 test_origin_),
-          &database_);
+          database_.get());
 
   EXPECT_CALL(listener_,
               OnDataMapCreation(StdStringToUint8Vector("2"), testing::_))
       .Times(1);
   // One call on fork.
-  EXPECT_CALL(listener_, OnCommitResult(leveldb::mojom::DatabaseError::OK))
-      .Times(1);
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus())).Times(1);
 
   scoped_refptr<SessionStorageDataMap> map2 =
       SessionStorageDataMap::CreateClone(
@@ -205,9 +253,7 @@ TEST_F(SessionStorageDataMapTest, Clone) {
   EXPECT_EQ(StdStringToUint8Vector("data1"), data[0]->value);
 
   // Test that the data was copied.
-  EXPECT_EQ(StdStringToUint8Vector("data1"),
-            mock_data_[StdStringToUint8Vector("map-2-key1")]);
-
+  EXPECT_EQ("data1", GetDatabaseContents()["map-2-key1"]);
   EXPECT_CALL(listener_, OnDataMapDestruction(StdStringToUint8Vector("1")))
       .Times(1);
   EXPECT_CALL(listener_, OnDataMapDestruction(StdStringToUint8Vector("2")))
@@ -216,7 +262,7 @@ TEST_F(SessionStorageDataMapTest, Clone) {
   // Test data is not cleared on deletion.
   map1 = nullptr;
   map2 = nullptr;
-  EXPECT_EQ(3u, mock_data_.size());
+  EXPECT_EQ(3u, GetDatabaseContents().size());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/dom_storage/session_storage_metadata.cc b/chromium/content/browser/dom_storage/session_storage_metadata.cc
index 3a78234ba9e..89e75800166 100644
--- a/chromium/content/browser/dom_storage/session_storage_metadata.cc
+++ b/chromium/content/browser/dom_storage/session_storage_metadata.cc
@@ -121,7 +121,7 @@ bool SessionStorageMetadata::ParseDatabaseVersion(
 }
 
 bool SessionStorageMetadata::ParseNamespaces(
-    std::vector<leveldb::mojom::KeyValuePtr> values,
+    std::vector<storage::DomStorageDatabase::KeyValuePair> values,
     std::vector<leveldb::mojom::BatchedOperationPtr>* upgrade_operations) {
   namespace_origin_map_.clear();
   next_map_id_from_namespaces_ = 0;
@@ -131,11 +131,11 @@ bool SessionStorageMetadata::ParseNamespaces(
   std::map<url::Origin, scoped_refptr<MapData>>* last_namespace = nullptr;
   std::map<int64_t, scoped_refptr<MapData>> maps;
   bool error = false;
-  for (const leveldb::mojom::KeyValuePtr& key_value : values) {
-    size_t key_size = key_value->key.size();
+  for (const storage::DomStorageDatabase::KeyValuePair& key_value : values) {
+    size_t key_size = key_value.key.size();
 
     base::StringPiece key_as_string =
-        leveldb::Uint8VectorToStringPiece(key_value->key);
+        leveldb::Uint8VectorToStringPiece(key_value.key);
 
     if (key_size < kNamespacePrefixLength) {
       LOG(ERROR) << "Key size is less than prefix length: " << key_as_string;
@@ -176,10 +176,10 @@ bool SessionStorageMetadata::ParseNamespaces(
         key_as_string.substr(kPrefixBeforeOriginLength);
 
     int64_t map_number;
-    if (!ValueToNumber(key_value->value, &map_number)) {
+    if (!ValueToNumber(key_value.value, &map_number)) {
       error = true;
       LOG(ERROR) << "Could not parse map number "
-                 << leveldb::Uint8VectorToStringPiece(key_value->value);
+                 << leveldb::Uint8VectorToStringPiece(key_value.value);
       break;
     }
 
diff --git a/chromium/content/browser/dom_storage/session_storage_metadata.h b/chromium/content/browser/dom_storage/session_storage_metadata.h
index 0d05204b6e3..326edaddf28 100644
--- a/chromium/content/browser/dom_storage/session_storage_metadata.h
+++ b/chromium/content/browser/dom_storage/session_storage_metadata.h
@@ -11,6 +11,7 @@
 
 #include "base/memory/ref_counted.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/common/content_export.h"
 #include "url/origin.h"
 
@@ -106,7 +107,7 @@ class CONTENT_EXPORT SessionStorageMetadata {
   // will be populated in |upgrade_operations|. This call is not necessary on
   // new databases.
   bool ParseNamespaces(
-      std::vector<leveldb::mojom::KeyValuePtr> values,
+      std::vector<storage::DomStorageDatabase::KeyValuePair> values,
       std::vector<leveldb::mojom::BatchedOperationPtr>* upgrade_operations);
 
   // Parses the next map id from the given bytes. If that fails, then it uses
diff --git a/chromium/content/browser/dom_storage/session_storage_metadata_unittest.cc b/chromium/content/browser/dom_storage/session_storage_metadata_unittest.cc
index 43b1d055ea1..a7d9a0db1e8 100644
--- a/chromium/content/browser/dom_storage/session_storage_metadata_unittest.cc
+++ b/chromium/content/browser/dom_storage/session_storage_metadata_unittest.cc
@@ -12,12 +12,15 @@
 #include "base/stl_util.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/dom_storage_types.h"
 #include "content/browser/dom_storage/session_storage_database.h"
 #include "content/browser/indexed_db/leveldb/leveldb_env.h"
-#include "content/test/fake_leveldb_database.h"
 #include "mojo/public/cpp/bindings/strong_associated_binding.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -32,22 +35,9 @@ namespace content {
 namespace {
 using leveldb::StdStringToUint8Vector;
 using leveldb::Uint8VectorToStdString;
-using leveldb::mojom::DatabaseError;
 
-void GetCallback(std::vector<uint8_t>* value_out,
-                 DatabaseError error,
-                 const std::vector<uint8_t>& value) {
-  *value_out = value;
-}
-
-void ErrorCallback(DatabaseError* error_out, DatabaseError error) {
-  *error_out = error;
-}
-
-void GetAllCallback(std::vector<leveldb::mojom::KeyValuePtr>* values_out,
-                    DatabaseError error,
-                    std::vector<leveldb::mojom::KeyValuePtr> values) {
-  *values_out = std::move(values);
+void ErrorCallback(leveldb::Status* status_out, leveldb::Status status) {
+  *status_out = status;
 }
 
 class SessionStorageMetadataTest : public testing::Test {
@@ -57,8 +47,14 @@ class SessionStorageMetadataTest : public testing::Test {
         test_namespace2_id_(base::GenerateGUID()),
         test_namespace3_id_(base::GenerateGUID()),
         test_origin1_(url::Origin::Create(GURL("http://host1:1/"))),
-        test_origin2_(url::Origin::Create(GURL("http://host2:2/"))),
-        database_(&mock_data_) {
+        test_origin2_(url::Origin::Create(GURL("http://host2:2/"))) {
+    base::RunLoop loop;
+    database_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
+        base::nullopt, "SessionStorageMetadataTest",
+        base::CreateSequencedTaskRunner({base::MayBlock(), base::ThreadPool()}),
+        base::BindLambdaForTesting([&](leveldb::Status) { loop.Quit(); }));
+    loop.Run();
+
     next_map_id_key_ = std::vector<uint8_t>(
         std::begin(SessionStorageMetadata::kNextMapIdKeyBytes),
         std::end(SessionStorageMetadata::kNextMapIdKeyBytes));
@@ -72,18 +68,31 @@ class SessionStorageMetadataTest : public testing::Test {
   ~SessionStorageMetadataTest() override {}
 
   void ReadMetadataFromDatabase(SessionStorageMetadata* metadata) {
-    std::vector<uint8_t> value;
-    database_.Get(database_version_key_, base::BindOnce(&GetCallback, &value));
+    std::vector<uint8_t> version_value;
+    std::vector<uint8_t> next_map_id_value;
+    std::vector<storage::DomStorageDatabase::KeyValuePair> namespace_entries;
+
+    base::RunLoop loop;
+    database_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          EXPECT_TRUE(db.Get(database_version_key_, &version_value).ok());
+          EXPECT_TRUE(db.Get(next_map_id_key_, &next_map_id_value).ok());
+          EXPECT_TRUE(
+              db.GetPrefixed(namespaces_prefix_key_, &namespace_entries).ok());
+          loop.Quit();
+        }));
+    loop.Run();
+
     std::vector<leveldb::mojom::BatchedOperationPtr> migration_operations;
-    EXPECT_TRUE(metadata->ParseDatabaseVersion(value, &migration_operations));
-    EXPECT_TRUE(migration_operations.empty());
-    database_.Get(next_map_id_key_, base::BindOnce(&GetCallback, &value));
-    metadata->ParseNextMapId(value);
-    std::vector<leveldb::mojom::KeyValuePtr> values;
-    database_.GetPrefixed(namespaces_prefix_key_,
-                          base::BindOnce(&GetAllCallback, &values));
     EXPECT_TRUE(
-        metadata->ParseNamespaces(std::move(values), &migration_operations));
+        metadata->ParseDatabaseVersion(version_value, &migration_operations));
+    EXPECT_TRUE(migration_operations.empty());
+
+    metadata->ParseNextMapId(next_map_id_value);
+
+    EXPECT_TRUE(metadata->ParseNamespaces(std::move(namespace_entries),
+                                          &migration_operations));
     EXPECT_TRUE(migration_operations.empty());
   }
 
@@ -99,29 +108,69 @@ class SessionStorageMetadataTest : public testing::Test {
     // | namespace-<guid 2>-http://host2:2/     | 4                  |
     // | next-map-id                            | 5                  |
     // | version                                | 1                  |
-    mock_data_[StdStringToUint8Vector(
-        std::string("namespace-") + test_namespace1_id_ + "-" +
-        test_origin1_.GetURL().spec())] = StdStringToUint8Vector("1");
-    mock_data_[StdStringToUint8Vector(
-        std::string("namespace-") + test_namespace1_id_ + "-" +
-        test_origin2_.GetURL().spec())] = StdStringToUint8Vector("3");
-    mock_data_[StdStringToUint8Vector(
-        std::string("namespace-") + test_namespace2_id_ + "-" +
-        test_origin1_.GetURL().spec())] = StdStringToUint8Vector("1");
-    mock_data_[StdStringToUint8Vector(
-        std::string("namespace-") + test_namespace2_id_ + "-" +
-        test_origin2_.GetURL().spec())] = StdStringToUint8Vector("4");
-
-    mock_data_[next_map_id_key_] = StdStringToUint8Vector("5");
-
-    mock_data_[StdStringToUint8Vector("map-1-key1")] =
-        StdStringToUint8Vector("data1");
-    mock_data_[StdStringToUint8Vector("map-3-key1")] =
-        StdStringToUint8Vector("data3");
-    mock_data_[StdStringToUint8Vector("map-4-key1")] =
-        StdStringToUint8Vector("data4");
-
-    mock_data_[database_version_key_] = StdStringToUint8Vector("1");
+    base::RunLoop loop;
+    database_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          db.Put(StdStringToUint8Vector(std::string("namespace-") +
+                                        test_namespace1_id_ + "-" +
+                                        test_origin1_.GetURL().spec()),
+                 StdStringToUint8Vector("1"));
+          db.Put(StdStringToUint8Vector(std::string("namespace-") +
+                                        test_namespace1_id_ + "-" +
+                                        test_origin2_.GetURL().spec()),
+                 StdStringToUint8Vector("3"));
+          db.Put(StdStringToUint8Vector(std::string("namespace-") +
+                                        test_namespace2_id_ + "-" +
+                                        test_origin1_.GetURL().spec()),
+                 StdStringToUint8Vector("1"));
+          db.Put(StdStringToUint8Vector(std::string("namespace-") +
+                                        test_namespace2_id_ + "-" +
+                                        test_origin2_.GetURL().spec()),
+                 StdStringToUint8Vector("4"));
+
+          db.Put(next_map_id_key_, StdStringToUint8Vector("5"));
+
+          db.Put(StdStringToUint8Vector("map-1-key1"),
+                 StdStringToUint8Vector("data1"));
+          db.Put(StdStringToUint8Vector("map-3-key1"),
+                 StdStringToUint8Vector("data3"));
+          db.Put(StdStringToUint8Vector("map-4-key1"),
+                 StdStringToUint8Vector("data4"));
+
+          db.Put(database_version_key_, StdStringToUint8Vector("1"));
+          loop.Quit();
+        }));
+    loop.Run();
+  }
+
+  std::map<std::vector<uint8_t>, std::vector<uint8_t>> GetDatabaseContents() {
+    std::vector<storage::DomStorageDatabase::KeyValuePair> entries;
+    base::RunLoop loop;
+    database_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          leveldb::Status status = db.GetPrefixed({}, &entries);
+          ASSERT_TRUE(status.ok());
+          loop.Quit();
+        }));
+    loop.Run();
+
+    std::map<std::vector<uint8_t>, std::vector<uint8_t>> contents;
+    for (auto& entry : entries)
+      contents.emplace(entry.key, entry.value);
+    return contents;
+  }
+
+  void WriteBatch(std::vector<leveldb::mojom::BatchedOperationPtr> operations,
+                  base::OnceCallback<void(leveldb::Status)> callback) {
+    base::RunLoop loop;
+    database_->Write(std::move(operations),
+                     base::BindLambdaForTesting([&](leveldb::Status status) {
+                       std::move(callback).Run(status);
+                       loop.Quit();
+                     }));
+    loop.Run();
   }
 
  protected:
@@ -131,8 +180,7 @@ class SessionStorageMetadataTest : public testing::Test {
   std::string test_namespace3_id_;
   url::Origin test_origin1_;
   url::Origin test_origin2_;
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> mock_data_;
-  FakeLevelDBDatabase database_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> database_;
 
   std::vector<uint8_t> database_version_key_;
   std::vector<uint8_t> next_map_id_key_;
@@ -144,13 +192,13 @@ TEST_F(SessionStorageMetadataTest, SaveNewMetadata) {
   std::vector<leveldb::mojom::BatchedOperationPtr> operations =
       metadata.SetupNewDatabase();
 
-  DatabaseError error;
-  database_.Write(std::move(operations),
-                  base::BindOnce(&ErrorCallback, &error));
-  EXPECT_EQ(DatabaseError::OK, error);
+  leveldb::Status status;
+  WriteBatch(std::move(operations), base::BindOnce(&ErrorCallback, &status));
+  EXPECT_TRUE(status.ok());
 
-  EXPECT_EQ(StdStringToUint8Vector("1"), mock_data_[database_version_key_]);
-  EXPECT_EQ(StdStringToUint8Vector("0"), mock_data_[next_map_id_key_]);
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(StdStringToUint8Vector("1"), contents[database_version_key_]);
+  EXPECT_EQ(StdStringToUint8Vector("0"), contents[next_map_id_key_]);
 }
 
 TEST_F(SessionStorageMetadataTest, LoadingData) {
@@ -204,17 +252,17 @@ TEST_F(SessionStorageMetadataTest, SaveNewMap) {
                    ->second[test_origin1_]
                    ->ReferenceCount());
 
-  DatabaseError error;
-  database_.Write(std::move(operations),
-                  base::BindOnce(&ErrorCallback, &error));
-  EXPECT_EQ(DatabaseError::OK, error);
+  leveldb::Status status;
+  WriteBatch(std::move(operations), base::BindOnce(&ErrorCallback, &status));
+  EXPECT_TRUE(status.ok());
 
   // Verify metadata was written to disk.
-  EXPECT_EQ(StdStringToUint8Vector("6"), mock_data_[next_map_id_key_]);
+  auto contents = GetDatabaseContents();
+  EXPECT_EQ(StdStringToUint8Vector("6"), contents[next_map_id_key_]);
   EXPECT_EQ(StdStringToUint8Vector("5"),
-            mock_data_[StdStringToUint8Vector(std::string("namespace-") +
-                                              test_namespace1_id_ + "-" +
-                                              test_origin1_.GetURL().spec())]);
+            contents[StdStringToUint8Vector(std::string("namespace-") +
+                                            test_namespace1_id_ + "-" +
+                                            test_origin1_.GetURL().spec())]);
 }
 
 TEST_F(SessionStorageMetadataTest, ShallowCopies) {
@@ -228,10 +276,10 @@ TEST_F(SessionStorageMetadataTest, ShallowCopies) {
   std::vector<leveldb::mojom::BatchedOperationPtr> operations;
   metadata.RegisterShallowClonedNamespace(ns1_entry, ns3_entry, &operations);
 
-  DatabaseError error;
-  database_.Write(std::move(operations),
-                  base::BindOnce(&ErrorCallback, &error));
-  EXPECT_EQ(DatabaseError::OK, error);
+  leveldb::Status status;
+  ;
+  WriteBatch(std::move(operations), base::BindOnce(&ErrorCallback, &status));
+  EXPECT_TRUE(status.ok());
 
   // Verify in-memory metadata is correct.
   EXPECT_EQ(StdStringToUint8Vector("map-1-"),
@@ -246,14 +294,15 @@ TEST_F(SessionStorageMetadataTest, ShallowCopies) {
   EXPECT_EQ(2, ns3_entry->second[test_origin2_]->ReferenceCount());
 
   // Verify metadata was written to disk.
+  auto contents = GetDatabaseContents();
   EXPECT_EQ(StdStringToUint8Vector("1"),
-            mock_data_[StdStringToUint8Vector(std::string("namespace-") +
-                                              test_namespace3_id_ + "-" +
-                                              test_origin1_.GetURL().spec())]);
+            contents[StdStringToUint8Vector(std::string("namespace-") +
+                                            test_namespace3_id_ + "-" +
+                                            test_origin1_.GetURL().spec())]);
   EXPECT_EQ(StdStringToUint8Vector("3"),
-            mock_data_[StdStringToUint8Vector(std::string("namespace-") +
-                                              test_namespace3_id_ + "-" +
-                                              test_origin2_.GetURL().spec())]);
+            contents[StdStringToUint8Vector(std::string("namespace-") +
+                                            test_namespace3_id_ + "-" +
+                                            test_origin2_.GetURL().spec())]);
 }
 
 TEST_F(SessionStorageMetadataTest, DeleteNamespace) {
@@ -263,10 +312,9 @@ TEST_F(SessionStorageMetadataTest, DeleteNamespace) {
 
   std::vector<leveldb::mojom::BatchedOperationPtr> operations;
   metadata.DeleteNamespace(test_namespace1_id_, &operations);
-  DatabaseError error;
-  database_.Write(std::move(operations),
-                  base::BindOnce(&ErrorCallback, &error));
-  EXPECT_EQ(DatabaseError::OK, error);
+  leveldb::Status status;
+  WriteBatch(std::move(operations), base::BindOnce(&ErrorCallback, &status));
+  EXPECT_TRUE(status.ok());
 
   EXPECT_FALSE(
       base::Contains(metadata.namespace_origin_map(), test_namespace1_id_));
@@ -277,17 +325,17 @@ TEST_F(SessionStorageMetadataTest, DeleteNamespace) {
   EXPECT_EQ(1, ns2_entry->second[test_origin2_]->ReferenceCount());
 
   // Verify metadata and data was deleted from disk.
+  auto contents = GetDatabaseContents();
   EXPECT_FALSE(base::Contains(
-      mock_data_,
+      contents,
       StdStringToUint8Vector(std::string("namespace-") + test_namespace1_id_ +
                              "-" + test_origin1_.GetURL().spec())));
   EXPECT_FALSE(base::Contains(
-      mock_data_,
+      contents,
       StdStringToUint8Vector(std::string("namespace-") + test_namespace1_id_ +
                              "-" + test_origin2_.GetURL().spec())));
-  EXPECT_FALSE(
-      base::Contains(mock_data_, StdStringToUint8Vector("map-3-key1")));
-  EXPECT_TRUE(base::Contains(mock_data_, StdStringToUint8Vector("map-1-key1")));
+  EXPECT_FALSE(base::Contains(contents, StdStringToUint8Vector("map-3-key1")));
+  EXPECT_TRUE(base::Contains(contents, StdStringToUint8Vector("map-1-key1")));
 }
 
 TEST_F(SessionStorageMetadataTest, DeleteArea) {
@@ -298,10 +346,9 @@ TEST_F(SessionStorageMetadataTest, DeleteArea) {
   // First delete an area with a shared map.
   std::vector<leveldb::mojom::BatchedOperationPtr> operations;
   metadata.DeleteArea(test_namespace1_id_, test_origin1_, &operations);
-  DatabaseError error;
-  database_.Write(std::move(operations),
-                  base::BindOnce(&ErrorCallback, &error));
-  EXPECT_EQ(DatabaseError::OK, error);
+  leveldb::Status status;
+  WriteBatch(std::move(operations), base::BindOnce(&ErrorCallback, &status));
+  EXPECT_TRUE(status.ok());
 
   // Verify in-memory metadata is correct.
   auto ns1_entry = metadata.GetOrCreateNamespaceEntry(test_namespace1_id_);
@@ -312,23 +359,23 @@ TEST_F(SessionStorageMetadataTest, DeleteArea) {
   EXPECT_EQ(1, ns2_entry->second[test_origin2_]->ReferenceCount());
 
   // Verify only the applicable data was deleted.
+  auto contents = GetDatabaseContents();
   EXPECT_FALSE(base::Contains(
-      mock_data_,
+      contents,
       StdStringToUint8Vector(std::string("namespace-") + test_namespace1_id_ +
                              "-" + test_origin1_.GetURL().spec())));
   EXPECT_TRUE(base::Contains(
-      mock_data_,
+      contents,
       StdStringToUint8Vector(std::string("namespace-") + test_namespace1_id_ +
                              "-" + test_origin2_.GetURL().spec())));
-  EXPECT_TRUE(base::Contains(mock_data_, StdStringToUint8Vector("map-1-key1")));
-  EXPECT_TRUE(base::Contains(mock_data_, StdStringToUint8Vector("map-4-key1")));
+  EXPECT_TRUE(base::Contains(contents, StdStringToUint8Vector("map-1-key1")));
+  EXPECT_TRUE(base::Contains(contents, StdStringToUint8Vector("map-4-key1")));
 
   // Now delete an area with a unique map.
   operations.clear();
   metadata.DeleteArea(test_namespace2_id_, test_origin2_, &operations);
-  database_.Write(std::move(operations),
-                  base::BindOnce(&ErrorCallback, &error));
-  EXPECT_EQ(DatabaseError::OK, error);
+  WriteBatch(std::move(operations), base::BindOnce(&ErrorCallback, &status));
+  EXPECT_TRUE(status.ok());
 
   // Verify in-memory metadata is correct.
   EXPECT_FALSE(base::Contains(ns1_entry->second, test_origin1_));
@@ -337,18 +384,18 @@ TEST_F(SessionStorageMetadataTest, DeleteArea) {
   EXPECT_FALSE(base::Contains(ns2_entry->second, test_origin2_));
 
   // Verify only the applicable data was deleted.
+  contents = GetDatabaseContents();
   EXPECT_TRUE(base::Contains(
-      mock_data_,
+      contents,
       StdStringToUint8Vector(std::string("namespace-") + test_namespace2_id_ +
                              "-" + test_origin1_.GetURL().spec())));
   EXPECT_FALSE(base::Contains(
-      mock_data_,
+      contents,
       StdStringToUint8Vector(std::string("namespace-") + test_namespace2_id_ +
                              "-" + test_origin2_.GetURL().spec())));
-  EXPECT_TRUE(base::Contains(mock_data_, StdStringToUint8Vector("map-1-key1")));
-  EXPECT_TRUE(base::Contains(mock_data_, StdStringToUint8Vector("map-3-key1")));
-  EXPECT_FALSE(
-      base::Contains(mock_data_, StdStringToUint8Vector("map-4-key1")));
+  EXPECT_TRUE(base::Contains(contents, StdStringToUint8Vector("map-1-key1")));
+  EXPECT_TRUE(base::Contains(contents, StdStringToUint8Vector("map-3-key1")));
+  EXPECT_FALSE(base::Contains(contents, StdStringToUint8Vector("map-4-key1")));
 }
 
 class SessionStorageMetadataMigrationTest : public testing::Test {
@@ -433,7 +480,7 @@ TEST_F(SessionStorageMetadataMigrationTest, MigrateV0ToV1) {
   metadata.ParseNextMapId(leveldb::StdStringToUint8Vector(db_value));
 
   // Get all keys-value pairs with the given key prefix
-  std::vector<leveldb::mojom::KeyValuePtr> values;
+  std::vector<storage::DomStorageDatabase::KeyValuePair> values;
   {
     std::unique_ptr<leveldb::Iterator> it(db()->NewIterator(options));
     it->Seek(leveldb::Slice("namespace-"));
@@ -441,9 +488,8 @@ TEST_F(SessionStorageMetadataMigrationTest, MigrateV0ToV1) {
       if (!it->key().starts_with(leveldb::Slice("namespace-")))
         break;
       leveldb::mojom::KeyValuePtr kv = leveldb::mojom::KeyValue::New();
-      kv->key = leveldb::GetVectorFor(it->key());
-      kv->value = leveldb::GetVectorFor(it->value());
-      values.push_back(std::move(kv));
+      values.emplace_back(leveldb::GetVectorFor(it->key()),
+                          leveldb::GetVectorFor(it->value()));
     }
     EXPECT_TRUE(it->status().ok());
   }
diff --git a/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.cc b/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.cc
index 80d4391b41c..ed6d0b3d759 100644
--- a/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.cc
+++ b/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.cc
@@ -58,7 +58,7 @@ bool SessionStorageNamespaceImplMojo::HasAreaForOrigin(
 }
 
 void SessionStorageNamespaceImplMojo::PopulateFromMetadata(
-    leveldb::mojom::LevelDBDatabase* database,
+    leveldb::LevelDBDatabaseImpl* database,
     SessionStorageMetadata::NamespaceEntry namespace_metadata) {
   DCHECK(!IsPopulated());
   database_ = database;
@@ -85,7 +85,7 @@ void SessionStorageNamespaceImplMojo::PopulateFromMetadata(
 }
 
 void SessionStorageNamespaceImplMojo::PopulateAsClone(
-    leveldb::mojom::LevelDBDatabase* database,
+    leveldb::LevelDBDatabaseImpl* database,
     SessionStorageMetadata::NamespaceEntry namespace_metadata,
     const OriginAreas& areas_to_clone) {
   DCHECK(!IsPopulated());
@@ -227,7 +227,7 @@ void SessionStorageNamespaceImplMojo::Clone(
 }
 
 void SessionStorageNamespaceImplMojo::CloneAllNamespacesWaitingForClone(
-    leveldb::mojom::LevelDBDatabase* database,
+    leveldb::LevelDBDatabaseImpl* database,
     SessionStorageMetadata* metadata,
     const std::map<std::string,
                    std::unique_ptr<SessionStorageNamespaceImplMojo>>&
diff --git a/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.h b/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.h
index 38f09f83d71..a0eb45ef06f 100644
--- a/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.h
+++ b/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo.h
@@ -20,6 +20,10 @@
 #include "third_party/blink/public/mojom/dom_storage/session_storage_namespace.mojom.h"
 #include "url/origin.h"
 
+namespace leveldb {
+class LevelDBDatabaseImpl;
+}
+
 namespace content {
 
 // Implements the mojo interface SessionStorageNamespace. Stores data maps per
@@ -122,14 +126,14 @@ class CONTENT_EXPORT SessionStorageNamespaceImplMojo final
   // Called when this is a new namespace, or when the namespace was loaded from
   // disk. Should be called before |Bind|.
   void PopulateFromMetadata(
-      leveldb::mojom::LevelDBDatabase* database,
+      leveldb::LevelDBDatabaseImpl* database,
       SessionStorageMetadata::NamespaceEntry namespace_metadata);
 
   // Can either be called before |Bind|, or if the source namespace isn't
   // available yet, |SetWaitingForClonePopulation| can be called. Then |Bind|
   // will work, and hold onto the request until after this method is called.
   void PopulateAsClone(
-      leveldb::mojom::LevelDBDatabase* database,
+      leveldb::LevelDBDatabaseImpl* database,
       SessionStorageMetadata::NamespaceEntry namespace_metadata,
       const OriginAreas& areas_to_clone);
 
@@ -184,7 +188,7 @@ class CONTENT_EXPORT SessionStorageNamespaceImplMojo final
   // * If the parent is populated
   // * If the parent has a parent.
   void CloneAllNamespacesWaitingForClone(
-      leveldb::mojom::LevelDBDatabase* database,
+      leveldb::LevelDBDatabaseImpl* database,
       SessionStorageMetadata* metadata,
       const std::map<std::string,
                      std::unique_ptr<SessionStorageNamespaceImplMojo>>&
@@ -200,7 +204,7 @@ class CONTENT_EXPORT SessionStorageNamespaceImplMojo final
 
   const std::string namespace_id_;
   SessionStorageMetadata::NamespaceEntry namespace_entry_;
-  leveldb::mojom::LevelDBDatabase* database_ = nullptr;
+  leveldb::LevelDBDatabaseImpl* database_ = nullptr;
 
   SessionStorageDataMap::Listener* data_map_listener_;
   SessionStorageAreaImpl::RegisterNewAreaMap register_new_map_callback_;
diff --git a/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo_unittest.cc b/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo_unittest.cc
index 1a7c84c717b..48af5b086a5 100644
--- a/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo_unittest.cc
+++ b/chromium/content/browser/dom_storage/session_storage_namespace_impl_mojo_unittest.cc
@@ -4,12 +4,17 @@
 
 #include "content/browser/dom_storage/session_storage_namespace_impl_mojo.h"
 
+#include "base/barrier_closure.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/guid.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
+#include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/dom_storage/session_storage_data_map.h"
 #include "content/browser/dom_storage/session_storage_metadata.h"
@@ -17,7 +22,6 @@
 #include "content/browser/site_instance_impl.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
-#include "content/test/fake_leveldb_database.h"
 #include "content/test/gmock_util.h"
 #include "mojo/core/embedder/embedder.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
@@ -27,15 +31,20 @@
 #include "url/gurl.h"
 
 namespace content {
+
 namespace {
+
 using leveldb::StdStringToUint8Vector;
-using leveldb::mojom::DatabaseError;
 using NamespaceEntry = SessionStorageMetadata::NamespaceEntry;
 
 constexpr const int kTestProcessIdOrigin1 = 11;
 constexpr const int kTestProcessIdAllOrigins = 12;
 constexpr const int kTestProcessIdOrigin3 = 13;
 
+MATCHER(OKStatus, "Equality matcher for type OK leveldb::Status") {
+  return arg.ok();
+}
+
 class MockListener : public SessionStorageDataMap::Listener {
  public:
   MockListener() {}
@@ -44,7 +53,7 @@ class MockListener : public SessionStorageDataMap::Listener {
                void(const std::vector<uint8_t>& map_id,
                     SessionStorageDataMap* map));
   MOCK_METHOD1(OnDataMapDestruction, void(const std::vector<uint8_t>& map_id));
-  MOCK_METHOD1(OnCommitResult, void(leveldb::mojom::DatabaseError error));
+  MOCK_METHOD1(OnCommitResult, void(leveldb::Status));
 };
 
 class SessionStorageNamespaceImplMojoTest
@@ -56,22 +65,45 @@ class SessionStorageNamespaceImplMojoTest
         test_namespace_id2_(base::GenerateGUID()),
         test_origin1_(url::Origin::Create(GURL("https://host1.com/"))),
         test_origin2_(url::Origin::Create(GURL("https://host2.com/"))),
-        test_origin3_(url::Origin::Create(GURL("https://host3.com/"))),
-        database_(&mock_data_) {}
+        test_origin3_(url::Origin::Create(GURL("https://host3.com/"))) {}
   ~SessionStorageNamespaceImplMojoTest() override = default;
 
+  void WriteBatch(std::vector<leveldb::mojom::BatchedOperationPtr> operations) {
+    base::RunLoop loop(base::RunLoop::Type::kNestableTasksAllowed);
+    database_->Write(
+        std::move(operations),
+        base::BindLambdaForTesting([&](leveldb::Status) { loop.Quit(); }));
+    loop.Run();
+  }
+
   void SetUp() override {
     // Create a database that already has a namespace saved.
+    base::RunLoop loop;
+    database_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
+        base::nullopt, "SessionStorageNamespaceImplMojoTest",
+        base::CreateSequencedTaskRunner({base::MayBlock(), base::ThreadPool()}),
+        base::BindLambdaForTesting([&](leveldb::Status) { loop.Quit(); }));
+    loop.Run();
+
     metadata_.SetupNewDatabase();
     std::vector<leveldb::mojom::BatchedOperationPtr> save_operations;
     auto entry = metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_);
     auto map_id =
         metadata_.RegisterNewMap(entry, test_origin1_, &save_operations);
     DCHECK(map_id->KeyPrefix() == StdStringToUint8Vector("map-0-"));
-    database_.Write(std::move(save_operations), base::DoNothing());
+    WriteBatch(std::move(save_operations));
+
     // Put some data in one of the maps.
-    mock_data_[StdStringToUint8Vector("map-0-key1")] =
-        StdStringToUint8Vector("data1");
+    base::RunLoop put_loop;
+    database_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          ASSERT_TRUE(db.Put(StdStringToUint8Vector("map-0-key1"),
+                             StdStringToUint8Vector("data1"))
+                          .ok());
+          put_loop.Quit();
+        }));
+    put_loop.Run();
 
     auto* security_policy = ChildProcessSecurityPolicyImpl::GetInstance();
     security_policy->Add(kTestProcessIdOrigin1, &browser_context_);
@@ -127,7 +159,7 @@ class SessionStorageNamespaceImplMojoTest
     std::vector<leveldb::mojom::BatchedOperationPtr> save_operations;
     auto map_data =
         metadata_.RegisterNewMap(namespace_entry, origin, &save_operations);
-    database_.Write(std::move(save_operations), base::DoNothing());
+    WriteBatch(std::move(save_operations));
     return map_data;
   }
 
@@ -141,17 +173,18 @@ class SessionStorageNamespaceImplMojoTest
         metadata_.GetOrCreateNamespaceEntry(destination_namespace);
     metadata_.RegisterShallowClonedNamespace(source_namespace, namespace_entry,
                                              &save_operations);
-    database_.Write(std::move(save_operations), base::DoNothing());
+    WriteBatch(std::move(save_operations));
 
     auto it = namespaces_.find(destination_namespace);
     if (it == namespaces_.end()) {
       auto* namespace_impl =
           CreateSessionStorageNamespaceImplMojo(destination_namespace);
-      namespace_impl->PopulateAsClone(&database_, namespace_entry,
+      namespace_impl->PopulateAsClone(database_.get(), namespace_entry,
                                       areas_to_clone);
       return;
     }
-    it->second->PopulateAsClone(&database_, namespace_entry, areas_to_clone);
+    it->second->PopulateAsClone(database_.get(), namespace_entry,
+                                areas_to_clone);
   }
 
   scoped_refptr<SessionStorageDataMap> MaybeGetExistingDataMapForId(
@@ -179,8 +212,7 @@ class SessionStorageNamespaceImplMojoTest
       data_maps_;
 
   testing::StrictMock<MockListener> listener_;
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> mock_data_;
-  FakeLevelDBDatabase database_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> database_;
 };
 
 TEST_F(SessionStorageNamespaceImplMojoTest, MetadataLoad) {
@@ -193,7 +225,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, MetadataLoad) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   namespace_impl->Bind(ss_namespace.BindNewPipeAndPassReceiver(),
@@ -226,7 +259,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, MetadataLoadWithMapOperations) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   namespace_impl->Bind(ss_namespace.BindNewPipeAndPassReceiver(),
@@ -236,9 +270,13 @@ TEST_F(SessionStorageNamespaceImplMojoTest, MetadataLoadWithMapOperations) {
   ss_namespace->OpenArea(test_origin1_,
                          leveldb_1.BindNewEndpointAndPassReceiver());
 
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK)).Times(1);
+  base::RunLoop commit_loop;
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
+      .Times(1)
+      .WillOnce(testing::Invoke([&](auto error) { commit_loop.Quit(); }));
   test::PutSync(leveldb_1.get(), StdStringToUint8Vector("key2"),
                 StdStringToUint8Vector("data2"), base::nullopt, "");
+  commit_loop.Run();
 
   std::vector<blink::mojom::KeyValuePtr> data;
   EXPECT_TRUE(test::GetAllSync(leveldb_1.get(), &data));
@@ -252,6 +290,7 @@ TEST_F(SessionStorageNamespaceImplMojoTest, MetadataLoadWithMapOperations) {
 
   EXPECT_CALL(listener_, OnDataMapDestruction(StdStringToUint8Vector("0")))
       .Times(1);
+
   namespaces_.clear();
 }
 
@@ -267,7 +306,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, CloneBeforeBind) {
       .Times(1);
 
   namespace_impl1->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace1;
   namespace_impl1->Bind(ss_namespace1.BindNewPipeAndPassReceiver(),
@@ -285,12 +325,18 @@ TEST_F(SessionStorageNamespaceImplMojoTest, CloneBeforeBind) {
                           leveldb_2.BindNewEndpointAndPassReceiver());
 
   // Do a put in the cloned namespace.
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK)).Times(2);
+  base::RunLoop commit_loop;
+  auto commit_callback = base::BarrierClosure(2, commit_loop.QuitClosure());
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
+      .Times(2)
+      .WillRepeatedly(
+          testing::Invoke([&](auto error) { commit_callback.Run(); }));
   EXPECT_CALL(listener_,
               OnDataMapCreation(StdStringToUint8Vector("1"), testing::_))
       .Times(1);
   test::PutSync(leveldb_2.get(), StdStringToUint8Vector("key2"),
                 StdStringToUint8Vector("data2"), base::nullopt, "");
+  commit_loop.Run();
 
   std::vector<blink::mojom::KeyValuePtr> data;
   EXPECT_TRUE(test::GetAllSync(leveldb_2.get(), &data));
@@ -323,7 +369,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, CloneAfterBind) {
       .Times(1);
 
   namespace_impl1->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace1;
   namespace_impl1->Bind(ss_namespace1.BindNewPipeAndPassReceiver(),
@@ -353,9 +400,13 @@ TEST_F(SessionStorageNamespaceImplMojoTest, CloneAfterBind) {
   ASSERT_TRUE(namespace_impl2->IsPopulated());
 
   // Do a put in the cloned namespace.
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK)).Times(1);
+  base::RunLoop commit_loop;
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
+      .Times(1)
+      .WillOnce(testing::Invoke([&](auto error) { commit_loop.Quit(); }));
   test::PutSync(leveldb_n2_o2.get(), StdStringToUint8Vector("key2"),
                 StdStringToUint8Vector("data2"), base::nullopt, "");
+  commit_loop.Run();
 
   std::vector<blink::mojom::KeyValuePtr> data;
   EXPECT_TRUE(test::GetAllSync(leveldb_n2_o1.get(), &data));
@@ -387,7 +438,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, RemoveOriginData) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   namespace_impl->Bind(ss_namespace.BindNewPipeAndPassReceiver(),
@@ -409,8 +461,12 @@ TEST_F(SessionStorageNamespaceImplMojoTest, RemoveOriginData) {
   EXPECT_CALL(mock_observer, AllDeleted("\n"))
       .WillOnce(base::test::RunClosure(loop.QuitClosure()));
 
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK)).Times(1);
+  base::RunLoop commit_loop;
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
+      .Times(1)
+      .WillOnce(testing::Invoke([&](auto error) { commit_loop.Quit(); }));
   namespace_impl->RemoveOriginData(test_origin1_, base::DoNothing());
+  commit_loop.Run();
 
   std::vector<blink::mojom::KeyValuePtr> data;
   EXPECT_TRUE(test::GetAllSync(leveldb_1.get(), &data));
@@ -433,10 +489,11 @@ TEST_F(SessionStorageNamespaceImplMojoTest, RemoveOriginDataWithoutBinding) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   base::RunLoop loop;
-  EXPECT_CALL(listener_, OnCommitResult(DatabaseError::OK))
+  EXPECT_CALL(listener_, OnCommitResult(OKStatus()))
       .WillOnce(base::test::RunClosure(loop.QuitClosure()));
   namespace_impl->RemoveOriginData(test_origin1_, base::DoNothing());
   loop.Run();
@@ -457,7 +514,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, ProcessLockedToOtherOrigin) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   namespace_impl->Bind(ss_namespace.BindNewPipeAndPassReceiver(),
@@ -484,7 +542,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, PurgeUnused) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   namespace_impl->Bind(ss_namespace.BindNewPipeAndPassReceiver(),
@@ -517,7 +576,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, NamespaceBindingPerOrigin) {
       .Times(1);
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace_o1;
   namespace_impl->Bind(ss_namespace_o1.BindNewPipeAndPassReceiver(),
@@ -561,7 +621,8 @@ TEST_F(SessionStorageNamespaceImplMojoTest, ReopenClonedAreaAfterPurge) {
       .WillOnce(testing::SaveArg<1>(&data_map));
 
   namespace_impl->PopulateFromMetadata(
-      &database_, metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
+      database_.get(),
+      metadata_.GetOrCreateNamespaceEntry(test_namespace_id1_));
 
   mojo::Remote<blink::mojom::SessionStorageNamespace> ss_namespace;
   namespace_impl->Bind(ss_namespace.BindNewPipeAndPassReceiver(),
diff --git a/chromium/content/browser/dom_storage/storage_area_impl.cc b/chromium/content/browser/dom_storage/storage_area_impl.cc
index 6df1e05f319..dbb47977131 100644
--- a/chromium/content/browser/dom_storage/storage_area_impl.cc
+++ b/chromium/content/browser/dom_storage/storage_area_impl.cc
@@ -6,23 +6,26 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/containers/span.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/memory_dump_manager.h"
 #include "base/trace_event/process_memory_dump.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
 #include "content/public/browser/browser_thread.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "third_party/leveldatabase/env_chromium.h"
 
 namespace content {
-namespace {
-using leveldb::mojom::BatchedOperation;
-using leveldb::mojom::BatchedOperationPtr;
-using leveldb::mojom::DatabaseError;
-}  // namespace
 
 StorageAreaImpl::Delegate::~Delegate() {}
 
+void StorageAreaImpl::Delegate::PrepareToCommit(
+    std::vector<storage::DomStorageDatabase::KeyValuePair>*
+        extra_entries_to_add,
+    std::vector<storage::DomStorageDatabase::Key>* extra_keys_to_delete) {}
+
 void StorageAreaImpl::Delegate::MigrateData(
     base::OnceCallback<void(std::unique_ptr<ValueMap>)> callback) {
   std::move(callback).Run(nullptr);
@@ -33,7 +36,7 @@ std::vector<StorageAreaImpl::Change> StorageAreaImpl::Delegate::FixUpData(
   return std::vector<Change>();
 }
 
-void StorageAreaImpl::Delegate::OnMapLoaded(DatabaseError) {}
+void StorageAreaImpl::Delegate::OnMapLoaded(leveldb::Status) {}
 
 bool StorageAreaImpl::s_aggressive_flushing_enabled_ = false;
 
@@ -58,7 +61,7 @@ base::TimeDelta StorageAreaImpl::RateLimiter::ComputeDelayNeeded(
 StorageAreaImpl::CommitBatch::CommitBatch() : clear_all_first(false) {}
 StorageAreaImpl::CommitBatch::~CommitBatch() {}
 
-StorageAreaImpl::StorageAreaImpl(leveldb::mojom::LevelDBDatabase* database,
+StorageAreaImpl::StorageAreaImpl(leveldb::LevelDBDatabaseImpl* database,
                                  const std::string& prefix,
                                  Delegate* delegate,
                                  const Options& options)
@@ -67,7 +70,7 @@ StorageAreaImpl::StorageAreaImpl(leveldb::mojom::LevelDBDatabase* database,
                       delegate,
                       options) {}
 
-StorageAreaImpl::StorageAreaImpl(leveldb::mojom::LevelDBDatabase* database,
+StorageAreaImpl::StorageAreaImpl(leveldb::LevelDBDatabaseImpl* database,
                                  std::vector<uint8_t> prefix,
                                  Delegate* delegate,
                                  const Options& options)
@@ -97,7 +100,7 @@ StorageAreaImpl::~StorageAreaImpl() {
 void StorageAreaImpl::InitializeAsEmpty() {
   DCHECK_EQ(map_state_, MapState::UNLOADED);
   map_state_ = MapState::LOADING_FROM_DATABASE;
-  OnMapLoaded(leveldb::mojom::DatabaseError::OK,
+  OnMapLoaded(leveldb::Status::OK(),
               std::vector<leveldb::mojom::KeyValuePtr>());
 }
 
@@ -569,7 +572,7 @@ void StorageAreaImpl::LoadMap(base::OnceClosure completion_callback) {
   map_state_ = MapState::LOADING_FROM_DATABASE;
 
   if (!database_) {
-    OnMapLoaded(DatabaseError::IO_ERROR,
+    OnMapLoaded(leveldb::Status::IOError(""),
                 std::vector<leveldb::mojom::KeyValuePtr>());
     return;
   }
@@ -580,16 +583,17 @@ void StorageAreaImpl::LoadMap(base::OnceClosure completion_callback) {
 }
 
 void StorageAreaImpl::OnMapLoaded(
-    DatabaseError status,
+    leveldb::Status status,
     std::vector<leveldb::mojom::KeyValuePtr> data) {
   DCHECK(keys_values_map_.empty());
   DCHECK_EQ(map_state_, MapState::LOADING_FROM_DATABASE);
 
-  if (data.empty() && status == DatabaseError::OK) {
+  if (data.empty() && status.ok()) {
     delegate_->MigrateData(base::BindOnce(&StorageAreaImpl::OnGotMigrationData,
                                           weak_ptr_factory_.GetWeakPtr()));
     return;
   }
+
   keys_only_map_.clear();
   map_state_ = MapState::LOADED_KEYS_AND_VALUES;
 
@@ -630,11 +634,14 @@ void StorageAreaImpl::OnMapLoaded(
   // We proceed without using a backing store, nothing will be persisted but the
   // class is functional for the lifetime of the object.
   delegate_->OnMapLoaded(status);
-  if (status != DatabaseError::OK) {
+  if (!status.ok()) {
     database_ = nullptr;
     SetCacheMode(CacheMode::KEYS_AND_VALUES);
   }
 
+  if (on_load_callback_for_testing_)
+    std::move(on_load_callback_for_testing_).Run();
+
   OnLoadComplete();
 }
 
@@ -643,7 +650,7 @@ void StorageAreaImpl::OnGotMigrationData(std::unique_ptr<ValueMap> data) {
   keys_values_map_ = data ? std::move(*data) : ValueMap();
   map_state_ = MapState::LOADED_KEYS_AND_VALUES;
   CalculateStorageAndMemoryUsed();
-  delegate_->OnMapLoaded(leveldb::mojom::DatabaseError::OK);
+  delegate_->OnMapLoaded(leveldb::Status::OK());
 
   if (database_ && !empty()) {
     CreateCommitBatchIfNeeded();
@@ -751,56 +758,60 @@ void StorageAreaImpl::CommitChanges() {
   commit_rate_limiter_.add_samples(1);
 
   // Commit all our changes in a single batch.
-  std::vector<BatchedOperationPtr> operations = delegate_->PrepareToCommit();
-  bool has_changes = !operations.empty() ||
-                     !commit_batch_->changed_values.empty() ||
-                     !commit_batch_->changed_keys.empty();
-  if (commit_batch_->clear_all_first) {
-    BatchedOperationPtr item = BatchedOperation::New();
-    item->type = leveldb::mojom::BatchOperationType::DELETE_PREFIXED_KEY;
-    item->key = prefix_;
-    operations.push_back(std::move(item));
-  }
+  struct Commit {
+    storage::DomStorageDatabase::Key prefix;
+    bool clear_all_first;
+    std::vector<storage::DomStorageDatabase::KeyValuePair> entries_to_add;
+    std::vector<storage::DomStorageDatabase::Key> keys_to_delete;
+    base::Optional<storage::DomStorageDatabase::Key> copy_to_prefix;
+  };
+
+  Commit commit;
+  commit.prefix = prefix_;
+  commit.clear_all_first = commit_batch_->clear_all_first;
+  delegate_->PrepareToCommit(&commit.entries_to_add, &commit.keys_to_delete);
+
+  const bool has_changes = !commit.entries_to_add.empty() ||
+                           !commit.keys_to_delete.empty() ||
+                           !commit_batch_->changed_values.empty() ||
+                           !commit_batch_->changed_keys.empty();
   size_t data_size = 0;
   if (map_state_ == MapState::LOADED_KEYS_AND_VALUES) {
     DCHECK(commit_batch_->changed_values.empty())
         << "Map state and commit state out of sync.";
     for (const auto& key : commit_batch_->changed_keys) {
       data_size += key.size();
-      BatchedOperationPtr item = BatchedOperation::New();
-      item->key.reserve(prefix_.size() + key.size());
-      item->key.insert(item->key.end(), prefix_.begin(), prefix_.end());
-      item->key.insert(item->key.end(), key.begin(), key.end());
-      auto kv_it = keys_values_map_.find(key);
-      if (kv_it != keys_values_map_.end()) {
-        item->type = leveldb::mojom::BatchOperationType::PUT_KEY;
-        data_size += kv_it->second.size();
-        item->value = kv_it->second;
+      storage::DomStorageDatabase::Key prefixed_key;
+      prefixed_key.reserve(prefix_.size() + key.size());
+      prefixed_key.insert(prefixed_key.end(), prefix_.begin(), prefix_.end());
+      prefixed_key.insert(prefixed_key.end(), key.begin(), key.end());
+      auto it = keys_values_map_.find(key);
+      if (it != keys_values_map_.end()) {
+        data_size += it->second.size();
+        commit.entries_to_add.emplace_back(std::move(prefixed_key), it->second);
       } else {
-        item->type = leveldb::mojom::BatchOperationType::DELETE_KEY;
+        commit.keys_to_delete.push_back(std::move(prefixed_key));
       }
-      operations.push_back(std::move(item));
     }
   } else {
     DCHECK(commit_batch_->changed_keys.empty())
         << "Map state and commit state out of sync.";
     DCHECK_EQ(map_state_, MapState::LOADED_KEYS_ONLY);
-    for (auto& it : commit_batch_->changed_values) {
-      const auto& key = it.first;
+    for (auto& entry : commit_batch_->changed_values) {
+      const auto& key = entry.first;
       data_size += key.size();
-      BatchedOperationPtr item = BatchedOperation::New();
-      item->key.reserve(prefix_.size() + key.size());
-      item->key.insert(item->key.end(), prefix_.begin(), prefix_.end());
-      item->key.insert(item->key.end(), key.begin(), key.end());
-      auto kv_it = keys_only_map_.find(key);
-      if (kv_it != keys_only_map_.end()) {
-        item->type = leveldb::mojom::BatchOperationType::PUT_KEY;
-        data_size += it.second.size();
-        item->value = std::move(it.second);
+      storage::DomStorageDatabase::Key prefixed_key;
+      prefixed_key.reserve(prefix_.size() + key.size());
+      prefixed_key.insert(prefixed_key.end(), prefix_.begin(), prefix_.end());
+      prefixed_key.insert(prefixed_key.end(), key.begin(), key.end());
+      auto it = keys_only_map_.find(key);
+      if (it != keys_only_map_.end()) {
+        data_size += entry.second.size();
+        commit.entries_to_add.emplace_back(std::move(prefixed_key),
+                                           std::move(entry.second));
       } else {
-        item->type = leveldb::mojom::BatchOperationType::DELETE_KEY;
+        commit.keys_to_delete.push_back(std::move(prefixed_key));
       }
-      operations.push_back(std::move(item));
     }
   }
   // Schedule the copy, and ignore if |clear_all_first| is specified and there
@@ -808,11 +819,7 @@ void StorageAreaImpl::CommitChanges() {
   if (commit_batch_->copy_to_prefix) {
     DCHECK(!has_changes);
     DCHECK(!commit_batch_->clear_all_first);
-    BatchedOperationPtr item = BatchedOperation::New();
-    item->type = leveldb::mojom::BatchOperationType::COPY_PREFIXED_KEY;
-    item->key = prefix_;
-    item->value = std::move(commit_batch_->copy_to_prefix.value());
-    operations.push_back(std::move(item));
+    commit.copy_to_prefix = std::move(commit_batch_->copy_to_prefix);
   }
   commit_batch_.reset();
 
@@ -820,26 +827,41 @@ void StorageAreaImpl::CommitChanges() {
 
   ++commit_batches_in_flight_;
 
-  // TODO(michaeln): Currently there is no guarantee LevelDBDatabaseImpl::Write
-  // will run during a clean shutdown. We need that to avoid dataloss.
-  database_->Write(std::move(operations),
-                   base::BindOnce(&StorageAreaImpl::OnCommitComplete,
-                                  weak_ptr_factory_.GetWeakPtr()));
-}
-
-void StorageAreaImpl::OnCommitComplete(DatabaseError error) {
+  database_->RunDatabaseTask(
+      base::BindOnce(
+          [](Commit commit, const storage::DomStorageDatabase& db) {
+            leveldb::WriteBatch batch;
+            if (commit.clear_all_first)
+              db.DeletePrefixed(commit.prefix, &batch);
+            for (const auto& entry : commit.entries_to_add) {
+              batch.Put(leveldb_env::MakeSlice(entry.key),
+                        leveldb_env::MakeSlice(entry.value));
+            }
+            for (const auto& key : commit.keys_to_delete)
+              batch.Delete(leveldb_env::MakeSlice(key));
+            if (commit.copy_to_prefix) {
+              db.CopyPrefixed(commit.prefix, commit.copy_to_prefix.value(),
+                              &batch);
+            }
+            return db.Commit(&batch);
+          },
+          std::move(commit)),
+      base::BindOnce(&StorageAreaImpl::OnCommitComplete,
+                     weak_ptr_factory_.GetWeakPtr()));
+}
+
+void StorageAreaImpl::OnCommitComplete(leveldb::Status status) {
   has_committed_data_ = true;
   --commit_batches_in_flight_;
   StartCommitTimer();
 
-  if (error != DatabaseError::OK) {
+  if (!status.ok())
     SetCacheMode(CacheMode::KEYS_AND_VALUES);
-  }
 
   // Call before |DidCommit| as delegate can destroy this object.
   UnloadMapIfPossible();
 
-  delegate_->DidCommit(error);
+  delegate_->DidCommit(status);
 }
 
 void StorageAreaImpl::UnloadMapIfPossible() {
diff --git a/chromium/content/browser/dom_storage/storage_area_impl.h b/chromium/content/browser/dom_storage/storage_area_impl.h
index 4c0ebd20299..0f31929e065 100644
--- a/chromium/content/browser/dom_storage/storage_area_impl.h
+++ b/chromium/content/browser/dom_storage/storage_area_impl.h
@@ -16,6 +16,7 @@
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
@@ -29,11 +30,15 @@ class ProcessMemoryDump;
 }
 }  // namespace base
 
+namespace leveldb {
+class LevelDBDatabaseImpl;
+}
+
 namespace content {
 
-// This is a wrapper around a leveldb::mojom::LevelDBDatabase. Multiple
-// interface pointers can be bound to the same object. The wrapper adds a couple
-// of features not found directly in leveldb.
+// This is a wrapper around a leveldb::LevelDBDatabaseImpl. Multiple interface
+// endpoints can be bound to the same object. The wrapper adds a couple of
+// features not found directly in leveldb:
 // 1) Adds the given prefix, if any, to all keys. This allows the sharing of one
 //    database across many, possibly untrusted, consumers and ensuring that they
 //    can't access each other's values.
@@ -54,15 +59,17 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
    public:
     virtual ~Delegate();
     virtual void OnNoBindings() = 0;
-    virtual std::vector<leveldb::mojom::BatchedOperationPtr>
-    PrepareToCommit() = 0;
-    virtual void DidCommit(leveldb::mojom::DatabaseError error) = 0;
+    virtual void PrepareToCommit(
+        std::vector<storage::DomStorageDatabase::KeyValuePair>*
+            extra_entries_to_add,
+        std::vector<storage::DomStorageDatabase::Key>* extra_keys_to_delete);
+    virtual void DidCommit(leveldb::Status error) = 0;
     // Called during loading if no data was found. Needs to call |callback|.
     virtual void MigrateData(ValueMapCallback callback);
     // Called during loading to give delegate a chance to modify the data as
     // stored in the database.
     virtual std::vector<Change> FixUpData(const ValueMap& data);
-    virtual void OnMapLoaded(leveldb::mojom::DatabaseError error);
+    virtual void OnMapLoaded(leveldb::Status status);
   };
 
   enum class CacheMode {
@@ -91,11 +98,11 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
 
   // |Delegate::OnNoBindings| will be called when this object has no more
   // bindings and all pending modifications have been processed.
-  StorageAreaImpl(leveldb::mojom::LevelDBDatabase* database,
+  StorageAreaImpl(leveldb::LevelDBDatabaseImpl* database,
                   const std::string& prefix,
                   Delegate* delegate,
                   const Options& options);
-  StorageAreaImpl(leveldb::mojom::LevelDBDatabase* database,
+  StorageAreaImpl(leveldb::LevelDBDatabaseImpl* database,
                   std::vector<uint8_t> prefix,
                   Delegate* delegate,
                   const Options& options);
@@ -152,7 +159,7 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
 
   const std::vector<uint8_t>& prefix() { return prefix_; }
 
-  leveldb::mojom::LevelDBDatabase* database() { return database_; }
+  leveldb::LevelDBDatabaseImpl* database() { return database_; }
 
   // Commence aggressive flushing. This should be called early during startup,
   // before any localStorage writing. Currently scheduled writes will not be
@@ -198,6 +205,10 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
                   blink::mojom::StorageAreaGetAllCallback> complete_callback,
               GetAllCallback callback) override;
 
+  void SetOnLoadCallbackForTesting(base::OnceClosure callback) {
+    on_load_callback_for_testing_ = std::move(callback);
+  }
+
  private:
   FRIEND_TEST_ALL_PREFIXES(StorageAreaImplTest, GetAllAfterSetCacheMode);
   FRIEND_TEST_ALL_PREFIXES(StorageAreaImplTest,
@@ -277,7 +288,7 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
   // Then if the |cache_mode_| is keys-only, it unloads the map to the
   // |keys_only_map_| and sets the |map_state_| to LOADED_KEYS_ONLY
   void LoadMap(base::OnceClosure completion_callback);
-  void OnMapLoaded(leveldb::mojom::DatabaseError status,
+  void OnMapLoaded(leveldb::Status status,
                    std::vector<leveldb::mojom::KeyValuePtr> data);
   void OnGotMigrationData(std::unique_ptr<ValueMap> data);
   void CalculateStorageAndMemoryUsed();
@@ -288,7 +299,7 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
   base::TimeDelta ComputeCommitDelay() const;
 
   void CommitChanges();
-  void OnCommitComplete(leveldb::mojom::DatabaseError error);
+  void OnCommitComplete(leveldb::Status status);
 
   void UnloadMapIfPossible();
 
@@ -318,7 +329,7 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
   mojo::ReceiverSet<blink::mojom::StorageArea> receivers_;
   mojo::AssociatedRemoteSet<blink::mojom::StorageAreaObserver> observers_;
   Delegate* delegate_;
-  leveldb::mojom::LevelDBDatabase* database_;
+  leveldb::LevelDBDatabaseImpl* database_;
 
   // For commits to work correctly the map loaded state (keys vs keys & values)
   // must stay consistent for a given commit batch.
@@ -340,6 +351,8 @@ class CONTENT_EXPORT StorageAreaImpl : public blink::mojom::StorageArea {
   bool has_committed_data_ = false;
   std::unique_ptr<CommitBatch> commit_batch_;
 
+  base::OnceClosure on_load_callback_for_testing_;
+
   base::WeakPtrFactory<StorageAreaImpl> weak_ptr_factory_{this};
 
   static bool s_aggressive_flushing_enabled_;
diff --git a/chromium/content/browser/dom_storage/storage_area_impl_unittest.cc b/chromium/content/browser/dom_storage/storage_area_impl_unittest.cc
index a4cd87b9b1c..1d7cf8c7c5a 100644
--- a/chromium/content/browser/dom_storage/storage_area_impl_unittest.cc
+++ b/chromium/content/browser/dom_storage/storage_area_impl_unittest.cc
@@ -7,19 +7,22 @@
 #include "base/atomic_ref_count.h"
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/containers/span.h"
 #include "base/memory/ptr_util.h"
 #include "base/run_loop.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/task/post_task.h"
 #include "base/task_runner_util.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/test_simple_task_runner.h"
 #include "base/threading/thread.h"
+#include "components/services/leveldb/leveldb_database_impl.h"
 #include "components/services/leveldb/public/cpp/util.h"
 #include "components/services/leveldb/public/mojom/leveldb.mojom.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/dom_storage/test/storage_area_test_util.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/test/barrier_builder.h"
-#include "content/test/fake_leveldb_database.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -31,7 +34,6 @@ using test::GetAllCallback;
 using test::MakeGetAllCallback;
 using test::MakeSuccessCallback;
 using CacheMode = StorageAreaImpl::CacheMode;
-using DatabaseError = leveldb::mojom::DatabaseError;
 
 const char* kTestSource = "source";
 const size_t kTestSizeLimit = 512;
@@ -40,8 +42,8 @@ std::string ToString(const std::vector<uint8_t>& input) {
   return leveldb::Uint8VectorToStdString(input);
 }
 
-std::vector<uint8_t> ToBytes(const std::string& input) {
-  return leveldb::StdStringToUint8Vector(input);
+std::vector<uint8_t> ToBytes(base::StringPiece input) {
+  return std::vector<uint8_t>(input.begin(), input.end());
 }
 
 class MockDelegate : public StorageAreaImpl::Delegate {
@@ -50,16 +52,13 @@ class MockDelegate : public StorageAreaImpl::Delegate {
   ~MockDelegate() override {}
 
   void OnNoBindings() override {}
-  std::vector<leveldb::mojom::BatchedOperationPtr> PrepareToCommit() override {
-    return std::vector<leveldb::mojom::BatchedOperationPtr>();
-  }
-  void DidCommit(DatabaseError error) override {
-    if (error != DatabaseError::OK)
+  void DidCommit(leveldb::Status status) override {
+    if (!status.ok())
       LOG(ERROR) << "error committing!";
     if (committed_)
       std::move(committed_).Run();
   }
-  void OnMapLoaded(DatabaseError error) override { map_load_count_++; }
+  void OnMapLoaded(leveldb::Status) override { map_load_count_++; }
   std::vector<StorageAreaImpl::Change> FixUpData(
       const StorageAreaImpl::ValueMap& data) override {
     return std::move(mock_changes_);
@@ -122,44 +121,86 @@ class StorageAreaImplTest : public testing::Test,
     bool should_send_old_value;
   };
 
-  StorageAreaImplTest() : db_(&mock_data_) {
-    auto request = level_db_database_remote_.BindNewPipeAndPassReceiver();
-    db_.Bind(std::move(request));
+  StorageAreaImplTest() {
+    base::RunLoop loop;
+    db_ = leveldb::LevelDBDatabaseImpl::OpenInMemory(
+        base::nullopt, "StorageAreaImplTest",
+        base::CreateSequencedTaskRunner({base::MayBlock(), base::ThreadPool()}),
+        base::BindLambdaForTesting(
+            [&](leveldb::Status status) { loop.Quit(); }));
+    loop.Run();
 
     StorageAreaImpl::Options options =
         GetDefaultTestingOptions(CacheMode::KEYS_ONLY_WHEN_POSSIBLE);
-    storage_area_ = std::make_unique<StorageAreaImpl>(
-        level_db_database_remote_.get(), test_prefix_, &delegate_, options);
+    storage_area_ = std::make_unique<StorageAreaImpl>(db_.get(), test_prefix_,
+                                                      &delegate_, options);
 
-    set_mock_data(test_prefix_ + test_key1_, test_value1_);
-    set_mock_data(test_prefix_ + test_key2_, test_value2_);
-    set_mock_data("123", "baddata");
+    SetDatabaseEntry(test_prefix_ + test_key1_, test_value1_);
+    SetDatabaseEntry(test_prefix_ + test_key2_, test_value2_);
+    SetDatabaseEntry("123", "baddata");
 
     storage_area_->Bind(storage_area_remote_.BindNewPipeAndPassReceiver());
     storage_area_remote_->AddObserver(
         observer_receiver_.BindNewEndpointAndPassRemote());
   }
 
-  ~StorageAreaImplTest() override {}
+  ~StorageAreaImplTest() override = default;
 
-  void set_mock_data(const std::string& key, const std::string& value) {
-    mock_data_[ToBytes(key)] = ToBytes(value);
+  void SetDatabaseEntry(const std::vector<uint8_t>& key,
+                        const std::vector<uint8_t>& value) {
+    base::RunLoop loop;
+    db_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          ASSERT_TRUE(db.Put(key, value).ok());
+          loop.Quit();
+        }));
+    loop.Run();
   }
 
-  void set_mock_data(const std::vector<uint8_t>& key,
-                     const std::vector<uint8_t>& value) {
-    mock_data_[key] = value;
+  void SetDatabaseEntry(base::StringPiece key, base::StringPiece value) {
+    SetDatabaseEntry(ToBytes(key), ToBytes(value));
   }
 
-  bool has_mock_data(const std::string& key) {
-    return mock_data_.find(ToBytes(key)) != mock_data_.end();
+  std::string GetDatabaseEntry(base::StringPiece key) {
+    std::vector<uint8_t> value;
+    base::RunLoop loop;
+    db_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          ASSERT_TRUE(db.Get(ToBytes(key), &value).ok());
+          loop.Quit();
+        }));
+    loop.Run();
+    return std::string(value.begin(), value.end());
   }
 
-  std::string get_mock_data(const std::string& key) {
-    return has_mock_data(key) ? ToString(mock_data_[ToBytes(key)]) : "";
+  bool HasDatabaseEntry(base::StringPiece key) {
+    base::RunLoop loop;
+    leveldb::Status status;
+    db_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          std::vector<uint8_t> value;
+          status = db.Get(ToBytes(key), &value);
+          loop.Quit();
+        }));
+    loop.Run();
+    return status.ok();
   }
 
-  void clear_mock_data() { mock_data_.clear(); }
+  void ClearDatabase() {
+    base::RunLoop loop;
+    db_->database().PostTaskWithThisObject(
+        FROM_HERE,
+        base::BindLambdaForTesting([&](const storage::DomStorageDatabase& db) {
+          leveldb::WriteBatch batch;
+          ASSERT_TRUE(db.DeletePrefixed({}, &batch).ok());
+          ASSERT_TRUE(db.Commit(&batch).ok());
+          loop.Quit();
+        }));
+    loop.Run();
+  }
 
   blink::mojom::StorageArea* storage_area() {
     return storage_area_remote_.get();
@@ -233,16 +274,12 @@ class StorageAreaImplTest : public testing::Test,
       area->ScheduleImmediateCommit();
       loop.Run();
     }
-
-    db_.FlushBindingsForTesting();
   }
 
   const std::vector<Observation>& observations() { return observations_; }
 
   MockDelegate* delegate() { return &delegate_; }
-  leveldb::mojom::LevelDBDatabase* database() const {
-    return level_db_database_remote_.get();
-  }
+  leveldb::LevelDBDatabaseImpl* database() { return db_.get(); }
 
   void should_record_send_old_value_observations(bool value) {
     should_record_send_old_value_observations_ = value;
@@ -264,7 +301,6 @@ class StorageAreaImplTest : public testing::Test,
   const std::vector<uint8_t> test_key2_bytes_ = ToBytes(test_key2_);
   const std::vector<uint8_t> test_value1_bytes_ = ToBytes(test_value1_);
   const std::vector<uint8_t> test_value2_bytes_ = ToBytes(test_value2_);
-  mojo::Remote<leveldb::mojom::LevelDBDatabase> level_db_database_remote_;
 
  private:
   // LevelDBObserver:
@@ -299,8 +335,7 @@ class StorageAreaImplTest : public testing::Test,
   }
 
   BrowserTaskEnvironment task_environment_;
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> mock_data_;
-  FakeLevelDBDatabase db_;
+  std::unique_ptr<leveldb::LevelDBDatabaseImpl> db_;
   MockDelegate delegate_;
   std::unique_ptr<StorageAreaImpl> storage_area_;
   mojo::Remote<blink::mojom::StorageArea> storage_area_remote_;
@@ -445,13 +480,13 @@ TEST_P(StorageAreaImplParamTest, CommitPutToDB) {
   EXPECT_TRUE(put_success2);
   EXPECT_TRUE(put_success3);
 
-  EXPECT_FALSE(has_mock_data(test_prefix_ + key2));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + key2));
 
   BlockingCommit();
-  EXPECT_TRUE(has_mock_data(test_prefix_ + key1));
-  EXPECT_EQ(value1, get_mock_data(test_prefix_ + key1));
-  EXPECT_TRUE(has_mock_data(test_prefix_ + key2));
-  EXPECT_EQ(value2, get_mock_data(test_prefix_ + key2));
+  EXPECT_TRUE(HasDatabaseEntry(test_prefix_ + key1));
+  EXPECT_EQ(value1, GetDatabaseEntry(test_prefix_ + key1));
+  EXPECT_TRUE(HasDatabaseEntry(test_prefix_ + key2));
+  EXPECT_EQ(value2, GetDatabaseEntry(test_prefix_ + key2));
 }
 
 TEST_P(StorageAreaImplParamTest, PutObservations) {
@@ -492,7 +527,7 @@ TEST_P(StorageAreaImplParamTest, DeleteExistingKey) {
   storage_area_impl()->SetCacheModeForTesting(GetParam());
   std::string key = "newkey";
   std::string value = "foo";
-  set_mock_data(test_prefix_ + key, value);
+  SetDatabaseEntry(test_prefix_ + key, value);
 
   EXPECT_TRUE(DeleteSync(ToBytes(key), ToBytes(value)));
   ASSERT_EQ(1u, observations().size());
@@ -501,10 +536,10 @@ TEST_P(StorageAreaImplParamTest, DeleteExistingKey) {
   EXPECT_EQ(value, observations()[0].old_value);
   EXPECT_EQ(test_source_, observations()[0].source);
 
-  EXPECT_TRUE(has_mock_data(test_prefix_ + key));
+  EXPECT_TRUE(HasDatabaseEntry(test_prefix_ + key));
 
   BlockingCommit();
-  EXPECT_FALSE(has_mock_data(test_prefix_ + key));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + key));
 }
 
 TEST_P(StorageAreaImplParamTest, DeleteAllWithoutLoadedMap) {
@@ -512,20 +547,20 @@ TEST_P(StorageAreaImplParamTest, DeleteAllWithoutLoadedMap) {
   std::string key = "newkey";
   std::string value = "foo";
   std::string dummy_key = "foobar";
-  set_mock_data(dummy_key, value);
-  set_mock_data(test_prefix_ + key, value);
+  SetDatabaseEntry(dummy_key, value);
+  SetDatabaseEntry(test_prefix_ + key, value);
 
   EXPECT_TRUE(DeleteAllSync());
   ASSERT_EQ(1u, observations().size());
   EXPECT_EQ(Observation::kDeleteAll, observations()[0].type);
   EXPECT_EQ(test_source_, observations()[0].source);
 
-  EXPECT_TRUE(has_mock_data(test_prefix_ + key));
-  EXPECT_TRUE(has_mock_data(dummy_key));
+  EXPECT_TRUE(HasDatabaseEntry(test_prefix_ + key));
+  EXPECT_TRUE(HasDatabaseEntry(dummy_key));
 
   BlockingCommit();
-  EXPECT_FALSE(has_mock_data(test_prefix_ + key));
-  EXPECT_TRUE(has_mock_data(dummy_key));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + key));
+  EXPECT_TRUE(HasDatabaseEntry(dummy_key));
 
   // Deleting all again should still work, but not cause an observation.
   EXPECT_TRUE(DeleteAllSync());
@@ -541,7 +576,7 @@ TEST_P(StorageAreaImplParamTest, DeleteAllWithLoadedMap) {
   std::string key = "newkey";
   std::string value = "foo";
   std::string dummy_key = "foobar";
-  set_mock_data(dummy_key, value);
+  SetDatabaseEntry(dummy_key, value);
 
   EXPECT_TRUE(PutSync(ToBytes(key), ToBytes(value), base::nullopt));
 
@@ -550,11 +585,11 @@ TEST_P(StorageAreaImplParamTest, DeleteAllWithLoadedMap) {
   EXPECT_EQ(Observation::kDeleteAll, observations()[1].type);
   EXPECT_EQ(test_source_, observations()[1].source);
 
-  EXPECT_TRUE(has_mock_data(dummy_key));
+  EXPECT_TRUE(HasDatabaseEntry(dummy_key));
 
   BlockingCommit();
-  EXPECT_FALSE(has_mock_data(test_prefix_ + key));
-  EXPECT_TRUE(has_mock_data(dummy_key));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + key));
+  EXPECT_TRUE(HasDatabaseEntry(dummy_key));
 }
 
 TEST_P(StorageAreaImplParamTest, DeleteAllWithPendingMapLoad) {
@@ -562,7 +597,7 @@ TEST_P(StorageAreaImplParamTest, DeleteAllWithPendingMapLoad) {
   std::string key = "newkey";
   std::string value = "foo";
   std::string dummy_key = "foobar";
-  set_mock_data(dummy_key, value);
+  SetDatabaseEntry(dummy_key, value);
 
   storage_area()->Put(ToBytes(key), ToBytes(value), base::nullopt, kTestSource,
                       base::DoNothing());
@@ -572,16 +607,16 @@ TEST_P(StorageAreaImplParamTest, DeleteAllWithPendingMapLoad) {
   EXPECT_EQ(Observation::kDeleteAll, observations()[1].type);
   EXPECT_EQ(test_source_, observations()[1].source);
 
-  EXPECT_TRUE(has_mock_data(dummy_key));
+  EXPECT_TRUE(HasDatabaseEntry(dummy_key));
 
   BlockingCommit();
-  EXPECT_FALSE(has_mock_data(test_prefix_ + key));
-  EXPECT_TRUE(has_mock_data(dummy_key));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + key));
+  EXPECT_TRUE(HasDatabaseEntry(dummy_key));
 }
 
 TEST_P(StorageAreaImplParamTest, DeleteAllWithoutLoadedEmptyMap) {
   storage_area_impl()->SetCacheModeForTesting(GetParam());
-  clear_mock_data();
+  ClearDatabase();
 
   EXPECT_TRUE(DeleteAllSync());
   ASSERT_EQ(0u, observations().size());
@@ -615,7 +650,7 @@ TEST_F(StorageAreaImplParamTest, PutWhenAlreadyOverQuota) {
   std::vector<uint8_t> value(kTestSizeLimit, 4);
   std::vector<uint8_t> old_value = value;
 
-  set_mock_data(test_prefix_ + key, ToString(value));
+  SetDatabaseEntry(test_prefix_ + key, ToString(value));
 
   // Put with same data should succeed.
   EXPECT_TRUE(PutSync(ToBytes(key), value, base::nullopt));
@@ -649,7 +684,7 @@ TEST_F(StorageAreaImplParamTest, PutWhenAlreadyOverQuotaBecauseOfLargeKey) {
   std::vector<uint8_t> value = ToBytes("value");
   std::vector<uint8_t> old_value = value;
 
-  set_mock_data(test_prefix_ + ToString(key), ToString(value));
+  SetDatabaseEntry(test_prefix_ + ToString(key), ToString(value));
 
   // Put with same data size should succeed.
   value[0] = 'X';
@@ -717,9 +752,9 @@ TEST_P(StorageAreaImplParamTest, FixUpData) {
   EXPECT_EQ(test_key1_, ToString(data[1]->key));
   EXPECT_EQ("foo", ToString(data[1]->value));
 
-  EXPECT_FALSE(has_mock_data(test_prefix_ + test_key2_));
-  EXPECT_EQ("foo", get_mock_data(test_prefix_ + test_key1_));
-  EXPECT_EQ("bla", get_mock_data(test_prefix_ + test_prefix_));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + test_key2_));
+  EXPECT_EQ("foo", GetDatabaseEntry(test_prefix_ + test_key1_));
+  EXPECT_EQ("bla", GetDatabaseEntry(test_prefix_ + test_prefix_));
 }
 
 TEST_F(StorageAreaImplTest, SetOnlyKeysWithoutDatabase) {
@@ -800,7 +835,7 @@ TEST_P(StorageAreaImplParamTest, CommitOnDifferentCacheModes) {
 
   BlockingCommit();
 
-  EXPECT_EQ("foo2", get_mock_data(test_prefix_ + test_key2_));
+  EXPECT_EQ("foo2", GetDatabaseEntry(test_prefix_ + test_key2_));
   if (GetParam() == CacheMode::KEYS_AND_VALUES)
     EXPECT_EQ(2u, storage_area_impl()->keys_values_map_.size());
   else
@@ -823,10 +858,10 @@ TEST_P(StorageAreaImplParamTest, CommitOnDifferentCacheModes) {
     EXPECT_EQ(value3, it->second);
   }
 
-  clear_mock_data();
+  ClearDatabase();
   EXPECT_TRUE(storage_area_impl()->has_changes_to_commit());
   BlockingCommit();
-  EXPECT_EQ("foobar", get_mock_data(test_prefix_ + test_key2_));
+  EXPECT_EQ("foobar", GetDatabaseEntry(test_prefix_ + test_key2_));
   EXPECT_FALSE(storage_area_impl()->has_changes_to_commit());
 }
 
@@ -846,7 +881,6 @@ TEST_F(StorageAreaImplTest, GetAllWhenCacheOnlyKeys) {
   bool result = false;
 
   base::RunLoop loop;
-
   bool put_result1 = false;
   bool put_result2 = false;
   {
@@ -867,10 +901,8 @@ TEST_F(StorageAreaImplTest, GetAllWhenCacheOnlyKeys) {
 
   // GetAll triggers a commit when it's switching map types.
   EXPECT_TRUE(put_result1);
-  EXPECT_EQ("foo", get_mock_data(test_prefix_ + test_key2_));
+  EXPECT_EQ("foo", GetDatabaseEntry(test_prefix_ + test_key2_));
 
-  EXPECT_FALSE(put_result2);
-  EXPECT_FALSE(result);
   loop.Run();
 
   EXPECT_TRUE(result);
@@ -886,12 +918,12 @@ TEST_F(StorageAreaImplTest, GetAllWhenCacheOnlyKeys) {
   EXPECT_TRUE(get_all_success);
 
   // The last "put" isn't committed yet.
-  EXPECT_EQ("foo", get_mock_data(test_prefix_ + test_key2_));
+  EXPECT_EQ("foo", GetDatabaseEntry(test_prefix_ + test_key2_));
 
   ASSERT_TRUE(storage_area_impl()->has_changes_to_commit());
   BlockingCommit();
 
-  EXPECT_EQ("foobar", get_mock_data(test_prefix_ + test_key2_));
+  EXPECT_EQ("foobar", GetDatabaseEntry(test_prefix_ + test_key2_));
 }
 
 TEST_F(StorageAreaImplTest, GetAllAfterSetCacheMode) {
@@ -927,11 +959,11 @@ TEST_F(StorageAreaImplTest, GetAllAfterSetCacheMode) {
         key, value, value2, test_source_,
         MakeSuccessCallback(barrier.AddClosure(), &put_success));
 
-    // Put task triggers database upgrade, so there are no more changes
-    // to commit.
-    FlushAreaBinding();
-    EXPECT_FALSE(storage_area_impl()->has_changes_to_commit());
-    EXPECT_TRUE(storage_area_impl()->has_pending_load_tasks());
+    // Put task triggers database upgrade, so there should be another map load.
+    base::RunLoop upgrade_loop;
+    storage_area_impl()->SetOnLoadCallbackForTesting(
+        upgrade_loop.QuitClosure());
+    upgrade_loop.Run();
 
     storage_area()->GetAll(
         GetAllCallback::CreateAndBind(&get_all_success, barrier.AddClosure()),
@@ -958,12 +990,12 @@ TEST_F(StorageAreaImplTest, GetAllAfterSetCacheMode) {
 
   // GetAll shouldn't trigger a commit before it runs now because the value
   // map should be loading.
-  EXPECT_EQ("foobar", get_mock_data(test_prefix_ + test_key2_));
+  EXPECT_EQ("foobar", GetDatabaseEntry(test_prefix_ + test_key2_));
 
   ASSERT_TRUE(storage_area_impl()->has_changes_to_commit());
   BlockingCommit();
 
-  EXPECT_FALSE(has_mock_data(test_prefix_ + test_key2_));
+  EXPECT_FALSE(HasDatabaseEntry(test_prefix_ + test_key2_));
 }
 
 TEST_F(StorageAreaImplTest, SetCacheModeConsistent) {
@@ -976,7 +1008,7 @@ TEST_F(StorageAreaImplTest, SetCacheModeConsistent) {
               CacheMode::KEYS_ONLY_WHEN_POSSIBLE);
 
   // Clear the database before the area loads data.
-  clear_mock_data();
+  ClearDatabase();
 
   EXPECT_TRUE(PutSync(key, value, base::nullopt));
   EXPECT_TRUE(storage_area_impl()->has_changes_to_commit());
@@ -1116,16 +1148,16 @@ TEST_P(StorageAreaImplParamTest, PrefixForking) {
   BlockingCommit(&fork1_delegate, fork1.get());
 
   // test_key1_ values.
-  EXPECT_EQ(value3, get_mock_data(test_prefix_ + test_key1_));
-  EXPECT_EQ(test_value1_, get_mock_data(test_copy_prefix1_ + test_key1_));
-  EXPECT_EQ(test_value1_, get_mock_data(test_copy_prefix2_ + test_key1_));
-  EXPECT_EQ(value3, get_mock_data(test_copy_prefix3_ + test_key1_));
+  EXPECT_EQ(value3, GetDatabaseEntry(test_prefix_ + test_key1_));
+  EXPECT_EQ(test_value1_, GetDatabaseEntry(test_copy_prefix1_ + test_key1_));
+  EXPECT_EQ(test_value1_, GetDatabaseEntry(test_copy_prefix2_ + test_key1_));
+  EXPECT_EQ(value3, GetDatabaseEntry(test_copy_prefix3_ + test_key1_));
 
   // test_key2_ values.
-  EXPECT_EQ(test_value2_, get_mock_data(test_prefix_ + test_key2_));
-  EXPECT_EQ(value5, get_mock_data(test_copy_prefix1_ + test_key2_));
-  EXPECT_EQ(value4, get_mock_data(test_copy_prefix2_ + test_key2_));
-  EXPECT_EQ(test_value2_, get_mock_data(test_copy_prefix3_ + test_key2_));
+  EXPECT_EQ(test_value2_, GetDatabaseEntry(test_prefix_ + test_key2_));
+  EXPECT_EQ(value5, GetDatabaseEntry(test_copy_prefix1_ + test_key2_));
+  EXPECT_EQ(value4, GetDatabaseEntry(test_copy_prefix2_ + test_key2_));
+  EXPECT_EQ(test_value2_, GetDatabaseEntry(test_copy_prefix3_ + test_key2_));
 }
 
 TEST_P(StorageAreaImplParamTest, PrefixForkAfterLoad) {
@@ -1146,7 +1178,7 @@ TEST_P(StorageAreaImplParamTest, PrefixForkAfterLoad) {
 
   BlockingCommit(delegate(), storage_area_impl());
 
-  EXPECT_EQ(kValue, get_mock_data(test_copy_prefix1_ + test_key1_));
+  EXPECT_EQ(kValue, GetDatabaseEntry(test_copy_prefix1_ + test_key1_));
 }
 
 namespace {
@@ -1290,12 +1322,12 @@ TEST_F(StorageAreaImplTest, PrefixForkingPsuedoFuzzer) {
     std::vector<uint8_t> prefix = areas[i]->prefix();
     std::string key1 = ToString(prefix) + kKey1;
     std::string key2 = ToString(prefix) + kKey2;
-    EXPECT_EQ(!!state.val1, has_mock_data(key1));
+    EXPECT_EQ(!!state.val1, HasDatabaseEntry(key1));
     if (state.val1)
-      EXPECT_EQ(ToString(state.val1.value()), get_mock_data(key1));
-    EXPECT_EQ(!!state.val2, has_mock_data(key2));
+      EXPECT_EQ(ToString(state.val1.value()), GetDatabaseEntry(key1));
+    EXPECT_EQ(!!state.val2, HasDatabaseEntry(key2));
     if (state.val2)
-      EXPECT_EQ(ToString(state.val2.value()), get_mock_data(key2));
+      EXPECT_EQ(ToString(state.val2.value()), GetDatabaseEntry(key2));
 
     EXPECT_FALSE(areas[i]->has_pending_load_tasks()) << i;
   }
@@ -1306,13 +1338,13 @@ TEST_P(StorageAreaImplParamTest, EmptyMapIgnoresDisk) {
   const std::vector<uint8_t> kValueVec = ToBytes(kValue);
 
   // Set fake data to ensure that our shortcut doesn't read it.
-  set_mock_data(test_copy_prefix1_ + test_key1_, kValue);
+  SetDatabaseEntry(test_copy_prefix1_ + test_key1_, kValue);
 
   // Create an empty map that will have no data in it.
   StorageAreaImpl::Options options =
       GetDefaultTestingOptions(CacheMode::KEYS_ONLY_WHEN_POSSIBLE);
   auto empty_storage_area = std::make_unique<StorageAreaImpl>(
-      level_db_database_remote_.get(), test_copy_prefix1_, delegate(), options);
+      database(), test_copy_prefix1_, delegate(), options);
   empty_storage_area->InitializeAsEmpty();
 
   // Check the forked state, which should be empty.
@@ -1324,13 +1356,13 @@ TEST_P(StorageAreaImplParamTest, ForkFromEmptyMap) {
   const std::vector<uint8_t> kValueVec = ToBytes(kValue);
 
   // Set fake data to ensure that our shortcut doesn't read it.
-  set_mock_data(test_copy_prefix1_ + test_key1_, kValue);
+  SetDatabaseEntry(test_copy_prefix1_ + test_key1_, kValue);
 
   // Create an empty map that will have no data in it.
   StorageAreaImpl::Options options =
       GetDefaultTestingOptions(CacheMode::KEYS_ONLY_WHEN_POSSIBLE);
   auto empty_storage_area = std::make_unique<StorageAreaImpl>(
-      level_db_database_remote_.get(), test_copy_prefix1_, delegate(), options);
+      database(), test_copy_prefix1_, delegate(), options);
   empty_storage_area->InitializeAsEmpty();
 
   // Execute the fork, which should shortcut disk and just be empty.
diff --git a/chromium/content/browser/download/download_browsertest.cc b/chromium/content/browser/download/download_browsertest.cc
index f6784f570fa..3a421eb7a17 100644
--- a/chromium/content/browser/download/download_browsertest.cc
+++ b/chromium/content/browser/download/download_browsertest.cc
@@ -43,6 +43,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/download_request_utils.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/webplugininfo.h"
@@ -77,6 +78,10 @@
 #include "content/browser/plugin_service_impl.h"
 #endif
 
+#if defined(OS_ANDROID)
+#include "base/android/build_info.h"
+#endif
+
 using ::testing::AllOf;
 using ::testing::Field;
 using ::testing::InSequence;
@@ -99,9 +104,9 @@ constexpr int kTestRequestCount = 3;
 // Offset for download to pause.
 const int kPauseOffset = 100 * 1024;
 
-const std::string kOriginOne = "one.example";
-const std::string kOriginTwo = "two.example";
-const std::string kOriginThree = "example.com";
+const char kOriginOne[] = "one.example";
+const char kOriginTwo[] = "two.example";
+const char kOriginThree[] = "example.com";
 const char k404Response[] = "HTTP/1.1 404 Not found\r\n\r\n";
 
 // Implementation of TestContentBrowserClient that overrides
@@ -141,7 +146,7 @@ class MockDownloadItemObserver : public download::DownloadItem::Observer {
 
 class MockDownloadManagerObserver : public DownloadManager::Observer {
  public:
-  MockDownloadManagerObserver(DownloadManager* manager) {
+  explicit MockDownloadManagerObserver(DownloadManager* manager) {
     manager_ = manager;
     manager->AddObserver(this);
   }
@@ -162,6 +167,7 @@ class MockDownloadManagerObserver : public DownloadManager::Observer {
   }
 
   MOCK_METHOD1(MockManagerGoingDown, void(DownloadManager*));
+
  private:
   DownloadManager* manager_;
 };
@@ -532,6 +538,7 @@ class TestShellDownloadManagerDelegate : public ShellDownloadManagerDelegate {
       std::vector<DownloadOpenDelayedCallback>* callbacks) {
     callbacks->swap(delayed_callbacks_);
   }
+
  private:
   bool delay_download_open_;
   std::vector<DownloadOpenDelayedCallback> delayed_callbacks_;
@@ -540,7 +547,7 @@ class TestShellDownloadManagerDelegate : public ShellDownloadManagerDelegate {
 // Get the next created download.
 class DownloadCreateObserver : DownloadManager::Observer {
  public:
-  DownloadCreateObserver(DownloadManager* manager)
+  explicit DownloadCreateObserver(DownloadManager* manager)
       : manager_(manager), item_(nullptr) {
     manager_->AddObserver(this);
   }
@@ -594,9 +601,8 @@ class ErrorStreamCountingObserver : download::DownloadItem::Observer {
   void OnDownloadUpdated(download::DownloadItem* download) override {
     std::unique_ptr<base::HistogramSamples> samples =
         histogram_tester_.GetHistogramSamplesSinceCreation(
-            "Download.ParallelDownloadAddStreamSuccess");
-    if (samples->GetCount(0 /* failure */) == count_ &&
-        !completion_closure_.is_null())
+            "Download.ParallelDownload.CreationFailureReason");
+    if (samples->TotalCount() == count_ && !completion_closure_.is_null())
       std::move(completion_closure_).Run();
   }
 
@@ -820,7 +826,6 @@ class DownloadContentTest : public ContentBrowserTest {
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     ContentBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
     IsolateAllSitesForTesting(command_line);
   }
 
@@ -889,12 +894,28 @@ class DownloadContentTest : public ContentBrowserTest {
         std::move(factory));
   }
 
+  // Navigate to a URL and wait for a download, expecting that the URL will not
+  // result in a new committed navigation. This is typically the case for most
+  // downloads.
   void NavigateToURLAndWaitForDownload(
       Shell* shell,
       const GURL& url,
       download::DownloadItem::DownloadState expected_terminal_state) {
     std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell, 1));
-    NavigateToURL(shell, url);
+    EXPECT_TRUE(NavigateToURLAndExpectNoCommit(shell, url));
+    observer->WaitForFinished();
+    EXPECT_EQ(1u, observer->NumDownloadsSeenInState(expected_terminal_state));
+  }
+
+  // Navigate to a URL, expecting it to commit, and wait for a download. This
+  // is useful when the URL actually commits and then starts a download via
+  // script.
+  void NavigateToCommittedURLAndWaitForDownload(
+      Shell* shell,
+      const GURL& url,
+      download::DownloadItem::DownloadState expected_terminal_state) {
+    std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell, 1));
+    EXPECT_TRUE(NavigateToURL(shell, url));
     observer->WaitForFinished();
     EXPECT_EQ(1u, observer->NumDownloadsSeenInState(expected_terminal_state));
   }
@@ -939,19 +960,84 @@ class DownloadContentTest : public ContentBrowserTest {
     return observer->WaitForFinished();
   }
 
+  TestDownloadResponseHandler* test_response_handler() {
+    return &test_response_handler_;
+  }
+
+  static bool PathExists(const base::FilePath& path) {
+    base::ScopedAllowBlockingForTesting allow_blocking;
+    return base::PathExists(path);
+  }
+
+  static void ReadAndVerifyFileContents(int seed,
+                                        int64_t expected_size,
+                                        const base::FilePath& path) {
+    base::ScopedAllowBlockingForTesting allow_blocking;
+    base::File file(path, base::File::FLAG_OPEN | base::File::FLAG_READ);
+    ASSERT_TRUE(file.IsValid());
+    int64_t file_length = file.GetLength();
+    ASSERT_EQ(expected_size, file_length);
+
+    const int64_t kBufferSize = 64 * 1024;
+    std::string pattern;
+    std::vector<char> data;
+    pattern.resize(kBufferSize);
+    data.resize(kBufferSize);
+    for (int64_t offset = 0; offset < file_length;) {
+      int bytes_read = file.Read(offset, &data.front(), kBufferSize);
+      ASSERT_LT(0, bytes_read);
+      ASSERT_GE(kBufferSize, bytes_read);
+
+      pattern =
+          TestDownloadHttpResponse::GetPatternBytes(seed, offset, bytes_read);
+      ASSERT_EQ(0, memcmp(pattern.data(), &data.front(), bytes_read))
+          << "Comparing block at offset " << offset << " and length "
+          << bytes_read;
+      offset += bytes_read;
+    }
+  }
+
+  TestDownloadHttpResponse::InjectErrorCallback inject_error_callback() {
+    return inject_error_callback_;
+  }
+
+  void RegisterServiceWorker(Shell* shell, const std::string& worker_url) {
+    EXPECT_TRUE(NavigateToURL(shell, embedded_test_server()->GetURL(
+                                         "/register_service_worker.html")));
+    EXPECT_EQ("DONE", EvalJs(shell, "register('" + worker_url + "')"));
+  }
+
+  void ClearAutoResumptionCount(download::DownloadItem* download) {
+    static_cast<download::DownloadItemImpl*>(download)
+        ->SetAutoResumeCountForTesting(0);
+  }
+
+ private:
+  // Location of the downloads directory for these tests
+  base::ScopedTempDir downloads_directory_;
+  std::unique_ptr<TestShellDownloadManagerDelegate> test_delegate_;
+  TestDownloadResponseHandler test_response_handler_;
+  TestDownloadHttpResponse::InjectErrorCallback inject_error_callback_;
+};
+
+constexpr int kValidationLength = 1024;
+
+class DownloadContentTestWithoutStrongValidators : public DownloadContentTest {
+ public:
+  DownloadContentTestWithoutStrongValidators() {
+    std::map<std::string, std::string> params = {
+        {download::kDownloadContentValidationLengthFinchKey,
+         base::NumberToString(kValidationLength)}};
+    scoped_feature_list_.InitAndEnableFeatureWithParameters(
+        download::features::kAllowDownloadResumptionWithoutStrongValidators,
+        params);
+  }
+
   // Starts a download without strong validators, interrupts it, and resumes it.
   // If |fail_content_validation| is true, download content will change during
   // resumption.
   void InterruptAndResumeDownloadWithoutStrongValidators(
       bool fail_content_validation) {
-    int validation_length = 1024;
-    base::test::ScopedFeatureList scoped_feature_list;
-    std::map<std::string, std::string> params = {
-        {download::kDownloadContentValidationLengthFinchKey,
-         base::NumberToString(validation_length)}};
-    scoped_feature_list.InitAndEnableFeatureWithParameters(
-        download::features::kAllowDownloadResumptionWithoutStrongValidators,
-        params);
     SetupErrorInjectionDownloads();
     GURL url = TestDownloadHttpResponse::GetNextURLForDownload();
     GURL server_url = embedded_test_server()->GetURL(url.host(), url.path());
@@ -1003,7 +1089,7 @@ class DownloadContentTest : public ContentBrowserTest {
                 requests[1]->http_request.headers.end());
     EXPECT_EQ(
         base::StringPrintf("bytes=%" PRId64 "-",
-                           interruption_offset - validation_length),
+                           interruption_offset - kValidationLength),
         requests[1]->http_request.headers.at(net::HttpRequestHeaders::kRange));
     if (fail_content_validation) {
       // The third request is a restart request.
@@ -1014,64 +1100,8 @@ class DownloadContentTest : public ContentBrowserTest {
     }
   }
 
-  TestDownloadResponseHandler* test_response_handler() {
-    return &test_response_handler_;
-  }
-
-  static bool PathExists(const base::FilePath& path) {
-    base::ScopedAllowBlockingForTesting allow_blocking;
-    return base::PathExists(path);
-  }
-
-  static void ReadAndVerifyFileContents(int seed,
-                                        int64_t expected_size,
-                                        const base::FilePath& path) {
-    base::ScopedAllowBlockingForTesting allow_blocking;
-    base::File file(path, base::File::FLAG_OPEN | base::File::FLAG_READ);
-    ASSERT_TRUE(file.IsValid());
-    int64_t file_length = file.GetLength();
-    ASSERT_EQ(expected_size, file_length);
-
-    const int64_t kBufferSize = 64 * 1024;
-    std::string pattern;
-    std::vector<char> data;
-    pattern.resize(kBufferSize);
-    data.resize(kBufferSize);
-    for (int64_t offset = 0; offset < file_length;) {
-      int bytes_read = file.Read(offset, &data.front(), kBufferSize);
-      ASSERT_LT(0, bytes_read);
-      ASSERT_GE(kBufferSize, bytes_read);
-
-      pattern =
-          TestDownloadHttpResponse::GetPatternBytes(seed, offset, bytes_read);
-      ASSERT_EQ(0, memcmp(pattern.data(), &data.front(), bytes_read))
-          << "Comparing block at offset " << offset << " and length "
-          << bytes_read;
-      offset += bytes_read;
-    }
-  }
-
-  TestDownloadHttpResponse::InjectErrorCallback inject_error_callback() {
-    return inject_error_callback_;
-  }
-
-  void RegisterServiceWorker(Shell* shell, const std::string& worker_url) {
-    NavigateToURL(
-        shell, embedded_test_server()->GetURL("/register_service_worker.html"));
-    EXPECT_EQ("DONE", EvalJs(shell, "register('" + worker_url + "')"));
-  }
-
-  void ClearAutoResumptionCount(download::DownloadItem* download) {
-    static_cast<download::DownloadItemImpl*>(download)
-        ->SetAutoResumeCountForTesting(0);
-  }
-
  private:
-  // Location of the downloads directory for these tests
-  base::ScopedTempDir downloads_directory_;
-  std::unique_ptr<TestShellDownloadManagerDelegate> test_delegate_;
-  TestDownloadResponseHandler test_response_handler_;
-  TestDownloadHttpResponse::InjectErrorCallback inject_error_callback_;
+  base::test::ScopedFeatureList scoped_feature_list_;
 };
 
 // Test fixture for parallel downloading.
@@ -1096,7 +1126,7 @@ class ParallelDownloadTest : public DownloadContentTest {
       const base::FilePath& path,
       const std::vector<GURL>& url_chain,
       const download::DownloadItem::ReceivedSlices& slices,
-      TestDownloadHttpResponse::Parameters& parameters) {
+      const TestDownloadHttpResponse::Parameters& parameters) {
     std::string output;
     int64_t total_bytes = 0u;
     const int64_t kBufferSize = 64 * 1024;
@@ -1143,10 +1173,6 @@ class ParallelDownloadTest : public DownloadContentTest {
       int64_t total_length,
       size_t expected_request_count,
       bool support_partial_response) {
-    EXPECT_TRUE(
-        base::FeatureList::IsEnabled(download::features::kParallelDownloading));
-    GURL url = TestDownloadHttpResponse::GetNextURLForDownload();
-    GURL server_url = embedded_test_server()->GetURL(url.host(), url.path());
     TestDownloadHttpResponse::Parameters parameters;
     parameters.etag = "ABC";
     parameters.size = total_length;
@@ -1154,6 +1180,19 @@ class ParallelDownloadTest : public DownloadContentTest {
     parameters.support_partial_response = support_partial_response;
     // Needed to specify HTTP connection type to create parallel download.
     parameters.connection_type = net::HttpResponseInfo::CONNECTION_INFO_HTTP1_1;
+    RunResumptionTestWithParameters(received_slices, expected_request_count,
+                                    parameters);
+  }
+
+  // Similar to the above method, but with given http response parameters.
+  void RunResumptionTestWithParameters(
+      const download::DownloadItem::ReceivedSlices& received_slices,
+      size_t expected_request_count,
+      const TestDownloadHttpResponse::Parameters& parameters) {
+    EXPECT_TRUE(
+        base::FeatureList::IsEnabled(download::features::kParallelDownloading));
+    GURL url = TestDownloadHttpResponse::GetNextURLForDownload();
+    GURL server_url = embedded_test_server()->GetURL(url.host(), url.path());
     TestDownloadHttpResponse::StartServing(parameters, server_url);
 
     base::FilePath intermediate_file_path =
@@ -1171,7 +1210,7 @@ class ParallelDownloadTest : public DownloadContentTest {
     // TODO(qinmin): count the failed partial responses in DownloadJob when
     // support_partial_response is false. EmbeddedTestServer doesn't know
     // whether completing or canceling the response will come first.
-    if (support_partial_response) {
+    if (parameters.support_partial_response) {
       test_response_handler()->WaitUntilCompletion(expected_request_count);
 
       // Verify number of requests sent to the server.
@@ -1279,9 +1318,11 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, MultiDownload) {
 
   // Allow the first request to finish.
   std::unique_ptr<DownloadTestObserver> observer2(CreateWaiter(shell(), 1));
-  NavigateToURL(shell(), embedded_test_server()->GetURL(
-                             SlowDownloadHttpResponse::kSlowDownloadHostName,
-                             SlowDownloadHttpResponse::kFinishDownloadUrl));
+  EXPECT_TRUE(NavigateToURL(shell(),
+                            embedded_test_server()->GetURL(
+                                SlowDownloadHttpResponse::kSlowDownloadHostName,
+                                SlowDownloadHttpResponse::kFinishDownloadUrl)));
+
   observer2->WaitForFinished();  // Wait for the third request.
 
   EXPECT_EQ(
@@ -1420,8 +1461,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, CancelAtFinalRename) {
       std::unique_ptr<download::DownloadFileFactory>(file_factory));
 
   // Create a download
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/download/download-test.lib"));
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(
+      shell(), embedded_test_server()->GetURL("/download/download-test.lib")));
 
   // Wait until the first (intermediate file) rename and execute the callback.
   file_factory->WaitForSomeCallback();
@@ -1469,8 +1510,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, CancelAtRelease) {
       std::unique_ptr<download::DownloadFileFactory>(file_factory));
 
   // Create a download
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/download/download-test.lib"));
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(
+      shell(), embedded_test_server()->GetURL("/download/download-test.lib")));
 
   // Wait until the first (intermediate file) rename and execute the callback.
   file_factory->WaitForSomeCallback();
@@ -1575,8 +1616,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, ShutdownAtRelease) {
       std::unique_ptr<download::DownloadFileFactory>(file_factory));
 
   // Create a download
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/download/download-test.lib"));
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(
+      shell(), embedded_test_server()->GetURL("/download/download-test.lib")));
 
   // Wait until the first (intermediate file) rename and execute the callback.
   file_factory->WaitForSomeCallback();
@@ -1679,13 +1720,14 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, ResumeWithStrongValidators) {
 }
 
 // Test resumption when strong validators are not present in the response.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest, ResumeWithoutStrongValidators) {
+IN_PROC_BROWSER_TEST_F(DownloadContentTestWithoutStrongValidators,
+                       ResumeWithoutStrongValidators) {
   InterruptAndResumeDownloadWithoutStrongValidators(false);
 }
 
 // Test resumption when strong validators are not present in the response and
 // the content of the download changes.
-IN_PROC_BROWSER_TEST_F(DownloadContentTest,
+IN_PROC_BROWSER_TEST_F(DownloadContentTestWithoutStrongValidators,
                        ResumeWithoutStrongValidatorsAndFailValidation) {
   InterruptAndResumeDownloadWithoutStrongValidators(true);
 }
@@ -1831,17 +1873,54 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, RedirectDownload) {
   std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
   auto download_parameters = std::make_unique<download::DownloadUrlParameters>(
       first_url, TRAFFIC_ANNOTATION_FOR_TESTS);
-  download_parameters->set_follow_cross_origin_redirects(true);
+  download_parameters->set_cross_origin_redirects(
+      network::mojom::RedirectMode::kFollow);
   DownloadManagerForShell(shell())->DownloadUrl(std::move(download_parameters));
   observer->WaitForFinished();
 
-  // Verify download is done.
+  // Verify download failed.
   std::vector<download::DownloadItem*> downloads;
   DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
   EXPECT_EQ(1u, downloads.size());
   EXPECT_EQ(download::DownloadItem::COMPLETE, downloads[0]->GetState());
 }
 
+// Verify that DownloadUrl can detect and fail a cross-origin URL redirect.
+IN_PROC_BROWSER_TEST_F(DownloadContentTest, FailCrossOriginDownload) {
+  // Setup a cross-origin redirect chain with two URLs.
+  net::EmbeddedTestServer origin_one;
+  net::EmbeddedTestServer origin_two;
+  ASSERT_TRUE(origin_one.InitializeAndListen());
+  ASSERT_TRUE(origin_two.InitializeAndListen());
+
+  GURL first_url = origin_one.GetURL("/first-url");
+  GURL second_url = origin_two.GetURL("/download");
+
+  origin_one.ServeFilesFromDirectory(GetTestFilePath("download", ""));
+  origin_one.RegisterRequestHandler(
+      CreateRedirectHandler("/first-url", second_url));
+  origin_one.StartAcceptingConnections();
+  origin_two.StartAcceptingConnections();
+
+  // Start a download and explicitly specify to fail cross-origin redirect.
+  std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
+  auto download_parameters = std::make_unique<download::DownloadUrlParameters>(
+      first_url, TRAFFIC_ANNOTATION_FOR_TESTS);
+  download_parameters->set_cross_origin_redirects(
+      network::mojom::RedirectMode::kError);
+  DownloadManagerForShell(shell())->DownloadUrl(std::move(download_parameters));
+  observer->WaitForFinished();
+
+  // Verify download is done.
+  std::vector<download::DownloadItem*> downloads;
+  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
+  EXPECT_EQ(1u, downloads.size());
+  EXPECT_EQ(download::DownloadItem::INTERRUPTED, downloads[0]->GetState());
+
+  ASSERT_TRUE(origin_two.ShutdownAndWaitUntilComplete());
+  ASSERT_TRUE(origin_one.ShutdownAndWaitUntilComplete());
+}
+
 // Verify that DownloadUrl() to URL with unsafe scheme should fail.
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, RedirectUnsafeDownload) {
   // Setup a redirect chain with two URL.
@@ -1863,7 +1942,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, RedirectUnsafeDownload) {
           DownloadTestObserver::ON_DANGEROUS_DOWNLOAD_FAIL);
   auto download_parameters = std::make_unique<download::DownloadUrlParameters>(
       first_url, TRAFFIC_ANNOTATION_FOR_TESTS);
-  download_parameters->set_follow_cross_origin_redirects(true);
+  download_parameters->set_cross_origin_redirects(
+      network::mojom::RedirectMode::kFollow);
   download_manager->DownloadUrl(std::move(download_parameters));
   observer->WaitForFinished();
 
@@ -2498,7 +2578,7 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, CancelResumingDownload) {
   // Resume and cancel download. We expect only a single OnDownloadCreated()
   // call, and that's for the second download created below.
   MockDownloadManagerObserver dm_observer(DownloadManagerForShell(shell()));
-  EXPECT_CALL(dm_observer, OnDownloadCreated(_,_)).Times(1);
+  EXPECT_CALL(dm_observer, OnDownloadCreated(_, _)).Times(1);
 
   TestRequestPauseHandler request_pause_handler;
   parameters.on_pause_handler = request_pause_handler.GetOnPauseHandler();
@@ -3223,8 +3303,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
                                  "application/octet-stream", "Hello"));
   origin_two.StartAcceptingConnections();
 
-  NavigateToURLAndWaitForDownload(shell(), referrer_url,
-                                  download::DownloadItem::COMPLETE);
+  NavigateToCommittedURLAndWaitForDownload(shell(), referrer_url,
+                                           download::DownloadItem::COMPLETE);
 
   std::vector<download::DownloadItem*> downloads;
   DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
@@ -3274,8 +3354,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
   origin_one.StartAcceptingConnections();
   origin_two.StartAcceptingConnections();
 
-  NavigateToURLAndWaitForDownload(shell(), referrer_url,
-                                  download::DownloadItem::COMPLETE);
+  NavigateToCommittedURLAndWaitForDownload(shell(), referrer_url,
+                                           download::DownloadItem::COMPLETE);
 
   std::vector<download::DownloadItem*> downloads;
   DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
@@ -3289,8 +3369,10 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
 
 // A file type that Blink can handle should not be downloaded if there are cross
 // origin redirects in the middle of the redirect chain.
+// TODO(https://crbug.com/1009913): Fix flakes on various bots and re-enable
+// this test.
 IN_PROC_BROWSER_TEST_F(DownloadContentTest,
-                       DownloadAttributeSameOriginRedirectNavigation) {
+                       DISABLED_DownloadAttributeSameOriginRedirectNavigation) {
   net::EmbeddedTestServer origin_one;
   net::EmbeddedTestServer origin_two;
   ASSERT_TRUE(origin_one.InitializeAndListen());
@@ -3324,7 +3406,9 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
 
   base::string16 expected_title(base::UTF8ToUTF16("hello"));
   TitleWatcher observer(shell()->web_contents(), expected_title);
-  NavigateToURL(shell(), referrer_url);
+  EXPECT_TRUE(
+      NavigateToURL(shell(), referrer_url,
+                    origin_two.GetURL("/download") /* expected_commit_url */));
   ASSERT_EQ(expected_title, observer.WaitAndGetTitle());
 
   std::vector<download::DownloadItem*> downloads;
@@ -3421,7 +3505,7 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
   origin_two.StartAcceptingConnections();
 
   std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
-  NavigateToURL(shell(), referrer_url);
+  EXPECT_TRUE(NavigateToURL(shell(), referrer_url));
 
   // Alt-click the link.
   blink::WebMouseEvent mouse_event(
@@ -3466,8 +3550,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadAttributeDataUrl) {
   server.ServeFilesFromDirectory(GetTestFilePath("download", ""));
   server.StartAcceptingConnections();
 
-  NavigateToURLAndWaitForDownload(shell(), url,
-                                  download::DownloadItem::COMPLETE);
+  NavigateToCommittedURLAndWaitForDownload(shell(), url,
+                                           download::DownloadItem::COMPLETE);
 
   std::vector<download::DownloadItem*> downloads;
   DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
@@ -3537,7 +3621,7 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadAttributeInvalidURL) {
       std::make_unique<content::TestNavigationObserver>(GURL(kBlockedURL));
   observer->WatchExistingWebContents();
   observer->StartWatchingNewWebContents();
-  NavigateToURL(shell(), url);
+  shell()->LoadURL(url);
   observer->WaitForNavigationFinished();
 }
 
@@ -3665,6 +3749,42 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DuplicateContentDisposition) {
             downloads[0]->GetTargetFilePath().BaseName().value());
 }
 
+// Test that the network isolation key is populated for <a download> triggered
+// download request that doesn't go through the navigation path.
+IN_PROC_BROWSER_TEST_F(DownloadContentTest,
+                       DownloadAttributeNetworkIsolationKeyPopulated) {
+  GURL frame_url = embedded_test_server()->GetURL(
+      "/download/download-attribute.html?noclick=/download/download-test.lib");
+  GURL document_url = embedded_test_server()->GetURL(
+      "/download/iframe-host.html?target=" + frame_url.spec());
+
+  // Load a page that contains a same-origin iframe, where the iframe contains
+  // a <a download> link same-origin to the iframe's origin.
+  TestNavigationObserver same_tab_observer(shell()->web_contents(), 1);
+  shell()->LoadURL(document_url);
+  same_tab_observer.Wait();
+
+  FetchHistogramsFromChildProcesses();
+  base::HistogramTester histogram_tester;
+  histogram_tester.ExpectTotalCount("HttpCache.NetworkIsolationKeyPresent2", 0);
+
+  std::unique_ptr<DownloadCreateObserver> observer(
+      new DownloadCreateObserver(DownloadManagerForShell(shell())));
+
+  // click the <a download> link in the child frame
+  EXPECT_TRUE(
+      ExecJs(shell()->web_contents()->GetAllFrames()[1],
+             "var anchorElement = document.querySelector('a[download]'); "
+             "anchorElement.click();"));
+  download::DownloadItem* download = observer->WaitForFinished();
+  WaitForCompletion(download);
+
+  FetchHistogramsFromChildProcesses();
+  // Assert that the NIK for the download request is populated.
+  histogram_tester.ExpectUniqueSample("HttpCache.NetworkIsolationKeyPresent2",
+                                      2 /*kPresent*/, 1 /*count*/);
+}
+
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadAttributeSameOriginIFrame) {
   GURL frame_url = embedded_test_server()->GetURL(
       "/download/download-attribute.html?target=/download/download-test.lib");
@@ -3705,14 +3825,8 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest,
                download->GetTargetFilePath().BaseName().value().c_str());
 }
 
-#if defined(OS_WIN)
-// Flaky on windows: https://crbug.com/810982
-#define MAYBE_ParallelDownloadComplete DISABLED_ParallelDownloadComplete
-#else
-#define MAYBE_ParallelDownloadComplete ParallelDownloadComplete
-#endif
 // Verify parallel download in normal case.
-IN_PROC_BROWSER_TEST_F(ParallelDownloadTest, MAYBE_ParallelDownloadComplete) {
+IN_PROC_BROWSER_TEST_F(ParallelDownloadTest, ParallelDownloadComplete) {
   TestDownloadHttpResponse::Parameters parameters;
   parameters.etag = "ABC";
   parameters.size = 5097152;
@@ -3829,6 +3943,31 @@ IN_PROC_BROWSER_TEST_F(ParallelDownloadTest, ResumptionNoPartialResponse) {
                     false /* support_partial_response */);
 }
 
+// Verify that if a temporary error happens to one of the parallel request,
+// resuming a parallel download should still complete.
+IN_PROC_BROWSER_TEST_F(ParallelDownloadTest,
+                       ResumptionMiddleSliceTemporaryError) {
+  // Create the received slices data.
+  std::vector<download::DownloadItem::ReceivedSlice> received_slices = {
+      download::DownloadItem::ReceivedSlice(0, 1000),
+      download::DownloadItem::ReceivedSlice(1000000, 1000),
+      download::DownloadItem::ReceivedSlice(2000000, 1000,
+                                            false /* finished */)};
+
+  TestDownloadHttpResponse::Parameters parameters;
+  parameters.etag = "ABC";
+  parameters.size = 3000000;
+  parameters.connection_type = net::HttpResponseInfo::CONNECTION_INFO_HTTP1_1;
+  // The 2nd slice will fail. Once the first and the third slices
+  // complete, download will resume on the 2nd slice.
+  parameters.SetResponseForRangeRequest(1000000, 1010000, k404Response,
+                                        true /* is_transient */);
+
+  // A total of 4 requests will be sent, 3 during the initial attempt, and 1
+  // for the retry attempt on the 2nd slice.
+  RunResumptionTestWithParameters(received_slices, kTestRequestCount + 1,
+                                  parameters);
+}
 // Test to verify that the browser-side enforcement of X-Frame-Options does
 // not impact downloads. Since XFO is only checked for subframes, this test
 // initiates a download in an iframe and expects it to succeed.
@@ -3995,7 +4134,7 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, FetchErrorResponseBodyResumption) {
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadFromWebUI) {
   GURL webui_url(
       GetWebUIURL("resources/images/apps/topbar_button_maximize.png"));
-  NavigateToURL(shell(), webui_url);
+  EXPECT_TRUE(NavigateToURL(shell(), webui_url));
   SetupEnsureNoPendingDownloads();
 
   // Creates download parameters with renderer process information.
@@ -4018,7 +4157,7 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadFromWebUI) {
 // process.
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadFromWebUIWithoutRenderer) {
   GURL webui_url("chrome://resources/images/apps/topbar_button_maximize.png");
-  NavigateToURL(shell(), webui_url);
+  EXPECT_TRUE(NavigateToURL(shell(), webui_url));
   SetupEnsureNoPendingDownloads();
 
   // Creates download parameters without any renderer process information.
@@ -4040,6 +4179,37 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadFromWebUIWithoutRenderer) {
   ASSERT_EQ(download::DownloadItem::INTERRUPTED, downloads[0]->GetState());
 }
 
+IN_PROC_BROWSER_TEST_F(DownloadContentTest, SaveImageAt) {
+  // Navigate to a page containing a data-URL image in the top-left corner.
+  GURL main_url(
+      embedded_test_server()->GetURL("/download/page_with_data_image.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  // Ask the frame to save a data-URL image at the given coordinates.
+  std::unique_ptr<DownloadTestObserver> observer(CreateWaiter(shell(), 1));
+  shell()->web_contents()->GetMainFrame()->SaveImageAt(100, 100);
+  observer->WaitForFinished();
+  EXPECT_EQ(
+      1u, observer->NumDownloadsSeenInState(download::DownloadItem::COMPLETE));
+
+  // Verify that there was one, appropriately named download.
+  std::vector<download::DownloadItem*> downloads;
+  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
+  ASSERT_EQ(1u, downloads.size());
+  EXPECT_EQ(FILE_PATH_LITERAL("download.png"),
+            downloads[0]->GetTargetFilePath().BaseName().value());
+
+  // Verify file contents.
+  std::string expected_content;
+  {
+    base::ScopedAllowBlockingForTesting allow_blocking;
+    ASSERT_TRUE(ReadFileToString(GetTestFilePath("media", "blackwhite.png"),
+                                 &expected_content));
+  }
+  ASSERT_TRUE(VerifyFile(downloads[0]->GetFullPath(), expected_content,
+                         expected_content.size()));
+}
+
 // Test fixture for forcing MHTML download.
 class MhtmlDownloadTest : public DownloadContentTest {
  protected:
@@ -4122,7 +4292,7 @@ IN_PROC_BROWSER_TEST_F(MhtmlLoadingTest, AllowRenderMultipartRelatedPage) {
   observer->WatchExistingWebContents();
   observer->StartWatchingNewWebContents();
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   observer->WaitForNavigationFinished();
 }
@@ -4134,7 +4304,7 @@ IN_PROC_BROWSER_TEST_F(MhtmlLoadingTest, AllowRenderMessageRfc822Page) {
   observer->WatchExistingWebContents();
   observer->StartWatchingNewWebContents();
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   observer->WaitForNavigationFinished();
 }
diff --git a/chromium/content/browser/download/download_manager_impl.cc b/chromium/content/browser/download/download_manager_impl.cc
index 286e70f5328..0f91b3b6ff3 100644
--- a/chromium/content/browser/download/download_manager_impl.cc
+++ b/chromium/content/browser/download/download_manager_impl.cc
@@ -40,8 +40,8 @@
 #include "content/browser/data_url_loader_factory.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/download/network_download_url_loader_factory_info.h"
-#include "content/browser/file_url_loader_factory.h"
 #include "content/browser/fileapi/file_system_url_loader_factory.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -61,10 +61,12 @@
 #include "content/public/browser/system_connector.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_ui_url_loader_factory.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/origin_util.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/referrer.h"
 #include "content/public/common/url_utils.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/base/elements_upload_data_stream.h"
 #include "net/base/load_flags.h"
@@ -83,7 +85,6 @@
 namespace content {
 namespace {
 
-#if defined(OS_ANDROID)
 void DeleteDownloadedFileOnUIThread(const base::FilePath& file_path) {
   if (!file_path.empty()) {
     download::GetDownloadTaskRunner()->PostTask(
@@ -92,7 +93,6 @@ void DeleteDownloadedFileOnUIThread(const base::FilePath& file_path) {
                        file_path));
   }
 }
-#endif
 
 StoragePartitionImpl* GetStoragePartition(BrowserContext* context,
                                           int render_process_id,
@@ -112,14 +112,17 @@ StoragePartitionImpl* GetStoragePartition(BrowserContext* context,
 
 void OnDownloadStarted(
     download::DownloadItemImpl* download,
-    const download::DownloadUrlParameters::OnStartedCallback& on_started) {
+    download::DownloadUrlParameters::OnStartedCallback on_started) {
   if (on_started.is_null())
     return;
 
-  if (!download || download->GetState() == download::DownloadItem::CANCELLED)
-    on_started.Run(nullptr, download::DOWNLOAD_INTERRUPT_REASON_USER_CANCELED);
-  else
-    on_started.Run(download, download::DOWNLOAD_INTERRUPT_REASON_NONE);
+  if (!download || download->GetState() == download::DownloadItem::CANCELLED) {
+    std::move(on_started)
+        .Run(nullptr, download::DOWNLOAD_INTERRUPT_REASON_USER_CANCELED);
+  } else {
+    std::move(on_started)
+        .Run(download, download::DOWNLOAD_INTERRUPT_REASON_NONE);
+  }
 }
 
 // Creates an interrupted download and calls StartDownload. Can be called on
@@ -138,7 +141,7 @@ void CreateInterruptedDownload(
       base::BindOnce(&DownloadManagerImpl::StartDownload, download_manager,
                      std::move(failed_created_info),
                      std::make_unique<download::InputStream>(),
-                     params->callback()));
+                     std::move(params->callback())));
 }
 
 class DownloadItemFactoryImpl : public download::DownloadItemFactory {
@@ -175,11 +178,9 @@ class DownloadItemFactoryImpl : public download::DownloadItemFactory {
       bool transient,
       const std::vector<download::DownloadItem::ReceivedSlice>& received_slices)
       override {
-    int auto_resume_count = 0;
-    if (base::FeatureList::IsEnabled(
-            download::features::kDownloadDBForNewDownloads)) {
-      auto_resume_count = download::DownloadItemImpl::kMaxAutoResumeAttempts;
-    }
+    // For history download only as history don't have auto resumption count
+    // saved.
+    int auto_resume_count = download::DownloadItemImpl::kMaxAutoResumeAttempts;
 
     return new download::DownloadItemImpl(
         delegate, guid, download_id, current_path, target_path, url_chain,
@@ -188,7 +189,7 @@ class DownloadItemFactoryImpl : public download::DownloadItemFactory {
         last_modified, received_bytes, total_bytes, auto_resume_count, hash,
         state, danger_type, interrupt_reason, false /* paused */,
         false /* allow_metered */, opened, last_access_time, transient,
-        received_slices);
+        received_slices, nullptr /* download_entry */);
   }
 
   download::DownloadItemImpl* CreateActiveItem(
@@ -223,10 +224,11 @@ std::unique_ptr<network::SharedURLLoaderFactoryInfo>
 CreateSharedURLLoaderFactoryInfo(StoragePartitionImpl* storage_partition,
                                  RenderFrameHost* rfh,
                                  bool is_download) {
-  // TODO(crbug.com/955171): Replace these with PendingRemote and
-  // PendingReceiver.
+  // TODO(crbug.com/955171): Replace |proxy_factory_ptr_info| with
+  // PendingRemote.
   network::mojom::URLLoaderFactoryPtrInfo proxy_factory_ptr_info;
-  network::mojom::URLLoaderFactoryRequest proxy_factory_request;
+  mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+      proxy_factory_receiver;
   if (rfh) {
     bool should_proxy = false;
 
@@ -254,13 +256,13 @@ CreateSharedURLLoaderFactoryInfo(StoragePartitionImpl* storage_partition,
     // intermediate pipe along to the NetworkDownloadURLLoaderFactoryInfo.
     if (should_proxy) {
       proxy_factory_ptr_info = std::move(maybe_proxy_factory_ptr_info);
-      proxy_factory_request = std::move(maybe_proxy_factory_receiver);
+      proxy_factory_receiver = std::move(maybe_proxy_factory_receiver);
     }
   }
 
   return std::make_unique<NetworkDownloadURLLoaderFactoryInfo>(
       storage_partition->url_loader_factory_getter(),
-      std::move(proxy_factory_ptr_info), std::move(proxy_factory_request));
+      std::move(proxy_factory_ptr_info), std::move(proxy_factory_receiver));
 }
 
 std::unique_ptr<network::SharedURLLoaderFactoryInfo>
@@ -292,6 +294,7 @@ DownloadManagerImpl::DownloadManagerImpl(BrowserContext* browser_context)
       cancelled_download_cleared_from_history_(0),
       interrupted_download_cleared_from_history_(0) {
   DCHECK(browser_context);
+
   download::SetIOTaskRunner(
       base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
 
@@ -530,9 +533,8 @@ base::FilePath DownloadManagerImpl::GetDefaultDownloadDirectory() {
 #else
   if (delegate_) {
     base::FilePath website_save_directory;  // Unused
-    bool skip_dir_check = false;            // Unused
     delegate_->GetSaveDir(GetBrowserContext(), &website_save_directory,
-                          &default_download_directory, &skip_dir_check);
+                          &default_download_directory);
   }
 #endif
   if (default_download_directory.empty()) {
@@ -554,16 +556,16 @@ void DownloadManagerImpl::OnDownloadsInitialized() {
     uint32_t id = download->GetId();
     if (id > max_id)
       max_id = id;
-#if defined(OS_ANDROID)
-    // On android, clean up cancelled and non resumable interrupted downloads.
+
+    // Clean up cancelled and non resumable interrupted downloads.
     if (ShouldClearDownloadFromDB(download->GetURL(), download->GetState(),
-                                  download->GetLastReason())) {
+                                  download->GetLastReason(),
+                                  download->GetStartTime())) {
       cleared_download_guids_on_startup_.insert(download->GetGuid());
       DeleteDownloadedFileOnUIThread(download->GetFullPath());
       it = in_progress_downloads_.erase(it);
       continue;
     }
-#endif  // defined(OS_ANDROID)
     ++it;
   }
   PostInitialization(DOWNLOAD_INITIALIZATION_DEPENDENCY_IN_PROGRESS_CACHE);
@@ -572,7 +574,7 @@ void DownloadManagerImpl::OnDownloadsInitialized() {
 
 void DownloadManagerImpl::StartDownloadItem(
     std::unique_ptr<download::DownloadCreateInfo> info,
-    const download::DownloadUrlParameters::OnStartedCallback& on_started,
+    download::DownloadUrlParameters::OnStartedCallback on_started,
     download::InProgressDownloadManager::StartDownloadItemCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -582,17 +584,17 @@ void DownloadManagerImpl::StartDownloadItem(
       download = nullptr;
     std::move(callback).Run(std::move(info), download,
                             should_persist_new_download_);
-    OnDownloadStarted(download, on_started);
+    OnDownloadStarted(download, std::move(on_started));
   } else {
     GetNextId(base::BindOnce(&DownloadManagerImpl::CreateNewDownloadItemToStart,
                              weak_factory_.GetWeakPtr(), std::move(info),
-                             on_started, std::move(callback)));
+                             std::move(on_started), std::move(callback)));
   }
 }
 
 void DownloadManagerImpl::CreateNewDownloadItemToStart(
     std::unique_ptr<download::DownloadCreateInfo> info,
-    const download::DownloadUrlParameters::OnStartedCallback& on_started,
+    download::DownloadUrlParameters::OnStartedCallback on_started,
     download::InProgressDownloadManager::StartDownloadItemCallback callback,
     uint32_t id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -609,7 +611,7 @@ void DownloadManagerImpl::CreateNewDownloadItemToStart(
     OnNewDownloadCreated(download);
   }
 
-  OnDownloadStarted(download, on_started);
+  OnDownloadStarted(download, std::move(on_started));
 }
 
 service_manager::Connector* DownloadManagerImpl::GetServiceManagerConnector() {
@@ -628,13 +630,13 @@ DownloadManagerImpl::GetQuarantineConnectionCallback() {
 void DownloadManagerImpl::StartDownload(
     std::unique_ptr<download::DownloadCreateInfo> info,
     std::unique_ptr<download::InputStream> stream,
-    const download::DownloadUrlParameters::OnStartedCallback& on_started) {
+    download::DownloadUrlParameters::OnStartedCallback on_started) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(info);
   in_progress_manager_->StartDownload(
       std::move(info), std::move(stream),
       download::URLLoaderFactoryProvider::GetNullPtr(), base::DoNothing(),
-      on_started);
+      std::move(on_started));
 }
 
 void DownloadManagerImpl::CheckForHistoryFilesRemoval() {
@@ -730,7 +732,7 @@ void DownloadManagerImpl::CreateSavePackageDownloadItemWithId(
 void DownloadManagerImpl::ResumeInterruptedDownload(
     std::unique_ptr<download::DownloadUrlParameters> params,
     const GURL& site_url) {
-  BeginDownloadInternal(std::move(params), nullptr /* blob_data_handle */,
+  BeginDownloadInternal(std::move(params),
                         nullptr /* blob_url_loader_factory */, false, site_url);
 }
 
@@ -767,11 +769,6 @@ void DownloadManagerImpl::DownloadInterrupted(
   }
 }
 
-base::Optional<download::DownloadEntry> DownloadManagerImpl::GetInProgressEntry(
-    download::DownloadItemImpl* download) {
-  return in_progress_manager_->GetInProgressEntry(download);
-}
-
 bool DownloadManagerImpl::IsOffTheRecord() const {
   return browser_context_->IsOffTheRecord();
 }
@@ -846,13 +843,11 @@ bool DownloadManagerImpl::CanDownload(
 
 void DownloadManagerImpl::DownloadUrl(
     std::unique_ptr<download::DownloadUrlParameters> params) {
-  DownloadUrl(std::move(params), nullptr /* blob_data_handle */,
-              nullptr /* blob_url_loader_factory */);
+  DownloadUrl(std::move(params), nullptr /* blob_url_loader_factory */);
 }
 
 void DownloadManagerImpl::DownloadUrl(
     std::unique_ptr<download::DownloadUrlParameters> params,
-    std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {
   if (params->post_id() >= 0) {
     // Check this here so that the traceback is more useful.
@@ -866,8 +861,8 @@ void DownloadManagerImpl::DownloadUrl(
                                       params->render_frame_host_routing_id());
   if (rfh)
     params->set_frame_tree_node_id(rfh->GetFrameTreeNodeId());
-  BeginDownloadInternal(std::move(params), std::move(blob_data_handle),
-                        std::move(blob_url_loader_factory), true,
+  BeginDownloadInternal(std::move(params), std::move(blob_url_loader_factory),
+                        true,
                         rfh ? rfh->GetSiteInstance()->GetSiteURL() : GURL());
 }
 
@@ -909,20 +904,20 @@ download::DownloadItem* DownloadManagerImpl::CreateDownloadItem(
   // Retrive the in-progress download if it exists. Notice that this also
   // removes it from |in_progress_downloads_|.
   auto in_progress_download = RetrieveInProgressDownload(id);
-#if defined(OS_ANDROID)
-  // On Android, there is no way to interact with cancelled or non-resumable
-  // download. Simply returning null and don't store them in this class to
-  // reduce memory usage.
+
+  // Return null to clear cancelled or non-resumable download.
   if (cleared_download_guids_on_startup_.find(guid) !=
       cleared_download_guids_on_startup_.end()) {
     return nullptr;
   }
+
   if (url_chain.empty() ||
-      ShouldClearDownloadFromDB(url_chain.back(), state, interrupt_reason)) {
+      ShouldClearDownloadFromDB(url_chain.back(), state, interrupt_reason,
+                                start_time)) {
     DeleteDownloadedFileOnUIThread(current_path);
     return nullptr;
   }
-#endif
+
   auto item = base::WrapUnique(item_factory_->CreatePersistedItem(
       this, guid, id, current_path, target_path, url_chain, referrer_url,
       site_url, tab_url, tab_refererr_url, request_initiator, mime_type,
@@ -930,11 +925,23 @@ download::DownloadItem* DownloadManagerImpl::CreateDownloadItem(
       received_bytes, total_bytes, hash, state, danger_type, interrupt_reason,
       opened, last_access_time, transient, received_slices));
   if (in_progress_download) {
-    // If the download item from history db is already in terminal state,
-    // remove it from the in-progress db. Otherwise, use the in-progress db one.
-    if (item->IsDone()) {
+    // If a download is in both history DB and in-progress DB, we should
+    // be able to remove the in-progress entry if the following 2 conditions
+    // are both met:
+    // 1. The download state in the history DB is a terminal state.
+    // 2. The download is not currently in progress.
+    // The situation could happen when browser crashes when download just
+    // reaches a terminal state. If the download is already in progress, we
+    // should wait for it to complete so that both DBs will be updated
+    // afterwards.
+    if (item->IsDone() && in_progress_download->GetState() !=
+                              download::DownloadItem::IN_PROGRESS) {
       in_progress_manager_->RemoveInProgressDownload(guid);
     } else {
+      // If one of the conditions are not met, use the in-progress download
+      // entry.
+      // TODO(qinmin): return nullptr so that the history DB will delete
+      // the download.
       item = std::move(in_progress_download);
       item->SetDelegate(this);
     }
@@ -998,28 +1005,26 @@ void DownloadManagerImpl::PostInitialization(
   if (!history_loaded || !in_progress_cache_initialized_)
     return;
 
-#if defined(OS_ANDROID)
-    for (const auto& guid : cleared_download_guids_on_startup_)
-      in_progress_manager_->RemoveInProgressDownload(guid);
-    if (cancelled_download_cleared_from_history_ > 0) {
-      UMA_HISTOGRAM_COUNTS_1000(
-          "MobileDownload.CancelledDownloadRemovedFromHistory",
-          cancelled_download_cleared_from_history_);
-    }
+  for (const auto& guid : cleared_download_guids_on_startup_) {
+    in_progress_manager_->RemoveInProgressDownload(guid);
+  }
 
-    if (interrupted_download_cleared_from_history_ > 0) {
-      UMA_HISTOGRAM_COUNTS_1000(
-          "MobileDownload.InterruptedDownloadsRemovedFromHistory",
-          interrupted_download_cleared_from_history_);
-    }
-#endif
+  if (cancelled_download_cleared_from_history_ > 0) {
+    UMA_HISTOGRAM_COUNTS_1000("Download.CancelledDownloadRemovedFromHistory",
+                              cancelled_download_cleared_from_history_);
+  }
 
-    if (in_progress_downloads_.empty()) {
-      OnDownloadManagerInitialized();
-    } else {
-      GetNextId(base::BindOnce(&DownloadManagerImpl::ImportInProgressDownloads,
-                               weak_factory_.GetWeakPtr()));
-    }
+  if (interrupted_download_cleared_from_history_ > 0) {
+    UMA_HISTOGRAM_COUNTS_1000("Download.InterruptedDownloadsRemovedFromHistory",
+                              interrupted_download_cleared_from_history_);
+  }
+
+  if (in_progress_downloads_.empty()) {
+    OnDownloadManagerInitialized();
+  } else {
+    GetNextId(base::BindOnce(&DownloadManagerImpl::ImportInProgressDownloads,
+                             weak_factory_.GetWeakPtr()));
+  }
 }
 
 void DownloadManagerImpl::ImportInProgressDownloads(uint32_t id) {
@@ -1046,6 +1051,11 @@ void DownloadManagerImpl::OnDownloadManagerInitialized() {
   in_progress_manager_->OnAllInprogressDownloadsLoaded();
   for (auto& observer : observers_)
     observer.OnManagerInitialized();
+  size_t size = 0;
+  for (const auto& it : downloads_)
+    size += it.second->GetApproximateMemoryUsage();
+  if (!IsOffTheRecord() && size > 0)
+    download::RecordDownloadManagerMemoryUsage(size);
 }
 
 bool DownloadManagerImpl::IsManagerInitialized() {
@@ -1203,6 +1213,11 @@ void DownloadManagerImpl::BeginResourceDownloadOnChecksComplete(
       tab_url = entry->GetURL();
       tab_referrer_url = entry->GetReferrer().url;
     }
+    RenderFrameHost* top_frame = web_contents->GetMainFrame();
+    if (top_frame) {
+      params->set_network_isolation_key(net::NetworkIsolationKey(
+          top_frame->GetLastCommittedOrigin(), rfh->GetLastCommittedOrigin()));
+    }
   }
 
   DCHECK_EQ(params->url().SchemeIsBlob(), bool{blob_url_loader_factory});
@@ -1285,7 +1300,6 @@ void DownloadManagerImpl::BeginResourceDownloadOnChecksComplete(
 
 void DownloadManagerImpl::BeginDownloadInternal(
     std::unique_ptr<download::DownloadUrlParameters> params,
-    std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
     bool is_new_download,
     const GURL& site_url) {
@@ -1340,25 +1354,33 @@ bool DownloadManagerImpl::IsNextIdInitialized() const {
   return is_history_download_id_retrieved_ && in_progress_cache_initialized_;
 }
 
-#if defined(OS_ANDROID)
 bool DownloadManagerImpl::ShouldClearDownloadFromDB(
     const GURL& url,
     download::DownloadItem::DownloadState state,
-    download::DownloadInterruptReason reason) {
-  if (state == download::DownloadItem::CANCELLED) {
+    download::DownloadInterruptReason reason,
+    const base::Time& start_time) {
+  if (!base::FeatureList::IsEnabled(
+          download::features::kDeleteExpiredDownloads)) {
+    return false;
+  }
+
+  // Use system time to determine if the download is expired. Manually setting
+  // the system time can affect this.
+  bool expired = base::Time::Now() - start_time >=
+                 download::GetExpiredDownloadDeleteTime();
+  if (state == download::DownloadItem::CANCELLED && expired) {
     ++cancelled_download_cleared_from_history_;
     return true;
   }
+
   if (reason != download::DOWNLOAD_INTERRUPT_REASON_NONE &&
-      download::GetDownloadResumeMode(url, reason, false /* restart_required */,
-                                      false /* user_action_required */) ==
-          download::ResumeMode::INVALID) {
+      state == download::DownloadItem::INTERRUPTED && expired) {
     ++interrupted_download_cleared_from_history_;
     return true;
   }
+
   return false;
 }
-#endif  // defined(OS_ANDROID)
 
 std::unique_ptr<download::DownloadItemImpl>
 DownloadManagerImpl::RetrieveInProgressDownload(uint32_t id) {
diff --git a/chromium/content/browser/download/download_manager_impl.h b/chromium/content/browser/download/download_manager_impl.h
index 248f04f340d..f1921664668 100644
--- a/chromium/content/browser/download/download_manager_impl.h
+++ b/chromium/content/browser/download/download_manager_impl.h
@@ -88,7 +88,6 @@ class CONTENT_EXPORT DownloadManagerImpl
   void DownloadUrl(
       std::unique_ptr<download::DownloadUrlParameters> parameters) override;
   void DownloadUrl(std::unique_ptr<download::DownloadUrlParameters> params,
-                   std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
                    scoped_refptr<network::SharedURLLoaderFactory>
                        blob_url_loader_factory) override;
   void AddObserver(Observer* observer) override;
@@ -136,7 +135,7 @@ class CONTENT_EXPORT DownloadManagerImpl
   void StartDownload(
       std::unique_ptr<download::DownloadCreateInfo> info,
       std::unique_ptr<download::InputStream> stream,
-      const download::DownloadUrlParameters::OnStartedCallback& on_started);
+      download::DownloadUrlParameters::OnStartedCallback on_started);
 
   // For testing; specifically, accessed from TestFileErrorInjector.
   void SetDownloadItemFactoryForTesting(
@@ -182,14 +181,14 @@ class CONTENT_EXPORT DownloadManagerImpl
   base::FilePath GetDefaultDownloadDirectory() override;
   void StartDownloadItem(
       std::unique_ptr<download::DownloadCreateInfo> info,
-      const download::DownloadUrlParameters::OnStartedCallback& on_started,
+      download::DownloadUrlParameters::OnStartedCallback on_started,
       download::InProgressDownloadManager::StartDownloadItemCallback callback)
       override;
 
   // Creates a new download item and call |callback|.
   void CreateNewDownloadItemToStart(
       std::unique_ptr<download::DownloadCreateInfo> info,
-      const download::DownloadUrlParameters::OnStartedCallback& on_started,
+      download::DownloadUrlParameters::OnStartedCallback on_started,
       download::InProgressDownloadManager::StartDownloadItemCallback callback,
       uint32_t id);
 
@@ -231,8 +230,6 @@ class CONTENT_EXPORT DownloadManagerImpl
   void ShowDownloadInShell(download::DownloadItemImpl* download) override;
   void DownloadRemoved(download::DownloadItemImpl* download) override;
   void DownloadInterrupted(download::DownloadItemImpl* download) override;
-  base::Optional<download::DownloadEntry> GetInProgressEntry(
-      download::DownloadItemImpl* download) override;
   bool IsOffTheRecord() const override;
   void ReportBytesWasted(download::DownloadItemImpl* download) override;
   service_manager::Connector* GetServiceManagerConnector() override;
@@ -245,7 +242,6 @@ class CONTENT_EXPORT DownloadManagerImpl
   // Helper method to start or resume a download.
   void BeginDownloadInternal(
       std::unique_ptr<download::DownloadUrlParameters> params,
-      std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
       bool is_new_download,
       const GURL& site_url);
@@ -283,14 +279,12 @@ class CONTENT_EXPORT DownloadManagerImpl
   // Called when this object is considered initialized.
   void OnDownloadManagerInitialized();
 
-#if defined(OS_ANDROID)
-  // Check whether a download should be cleared from history. On Android,
-  // cancelled and non-resumable interrupted download will be cleaned up to
-  // save memory.
+  // Check whether a download should be cleared from history. Cancelled and
+  // non-resumable interrupted download will be cleaned up to save memory.
   bool ShouldClearDownloadFromDB(const GURL& url,
                                  download::DownloadItem::DownloadState state,
-                                 download::DownloadInterruptReason reason);
-#endif  // defined(OS_ANDROID)
+                                 download::DownloadInterruptReason reason,
+                                 const base::Time& start_time);
 
   // Factory for creation of downloads items.
   std::unique_ptr<download::DownloadItemFactory> item_factory_;
diff --git a/chromium/content/browser/download/download_manager_impl_unittest.cc b/chromium/content/browser/download/download_manager_impl_unittest.cc
index 5cf0f7e179e..d0919950079 100644
--- a/chromium/content/browser/download/download_manager_impl_unittest.cc
+++ b/chromium/content/browser/download/download_manager_impl_unittest.cc
@@ -25,8 +25,10 @@
 #include "base/strings/string16.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "components/download/public/common/download_create_info.h"
+#include "components/download/public/common/download_features.h"
 #include "components/download/public/common/download_file_factory.h"
 #include "components/download/public/common/download_interrupt_reasons.h"
 #include "components/download/public/common/download_item.h"
@@ -67,6 +69,8 @@ namespace content {
 
 namespace {
 
+const char kGuid[] = "8DF158E8-C980-4618-BB03-EBA3242EB48B";
+
 bool URLAlwaysSafe(int render_process_id, const GURL& url) {
   return true;
 }
@@ -83,12 +87,12 @@ class MockDownloadManagerDelegate : public DownloadManagerDelegate {
                     const DownloadTargetCallback&));
   MOCK_METHOD1(ShouldOpenFileBasedOnExtension, bool(const base::FilePath&));
   MOCK_METHOD2(ShouldCompleteDownload,
-               bool(download::DownloadItem*, const base::Closure&));
+               bool(download::DownloadItem*, base::OnceClosure));
   MOCK_METHOD2(ShouldOpenDownload,
                bool(download::DownloadItem*,
                     const DownloadOpenDelayedCallback&));
-  MOCK_METHOD4(GetSaveDir, void(BrowserContext*,
-                                base::FilePath*, base::FilePath*, bool*));
+  MOCK_METHOD3(GetSaveDir,
+               void(BrowserContext*, base::FilePath*, base::FilePath*));
   MOCK_METHOD5(ChooseSavePath, void(
       WebContents*, const base::FilePath&, const base::FilePath::StringType&,
       bool, const SavePackagePathPickedCallback&));
@@ -473,6 +477,27 @@ class DownloadManagerTest : public testing::Test {
     return item;
   }
 
+  // Helper function to create a download item.
+  download::DownloadItem* CreateDownloadItem(
+      const base::Time& start_time,
+      const std::vector<GURL>& url_chain,
+      download::DownloadItem::DownloadState download_state) {
+    download::DownloadItem* download_item =
+        download_manager_->CreateDownloadItem(
+            kGuid, 10, base::FilePath(), base::FilePath(), url_chain,
+            GURL("http://example.com/a"), GURL("http://example.com/a"),
+            GURL("http://example.com/a"), GURL("http://example.com/a"),
+            url::Origin::Create(GURL("http://example.com/")),
+            "application/octet-stream", "application/octet-stream", start_time,
+            base::Time::Now(), std::string(), std::string(), 10, 10,
+            std::string(), download_state,
+            download::DOWNLOAD_DANGER_TYPE_NOT_DANGEROUS,
+            download::DOWNLOAD_INTERRUPT_REASON_SERVER_FAILED, false,
+            base::Time::Now(), true,
+            std::vector<download::DownloadItem::ReceivedSlice>());
+    return download_item;
+  }
+
   download::MockDownloadItemImpl& GetMockDownloadItem(int id) {
     download::MockDownloadItemImpl* itemp =
         mock_download_item_factory_->GetItem(id);
@@ -574,7 +599,7 @@ TEST_F(DownloadManagerTest, StartDownload) {
 
 #if !defined(USE_X11)
   // Doing nothing will set the default download directory to null.
-  EXPECT_CALL(GetMockDownloadManagerDelegate(), GetSaveDir(_, _, _, _));
+  EXPECT_CALL(GetMockDownloadManagerDelegate(), GetSaveDir(_, _, _));
 #endif
   EXPECT_CALL(GetMockDownloadManagerDelegate(),
               ApplicationClientIdForFileScanning())
@@ -610,7 +635,7 @@ TEST_F(DownloadManagerTest, StartDownloadWithoutHistoryDB) {
 
 #if !defined(USE_X11)
   // Doing nothing will set the default download directory to null.
-  EXPECT_CALL(GetMockDownloadManagerDelegate(), GetSaveDir(_, _, _, _));
+  EXPECT_CALL(GetMockDownloadManagerDelegate(), GetSaveDir(_, _, _));
 #endif
   EXPECT_CALL(GetMockDownloadManagerDelegate(),
               ApplicationClientIdForFileScanning())
@@ -678,24 +703,12 @@ TEST_F(DownloadManagerTest, GetDownloadByGuid) {
 
   ASSERT_FALSE(download_manager_->GetDownloadByGuid(""));
 
-  const char kGuid[] = "8DF158E8-C980-4618-BB03-EBA3242EB48B";
   std::vector<GURL> url_chain;
   url_chain.emplace_back("http://example.com/1.zip");
-  download::DownloadItem* persisted_item =
-      download_manager_->CreateDownloadItem(
-          kGuid, 10, base::FilePath(), base::FilePath(), url_chain,
-          GURL("http://example.com/a"), GURL("http://example.com/a"),
-          GURL("http://example.com/a"), GURL("http://example.com/a"),
-          url::Origin::Create(GURL("http://example.com/")),
-          "application/octet-stream", "application/octet-stream",
-          base::Time::Now(), base::Time::Now(), std::string(), std::string(),
-          10, 10, std::string(), download::DownloadItem::INTERRUPTED,
-          download::DOWNLOAD_DANGER_TYPE_NOT_DANGEROUS,
-          download::DOWNLOAD_INTERRUPT_REASON_SERVER_FAILED, false,
-          base::Time::Now(), true,
-          std::vector<download::DownloadItem::ReceivedSlice>());
+  EXPECT_CALL(GetMockObserver(), OnDownloadCreated(download_manager_.get(), _));
+  download::DownloadItem* persisted_item = CreateDownloadItem(
+      base::Time::Now(), url_chain, download::DownloadItem::INTERRUPTED);
   ASSERT_TRUE(persisted_item);
-
   ASSERT_EQ(persisted_item, download_manager_->GetDownloadByGuid(kGuid));
 }
 
@@ -732,7 +745,6 @@ TEST_F(DownloadManagerTest, RemoveDownloadsByURL) {
 // DownloadManager.
 TEST_F(DownloadManagerTest, OnInProgressDownloadsLoaded) {
   auto in_progress_manager = std::make_unique<TestInProgressManager>();
-  const char kGuid[] = "8DF158E8-C980-4618-BB03-EBA3242EB48B";
   std::vector<GURL> url_chain;
   url_chain.emplace_back("http://example.com/1.zip");
   auto in_progress_item = std::make_unique<download::DownloadItemImpl>(
@@ -746,7 +758,8 @@ TEST_F(DownloadManagerTest, OnInProgressDownloadsLoaded) {
       download::DOWNLOAD_DANGER_TYPE_NOT_DANGEROUS,
       download::DOWNLOAD_INTERRUPT_REASON_SERVER_FAILED, false, false, false,
       base::Time::Now(), true,
-      std::vector<download::DownloadItem::ReceivedSlice>());
+      std::vector<download::DownloadItem::ReceivedSlice>(),
+      nullptr /* download_entry */);
   in_progress_manager->AddDownloadItem(std::move(in_progress_item));
   SetInProgressDownloadManager(std::move(in_progress_manager));
   EXPECT_CALL(GetMockObserver(), OnDownloadCreated(download_manager_.get(), _))
@@ -769,4 +782,36 @@ TEST_F(DownloadManagerTest, OnInProgressDownloadsLoaded) {
   ASSERT_FALSE(download_manager_->GetDownloadByGuid(kGuid));
 }
 
+// Verifies that expired canceled or interrupted downloads are deleted
+// correctly.
+TEST_F(DownloadManagerTest, DeleteExpiredDownload) {
+  base::test::ScopedFeatureList scoped_feature_list;
+  std::map<std::string, std::string> params = {
+      {download::kExpiredDownloadDeleteTimeFinchKey, base::NumberToString(1)}};
+  scoped_feature_list.InitAndEnableFeatureWithParameters(
+      download::features::kDeleteExpiredDownloads, params);
+
+  std::vector<GURL> url_chain;
+  url_chain.emplace_back("http://example.com/1.zip");
+  auto expired_start_time = base::Time::Now() - base::TimeDelta::FromDays(10);
+  download::DownloadItem* download_item = CreateDownloadItem(
+      expired_start_time, url_chain, download::DownloadItem::INTERRUPTED);
+  EXPECT_FALSE(download_item)
+      << "Expired interrupted download will be deleted.";
+
+  download_item = CreateDownloadItem(expired_start_time, url_chain,
+                                     download::DownloadItem::CANCELLED);
+  EXPECT_FALSE(download_item) << "Expired canceled download will be deleted.";
+
+  download_item = CreateDownloadItem(expired_start_time, std::vector<GURL>(),
+                                     download::DownloadItem::COMPLETE);
+  EXPECT_FALSE(download_item) << "Download without URL chain will be deleted.";
+
+  EXPECT_CALL(GetMockObserver(), OnDownloadCreated(download_manager_.get(), _));
+  download_item = CreateDownloadItem(expired_start_time, url_chain,
+                                     download::DownloadItem::COMPLETE);
+  EXPECT_TRUE(download_item)
+      << "Expired complete download will not be deleted.";
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/download/drag_download_file.cc b/chromium/content/browser/download/drag_download_file.cc
index ccf3ab9b3b2..712f2cb9532 100644
--- a/chromium/content/browser/download/drag_download_file.cc
+++ b/chromium/content/browser/download/drag_download_file.cc
@@ -98,8 +98,8 @@ class DragDownloadFile::DragDownloadFileUI
     params->set_referrer_policy(
         Referrer::ReferrerPolicyForUrlRequest(referrer_.policy));
     params->set_referrer_encoding(referrer_encoding_);
-    params->set_callback(base::Bind(&DragDownloadFileUI::OnDownloadStarted,
-                                    weak_ptr_factory_.GetWeakPtr()));
+    params->set_callback(base::BindOnce(&DragDownloadFileUI::OnDownloadStarted,
+                                        weak_ptr_factory_.GetWeakPtr()));
     params->set_file_path(file_path);
     params->set_file(std::move(file));  // Nulls file.
     params->set_download_source(download::DownloadSource::DRAG_AND_DROP);
diff --git a/chromium/content/browser/download/mhtml_generation_manager.cc b/chromium/content/browser/download/mhtml_generation_manager.cc
index 7c4ff01dd8d..b963e7b0417 100644
--- a/chromium/content/browser/download/mhtml_generation_manager.cc
+++ b/chromium/content/browser/download/mhtml_generation_manager.cc
@@ -36,6 +36,7 @@
 #include "crypto/secure_hash.h"
 #include "crypto/sha2.h"
 #include "mojo/core/embedder/embedder.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "net/base/mime_util.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 
@@ -280,7 +281,7 @@ class MHTMLGenerationManager::Job {
   std::vector<MHTMLExtraDataPart> extra_data_parts_;
 
   // MHTMLFileWriter instance for the frame being currently serialized.
-  mojom::MhtmlFileWriterAssociatedPtr writer_;
+  mojo::AssociatedRemote<mojom::MhtmlFileWriter> writer_;
 
   // Watcher to detect new data written to |mhtml_data_consumer_|.
   // This is instantiated and destroyed in the download sequence for each frame.
@@ -382,13 +383,19 @@ mojom::MhtmlSaveStatus MHTMLGenerationManager::Job::SendToNextRenderFrame() {
     return mojom::MhtmlSaveStatus::kFrameNoLongerExists;
   RenderFrameHost* rfh = ftn->current_frame_host();
 
+  if (writer_) {
+    // If we reached here, means the work for previous frame is done, so it is
+    // safe to cut the connection to the previous frame.
+    writer_.reset();
+  }
+
   // Bind Mojo interface to the RenderFrame
   rfh->GetRemoteAssociatedInterfaces()->GetInterface(&writer_);
 
   // Safe, as |writer_| is owned by this Job instance.
   auto error_callback =
       base::BindOnce(&Job::OnConnectionError, base::Unretained(this));
-  writer_.set_connection_error_handler(std::move(error_callback));
+  writer_.set_disconnect_handler(std::move(error_callback));
 
   mojom::SerializeAsMHTMLParamsPtr params(CreateMojoParams());
 
diff --git a/chromium/content/browser/download/network_download_url_loader_factory_info.cc b/chromium/content/browser/download/network_download_url_loader_factory_info.cc
index ecc6a7e80b7..9ef25ce4f02 100644
--- a/chromium/content/browser/download/network_download_url_loader_factory_info.cc
+++ b/chromium/content/browser/download/network_download_url_loader_factory_info.cc
@@ -14,10 +14,11 @@ namespace content {
 NetworkDownloadURLLoaderFactoryInfo::NetworkDownloadURLLoaderFactoryInfo(
     scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter,
     network::mojom::URLLoaderFactoryPtrInfo proxy_factory_ptr_info,
-    network::mojom::URLLoaderFactoryRequest proxy_factory_request)
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+        proxy_factory_receiver)
     : url_loader_factory_getter_(url_loader_factory_getter),
       proxy_factory_ptr_info_(std::move(proxy_factory_ptr_info)),
-      proxy_factory_request_(std::move(proxy_factory_request)) {}
+      proxy_factory_receiver_(std::move(proxy_factory_receiver)) {}
 
 NetworkDownloadURLLoaderFactoryInfo::~NetworkDownloadURLLoaderFactoryInfo() =
     default;
@@ -28,9 +29,9 @@ NetworkDownloadURLLoaderFactoryInfo::CreateFactory() {
   DCHECK(download::GetIOTaskRunner()->BelongsToCurrentThread());
   if (lazy_factory_)
     return lazy_factory_;
-  if (proxy_factory_request_.is_pending()) {
+  if (proxy_factory_receiver_.is_valid()) {
     url_loader_factory_getter_->CloneNetworkFactory(
-        std::move(proxy_factory_request_));
+        std::move(proxy_factory_receiver_));
     lazy_factory_ =
         base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
             std::move(proxy_factory_ptr_info_));
diff --git a/chromium/content/browser/download/network_download_url_loader_factory_info.h b/chromium/content/browser/download/network_download_url_loader_factory_info.h
index 660afc3d39c..6e541585d42 100644
--- a/chromium/content/browser/download/network_download_url_loader_factory_info.h
+++ b/chromium/content/browser/download/network_download_url_loader_factory_info.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_DOWNLOAD_NETWORK_DOWNLOAD_URL_LOADER_FACTORY_INFO_H_
 #define CONTENT_BROWSER_DOWNLOAD_NETWORK_DOWNLOAD_URL_LOADER_FACTORY_INFO_H_
 
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
@@ -20,7 +21,8 @@ class NetworkDownloadURLLoaderFactoryInfo
   NetworkDownloadURLLoaderFactoryInfo(
       scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter,
       network::mojom::URLLoaderFactoryPtrInfo proxy_factory_ptr_info,
-      network::mojom::URLLoaderFactoryRequest proxy_factory_request);
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+          proxy_factory_receiver);
   ~NetworkDownloadURLLoaderFactoryInfo() override;
 
  protected:
@@ -31,7 +33,8 @@ class NetworkDownloadURLLoaderFactoryInfo
   scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter_;
   scoped_refptr<network::SharedURLLoaderFactory> lazy_factory_;
   network::mojom::URLLoaderFactoryPtrInfo proxy_factory_ptr_info_;
-  network::mojom::URLLoaderFactoryRequest proxy_factory_request_;
+  mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+      proxy_factory_receiver_;
 
   DISALLOW_COPY_AND_ASSIGN(NetworkDownloadURLLoaderFactoryInfo);
 };
diff --git a/chromium/content/browser/download/save_file_manager.cc b/chromium/content/browser/download/save_file_manager.cc
index d468089b7af..c21f223f736 100644
--- a/chromium/content/browser/download/save_file_manager.cc
+++ b/chromium/content/browser/download/save_file_manager.cc
@@ -15,8 +15,8 @@
 #include "content/browser/data_url_loader_factory.h"
 #include "content/browser/download/save_file.h"
 #include "content/browser/download/save_package.h"
-#include "content/browser/file_url_loader_factory.h"
 #include "content/browser/fileapi/file_system_url_loader_factory.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
@@ -26,6 +26,7 @@
 #include "content/public/browser/shared_cors_origin_access_list.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_ui_url_loader_factory.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/previews_state.h"
 #include "net/base/io_buffer.h"
 #include "net/base/load_flags.h"
@@ -36,6 +37,7 @@
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/cpp/simple_url_loader_stream_consumer.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -95,7 +97,7 @@ class SaveFileManager::SimpleURLLoaderHelper
                          int render_process_id,
                          int render_frame_routing_id,
                          const GURL& final_url,
-                         const network::ResourceResponseHead& response_head) {
+                         const network::mojom::URLResponseHead& response_head) {
     std::string content_disposition;
     if (response_head.headers) {
       response_head.headers->GetNormalizedHeader("Content-Disposition",
diff --git a/chromium/content/browser/download/save_package.cc b/chromium/content/browser/download/save_package.cc
index 46ca3cecee3..c59d82b04df 100644
--- a/chromium/content/browser/download/save_package.cc
+++ b/chromium/content/browser/download/save_package.cc
@@ -334,7 +334,7 @@ void SavePackage::OnMHTMLGenerated(int64_t size) {
 
   auto* delegate = download_manager_->GetDelegate();
   if (!delegate || delegate->ShouldCompleteDownload(
-                       download_, base::Bind(&SavePackage::Finish, this))) {
+                       download_, base::BindOnce(&SavePackage::Finish, this))) {
     Finish();
   }
 }
@@ -1240,12 +1240,10 @@ void SavePackage::GetSaveInfo() {
   // need before calling to it.
   base::FilePath website_save_dir;
   base::FilePath download_save_dir;
-  bool skip_dir_check = false;
   auto* delegate = download_manager_->GetDelegate();
   if (delegate) {
-    delegate->GetSaveDir(
-        web_contents()->GetBrowserContext(), &website_save_dir,
-        &download_save_dir, &skip_dir_check);
+    delegate->GetSaveDir(web_contents()->GetBrowserContext(), &website_save_dir,
+                         &download_save_dir);
   }
   std::string mime_type = web_contents()->GetContentsMimeType();
   bool can_save_as_complete = CanSaveAsComplete(mime_type);
@@ -1253,7 +1251,7 @@ void SavePackage::GetSaveInfo() {
       download::GetDownloadTaskRunner().get(), FROM_HERE,
       base::Bind(&SavePackage::CreateDirectoryOnFileThread, title_, page_url_,
                  can_save_as_complete, mime_type, website_save_dir,
-                 download_save_dir, skip_dir_check),
+                 download_save_dir),
       base::Bind(&SavePackage::ContinueGetSaveInfo, this,
                  can_save_as_complete));
 }
@@ -1265,8 +1263,7 @@ base::FilePath SavePackage::CreateDirectoryOnFileThread(
     bool can_save_as_complete,
     const std::string& mime_type,
     const base::FilePath& website_save_dir,
-    const base::FilePath& download_save_dir,
-    bool skip_dir_check) {
+    const base::FilePath& download_save_dir) {
   DCHECK(download::GetDownloadTaskRunner()->RunsTasksInCurrentSequence());
 
   base::FilePath suggested_filename = filename_generation::GenerateFilename(
@@ -1274,8 +1271,7 @@ base::FilePath SavePackage::CreateDirectoryOnFileThread(
 
   base::FilePath save_dir;
   // If the default html/websites save folder doesn't exist...
-  // We skip the directory check for gdata directories on ChromeOS.
-  if (!skip_dir_check && !base::DirectoryExists(website_save_dir)) {
+  if (!base::DirectoryExists(website_save_dir)) {
     // If the default download dir doesn't exist, create it.
     if (!base::DirectoryExists(download_save_dir)) {
       bool res = base::CreateDirectory(download_save_dir);
diff --git a/chromium/content/browser/download/save_package.h b/chromium/content/browser/download/save_package.h
index c3385f8f3da..742fd2f0b86 100644
--- a/chromium/content/browser/download/save_package.h
+++ b/chromium/content/browser/download/save_package.h
@@ -305,8 +305,7 @@ class CONTENT_EXPORT SavePackage
       bool can_save_as_complete,
       const std::string& mime_type,
       const base::FilePath& website_save_dir,
-      const base::FilePath& download_save_dir,
-      bool skip_dir_check);
+      const base::FilePath& download_save_dir);
   void ContinueGetSaveInfo(bool can_save_as_complete,
                            const base::FilePath& suggested_path);
   void OnPathPicked(
diff --git a/chromium/content/browser/download/save_package_browsertest.cc b/chromium/content/browser/download/save_package_browsertest.cc
index 69dee7f5d08..2d9c7fba4ca 100644
--- a/chromium/content/browser/download/save_package_browsertest.cc
+++ b/chromium/content/browser/download/save_package_browsertest.cc
@@ -38,15 +38,13 @@ class TestShellDownloadManagerDelegate : public ShellDownloadManagerDelegate {
 
   void GetSaveDir(BrowserContext* context,
                   base::FilePath* website_save_dir,
-                  base::FilePath* download_save_dir,
-                  bool* skip_dir_check) override {
+                  base::FilePath* download_save_dir) override {
     *website_save_dir = download_dir_;
     *download_save_dir = download_dir_;
-    *skip_dir_check = false;
   }
 
   bool ShouldCompleteDownload(download::DownloadItem* download,
-                              const base::Closure& closure) override {
+                              base::OnceClosure closure) override {
     return true;
   }
 
diff --git a/chromium/content/browser/field_trial_recorder.cc b/chromium/content/browser/field_trial_recorder.cc
index 51540dcd050..65b115ec76b 100644
--- a/chromium/content/browser/field_trial_recorder.cc
+++ b/chromium/content/browser/field_trial_recorder.cc
@@ -4,8 +4,14 @@
 
 #include "content/browser/field_trial_recorder.h"
 
+#include <memory>
+#include <string>
+#include <utility>
+
 #include "base/metrics/field_trial.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "content/common/field_trial_recorder.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
 
@@ -15,9 +21,9 @@ FieldTrialRecorder::~FieldTrialRecorder() = default;
 
 // static
 void FieldTrialRecorder::Create(
-    mojom::FieldTrialRecorderRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<FieldTrialRecorder>(),
-                          std::move(request));
+    mojo::PendingReceiver<mojom::FieldTrialRecorder> receiver) {
+  mojo::MakeSelfOwnedReceiver(std::make_unique<FieldTrialRecorder>(),
+                              std::move(receiver));
 }
 
 void FieldTrialRecorder::FieldTrialActivated(const std::string& trial_name) {
@@ -28,4 +34,4 @@ void FieldTrialRecorder::FieldTrialActivated(const std::string& trial_name) {
   base::FieldTrialList::FindFullName(trial_name);
 }
 
-}  // namespce content
+}  // namespace content
diff --git a/chromium/content/browser/field_trial_recorder.h b/chromium/content/browser/field_trial_recorder.h
index ab425d500b5..040e2f5f60a 100644
--- a/chromium/content/browser/field_trial_recorder.h
+++ b/chromium/content/browser/field_trial_recorder.h
@@ -7,6 +7,7 @@
 
 #include "base/threading/thread_checker.h"
 #include "content/common/field_trial_recorder.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
@@ -15,7 +16,7 @@ class FieldTrialRecorder : public mojom::FieldTrialRecorder {
   FieldTrialRecorder();
   ~FieldTrialRecorder() override;
 
-  static void Create(mojom::FieldTrialRecorderRequest request);
+  static void Create(mojo::PendingReceiver<mojom::FieldTrialRecorder> receiver);
 
  private:
   // content::mojom::FieldTrialRecorder:
diff --git a/chromium/content/browser/fileapi/file_system_browsertest.cc b/chromium/content/browser/fileapi/file_system_browsertest.cc
index 74d2dffa25e..c1a2731579e 100644
--- a/chromium/content/browser/fileapi/file_system_browsertest.cc
+++ b/chromium/content/browser/fileapi/file_system_browsertest.cc
@@ -23,7 +23,6 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
-#include "storage/browser/fileapi/file_system_features.h"
 #include "storage/browser/quota/quota_manager.h"
 
 using storage::QuotaManager;
@@ -37,8 +36,6 @@ class FileSystemBrowserTest : public ContentBrowserTest,
  public:
   FileSystemBrowserTest() {
     is_incognito_ = GetParam();
-    feature_list_.InitAndEnableFeature(
-        storage::features::kEnableFilesystemInIncognito);
   }
 
   void SimpleTest(const GURL& test_url) {
diff --git a/chromium/content/browser/fileapi/file_system_manager_impl.cc b/chromium/content/browser/fileapi/file_system_manager_impl.cc
index 43beef8016e..b244edd7a99 100644
--- a/chromium/content/browser/fileapi/file_system_manager_impl.cc
+++ b/chromium/content/browser/fileapi/file_system_manager_impl.cc
@@ -4,10 +4,7 @@
 
 #include "content/browser/fileapi/file_system_manager_impl.h"
 
-#include <memory>
-#include <string>
 #include <utility>
-#include <vector>
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
@@ -28,7 +25,6 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "ipc/ipc_platform_file.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/base/mime_util.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "storage/browser/blob/blob_storage_context.h"
@@ -140,7 +136,7 @@ class FileSystemManagerImpl::FileSystemCancellableOperationImpl
   }
 
   const OperationID id_;
-  // |file_system_manager_impl| owns |this| through a StrongBindingSet.
+  // |file_system_manager_impl| owns |this| through a UniqueReceiverSet.
   FileSystemManagerImpl* const file_system_manager_impl_;
 };
 
@@ -159,7 +155,7 @@ class FileSystemManagerImpl::ReceivedSnapshotListenerImpl
   }
 
   const int snapshot_id_;
-  // |file_system_manager_impl| owns |this| through a StrongBindingSet.
+  // |file_system_manager_impl| owns |this| through a UniqueReceiverSet.
   FileSystemManagerImpl* const file_system_manager_impl_;
 };
 
@@ -190,7 +186,7 @@ FileSystemManagerImpl::FileSystemManagerImpl(
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(context_);
   DCHECK(blob_storage_context_);
-  bindings_.set_connection_error_handler(base::BindRepeating(
+  receivers_.set_disconnect_handler(base::BindRepeating(
       &FileSystemManagerImpl::OnConnectionError, base::Unretained(this)));
 }
 
@@ -203,12 +199,12 @@ base::WeakPtr<FileSystemManagerImpl> FileSystemManagerImpl::GetWeakPtr() {
   return weak_factory_.GetWeakPtr();
 }
 
-void FileSystemManagerImpl::BindRequest(
-    blink::mojom::FileSystemManagerRequest request) {
+void FileSystemManagerImpl::BindReceiver(
+    mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (!operation_runner_)
     operation_runner_ = context_->CreateFileSystemOperationRunner();
-  bindings_.AddBinding(this, std::move(request));
+  receivers_.Add(this, std::move(receiver));
 }
 
 void FileSystemManagerImpl::Open(const url::Origin& origin,
@@ -406,10 +402,13 @@ void FileSystemManagerImpl::Exists(const GURL& path,
 
 void FileSystemManagerImpl::ReadDirectory(
     const GURL& path,
-    blink::mojom::FileSystemOperationListenerPtr listener) {
+    mojo::PendingRemote<blink::mojom::FileSystemOperationListener>
+        pending_listener) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   FileSystemURL url(context_->CrackURL(path));
   base::Optional<base::File::Error> opt_error = ValidateFileSystemURL(url);
+  mojo::Remote<blink::mojom::FileSystemOperationListener> listener(
+      std::move(pending_listener));
   if (opt_error) {
     listener->ErrorOccurred(opt_error.value());
     return;
@@ -453,12 +452,16 @@ void FileSystemManagerImpl::Write(
     const GURL& file_path,
     const std::string& blob_uuid,
     int64_t position,
-    blink::mojom::FileSystemCancellableOperationRequest op_request,
-    blink::mojom::FileSystemOperationListenerPtr listener) {
+    mojo::PendingReceiver<blink::mojom::FileSystemCancellableOperation>
+        op_receiver,
+    mojo::PendingRemote<blink::mojom::FileSystemOperationListener>
+        pending_listener) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   FileSystemURL url(context_->CrackURL(file_path));
   base::Optional<base::File::Error> opt_error = ValidateFileSystemURL(url);
+  mojo::Remote<blink::mojom::FileSystemOperationListener> listener(
+      std::move(pending_listener));
   if (opt_error) {
     listener->ErrorOccurred(opt_error.value());
     return;
@@ -476,9 +479,9 @@ void FileSystemManagerImpl::Write(
       url, std::move(blob), position,
       base::BindRepeating(&FileSystemManagerImpl::DidWrite, GetWeakPtr(),
                           listener_id));
-  cancellable_operations_.AddBinding(
+  cancellable_operations_.Add(
       std::make_unique<FileSystemCancellableOperationImpl>(op_id, this),
-      std::move(op_request));
+      std::move(op_receiver));
 }
 
 void FileSystemManagerImpl::WriteSync(const GURL& file_path,
@@ -510,7 +513,8 @@ void FileSystemManagerImpl::WriteSync(const GURL& file_path,
 void FileSystemManagerImpl::Truncate(
     const GURL& file_path,
     int64_t length,
-    blink::mojom::FileSystemCancellableOperationRequest op_request,
+    mojo::PendingReceiver<blink::mojom::FileSystemCancellableOperation>
+        op_receiver,
     TruncateCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   FileSystemURL url(context_->CrackURL(file_path));
@@ -528,9 +532,9 @@ void FileSystemManagerImpl::Truncate(
       url, length,
       base::BindRepeating(&FileSystemManagerImpl::DidFinish, GetWeakPtr(),
                           base::Passed(&callback)));
-  cancellable_operations_.AddBinding(
+  cancellable_operations_.Add(
       std::make_unique<FileSystemCancellableOperationImpl>(op_id, this),
-      std::move(op_request));
+      std::move(op_receiver));
 }
 
 void FileSystemManagerImpl::TruncateSync(const GURL& file_path,
@@ -588,12 +592,13 @@ void FileSystemManagerImpl::CreateSnapshotFile(
   base::Optional<base::File::Error> opt_error = ValidateFileSystemURL(url);
   if (opt_error) {
     std::move(callback).Run(base::File::Info(), base::FilePath(),
-                            opt_error.value(), nullptr);
+                            opt_error.value(), mojo::NullRemote());
     return;
   }
   if (!security_policy_->CanReadFileSystemFile(process_id_, url)) {
     std::move(callback).Run(base::File::Info(), base::FilePath(),
-                            base::File::FILE_ERROR_SECURITY, nullptr);
+                            base::File::FILE_ERROR_SECURITY,
+                            mojo::NullRemote());
     return;
   }
 
@@ -639,10 +644,10 @@ void FileSystemManagerImpl::DidReceiveSnapshotFile(int snapshot_id) {
 
 void FileSystemManagerImpl::OnConnectionError() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  if (bindings_.empty()) {
+  if (receivers_.empty()) {
     in_transit_snapshot_files_.Clear();
     operation_runner_.reset();
-    cancellable_operations_.CloseAllBindings();
+    cancellable_operations_.Clear();
   }
 }
 
@@ -667,7 +672,7 @@ void FileSystemManagerImpl::DidGetMetadataForStreaming(
   // For now, streaming Blobs are implemented as a successful snapshot file
   // creation with an empty path.
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  std::move(callback).Run(info, base::FilePath(), result, nullptr);
+  std::move(callback).Run(info, base::FilePath(), result, mojo::NullRemote());
 }
 
 void FileSystemManagerImpl::DidReadDirectory(
@@ -780,7 +785,7 @@ void FileSystemManagerImpl::DidCreateSnapshot(
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (result != base::File::FILE_OK) {
     std::move(callback).Run(base::File::Info(), base::FilePath(), result,
-                            nullptr);
+                            mojo::NullRemote());
     return;
   }
 
@@ -811,19 +816,17 @@ void FileSystemManagerImpl::DidCreateSnapshot(
   if (file_ref.get()) {
     // This ref is held until DidReceiveSnapshotFile is called.
     int request_id = in_transit_snapshot_files_.Add(file_ref);
-    blink::mojom::ReceivedSnapshotListenerPtr listener_ptr;
-    snapshot_listeners_.AddBinding(
+    mojo::PendingRemote<blink::mojom::ReceivedSnapshotListener> listener;
+    snapshot_listeners_.Add(
         std::make_unique<ReceivedSnapshotListenerImpl>(request_id, this),
-        mojo::MakeRequest<blink::mojom::ReceivedSnapshotListener>(
-            &listener_ptr));
+        listener.InitWithNewPipeAndPassReceiver());
     // Return the file info and platform_path.
-    std::move(callback).Run(info, platform_path, result,
-                            std::move(listener_ptr));
+    std::move(callback).Run(info, platform_path, result, std::move(listener));
     return;
   }
 
   // Return the file info and platform_path.
-  std::move(callback).Run(info, platform_path, result, nullptr);
+  std::move(callback).Run(info, platform_path, result, mojo::NullRemote());
 }
 
 void FileSystemManagerImpl::DidGetPlatformPath(GetPlatformPathCallback callback,
@@ -872,10 +875,10 @@ base::Optional<base::File::Error> FileSystemManagerImpl::ValidateFileSystemURL(
 }
 
 FileSystemManagerImpl::OperationListenerID FileSystemManagerImpl::AddOpListener(
-    blink::mojom::FileSystemOperationListenerPtr listener) {
+    mojo::Remote<blink::mojom::FileSystemOperationListener> listener) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   int op_id = next_operation_listener_id_++;
-  listener.set_connection_error_handler(
+  listener.set_disconnect_handler(
       base::BindOnce(&FileSystemManagerImpl::OnConnectionErrorForOpListeners,
                      base::Unretained(this), op_id));
   op_listeners_[op_id] = std::move(listener);
diff --git a/chromium/content/browser/fileapi/file_system_manager_impl.h b/chromium/content/browser/fileapi/file_system_manager_impl.h
index 3aaaefacc31..c6adc332e14 100644
--- a/chromium/content/browser/fileapi/file_system_manager_impl.h
+++ b/chromium/content/browser/fileapi/file_system_manager_impl.h
@@ -10,7 +10,6 @@
 
 #include <map>
 #include <memory>
-#include <set>
 #include <string>
 #include <unordered_map>
 #include <vector>
@@ -22,9 +21,10 @@
 #include "components/services/filesystem/public/mojom/types.mojom.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_message_filter.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
-#include "mojo/public/cpp/bindings/interface_ptr_set.h"
-#include "mojo/public/cpp/bindings/strong_binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/unique_receiver_set.h"
 #include "storage/browser/fileapi/file_system_context.h"
 #include "storage/browser/fileapi/file_system_operation_runner.h"
 #include "storage/common/fileapi/file_system_types.h"
@@ -65,7 +65,8 @@ class CONTENT_EXPORT FileSystemManagerImpl
   ~FileSystemManagerImpl() override;
   base::WeakPtr<FileSystemManagerImpl> GetWeakPtr();
 
-  void BindRequest(blink::mojom::FileSystemManagerRequest request);
+  void BindReceiver(
+      mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver);
 
   // blink::mojom::FileSystem
   void Open(const url::Origin& origin,
@@ -93,22 +94,27 @@ class CONTENT_EXPORT FileSystemManagerImpl
               ExistsCallback callback) override;
   void ReadDirectory(
       const GURL& path,
-      blink::mojom::FileSystemOperationListenerPtr listener) override;
+      mojo::PendingRemote<blink::mojom::FileSystemOperationListener>
+          pending_listener) override;
   void ReadDirectorySync(const GURL& path,
                          ReadDirectorySyncCallback callback) override;
   void Write(const GURL& file_path,
              const std::string& blob_uuid,
              int64_t position,
-             blink::mojom::FileSystemCancellableOperationRequest op_request,
-             blink::mojom::FileSystemOperationListenerPtr listener) override;
+             mojo::PendingReceiver<blink::mojom::FileSystemCancellableOperation>
+                 op_receiver,
+             mojo::PendingRemote<blink::mojom::FileSystemOperationListener>
+                 pending_listener) override;
   void WriteSync(const GURL& file_path,
                  const std::string& blob_uuid,
                  int64_t position,
                  WriteSyncCallback callback) override;
-  void Truncate(const GURL& file_path,
-                int64_t length,
-                blink::mojom::FileSystemCancellableOperationRequest op_request,
-                TruncateCallback callback) override;
+  void Truncate(
+      const GURL& file_path,
+      int64_t length,
+      mojo::PendingReceiver<blink::mojom::FileSystemCancellableOperation>
+          op_receiver,
+      TruncateCallback callback) override;
   void TruncateSync(const GURL& file_path,
                     int64_t length,
                     TruncateSyncCallback callback) override;
@@ -195,7 +201,7 @@ class CONTENT_EXPORT FileSystemManagerImpl
   }
 
   OperationListenerID AddOpListener(
-      blink::mojom::FileSystemOperationListenerPtr listener);
+      mojo::Remote<blink::mojom::FileSystemOperationListener> listener);
   void RemoveOpListener(OperationListenerID listener_id);
   blink::mojom::FileSystemOperationListener* GetOpListener(
       OperationListenerID listener_id);
@@ -207,14 +213,14 @@ class CONTENT_EXPORT FileSystemManagerImpl
   const scoped_refptr<ChromeBlobStorageContext> blob_storage_context_;
   std::unique_ptr<storage::FileSystemOperationRunner> operation_runner_;
 
-  mojo::BindingSet<blink::mojom::FileSystemManager> bindings_;
-  mojo::StrongBindingSet<blink::mojom::FileSystemCancellableOperation>
+  mojo::ReceiverSet<blink::mojom::FileSystemManager> receivers_;
+  mojo::UniqueReceiverSet<blink::mojom::FileSystemCancellableOperation>
       cancellable_operations_;
-  mojo::StrongBindingSet<blink::mojom::ReceivedSnapshotListener>
+  mojo::UniqueReceiverSet<blink::mojom::ReceivedSnapshotListener>
       snapshot_listeners_;
 
   std::unordered_map<OperationListenerID,
-                     blink::mojom::FileSystemOperationListenerPtr>
+                     mojo::Remote<blink::mojom::FileSystemOperationListener>>
       op_listeners_;
   OperationListenerID next_operation_listener_id_ = 1;
 
diff --git a/chromium/content/browser/fileapi/file_system_url_loader_factory.cc b/chromium/content/browser/fileapi/file_system_url_loader_factory.cc
index 7935baf2644..4d6e73d254d 100644
--- a/chromium/content/browser/fileapi/file_system_url_loader_factory.cc
+++ b/chromium/content/browser/fileapi/file_system_url_loader_factory.cc
@@ -26,7 +26,9 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/child_process_host.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/system/data_pipe_producer.h"
 #include "mojo/public/cpp/system/string_data_source.h"
 #include "net/base/completion_repeating_callback.h"
@@ -602,7 +604,7 @@ class FileSystemURLLoaderFactory : public network::mojom::URLLoaderFactory {
 
   network::mojom::URLLoaderFactoryPtr CreateBinding() {
     network::mojom::URLLoaderFactoryPtr factory;
-    bindings_.AddBinding(this, mojo::MakeRequest(&factory));
+    receivers_.Add(this, mojo::MakeRequest(&factory));
     return factory;
   }
 
@@ -634,12 +636,13 @@ class FileSystemURLLoaderFactory : public network::mojom::URLLoaderFactory {
                                             io_task_runner_);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest loader) override {
-    bindings_.AddBinding(this, std::move(loader));
+  void Clone(
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) override {
+    receivers_.Add(this, std::move(loader));
   }
 
   const FactoryParams params_;
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
   scoped_refptr<base::SequencedTaskRunner> io_task_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(FileSystemURLLoaderFactory);
diff --git a/chromium/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc b/chromium/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc
index 5ab183bb00f..fda45233c21 100644
--- a/chromium/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc
+++ b/chromium/content/browser/fileapi/file_system_url_loader_factory_browsertest.cc
@@ -16,7 +16,6 @@
 #include "base/rand_util.h"
 #include "base/task/post_task.h"
 #include "base/test/bind_test_util.h"
-#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/browser/fileapi/file_system_url_loader_factory.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -34,7 +33,6 @@
 #include "services/network/test/test_url_loader_client.h"
 #include "storage/browser/fileapi/external_mount_points.h"
 #include "storage/browser/fileapi/file_system_context.h"
-#include "storage/browser/fileapi/file_system_features.h"
 #include "storage/browser/fileapi/file_system_file_util.h"
 #include "storage/browser/fileapi/file_system_operation_context.h"
 #include "storage/browser/fileapi/file_system_operation_runner.h"
@@ -58,7 +56,7 @@ using storage::FileSystemURL;
 namespace content {
 namespace {
 
-enum class TestMode { kRegular, kIncognito, kRegularWithIncognitoEnabled };
+enum class TestMode { kRegular, kIncognito };
 
 // We always use the TEMPORARY FileSystem in these tests.
 const char kFileSystemURLPrefix[] = "filesystem:http://remote/temporary/";
@@ -161,21 +159,9 @@ class FileSystemURLLoaderFactoryTest
     : public ContentBrowserTest,
       public ::testing::WithParamInterface<TestMode> {
  protected:
-  FileSystemURLLoaderFactoryTest() : file_util_(nullptr) {
-    std::vector<base::Feature> features;
-    if (GetParam() == TestMode::kIncognito ||
-        GetParam() == TestMode::kRegularWithIncognitoEnabled) {
-      features.push_back(storage::features::kEnableFilesystemInIncognito);
-    }
-    feature_list_.InitWithFeatures(features, std::vector<base::Feature>());
-  }
+  FileSystemURLLoaderFactoryTest() : file_util_(nullptr) {}
   ~FileSystemURLLoaderFactoryTest() override = default;
 
-  bool IsInMemoryFileSystemEnabled() {
-    return base::FeatureList::IsEnabled(
-        storage::features::kEnableFilesystemInIncognito);
-  }
-
   bool IsIncognito() { return GetParam() == TestMode::kIncognito; }
 
   void SetUpOnMainThread() override {
@@ -483,7 +469,6 @@ class FileSystemURLLoaderFactoryTest
     return client;
   }
 
-  base::test::ScopedFeatureList feature_list_;
   scoped_refptr<MockSpecialStoragePolicy> special_storage_policy_;
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
   scoped_refptr<base::SequencedTaskRunner> blocking_task_runner_;
@@ -494,12 +479,10 @@ class FileSystemURLLoaderFactoryTest
   DISALLOW_COPY_AND_ASSIGN(FileSystemURLLoaderFactoryTest);
 };
 
-INSTANTIATE_TEST_SUITE_P(
-    ,
-    FileSystemURLLoaderFactoryTest,
-    testing::Values(TestMode::kRegular,
-                    TestMode::kIncognito,
-                    TestMode::kRegularWithIncognitoEnabled));
+INSTANTIATE_TEST_SUITE_P(,
+                         FileSystemURLLoaderFactoryTest,
+                         testing::Values(TestMode::kRegular,
+                                         TestMode::kIncognito));
 
 IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, DirectoryListing) {
   base::ScopedAllowBlockingForTesting allow_blocking;
@@ -592,30 +575,11 @@ IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, Incognito) {
 
   auto client =
       TestLoadWithContext(CreateFileSystemURL("/"), file_system_context.get());
-  if (IsInMemoryFileSystemEnabled()) {
-    // When in-memory file system is enabled, the request fails as the requested
-    // directory does not exist in in-memory obfuscated file system.
-    ASSERT_FALSE(client->has_received_response());
-    ASSERT_TRUE(client->has_received_completion());
-    EXPECT_EQ(net::ERR_FILE_NOT_FOUND, client->completion_status().error_code);
-  } else {
-    ASSERT_TRUE(client->has_received_response());
-    ASSERT_TRUE(client->has_received_completion());
-
-    std::string response_text = ReadDataPipe(client->response_body_release());
-    EXPECT_GT(response_text.size(), 0ul);
-
-    std::istringstream in(response_text);
-
-    int num_entries = 0;
-    std::string line;
-    while (!!std::getline(in, line)) {
-      if (IsDirectoryListingLine(line))
-        num_entries++;
-    }
-
-    EXPECT_EQ(0, num_entries);
-  }
+  // The request fails as the requested directory does not exist in in-memory
+  // obfuscated file system.
+  ASSERT_FALSE(client->has_received_response());
+  ASSERT_TRUE(client->has_received_completion());
+  EXPECT_EQ(net::ERR_FILE_NOT_FOUND, client->completion_status().error_code);
 
   client = TestLoadWithContext(CreateFileSystemURL("foo"),
                                file_system_context.get());
@@ -700,10 +664,10 @@ IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, FileTest) {
   EXPECT_TRUE(client->has_received_completion());
   std::string response_text = ReadDataPipe(client->response_body_release());
   EXPECT_EQ(kTestFileData, response_text);
-  ASSERT_TRUE(client->response_head().headers) << "No response headers";
-  EXPECT_EQ(200, client->response_head().headers->response_code());
+  ASSERT_TRUE(client->response_head()->headers) << "No response headers";
+  EXPECT_EQ(200, client->response_head()->headers->response_code());
   std::string cache_control;
-  EXPECT_TRUE(client->response_head().headers->GetNormalizedHeader(
+  EXPECT_TRUE(client->response_head()->headers->GetNormalizedHeader(
       "cache-control", &cache_control));
   EXPECT_EQ("no-cache", cache_control);
 }
@@ -874,8 +838,8 @@ IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, FileGetMimeType) {
   EXPECT_TRUE(client->has_received_response());
   EXPECT_TRUE(client->has_received_completion());
 
-  EXPECT_EQ(mime_type_direct, client->response_head().mime_type);
-  EXPECT_TRUE(client->response_head().did_mime_sniff);
+  EXPECT_EQ(mime_type_direct, client->response_head()->mime_type);
+  EXPECT_TRUE(client->response_head()->did_mime_sniff);
 }
 
 IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, FileIncognito) {
@@ -901,7 +865,7 @@ IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, FileIncognito) {
   EXPECT_TRUE(client->has_received_completion());
   std::string response_text = ReadDataPipe(client->response_body_release());
   EXPECT_EQ(kTestFileData, response_text);
-  EXPECT_EQ(200, client->response_head().headers->response_code());
+  EXPECT_EQ(200, client->response_head()->headers->response_code());
 }
 
 IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, FileAutoMountFileTest) {
@@ -914,10 +878,10 @@ IN_PROC_BROWSER_TEST_P(FileSystemURLLoaderFactoryTest, FileAutoMountFileTest) {
   EXPECT_TRUE(client->has_received_completion());
   std::string response_text = ReadDataPipe(client->response_body_release());
   EXPECT_EQ(kTestFileData, response_text);
-  EXPECT_EQ(200, client->response_head().headers->response_code());
+  EXPECT_EQ(200, client->response_head()->headers->response_code());
 
   std::string cache_control;
-  EXPECT_TRUE(client->response_head().headers->GetNormalizedHeader(
+  EXPECT_TRUE(client->response_head()->headers->GetNormalizedHeader(
       "cache-control", &cache_control));
   EXPECT_EQ("no-cache", cache_control);
 
diff --git a/chromium/content/browser/fileapi/fileapi_browsertest.cc b/chromium/content/browser/fileapi/fileapi_browsertest.cc
index 43faade2264..25d5e5c791c 100644
--- a/chromium/content/browser/fileapi/fileapi_browsertest.cc
+++ b/chromium/content/browser/fileapi/fileapi_browsertest.cc
@@ -23,7 +23,7 @@ IN_PROC_BROWSER_TEST_F(FileAPIBrowserTest, FileInputChooserParams) {
   EXPECT_TRUE(base::PathService::Get(base::DIR_TEMP, &file));
   file = file.AppendASCII("bar");
 
-  NavigateToURL(shell(), GetTestUrl(".", "file_input.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(".", "file_input.html")));
 
   // Click on the <input type=file> element to launch the file upload picker.
   {
diff --git a/chromium/content/browser/find_request_manager.cc b/chromium/content/browser/find_request_manager.cc
index 3e0ca8d4771..0bda4a5dc93 100644
--- a/chromium/content/browser/find_request_manager.cc
+++ b/chromium/content/browser/find_request_manager.cc
@@ -5,6 +5,7 @@
 #include "content/browser/find_request_manager.h"
 
 #include <algorithm>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/containers/queue.h"
@@ -32,6 +33,7 @@ namespace {
 // Returns all child frames of |node|.
 std::vector<FrameTreeNode*> GetChildren(FrameTreeNode* node) {
   std::vector<FrameTreeNode*> children;
+  children.reserve(node->child_count());
   for (size_t i = 0; i != node->child_count(); ++i) {
     if (auto* contents = static_cast<WebContentsImpl*>(
             WebContentsImpl::FromOuterFrameTreeNode(node->child_at(i)))) {
@@ -95,20 +97,16 @@ FrameTreeNode* GetParent(FrameTreeNode* node) {
     return node->parent();
 
   auto* contents = WebContentsImpl::FromFrameTreeNode(node);
+  if (!node->IsMainFrame() || !contents->GetOuterWebContents())
+    return nullptr;
 
-  if (node->IsMainFrame() && contents->GetOuterWebContents()) {
-    if (!GuestMode::IsCrossProcessFrameGuest(contents) &&
-        contents->GetBrowserPluginGuest() &&
-        contents->GetBrowserPluginGuest()->GetEmbedderFrame()) {
-      return contents->GetBrowserPluginGuest()
-          ->GetEmbedderFrame()
-          ->frame_tree_node();
-    } else {
-      return GetParent(FrameTreeNode::GloballyFindByID(
-          contents->GetOuterDelegateFrameTreeNodeId()));
-    }
+  if (!GuestMode::IsCrossProcessFrameGuest(contents)) {
+    auto* guest = contents->GetBrowserPluginGuest();
+    if (guest && guest->GetEmbedderFrame())
+      return guest->GetEmbedderFrame()->frame_tree_node();
   }
-  return nullptr;
+  return GetParent(FrameTreeNode::GloballyFindByID(
+      contents->GetOuterDelegateFrameTreeNodeId()));
 }
 
 // Returns the previous sibling FrameTreeNode of |node|, if one exists, or
@@ -197,7 +195,7 @@ class FindRequestManager::FrameObserver : public WebContentsObserver {
   FrameObserver(WebContentsImpl* web_contents, FindRequestManager* manager)
       : WebContentsObserver(web_contents), manager_(manager) {}
 
-  ~FrameObserver() override {}
+  ~FrameObserver() override = default;
 
   void DidFinishLoad(RenderFrameHost* rfh, const GURL& validated_url) override {
     if (manager_->current_session_id_ == kInvalidId)
@@ -236,7 +234,7 @@ class FindRequestManager::FrameObserver : public WebContentsObserver {
   DISALLOW_COPY_AND_ASSIGN(FrameObserver);
 };
 
-FindRequestManager::FindRequest::FindRequest() {}
+FindRequestManager::FindRequest::FindRequest() = default;
 
 FindRequestManager::FindRequest::FindRequest(
     int id,
@@ -249,7 +247,7 @@ FindRequestManager::FindRequest::FindRequest(const FindRequest& request)
       search_text(request.search_text),
       options(request.options.Clone()) {}
 
-FindRequestManager::FindRequest::~FindRequest() {}
+FindRequestManager::FindRequest::~FindRequest() = default;
 
 FindRequestManager::FindRequest& FindRequestManager::FindRequest::operator=(
     const FindRequest& request) {
@@ -266,33 +264,25 @@ FindRequestManager::ActivateNearestFindResultState::
     ActivateNearestFindResultState(float x, float y)
     : current_request_id(GetNextID()), point(x, y) {}
 FindRequestManager::ActivateNearestFindResultState::
-~ActivateNearestFindResultState() {}
+    ~ActivateNearestFindResultState() = default;
 
 FindRequestManager::FrameRects::FrameRects() = default;
 FindRequestManager::FrameRects::FrameRects(const std::vector<gfx::RectF>& rects,
                                            int version)
     : rects(rects), version(version) {}
-FindRequestManager::FrameRects::~FrameRects() {}
+FindRequestManager::FrameRects::~FrameRects() = default;
 
 FindRequestManager::FindMatchRectsState::FindMatchRectsState() = default;
-FindRequestManager::FindMatchRectsState::~FindMatchRectsState() {}
+FindRequestManager::FindMatchRectsState::~FindMatchRectsState() = default;
 #endif
 
 // static
 const int FindRequestManager::kInvalidId = -1;
 
 FindRequestManager::FindRequestManager(WebContentsImpl* web_contents)
-    : contents_(web_contents),
-      current_session_id_(kInvalidId),
-      pending_find_next_reply_(nullptr),
-      pending_active_match_ordinal_(false),
-      number_of_matches_(0),
-      active_frame_(nullptr),
-      relative_active_match_ordinal_(0),
-      active_match_ordinal_(0),
-      last_reported_id_(kInvalidId) {}
-
-FindRequestManager::~FindRequestManager() {}
+    : contents_(web_contents) {}
+
+FindRequestManager::~FindRequestManager() = default;
 
 void FindRequestManager::Find(int request_id,
                               const base::string16& search_text,
@@ -419,6 +409,11 @@ void FindRequestManager::RemoveFrame(RenderFrameHost* rfh) {
   if (current_session_id_ == kInvalidId || !CheckFrame(rfh))
     return;
 
+  // Make sure to always clear the highlighted selection. It is useful in case
+  // the user goes back to the same page using the BackForwardCache.
+  static_cast<RenderFrameHostImpl*>(rfh)->GetFindInPage()->StopFinding(
+      blink::mojom::StopFindAction::kStopFindActionClearSelection);
+
   // If matches are counted for the frame that is being removed, decrement the
   // match total before erasing that entry.
   auto it = find_in_page_clients_.find(rfh);
@@ -443,10 +438,8 @@ void FindRequestManager::RemoveFrame(RenderFrameHost* rfh) {
     activate_.nearest_frame = nullptr;
 
   // Match rects in the removed frame are no longer relevant.
-  if (match_rects_.frame_rects.count(rfh)) {
-    match_rects_.frame_rects.erase(rfh);
+  if (match_rects_.frame_rects.erase(rfh) != 0)
     ++match_rects_.known_version;
-  }
 
   // A reply should not be expected from the removed frame.
   RemoveNearestFindResultPendingReply(rfh);
@@ -455,16 +448,16 @@ void FindRequestManager::RemoveFrame(RenderFrameHost* rfh) {
 
   // If no pending find replies are expected for the removed frame, then just
   // report the updated results.
-  if (!pending_initial_replies_.count(rfh) && pending_find_next_reply_ != rfh) {
+  if (!base::Contains(pending_initial_replies_, rfh) &&
+      pending_find_next_reply_ != rfh) {
     bool final_update =
         pending_initial_replies_.empty() && !pending_find_next_reply_;
     NotifyFindReply(current_session_id_, final_update);
     return;
   }
 
-  if (pending_initial_replies_.count(rfh)) {
+  if (pending_initial_replies_.erase(rfh) != 0) {
     // A reply should not be expected from the removed frame.
-    pending_initial_replies_.erase(rfh);
     if (pending_initial_replies_.empty()) {
       FinalUpdateReceived(current_session_id_, rfh);
     }
@@ -513,7 +506,7 @@ void FindRequestManager::OnGetNearestFindResultReply(RenderFrameHostImpl* rfh,
                                                      int request_id,
                                                      float distance) {
   if (request_id != activate_.current_request_id ||
-      !activate_.pending_replies.count(rfh)) {
+      !base::Contains(activate_.pending_replies, rfh)) {
     return;
   }
 
@@ -680,10 +673,10 @@ RenderFrameHost* FindRequestManager::Traverse(RenderFrameHost* from_rfh,
   DCHECK(from_rfh);
   // If |from_rfh| is being detached, it might already be removed from
   // its parent's list of children, meaning we can't traverse it correctly.
-  if (!static_cast<RenderFrameHostImpl*>(from_rfh)->is_active())
+  auto* from_rfh_impl = static_cast<RenderFrameHostImpl*>(from_rfh);
+  if (!from_rfh_impl->is_active())
     return nullptr;
-  FrameTreeNode* node =
-      static_cast<RenderFrameHostImpl*>(from_rfh)->frame_tree_node();
+  FrameTreeNode* node = from_rfh_impl->frame_tree_node();
   FrameTreeNode* last_node = node;
   while ((node = TraverseNode(node, forward, wrap)) != nullptr) {
     if (!CheckFrame(node->current_frame_host())) {
@@ -697,7 +690,7 @@ RenderFrameHost* FindRequestManager::Traverse(RenderFrameHost* from_rfh,
     RenderFrameHost* current_rfh = node->current_frame_host();
     if (!matches_only ||
         find_in_page_clients_.find(current_rfh)->second->number_of_matches() ||
-        pending_initial_replies_.count(current_rfh)) {
+        base::Contains(pending_initial_replies_, current_rfh)) {
       // Note that if there is still a pending reply expected for this frame,
       // then it may have unaccounted matches and will not be skipped via
       // |matches_only|.
@@ -728,7 +721,7 @@ void FindRequestManager::AddFrame(RenderFrameHost* rfh, bool force) {
 }
 
 bool FindRequestManager::CheckFrame(RenderFrameHost* rfh) const {
-  return rfh && find_in_page_clients_.count(rfh);
+  return rfh && base::Contains(find_in_page_clients_, rfh);
 }
 
 void FindRequestManager::UpdateActiveMatchOrdinal() {
@@ -833,30 +826,29 @@ void FindRequestManager::RemoveFindMatchRectsPendingReply(
     return;
 
   match_rects_.pending_replies.erase(it);
-  if (match_rects_.pending_replies.empty()) {
-    // All replies are in.
-    std::vector<gfx::RectF> aggregate_rects;
-    if (match_rects_.request_version != match_rects_.known_version) {
-      // Request version is stale, so aggregate and report the newer find
-      // match rects. The rects should be aggregated in search order.
-      for (RenderFrameHost* frame = GetInitialFrame(true /* forward */); frame;
-           frame = Traverse(frame,
-                            true /* forward */,
-                            true /* matches_only */,
-                            false /* wrap */)) {
-        auto frame_it = match_rects_.frame_rects.find(frame);
-        if (frame_it == match_rects_.frame_rects.end())
-          continue;
-
-        std::vector<gfx::RectF>& frame_rects = frame_it->second.rects;
-        aggregate_rects.insert(
-            aggregate_rects.end(), frame_rects.begin(), frame_rects.end());
-      }
+  if (!match_rects_.pending_replies.empty())
+    return;
+
+  // All replies are in.
+  std::vector<gfx::RectF> aggregate_rects;
+  if (match_rects_.request_version != match_rects_.known_version) {
+    // Request version is stale, so aggregate and report the newer find
+    // match rects. The rects should be aggregated in search order.
+    for (RenderFrameHost* frame = GetInitialFrame(true /* forward */); frame;
+         frame = Traverse(frame, true /* forward */, true /* matches_only */,
+                          false /* wrap */)) {
+      auto frame_it = match_rects_.frame_rects.find(frame);
+      if (frame_it == match_rects_.frame_rects.end())
+        continue;
+
+      std::vector<gfx::RectF>& frame_rects = frame_it->second.rects;
+      aggregate_rects.insert(aggregate_rects.end(), frame_rects.begin(),
+                             frame_rects.end());
     }
-    contents_->NotifyFindMatchRectsReply(
-        match_rects_.known_version, aggregate_rects, match_rects_.active_rect);
   }
+  contents_->NotifyFindMatchRectsReply(
+      match_rects_.known_version, aggregate_rects, match_rects_.active_rect);
 }
-#endif
+#endif  // defined(OS_ANDROID)
 
 }  // namespace content
diff --git a/chromium/content/browser/find_request_manager.h b/chromium/content/browser/find_request_manager.h
index 0ddf5ab5c19..8c85cbbcc39 100644
--- a/chromium/content/browser/find_request_manager.h
+++ b/chromium/content/browser/find_request_manager.h
@@ -5,9 +5,9 @@
 #ifndef CONTENT_BROWSER_FIND_REQUEST_MANAGER_H_
 #define CONTENT_BROWSER_FIND_REQUEST_MANAGER_H_
 
+#include <memory>
 #include <unordered_map>
 #include <unordered_set>
-#include <utility>
 #include <vector>
 
 #include "base/containers/queue.h"
@@ -277,7 +277,7 @@ class CONTENT_EXPORT FindRequestManager {
   // in all find-related IPCs, which allows reply IPCs containing results from
   // previous sessions (with |request_id| < |current_session_id_|) to be easily
   // identified and ignored.
-  int current_session_id_;
+  int current_session_id_ = kInvalidId;
 
   // The current find request.
   FindRequest current_request_;
@@ -290,13 +290,13 @@ class CONTENT_EXPORT FindRequestManager {
 
   // The frame (if any) that is still expected to reply to the last pending
   // "find next" request.
-  RenderFrameHost* pending_find_next_reply_;
+  RenderFrameHost* pending_find_next_reply_ = nullptr;
 
   // Indicates whether an update to the active match ordinal is expected. Once
   // set, |pending_active_match_ordinal_| will not reset until an update to the
   // active match ordinal is received in response to the find request with ID
   // |current_request_.id| (the latest request).
-  bool pending_active_match_ordinal_;
+  bool pending_active_match_ordinal_ = false;
 
   // The FindInPageClient associated with each frame. There will necessarily be
   // entries in this map for every frame that is being (or has been) searched in
@@ -307,16 +307,16 @@ class CONTENT_EXPORT FindRequestManager {
   // The total number of matches found in the current find-in-page session. This
   // should always be equal to the sum of all the entries in
   // |matches_per_frame_|.
-  int number_of_matches_;
+  int number_of_matches_ = 0;
 
   // The frame containing the active match, if one exists, or nullptr otherwise.
-  RenderFrameHostImpl* active_frame_;
+  RenderFrameHostImpl* active_frame_ = nullptr;
 
   // The active match ordinal relative to the matches found in its own frame.
-  int relative_active_match_ordinal_;
+  int relative_active_match_ordinal_ = 0;
 
   // The overall active match ordinal for the current find-in-page session.
-  int active_match_ordinal_;
+  int active_match_ordinal_ = 0;
 
   // The rectangle around the active match, in screen coordinates.
   gfx::Rect selection_rect_;
@@ -327,7 +327,7 @@ class CONTENT_EXPORT FindRequestManager {
 
   // Keeps track of the find request ID of the last find reply reported via
   // NotifyFindReply().
-  int last_reported_id_;
+  int last_reported_id_ = kInvalidId;
 
   // WebContentsObservers to observe frame changes in |contents_| and its inner
   // WebContentses.
diff --git a/chromium/content/browser/find_request_manager_browsertest.cc b/chromium/content/browser/find_request_manager_browsertest.cc
index b8f22c30aae..b07c002d049 100644
--- a/chromium/content/browser/find_request_manager_browsertest.cc
+++ b/chromium/content/browser/find_request_manager_browsertest.cc
@@ -60,7 +60,8 @@ class FindRequestManagerTest : public ContentBrowserTest,
   // Navigates to |url| and waits for it to finish loading.
   void LoadAndWait(const std::string& url) {
     TestNavigationObserver navigation_observer(contents());
-    NavigateToURL(shell(), embedded_test_server()->GetURL("a.com", url));
+    EXPECT_TRUE(
+        NavigateToURL(shell(), embedded_test_server()->GetURL("a.com", url)));
     ASSERT_TRUE(navigation_observer.last_navigation_succeeded());
   }
 
@@ -429,7 +430,7 @@ IN_PROC_BROWSER_TEST_P(FindRequestManagerTest, DISABLED_AddFrame) {
 // matches.
 IN_PROC_BROWSER_TEST_F(FindRequestManagerTest, MAYBE(AddFrameAfterNoMatches)) {
   TestNavigationObserver navigation_observer(contents());
-  NavigateToURL(shell(), GURL("about:blank"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
   EXPECT_TRUE(navigation_observer.last_navigation_succeeded());
 
   auto default_options = blink::mojom::FindOptions::New();
@@ -622,7 +623,7 @@ IN_PROC_BROWSER_TEST_F(FindRequestManagerTest, DetachFrameWithMatch) {
 
 IN_PROC_BROWSER_TEST_F(FindRequestManagerTest, MAYBE(FindInPage_Issue644448)) {
   TestNavigationObserver navigation_observer(contents());
-  NavigateToURL(shell(), GURL("about:blank"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
   EXPECT_TRUE(navigation_observer.last_navigation_succeeded());
 
   auto default_options = blink::mojom::FindOptions::New();
@@ -844,4 +845,63 @@ IN_PROC_BROWSER_TEST_P(FindRequestManagerTest, ActivateNearestFindMatch) {
 }
 #endif  // defined(OS_ANDROID)
 
+// Test basic find-in-page functionality after going back and forth to the same
+// page. In particular, find-in-page should continue to work after going back to
+// a page using the back-forward cache.
+IN_PROC_BROWSER_TEST_P(FindRequestManagerTest, HistoryBackAndForth) {
+  GURL url_a = embedded_test_server()->GetURL("a.com", "/find_in_page.html");
+  GURL url_b = embedded_test_server()->GetURL("b.com", "/find_in_page.html");
+
+  auto test_page = [&] {
+    if (GetParam())
+      MakeChildFrameCrossProcess();
+
+    auto options = blink::mojom::FindOptions::New();
+
+    // The initial find-in-page request.
+    Find("result", options->Clone());
+    delegate()->WaitForFinalReply();
+
+    FindResults results = delegate()->GetFindResults();
+    EXPECT_EQ(last_request_id(), results.request_id);
+    EXPECT_EQ(19, results.number_of_matches);
+
+    // Iterate forward/backward over a few elements.
+    int match_index = results.active_match_ordinal;
+    for (int delta : {-1, -1, +1, +1, +1, +1, -1, +1, +1}) {
+      options->find_next = true;
+      options->forward = delta > 0;
+      // |active_match_ordinal| uses 1-based index. It belongs to [1, 19].
+      match_index += delta;
+      match_index = (match_index + 18) % 19 + 1;
+
+      Find("result", options->Clone());
+      delegate()->WaitForFinalReply();
+      results = delegate()->GetFindResults();
+
+      EXPECT_EQ(last_request_id(), results.request_id);
+      EXPECT_EQ(19, results.number_of_matches);
+      EXPECT_EQ(match_index, results.active_match_ordinal);
+    }
+  };
+
+  // 1) Navigate to A.
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  test_page();
+
+  // 2) Navigate to B.
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+  test_page();
+
+  // 3) Go back to A.
+  contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  test_page();
+
+  // 4) Go forward to B.
+  contents()->GetController().GoForward();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  test_page();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc b/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
index 18e63dfaec0..4433a860c13 100644
--- a/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
+++ b/chromium/content/browser/font_unique_name_lookup/font_unique_name_browsertest.cc
@@ -150,7 +150,8 @@ class FontUniqueNameBrowserTest : public DevToolsProtocolTest {
     ASSERT_TRUE(embedded_test_server()->Start());
     TestNavigationObserver navigation_observer(
         static_cast<WebContentsImpl*>(shell()->web_contents()));
-    NavigateToURL(shell(), embedded_test_server()->GetURL("a.com", url));
+    EXPECT_TRUE(
+        NavigateToURL(shell(), embedded_test_server()->GetURL("a.com", url)));
     ASSERT_TRUE(navigation_observer.last_navigation_succeeded());
   }
 
diff --git a/chromium/content/browser/frame_host/ancestor_throttle.cc b/chromium/content/browser/frame_host/ancestor_throttle.cc
index 2045100270c..361ac112996 100644
--- a/chromium/content/browser/frame_host/ancestor_throttle.cc
+++ b/chromium/content/browser/frame_host/ancestor_throttle.cc
@@ -10,12 +10,15 @@
 #include "base/strings/stringprintf.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
+#include "content/common/content_security_policy/csp_context.h"
+#include "content/common/content_security_policy/csp_source_list.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "net/http/http_response_headers.h"
+#include "services/network/public/cpp/content_security_policy.h"
+#include "services/network/public/cpp/features.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "url/origin.h"
 
@@ -133,17 +136,48 @@ NavigationThrottle::ThrottleCheckResult AncestorThrottle::ProcessResponseImpl(
     LoggingDisposition logging) {
   DCHECK(!navigation_handle()->IsInMainFrame());
 
-  NavigationHandleImpl* handle =
-      static_cast<NavigationHandleImpl*>(navigation_handle());
+  NavigationRequest* request = NavigationRequest::From(navigation_handle());
 
   // Downloads should be exempt from checking for X-Frame-Options, so
   // proceed if this is a download.
-  if (handle->IsDownload())
+  if (request->IsDownload())
     return NavigationThrottle::PROCEED;
 
+  // Evaluate whether the navigation should be allowed or blocked based on
+  // existing content-security-policy on the response.
+  if (base::FeatureList::IsEnabled(
+          network::features::kOutOfBlinkFrameAncestors)) {
+    if (network::mojom::ContentSecurityPolicyPtr policy =
+            request->response()->head.content_security_policy) {
+      if (auto& frame_ancestors = policy->frame_ancestors) {
+        CSPSourceList frame_ancestors_list(*frame_ancestors);
+        frame_ancestors_list.allow_response_redirects = true;
+        FrameTreeNode* parent = request->frame_tree_node()->parent();
+        // Since the navigation hasn't committed yet, we need to create a
+        // CSPContext for the navigation handle.
+        CSPContext csp_context;
+        csp_context.SetSelf(url::Origin::Create(navigation_handle()->GetURL()));
+        while (parent) {
+          if (CSPSourceList::Allow(frame_ancestors_list,
+                                   parent->current_frame_host()
+                                       ->GetLastCommittedOrigin()
+                                       .GetURL(),
+                                   &csp_context,
+                                   false /* has_followed_redirect */,
+                                   true /* is_response_check) */)) {
+            parent = parent->parent();
+            continue;
+          }
+          return NavigationThrottle::BLOCK_RESPONSE;
+        }
+        return NavigationThrottle::PROCEED;
+      }
+    }
+  }
+
   std::string header_value;
   HeaderDisposition disposition =
-      ParseHeader(handle->GetResponseHeaders(), &header_value);
+      ParseHeader(request->GetResponseHeaders(), &header_value);
 
   switch (disposition) {
     case HeaderDisposition::CONFLICT:
@@ -167,7 +201,7 @@ NavigationThrottle::ThrottleCheckResult AncestorThrottle::ProcessResponseImpl(
 
     case HeaderDisposition::SAMEORIGIN: {
       // Block the request when any ancestor is not same-origin.
-      FrameTreeNode* parent = handle->frame_tree_node()->parent();
+      FrameTreeNode* parent = request->frame_tree_node()->parent();
       url::Origin current_origin =
           url::Origin::Create(navigation_handle()->GetURL());
       while (parent) {
@@ -305,6 +339,8 @@ AncestorThrottle::HeaderDisposition AncestorThrottle::ParseHeader(
   if (result != HeaderDisposition::NONE &&
       result != HeaderDisposition::ALLOWALL &&
       HeadersContainFrameAncestorsCSP(headers)) {
+    DCHECK(!base::FeatureList::IsEnabled(
+        network::features::kOutOfBlinkFrameAncestors));
     // TODO(mkwst): 'frame-ancestors' is currently handled in Blink. We should
     // handle it here instead. Until then, don't block the request, and let
     // Blink handle it. https://crbug.com/555418
diff --git a/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc b/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc
new file mode 100644
index 00000000000..a675c6f927e
--- /dev/null
+++ b/chromium/content/browser/frame_host/ancestor_throttle_browsertest.cc
@@ -0,0 +1,125 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/strings/string_util.h"
+#include "base/test/scoped_feature_list.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "net/base/escape.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "net/test/embedded_test_server/http_response.h"
+#include "net/test/embedded_test_server/request_handler_util.h"
+#include "services/network/public/cpp/features.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+class AncestorThrottleTest : public ContentBrowserTest,
+                             public ::testing::WithParamInterface<bool> {
+ public:
+  AncestorThrottleTest() {}
+
+ protected:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ContentBrowserTest::SetUpCommandLine(command_line);
+
+    if (GetParam()) {
+      feature_list_.InitAndEnableFeature(
+          network::features::kOutOfBlinkFrameAncestors);
+    }
+  }
+
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    ASSERT_TRUE(embedded_test_server()->Start());
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+// Tests that an iframe navigation with frame-anecestors 'none' is blocked.
+IN_PROC_BROWSER_TEST_P(AncestorThrottleTest, FailedCSP) {
+  GURL parent_url(
+      embedded_test_server()->GetURL("foo.com", "/page_with_iframe.html"));
+  GURL iframe_url(
+      embedded_test_server()->GetURL("foo.com", "/frame-ancestors-none.html"));
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  EXPECT_TRUE(NavigateToURL(web_contents, parent_url));
+  EXPECT_TRUE(NavigateIframeToURL(web_contents, "test_iframe", iframe_url));
+
+  // Check that we have an opaque origin, since the frame was blocked.
+  // TODO(lfg): We can't check last_navigation_succeded because of
+  // https://crbug.com/1000804.
+  EXPECT_TRUE(web_contents->GetFrameTree()
+                  ->root()
+                  ->child_at(0)
+                  ->current_frame_host()
+                  ->GetLastCommittedOrigin()
+                  .opaque());
+}
+
+// Tests that redirecting on a forbidden frame-ancestors will still commit if
+// the final response does not have a CSP policy that prevents the navigation.
+IN_PROC_BROWSER_TEST_P(AncestorThrottleTest, RedirectCommitsIfNoCSP) {
+  GURL parent_url(
+      embedded_test_server()->GetURL("foo.com", "/page_with_iframe.html"));
+  GURL iframe_url(
+      embedded_test_server()->GetURL("foo.com", "/redirect301-csp-to-http"));
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  EXPECT_TRUE(NavigateToURL(web_contents, parent_url));
+  EXPECT_TRUE(NavigateIframeToURL(web_contents, "test_iframe", iframe_url));
+
+  // Check that we don't have an opaque origin, since the frame should have
+  // loaded.
+  // TODO(lfg): We can't check last_navigation_succeded because of
+  // https://crbug.com/1000804.
+  EXPECT_FALSE(web_contents->GetFrameTree()
+                   ->root()
+                   ->child_at(0)
+                   ->current_frame_host()
+                   ->GetLastCommittedOrigin()
+                   .opaque());
+}
+
+// Tests that redirecting on a forbidden frame-ancestors will not commit if
+// the final response does have a CSP policy that prevents the navigation.
+IN_PROC_BROWSER_TEST_P(AncestorThrottleTest, RedirectFails) {
+  GURL parent_url(
+      embedded_test_server()->GetURL("foo.com", "/page_with_iframe.html"));
+  GURL iframe_url(embedded_test_server()->GetURL(
+      "foo.com", "/redirect301-csp-to-frame-ancestors-none"));
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  EXPECT_TRUE(NavigateToURL(web_contents, parent_url));
+  EXPECT_TRUE(NavigateIframeToURL(web_contents, "test_iframe", iframe_url));
+
+  // Check that we have an opaque origin, since the frame was blocked.
+  // TODO(lfg): We can't check last_navigation_succeded because of
+  // https://crbug.com/1000804.
+  EXPECT_TRUE(web_contents->GetFrameTree()
+                  ->root()
+                  ->child_at(0)
+                  ->current_frame_host()
+                  ->GetLastCommittedOrigin()
+                  .opaque());
+}
+
+INSTANTIATE_TEST_SUITE_P(, AncestorThrottleTest, ::testing::Bool());
+
+}  // namespace
+
+}  // namespace content
diff --git a/chromium/content/browser/frame_host/ancestor_throttle_unittest.cc b/chromium/content/browser/frame_host/ancestor_throttle_unittest.cc
index e0e86676f0f..d025c1fc94c 100644
--- a/chromium/content/browser/frame_host/ancestor_throttle_unittest.cc
+++ b/chromium/content/browser/frame_host/ancestor_throttle_unittest.cc
@@ -2,10 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "content/browser/frame_host/ancestor_throttle.h"
+
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/memory/ref_counted.h"
-#include "content/browser/frame_host/ancestor_throttle.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/web_contents.h"
diff --git a/chromium/content/browser/frame_host/back_forward_cache.cc b/chromium/content/browser/frame_host/back_forward_cache.cc
deleted file mode 100644
index 98a12acc834..00000000000
--- a/chromium/content/browser/frame_host/back_forward_cache.cc
+++ /dev/null
@@ -1,262 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/back_forward_cache.h"
-
-#include <unordered_set>
-
-#include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/render_frame_host_delegate.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"
-#include "content/common/page_messages.h"
-#include "content/public/common/navigation_policy.h"
-#include "net/http/http_status_code.h"
-#include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
-
-namespace content {
-
-namespace {
-
-using blink::scheduler::WebSchedulerTrackedFeature;
-
-// The number of document the BackForwardCache can hold per tab.
-static constexpr size_t kBackForwardCacheLimit = 3;
-
-// Converts a WebSchedulerTrackedFeature to a bit for use in a bitmask.
-constexpr uint64_t ToFeatureBit(WebSchedulerTrackedFeature feature) {
-  return 1 << static_cast<uint32_t>(feature);
-}
-
-void SetPageFrozenImpl(
-    RenderFrameHostImpl* render_frame_host,
-    bool frozen,
-    std::unordered_set<RenderViewHostImpl*>* render_view_hosts) {
-  RenderViewHostImpl* render_view_host = render_frame_host->render_view_host();
-  // (Un)Freeze the frame's page if it is not (un)frozen yet.
-  if (render_view_hosts->find(render_view_host) == render_view_hosts->end()) {
-    // The state change for bfcache is:
-    // PageHidden -> PageFrozen -> PageResumed -> PageShown.
-    //
-    // See: https://developers.google.com/web/updates/2018/07/page-lifecycle-api
-    int rvh_routing_id = render_view_host->GetRoutingID();
-    if (frozen) {
-      render_view_host->Send(
-          new PageMsg_PutPageIntoBackForwardCache(rvh_routing_id));
-    } else {
-      render_view_host->Send(
-          new PageMsg_RestorePageFromBackForwardCache(rvh_routing_id));
-    }
-    render_view_hosts->insert(render_view_host);
-  }
-  // Recurse on |render_frame_host|'s children.
-  for (size_t index = 0; index < render_frame_host->child_count(); ++index) {
-    RenderFrameHostImpl* child_frame_host =
-        render_frame_host->child_at(index)->current_frame_host();
-    SetPageFrozenImpl(child_frame_host, frozen, render_view_hosts);
-  }
-}
-
-// Recursively checks whether this RenderFrameHost and all child frames
-// can be cached.
-bool CanStoreRenderFrameHost(RenderFrameHostImpl* rfh,
-                             uint64_t disallowed_features) {
-  // For the main frame, we don't check loading at the FrameTreeNode level,
-  // because the FrameTreeNode has already begun loading the page being
-  // navigated to.
-  bool is_loading = rfh->frame_tree_node()->IsMainFrame()
-                        ? rfh->is_loading()
-                        : rfh->frame_tree_node()->IsLoading();
-  if (is_loading)
-    return false;
-
-  // If the rfh has ever granted media access, prevent it from entering cache.
-  // TODO(crbug.com/989379): Consider only blocking when there's an active
-  //                         media stream.
-  if (rfh->was_granted_media_access())
-    return false;
-
-  // Don't cache the page if it uses any disallowed features.
-  // TODO(lowell): Handle races involving scheduler_tracked_features.
-  // One solution could be to listen for changes to scheduler_tracked_features
-  // and if we see a frame in bfcache starting to use something forbidden, evict
-  // it from the bfcache.
-  if (disallowed_features & rfh->scheduler_tracked_features())
-    return false;
-
-  for (size_t i = 0; i < rfh->child_count(); i++) {
-    if (!CanStoreRenderFrameHost(rfh->child_at(i)->current_frame_host(),
-                                 disallowed_features)) {
-      return false;
-    }
-  }
-
-  return true;
-}
-
-uint64_t GetDisallowedFeatures() {
-  // TODO(lowell): Finalize disallowed feature list, and test for each
-  // disallowed feature.
-  constexpr uint64_t kAlwaysDisallowedFeatures =
-      ToFeatureBit(WebSchedulerTrackedFeature::kWebRTC) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kContainsPlugins) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kDedicatedWorkerOrWorklet) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kOutstandingIndexedDBTransaction) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kHasScriptableFramesInMultipleTabs) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kRequestedGeolocationPermission) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kRequestedNotificationsPermission) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kRequestedMIDIPermission) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kRequestedAudioCapturePermission) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kRequestedVideoCapturePermission) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kRequestedSensorsPermission) |
-      ToFeatureBit(
-          WebSchedulerTrackedFeature::kRequestedBackgroundWorkPermission) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kBroadcastChannel) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kIndexedDBConnection) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kWebGL) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kWebVR) |
-      ToFeatureBit(WebSchedulerTrackedFeature::kWebXR);
-
-  uint64_t result = kAlwaysDisallowedFeatures;
-
-  if (!base::FeatureList::IsEnabled(kBackForwardCacheWithServiceWorker)) {
-    result |=
-        ToFeatureBit(WebSchedulerTrackedFeature::kServiceWorkerControlledPage);
-  }
-  return result;
-}
-
-}  // namespace
-
-const base::Feature kBackForwardCacheWithServiceWorker = {
-    "BackForwardCacheWithServiceWorker", base::FEATURE_DISABLED_BY_DEFAULT};
-
-BackForwardCache::BackForwardCache() = default;
-BackForwardCache::~BackForwardCache() = default;
-
-bool BackForwardCache::CanStoreDocument(RenderFrameHostImpl* rfh) {
-  // Use the BackForwardCache only for the main frame.
-  if (rfh->GetParent())
-    return false;
-
-  if (!IsBackForwardCacheEnabled() || is_disabled_for_testing_)
-    return false;
-
-  // Two pages in the same BrowsingInstance can script each other. When a page
-  // can be scripted from outside, it can't enter the BackForwardCache.
-  //
-  // The "RelatedActiveContentsCount" below is compared against 0, not 1. This
-  // is because the |rfh| is not a "current" RenderFrameHost anymore. It is not
-  // "active" itself.
-  //
-  // This check makes sure the old and new document aren't sharing the same
-  // BrowsingInstance.
-  if (rfh->GetSiteInstance()->GetRelatedActiveContentsCount() != 0)
-    return false;
-
-  // Only store documents that have successful http status code.
-  // Note that for error pages, |last_http_status_code| is equal to 0.
-  if (rfh->last_http_status_code() != net::HTTP_OK)
-    return false;
-
-  // Do store main document with non HTTP/HTTPS URL scheme. In particular, this
-  // excludes the new tab page.
-  if (!rfh->GetLastCommittedURL().SchemeIsHTTPOrHTTPS())
-    return false;
-
-  return CanStoreRenderFrameHost(rfh, GetDisallowedFeatures());
-}
-
-void BackForwardCache::StoreDocument(std::unique_ptr<RenderFrameHostImpl> rfh) {
-  DCHECK(CanStoreDocument(rfh.get()));
-
-  rfh->EnterBackForwardCache();
-  render_frame_hosts_.push_front(std::move(rfh));
-
-  // Remove the last recently used document if the BackForwardCache list is
-  // full.
-  if (render_frame_hosts_.size() > kBackForwardCacheLimit) {
-    // TODO(arthursonzogni): Handle RenderFrame deletion appropriately.
-    render_frame_hosts_.pop_back();
-  }
-}
-
-void BackForwardCache::Freeze(RenderFrameHostImpl* main_rfh) {
-  // Several RenderFrameHost can live under the same RenderViewHost.
-  // |frozen_render_view_hosts| keeps track of the ones that freezing has been
-  // applied to.
-  std::unordered_set<RenderViewHostImpl*> frozen_render_view_hosts;
-  SetPageFrozenImpl(main_rfh, /*frozen = */ true, &frozen_render_view_hosts);
-}
-
-void BackForwardCache::Resume(RenderFrameHostImpl* main_rfh) {
-  // |unfrozen_render_view_hosts| keeps track of the ones that resuming has
-  // been applied to.
-  std::unordered_set<RenderViewHostImpl*> unfrozen_render_view_hosts;
-  SetPageFrozenImpl(main_rfh, /*frozen = */ false, &unfrozen_render_view_hosts);
-}
-
-void BackForwardCache::EvictDocument(RenderFrameHostImpl* render_frame_host) {
-  auto matching_rfh = std::find_if(
-      render_frame_hosts_.begin(), render_frame_hosts_.end(),
-      [render_frame_host](std::unique_ptr<RenderFrameHostImpl>& rfh) {
-        return rfh.get() == render_frame_host;
-      });
-
-  DCHECK(matching_rfh != render_frame_hosts_.end());
-  render_frame_hosts_.erase(matching_rfh);
-}
-
-std::unique_ptr<RenderFrameHostImpl> BackForwardCache::RestoreDocument(
-    int navigation_entry_id) {
-  // Select the RenderFrameHostImpl matching the navigation entry.
-  auto matching_rfh = std::find_if(
-      render_frame_hosts_.begin(), render_frame_hosts_.end(),
-      [navigation_entry_id](std::unique_ptr<RenderFrameHostImpl>& rfh) {
-        return rfh->nav_entry_id() == navigation_entry_id;
-      });
-
-  // Not found.
-  if (matching_rfh == render_frame_hosts_.end())
-    return nullptr;
-
-  std::unique_ptr<RenderFrameHostImpl> rfh = std::move(*matching_rfh);
-  render_frame_hosts_.erase(matching_rfh);
-  rfh->LeaveBackForwardCache();
-  return rfh;
-}
-
-void BackForwardCache::Flush() {
-  render_frame_hosts_.clear();
-}
-
-void BackForwardCache::DisableForTesting(DisableForTestingReason reason) {
-  is_disabled_for_testing_ = true;
-
-  // This could happen if a test populated some pages in the cache, then
-  // called DisableForTesting(). This is not something we currently expect tests
-  // to do.
-  DCHECK(render_frame_hosts_.empty());
-}
-
-RenderFrameHostImpl* BackForwardCache::GetDocument(int navigation_entry_id) {
-  auto matching_rfh = std::find_if(
-      render_frame_hosts_.begin(), render_frame_hosts_.end(),
-      [navigation_entry_id](std::unique_ptr<RenderFrameHostImpl>& rfh) {
-        return rfh->nav_entry_id() == navigation_entry_id;
-      });
-
-  if (matching_rfh == render_frame_hosts_.end())
-    return nullptr;
-
-  return (*matching_rfh).get();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/back_forward_cache.h b/chromium/content/browser/frame_host/back_forward_cache.h
deleted file mode 100644
index 5ce3d407fe4..00000000000
--- a/chromium/content/browser/frame_host/back_forward_cache.h
+++ /dev/null
@@ -1,138 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_FRAME_HOST_BACK_FORWARD_CACHE_H_
-#define CONTENT_BROWSER_FRAME_HOST_BACK_FORWARD_CACHE_H_
-
-#include <list>
-#include <memory>
-
-#include "base/feature_list.h"
-#include "base/macros.h"
-#include "content/common/content_export.h"
-
-namespace content {
-
-class RenderFrameHostImpl;
-
-// BackForwardCache:
-//
-// After the user navigates away from a document, the old one goes into the
-// frozen state and is kept in this object. They can potentially be reused
-// after an history navigation. Reusing a document means swapping it back with
-// the current_frame_host.
-class CONTENT_EXPORT BackForwardCache {
- public:
-  BackForwardCache();
-  ~BackForwardCache();
-
-  // Returns true when a RenderFrameHost can be stored into the
-  // BackForwardCache. Depends on the |render_frame_host| and its children's
-  // state.
-  bool CanStoreDocument(RenderFrameHostImpl* render_frame_host);
-
-  // Moves |rfh| into the BackForwardCache. It can be reused in
-  // a future history navigation by using RestoreDocument(). When the
-  // BackForwardCache is full, the least recently used document is evicted.
-  // Precondition: CanStoreDocument(render_frame_host).
-  void StoreDocument(std::unique_ptr<RenderFrameHostImpl> rfh);
-
-  // Iterates over all the RenderViewHost inside |main_rfh| and freeze or
-  // resume them.
-  static void Freeze(RenderFrameHostImpl* main_rfh);
-  static void Resume(RenderFrameHostImpl* main_rfh);
-
-  // Returns a pointer to a cached RenderFrameHost matching
-  // |navigation_entry_id| if it exists in the BackForwardCache. Returns nullptr
-  // if no matching document is found.
-  //
-  // Note: The returned pointer should be used temporarily only within the
-  // execution of a single task on the event loop. Beyond that, there is no
-  // guarantee the pointer will be valid, because the document may be
-  // removed/evicted from the cache.
-  RenderFrameHostImpl* GetDocument(int navigation_entry_id);
-
-  // Remove a document from the BackForwardCache.
-  void EvictDocument(RenderFrameHostImpl* render_frame_host);
-
-  // During a history navigation, move a document out of the BackForwardCache
-  // knowing its |navigation_entry_id|. Returns nullptr when none is found.
-  std::unique_ptr<RenderFrameHostImpl> RestoreDocument(int navigation_entry_id);
-
-  // Remove all entries from the BackForwardCache.
-  void Flush();
-
-  // List of reasons the BackForwardCache was disabled for a specific test. If a
-  // test needs to be disabled for a reason not covered below, please add to
-  // this enum.
-  enum DisableForTestingReason {
-    // The test has expectations that won't make sense if caching is enabled.
-    //
-    // One alternative to disabling the test is to make the test's logic
-    // conditional, based on whether or not BackForwardCache is enabled.
-    //
-    // You should also consider whether it would make sense to instead
-    // split into two tests, one using a cacheable page, and one using an
-    // uncacheable page.
-    //
-    // Once BackForwardCache is enabled everywhere, any tests still disabled for
-    // this reason should change their expectations to permanently match the
-    // BackForwardCache enabled behavior.
-    TEST_ASSUMES_NO_CACHING,
-
-    // Unload events never fire for documents that are put into the
-    // BackForwardCache. This is by design, as there is never an appropriate
-    // moment to fire unload if the document is cached.
-    // In short, this is because:
-    //
-    // * We can't fire unload when going into the cache, because it may be
-    // destructive, and put the document into an unknown/bad state. Pages can
-    // also be cached and restored multiple times, and we don't want to invoke
-    // unload more than once.
-    //
-    // * We can't fire unload when the document is evicted from the cache,
-    // because at that point we don't want to run javascript for privacy and
-    // security reasons.
-    //
-    // An alternative to disabling the test, is to have the test load a page
-    // that is ineligible for caching (e.g. due to an unsupported feature).
-    TEST_USES_UNLOAD_EVENT,
-  };
-
-  // Disables the BackForwardCache so that no documents will be stored/served.
-  // This allows tests to "force" not using the BackForwardCache, this can be
-  // useful when:
-  // * Tests rely on a new document being loaded.
-  // * Tests want to test this case specifically.
-  // Callers should pass an accurate |reason| to make future triaging of
-  // disabled tests easier.
-  //
-  // Note: It's preferable to make tests BackForwardCache compatible
-  // when feasible, rather than using this method. Also please consider whether
-  // you actually should have 2 tests, one with the document cached
-  // (BackForwardCache enabled), and one without.
-  void DisableForTesting(DisableForTestingReason reason);
-
- private:
-  // Contains the set of stored RenderFrameHost.
-  // Invariant:
-  // - Ordered from the most recently used to the last recently used.
-  // - Once the list is full, the least recently used document is evicted.
-  std::list<std::unique_ptr<RenderFrameHostImpl>> render_frame_hosts_;
-
-  // Whether the BackforwardCached has been disabled for testing.
-  bool is_disabled_for_testing_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(BackForwardCache);
-};
-
-// TODO(crbug.com/991082): We need to implement frozen frame enumeration
-// before we can properly support pages with ServiceWorker in back-forward
-// cache. This flag allows to bypass this restriction for local testing.
-// Remove after ServiceWorker support is implemented.
-CONTENT_EXPORT extern const base::Feature kBackForwardCacheWithServiceWorker;
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_FRAME_HOST_BACK_FORWARD_CACHE_H_
diff --git a/chromium/content/browser/frame_host/back_forward_cache_impl.cc b/chromium/content/browser/frame_host/back_forward_cache_impl.cc
new file mode 100644
index 00000000000..48c73cf9e90
--- /dev/null
+++ b/chromium/content/browser/frame_host/back_forward_cache_impl.cc
@@ -0,0 +1,524 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/frame_host/back_forward_cache_impl.h"
+
+#include <algorithm>
+#include <string>
+
+#include "base/metrics/field_trial_params.h"
+#include "base/strings/string_split.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/render_frame_host_delegate.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/frame_host/render_frame_proxy_host.h"
+#include "content/browser/renderer_host/render_view_host_impl.h"
+#include "content/common/page_messages.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/navigation_policy.h"
+#include "net/http/http_request_headers.h"
+#include "net/http/http_status_code.h"
+#include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
+
+namespace content {
+
+namespace {
+
+using blink::scheduler::WebSchedulerTrackedFeature;
+
+// Removes the time limit for cached content. This is used on bots to identify
+// accidentally passing tests.
+const base::Feature kBackForwardCacheNoTimeEviction{
+    "BackForwardCacheNoTimeEviction", base::FEATURE_DISABLED_BY_DEFAULT};
+
+// The number of entries the BackForwardCache can hold per tab.
+static constexpr size_t kBackForwardCacheLimit = 1;
+
+// The default time to live in seconds for documents in BackForwardCache.
+static constexpr int kDefaultTimeToLiveInBackForwardCacheInSeconds = 15;
+
+// Converts a WebSchedulerTrackedFeature to a bit for use in a bitmask.
+constexpr uint64_t ToFeatureBit(WebSchedulerTrackedFeature feature) {
+  return 1ull << static_cast<uint32_t>(feature);
+}
+
+void SetPageFrozenImpl(
+    RenderFrameHostImpl* render_frame_host,
+    bool frozen,
+    std::unordered_set<RenderViewHostImpl*>* render_view_hosts) {
+  RenderViewHostImpl* render_view_host = render_frame_host->render_view_host();
+  // (Un)Freeze the frame's page if it is not (un)frozen yet.
+  if (render_view_hosts->find(render_view_host) == render_view_hosts->end()) {
+    // The state change for bfcache is:
+    // PageHidden -> PageFrozen -> PageResumed -> PageShown.
+    //
+    // See: https://developers.google.com/web/updates/2018/07/page-lifecycle-api
+    int rvh_routing_id = render_view_host->GetRoutingID();
+    // TODO(dcheng): Page messages should be used in conjunction with
+    // SendPageMessage(). Having it used to directly route a message to a
+    // RenderView is somewhat unusual. Figure out why this is needed.
+    if (frozen) {
+      render_view_host->Send(
+          new PageMsg_PutPageIntoBackForwardCache(rvh_routing_id));
+    } else {
+      render_view_host->Send(
+          new PageMsg_RestorePageFromBackForwardCache(rvh_routing_id));
+    }
+    render_view_hosts->insert(render_view_host);
+  }
+  // Recurse on |render_frame_host|'s children.
+  for (size_t index = 0; index < render_frame_host->child_count(); ++index) {
+    RenderFrameHostImpl* child_frame_host =
+        render_frame_host->child_at(index)->current_frame_host();
+    SetPageFrozenImpl(child_frame_host, frozen, render_view_hosts);
+  }
+}
+
+bool IsServiceWorkerSupported() {
+  static constexpr base::FeatureParam<bool> service_worker_supported(
+      &features::kBackForwardCache, "service_worker_supported", false);
+  return service_worker_supported.Get();
+}
+
+uint64_t GetDisallowedFeatures() {
+  // TODO(lowell): Finalize disallowed feature list, and test for each
+  // disallowed feature.
+  constexpr uint64_t kAlwaysDisallowedFeatures =
+      ToFeatureBit(WebSchedulerTrackedFeature::kWebRTC) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kContainsPlugins) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kDedicatedWorkerOrWorklet) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kOutstandingNetworkRequest) |
+      ToFeatureBit(
+          WebSchedulerTrackedFeature::kOutstandingIndexedDBTransaction) |
+      ToFeatureBit(
+          WebSchedulerTrackedFeature::kHasScriptableFramesInMultipleTabs) |
+      ToFeatureBit(
+          WebSchedulerTrackedFeature::kRequestedNotificationsPermission) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kRequestedMIDIPermission) |
+      ToFeatureBit(
+          WebSchedulerTrackedFeature::kRequestedAudioCapturePermission) |
+      ToFeatureBit(
+          WebSchedulerTrackedFeature::kRequestedVideoCapturePermission) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kRequestedSensorsPermission) |
+      ToFeatureBit(
+          WebSchedulerTrackedFeature::kRequestedBackgroundWorkPermission) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kBroadcastChannel) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kIndexedDBConnection) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kWebGL) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kWebVR) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kWebXR) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kSharedWorker) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kWebXR) |
+      ToFeatureBit(WebSchedulerTrackedFeature::kWebLocks);
+
+  uint64_t result = kAlwaysDisallowedFeatures;
+
+  if (!IsServiceWorkerSupported()) {
+    result |=
+        ToFeatureBit(WebSchedulerTrackedFeature::kServiceWorkerControlledPage);
+  }
+  return result;
+}
+
+std::string DescribeFeatures(uint64_t blocklisted_features) {
+  std::vector<std::string> features;
+  for (size_t i = 0;
+       i <= static_cast<size_t>(WebSchedulerTrackedFeature::kMaxValue); ++i) {
+    if (blocklisted_features & (1 << i)) {
+      features.push_back(blink::scheduler::FeatureToString(
+          static_cast<WebSchedulerTrackedFeature>(i)));
+    }
+  }
+  return base::JoinString(features, ", ");
+}
+
+// The BackForwardCache feature is controlled via an experiment. This function
+// returns the allowed URLs where it is enabled. To enter the BackForwardCache
+// the URL of a document must have a host and a path matching with at least
+// one URL in this map. We represent/format the string associated with
+// parameter as comma separated urls.
+std::map<std::string, std::vector<std::string>> SetAllowedURLs() {
+  std::map<std::string, std::vector<std::string>> allowed_urls;
+  for (auto& it :
+       base::SplitString(base::GetFieldTrialParamValueByFeature(
+                             features::kBackForwardCache, "allowed_websites"),
+                         ",", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL)) {
+    GURL url = GURL(it);
+    allowed_urls[url.host()].emplace_back(url.path());
+  }
+  return allowed_urls;
+}
+
+BackForwardCacheTestDelegate* g_bfcache_disabled_test_observer = nullptr;
+
+}  // namespace
+
+BackForwardCacheImpl::Entry::Entry(
+    std::unique_ptr<RenderFrameHostImpl> rfh,
+    RenderFrameProxyHostMap proxies,
+    std::set<RenderViewHostImpl*> render_view_hosts)
+    : render_frame_host(std::move(rfh)),
+      proxy_hosts(std::move(proxies)),
+      render_view_hosts(std::move(render_view_hosts)) {}
+BackForwardCacheImpl::Entry::~Entry() {}
+
+std::string BackForwardCacheImpl::CanStoreDocumentResult::ToString() {
+  using Reason = BackForwardCacheMetrics::CanNotStoreDocumentReason;
+
+  if (can_store)
+    return "Yes";
+
+  switch (reason.value()) {
+    case Reason::kNotMainFrame:
+      return "No: not a main frame";
+    case Reason::kBackForwardCacheDisabled:
+      return "No: BackForwardCache disabled";
+    case Reason::kRelatedActiveContentsExist:
+      return "No: related active contents exist";
+    case Reason::kHTTPStatusNotOK:
+      return "No: HTTP status is not OK";
+    case Reason::kSchemeNotHTTPOrHTTPS:
+      return "No: scheme is not HTTP or HTTPS";
+    case Reason::kLoading:
+      return "No: frame is not fully loaded";
+    case Reason::kWasGrantedMediaAccess:
+      return "No: frame was granted microphone or camera access";
+    case Reason::kBlocklistedFeatures:
+      return "No: blocklisted features: " +
+             DescribeFeatures(blocklisted_features);
+    case Reason::kDisableForRenderFrameHostCalled:
+      return "No: BackForwardCache::DisableForRenderFrameHost() was called";
+    case Reason::kDomainNotAllowed:
+      return "No: This domain is not allowed to be stored in BackForwardCache";
+    case Reason::kHTTPMethodNotGET:
+      return "No: HTTP method is not GET";
+  }
+}
+
+BackForwardCacheImpl::CanStoreDocumentResult::CanStoreDocumentResult(
+    const CanStoreDocumentResult&) = default;
+BackForwardCacheImpl::CanStoreDocumentResult::~CanStoreDocumentResult() =
+    default;
+
+BackForwardCacheImpl::CanStoreDocumentResult
+BackForwardCacheImpl::CanStoreDocumentResult::Yes() {
+  return CanStoreDocumentResult(true, base::nullopt, 0);
+}
+
+BackForwardCacheImpl::CanStoreDocumentResult
+BackForwardCacheImpl::CanStoreDocumentResult::No(
+    BackForwardCacheMetrics::CanNotStoreDocumentReason reason) {
+  return CanStoreDocumentResult(false, reason, 0);
+}
+
+BackForwardCacheImpl::CanStoreDocumentResult
+BackForwardCacheImpl::CanStoreDocumentResult::NoDueToFeatures(
+    uint64_t blocklisted_features) {
+  return CanStoreDocumentResult(
+      false,
+      BackForwardCacheMetrics::CanNotStoreDocumentReason::kBlocklistedFeatures,
+      blocklisted_features);
+}
+
+BackForwardCacheImpl::CanStoreDocumentResult::CanStoreDocumentResult(
+    bool can_store,
+    base::Optional<BackForwardCacheMetrics::CanNotStoreDocumentReason> reason,
+    uint64_t blocklisted_features)
+    : can_store(can_store),
+      reason(reason),
+      blocklisted_features(blocklisted_features) {}
+
+BackForwardCacheTestDelegate::BackForwardCacheTestDelegate() {
+  DCHECK(!g_bfcache_disabled_test_observer);
+  g_bfcache_disabled_test_observer = this;
+}
+
+BackForwardCacheTestDelegate::~BackForwardCacheTestDelegate() {
+  DCHECK_EQ(g_bfcache_disabled_test_observer, this);
+  g_bfcache_disabled_test_observer = nullptr;
+}
+
+BackForwardCacheImpl::BackForwardCacheImpl()
+    : allowed_urls_(SetAllowedURLs()), weak_factory_(this) {}
+BackForwardCacheImpl::~BackForwardCacheImpl() = default;
+
+base::TimeDelta BackForwardCacheImpl::GetTimeToLiveInBackForwardCache() {
+  // We use the following order of priority if multiple values exist:
+  // - The programmatical value set in params. Used in specific tests.
+  // - Infinite if kBackForwardCacheNoTimeEviction is enabled.
+  // - Default value otherwise, kDefaultTimeToLiveInBackForwardCacheInSeconds.
+  if (base::FeatureList::IsEnabled(kBackForwardCacheNoTimeEviction) &&
+      GetFieldTrialParamValueByFeature(features::kBackForwardCache,
+                                       "TimeToLiveInBackForwardCacheInSeconds")
+          .empty()) {
+    return base::TimeDelta::Max();
+  }
+
+  return base::TimeDelta::FromSeconds(base::GetFieldTrialParamByFeatureAsInt(
+      features::kBackForwardCache, "TimeToLiveInBackForwardCacheInSeconds",
+      kDefaultTimeToLiveInBackForwardCacheInSeconds));
+}
+
+BackForwardCacheImpl::CanStoreDocumentResult
+BackForwardCacheImpl::CanStoreDocument(RenderFrameHostImpl* rfh) {
+  // Use the BackForwardCache only for the main frame.
+  if (rfh->GetParent()) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::kNotMainFrame);
+  }
+
+  if (!IsBackForwardCacheEnabled() || is_disabled_for_testing_) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::
+            kBackForwardCacheDisabled);
+  }
+
+  // Two pages in the same BrowsingInstance can script each other. When a page
+  // can be scripted from outside, it can't enter the BackForwardCache.
+  //
+  // The "RelatedActiveContentsCount" below is compared against 0, not 1. This
+  // is because the |rfh| is not a "current" RenderFrameHost anymore. It is not
+  // "active" itself.
+  //
+  // This check makes sure the old and new document aren't sharing the same
+  // BrowsingInstance.
+  if (rfh->GetSiteInstance()->GetRelatedActiveContentsCount() != 0) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::
+            kRelatedActiveContentsExist);
+  }
+
+  // Only store documents that have successful http status code.
+  // Note that for error pages, |last_http_status_code| is equal to 0.
+  if (rfh->last_http_status_code() != net::HTTP_OK) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::kHTTPStatusNotOK);
+  }
+
+  // Only store documents that were fetched via HTTP GET method.
+  if (rfh->last_http_method() != net::HttpRequestHeaders::kGetMethod) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::kHTTPMethodNotGET);
+  }
+
+  // Do not store main document with non HTTP/HTTPS URL scheme. In particular,
+  // this excludes the new tab page.
+  if (!rfh->GetLastCommittedURL().SchemeIsHTTPOrHTTPS()) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::
+            kSchemeNotHTTPOrHTTPS);
+  }
+
+  // Only store documents that have URLs allowed through experiment.
+  if (!IsAllowed(rfh->GetLastCommittedURL())) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::kDomainNotAllowed);
+  }
+
+  return CanStoreRenderFrameHost(rfh, GetDisallowedFeatures());
+}
+
+// Recursively checks whether this RenderFrameHost and all child frames
+// can be cached.
+BackForwardCacheImpl::CanStoreDocumentResult
+BackForwardCacheImpl::CanStoreRenderFrameHost(RenderFrameHostImpl* rfh,
+                                              uint64_t disallowed_features) {
+  if (!rfh->dom_content_loaded())
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::kLoading);
+
+  // If the rfh has ever granted media access, prevent it from entering cache.
+  // TODO(crbug.com/989379): Consider only blocking when there's an active
+  //                         media stream.
+  if (rfh->was_granted_media_access()) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::
+            kWasGrantedMediaAccess);
+  }
+
+  if (rfh->is_back_forward_cache_disallowed()) {
+    return CanStoreDocumentResult::No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason::
+            kDisableForRenderFrameHostCalled);
+  }
+
+  // Don't cache the page if it uses any disallowed features.
+  // TODO(altimin): At the moment only the first detected failure is reported.
+  // For reporting purposes it's a good idea to also collect this information
+  // from children.
+  if (uint64_t banned_features =
+          disallowed_features & rfh->scheduler_tracked_features()) {
+    return CanStoreDocumentResult::NoDueToFeatures(banned_features);
+  }
+
+  for (size_t i = 0; i < rfh->child_count(); i++) {
+    CanStoreDocumentResult can_store_child = CanStoreRenderFrameHost(
+        rfh->child_at(i)->current_frame_host(), disallowed_features);
+    if (!can_store_child.can_store)
+      return can_store_child;
+  }
+
+  return CanStoreDocumentResult::Yes();
+}
+
+void BackForwardCacheImpl::StoreEntry(
+    std::unique_ptr<BackForwardCacheImpl::Entry> entry) {
+  TRACE_EVENT0("navigation", "BackForwardCache::StoreEntry");
+  DCHECK(CanStoreDocument(entry->render_frame_host.get()));
+
+  entry->render_frame_host->EnterBackForwardCache();
+  entries_.push_front(std::move(entry));
+
+  size_t size_limit = cache_size_limit_for_testing_
+                          ? cache_size_limit_for_testing_
+                          : kBackForwardCacheLimit;
+  // Evict the least recently used documents if the BackForwardCache list is
+  // full.
+  size_t available_count = 0;
+  for (auto& stored_entry : entries_) {
+    if (stored_entry->render_frame_host->is_evicted_from_back_forward_cache())
+      continue;
+    if (++available_count > size_limit) {
+      stored_entry->render_frame_host->EvictFromBackForwardCacheWithReason(
+          BackForwardCacheMetrics::EvictedReason::kCacheLimit);
+    }
+  }
+}
+
+void BackForwardCacheImpl::Freeze(RenderFrameHostImpl* main_rfh) {
+  // Several RenderFrameHost can live under the same RenderViewHost.
+  // |frozen_render_view_hosts| keeps track of the ones that freezing has been
+  // applied to.
+  std::unordered_set<RenderViewHostImpl*> frozen_render_view_hosts;
+  SetPageFrozenImpl(main_rfh, /*frozen = */ true, &frozen_render_view_hosts);
+}
+
+void BackForwardCacheImpl::Resume(RenderFrameHostImpl* main_rfh) {
+  // |unfrozen_render_view_hosts| keeps track of the ones that resuming has
+  // been applied to.
+  std::unordered_set<RenderViewHostImpl*> unfrozen_render_view_hosts;
+  SetPageFrozenImpl(main_rfh, /*frozen = */ false, &unfrozen_render_view_hosts);
+}
+
+std::unique_ptr<BackForwardCacheImpl::Entry> BackForwardCacheImpl::RestoreEntry(
+    int navigation_entry_id) {
+  TRACE_EVENT0("navigation", "BackForwardCache::RestoreEntry");
+  // Select the RenderFrameHostImpl matching the navigation entry.
+  auto matching_entry = std::find_if(
+      entries_.begin(), entries_.end(),
+      [navigation_entry_id](std::unique_ptr<Entry>& entry) {
+        return entry->render_frame_host->nav_entry_id() == navigation_entry_id;
+      });
+
+  // Not found.
+  if (matching_entry == entries_.end())
+    return nullptr;
+
+  // Don't restore an evicted frame.
+  if ((*matching_entry)
+          ->render_frame_host->is_evicted_from_back_forward_cache())
+    return nullptr;
+
+  std::unique_ptr<Entry> entry = std::move(*matching_entry);
+  entries_.erase(matching_entry);
+  entry->render_frame_host->LeaveBackForwardCache();
+  return entry;
+}
+
+void BackForwardCacheImpl::Flush() {
+  TRACE_EVENT0("navigation", "BackForwardCache::Flush");
+  entries_.clear();
+}
+
+void BackForwardCacheImpl::PostTaskToDestroyEvictedFrames() {
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&BackForwardCacheImpl::DestroyEvictedFrames,
+                                weak_factory_.GetWeakPtr()));
+}
+
+// static
+void BackForwardCache::DisableForRenderFrameHost(RenderFrameHost* rfh,
+                                                 base::StringPiece reason) {
+  DisableForRenderFrameHost(
+      static_cast<RenderFrameHostImpl*>(rfh)->GetGlobalFrameRoutingId(),
+      reason);
+}
+
+// static
+void BackForwardCache::DisableForRenderFrameHost(GlobalFrameRoutingId id,
+                                                 base::StringPiece reason) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  if (g_bfcache_disabled_test_observer)
+    g_bfcache_disabled_test_observer->OnDisabledForFrameWithReason(id, reason);
+
+  if (auto* rfh = RenderFrameHostImpl::FromID(id)) {
+    rfh->DisallowBackForwardCache();
+
+    RenderFrameHostImpl* frame = rfh;
+    while (frame->GetParent())
+      frame = frame->GetParent();
+
+    if (BackForwardCacheMetrics* metrics = frame->GetBackForwardCacheMetrics())
+      metrics->MarkDisableForRenderFrameHost(reason);
+  }
+}
+
+void BackForwardCacheImpl::DisableForTesting(DisableForTestingReason reason) {
+  is_disabled_for_testing_ = true;
+
+  // This could happen if a test populated some entries in the cache, then
+  // called DisableForTesting(). This is not something we currently expect tests
+  // to do.
+  DCHECK(entries_.empty());
+}
+
+BackForwardCacheImpl::Entry* BackForwardCacheImpl::GetEntry(
+    int navigation_entry_id) {
+  auto matching_entry = std::find_if(
+      entries_.begin(), entries_.end(),
+      [navigation_entry_id](std::unique_ptr<Entry>& entry) {
+        return entry->render_frame_host->nav_entry_id() == navigation_entry_id;
+      });
+
+  if (matching_entry == entries_.end())
+    return nullptr;
+
+  // Don't return the frame if it is evicted.
+  if ((*matching_entry)
+          ->render_frame_host->is_evicted_from_back_forward_cache())
+    return nullptr;
+
+  return (*matching_entry).get();
+}
+
+void BackForwardCacheImpl::DestroyEvictedFrames() {
+  TRACE_EVENT0("navigation", "BackForwardCache::DestroyEvictedFrames");
+  if (entries_.empty())
+    return;
+  entries_.erase(std::remove_if(
+      entries_.begin(), entries_.end(), [](std::unique_ptr<Entry>& entry) {
+        return entry->render_frame_host->is_evicted_from_back_forward_cache();
+      }));
+}
+
+bool BackForwardCacheImpl::IsAllowed(const GURL& current_url) {
+  // By convention, when |allowed_urls_| is empty, it means there are no
+  // restrictions about what RenderFrameHost can enter the BackForwardCache.
+  if (allowed_urls_.empty())
+    return true;
+
+  // Checking for each url in the |allowed_urls_|, if the current_url matches
+  // the corresponding host and path is the prefix of the allowed url path. We
+  // only check for host and path and not any other components including url
+  // scheme here.
+  const auto& entry = allowed_urls_.find(current_url.host());
+  if (entry != allowed_urls_.end()) {
+    for (auto allowed_path : entry->second) {
+      if (current_url.path_piece().starts_with(allowed_path))
+        return true;
+    }
+  }
+  return false;
+}
+}  // namespace content
diff --git a/chromium/content/browser/frame_host/back_forward_cache_impl.h b/chromium/content/browser/frame_host/back_forward_cache_impl.h
new file mode 100644
index 00000000000..8b272088a59
--- /dev/null
+++ b/chromium/content/browser/frame_host/back_forward_cache_impl.h
@@ -0,0 +1,226 @@
+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_FRAME_HOST_BACK_FORWARD_CACHE_IMPL_H_
+#define CONTENT_BROWSER_FRAME_HOST_BACK_FORWARD_CACHE_IMPL_H_
+
+#include <list>
+#include <memory>
+#include <unordered_map>
+
+#include "base/feature_list.h"
+#include "base/macros.h"
+#include "base/memory/weak_ptr.h"
+#include "base/optional.h"
+#include "base/single_thread_task_runner.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "base/time/time.h"
+#include "content/browser/frame_host/back_forward_cache_metrics.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/back_forward_cache.h"
+#include "content/public/browser/global_routing_id.h"
+#include "url/gurl.h"
+
+namespace content {
+
+class RenderFrameHostImpl;
+class RenderFrameProxyHost;
+class RenderViewHostImpl;
+
+// BackForwardCache:
+//
+// After the user navigates away from a document, the old one goes into the
+// frozen state and is kept in this object. They can potentially be reused
+// after an history navigation. Reusing a document means swapping it back with
+// the current_frame_host.
+class CONTENT_EXPORT BackForwardCacheImpl : public BackForwardCache {
+ public:
+  struct Entry {
+    using RenderFrameProxyHostMap =
+        std::unordered_map<int32_t /* SiteInstance ID */,
+                           std::unique_ptr<RenderFrameProxyHost>>;
+
+    Entry(std::unique_ptr<RenderFrameHostImpl> rfh,
+          RenderFrameProxyHostMap proxy_hosts,
+          std::set<RenderViewHostImpl*> render_view_hosts);
+    ~Entry();
+
+    // The main document being stored.
+    std::unique_ptr<RenderFrameHostImpl> render_frame_host;
+
+    // Proxies of the main document as seen by other processes.
+    // Currently, we only store proxies for SiteInstances of all subframes on
+    // the page, because pages using window.open and nested WebContents are not
+    // cached.
+    RenderFrameProxyHostMap proxy_hosts;
+
+    // RenderViewHosts belonging to the main frame, and its proxies (if any).
+    //
+    // While RenderViewHostImpl(s) are in the BackForwardCache, they aren't
+    // reused for pages outside the cache. This prevents us from having two main
+    // frames, (one in the cache, one live), associated with a single
+    // RenderViewHost.
+    //
+    // Keeping these here also prevents RenderFrameHostManager code from
+    // unwittingly iterating over RenderViewHostImpls that are in the cache.
+    std::set<RenderViewHostImpl*> render_view_hosts;
+
+    DISALLOW_COPY_AND_ASSIGN(Entry);
+  };
+
+  BackForwardCacheImpl();
+  ~BackForwardCacheImpl();
+
+  struct CanStoreDocumentResult {
+    CanStoreDocumentResult(const CanStoreDocumentResult&);
+    ~CanStoreDocumentResult();
+
+    bool can_store;
+    base::Optional<BackForwardCacheMetrics::CanNotStoreDocumentReason> reason;
+    uint64_t blocklisted_features;
+
+    static CanStoreDocumentResult Yes();
+    static CanStoreDocumentResult No(
+        BackForwardCacheMetrics::CanNotStoreDocumentReason reason);
+    static CanStoreDocumentResult NoDueToFeatures(uint64_t features);
+
+    std::string ToString();
+
+    operator bool() const { return can_store; }
+
+   private:
+    CanStoreDocumentResult(
+        bool can_store,
+        base::Optional<BackForwardCacheMetrics::CanNotStoreDocumentReason>
+            reason,
+        uint64_t blocklisted_features);
+  };
+
+  // Returns whether a RenderFrameHost can be stored into the
+  // BackForwardCache. Depends on the |render_frame_host| and its children's
+  // state.
+  CanStoreDocumentResult CanStoreDocument(
+      RenderFrameHostImpl* render_frame_host);
+
+  // Moves the specified BackForwardCache entry into the BackForwardCache. It
+  // can be reused in a future history navigation by using RestoreEntry(). When
+  // the BackForwardCache is full, the least recently used document is evicted.
+  // Precondition: CanStoreDocument(*(entry->render_frame_host)).
+  void StoreEntry(std::unique_ptr<Entry> entry);
+
+  // Iterates over all the RenderViewHost inside |main_rfh| and freeze or
+  // resume them.
+  static void Freeze(RenderFrameHostImpl* main_rfh);
+  static void Resume(RenderFrameHostImpl* main_rfh);
+
+  // Returns a pointer to a cached BackForwardCache entry matching
+  // |navigation_entry_id| if it exists in the BackForwardCache. Returns nullptr
+  // if no matching entry is found.
+  //
+  // Note: The returned pointer should be used temporarily only within the
+  // execution of a single task on the event loop. Beyond that, there is no
+  // guarantee the pointer will be valid, because the document may be
+  // removed/evicted from the cache.
+  Entry* GetEntry(int navigation_entry_id);
+
+  // During a history navigation, moves an entry out of the BackForwardCache
+  // knowing its |navigation_entry_id|. Returns nullptr when none is found.
+  std::unique_ptr<Entry> RestoreEntry(int navigation_entry_id);
+
+  // Remove all entries from the BackForwardCache.
+  void Flush();
+
+  // Posts a task to destroy all frames in the BackForwardCache that have been
+  // marked as evicted.
+  void PostTaskToDestroyEvictedFrames();
+
+  // Storing frames in back-forward cache is not supported indefinitely
+  // due to potential privacy issues and memory leaks. Instead we are evicting
+  // the frame from the cache after the time to live, which can be controlled
+  // via experiment.
+  static base::TimeDelta GetTimeToLiveInBackForwardCache();
+
+  // Returns the task runner that should be used by the eviction timer.
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner() {
+    return task_runner_for_testing_ ? task_runner_for_testing_
+                                    : base::ThreadTaskRunnerHandle::Get();
+  }
+
+  // Inject task runner for precise timing control in browser tests.
+  void SetTaskRunnerForTesting(
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
+    task_runner_for_testing_ = task_runner;
+  }
+
+  // Sets the number of documents that can be stored in the cache. This is meant
+  // for use from within tests only.
+  // If |cache_size_limit_for_testing| is 0 (the default), the normal cache
+  // size limit will be used.
+  void set_cache_size_limit_for_testing(size_t cache_size_limit_for_testing) {
+    cache_size_limit_for_testing_ = cache_size_limit_for_testing;
+  }
+
+  void DisableForTesting(DisableForTestingReason reason) override;
+
+ private:
+  // Destroys all evicted frames in the BackForwardCache.
+  void DestroyEvictedFrames();
+
+  // Helper for recursively checking each child.
+  CanStoreDocumentResult CanStoreRenderFrameHost(
+      RenderFrameHostImpl* render_frame_host,
+      uint64_t disallowed_features);
+
+  // Checks if the url's host and path matches with the |allowed_urls_| host and
+  // path. This is controlled by "allowed_websites" param on BackForwardCache
+  // feature and if the param is not set, it will allow all websites by default.
+  bool IsAllowed(const GURL& current_url);
+
+  // Contains the set of stored Entries.
+  // Invariant:
+  // - Ordered from the most recently used to the last recently used.
+  // - Once the list is full, the least recently used document is evicted.
+  std::list<std::unique_ptr<Entry>> entries_;
+
+  // Only used in tests. Whether the BackforwardCached has been disabled for
+  // testing.
+  bool is_disabled_for_testing_ = false;
+
+  // Only used in tests. If non-zero, this value will be used as the cache size
+  // limit.
+  size_t cache_size_limit_for_testing_ = 0;
+
+  // Only used for tests. This task runner is used for precise injection in
+  // browser tests and for timing control.
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_testing_;
+
+  // To enter the back-forward cache, the main document URL's must match one of
+  // the field trial parameter "allowed_websites". This is represented here by a
+  // set of host and path prefix.
+  std::map<std::string,              // URL's host,
+           std::vector<std::string>  // URL's path prefix
+           >
+      allowed_urls_;
+
+  base::WeakPtrFactory<BackForwardCacheImpl> weak_factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(BackForwardCacheImpl);
+};
+
+// Allow external code to be notified when back-forward cache is disabled for a
+// RenderFrameHost. This should be used only by the testing infrastructure which
+// want to know the exact reason why the cache was disabled. There can be only
+// one observer.
+class CONTENT_EXPORT BackForwardCacheTestDelegate {
+ public:
+  BackForwardCacheTestDelegate();
+  virtual ~BackForwardCacheTestDelegate();
+
+  virtual void OnDisabledForFrameWithReason(GlobalFrameRoutingId id,
+                                            base::StringPiece reason) = 0;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_FRAME_HOST_BACK_FORWARD_CACHE_IMPL_H_
diff --git a/chromium/content/browser/frame_host/back_forward_cache_metrics.cc b/chromium/content/browser/frame_host/back_forward_cache_metrics.cc
index da826ddcd1f..871a700d977 100644
--- a/chromium/content/browser/frame_host/back_forward_cache_metrics.cc
+++ b/chromium/content/browser/frame_host/back_forward_cache_metrics.cc
@@ -4,7 +4,11 @@
 
 #include "content/browser/frame_host/back_forward_cache_metrics.h"
 
+#include "base/metrics/histogram_macros.h"
+#include "base/metrics/metrics_hashes.h"
+#include "base/metrics/sparse_histogram.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/public/browser/browser_thread.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
@@ -91,21 +95,28 @@ void BackForwardCacheMetrics::MainFrameDidStartNavigationToDocument() {
 }
 
 void BackForwardCacheMetrics::DidCommitNavigation(
-    int64_t navigation_id,
-    int64_t navigation_entry_id,
-    bool is_main_frame_navigation) {
+    NavigationRequest* navigation) {
+  bool is_history_navigation =
+      navigation->GetPageTransition() & ui::PAGE_TRANSITION_FORWARD_BACK;
+  if (navigation->IsInMainFrame() && !navigation->IsSameDocument() &&
+      is_history_navigation) {
+    RecordMetricsForHistoryNavigationCommit(navigation);
+    disallowed_reasons_.clear();
+    evicted_reason_ = base::nullopt;
+  }
+
   if (last_committed_main_frame_navigation_id_ != -1 &&
-      is_main_frame_navigation) {
+      navigation->IsInMainFrame()) {
     // We've visited an entry associated with this main frame document before,
     // so record metrics to determine whether it might be a back-forward cache
     // hit.
     ukm::builders::HistoryNavigation builder(ukm::ConvertToSourceId(
-        navigation_id, ukm::SourceIdType::NAVIGATION_ID));
+        navigation->GetNavigationId(), ukm::SourceIdType::NAVIGATION_ID));
     builder.SetLastCommittedSourceIdForTheSameDocument(
         ukm::ConvertToSourceId(last_committed_main_frame_navigation_id_,
                                ukm::SourceIdType::NAVIGATION_ID));
     builder.SetNavigatedToTheMostRecentEntryForDocument(
-        navigation_entry_id == last_committed_navigation_entry_id_);
+        navigation->nav_entry_id() == last_committed_navigation_entry_id_);
     builder.SetMainFrameFeatures(main_frame_features_);
     builder.SetSameOriginSubframesFeatures(same_origin_frames_features_);
     builder.SetCrossOriginSubframesFeatures(cross_origin_frames_features_);
@@ -121,9 +132,9 @@ void BackForwardCacheMetrics::DidCommitNavigation(
     }
     builder.Record(ukm::UkmRecorder::Get());
   }
-  if (is_main_frame_navigation)
-    last_committed_main_frame_navigation_id_ = navigation_id;
-  last_committed_navigation_entry_id_ = navigation_entry_id;
+  if (navigation->IsInMainFrame())
+    last_committed_main_frame_navigation_id_ = navigation->GetNavigationId();
+  last_committed_navigation_entry_id_ = navigation->nav_entry_id();
 
   navigated_away_from_main_document_timestamp_ = base::nullopt;
   started_navigation_timestamp_ = base::nullopt;
@@ -167,4 +178,57 @@ void BackForwardCacheMetrics::CollectFeatureUsageFromSubtree(
   }
 }
 
+void BackForwardCacheMetrics::MarkDisableForRenderFrameHost(
+    const base::StringPiece& reason) {
+  disallowed_reasons_.push_back(reason.as_string());
+}
+
+void BackForwardCacheMetrics::MarkEvictedFromBackForwardCacheWithReason(
+    BackForwardCacheMetrics::EvictedReason reason) {
+  evicted_reason_ = reason;
+}
+
+void BackForwardCacheMetrics::RecordMetricsForHistoryNavigationCommit(
+    NavigationRequest* navigation) {
+  HistoryNavigationOutcome outcome = HistoryNavigationOutcome::kNotRestored;
+  if (navigation->IsServedFromBackForwardCache()) {
+    outcome = HistoryNavigationOutcome::kRestored;
+
+    UMA_HISTOGRAM_ENUMERATION(
+        "BackForwardCache.EvictedAfterDocumentRestoredReason",
+        BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason::kRestored);
+  }
+
+  // TODO(hajimehoshi): Do not record the outcome when the experient condition
+  // does not match.
+  UMA_HISTOGRAM_ENUMERATION("BackForwardCache.HistoryNavigationOutcome",
+                            outcome);
+
+  if (evicted_reason_.has_value()) {
+    UMA_HISTOGRAM_ENUMERATION(
+        "BackForwardCache.HistoryNavigationOutcome.EvictedReason",
+        evicted_reason_.value());
+  }
+
+  for (const std::string& reason : disallowed_reasons_) {
+    // Use SparseHistogram instead of other simple macros for metrics. It is
+    // because the reasons are represented as strings, and it was impossible to
+    // define an enum values.
+    base::HistogramBase* histogram = base::SparseHistogram::FactoryGet(
+        "BackForwardCache.HistoryNavigationOutcome."
+        "DisabledForRenderFrameHostReason",
+        base::HistogramBase::kUmaTargetedHistogramFlag);
+    // Adopts the lower 32 bits as a signed integer from unsigned 64 bits
+    // integer.
+    histogram->Add(base::HistogramBase::Sample(
+        static_cast<int32_t>(base::HashMetricName(reason))));
+  }
+}
+
+void BackForwardCacheMetrics::RecordEvictedAfterDocumentRestored(
+    EvictedAfterDocumentRestoredReason reason) {
+  UMA_HISTOGRAM_ENUMERATION(
+      "BackForwardCache.EvictedAfterDocumentRestoredReason", reason);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/back_forward_cache_metrics.h b/chromium/content/browser/frame_host/back_forward_cache_metrics.h
index fe1567beac1..a66fa537ca7 100644
--- a/chromium/content/browser/frame_host/back_forward_cache_metrics.h
+++ b/chromium/content/browser/frame_host/back_forward_cache_metrics.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/optional.h"
+#include "base/strings/string_piece.h"
 #include "base/time/tick_clock.h"
 #include "base/time/time.h"
 #include "content/common/content_export.h"
@@ -18,6 +19,7 @@ class Origin;
 
 namespace content {
 class NavigationEntryImpl;
+class NavigationRequest;
 class RenderFrameHostImpl;
 
 // Helper class for recording metrics around history navigations.
@@ -30,6 +32,51 @@ class RenderFrameHostImpl;
 class BackForwardCacheMetrics
     : public base::RefCounted<BackForwardCacheMetrics> {
  public:
+  enum class CanNotStoreDocumentReason : uint8_t {
+    kNotMainFrame,
+    kBackForwardCacheDisabled,
+    kRelatedActiveContentsExist,
+    kHTTPStatusNotOK,
+    kSchemeNotHTTPOrHTTPS,
+    kLoading,
+    kWasGrantedMediaAccess,
+    kBlocklistedFeatures,
+    kDisableForRenderFrameHostCalled,
+    kDomainNotAllowed,
+    kHTTPMethodNotGET
+  };
+
+  // Please keep in sync with BackForwardCacheHistoryNavigationOutcome in
+  // tools/metrics/histograms/enums.xml. These values should not be renumbered.
+  enum class HistoryNavigationOutcome {
+    kRestored = 0,
+    kNotRestored = 1,
+    kMaxValue = kNotRestored,
+  };
+
+  // Please keep in sync with BackForwardCacheEvictedReason in
+  // tools/metrics/histograms/enums.xml. These values should not be renumbered.
+  enum class EvictedReason {
+    kTimeout = 0,
+    kCacheLimit = 1,
+    kJavaScriptExecution = 2,
+    kRendererProcessKilled = 3,
+    kRendererProcessCrashed = 4,
+    kDialog = 5,
+    kGrantedMediaStreamAccess = 6,
+    kSchedulerTrackedFeatureUsed = 7,
+    kMaxValue = kSchedulerTrackedFeatureUsed,
+  };
+
+  // Please keep in sync with BackForwardCacheEvictedAfterDocumentRestoredReason
+  // in tools/metrics/histograms/enums.xml. These values should not be
+  // renumbered.
+  enum class EvictedAfterDocumentRestoredReason {
+    kRestored = 0,
+    kByJavaScript = 1,
+    kMaxValue = kByJavaScript,
+  };
+
   // Creates a potential new metrics object for the navigation.
   // Note that this object will not be used if the entry we are navigating to
   // already has the BackForwardCacheMetrics object (which happens for history
@@ -44,6 +91,11 @@ class BackForwardCacheMetrics
       bool is_main_frame_navigation,
       int64_t document_sequence_number);
 
+  // Records when the page is evicted after the document is restored e.g. when
+  // the race condition by JavaScript happens.
+  static void RecordEvictedAfterDocumentRestored(
+      EvictedAfterDocumentRestoredReason reason);
+
   // Notifies that the main frame has started a navigation to an entry
   // associated with |this|.
   //
@@ -56,9 +108,7 @@ class BackForwardCacheMetrics
   void MainFrameDidStartNavigationToDocument();
 
   // Notifies that an associated entry has committed a navigation.
-  void DidCommitNavigation(int64_t navigation_id,
-                           int64_t navigation_entry_id,
-                           bool is_main_frame_navigation);
+  void DidCommitNavigation(NavigationRequest* navigation_request);
 
   // Records when another navigation commits away from the most recent entry
   // associated with |this|.  This is the point in time that the previous
@@ -70,6 +120,14 @@ class BackForwardCacheMetrics
   // placed in the back-forward cache.
   void RecordFeatureUsage(RenderFrameHostImpl* main_frame);
 
+  // Marks when the page is evicted with the reason. This information is useful
+  // e.g., to know the major cause of eviction.
+  void MarkEvictedFromBackForwardCacheWithReason(
+      BackForwardCacheMetrics::EvictedReason reason);
+
+  // Marks the frame disabled the back forward cache with the reason.
+  void MarkDisableForRenderFrameHost(const base::StringPiece& reason);
+
   // Injects a clock for mocking time.
   // Should be called only from the UI thread.
   CONTENT_EXPORT static void OverrideTimeForTesting(base::TickClock* clock);
@@ -86,6 +144,8 @@ class BackForwardCacheMetrics
   void CollectFeatureUsageFromSubtree(RenderFrameHostImpl* rfh,
                                       const url::Origin& main_frame_origin);
 
+  void RecordMetricsForHistoryNavigationCommit(NavigationRequest* navigation);
+
   // Main frame document sequence number that identifies all NavigationEntries
   // this metrics object is associated with.
   const int64_t document_sequence_number_;
@@ -109,6 +169,9 @@ class BackForwardCacheMetrics
   base::Optional<base::TimeTicks> started_navigation_timestamp_;
   base::Optional<base::TimeTicks> navigated_away_from_main_document_timestamp_;
 
+  std::vector<std::string> disallowed_reasons_;
+  base::Optional<EvictedReason> evicted_reason_;
+
   DISALLOW_COPY_AND_ASSIGN(BackForwardCacheMetrics);
 };
 
diff --git a/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc b/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc
index ab3d5853bc2..6d83f517b1e 100644
--- a/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc
+++ b/chromium/content/browser/frame_host/back_forward_cache_metrics_browsertest.cc
@@ -320,7 +320,6 @@ std::ostream& operator<<(std::ostream& os, const FeatureUsage& usage) {
 
 std::vector<FeatureUsage> GetFeatureUsageMetrics(
     ukm::TestAutoSetUkmRecorder* recorder) {
-
   std::vector<FeatureUsage> result;
   for (const auto& entry :
        GetEntries(recorder, "HistoryNavigation",
@@ -497,6 +496,26 @@ IN_PROC_BROWSER_TEST_F(BackForwardCacheMetricsBrowserTest, DedicatedWorker) {
                                       kDedicatedWorkerOrWorklet));
 }
 
+// TODO(https://crbug.com/154571): Shared workers are not available on Android.
+#if defined(OS_ANDROID)
+#define MAYBE_SharedWorker DISABLED_SharedWorker
+#else
+#define MAYBE_SharedWorker SharedWorker
+#endif
+IN_PROC_BROWSER_TEST_F(BackForwardCacheMetricsBrowserTest, MAYBE_SharedWorker) {
+  const GURL url(embedded_test_server()->GetURL(
+      "/back_forward_cache/page_with_shared_worker.html"));
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  EXPECT_EQ(static_cast<WebContentsImpl*>(shell()->web_contents())
+                    ->GetMainFrame()
+                    ->scheduler_tracked_features() &
+                ~kFeaturesToIgnoreMask,
+            1ull << static_cast<uint32_t>(
+                blink::scheduler::WebSchedulerTrackedFeature::kSharedWorker));
+}
+
 IN_PROC_BROWSER_TEST_F(BackForwardCacheMetricsBrowserTest,
                        WindowOpen_SameOrigin) {
   ukm::TestAutoSetUkmRecorder recorder;
diff --git a/chromium/content/browser/frame_host/blocked_scheme_navigation_throttle.cc b/chromium/content/browser/frame_host/blocked_scheme_navigation_throttle.cc
index 68f5754a62c..3760d71d71b 100644
--- a/chromium/content/browser/frame_host/blocked_scheme_navigation_throttle.cc
+++ b/chromium/content/browser/frame_host/blocked_scheme_navigation_throttle.cc
@@ -9,7 +9,7 @@
 #include "build/build_config.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/content_features.h"
@@ -30,17 +30,16 @@ BlockedSchemeNavigationThrottle::~BlockedSchemeNavigationThrottle() {}
 
 NavigationThrottle::ThrottleCheckResult
 BlockedSchemeNavigationThrottle::WillProcessResponse() {
-  NavigationHandleImpl* handle =
-      static_cast<NavigationHandleImpl*>(navigation_handle());
-  if (handle->IsDownload())
+  NavigationRequest* request = NavigationRequest::From(navigation_handle());
+  if (request->IsDownload())
     return PROCEED;
 
   RenderFrameHost* top_frame =
-      handle->frame_tree_node()->frame_tree()->root()->current_frame_host();
+      request->frame_tree_node()->frame_tree()->root()->current_frame_host();
   top_frame->AddMessageToConsole(
       blink::mojom::ConsoleMessageLevel::kError,
-      base::StringPrintf(kConsoleError, handle->GetURL().scheme().c_str(),
-                         handle->GetURL().spec().c_str()));
+      base::StringPrintf(kConsoleError, request->GetURL().scheme().c_str(),
+                         request->GetURL().spec().c_str()));
   return CANCEL;
 }
 
diff --git a/chromium/content/browser/frame_host/cross_process_frame_connector.h b/chromium/content/browser/frame_host/cross_process_frame_connector.h
index f078c30d7d5..b9d1a1dc4ee 100644
--- a/chromium/content/browser/frame_host/cross_process_frame_connector.h
+++ b/chromium/content/browser/frame_host/cross_process_frame_connector.h
@@ -67,7 +67,7 @@ class CONTENT_EXPORT CrossProcessFrameConnector
       RenderFrameProxyHost* frame_proxy_in_parent_renderer);
   ~CrossProcessFrameConnector() override;
 
-  bool OnMessageReceived(const IPC::Message &msg);
+  bool OnMessageReceived(const IPC::Message& msg);
 
   // |view| corresponds to B2's RenderWidgetHostViewChildFrame in the example
   // above.
diff --git a/chromium/content/browser/frame_host/debug_urls.cc b/chromium/content/browser/frame_host/debug_urls.cc
index fc475c88aef..cf7ada7654d 100644
--- a/chromium/content/browser/frame_host/debug_urls.cc
+++ b/chromium/content/browser/frame_host/debug_urls.cc
@@ -27,7 +27,7 @@
 
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "content/browser/ppapi_plugin_process_host.h"  // nogncheck
-#include "ppapi/proxy/ppapi_messages.h"  // nogncheck
+#include "ppapi/proxy/ppapi_messages.h"                 // nogncheck
 #endif
 
 #if defined(OS_WIN)
@@ -59,8 +59,8 @@ void HandlePpapiFlashDebugURL(const GURL& url) {
   bool crash = url == kChromeUIPpapiFlashCrashURL;
 
   std::vector<PpapiPluginProcessHost*> hosts;
-  PpapiPluginProcessHost::FindByName(
-      base::UTF8ToUTF16(kFlashPluginName), &hosts);
+  PpapiPluginProcessHost::FindByName(base::UTF8ToUTF16(kFlashPluginName),
+                                     &hosts);
   for (auto iter = hosts.begin(); iter != hosts.end(); ++iter) {
     if (crash)
       (*iter)->Send(new PpapiMsg_Crash());
@@ -72,8 +72,7 @@ void HandlePpapiFlashDebugURL(const GURL& url) {
 
 bool IsAsanDebugURL(const GURL& url) {
   if (!(url.is_valid() && url.SchemeIs(kChromeUIScheme) &&
-        url.DomainIs(kAsanCrashDomain) &&
-        url.has_path())) {
+        url.DomainIs(kAsanCrashDomain) && url.has_path())) {
     return false;
   }
 
@@ -128,23 +127,16 @@ void HangCurrentThread() {
 
 }  // namespace
 
-bool HandleDebugURL(const GURL& url, ui::PageTransition transition) {
-  // Ensure that the user explicitly navigated to this URL, unless
-  // kEnableGpuBenchmarking is enabled by Telemetry.
+bool HandleDebugURL(const GURL& url,
+                    ui::PageTransition transition,
+                    bool is_explicit_navigation) {
+  // We want to handle the debug URL if the user explicitly navigated to this
+  // URL, unless kEnableGpuBenchmarking is enabled by Telemetry.
   bool is_telemetry_navigation =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           cc::switches::kEnableGpuBenchmarking) &&
       (PageTransitionCoreTypeIs(transition, ui::PAGE_TRANSITION_TYPED));
 
-  // TODO(crbug.com/986346): allow this behavior to be customized by the
-  // embedder.
-  bool is_explicit_navigation =
-#if defined(ENABLE_ADDRESS_BAR)
-      transition & ui::PAGE_TRANSITION_FROM_ADDRESS_BAR;
-#else
-      ui::PageTransitionCoreTypeIs(transition, ui::PAGE_TRANSITION_TYPED);
-#endif
-
   if (!is_explicit_navigation && !is_telemetry_navigation)
     return false;
 
@@ -182,7 +174,7 @@ bool HandleDebugURL(const GURL& url, ui::PageTransition transition) {
   if (url == kChromeUIGpuCleanURL) {
     GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_SANDBOXED,
                              false /* force_create */,
-                             base::Bind([](GpuProcessHost* host) {
+                             base::BindOnce([](GpuProcessHost* host) {
                                if (host)
                                  host->gpu_service()->DestroyAllChannels();
                              }));
@@ -192,7 +184,7 @@ bool HandleDebugURL(const GURL& url, ui::PageTransition transition) {
   if (url == kChromeUIGpuCrashURL) {
     GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_SANDBOXED,
                              false /* force_create */,
-                             base::Bind([](GpuProcessHost* host) {
+                             base::BindOnce([](GpuProcessHost* host) {
                                if (host)
                                  host->gpu_service()->Crash();
                              }));
@@ -203,7 +195,7 @@ bool HandleDebugURL(const GURL& url, ui::PageTransition transition) {
   if (url == kChromeUIGpuJavaCrashURL) {
     GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_SANDBOXED,
                              false /* force_create */,
-                             base::Bind([](GpuProcessHost* host) {
+                             base::BindOnce([](GpuProcessHost* host) {
                                if (host)
                                  host->gpu_service()->ThrowJavaException();
                              }));
@@ -214,7 +206,7 @@ bool HandleDebugURL(const GURL& url, ui::PageTransition transition) {
   if (url == kChromeUIGpuHangURL) {
     GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_SANDBOXED,
                              false /* force_create */,
-                             base::Bind([](GpuProcessHost* host) {
+                             base::BindOnce([](GpuProcessHost* host) {
                                if (host)
                                  host->gpu_service()->Hang();
                              }));
diff --git a/chromium/content/browser/frame_host/debug_urls.h b/chromium/content/browser/frame_host/debug_urls.h
index 189ac16a4aa..fbeb6603228 100644
--- a/chromium/content/browser/frame_host/debug_urls.h
+++ b/chromium/content/browser/frame_host/debug_urls.h
@@ -14,7 +14,9 @@ namespace content {
 
 // Checks if the given url is a url used for debugging purposes, and if so
 // handles it and returns true.
-bool HandleDebugURL(const GURL& url, ui::PageTransition transition);
+bool HandleDebugURL(const GURL& url,
+                    ui::PageTransition transition,
+                    bool is_explicit_navigation);
 
 }  // namespace content
 
diff --git a/chromium/content/browser/frame_host/form_submission_throttle.cc b/chromium/content/browser/frame_host/form_submission_throttle.cc
index 0f9ca0afafe..9c83ef7524c 100644
--- a/chromium/content/browser/frame_host/form_submission_throttle.cc
+++ b/chromium/content/browser/frame_host/form_submission_throttle.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/form_submission_throttle.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
@@ -62,19 +62,20 @@ FormSubmissionThrottle::CheckContentSecurityPolicyFormAction(
   if (!was_server_redirect)
     return NavigationThrottle::PROCEED;
 
-  NavigationHandleImpl* handle =
-      static_cast<NavigationHandleImpl*>(navigation_handle());
+  NavigationRequest* request = NavigationRequest::From(navigation_handle());
 
-  if (handle->should_check_main_world_csp() == CSPDisposition::DO_NOT_CHECK)
+  if (request->common_params().initiator_csp_info.should_check_main_world_csp ==
+      CSPDisposition::DO_NOT_CHECK) {
     return NavigationThrottle::PROCEED;
+  }
 
-  const GURL& url = handle->GetURL();
+  const GURL& url = request->GetURL();
 
   // TODO(arthursonzogni): This is not the right RenderFrameHostImpl. The one
   // that has initiated the navigation must be used instead.
   // See https://crbug.com/700964
   RenderFrameHostImpl* render_frame =
-      handle->frame_tree_node()->current_frame_host();
+      request->frame_tree_node()->current_frame_host();
 
   // TODO(estark): Move this check into NavigationRequest and split it into (1)
   // check report-only CSP, (2) upgrade request if needed, (3) check enforced
@@ -82,7 +83,7 @@ FormSubmissionThrottle::CheckContentSecurityPolicyFormAction(
   if (render_frame->IsAllowedByCsp(
           CSPDirective::FormAction, url, was_server_redirect,
           false /* is_response_check */,
-          handle->source_location().value_or(SourceLocation()),
+          request->common_params().source_location.value_or(SourceLocation()),
           CSPContext::CHECK_ALL_CSP, true /* is_form_submission */)) {
     return NavigationThrottle::PROCEED;
   }
diff --git a/chromium/content/browser/frame_host/form_submission_throttle_unittest.cc b/chromium/content/browser/frame_host/form_submission_throttle_unittest.cc
index fb31c5df6e1..103bd40f35e 100644
--- a/chromium/content/browser/frame_host/form_submission_throttle_unittest.cc
+++ b/chromium/content/browser/frame_host/form_submission_throttle_unittest.cc
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/common/content_security_policy/csp_context.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/test/navigation_simulator_impl.h"
diff --git a/chromium/content/browser/frame_host/frame_navigation_entry.cc b/chromium/content/browser/frame_host/frame_navigation_entry.cc
index 34d737a74c9..34d9543ea17 100644
--- a/chromium/content/browser/frame_host/frame_navigation_entry.cc
+++ b/chromium/content/browser/frame_host/frame_navigation_entry.cc
@@ -47,8 +47,7 @@ FrameNavigationEntry::FrameNavigationEntry(
     committed_origin_ = *origin;
 }
 
-FrameNavigationEntry::~FrameNavigationEntry() {
-}
+FrameNavigationEntry::~FrameNavigationEntry() {}
 
 scoped_refptr<FrameNavigationEntry> FrameNavigationEntry::Clone() const {
   auto copy = base::MakeRefCounted<FrameNavigationEntry>();
diff --git a/chromium/content/browser/frame_host/frame_service_base_unittest.cc b/chromium/content/browser/frame_host/frame_service_base_unittest.cc
index dc1dcac8283..49829e08b9a 100644
--- a/chromium/content/browser/frame_host/frame_service_base_unittest.cc
+++ b/chromium/content/browser/frame_host/frame_service_base_unittest.cc
@@ -12,6 +12,8 @@
 #include "content/public/test/test_renderer_host.h"
 #include "content/test/echo.mojom.h"
 #include "content/test/test_render_frame_host.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "url/gurl.h"
 
 // Unit test for FrameServiceBase in content/public/browser.
@@ -27,9 +29,9 @@ const char kBarOrigin[] = "https://bar.com";
 class EchoImpl final : public FrameServiceBase<mojom::Echo> {
  public:
   EchoImpl(RenderFrameHost* render_frame_host,
-           mojo::InterfaceRequest<mojom::Echo> request,
+           mojo::PendingReceiver<mojom::Echo> receiver,
            base::OnceClosure destruction_cb)
-      : FrameServiceBase(render_frame_host, std::move(request)),
+      : FrameServiceBase(render_frame_host, std::move(receiver)),
         destruction_cb_(std::move(destruction_cb)) {}
   ~EchoImpl() final { std::move(destruction_cb_).Run(); }
 
@@ -79,7 +81,7 @@ class FrameServiceBaseTest : public RenderViewHostTestHarness {
 
   void CreateEchoImpl(RenderFrameHost* rfh) {
     DCHECK(!is_echo_impl_alive_);
-    new EchoImpl(rfh, mojo::MakeRequest(&echo_ptr_),
+    new EchoImpl(rfh, echo_remote_.BindNewPipeAndPassReceiver(),
                  base::BindOnce(&FrameServiceBaseTest::OnEchoImplDestructed,
                                 base::Unretained(this)));
     is_echo_impl_alive_ = true;
@@ -91,12 +93,12 @@ class FrameServiceBaseTest : public RenderViewHostTestHarness {
   }
 
   void ResetConnection() {
-    echo_ptr_.reset();
+    echo_remote_.reset();
     base::RunLoop().RunUntilIdle();
   }
 
   RenderFrameHost* main_rfh_ = nullptr;
-  mojom::EchoPtr echo_ptr_;
+  mojo::Remote<mojom::Echo> echo_remote_;
   bool is_echo_impl_alive_ = false;
 };
 
diff --git a/chromium/content/browser/frame_host/frame_tree.cc b/chromium/content/browser/frame_host/frame_tree.cc
index 1b9e19c4fd8..e842fe089fc 100644
--- a/chromium/content/browser/frame_host/frame_tree.cc
+++ b/chromium/content/browser/frame_host/frame_tree.cc
@@ -14,6 +14,7 @@
 #include "base/callback.h"
 #include "base/lazy_instance.h"
 #include "base/memory/ptr_util.h"
+#include "base/stl_util.h"
 #include "base/unguessable_token.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
@@ -264,9 +265,8 @@ void FrameTree::RemoveFrame(FrameTreeNode* child) {
   parent->current_frame_host()->RemoveChild(child);
 }
 
-void FrameTree::CreateProxiesForSiteInstance(
-    FrameTreeNode* source,
-    SiteInstance* site_instance) {
+void FrameTree::CreateProxiesForSiteInstance(FrameTreeNode* source,
+                                             SiteInstance* site_instance) {
   // Create the RenderFrameProxyHost for the new SiteInstance.
   if (!source || !source->IsMainFrame()) {
     RenderViewHostImpl* render_view_host =
@@ -381,7 +381,7 @@ scoped_refptr<RenderViewHostImpl> FrameTree::CreateRenderViewHost(
       static_cast<RenderViewHostImpl*>(RenderViewHostFactory::Create(
           site_instance, render_view_delegate_, render_widget_delegate_,
           routing_id, main_frame_routing_id, widget_routing_id, swapped_out));
-  render_view_host_map_[site_instance->GetId()] = rvh;
+  RegisterRenderViewHost(rvh);
   return base::WrapRefCounted(rvh);
 }
 
@@ -394,7 +394,13 @@ scoped_refptr<RenderViewHostImpl> FrameTree::GetRenderViewHost(
   return base::WrapRefCounted(it->second);
 }
 
-void FrameTree::RenderViewHostDeleted(RenderViewHost* rvh) {
+void FrameTree::RegisterRenderViewHost(RenderViewHostImpl* rvh) {
+  CHECK(
+      !base::Contains(render_view_host_map_, rvh->GetSiteInstance()->GetId()));
+  render_view_host_map_[rvh->GetSiteInstance()->GetId()] = rvh;
+}
+
+void FrameTree::UnregisterRenderViewHost(RenderViewHostImpl* rvh) {
   auto it = render_view_host_map_.find(rvh->GetSiteInstance()->GetId());
   CHECK(it != render_view_host_map_.end());
   CHECK_EQ(it->second, rvh);
diff --git a/chromium/content/browser/frame_host/frame_tree.h b/chromium/content/browser/frame_host/frame_tree.h
index f32aaddb486..092e9cf2385 100644
--- a/chromium/content/browser/frame_host/frame_tree.h
+++ b/chromium/content/browser/frame_host/frame_tree.h
@@ -222,11 +222,24 @@ class CONTENT_EXPORT FrameTree {
   scoped_refptr<RenderViewHostImpl> GetRenderViewHost(
       SiteInstance* site_instance);
 
-  // The FrameTree maintains a list of existing RenderViewHostImpl so that
-  // FrameTree::CreateRenderViewHost() can return them directly instead of
-  // creating a new one. Calling this function removes it from the list when the
-  // |render_view_host| is deleted.
-  void RenderViewHostDeleted(RenderViewHost* render_view_host);
+  // Registers a RenderViewHost so that it can be reused by other frames
+  // belonging to the same SiteInstance.
+  //
+  // This method does not take ownership of|rvh|.
+  //
+  // NOTE: This method CHECK fails if a RenderViewHost is already registered for
+  // |rvh|'s SiteInstance.
+  //
+  // ALSO NOTE: After calling RegisterRenderViewHost, UnregisterRenderViewHost
+  // *must* be called for |rvh| when it is destroyed or put into the
+  // BackForwardCache, to prevent FrameTree::CreateRenderViewHost from trying to
+  // reuse it.
+  void RegisterRenderViewHost(RenderViewHostImpl* rvh);
+
+  // Unregisters the RenderViewHostImpl that's available for reuse for a
+  // particular SiteInstance. NOTE: This method CHECK fails if it is called for
+  // a |render_view_host| that is not currently set for reuse.
+  void UnregisterRenderViewHost(RenderViewHostImpl* render_view_host);
 
   // This is called when the frame is about to be removed and started to run
   // unload handlers.
diff --git a/chromium/content/browser/frame_host/frame_tree_browsertest.cc b/chromium/content/browser/frame_host/frame_tree_browsertest.cc
index de101c646b2..e5fd2501c96 100644
--- a/chromium/content/browser/frame_host/frame_tree_browsertest.cc
+++ b/chromium/content/browser/frame_host/frame_tree_browsertest.cc
@@ -64,9 +64,9 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, FrameTreeShape) {
   // Frame tree:
   //   Site-A Root
   EXPECT_TRUE(NavigateToURL(shell(), base_url.Resolve("blank.html")));
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-      GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
   EXPECT_EQ(0U, root->child_count());
 
   // Add 2 same-site frames. Verify 3 nodes in tree with proper names.
@@ -104,7 +104,8 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, FrameTreeShape2) {
   ASSERT_EQ(2UL, root->child_at(2)->child_count());
   EXPECT_EQ(1UL, root->child_at(2)->child_at(1)->child_count());
   EXPECT_EQ(0UL, root->child_at(2)->child_at(1)->child_at(0)->child_count());
-  EXPECT_STREQ("3-1-name",
+  EXPECT_STREQ(
+      "3-1-name",
       root->child_at(2)->child_at(1)->child_at(0)->frame_name().c_str());
 
   // Navigate to about:blank, which should leave only the root node of the frame
@@ -161,13 +162,7 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, FrameTreeAfterCrash) {
 
 // Test that we can navigate away if the previous renderer doesn't clean up its
 // child frames.
-// Flaky on Mac. http://crbug.com/452018
-#if defined(OS_MACOSX)
-#define MAYBE_NavigateWithLeftoverFrames DISABLED_NavigateWithLeftoverFrames
-#else
-#define MAYBE_NavigateWithLeftoverFrames NavigateWithLeftoverFrames
-#endif
-IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, MAYBE_NavigateWithLeftoverFrames) {
+IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, NavigateWithLeftoverFrames) {
   GURL base_url = embedded_test_server()->GetURL("A.com", "/site_isolation/");
 
   EXPECT_TRUE(NavigateToURL(
@@ -199,7 +194,8 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, IsRenderFrameLive) {
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()->root();
+                            ->GetFrameTree()
+                            ->root();
 
   // The root and subframe should each have a live RenderFrame.
   EXPECT_TRUE(
@@ -522,9 +518,10 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, ChildFrameWithSrcdoc) {
   // Create a new iframe with srcdoc and add it to the main frame. It should
   // be created in the same SiteInstance as the parent.
   {
-    std::string script("var f = document.createElement('iframe');"
-                       "f.srcdoc = 'some content';"
-                       "document.body.appendChild(f)");
+    std::string script(
+        "var f = document.createElement('iframe');"
+        "f.srcdoc = 'some content';"
+        "document.body.appendChild(f)");
     TestNavigationObserver observer(shell()->web_contents());
     EXPECT_TRUE(ExecJs(root, script));
     EXPECT_EQ(2U, root->child_count());
@@ -541,8 +538,9 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, ChildFrameWithSrcdoc) {
   // Set srcdoc on the existing cross-site frame. It should navigate the frame
   // back to the origin of the parent.
   {
-    std::string script("var f = document.getElementById('child-0');"
-                       "f.srcdoc = 'some content';");
+    std::string script(
+        "var f = document.getElementById('child-0');"
+        "f.srcdoc = 'some content';");
     TestNavigationObserver observer(shell()->web_contents());
     EXPECT_TRUE(ExecJs(root, script));
     observer.Wait();
@@ -614,7 +612,8 @@ IN_PROC_BROWSER_TEST_F(FrameTreeBrowserTest, SandboxFlagsSetForChildFrames) {
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()->root();
+                            ->GetFrameTree()
+                            ->root();
 
   // Verify that sandbox flags are set properly for all FrameTreeNodes.
   // First frame is completely sandboxed; second frame uses "allow-scripts",
@@ -808,7 +807,8 @@ IN_PROC_BROWSER_TEST_F(CrossProcessFrameTreeBrowserTest,
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()->root();
+                            ->GetFrameTree()
+                            ->root();
 
   // There should not be a proxy for the root's own SiteInstance.
   SiteInstance* root_instance = root->current_frame_host()->GetSiteInstance();
@@ -861,7 +861,8 @@ IN_PROC_BROWSER_TEST_F(CrossProcessFrameTreeBrowserTest,
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()->root();
+                            ->GetFrameTree()
+                            ->root();
 
   EXPECT_EQ(root->current_origin().Serialize() + '/',
             main_url.GetOrigin().spec());
diff --git a/chromium/content/browser/frame_host/frame_tree_node.cc b/chromium/content/browser/frame_host/frame_tree_node.cc
index b391237f235..fad4d2ad14f 100644
--- a/chromium/content/browser/frame_host/frame_tree_node.cc
+++ b/chromium/content/browser/frame_host/frame_tree_node.cc
@@ -51,6 +51,8 @@ const double kLoadingProgressDone = 1.0;
 
 }  // namespace
 
+const int FrameTreeNode::kFrameTreeNodeInvalidId = -1;
+
 // This observer watches the opener of its owner FrameTreeNode and clears the
 // owner's opener if the opener is destroyed.
 class FrameTreeNode::OpenerDestroyedObserver : public FrameTreeNode::Observer {
@@ -430,7 +432,7 @@ void FrameTreeNode::CreatedNavigationRequest(
   // RenderFrameHostManager will take care of updates to the speculative
   // RenderFrameHost in DidCreateNavigationRequest below.
   if (was_previously_loading) {
-    if (navigation_request_ && navigation_request_->navigation_handle()) {
+    if (navigation_request_ && navigation_request_->IsNavigationStarted()) {
       // Mark the old request as aborted.
       navigation_request_->set_net_error(net::ERR_ABORTED);
     }
@@ -548,15 +550,8 @@ void FrameTreeNode::DidChangeLoadProgress(double load_progress) {
 }
 
 bool FrameTreeNode::StopLoading() {
-  if (navigation_request_) {
-    int expected_pending_nav_entry_id = navigation_request_->nav_entry_id();
-    if (navigation_request_->navigation_handle()) {
-      navigation_request_->set_net_error(net::ERR_ABORTED);
-      expected_pending_nav_entry_id =
-          navigation_request_->navigation_handle()->pending_nav_entry_id();
-    }
-    navigator_->DiscardPendingEntryIfNeeded(expected_pending_nav_entry_id);
-  }
+  if (navigation_request_ && navigation_request_->IsNavigationStarted())
+    navigation_request_->set_net_error(net::ERR_ABORTED);
   ResetNavigationRequest(false, true);
 
   // TODO(nasko): see if child frames should send IPCs in site-per-process
diff --git a/chromium/content/browser/frame_host/frame_tree_node.h b/chromium/content/browser/frame_host/frame_tree_node.h
index d120853637a..99074b56b1b 100644
--- a/chromium/content/browser/frame_host/frame_tree_node.h
+++ b/chromium/content/browser/frame_host/frame_tree_node.h
@@ -62,7 +62,7 @@ class CONTENT_EXPORT FrameTreeNode {
     virtual ~Observer() {}
   };
 
-  static const int kFrameTreeNodeInvalidId = -1;
+  static const int kFrameTreeNodeInvalidId;
 
   // Returns the FrameTreeNode with the given global |frame_tree_node_id|,
   // regardless of which FrameTree it is in.
@@ -95,25 +95,11 @@ class CONTENT_EXPORT FrameTreeNode {
   // Feature-Policy HTTP headers).
   void ResetForNavigation();
 
-  FrameTree* frame_tree() const {
-    return frame_tree_;
-  }
-
-  Navigator* navigator() {
-    return navigator_.get();
-  }
-
-  RenderFrameHostManager* render_manager() {
-    return &render_manager_;
-  }
-
-  int frame_tree_node_id() const {
-    return frame_tree_node_id_;
-  }
-
-  const std::string& frame_name() const {
-    return replication_state_.name;
-  }
+  FrameTree* frame_tree() const { return frame_tree_; }
+  Navigator* navigator() { return navigator_.get(); }
+  RenderFrameHostManager* render_manager() { return &render_manager_; }
+  int frame_tree_node_id() const { return frame_tree_node_id_; }
+  const std::string& frame_name() const { return replication_state_.name; }
 
   const std::string& unique_name() const {
     return replication_state_.unique_name;
@@ -164,9 +150,7 @@ class CONTENT_EXPORT FrameTreeNode {
   void SetCurrentURL(const GURL& url);
 
   // Returns true iff SetCurrentURL has been called with a non-blank URL.
-  bool has_committed_real_load() const {
-    return has_committed_real_load_;
-  }
+  bool has_committed_real_load() const { return has_committed_real_load_; }
 
   // Returns whether the frame's owner element in the parent document is
   // collapsed, that is, removed from the layout as if it did not exist, as per
diff --git a/chromium/content/browser/frame_host/frame_tree_node_blame_context.cc b/chromium/content/browser/frame_host/frame_tree_node_blame_context.cc
index f856b110c99..d2b8a334503 100644
--- a/chromium/content/browser/frame_host/frame_tree_node_blame_context.cc
+++ b/chromium/content/browser/frame_host/frame_tree_node_blame_context.cc
@@ -24,13 +24,13 @@ const char kRenderFrameBlameContextScope[] = "RenderFrame";
 
 FrameTreeNodeBlameContext::FrameTreeNodeBlameContext(int node_id,
                                                      FrameTreeNode* parent)
-    : base::trace_event::BlameContext(kFrameTreeNodeBlameContextCategory,
-                                      kFrameTreeNodeBlameContextName,
-                                      kFrameTreeNodeBlameContextType,
-                                      kFrameTreeNodeBlameContextScope,
-                                      node_id,
-                                      parent ? &parent->blame_context()
-                                             : nullptr) {}
+    : base::trace_event::BlameContext(
+          kFrameTreeNodeBlameContextCategory,
+          kFrameTreeNodeBlameContextName,
+          kFrameTreeNodeBlameContextType,
+          kFrameTreeNodeBlameContextScope,
+          node_id,
+          parent ? &parent->blame_context() : nullptr) {}
 
 FrameTreeNodeBlameContext::~FrameTreeNodeBlameContext() {}
 
diff --git a/chromium/content/browser/frame_host/frame_tree_node_blame_context.h b/chromium/content/browser/frame_host/frame_tree_node_blame_context.h
index 6573f7cf6ab..8838fd073ad 100644
--- a/chromium/content/browser/frame_host/frame_tree_node_blame_context.h
+++ b/chromium/content/browser/frame_host/frame_tree_node_blame_context.h
@@ -12,8 +12,8 @@
 namespace base {
 namespace trace_event {
 class TracedValue;
-}
-}
+}  // namespace trace_event
+}  // namespace base
 
 namespace content {
 
diff --git a/chromium/content/browser/frame_host/input/input_injector_impl.cc b/chromium/content/browser/frame_host/input/input_injector_impl.cc
index f4113506d32..64a8a53beba 100644
--- a/chromium/content/browser/frame_host/input/input_injector_impl.cc
+++ b/chromium/content/browser/frame_host/input/input_injector_impl.cc
@@ -10,7 +10,9 @@
 #include "base/bind.h"
 #include "content/browser/renderer_host/input/synthetic_gesture.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "content/common/input/input_injector.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
 
@@ -29,10 +31,11 @@ InputInjectorImpl::InputInjectorImpl(
 
 InputInjectorImpl::~InputInjectorImpl() {}
 
-void InputInjectorImpl::Create(base::WeakPtr<RenderFrameHostImpl> frame_host,
-                               mojom::InputInjectorRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<InputInjectorImpl>(frame_host),
-                          std::move(request));
+void InputInjectorImpl::Create(
+    base::WeakPtr<RenderFrameHostImpl> frame_host,
+    mojo::PendingReceiver<mojom::InputInjector> receiver) {
+  mojo::MakeSelfOwnedReceiver(std::make_unique<InputInjectorImpl>(frame_host),
+                              std::move(receiver));
 }
 
 void InputInjectorImpl::QueueSyntheticSmoothDrag(
diff --git a/chromium/content/browser/frame_host/input/input_injector_impl.h b/chromium/content/browser/frame_host/input/input_injector_impl.h
index e9f696a277d..62f07fc9804 100644
--- a/chromium/content/browser/frame_host/input/input_injector_impl.h
+++ b/chromium/content/browser/frame_host/input/input_injector_impl.h
@@ -10,6 +10,7 @@
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/input/synthetic_gesture.h"
 #include "content/common/input/input_injector.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
@@ -20,7 +21,7 @@ class CONTENT_EXPORT InputInjectorImpl : public mojom::InputInjector {
   ~InputInjectorImpl() override;
 
   static void Create(base::WeakPtr<RenderFrameHostImpl> frame_host,
-                     mojom::InputInjectorRequest request);
+                     mojo::PendingReceiver<mojom::InputInjector> receiver);
 
   // mojom::InputInjector overrides.
   void QueueSyntheticSmoothDrag(
diff --git a/chromium/content/browser/frame_host/interstitial_page_impl.cc b/chromium/content/browser/frame_host/interstitial_page_impl.cc
index be1334c4613..7bb71f92bb0 100644
--- a/chromium/content/browser/frame_host/interstitial_page_impl.cc
+++ b/chromium/content/browser/frame_host/interstitial_page_impl.cc
@@ -63,7 +63,7 @@ using blink::WebDragOperationsMask;
 namespace content {
 
 class InterstitialPageImpl::InterstitialPageRVHDelegateView
-  : public RenderViewHostDelegateView {
+    : public RenderViewHostDelegateView {
  public:
   explicit InterstitialPageRVHDelegateView(InterstitialPageImpl* page);
 
@@ -104,7 +104,6 @@ class InterstitialPageImpl::InterstitialPageRVHDelegateView
   DISALLOW_COPY_AND_ASSIGN(InterstitialPageRVHDelegateView);
 };
 
-
 // We keep a map of the various blocking pages shown as the UI tests need to
 // be able to retrieve them.
 typedef std::map<WebContents*, InterstitialPageImpl*> InterstitialPageMap;
@@ -263,7 +262,7 @@ void InterstitialPageImpl::Show() {
   frame_tree_->root()->current_frame_host()->UpdateAccessibilityMode();
 
   notification_registrar_.Add(this, NOTIFICATION_NAV_ENTRY_PENDING,
-      Source<NavigationController>(controller_));
+                              Source<NavigationController>(controller_));
 }
 
 void InterstitialPageImpl::Hide() {
@@ -277,10 +276,8 @@ void InterstitialPageImpl::Hide() {
 
   RenderWidgetHostView* old_view =
       controller_->delegate()->GetRenderViewHost()->GetWidget()->GetView();
-  if (controller_->delegate()->GetInterstitialPage() == this &&
-      old_view &&
-      !old_view->IsShowing() &&
-      !controller_->delegate()->IsHidden()) {
+  if (controller_->delegate()->GetInterstitialPage() == this && old_view &&
+      !old_view->IsShowing() && !controller_->delegate()->IsHidden()) {
     // Show the original RVH since we're going away.  Note it might not exist if
     // the renderer crashed while the interstitial was showing.
     // Note that it is important that we don't call Show() if the view is
@@ -330,10 +327,9 @@ void InterstitialPageImpl::RenderWidgetHostDestroyed(
   }
 }
 
-void InterstitialPageImpl::Observe(
-    int type,
-    const NotificationSource& source,
-    const NotificationDetails& details) {
+void InterstitialPageImpl::Observe(int type,
+                                   const NotificationSource& source,
+                                   const NotificationDetails& details) {
   switch (type) {
     case NOTIFICATION_NAV_ENTRY_PENDING:
       // We are navigating away from the interstitial (the user has typed a URL
@@ -604,8 +600,9 @@ RenderViewHostImpl* InterstitialPageImpl::CreateRenderViewHost() {
       SiteInstance::Create(browser_context);
   DOMStorageContextWrapper* dom_storage_context =
       static_cast<DOMStorageContextWrapper*>(
-          BrowserContext::GetStoragePartition(
-              browser_context, site_instance.get())->GetDOMStorageContext());
+          BrowserContext::GetStoragePartition(browser_context,
+                                              site_instance.get())
+              ->GetDOMStorageContext());
   session_storage_namespace_ =
       SessionStorageNamespaceImpl::Create(dom_storage_context);
 
@@ -752,10 +749,10 @@ RenderWidgetHostView* InterstitialPageImpl::GetView() {
   return render_view_host_->GetWidget()->GetView();
 }
 
-RenderFrameHost* InterstitialPageImpl::GetMainFrame() {
+RenderFrameHostImpl* InterstitialPageImpl::GetMainFrame() {
   if (!render_view_host_)
     return nullptr;
-  return render_view_host_->GetMainFrame();
+  return static_cast<RenderFrameHostImpl*>(render_view_host_->GetMainFrame());
 }
 
 InterstitialPageDelegate* InterstitialPageImpl::GetDelegateForTesting() {
@@ -766,15 +763,14 @@ void InterstitialPageImpl::DontCreateViewForTesting() {
   create_view_ = false;
 }
 
-void InterstitialPageImpl::CreateNewWindow(
+RenderFrameHostDelegate* InterstitialPageImpl::CreateNewWindow(
     RenderFrameHost* opener,
-    int32_t render_view_route_id,
-    int32_t main_frame_route_id,
-    int32_t main_frame_widget_route_id,
     const mojom::CreateNewWindowParams& params,
+    bool is_new_browsing_instance,
     bool has_user_gesture,
     SessionStorageNamespace* session_storage_namespace) {
   NOTREACHED() << "InterstitialPage does not support showing popups.";
+  return nullptr;
 }
 
 void InterstitialPageImpl::SetFocusedFrame(FrameTreeNode* node,
@@ -792,15 +788,19 @@ Visibility InterstitialPageImpl::GetVisibility() {
   return Visibility::OCCLUDED;
 }
 
-void InterstitialPageImpl::CreateNewWidget(int32_t render_process_id,
-                                           int32_t route_id,
-                                           mojom::WidgetPtr widget) {
+void InterstitialPageImpl::CreateNewWidget(
+    int32_t render_process_id,
+    int32_t route_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    RenderViewHostImpl* render_view_host) {
   NOTREACHED() << "InterstitialPage does not support showing drop-downs.";
 }
 
-void InterstitialPageImpl::CreateNewFullscreenWidget(int32_t render_process_id,
-                                                     int32_t route_id,
-                                                     mojom::WidgetPtr widget) {
+void InterstitialPageImpl::CreateNewFullscreenWidget(
+    int32_t render_process_id,
+    int32_t route_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    RenderViewHostImpl* render_view_host) {
   NOTREACHED()
       << "InterstitialPage does not support showing full screen popups.";
 }
@@ -879,8 +879,8 @@ void InterstitialPageImpl::TakeActionOnResourceDispatcher(
   // The tab might not have a render_view_host if it was closed (in which case,
   // we have taken care of the blocked requests when processing
   // NOTIFY_RENDER_WIDGET_HOST_DESTROYED.
-  RenderViewHostImpl* rvh = RenderViewHostImpl::FromID(original_child_id_,
-                                                       original_rvh_id_);
+  RenderViewHostImpl* rvh =
+      RenderViewHostImpl::FromID(original_child_id_, original_rvh_id_);
   if (!rvh)
     return;
 
@@ -920,11 +920,9 @@ void InterstitialPageImpl::OnDomOperationResponse(
   delegate_->CommandReceived(json_string);
 }
 
-
 InterstitialPageImpl::InterstitialPageRVHDelegateView::
     InterstitialPageRVHDelegateView(InterstitialPageImpl* page)
-    : interstitial_page_(page) {
-}
+    : interstitial_page_(page) {}
 
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
 void InterstitialPageImpl::InterstitialPageRVHDelegateView::ShowPopupMenu(
@@ -951,8 +949,8 @@ void InterstitialPageImpl::InterstitialPageRVHDelegateView::StartDragging(
     const gfx::Vector2d& image_offset,
     const DragEventSourceInfo& event_info,
     RenderWidgetHostImpl* source_rwh) {
-  interstitial_page_->render_view_host_->GetWidget()->
-      DragSourceSystemDragEnded();
+  interstitial_page_->render_view_host_->GetWidget()
+      ->DragSourceSystemDragEnded();
   DVLOG(1) << "InterstitialPage does not support dragging yet.";
 }
 
@@ -1025,15 +1023,16 @@ bool InterstitialPageImpl::InterstitialPageRVHDelegateView::
 }
 
 void InterstitialPageImpl::InterstitialPageRVHDelegateView::OnFindReply(
-    int request_id, int number_of_matches, const gfx::Rect& selection_rect,
-    int active_match_ordinal, bool final_update) {
-}
+    int request_id,
+    int number_of_matches,
+    const gfx::Rect& selection_rect,
+    int active_match_ordinal,
+    bool final_update) {}
 
 InterstitialPageImpl::UnderlyingContentObserver::UnderlyingContentObserver(
     WebContents* web_contents,
     InterstitialPageImpl* interstitial)
-    : WebContentsObserver(web_contents), interstitial_(interstitial) {
-}
+    : WebContentsObserver(web_contents), interstitial_(interstitial) {}
 
 void InterstitialPageImpl::UnderlyingContentObserver::NavigationEntryCommitted(
     const LoadCommittedDetails& load_details) {
@@ -1045,8 +1044,9 @@ void InterstitialPageImpl::UnderlyingContentObserver::WebContentsDestroyed() {
 }
 
 TextInputManager* InterstitialPageImpl::GetTextInputManager() {
-  return !web_contents_ ? nullptr : static_cast<WebContentsImpl*>(web_contents_)
-                                        ->GetTextInputManager();
+  return !web_contents_ ? nullptr
+                        : static_cast<WebContentsImpl*>(web_contents_)
+                              ->GetTextInputManager();
 }
 
 RenderWidgetHostInputEventRouter* InterstitialPageImpl::GetInputEventRouter() {
diff --git a/chromium/content/browser/frame_host/interstitial_page_impl.h b/chromium/content/browser/frame_host/interstitial_page_impl.h
index 38439897fd2..1e9fd5102de 100644
--- a/chromium/content/browser/frame_host/interstitial_page_impl.h
+++ b/chromium/content/browser/frame_host/interstitial_page_impl.h
@@ -25,6 +25,7 @@
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_observer.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "url/gurl.h"
 
@@ -39,11 +40,7 @@ namespace mojom {
 class CreateNewWindowParams;
 }
 
-enum ResourceRequestAction {
-  BLOCK,
-  RESUME,
-  CANCEL
-};
+enum ResourceRequestAction { BLOCK, RESUME, CANCEL };
 
 class CONTENT_EXPORT InterstitialPageImpl : public InterstitialPage,
                                             public NotificationObserver,
@@ -73,7 +70,7 @@ class CONTENT_EXPORT InterstitialPageImpl : public InterstitialPage,
   void DontProceed() override;
   void Proceed() override;
   WebContents* GetWebContents() override;
-  RenderFrameHost* GetMainFrame() override;
+  RenderFrameHostImpl* GetMainFrame() override;
   InterstitialPageDelegate* GetDelegateForTesting() override;
   void DontCreateViewForTesting() override;
   void SetSize(const gfx::Size& size) override;
@@ -94,9 +91,8 @@ class CONTENT_EXPORT InterstitialPageImpl : public InterstitialPage,
 
   // TODO(nasko): This should move to InterstitialPageNavigatorImpl, but in
   // the meantime make it public, so it can be called directly.
-  void DidNavigate(
-      RenderViewHost* render_view_host,
-      const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
+  void DidNavigate(RenderViewHost* render_view_host,
+                   const FrameHostMsg_DidCommitProvisionalLoad_Params& params);
 
   // NavigatorDelegate implementation.
   WebContents* OpenURL(const OpenURLParams& params) override;
@@ -128,12 +124,10 @@ class CONTENT_EXPORT InterstitialPageImpl : public InterstitialPage,
   void Copy() override;
   void Paste() override;
   void SelectAll() override;
-  void CreateNewWindow(
+  RenderFrameHostDelegate* CreateNewWindow(
       RenderFrameHost* opener,
-      int32_t render_view_route_id,
-      int32_t main_frame_route_id,
-      int32_t main_frame_widget_route_id,
       const mojom::CreateNewWindowParams& params,
+      bool is_new_browsing_instance,
       bool has_user_gesture,
       SessionStorageNamespace* session_storage_namespace) override;
   void ShowCreatedWindow(int process_id,
@@ -160,10 +154,12 @@ class CONTENT_EXPORT InterstitialPageImpl : public InterstitialPage,
       BrowserContext* browser_context) const override;
   void CreateNewWidget(int32_t render_process_id,
                        int32_t route_id,
-                       mojom::WidgetPtr widget) override;
+                       mojo::PendingRemote<mojom::Widget> widget,
+                       RenderViewHostImpl* render_view_host) override;
   void CreateNewFullscreenWidget(int32_t render_process_id,
                                  int32_t route_id,
-                                 mojom::WidgetPtr widget) override;
+                                 mojo::PendingRemote<mojom::Widget> widget,
+                                 RenderViewHostImpl* render_view_host) override;
   void ShowCreatedWidget(int process_id,
                          int route_id,
                          const gfx::Rect& initial_rect) override;
diff --git a/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc b/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc
index 915f0623654..6fb9bfe899d 100644
--- a/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc
+++ b/chromium/content/browser/frame_host/interstitial_page_impl_browsertest.cc
@@ -115,8 +115,9 @@ class InterstitialPageImplTest : public ContentBrowserTest {
     WaitForInterstitialAttach(web_contents);
 
     // Focus the interstitial frame
-    FrameTree* frame_tree = static_cast<RenderViewHostDelegate*>(
-                                interstitial_.get())->GetFrameTree();
+    FrameTree* frame_tree =
+        static_cast<RenderViewHostDelegate*>(interstitial_.get())
+            ->GetFrameTree();
     static_cast<RenderFrameHostDelegate*>(interstitial_.get())
         ->SetFocusedFrame(frame_tree->root(),
                           frame_tree->GetMainFrame()->GetSiteInstance());
diff --git a/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h b/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h
index 28cded2c220..15479820fff 100644
--- a/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h
+++ b/chromium/content/browser/frame_host/interstitial_page_navigator_impl.h
@@ -7,7 +7,7 @@
 
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/common/content_export.h"
 
diff --git a/chromium/content/browser/frame_host/ipc_utils.cc b/chromium/content/browser/frame_host/ipc_utils.cc
index cc63fbdde31..f45019d7c75 100644
--- a/chromium/content/browser/frame_host/ipc_utils.cc
+++ b/chromium/content/browser/frame_host/ipc_utils.cc
@@ -64,14 +64,15 @@ bool VerifyInitiatorOrigin(int process_id,
 
 }  // namespace
 
-bool VerifyDownloadUrlParams(int process_id,
+bool VerifyDownloadUrlParams(SiteInstance* site_instance,
                              const FrameHostMsg_DownloadUrl_Params& params,
                              mojo::PendingRemote<blink::mojom::BlobURLToken>*
                                  out_blob_url_token_remote) {
-  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO) ||
-         BrowserThread::CurrentlyOn(BrowserThread::UI));
-  DCHECK_NE(ChildProcessHost::kInvalidUniqueID, process_id);
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  DCHECK(site_instance);
   DCHECK(out_blob_url_token_remote);
+  RenderProcessHost* process = site_instance->GetProcess();
+  int process_id = process->GetID();
 
   // Verify |params.blob_url_token| and populate |out_blob_url_token_remote|.
   if (!VerifyBlobToken(process_id, params.blob_url_token, params.url,
diff --git a/chromium/content/browser/frame_host/ipc_utils.h b/chromium/content/browser/frame_host/ipc_utils.h
index 496e80acb7c..709b7e32f72 100644
--- a/chromium/content/browser/frame_host/ipc_utils.h
+++ b/chromium/content/browser/frame_host/ipc_utils.h
@@ -18,7 +18,8 @@ namespace content {
 
 class SiteInstance;
 
-// Verifies that |params| are valid and can be accessed by |process_id|.
+// Verifies that |params| are valid and can be accessed by the renderer process
+// associated with |site_instance|.
 //
 // Returns true if the |params| are valid.  As a side-effect of the verification
 // |out_blob_url_token_remote| will be populated.
@@ -26,10 +27,9 @@ class SiteInstance;
 // Terminates the renderer with the given |process_id| and returns false if the
 // |params| are invalid.
 //
-// This function may be called on either the IO thread or the UI thread
-// (but not on other threads).
+// This function has to be called on the UI thread.
 bool VerifyDownloadUrlParams(
-    int process_id,
+    SiteInstance* site_instance,
     const FrameHostMsg_DownloadUrl_Params& params,
     mojo::PendingRemote<blink::mojom::BlobURLToken>* out_blob_url_token_remote);
 
diff --git a/chromium/content/browser/frame_host/keep_alive_handle_factory.cc b/chromium/content/browser/frame_host/keep_alive_handle_factory.cc
index 70b5ad3eec8..9d702d0356c 100644
--- a/chromium/content/browser/frame_host/keep_alive_handle_factory.cc
+++ b/chromium/content/browser/frame_host/keep_alive_handle_factory.cc
@@ -4,16 +4,20 @@
 
 #include "content/browser/frame_host/keep_alive_handle_factory.h"
 
+#include <memory>
+#include <utility>
+
 #include "base/bind.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/field_trial_params.h"
 #include "base/task/post_task.h"
+#include "content/common/frame.mojom.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_features.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
-#include "mojo/public/cpp/bindings/strong_binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/unique_receiver_set.h"
 
 namespace content {
 
@@ -44,9 +48,9 @@ class KeepAliveHandleFactory::Context final : public base::RefCounted<Context> {
                           timeout);
   }
 
-  void AddBinding(std::unique_ptr<mojom::KeepAliveHandle> impl,
-                  mojom::KeepAliveHandleRequest request) {
-    binding_set_.AddBinding(std::move(impl), std::move(request));
+  void AddReceiver(std::unique_ptr<mojom::KeepAliveHandle> impl,
+                   mojo::PendingReceiver<mojom::KeepAliveHandle> receiver) {
+    receiver_set_.Add(std::move(impl), std::move(receiver));
   }
 
   base::WeakPtr<Context> AsWeakPtr() { return weak_ptr_factory_.GetWeakPtr(); }
@@ -55,7 +59,7 @@ class KeepAliveHandleFactory::Context final : public base::RefCounted<Context> {
   friend class base::RefCounted<Context>;
   ~Context() { Detach(); }
 
-  mojo::StrongBindingSet<mojom::KeepAliveHandle> binding_set_;
+  mojo::UniqueReceiverSet<mojom::KeepAliveHandle> receiver_set_;
   const int process_id_;
   bool detached_ = false;
 
@@ -85,7 +89,8 @@ KeepAliveHandleFactory::~KeepAliveHandleFactory() {
     context_->DetachLater(timeout_);
 }
 
-void KeepAliveHandleFactory::Create(mojom::KeepAliveHandleRequest request) {
+void KeepAliveHandleFactory::Create(
+    mojo::PendingReceiver<mojom::KeepAliveHandle> receiver) {
   scoped_refptr<Context> context;
   if (context_) {
     context = context_.get();
@@ -94,8 +99,8 @@ void KeepAliveHandleFactory::Create(mojom::KeepAliveHandleRequest request) {
     context_ = context->AsWeakPtr();
   }
 
-  context->AddBinding(std::make_unique<KeepAliveHandleImpl>(context),
-                      std::move(request));
+  context->AddReceiver(std::make_unique<KeepAliveHandleImpl>(context),
+                       std::move(receiver));
 }
 
 void KeepAliveHandleFactory::SetTimeout(base::TimeDelta timeout) {
diff --git a/chromium/content/browser/frame_host/keep_alive_handle_factory.h b/chromium/content/browser/frame_host/keep_alive_handle_factory.h
index d5eb453b468..746ae5073c0 100644
--- a/chromium/content/browser/frame_host/keep_alive_handle_factory.h
+++ b/chromium/content/browser/frame_host/keep_alive_handle_factory.h
@@ -9,6 +9,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/time/time.h"
 #include "content/common/frame.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
@@ -25,7 +26,7 @@ class KeepAliveHandleFactory final {
   explicit KeepAliveHandleFactory(RenderProcessHost* process_host);
   ~KeepAliveHandleFactory();
 
-  void Create(mojom::KeepAliveHandleRequest request);
+  void Create(mojo::PendingReceiver<mojom::KeepAliveHandle> receiver);
 
   // Sets the timeout after which all created handles will be invalidated.
   void SetTimeout(base::TimeDelta timeout);
diff --git a/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc b/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc
index 07fb7852733..169d1c18600 100644
--- a/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc
+++ b/chromium/content/browser/frame_host/mixed_content_navigation_throttle.cc
@@ -8,7 +8,7 @@
 #include "base/stl_util.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/common/frame_messages.h"
@@ -67,7 +67,7 @@ bool DoesOriginSchemeRestrictMixedContent(const url::Origin& origin) {
   return origin.scheme() == url::kHttpsScheme;
 }
 
-void UpdateRendererOnMixedContentFound(NavigationHandleImpl* navigation_handle,
+void UpdateRendererOnMixedContentFound(NavigationRequest* navigation_request,
                                        const GURL& mixed_content_url,
                                        bool was_allowed,
                                        bool for_redirect) {
@@ -75,17 +75,19 @@ void UpdateRendererOnMixedContentFound(NavigationHandleImpl* navigation_handle,
   // mixed content for now. Once/if the browser should also check form submits
   // for mixed content than this will be allowed to happen and this DCHECK
   // should be updated.
-  DCHECK(navigation_handle->frame_tree_node()->parent());
+  DCHECK(navigation_request->frame_tree_node()->parent());
   RenderFrameHost* rfh =
-      navigation_handle->frame_tree_node()->current_frame_host();
+      navigation_request->frame_tree_node()->current_frame_host();
   FrameMsg_MixedContentFound_Params params;
   params.main_resource_url = mixed_content_url;
-  params.mixed_content_url = navigation_handle->GetURL();
-  params.request_context_type = navigation_handle->request_context_type();
+  params.mixed_content_url = navigation_request->GetURL();
+  params.request_context_type = navigation_request->request_context_type();
   params.was_allowed = was_allowed;
   params.had_redirect = for_redirect;
-  if (navigation_handle->source_location())
-    params.source_location = navigation_handle->source_location().value();
+  if (navigation_request->common_params().source_location) {
+    params.source_location =
+        navigation_request->common_params().source_location.value();
+  }
 
   rfh->Send(new FrameMsg_MixedContentFound(rfh->GetRoutingID(), params));
 }
@@ -101,8 +103,7 @@ MixedContentNavigationThrottle::CreateThrottleForNavigation(
 
 MixedContentNavigationThrottle::MixedContentNavigationThrottle(
     NavigationHandle* navigation_handle)
-    : NavigationThrottle(navigation_handle) {
-}
+    : NavigationThrottle(navigation_handle) {}
 
 MixedContentNavigationThrottle::~MixedContentNavigationThrottle() {}
 
@@ -135,13 +136,12 @@ const char* MixedContentNavigationThrottle::GetNameForLogging() {
 
 // Based off of MixedContentChecker::shouldBlockFetch.
 bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
-  NavigationHandleImpl* handle_impl =
-      static_cast<NavigationHandleImpl*>(navigation_handle());
-  FrameTreeNode* node = handle_impl->frame_tree_node();
+  NavigationRequest* request = NavigationRequest::From(navigation_handle());
+  FrameTreeNode* node = request->frame_tree_node();
 
   // Find the parent node where mixed content is characterized, if any.
   FrameTreeNode* mixed_content_node =
-      InWhichFrameIsContentMixed(node, handle_impl->GetURL());
+      InWhichFrameIsContentMixed(node, request->GetURL());
   if (!mixed_content_node) {
     MaybeSendBlinkFeatureUsageReport();
     return false;
@@ -150,8 +150,8 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
   // From this point on we know this is not a main frame navigation and that
   // there is mixed content. Now let's decide if it's OK to proceed with it.
 
-  ReportBasicMixedContentFeatures(handle_impl->request_context_type(),
-                                  handle_impl->mixed_content_context_type());
+  ReportBasicMixedContentFeatures(request->request_context_type(),
+                                  request->mixed_content_context_type());
 
   // If we're in strict mode, we'll automagically fail everything, and
   // intentionally skip the client/embedder checks in order to prevent degrading
@@ -166,11 +166,12 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
       prefs.strict_mixed_content_checking || block_all_mixed_content;
 
   blink::WebMixedContentContextType mixed_context_type =
-      handle_impl->mixed_content_context_type();
+      request->mixed_content_context_type();
 
-  if (!ShouldTreatURLSchemeAsCorsEnabled(handle_impl->GetURL()))
+  if (!ShouldTreatURLSchemeAsCorsEnabled(request->GetURL())) {
     mixed_context_type =
         blink::WebMixedContentContextType::kOptionallyBlockable;
+  }
 
   bool allowed = false;
   RenderFrameHostDelegate* frame_host_delegate =
@@ -179,7 +180,7 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
     case blink::WebMixedContentContextType::kOptionallyBlockable:
       allowed = !strict_mode;
       if (allowed) {
-        frame_host_delegate->PassiveInsecureContentFound(handle_impl->GetURL());
+        frame_host_delegate->PassiveInsecureContentFound(request->GetURL());
         frame_host_delegate->DidDisplayInsecureContent();
       }
       break;
@@ -193,16 +194,15 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
       bool should_ask_delegate =
           !strict_mode && (!prefs.strictly_block_blockable_mixed_content ||
                            prefs.allow_running_insecure_content);
-      allowed =
-          should_ask_delegate &&
-          frame_host_delegate->ShouldAllowRunningInsecureContent(
-              handle_impl->GetWebContents(),
-              prefs.allow_running_insecure_content,
-              mixed_content_node->current_origin(), handle_impl->GetURL());
+      allowed = should_ask_delegate &&
+                frame_host_delegate->ShouldAllowRunningInsecureContent(
+                    navigation_handle()->GetWebContents(),
+                    prefs.allow_running_insecure_content,
+                    mixed_content_node->current_origin(), request->GetURL());
       if (allowed) {
         const GURL& origin_url = mixed_content_node->current_origin().GetURL();
         frame_host_delegate->DidRunInsecureContent(origin_url,
-                                                   handle_impl->GetURL());
+                                                   request->GetURL());
         GetContentClient()->browser()->RecordURLMetric(
             "ContentSettings.MixedScript.RanMixedScript", origin_url);
         mixed_content_features_.insert(
@@ -222,8 +222,8 @@ bool MixedContentNavigationThrottle::ShouldBlockNavigation(bool for_redirect) {
       break;
   };
 
-  UpdateRendererOnMixedContentFound(
-      handle_impl, mixed_content_node->current_url(), allowed, for_redirect);
+  UpdateRendererOnMixedContentFound(request, mixed_content_node->current_url(),
+                                    allowed, for_redirect);
   MaybeSendBlinkFeatureUsageReport();
 
   return !allowed;
@@ -287,9 +287,8 @@ FrameTreeNode* MixedContentNavigationThrottle::InWhichFrameIsContentMixed(
 
 void MixedContentNavigationThrottle::MaybeSendBlinkFeatureUsageReport() {
   if (!mixed_content_features_.empty()) {
-    NavigationHandleImpl* handle_impl =
-        static_cast<NavigationHandleImpl*>(navigation_handle());
-    RenderFrameHost* rfh = handle_impl->frame_tree_node()->current_frame_host();
+    NavigationRequest* request = NavigationRequest::From(navigation_handle());
+    RenderFrameHost* rfh = request->frame_tree_node()->current_frame_host();
     rfh->Send(new FrameMsg_BlinkFeatureUsageReport(rfh->GetRoutingID(),
                                                    mixed_content_features_));
     mixed_content_features_.clear();
diff --git a/chromium/content/browser/frame_host/mixed_content_navigation_throttle_unittest.cc b/chromium/content/browser/frame_host/mixed_content_navigation_throttle_unittest.cc
index 244a4a5f3d4..06f53c27b87 100644
--- a/chromium/content/browser/frame_host/mixed_content_navigation_throttle_unittest.cc
+++ b/chromium/content/browser/frame_host/mixed_content_navigation_throttle_unittest.cc
@@ -55,4 +55,4 @@ TEST(MixedContentNavigationThrottleTest, IsMixedContent) {
   }
 }
 
-}  // content
\ No newline at end of file
+}  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_controller_android.cc b/chromium/content/browser/frame_host/navigation_controller_android.cc
index 06f8feddb0d..e32b83aa622 100644
--- a/chromium/content/browser/frame_host/navigation_controller_android.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_android.cc
@@ -16,6 +16,7 @@
 #include "content/public/android/content_jni_headers/NavigationControllerImpl_jni.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/ssl_host_state_delegate.h"
+#include "content/public/common/referrer.h"
 #include "content/public/common/resource_request_body_android.h"
 #include "net/base/data_url.h"
 #include "ui/gfx/android/java_bitmap.h"
@@ -112,9 +113,9 @@ NavigationControllerAndroid::NavigationControllerAndroid(
     NavigationControllerImpl* navigation_controller)
     : navigation_controller_(navigation_controller) {
   JNIEnv* env = AttachCurrentThread();
-  obj_.Reset(env,
-             Java_NavigationControllerImpl_create(
-                 env, reinterpret_cast<intptr_t>(this)).obj());
+  obj_.Reset(env, Java_NavigationControllerImpl_create(
+                      env, reinterpret_cast<intptr_t>(this))
+                      .obj());
 }
 
 NavigationControllerAndroid::~NavigationControllerAndroid() {
@@ -282,9 +283,9 @@ void NavigationControllerAndroid::LoadUrl(
   }
 
   if (j_referrer_url) {
-    params.referrer = content::Referrer(
-        GURL(ConvertJavaStringToUTF8(env, j_referrer_url)),
-        static_cast<network::mojom::ReferrerPolicy>(referrer_policy));
+    params.referrer =
+        Referrer(GURL(ConvertJavaStringToUTF8(env, j_referrer_url)),
+                 Referrer::ConvertToPolicy(referrer_policy));
   }
 
   navigation_controller_->LoadURLWithParams(params);
@@ -323,8 +324,7 @@ void NavigationControllerAndroid::GetDirectedNavigationHistory(
   int num_added = 0;
   int increment_value = is_forward ? 1 : -1;
   for (int i = navigation_controller_->GetCurrentEntryIndex() + increment_value;
-       i >= 0 && i < count;
-       i += increment_value) {
+       i >= 0 && i < count; i += increment_value) {
     if (num_added >= max_entries)
       break;
 
@@ -337,7 +337,7 @@ void NavigationControllerAndroid::GetDirectedNavigationHistory(
 void NavigationControllerAndroid::ClearSslPreferences(
     JNIEnv* env,
     const JavaParamRef<jobject>& obj) {
-  content::SSLHostStateDelegate* delegate =
+  SSLHostStateDelegate* delegate =
       navigation_controller_->GetBrowserContext()->GetSSLHostStateDelegate();
   if (delegate)
     delegate->Clear(base::Callback<bool(const std::string&)>());
@@ -382,8 +382,7 @@ NavigationControllerAndroid::GetEntryAtIndex(JNIEnv* env,
   if (index < 0 || index >= navigation_controller_->GetEntryCount())
     return base::android::ScopedJavaLocalRef<jobject>();
 
-  content::NavigationEntry* entry =
-      navigation_controller_->GetEntryAtIndex(index);
+  NavigationEntry* entry = navigation_controller_->GetEntryAtIndex(index);
   return JNI_NavigationControllerImpl_CreateJavaNavigationEntry(env, entry,
                                                                 index);
 }
@@ -391,7 +390,7 @@ NavigationControllerAndroid::GetEntryAtIndex(JNIEnv* env,
 base::android::ScopedJavaLocalRef<jobject>
 NavigationControllerAndroid::GetVisibleEntry(JNIEnv* env,
                                              const JavaParamRef<jobject>& obj) {
-  content::NavigationEntry* entry = navigation_controller_->GetVisibleEntry();
+  NavigationEntry* entry = navigation_controller_->GetVisibleEntry();
 
   if (!entry)
     return base::android::ScopedJavaLocalRef<jobject>();
@@ -403,7 +402,7 @@ NavigationControllerAndroid::GetVisibleEntry(JNIEnv* env,
 base::android::ScopedJavaLocalRef<jobject>
 NavigationControllerAndroid::GetPendingEntry(JNIEnv* env,
                                              const JavaParamRef<jobject>& obj) {
-  content::NavigationEntry* entry = navigation_controller_->GetPendingEntry();
+  NavigationEntry* entry = navigation_controller_->GetPendingEntry();
 
   if (!entry)
     return base::android::ScopedJavaLocalRef<jobject>();
@@ -425,6 +424,12 @@ jboolean NavigationControllerAndroid::RemoveEntryAtIndex(
   return navigation_controller_->RemoveEntryAtIndex(index);
 }
 
+void NavigationControllerAndroid::PruneForwardEntries(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& obj) {
+  return navigation_controller_->PruneForwardEntries();
+}
+
 ScopedJavaLocalRef<jstring> NavigationControllerAndroid::GetEntryExtraData(
     JNIEnv* env,
     const JavaParamRef<jobject>& obj,
diff --git a/chromium/content/browser/frame_host/navigation_controller_android.h b/chromium/content/browser/frame_host/navigation_controller_android.h
index 7f01993722c..261353ca32b 100644
--- a/chromium/content/browser/frame_host/navigation_controller_android.h
+++ b/chromium/content/browser/frame_host/navigation_controller_android.h
@@ -119,6 +119,8 @@ class CONTENT_EXPORT NavigationControllerAndroid {
   jboolean RemoveEntryAtIndex(JNIEnv* env,
                               const base::android::JavaParamRef<jobject>& obj,
                               jint index);
+  void PruneForwardEntries(JNIEnv* env,
+                           const base::android::JavaParamRef<jobject>& obj);
   base::android::ScopedJavaLocalRef<jstring> GetEntryExtraData(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>& obj,
diff --git a/chromium/content/browser/frame_host/navigation_controller_delegate.h b/chromium/content/browser/frame_host/navigation_controller_delegate.h
index 2615790454e..e738630db57 100644
--- a/chromium/content/browser/frame_host/navigation_controller_delegate.h
+++ b/chromium/content/browser/frame_host/navigation_controller_delegate.h
@@ -56,6 +56,10 @@ class NavigationControllerDelegate {
   virtual void ActivateAndShowRepostFormWarningDialog() = 0;
   virtual bool HasAccessedInitialDocument() = 0;
 
+  // Returns whether URLs for aborted browser-initiated navigations should be
+  // preserved in the omnibox.  Defaults to false.
+  virtual bool ShouldPreserveAbortedURLs() = 0;
+
   // TODO(crbug.com/934637): Remove when pdf and any inner web contents user
   // gesture is properly propagated.
   virtual bool HadInnerWebContents() = 0;
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl.cc b/chromium/content/browser/frame_host/navigation_controller_impl.cc
index dacaa680682..b2dfa02a989 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_impl.cc
@@ -35,13 +35,13 @@
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
+#include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_macros.h"
-#include "base/strings/string_number_conversions.h"  // Temporary
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
@@ -56,10 +56,10 @@
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
-#include "content/browser/renderer_host/render_view_host_impl.h"  // Temporary
 #include "content/browser/site_instance_impl.h"
+#include "content/browser/web_package/bundled_exchanges_navigation_info.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/frame_messages.h"
 #include "content/common/view_messages.h"
@@ -69,6 +69,7 @@
 #include "content/public/browser/navigation_details.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/replaced_navigation_entry_data.h"
@@ -76,6 +77,7 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
+#include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "media/base/mime_util.h"
 #include "net/base/escape.h"
@@ -102,30 +104,16 @@ void NotifyPrunedEntries(NavigationControllerImpl* nav_controller,
   nav_controller->delegate()->NotifyNavigationListPruned(details);
 }
 
-// Ensure the given NavigationEntry has a valid state, so that WebKit does not
-// get confused if we navigate back to it.
-//
-// An empty state is treated as a new navigation by WebKit, which would mean
-// losing the navigation entries and generating a new navigation entry after
-// this one. We don't want that. To avoid this we create a valid state which
-// WebKit will not treat as a new navigation.
-void SetPageStateIfEmpty(NavigationEntryImpl* entry) {
-  if (!entry->GetPageState().IsValid())
-    entry->SetPageState(PageState::CreateFromURL(entry->GetURL()));
-}
-
 // Configure all the NavigationEntries in entries for restore. This resets
 // the transition type to reload and makes sure the content state isn't empty.
 void ConfigureEntriesForRestore(
     std::vector<std::unique_ptr<NavigationEntryImpl>>* entries,
     RestoreType type) {
-  for (size_t i = 0; i < entries->size(); ++i) {
+  for (auto& entry : *entries) {
     // Use a transition type of reload so that we don't incorrectly increase
     // the typed count.
-    (*entries)[i]->SetTransitionType(ui::PAGE_TRANSITION_RELOAD);
-    (*entries)[i]->set_restore_type(type);
-    // NOTE(darin): This code is only needed for backwards compat.
-    SetPageStateIfEmpty((*entries)[i].get());
+    entry->SetTransitionType(ui::PAGE_TRANSITION_RELOAD);
+    entry->set_restore_type(type);
   }
 }
 
@@ -146,8 +134,6 @@ bool ShouldOverrideUserAgent(
       return true;
     case NavigationController::UA_OVERRIDE_FALSE:
       return false;
-    default:
-      break;
   }
   NOTREACHED();
   return false;
@@ -321,18 +307,15 @@ mojom::NavigationType GetNavigationType(const GURL& old_url,
   }
 
   if (entry->restore_type() == RestoreType::LAST_SESSION_EXITED_CLEANLY) {
-    if (entry->GetHasPostData())
-      return mojom::NavigationType::RESTORE_WITH_POST;
-    else
-      return mojom::NavigationType::RESTORE;
+    return entry->GetHasPostData() ? mojom::NavigationType::RESTORE_WITH_POST
+                                   : mojom::NavigationType::RESTORE;
   }
 
   // History navigations.
   if (frame_entry.page_state().IsValid()) {
-    if (is_same_document_history_load)
-      return mojom::NavigationType::HISTORY_SAME_DOCUMENT;
-    else
-      return mojom::NavigationType::HISTORY_DIFFERENT_DOCUMENT;
+    return is_same_document_history_load
+               ? mojom::NavigationType::HISTORY_SAME_DOCUMENT
+               : mojom::NavigationType::HISTORY_DIFFERENT_DOCUMENT;
   }
   DCHECK(!is_same_document_history_load);
 
@@ -347,12 +330,10 @@ mojom::NavigationType GetNavigationType(const GURL& old_url,
   // history navigation from 'A#foo' to 'A#bar' is not a same-document
   // navigation, but a different-document one. This is why history navigation
   // are classified before this check.
-  if (new_url.has_ref() && old_url.EqualsIgnoringRef(new_url) &&
-      frame_entry.method() == "GET") {
-    return mojom::NavigationType::SAME_DOCUMENT;
-  } else {
-    return mojom::NavigationType::DIFFERENT_DOCUMENT;
-  }
+  bool is_same_doc = new_url.has_ref() && old_url.EqualsIgnoringRef(new_url) &&
+                     frame_entry.method() == "GET";
+  return is_same_doc ? mojom::NavigationType::SAME_DOCUMENT
+                     : mojom::NavigationType::DIFFERENT_DOCUMENT;
 }
 
 // Adjusts the original input URL if needed, to get the URL to actually load and
@@ -447,6 +428,19 @@ bool DoesSandboxNavigationStayWithinSubtree(
 
 }  // namespace
 
+// NavigationControllerImpl::PendingEntryRef------------------------------------
+
+NavigationControllerImpl::PendingEntryRef::PendingEntryRef(
+    base::WeakPtr<NavigationControllerImpl> controller)
+    : controller_(controller) {}
+
+NavigationControllerImpl::PendingEntryRef::~PendingEntryRef() {
+  if (!controller_)  // Can be null with interstitials.
+    return;
+
+  controller_->PendingEntryRefDeleted(this);
+}
+
 // NavigationControllerImpl ----------------------------------------------------
 
 const size_t kMaxEntryCountForTestingNotSet = static_cast<size_t>(-1);
@@ -462,8 +456,26 @@ static bool g_check_for_repost = true;
 // static
 std::unique_ptr<NavigationEntry> NavigationController::CreateNavigationEntry(
     const GURL& url,
-    const Referrer& referrer,
-    const base::Optional<url::Origin>& initiator_origin,
+    Referrer referrer,
+    base::Optional<url::Origin> initiator_origin,
+    ui::PageTransition transition,
+    bool is_renderer_initiated,
+    const std::string& extra_headers,
+    BrowserContext* browser_context,
+    scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {
+  return NavigationControllerImpl::CreateNavigationEntry(
+      url, referrer, std::move(initiator_origin),
+      nullptr /* source_site_instance */, transition, is_renderer_initiated,
+      extra_headers, browser_context, std::move(blob_url_loader_factory));
+}
+
+// static
+std::unique_ptr<NavigationEntryImpl>
+NavigationControllerImpl::CreateNavigationEntry(
+    const GURL& url,
+    Referrer referrer,
+    base::Optional<url::Origin> initiator_origin,
+    SiteInstance* source_site_instance,
     ui::PageTransition transition,
     bool is_renderer_initiated,
     const std::string& extra_headers,
@@ -475,6 +487,12 @@ std::unique_ptr<NavigationEntry> NavigationController::CreateNavigationEntry(
   RewriteUrlForNavigation(url, browser_context, &url_to_load, &virtual_url,
                           &reverse_on_redirect);
 
+  // Let the NTP override the navigation params and pretend that this is a
+  // browser-initiated, bookmark-like navigation.
+  GetContentClient()->browser()->OverrideNavigationParams(
+      source_site_instance, &transition, &is_renderer_initiated, &referrer,
+      &initiator_origin);
+
   auto entry = std::make_unique<NavigationEntryImpl>(
       nullptr,  // The site instance for tabs is sent on navigation
                 // (WebContents::GetSiteInstance).
@@ -512,18 +530,9 @@ NavigationControllerImpl::NavigationControllerImpl(
     NavigationControllerDelegate* delegate,
     BrowserContext* browser_context)
     : browser_context_(browser_context),
-      pending_entry_(nullptr),
-      failed_pending_entry_id_(0),
-      last_committed_entry_index_(-1),
-      pending_entry_index_(-1),
-      transient_entry_index_(-1),
       delegate_(delegate),
       ssl_manager_(this),
-      needs_reload_(false),
-      is_initial_navigation_(true),
-      in_navigate_to_pending_entry_(false),
-      pending_reload_(ReloadType::NONE),
-      get_timestamp_callback_(base::Bind(&base::Time::Now)) {
+      get_timestamp_callback_(base::BindRepeating(&base::Time::Now)) {
   DCHECK(browser_context_);
 }
 
@@ -547,7 +556,8 @@ void NavigationControllerImpl::Restore(
     RestoreType type,
     std::vector<std::unique_ptr<NavigationEntry>>* entries) {
   // Verify that this controller is unused and that the input is valid.
-  DCHECK(GetEntryCount() == 0 && !GetPendingEntry());
+  DCHECK_EQ(0, GetEntryCount());
+  DCHECK(!GetPendingEntry());
   DCHECK(selected_navigation >= 0 &&
          selected_navigation < static_cast<int>(entries->size()));
   DCHECK_EQ(-1, pending_entry_index_);
@@ -577,9 +587,7 @@ void NavigationControllerImpl::Reload(ReloadType reload_type,
     NavigationEntryImpl* transient_entry = GetTransientEntry();
     if (!transient_entry)
       return;
-    LoadURL(transient_entry->GetURL(),
-            Referrer(),
-            ui::PAGE_TRANSITION_RELOAD,
+    LoadURL(transient_entry->GetURL(), Referrer(), ui::PAGE_TRANSITION_RELOAD,
             transient_entry->extra_headers());
     return;
   }
@@ -587,9 +595,20 @@ void NavigationControllerImpl::Reload(ReloadType reload_type,
   NavigationEntryImpl* entry = nullptr;
   int current_index = -1;
 
-  // If we are reloading the initial navigation, just use the current
-  // pending entry.  Otherwise look up the current entry.
-  if (IsInitialNavigation() && pending_entry_) {
+  if (entry_replaced_by_post_commit_error_) {
+    // If there is an entry that was replaced by a currently active post-commit
+    // error navigation, this can't be the initial navigation.
+    DCHECK(!IsInitialNavigation());
+    // If the current entry is a post commit error, we reload the entry it
+    // replaced instead. We leave the error entry in place until a commit
+    // replaces it, but the pending entry points to the original entry in the
+    // meantime. Note that NavigateToExistingPendingEntry is able to handle the
+    // case that pending_entry_ != entries_[pending_entry_index_].
+    entry = entry_replaced_by_post_commit_error_.get();
+    current_index = GetCurrentEntryIndex();
+  } else if (IsInitialNavigation() && pending_entry_) {
+    // If we are reloading the initial navigation, just use the current
+    // pending entry.  Otherwise look up the current entry.
     entry = pending_entry_;
     // The pending entry might be in entries_ (e.g., after a Clone), so we
     // should also update the current_index.
@@ -610,8 +629,7 @@ void NavigationControllerImpl::Reload(ReloadType reload_type,
   // Set ReloadType for |entry|.
   entry->set_reload_type(reload_type);
 
-  if (g_check_for_repost && check_for_repost &&
-      entry->GetHasPostData()) {
+  if (g_check_for_repost && check_for_repost && entry->GetHasPostData()) {
     // The user is asking to reload a page with POST data. Prompt to make sure
     // they really want to do this. If they do, the dialog will call us back
     // with check_for_repost = false.
@@ -619,17 +637,18 @@ void NavigationControllerImpl::Reload(ReloadType reload_type,
 
     pending_reload_ = reload_type;
     delegate_->ActivateAndShowRepostFormWarningDialog();
-  } else {
-    if (!IsInitialNavigation())
-      DiscardNonCommittedEntries();
+    return;
+  }
 
-    pending_entry_ = entry;
-    pending_entry_index_ = current_index;
-    pending_entry_->SetTransitionType(ui::PAGE_TRANSITION_RELOAD);
+  if (!IsInitialNavigation())
+    DiscardNonCommittedEntries();
 
-    NavigateToExistingPendingEntry(reload_type,
-                                   FrameTreeNode::kFrameTreeNodeInvalidId);
-  }
+  pending_entry_ = entry;
+  pending_entry_index_ = current_index;
+  pending_entry_->SetTransitionType(ui::PAGE_TRANSITION_RELOAD);
+
+  NavigateToExistingPendingEntry(reload_type,
+                                 FrameTreeNode::kFrameTreeNodeInvalidId);
 }
 
 void NavigationControllerImpl::CancelPendingReload() {
@@ -657,8 +676,8 @@ bool NavigationControllerImpl::IsInitialBlankNavigation() {
   return IsInitialNavigation() && GetEntryCount() == 0;
 }
 
-NavigationEntryImpl*
-NavigationControllerImpl::GetEntryWithUniqueID(int nav_entry_id) const {
+NavigationEntryImpl* NavigationControllerImpl::GetEntryWithUniqueID(
+    int nav_entry_id) const {
   int index = GetEntryIndexWithUniqueID(nav_entry_id);
   return (index != -1) ? entries_[index].get() : nullptr;
 }
@@ -669,8 +688,7 @@ void NavigationControllerImpl::SetPendingEntry(
   pending_entry_ = entry.release();
   DCHECK_EQ(-1, pending_entry_index_);
   NotificationService::current()->Notify(
-      NOTIFICATION_NAV_ENTRY_PENDING,
-      Source<NavigationController>(this),
+      NOTIFICATION_NAV_ENTRY_PENDING, Source<NavigationController>(this),
       Details<NavigationEntry>(pending_entry_));
 }
 
@@ -703,11 +721,8 @@ NavigationEntryImpl* NavigationControllerImpl::GetVisibleEntry() {
   // Also allow showing the pending entry for history navigations in a new tab,
   // such as Ctrl+Back.  In this case, no existing page is visible and no one
   // can script the new tab before it commits.
-  if (!safe_to_show_pending &&
-      pending_entry_ &&
-      pending_entry_index_ != -1 &&
-      IsInitialNavigation() &&
-      !pending_entry_->is_renderer_initiated())
+  if (!safe_to_show_pending && pending_entry_ && pending_entry_index_ != -1 &&
+      IsInitialNavigation() && !pending_entry_->is_renderer_initiated())
     safe_to_show_pending = true;
 
   if (safe_to_show_pending)
@@ -735,7 +750,7 @@ bool NavigationControllerImpl::CanViewSource() {
                                !media::IsSupportedMediaMimeType(mime_type);
   NavigationEntry* visible_entry = GetVisibleEntry();
   return visible_entry && !visible_entry->IsViewSourceMode() &&
-      is_viewable_mime_type && !delegate_->GetInterstitialPage();
+         is_viewable_mime_type && !delegate_->GetInterstitialPage();
 }
 
 int NavigationControllerImpl::GetLastCommittedEntryIndex() {
@@ -796,8 +811,8 @@ void NavigationControllerImpl::GoBack() {
   // history intervention is enabled.
   int count_entries_skipped = 0;
   bool all_skippable_entries = true;
-  bool history_intervention_enabled = base::FeatureList::IsEnabled(
-              features::kHistoryManipulationIntervention);
+  bool history_intervention_enabled =
+      base::FeatureList::IsEnabled(features::kHistoryManipulationIntervention);
   for (int index = target_index; index >= 0; index--) {
     if (GetEntryAtIndex(index)->should_skip_on_back_forward_ui()) {
       count_entries_skipped++;
@@ -832,8 +847,8 @@ void NavigationControllerImpl::GoForward() {
   // entries are marked skippable only when they add another entry because of
   // redirect or pushState.
   int count_entries_skipped = 0;
-  bool history_intervention_enabled = base::FeatureList::IsEnabled(
-              features::kHistoryManipulationIntervention);
+  bool history_intervention_enabled =
+      base::FeatureList::IsEnabled(features::kHistoryManipulationIntervention);
   for (size_t index = target_index; index < entries_.size(); index++) {
     if (GetEntryAtIndex(index)->should_skip_on_back_forward_ui()) {
       count_entries_skipped++;
@@ -893,16 +908,26 @@ void NavigationControllerImpl::GoToOffset(int offset) {
 }
 
 bool NavigationControllerImpl::RemoveEntryAtIndex(int index) {
-  if (index == last_committed_entry_index_ ||
-      index == pending_entry_index_)
+  if (index == last_committed_entry_index_ || index == pending_entry_index_)
     return false;
 
   RemoveEntryAtIndexInternal(index);
   return true;
 }
 
-void NavigationControllerImpl::UpdateVirtualURLToURL(
-    NavigationEntryImpl* entry, const GURL& new_url) {
+void NavigationControllerImpl::PruneForwardEntries() {
+  DiscardNonCommittedEntries();
+  int remove_start_index = last_committed_entry_index_ + 1;
+  int num_removed = static_cast<int>(entries_.size()) - remove_start_index;
+  if (num_removed <= 0)
+    return;
+  entries_.erase(entries_.begin() + remove_start_index, entries_.end());
+  NotifyPrunedEntries(this, remove_start_index /* start index */,
+                      num_removed /* count */);
+}
+
+void NavigationControllerImpl::UpdateVirtualURLToURL(NavigationEntryImpl* entry,
+                                                     const GURL& new_url) {
   GURL new_virtual_url(new_url);
   if (BrowserURLHandlerImpl::GetInstance()->ReverseURLRewrite(
           &new_virtual_url, entry->GetVirtualURL(), browser_context_)) {
@@ -910,11 +935,10 @@ void NavigationControllerImpl::UpdateVirtualURLToURL(
   }
 }
 
-void NavigationControllerImpl::LoadURL(
-    const GURL& url,
-    const Referrer& referrer,
-    ui::PageTransition transition,
-    const std::string& extra_headers) {
+void NavigationControllerImpl::LoadURL(const GURL& url,
+                                       const Referrer& referrer,
+                                       ui::PageTransition transition,
+                                       const std::string& extra_headers) {
   LoadURLParams params(url);
   params.referrer = referrer;
   params.transition_type = transition;
@@ -927,9 +951,13 @@ void NavigationControllerImpl::LoadURLWithParams(const LoadURLParams& params) {
     DCHECK(params.initiator_origin.has_value());
 
   TRACE_EVENT1("browser,navigation",
-               "NavigationControllerImpl::LoadURLWithParams",
-               "url", params.url.possibly_invalid_spec());
-  if (HandleDebugURL(params.url, params.transition_type)) {
+               "NavigationControllerImpl::LoadURLWithParams", "url",
+               params.url.possibly_invalid_spec());
+  bool is_explicit_navigation =
+      GetContentClient()->browser()->IsExplicitNavigation(
+          params.transition_type);
+  if (HandleDebugURL(params.url, params.transition_type,
+                     is_explicit_navigation)) {
     // If Telemetry is running, allow the URL load to proceed as if it's
     // unhandled, otherwise Telemetry can't tell if Navigation completed.
     if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -948,9 +976,6 @@ void NavigationControllerImpl::LoadURLWithParams(const LoadURLParams& params) {
         return;
       }
       break;
-    default:
-      NOTREACHED();
-      break;
   }
 
   // The user initiated a load, we don't need to reload anymore.
@@ -959,10 +984,10 @@ void NavigationControllerImpl::LoadURLWithParams(const LoadURLParams& params) {
   NavigateWithoutEntry(params);
 }
 
-bool NavigationControllerImpl::PendingEntryMatchesHandle(
-    NavigationHandleImpl* handle) const {
+bool NavigationControllerImpl::PendingEntryMatchesRequest(
+    NavigationRequest* request) const {
   return pending_entry_ &&
-         pending_entry_->GetUniqueID() == handle->pending_nav_entry_id();
+         pending_entry_->GetUniqueID() == request->nav_entry_id();
 }
 
 bool NavigationControllerImpl::RendererDidNavigate(
@@ -978,6 +1003,21 @@ bool NavigationControllerImpl::RendererDidNavigate(
   // Save the previous state before we clobber it.
   bool overriding_user_agent_changed = false;
   if (GetLastCommittedEntry()) {
+    if (entry_replaced_by_post_commit_error_) {
+      if (is_same_document_navigation) {
+        // Same document navigations should not be possible on error pages and
+        // would leave the controller in a weird state. Kill the renderer if
+        // that happens.
+        bad_message::ReceivedBadMessage(
+            rfh->GetProcess(), bad_message::NC_SAME_DOCUMENT_POST_COMMIT_ERROR);
+      }
+      // Any commit while a post-commit error page is showing should put the
+      // original entry back, replacing the error page's entry.  This includes
+      // reloads, where the original entry was used as the pending entry and
+      // should now be at the correct index at commit time.
+      entries_[last_committed_entry_index_] =
+          std::move(entry_replaced_by_post_commit_error_);
+    }
     details->previous_url = GetLastCommittedEntry()->GetURL();
     details->previous_entry_index = GetLastCommittedEntryIndex();
     if (pending_entry_ &&
@@ -1048,35 +1088,33 @@ bool NavigationControllerImpl::RendererDidNavigate(
   // renderer.  Limit this to a very narrow set of conditions to avoid risks to
   // other navigation types. See https://crbug.com/900036.
   // TODO(crbug.com/926009): Handle history.pushState() as well.
-  NavigationHandleImpl* navigation_handle =
-      navigation_request->navigation_handle();
   bool keep_pending_entry = is_same_document_navigation &&
                             details->type == NAVIGATION_TYPE_EXISTING_PAGE &&
                             pending_entry_ &&
-                            !PendingEntryMatchesHandle(navigation_handle);
+                            !PendingEntryMatchesRequest(navigation_request);
 
   switch (details->type) {
     case NAVIGATION_TYPE_NEW_PAGE:
       RendererDidNavigateToNewPage(
           rfh, params, details->is_same_document, details->did_replace_entry,
-          previous_document_was_activated, navigation_handle);
+          previous_document_was_activated, navigation_request);
       break;
     case NAVIGATION_TYPE_EXISTING_PAGE:
       RendererDidNavigateToExistingPage(rfh, params, details->is_same_document,
-                                        was_restored, navigation_handle,
+                                        was_restored, navigation_request,
                                         keep_pending_entry);
       break;
     case NAVIGATION_TYPE_SAME_PAGE:
       RendererDidNavigateToSamePage(rfh, params, details->is_same_document,
-                                    navigation_handle);
+                                    navigation_request);
       break;
     case NAVIGATION_TYPE_NEW_SUBFRAME:
       RendererDidNavigateNewSubframe(
           rfh, params, details->is_same_document, details->did_replace_entry,
-          previous_document_was_activated, navigation_handle);
+          previous_document_was_activated, navigation_request);
       break;
     case NAVIGATION_TYPE_AUTO_SUBFRAME:
-      if (!RendererDidNavigateAutoSubframe(rfh, params, navigation_handle)) {
+      if (!RendererDidNavigateAutoSubframe(rfh, params, navigation_request)) {
         // We don't send a notification about auto-subframe PageState during
         // UpdateStateForFrame, since it looks like nothing has changed.  Send
         // it here at commit time instead.
@@ -1092,8 +1130,9 @@ bool NavigationControllerImpl::RendererDidNavigate(
       if (pending_entry_)
         DiscardNonCommittedEntries();
       return false;
-    default:
+    case NAVIGATION_TYPE_UNKNOWN:
       NOTREACHED();
+      break;
   }
 
   // At this point, we know that the navigation has just completed, so
@@ -1126,8 +1165,7 @@ bool NavigationControllerImpl::RendererDidNavigate(
         std::move(back_forward_cache_metrics));
   }
   active_entry->back_forward_cache_metrics()->DidCommitNavigation(
-      navigation_request->navigation_handle()->GetNavigationId(),
-      active_entry->GetUniqueID(), rfh->frame_tree_node()->IsMainFrame());
+      navigation_request);
 
   // Grab the corresponding FrameNavigationEntry for a few updates, but only if
   // the SiteInstance matches (to avoid updating the wrong entry by mistake).
@@ -1170,7 +1208,7 @@ bool NavigationControllerImpl::RendererDidNavigate(
   NotifyNavigationEntryCommitted(details);
 
   if (active_entry->GetURL().SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-      navigation_handle->GetNetErrorCode() == net::OK) {
+      navigation_request->GetNetErrorCode() == net::OK) {
     UMA_HISTOGRAM_BOOLEAN("Navigation.SecureSchemeHasSSLStatus",
                           !!active_entry->GetSSL().certificate);
   }
@@ -1217,13 +1255,12 @@ NavigationType NavigationControllerImpl::ClassifyNavigation(
   if (rfh->GetParent()) {
     // All manual subframes would be did_create_new_entry and handled above, so
     // we know this is auto.
-    if (GetLastCommittedEntry()) {
+    if (GetLastCommittedEntry())
       return NAVIGATION_TYPE_AUTO_SUBFRAME;
-    } else {
-      // We ignore subframes created in non-committed pages; we'd appreciate if
-      // people stopped doing that.
-      return NAVIGATION_TYPE_NAV_IGNORE;
-    }
+
+    // We ignore subframes created in non-committed pages; we'd appreciate if
+    // people stopped doing that.
+    return NAVIGATION_TYPE_NAV_IGNORE;
   }
 
   if (params.nav_entry_id == 0) {
@@ -1318,12 +1355,12 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     bool is_same_document,
     bool replace_entry,
     bool previous_document_was_activated,
-    NavigationHandleImpl* handle) {
+    NavigationRequest* request) {
   std::unique_ptr<NavigationEntryImpl> new_entry;
   bool update_virtual_url = false;
 
   const base::Optional<url::Origin>& initiator_origin =
-      handle->navigation_request()->common_params().initiator_origin;
+      request->common_params().initiator_origin;
 
   // First check if this is an in-page navigation.  If so, clone the current
   // entry instead of looking at the pending entry, because the pending entry
@@ -1346,7 +1383,7 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
       new_entry->GetSSL() = SSLStatus();
 
       if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-          handle->GetNetErrorCode() == net::OK) {
+          request->GetNetErrorCode() == net::OK) {
         UMA_HISTOGRAM_BOOLEAN(
             "Navigation.SecureSchemeHasSSLStatus.NewPageInPageOriginMismatch",
             !!new_entry->GetSSL().certificate);
@@ -1362,7 +1399,7 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     update_virtual_url = new_entry->update_virtual_url_with_url();
 
     if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-        handle->GetNetErrorCode() == net::OK) {
+        request->GetNetErrorCode() == net::OK) {
       UMA_HISTOGRAM_BOOLEAN("Navigation.SecureSchemeHasSSLStatus.NewPageInPage",
                             !!new_entry->GetSSL().certificate);
     }
@@ -1370,25 +1407,25 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
 
   // Only make a copy of the pending entry if it is appropriate for the new page
   // that was just loaded. Verify this by checking if the entry corresponds
-  // to the given navigation handle. Additionally, coarsely check that:
+  // to the given NavigationRequest. Additionally, coarsely check that:
   // 1. The SiteInstance hasn't been assigned to something else.
   // 2. The pending entry was intended as a new entry, rather than being a
   // history navigation that was interrupted by an unrelated,
   // renderer-initiated navigation.
   // TODO(csharrison): Investigate whether we can remove some of the coarser
   // checks.
-  if (!new_entry &&
-      PendingEntryMatchesHandle(handle) && pending_entry_index_ == -1 &&
+  if (!new_entry && PendingEntryMatchesRequest(request) &&
+      pending_entry_index_ == -1 &&
       (!pending_entry_->site_instance() ||
        pending_entry_->site_instance() == rfh->GetSiteInstance())) {
     new_entry = pending_entry_->Clone();
 
     update_virtual_url = new_entry->update_virtual_url_with_url();
     new_entry->GetSSL() =
-        SSLStatus(handle->GetSSLInfo().value_or(net::SSLInfo()));
+        SSLStatus(request->GetSSLInfo().value_or(net::SSLInfo()));
 
     if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-        handle->GetNetErrorCode() == net::OK) {
+        request->GetNetErrorCode() == net::OK) {
       UMA_HISTOGRAM_BOOLEAN(
           "Navigation.SecureSchemeHasSSLStatus.NewPagePendingEntryMatches",
           !!new_entry->GetSSL().certificate);
@@ -1400,7 +1437,7 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     new_entry = std::make_unique<NavigationEntryImpl>(
         rfh->GetSiteInstance(), params.url, params.referrer, initiator_origin,
         base::string16(),  // title
-        params.transition, handle->IsRendererInitiated(),
+        params.transition, request->IsRendererInitiated(),
         nullptr);  // blob_url_loader_factory
 
     // Find out whether the new entry needs to update its virtual URL on URL
@@ -1418,10 +1455,10 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
     // the URL.
     update_virtual_url = needs_update;
     new_entry->GetSSL() =
-        SSLStatus(handle->GetSSLInfo().value_or(net::SSLInfo()));
+        SSLStatus(request->GetSSLInfo().value_or(net::SSLInfo()));
 
     if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-        handle->GetNetErrorCode() == net::OK) {
+        request->GetNetErrorCode() == net::OK) {
       UMA_HISTOGRAM_BOOLEAN(
           "Navigation.SecureSchemeHasSSLStatus.NewPageNoMatchingEntry",
           !!new_entry->GetSSL().certificate);
@@ -1443,6 +1480,11 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
   new_entry->SetOriginalRequestURL(params.original_request_url);
   new_entry->SetIsOverridingUserAgent(params.is_overriding_user_agent);
 
+  if (request->bundled_exchanges_navigation_info()) {
+    new_entry->set_bundled_exchanges_navigation_info(
+        request->bundled_exchanges_navigation_info()->Clone());
+  }
+
   // Update the FrameNavigationEntry for new main frame commits.
   FrameNavigationEntry* frame_entry =
       new_entry->GetFrameEntry(rfh->frame_tree_node());
@@ -1485,9 +1527,10 @@ void NavigationControllerImpl::RendererDidNavigateToNewPage(
 
   SetShouldSkipOnBackForwardUIIfNeeded(rfh, replace_entry,
                                        previous_document_was_activated,
-                                       handle->IsRendererInitiated());
+                                       request->IsRendererInitiated());
 
-  InsertOrReplaceEntry(std::move(new_entry), replace_entry);
+  InsertOrReplaceEntry(std::move(new_entry), replace_entry,
+                       !request->post_commit_error_page_html().empty());
 }
 
 void NavigationControllerImpl::RendererDidNavigateToExistingPage(
@@ -1495,7 +1538,7 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
     bool is_same_document,
     bool was_restored,
-    NavigationHandleImpl* handle,
+    NavigationRequest* request,
     bool keep_pending_entry) {
   DCHECK(GetLastCommittedEntry()) << "ClassifyNavigation should guarantee "
                                   << "that a last committed entry exists.";
@@ -1510,13 +1553,13 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     // entry.
     entry = GetLastCommittedEntry();
     // If this is a same document navigation, then there's no SSLStatus in the
-    // NavigationHandle so don't overwrite the existing entry's SSLStatus.
+    // NavigationRequest so don't overwrite the existing entry's SSLStatus.
     if (!is_same_document)
       entry->GetSSL() =
-          SSLStatus(handle->GetSSLInfo().value_or(net::SSLInfo()));
+          SSLStatus(request->GetSSLInfo().value_or(net::SSLInfo()));
 
     if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-        handle->GetNetErrorCode() == net::OK) {
+        request->GetNetErrorCode() == net::OK) {
       bool has_cert = !!entry->GetSSL().certificate;
       if (is_same_document) {
         UMA_HISTOGRAM_BOOLEAN(
@@ -1535,7 +1578,7 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     entry = GetEntryWithUniqueID(params.nav_entry_id);
 
     if (is_same_document) {
-      // There's no SSLStatus in the NavigationHandle for same document
+      // There's no SSLStatus in the NavigationRequest for same document
       // navigations, so normally we leave |entry|'s SSLStatus as is. However if
       // this was a restored same document navigation entry, then it won't have
       // an SSLStatus. So we need to copy over the SSLStatus from the entry that
@@ -1547,19 +1590,19 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
         entry->GetSSL() = last_entry->GetSSL();
       }
     } else {
-      // In rapid back/forward navigations |handle| sometimes won't have a cert
-      // (http://crbug.com/727892). So we use the handle's cert if it exists,
+      // In rapid back/forward navigations |request| sometimes won't have a cert
+      // (http://crbug.com/727892). So we use the request's cert if it exists,
       // otherwise we only reuse the existing cert if the origins match.
-      if (handle->GetSSLInfo().has_value() &&
-          handle->GetSSLInfo()->is_valid()) {
-        entry->GetSSL() = SSLStatus(*(handle->GetSSLInfo()));
-      } else if (entry->GetURL().GetOrigin() != handle->GetURL().GetOrigin()) {
+      if (request->GetSSLInfo().has_value() &&
+          request->GetSSLInfo()->is_valid()) {
+        entry->GetSSL() = SSLStatus(*(request->GetSSLInfo()));
+      } else if (entry->GetURL().GetOrigin() != request->GetURL().GetOrigin()) {
         entry->GetSSL() = SSLStatus();
       }
     }
 
     if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-        handle->GetNetErrorCode() == net::OK) {
+        request->GetNetErrorCode() == net::OK) {
       bool has_cert = !!entry->GetSSL().certificate;
       if (is_same_document && was_restored) {
         UMA_HISTOGRAM_BOOLEAN(
@@ -1597,13 +1640,13 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
     CopyReplacedNavigationEntryDataIfPreviouslyEmpty(entry, entry);
 
     // If this is a same document navigation, then there's no SSLStatus in the
-    // NavigationHandle so don't overwrite the existing entry's SSLStatus.
+    // NavigationRequest so don't overwrite the existing entry's SSLStatus.
     if (!is_same_document)
       entry->GetSSL() =
-          SSLStatus(handle->GetSSLInfo().value_or(net::SSLInfo()));
+          SSLStatus(request->GetSSLInfo().value_or(net::SSLInfo()));
 
     if (params.url.SchemeIs(url::kHttpsScheme) && !rfh->GetParent() &&
-        handle->GetNetErrorCode() == net::OK) {
+        request->GetNetErrorCode() == net::OK) {
       bool has_cert = !!entry->GetSSL().certificate;
       if (is_same_document) {
         UMA_HISTOGRAM_BOOLEAN(
@@ -1631,14 +1674,13 @@ void NavigationControllerImpl::RendererDidNavigateToExistingPage(
   // The site instance will normally be the same except
   // 1) session restore, when no site instance will be assigned or
   // 2) redirect, when the site instance is reset.
-  DCHECK(entry->site_instance() == nullptr ||
-         !entry->GetRedirectChain().empty() ||
+  DCHECK(!entry->site_instance() || !entry->GetRedirectChain().empty() ||
          entry->site_instance() == rfh->GetSiteInstance());
 
   // Update the existing FrameNavigationEntry to ensure all of its members
   // reflect the parameters coming from the renderer process.
   const base::Optional<url::Origin>& initiator_origin =
-      handle->navigation_request()->common_params().initiator_origin;
+      request->common_params().initiator_origin;
   entry->AddOrUpdateFrameEntry(
       rfh->frame_tree_node(), params.item_sequence_number,
       params.document_sequence_number, rfh->GetSiteInstance(), nullptr,
@@ -1671,7 +1713,7 @@ void NavigationControllerImpl::RendererDidNavigateToSamePage(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
     bool is_same_document,
-    NavigationHandleImpl* handle) {
+    NavigationRequest* request) {
   // This classification says that we have a pending entry that's the same as
   // the last committed entry. This entry is guaranteed to exist by
   // ClassifyNavigation. All we need to do is update the existing entry.
@@ -1701,10 +1743,10 @@ void NavigationControllerImpl::RendererDidNavigateToSamePage(
   // change, the previous SSLStatus is still valid.
   if (!is_same_document)
     existing_entry->GetSSL() =
-        SSLStatus(handle->GetSSLInfo().value_or(net::SSLInfo()));
+        SSLStatus(request->GetSSLInfo().value_or(net::SSLInfo()));
 
   if (existing_entry->GetURL().SchemeIs(url::kHttpsScheme) &&
-      !rfh->GetParent() && handle->GetNetErrorCode() == net::OK) {
+      !rfh->GetParent() && request->GetNetErrorCode() == net::OK) {
     UMA_HISTOGRAM_BOOLEAN("Navigation.SecureSchemeHasSSLStatus.SamePage",
                           !!existing_entry->GetSSL().certificate);
   }
@@ -1715,7 +1757,7 @@ void NavigationControllerImpl::RendererDidNavigateToSamePage(
   // Update the existing FrameNavigationEntry to ensure all of its members
   // reflect the parameters coming from the renderer process.
   const base::Optional<url::Origin>& initiator_origin =
-      handle->navigation_request()->common_params().initiator_origin;
+      request->common_params().initiator_origin;
   existing_entry->AddOrUpdateFrameEntry(
       rfh->frame_tree_node(), params.item_sequence_number,
       params.document_sequence_number, rfh->GetSiteInstance(), nullptr,
@@ -1732,7 +1774,7 @@ void NavigationControllerImpl::RendererDidNavigateNewSubframe(
     bool is_same_document,
     bool replace_entry,
     bool previous_document_was_activated,
-    NavigationHandleImpl* handle) {
+    NavigationRequest* request) {
   DCHECK(ui::PageTransitionCoreTypeIs(params.transition,
                                       ui::PAGE_TRANSITION_MANUAL_SUBFRAME));
 
@@ -1752,7 +1794,7 @@ void NavigationControllerImpl::RendererDidNavigateNewSubframe(
   // This FrameNavigationEntry might not end up being used in the
   // CloneAndReplace() call below, if a spot can't be found for it in the tree.
   const base::Optional<url::Origin>& initiator_origin =
-      handle->navigation_request()->common_params().initiator_origin;
+      request->common_params().initiator_origin;
   auto frame_entry = base::MakeRefCounted<FrameNavigationEntry>(
       rfh->frame_tree_node()->unique_name(), params.item_sequence_number,
       params.document_sequence_number, rfh->GetSiteInstance(), nullptr,
@@ -1767,20 +1809,20 @@ void NavigationControllerImpl::RendererDidNavigateNewSubframe(
 
   SetShouldSkipOnBackForwardUIIfNeeded(rfh, replace_entry,
                                        previous_document_was_activated,
-                                       handle->IsRendererInitiated());
+                                       request->IsRendererInitiated());
 
   // TODO(creis): Update this to add the frame_entry if we can't find the one
   // to replace, which can happen due to a unique name change. See
   // https://crbug.com/607205. For now, the call to CloneAndReplace() will
   // delete the |frame_entry| when the function exits if it doesn't get used.
 
-  InsertOrReplaceEntry(std::move(new_entry), replace_entry);
+  InsertOrReplaceEntry(std::move(new_entry), replace_entry, false);
 }
 
 bool NavigationControllerImpl::RendererDidNavigateAutoSubframe(
     RenderFrameHostImpl* rfh,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-    NavigationHandleImpl* handle) {
+    NavigationRequest* request) {
   DCHECK(ui::PageTransitionCoreTypeIs(params.transition,
                                       ui::PAGE_TRANSITION_AUTO_SUBFRAME));
 
@@ -1830,7 +1872,7 @@ bool NavigationControllerImpl::RendererDidNavigateAutoSubframe(
   // it may be a "history auto" case where we update an existing one.
   NavigationEntryImpl* last_committed = GetLastCommittedEntry();
   const base::Optional<url::Origin>& initiator_origin =
-      handle->navigation_request()->common_params().initiator_origin;
+      request->common_params().initiator_origin;
   last_committed->AddOrUpdateFrameEntry(
       rfh->frame_tree_node(), params.item_sequence_number,
       params.document_sequence_number, rfh->GetSiteInstance(), nullptr,
@@ -1918,7 +1960,8 @@ void NavigationControllerImpl::CopyStateFrom(NavigationController* temp,
   NavigationControllerImpl* source =
       static_cast<NavigationControllerImpl*>(temp);
   // Verify that we look new.
-  DCHECK(GetEntryCount() == 0 && !GetPendingEntry());
+  DCHECK_EQ(0, GetEntryCount());
+  DCHECK(!GetPendingEntry());
 
   if (source->GetEntryCount() == 0)
     return;  // Nothing new to do.
@@ -1938,9 +1981,8 @@ void NavigationControllerImpl::CopyStateFrom(NavigationController* temp,
                 RestoreType::CURRENT_SESSION);
 }
 
-void NavigationControllerImpl::CopyStateFromAndPrune(
-    NavigationController* temp,
-    bool replace_entry) {
+void NavigationControllerImpl::CopyStateFromAndPrune(NavigationController* temp,
+                                                     bool replace_entry) {
   // It is up to callers to check the invariants before calling this.
   CHECK(CanPruneAllButLastCommitted());
 
@@ -2055,6 +2097,10 @@ bool NavigationControllerImpl::IsEntryMarkedToBeSkipped(int index) {
   return entry && entry->should_skip_on_back_forward_ui();
 }
 
+BackForwardCacheImpl& NavigationControllerImpl::GetBackForwardCache() {
+  return back_forward_cache_;
+}
+
 void NavigationControllerImpl::DiscardPendingEntry(bool was_failure) {
   // It is not safe to call DiscardPendingEntry while NavigateToEntry is in
   // progress, since this will cause a use-after-free.  (We only allow this
@@ -2074,6 +2120,11 @@ void NavigationControllerImpl::DiscardPendingEntry(bool was_failure) {
     pending_entry_index_ = -1;
     pending_entry_ = nullptr;
   }
+
+  // Ensure any refs to the current pending entry are ignored if they get
+  // deleted, by clearing the set of known refs. All future pending entries will
+  // only be affected by new refs.
+  pending_entry_refs_.clear();
 }
 
 void NavigationControllerImpl::SetPendingNavigationSSLError(bool error) {
@@ -2125,7 +2176,7 @@ void NavigationControllerImpl::NotifyUserActivation() {
 
 bool NavigationControllerImpl::StartHistoryNavigationInNewSubframe(
     RenderFrameHostImpl* render_frame_host,
-    mojom::NavigationClientAssociatedPtrInfo* navigation_client) {
+    mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client) {
   NavigationEntryImpl* entry =
       GetEntryWithUniqueID(render_frame_host->nav_entry_id());
   if (!entry)
@@ -2203,8 +2254,9 @@ void NavigationControllerImpl::NavigateFromFrameProxy(
       // TODO(creis): Ensure this case can't exist in https://crbug.com/524208.
       entry = NavigationEntryImpl::FromNavigationEntry(CreateNavigationEntry(
           GURL(url::kAboutBlankURL), referrer, initiator_origin,
-          page_transition, is_renderer_initiated, extra_headers,
-          browser_context_, nullptr /* blob_url_loader_factory */));
+          source_site_instance, page_transition, is_renderer_initiated,
+          extra_headers, browser_context_,
+          nullptr /* blob_url_loader_factory */));
     }
     entry->AddOrUpdateFrameEntry(
         node, -1, -1, nullptr,
@@ -2214,8 +2266,9 @@ void NavigationControllerImpl::NavigateFromFrameProxy(
   } else {
     // Main frame case.
     entry = NavigationEntryImpl::FromNavigationEntry(CreateNavigationEntry(
-        url, referrer, initiator_origin, page_transition, is_renderer_initiated,
-        extra_headers, browser_context_, blob_url_loader_factory));
+        url, referrer, initiator_origin, source_site_instance, page_transition,
+        is_renderer_initiated, extra_headers, browser_context_,
+        blob_url_loader_factory));
     entry->root_node()->frame_entry->set_source_site_instance(
         static_cast<SiteInstanceImpl*>(source_site_instance));
     entry->root_node()->frame_entry->set_method(method);
@@ -2284,6 +2337,11 @@ void NavigationControllerImpl::NavigateFromFrameProxy(
   if (!request)
     return;
 
+  // At this stage we are proceeding with this navigation. If this was renderer
+  // initiated with user gesture, we need to make sure we clear up potential
+  // remains of a cancelled browser initiated navigation to avoid URL spoofs.
+  DiscardNonCommittedEntries();
+
   node->navigator()->Navigate(std::move(request), ReloadType::NONE,
                               RestoreType::NONE);
 }
@@ -2297,29 +2355,28 @@ void NavigationControllerImpl::SetSessionStorageNamespace(
   // We can't overwrite an existing SessionStorage without violating spec.
   // Attempts to do so may give a tab access to another tab's session storage
   // so die hard on an error.
-  bool successful_insert = session_storage_namespace_map_.insert(
-      make_pair(partition_id,
-                static_cast<SessionStorageNamespaceImpl*>(
-                    session_storage_namespace)))
+  bool successful_insert =
+      session_storage_namespace_map_
+          .insert(
+              make_pair(partition_id, static_cast<SessionStorageNamespaceImpl*>(
+                                          session_storage_namespace)))
           .second;
   CHECK(successful_insert) << "Cannot replace existing SessionStorageNamespace";
 }
 
 bool NavigationControllerImpl::IsUnmodifiedBlankTab() {
-  return IsInitialNavigation() &&
-         !GetLastCommittedEntry() &&
+  return IsInitialNavigation() && !GetLastCommittedEntry() &&
          !delegate_->HasAccessedInitialDocument();
 }
 
-SessionStorageNamespace*
-NavigationControllerImpl::GetSessionStorageNamespace(SiteInstance* instance) {
+SessionStorageNamespace* NavigationControllerImpl::GetSessionStorageNamespace(
+    SiteInstance* instance) {
   std::string partition_id;
   if (instance) {
     // TODO(ajwong): When GetDefaultSessionStorageNamespace() goes away, remove
     // this if statement so |instance| must not be NULL.
-    partition_id =
-        GetContentClient()->browser()->GetStoragePartitionIdForSite(
-            browser_context_, instance->GetSiteURL());
+    partition_id = GetContentClient()->browser()->GetStoragePartitionIdForSite(
+        browser_context_, instance->GetSiteURL());
   }
 
   // TODO(ajwong): Should this use the |partition_id| directly rather than
@@ -2333,8 +2390,8 @@ NavigationControllerImpl::GetSessionStorageNamespace(SiteInstance* instance) {
       session_storage_namespace_map_.find(partition_id);
   if (it != session_storage_namespace_map_.end()) {
     // Ensure that this namespace actually belongs to this partition.
-    DCHECK(static_cast<SessionStorageNamespaceImpl*>(it->second.get())->
-        IsFromContext(context_wrapper));
+    DCHECK(static_cast<SessionStorageNamespaceImpl*>(it->second.get())
+               ->IsFromContext(context_wrapper));
     return it->second.get();
   }
 
@@ -2403,9 +2460,12 @@ NavigationEntryImpl* NavigationControllerImpl::GetPendingEntry() {
   DCHECK(pending_entry_ || pending_entry_index_ == -1);
 
   // If there is a pending_entry_index_, then pending_entry_ must be the entry
-  // at that index.
+  // at that index. An exception is while a reload of a post commit error page
+  // is ongoing; in that case pending entry will point to the entry replaced
+  // by the error.
   DCHECK(pending_entry_index_ == -1 ||
-         pending_entry_ == GetEntryAtIndex(pending_entry_index_));
+         pending_entry_ == GetEntryAtIndex(pending_entry_index_) ||
+         pending_entry_ == entry_replaced_by_post_commit_error_.get());
 
   return pending_entry_;
 }
@@ -2420,7 +2480,8 @@ int NavigationControllerImpl::GetPendingEntryIndex() {
 
 void NavigationControllerImpl::InsertOrReplaceEntry(
     std::unique_ptr<NavigationEntryImpl> entry,
-    bool replace) {
+    bool replace,
+    bool was_post_commit_error) {
   DCHECK(!ui::PageTransitionCoreTypeIs(entry->GetTransitionType(),
                                        ui::PAGE_TRANSITION_AUTO_SUBFRAME));
 
@@ -2434,12 +2495,18 @@ void NavigationControllerImpl::InsertOrReplaceEntry(
 
   DiscardNonCommittedEntries();
 
-  int current_size = static_cast<int>(entries_.size());
-
   // When replacing, don't prune the forward history.
-  if (replace && current_size > 0) {
+  if ((replace || was_post_commit_error) && entries_.size() > 0) {
     CopyReplacedNavigationEntryDataIfPreviouslyEmpty(
         entries_[last_committed_entry_index_].get(), entry.get());
+    // If the new entry is a post-commit error page, we store the current last
+    // committed entry to the side so that we can put it back when navigating
+    // away from the error.
+    if (was_post_commit_error) {
+      DCHECK(!entry_replaced_by_post_commit_error_);
+      entry_replaced_by_post_commit_error_ =
+          std::move(entries_[last_committed_entry_index_]);
+    }
     entries_[last_committed_entry_index_] = std::move(entry);
     return;
   }
@@ -2447,20 +2514,7 @@ void NavigationControllerImpl::InsertOrReplaceEntry(
   // We shouldn't see replace == true when there's no committed entries.
   DCHECK(!replace);
 
-  if (current_size > 0) {
-    // Prune any entries which are in front of the current entry.
-    int num_pruned = 0;
-    while (last_committed_entry_index_ < (current_size - 1)) {
-      num_pruned++;
-      entries_.pop_back();
-      current_size--;
-    }
-    if (num_pruned > 0) {  // Only notify if we did prune something.
-      NotifyPrunedEntries(this,
-                          last_committed_entry_index_ + 1 /* start index */,
-                          num_pruned /* count */);
-    }
-  }
+  PruneForwardEntries();
 
   PruneOldestSkippableEntryIfFull();
 
@@ -2501,8 +2555,16 @@ void NavigationControllerImpl::PruneOldestSkippableEntryIfFull() {
 void NavigationControllerImpl::NavigateToExistingPendingEntry(
     ReloadType reload_type,
     int sandboxed_source_frame_tree_node_id) {
+  TRACE_EVENT0("navigation",
+               "NavigationControllerImpl::NavigateToExistingPendingEntry");
   DCHECK(pending_entry_);
   DCHECK(IsInitialNavigation() || pending_entry_index_ != -1);
+  if (pending_entry_index_ != -1) {
+    // The pending entry may not be in entries_ if a post-commit error page is
+    // showing.
+    DCHECK(pending_entry_ == entries_[pending_entry_index_].get() ||
+           pending_entry_ == entry_replaced_by_post_commit_error_.get());
+  }
   DCHECK(!IsRendererDebugURL(pending_entry_->GetURL()));
   needs_reload_ = false;
   FrameTreeNode* root = delegate_->GetFrameTree()->root();
@@ -2510,7 +2572,7 @@ void NavigationControllerImpl::NavigateToExistingPendingEntry(
 
   // BackForwardCache:
   // Navigate immediately if the document is in the BackForwardCache.
-  if (back_forward_cache_.GetDocument(nav_entry_id)) {
+  if (back_forward_cache_.GetEntry(nav_entry_id)) {
     DCHECK_EQ(reload_type, ReloadType::NONE);
     auto navigation_request = CreateNavigationRequestFromEntry(
         root, pending_entry_, pending_entry_->GetFrameEntry(root),
@@ -2522,6 +2584,20 @@ void NavigationControllerImpl::NavigateToExistingPendingEntry(
     return;
   }
 
+  // By design, a page in the BackForwardCache is alone in its BrowsingInstance.
+  // History navigation might try to reuse a specific SiteInstance, already used
+  // by a page in the cache. This must not happen. It would fail creating the
+  // RenderFrame, because only one main document can live there. For this
+  // reason, the BackForwardCache is flushed.
+  // TODO(arthursonzogni): Flushing the entire cache is a bit overkill, this can
+  // be refined to only delete the page (if any) using the same
+  // BrowsingInstance.
+  if (pending_entry_->site_instance()) {
+    SiteInstance* current = root->current_frame_host()->GetSiteInstance();
+    if (!current->IsRelatedSiteInstance(pending_entry_->site_instance()))
+      back_forward_cache_.Flush();
+  }
+
   // If we were navigating to a slow-to-commit page, and the user performs
   // a session history navigation to the last committed page, RenderViewHost
   // will force the throbber to start, but WebKit will essentially ignore the
@@ -2590,10 +2666,7 @@ void NavigationControllerImpl::NavigateToExistingPendingEntry(
             sandboxed_source_frame_tree_node_id, same_document_loads) &&
         DoesSandboxNavigationStayWithinSubtree(
             sandboxed_source_frame_tree_node_id, different_document_loads);
-    UMA_HISTOGRAM_BOOLEAN(
-        "Navigation.SandboxFrameBackForwardStaysWithinSubtree",
-        navigates_inside_tree);
-    // Also count the navigations as web use counters so we can determine
+    // Count the navigations as web use counters so we can determine
     // the number of pages that trigger this.
     FrameTreeNode* sandbox_source_frame_tree_node =
         FrameTreeNode::GloballyFindByID(sandboxed_source_frame_tree_node_id);
@@ -2633,6 +2706,11 @@ void NavigationControllerImpl::NavigateToExistingPendingEntry(
   CHECK(!in_navigate_to_pending_entry_);
   in_navigate_to_pending_entry_ = true;
 
+  // It is not possible to delete the pending NavigationEntry while navigating
+  // to it. Grab a reference to delay potential deletion until the end of this
+  // function.
+  std::unique_ptr<PendingEntryRef> pending_entry_ref = ReferencePendingEntry();
+
   // Send all the same document frame loads before the different document loads.
   for (auto& item : same_document_loads) {
     FrameTreeNode* frame = item->frame_tree_node();
@@ -2674,7 +2752,7 @@ void NavigationControllerImpl::FindFramesToNavigate(
   // a SiteInstance yet, in which case it will be assigned on first commit.
   if (!old_item ||
       new_item->item_sequence_number() != old_item->item_sequence_number() ||
-      (new_item->site_instance() != nullptr &&
+      (new_item->site_instance() &&
        new_item->site_instance() != old_item->site_instance())) {
     // Same document loads happen if the previous item has the same document
     // sequence number.  Note that we should treat them as different document if
@@ -2711,21 +2789,21 @@ void NavigationControllerImpl::FindFramesToNavigate(
       // For now, we accept this bug, and hope to resolve the race in a
       // different way that will one day allow us to fix this.
       return;
-    } else {
-      std::unique_ptr<NavigationRequest> navigation_request =
-          CreateNavigationRequestFromEntry(
-              frame, pending_entry_, new_item, reload_type,
-              false /* is_same_document_history_load */,
-              false /* is_history_navigation_in_new_child */);
-      if (navigation_request) {
-        // Only add the request if was properly created. It's possible for the
-        // creation to fail in certain cases, e.g. when the URL is invalid.
-        different_document_loads->push_back(std::move(navigation_request));
-      }
-      // For a different document, the subframes will be destroyed, so there's
-      // no need to consider them.
-      return;
     }
+
+    std::unique_ptr<NavigationRequest> navigation_request =
+        CreateNavigationRequestFromEntry(
+            frame, pending_entry_, new_item, reload_type,
+            false /* is_same_document_history_load */,
+            false /* is_history_navigation_in_new_child */);
+    if (navigation_request) {
+      // Only add the request if was properly created. It's possible for the
+      // creation to fail in certain cases, e.g. when the URL is invalid.
+      different_document_loads->push_back(std::move(navigation_request));
+    }
+    // For a different document, the subframes will be destroyed, so there's
+    // no need to consider them.
+    return;
   }
 
   for (size_t i = 0; i < frame->child_count(); i++) {
@@ -2863,6 +2941,11 @@ void NavigationControllerImpl::NavigateWithoutEntry(
   CHECK(!in_navigate_to_pending_entry_);
   in_navigate_to_pending_entry_ = true;
 
+  // It is not possible to delete the pending NavigationEntry while navigating
+  // to it. Grab a reference to delay potential deletion until the end of this
+  // function.
+  std::unique_ptr<PendingEntryRef> pending_entry_ref = ReferencePendingEntry();
+
   node->navigator()->Navigate(std::move(request), reload_type,
                               RestoreType::NONE);
 
@@ -2919,8 +3002,9 @@ NavigationControllerImpl::CreateNavigationEntryFromLoadParams(
       // TODO(creis): Ensure this case can't exist in https://crbug.com/524208.
       entry = NavigationEntryImpl::FromNavigationEntry(CreateNavigationEntry(
           GURL(url::kAboutBlankURL), params.referrer, params.initiator_origin,
-          params.transition_type, params.is_renderer_initiated,
-          extra_headers_crlf, browser_context_, blob_url_loader_factory));
+          params.source_site_instance.get(), params.transition_type,
+          params.is_renderer_initiated, extra_headers_crlf, browser_context_,
+          blob_url_loader_factory));
     }
 
     entry->AddOrUpdateFrameEntry(
@@ -2932,8 +3016,9 @@ NavigationControllerImpl::CreateNavigationEntryFromLoadParams(
     // Otherwise, create a pending entry for the main frame.
     entry = NavigationEntryImpl::FromNavigationEntry(CreateNavigationEntry(
         params.url, params.referrer, params.initiator_origin,
-        params.transition_type, params.is_renderer_initiated,
-        extra_headers_crlf, browser_context_, blob_url_loader_factory));
+        params.source_site_instance.get(), params.transition_type,
+        params.is_renderer_initiated, extra_headers_crlf, browser_context_,
+        blob_url_loader_factory));
     entry->set_source_site_instance(
         static_cast<SiteInstanceImpl*>(params.source_site_instance.get()));
     entry->SetRedirectChain(params.redirect_chain);
@@ -2962,9 +3047,6 @@ NavigationControllerImpl::CreateNavigationEntryFromLoadParams(
 #endif
       entry->SetCanLoadLocalResources(params.can_load_local_resources);
       break;
-    default:
-      NOTREACHED();
-      break;
   }
 
   // TODO(clamy): NavigationEntry is meant for information that will be kept
@@ -3120,7 +3202,8 @@ NavigationControllerImpl::CreateNavigationRequestFromLoadParams(
           std::string(), /* data_url_as_string */
 #endif
           false, /* is_browser_initiated */
-          network::mojom::IPAddressSpace::kUnknown);
+          network::mojom::IPAddressSpace::kUnknown,
+          GURL() /* base_url_override_for_bundled_exchanges */);
 #if defined(OS_ANDROID)
   if (ValidateDataURLAsString(params.data_url_as_string)) {
     commit_params->data_url_as_string = params.data_url_as_string->data();
@@ -3268,16 +3351,15 @@ void NavigationControllerImpl::NotifyNavigationEntryCommitted(
   // TODO(avi): Remove. http://crbug.com/170921
   NotificationDetails notification_details =
       Details<LoadCommittedDetails>(details);
-  NotificationService::current()->Notify(
-      NOTIFICATION_NAV_ENTRY_COMMITTED,
-      Source<NavigationController>(this),
-      notification_details);
+  NotificationService::current()->Notify(NOTIFICATION_NAV_ENTRY_COMMITTED,
+                                         Source<NavigationController>(this),
+                                         notification_details);
 }
 
 // static
 size_t NavigationControllerImpl::max_entry_count() {
   if (max_entry_count_for_testing_ != kMaxEntryCountForTestingNotSet)
-     return max_entry_count_for_testing_;
+    return max_entry_count_for_testing_;
   return kMaxSessionHistoryEntries;
 }
 
@@ -3311,10 +3393,16 @@ void NavigationControllerImpl::LoadIfNecessary() {
   }
 }
 
-void NavigationControllerImpl::LoadErrorPage(RenderFrameHost* render_frame_host,
-                                             const GURL& url,
-                                             const std::string& error_page_html,
-                                             net::Error error) {
+void NavigationControllerImpl::LoadPostCommitErrorPage(
+    RenderFrameHost* render_frame_host,
+    const GURL& url,
+    const std::string& error_page_html,
+    net::Error error) {
+  // A frame pending deletion is not allowed to navigate, the browser is already
+  // committed to destroying this frame so ignore loading the error page.
+  if (!static_cast<RenderFrameHostImpl*>(render_frame_host)->is_active())
+    return;
+
   FrameTreeNode* node =
       static_cast<RenderFrameHostImpl*>(render_frame_host)->frame_tree_node();
 
@@ -3330,7 +3418,7 @@ void NavigationControllerImpl::LoadErrorPage(RenderFrameHost* render_frame_host,
           true /* browser_initiated */, "" /* extra_headers */,
           nullptr /* frame_entry */, nullptr /* entry */,
           nullptr /* post_body */, nullptr /* navigation_ui_data */);
-  navigation_request->set_error_page_html(error_page_html);
+  navigation_request->set_post_commit_error_page_html(error_page_html);
   navigation_request->set_net_error(error);
   node->CreatedNavigationRequest(std::move(navigation_request));
   DCHECK(node->navigation_request());
@@ -3340,8 +3428,7 @@ void NavigationControllerImpl::LoadErrorPage(RenderFrameHost* render_frame_host,
 void NavigationControllerImpl::NotifyEntryChanged(NavigationEntry* entry) {
   EntryChangedDetails det;
   det.changed_entry = entry;
-  det.index = GetIndexOfEntry(
-      NavigationEntryImpl::FromNavigationEntry(entry));
+  det.index = GetIndexOfEntry(NavigationEntryImpl::FromNavigationEntry(entry));
   delegate_->NotifyNavigationEntryChanged(det);
 }
 
@@ -3354,6 +3441,14 @@ void NavigationControllerImpl::FinishRestore(int selected_index,
 }
 
 void NavigationControllerImpl::DiscardNonCommittedEntries() {
+  // Avoid sending a notification if there is nothing to discard.
+  // TODO(mthiesse): Temporarily checking failed_pending_entry_id_ to help
+  // diagnose https://bugs.chromium.org/p/chromium/issues/detail?id=1007570.
+  if (!pending_entry_ && transient_entry_index_ == -1 &&
+      failed_pending_entry_id_ == 0) {
+    return;
+  }
+
   DiscardPendingEntry(false);
   DiscardTransientEntry();
   if (delegate_)
@@ -3421,7 +3516,7 @@ void NavigationControllerImpl::InsertEntriesFrom(
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
-    const base::Callback<base::Time()>& get_timestamp_callback) {
+    const base::RepeatingCallback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
@@ -3481,4 +3576,54 @@ void NavigationControllerImpl::SetSkippableForSameDocumentEntries(
   }
 }
 
+std::unique_ptr<NavigationControllerImpl::PendingEntryRef>
+NavigationControllerImpl::ReferencePendingEntry() {
+  DCHECK(pending_entry_);
+  auto pending_entry_ref =
+      std::make_unique<PendingEntryRef>(weak_factory_.GetWeakPtr());
+  pending_entry_refs_.insert(pending_entry_ref.get());
+  return pending_entry_ref;
+}
+
+void NavigationControllerImpl::PendingEntryRefDeleted(PendingEntryRef* ref) {
+  // Ignore refs that don't correspond to the current pending entry.
+  auto it = pending_entry_refs_.find(ref);
+  if (it == pending_entry_refs_.end())
+    return;
+  pending_entry_refs_.erase(it);
+
+  if (!pending_entry_refs_.empty())
+    return;
+
+  // The pending entry may be deleted before the last PendingEntryRef.
+  if (!pending_entry_)
+    return;
+
+  // We usually clear the pending entry when the matching NavigationRequest
+  // fails, so that an arbitrary URL isn't left visible above a committed page.
+  //
+  // However, we do preserve the pending entry in some cases, such as on the
+  // initial navigation of an unmodified blank tab. We also allow the delegate
+  // to say when it's safe to leave aborted URLs in the omnibox, to let the
+  // user edit the URL and try again. This may be useful in cases that the
+  // committed page cannot be attacker-controlled. In these cases, we still
+  // allow the view to clear the pending entry and typed URL if the user
+  // requests (e.g., hitting Escape with focus in the address bar).
+  //
+  // Do not leave the pending entry visible if it has an invalid URL, since this
+  // might be formatted in an unexpected or unsafe way.
+  // TODO(creis): Block navigations to invalid URLs in https://crbug.com/850824.
+  //
+  // Note: don't touch the transient entry, since an interstitial may exist.
+  bool should_preserve_entry =
+      (pending_entry_ == GetVisibleEntry()) &&
+      pending_entry_->GetURL().is_valid() &&
+      (IsUnmodifiedBlankTab() || delegate_->ShouldPreserveAbortedURLs());
+  if (should_preserve_entry)
+    return;
+
+  DiscardPendingEntry(true);
+  delegate_->NotifyNavigationStateChanged(INVALIDATE_TYPE_URL);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl.h b/chromium/content/browser/frame_host/navigation_controller_impl.h
index d85c4ee26ba..00ab09d3d71 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl.h
+++ b/chromium/content/browser/frame_host/navigation_controller_impl.h
@@ -8,36 +8,71 @@
 #include <stddef.h>
 #include <stdint.h>
 
+#include <memory>
+#include <set>
+#include <string>
 #include <vector>
 
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
+#include "base/memory/weak_ptr.h"
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
-#include "content/browser/frame_host/back_forward_cache.h"
+#include "content/browser/frame_host/back_forward_cache_impl.h"
 #include "content/browser/frame_host/navigation_controller_delegate.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/ssl/ssl_manager.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_type.h"
 #include "content/public/browser/reload_type.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 
 struct FrameHostMsg_DidCommitProvisionalLoad_Params;
 
 namespace content {
 class FrameTreeNode;
+class NavigationRequest;
 class RenderFrameHostImpl;
 class SiteInstance;
 struct LoadCommittedDetails;
 
 class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
  public:
-  NavigationControllerImpl(
-      NavigationControllerDelegate* delegate,
-      BrowserContext* browser_context);
+  // This tracks one NavigationRequest navigating to a pending NavigationEntry.
+  // In some cases, several NavigationRequests are referencing the same pending
+  // NavigationEntry. For instance:
+  // - A reload requested while a reload is already in progress.
+  // - An history navigation causing several subframes to navigate.
+  //
+  // When no NavigationRequests are referencing the pending NavigationEntry
+  // anymore, it should be discarded to avoid a URL spoof.
+  //
+  // The deletion is not always immediate, because it is not possible to delete
+  // the entry while requesting a navigation to it at the same time. In this
+  // case, the deletion happens later, when returning from the function.
+  //
+  // If the pending NavigationEntry is discarded before the PendingEntryRef(s),
+  // then removing the last associated PendingEntryRef is a no-op. It is a no-op
+  // forever, even if the entry becomes the pending NavigationEntry again in the
+  // meantime. Rather than track the NavigationRequest or pending entry
+  // explicitly, this ref class simply goes into a set that gets cleared with
+  // each change to the pending entry
+  class PendingEntryRef {
+   public:
+    explicit PendingEntryRef(
+        base::WeakPtr<NavigationControllerImpl> controller);
+    ~PendingEntryRef();
+
+   private:
+    base::WeakPtr<NavigationControllerImpl> controller_;
+    DISALLOW_COPY_AND_ASSIGN(PendingEntryRef);
+  };
+
+  NavigationControllerImpl(NavigationControllerDelegate* delegate,
+                           BrowserContext* browser_context);
   ~NavigationControllerImpl() override;
 
   // NavigationController implementation:
@@ -66,10 +101,10 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
                const std::string& extra_headers) override;
   void LoadURLWithParams(const LoadURLParams& params) override;
   void LoadIfNecessary() override;
-  void LoadErrorPage(RenderFrameHost* render_frame_host,
-                     const GURL& url,
-                     const std::string& error_page_html,
-                     net::Error error) override;
+  void LoadPostCommitErrorPage(RenderFrameHost* render_frame_host,
+                               const GURL& url,
+                               const std::string& error_page_html,
+                               net::Error error) override;
   bool CanGoBack() override;
   bool CanGoForward() override;
   bool CanGoToOffset(int offset) override;
@@ -78,6 +113,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   void GoToIndex(int index) override;
   void GoToOffset(int offset) override;
   bool RemoveEntryAtIndex(int index) override;
+  void PruneForwardEntries() override;
   const SessionStorageNamespaceMap& GetSessionStorageNamespaceMap() override;
   SessionStorageNamespace* GetDefaultSessionStorageNamespace() override;
   bool NeedsReload() override;
@@ -96,6 +132,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   void DeleteNavigationEntries(
       const DeletionPredicate& deletionPredicate) override;
   bool IsEntryMarkedToBeSkipped(int index) override;
+  BackForwardCacheImpl& GetBackForwardCache() override;
 
   // Starts a navigation in a newly created subframe as part of a history
   // navigation. Returns true if the history navigation could start, false
@@ -103,7 +140,8 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // navigation to the default src URL for the frame instead.
   bool StartHistoryNavigationInNewSubframe(
       RenderFrameHostImpl* render_frame_host,
-      mojom::NavigationClientAssociatedPtrInfo* navigation_client);
+      mojo::PendingAssociatedRemote<mojom::NavigationClient>*
+          navigation_client);
 
   // Navigates to a specified offset from the "current entry". Currently records
   // a histogram indicating whether the session history navigation would only
@@ -134,8 +172,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
 
   // The session storage namespace that all child RenderViews belonging to
   // |instance| should use.
-  SessionStorageNamespace* GetSessionStorageNamespace(
-      SiteInstance* instance);
+  SessionStorageNamespace* GetSessionStorageNamespace(SiteInstance* instance);
 
   // Returns the index of the specified entry, or -1 if entry is not contained
   // in this NavigationController.
@@ -147,9 +184,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // Return the entry with the given unique id, or null if not found.
   NavigationEntryImpl* GetEntryWithUniqueID(int nav_entry_id) const;
 
-  NavigationControllerDelegate* delegate() const {
-    return delegate_;
-  }
+  NavigationControllerDelegate* delegate() const { return delegate_; }
 
   // These values are persisted to logs. Entries should not be renumbered and
   // numeric values should never be reused.
@@ -244,7 +279,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   static size_t max_entry_count();
 
   void SetGetTimestampCallbackForTest(
-      const base::Callback<base::Time()>& get_timestamp_callback);
+      const base::RepeatingCallback<base::Time()>& get_timestamp_callback);
 
   // Discards only the pending entry. |was_failure| should be set if the pending
   // entry is being discarded because it failed to load.
@@ -254,8 +289,6 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // navigation failed due to an SSL error.
   void SetPendingNavigationSSLError(bool error);
 
-  BackForwardCache& back_forward_cache() { return back_forward_cache_; }
-
 // Returns true if the string corresponds to a valid data URL, false
 // otherwise.
 #if defined(OS_ANDROID)
@@ -267,6 +300,24 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // entries can be updated as needed.
   void NotifyUserActivation();
 
+  // Tracks a new association between the current pending entry and a
+  // NavigationRequest. Callers are responsible for only calling this for
+  // requests corresponding to the current pending entry.
+  std::unique_ptr<PendingEntryRef> ReferencePendingEntry();
+
+  // Like NavigationController::CreateNavigationEntry, but takes an extra
+  // |source_site_instance| argument.
+  static std::unique_ptr<NavigationEntryImpl> CreateNavigationEntry(
+      const GURL& url,
+      Referrer referrer,
+      base::Optional<url::Origin> initiator_origin,
+      SiteInstance* source_site_instance,
+      ui::PageTransition transition,
+      bool is_renderer_initiated,
+      const std::string& extra_headers,
+      BrowserContext* browser_context,
+      scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory);
+
  private:
   friend class RestoreHelper;
 
@@ -366,8 +417,8 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
       bool is_history_navigation_in_new_child_frame);
 
   // Returns whether there is a pending NavigationEntry whose unique ID matches
-  // the given NavigationHandle's pending_nav_entry_id.
-  bool PendingEntryMatchesHandle(NavigationHandleImpl* handle) const;
+  // the given NavigationRequest's pending_nav_entry_id.
+  bool PendingEntryMatchesRequest(NavigationRequest* request) const;
 
   // Classifies the given renderer navigation (see the NavigationType enum).
   NavigationType ClassifyNavigation(
@@ -394,30 +445,30 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
       bool is_same_document,
       bool replace_entry,
       bool previous_document_was_activated,
-      NavigationHandleImpl* handle);
+      NavigationRequest* request);
   void RendererDidNavigateToExistingPage(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
       bool is_same_document,
       bool was_restored,
-      NavigationHandleImpl* handle,
+      NavigationRequest* request,
       bool keep_pending_entry);
   void RendererDidNavigateToSamePage(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
       bool is_same_document,
-      NavigationHandleImpl* handle);
+      NavigationRequest* request);
   void RendererDidNavigateNewSubframe(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
       bool is_same_document,
       bool replace_entry,
       bool previous_document_was_activated,
-      NavigationHandleImpl* handle);
+      NavigationRequest* request);
   bool RendererDidNavigateAutoSubframe(
       RenderFrameHostImpl* rfh,
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
-      NavigationHandleImpl* handle);
+      NavigationRequest* request);
 
   // Allows the derived class to issue notifications that a load has been
   // committed. This will fill in the active entry to the details structure.
@@ -425,8 +476,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
 
   // Updates the virtual URL of an entry to match a new URL, for cases where
   // the real renderer URL is derived from the virtual URL, like view-source:
-  void UpdateVirtualURLToURL(NavigationEntryImpl* entry,
-                             const GURL& new_url);
+  void UpdateVirtualURLToURL(NavigationEntryImpl* entry, const GURL& new_url);
 
   // Invoked after session/tab restore or cloning a tab. Resets the transition
   // type of the entries, updates the max page id and creates the active
@@ -435,8 +485,12 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
 
   // Inserts a new entry or replaces the current entry with a new one, removing
   // all entries after it. The new entry will become the active one.
+  // If |was_post_commit_error_| is set, the last committed entry will be saved,
+  // the new entry will replace it, and on any navigation away from the new
+  // entry or on reloads, the old one will replace |entry|.
   void InsertOrReplaceEntry(std::unique_ptr<NavigationEntryImpl> entry,
-                            bool replace);
+                            bool replace,
+                            bool was_post_commit_error);
 
   // Removes the entry at |index|, as long as it is not the current entry.
   void RemoveEntryAtIndexInternal(int index);
@@ -489,10 +543,15 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // at |reference_index| will get their skippable flag set to |skippable|.
   void SetSkippableForSameDocumentEntries(int reference_index, bool skippable);
 
+  // Called when one PendingEntryRef is deleted. When all of the refs for the
+  // current pending entry have been deleted, this automatically discards the
+  // pending NavigationEntry.
+  void PendingEntryRefDeleted(PendingEntryRef* ref);
+
   // ---------------------------------------------------------------------------
 
   // The user browser context associated with this controller.
-  BrowserContext* browser_context_;
+  BrowserContext* const browser_context_;
 
   // List of |NavigationEntry|s for this controller.
   std::vector<std::unique_ptr<NavigationEntryImpl>> entries_;
@@ -504,7 +563,15 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // This may refer to an item in the entries_ list if the pending_entry_index_
   // != -1, or it may be its own entry that should be deleted. Be careful with
   // the memory management.
-  NavigationEntryImpl* pending_entry_;
+  NavigationEntryImpl* pending_entry_ = nullptr;
+
+  // This keeps track of the NavigationRequests associated with the pending
+  // NavigationEntry. When all of them have been deleted, or have stopped
+  // loading, the pending NavigationEntry can be discarded.
+  //
+  // This is meant to avoid a class of URL spoofs where the navigation is
+  // canceled, but the stale pending NavigationEntry is left in place.
+  std::set<PendingEntryRef*> pending_entry_refs_;
 
   // If a new entry fails loading, details about it are temporarily held here
   // until the error page is shown (or 0 otherwise).
@@ -514,21 +581,21 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // issues: 1. This might hang around longer than we'd like if there is no
   // error page loaded, and 2. This doesn't work very well for frames.
   // http://crbug.com/474261
-  int failed_pending_entry_id_;
+  int failed_pending_entry_id_ = 0;
 
   // The index of the currently visible entry.
-  int last_committed_entry_index_;
+  int last_committed_entry_index_ = -1;
 
   // The index of the pending entry if it is in entries_, or -1 if
   // pending_entry_ is a new entry (created by LoadURL).
-  int pending_entry_index_;
+  int pending_entry_index_ = -1;
 
   // The index for the entry that is shown until a navigation occurs.  This is
   // used for interstitial pages. -1 if there are no such entry.
   // Note that this entry really appears in the list of entries, but only
   // temporarily (until the next navigation).  Any index pointing to an entry
   // after the transient entry will become invalid if you navigate forward.
-  int transient_entry_index_;
+  int transient_entry_index_ = -1;
 
   // The delegate associated with the controller. Possibly NULL during
   // setup.
@@ -538,7 +605,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   SSLManager ssl_manager_;
 
   // Whether we need to be reloaded when made active.
-  bool needs_reload_;
+  bool needs_reload_ = false;
 
   // Source of when |needs_reload_| is set. Only valid when |needs_reload_|
   // is set.
@@ -546,10 +613,10 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
 
   // Whether this is the initial navigation.
   // Becomes false when initial navigation commits.
-  bool is_initial_navigation_;
+  bool is_initial_navigation_ = true;
 
   // Prevent unsafe re-entrant calls to NavigateToPendingEntry.
-  bool in_navigate_to_pending_entry_;
+  bool in_navigate_to_pending_entry_ = false;
 
   // Used to find the appropriate SessionStorageNamespace for the storage
   // partition of a NavigationEntry.
@@ -565,10 +632,10 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
 
   // If a repost is pending, its type (RELOAD or RELOAD_BYPASSING_CACHE),
   // NO_RELOAD otherwise.
-  ReloadType pending_reload_;
+  ReloadType pending_reload_ = ReloadType::NONE;
 
   // Used to get timestamps for newly-created navigation entries.
-  base::Callback<base::Time()> get_timestamp_callback_;
+  base::RepeatingCallback<base::Time()> get_timestamp_callback_;
 
   // Used to smooth out timestamps from |get_timestamp_callback_|.
   // Without this, whenever there is a run of redirects or
@@ -581,7 +648,21 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   //
   // Stores frozen RenderFrameHost. Restores them on history navigation.
   // See BackForwardCache class documentation.
-  BackForwardCache back_forward_cache_;
+  BackForwardCacheImpl back_forward_cache_;
+
+  // Holds the entry that was committed at the time an error page was triggered
+  // due to a call to LoadPostCommitErrorPage. The error entry will take its
+  // place until the user navigates again, at which point it will go back into
+  // the entry list instead of the error entry. Set to nullptr if there is no
+  // post commit error entry. Note that this entry must always correspond to the
+  // last committed entry index, and that there can be only a single post-commit
+  // error page entry in its place in entries_. This ensures that its spot in
+  // entries_ cannot go away (e.g., due to PruneForwardEntries) and that it can
+  // go back into place after any subsequent commit.
+  std::unique_ptr<NavigationEntryImpl> entry_replaced_by_post_commit_error_;
+
+  // NOTE: This must be the last member.
+  base::WeakPtrFactory<NavigationControllerImpl> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(NavigationControllerImpl);
 };
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc b/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc
index 4cbc72de1c5..db76b82ac40 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_impl_browsertest.cc
@@ -10,6 +10,7 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/callback.h"
 #include "base/command_line.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/macros.h"
@@ -19,6 +20,7 @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/threading/thread_restrictions.h"
@@ -28,7 +30,6 @@
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/display_util.h"
@@ -73,22 +74,30 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 
+namespace content {
 namespace {
 
-static const char kAddNamedFrameScript[] =
+using testing::ElementsAre;
+using testing::IsEmpty;
+
+const char kAddNamedFrameScript[] =
     "var f = document.createElement('iframe');"
     "f.name = 'foo-frame-name';"
     "document.body.appendChild(f);";
-static const char kRemoveFrameScript[] =
+const char kRemoveFrameScript[] =
     "var f = document.querySelector('iframe');"
     "f.parentNode.removeChild(f);";
 
-using testing::ElementsAre;
-using testing::IsEmpty;
+const char kAddEmptyFrameScript[] =
+    "let iframe = document.createElement('iframe');"
+    "document.body.appendChild(iframe);";
 
-}  // namespace
+const char kAddFrameWithSrcScript[] =
+    "let iframe = document.createElement('iframe');"
+    "iframe.src = $1;"
+    "document.body.appendChild(iframe);";
 
-namespace content {
+}  // namespace
 
 class NavigationControllerBrowserTest : public ContentBrowserTest {
  protected:
@@ -551,8 +560,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, UniqueIDsOnFrames) {
 // list.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        DontIgnoreBackAfterNavEntryLimit) {
-  NavigationController& controller =
-      shell()->web_contents()->GetController();
+  NavigationController& controller = shell()->web_contents()->GetController();
 
   const int kMaxEntryCount =
       static_cast<int>(NavigationControllerImpl::max_entry_count());
@@ -566,8 +574,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_EQ(controller.GetEntryCount(), kMaxEntryCount);
 
   // Navigate twice more more.
-  for (int url_index = kMaxEntryCount;
-       url_index < kMaxEntryCount + 2; ++url_index) {
+  for (int url_index = kMaxEntryCount; url_index < kMaxEntryCount + 2;
+       ++url_index) {
     GURL url(base::StringPrintf("data:text/html,page%d", url_index));
     EXPECT_TRUE(NavigateToURL(shell(), url));
   }
@@ -608,8 +616,7 @@ bool RendererLocationReplace(Shell* shell, const GURL& url) {
 // that the browser and renderer agree, and that both get it right.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        CorrectLengthWithCurrentItemReplacement) {
-  NavigationController& controller =
-      shell()->web_contents()->GetController();
+  NavigationController& controller = shell()->web_contents()->GetController();
 
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL("/simple_page.html")));
@@ -705,17 +712,9 @@ class FrameNavigateParamsCapturer : public WebContentsObserver {
         wait_for_load_(true),
         message_loop_runner_(new MessageLoopRunner) {}
 
-  void set_navigations_remaining(int count) {
-    navigations_remaining_ = count;
-  }
-
-  void set_wait_for_load(bool ignore) {
-    wait_for_load_ = ignore;
-  }
-
-  void Wait() {
-    message_loop_runner_->Run();
-  }
+  void set_navigations_remaining(int count) { navigations_remaining_ = count; }
+  void set_wait_for_load(bool ignore) { wait_for_load_ = ignore; }
+  void Wait() { message_loop_runner_->Run(); }
 
   ui::PageTransition transition() {
     EXPECT_EQ(1U, transitions_.size());
@@ -759,8 +758,7 @@ class FrameNavigateParamsCapturer : public WebContentsObserver {
     transitions_.push_back(navigation_handle->GetPageTransition());
     urls_.push_back(navigation_handle->GetURL());
     navigation_types_.push_back(
-        static_cast<NavigationHandleImpl*>(navigation_handle)
-            ->navigation_type());
+        NavigationRequest::From(navigation_handle)->navigation_type());
     is_same_documents_.push_back(navigation_handle->IsSameDocument());
     did_replace_entries_.push_back(navigation_handle->DidReplaceEntry());
     if (!navigations_remaining_ &&
@@ -871,13 +869,9 @@ class LoadCommittedCapturer : public WebContentsObserver {
         frame_tree_node_id_(0),
         message_loop_runner_(new MessageLoopRunner) {}
 
-  void Wait() {
-    message_loop_runner_->Run();
-  }
+  void Wait() { message_loop_runner_->Run(); }
 
-  ui::PageTransition transition_type() const {
-    return transition_type_;
-  }
+  ui::PageTransition transition_type() const { return transition_type_; }
 
  private:
   void RenderFrameCreated(RenderFrameHost* render_frame_host) override {
@@ -908,7 +902,7 @@ class LoadCommittedCapturer : public WebContentsObserver {
 
     DCHECK_NE(0, frame_tree_node_id_);
     if (navigation_handle->GetRenderFrameHost()->GetFrameTreeNodeId() !=
-            frame_tree_node_id_) {
+        frame_tree_node_id_) {
       return;
     }
 
@@ -964,9 +958,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, SubframeOnEmptyPage) {
   NoNavigationsObserver observer(new_shell->web_contents());
   {
     LoadCommittedCapturer capturer(new_shell->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = 'data:text/html,<p>some page</p>';"
-                         "document.body.appendChild(iframe);";
+    std::string script =
+        JsReplace(kAddFrameWithSrcScript, "data:text/html,<p>some page</p>");
     EXPECT_TRUE(ExecJs(new_root, script));
     capturer.Wait();
   }
@@ -992,10 +985,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, SubframeOnEmptyPage) {
       "bar.com", "/navigation_controller/simple_page_1.html"));
   {
     LoadCommittedCapturer capturer(new_shell->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + grandchild_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(new_root->child_at(0), script));
+    EXPECT_TRUE(ExecJs(new_root->child_at(0),
+                       JsReplace(kAddFrameWithSrcScript, grandchild_url)));
     capturer.Wait();
   }
   ASSERT_EQ(1U, new_root->child_at(0)->child_count());
@@ -1085,8 +1076,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(new_root->current_frame_host()->IsRenderFrameLive());
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       ErrorPageReplacement) {
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, ErrorPageReplacement) {
   NavigationController& controller = shell()->web_contents()->GetController();
   GURL error_url = embedded_test_server()->GetURL("/close-socket");
   base::PostTask(FROM_HERE, {BrowserThread::IO},
@@ -1095,9 +1085,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
   EXPECT_EQ(1, controller.GetEntryCount());
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   // Navigate to a page that fails to load. It must result in an error page, the
   // NEW_PAGE navigation type, and an addition to the history list.
@@ -1170,9 +1160,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        NavigationTypeClassification_NewPage) {
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   {
     // Simple load.
@@ -1271,9 +1261,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/simple_page_2.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url2));
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   {
     // Back from the browser side.
@@ -1511,9 +1501,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/simple_page_1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url1));
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   {
     // Simple load.
@@ -1616,9 +1606,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/simple_page_1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url1));
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   {
     // Load an (invalid) empty GURL.  Blink will treat this as an inert commit,
@@ -1641,9 +1631,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   ASSERT_EQ(1U, root->child_count());
   ASSERT_NE(nullptr, root->child_at(0));
@@ -1776,10 +1766,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
     LoadCommittedCapturer capturer(shell()->web_contents());
     GURL frame_url(embedded_test_server()->GetURL(
         "/navigation_controller/simple_page_1.html"));
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + frame_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, frame_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -1793,9 +1780,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   {
     // Load the redirecting page.
@@ -1829,9 +1816,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), links_url));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   {
     // Do a fragment link click.
@@ -1863,8 +1850,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/page_with_iframe.html"));
   EXPECT_TRUE(NavigateToURL(shell(), iframe_url));
 
-  root = static_cast<WebContentsImpl*>(shell()->web_contents())->
-      GetFrameTree()->root();
+  root = static_cast<WebContentsImpl*>(shell()->web_contents())
+             ->GetFrameTree()
+             ->root();
 
   ASSERT_EQ(1U, root->child_count());
   ASSERT_NE(nullptr, root->child_at(0));
@@ -1907,9 +1895,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
   url::Origin main_origin =
       root->current_frame_host()->GetLastCommittedOrigin();
   EXPECT_EQ(url::Origin::Create(main_url), main_origin);
@@ -1917,9 +1905,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 1. Create a iframe with no URL.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, kAddEmptyFrameScript));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -1949,9 +1935,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // count as a real load.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(0), script));
+    EXPECT_TRUE(ExecJs(root->child_at(0), kAddEmptyFrameScript));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -1970,10 +1954,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 2. Create another iframe with an explicit about:blank URL.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = 'about:blank';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, "about:blank")));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2061,8 +2042,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // not the initial blank page.
   {
     LoadCommittedCapturer capturer(root->child_at(0)->child_at(0));
-    std::string script = "var frames = document.getElementsByTagName('iframe');"
-                         "frames[0].src = 'about:blank';";
+    std::string script =
+        "var frames = document.getElementsByTagName('iframe');"
+        "frames[0].src = 'about:blank';";
     EXPECT_TRUE(ExecJs(root->child_at(0), script));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
@@ -2249,9 +2231,12 @@ IN_PROC_BROWSER_TEST_F(
   // 1. Create a iframe with a URL that doesn't commit.
   GURL no_commit_url(embedded_test_server()->GetURL("/nocontent"));
   {
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + no_commit_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
+    std::string script =
+        "var iframe = document.createElement('iframe');"
+        "iframe.src = '" +
+        no_commit_url.spec() +
+        "';"
+        "document.body.appendChild(iframe);";
     EXPECT_TRUE(ExecJs(root, script));
   }
   EXPECT_EQ(GURL(), root->child_at(0)->current_url());
@@ -2261,10 +2246,8 @@ IN_PROC_BROWSER_TEST_F(
       "foo.com", "/navigation_controller/simple_page_1.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + foo_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(0), script));
+    EXPECT_TRUE(
+        ExecJs(root->child_at(0), JsReplace(kAddFrameWithSrcScript, foo_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2303,10 +2286,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/simple_page_2.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + child_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, child_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2324,10 +2304,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "foo.com", "/navigation_controller/simple_page_1.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + grandchild_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(0), script));
+    EXPECT_TRUE(ExecJs(root->child_at(0),
+                       JsReplace(kAddFrameWithSrcScript, grandchild_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2355,10 +2333,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/simple_page_2.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + child_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, child_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2372,10 +2347,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "bar.com", "/navigation_controller/simple_page_1.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + bar_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(0), script));
+    EXPECT_TRUE(
+        ExecJs(root->child_at(0), JsReplace(kAddFrameWithSrcScript, bar_url)));
 
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
@@ -2397,19 +2370,16 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   // 1. Create a same-site iframe.
   GURL frame_url(embedded_test_server()->GetURL(
       "/navigation_controller/simple_page_2.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + frame_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, frame_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2439,10 +2409,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "foo.com", "/navigation_controller/simple_page_1.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + foo_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, foo_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2469,10 +2436,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 3. Create a nested iframe in the second subframe.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + foo_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(1), script));
+    EXPECT_TRUE(
+        ExecJs(root->child_at(1), JsReplace(kAddFrameWithSrcScript, foo_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2499,10 +2464,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // the commit type is correct even when the subframe process already exists.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + foo_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, foo_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2527,11 +2489,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 5. Create a nested iframe on the original site (A-B-A).
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + frame_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
     FrameTreeNode* child = root->child_at(2);
-    EXPECT_TRUE(ExecJs(child, script));
+    EXPECT_TRUE(ExecJs(child, JsReplace(kAddFrameWithSrcScript, frame_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2579,19 +2538,16 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   // 1. Create a same-site iframe.
   GURL frame_url(embedded_test_server()->GetURL(
       "/navigation_controller/simple_page_2.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + frame_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, frame_url)));
     capturer.Wait();
   }
   NavigationEntryImpl* entry = controller.GetLastCommittedEntry();
@@ -2627,10 +2583,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "foo.com", "/navigation_controller/simple_page_1.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + foo_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, foo_url)));
     capturer.Wait();
   }
 
@@ -2638,10 +2591,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // commit, then navigate it again cross-site.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + foo_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(1), script));
+    EXPECT_TRUE(
+        ExecJs(root->child_at(1), JsReplace(kAddFrameWithSrcScript, foo_url)));
     capturer.Wait();
   }
   GURL bar_url(embedded_test_server()->GetURL(
@@ -2684,8 +2635,10 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
     FrameNavigateParamsCapturer capturer(root->child_at(1));
     RenderFrameDeletedObserver deleted_observer(
         root->child_at(1)->current_frame_host());
-    std::string script = "var frames = document.getElementsByTagName('iframe');"
-                         "frames[1].src = '" + baz_url.spec() + "';";
+    std::string script =
+        "var frames = document.getElementsByTagName('iframe');"
+        "frames[1].src = '" +
+        baz_url.spec() + "';";
     EXPECT_TRUE(ExecJs(root, script));
     // Wait for the RenderFrame to go away, if this will be cross-process.
     if (AreAllSitesIsolatedForTesting())
@@ -2734,9 +2687,9 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   ASSERT_EQ(1U, root->child_count());
   ASSERT_NE(nullptr, root->child_at(0));
@@ -2766,10 +2719,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 3. Add a nested subframe.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + subframe_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root->child_at(0), script));
+    EXPECT_TRUE(ExecJs(root->child_at(0),
+                       JsReplace(kAddFrameWithSrcScript, subframe_url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -2802,10 +2753,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
       "/navigation_controller/simple_page_2.html"));
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + frame_url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, frame_url)));
     capturer.Wait();
   }
   NavigationEntryImpl* entry1 = controller.GetLastCommittedEntry();
@@ -4162,13 +4110,11 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/navigation_controller/inject_into_blank_iframe.html"));
   GURL blank_url(url::kAboutBlankURL);
-  NavigationControllerImpl& controller =
-      static_cast<NavigationControllerImpl&>(
-          shell()->web_contents()->GetController());
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())
-          ->GetFrameTree()
-          ->root();
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell()->web_contents()->GetController());
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   // Create a NavigationEntry to restore, as if it had been loaded before.  The
   // page has an about:blank iframe and injects content into it, but the
@@ -4241,10 +4187,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 2. Add an unnamed subframe, which does an AUTO_SUBFRAME navigation.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + url.spec() + "';"
-                         "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -4266,10 +4209,12 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 3. Add a named subframe.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string script = "var iframe = document.createElement('iframe');"
-                         "iframe.src = '" + url.spec() + "';"
-                         "iframe.name = 'foo';"
-                         "document.body.appendChild(iframe);";
+    std::string script = JsReplace(
+        "var iframe = document.createElement('iframe');"
+        "iframe.src = $1;"
+        "iframe.name = 'foo';"
+        "document.body.appendChild(iframe);",
+        url);
     EXPECT_TRUE(ExecJs(root, script));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
@@ -4886,9 +4831,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 2. Add a cross-site subframe.
   GURL frame_url(embedded_test_server()->GetURL(
       "foo.com", "/navigation_controller/simple_page_1.html"));
-  std::string script = "var iframe = document.createElement('iframe');"
-                       "iframe.src = '" + frame_url.spec() + "';"
-                       "document.body.appendChild(iframe);";
+  std::string script = JsReplace(kAddFrameWithSrcScript, frame_url);
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
     EXPECT_TRUE(ExecJs(root, script));
@@ -4968,10 +4911,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   // 3. Add a subframe, which does an AUTO_SUBFRAME navigation.
   {
     LoadCommittedCapturer capturer(shell()->web_contents());
-    std::string add_script = "var iframe = document.createElement('iframe');"
-                             "iframe.src = '" + url.spec() + "';"
-                             "document.body.appendChild(iframe);";
-    EXPECT_TRUE(ExecJs(root, add_script));
+    EXPECT_TRUE(ExecJs(root, JsReplace(kAddFrameWithSrcScript, url)));
     capturer.Wait();
     EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
         capturer.transition_type(), ui::PAGE_TRANSITION_AUTO_SUBFRAME));
@@ -5182,13 +5122,12 @@ void DoReplaceStateWhilePending(Shell* shell,
                                 const GURL& start_url,
                                 const GURL& stalled_url,
                                 const std::string& replace_state_filename) {
-  NavigationControllerImpl& controller =
-      static_cast<NavigationControllerImpl&>(
-          shell->web_contents()->GetController());
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell->web_contents()->GetController());
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   // Start with one page.
   EXPECT_TRUE(NavigateToURL(shell, start_url));
@@ -5483,8 +5422,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   {
     // history.replaceState().
     FrameNavigateParamsCapturer capturer(root);
-    std::string script =
-        "history.replaceState({}, 'replaced', 'replaced')";
+    std::string script = "history.replaceState({}, 'replaced', 'replaced')";
     EXPECT_TRUE(ExecJs(root, script));
     capturer.Wait();
   }
@@ -5515,9 +5453,7 @@ class FailureWatcher : public WebContentsObserver {
         frame_tree_node_id_(node->frame_tree_node_id()),
         message_loop_runner_(new MessageLoopRunner) {}
 
-  void Wait() {
-    message_loop_runner_->Run();
-  }
+  void Wait() { message_loop_runner_->Run(); }
 
  private:
   void DidFailLoad(RenderFrameHost* render_frame_host,
@@ -5552,13 +5488,12 @@ class FailureWatcher : public WebContentsObserver {
 
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
                        StopCausesFailureDespiteJavaScriptURL) {
-  NavigationControllerImpl& controller =
-      static_cast<NavigationControllerImpl&>(
-          shell()->web_contents()->GetController());
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell()->web_contents()->GetController());
 
-  FrameTreeNode* root =
-      static_cast<WebContentsImpl*>(shell()->web_contents())->
-          GetFrameTree()->root();
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
 
   // Start with a normal page.
   GURL url1(embedded_test_server()->GetURL(
@@ -5824,11 +5759,12 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
 
   GURL frame_url_1 = embedded_test_server()->GetURL(
       "/navigation_controller/simple_page_1.html");
-  std::string script =
+  std::string script = JsReplace(
       "var iframe = document.createElement('iframe');"
-      "iframe.src = '" + frame_url_1.spec() + "';"
+      "iframe.src = $1;"
       "iframe.id = 'frame';"
-      "document.body.appendChild(iframe);";
+      "document.body.appendChild(iframe);",
+      frame_url_1);
   EXPECT_TRUE(ExecJs(root, script));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
@@ -5949,11 +5885,12 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
 
   GURL frame_url_1 = embedded_test_server()->GetURL(
       "/navigation_controller/simple_page_1.html");
-  std::string script =
+  std::string script = JsReplace(
       "var iframe = document.createElement('iframe');"
-      "iframe.src = '" + frame_url_1.spec() + "';"
+      "iframe.src = $1;"
       "iframe.id = 'frame';"
-      "document.body.appendChild(iframe);";
+      "document.body.appendChild(iframe);",
+      frame_url_1);
   EXPECT_TRUE(ExecJs(root->current_frame_host(), script));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
@@ -6623,8 +6560,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
 
 // Tests that when using FrameNavigationEntries, knowledge of POST navigations
 // is recorded on a subframe level.
-IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       PostInSubframe) {
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, PostInSubframe) {
   GURL page_with_form_url = embedded_test_server()->GetURL(
       "/navigation_controller/subframe_form.html");
   EXPECT_TRUE(NavigateToURL(shell(), page_with_form_url));
@@ -6686,7 +6622,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, PostViaOpenUrlMsg) {
       ->web_contents()
       ->GetMutableRendererPrefs()
       ->browser_handles_all_top_level_requests = true;
-  shell()->web_contents()->GetRenderViewHost()->SyncRendererPrefs();
+  shell()->web_contents()->SyncRendererPrefs();
 
   // Submit the form.
   TestNavigationObserver form_post_observer(shell()->web_contents(), 1);
@@ -7183,6 +7119,50 @@ IN_PROC_BROWSER_TEST_F(
             EvalJs(web_contents, "self.origin"));
 }
 
+// This test simulates what happens when OnCommitTimeout is triggered after
+// ResetForCrossDocumentRestart. See https://crbug.com/1006677.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       OnCommitTimeoutAfterResetForCrossDocumentRestart) {
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  FrameTreeNode* root = web_contents->GetFrameTree()->root();
+
+  // Navigate to a simple page and then perform a same document navigation.
+  GURL start_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  GURL same_document_url(
+      embedded_test_server()->GetURL("a.com", "/title1.html#foo"));
+  EXPECT_TRUE(NavigateToURL(shell(), same_document_url));
+  EXPECT_EQ(2, web_contents->GetController().GetEntryCount());
+
+  // Create a HistoryNavigationBeforeCommitInjector, which will perform a
+  // GoBack() just before a cross-origin, same process navigation commits.
+  GURL cross_origin_url(
+      embedded_test_server()->GetURL("suborigin.a.com", "/title2.html"));
+  HistoryNavigationBeforeCommitInjector trigger(web_contents, cross_origin_url);
+
+  // Trigger OnCommitTimeout by setting commit timeout to 1 microsecond.
+  NavigationRequest::SetCommitTimeoutForTesting(
+      base::TimeDelta::FromMicroseconds(1));
+
+  // Navigate cross-origin, waiting for the commit to occur.
+  UrlCommitObserver cross_origin_commit_observer(root, cross_origin_url);
+  UrlCommitObserver history_commit_observer(root, start_url);
+  shell()->LoadURL(cross_origin_url);
+  cross_origin_commit_observer.Wait();
+  EXPECT_EQ(cross_origin_url, web_contents->GetLastCommittedURL());
+  EXPECT_EQ(2, web_contents->GetController().GetLastCommittedEntryIndex());
+
+  // Wait for the history navigation to commit.
+  history_commit_observer.Wait();
+  EXPECT_EQ(start_url, web_contents->GetLastCommittedURL());
+  EXPECT_EQ(0, web_contents->GetController().GetLastCommittedEntryIndex());
+
+  // Reset the timeout.
+  NavigationRequest::SetCommitTimeoutForTesting(base::TimeDelta());
+}
+
 // This test simulates a same-document navigation, being restarted as a
 // cross-document one. It starts a network loader, but fails and an error page
 // is committed instead. The RenderFrameHost selected initially for the initial
@@ -7354,8 +7334,8 @@ class AllowDialogIPCOnCommitFilter : public BrowserMessageFilter,
 
     // Suspend the message.
     web_contents_observer_.SetCallback(
-        base::Bind(&RenderFrameHost::OnMessageReceived,
-                   base::Unretained(render_frame_host_), message));
+        base::BindOnce(&RenderFrameHost::OnMessageReceived,
+                       base::Unretained(render_frame_host_), message));
     return true;
   }
 
@@ -7370,7 +7350,7 @@ class AllowDialogIPCOnCommitFilter : public BrowserMessageFilter,
   // OnMessageReceived function; this is the simplest way to disambiguate.
   class : public WebContentsObserver {
    public:
-    using Callback = base::Callback<bool()>;
+    using Callback = base::OnceCallback<bool()>;
 
     using WebContentsObserver::Observe;
 
@@ -7383,7 +7363,7 @@ class AllowDialogIPCOnCommitFilter : public BrowserMessageFilter,
         return;
 
       // Resume the message.
-      callback_.Run();
+      std::move(callback_).Run();
     }
 
     Callback callback_;
@@ -7473,7 +7453,7 @@ class RequestMonitoringNavigationBrowserTest : public ContentBrowserTest {
   void SetUpOnMainThread() override {
     // Accumulate all http requests made to |embedded_test_server| into
     // |accumulated_requests_| container.
-    embedded_test_server()->RegisterRequestMonitor(base::Bind(
+    embedded_test_server()->RegisterRequestMonitor(base::BindRepeating(
         &RequestMonitoringNavigationBrowserTest::MonitorRequestOnIoThread,
         weak_factory_.GetWeakPtr(), base::SequencedTaskRunnerHandle::Get()));
 
@@ -7588,7 +7568,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
                             ->GetFrameTree()
                             ->root();
-  EXPECT_FALSE(main_frame->GetNavigationHandle());
+  EXPECT_FALSE(main_frame->navigation_request());
   EXPECT_FALSE(root->navigation_request());
 
   // Start navigating to the second page.
@@ -7657,8 +7637,7 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
 
 // Tests that a 204 response to a browser-initiated navigation does not result
 // in a new NavigationEntry being committed.
-IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       204Navigation) {
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest, 204Navigation) {
   const GURL kURL = embedded_test_server()->GetURL("/title1.html");
   const GURL kURL204 = embedded_test_server()->GetURL("/page204.html");
 
@@ -8478,10 +8457,10 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_EQ(url1, shell()->web_contents()->GetLastCommittedURL());
 }
 
-// Test to verify that LoadErrorPage loads an error page even with a
+// Test to verify that LoadPostCommitErrorPage loads an error page even with a
 // valid URL.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       BrowserInitiatedLoadErrorPage) {
+                       BrowserInitiatedLoadPostCommitErrorPage) {
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
 
@@ -8493,7 +8472,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
 
   std::string error_html = "Error page";
   TestNavigationObserver error_observer(shell()->web_contents());
-  controller.LoadErrorPage(root, url, error_html, net::ERR_BLOCKED_BY_CLIENT);
+  controller.LoadPostCommitErrorPage(root, url, error_html,
+                                     net::ERR_BLOCKED_BY_CLIENT);
   error_observer.Wait();
 
   scoped_refptr<SiteInstance> error_site_instance =
@@ -8521,10 +8501,10 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
             policy->GetOriginLock(error_site_instance->GetProcess()->GetID()));
 }
 
-// Test to verify that LoadErrorPage loads an error page in a subframe
+// Test to verify that LoadPostCommitErrorPage loads an error page in a subframe
 // correctly.
 IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       BrowserInitiatedLoadErrorPageForSubframe) {
+                       BrowserInitiatedLoadPostCommitErrorPageForSubframe) {
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
 
@@ -8539,7 +8519,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
 
   std::string error_html = "Error page";
   TestNavigationObserver error_observer(shell()->web_contents());
-  controller.LoadErrorPage(child, url, error_html, net::ERR_BLOCKED_BY_CLIENT);
+  controller.LoadPostCommitErrorPage(child, url, error_html,
+                                     net::ERR_BLOCKED_BY_CLIENT);
   error_observer.Wait();
 
   EXPECT_FALSE(error_observer.last_navigation_succeeded());
@@ -8554,10 +8535,56 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   EXPECT_NE(GURL(kUnreachableWebDataURL), error_site_instance->GetSiteURL());
 }
 
-// Test to verify that LoadErrorPage works correctly when supplied with an
-// about:blank url for the error page.
-IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
-                       BrowserInitiatedLoadErrorPageWithAboutBlankUrl) {
+// Checks that a browser initiated error page navigation in a frame pending
+// deletion is ignored and does not result in a crash. See
+// https://crbug.com/1019180.
+IN_PROC_BROWSER_TEST_F(
+    NavigationControllerBrowserTest,
+    BrowserInitiatedLoadPostCommitErrorPageIgnoredForFramePendingDeletion) {
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell()->web_contents()->GetController());
+
+  GURL url(embedded_test_server()->GetURL("a.com", "/page_with_iframe.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  RenderFrameHost* frame = shell()->web_contents()->GetMainFrame();
+
+  // Create an unload handler and force the browser process to wait before
+  // deleting |frame|.
+  EXPECT_TRUE(ExecJs(frame, R"(
+             window.onunload=function(e){
+               window.domAutomationController.send('done');
+             };)"));
+
+  // Navigate the main frame cross-process and wait for the unload event to
+  // fire.
+  DOMMessageQueue dom_message_queue(frame);
+  GURL cross_process_url(
+      embedded_test_server()->GetURL("b.com", "/page_with_iframe.html"));
+  shell()->LoadURL(cross_process_url);
+
+  std::string message;
+  EXPECT_TRUE(dom_message_queue.WaitForMessage(&message));
+  EXPECT_EQ("\"done\"", message);
+
+  // |frame| is now pending deletion.
+  EXPECT_FALSE(static_cast<RenderFrameHostImpl*>(frame)->is_active());
+
+  std::string error_html = "Error page";
+  DidStartNavigationObserver did_start_navigation_observer(
+      shell()->web_contents());
+  controller.LoadPostCommitErrorPage(frame, url, error_html,
+                                     net::ERR_BLOCKED_BY_CLIENT);
+
+  // The error page navigation was ignored.
+  EXPECT_FALSE(did_start_navigation_observer.observed());
+}
+
+// Test to verify that LoadPostCommitErrorPage works correctly when supplied
+// with an about:blank url for the error page.
+IN_PROC_BROWSER_TEST_F(
+    NavigationControllerBrowserTest,
+    BrowserInitiatedLoadPostCommitErrorPageWithAboutBlankUrl) {
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
       shell()->web_contents()->GetController());
 
@@ -8573,8 +8600,8 @@ IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
   std::string error_html = "Error page";
   GURL error_url("about:blank#error");
   TestNavigationObserver error_observer(shell()->web_contents());
-  controller.LoadErrorPage(child, error_url, error_html,
-                           net::ERR_BLOCKED_BY_CLIENT);
+  controller.LoadPostCommitErrorPage(child, error_url, error_html,
+                                     net::ERR_BLOCKED_BY_CLIENT);
   error_observer.Wait();
 
   EXPECT_FALSE(error_observer.last_navigation_succeeded());
@@ -8605,6 +8632,138 @@ class NavigationControllerDisableHistoryIntervention
   base::test::ScopedFeatureList feature_list_;
 };
 
+// Test to verify that after loading a post-commit error page, back is treated
+// as navigating to the entry prior to the page that was active when the
+// post-commit error page was triggered.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       BackOnBrowserInitiatedErrorPageNavigation) {
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell()->web_contents()->GetController());
+
+  GURL url1(embedded_test_server()->GetURL("/title1.html"));
+  GURL url2(embedded_test_server()->GetURL("/title2.html"));
+
+  // Navigate to a valid page.
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+  int initial_entry_index = controller.GetLastCommittedEntryIndex();
+
+  // Navigate to a different page.
+  EXPECT_TRUE(NavigateToURL(shell(), url2));
+
+  // Trigger a post-commit error page navigation.
+  TestNavigationObserver error_observer(shell()->web_contents());
+  controller.LoadPostCommitErrorPage(shell()->web_contents()->GetMainFrame(),
+                                     url2, "Error Page",
+                                     net::ERR_BLOCKED_BY_CLIENT);
+  error_observer.Wait();
+  EXPECT_EQ(PAGE_TYPE_ERROR, controller.GetLastCommittedEntry()->GetPageType());
+  EXPECT_EQ(2, controller.GetEntryCount());
+
+  // Make sure back is treated as going back from the page that was visible when
+  // the post-commit error page was loaded.
+  controller.GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(2, controller.GetEntryCount());
+  EXPECT_EQ(initial_entry_index, controller.GetLastCommittedEntryIndex());
+  // Check that the next forward entry has been replaced with the original visit
+  // to the site (i.e. it shouldn't be the error page).
+  EXPECT_EQ(PAGE_TYPE_NORMAL, controller.GetEntryAtOffset(1)->GetPageType());
+  EXPECT_EQ(url2, controller.GetEntryAtOffset(1)->GetURL());
+}
+
+// Test to verify that after loading a post-commit error page, reload
+// triggers a navigation to the previous page (the page that was active when
+// the navigation to an error was triggered).
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       ReloadOnBrowserInitiatedErrorPageNavigation) {
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell()->web_contents()->GetController());
+
+  GURL url(embedded_test_server()->GetURL("/title1.html"));
+
+  // Navigate to a valid page.
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  int initial_entry_index = controller.GetLastCommittedEntryIndex();
+  int initial_entry_id = controller.GetLastCommittedEntry()->GetUniqueID();
+
+  // Trigger a post-commit error page navigation.
+  TestNavigationObserver error_observer(shell()->web_contents());
+  controller.LoadPostCommitErrorPage(shell()->web_contents()->GetMainFrame(),
+                                     url, "Error Page",
+                                     net::ERR_BLOCKED_BY_CLIENT);
+  error_observer.Wait();
+  EXPECT_EQ(PAGE_TYPE_ERROR, controller.GetLastCommittedEntry()->GetPageType());
+  EXPECT_EQ(1, controller.GetEntryCount());
+
+  // Make sure reload triggers a reload of the original page, not the error,
+  // and that we get back to the original entry.
+  controller.Reload(ReloadType::NORMAL, false);
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_EQ(initial_entry_index, controller.GetLastCommittedEntryIndex());
+
+  // We should be in the initial entry and no longer be in an error page.
+  EXPECT_EQ(initial_entry_id,
+            controller.GetLastCommittedEntry()->GetUniqueID());
+  EXPECT_EQ(PAGE_TYPE_NORMAL,
+            controller.GetLastCommittedEntry()->GetPageType());
+
+  // The error page entry shouldn't be available as a forward navigation.
+  EXPECT_FALSE(controller.CanGoForward());
+  EXPECT_EQ(1, controller.GetEntryCount());
+}
+
+// Test clone behavior of post-commit error page navigations.
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       CloneOnBrowserInitiatedErrorPageNavigation) {
+  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
+      shell()->web_contents()->GetController());
+
+  GURL url(embedded_test_server()->GetURL("/title2.html"));
+
+  // Navigate to a valid page.
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  int initial_entry_id = controller.GetLastCommittedEntry()->GetUniqueID();
+  base::string16 initial_title = controller.GetLastCommittedEntry()->GetTitle();
+  // Trigger a post-commit error page navigation.
+  TestNavigationObserver error_observer(shell()->web_contents());
+  controller.LoadPostCommitErrorPage(shell()->web_contents()->GetMainFrame(),
+                                     url, "Error Page",
+                                     net::ERR_BLOCKED_BY_CLIENT);
+  error_observer.Wait();
+  EXPECT_EQ(PAGE_TYPE_ERROR, controller.GetLastCommittedEntry()->GetPageType());
+  EXPECT_EQ(1, controller.GetEntryCount());
+
+  // Clone the tab and load the entry.
+  std::unique_ptr<WebContents> new_tab = shell()->web_contents()->Clone();
+  WebContentsImpl* new_tab_impl = static_cast<WebContentsImpl*>(new_tab.get());
+  NavigationController& new_controller = new_tab_impl->GetController();
+  EXPECT_TRUE(new_controller.IsInitialNavigation());
+  EXPECT_TRUE(new_controller.NeedsReload());
+  // TODO(carlosil): Before we load, the entry on the new controller is a clone
+  // of the post commit error page entry. This is mostly ok since after the load
+  // we end up in the right page, but causes navigation state to be lost,
+  // ideally we should clone the entry replaced by the error page instead.
+  EXPECT_EQ(PAGE_TYPE_ERROR,
+            new_controller.GetLastCommittedEntry()->GetPageType());
+  {
+    TestNavigationObserver clone_observer(new_tab.get());
+    new_controller.LoadIfNecessary();
+    clone_observer.Wait();
+  }
+  // The entry on the new controller should be a new one.
+  EXPECT_NE(initial_entry_id,
+            new_controller.GetLastCommittedEntry()->GetUniqueID());
+  // The new entry should keep the URL from the initial navigation, which means
+  // after the load it should navigate to the initial page, not to the error.
+  EXPECT_EQ(url, new_controller.GetLastCommittedEntry()->GetURL());
+  EXPECT_EQ(initial_title, new_controller.GetLastCommittedEntry()->GetTitle());
+  EXPECT_EQ(PAGE_TYPE_NORMAL,
+            new_controller.GetLastCommittedEntry()->GetPageType());
+
+  // Only one entry should exist in the controller of the cloned tab.
+  EXPECT_EQ(1, new_controller.GetEntryCount());
+}
+
 // Tests that the navigation entry is marked as skippable on back/forward button
 // if it does a renderer initiated navigation without ever getting a user
 // activation.
@@ -9735,20 +9894,14 @@ class SandboxedNavigationControllerBrowserTest
     // *main(simple2, sandbox#test(simple2))]
   }
 
-  static constexpr const char* kWithinSubtreeHistogram =
-      "Navigation.SandboxFrameBackForwardStaysWithinSubtree";
-
  private:
   base::test::ScopedFeatureList feature_list_;
 };
 
-// Tests navigations which occur from a sandboxed frame are tracked
-// accordingly in histograms.
+// Tests navigations which occur from a sandboxed frame are prevented.
 IN_PROC_BROWSER_TEST_F(SandboxedNavigationControllerBrowserTest,
                        TopLevelNavigationFromSandboxSource) {
-  base::HistogramTester histogram;
   SetupNavigation();
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
 
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
                             ->GetFrameTree()
@@ -9762,29 +9915,21 @@ IN_PROC_BROWSER_TEST_F(SandboxedNavigationControllerBrowserTest,
   // Navigate sandbox frame back same-document.
   EXPECT_TRUE(ExecJs(root->child_at(1), back_script));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, true, 1);
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, false, 0);
   EXPECT_EQ(3, controller.GetCurrentEntryIndex());
 
   // Navigate innermost frame back cross-document.
   EXPECT_TRUE(ExecJs(root->child_at(1), back_script));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, true, 2);
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, false, 0);
   EXPECT_EQ(2, controller.GetCurrentEntryIndex());
 
   // Navigate sibling frame back cross-document. It should fail.
   EXPECT_TRUE(ExecJs(root->child_at(1), back_script));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, true, 2);
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, false, 1);
   EXPECT_EQ(2, controller.GetCurrentEntryIndex());
 
   // Try it again and it should fail.
   EXPECT_TRUE(ExecJs(root->child_at(1), back_script));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, true, 2);
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, false, 2);
   EXPECT_EQ(2, controller.GetCurrentEntryIndex());
 
   // Do it browser initiated. Make sure histograms don't change.
@@ -9792,8 +9937,6 @@ IN_PROC_BROWSER_TEST_F(SandboxedNavigationControllerBrowserTest,
   controller.GoBack();
   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, true, 2);
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, false, 2);
 
   // Go forward to reset state, then a mouse back button navigation.
   // Using the mouse back button should be allowed because it is a
@@ -9816,67 +9959,6 @@ IN_PROC_BROWSER_TEST_F(SandboxedNavigationControllerBrowserTest,
   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 }
 
-// Tests navigations that occur inside a doubly nested sandbox
-// that affect the parent sandbox are considered outside of tree navigation.
-IN_PROC_BROWSER_TEST_F(SandboxedNavigationControllerBrowserTest,
-                       DoublyNestedSandboxConsideredOutsideOfTree) {
-  base::HistogramTester histogram;
-  SetupNavigation();
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
-
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
-
-  std::string back_script = "history.back();";
-
-  // Test that a navigation in the innermost frame affecting its parent
-  // in the same sandbox is considered outside the subtree.
-  EXPECT_TRUE(ExecJs(root->child_at(1)->child_at(0), back_script));
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, true, 0);
-  histogram.ExpectBucketCount(kWithinSubtreeHistogram, false, 1);
-}
-
-// Tests navigations that influence a sandboxed frame that originate
-// from outside the sandboxed frame are not tracked in histograms.
-IN_PROC_BROWSER_TEST_F(SandboxedNavigationControllerBrowserTest,
-                       TopLevelNavigationFromNonSandboxSource) {
-  base::HistogramTester histogram;
-  SetupNavigation();
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
-
-  NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
-      shell()->web_contents()->GetController());
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
-
-  std::string back_script = "history.back();";
-  std::string forward_script = "history.forward();";
-
-  // Browser initiated back. Make sure histograms don't change.
-  ASSERT_TRUE(controller.CanGoBack());
-  controller.GoBack();
-  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
-
-  // Browser initiated forward. Make sure histograms don't change.
-  ASSERT_TRUE(controller.CanGoForward());
-  controller.GoForward();
-  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
-
-  // Navigate sandbox frame back same-document originated from
-  // the main frame though.
-  EXPECT_TRUE(ExecJs(root, back_script));
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
-
-  // Navigate sandbox frame forward same-document originated from
-  // the main frame though.
-  EXPECT_TRUE(ExecJs(root, forward_script));
-  histogram.ExpectTotalCount(kWithinSubtreeHistogram, 0);
-}
-
 class SandboxedNavigationControllerPopupBrowserTest
     : public NavigationControllerBrowserTest {
  protected:
@@ -10060,61 +10142,69 @@ IN_PROC_BROWSER_TEST_F(
               ElementsAre(1, 1, 2, 1));
 }
 
+namespace {
+
+class DidCommitNavigationCanceller : public DidCommitNavigationInterceptor {
+  using CallbackScriptRunner = base::OnceCallback<void()>;
+
+ public:
+  DidCommitNavigationCanceller(WebContents* web_contents,
+                               CallbackScriptRunner callback)
+      : DidCommitNavigationInterceptor(web_contents) {
+    callback_ = std::move(callback);
+  }
+
+  bool WillProcessDidCommitNavigation(
+      RenderFrameHost* render_frame_host,
+      NavigationRequest* navigation_request,
+      ::FrameHostMsg_DidCommitProvisionalLoad_Params* params,
+      mojom::DidCommitProvisionalLoadInterfaceParamsPtr* interface_params)
+      override {
+    std::move(callback_).Run();
+    return false;
+  }
+
+ private:
+  CallbackScriptRunner callback_;
+};
+
+}  //  namespace
+
 // When running OpenURL to an invalid URL on a frame proxy it should not spoof
 // the url by canceling a main frame navigation.
 // See https://crbug.com/966914.
-// Failing on Linux CFI. http://crbug.com/974319
-#if defined(OS_LINUX) || defined(OS_MACOSX)
-#define MAYBE_CrossProcessIframeToInvalidURLCancelsRedirectSpoof \
-  DISABLED_CrossProcessIframeToInvalidURLCancelsRedirectSpoof
-#else
-#define MAYBE_CrossProcessIframeToInvalidURLCancelsRedirectSpoof \
-  CrossProcessIframeToInvalidURLCancelsRedirectSpoof
-#endif
-IN_PROC_BROWSER_TEST_F(
-    NavigationControllerBrowserTest,
-    MAYBE_CrossProcessIframeToInvalidURLCancelsRedirectSpoof) {
+IN_PROC_BROWSER_TEST_F(NavigationControllerBrowserTest,
+                       CrossProcessIframeToInvalidURLCancelsRedirectSpoof) {
+  // This tests something that can only happened with out of process iframes.
+  if (!AreAllSitesIsolatedForTesting())
+    return;
+
   const GURL main_frame_url(embedded_test_server()->GetURL(
-      "a.com",
-      "/cross_site_iframe_factory.html?a(b{sandbox-allow-scripts,sandbox-allow-"
-      "top-navigation}())"));
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
   const GURL main_frame_url_2(embedded_test_server()->GetURL("/title2.html"));
 
   // Load the initial page, containing a fully scriptable cross-site iframe.
   EXPECT_TRUE(NavigateToURL(shell(), main_frame_url));
 
-  // Setup the message trigger on the main frame and the handler on the iframe.
-  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
-                            ->GetFrameTree()
-                            ->root();
-  std::string script =
-      "var messageUnloadEventSent = false;"
-      "window.addEventListener('beforeunload', function "
-      "   onBeforeUnload(event) {"
-      "       if(messageUnloadEventSent) {"
-      "         return;"
-      "       }"
-      "       messageUnloadEventSent = true;"
-      "       var iframe = document.getElementById('child-0');"
-      "       iframe.contentWindow.postMessage('', '*');"
-      "   }"
-      ");";
-  EXPECT_TRUE(ExecJs(root, script));
+  FrameTreeNode* iframe = static_cast<WebContentsImpl*>(shell()->web_contents())
+                              ->GetFrameTree()
+                              ->root()
+                              ->child_at(0);
 
-  script =
-      "window.addEventListener('message', function (event) {"
-      "  parent.location.href = 'chrome-guest://1234';"
-      "});";
-  EXPECT_TRUE(ExecJs(root->child_at(0), script));
+  DidCommitNavigationCanceller canceller(
+      shell()->web_contents(), base::BindLambdaForTesting([iframe]() {
+        EXPECT_TRUE(
+            ExecJs(iframe, "parent.location.href = 'chrome-guest://1234';"));
+      }));
 
   // This navigation will be raced by a navigation started in the iframe.
-  // It should still be prevalent compared to a non user-initiated render frame
-  // navigation.
-  // TODO(ahemery): EXPECT_TRUE when https://crbug.com/973415 is fixed.
-  // The navigation started in the iframe sometimes has_user_gesture set to
-  // true. It should not be the case and is being investigated in the above bug.
-  // Here we simply care that no spoof happens, which is verified below anyway.
-  ignore_result(NavigateToURL(shell(), main_frame_url_2));
+  // The NavigationRequest for the first navigation will already be in the
+  // RenderFrameHost at this point, and the iframe proxy navigation will
+  // proceed because we don't have a FrameTreeNode ongoing navigation.
+  // So the main navigation will be cancelled first, by the iframe navigation
+  // taking precedence, and the iframe navigation will not get passed network
+  // because of the invalid url, getting cancelled as well.
+  EXPECT_FALSE(NavigateToURL(shell(), main_frame_url_2));
 
   // Check that no spoof happened.
   NavigationControllerImpl& controller = static_cast<NavigationControllerImpl&>(
diff --git a/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc b/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc
index 158184929b1..51b13de1583 100644
--- a/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc
+++ b/chromium/content/browser/frame_host/navigation_controller_impl_unittest.cc
@@ -25,7 +25,6 @@
 #include "content/browser/browser_url_handler_impl.h"
 #include "content/browser/frame_host/frame_navigation_entry.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_impl.h"
@@ -60,6 +59,11 @@ using base::Time;
 
 namespace {
 
+base::Time InMicrosecondsSinceEpoch(int64_t us) {
+  return base::Time::FromDeltaSinceWindowsEpoch(
+      base::TimeDelta::FromMicroseconds(us));
+}
+
 // Creates an image with a 1x1 SkBitmap of the specified |color|.
 gfx::Image CreateImage(SkColor color) {
   SkBitmap bitmap;
@@ -93,7 +97,7 @@ namespace content {
 TEST(TimeSmoother, Basic) {
   NavigationControllerImpl::TimeSmoother smoother;
   for (int64_t i = 1; i < 1000; ++i) {
-    base::Time t = base::Time::FromInternalValue(i);
+    base::Time t = InMicrosecondsSinceEpoch(i);
     EXPECT_EQ(t, smoother.GetSmoothedTime(t));
   }
 }
@@ -102,11 +106,11 @@ TEST(TimeSmoother, Basic) {
 // microsecond, the smoothed time should always be one behind.
 TEST(TimeSmoother, SingleDuplicate) {
   NavigationControllerImpl::TimeSmoother smoother;
-  base::Time t = base::Time::FromInternalValue(1);
+  base::Time t = InMicrosecondsSinceEpoch(1);
   EXPECT_EQ(t, smoother.GetSmoothedTime(t));
   for (int64_t i = 1; i < 1000; ++i) {
-    base::Time expected_t = base::Time::FromInternalValue(i + 1);
-    t = base::Time::FromInternalValue(i);
+    base::Time expected_t = InMicrosecondsSinceEpoch(i + 1);
+    t = InMicrosecondsSinceEpoch(i);
     EXPECT_EQ(expected_t, smoother.GetSmoothedTime(t));
   }
 }
@@ -116,15 +120,14 @@ TEST(TimeSmoother, SingleDuplicate) {
 TEST(TimeSmoother, ManyDuplicates) {
   const int64_t kNumDuplicates = 100;
   NavigationControllerImpl::TimeSmoother smoother;
-  base::Time t = base::Time::FromInternalValue(1);
+  base::Time t = InMicrosecondsSinceEpoch(1);
   for (int64_t i = 0; i < kNumDuplicates; ++i) {
-    base::Time expected_t = base::Time::FromInternalValue(i + 1);
+    base::Time expected_t = InMicrosecondsSinceEpoch(i + 1);
     EXPECT_EQ(expected_t, smoother.GetSmoothedTime(t));
   }
   for (int64_t i = 1; i < 1000; ++i) {
-    base::Time expected_t =
-        base::Time::FromInternalValue(i + kNumDuplicates);
-    t = base::Time::FromInternalValue(i);
+    base::Time expected_t = InMicrosecondsSinceEpoch(i + kNumDuplicates);
+    t = InMicrosecondsSinceEpoch(i);
     EXPECT_EQ(expected_t, smoother.GetSmoothedTime(t));
   }
 }
@@ -134,20 +137,19 @@ TEST(TimeSmoother, ManyDuplicates) {
 TEST(TimeSmoother, ClockBackwardsJump) {
   const int64_t kNumDuplicates = 100;
   NavigationControllerImpl::TimeSmoother smoother;
-  base::Time t = base::Time::FromInternalValue(1000);
+  base::Time t = InMicrosecondsSinceEpoch(1000);
   for (int64_t i = 0; i < kNumDuplicates; ++i) {
-    base::Time expected_t = base::Time::FromInternalValue(i + 1000);
+    base::Time expected_t = InMicrosecondsSinceEpoch(i + 1000);
     EXPECT_EQ(expected_t, smoother.GetSmoothedTime(t));
   }
-  t = base::Time::FromInternalValue(500);
+  t = InMicrosecondsSinceEpoch(500);
   EXPECT_EQ(t, smoother.GetSmoothedTime(t));
 }
 
 // NavigationControllerTest ----------------------------------------------------
 
-class NavigationControllerTest
-    : public RenderViewHostImplTestHarness,
-      public WebContentsObserver {
+class NavigationControllerTest : public RenderViewHostImplTestHarness,
+                                 public WebContentsObserver {
  public:
   NavigationControllerTest() {}
 
@@ -184,9 +186,7 @@ class NavigationControllerTest
     navigation_entries_deleted_counter_++;
   }
 
-  const GURL& navigated_url() const {
-    return navigated_url_;
-  }
+  const GURL& navigated_url() const { return navigated_url_; }
 
   NavigationControllerImpl& controller_impl() {
     return static_cast<NavigationControllerImpl&>(controller());
@@ -230,13 +230,9 @@ class TestWebContentsDelegate : public WebContentsDelegate {
   TestWebContentsDelegate()
       : navigation_state_change_count_(0), repost_form_warning_count_(0) {}
 
-  int navigation_state_change_count() {
-    return navigation_state_change_count_;
-  }
+  int navigation_state_change_count() { return navigation_state_change_count_; }
 
-  int repost_form_warning_count() {
-    return repost_form_warning_count_;
-  }
+  int repost_form_warning_count() { return repost_form_warning_count_; }
 
   // Keep track of whether the tab has notified us of a navigation state change.
   void NavigationStateChanged(WebContents* source,
@@ -281,8 +277,8 @@ class LoadCommittedDetailsObserver : public WebContentsObserver {
     if (!navigation_handle->HasCommitted())
       return;
 
-    navigation_type_ = static_cast<NavigationHandleImpl*>(navigation_handle)
-                           ->navigation_type();
+    navigation_type_ =
+        NavigationRequest::From(navigation_handle)->navigation_type();
     previous_url_ = navigation_handle->GetPreviousURL();
     reload_type_ = navigation_handle->GetReloadType();
     is_same_document_ = navigation_handle->IsSameDocument();
@@ -306,9 +302,7 @@ class LoadCommittedDetailsObserver : public WebContentsObserver {
 class NavigationControllerTestWithBrowserSideNavigation
     : public NavigationControllerTest {
  public:
-  void SetUp() override {
-    NavigationControllerTest::SetUp();
-  }
+  void SetUp() override { NavigationControllerTest::SetUp(); }
 };
 
 // -----------------------------------------------------------------------------
@@ -367,12 +361,7 @@ TEST_F(NavigationControllerTest, GoToOffset) {
   };
 
   const int test_offsets[NUM_TESTS] = {
-    GO_TO_MIDDLE_PAGE,
-    GO_FORWARDS,
-    GO_BACKWARDS,
-    GO_TO_BEGINNING,
-    GO_TO_END
-  };
+      GO_TO_MIDDLE_PAGE, GO_FORWARDS, GO_BACKWARDS, GO_TO_BEGINNING, GO_TO_END};
 
   for (int test = 0; test < NUM_TESTS; ++test) {
     int offset = test_offsets[test];
@@ -438,8 +427,8 @@ TEST_F(NavigationControllerTest, LoadURL) {
   const GURL url1("http://foo1");
   const GURL url2("http://foo2");
 
-  controller.LoadURL(
-      url1, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller.LoadURL(url1, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     std::string());
   int entry_id = controller.GetPendingEntry()->GetUniqueID();
   // Creating a pending notification should not have issued any of the
   // notifications we're listening for.
@@ -489,8 +478,8 @@ TEST_F(NavigationControllerTest, LoadURL) {
       blink::UserActivationUpdateType::kNotifyActivation);
 
   // Load another...
-  controller.LoadURL(
-      url2, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller.LoadURL(url2, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     std::string());
   entry_id = controller.GetPendingEntry()->GetUniqueID();
 
   // The load should now be pending.
@@ -537,7 +526,7 @@ TEST_F(NavigationControllerTest, LoadURLSameTime) {
 
   // Set the clock to always return a timestamp of 1.
   controller.SetGetTimestampCallbackForTest(
-      base::Bind(&GetFixedTime, base::Time::FromInternalValue(1)));
+      base::BindRepeating(&GetFixedTime, InMicrosecondsSinceEpoch(1)));
 
   const GURL url1("http://foo1");
   const GURL url2("http://foo2");
@@ -586,7 +575,7 @@ void CheckNavigationEntryMatchLoadParams(
   if (NavigationController::UA_OVERRIDE_INHERIT !=
       load_params.override_user_agent) {
     bool should_override = (NavigationController::UA_OVERRIDE_TRUE ==
-        load_params.override_user_agent);
+                            load_params.override_user_agent);
     EXPECT_EQ(should_override, entry->GetIsOverridingUserAgent());
   }
   EXPECT_EQ(load_params.post_data, entry->GetPostData());
@@ -736,8 +725,8 @@ TEST_F(NavigationControllerTest, LoadURL_SamePage) {
   EXPECT_FALSE(timestamp.is_null());
 
   const std::string new_extra_headers("Foo: Bar\nBar: Baz");
-  controller.LoadURL(
-      url1, Referrer(), ui::PAGE_TRANSITION_TYPED, new_extra_headers);
+  controller.LoadURL(url1, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     new_extra_headers);
   auto navigation2 = NavigationSimulator::CreateFromPending(contents());
   EXPECT_EQ(0U, navigation_entry_changed_counter_);
   EXPECT_EQ(0U, navigation_list_pruned_counter_);
@@ -819,8 +808,8 @@ TEST_F(NavigationControllerTest, LoadURL_Discarded) {
   const base::Time timestamp = controller.GetVisibleEntry()->GetTimestamp();
   EXPECT_FALSE(timestamp.is_null());
 
-  controller.LoadURL(
-      url2, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller.LoadURL(url2, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     std::string());
   controller.DiscardNonCommittedEntries();
   EXPECT_EQ(0U, navigation_entry_changed_counter_);
   EXPECT_EQ(0U, navigation_list_pruned_counter_);
@@ -1072,7 +1061,7 @@ TEST_F(NavigationControllerTest, LoadURL_IgnorePreemptsPending) {
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_TRUE(controller.GetPendingEntry());
   EXPECT_EQ(-1, controller.GetLastCommittedEntryIndex());
-  EXPECT_EQ(2, delegate->navigation_state_change_count());
+  EXPECT_EQ(1, delegate->navigation_state_change_count());
 
   // Certain rare cases can make a direct DidCommitProvisionalLoad call without
   // going to the browser. Renderer reload of an about:blank is such a case.
@@ -1083,7 +1072,7 @@ TEST_F(NavigationControllerTest, LoadURL_IgnorePreemptsPending) {
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_FALSE(controller.GetPendingEntry());
   EXPECT_EQ(-1, controller.GetLastCommittedEntryIndex());
-  EXPECT_EQ(3, delegate->navigation_state_change_count());
+  EXPECT_EQ(2, delegate->navigation_state_change_count());
 
   contents()->SetDelegate(nullptr);
 }
@@ -1102,15 +1091,15 @@ TEST_F(NavigationControllerTest, LoadURL_AbortDoesntCancelPending) {
 
   // Start with a pending new navigation.
   const GURL kNewURL("http://eh");
-  controller.LoadURL(
-      kNewURL, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller.LoadURL(kNewURL, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     std::string());
   main_test_rfh()->PrepareForCommit();
   EXPECT_EQ(0U, navigation_entry_changed_counter_);
   EXPECT_EQ(0U, navigation_list_pruned_counter_);
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_TRUE(controller.GetPendingEntry());
   EXPECT_EQ(-1, controller.GetLastCommittedEntryIndex());
-  EXPECT_EQ(2, delegate->navigation_state_change_count());
+  EXPECT_EQ(1, delegate->navigation_state_change_count());
 
   // It may abort before committing, if it's a download or due to a stop or
   // a new navigation from the user.
@@ -1122,7 +1111,7 @@ TEST_F(NavigationControllerTest, LoadURL_AbortDoesntCancelPending) {
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_TRUE(controller.GetPendingEntry());
   EXPECT_EQ(-1, controller.GetLastCommittedEntryIndex());
-  EXPECT_EQ(2, delegate->navigation_state_change_count());
+  EXPECT_EQ(1, delegate->navigation_state_change_count());
   NavigationEntry* pending_entry = controller.GetPendingEntry();
 
   // Ensure that a reload keeps the same pending entry.
@@ -1163,9 +1152,9 @@ TEST_F(NavigationControllerTest, LoadURL_RedirectAbortDoesntShowPendingURL) {
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_TRUE(controller.GetPendingEntry());
   EXPECT_EQ(0, controller.GetLastCommittedEntryIndex());
-  // The delegate should have been notified at least twice: once for the loading
-  // state change, and once for the url change.
-  EXPECT_EQ(3, delegate->navigation_state_change_count());
+  // The delegate should have been notified twice: once for the loading state
+  // change, and once for the url change.
+  EXPECT_EQ(2, delegate->navigation_state_change_count());
 
   // The visible entry should be the last committed URL, not the pending one.
   EXPECT_EQ(kExistingURL, controller.GetVisibleEntry()->GetURL());
@@ -1189,7 +1178,7 @@ TEST_F(NavigationControllerTest, LoadURL_RedirectAbortDoesntShowPendingURL) {
   EXPECT_EQ(0, controller.GetLastCommittedEntryIndex());
   // The delegate should have been notified twice: once for the loading state
   // change, and once for the url change.
-  EXPECT_EQ(5, delegate->navigation_state_change_count());
+  EXPECT_EQ(4, delegate->navigation_state_change_count());
 
   // The visible entry should be the last committed URL, not the pending one,
   // so that no spoof is possible.
@@ -1336,7 +1325,8 @@ TEST_F(NavigationControllerTest, ReloadWithGuest) {
   // Make the entry believe its RenderProcessHost is a guest.
   NavigationEntryImpl* entry1 = controller.GetVisibleEntry();
   reinterpret_cast<MockRenderProcessHost*>(
-      entry1->site_instance()->GetProcess())->set_is_for_guests_only(true);
+      entry1->site_instance()->GetProcess())
+      ->set_is_for_guests_only(true);
 
   // And reload.
   controller.Reload(ReloadType::NORMAL, true);
@@ -1370,8 +1360,8 @@ TEST_F(NavigationControllerTest, ReloadOriginalRequestURL) {
 
   // The NavigationEntry should save both the original URL and the final
   // redirected URL.
-  EXPECT_EQ(
-      original_url, controller.GetVisibleEntry()->GetOriginalRequestURL());
+  EXPECT_EQ(original_url,
+            controller.GetVisibleEntry()->GetOriginalRequestURL());
   EXPECT_EQ(final_url, controller.GetVisibleEntry()->GetURL());
 
   // Reload using the original URL.
@@ -1452,13 +1442,6 @@ TEST_F(NavigationControllerTest, ResetEntryValuesAfterCommit) {
   EXPECT_FALSE(committed_entry->should_clear_history_list());
 }
 
-namespace {
-void SetRedirects(const std::vector<GURL>& redirects,
-                  FrameHostMsg_DidCommitProvisionalLoad_Params* params) {
-  params->redirects = redirects;
-}
-}
-
 // Test that Redirects are preserved after a commit.
 TEST_F(NavigationControllerTest, RedirectsAreNotResetByCommit) {
   NavigationControllerImpl& controller = controller_impl();
@@ -1471,7 +1454,6 @@ TEST_F(NavigationControllerTest, RedirectsAreNotResetByCommit) {
   // Set up some redirect values.
   std::vector<GURL> redirects;
   redirects.push_back(url2);
-  auto set_redirects_callback = base::Bind(SetRedirects, redirects);
 
   // Set redirects on the pending entry.
   NavigationEntryImpl* pending_entry = controller.GetPendingEntry();
@@ -1658,8 +1640,8 @@ TEST_F(NavigationControllerTest, Back_NewPending) {
   navigation_entry_committed_counter_ = 0;
 
   // Now start a new pending navigation and go back before it commits.
-  controller.LoadURL(
-      kUrl3, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller.LoadURL(kUrl3, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     std::string());
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_EQ(kUrl3, controller.GetPendingEntry()->GetURL());
   controller.GoBack();
@@ -2408,7 +2390,6 @@ TEST_F(NavigationControllerTest, EnforceMaxNavigationCount) {
 
   EXPECT_EQ(controller.GetEntryCount(), kMaxEntryCount);
 
-
   // Navigate some more.
   GURL url(base::StringPrintf("http://www.a.com/%d", url_index));
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(), url);
@@ -2450,7 +2431,6 @@ TEST_F(NavigationControllerTest, RestoreNavigate) {
           std::string(), browser_context(),
           nullptr /* blob_url_loader_factory */);
   entry->SetTitle(base::ASCIIToUTF16("Title"));
-  entry->SetPageState(PageState::CreateFromEncodedData("state"));
   const base::Time timestamp = base::Time::Now();
   entry->SetTimestamp(timestamp);
   entries.push_back(std::move(entry));
@@ -2519,7 +2499,6 @@ TEST_F(NavigationControllerTest, RestoreNavigateAfterFailure) {
           std::string(), browser_context(),
           nullptr /* blob_url_loader_factory */);
   new_entry->SetTitle(base::ASCIIToUTF16("Title"));
-  new_entry->SetPageState(PageState::CreateFromEncodedData("state"));
   entries.push_back(std::move(new_entry));
   std::unique_ptr<WebContents> our_contents =
       WebContents::Create(WebContents::CreateParams(browser_context()));
@@ -3544,11 +3523,35 @@ TEST_F(NavigationControllerTest, SubframeWhilePending) {
   TestRenderFrameHost* subframe = static_cast<TestRenderFrameHost*>(
       contents()->GetFrameTree()->root()->child_at(0)->current_frame_host());
   const GURL url1_sub("http://foo/subframe");
-  NavigationSimulator::NavigateAndCommitFromDocument(url1_sub, subframe);
+
+  auto subframe_navigation =
+      NavigationSimulator::CreateRendererInitiated(url1_sub, subframe);
+  subframe_navigation->Start();
+
+  // Creating the subframe navigation should have no effect on the pending
+  // navigation entry and on the visible URL.
+  EXPECT_EQ(url1, controller.GetLastCommittedEntry()->GetURL());
+  EXPECT_EQ(url2, controller.GetVisibleEntry()->GetURL());
+
+  auto nav_entry_id = [](NavigationSimulator* simulator) {
+    return NavigationRequest::From(simulator->GetNavigationHandle())
+        ->nav_entry_id();
+  };
+
+  // The main frame navigation is still associated with the pending entry, the
+  // subframe one isn't.
+  EXPECT_EQ(controller.GetPendingEntry()->GetUniqueID(),
+            nav_entry_id(main_frame_navigation.get()));
+  EXPECT_EQ(0, nav_entry_id(subframe_navigation.get()));
+
+  subframe_navigation->Commit();
 
   // The subframe navigation should have no effect on the displayed url.
   EXPECT_EQ(url1, controller.GetLastCommittedEntry()->GetURL());
   EXPECT_EQ(url2, controller.GetVisibleEntry()->GetURL());
+
+  EXPECT_EQ(controller.GetPendingEntry()->GetUniqueID(),
+            nav_entry_id(main_frame_navigation.get()));
 }
 
 // Test CopyStateFrom with 2 urls, the first selected and nothing in the target.
@@ -3742,8 +3745,8 @@ TEST_F(NavigationControllerTest, CopyStateFromAndPruneTargetPending) {
       static_cast<TestWebContents*>(CreateTestWebContents().release()));
   NavigationControllerImpl& other_controller = other_contents->GetController();
   other_contents->NavigateAndCommit(url3);
-  other_controller.LoadURL(
-      url4, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  other_controller.LoadURL(url4, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                           std::string());
   other_contents->ExpectSetHistoryOffsetAndLength(1, 2);
   other_controller.CopyStateFromAndPrune(&controller, false);
 
@@ -3777,8 +3780,8 @@ TEST_F(NavigationControllerTest, CopyStateFromAndPruneTargetPending2) {
   NavigationControllerImpl& other_controller = other_contents->GetController();
   other_contents->NavigateAndCommit(url2a);
   // Simulate a client redirect, which has the same page ID as entry 2a.
-  other_controller.LoadURL(
-      url2b, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
+  other_controller.LoadURL(url2b, Referrer(), ui::PAGE_TRANSITION_LINK,
+                           std::string());
 
   other_contents->ExpectSetHistoryOffsetAndLength(1, 2);
   other_controller.CopyStateFromAndPrune(&controller, false);
@@ -3797,8 +3800,8 @@ TEST_F(NavigationControllerTest, CopyStateFromAndPruneTargetPending2) {
   EXPECT_EQ(url2b, other_controller.GetPendingEntry()->GetURL());
 
   // Let the pending entry commit.
-  other_contents->TestDidNavigate(other_contents->GetMainFrame(),
-                                  0, false, url2b, ui::PAGE_TRANSITION_LINK);
+  other_contents->TestDidNavigate(other_contents->GetMainFrame(), 0, false,
+                                  url2b, ui::PAGE_TRANSITION_LINK);
 }
 
 // Test CopyStateFromAndPrune with 2 urls, a back navigation pending in the
@@ -3895,7 +3898,6 @@ TEST_F(NavigationControllerTest, CopyStateFromAndPruneMaxEntries) {
   const GURL url3("http://foo/3");
   const GURL url4("http://foo/4");
 
-
   NavigateAndCommit(url1);
   NavigateAndCommit(url2);
   NavigateAndCommit(url3);
@@ -3979,7 +3981,6 @@ TEST_F(NavigationControllerTest, CopyStateFromAndPruneMaxEntriesReplaceEntry) {
   const GURL url3("http://foo/3");
   const GURL url4("http://foo/4");
 
-
   NavigateAndCommit(url1);
   NavigateAndCommit(url2);
   NavigateAndCommit(url3);
@@ -4011,8 +4012,8 @@ TEST_F(NavigationControllerTest, CopyStateFromAndPruneMaxEntriesReplaceEntry) {
 // imported by CopyStateFromAndPrune.
 TEST_F(NavigationControllerTest, CopyRestoredStateAndNavigate) {
   const GURL kRestoredUrls[] = {
-    GURL("http://site1.com"),
-    GURL("http://site2.com"),
+      GURL("http://site1.com"),
+      GURL("http://site2.com"),
   };
   const GURL kInitialUrl("http://site3.com");
 
@@ -4077,7 +4078,7 @@ TEST_F(NavigationControllerTest, HistoryNavigate) {
   process()->sink().ClearMessages();
 
   // Simulate the page calling history.back(). It should create a pending entry.
-  contents()->OnGoToEntryAtOffset(main_test_rfh(), -1, false, true);
+  contents()->OnGoToEntryAtOffset(main_test_rfh(), -1, false);
   EXPECT_EQ(0, controller.GetPendingEntryIndex());
 
   // Also make sure we told the page to navigate.
@@ -4087,7 +4088,7 @@ TEST_F(NavigationControllerTest, HistoryNavigate) {
   process()->sink().ClearMessages();
 
   // Now test history.forward()
-  contents()->OnGoToEntryAtOffset(main_test_rfh(), 2, false, true);
+  contents()->OnGoToEntryAtOffset(main_test_rfh(), 2, false);
   EXPECT_EQ(2, controller.GetPendingEntryIndex());
 
   nav_url = GetLastNavigationURL();
@@ -4098,8 +4099,8 @@ TEST_F(NavigationControllerTest, HistoryNavigate) {
   controller.DiscardNonCommittedEntries();
 
   // Make sure an extravagant history.go() doesn't break.
-  contents()->OnGoToEntryAtOffset(main_test_rfh(), 120, false,
-                                  true);  // Out of bounds.
+  contents()->OnGoToEntryAtOffset(main_test_rfh(), 120,
+                                  false);  // Out of bounds.
   EXPECT_EQ(-1, controller.GetPendingEntryIndex());
   EXPECT_FALSE(HasNavigationRequest());
 }
@@ -4240,8 +4241,8 @@ TEST_F(NavigationControllerTest, IsInitialNavigation) {
 
   // After starting a new navigation, it stays false.
   const GURL url2("http://foo2");
-  controller.LoadURL(
-      url2, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller.LoadURL(url2, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                     std::string());
   EXPECT_FALSE(controller.IsInitialNavigation());
   EXPECT_FALSE(controller.IsInitialBlankNavigation());
 
@@ -4341,8 +4342,7 @@ TEST_F(NavigationControllerTest, PushStateUpdatesTitleAndFavicon) {
   FaviconStatus favicon;
   favicon.valid = true;
   favicon.url = GURL("http://foo/favicon.ico");
-  contents()->UpdateTitleForEntry(
-      controller().GetLastCommittedEntry(), title);
+  contents()->UpdateTitleForEntry(controller().GetLastCommittedEntry(), title);
   controller().GetLastCommittedEntry()->GetFavicon() = favicon;
 
   // history.pushState() is called.
@@ -4495,8 +4495,8 @@ TEST_F(NavigationControllerTest, UnreachableURLGivesErrorPage) {
   // Navigate to same page.
   // Note: The call to LoadURL() creates a pending entry in order to trigger the
   // same-page transition.
-  controller_impl().LoadURL(
-      url, Referrer(), ui::PAGE_TRANSITION_TYPED, std::string());
+  controller_impl().LoadURL(url, Referrer(), ui::PAGE_TRANSITION_TYPED,
+                            std::string());
   params.nav_entry_id = controller_impl().GetPendingEntry()->GetUniqueID();
   params.transition = ui::PAGE_TRANSITION_TYPED;
   {
@@ -4841,4 +4841,106 @@ TEST_F(NavigationControllerTest, NoURLRewriteForSubframes) {
   BrowserURLHandlerImpl::GetInstance()->SetFixupHandlerForTesting(nullptr);
 }
 
+// Tests that calling RemoveForwareEntries() clears all forward entries
+// including non-committed entries.
+TEST_F(NavigationControllerTest, PruneForwardEntries) {
+  NavigationControllerImpl& controller = controller_impl();
+  const GURL url_0("http://foo/0");
+  const GURL url_1("http://foo/1");
+  const GURL url_2("http://foo/2");
+  const GURL url_3("http://foo/3");
+  const GURL url_transient("http://foo/transient");
+
+  NavigateAndCommit(url_0);
+  NavigateAndCommit(url_1);
+  NavigateAndCommit(url_2);
+  NavigateAndCommit(url_3);
+
+  // Set a WebContentsDelegate to listen for state changes.
+  std::unique_ptr<TestWebContentsDelegate> delegate(
+      new TestWebContentsDelegate());
+  EXPECT_FALSE(contents()->GetDelegate());
+  contents()->SetDelegate(delegate.get());
+
+  controller.GoBack();
+
+  // Ensure that non-committed entries are removed even if there are no forward
+  // entries.
+  EXPECT_EQ(4, controller.GetEntryCount());
+  EXPECT_EQ(2, controller.GetPendingEntryIndex());
+  EXPECT_EQ(2, controller.GetCurrentEntryIndex());
+  EXPECT_EQ(3, controller.GetLastCommittedEntryIndex());
+  int state_change_count = delegate->navigation_state_change_count();
+  controller.PruneForwardEntries();
+  EXPECT_EQ(4, controller.GetEntryCount());
+  EXPECT_EQ(-1, controller.GetPendingEntryIndex());
+  EXPECT_EQ(3, controller.GetCurrentEntryIndex());
+  EXPECT_EQ(3, controller.GetLastCommittedEntryIndex());
+  EXPECT_EQ(0U, navigation_list_pruned_counter_);
+  EXPECT_EQ(state_change_count + 1, delegate->navigation_state_change_count());
+
+  controller.GoBack();
+  contents()->CommitPendingNavigation();
+  controller.GoBack();
+  contents()->CommitPendingNavigation();
+  controller.GoBack();
+  contents()->CommitPendingNavigation();
+  controller.GoForward();
+
+  EXPECT_EQ(1, controller.GetPendingEntryIndex());
+  EXPECT_EQ(0, controller.GetLastCommittedEntryIndex());
+  // Insert a transient entry before the pending one.
+  std::unique_ptr<NavigationEntry> transient_entry(new NavigationEntryImpl);
+  transient_entry->SetURL(url_transient);
+  controller.SetTransientEntry(std::move(transient_entry));
+
+  state_change_count = delegate->navigation_state_change_count();
+  controller.PruneForwardEntries();
+
+  EXPECT_EQ(1, controller.GetEntryCount());
+  EXPECT_FALSE(controller.CanGoForward());
+  EXPECT_FALSE(controller.CanGoBack());
+  EXPECT_EQ(0, controller.GetLastCommittedEntryIndex());
+  EXPECT_EQ(0, controller.GetCurrentEntryIndex());
+  EXPECT_EQ(-1, controller.GetPendingEntryIndex());
+  EXPECT_EQ(nullptr, controller.GetPendingEntry());
+  EXPECT_EQ(nullptr, controller.GetTransientEntry());
+  EXPECT_EQ(url_0, controller.GetVisibleEntry()->GetURL());
+  EXPECT_EQ(1U, navigation_list_pruned_counter_);
+  EXPECT_EQ(1, last_navigation_entry_pruned_details_.index);
+  EXPECT_EQ(3, last_navigation_entry_pruned_details_.count);
+  EXPECT_EQ(state_change_count + 1, delegate->navigation_state_change_count());
+}
+
+// Make sure that cloning a WebContentsImpl and clearing forward entries
+// before the first commit doesn't clear all entries.
+TEST_F(NavigationControllerTest, PruneForwardEntriesAfterClone) {
+  NavigationControllerImpl& controller = controller_impl();
+  const GURL url1("http://foo1");
+  const GURL url2("http://foo2");
+
+  NavigateAndCommit(url1);
+  NavigateAndCommit(url2);
+
+  std::unique_ptr<WebContents> clone(controller.GetWebContents()->Clone());
+  clone->GetController().LoadIfNecessary();
+
+  // Set a WebContentsDelegate to listen for state changes after the clone call
+  // to only count state changes from the PruneForwardEntries call.
+  std::unique_ptr<TestWebContentsDelegate> delegate(
+      new TestWebContentsDelegate());
+  EXPECT_FALSE(clone->GetDelegate());
+  clone->SetDelegate(delegate.get());
+
+  EXPECT_EQ(1, clone->GetController().GetPendingEntryIndex());
+
+  clone->GetController().PruneForwardEntries();
+
+  ASSERT_EQ(2, clone->GetController().GetEntryCount());
+  EXPECT_EQ(-1, clone->GetController().GetPendingEntryIndex());
+  EXPECT_EQ(url2, clone->GetController().GetVisibleEntry()->GetURL());
+  EXPECT_EQ(0U, navigation_list_pruned_counter_);
+  EXPECT_EQ(1, delegate->navigation_state_change_count());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_entry_impl.cc b/chromium/content/browser/frame_host/navigation_entry_impl.cc
index 7575f08aa1e..e7d7414e542 100644
--- a/chromium/content/browser/frame_host/navigation_entry_impl.cc
+++ b/chromium/content/browser/frame_host/navigation_entry_impl.cc
@@ -20,6 +20,7 @@
 #include "build/build_config.h"
 #include "components/url_formatter/url_formatter.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
+#include "content/browser/web_package/bundled_exchanges_navigation_info.h"
 #include "content/common/content_constants_internal.h"
 #include "content/common/navigation_params.h"
 #include "content/common/page_state_serialization.h"
@@ -65,10 +66,6 @@ void RecursivelyGenerateFrameEntries(
   EncodePageState(page_state, &data);
   DCHECK(!data.empty()) << "Shouldn't generate an empty PageState.";
 
-  // TODO(lukasza): https://crbug.com/976055: |initiator_origin| should be
-  // persisted across session restore.
-  base::Optional<url::Origin> initiator_origin = base::nullopt;
-
   node->frame_entry = base::MakeRefCounted<FrameNavigationEntry>(
       UTF16ToUTF8(state.target.value_or(base::string16())),
       state.item_sequence_number, state.document_sequence_number, nullptr,
@@ -78,7 +75,7 @@ void RecursivelyGenerateFrameEntries(
       nullptr /* origin */,
       Referrer(GURL(state.referrer.value_or(base::string16())),
                state.referrer_policy),
-      initiator_origin, std::vector<GURL>(),
+      state.initiator_origin, std::vector<GURL>(),
       PageState::CreateFromEncodedData(data), "GET", -1,
       nullptr /* blob_url_loader_factory */);
 
@@ -95,6 +92,12 @@ void RecursivelyGenerateFrameEntries(
   }
 }
 
+base::Optional<base::string16> UrlToOptionalString16(const GURL& url) {
+  if (!url.is_valid())
+    return base::nullopt;
+  return base::UTF8ToUTF16(url.spec());
+}
+
 void RecursivelyGenerateFrameState(
     NavigationEntryImpl::TreeNode* node,
     ExplodedFrameState* state,
@@ -112,6 +115,34 @@ void RecursivelyGenerateFrameState(
   // Copy the FrameNavigationEntry's frame state into the destination state.
   *state = frame_state;
 
+  // Some data is stored *both* in 1) PageState/ExplodedFrameState and 2)
+  // FrameNavigationEntry.  We want to treat FrameNavigationEntry as the
+  // authoritative source of the data, so we clobber the ExplodedFrameState with
+  // the data taken from FrameNavigationEntry.
+  //
+  // The following ExplodedFrameState fields do not have an equivalent
+  // FrameNavigationEntry field:
+  // - target
+  // - state_object
+  // - document_state
+  // - scroll_restoration_type
+  // - did_save_scroll_or_scale_state
+  // - visual_viewport_scroll_offset
+  // - scroll_offset
+  // - page_scale_factor
+  // - http_body (FrameNavigationEntry::GetPostData extracts the body from
+  //   the ExplodedFrameState)
+  // - scroll_anchor_selector
+  // - scroll_anchor_offset
+  // - scroll_anchor_simhash
+  state->url_string = UrlToOptionalString16(node->frame_entry->url());
+  state->referrer = UrlToOptionalString16(node->frame_entry->referrer().url);
+  state->referrer_policy = node->frame_entry->referrer().policy;
+  state->item_sequence_number = node->frame_entry->item_sequence_number();
+  state->document_sequence_number =
+      node->frame_entry->document_sequence_number();
+  state->initiator_origin = node->frame_entry->initiator_origin();
+
   // Copy the frame's files into the PageState's |referenced_files|.
   referenced_files->reserve(referenced_files->size() +
                             exploded_page_state.referenced_files.size());
@@ -155,8 +186,7 @@ NavigationEntryImpl::TreeNode::TreeNode(
     scoped_refptr<FrameNavigationEntry> frame_entry)
     : parent(parent), frame_entry(std::move(frame_entry)) {}
 
-NavigationEntryImpl::TreeNode::~TreeNode() {
-}
+NavigationEntryImpl::TreeNode::~TreeNode() {}
 
 bool NavigationEntryImpl::TreeNode::MatchesFrame(
     FrameTreeNode* frame_tree_node) const {
@@ -302,8 +332,7 @@ NavigationEntryImpl::NavigationEntryImpl(
       ssl_error_(false),
       should_skip_on_back_forward_ui_(false) {}
 
-NavigationEntryImpl::~NavigationEntryImpl() {
-}
+NavigationEntryImpl::~NavigationEntryImpl() {}
 
 int NavigationEntryImpl::GetUniqueID() {
   return unique_id_;
@@ -374,6 +403,8 @@ const base::string16& NavigationEntryImpl::GetTitle() {
 }
 
 void NavigationEntryImpl::SetPageState(const PageState& state) {
+  DCHECK(state.IsValid());
+
   // SetPageState should only be called before the NavigationEntry has been
   // loaded, such as for restore (when there are no subframe
   // FrameNavigationEntries yet).  However, some callers expect to call this
@@ -386,12 +417,10 @@ void NavigationEntryImpl::SetPageState(const PageState& state) {
   if (!frame_tree_->children.empty())
     frame_tree_->children.clear();
 
-  // If the PageState can't be parsed or has no children, just store it on the
-  // main frame's FrameNavigationEntry without recursively creating subframe
-  // entries.
+  // If the PageState can't be parsed, just store it on the main frame's
+  // FrameNavigationEntry without recursively creating subframe entries.
   ExplodedPageState exploded_state;
-  if (!DecodePageState(state.ToEncodedData(), &exploded_state) ||
-      exploded_state.top.children.size() == 0U) {
+  if (!DecodePageState(state.ToEncodedData(), &exploded_state)) {
     frame_tree_->frame_entry->SetPageState(state);
     return;
   }
@@ -401,14 +430,8 @@ void NavigationEntryImpl::SetPageState(const PageState& state) {
 }
 
 PageState NavigationEntryImpl::GetPageState() {
-  // Just return the main frame's state if there are no subframe
-  // FrameNavigationEntries.
-  if (frame_tree_->children.size() == 0U)
-    return frame_tree_->frame_entry->page_state();
-
-  // When we're using subframe entries, each FrameNavigationEntry has a
-  // frame-specific PageState.  We combine these into an ExplodedPageState tree
-  // and generate a full PageState from it.
+  // Each FrameNavigationEntry has a frame-specific PageState.  We combine these
+  // into an ExplodedPageState tree and generate a full PageState from it.
   ExplodedPageState exploded_state;
   RecursivelyGenerateFrameState(frame_tree_.get(), &exploded_state.top,
                                 &exploded_state.referenced_files);
@@ -662,6 +685,10 @@ std::unique_ptr<NavigationEntryImpl> NavigationEntryImpl::CloneAndReplace(
   copy->CloneDataFrom(*this);
   copy->replaced_entry_data_ = replaced_entry_data_;
   copy->should_skip_on_back_forward_ui_ = should_skip_on_back_forward_ui_;
+  if (bundled_exchanges_navigation_info_) {
+    copy->bundled_exchanges_navigation_info_ =
+        bundled_exchanges_navigation_info_->Clone();
+  }
 
   return copy;
 }
@@ -737,7 +764,8 @@ NavigationEntryImpl::ConstructCommitNavigationParams(
 #if defined(OS_ANDROID)
           std::string(),
 #endif
-          false, network::mojom::IPAddressSpace::kUnknown);
+          false, network::mojom::IPAddressSpace::kUnknown,
+          GURL() /* base_url_override_for_bundled_exchanges */);
 #if defined(OS_ANDROID)
   if (NavigationControllerImpl::ValidateDataURLAsString(GetDataURLAsString())) {
     commit_params->data_url_as_string = GetDataURLAsString()->data();
@@ -926,4 +954,16 @@ GURL NavigationEntryImpl::GetHistoryURLForDataURL() {
   return GetBaseURLForDataURL().is_empty() ? GURL() : GetVirtualURL();
 }
 
+void NavigationEntryImpl::set_bundled_exchanges_navigation_info(
+    std::unique_ptr<BundledExchangesNavigationInfo>
+        bundled_exchanges_navigation_info) {
+  bundled_exchanges_navigation_info_ =
+      std::move(bundled_exchanges_navigation_info);
+}
+
+BundledExchangesNavigationInfo*
+NavigationEntryImpl::bundled_exchanges_navigation_info() const {
+  return bundled_exchanges_navigation_info_.get();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_entry_impl.h b/chromium/content/browser/frame_host/navigation_entry_impl.h
index 2bb6422dad2..97097c29d6d 100644
--- a/chromium/content/browser/frame_host/navigation_entry_impl.h
+++ b/chromium/content/browser/frame_host/navigation_entry_impl.h
@@ -35,6 +35,8 @@
 
 namespace content {
 
+class BundledExchangesNavigationInfo;
+
 class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
  public:
   // Represents a tree of FrameNavigationEntries that make up this joint session
@@ -205,9 +207,7 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   // In default Chrome, this tree only has a root node with an unshared
   // FrameNavigationEntry.  Subframes are only added to the tree if the
   // --site-per-process flag is passed.
-  TreeNode* root_node() const {
-    return frame_tree_.get();
-  }
+  TreeNode* root_node() const { return frame_tree_.get(); }
 
   // Finds the TreeNode associated with |frame_tree_node|, if any.
   NavigationEntryImpl::TreeNode* GetTreeNode(
@@ -264,9 +264,7 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   void RemoveEntryForFrame(FrameTreeNode* frame_tree_node,
                            bool only_if_different_position);
 
-  void set_unique_id(int unique_id) {
-    unique_id_ = unique_id;
-  }
+  void set_unique_id(int unique_id) { unique_id_ = unique_id; }
 
   void set_started_from_context_menu(bool started_from_context_menu) {
     started_from_context_menu_ = started_from_context_menu;
@@ -300,17 +298,11 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   // of commit, to ensure that we do not grant it additional bindings if we
   // navigate back to it in the future.  This can only be changed once.
   void SetBindings(int bindings);
-  int bindings() const {
-    return bindings_;
-  }
+  int bindings() const { return bindings_; }
 
-  void set_page_type(PageType page_type) {
-    page_type_ = page_type;
-  }
+  void set_page_type(PageType page_type) { page_type_ = page_type; }
 
-  bool has_virtual_url() const {
-    return !virtual_url_.is_empty();
-  }
+  bool has_virtual_url() const { return !virtual_url_.is_empty(); }
 
   bool update_virtual_url_with_url() const {
     return update_virtual_url_with_url_;
@@ -323,18 +315,14 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   void set_extra_headers(const std::string& extra_headers) {
     extra_headers_ = extra_headers;
   }
-  const std::string& extra_headers() const {
-    return extra_headers_;
-  }
+  const std::string& extra_headers() const { return extra_headers_; }
 
   // Whether this (pending) navigation is renderer-initiated.  Resets to false
   // for all types of navigations after commit.
   void set_is_renderer_initiated(bool is_renderer_initiated) {
     is_renderer_initiated_ = is_renderer_initiated;
   }
-  bool is_renderer_initiated() const {
-    return is_renderer_initiated_;
-  }
+  bool is_renderer_initiated() const { return is_renderer_initiated_; }
 
   void set_user_typed_url(const GURL& user_typed_url) {
     user_typed_url_ = user_typed_url;
@@ -342,12 +330,8 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
 
   // The RestoreType for this entry. This is set if the entry was retored. This
   // is set to RestoreType::NONE once the entry is loaded.
-  void set_restore_type(RestoreType type) {
-    restore_type_ = type;
-  }
-  RestoreType restore_type() const {
-    return restore_type_;
-  }
+  void set_restore_type(RestoreType type) { restore_type_ = type; }
+  RestoreType restore_type() const { return restore_type_; }
 
   // The ReloadType for this entry.  This is set when a reload is requested.
   // This is set to ReloadType::NONE if the entry isn't for a reload, or once
@@ -357,9 +341,7 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
 
   // Whether this (pending) navigation needs to replace current entry.
   // Resets to false after commit.
-  bool should_replace_entry() const {
-    return should_replace_entry_;
-  }
+  bool should_replace_entry() const { return should_replace_entry_; }
 
   void set_should_replace_entry(bool should_replace_entry) {
     should_replace_entry_ = should_replace_entry;
@@ -367,18 +349,14 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
 
   // Whether this (pending) navigation should clear the session history. Resets
   // to false after commit.
-  bool should_clear_history_list() const {
-    return should_clear_history_list_;
-  }
+  bool should_clear_history_list() const { return should_clear_history_list_; }
   void set_should_clear_history_list(bool should_clear_history_list) {
     should_clear_history_list_ = should_clear_history_list;
   }
 
   // Indicates which FrameTreeNode to navigate.  Currently only used if the
   // --site-per-process flag is passed.
-  int frame_tree_node_id() const {
-    return frame_tree_node_id_;
-  }
+  int frame_tree_node_id() const { return frame_tree_node_id_; }
   void set_frame_tree_node_id(int frame_tree_node_id) {
     frame_tree_node_id_ = frame_tree_node_id;
   }
@@ -391,14 +369,22 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   void set_ssl_error(bool error) { ssl_error_ = error; }
   bool ssl_error() const { return ssl_error_; }
 
-  bool has_user_gesture() const {
-    return has_user_gesture_;
-  }
+  bool has_user_gesture() const { return has_user_gesture_; }
 
   void set_has_user_gesture(bool has_user_gesture) {
     has_user_gesture_ = has_user_gesture;
   }
 
+  void set_network_isolation_key(
+      const net::NetworkIsolationKey& network_isolation_key) {
+    network_isolation_key_ = network_isolation_key;
+  }
+
+  const base::Optional<net::NetworkIsolationKey>& network_isolation_key()
+      const {
+    return network_isolation_key_;
+  }
+
   // Stores a record of the what was committed in this NavigationEntry's main
   // frame before it was replaced (e.g. by history.replaceState()).
   void set_replaced_entry_data(const ReplacedNavigationEntryData& data) {
@@ -425,6 +411,11 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
     back_forward_cache_metrics_ = metrics;
   }
 
+  void set_bundled_exchanges_navigation_info(
+      std::unique_ptr<BundledExchangesNavigationInfo>
+          bundled_exchanges_navigation_info);
+  BundledExchangesNavigationInfo* bundled_exchanges_navigation_info() const;
+
  private:
   // WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING
   // Session/Tab restore save portions of this class so that it can be recreated
@@ -531,6 +522,12 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   // for a pending navigation. Defaults to false.
   bool ssl_error_;
 
+  // The network isolation key for this NavigationEntry. If provided, this
+  // determines the network isolation key to be used when navigating to this
+  // NavigationEntry; otherwise, the key is determined based on the navigating
+  // frame and top frame origins.  For example, this is used for view-source.
+  base::Optional<net::NetworkIsolationKey> network_isolation_key_;
+
   // Stores information about the entry prior to being replaced (e.g.
   // history.replaceState()). It is preserved after commit (session sync for
   // offline analysis) but should not be persisted. The concept is valid for
@@ -555,6 +552,16 @@ class CONTENT_EXPORT NavigationEntryImpl : public NavigationEntry {
   // It is preserved at commit but not persisted.
   scoped_refptr<BackForwardCacheMetrics> back_forward_cache_metrics_;
 
+  // Keeps the bundled exchanges related information when |this| is for a
+  // navigation within a bundled exchanges file. Used when
+  // BundledHTTPExchanges feature is enabled or
+  // TrustableBundledExchangesFileUrl switch is set.
+  // TODO(995177): Support Session/Tab restore.
+  // TODO(995177): Consider if this should be here or in FrameNavigationEntry
+  // for a correct iframe support.
+  std::unique_ptr<BundledExchangesNavigationInfo>
+      bundled_exchanges_navigation_info_;
+
   DISALLOW_COPY_AND_ASSIGN(NavigationEntryImpl);
 };
 
diff --git a/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc b/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc
index 9bbcf16826d..f5863c9f3e9 100644
--- a/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc
+++ b/chromium/content/browser/frame_host/navigation_entry_impl_unittest.cc
@@ -14,6 +14,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/browser/site_instance_impl.h"
+#include "content/common/page_state_serialization.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
@@ -49,6 +50,13 @@ class TestSSLStatusData : public SSLStatus::UserData {
   DISALLOW_COPY_AND_ASSIGN(TestSSLStatusData);
 };
 
+PageState CreateTestPageState() {
+  ExplodedPageState exploded_state;
+  std::string encoded_data;
+  EncodePageState(exploded_state, &encoded_data);
+  return PageState::CreateFromEncodedData(encoded_data);
+}
+
 }  // namespace
 
 class NavigationEntryTest : public testing::Test {
@@ -231,12 +239,6 @@ TEST_F(NavigationEntryTest, NavigationEntryAccessors) {
   entry2_->SetTitle(ASCIIToUTF16("title2"));
   EXPECT_EQ(ASCIIToUTF16("title2"), entry2_->GetTitle());
 
-  // State
-  EXPECT_FALSE(entry1_->GetPageState().IsValid());
-  EXPECT_FALSE(entry2_->GetPageState().IsValid());
-  entry2_->SetPageState(PageState::CreateFromEncodedData("state"));
-  EXPECT_EQ("state", entry2_->GetPageState().ToEncodedData());
-
   // Transition type
   EXPECT_TRUE(ui::PageTransitionTypeIncludingQualifiersIs(
       entry1_->GetTransitionType(), ui::PAGE_TRANSITION_LINK));
@@ -292,10 +294,20 @@ TEST_F(NavigationEntryTest, NavigationEntryAccessors) {
   // Initiator origin.
   EXPECT_FALSE(
       entry1_->root_node()->frame_entry->initiator_origin().has_value());
-  EXPECT_TRUE(
+  ASSERT_TRUE(
       entry2_->root_node()->frame_entry->initiator_origin().has_value());
   EXPECT_EQ(url::Origin::Create(GURL("https://initiator.example.com")),
             entry2_->root_node()->frame_entry->initiator_origin().value());
+
+  // State.
+  //
+  // Note that calling SetPageState may also set some other FNE members
+  // (referrer, initiator, etc.).  This is why it is important to test
+  // SetPageState/GetPageState last.
+  PageState test_page_state = CreateTestPageState();
+  entry2_->SetPageState(test_page_state);
+  EXPECT_EQ(test_page_state.ToEncodedData(),
+            entry2_->GetPageState().ToEncodedData());
 }
 
 // Test basic Clone behavior.
diff --git a/chromium/content/browser/frame_host/navigation_handle_impl.cc b/chromium/content/browser/frame_host/navigation_handle_impl.cc
deleted file mode 100644
index ac68fe77b11..00000000000
--- a/chromium/content/browser/frame_host/navigation_handle_impl.cc
+++ /dev/null
@@ -1,285 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/frame_host/navigation_handle_impl.h"
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
-#include "content/browser/appcache/appcache_navigation_handle.h"
-#include "content/browser/appcache/appcache_service_impl.h"
-#include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/devtools/devtools_instrumentation.h"
-#include "content/browser/frame_host/debug_urls.h"
-#include "content/browser/frame_host/navigation_controller_impl.h"
-#include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigator.h"
-#include "content/browser/frame_host/navigator_delegate.h"
-#include "content/browser/renderer_host/render_widget_host_impl.h"
-#include "content/browser/service_worker/service_worker_context_wrapper.h"
-#include "content/browser/service_worker/service_worker_navigation_handle.h"
-#include "content/common/frame_messages.h"
-#include "content/public/browser/navigation_ui_data.h"
-#include "content/public/browser/render_process_host.h"
-#include "content/public/common/child_process_host.h"
-#include "content/public/common/content_client.h"
-#include "content/public/common/url_constants.h"
-#include "content/public/common/url_utils.h"
-#include "net/base/net_errors.h"
-#include "services/network/public/cpp/resource_request_body.h"
-
-namespace content {
-
-NavigationHandleImpl::NavigationHandleImpl(
-    NavigationRequest* navigation_request)
-    : navigation_request_(navigation_request) {}
-
-NavigationHandleImpl::~NavigationHandleImpl() = default;
-
-int64_t NavigationHandleImpl::GetNavigationId() {
-  return navigation_request_->navigation_handle_id();
-}
-
-const GURL& NavigationHandleImpl::GetURL() {
-  return navigation_request_->common_params().url;
-}
-
-SiteInstanceImpl* NavigationHandleImpl::GetStartingSiteInstance() {
-  return navigation_request_->starting_site_instance();
-}
-
-bool NavigationHandleImpl::IsInMainFrame() {
-  return navigation_request_->IsInMainFrame();
-}
-
-bool NavigationHandleImpl::IsParentMainFrame() {
-  return navigation_request_->IsParentMainFrame();
-}
-
-bool NavigationHandleImpl::IsRendererInitiated() {
-  return !navigation_request_->browser_initiated();
-}
-
-bool NavigationHandleImpl::WasServerRedirect() {
-  return navigation_request_->was_redirected();
-}
-
-const std::vector<GURL>& NavigationHandleImpl::GetRedirectChain() {
-  return navigation_request_->redirect_chain();
-}
-
-int NavigationHandleImpl::GetFrameTreeNodeId() {
-  return navigation_request_->GetFrameTreeNodeId();
-}
-
-RenderFrameHostImpl* NavigationHandleImpl::GetParentFrame() {
-  return navigation_request_->GetParentFrame();
-}
-
-base::TimeTicks NavigationHandleImpl::NavigationStart() {
-  return navigation_request_->common_params().navigation_start;
-}
-
-base::TimeTicks NavigationHandleImpl::NavigationInputStart() {
-  return navigation_request_->common_params().input_start;
-}
-
-bool NavigationHandleImpl::IsPost() {
-  return navigation_request_->common_params().method == "POST";
-}
-
-const scoped_refptr<network::ResourceRequestBody>&
-NavigationHandleImpl::GetResourceRequestBody() {
-  return navigation_request_->common_params().post_data;
-}
-
-const blink::mojom::Referrer& NavigationHandleImpl::GetReferrer() {
-  return navigation_request_->sanitized_referrer();
-}
-
-bool NavigationHandleImpl::HasUserGesture() {
-  return navigation_request_->common_params().has_user_gesture;
-}
-
-ui::PageTransition NavigationHandleImpl::GetPageTransition() {
-  return navigation_request_->common_params().transition;
-}
-
-NavigationUIData* NavigationHandleImpl::GetNavigationUIData() {
-  return navigation_request_->navigation_ui_data();
-}
-
-bool NavigationHandleImpl::IsExternalProtocol() {
-  return navigation_request_->IsExternalProtocol();
-}
-
-net::Error NavigationHandleImpl::GetNetErrorCode() {
-  return navigation_request_->net_error();
-}
-
-RenderFrameHostImpl* NavigationHandleImpl::GetRenderFrameHost() {
-  return navigation_request_->render_frame_host();
-}
-
-bool NavigationHandleImpl::IsSameDocument() {
-  return navigation_request_->IsSameDocument();
-}
-
-const net::HttpRequestHeaders& NavigationHandleImpl::GetRequestHeaders() {
-  return navigation_request_->request_headers();
-}
-
-void NavigationHandleImpl::RemoveRequestHeader(const std::string& header_name) {
-  navigation_request_->RemoveRequestHeader(header_name);
-}
-
-void NavigationHandleImpl::SetRequestHeader(const std::string& header_name,
-                                            const std::string& header_value) {
-  navigation_request_->SetRequestHeader(header_name, header_value);
-}
-
-const net::HttpResponseHeaders* NavigationHandleImpl::GetResponseHeaders() {
-  return navigation_request_->GetResponseHeaders();
-}
-
-net::HttpResponseInfo::ConnectionInfo
-NavigationHandleImpl::GetConnectionInfo() {
-  return navigation_request_->GetConnectionInfo();
-}
-
-const base::Optional<net::SSLInfo>& NavigationHandleImpl::GetSSLInfo() {
-  return navigation_request_->ssl_info();
-}
-
-const base::Optional<net::AuthChallengeInfo>&
-NavigationHandleImpl::GetAuthChallengeInfo() {
-  return navigation_request_->auth_challenge_info();
-}
-
-bool NavigationHandleImpl::HasCommitted() {
-  return navigation_request_->HasCommitted();
-}
-
-bool NavigationHandleImpl::IsErrorPage() {
-  return navigation_request_->IsErrorPage();
-}
-
-bool NavigationHandleImpl::HasSubframeNavigationEntryCommitted() {
-  return navigation_request_->subframe_entry_committed();
-}
-
-bool NavigationHandleImpl::DidReplaceEntry() {
-  return navigation_request_->did_replace_entry();
-}
-
-bool NavigationHandleImpl::ShouldUpdateHistory() {
-  return navigation_request_->should_update_history();
-}
-
-const GURL& NavigationHandleImpl::GetPreviousURL() {
-  return navigation_request_->previous_url();
-}
-
-net::IPEndPoint NavigationHandleImpl::GetSocketAddress() {
-  return navigation_request_->GetSocketAddress();
-}
-
-void NavigationHandleImpl::RegisterThrottleForTesting(
-    std::unique_ptr<NavigationThrottle> navigation_throttle) {
-  navigation_request_->RegisterThrottleForTesting(
-      std::move(navigation_throttle));
-}
-
-bool NavigationHandleImpl::IsDeferredForTesting() {
-  return navigation_request_->IsDeferredForTesting();
-}
-
-bool NavigationHandleImpl::WasStartedFromContextMenu() {
-  return navigation_request_->common_params().started_from_context_menu;
-}
-
-const GURL& NavigationHandleImpl::GetSearchableFormURL() {
-  return navigation_request_->begin_params()->searchable_form_url;
-}
-
-const std::string& NavigationHandleImpl::GetSearchableFormEncoding() {
-  return navigation_request_->begin_params()->searchable_form_encoding;
-}
-
-ReloadType NavigationHandleImpl::GetReloadType() {
-  return navigation_request_->reload_type();
-}
-
-RestoreType NavigationHandleImpl::GetRestoreType() {
-  return navigation_request_->restore_type();
-}
-
-const GURL& NavigationHandleImpl::GetBaseURLForDataURL() {
-  return navigation_request_->common_params().base_url_for_data_url;
-}
-
-void NavigationHandleImpl::RegisterSubresourceOverride(
-    mojom::TransferrableURLLoaderPtr transferrable_loader) {
-  navigation_request_->RegisterSubresourceOverride(
-      std::move(transferrable_loader));
-}
-
-const GlobalRequestID& NavigationHandleImpl::GetGlobalRequestID() {
-  return navigation_request_->request_id();
-}
-
-bool NavigationHandleImpl::IsDownload() {
-  return navigation_request_->is_download();
-}
-
-bool NavigationHandleImpl::IsFormSubmission() {
-  return navigation_request_->begin_params()->is_form_submission;
-}
-
-bool NavigationHandleImpl::WasInitiatedByLinkClick() {
-  return navigation_request_->begin_params()->was_initiated_by_link_click;
-}
-
-const std::string& NavigationHandleImpl::GetHrefTranslate() {
-  return navigation_request_->common_params().href_translate;
-}
-
-void NavigationHandleImpl::CallResumeForTesting() {
-  navigation_request_->CallResumeForTesting();
-}
-
-const base::Optional<url::Origin>& NavigationHandleImpl::GetInitiatorOrigin() {
-  return navigation_request_->common_params().initiator_origin;
-}
-
-bool NavigationHandleImpl::IsSameProcess() {
-  return navigation_request_->is_same_process();
-}
-
-int NavigationHandleImpl::GetNavigationEntryOffset() {
-  return navigation_request_->navigation_entry_offset();
-}
-
-bool NavigationHandleImpl::FromDownloadCrossOriginRedirect() {
-  return navigation_request_->from_download_cross_origin_redirect();
-}
-
-bool NavigationHandleImpl::IsSignedExchangeInnerResponse() {
-  return navigation_request_->IsSignedExchangeInnerResponse();
-}
-
-bool NavigationHandleImpl::HasPrefetchedAlternativeSubresourceSignedExchange() {
-  return navigation_request_
-      ->HasPrefetchedAlternativeSubresourceSignedExchange();
-}
-
-bool NavigationHandleImpl::WasResponseCached() {
-  return navigation_request_->WasResponseCached();
-}
-
-const net::ProxyServer& NavigationHandleImpl::GetProxyServer() {
-  return navigation_request_->proxy_server();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_handle_impl.h b/chromium/content/browser/frame_host/navigation_handle_impl.h
deleted file mode 100644
index ec34c7127a2..00000000000
--- a/chromium/content/browser/frame_host/navigation_handle_impl.h
+++ /dev/null
@@ -1,179 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_FRAME_HOST_NAVIGATION_HANDLE_IMPL_H_
-#define CONTENT_BROWSER_FRAME_HOST_NAVIGATION_HANDLE_IMPL_H_
-
-#include "content/public/browser/navigation_handle.h"
-
-#include <stddef.h>
-
-#include <memory>
-#include <string>
-#include <utility>
-#include <vector>
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/optional.h"
-#include "content/browser/frame_host/frame_tree_node.h"
-#include "content/browser/frame_host/navigation_request.h"
-#include "content/browser/frame_host/navigation_throttle_runner.h"
-#include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/common/content_export.h"
-#include "content/public/browser/global_request_id.h"
-#include "content/public/browser/navigation_throttle.h"
-#include "content/public/browser/navigation_type.h"
-#include "content/public/browser/restore_type.h"
-#include "net/base/ip_endpoint.h"
-#include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
-#include "third_party/blink/public/platform/web_mixed_content_context_type.h"
-#include "url/gurl.h"
-
-namespace content {
-
-class NavigationUIData;
-class SiteInstanceImpl;
-
-// This class keeps track of a single navigation. It is created after the
-// BeforeUnload for the navigation has run. It is then owned by the
-// NavigationRequest until the navigation is ready to commit. The
-// NavigationHandleImpl ownership is then transferred to the RenderFrameHost in
-// which the navigation will commit. It is finaly destroyed when the navigation
-// commits.
-class CONTENT_EXPORT NavigationHandleImpl : public NavigationHandle {
- public:
-  ~NavigationHandleImpl() override;
-
-  // NavigationHandle implementation:
-  int64_t GetNavigationId() override;
-  const GURL& GetURL() override;
-  SiteInstanceImpl* GetStartingSiteInstance() override;
-  bool IsInMainFrame() override;
-  bool IsParentMainFrame() override;
-  bool IsRendererInitiated() override;
-  bool WasServerRedirect() override;
-  const std::vector<GURL>& GetRedirectChain() override;
-  int GetFrameTreeNodeId() override;
-  RenderFrameHostImpl* GetParentFrame() override;
-  base::TimeTicks NavigationStart() override;
-  base::TimeTicks NavigationInputStart() override;
-  bool IsPost() override;
-  const scoped_refptr<network::ResourceRequestBody>& GetResourceRequestBody()
-      override;
-  const blink::mojom::Referrer& GetReferrer() override;
-  bool HasUserGesture() override;
-  ui::PageTransition GetPageTransition() override;
-  NavigationUIData* GetNavigationUIData() override;
-  bool IsExternalProtocol() override;
-  net::Error GetNetErrorCode() override;
-  RenderFrameHostImpl* GetRenderFrameHost() override;
-  bool IsSameDocument() override;
-  bool HasCommitted() override;
-  bool IsErrorPage() override;
-  bool HasSubframeNavigationEntryCommitted() override;
-  bool DidReplaceEntry() override;
-  bool ShouldUpdateHistory() override;
-  const GURL& GetPreviousURL() override;
-  net::IPEndPoint GetSocketAddress() override;
-  const net::HttpRequestHeaders& GetRequestHeaders() override;
-  void RemoveRequestHeader(const std::string& header_name) override;
-  void SetRequestHeader(const std::string& header_name,
-                        const std::string& header_value) override;
-  const net::HttpResponseHeaders* GetResponseHeaders() override;
-  net::HttpResponseInfo::ConnectionInfo GetConnectionInfo() override;
-  const base::Optional<net::SSLInfo>& GetSSLInfo() override;
-  const base::Optional<net::AuthChallengeInfo>& GetAuthChallengeInfo() override;
-  void RegisterThrottleForTesting(
-      std::unique_ptr<NavigationThrottle> navigation_throttle) override;
-  bool IsDeferredForTesting() override;
-  bool WasStartedFromContextMenu() override;
-  const GURL& GetSearchableFormURL() override;
-  const std::string& GetSearchableFormEncoding() override;
-  ReloadType GetReloadType() override;
-  RestoreType GetRestoreType() override;
-  const GURL& GetBaseURLForDataURL() override;
-  const GlobalRequestID& GetGlobalRequestID() override;
-  bool IsDownload() override;
-  bool IsFormSubmission() override;
-  bool WasInitiatedByLinkClick() override;
-  bool IsSignedExchangeInnerResponse() override;
-  bool HasPrefetchedAlternativeSubresourceSignedExchange() override;
-  bool WasResponseCached() override;
-  const net::ProxyServer& GetProxyServer() override;
-  const std::string& GetHrefTranslate() override;
-  const base::Optional<url::Origin>& GetInitiatorOrigin() override;
-  bool IsSameProcess() override;
-  int GetNavigationEntryOffset() override;
-  bool FromDownloadCrossOriginRedirect() override;
-
-  // Returns the NavigationRequest which owns this NavigationHandle.
-  NavigationRequest* navigation_request() { return navigation_request_; }
-
-  // Simulates the navigation resuming. Most callers should just let the
-  // deferring NavigationThrottle do the resuming.
-  void CallResumeForTesting();
-
-  void RegisterSubresourceOverride(
-      mojom::TransferrableURLLoaderPtr transferrable_loader) override;
-
-  blink::mojom::RequestContextType request_context_type() const {
-    DCHECK_GE(state(), NavigationRequest::PROCESSING_WILL_START_REQUEST);
-    return navigation_request_->begin_params()->request_context_type;
-  }
-
-  blink::WebMixedContentContextType mixed_content_context_type() const {
-    DCHECK_GE(state(), NavigationRequest::PROCESSING_WILL_START_REQUEST);
-    return navigation_request_->begin_params()->mixed_content_context_type;
-  }
-
-  // Get the unique id from the NavigationEntry associated with this
-  // NavigationHandle. Note that a synchronous, renderer-initiated navigation
-  // will not have a NavigationEntry associated with it, and this will return 0.
-  int pending_nav_entry_id() const {
-    return navigation_request_->nav_entry_id();
-  }
-
-  // Returns the FrameTreeNode this navigation is happening in.
-  FrameTreeNode* frame_tree_node() const {
-    return navigation_request_->frame_tree_node();
-  }
-
-  NavigationType navigation_type() {
-    return navigation_request_->navigation_type();
-  }
-
-  CSPDisposition should_check_main_world_csp() const {
-    return navigation_request_->common_params()
-        .initiator_csp_info.should_check_main_world_csp;
-  }
-
-  const base::Optional<SourceLocation>& source_location() const {
-    return navigation_request_->common_params().source_location;
-  }
-
- private:
-  friend class NavigationRequest;
-
-  // If |redirect_chain| is empty, then the redirect chain will be created to
-  // start with |url|. Otherwise |redirect_chain| is used as the starting point.
-  // |navigation_start| comes from the CommonNavigationParams associated with
-  // this navigation.
-  NavigationHandleImpl(NavigationRequest* navigation_request);
-
-  NavigationRequest::NavigationHandleState state() const {
-    return navigation_request_->handle_state();
-  }
-
-  // The NavigationRequest that owns this NavigationHandle.
-  NavigationRequest* navigation_request_;
-
-  base::WeakPtrFactory<NavigationHandleImpl> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(NavigationHandleImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_FRAME_HOST_NAVIGATION_HANDLE_IMPL_H_
diff --git a/chromium/content/browser/frame_host/navigation_request.cc b/chromium/content/browser/frame_host/navigation_request.cc
index 35381afde31..c65805b8884 100644
--- a/chromium/content/browser/frame_host/navigation_request.cc
+++ b/chromium/content/browser/frame_host/navigation_request.cc
@@ -33,7 +33,7 @@
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigation_request_info.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_impl.h"
@@ -49,6 +49,10 @@
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_navigation_handle.h"
 #include "content/browser/site_instance_impl.h"
+#include "content/browser/web_package/bundled_exchanges_handle_tracker.h"
+#include "content/browser/web_package/bundled_exchanges_navigation_info.h"
+#include "content/browser/web_package/bundled_exchanges_source.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
 #include "content/common/appcache_interfaces.h"
 #include "content/common/content_constants_internal.h"
@@ -301,12 +305,18 @@ void AddAdditionalRequestHeaders(net::HttpRequestHeaders* headers,
         destination = "embed";
         break;
       case blink::FrameOwnerElementType::kIframe:
+        destination = "iframe";
+        break;
       case blink::FrameOwnerElementType::kFrame:
+        destination = "frame";
+        break;
       case blink::FrameOwnerElementType::kPortal:
         // TODO(mkwst): "Portal"'s destination isn't actually defined at the
         // moment. Let's assume it'll be similar to a frame until we decide
         // otherwise.
-        destination = "nested-document";
+        // https://github.com/w3c/webappsec-fetch-metadata/issues/46
+        destination = "document";
+        break;
     }
 
     if (IsFetchMetadataDestinationEnabled()) {
@@ -451,65 +461,103 @@ void RecordReadyToCommitMetrics(
     RenderFrameHostImpl* new_rfh,
     const mojom::CommonNavigationParams& common_params,
     base::TimeTicks ready_to_commit_time) {
+  bool is_main_frame = !new_rfh->GetParent();
   bool is_same_process =
       old_rfh->GetProcess()->GetID() == new_rfh->GetProcess()->GetID();
 
-  bool is_same_browsing_instance =
-      old_rfh->GetSiteInstance()->IsRelatedSiteInstance(
-          new_rfh->GetSiteInstance());
-
-  bool is_same_site_instance =
-      old_rfh->GetSiteInstance() == new_rfh->GetSiteInstance();
-
-  // Log overall value, then log specific value per type of navigation.
-  UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess", is_same_process);
-  UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameSiteInstance", is_same_site_instance);
-  UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameBrowsingInstance",
-                        is_same_browsing_instance);
-
-  UMA_HISTOGRAM_BOOLEAN("Navigation.RequiresDedicatedProcess",
-                        new_rfh->GetSiteInstance()->RequiresDedicatedProcess());
-
-  ChildProcessSecurityPolicyImpl* policy =
-      ChildProcessSecurityPolicyImpl::GetInstance();
-  GURL process_lock = policy->GetOriginLock(new_rfh->GetProcess()->GetID());
-  UMA_HISTOGRAM_BOOLEAN("Navigation.IsLockedProcess", !process_lock.is_empty());
-
-  if (common_params.transition & ui::PAGE_TRANSITION_FORWARD_BACK) {
-    UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess.BackForward",
-                          is_same_process);
-  } else if (ui::PageTransitionCoreTypeIs(common_params.transition,
-                                          ui::PAGE_TRANSITION_RELOAD)) {
-    UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess.Reload", is_same_process);
-  } else if (ui::PageTransitionIsNewNavigation(common_params.transition)) {
-    UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess.NewNavigation",
-                          is_same_process);
-  } else {
-    NOTREACHED() << "Invalid page transition: " << common_params.transition;
+  // Navigation.IsSameBrowsingInstance
+  if (is_main_frame) {
+    bool is_same_browsing_instance =
+        old_rfh->GetSiteInstance()->IsRelatedSiteInstance(
+            new_rfh->GetSiteInstance());
+
+    UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameBrowsingInstance",
+                          is_same_browsing_instance);
   }
 
-  constexpr base::Optional<bool> kIsBackground = base::nullopt;
-  base::TimeDelta delta = ready_to_commit_time - common_params.navigation_start;
+  // Navigation.IsSameSiteInstance
+  {
+    bool is_same_site_instance =
+        old_rfh->GetSiteInstance() == new_rfh->GetSiteInstance();
+    UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameSiteInstance",
+                          is_same_site_instance);
+    if (is_main_frame) {
+      UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameSiteInstance.MainFrame",
+                            is_same_site_instance);
+    } else {
+      UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameSiteInstance.Subframe",
+                            is_same_site_instance);
+    }
+  }
 
-  LOG_NAVIGATION_TIMING_HISTOGRAM(
-      "TimeToReadyToCommit2", common_params.transition, kIsBackground, delta);
-  if (!old_rfh->GetParent()) {
-    LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.MainFrame",
-                                    common_params.transition, kIsBackground,
-                                    delta);
-  } else {
-    LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.Subframe",
-                                    common_params.transition, kIsBackground,
-                                    delta);
+  // Navigation.IsLockedProcess
+  {
+    ChildProcessSecurityPolicyImpl* policy =
+        ChildProcessSecurityPolicyImpl::GetInstance();
+    GURL process_lock = policy->GetOriginLock(new_rfh->GetProcess()->GetID());
+    UMA_HISTOGRAM_BOOLEAN("Navigation.IsLockedProcess",
+                          !process_lock.is_empty());
+    if (common_params.url.SchemeIsHTTPOrHTTPS()) {
+      UMA_HISTOGRAM_BOOLEAN("Navigation.IsLockedProcess.HTTPOrHTTPS",
+                            !process_lock.is_empty());
+    }
   }
-  if (is_same_process) {
-    LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.SameProcess",
-                                    common_params.transition, kIsBackground,
-                                    delta);
-  } else {
-    LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.CrossProcess",
-                                    common_params.transition, kIsBackground,
-                                    delta);
+
+  // Navigation.RequiresDedicatedProcess
+  {
+    UMA_HISTOGRAM_BOOLEAN(
+        "Navigation.RequiresDedicatedProcess",
+        new_rfh->GetSiteInstance()->RequiresDedicatedProcess());
+    if (common_params.url.SchemeIsHTTPOrHTTPS()) {
+      UMA_HISTOGRAM_BOOLEAN(
+          "Navigation.RequiresDedicatedProcess.HTTPOrHTTPS",
+          new_rfh->GetSiteInstance()->RequiresDedicatedProcess());
+    }
+  }
+
+  // Navigation.IsSameProcess
+  {
+    UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess", is_same_process);
+    if (common_params.transition & ui::PAGE_TRANSITION_FORWARD_BACK) {
+      UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess.BackForward",
+                            is_same_process);
+    } else if (ui::PageTransitionCoreTypeIs(common_params.transition,
+                                            ui::PAGE_TRANSITION_RELOAD)) {
+      UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess.Reload", is_same_process);
+    } else if (ui::PageTransitionIsNewNavigation(common_params.transition)) {
+      UMA_HISTOGRAM_BOOLEAN("Navigation.IsSameProcess.NewNavigation",
+                            is_same_process);
+    } else {
+      NOTREACHED() << "Invalid page transition: " << common_params.transition;
+    }
+  }
+
+  // TimeToReadyToCommit2
+  {
+    constexpr base::Optional<bool> kIsBackground = base::nullopt;
+    base::TimeDelta delta =
+        ready_to_commit_time - common_params.navigation_start;
+
+    LOG_NAVIGATION_TIMING_HISTOGRAM(
+        "TimeToReadyToCommit2", common_params.transition, kIsBackground, delta);
+    if (is_main_frame) {
+      LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.MainFrame",
+                                      common_params.transition, kIsBackground,
+                                      delta);
+    } else {
+      LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.Subframe",
+                                      common_params.transition, kIsBackground,
+                                      delta);
+    }
+    if (is_same_process) {
+      LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.SameProcess",
+                                      common_params.transition, kIsBackground,
+                                      delta);
+    } else {
+      LOG_NAVIGATION_TIMING_HISTOGRAM("TimeToReadyToCommit2.CrossProcess",
+                                      common_params.transition, kIsBackground,
+                                      delta);
+    }
   }
 }
 
@@ -565,6 +613,28 @@ network::mojom::IPAddressSpace CalculateIPAddressSpace(
   return network::mojom::IPAddressSpace::kPublic;
 }
 
+// Convert the navigation type to the appropriate cross-document one.
+//
+// This is currently used when:
+// 1) Restarting a same-document navigation as cross-document.
+// 2) Committing an error page after blocking a same-document navigations.
+mojom::NavigationType ConvertToCrossDocumentType(mojom::NavigationType type) {
+  switch (type) {
+    case mojom::NavigationType::SAME_DOCUMENT:
+      return mojom::NavigationType::DIFFERENT_DOCUMENT;
+    case mojom::NavigationType::HISTORY_SAME_DOCUMENT:
+      return mojom::NavigationType::HISTORY_DIFFERENT_DOCUMENT;
+    case mojom::NavigationType::RELOAD:
+    case mojom::NavigationType::RELOAD_BYPASSING_CACHE:
+    case mojom::NavigationType::RELOAD_ORIGINAL_REQUEST_URL:
+    case mojom::NavigationType::RESTORE:
+    case mojom::NavigationType::RESTORE_WITH_POST:
+    case mojom::NavigationType::HISTORY_DIFFERENT_DOCUMENT:
+    case mojom::NavigationType::DIFFERENT_DOCUMENT:
+      return type;
+  }
+}
+
 }  // namespace
 
 // static
@@ -603,16 +673,20 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateBrowserInitiated(
     NavigationControllerImpl* controller =
         static_cast<NavigationControllerImpl*>(
             frame_tree_node->navigator()->GetController());
-    rfh_restored_from_back_forward_cache =
-        controller->back_forward_cache().GetDocument(entry->GetUniqueID());
+    BackForwardCacheImpl::Entry* restored_entry =
+        controller->GetBackForwardCache().GetEntry(entry->GetUniqueID());
+    if (restored_entry) {
+      rfh_restored_from_back_forward_cache =
+          restored_entry->render_frame_host.get();
+    }
   }
 
   std::unique_ptr<NavigationRequest> navigation_request(new NavigationRequest(
       frame_tree_node, std::move(common_params), std::move(navigation_params),
       std::move(commit_params), browser_initiated,
       false /* from_begin_navigation */, false /* is_for_commit */, frame_entry,
-      entry, std::move(navigation_ui_data), nullptr, mojo::NullRemote(),
-      rfh_restored_from_back_forward_cache));
+      entry, std::move(navigation_ui_data), mojo::NullAssociatedRemote(),
+      mojo::NullRemote(), rfh_restored_from_back_forward_cache));
 
   if (frame_entry) {
     navigation_request->blob_url_loader_factory_ =
@@ -645,10 +719,12 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateRendererInitiated(
     int current_history_list_length,
     bool override_user_agent,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
     scoped_refptr<PrefetchedSignedExchangeCache>
-        prefetched_signed_exchange_cache) {
+        prefetched_signed_exchange_cache,
+    std::unique_ptr<BundledExchangesHandleTracker>
+        bundled_exchanges_handle_tracker) {
   // Only normal navigations to a different document or reloads are expected.
   // - Renderer-initiated same document navigations never start in the browser.
   // - Restore-navigations are always browser-initiated.
@@ -692,7 +768,9 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateRendererInitiated(
           std::string(),  // data_url_as_string
 #endif
           false,  // is_browser_initiated
-          network::mojom::IPAddressSpace::kUnknown);
+          network::mojom::IPAddressSpace::kUnknown,
+          GURL() /* base_url_override_for_bundled_exchanges */
+      );
   std::unique_ptr<NavigationRequest> navigation_request(new NavigationRequest(
       frame_tree_node, std::move(common_params), std::move(begin_params),
       std::move(commit_params),
@@ -708,6 +786,8 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateRendererInitiated(
       std::move(blob_url_loader_factory);
   navigation_request->prefetched_signed_exchange_cache_ =
       std::move(prefetched_signed_exchange_cache);
+  navigation_request->bundled_exchanges_handle_tracker_ =
+      std::move(bundled_exchanges_handle_tracker);
   return navigation_request;
 }
 
@@ -763,7 +843,9 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateForCommit(
           std::string(), /* data_url_as_string */
 #endif
           false,  // is_browser_initiated
-          network::mojom::IPAddressSpace::kUnknown);
+          network::mojom::IPAddressSpace::kUnknown,
+          GURL() /* base_url_override_for_bundled_exchanges */
+      );
   mojom::BeginNavigationParamsPtr begin_params =
       mojom::BeginNavigationParams::New();
   std::unique_ptr<NavigationRequest> navigation_request(new NavigationRequest(
@@ -771,16 +853,16 @@ std::unique_ptr<NavigationRequest> NavigationRequest::CreateForCommit(
       std::move(commit_params), !is_renderer_initiated,
       false /* from_begin_navigation */, true /* is_for_commit */,
       entry ? entry->GetFrameEntry(frame_tree_node) : nullptr, entry,
-      nullptr /* navigation_ui_data */,
-      mojom::NavigationClientAssociatedPtrInfo(), mojo::NullRemote(),
-      nullptr /* rfh_restored_from_back_forward_cache */));
+      nullptr /* navigation_ui_data */, mojo::NullAssociatedRemote(),
+      mojo::NullRemote(), nullptr /* rfh_restored_from_back_forward_cache */));
+
+  navigation_request->render_frame_host_ = render_frame_host;
+  navigation_request->StartNavigation(true);
+  DCHECK(navigation_request->IsNavigationStarted());
 
   // Update the state of the NavigationRequest to match the fact that the
   // navigation just committed.
   navigation_request->state_ = RESPONSE_STARTED;
-  navigation_request->render_frame_host_ = render_frame_host;
-  navigation_request->CreateNavigationHandle(true);
-  DCHECK(navigation_request->navigation_handle());
   return navigation_request;
 }
 
@@ -795,7 +877,7 @@ NavigationRequest::NavigationRequest(
     const FrameNavigationEntry* frame_entry,
     NavigationEntryImpl* entry,
     std::unique_ptr<NavigationUIData> navigation_ui_data,
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
     RenderFrameHostImpl* rfh_restored_from_back_forward_cache)
     : frame_tree_node_(frame_tree_node),
@@ -815,17 +897,19 @@ NavigationRequest::NavigationRequest(
       net_error_(net::OK),
       expected_render_process_host_id_(ChildProcessHost::kInvalidUniqueID),
       devtools_navigation_token_(base::UnguessableToken::Create()),
-      request_navigation_client_(nullptr),
-      commit_navigation_client_(nullptr),
+      request_navigation_client_(mojo::NullAssociatedRemote()),
+      commit_navigation_client_(mojo::NullAssociatedRemote()),
       rfh_restored_from_back_forward_cache_(
           rfh_restored_from_back_forward_cache) {
-  DCHECK(browser_initiated || common_params_->initiator_origin.has_value());
+  DCHECK(browser_initiated_ || common_params_->initiator_origin.has_value());
   DCHECK(!IsRendererDebugURL(common_params_->url));
   DCHECK(common_params_->method == "POST" || !common_params_->post_data);
   TRACE_EVENT_ASYNC_BEGIN2("navigation", "NavigationRequest", this,
                            "frame_tree_node",
                            frame_tree_node_->frame_tree_node_id(), "url",
                            common_params_->url.possibly_invalid_spec());
+  NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
+      frame_tree_node_->navigator()->GetController());
 
   if (frame_entry) {
     frame_entry_item_sequence_number_ = frame_entry->item_sequence_number();
@@ -855,10 +939,47 @@ NavigationRequest::NavigationRequest(
     if (frame_navigation_entry) {
       source_site_instance_ = frame_navigation_entry->source_site_instance();
       dest_site_instance_ = frame_navigation_entry->site_instance();
+
+      // Handle history subframe navigations that require a source_site_instance
+      // but do not have one set yet. This can happen when navigation entries
+      // are restored from PageState objects. The serialized state does not
+      // contain a SiteInstance so we need to use the initiator_origin to
+      // get an appropriate source SiteInstance.
+      if (common_params_->is_history_navigation_in_new_child_frame)
+        SetSourceSiteInstanceToInitiatorIfNeeded();
     }
+    network_isolation_key_ = entry->network_isolation_key();
     is_view_source_ = entry->IsViewSourceMode();
     bindings_ = entry->bindings();
-  }
+
+    // Ensure that we always have a |source_site_instance_| for navigations
+    // that require it at this point. This is needed to ensure that data: URLs
+    // commit in the SiteInstance that initiated them.
+    //
+    // TODO(acolwell): Move this below so it can be enforced on all paths.
+    // This requires auditing same-document and other navigations that don't
+    // have |from_begin_navigation_| or |entry| set.
+    DCHECK(!RequiresSourceSiteInstance() || source_site_instance_);
+  }
+
+  // Let the NTP override the navigation params and pretend that this is a
+  // browser-initiated, bookmark-like navigation.
+  if (!browser_initiated_ && source_site_instance_) {
+    bool is_renderer_initiated = !browser_initiated_;
+    Referrer referrer(*common_params_->referrer);
+    GetContentClient()->browser()->OverrideNavigationParams(
+        source_site_instance_.get(), &common_params_->transition,
+        &is_renderer_initiated, &referrer, &common_params_->initiator_origin);
+    common_params_->referrer =
+        blink::mojom::Referrer::New(referrer.url, referrer.policy);
+    browser_initiated_ = !is_renderer_initiated;
+    commit_params_->is_browser_initiated = browser_initiated_;
+  }
+
+  // Store the old RenderFrameHost id at request creation to be used later.
+  previous_render_frame_host_id_ = GlobalFrameRoutingId(
+      frame_tree_node->current_frame_host()->GetProcess()->GetID(),
+      frame_tree_node->current_frame_host()->GetRoutingID());
 
   // Update the load flags with cache information.
   UpdateLoadFlagsWithCacheFlags(&begin_params_->load_flags,
@@ -877,6 +998,16 @@ NavigationRequest::NavigationRequest(
       entry->back_forward_cache_metrics()
           ->MainFrameDidStartNavigationToDocument();
     }
+    if (entry->bundled_exchanges_navigation_info()) {
+      bundled_exchanges_navigation_info_ =
+          entry->bundled_exchanges_navigation_info()->Clone();
+    }
+
+    // If this NavigationRequest is for the current pending entry, make sure
+    // that we will discard the pending entry if all of associated its requests
+    // go away, by creating a ref to it.
+    if (entry == controller->GetPendingEntry())
+      pending_entry_ref_ = controller->ReferencePendingEntry();
   }
 
   std::string user_agent_override;
@@ -890,8 +1021,7 @@ NavigationRequest::NavigationRequest(
   // Only add specific headers when creating a NavigationRequest before the
   // network request is made, not at commit time.
   if (!is_for_commit) {
-    BrowserContext* browser_context =
-        frame_tree_node_->navigator()->GetController()->GetBrowserContext();
+    BrowserContext* browser_context = controller->GetBrowserContext();
     ClientHintsControllerDelegate* client_hints_delegate =
         browser_context->GetClientHintsControllerDelegate();
     if (client_hints_delegate) {
@@ -909,18 +1039,17 @@ NavigationRequest::NavigationRequest(
     headers.AddHeadersFromString(begin_params_->headers);
     AddAdditionalRequestHeaders(
         &headers, common_params_->url, common_params_->navigation_type,
-        common_params_->transition,
-        frame_tree_node_->navigator()->GetController()->GetBrowserContext(),
+        common_params_->transition, controller->GetBrowserContext(),
         common_params_->method, user_agent_override,
         common_params_->has_user_gesture, common_params_->initiator_origin,
         common_params_->referrer->policy, frame_tree_node);
 
     if (begin_params_->is_form_submission) {
-      if (browser_initiated && !commit_params_->post_content_type.empty()) {
+      if (browser_initiated_ && !commit_params_->post_content_type.empty()) {
         // This is a form resubmit, so make sure to set the Content-Type header.
         headers.SetHeaderIfMissing(net::HttpRequestHeaders::kContentType,
                                    commit_params_->post_content_type);
-      } else if (!browser_initiated) {
+      } else if (!browser_initiated_) {
         // Save the Content-Type in case the form is resubmitted. This will get
         // sent back to the renderer in the CommitNavigation IPC. The renderer
         // will then send it back with the post body so that we can access it
@@ -951,14 +1080,25 @@ NavigationRequest::~NavigationRequest() {
         *this, network::URLLoaderCompletionStatus(net::ERR_ABORTED));
   }
 
+  // If this NavigationRequest is the last one referencing the pending
+  // NavigationEntry, the entry is discarded.
+  //
+  // Leaving a stale pending NavigationEntry with no matching navigation can
+  // potentially lead to URL-spoof issues.
+  //
+  // Note: Discarding the pending NavigationEntry is done before notifying the
+  // navigation finished to the observers. One class is relying on this:
+  // org.chromium.chrome.browser.toolbar.ToolbarManager
+  pending_entry_ref_.reset();
+
 #if defined(OS_ANDROID)
   if (navigation_handle_proxy_)
     navigation_handle_proxy_->DidFinish();
 #endif
 
-  if (navigation_handle()) {
-    GetDelegate()->DidFinishNavigation(navigation_handle());
-    TraceNavigationHandleEnd();
+  if (IsNavigationStarted()) {
+    GetDelegate()->DidFinishNavigation(this);
+    TraceNavigationEnd();
   }
 }
 
@@ -1015,7 +1155,7 @@ void NavigationRequest::BeginNavigation() {
   if (net_error != net::OK) {
     // Create a navigation handle so that the correct error code can be set on
     // it by OnRequestFailedInternal().
-    CreateNavigationHandle(false);
+    StartNavigation(false);
     OnRequestFailedInternal(network::URLLoaderCompletionStatus(net_error),
                             false /* skip_throttles */,
                             base::nullopt /* error_page_content */,
@@ -1031,7 +1171,7 @@ void NavigationRequest::BeginNavigation() {
           LegacyProtocolInSubresourceCheckResult::BLOCK_REQUEST) {
     // Create a navigation handle so that the correct error code can be set on
     // it by OnRequestFailedInternal().
-    CreateNavigationHandle(false);
+    StartNavigation(false);
     OnRequestFailedInternal(
         network::URLLoaderCompletionStatus(net::ERR_ABORTED),
         false /* skip_throttles  */, base::nullopt /* error_page_content */,
@@ -1042,7 +1182,7 @@ void NavigationRequest::BeginNavigation() {
     return;
   }
 
-  CreateNavigationHandle(false);
+  StartNavigation(false);
 
   if (CheckAboutSrcDoc() == AboutSrcDocCheckResult::BLOCK_REQUEST) {
     OnRequestFailedInternal(
@@ -1054,11 +1194,12 @@ void NavigationRequest::BeginNavigation() {
     return;
   }
 
-  if (!error_page_html_.empty()) {
-    OnRequestFailedInternal(network::URLLoaderCompletionStatus(net_error_),
-                            true /* skip_throttles  */,
-                            error_page_html_ /* error_page_content */,
-                            false /* collapse_frame */);
+  if (!post_commit_error_page_html_.empty()) {
+    OnRequestFailedInternal(
+        network::URLLoaderCompletionStatus(net_error_),
+        true /* skip_throttles  */,
+        post_commit_error_page_html_ /* error_page_content */,
+        false /* collapse_frame */);
     // DO NOT ADD CODE after this. The previous call to OnRequestFailedInternal
     // has destroyed the NavigationRequest.
     return;
@@ -1067,7 +1208,7 @@ void NavigationRequest::BeginNavigation() {
   if (!NeedsUrlLoader()) {
     // The types of pages that don't need a URL Loader should never get served
     // from the BackForwardCache.
-    DCHECK(!is_served_from_back_forward_cache());
+    DCHECK(!IsServedFromBackForwardCache());
 
     // There is no need to make a network request for this navigation, so commit
     // it immediately.
@@ -1077,7 +1218,7 @@ void NavigationRequest::BeginNavigation() {
 
     // Select an appropriate RenderFrameHost.
     render_frame_host_ =
-        frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
+        frame_tree_node_->render_manager()->GetFrameHostForNavigation(this);
     NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(
         render_frame_host_, common_params_->url);
 
@@ -1088,15 +1229,14 @@ void NavigationRequest::BeginNavigation() {
 
   common_params_->previews_state =
       GetContentClient()->browser()->DetermineAllowedPreviews(
-          common_params_->previews_state, navigation_handle_.get(),
-          common_params_->url);
+          common_params_->previews_state, this, common_params_->url);
 
   // It's safe to use base::Unretained because this NavigationRequest owns
   // the NavigationHandle where the callback will be stored.
   // TODO(clamy): pass the method to the NavigationHandle instead of a
   // boolean.
-  WillStartRequest(base::Bind(&NavigationRequest::OnStartChecksComplete,
-                              base::Unretained(this)));
+  WillStartRequest(base::BindOnce(&NavigationRequest::OnStartChecksComplete,
+                                  base::Unretained(this)));
 }
 
 void NavigationRequest::SetWaitingForRendererResponse() {
@@ -1106,7 +1246,7 @@ void NavigationRequest::SetWaitingForRendererResponse() {
   state_ = WAITING_FOR_RENDERER_RESPONSE;
 }
 
-void NavigationRequest::CreateNavigationHandle(bool is_for_commit) {
+void NavigationRequest::StartNavigation(bool is_for_commit) {
   DCHECK(frame_tree_node_->navigation_request() == this || is_for_commit);
   FrameTreeNode* frame_tree_node = frame_tree_node_;
 
@@ -1119,7 +1259,6 @@ void NavigationRequest::CreateNavigationHandle(bool is_for_commit) {
   // starting SiteInstance.
   starting_site_instance_ =
       frame_tree_node->current_frame_host()->GetSiteInstance();
-
   site_url_ = GetSiteForCommonParamsURL();
 
   // Compute the redirect chain.
@@ -1162,34 +1301,26 @@ void NavigationRequest::CreateNavigationHandle(bool is_for_commit) {
         common_params_->url, *common_params_->referrer);
   }
 
-  handle_state_ = NavigationRequest::INITIAL;
+  DCHECK_EQ(handle_state_, NOT_CREATED);
+  handle_state_ = INITIAL;
   navigation_handle_id_ = CreateUniqueHandleID();
 
   request_headers_ = std::move(headers);
   modified_request_headers_.Clear();
   removed_request_headers_.clear();
-  std::unique_ptr<NavigationHandleImpl> navigation_handle =
-      base::WrapUnique(new NavigationHandleImpl(this));
-
-  if (!frame_tree_node->navigation_request() && !is_for_commit) {
-    // A callback could have cancelled this request synchronously in which case
-    // |this| is deleted.
-    return;
-  }
-
-  DCHECK(!navigation_handle_);
-  navigation_handle_ = std::move(navigation_handle);
-  TraceNavigationHandleStart();
 
-  throttle_runner_ = base::WrapUnique(
-      new NavigationThrottleRunner(this, navigation_handle_.get()));
+  // TODO(zetamoo): Refactor NavigationThrottleRunner to accept one argument.
+  throttle_runner_ = base::WrapUnique(new NavigationThrottleRunner(this, this));
 
 #if defined(OS_ANDROID)
-  navigation_handle_proxy_ =
-      std::make_unique<NavigationHandleProxy>(navigation_handle_.get());
+  navigation_handle_proxy_ = std::make_unique<NavigationHandleProxy>(this);
 #endif
 
-  GetDelegate()->DidStartNavigation(navigation_handle_.get());
+  TraceNavigationStart();
+  GetDelegate()->DidStartNavigation(this);
+
+  // The previous call to DidStartNavigation could have cancelled this request
+  // synchronously.
 }
 
 void NavigationRequest::ResetForCrossDocumentRestart() {
@@ -1207,12 +1338,16 @@ void NavigationRequest::ResetForCrossDocumentRestart() {
 
   // It is necessary to call DidFinishNavigation before resetting
   // |navigation_handle_proxy_|. See https://crbug.com/958396.
-  if (navigation_handle()) {
-    GetDelegate()->DidFinishNavigation(navigation_handle());
-    TraceNavigationHandleEnd();
-    navigation_handle_.reset();
+  if (IsNavigationStarted()) {
+    GetDelegate()->DidFinishNavigation(this);
+    TraceNavigationEnd();
   }
 
+  // Reset the states of the NavigationRequest.
+  StopCommitTimeout();
+  state_ = NOT_STARTED;
+  handle_state_ = NOT_CREATED;
+
 #if defined(OS_ANDROID)
   if (navigation_handle_proxy_)
     navigation_handle_proxy_.reset();
@@ -1224,18 +1359,8 @@ void NavigationRequest::ResetForCrossDocumentRestart() {
   render_frame_host_ = nullptr;
 
   // Convert the navigation type to the appropriate cross-document one.
-  if (common_params_->navigation_type ==
-      mojom::NavigationType::HISTORY_SAME_DOCUMENT) {
-    common_params_->navigation_type =
-        mojom::NavigationType::HISTORY_DIFFERENT_DOCUMENT;
-  } else {
-    DCHECK(common_params_->navigation_type ==
-           mojom::NavigationType::SAME_DOCUMENT);
-    common_params_->navigation_type = mojom::NavigationType::DIFFERENT_DOCUMENT;
-  }
-
-  // Reset the state of the NavigationRequest.
-  state_ = NOT_STARTED;
+  common_params_->navigation_type =
+      ConvertToCrossDocumentType(common_params_->navigation_type);
 }
 
 void NavigationRequest::RegisterSubresourceOverride(
@@ -1268,6 +1393,11 @@ void NavigationRequest::OnRequestRedirected(
   response_head_ = response_head;
   ssl_info_ = response_head->head.ssl_info;
   auth_challenge_info_ = response_head->head.auth_challenge_info;
+
+  // Reset the page state as it can no longer be used at commit time since the
+  // navigation was redirected.
+  commit_params_->page_state = PageState();
+
 #if defined(OS_ANDROID)
   base::WeakPtr<NavigationRequest> this_ptr(weak_factory_.GetWeakPtr());
 
@@ -1299,8 +1429,8 @@ void NavigationRequest::OnRequestRedirected(
     // (rather than passing the old URL).
     UpdateStateFollowingRedirect(
         GURL(redirect_info.new_referrer),
-        base::Bind(&NavigationRequest::OnRedirectChecksComplete,
-                   base::Unretained(this)));
+        base::BindOnce(&NavigationRequest::OnRedirectChecksComplete,
+                       base::Unretained(this)));
     frame_tree_node_->ResetNavigationRequest(false, true);
     return;
   }
@@ -1325,9 +1455,9 @@ void NavigationRequest::OnRequestRedirected(
   // For renderer-initiated navigations we need to check if the source has
   // access to the URL. Browser-initiated navigations only rely on the
   // |CanRedirectToURL| test above.
-  if (!browser_initiated_ && source_site_instance() &&
+  if (!browser_initiated_ && GetSourceSiteInstance() &&
       !ChildProcessSecurityPolicyImpl::GetInstance()->CanRequestURL(
-          source_site_instance()->GetProcess()->GetID(),
+          GetSourceSiteInstance()->GetProcess()->GetID(),
           redirect_info.new_url)) {
     DVLOG(1) << "Denied unauthorized redirect for "
              << redirect_info.new_url.possibly_invalid_spec();
@@ -1371,6 +1501,12 @@ void NavigationRequest::OnRequestRedirected(
   common_params_->referrer = Referrer::SanitizeForRequest(
       common_params_->url, *common_params_->referrer);
 
+  // On redirects, the initial referrer is no longer correct, so it must
+  // be updated.  (A parallel process updates the outgoing referrer in the
+  // network stack.)
+  commit_params_->redirect_infos.back().new_referrer =
+      common_params_->referrer->url.spec();
+
   // Check Content Security Policy before the NavigationThrottles run. This
   // gives CSP a chance to modify requests that NavigationThrottles would
   // otherwise block.
@@ -1408,7 +1544,7 @@ void NavigationRequest::OnRequestRedirected(
   // before the navigation is ready to commit.
   scoped_refptr<SiteInstance> site_instance =
       frame_tree_node_->render_manager()->GetSiteInstanceForNavigationRequest(
-          *this);
+          this);
   speculative_site_instance_ =
       site_instance->HasProcess() ? site_instance : nullptr;
 
@@ -1426,8 +1562,7 @@ void NavigationRequest::OnRequestRedirected(
   // created.
   common_params_->previews_state =
       GetContentClient()->browser()->DetermineAllowedPreviews(
-          common_params_->previews_state, navigation_handle_.get(),
-          common_params_->url);
+          common_params_->previews_state, this, common_params_->url);
 
   // Check what the process of the SiteInstance is. It will be passed to the
   // NavigationHandle, and informed to expect a navigation to the redirected
@@ -1440,9 +1575,10 @@ void NavigationRequest::OnRequestRedirected(
 
   // It's safe to use base::Unretained because this NavigationRequest owns the
   // NavigationHandle where the callback will be stored.
-  WillRedirectRequest(common_params_->referrer->url, expected_process,
-                      base::Bind(&NavigationRequest::OnRedirectChecksComplete,
-                                 base::Unretained(this)));
+  WillRedirectRequest(
+      common_params_->referrer->url, expected_process,
+      base::BindOnce(&NavigationRequest::OnRedirectChecksComplete,
+                     base::Unretained(this)));
 }
 
 void NavigationRequest::OnResponseStarted(
@@ -1540,14 +1676,15 @@ void NavigationRequest::OnResponseStarted(
   }
 
   // Select an appropriate renderer to commit the navigation.
-  if (is_served_from_back_forward_cache()) {
+  if (IsServedFromBackForwardCache()) {
     NavigationControllerImpl* controller =
         static_cast<NavigationControllerImpl*>(
             frame_tree_node_->navigator()->GetController());
-    render_frame_host_ =
-        controller->back_forward_cache().GetDocument(nav_entry_id_);
+    render_frame_host_ = controller->GetBackForwardCache()
+                             .GetEntry(nav_entry_id_)
+                             ->render_frame_host.get();
 
-    // The only time GetDocument can return nullptr here, is if the document was
+    // The only time GetEntry can return nullptr here, is if the document was
     // evicted from the BackForwardCache since this navigation started.
     //
     // If the document was evicted, the navigation should have been re-issued
@@ -1556,7 +1693,7 @@ void NavigationRequest::OnResponseStarted(
     CHECK(render_frame_host_);
   } else if (response_should_be_rendered_) {
     render_frame_host_ =
-        frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
+        frame_tree_node_->render_manager()->GetFrameHostForNavigation(this);
     NavigatorImpl::CheckWebUIRendererDoesNotDisplayNormalURL(
         render_frame_host_, common_params_->url);
   } else {
@@ -1587,7 +1724,7 @@ void NavigationRequest::OnResponseStarted(
   // Update the previews state of the request.
   common_params_->previews_state =
       GetContentClient()->browser()->DetermineCommittedPreviews(
-          common_params_->previews_state, navigation_handle_.get(),
+          common_params_->previews_state, this,
           response_head->head.headers.get());
 
   // Store the URLLoaderClient endpoints until checks have been processed.
@@ -1727,8 +1864,8 @@ void NavigationRequest::OnResponseStarted(
 
   // Check if the navigation should be allowed to proceed.
   WillProcessResponse(
-      base::Bind(&NavigationRequest::OnWillProcessResponseChecksComplete,
-                 base::Unretained(this)));
+      base::BindOnce(&NavigationRequest::OnWillProcessResponseChecksComplete,
+                     base::Unretained(this)));
 }
 
 void NavigationRequest::OnRequestFailed(
@@ -1756,7 +1893,7 @@ void NavigationRequest::OnRequestFailedInternal(
   // anymore from now while the error page is being loaded.
   loader_.reset();
 
-  common_params_->previews_state = content::PREVIEWS_OFF;
+  common_params_->previews_state = PREVIEWS_OFF;
   if (status.ssl_info.has_value())
     ssl_info_ = status.ssl_info;
 
@@ -1768,7 +1905,9 @@ void NavigationRequest::OnRequestFailedInternal(
                                "OnRequestFailed", "error", status.error_code);
   state_ = FAILED;
 
-  frame_tree_node_->navigator()->DiscardPendingEntryIfNeeded(nav_entry_id_);
+  // Ensure the pending entry also gets discarded if it has no other active
+  // requests.
+  pending_entry_ref_.reset();
 
   net_error_ = static_cast<net::Error>(status.error_code);
 
@@ -1798,13 +1937,13 @@ void NavigationRequest::OnRequestFailedInternal(
     // RenderFrameHost. See https://crbug.com/793127.
     ResetExpectedProcess();
     render_frame_host =
-        frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
+        frame_tree_node_->render_manager()->GetFrameHostForNavigation(this);
   } else {
     if (ShouldKeepErrorPageInCurrentProcess(status.error_code)) {
       render_frame_host = frame_tree_node_->current_frame_host();
     } else {
       render_frame_host =
-          frame_tree_node_->render_manager()->GetFrameHostForNavigation(*this);
+          frame_tree_node_->render_manager()->GetFrameHostForNavigation(this);
     }
   }
 
@@ -1953,25 +2092,39 @@ void NavigationRequest::OnStartChecksComplete(
   }
 
   // Initialize the BundledExchangesHandle.
-  if (GetContentClient()->browser()->CanAcceptUntrustedExchangesIfNeeded() &&
-      common_params_->url.SchemeIsFile() &&
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kTrustableBundledExchangesFile)) {
-    // Fast path for testing navigation to a trustable BundledExchanges source.
-    const base::FilePath specified_path =
-        base::CommandLine::ForCurrentProcess()->GetSwitchValuePath(
-            switches::kTrustableBundledExchangesFile);
-    base::FilePath url_path;
-    if (net::FileURLToFilePath(common_params_->url, &url_path) &&
-        url_path == specified_path) {
-      BundledExchangesSource source(specified_path);
-      source.is_trusted = true;
-      bundled_exchanges_handle_ =
-          std::make_unique<BundledExchangesHandle>(source);
+  if (bundled_exchanges_handle_tracker_) {
+    DCHECK(base::FeatureList::IsEnabled(features::kWebBundles) ||
+           base::CommandLine::ForCurrentProcess()->HasSwitch(
+               switches::kTrustableBundledExchangesFileUrl));
+    bundled_exchanges_handle_ =
+        bundled_exchanges_handle_tracker_->MaybeCreateBundledExchangesHandle(
+            common_params_->url, frame_tree_node_->frame_tree_node_id());
+  }
+  if (!bundled_exchanges_handle_ && bundled_exchanges_navigation_info_) {
+    DCHECK(base::FeatureList::IsEnabled(features::kWebBundles) ||
+           base::CommandLine::ForCurrentProcess()->HasSwitch(
+               switches::kTrustableBundledExchangesFileUrl));
+    bundled_exchanges_handle_ = BundledExchangesHandle::CreateForNavigationInfo(
+        bundled_exchanges_navigation_info_->Clone(),
+        frame_tree_node_->frame_tree_node_id());
+  }
+  if (!bundled_exchanges_handle_) {
+    if (bundled_exchanges_utils::CanLoadAsTrustableBundledExchangesFile(
+            common_params_->url)) {
+      auto source = BundledExchangesSource::MaybeCreateFromTrustedFileUrl(
+          common_params_->url);
+      // MaybeCreateFromTrustedFileUrl() returns null when the url contains an
+      // invalid character.
+      if (source) {
+        bundled_exchanges_handle_ =
+            BundledExchangesHandle::CreateForTrustableFile(
+                std::move(source), frame_tree_node_->frame_tree_node_id());
+      }
+    } else if (bundled_exchanges_utils::CanLoadAsBundledExchangesFile(
+                   common_params_->url)) {
+      bundled_exchanges_handle_ = BundledExchangesHandle::CreateForFile(
+          frame_tree_node_->frame_tree_node_id());
     }
-  } else if (base::FeatureList::IsEnabled(features::kBundledHTTPExchanges)) {
-    // Production path behind the feature flag.
-    bundled_exchanges_handle_ = std::make_unique<BundledExchangesHandle>();
   }
 
   // Mark the fetch_start (Navigation Timing API).
@@ -1998,17 +2151,6 @@ void NavigationRequest::OnStartChecksComplete(
       frame_tree_node_, begin_params_.get(), &report_raw_headers);
   devtools_instrumentation::OnNavigationRequestWillBeSent(*this);
 
-  // If this is a top-frame navigation, then use the origin of the url (and
-  // update it as redirects happen). If this is a sub-frame navigation, get the
-  // URL from the top frame.
-  // TODO(crbug.com/979296): Consider changing this code to copy an origin
-  // instead of creating one from a URL which lacks opacity information.
-  url::Origin frame_origin = url::Origin::Create(common_params_->url);
-  url::Origin top_frame_origin =
-      frame_tree_node_->IsMainFrame()
-          ? frame_origin
-          : frame_tree_node_->frame_tree()->root()->current_origin();
-
   // Merge headers with embedder's headers.
   net::HttpRequestHeaders headers;
   headers.AddHeadersFromString(begin_params_->headers);
@@ -2019,14 +2161,13 @@ void NavigationRequest::OnStartChecksComplete(
   // ResourceRequest directly here.
   std::vector<std::unique_ptr<NavigationLoaderInterceptor>> interceptor;
   if (bundled_exchanges_handle_)
-    interceptor.push_back(bundled_exchanges_handle_->CreateInterceptor());
+    interceptor.push_back(bundled_exchanges_handle_->TakeInterceptor());
   loader_ = NavigationURLLoader::Create(
       browser_context, partition,
       std::make_unique<NavigationRequestInfo>(
           common_params_->Clone(), begin_params_.Clone(), site_for_cookies,
-          net::NetworkIsolationKey(top_frame_origin, frame_origin),
-          frame_tree_node_->IsMainFrame(), parent_is_main_frame,
-          IsSecureFrame(frame_tree_node_->parent()),
+          GetNetworkIsolationKey(), frame_tree_node_->IsMainFrame(),
+          parent_is_main_frame, IsSecureFrame(frame_tree_node_->parent()),
           frame_tree_node_->frame_tree_node_id(), is_for_guests_only,
           report_raw_headers,
           navigating_frame_host->GetVisibilityState() ==
@@ -2038,7 +2179,7 @@ void NavigationRequest::OnStartChecksComplete(
           OriginPolicyThrottle::ShouldRequestOriginPolicy(common_params_->url)),
       std::move(navigation_ui_data), service_worker_handle_.get(),
       appcache_handle_.get(), std::move(prefetched_signed_exchange_cache_),
-      this, is_served_from_back_forward_cache(), std::move(interceptor));
+      this, IsServedFromBackForwardCache(), std::move(interceptor));
 
   DCHECK(!render_frame_host_);
 }
@@ -2230,6 +2371,14 @@ void NavigationRequest::OnWillProcessResponseChecksComplete(
 void NavigationRequest::CommitErrorPage(
     const base::Optional<std::string>& error_page_content) {
   UpdateCommitNavigationParamsHistory();
+
+  // Error pages are always cross-document.
+  //
+  // This is useful when a same-document navigation is blocked and commit an
+  // error page instead. See https://crbug.com/1018385.
+  common_params_->navigation_type =
+      ConvertToCrossDocumentType(common_params_->navigation_type);
+
   frame_tree_node_->TransferNavigationRequestOwnership(render_frame_host_);
   // Error pages commit in an opaque origin in the renderer process. If this
   // NavigationRequest resulted in committing an error page, set
@@ -2237,7 +2386,7 @@ void NavigationRequest::CommitErrorPage(
   // consistent with the URL being requested.
   commit_params_->origin_to_commit =
       url::Origin::Create(common_params_->url).DeriveNewOpaqueOrigin();
-  if (IsPerNavigationMojoInterfaceEnabled() && request_navigation_client_ &&
+  if (IsPerNavigationMojoInterfaceEnabled() &&
       request_navigation_client_.is_bound()) {
     if (associated_site_instance_id_ ==
         render_frame_host_->GetSiteInstance()->GetId()) {
@@ -2264,35 +2413,36 @@ void NavigationRequest::CommitNavigation() {
   DCHECK(!common_params_->url.SchemeIs(url::kJavaScriptScheme));
   DCHECK(!IsRendererDebugURL(common_params_->url));
 
-  if (is_served_from_back_forward_cache()) {
+  if (IsServedFromBackForwardCache()) {
     NavigationControllerImpl* controller =
         static_cast<NavigationControllerImpl*>(
             frame_tree_node_->navigator()->GetController());
 
-    std::unique_ptr<RenderFrameHostImpl> restored_rfh =
-        controller->back_forward_cache().RestoreDocument(nav_entry_id_);
+    std::unique_ptr<BackForwardCacheImpl::Entry> restored_bfcache_entry =
+        controller->GetBackForwardCache().RestoreEntry(nav_entry_id_);
 
-    // The only time restored_rfh can be nullptr here, is if the
+    // The only time restored_bfcache_entry can be nullptr here, is if the
     // document was evicted from the BackForwardCache since this navigation
     // started.
     //
     // If the document was evicted, it should have re-issued the navigation
     // (deleting this NavigationRequest), so we should never reach this point
     // without the document still present in the BackForwardCache.
-    CHECK(restored_rfh);
+    CHECK(restored_bfcache_entry);
 
     // Transfer ownership of this NavigationRequest to the restored
     // RenderFrameHost.
-    frame_tree_node_->TransferNavigationRequestOwnership(render_frame_host());
+    frame_tree_node_->TransferNavigationRequestOwnership(GetRenderFrameHost());
 
-    // Move the restored RenderFrameHost into RenderFrameHostManager, in
+    // Move the restored BackForwardCache Entry into RenderFrameHostManager, in
     // preparation for committing.
     frame_tree_node_->render_manager()->RestoreFromBackForwardCache(
-        std::move(restored_rfh));
+        std::move(restored_bfcache_entry));
 
-    // Commit the restored RenderFrameHost.
+    // Commit the restored BackForwardCache Entry. This includes committing the
+    // RenderFrameHost and restoring extra state, such as proxies, etc.
     // Note that this will delete the NavigationRequest.
-    render_frame_host()->DidCommitBackForwardCacheNavigation(
+    GetRenderFrameHost()->DidCommitBackForwardCacheNavigation(
         this, MakeDidCommitProvisionalLoadParamsForBFCache());
 
     return;
@@ -2305,7 +2455,7 @@ void NavigationRequest::CommitNavigation() {
 
   frame_tree_node_->TransferNavigationRequestOwnership(render_frame_host_);
 
-  if (IsPerNavigationMojoInterfaceEnabled() && request_navigation_client_ &&
+  if (IsPerNavigationMojoInterfaceEnabled() &&
       request_navigation_client_.is_bound()) {
     if (associated_site_instance_id_ ==
         render_frame_host_->GetSiteInstance()->GetId()) {
@@ -2328,8 +2478,18 @@ void NavigationRequest::CommitNavigation() {
         render_frame_host_->GetProcess()->GetID(),
         render_frame_host_->GetRoutingID(), &service_worker_provider_info);
   }
+
+  if (bundled_exchanges_handle_ &&
+      bundled_exchanges_handle_->navigation_info()) {
+    bundled_exchanges_navigation_info_ =
+        bundled_exchanges_handle_->navigation_info()->Clone();
+  }
+
   auto common_params = common_params_->Clone();
   auto commit_params = commit_params_.Clone();
+  network::mojom::URLResponseHeadPtr response_head;
+  if (response_head_)
+    response_head = response_head_->head;
   if (subresource_loader_params_ &&
       !subresource_loader_params_->prefetched_signed_exchanges.empty()) {
     commit_params->prefetched_signed_exchanges =
@@ -2339,7 +2499,7 @@ void NavigationRequest::CommitNavigation() {
   AddNetworkServiceDebugEvent("COM");
   render_frame_host_->CommitNavigation(
       this, std::move(common_params), std::move(commit_params),
-      response_head_.get(), std::move(response_body_),
+      std::move(response_head), std::move(response_body_),
       std::move(url_loader_client_endpoints_), is_view_source_,
       std::move(subresource_loader_params_), std::move(subresource_overrides_),
       std::move(service_worker_provider_info), devtools_navigation_token_,
@@ -2660,22 +2820,20 @@ void NavigationRequest::OnRendererAbortedNavigation() {
 }
 
 void NavigationRequest::HandleInterfaceDisconnection(
-    mojom::NavigationClientAssociatedPtr* navigation_client,
+    mojo::AssociatedRemote<mojom::NavigationClient>* navigation_client,
     base::OnceClosure error_handler) {
-  navigation_client->set_connection_error_handler(std::move(error_handler));
+  navigation_client->set_disconnect_handler(std::move(error_handler));
 }
 
 void NavigationRequest::IgnoreInterfaceDisconnection() {
-  return request_navigation_client_.set_connection_error_handler(
-      base::DoNothing());
+  return request_navigation_client_.set_disconnect_handler(base::DoNothing());
 }
 
 void NavigationRequest::IgnoreCommitInterfaceDisconnection() {
-  return commit_navigation_client_.set_connection_error_handler(
-      base::DoNothing());
+  return commit_navigation_client_.set_disconnect_handler(base::DoNothing());
 }
 
-bool NavigationRequest::IsSameDocument() const {
+bool NavigationRequest::IsSameDocument() {
   return NavigationTypeUtils::IsSameDocument(common_params_->navigation_type);
 }
 
@@ -2700,7 +2858,7 @@ int NavigationRequest::EstimateHistoryOffset() {
 
 void NavigationRequest::RecordDownloadUseCountersPrePolicyCheck(
     NavigationDownloadPolicy download_policy) {
-  content::RenderFrameHost* rfh = frame_tree_node_->current_frame_host();
+  RenderFrameHost* rfh = frame_tree_node_->current_frame_host();
   GetContentClient()->browser()->LogWebFeatureForCurrentPage(
       rfh, blink::mojom::WebFeature::kDownloadPrePolicyCheck);
 
@@ -2750,7 +2908,7 @@ void NavigationRequest::RecordDownloadUseCountersPrePolicyCheck(
 
 void NavigationRequest::RecordDownloadUseCountersPostPolicyCheck() {
   DCHECK(is_download_);
-  content::RenderFrameHost* rfh = frame_tree_node_->current_frame_host();
+  RenderFrameHost* rfh = frame_tree_node_->current_frame_host();
   GetContentClient()->browser()->LogWebFeatureForCurrentPage(
       rfh, blink::mojom::WebFeature::kDownloadPostPolicyCheck);
 }
@@ -2801,7 +2959,7 @@ void NavigationRequest::OnWillRedirectRequestProcessed(
 
     // Notify the delegate that a redirect was encountered and will be followed.
     if (GetDelegate())
-      GetDelegate()->DidRedirectNavigation(navigation_handle_.get());
+      GetDelegate()->DidRedirectNavigation(this);
   } else {
     handle_state_ = NavigationRequest::CANCELING;
   }
@@ -2928,8 +3086,7 @@ void NavigationRequest::WillStartRequest(
   // If the content/ embedder did not pass the NavigationUIData at the beginning
   // of the navigation, ask for it now.
   if (!navigation_ui_data_) {
-    navigation_ui_data_ =
-        GetDelegate()->GetNavigationUIData(navigation_handle_.get());
+    navigation_ui_data_ = GetDelegate()->GetNavigationUIData(this);
   }
 
   // Notify each throttle of the request.
@@ -3040,13 +3197,11 @@ void NavigationRequest::DidCommitNavigation(
   // count it as an error page.
   if (params.base_url.spec() == kUnreachableWebDataURL ||
       net_error_ != net::OK) {
-    TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationHandle",
-                                 navigation_handle_.get(),
+    TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationHandle", this,
                                  "DidCommitNavigation: error page");
     handle_state_ = DID_COMMIT_ERROR_PAGE;
   } else {
-    TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationHandle",
-                                 navigation_handle_.get(),
+    TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationHandle", this,
                                  "DidCommitNavigation");
     handle_state_ = DID_COMMIT;
   }
@@ -3089,6 +3244,24 @@ GURL NavigationRequest::GetSiteForCommonParamsURL() const {
       starting_site_instance_->GetIsolationContext(), common_params_->url);
 }
 
+net::NetworkIsolationKey NavigationRequest::GetNetworkIsolationKey() const {
+  if (network_isolation_key_)
+    return network_isolation_key_.value();
+
+  // If this is a top-frame navigation, then use the origin of the url (and
+  // update it as redirects happen). If this is a subframe navigation, get the
+  // URL from the top frame.
+  // TODO(crbug.com/979296): Consider changing this code to copy an origin
+  // instead of creating one from a URL which lacks opacity information.
+  url::Origin frame_origin = url::Origin::Create(common_params_->url);
+  url::Origin top_frame_origin =
+      frame_tree_node_->IsMainFrame()
+          ? frame_origin
+          : frame_tree_node_->frame_tree()->root()->current_origin();
+
+  return net::NetworkIsolationKey(top_frame_origin, frame_origin);
+}
+
 // TODO(zetamoo): Try to merge this function inside its callers.
 void NavigationRequest::UpdateStateFollowingRedirect(
     const GURL& new_referrer_url,
@@ -3107,6 +3280,8 @@ void NavigationRequest::UpdateStateFollowingRedirect(
         Referrer::SanitizeForRequest(common_params_->url, *sanitized_referrer_);
   }
 
+  common_params_->referrer = sanitized_referrer_.Clone();
+
   was_redirected_ = true;
   redirect_chain_.push_back(common_params_->url);
 
@@ -3120,7 +3295,7 @@ void NavigationRequest::UpdateStateFollowingRedirect(
 }
 
 void NavigationRequest::SetNavigationClient(
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     int32_t associated_site_instance_id) {
   DCHECK(from_begin_navigation_ ||
          common_params_->is_history_navigation_in_new_child_frame);
@@ -3128,7 +3303,7 @@ void NavigationRequest::SetNavigationClient(
   if (!navigation_client.is_valid())
     return;
 
-  request_navigation_client_ = mojom::NavigationClientAssociatedPtr();
+  request_navigation_client_.reset();
   request_navigation_client_.Bind(std::move(navigation_client));
 
   // Binds the OnAbort callback
@@ -3139,7 +3314,7 @@ void NavigationRequest::SetNavigationClient(
   associated_site_instance_id_ = associated_site_instance_id;
 }
 
-bool NavigationRequest::NeedsUrlLoader() const {
+bool NavigationRequest::NeedsUrlLoader() {
   return IsURLHandledByNetworkStack(common_params_->url) && !IsSameDocument() &&
          !IsForMhtmlSubframe();
 }
@@ -3157,7 +3332,7 @@ void NavigationRequest::ReadyToCommitNavigation(bool is_error) {
 
   // https://wicg.github.io/cors-rfc1918/#address-space
   commit_params_->ip_address_space = CalculateIPAddressSpace(
-      navigation_handle()->GetSocketAddress().address(),
+      GetSocketAddress().address(),
       response_head_ ? response_head_->head.headers.get() : nullptr);
 
   if (appcache_handle_) {
@@ -3181,7 +3356,7 @@ void NavigationRequest::ReadyToCommitNavigation(bool is_error) {
   SetExpectedProcess(render_frame_host_->GetProcess());
 
   if (!IsSameDocument())
-    GetDelegate()->ReadyToCommitNavigation(navigation_handle_.get());
+    GetDelegate()->ReadyToCommitNavigation(this);
 }
 
 std::unique_ptr<AppCacheNavigationHandle>
@@ -3220,7 +3395,7 @@ void NavigationRequest::RenderProcessBlockedStateChanged(bool blocked) {
 void NavigationRequest::StopCommitTimeout() {
   commit_timeout_timer_.Stop();
   render_process_blocked_state_changed_subscription_.reset();
-  render_frame_host()->GetRenderWidgetHost()->RendererIsResponsive();
+  GetRenderFrameHost()->GetRenderWidgetHost()->RendererIsResponsive();
 }
 
 void NavigationRequest::RestartCommitTimeout() {
@@ -3229,7 +3404,7 @@ void NavigationRequest::RestartCommitTimeout() {
     return;
 
   RenderProcessHost* renderer_host =
-      render_frame_host()->GetRenderWidgetHost()->GetProcess();
+      GetRenderFrameHost()->GetRenderWidgetHost()->GetProcess();
   if (!render_process_blocked_state_changed_subscription_) {
     render_process_blocked_state_changed_subscription_ =
         renderer_host->RegisterBlockStateChangedCallback(base::BindRepeating(
@@ -3303,14 +3478,14 @@ void NavigationRequest::OnCommitTimeout() {
         last_crash_time);
   }
   UMA_HISTOGRAM_BOOLEAN("Navigation.CommitTimeout.IsRendererProcessReady",
-                        render_frame_host()->GetProcess()->IsReady());
+                        GetRenderFrameHost()->GetProcess()->IsReady());
   UMA_HISTOGRAM_ENUMERATION("Navigation.CommitTimeout.Scheme",
                             GetScheme(common_params_->url));
   UMA_HISTOGRAM_BOOLEAN("Navigation.CommitTimeout.IsMainFrame",
                         frame_tree_node_->IsMainFrame());
   base::UmaHistogramSparse("Navigation.CommitTimeout.ErrorCode", -net_error_);
   render_process_blocked_state_changed_subscription_.reset();
-  render_frame_host()->GetRenderWidgetHost()->RendererIsUnresponsive(
+  GetRenderFrameHost()->GetRenderWidgetHost()->RendererIsUnresponsive(
       base::BindRepeating(&NavigationRequest::RestartCommitTimeout,
                           weak_factory_.GetWeakPtr()));
 }
@@ -3348,40 +3523,37 @@ const net::HttpResponseHeaders* NavigationRequest::GetResponseHeaders() {
 
 std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
 NavigationRequest::MakeDidCommitProvisionalLoadParamsForBFCache() {
-  // TODO(lowell): Review all of these parameters for completeness.
+  // Use the DidCommitProvisionalLoad_Params last used to commit the frame
+  // being restored as a starting point.
   std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params> params =
-      std::make_unique<FrameHostMsg_DidCommitProvisionalLoad_Params>();
-  params->http_status_code = net::HTTP_OK;
-  params->method = common_params().method;
+      render_frame_host_->TakeLastCommitParams();
+
+  // Params must have been set when the RFH being restored from the cache last
+  // navigated.
+  CHECK(params);
+
+  DCHECK_EQ(params->http_status_code, net::HTTP_OK);
+  DCHECK_EQ(params->url_is_unreachable, false);
+
   params->intended_as_new_entry = commit_params().intended_as_new_entry;
   params->should_replace_current_entry =
       common_params().should_replace_current_entry;
-  params->post_id = -1;
+  DCHECK_EQ(params->post_id, -1);
   params->nav_entry_id = commit_params().nav_entry_id;
   params->navigation_token = commit_params().navigation_token;
-  params->transition = common_params().transition;
-
-  // TODO(lowell): Is there a way to get access to the the values needed to set
-  // the insecure_request_policy, etc?
-
-  params->url = common_params().url;
+  params->did_create_new_entry = false;
+  DCHECK_EQ(params->origin, commit_params().origin_to_commit.value());
+  DCHECK_EQ(params->url, common_params().url);
+  params->should_update_history = true;
   params->gesture = common_params().has_user_gesture ? NavigationGestureUser
                                                      : NavigationGestureAuto;
   params->page_state = commit_params().page_state;
-
-  params->should_update_history = true;
-
-  if (commit_params().origin_to_commit.has_value()) {
-    params->origin = commit_params().origin_to_commit.value();
-  }
-
+  DCHECK_EQ(params->method, common_params().method);
   params->item_sequence_number = frame_entry_item_sequence_number_;
   params->document_sequence_number = frame_entry_document_sequence_number_;
-
-  // TODO(lowell): Set the actual response mime type from FrameNavigationEntry.
-  params->contents_mime_type = "text/html";
-
-  params->request_id = request_id().request_id;
+  params->transition = common_params().transition;
+  params->history_list_was_cleared = false;
+  params->request_id = GetGlobalRequestID().request_id;
 
   return params;
 }
@@ -3441,37 +3613,253 @@ bool NavigationRequest::HasPrefetchedAlternativeSubresourceSignedExchange() {
   return !commit_params_->prefetched_signed_exchanges.empty();
 }
 
-void NavigationRequest::TraceNavigationHandleStart() {
-  DCHECK(navigation_handle_);
-  TRACE_EVENT_ASYNC_BEGIN2("navigation", "NavigationHandle",
-                           navigation_handle_.get(), "frame_tree_node",
-                           GetFrameTreeNodeId(), "url",
+void NavigationRequest::TraceNavigationStart() {
+  TRACE_EVENT_ASYNC_BEGIN2("navigation", "NavigationRequest", this,
+                           "frame_tree_node", GetFrameTreeNodeId(), "url",
                            common_params_->url.possibly_invalid_spec());
   DCHECK(!common_params_->navigation_start.is_null());
   DCHECK(!IsRendererDebugURL(common_params_->url));
 
   if (IsInMainFrame()) {
     TRACE_EVENT_ASYNC_BEGIN_WITH_TIMESTAMP1(
-        "navigation", "Navigation StartToCommit", navigation_handle_.get(),
+        "navigation", "Navigation StartToCommit", this,
         common_params_->navigation_start, "Initial URL",
         common_params_->url.spec());
   }
 
   if (IsSameDocument()) {
-    TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationHandle",
-                                 navigation_handle_.get(), "Same document");
+    TRACE_EVENT_ASYNC_STEP_INTO0("navigation", "NavigationRequest", this,
+                                 "Same document");
   }
 }
 
-void NavigationRequest::TraceNavigationHandleEnd() {
-  DCHECK(navigation_handle_);
+void NavigationRequest::TraceNavigationEnd() {
+  DCHECK(IsNavigationStarted());
   if (IsInMainFrame()) {
-    TRACE_EVENT_ASYNC_END2(
-        "navigation", "Navigation StartToCommit", navigation_handle_.get(),
-        "URL", common_params_->url.spec(), "Net Error Code", net_error_);
+    TRACE_EVENT_ASYNC_END2("navigation", "Navigation StartToCommit", this,
+                           "URL", common_params_->url.spec(), "Net Error Code",
+                           net_error_);
   }
-  TRACE_EVENT_ASYNC_END0("navigation", "NavigationHandle",
-                         navigation_handle_.get());
+  TRACE_EVENT_ASYNC_END0("navigation", "NavigationRequest", this);
+}
+
+int64_t NavigationRequest::GetNavigationId() {
+  return navigation_handle_id_;
+}
+
+const GURL& NavigationRequest::GetURL() {
+  return common_params().url;
+}
+
+SiteInstanceImpl* NavigationRequest::GetStartingSiteInstance() {
+  return starting_site_instance_.get();
+}
+
+SiteInstanceImpl* NavigationRequest::GetSourceSiteInstance() {
+  return source_site_instance_.get();
+}
+
+bool NavigationRequest::IsRendererInitiated() {
+  return !browser_initiated_;
+}
+
+bool NavigationRequest::WasServerRedirect() {
+  return was_redirected_;
+}
+
+const std::vector<GURL>& NavigationRequest::GetRedirectChain() {
+  return redirect_chain_;
+}
+
+base::TimeTicks NavigationRequest::NavigationStart() {
+  return common_params().navigation_start;
+}
+
+base::TimeTicks NavigationRequest::NavigationInputStart() {
+  return common_params().input_start;
+}
+
+bool NavigationRequest::IsPost() {
+  return common_params().method == "POST";
+}
+
+const blink::mojom::Referrer& NavigationRequest::GetReferrer() {
+  return *sanitized_referrer_;
+}
+
+bool NavigationRequest::HasUserGesture() {
+  return common_params().has_user_gesture;
+}
+
+ui::PageTransition NavigationRequest::GetPageTransition() {
+  return common_params().transition;
+}
+
+NavigationUIData* NavigationRequest::GetNavigationUIData() {
+  return navigation_ui_data_.get();
+}
+
+net::Error NavigationRequest::GetNetErrorCode() {
+  return net_error_;
+}
+
+// The RenderFrameHost that will commit the navigation or an error page.
+// This is computed when the response is received, or when the navigation
+// fails and error page should be displayed.
+RenderFrameHostImpl* NavigationRequest::GetRenderFrameHost() {
+  // Only allow the RenderFrameHost to be retrieved once it has been set for
+  // this navigation. This will happens either at WillProcessResponse time for
+  // regular navigations or at WillFailRequest time for error pages.
+  CHECK_GE(handle_state_, PROCESSING_WILL_FAIL_REQUEST)
+      << "This accessor should only be called after a RenderFrameHost has "
+         "been picked for this navigation.";
+  static_assert(WILL_FAIL_REQUEST < WILL_PROCESS_RESPONSE,
+                "WillFailRequest state should come before WillProcessResponse");
+  return render_frame_host_;
+}
+
+const net::HttpRequestHeaders& NavigationRequest::GetRequestHeaders() {
+  return request_headers_;
+}
+
+const base::Optional<net::SSLInfo>& NavigationRequest::GetSSLInfo() {
+  return ssl_info_;
+}
+
+const base::Optional<net::AuthChallengeInfo>&
+NavigationRequest::GetAuthChallengeInfo() {
+  return auth_challenge_info_;
+}
+
+bool NavigationRequest::HasSubframeNavigationEntryCommitted() {
+  DCHECK(!frame_tree_node_->IsMainFrame());
+  DCHECK(handle_state_ == DID_COMMIT || handle_state_ == DID_COMMIT_ERROR_PAGE);
+  return subframe_entry_committed_;
 }
 
+bool NavigationRequest::DidReplaceEntry() {
+  DCHECK(handle_state_ == DID_COMMIT || handle_state_ == DID_COMMIT_ERROR_PAGE);
+  return did_replace_entry_;
+}
+
+bool NavigationRequest::ShouldUpdateHistory() {
+  DCHECK(handle_state_ == DID_COMMIT || handle_state_ == DID_COMMIT_ERROR_PAGE);
+  return should_update_history_;
+}
+
+const GURL& NavigationRequest::GetPreviousURL() {
+  DCHECK(handle_state_ == DID_COMMIT || handle_state_ == DID_COMMIT_ERROR_PAGE);
+  return previous_url_;
+}
+
+bool NavigationRequest::WasStartedFromContextMenu() {
+  return common_params().started_from_context_menu;
+}
+
+const GURL& NavigationRequest::GetSearchableFormURL() {
+  return begin_params()->searchable_form_url;
+}
+
+const std::string& NavigationRequest::GetSearchableFormEncoding() {
+  return begin_params()->searchable_form_encoding;
+}
+
+ReloadType NavigationRequest::GetReloadType() {
+  return reload_type_;
+}
+
+RestoreType NavigationRequest::GetRestoreType() {
+  return restore_type_;
+}
+
+const GURL& NavigationRequest::GetBaseURLForDataURL() {
+  return common_params().base_url_for_data_url;
+}
+
+const GlobalRequestID& NavigationRequest::GetGlobalRequestID() {
+  DCHECK_GE(handle_state_, PROCESSING_WILL_PROCESS_RESPONSE);
+  return request_id_;
+}
+
+bool NavigationRequest::IsDownload() {
+  return is_download_;
+}
+
+bool NavigationRequest::IsFormSubmission() {
+  return begin_params()->is_form_submission;
+}
+
+bool NavigationRequest::WasInitiatedByLinkClick() {
+  return begin_params()->was_initiated_by_link_click;
+}
+
+const std::string& NavigationRequest::GetHrefTranslate() {
+  return common_params().href_translate;
+}
+
+const base::Optional<url::Origin>& NavigationRequest::GetInitiatorOrigin() {
+  return common_params().initiator_origin;
+}
+
+bool NavigationRequest::IsSameProcess() {
+  return is_same_process_;
+}
+
+int NavigationRequest::GetNavigationEntryOffset() {
+  return navigation_entry_offset_;
+}
+
+bool NavigationRequest::FromDownloadCrossOriginRedirect() {
+  return from_download_cross_origin_redirect_;
+}
+
+const net::ProxyServer& NavigationRequest::GetProxyServer() {
+  return proxy_server_;
+}
+
+GlobalFrameRoutingId NavigationRequest::GetPreviousRenderFrameHostId() {
+  return previous_render_frame_host_id_;
+}
+
+bool NavigationRequest::IsServedFromBackForwardCache() {
+  return rfh_restored_from_back_forward_cache_ != nullptr;
+}
+
+// static
+NavigationRequest* NavigationRequest::From(NavigationHandle* handle) {
+  return static_cast<NavigationRequest*>(handle);
+}
+
+bool NavigationRequest::IsNavigationStarted() const {
+  return handle_state_ >= INITIAL;
+}
+
+void NavigationRequest::DropPendingEntryRef() {
+  pending_entry_ref_.reset();
+}
+
+bool NavigationRequest::RequiresSourceSiteInstance() const {
+  // TODO(acolwell): Include about:blank as part of this check. This will
+  // require fixing |source_site_instance_| setting logic and code that
+  // constructs NavigationRequests.
+  return (common_params_->url.SchemeIs(url::kDataScheme)) &&
+         !dest_site_instance_ && common_params_->initiator_origin &&
+         !common_params_->initiator_origin->GetTupleOrPrecursorTupleIfOpaque()
+              .IsInvalid();
+}
+
+void NavigationRequest::SetSourceSiteInstanceToInitiatorIfNeeded() {
+  if (source_site_instance_ || !RequiresSourceSiteInstance() ||
+      !common_params_->initiator_origin.has_value()) {
+    return;
+  }
+
+  const auto tuple =
+      common_params_->initiator_origin->GetTupleOrPrecursorTupleIfOpaque();
+  source_site_instance_ = static_cast<SiteInstanceImpl*>(
+      frame_tree_node_->current_frame_host()
+          ->GetSiteInstance()
+          ->GetRelatedSiteInstance(tuple.GetURL())
+          .get());
+}
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigation_request.h b/chromium/content/browser/frame_host/navigation_request.h
index b8060514fa6..f0d2529b629 100644
--- a/chromium/content/browser/frame_host/navigation_request.h
+++ b/chromium/content/browser/frame_host/navigation_request.h
@@ -17,6 +17,7 @@
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "build/build_config.h"
+#include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
 #include "content/browser/frame_host/navigation_throttle_runner.h"
 #include "content/browser/initiator_csp_context.h"
@@ -26,10 +27,14 @@
 #include "content/common/content_export.h"
 #include "content/common/navigation_params.h"
 #include "content/common/navigation_params.mojom.h"
+#include "content/public/browser/global_routing_id.h"
+#include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/navigation_type.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/common/previews_state.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/proxy_server.h"
@@ -43,16 +48,17 @@
 namespace network {
 class ResourceRequestBody;
 struct URLLoaderCompletionStatus;
-}
+}  // namespace network
 
 struct FrameHostMsg_DidCommitProvisionalLoad_Params;
 
 namespace content {
 
 class AppCacheNavigationHandle;
+class BundledExchangesHandleTracker;
+class BundledExchangesNavigationInfo;
 class FrameNavigationEntry;
 class FrameTreeNode;
-class NavigationHandleImpl;
 class NavigationURLLoader;
 class NavigationUIData;
 class NavigatorDelegate;
@@ -66,7 +72,8 @@ struct SubresourceLoaderParams;
 // ResourceDispatcherHost (that lives on the IO thread).
 // TODO(clamy): Describe the interactions between the UI and IO thread during
 // the navigation following its refactoring.
-class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
+class CONTENT_EXPORT NavigationRequest : public NavigationHandle,
+                                         public NavigationURLLoaderDelegate,
                                          NavigationThrottleRunner::Delegate,
                                          private RenderProcessHostObserver {
  public:
@@ -80,7 +87,8 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
     // request is created, this stage is skipped.
     WAITING_FOR_RENDERER_RESPONSE,
 
-    // The request was sent to the IO thread.
+    // The request was sent to the IO thread and the NavigatorDelegate has been
+    // notified.
     STARTED,
 
     // The response started on the IO thread and is ready to be committed. This
@@ -156,11 +164,13 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
       int current_history_list_length,
       bool override_user_agent,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      mojom::NavigationClientAssociatedPtrInfo navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>
           navigation_initiator,
       scoped_refptr<PrefetchedSignedExchangeCache>
-          prefetched_signed_exchange_cache);
+          prefetched_signed_exchange_cache,
+      std::unique_ptr<BundledExchangesHandleTracker>
+          bundled_exchanges_handle_tracker);
 
   // Creates a request at commit time. This should only be used for
   // renderer-initiated same-document navigations, and navigations whose
@@ -175,8 +185,75 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
       bool is_renderer_initiated,
       bool is_same_document);
 
+  static NavigationRequest* From(NavigationHandle* handle);
+
   ~NavigationRequest() override;
 
+  // NavigationHandle implementation:
+  int64_t GetNavigationId() override;
+  const GURL& GetURL() override;
+  SiteInstanceImpl* GetStartingSiteInstance() override;
+  SiteInstanceImpl* GetSourceSiteInstance() override;
+  bool IsInMainFrame() override;
+  bool IsParentMainFrame() override;
+  bool IsRendererInitiated() override;
+  bool WasServerRedirect() override;
+  const std::vector<GURL>& GetRedirectChain() override;
+  int GetFrameTreeNodeId() override;
+  RenderFrameHostImpl* GetParentFrame() override;
+  base::TimeTicks NavigationStart() override;
+  base::TimeTicks NavigationInputStart() override;
+  bool IsPost() override;
+  const blink::mojom::Referrer& GetReferrer() override;
+  bool HasUserGesture() override;
+  ui::PageTransition GetPageTransition() override;
+  NavigationUIData* GetNavigationUIData() override;
+  bool IsExternalProtocol() override;
+  net::Error GetNetErrorCode() override;
+  RenderFrameHostImpl* GetRenderFrameHost() override;
+  bool IsSameDocument() override;
+  bool HasCommitted() override;
+  bool IsErrorPage() override;
+  bool HasSubframeNavigationEntryCommitted() override;
+  bool DidReplaceEntry() override;
+  bool ShouldUpdateHistory() override;
+  const GURL& GetPreviousURL() override;
+  net::IPEndPoint GetSocketAddress() override;
+  const net::HttpRequestHeaders& GetRequestHeaders() override;
+  void RemoveRequestHeader(const std::string& header_name) override;
+  void SetRequestHeader(const std::string& header_name,
+                        const std::string& header_value) override;
+  const net::HttpResponseHeaders* GetResponseHeaders() override;
+  net::HttpResponseInfo::ConnectionInfo GetConnectionInfo() override;
+  const base::Optional<net::SSLInfo>& GetSSLInfo() override;
+  const base::Optional<net::AuthChallengeInfo>& GetAuthChallengeInfo() override;
+  void RegisterThrottleForTesting(
+      std::unique_ptr<NavigationThrottle> navigation_throttle) override;
+  bool IsDeferredForTesting() override;
+  bool WasStartedFromContextMenu() override;
+  const GURL& GetSearchableFormURL() override;
+  const std::string& GetSearchableFormEncoding() override;
+  ReloadType GetReloadType() override;
+  RestoreType GetRestoreType() override;
+  const GURL& GetBaseURLForDataURL() override;
+  const GlobalRequestID& GetGlobalRequestID() override;
+  bool IsDownload() override;
+  bool IsFormSubmission() override;
+  bool WasInitiatedByLinkClick() override;
+  bool IsSignedExchangeInnerResponse() override;
+  bool HasPrefetchedAlternativeSubresourceSignedExchange() override;
+  bool WasResponseCached() override;
+  const net::ProxyServer& GetProxyServer() override;
+  const std::string& GetHrefTranslate() override;
+  const base::Optional<url::Origin>& GetInitiatorOrigin() override;
+  bool IsSameProcess() override;
+  int GetNavigationEntryOffset() override;
+  bool FromDownloadCrossOriginRedirect() override;
+  void RegisterSubresourceOverride(
+      mojom::TransferrableURLLoaderPtr transferrable_loader) override;
+  GlobalFrameRoutingId GetPreviousRenderFrameHostId() override;
+  bool IsServedFromBackForwardCache() override;
+
   // Called on the UI thread by the Navigator to start the navigation.
   // The NavigationRequest can be deleted while BeginNavigation() is called.
   void BeginNavigation();
@@ -204,27 +281,15 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
 
   FrameTreeNode* frame_tree_node() const { return frame_tree_node_; }
 
-  SiteInstanceImpl* source_site_instance() const {
-    return source_site_instance_.get();
-  }
-
   SiteInstanceImpl* dest_site_instance() const {
     return dest_site_instance_.get();
   }
 
-  RestoreType restore_type() const { return restore_type_; }
-
-  ReloadType reload_type() const { return reload_type_; }
-
   bool is_view_source() const { return is_view_source_; }
 
   int bindings() const { return bindings_; }
 
-  SiteInstanceImpl* starting_site_instance() const {
-    return starting_site_instance_.get();
-  }
-
-  bool browser_initiated() const { return browser_initiated_ ; }
+  bool browser_initiated() const { return browser_initiated_; }
 
   bool from_begin_navigation() const { return from_begin_navigation_; }
 
@@ -237,11 +302,6 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
 
   void set_was_discarded() { commit_params_->was_discarded = true; }
 
-  NavigationHandleImpl* navigation_handle() const {
-    return navigation_handle_.get();
-  }
-
-  net::Error net_error() { return net_error_; }
   void set_net_error(net::Error net_error) { net_error_ = net_error; }
 
   const std::string& GetMimeType() {
@@ -249,40 +309,16 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
                           : base::EmptyString();
   }
 
-  // The RenderFrameHost that will commit the navigation or an error page.
-  // This is computed when the response is received, or when the navigation
-  // fails and error page should be displayed.
-  RenderFrameHostImpl* render_frame_host() const {
-    // Only allow the RenderFrameHost to be retrieved once it has been set for
-    // this navigation. This will happens either at WillProcessResponse time for
-    // regular navigations or at WillFailRequest time for error pages.
-    CHECK_GE(handle_state_, PROCESSING_WILL_FAIL_REQUEST)
-        << "This accessor should only be called after a RenderFrameHost has "
-           "been picked for this navigation.";
-    static_assert(
-        WILL_FAIL_REQUEST < WILL_PROCESS_RESPONSE,
-        "WillFailRequest state should come before WillProcessResponse");
-    return render_frame_host_;
-  }
-
   const network::ResourceResponse* response() { return response_head_.get(); }
-  const GlobalRequestID& request_id() const {
-    DCHECK_GE(handle_state_, PROCESSING_WILL_PROCESS_RESPONSE);
-    return request_id_;
-  }
-  bool is_download() const { return is_download_; }
-  const base::Optional<net::SSLInfo>& ssl_info() { return ssl_info_; }
-  const base::Optional<net::AuthChallengeInfo>& auth_challenge_info() {
-    return auth_challenge_info_;
-  }
 
   void SetWaitingForRendererResponse();
 
-  // Creates a NavigationHandle. This should be called after any previous
-  // NavigationRequest for the FrameTreeNode has been destroyed. |is_for_commit|
-  // should only be true when creating a NavigationHandle at commit time (this
-  // happens for renderer-initiated same-document navigations).
-  void CreateNavigationHandle(bool is_for_commit);
+  // Notifies the NavigatorDelegate the navigation started. This should be
+  // called after any previous NavigationRequest for the FrameTreeNode has been
+  // destroyed. |is_for_commit| should only be true when creating a
+  // NavigationRequest at commit time (this happens for renderer-initiated
+  // same-document navigations).
+  void StartNavigation(bool is_for_commit);
 
   void set_on_start_checks_complete_closure_for_testing(
       const base::Closure& closure) {
@@ -321,9 +357,6 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // due to another navigation committing in the meantime.
   void ResetForCrossDocumentRestart();
 
-  void RegisterSubresourceOverride(
-      mojom::TransferrableURLLoaderPtr transferrable_loader);
-
   // Lazily initializes and returns the mojo::NavigationClient interface used
   // for commit. Only used with PerNavigationMojoInterface enabled.
   mojom::NavigationClient* GetCommitNavigationClient();
@@ -340,16 +373,8 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // navigation_client used to commit.
   void IgnoreCommitInterfaceDisconnection();
 
-  bool IsSameDocument() const;
-
-  int navigation_entry_offset() { return navigation_entry_offset_; }
-
   NavigationHandleState handle_state() { return handle_state_; }
 
-  NavigationUIData* navigation_ui_data() const {
-    return navigation_ui_data_.get();
-  }
-
   // Resume and CancelDeferredNavigation must only be called by the
   // NavigationThrottle that is currently deferring the navigation.
   // |resuming_throttle| and |cancelling_throttle| are the throttles calling
@@ -362,11 +387,6 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // deferring NavigationThrottle do the resuming.
   void CallResumeForTesting();
 
-  void RegisterThrottleForTesting(
-      std::unique_ptr<NavigationThrottle> navigation_throttle);
-
-  bool IsDeferredForTesting();
-
   typedef base::OnceCallback<void(NavigationThrottle::ThrottleCheckResult)>
       ThrottleChecksFinishedCallback;
 
@@ -392,35 +412,6 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
     return navigation_type_;
   }
 
-  bool did_replace_entry() const {
-    DCHECK(handle_state_ == DID_COMMIT ||
-           handle_state_ == DID_COMMIT_ERROR_PAGE);
-    return did_replace_entry_;
-  }
-
-  bool should_update_history() const {
-    DCHECK(handle_state_ == DID_COMMIT ||
-           handle_state_ == DID_COMMIT_ERROR_PAGE);
-    return should_update_history_;
-  }
-
-  bool subframe_entry_committed() const {
-    DCHECK(!frame_tree_node_->IsMainFrame());
-    DCHECK(handle_state_ == DID_COMMIT ||
-           handle_state_ == DID_COMMIT_ERROR_PAGE);
-    return subframe_entry_committed_;
-  }
-
-  const GURL& previous_url() const {
-    DCHECK(handle_state_ == DID_COMMIT ||
-           handle_state_ == DID_COMMIT_ERROR_PAGE);
-    return previous_url_;
-  }
-
-  bool from_download_cross_origin_redirect() const {
-    return from_download_cross_origin_redirect_;
-  }
-
 #if defined(OS_ANDROID)
   // Returns a reference to |navigation_handle_| Java counterpart. It is used
   // by Java WebContentsObservers.
@@ -429,15 +420,14 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   }
 #endif
 
-  bool was_redirected() { return was_redirected_; }
-
-  void set_error_page_html(const std::string& error_page_html) {
-    error_page_html_ = error_page_html;
+  const std::string& post_commit_error_page_html() {
+    return post_commit_error_page_html_;
   }
 
-  std::vector<GURL>& redirect_chain() { return redirect_chain_; }
-
-  blink::mojom::Referrer& sanitized_referrer() { return *sanitized_referrer_; }
+  void set_post_commit_error_page_html(
+      const std::string& post_commit_error_page_html) {
+    post_commit_error_page_html_ = post_commit_error_page_html;
+  }
 
   void set_from_download_cross_origin_redirect(
       bool from_download_cross_origin_redirect) {
@@ -449,7 +439,7 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // navigation in a subframe. This allows a browser-initiated NavigationRequest
   // to be canceled by the renderer.
   void SetNavigationClient(
-      mojom::NavigationClientAssociatedPtrInfo navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
       int32_t associated_site_instance_id);
 
   // Whether the new document created by this navigation will be loaded from a
@@ -459,69 +449,28 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
 
   std::unique_ptr<AppCacheNavigationHandle> TakeAppCacheHandle();
 
-  bool is_same_process() {
-    DCHECK(handle_state_ == DID_COMMIT ||
-           handle_state_ == DID_COMMIT_ERROR_PAGE);
-    return is_same_process_;
-  }
-
   void set_complete_callback_for_testing(
       ThrottleChecksFinishedCallback callback) {
     complete_callback_for_testing_ = std::move(callback);
   }
 
-  const net::ProxyServer& proxy_server() { return proxy_server_; }
-
-  int64_t navigation_handle_id() { return navigation_handle_id_; }
-
   // Sets the READY_TO_COMMIT -> DID_COMMIT timeout. Resets the timeout to the
   // default value if |timeout| is zero.
   static void SetCommitTimeoutForTesting(const base::TimeDelta& timeout);
 
-  const net::HttpRequestHeaders& request_headers() { return request_headers_; }
-
-  // Remove a request's header. If the header is not present, it has no effect.
-  // Must be called during a redirect.
-  void RemoveRequestHeader(const std::string& header_name);
-
-  // Set a request's header. If the header is already present, its value is
-  // overwritten. When modified during a navigation start, the headers will be
-  // applied to the initial network request. When modified during a redirect,
-  // the headers will be applied to the redirected request.
-  void SetRequestHeader(const std::string& header_name,
-                        const std::string& header_value);
-
   void set_response_headers_for_testing(
       scoped_refptr<net::HttpResponseHeaders> response_headers) {
     response_headers_for_testing_ = response_headers;
   }
 
-  const net::HttpResponseHeaders* GetResponseHeaders();
-
-  // Whether this navigation was served from the back-forward cache.
-  bool is_served_from_back_forward_cache() {
-    return rfh_restored_from_back_forward_cache_ != nullptr;
-  }
-
   RenderFrameHostImpl* rfh_restored_from_back_forward_cache() {
     return rfh_restored_from_back_forward_cache_;
   }
 
-  // NavigationHandle implementation:
-  // TODO(https://crbug.com/995268): Make NavigationRequest inherit from
-  // NavigationHandle, once NavigationHandleImpl is deleted.
-  bool IsExternalProtocol();
-  bool IsSignedExchangeInnerResponse();
-  net::IPEndPoint GetSocketAddress();
-  bool HasCommitted();
-  bool IsErrorPage();
-  net::HttpResponseInfo::ConnectionInfo GetConnectionInfo();
-  bool IsInMainFrame();
-  RenderFrameHostImpl* GetParentFrame();
-  bool IsParentMainFrame();
-  int GetFrameTreeNodeId();
-  bool WasResponseCached();
-  bool HasPrefetchedAlternativeSubresourceSignedExchange();
+  const BundledExchangesNavigationInfo* bundled_exchanges_navigation_info()
+      const {
+    return bundled_exchanges_navigation_info_.get();
+  }
 
   // The NavigatorDelegate to notify/query for various navigation events.
   // Normally this is the WebContents, except if this NavigationHandle was
@@ -535,23 +484,44 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // expose the NavigationHandle when navigating to an InterstitialPage.
   NavigatorDelegate* GetDelegate() const;
 
+  blink::mojom::RequestContextType request_context_type() const {
+    DCHECK_GE(handle_state_, PROCESSING_WILL_START_REQUEST);
+    return begin_params_->request_context_type;
+  }
+
+  blink::WebMixedContentContextType mixed_content_context_type() const {
+    DCHECK_GE(handle_state_, PROCESSING_WILL_START_REQUEST);
+    return begin_params_->mixed_content_context_type;
+  }
+
+  // Returns true if the navigation was started by the Navigator by calling
+  // BeginNavigation(), or if the request was created at commit time by calling
+  // CreateForCommit().
+  bool IsNavigationStarted() const;
+
+  // Stop referencing the pending NavigationEntry.
+  //
+  // Note: To be removed after removing DidFailProvisionalLoadWithError().
+  void DropPendingEntryRef();
+
  private:
   friend class NavigationRequestTest;
 
-  NavigationRequest(FrameTreeNode* frame_tree_node,
-                    mojom::CommonNavigationParamsPtr common_params,
-                    mojom::BeginNavigationParamsPtr begin_params,
-                    mojom::CommitNavigationParamsPtr commit_params,
-                    bool browser_initiated,
-                    bool from_begin_navigation,
-                    bool is_for_commit,
-                    const FrameNavigationEntry* frame_navigation_entry,
-                    NavigationEntryImpl* navitation_entry,
-                    std::unique_ptr<NavigationUIData> navigation_ui_data,
-                    mojom::NavigationClientAssociatedPtrInfo navigation_client,
-                    mojo::PendingRemote<blink::mojom::NavigationInitiator>
-                        navigation_initiator,
-                    RenderFrameHostImpl* rfh_restored_from_back_forward_cache);
+  NavigationRequest(
+      FrameTreeNode* frame_tree_node,
+      mojom::CommonNavigationParamsPtr common_params,
+      mojom::BeginNavigationParamsPtr begin_params,
+      mojom::CommitNavigationParamsPtr commit_params,
+      bool browser_initiated,
+      bool from_begin_navigation,
+      bool is_for_commit,
+      const FrameNavigationEntry* frame_navigation_entry,
+      NavigationEntryImpl* navitation_entry,
+      std::unique_ptr<NavigationUIData> navigation_ui_data,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
+      mojo::PendingRemote<blink::mojom::NavigationInitiator>
+          navigation_initiator,
+      RenderFrameHostImpl* rfh_restored_from_back_forward_cache);
 
   // NavigationURLLoaderDelegate implementation.
   void OnRequestRedirected(
@@ -682,8 +652,9 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // Binds the given error_handler to be called when an interface disconnection
   // happens on the renderer side.
   // Only used with PerNavigationMojoInterface enabled.
-  void HandleInterfaceDisconnection(mojom::NavigationClientAssociatedPtr*,
-                                    base::OnceClosure error_handler);
+  void HandleInterfaceDisconnection(
+      mojo::AssociatedRemote<mojom::NavigationClient>*,
+      base::OnceClosure error_handler);
 
   // When called, this NavigationRequest will no longer interpret the interface
   // disconnection on the renderer side as an AbortNavigation.
@@ -776,6 +747,11 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // Note: |site_url_| should only be updated with the result of this function.
   GURL GetSiteForCommonParamsURL() const;
 
+  // Returns the network isolation key for this NavigationRequest. If
+  // |network_isolation_key_| is empty, the key will be based off request url
+  // origin and top frame origin.
+  net::NetworkIsolationKey GetNetworkIsolationKey() const;
+
   // Updates the state of the navigation handle after encountering a server
   // redirect.
   void UpdateStateFollowingRedirect(const GURL& new_referrer_url,
@@ -806,7 +782,7 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   //
   // Note #3: Navigations that do not use a URL loader also bypass
   //          NavigationThrottle.
-  bool NeedsUrlLoader() const;
+  bool NeedsUrlLoader();
 
   // Called when the navigation is ready to be committed. This will update the
   // |handle_state_| and inform the delegate.
@@ -842,8 +818,21 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   }
 
   // Helper functions to trace the start and end of |navigation_handle_|.
-  void TraceNavigationHandleStart();
-  void TraceNavigationHandleEnd();
+  void TraceNavigationStart();
+  void TraceNavigationEnd();
+
+  // Returns true if the contents of |common_params_| requires
+  // |source_site_instance_| to be set. This is used to ensure that data:
+  // URLs with valid initiator origins always have |source_site_instance_| set
+  // so that site isolation enforcements work properly.
+  bool RequiresSourceSiteInstance() const;
+
+  // Sets |source_site_instance_| to a SiteInstance that is derived from
+  // |common_params_->initiator_origin| and related to the |frame_tree_node_|'s
+  // current SiteInstance. |source_site_instance_| is only set if it doesn't
+  // already have a value, |common_params_->initiator_origin| has a valid
+  // origin, and RequiresSourceSiteInstance() return true.
+  void SetSourceSiteInstanceToInitiatorIfNeeded();
 
   FrameTreeNode* frame_tree_node_;
 
@@ -859,10 +848,13 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // modified during redirects.
   // Note: |commit_params_| is not const because was_discarded will
   // be set in CreatedNavigationRequest.
+  // Note: |browser_initiated_| and |common_params_| may be mutated by
+  // ContentBrowserClient::OverrideNavigationParams at StartNavigation time
+  // (i.e. before we actually kick off the navigation).
   mojom::CommonNavigationParamsPtr common_params_;
   mojom::BeginNavigationParamsPtr begin_params_;
   mojom::CommitNavigationParamsPtr commit_params_;
-  const bool browser_initiated_;
+  bool browser_initiated_;
 
   // Stores the NavigationUIData for this navigation until the NavigationHandle
   // is created. This can be null if the embedded did not provide a
@@ -874,12 +866,6 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
 
   NavigationState state_;
 
-  // It's important to ensure |navigation_handle_| outlives |loader_|, since the
-  // loader holds raw pointers to objects owned by the navigation handle
-  // (namely, the AppCache and service worker handles). The destruction order
-  // matters because it occurs over separate tasks on the IO thread. So, declare
-  // the handle before the loader.
-  std::unique_ptr<NavigationHandleImpl> navigation_handle_;
   std::unique_ptr<NavigationURLLoader> loader_;
 
 #if defined(OS_ANDROID)
@@ -962,14 +948,14 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // case of a renderer initiated navigation. It is expected to be bound until
   // this navigation commits or is canceled.
   // Only valid when PerNavigationMojoInterface is enabled.
-  mojom::NavigationClientAssociatedPtr request_navigation_client_;
+  mojo::AssociatedRemote<mojom::NavigationClient> request_navigation_client_;
   base::Optional<int32_t> associated_site_instance_id_;
 
   // The NavigationClient interface used to commit the navigation. For now, this
   // is only used for same-site renderer-initiated navigation.
   // TODO(clamy, ahemery): Extend to all types of navigation.
   // Only valid when PerNavigationMojoInterface is enabled.
-  mojom::NavigationClientAssociatedPtr commit_navigation_client_;
+  mojo::AssociatedRemote<mojom::NavigationClient> commit_navigation_client_;
 
   // If set, any redirects to HTTP for this navigation will be upgraded to
   // HTTPS. This is used only on subframe navigations, when
@@ -1030,6 +1016,12 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   scoped_refptr<PrefetchedSignedExchangeCache>
       prefetched_signed_exchange_cache_;
 
+  // Tracks navigations within bundled exchanges file. Used when
+  // BundledHTTPExchanges feature is enabled or
+  // TrustableBundledExchangesFileUrl switch is set.
+  std::unique_ptr<BundledExchangesHandleTracker>
+      bundled_exchanges_handle_tracker_;
+
   // The time this navigation was ready to commit.
   base::TimeTicks ready_to_commit_time_;
 
@@ -1043,7 +1035,7 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
 
   // If set, starting the navigation will immediately result in an error page
   // with this html as content and |net_error| as the network error.
-  std::string error_page_html_;
+  std::string post_commit_error_page_html_;
 
   // This callback will be run when all throttle checks have been performed.
   // TODO(zetamoo): This can be removed once the navigation states are merged.
@@ -1057,8 +1049,22 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   // The instance to process the BundledExchanges that's bound to this request.
   // Used to navigate to the main resource URL of the BundledExchanges, and
   // load it from the corresponding entry.
+  // This is created in OnStartChecksComplete() and passed to the
+  // RenderFrameHostImpl in CommitNavigation().
   std::unique_ptr<BundledExchangesHandle> bundled_exchanges_handle_;
 
+  // Keeps the bundled exchanges related information when |this| is for a
+  // navigation within a bundled exchanges file. Used when
+  // BundledHTTPExchanges feature is enabled or
+  // TrustableBundledExchangesFileUrl switch is set.
+  // For navigations to bundled exchanges file, this is cloned from
+  // |bundled_exchanges_handle_| in CommitNavigation(), and is passed to
+  // NavigationEntry for the navigation. And for history (back / forward)
+  // navigations within the bundled exchanges file, this is cloned from the
+  // NavigationEntry and is used to create a BundledExchangesHandle.
+  std::unique_ptr<BundledExchangesNavigationInfo>
+      bundled_exchanges_navigation_info_;
+
   // Which proxy server was used for this navigation, if any.
   net::ProxyServer proxy_server_;
 
@@ -1101,6 +1107,18 @@ class CONTENT_EXPORT NavigationRequest : public NavigationURLLoaderDelegate,
   int64_t frame_entry_item_sequence_number_ = -1;
   int64_t frame_entry_document_sequence_number_ = -1;
 
+  // If non-empty, it represents the network isolation key explicitly asked to
+  // be used for this NavigationRequest.
+  base::Optional<net::NetworkIsolationKey> network_isolation_key_;
+
+  // This is used to store the current_frame_host id at request creation time.
+  GlobalFrameRoutingId previous_render_frame_host_id_;
+
+  // This tracks a connection between the current pending entry and this
+  // request, such that the pending entry can be discarded if no requests are
+  // left referencing it.
+  std::unique_ptr<NavigationControllerImpl::PendingEntryRef> pending_entry_ref_;
+
   base::WeakPtrFactory<NavigationRequest> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(NavigationRequest);
diff --git a/chromium/content/browser/frame_host/navigation_handle_impl_browsertest.cc b/chromium/content/browser/frame_host/navigation_request_browsertest.cc
index 78f9241188d..f57917bcd4f 100644
--- a/chromium/content/browser/frame_host/navigation_handle_impl_browsertest.cc
+++ b/chromium/content/browser/frame_host/navigation_request_browsertest.cc
@@ -10,7 +10,6 @@
 #include "base/task/post_task.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "content/browser/frame_host/debug_urls.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -64,19 +63,19 @@ class TestNavigationThrottle : public NavigationThrottle {
       NavigationThrottle::ThrottleCheckResult will_redirect_result,
       NavigationThrottle::ThrottleCheckResult will_fail_result,
       NavigationThrottle::ThrottleCheckResult will_process_result,
-      base::Closure did_call_will_start,
-      base::Closure did_call_will_redirect,
-      base::Closure did_call_will_fail,
-      base::Closure did_call_will_process)
+      base::OnceClosure did_call_will_start,
+      base::OnceClosure did_call_will_redirect,
+      base::OnceClosure did_call_will_fail,
+      base::OnceClosure did_call_will_process)
       : NavigationThrottle(handle),
         will_start_result_(will_start_result),
         will_redirect_result_(will_redirect_result),
         will_fail_result_(will_fail_result),
         will_process_result_(will_process_result),
-        did_call_will_start_(did_call_will_start),
-        did_call_will_redirect_(did_call_will_redirect),
-        did_call_will_fail_(did_call_will_fail),
-        did_call_will_process_(did_call_will_process) {}
+        did_call_will_start_(std::move(did_call_will_start)),
+        did_call_will_redirect_(std::move(did_call_will_redirect)),
+        did_call_will_fail_(std::move(did_call_will_fail)),
+        did_call_will_process_(std::move(did_call_will_process)) {}
   ~TestNavigationThrottle() override {}
 
   const char* GetNameForLogging() override { return "TestNavigationThrottle"; }
@@ -95,43 +94,44 @@ class TestNavigationThrottle : public NavigationThrottle {
  private:
   // NavigationThrottle implementation.
   NavigationThrottle::ThrottleCheckResult WillStartRequest() override {
-    NavigationHandleImpl* navigation_handle_impl =
-        static_cast<NavigationHandleImpl*>(navigation_handle());
+    NavigationRequest* navigation_request =
+        NavigationRequest::From(navigation_handle());
     CHECK_NE(blink::mojom::RequestContextType::UNSPECIFIED,
-             navigation_handle_impl->request_context_type());
-    request_context_type_ = navigation_handle_impl->request_context_type();
+             navigation_request->request_context_type());
+    request_context_type_ = navigation_request->request_context_type();
 
-    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_start_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   std::move(did_call_will_start_));
     return will_start_result_;
   }
 
   NavigationThrottle::ThrottleCheckResult WillRedirectRequest() override {
-    NavigationHandleImpl* navigation_handle_impl =
-        static_cast<NavigationHandleImpl*>(navigation_handle());
-    CHECK_EQ(request_context_type_,
-             navigation_handle_impl->request_context_type());
+    NavigationRequest* navigation_request =
+        NavigationRequest::From(navigation_handle());
+    CHECK_EQ(request_context_type_, navigation_request->request_context_type());
 
-    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_redirect_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   std::move(did_call_will_redirect_));
     return will_redirect_result_;
   }
 
   NavigationThrottle::ThrottleCheckResult WillFailRequest() override {
-    NavigationHandleImpl* navigation_handle_impl =
-        static_cast<NavigationHandleImpl*>(navigation_handle());
-    CHECK_EQ(request_context_type_,
-             navigation_handle_impl->request_context_type());
+    NavigationRequest* navigation_request =
+        NavigationRequest::From(navigation_handle());
+    CHECK_EQ(request_context_type_, navigation_request->request_context_type());
 
-    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_fail_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   std::move(did_call_will_fail_));
     return will_fail_result_;
   }
 
   NavigationThrottle::ThrottleCheckResult WillProcessResponse() override {
-    NavigationHandleImpl* navigation_handle_impl =
-        static_cast<NavigationHandleImpl*>(navigation_handle());
-    CHECK_EQ(request_context_type_,
-             navigation_handle_impl->request_context_type());
+    NavigationRequest* navigation_request =
+        NavigationRequest::From(navigation_handle());
+    CHECK_EQ(request_context_type_, navigation_request->request_context_type());
 
-    base::PostTask(FROM_HERE, {BrowserThread::UI}, did_call_will_process_);
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   std::move(did_call_will_process_));
     return will_process_result_;
   }
 
@@ -139,10 +139,10 @@ class TestNavigationThrottle : public NavigationThrottle {
   NavigationThrottle::ThrottleCheckResult will_redirect_result_;
   NavigationThrottle::ThrottleCheckResult will_fail_result_;
   NavigationThrottle::ThrottleCheckResult will_process_result_;
-  base::Closure did_call_will_start_;
-  base::Closure did_call_will_redirect_;
-  base::Closure did_call_will_fail_;
-  base::Closure did_call_will_process_;
+  base::OnceClosure did_call_will_start_;
+  base::OnceClosure did_call_will_redirect_;
+  base::OnceClosure did_call_will_fail_;
+  base::OnceClosure did_call_will_process_;
   blink::mojom::RequestContextType request_context_type_ =
       blink::mojom::RequestContextType::UNSPECIFIED;
 };
@@ -290,14 +290,17 @@ class TestNavigationThrottleInstaller : public WebContentsObserver {
     std::unique_ptr<NavigationThrottle> throttle(new TestNavigationThrottle(
         handle, will_start_result_, will_redirect_result_, will_fail_result_,
         will_process_result_,
-        base::Bind(&TestNavigationThrottleInstaller::DidCallWillStartRequest,
-                   weak_factory_.GetWeakPtr()),
-        base::Bind(&TestNavigationThrottleInstaller::DidCallWillRedirectRequest,
-                   weak_factory_.GetWeakPtr()),
-        base::Bind(&TestNavigationThrottleInstaller::DidCallWillFailRequest,
-                   weak_factory_.GetWeakPtr()),
-        base::Bind(&TestNavigationThrottleInstaller::DidCallWillProcessResponse,
-                   weak_factory_.GetWeakPtr())));
+        base::BindOnce(
+            &TestNavigationThrottleInstaller::DidCallWillStartRequest,
+            weak_factory_.GetWeakPtr()),
+        base::BindOnce(
+            &TestNavigationThrottleInstaller::DidCallWillRedirectRequest,
+            weak_factory_.GetWeakPtr()),
+        base::BindOnce(&TestNavigationThrottleInstaller::DidCallWillFailRequest,
+                       weak_factory_.GetWeakPtr()),
+        base::BindOnce(
+            &TestNavigationThrottleInstaller::DidCallWillProcessResponse,
+            weak_factory_.GetWeakPtr())));
     navigation_throttle_ = static_cast<TestNavigationThrottle*>(throttle.get());
     handle->RegisterThrottleForTesting(std::move(throttle));
     ++install_count_;
@@ -433,7 +436,7 @@ void ExpectChildFrameCollapsed(Shell* shell,
 
 }  // namespace
 
-class NavigationHandleImplBrowserTest : public ContentBrowserTest {
+class NavigationRequestBrowserTest : public ContentBrowserTest {
  protected:
   void SetUpOnMainThread() override {
     host_resolver()->AddRule("*", "127.0.0.1");
@@ -473,11 +476,11 @@ class NavigationHandleImplBrowserTest : public ContentBrowserTest {
   }
 };
 
-class NavigationHandleImplDownloadBrowserTest
-    : public NavigationHandleImplBrowserTest {
+class NavigationRequestDownloadBrowserTest
+    : public NavigationRequestBrowserTest {
  protected:
   void SetUpOnMainThread() override {
-    NavigationHandleImplBrowserTest::SetUpOnMainThread();
+    NavigationRequestBrowserTest::SetUpOnMainThread();
 
     // Set up a test download directory, in order to prevent prompting for
     // handling downloads.
@@ -496,7 +499,7 @@ class NavigationHandleImplDownloadBrowserTest
 };
 
 // Ensure that PageTransition is properly set on the NavigationHandle.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifyPageTransition) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifyPageTransition) {
   {
     // Test browser initiated navigation, which should have a PageTransition as
     // if it came from the omnibox.
@@ -540,7 +543,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifyPageTransition) {
 // Ensure that the following methods on NavigationHandle behave correctly:
 // * IsInMainFrame
 // * IsParentMainFrame
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifyFrameTree) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifyFrameTree) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(c))"));
   GURL b_url(embedded_test_server()->GetURL(
@@ -585,7 +588,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifyFrameTree) {
 }
 
 // Ensure that the WasRedirected() method on NavigationHandle behaves correctly.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifyRedirect) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifyRedirect) {
   {
     GURL url(embedded_test_server()->GetURL("/title1.html"));
     NavigationHandleObserver observer(shell()->web_contents(), url);
@@ -613,8 +616,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifyRedirect) {
 
 // Ensure that a certificate error results in a committed navigation with
 // the appropriate error code on the handle.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
-                       VerifyCertErrorFailure) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifyCertErrorFailure) {
   net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
   https_server.SetSSLConfig(net::EmbeddedTestServer::CERT_MISMATCHED_NAME);
   ASSERT_TRUE(https_server.Start());
@@ -631,8 +633,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Ensure that the IsRendererInitiated() method on NavigationHandle behaves
 // correctly.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
-                       VerifyRendererInitiated) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifyRendererInitiated) {
   {
     // Test browser initiated navigation.
     GURL url(embedded_test_server()->GetURL("/title1.html"));
@@ -698,7 +699,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Ensure that methods on NavigationHandle behave correctly with an iframe that
 // navigates to its srcdoc attribute.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifySrcdoc) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifySrcdoc) {
   GURL url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_srcdoc_frame.html"));
   NavigationHandleObserver observer(shell()->web_contents(),
@@ -713,7 +714,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifySrcdoc) {
 
 // Ensure that the IsSameDocument() method on NavigationHandle behaves
 // correctly.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifySameDocument) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, VerifySameDocument) {
   GURL url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(a())"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
@@ -779,7 +780,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, VerifySameDocument) {
 
 // Ensure that a NavigationThrottle can cancel the navigation at navigation
 // start.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleCancelStart) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleCancelStart) {
   GURL start_url(embedded_test_server()->GetURL("/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
@@ -803,8 +804,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleCancelStart) {
 
 // Ensure that a NavigationThrottle can cancel the navigation when a navigation
 // is redirected.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
-                       ThrottleCancelRedirect) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleCancelRedirect) {
   GURL start_url(embedded_test_server()->GetURL("/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
@@ -845,7 +845,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 }
 
 // Ensure that a NavigationThrottle can respond CANCEL when a navigation fails.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleCancelFailure) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleCancelFailure) {
   net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
   https_server.SetSSLConfig(net::EmbeddedTestServer::CERT_MISMATCHED_NAME);
   ASSERT_TRUE(https_server.Start());
@@ -916,8 +916,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleCancelFailure) {
 
 // Ensure that a NavigationThrottle can cancel the navigation when the response
 // is received.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
-                       ThrottleCancelResponse) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleCancelResponse) {
   GURL start_url(embedded_test_server()->GetURL("/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
@@ -941,7 +940,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Ensure that a NavigationThrottle can defer and resume the navigation at
 // navigation start, navigation redirect and response received.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleDefer) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleDefer) {
   GURL start_url(embedded_test_server()->GetURL("/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
@@ -992,7 +991,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleDefer) {
 
 // Ensure that a NavigationThrottle can defer and resume the navigation at
 // navigation start and navigation failure.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleDeferFailure) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleDeferFailure) {
   net::EmbeddedTestServer https_server(net::EmbeddedTestServer::TYPE_HTTPS);
   https_server.SetSSLConfig(net::EmbeddedTestServer::CERT_MISMATCHED_NAME);
   ASSERT_TRUE(https_server.Start());
@@ -1034,8 +1033,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ThrottleDeferFailure) {
 // Ensure that a NavigationThrottle can block the navigation and collapse the
 // frame owner both on request start as well as after a redirect. Plus, ensure
 // that the frame is restored on the subsequent non-error-page navigation.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
-                       ThrottleBlockAndCollapse) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ThrottleBlockAndCollapse) {
   const char kChildFrameId[] = "child0";
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/frame_tree/page_with_one_frame.html"));
@@ -1130,7 +1128,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // BLOCK_REQUEST_AND_COLLAPSE should block the navigation in legacy <frame>'s,
 // but should not collapse the <frame> element itself for legacy reasons.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        ThrottleBlockAndCollapse_LegacyFrameNotCollapsed) {
   const char kChildFrameId[] = "child0";
   GURL main_url(embedded_test_server()->GetURL(
@@ -1175,7 +1173,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 }
 
 // Checks that the RequestContextType value is properly set.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        VerifyRequestContextTypeForFrameTree) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(c))"));
@@ -1231,7 +1229,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 }
 
 // Checks that the RequestContextType value is properly set for an hyper-link.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        VerifyHyperlinkRequestContextType) {
   GURL link_url(embedded_test_server()->GetURL("/title2.html"));
   GURL document_url(embedded_test_server()->GetURL("/simple_links.html"));
@@ -1267,7 +1265,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 }
 
 // Checks that the RequestContextType value is properly set for an form (POST).
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        VerifyFormRequestContextType) {
   GURL document_url(
       embedded_test_server()->GetURL("/session_history/form.html"));
@@ -1302,7 +1300,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Checks that the error code is properly set on the NavigationHandle when a
 // NavigationThrottle cancels.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        ErrorCodeOnThrottleCancelNavigation) {
   const GURL kUrl = embedded_test_server()->GetURL("/title1.html");
   const GURL kRedirectingUrl =
@@ -1382,9 +1380,9 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
   EXPECT_EQ(net::ERR_BLOCKED_BY_CLIENT, observer.net_error_code());
 }
 
-// Checks that there's no UAF if NavigationHandleImpl::WillStartRequest cancels
-// the navigation.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+// Checks that there's no UAF if NavigationRequest::WillStartRequest cancels the
+// navigation.
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        CancelNavigationInWillStartRequest) {
   const GURL kUrl1 = embedded_test_server()->GetURL("/title1.html");
   const GURL kUrl2 = embedded_test_server()->GetURL("/title2.html");
@@ -1395,7 +1393,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
   // To take the path that doesn't run beforeunload, so that
   // NavigationControllerImpl::NavigateToPendingEntry is on the botttom of the
-  // stack when NavigationHandleImpl::WillStartRequest is called.
+  // stack when NavigationRequest::WillStartRequest is called.
   CrashTab(shell()->web_contents());
 
   // Set up a NavigationThrottle that will cancel the navigation in
@@ -1411,7 +1409,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 // Verify that a cross-process navigation in a frame for which the current
 // renderer process is not live will not result in leaking a
 // RenderProcessHost. See https://crbug.com/949977.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        NoLeakFromStartingSiteInstance) {
   GURL url_a = embedded_test_server()->GetURL("a.com", "/title1.html");
   EXPECT_TRUE(NavigateToURL(shell(), url_a));
@@ -1490,8 +1488,8 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Specialized test that verifies the NavigationHandle gets the HTTPS upgraded
 // URL from the very beginning of the navigation.
-class NavigationHandleImplHttpsUpgradeBrowserTest
-    : public NavigationHandleImplBrowserTest {
+class NavigationRequestHttpsUpgradeBrowserTest
+    : public NavigationRequestBrowserTest {
  public:
   void CheckHttpsUpgradedIframeNavigation(const GURL& start_url,
                                           const GURL& iframe_secure_url) {
@@ -1527,7 +1525,7 @@ class NavigationHandleImplHttpsUpgradeBrowserTest
 };
 
 // Tests that the start URL is HTTPS upgraded for a same site navigation.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplHttpsUpgradeBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestHttpsUpgradeBrowserTest,
                        StartUrlIsHttpsUpgradedSameSite) {
   GURL start_url(embedded_test_server()->GetURL(
       "example.com", "/https_upgrade_same_site.html"));
@@ -1544,7 +1542,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplHttpsUpgradeBrowserTest,
 }
 
 // Tests that the start URL is HTTPS upgraded for a cross site navigation.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplHttpsUpgradeBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestHttpsUpgradeBrowserTest,
                        StartUrlIsHttpsUpgradedCrossSite) {
   GURL start_url(
       embedded_test_server()->GetURL("/https_upgrade_cross_site.html"));
@@ -1555,7 +1553,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplHttpsUpgradeBrowserTest,
 
 // Ensure that browser-initiated same-document navigations are detected and
 // don't issue network requests.  See crbug.com/663777.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        SameDocumentBrowserInitiatedNoReload) {
   GURL url(embedded_test_server()->GetURL("/title1.html"));
   GURL url_fragment_1(embedded_test_server()->GetURL("/title1.html#id_1"));
@@ -1666,7 +1664,7 @@ class NavigationLogger : public WebContentsObserver {
 // a NavigationHandle mismatch and a new NavigationHandle creation to commit
 // the error page. This test makes sure that only one NavigationHandle is used
 // for committing the error page. See https://crbug.com/695421
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, BlockedOnRedirect) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, BlockedOnRedirect) {
   const GURL kUrl = embedded_test_server()->GetURL("/title1.html");
   const GURL kRedirectingUrl =
       embedded_test_server()->GetURL("/server-redirect?" + kUrl.spec());
@@ -1695,14 +1693,13 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, BlockedOnRedirect) {
 
 // Tests that when a navigation starts while there's an existing one, the first
 // one has the right error code set on its navigation handle.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ErrorCodeOnCancel) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ErrorCodeOnCancel) {
   GURL slow_url = embedded_test_server()->GetURL("/slow?60");
   NavigationHandleObserver observer(shell()->web_contents(), slow_url);
   shell()->LoadURL(slow_url);
 
   GURL url2(embedded_test_server()->GetURL("/title1.html"));
-  TestNavigationObserver same_tab_observer(
-      shell()->web_contents(), 1);
+  TestNavigationObserver same_tab_observer(shell()->web_contents(), 1);
   shell()->LoadURL(url2);
   same_tab_observer.Wait();
 
@@ -1711,7 +1708,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ErrorCodeOnCancel) {
 
 // Tests that when a renderer-initiated request redirects to a URL that the
 // renderer can't access, the right error code is set on the NavigationHandle.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ErrorCodeOnRedirect) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ErrorCodeOnRedirect) {
   GURL url(embedded_test_server()->GetURL("/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
@@ -1729,7 +1726,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ErrorCodeOnRedirect) {
 // Test to verify that error pages caused by NavigationThrottle blocking a
 // request in the main frame from being made are properly committed in a
 // separate error page process.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        ErrorPageBlockedNavigation) {
   GURL start_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
   GURL blocked_url(embedded_test_server()->GetURL("bar.com", "/title2.html"));
@@ -1885,7 +1882,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 // Test to verify that error pages caused by network error or other
 // recoverable error are properly committed in the process for the
 // destination URL.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ErrorPageNetworkError) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, ErrorPageNetworkError) {
   GURL start_url(embedded_test_server()->GetURL("foo.com", "/title1.html"));
   GURL error_url(embedded_test_server()->GetURL("/close-socket"));
   EXPECT_NE(start_url.host(), error_url.host());
@@ -1922,8 +1919,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, ErrorPageNetworkError) {
 // blocked (net::ERR_BLOCKED_BY_CLIENT) while departing from a privileged WebUI
 // page (chrome://gpu). It is a security risk for the error page to commit in
 // the privileged process.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
-                       BlockedRequestAfterWebUI) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, BlockedRequestAfterWebUI) {
   GURL web_ui_url(GetWebUIURL("gpu"));
   WebContents* web_contents = shell()->web_contents();
 
@@ -1957,7 +1953,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Redirects to renderer debug URLs caused problems.
 // See https://crbug.com/728398.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        RedirectToRendererDebugUrl) {
   GURL url(embedded_test_server()->GetURL("/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url));
@@ -2003,7 +1999,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
 
 // Check that iframe with embedded credentials are blocked.
 // See https://crbug.com/755892.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        BlockCredentialedSubresources) {
   if (!base::FeatureList::IsEnabled(features::kBlockCredentialedSubresources))
     return;
@@ -2108,7 +2104,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
   }
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, StartToCommitMetrics) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, StartToCommitMetrics) {
   enum class FrameType {
     kMain,
     kSub,
@@ -2269,7 +2265,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, StartToCommitMetrics) {
 
 // Verify that the TimeToReadyToCommit2 metrics are correctly logged for
 // SameProcess vs CrossProcess as well as MainFrame vs Subframe cases.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest,
                        TimeToReadyToCommitMetrics) {
   EXPECT_TRUE(
       NavigateToURL(shell(), embedded_test_server()->GetURL("/hello.html")));
@@ -2339,7 +2335,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
   }
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest, IsDownload) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest, IsDownload) {
   GURL url(embedded_test_server()->GetURL("/download-test1.lib"));
   NavigationHandleObserver observer(shell()->web_contents(), url);
   EXPECT_TRUE(NavigateToURLAndExpectNoCommit(shell(), url));
@@ -2347,7 +2343,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest, IsDownload) {
   EXPECT_TRUE(observer.is_download());
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        DownloadFalseForHtmlResponse) {
   GURL url(embedded_test_server()->GetURL("/title1.html"));
   NavigationHandleObserver observer(shell()->web_contents(), url);
@@ -2356,7 +2352,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
   EXPECT_FALSE(observer.is_download());
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        DownloadFalseFor404) {
   GURL url(embedded_test_server()->GetURL("/page404.html"));
   NavigationHandleObserver observer(shell()->web_contents(), url);
@@ -2365,7 +2361,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
   EXPECT_FALSE(observer.is_download());
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        DownloadFalseForFailedNavigation) {
   GURL url(embedded_test_server()->GetURL("/download-test1.lib"));
   NavigationHandleObserver observer(shell()->web_contents(), url);
@@ -2380,7 +2376,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
   EXPECT_FALSE(observer.is_download());
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        RedirectToDownload) {
   GURL redirect_url(
       embedded_test_server()->GetURL("/cross-site/bar.com/download-test1.lib"));
@@ -2391,7 +2387,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
   EXPECT_TRUE(observer.is_download());
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        RedirectToDownloadFails) {
   GURL redirect_url(
       embedded_test_server()->GetURL("/cross-site/bar.com/download-test1.lib"));
@@ -2411,14 +2407,13 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
 
 // Set of tests that check the various NavigationThrottle events can be used
 // with custom error pages.
-class NavigationHandleImplThrottleResultWithErrorPageBrowserTest
-    : public NavigationHandleImplBrowserTest,
+class NavigationRequestThrottleResultWithErrorPageBrowserTest
+    : public NavigationRequestBrowserTest,
       public ::testing::WithParamInterface<NavigationThrottle::ThrottleAction> {
 };
 
-IN_PROC_BROWSER_TEST_P(
-    NavigationHandleImplThrottleResultWithErrorPageBrowserTest,
-    WillStartRequest) {
+IN_PROC_BROWSER_TEST_P(NavigationRequestThrottleResultWithErrorPageBrowserTest,
+                       WillStartRequest) {
   NavigationThrottle::ThrottleAction action = GetParam();
 
   if (action == NavigationThrottle::CANCEL_AND_IGNORE) {
@@ -2447,9 +2442,8 @@ IN_PROC_BROWSER_TEST_P(
       url, action, TestNavigationThrottleInstaller::WILL_START_REQUEST);
 }
 
-IN_PROC_BROWSER_TEST_P(
-    NavigationHandleImplThrottleResultWithErrorPageBrowserTest,
-    WillRedirectRequest) {
+IN_PROC_BROWSER_TEST_P(NavigationRequestThrottleResultWithErrorPageBrowserTest,
+                       WillRedirectRequest) {
   NavigationThrottle::ThrottleAction action = GetParam();
 
   if (action == NavigationThrottle::CANCEL_AND_IGNORE) {
@@ -2478,9 +2472,8 @@ IN_PROC_BROWSER_TEST_P(
       url, action, TestNavigationThrottleInstaller::WILL_REDIRECT_REQUEST);
 }
 
-IN_PROC_BROWSER_TEST_P(
-    NavigationHandleImplThrottleResultWithErrorPageBrowserTest,
-    WillFailRequest) {
+IN_PROC_BROWSER_TEST_P(NavigationRequestThrottleResultWithErrorPageBrowserTest,
+                       WillFailRequest) {
   NavigationThrottle::ThrottleAction action = GetParam();
 
   if (action == NavigationThrottle::PROCEED ||
@@ -2505,9 +2498,8 @@ IN_PROC_BROWSER_TEST_P(
       url, action, TestNavigationThrottleInstaller::WILL_FAIL_REQUEST);
 }
 
-IN_PROC_BROWSER_TEST_P(
-    NavigationHandleImplThrottleResultWithErrorPageBrowserTest,
-    WillProcessResponse) {
+IN_PROC_BROWSER_TEST_P(NavigationRequestThrottleResultWithErrorPageBrowserTest,
+                       WillProcessResponse) {
   NavigationThrottle::ThrottleAction action = GetParam();
 
   if (action == NavigationThrottle::CANCEL_AND_IGNORE) {
@@ -2535,14 +2527,14 @@ IN_PROC_BROWSER_TEST_P(
 
 INSTANTIATE_TEST_SUITE_P(
     /* no prefix */,
-    NavigationHandleImplThrottleResultWithErrorPageBrowserTest,
+    NavigationRequestThrottleResultWithErrorPageBrowserTest,
     testing::Range(NavigationThrottle::ThrottleAction::FIRST,
                    NavigationThrottle::ThrottleAction::LAST));
 
 // The set of tests...
-// * NavigationHandleImplDownloadBrowserTest.AllowedResourceDownloaded
-// * NavigationHandleImplDownloadBrowserTest.AllowedResourceNotDownloaded
-// * NavigationHandleImplDownloadBrowserTest.Disallowed
+// * NavigationRequestDownloadBrowserTest.AllowedResourceDownloaded
+// * NavigationRequestDownloadBrowserTest.AllowedResourceNotDownloaded
+// * NavigationRequestDownloadBrowserTest.Disallowed
 //
 // ...covers every combination of possible states for:
 // * CommonNavigationParams::download_policy (allow vs disallow)
@@ -2550,7 +2542,7 @@ INSTANTIATE_TEST_SUITE_P(
 //
 // Download policies that enumerate allowed / disallowed options are not tested
 // here.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        AllowedResourceDownloaded) {
   GURL simple_url(embedded_test_server()->GetURL("/simple_page.html"));
 
@@ -2572,8 +2564,8 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
   EXPECT_FALSE(handle_observer.is_download());
 }
 
-// See NavigationHandleImplDownloadBrowserTest.AllowedResourceNotDownloaded
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
+// See NavigationRequestDownloadBrowserTest.AllowedResourceNotDownloaded
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest,
                        AllowedResourceNotDownloaded) {
   GURL download_url(embedded_test_server()->GetURL("/download-test1.lib"));
 
@@ -2596,8 +2588,8 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest,
   EXPECT_TRUE(handle_observer.is_download());
 }
 
-// See NavigationHandleImplDownloadBrowserTest.AllowedResourceNotDownloaded
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest, Disallowed) {
+// See NavigationRequestDownloadBrowserTest.AllowedResourceNotDownloaded
+IN_PROC_BROWSER_TEST_F(NavigationRequestDownloadBrowserTest, Disallowed) {
   GURL download_url(embedded_test_server()->GetURL("/download-test1.lib"));
 
   // An URL is allowed to be a download iff it is not a view-source URL.
@@ -2626,12 +2618,12 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplDownloadBrowserTest, Disallowed) {
   EXPECT_FALSE(handle_observer.is_download());
 }
 
-class NavigationHandleImplBackForwardBrowserTest
-    : public NavigationHandleImplBrowserTest,
+class NavigationRequestBackForwardBrowserTest
+    : public NavigationRequestBrowserTest,
       public WebContentsObserver {
  protected:
   void SetUpOnMainThread() override {
-    NavigationHandleImplBrowserTest::SetUpOnMainThread();
+    NavigationRequestBrowserTest::SetUpOnMainThread();
 
     WebContentsObserver::Observe(shell()->web_contents());
   }
@@ -2645,7 +2637,7 @@ class NavigationHandleImplBackForwardBrowserTest
   std::vector<int64_t> offsets_;
 };
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBackForwardBrowserTest,
                        NavigationEntryOffsets) {
   const GURL url1(embedded_test_server()->GetURL("/title1.html"));
   const GURL url2(embedded_test_server()->GetURL("/title2.html"));
@@ -2702,7 +2694,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
   EXPECT_THAT(offsets_, testing::ElementsAre(1, 0, 1, 1, -1, -1, 1));
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBackForwardBrowserTest,
                        NavigationEntryOffsetsForSubframes) {
   const GURL url1(embedded_test_server()->GetURL("/title1.html"));
   const GURL url1_fragment1(
@@ -2781,7 +2773,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
               testing::ElementsAre(1, 1, 1, 0, 1, 1, -1, 1, -1, -1, -1, 4));
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBackForwardBrowserTest,
                        NavigationEntryLimit) {
   const GURL url1(embedded_test_server()->GetURL("/title1.html"));
 
@@ -2797,7 +2789,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
   EXPECT_THAT(offsets_, testing::ElementsAre(1, 1, 1, 1, 1));
 }
 
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
+IN_PROC_BROWSER_TEST_F(NavigationRequestBackForwardBrowserTest,
                        LocationReplace) {
   const GURL url1(embedded_test_server()->GetURL("/title1.html"));
 
@@ -2819,7 +2811,7 @@ IN_PROC_BROWSER_TEST_F(NavigationHandleImplBackForwardBrowserTest,
 
 // Tests that the correct net::AuthChallengeInfo is exposed from the
 // NavigationHandle when the page requests authentication.
-IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest, AuthChallengeInfo) {
+IN_PROC_BROWSER_TEST_F(NavigationRequestBrowserTest, AuthChallengeInfo) {
   GURL url(embedded_test_server()->GetURL("/auth-basic"));
   NavigationHandleObserver observer(shell()->web_contents(), url);
   EXPECT_TRUE(NavigateToURL(shell(), url));
diff --git a/chromium/content/browser/frame_host/navigation_request_unittest.cc b/chromium/content/browser/frame_host/navigation_request_unittest.cc
index 6b6494ecb14..7c251dae15c 100644
--- a/chromium/content/browser/frame_host/navigation_request_unittest.cc
+++ b/chromium/content/browser/frame_host/navigation_request_unittest.cc
@@ -9,6 +9,7 @@
 #include "build/build_config.h"
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/ssl_status.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_side_navigation_test_utils.h"
 #include "content/public/test/test_navigation_throttle.h"
@@ -92,8 +93,8 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
     // It's safe to use base::Unretained since the NavigationHandle is owned by
     // the NavigationRequestTest.
     request_->WillStartRequest(
-        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
-                   base::Unretained(this)));
+        base::BindOnce(&NavigationRequestTest::UpdateThrottleCheckResult,
+                       base::Unretained(this)));
   }
 
   // Helper function to call WillRedirectRequest on |handle|. If this function
@@ -109,8 +110,8 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
     // the NavigationRequestTest.
     request_->WillRedirectRequest(
         GURL(), nullptr,
-        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
-                   base::Unretained(this)));
+        base::BindOnce(&NavigationRequestTest::UpdateThrottleCheckResult,
+                       base::Unretained(this)));
   }
 
   // Helper function to call WillFailRequest on |handle|. If this function
@@ -126,8 +127,8 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
     // It's safe to use base::Unretained since the NavigationHandle is owned by
     // the NavigationRequestTest.
     request_->WillFailRequest(
-        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
-                   base::Unretained(this)));
+        base::BindOnce(&NavigationRequestTest::UpdateThrottleCheckResult,
+                       base::Unretained(this)));
   }
 
   // Helper function to call WillProcessResponse on |handle|. If this function
@@ -144,8 +145,8 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
     // to WillRedirectRequest to verify that it's correctly plumbed in both
     // cases.
     request_->WillProcessResponse(
-        base::Bind(&NavigationRequestTest::UpdateThrottleCheckResult,
-                   base::Unretained(this)));
+        base::BindOnce(&NavigationRequestTest::UpdateThrottleCheckResult,
+                       base::Unretained(this)));
   }
 
   // Whether the callback was called.
@@ -192,7 +193,7 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
   TestNavigationThrottle* CreateTestNavigationThrottle(
       NavigationThrottle::ThrottleCheckResult result) {
     TestNavigationThrottle* test_throttle =
-        new TestNavigationThrottle(request_->navigation_handle());
+        new TestNavigationThrottle(request_.get());
     test_throttle->SetResponseForAllMethods(TestNavigationThrottle::SYNCHRONOUS,
                                             result);
     request_->RegisterThrottleForTesting(
@@ -223,13 +224,13 @@ class NavigationRequestTest : public RenderViewHostImplTestHarness {
         main_test_rfh()->frame_tree_node(), std::move(common_params),
         CreateCommitNavigationParams(), false /* browser-initiated */,
         std::string(), nullptr, nullptr, nullptr, nullptr);
-    request_->CreateNavigationHandle(true);
+    request_->StartNavigation(true);
   }
 
  private:
-  // The callback provided to NavigationHandleImpl::WillStartRequest,
-  // NavigationHandleImpl::WillRedirectRequest, and
-  // NavigationHandleImpl::WillFailRequest during the tests.
+  // The callback provided to NavigationRequest::WillStartRequest,
+  // NavigationRequest::WillRedirectRequest, and
+  // NavigationRequest::WillFailRequest during the tests.
   void UpdateThrottleCheckResult(
       NavigationThrottle::ThrottleCheckResult result) {
     callback_result_ = result;
@@ -250,7 +251,8 @@ TEST_F(NavigationRequestTest, SimpleDataChecksRedirectAndProcess) {
       NavigationSimulatorImpl::CreateRendererInitiated(kUrl1, main_rfh());
   navigation->Start();
   EXPECT_EQ(blink::mojom::RequestContextType::HYPERLINK,
-            navigation->GetNavigationHandle()->request_context_type());
+            NavigationRequest::From(navigation->GetNavigationHandle())
+                ->request_context_type());
   EXPECT_EQ(net::HttpResponseInfo::CONNECTION_INFO_UNKNOWN,
             navigation->GetNavigationHandle()->GetConnectionInfo());
 
@@ -258,7 +260,8 @@ TEST_F(NavigationRequestTest, SimpleDataChecksRedirectAndProcess) {
       net::HttpResponseInfo::CONNECTION_INFO_HTTP1_1);
   navigation->Redirect(kUrl2);
   EXPECT_EQ(blink::mojom::RequestContextType::HYPERLINK,
-            navigation->GetNavigationHandle()->request_context_type());
+            NavigationRequest::From(navigation->GetNavigationHandle())
+                ->request_context_type());
   EXPECT_EQ(net::HttpResponseInfo::CONNECTION_INFO_HTTP1_1,
             navigation->GetNavigationHandle()->GetConnectionInfo());
 
@@ -266,7 +269,8 @@ TEST_F(NavigationRequestTest, SimpleDataChecksRedirectAndProcess) {
       net::HttpResponseInfo::CONNECTION_INFO_QUIC_35);
   navigation->ReadyToCommit();
   EXPECT_EQ(blink::mojom::RequestContextType::HYPERLINK,
-            navigation->GetNavigationHandle()->request_context_type());
+            NavigationRequest::From(navigation->GetNavigationHandle())
+                ->request_context_type());
   EXPECT_EQ(net::HttpResponseInfo::CONNECTION_INFO_QUIC_35,
             navigation->GetNavigationHandle()->GetConnectionInfo());
 }
@@ -292,13 +296,15 @@ TEST_F(NavigationRequestTest, SimpleDataChecksFailure) {
       NavigationSimulatorImpl::CreateRendererInitiated(kUrl, main_rfh());
   navigation->Start();
   EXPECT_EQ(blink::mojom::RequestContextType::HYPERLINK,
-            navigation->GetNavigationHandle()->request_context_type());
+            NavigationRequest::From(navigation->GetNavigationHandle())
+                ->request_context_type());
   EXPECT_EQ(net::HttpResponseInfo::CONNECTION_INFO_UNKNOWN,
             navigation->GetNavigationHandle()->GetConnectionInfo());
 
   navigation->Fail(net::ERR_CERT_DATE_INVALID);
   EXPECT_EQ(blink::mojom::RequestContextType::HYPERLINK,
-            navigation->GetNavigationHandle()->request_context_type());
+            NavigationRequest::From(navigation->GetNavigationHandle())
+                ->request_context_type());
   EXPECT_EQ(net::ERR_CERT_DATE_INVALID,
             navigation->GetNavigationHandle()->GetNetErrorCode());
 }
@@ -550,11 +556,12 @@ TEST_F(NavigationRequestTest, MAYBE_WillFailRequestCanAccessRenderFrameHost) {
   navigation->SetAutoAdvance(false);
   navigation->Start();
   navigation->Fail(net::ERR_CERT_DATE_INVALID);
-  EXPECT_EQ(
-      NavigationRequest::PROCESSING_WILL_FAIL_REQUEST,
-      navigation->GetNavigationHandle()->navigation_request()->handle_state());
+  EXPECT_EQ(NavigationRequest::PROCESSING_WILL_FAIL_REQUEST,
+            NavigationRequest::From(navigation->GetNavigationHandle())
+                ->handle_state());
   EXPECT_TRUE(navigation->GetNavigationHandle()->GetRenderFrameHost());
-  navigation->GetNavigationHandle()->CallResumeForTesting();
+  NavigationRequest::From(navigation->GetNavigationHandle())
+      ->CallResumeForTesting();
   EXPECT_TRUE(navigation->GetNavigationHandle()->GetRenderFrameHost());
 
   SetBrowserClientForTesting(old_browser_client);
diff --git a/chromium/content/browser/frame_host/navigation_throttle_runner.cc b/chromium/content/browser/frame_host/navigation_throttle_runner.cc
index a6a3ced8084..8727dc0f4de 100644
--- a/chromium/content/browser/frame_host/navigation_throttle_runner.cc
+++ b/chromium/content/browser/frame_host/navigation_throttle_runner.cc
@@ -10,10 +10,11 @@
 #include "content/browser/frame_host/form_submission_throttle.h"
 #include "content/browser/frame_host/history_navigation_ablation_study_navigation_throttle.h"
 #include "content/browser/frame_host/mixed_content_navigation_throttle.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/origin_policy_throttle.h"
 #include "content/browser/frame_host/webui_navigation_throttle.h"
+#include "content/public/browser/navigation_handle.h"
 
 namespace content {
 
@@ -89,41 +90,40 @@ void NavigationThrottleRunner::RegisterNavigationThrottles() {
   std::vector<std::unique_ptr<NavigationThrottle>> testing_throttles =
       std::move(throttles_);
 
-  NavigationHandleImpl* handle = static_cast<NavigationHandleImpl*>(handle_);
-  throttles_ =
-      handle->navigation_request()->GetDelegate()->CreateThrottlesForNavigation(
-          handle);
+  throttles_ = NavigationRequest::From(handle_)
+                   ->GetDelegate()
+                   ->CreateThrottlesForNavigation(handle_);
 
   // Enforce rules for WebUI navigations.
-  AddThrottle(WebUINavigationThrottle::CreateThrottleForNavigation(handle));
+  AddThrottle(WebUINavigationThrottle::CreateThrottleForNavigation(handle_));
 
   // Check for renderer-inititated main frame navigations to blocked URL schemes
   // (data, filesystem). This is done early as it may block the main frame
   // navigation altogether.
   AddThrottle(
-      BlockedSchemeNavigationThrottle::CreateThrottleForNavigation(handle));
+      BlockedSchemeNavigationThrottle::CreateThrottleForNavigation(handle_));
 
-  AddThrottle(AncestorThrottle::MaybeCreateThrottleFor(handle));
-  AddThrottle(FormSubmissionThrottle::MaybeCreateThrottleFor(handle));
+  AddThrottle(AncestorThrottle::MaybeCreateThrottleFor(handle_));
+  AddThrottle(FormSubmissionThrottle::MaybeCreateThrottleFor(handle_));
 
   // Check for mixed content. This is done after the AncestorThrottle and the
   // FormSubmissionThrottle so that when folks block mixed content with a CSP
   // policy, they don't get a warning. They'll still get a warning in the
   // console about CSP blocking the load.
   AddThrottle(
-      MixedContentNavigationThrottle::CreateThrottleForNavigation(handle));
+      MixedContentNavigationThrottle::CreateThrottleForNavigation(handle_));
 
   // Handle Origin Policy (if enabled)
-  AddThrottle(OriginPolicyThrottle::MaybeCreateThrottleFor(handle));
+  AddThrottle(OriginPolicyThrottle::MaybeCreateThrottleFor(handle_));
 
   for (auto& throttle :
-       devtools_instrumentation::CreateNavigationThrottles(handle)) {
+       devtools_instrumentation::CreateNavigationThrottles(handle_)) {
     AddThrottle(std::move(throttle));
   }
 
   // Delay navigation for an ablation study (if needed).
   AddThrottle(HistoryNavigationAblationStudyNavigationThrottle::
-                  MaybeCreateForNavigation(handle));
+                  MaybeCreateForNavigation(handle_));
 
   // Insert all testing NavigationThrottles last.
   throttles_.insert(throttles_.end(),
diff --git a/chromium/content/browser/frame_host/navigation_throttle_runner.h b/chromium/content/browser/frame_host/navigation_throttle_runner.h
index 916bb85da61..fc388d82130 100644
--- a/chromium/content/browser/frame_host/navigation_throttle_runner.h
+++ b/chromium/content/browser/frame_host/navigation_throttle_runner.h
@@ -12,8 +12,6 @@
 
 namespace content {
 
-class NavigationHandleImpl;
-
 // This class owns the set of NavigationThrottles added to a NavigationHandle.
 // It is responsible for calling the various sets of events on its
 // NavigationThrottle, and notifying its delegate of the results of said events.
@@ -74,10 +72,10 @@ class CONTENT_EXPORT NavigationThrottleRunner {
 
   // The NavigationHandle associated with the NavigationThrottles this
   // NavigationThrottleRunner manages.
-  // Note: |handle_| is not defined as a NavigationHandleImpl* so that a
+  // Note: |handle_| is not defined as a NavigationRequest* so that a
   // MockNavigationHandle can be used in unit_tests. Unit tests that use a
   // MockNavigationHandle should never call RegisterNavigationThrottles as this
-  // function expects |handle_| to be a NavigationHandleImpl instead.
+  // function expects |handle_| to be a NavigationRequest instead.
   NavigationHandle* handle_;
 
   // A list of Throttles registered for this navigation.
diff --git a/chromium/content/browser/frame_host/navigator.cc b/chromium/content/browser/frame_host/navigator.cc
index b10066485bf..a2805dc0bce 100644
--- a/chromium/content/browser/frame_host/navigator.cc
+++ b/chromium/content/browser/frame_host/navigator.cc
@@ -5,6 +5,7 @@
 #include "content/browser/frame_host/navigator.h"
 
 #include "base/time/time.h"
+#include "content/browser/web_package/bundled_exchanges_handle_tracker.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
 
 namespace content {
@@ -19,7 +20,7 @@ NavigationController* Navigator::GetController() {
 
 bool Navigator::StartHistoryNavigationInNewSubframe(
     RenderFrameHostImpl* render_frame_host,
-    mojom::NavigationClientAssociatedPtrInfo* navigation_client) {
+    mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client) {
   return false;
 }
 
@@ -32,9 +33,11 @@ void Navigator::OnBeginNavigation(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::BeginNavigationParamsPtr begin_params,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
     scoped_refptr<PrefetchedSignedExchangeCache>
-        prefetched_signed_exchange_cache) {}
+        prefetched_signed_exchange_cache,
+    std::unique_ptr<BundledExchangesHandleTracker>
+        bundled_exchanges_handle_tracker) {}
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator.h b/chromium/content/browser/frame_host/navigator.h
index cea80e75f2c..194aa8501bd 100644
--- a/chromium/content/browser/frame_host/navigator.h
+++ b/chromium/content/browser/frame_host/navigator.h
@@ -7,14 +7,15 @@
 
 #include "base/memory/ref_counted.h"
 #include "base/time/time.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/common/content_export.h"
+#include "content/common/frame_messages.h"
 #include "content/common/navigation_params.mojom.h"
 #include "content/public/browser/navigation_controller.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "ui/base/window_open_disposition.h"
 
 class GURL;
@@ -30,6 +31,7 @@ class ResourceRequestBody;
 
 namespace content {
 
+class BundledExchangesHandleTracker;
 class FrameNavigationEntry;
 class FrameTreeNode;
 class PrefetchedSignedExchangeCache;
@@ -86,7 +88,8 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
   // FrameNavigationEntry can't be found or the navigation fails.
   virtual bool StartHistoryNavigationInNewSubframe(
       RenderFrameHostImpl* render_frame_host,
-      mojom::NavigationClientAssociatedPtrInfo* navigation_client);
+      mojo::PendingAssociatedRemote<mojom::NavigationClient>*
+          navigation_client);
 
   // Navigation requests -------------------------------------------------------
 
@@ -113,7 +116,7 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
       WindowOpenDisposition disposition,
       bool should_replace_current_entry,
       bool user_gesture,
-      blink::WebTriggeringEventInfo triggering_event_info,
+      blink::TriggeringEventInfo triggering_event_info,
       const std::string& href_translate,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {}
 
@@ -150,11 +153,13 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
       mojom::CommonNavigationParamsPtr common_params,
       mojom::BeginNavigationParamsPtr begin_params,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      mojom::NavigationClientAssociatedPtrInfo navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>
           navigation_initiator,
       scoped_refptr<PrefetchedSignedExchangeCache>
-          prefetched_signed_exchange_cache);
+          prefetched_signed_exchange_cache,
+      std::unique_ptr<BundledExchangesHandleTracker>
+          bundled_exchanges_handle_tracker);
 
   // Used to restart a navigation that was thought to be same-document in
   // cross-document mode.
@@ -186,14 +191,6 @@ class CONTENT_EXPORT Navigator : public base::RefCounted<Navigator> {
       const base::TimeTicks& renderer_before_unload_start_time,
       const base::TimeTicks& renderer_before_unload_end_time) {}
 
-  // Called when a navigation has failed or the response is 204/205 to discard
-  // the pending entry in order to avoid url spoofs. |expected_pending_entry_id|
-  // is the ID of the pending NavigationEntry at the start of the navigation.
-  // With sufficiently bad interleaving of IPCs, this may no longer be the
-  // pending NavigationEntry, in which case the pending NavigationEntry will not
-  // be discarded.
-  virtual void DiscardPendingEntryIfNeeded(int expected_pending_entry_id) {}
-
  protected:
   friend class base::RefCounted<Navigator>;
   virtual ~Navigator() {}
diff --git a/chromium/content/browser/frame_host/navigator_delegate.cc b/chromium/content/browser/frame_host/navigator_delegate.cc
index 5ab06ef5a4b..143f5041900 100644
--- a/chromium/content/browser/frame_host/navigator_delegate.cc
+++ b/chromium/content/browser/frame_host/navigator_delegate.cc
@@ -19,10 +19,6 @@ bool NavigatorDelegate::ShouldTransferNavigation(
   return true;
 }
 
-bool NavigatorDelegate::ShouldPreserveAbortedURLs() {
-  return false;
-}
-
 std::vector<std::unique_ptr<NavigationThrottle>>
 NavigatorDelegate::CreateThrottlesForNavigation(
     NavigationHandle* navigation_handle) {
diff --git a/chromium/content/browser/frame_host/navigator_delegate.h b/chromium/content/browser/frame_host/navigator_delegate.h
index 4d2327a23ff..f0bafe83c45 100644
--- a/chromium/content/browser/frame_host/navigator_delegate.h
+++ b/chromium/content/browser/frame_host/navigator_delegate.h
@@ -91,10 +91,6 @@ class CONTENT_EXPORT NavigatorDelegate {
   // different process between the load start and commit.
   virtual bool ShouldTransferNavigation(bool is_main_frame_navigation);
 
-  // Returns whether URLs for aborted browser-initiated navigations should be
-  // preserved in the omnibox.  Defaults to false.
-  virtual bool ShouldPreserveAbortedURLs();
-
   // Returns the overriden user agent string if it's set.
   virtual const std::string& GetUserAgentOverride() = 0;
 
@@ -134,6 +130,6 @@ class CONTENT_EXPORT NavigatorDelegate {
   virtual bool ShowingInterstitialPage() = 0;
 };
 
-}  // namspace content
+}  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_NAVIGATOR_DELEGATE_H_
diff --git a/chromium/content/browser/frame_host/navigator_impl.cc b/chromium/content/browser/frame_host/navigator_impl.cc
index a781313eed7..5b39e8f1d7c 100644
--- a/chromium/content/browser/frame_host/navigator_impl.cc
+++ b/chromium/content/browser/frame_host/navigator_impl.cc
@@ -16,13 +16,13 @@
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigation_request_info.h"
 #include "content/browser/frame_host/navigator_delegate.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/site_instance_impl.h"
+#include "content/browser/web_package/bundled_exchanges_handle_tracker.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
 #include "content/browser/webui/web_ui_controller_factory_registry.h"
 #include "content/browser/webui/web_ui_impl.h"
@@ -176,11 +176,9 @@ void NavigatorImpl::DidFailProvisionalLoadWithError(
   }
 
   // Discard the pending navigation entry if needed.
-  int expected_pending_entry_id =
-      render_frame_host->GetNavigationHandle()
-          ? render_frame_host->GetNavigationHandle()->pending_nav_entry_id()
-          : 0;
-  DiscardPendingEntryIfNeeded(expected_pending_entry_id);
+  NavigationRequest* request = render_frame_host->navigation_request();
+  if (request)
+    request->DropPendingEntryRef();
 }
 
 void NavigatorImpl::DidFailLoadWithError(
@@ -196,7 +194,7 @@ void NavigatorImpl::DidFailLoadWithError(
 
 bool NavigatorImpl::StartHistoryNavigationInNewSubframe(
     RenderFrameHostImpl* render_frame_host,
-    mojom::NavigationClientAssociatedPtrInfo* navigation_client) {
+    mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client) {
   return controller_->StartHistoryNavigationInNewSubframe(render_frame_host,
                                                           navigation_client);
 }
@@ -409,7 +407,7 @@ void NavigatorImpl::RequestOpenURL(
     WindowOpenDisposition disposition,
     bool should_replace_current_entry,
     bool user_gesture,
-    blink::WebTriggeringEventInfo triggering_event_info,
+    blink::TriggeringEventInfo triggering_event_info,
     const std::string& href_translate,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory) {
   // Note: This can be called for subframes (even when OOPIFs are not possible)
@@ -429,15 +427,6 @@ void NavigatorImpl::RequestOpenURL(
   // redirects.  http://crbug.com/311721.
   std::vector<GURL> redirect_chain;
 
-  // Note that unlike NavigateFromFrameProxy, this uses the navigating
-  // RenderFrameHost's current SiteInstance, as that's where this navigation
-  // originated.
-  GURL dest_url(url);
-  if (!GetContentClient()->browser()->ShouldAllowOpenURL(current_site_instance,
-                                                         url)) {
-    dest_url = GURL(url::kAboutBlankURL);
-  }
-
   int frame_tree_node_id = -1;
 
   // Send the navigation to the current FrameTreeNode if it's destined for a
@@ -449,7 +438,7 @@ void NavigatorImpl::RequestOpenURL(
         render_frame_host->frame_tree_node()->frame_tree_node_id();
   }
 
-  OpenURLParams params(dest_url, referrer, frame_tree_node_id, disposition,
+  OpenURLParams params(url, referrer, frame_tree_node_id, disposition,
                        ui::PAGE_TRANSITION_LINK,
                        true /* is_renderer_initiated */);
   params.uses_post = uses_post;
@@ -485,10 +474,6 @@ void NavigatorImpl::RequestOpenURL(
   params.blob_url_loader_factory = std::move(blob_url_loader_factory);
   params.href_translate = href_translate;
 
-  GetContentClient()->browser()->OverrideNavigationParams(
-      current_site_instance, &params.transition, &params.is_renderer_initiated,
-      &params.referrer, &params.initiator_origin);
-
   if (delegate_)
     delegate_->OpenURL(params);
 }
@@ -518,24 +503,10 @@ void NavigatorImpl::NavigateFromFrameProxy(
           render_frame_host->frame_tree_node()->IsMainFrame()))
     return;
 
-  Referrer referrer_to_use(referrer);
-  SiteInstance* current_site_instance = render_frame_host->GetSiteInstance();
-  // It is important to pass in the source_site_instance if it is available
-  // (such as when navigating a proxy).  See https://crbug.com/656752.
-  if (!GetContentClient()->browser()->ShouldAllowOpenURL(
-          source_site_instance ? source_site_instance : current_site_instance,
-          url)) {
-    // It is important to return here, rather than rewrite the url to
-    // about:blank.  The latter won't actually have any effect when
-    // transferring, as NavigateToEntry will think that the transfer is to the
-    // same RFH that started the navigation and let the existing navigation (for
-    // the disallowed URL) proceed.
-    return;
-  }
-
   // TODO(creis): Determine if this transfer started as a browser-initiated
   // navigation.  See https://crbug.com/495161.
   bool is_renderer_initiated = true;
+  Referrer referrer_to_use(referrer);
   if (render_frame_host->web_ui()) {
     // Note that we hide the referrer for Web UI pages. We don't really want
     // web sites to see a referrer of "chrome://blah" (and some chrome: URLs
@@ -554,13 +525,8 @@ void NavigatorImpl::NavigateFromFrameProxy(
     return;
   }
 
-  base::Optional<url::Origin> final_initiator_origin = initiator_origin;
-  GetContentClient()->browser()->OverrideNavigationParams(
-      current_site_instance, &page_transition, &is_renderer_initiated,
-      &referrer_to_use, &final_initiator_origin);
-
   controller_->NavigateFromFrameProxy(
-      render_frame_host, url, final_initiator_origin, is_renderer_initiated,
+      render_frame_host, url, initiator_origin, is_renderer_initiated,
       source_site_instance, referrer_to_use, page_transition,
       should_replace_current_entry, download_policy, method, post_body,
       extra_headers, std::move(blob_url_loader_factory));
@@ -618,10 +584,12 @@ void NavigatorImpl::OnBeginNavigation(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::BeginNavigationParamsPtr begin_params,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator,
     scoped_refptr<PrefetchedSignedExchangeCache>
-        prefetched_signed_exchange_cache) {
+        prefetched_signed_exchange_cache,
+    std::unique_ptr<BundledExchangesHandleTracker>
+        bundled_exchanges_handle_tracker) {
   // TODO(clamy): the url sent by the renderer should be validated with
   // FilterURL.
   // This is a renderer-initiated navigation.
@@ -658,22 +626,9 @@ void NavigatorImpl::OnBeginNavigation(
     return;
   }
 
-  // In all other cases the current navigation, if any, is canceled and a new
-  // NavigationRequest is created for the node.
-  if (frame_tree_node->IsMainFrame()) {
-    // Renderer-initiated main-frame navigations that need to swap processes
-    // will go to the browser via a OpenURL call, and then be handled by the
-    // same code path as browser-initiated navigations. For renderer-initiated
-    // main frame navigation that start via a BeginNavigation IPC, the
-    // RenderFrameHost will not be swapped. Therefore it is safe to call
-    // DidStartMainFrameNavigation with the SiteInstance from the current
-    // RenderFrameHost.
-    DidStartMainFrameNavigation(
-        *common_params,
-        frame_tree_node->current_frame_host()->GetSiteInstance(), nullptr);
-    navigation_data_.reset();
-  }
-  NavigationEntryImpl* pending_entry = controller_->GetPendingEntry();
+  NavigationEntryImpl* navigation_entry =
+      GetNavigationEntryForRendererInitiatedNavigation(*common_params,
+                                                       frame_tree_node);
   NavigationEntryImpl* current_entry = controller_->GetLastCommittedEntry();
   if (current_entry && common_params->url == current_entry->GetReferrer().url) {
     // Looks like a potential client redirect loop. Turn off any preview
@@ -692,12 +647,13 @@ void NavigatorImpl::OnBeginNavigation(
           : delegate_ && delegate_->ShouldOverrideUserAgentInNewTabs();
   frame_tree_node->CreatedNavigationRequest(
       NavigationRequest::CreateRendererInitiated(
-          frame_tree_node, pending_entry, std::move(common_params),
+          frame_tree_node, navigation_entry, std::move(common_params),
           std::move(begin_params), controller_->GetLastCommittedEntryIndex(),
           controller_->GetEntryCount(), override_user_agent,
           std::move(blob_url_loader_factory), std::move(navigation_client),
           std::move(navigation_initiator),
-          std::move(prefetched_signed_exchange_cache)));
+          std::move(prefetched_signed_exchange_cache),
+          std::move(bundled_exchanges_handle_tracker)));
   NavigationRequest* navigation_request = frame_tree_node->navigation_request();
 
   // This frame has already run beforeunload before it sent this IPC.  See if
@@ -786,51 +742,6 @@ void NavigatorImpl::LogBeforeUnloadTime(
   }
 }
 
-void NavigatorImpl::DiscardPendingEntryIfNeeded(int expected_pending_entry_id) {
-  // Racy conditions can cause a fail message to arrive after its corresponding
-  // pending entry has been replaced by another navigation. If
-  // |DiscardPendingEntry| is called in this case, then the completely valid
-  // entry for the new navigation would be discarded. See crbug.com/513742. To
-  // catch this case, the current pending entry is compared against the current
-  // navigation handle's entry id, which should correspond to the failed load.
-  NavigationEntry* pending_entry = controller_->GetPendingEntry();
-  bool pending_matches_fail_msg =
-      pending_entry &&
-      expected_pending_entry_id == pending_entry->GetUniqueID();
-  if (!pending_matches_fail_msg)
-    return;
-
-  // We usually clear the pending entry when it fails, so that an arbitrary URL
-  // isn't left visible above a committed page. This must be enforced when the
-  // pending entry isn't visible (e.g., renderer-initiated navigations) to
-  // prevent URL spoofs for same-document navigations that don't go through
-  // DidStartProvisionalLoadForFrame.
-  //
-  // However, we do preserve the pending entry in some cases, such as on the
-  // initial navigation of an unmodified blank tab. We also allow the delegate
-  // to say when it's safe to leave aborted URLs in the omnibox, to let the
-  // user edit the URL and try again. This may be useful in cases that the
-  // committed page cannot be attacker-controlled. In these cases, we still
-  // allow the view to clear the pending entry and typed URL if the user
-  // requests (e.g., hitting Escape with focus in the address bar).
-  //
-  // Do not leave the pending entry visible if it has an invalid URL, since this
-  // might be formatted in an unexpected or unsafe way.
-  // TODO(creis): Block navigations to invalid URLs in https://crbug.com/850824.
-  //
-  // Note: don't touch the transient entry, since an interstitial may exist.
-  bool should_preserve_entry = pending_entry->GetURL().is_valid() &&
-                               (controller_->IsUnmodifiedBlankTab() ||
-                                delegate_->ShouldPreserveAbortedURLs());
-  if (pending_entry != controller_->GetVisibleEntry() ||
-      !should_preserve_entry) {
-    controller_->DiscardPendingEntry(true);
-
-    // Also force the UI to refresh.
-    controller_->delegate()->NotifyNavigationStateChanged(INVALIDATE_TYPE_URL);
-  }
-}
-
 void NavigatorImpl::RecordNavigationMetrics(
     const LoadCommittedDetails& details,
     const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
@@ -882,10 +793,13 @@ void NavigatorImpl::RecordNavigationMetrics(
   navigation_data_.reset();
 }
 
-void NavigatorImpl::DidStartMainFrameNavigation(
+NavigationEntryImpl*
+NavigatorImpl::GetNavigationEntryForRendererInitiatedNavigation(
     const mojom::CommonNavigationParams& common_params,
-    SiteInstanceImpl* site_instance,
-    NavigationHandleImpl* navigation_handle) {
+    FrameTreeNode* frame_tree_node) {
+  if (!frame_tree_node->IsMainFrame())
+    return nullptr;
+
   // If there is no browser-initiated pending entry for this navigation and it
   // is not for the error URL, create a pending entry and ensure the address bar
   // updates accordingly.  We don't know the referrer or extra headers at this
@@ -895,6 +809,8 @@ void NavigatorImpl::DidStartMainFrameNavigation(
   NavigationEntryImpl* pending_entry = controller_->GetPendingEntry();
   bool has_browser_initiated_pending_entry =
       pending_entry && !pending_entry->is_renderer_initiated();
+  if (has_browser_initiated_pending_entry)
+    return nullptr;
 
   // A pending navigation entry is created in OnBeginNavigation(). The renderer
   // sends a provisional load notification after that. We don't want to create
@@ -902,33 +818,37 @@ void NavigatorImpl::DidStartMainFrameNavigation(
   bool renderer_provisional_load_to_pending_url =
       pending_entry && pending_entry->is_renderer_initiated() &&
       (pending_entry->GetURL() == common_params.url);
+  if (renderer_provisional_load_to_pending_url)
+    return nullptr;
 
   // If there is a transient entry, creating a new pending entry will result
   // in deleting it, which leads to inconsistent state.
   bool has_transient_entry = !!controller_->GetTransientEntry();
+  if (has_transient_entry)
+    return nullptr;
+
+  // Since GetNavigationEntryForRendererInitiatedNavigation is called from
+  // OnBeginNavigation, we can assume that no frame proxies are involved and
+  // therefore that |current_site_instance| is also the |source_site_instance|.
+  SiteInstance* current_site_instance =
+      frame_tree_node->current_frame_host()->GetSiteInstance();
+  SiteInstance* source_site_instance = current_site_instance;
+
+  std::unique_ptr<NavigationEntryImpl> entry =
+      NavigationEntryImpl::FromNavigationEntry(
+          NavigationControllerImpl::CreateNavigationEntry(
+              common_params.url, content::Referrer(),
+              common_params.initiator_origin, source_site_instance,
+              ui::PAGE_TRANSITION_LINK, true /* is_renderer_initiated */,
+              std::string() /* extra_headers */,
+              controller_->GetBrowserContext(),
+              nullptr /* blob_url_loader_factory */));
+
+  controller_->SetPendingEntry(std::move(entry));
+  if (delegate_)
+    delegate_->NotifyChangedNavigationState(content::INVALIDATE_TYPE_URL);
 
-  if (!has_browser_initiated_pending_entry && !has_transient_entry &&
-      !renderer_provisional_load_to_pending_url) {
-    std::unique_ptr<NavigationEntryImpl> entry =
-        NavigationEntryImpl::FromNavigationEntry(
-            NavigationController::CreateNavigationEntry(
-                common_params.url, content::Referrer(),
-                common_params.initiator_origin, ui::PAGE_TRANSITION_LINK,
-                true /* is_renderer_initiated */, std::string(),
-                controller_->GetBrowserContext(),
-                nullptr /* blob_url_loader_factory */));
-    // TODO(creis): If there's a pending entry already, find a safe way to
-    // update it instead of replacing it and copying over things like this.
-    // That will allow us to skip the NavigationHandle update below as well.
-    if (pending_entry) {
-      entry->set_should_replace_entry(pending_entry->should_replace_entry());
-      entry->SetRedirectChain(pending_entry->GetRedirectChain());
-    }
-
-    controller_->SetPendingEntry(std::move(entry));
-    if (delegate_)
-      delegate_->NotifyChangedNavigationState(content::INVALIDATE_TYPE_URL);
-  }
+  return controller_->GetPendingEntry();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/navigator_impl.h b/chromium/content/browser/frame_host/navigator_impl.h
index b941c0c558c..c3a53d4848d 100644
--- a/chromium/content/browser/frame_host/navigator_impl.h
+++ b/chromium/content/browser/frame_host/navigator_impl.h
@@ -57,7 +57,8 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
                    bool was_within_same_document) override;
   bool StartHistoryNavigationInNewSubframe(
       RenderFrameHostImpl* render_frame_host,
-      mojom::NavigationClientAssociatedPtrInfo* navigation_client) override;
+      mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client)
+      override;
   void Navigate(std::unique_ptr<NavigationRequest> request,
                 ReloadType reload_type,
                 RestoreType restore_type) override;
@@ -71,7 +72,7 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
                       WindowOpenDisposition disposition,
                       bool should_replace_current_entry,
                       bool user_gesture,
-                      blink::WebTriggeringEventInfo triggering_event_info,
+                      blink::TriggeringEventInfo triggering_event_info,
                       const std::string& href_translate,
                       scoped_refptr<network::SharedURLLoaderFactory>
                           blob_url_loader_factory) override;
@@ -97,11 +98,13 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
       mojom::CommonNavigationParamsPtr common_params,
       mojom::BeginNavigationParamsPtr begin_params,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      mojom::NavigationClientAssociatedPtrInfo navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>
           navigation_initiator,
       scoped_refptr<PrefetchedSignedExchangeCache>
-          prefetched_signed_exchange_cache) override;
+          prefetched_signed_exchange_cache,
+      std::unique_ptr<BundledExchangesHandleTracker>
+          bundled_exchanges_handle_tracker) override;
   void RestartNavigationAsCrossDocument(
       std::unique_ptr<NavigationRequest> navigation_request) override;
   void OnAbortNavigation(FrameTreeNode* frame_tree_node) override;
@@ -112,8 +115,6 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
       const base::TimeTicks& renderer_before_unload_end_time) override;
   void CancelNavigation(FrameTreeNode* frame_tree_node,
                         bool inform_renderer) override;
-  void DiscardPendingEntryIfNeeded(int expected_pending_entry_id) override;
-
  private:
   // Holds data used to track browser side navigation metrics.
   struct NavigationMetricsData;
@@ -126,13 +127,12 @@ class CONTENT_EXPORT NavigatorImpl : public Navigator {
       const FrameHostMsg_DidCommitProvisionalLoad_Params& params,
       SiteInstance* site_instance);
 
-  // Called when a navigation has started in a main frame, to update the pending
-  // NavigationEntry if the controller does not currently have a
-  // browser-initiated one.
-  void DidStartMainFrameNavigation(
+  // Called when a renderer initiated navigation has started. Returns the
+  // pending NavigationEntry to be used. Either null or a new one owned
+  // NavigationController.
+  NavigationEntryImpl* GetNavigationEntryForRendererInitiatedNavigation(
       const mojom::CommonNavigationParams& common_params,
-      SiteInstanceImpl* site_instance,
-      NavigationHandleImpl* navigation_handle);
+      FrameTreeNode* frame_tree_node);
 
   // The NavigationController that will keep track of session history for all
   // RenderFrameHost objects using this NavigatorImpl.
diff --git a/chromium/content/browser/frame_host/navigator_impl_unittest.cc b/chromium/content/browser/frame_host/navigator_impl_unittest.cc
index 2f5f7a264dc..6a3ba597927 100644
--- a/chromium/content/browser/frame_host/navigator_impl_unittest.cc
+++ b/chromium/content/browser/frame_host/navigator_impl_unittest.cc
@@ -46,13 +46,9 @@ class NavigatorTest : public RenderViewHostImplTestHarness {
   using SiteInstanceDescriptor = RenderFrameHostManager::SiteInstanceDescriptor;
   using SiteInstanceRelation = RenderFrameHostManager::SiteInstanceRelation;
 
-  void SetUp() override {
-    RenderViewHostImplTestHarness::SetUp();
-  }
+  void SetUp() override { RenderViewHostImplTestHarness::SetUp(); }
 
-  void TearDown() override {
-    RenderViewHostImplTestHarness::TearDown();
-  }
+  void TearDown() override { RenderViewHostImplTestHarness::TearDown(); }
 
   TestNavigationURLLoader* GetLoaderForNavigationRequest(
       NavigationRequest* request) const {
diff --git a/chromium/content/browser/frame_host/origin_policy_throttle.cc b/chromium/content/browser/frame_host/origin_policy_throttle.cc
index e85457d037a..dc128854023 100644
--- a/chromium/content/browser/frame_host/origin_policy_throttle.cc
+++ b/chromium/content/browser/frame_host/origin_policy_throttle.cc
@@ -11,12 +11,12 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/feature_list.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "services/network/public/mojom/origin_policy_manager.mojom.h"
@@ -92,8 +92,7 @@ OriginPolicyThrottle::WillProcessResponse() {
   const base::Optional<network::OriginPolicy>& origin_policy =
       GetTestOriginPolicy().has_value()
           ? GetTestOriginPolicy()
-          : static_cast<NavigationHandleImpl*>(navigation_handle())
-                ->navigation_request()
+          : NavigationRequest::From(navigation_handle())
                 ->response()
                 ->head.origin_policy;
 
diff --git a/chromium/content/browser/frame_host/origin_policy_throttle_unittest.cc b/chromium/content/browser/frame_host/origin_policy_throttle_unittest.cc
index 0f665dfbb8f..5957385a8f3 100644
--- a/chromium/content/browser/frame_host/origin_policy_throttle_unittest.cc
+++ b/chromium/content/browser/frame_host/origin_policy_throttle_unittest.cc
@@ -11,7 +11,7 @@
 #include "base/feature_list.h"
 #include "base/macros.h"
 #include "base/test/scoped_feature_list.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
diff --git a/chromium/content/browser/frame_host/popup_menu_helper_mac.h b/chromium/content/browser/frame_host/popup_menu_helper_mac.h
index 03f039b0443..837455ffcb1 100644
--- a/chromium/content/browser/frame_host/popup_menu_helper_mac.h
+++ b/chromium/content/browser/frame_host/popup_menu_helper_mac.h
@@ -13,6 +13,7 @@
 #include "base/memory/weak_ptr.h"
 #include "base/scoped_observer.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_observer.h"
 #include "ui/gfx/geometry/rect.h"
 
@@ -71,15 +72,15 @@ class PopupMenuHelper : public RenderWidgetHostObserver {
 
   Delegate* delegate_;  // Weak. Owns |this|.
 
-  ScopedObserver<RenderWidgetHost, RenderWidgetHostObserver> observer_;
-  RenderFrameHostImpl* render_frame_host_;
-  WebMenuRunner* menu_runner_;
-  bool popup_was_hidden_;
+  ScopedObserver<RenderWidgetHost, RenderWidgetHostObserver> observer_{this};
+  base::WeakPtr<RenderFrameHostImpl> render_frame_host_;
+  WebMenuRunner* menu_runner_ = nil;
+  bool popup_was_hidden_ = false;
 
   // Controls whether messages can be pumped during the menu fade.
   std::unique_ptr<base::ScopedPumpMessagesInPrivateModes> pump_in_fade_;
 
-  base::WeakPtrFactory<PopupMenuHelper> weak_ptr_factory_;
+  base::WeakPtrFactory<PopupMenuHelper> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(PopupMenuHelper);
 };
diff --git a/chromium/content/browser/frame_host/popup_menu_helper_mac.mm b/chromium/content/browser/frame_host/popup_menu_helper_mac.mm
index 76b42c7da32..8060f37947f 100644
--- a/chromium/content/browser/frame_host/popup_menu_helper_mac.mm
+++ b/chromium/content/browser/frame_host/popup_menu_helper_mac.mm
@@ -28,11 +28,8 @@ bool g_allow_showing_popup_menus = true;
 PopupMenuHelper::PopupMenuHelper(Delegate* delegate,
                                  RenderFrameHost* render_frame_host)
     : delegate_(delegate),
-      observer_(this),
-      render_frame_host_(static_cast<RenderFrameHostImpl*>(render_frame_host)),
-      menu_runner_(nil),
-      popup_was_hidden_(false),
-      weak_ptr_factory_(this) {
+      render_frame_host_(
+          static_cast<RenderFrameHostImpl*>(render_frame_host)->GetWeakPtr()) {
   RenderWidgetHost* widget_host =
       render_frame_host->GetRenderViewHost()->GetWidget();
   observer_.Add(widget_host);
@@ -150,7 +147,6 @@ void PopupMenuHelper::RenderWidgetHostVisibilityChanged(
 }
 
 void PopupMenuHelper::RenderWidgetHostDestroyed(RenderWidgetHost* widget_host) {
-  render_frame_host_ = nullptr;
   observer_.Remove(widget_host);
 }
 
diff --git a/chromium/content/browser/frame_host/render_frame_host_android.cc b/chromium/content/browser/frame_host/render_frame_host_android.cc
index 7474639309d..44b148223dc 100644
--- a/chromium/content/browser/frame_host/render_frame_host_android.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_android.cc
@@ -15,7 +15,10 @@
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/android/content_jni_headers/RenderFrameHostImpl_jni.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/browser/site_instance.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy_feature.mojom-shared.h"
+#include "url/origin.h"
 
 using base::android::AttachCurrentThread;
 using base::android::ConvertUTF8ToJavaString;
@@ -78,6 +81,12 @@ ScopedJavaLocalRef<jstring> RenderFrameHostAndroid::GetLastCommittedURL(
       env, render_frame_host_->GetLastCommittedURL().spec());
 }
 
+ScopedJavaLocalRef<jobject> RenderFrameHostAndroid::GetLastCommittedOrigin(
+    JNIEnv* env,
+    const JavaParamRef<jobject>& obj) {
+  return render_frame_host_->GetLastCommittedOrigin().CreateJavaObject();
+}
+
 void RenderFrameHostAndroid::GetCanonicalUrlForSharing(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>&,
@@ -87,6 +96,13 @@ void RenderFrameHostAndroid::GetCanonicalUrlForSharing(
       base::android::ScopedJavaGlobalRef<jobject>(env, jcallback)));
 }
 
+bool RenderFrameHostAndroid::IsPaymentFeaturePolicyEnabled(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>&) const {
+  return render_frame_host_->IsFeatureEnabled(
+      blink::mojom::FeaturePolicyFeature::kPayment);
+}
+
 ScopedJavaLocalRef<jobject>
 RenderFrameHostAndroid::GetAndroidOverlayRoutingToken(
     JNIEnv* env,
@@ -107,4 +123,10 @@ jboolean RenderFrameHostAndroid::IsRenderFrameCreated(
   return render_frame_host_->IsRenderFrameCreated();
 }
 
+jboolean RenderFrameHostAndroid::IsProcessBlocked(
+    JNIEnv* env,
+    const base::android::JavaParamRef<jobject>&) const {
+  return render_frame_host_->GetProcess()->IsBlocked();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_android.h b/chromium/content/browser/frame_host/render_frame_host_android.h
index efa9a2c6195..0732737990d 100644
--- a/chromium/content/browser/frame_host/render_frame_host_android.h
+++ b/chromium/content/browser/frame_host/render_frame_host_android.h
@@ -39,11 +39,19 @@ class RenderFrameHostAndroid : public base::SupportsUserData::Data {
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>&) const;
 
+  base::android::ScopedJavaLocalRef<jobject> GetLastCommittedOrigin(
+      JNIEnv* env,
+      const base::android::JavaParamRef<jobject>&);
+
   void GetCanonicalUrlForSharing(
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>&,
       const base::android::JavaParamRef<jobject>& jcallback) const;
 
+  bool IsPaymentFeaturePolicyEnabled(
+      JNIEnv* env,
+      const base::android::JavaParamRef<jobject>&) const;
+
   // Returns UnguessableToken.
   base::android::ScopedJavaLocalRef<jobject> GetAndroidOverlayRoutingToken(
       JNIEnv* env,
@@ -56,6 +64,9 @@ class RenderFrameHostAndroid : public base::SupportsUserData::Data {
       JNIEnv* env,
       const base::android::JavaParamRef<jobject>&) const;
 
+  jboolean IsProcessBlocked(JNIEnv* env,
+                            const base::android::JavaParamRef<jobject>&) const;
+
   RenderFrameHostImpl* render_frame_host() const { return render_frame_host_; }
 
  private:
diff --git a/chromium/content/browser/frame_host/render_frame_host_delegate.cc b/chromium/content/browser/frame_host/render_frame_host_delegate.cc
index 76a68ea7391..e4f2dcf65b1 100644
--- a/chromium/content/browser/frame_host/render_frame_host_delegate.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_delegate.cc
@@ -97,7 +97,8 @@ RenderFrameHostDelegate::GetGeolocationContext() {
 }
 
 #if defined(OS_ANDROID)
-void RenderFrameHostDelegate::GetNFC(device::mojom::NFCRequest request) {}
+void RenderFrameHostDelegate::GetNFC(
+    mojo::PendingReceiver<device::mojom::NFC> receiver) {}
 #endif
 
 bool RenderFrameHostDelegate::ShouldRouteMessageEvent(
@@ -111,11 +112,24 @@ RenderFrameHostDelegate::GetFocusedFrameIncludingInnerWebContents() {
   return nullptr;
 }
 
+RenderFrameHostImpl* RenderFrameHostDelegate::GetMainFrame() {
+  return nullptr;
+}
+
 std::unique_ptr<WebUIImpl>
 RenderFrameHostDelegate::CreateWebUIForRenderFrameHost(const GURL& url) {
   return nullptr;
 }
 
+RenderFrameHostDelegate* RenderFrameHostDelegate::CreateNewWindow(
+    RenderFrameHost* opener,
+    const mojom::CreateNewWindowParams& params,
+    bool is_new_browsing_instance,
+    bool has_user_gesture,
+    SessionStorageNamespace* session_storage_namespace) {
+  return nullptr;
+}
+
 bool RenderFrameHostDelegate::ShouldAllowRunningInsecureContent(
     WebContents* web_contents,
     bool allowed_per_prefs,
diff --git a/chromium/content/browser/frame_host/render_frame_host_delegate.h b/chromium/content/browser/frame_host/render_frame_host_delegate.h
index e3997f819e6..7af38fe1cd1 100644
--- a/chromium/content/browser/frame_host/render_frame_host_delegate.h
+++ b/chromium/content/browser/frame_host/render_frame_host_delegate.h
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/i18n/rtl.h"
+#include "base/optional.h"
 #include "build/build_config.h"
 #include "components/viz/common/surfaces/surface_id.h"
 #include "content/browser/webui/web_ui_impl.h"
@@ -21,6 +22,7 @@
 #include "content/public/common/javascript_dialog_type.h"
 #include "content/public/common/resource_load_info.mojom.h"
 #include "content/public/common/resource_type.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/http/http_response_headers.h"
@@ -30,6 +32,7 @@
 #include "third_party/blink/public/common/frame/blocked_navigation_types.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
+#include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/base/window_open_disposition.h"
 
@@ -51,18 +54,18 @@ class Message;
 namespace gfx {
 class Rect;
 class Size;
-}
+}  // namespace gfx
 
 namespace url {
 class Origin;
 }
 
 namespace blink {
-struct WebFullscreenOptions;
 namespace mojom {
 class FileChooserParams;
+class FullscreenOptions;
 }
-}
+}  // namespace blink
 
 namespace content {
 class FileSelectListener;
@@ -192,6 +195,9 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   virtual void FrameSizeChanged(RenderFrameHost* render_frame_host,
                                 const gfx::Size& frame_size) {}
 
+  // The DOMContentLoaded handler in the frame has completed.
+  virtual void DOMContentLoaded(RenderFrameHost* render_frame_host) {}
+
   // The onload handler in the frame has completed. Only called for the top-
   // level frame.
   virtual void DocumentOnLoadCompleted(RenderFrameHost* render_frame_host) {}
@@ -206,11 +212,6 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
                            const base::string16& title,
                            base::i18n::TextDirection title_direction) {}
 
-  // The page's encoding was changed and should be updated. Only called for the
-  // top-level frame.
-  virtual void UpdateEncoding(RenderFrameHost* render_frame_host,
-                              const std::string& encoding) {}
-
   // Return this object cast to a WebContents, if it is one. If the object is
   // not a WebContents, returns NULL.
   virtual WebContents* GetAsWebContents();
@@ -260,14 +261,14 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
 
 #if defined(OS_ANDROID)
   // Gets an NFC implementation within the context of this delegate.
-  virtual void GetNFC(device::mojom::NFCRequest request);
+  virtual void GetNFC(mojo::PendingReceiver<device::mojom::NFC> receiver);
 #endif
 
   // Notification that the frame wants to go into fullscreen mode.
   // |origin| represents the origin of the frame that requests fullscreen.
-  virtual void EnterFullscreenMode(const GURL& origin,
-                                   const blink::WebFullscreenOptions& options) {
-  }
+  virtual void EnterFullscreenMode(
+      const GURL& origin,
+      const blink::mojom::FullscreenOptions& options) {}
 
   // Notification that the frame wants to go out of fullscreen mode.
   // |will_cause_resize| indicates whether the fullscreen change causes a
@@ -323,6 +324,9 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   // WebContents is not live.
   virtual RenderFrameHost* GetFocusedFrameIncludingInnerWebContents();
 
+  // Returns the main frame for the delegate.
+  virtual RenderFrameHostImpl* GetMainFrame();
+
   // Called by when |source_rfh| advances focus to a RenderFrameProxyHost.
   virtual void OnAdvanceFocus(RenderFrameHostImpl* source_rfh) {}
 
@@ -340,12 +344,11 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
       const gfx::Rect& bounds_in_root_view) {}
 
   // The page is trying to open a new page (e.g. a popup window). The window
-  // should be created associated with the given |main_frame_widget_route_id| in
-  // the process of |opener|, but it should not be shown yet. That should happen
-  // in response to ShowCreatedWindow. |params.window_container_type| describes
-  // the type of RenderViewHost container that is requested -- in particular,
-  // the window.open call may have specified 'background' and 'persistent' in
-  // the feature string.
+  // should be created associated the process of |opener|, but it should not
+  // be shown yet. That should happen in response to ShowCreatedWindow.
+  // |params.window_container_type| describes the type of RenderViewHost
+  // container that is requested -- in particular, the window.open call may
+  // have specified 'background' and 'persistent' in the feature string.
   //
   // The passed |opener| is the RenderFrameHost initiating the window creation.
   // It will never be null, even if the opener is suppressed via |params|.
@@ -356,17 +359,17 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   // Note: this is not called "CreateWindow" because that will clash with
   // the Windows function which is actually a #define.
   //
+  // On success, a non-owning pointer to the new RenderFrameHostDelegate is
+  // returned.
+  //
   // The caller is expected to handle cleanup if this operation fails or is
-  // suppressed, by looking for the existence of a RenderFrameHost in
-  // |opener|'s process with |main_frame_route_id| after this method returns.
-  virtual void CreateNewWindow(
+  // suppressed by checking if the return value is null.
+  virtual RenderFrameHostDelegate* CreateNewWindow(
       RenderFrameHost* opener,
-      int32_t render_view_route_id,
-      int32_t main_frame_route_id,
-      int32_t main_frame_widget_route_id,
       const mojom::CreateNewWindowParams& params,
+      bool is_new_browsing_instance,
       bool has_user_gesture,
-      SessionStorageNamespace* session_storage_namespace) {}
+      SessionStorageNamespace* session_storage_namespace);
 
   // Show a previously created page with the specified disposition and bounds.
   // The window is identified by the |main_frame_widget_route_id| passed to
@@ -449,6 +452,11 @@ class CONTENT_EXPORT RenderFrameHostDelegate {
   virtual RenderFrameHostImpl* GetMainFrameForInnerDelegate(
       FrameTreeNode* frame_tree_node);
 
+  // Notifies that the given frame has changed theme color.
+  virtual void OnThemeColorChanged(RenderFrameHostImpl* source,
+                                   const base::Optional<SkColor>& theme_color) {
+  }
+
  protected:
   virtual ~RenderFrameHostDelegate() {}
 };
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.cc b/chromium/content/browser/frame_host/render_frame_host_impl.cc
index 523c981bbd1..e7e0ec17f67 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.cc
@@ -5,6 +5,7 @@
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <algorithm>
+#include <memory>
 #include <unordered_map>
 #include <utility>
 
@@ -15,6 +16,7 @@
 #include "base/debug/alias.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/hash/hash.h"
+#include "base/i18n/character_encoding.h"
 #include "base/lazy_instance.h"
 #include "base/memory/ptr_util.h"
 #include "base/memory/ref_counted.h"
@@ -32,6 +34,7 @@
 #include "base/trace_event/traced_value.h"
 #include "build/build_config.h"
 #include "cc/base/switches.h"
+#include "components/download/public/common/download_url_parameters.h"
 #include "content/browser/about_url_loader_factory.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
@@ -44,9 +47,9 @@
 #include "content/browser/devtools/devtools_instrumentation.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
 #include "content/browser/download/mhtml_generation_manager.h"
-#include "content/browser/file_url_loader_factory.h"
 #include "content/browser/fileapi/file_system_manager_impl.h"
 #include "content/browser/fileapi/file_system_url_loader_factory.h"
+#include "content/browser/frame_host/back_forward_cache_impl.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/frame_tree.h"
@@ -55,7 +58,6 @@
 #include "content/browser/frame_host/ipc_utils.h"
 #include "content/browser/frame_host/keep_alive_handle_factory.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/navigator_impl.h"
@@ -63,16 +65,13 @@
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/generic_sensor/sensor_provider_proxy_impl.h"
 #include "content/browser/geolocation/geolocation_service_impl.h"
-#include "content/browser/image_capture/image_capture_impl.h"
-#include "content/browser/installedapp/installed_app_provider_impl_default.h"
 #include "content/browser/interface_provider_filtering.h"
-#include "content/browser/keyboard_lock/keyboard_lock_service_impl.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 #include "content/browser/loader/navigation_url_loader_impl.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
 #include "content/browser/log_console_message.h"
 #include "content/browser/media/capture/audio_mirroring_manager.h"
 #include "content/browser/media/media_interface_proxy.h"
-#include "content/browser/media/session/media_session_service_impl.h"
 #include "content/browser/media/webaudio/audio_context_manager_impl.h"
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
 #include "content/browser/navigation_subresource_loader_params.h"
@@ -80,7 +79,6 @@
 #include "content/browser/permissions/permission_controller_impl.h"
 #include "content/browser/permissions/permission_service_context.h"
 #include "content/browser/permissions/permission_service_impl.h"
-#include "content/browser/picture_in_picture/picture_in_picture_service_impl.h"
 #include "content/browser/portal/portal.h"
 #include "content/browser/presentation/presentation_service_impl.h"
 #include "content/browser/push_messaging/push_messaging_manager.h"
@@ -89,8 +87,6 @@
 #include "content/browser/renderer_host/input/input_router.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
 #include "content/browser/renderer_host/media/audio_input_delegate_impl.h"
-#include "content/browser/renderer_host/media/media_devices_dispatcher_host.h"
-#include "content/browser/renderer_host/media/media_stream_dispatcher_host.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
@@ -103,11 +99,10 @@
 #include "content/browser/scoped_active_url.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/sms/sms_service.h"
-#include "content/browser/speech/speech_recognition_dispatcher_host.h"
 #include "content/browser/speech/speech_synthesis_impl.h"
 #include "content/browser/storage_partition_impl.h"
-#include "content/browser/wake_lock/wake_lock_service_impl.h"
 #include "content/browser/web_package/bundled_exchanges_handle.h"
+#include "content/browser/web_package/bundled_exchanges_handle_tracker.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
 #include "content/browser/webauth/authenticator_environment_impl.h"
 #include "content/browser/webauth/authenticator_impl.h"
@@ -120,7 +115,9 @@
 #include "content/browser/worker_host/shared_worker_service_impl.h"
 #include "content/common/accessibility_messages.h"
 #include "content/common/associated_interfaces.mojom.h"
+#include "content/common/content_constants_internal.h"
 #include "content/common/content_security_policy/content_security_policy.h"
+#include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/input/input_handler.mojom.h"
@@ -139,7 +136,9 @@
 #include "content/public/browser/browser_plugin_guest_manager.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/download_manager.h"
 #include "content/public/browser/file_select_listener.h"
+#include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/page_visibility_state.h"
 #include "content/public/browser/permission_type.h"
@@ -148,8 +147,8 @@
 #include "content/public/browser/shared_cors_origin_access_list.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/browser/webvr_service_provider.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
@@ -163,7 +162,6 @@
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "device/gamepad/gamepad_monitor.h"
-#include "device/vr/public/mojom/vr_service.mojom.h"
 #include "media/audio/audio_manager.h"
 #include "media/base/media_switches.h"
 #include "media/base/user_input_monitor.h"
@@ -173,12 +171,8 @@
 #include "media/mojo/services/media_interface_provider.h"
 #include "media/mojo/services/media_metrics_provider.h"
 #include "media/mojo/services/video_decode_perf_history.h"
-#include "mojo/public/cpp/bindings/associated_interface_ptr.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "mojo/public/cpp/bindings/message.h"
-#include "mojo/public/cpp/bindings/pending_associated_remote.h"
-#include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "mojo/public/cpp/system/data_pipe.h"
@@ -202,7 +196,10 @@
 #include "third_party/blink/public/common/frame/frame_policy.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
+#include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
+#include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "third_party/blink/public/mojom/frame/frame_host_test_interface.mojom.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom.h"
 #include "third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
@@ -244,17 +241,13 @@ const void* const kRenderFrameHostAndroidKey = &kRenderFrameHostAndroidKey;
 // The next value to use for the accessibility reset token.
 int g_next_accessibility_reset_token = 1;
 
-#if defined(OS_ANDROID) || defined(OS_FUCHSIA) || defined(IS_CHROMECAST)
 // Whether to allow injecting javascript into any kind of frame, for Android
-// WebView, Fuchsia web.ContextProvider and CastOS content shell.
+// WebView, WebLayer, Fuchsia web.ContextProvider and CastOS content shell.
 bool g_allow_injecting_javascript = false;
-#endif
 
-// The (process id, routing id) pair that identifies one RenderFrame.
-typedef std::pair<int32_t, int32_t> RenderFrameHostID;
-typedef std::unordered_map<RenderFrameHostID,
+typedef std::unordered_map<GlobalFrameRoutingId,
                            RenderFrameHostImpl*,
-                           base::IntPairHash<RenderFrameHostID>>
+                           GlobalFrameRoutingIdHasher>
     RoutingIDFrameMap;
 base::LazyInstance<RoutingIDFrameMap>::DestructorAtExit g_routing_id_frame_map =
     LAZY_INSTANCE_INITIALIZER;
@@ -286,6 +279,26 @@ base::i18n::TextDirection WebTextDirectionToChromeTextDirection(
   }
 }
 
+// Returns true if |url| & |base_url| represents a WebView loadDataWithBaseUrl
+// navigation.
+bool IsLoadDataWithBaseURL(const GURL& url, const GURL& base_url) {
+  return url.SchemeIs(url::kDataScheme) && !base_url.is_empty();
+}
+
+// Returns true if |common_params| represents a WebView loadDataWithBaseUrl
+// navigation.
+bool IsLoadDataWithBaseURL(const mojom::CommonNavigationParams& common_params) {
+  return IsLoadDataWithBaseURL(common_params.url,
+                               common_params.base_url_for_data_url);
+}
+
+// Returns true if |validated_params| represents a WebView loadDataWithBaseUrl
+// navigation.
+bool IsLoadDataWithBaseURL(
+    const FrameHostMsg_DidCommitProvisionalLoad_Params& validated_params) {
+  return IsLoadDataWithBaseURL(validated_params.url, validated_params.base_url);
+}
+
 // Ensure that we reset nav_entry_id_ in DidCommitProvisionalLoad if any of
 // the validations fail and lead to an early return.  Call disable() once we
 // know the commit will be successful.  Resetting nav_entry_id_ avoids acting on
@@ -308,6 +321,39 @@ class ScopedCommitStateResetter {
   bool disabled_;
 };
 
+class ActiveURLMessageFilter : public mojo::MessageFilter {
+ public:
+  explicit ActiveURLMessageFilter(RenderFrameHostImpl* render_frame_host)
+      : render_frame_host_(render_frame_host) {}
+
+  ~ActiveURLMessageFilter() override {
+    if (debug_url_set_) {
+      GetContentClient()->SetActiveURL(GURL(), "");
+    }
+  }
+
+  // mojo::MessageFilter overrides.
+  bool WillDispatch(mojo::Message* message) override {
+    debug_url_set_ = true;
+    auto* frame_tree_node = render_frame_host_->frame_tree_node();
+    GetContentClient()->SetActiveURL(frame_tree_node->current_url(),
+                                     frame_tree_node->frame_tree()
+                                         ->root()
+                                         ->current_origin()
+                                         .GetDebugString());
+    return true;
+  }
+
+  void DidDispatchOrReject(mojo::Message* message, bool accepted) override {
+    GetContentClient()->SetActiveURL(GURL(), "");
+    debug_url_set_ = false;
+  }
+
+ private:
+  RenderFrameHostImpl* render_frame_host_;
+  bool debug_url_set_ = false;
+};
+
 void GrantFileAccess(int child_id,
                      const std::vector<base::FilePath>& file_paths) {
   ChildProcessSecurityPolicyImpl* policy =
@@ -342,8 +388,8 @@ class RemoterFactoryImpl final : public media::mojom::RemoterFactory {
   void Create(media::mojom::RemotingSourcePtr source,
               media::mojom::RemoterRequest request) final {
     if (auto* host = RenderFrameHostImpl::FromID(process_id_, routing_id_)) {
-      GetContentClient()->browser()->CreateMediaRemoter(
-          host, std::move(source), std::move(request));
+      GetContentClient()->browser()->CreateMediaRemoter(host, std::move(source),
+                                                        std::move(request));
     }
   }
 
@@ -408,12 +454,11 @@ base::Optional<url::Origin> GetOriginForURLLoaderFactoryUnchecked(
   // GetOriginForURLLoaderFactory should only be called at the ready-to-commit
   // time, when the RFHI and process to commit the navigation are already known.
   DCHECK_LE(NavigationRequest::RESPONSE_STARTED, navigation_request->state());
-  RenderFrameHostImpl* target_frame = navigation_request->render_frame_host();
+  RenderFrameHostImpl* target_frame = navigation_request->GetRenderFrameHost();
 
   // Check if this is loadDataWithBaseUrl (which needs special treatment).
   auto& common_params = navigation_request->common_params();
-  if (common_params.url.SchemeIs(url::kDataScheme) &&
-      !common_params.base_url_for_data_url.is_empty()) {
+  if (IsLoadDataWithBaseURL(common_params)) {
     // A (potentially attacker-controlled) renderer process should not be able
     // to use loadDataWithBaseUrl code path to initiate fetches on behalf of a
     // victim origin (fetches controlled by attacker-provided
@@ -474,7 +519,7 @@ base::Optional<url::Origin> GetOriginForURLLoaderFactory(
   if (result.has_value() && !result->opaque()) {
     auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
     CHECK(policy->CanAccessDataForOrigin(
-        navigation_request->render_frame_host()->GetProcess()->GetID(),
+        navigation_request->GetRenderFrameHost()->GetProcess()->GetID(),
         *result));
   }
 
@@ -495,7 +540,8 @@ void GetRestrictedCookieManager(
     mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver) {
   storage_partition->CreateRestrictedCookieManager(
       network::mojom::RestrictedCookieManagerRole::SCRIPT,
-      frame_host->GetLastCommittedOrigin(),
+      frame_host->GetLastCommittedOrigin(), frame_host->ComputeSiteForCookies(),
+      frame_host->ComputeTopFrameOrigin(frame_host->GetLastCommittedOrigin()),
       /* is_service_worker = */ false, process_id, frame_id,
       std::move(receiver));
 }
@@ -543,14 +589,14 @@ struct PendingNavigation {
   mojom::CommonNavigationParamsPtr common_params;
   mojom::BeginNavigationParamsPtr begin_navigation_params;
   scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory;
-  mojom::NavigationClientAssociatedPtrInfo navigation_client;
+  mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client;
   mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator;
 
   PendingNavigation(
       mojom::CommonNavigationParamsPtr common_params,
       mojom::BeginNavigationParamsPtr begin_navigation_params,
       scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-      mojom::NavigationClientAssociatedPtrInfo navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>
           navigation_initiator);
 };
@@ -559,7 +605,7 @@ PendingNavigation::PendingNavigation(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::BeginNavigationParamsPtr begin_navigation_params,
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory,
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     mojo::PendingRemote<blink::mojom::NavigationInitiator> navigation_initiator)
     : common_params(std::move(common_params)),
       begin_navigation_params(std::move(begin_navigation_params)),
@@ -574,11 +620,12 @@ class FileChooserImpl : public blink::mojom::FileChooser,
   using FileChooserResult = blink::mojom::FileChooserResult;
 
  public:
-  static void Create(RenderFrameHostImpl* render_frame_host,
-                     blink::mojom::FileChooserRequest request) {
-    mojo::MakeStrongBinding(
+  static void Create(
+      RenderFrameHostImpl* render_frame_host,
+      mojo::PendingReceiver<blink::mojom::FileChooser> receiver) {
+    mojo::MakeSelfOwnedReceiver(
         std::make_unique<FileChooserImpl>(render_frame_host),
-        std::move(request));
+        std::move(receiver));
   }
 
   FileChooserImpl(RenderFrameHostImpl* render_frame_host)
@@ -744,22 +791,27 @@ class FileChooserImpl : public blink::mojom::FileChooser,
 // static
 RenderFrameHost* RenderFrameHost::FromID(int render_process_id,
                                          int render_frame_id) {
-  return RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
+  return RenderFrameHostImpl::FromID(
+      GlobalFrameRoutingId(render_process_id, render_frame_id));
 }
 
-#if defined(OS_ANDROID) || defined(OS_FUCHSIA) || defined(IS_CHROMECAST)
 // static
 void RenderFrameHost::AllowInjectingJavaScript() {
   g_allow_injecting_javascript = true;
 }
-#endif  // defined(OS_ANDROID) || defined(OS_FUCHSIA) || defined(IS_CHROMECAST)
 
 // static
-RenderFrameHostImpl* RenderFrameHostImpl::FromID(int process_id,
-                                                 int routing_id) {
+RenderFrameHostImpl* RenderFrameHostImpl::FromID(int render_process_id,
+                                                 int render_frame_id) {
+  return RenderFrameHostImpl::FromID(
+      GlobalFrameRoutingId(render_process_id, render_frame_id));
+}
+
+// static
+RenderFrameHostImpl* RenderFrameHostImpl::FromID(GlobalFrameRoutingId id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RoutingIDFrameMap* frames = g_routing_id_frame_map.Pointer();
-  auto it = frames->find(RenderFrameHostID(process_id, routing_id));
+  auto it = frames->find(id);
   return it == frames->end() ? NULL : it->second;
 }
 
@@ -843,7 +895,6 @@ RenderFrameHostImpl::RenderFrameHostImpl(
       has_selection_(false),
       is_audible_(false),
       last_navigation_previews_state_(PREVIEWS_UNSPECIFIED),
-      frame_host_associated_binding_(this),
       waiting_for_init_(renderer_initiated_creation),
       has_focused_editable_element_(false),
       push_messaging_manager_(
@@ -855,10 +906,12 @@ RenderFrameHostImpl::RenderFrameHostImpl(
       keep_alive_timeout_(base::TimeDelta::FromSeconds(30)),
       subframe_unload_timeout_(base::TimeDelta::FromMilliseconds(
           RenderViewHostImpl::kUnloadTimeoutMS)),
-      commit_callback_interceptor_(nullptr) {
+      commit_callback_interceptor_(nullptr),
+      media_device_id_salt_base_(
+          BrowserContext::CreateRandomMediaDeviceIDSalt()) {
   GetProcess()->AddRoute(routing_id_, this);
   g_routing_id_frame_map.Get().emplace(
-      RenderFrameHostID(GetProcess()->GetID(), routing_id_), this);
+      GlobalFrameRoutingId(GetProcess()->GetID(), routing_id_), this);
   site_instance_->AddObserver(this);
   process_->AddObserver(this);
   GetSiteInstance()->IncrementActiveFrameCount();
@@ -880,15 +933,16 @@ RenderFrameHostImpl::RenderFrameHostImpl(
 
   SetUpMojoIfNeeded();
 
-  swapout_event_monitor_timeout_.reset(new TimeoutMonitor(base::Bind(
+  swapout_event_monitor_timeout_.reset(new TimeoutMonitor(base::BindRepeating(
       &RenderFrameHostImpl::OnSwappedOut, weak_ptr_factory_.GetWeakPtr())));
-  beforeunload_timeout_.reset(
-      new TimeoutMonitor(base::Bind(&RenderFrameHostImpl::BeforeUnloadTimeout,
-                                    weak_ptr_factory_.GetWeakPtr())));
+  beforeunload_timeout_.reset(new TimeoutMonitor(
+      base::BindRepeating(&RenderFrameHostImpl::BeforeUnloadTimeout,
+                          weak_ptr_factory_.GetWeakPtr())));
 
   if (widget_routing_id != MSG_ROUTING_NONE) {
-    mojom::WidgetPtr widget;
-    GetRemoteInterfaces()->GetInterface(&widget);
+    mojo::PendingRemote<mojom::Widget> widget;
+    GetRemoteInterfaces()->GetInterface(
+        widget.InitWithNewPipeAndPassReceiver());
 
     if (!parent_) {
       // For main frames, the RenderWidgetHost is owned by the RenderViewHost.
@@ -912,6 +966,10 @@ RenderFrameHostImpl::RenderFrameHostImpl(
           frame_tree_->render_widget_delegate(), GetProcess(),
           widget_routing_id, std::move(widget), /*hidden=*/true);
       owned_render_widget_host_->set_owned_by_render_frame_host(true);
+#if defined(OS_ANDROID)
+      owned_render_widget_host_->SetForceEnableZoom(
+          render_view_host_->GetWebkitPreferences().force_enable_zoom);
+#endif  // defined(OS_ANDROID)
     }
 
     if (!frame_tree_node_->parent())
@@ -1039,7 +1097,7 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
 
   GetProcess()->RemoveRoute(routing_id_);
   g_routing_id_frame_map.Get().erase(
-      RenderFrameHostID(GetProcess()->GetID(), routing_id_));
+      GlobalFrameRoutingId(GetProcess()->GetID(), routing_id_));
 
   // Null out the swapout timer; in crash dumps this member will be null only if
   // the dtor has run.  (It may also be null in tests.)
@@ -1058,11 +1116,9 @@ RenderFrameHostImpl::~RenderFrameHostImpl() {
   if (owned_render_widget_host_)
     owned_render_widget_host_->ShutdownAndDestroyWidget(false);
 
-  // TODO(https://crbug.com/1005077): There is no known reason for removing the
-  // RenderViewHostImpl here instead of automatically at the end of the
-  // destructor. In practise, not doing it here will prevent android WebView to
-  // display a new page after a long sequence of WebView creation / deletion.
-  // The real reason why this is needed needs to be investigated.
+  // This needs to be deleted before |frame_input_handler_| so associated
+  // remotes can send messages during shutdown. See crbug.com/1010478 for
+  // details.
   render_view_host_.reset();
 
   // If another frame is waiting for a beforeunload ACK from this frame,
@@ -1110,6 +1166,10 @@ void RenderFrameHostImpl::EnterBackForwardCache() {
   DCHECK(IsBackForwardCacheEnabled());
   DCHECK(!is_in_back_forward_cache_);
   is_in_back_forward_cache_ = true;
+  // Pages in the back-forward cache are automatically evicted after a certain
+  // time.
+  if (!GetParent())
+    StartBackForwardCacheEvictionTimer();
   for (auto& child : children_)
     child->current_frame_host()->EnterBackForwardCache();
 }
@@ -1119,12 +1179,44 @@ void RenderFrameHostImpl::LeaveBackForwardCache() {
   DCHECK(IsBackForwardCacheEnabled());
   DCHECK(is_in_back_forward_cache_);
   is_in_back_forward_cache_ = false;
+  if (back_forward_cache_eviction_timer_.IsRunning())
+    back_forward_cache_eviction_timer_.Stop();
   for (auto& child : children_)
     child->current_frame_host()->LeaveBackForwardCache();
 }
 
+std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
+RenderFrameHostImpl::TakeLastCommitParams() {
+  return std::move(last_commit_params_);
+}
+
+void RenderFrameHostImpl::StartBackForwardCacheEvictionTimer() {
+  DCHECK(is_in_back_forward_cache_);
+  base::TimeDelta evict_after =
+      BackForwardCacheImpl::GetTimeToLiveInBackForwardCache();
+  NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
+      frame_tree_node_->navigator()->GetController());
+
+  back_forward_cache_eviction_timer_.SetTaskRunner(
+      controller->GetBackForwardCache().GetTaskRunner());
+
+  back_forward_cache_eviction_timer_.Start(
+      FROM_HERE, evict_after,
+      base::BindOnce(&RenderFrameHostImpl::EvictFromBackForwardCacheWithReason,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     BackForwardCacheMetrics::EvictedReason::kTimeout));
+}
+
+void RenderFrameHostImpl::DisallowBackForwardCache() {
+  is_back_forward_cache_disallowed_ = true;
+  if (is_in_back_forward_cache())
+    EvictFromBackForwardCacheWithReason(base::nullopt);
+}
+
 void RenderFrameHostImpl::OnGrantedMediaStreamAccess() {
   was_granted_media_access_ = true;
+  MaybeEvictFromBackForwardCache(
+      BackForwardCacheMetrics::EvictedReason::kGrantedMediaStreamAccess);
 }
 
 void RenderFrameHostImpl::OnPortalActivated(
@@ -1165,6 +1257,13 @@ RenderFrameHostImpl* RenderFrameHostImpl::GetParent() {
   return parent_;
 }
 
+std::vector<RenderFrameHost*> RenderFrameHostImpl::GetFramesInSubtree() {
+  std::vector<RenderFrameHost*> frame_hosts;
+  for (FrameTreeNode* node : frame_tree_->SubtreeNodes(frame_tree_node()))
+    frame_hosts.push_back(node->current_frame_host());
+  return frame_hosts;
+}
+
 bool RenderFrameHostImpl::IsDescendantOf(RenderFrameHost* ancestor) {
   if (!ancestor || !static_cast<RenderFrameHostImpl*>(ancestor)->child_count())
     return false;
@@ -1246,19 +1345,22 @@ void RenderFrameHostImpl::ExecuteMediaPlayerActionAtLocation(
 }
 
 bool RenderFrameHostImpl::CreateNetworkServiceDefaultFactory(
-    network::mojom::URLLoaderFactoryRequest default_factory_request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+        default_factory_receiver) {
   return CreateNetworkServiceDefaultFactoryInternal(
       last_committed_origin_, network_isolation_key_,
-      std::move(default_factory_request));
+      std::move(default_factory_receiver));
 }
 
-void RenderFrameHostImpl::MarkInitiatorsAsRequiringSeparateURLLoaderFactory(
-    base::flat_set<url::Origin> request_initiators,
+void RenderFrameHostImpl::MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory(
+    base::flat_set<url::Origin> isolated_world_origins,
     bool push_to_renderer_now) {
-  size_t old_size = initiators_requiring_separate_url_loader_factory_.size();
-  initiators_requiring_separate_url_loader_factory_.insert(
-      request_initiators.begin(), request_initiators.end());
-  size_t new_size = initiators_requiring_separate_url_loader_factory_.size();
+  size_t old_size =
+      isolated_worlds_requiring_separate_url_loader_factory_.size();
+  isolated_worlds_requiring_separate_url_loader_factory_.insert(
+      isolated_world_origins.begin(), isolated_world_origins.end());
+  size_t new_size =
+      isolated_worlds_requiring_separate_url_loader_factory_.size();
   bool insertion_took_place = (old_size != new_size);
 
   // Push the updated set of factories to the renderer, but only if
@@ -1275,8 +1377,8 @@ void RenderFrameHostImpl::MarkInitiatorsAsRequiringSeparateURLLoaderFactory(
     std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
         subresource_loader_factories =
             std::make_unique<blink::URLLoaderFactoryBundleInfo>();
-    subresource_loader_factories->pending_initiator_specific_factories() =
-        CreateInitiatorSpecificURLLoaderFactories(request_initiators);
+    subresource_loader_factories->pending_isolated_world_factories() =
+        CreateURLLoaderFactoriesForIsolatedWorlds(isolated_world_origins);
     GetNavigationControl()->UpdateSubresourceLoaderFactories(
         std::move(subresource_loader_factories));
   }
@@ -1293,10 +1395,10 @@ bool RenderFrameHostImpl::IsSandboxed(blink::WebSandboxFlags flags) {
 }
 
 blink::URLLoaderFactoryBundleInfo::OriginMap
-RenderFrameHostImpl::CreateInitiatorSpecificURLLoaderFactories(
-    const base::flat_set<url::Origin>& initiator_origins) {
+RenderFrameHostImpl::CreateURLLoaderFactoriesForIsolatedWorlds(
+    const base::flat_set<url::Origin>& isolated_world_origins) {
   blink::URLLoaderFactoryBundleInfo::OriginMap result;
-  for (const url::Origin& initiator : initiator_origins) {
+  for (const url::Origin& initiator : isolated_world_origins) {
     network::mojom::URLLoaderFactoryPtrInfo factory_info;
     CreateNetworkServiceDefaultFactoryAndObserve(
         initiator, network_isolation_key_, mojo::MakeRequest(&factory_info));
@@ -1389,21 +1491,23 @@ service_manager::InterfaceProvider* RenderFrameHostImpl::GetRemoteInterfaces() {
 blink::AssociatedInterfaceProvider*
 RenderFrameHostImpl::GetRemoteAssociatedInterfaces() {
   if (!remote_associated_interfaces_) {
-    blink::mojom::AssociatedInterfaceProviderAssociatedPtr remote_interfaces;
+    mojo::AssociatedRemote<blink::mojom::AssociatedInterfaceProvider>
+        remote_interfaces;
     IPC::ChannelProxy* channel = GetProcess()->GetChannel();
     if (channel) {
       RenderProcessHostImpl* process =
           static_cast<RenderProcessHostImpl*>(GetProcess());
       process->GetRemoteRouteProvider()->GetRoute(
-          GetRoutingID(), mojo::MakeRequest(&remote_interfaces));
+          GetRoutingID(), remote_interfaces.BindNewEndpointAndPassReceiver());
     } else {
       // The channel may not be initialized in some tests environments. In this
       // case we set up a dummy interface provider.
-      mojo::MakeRequestAssociatedWithDedicatedPipe(&remote_interfaces);
+      ignore_result(remote_interfaces
+                        .BindNewEndpointAndPassDedicatedReceiverForTesting());
     }
     remote_associated_interfaces_ =
         std::make_unique<blink::AssociatedInterfaceProvider>(
-            std::move(remote_interfaces));
+            remote_interfaces.Unbind());
   }
   return remote_associated_interfaces_.get();
 }
@@ -1439,15 +1543,13 @@ bool RenderFrameHostImpl::Send(IPC::Message* message) {
   return GetProcess()->Send(message);
 }
 
-bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
+bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message& msg) {
   // Only process messages if the RenderFrame is alive.
   if (!render_frame_created_)
     return false;
 
   // Crash reports triggered by IPC messages for this frame should be associated
   // with its URL.
-  // TODO(lukasza): Also call SetActiveURL for mojo messages dispatched to
-  // either the FrameHost interface or to interfaces bound by this frame.
   ScopedActiveURL scoped_active_url(this);
 
   if (delegate_->OnMessageReceived(this, msg))
@@ -1467,8 +1569,7 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
     IPC_MESSAGE_HANDLER(FrameHostMsg_BeforeUnload_ACK, OnBeforeUnloadACK)
     IPC_MESSAGE_HANDLER(FrameHostMsg_SwapOut_ACK, OnSwapOutACK)
     IPC_MESSAGE_HANDLER(FrameHostMsg_ContextMenu, OnContextMenu)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_VisualStateResponse,
-                        OnVisualStateResponse)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_VisualStateResponse, OnVisualStateResponse)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunJavaScriptDialog,
                                     OnRunJavaScriptDialog)
     IPC_MESSAGE_HANDLER_DELAY_REPLY(FrameHostMsg_RunBeforeUnloadConfirm,
@@ -1499,10 +1600,10 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
                         OnAccessibilityChildFrameHitTestResult)
     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_SnapshotResponse,
                         OnAccessibilitySnapshotResponse)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_EnterFullscreen, OnEnterFullscreen)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_ExitFullscreen, OnExitFullscreen)
     IPC_MESSAGE_HANDLER(FrameHostMsg_SuddenTerminationDisablerChanged,
                         OnSuddenTerminationDisablerChanged)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_DidFinishDocumentLoad,
+                        OnDidFinishDocumentLoad)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidStopLoading, OnDidStopLoading)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeLoadProgress,
                         OnDidChangeLoadProgress)
@@ -1521,6 +1622,9 @@ bool RenderFrameHostImpl::OnMessageReceived(const IPC::Message &msg) {
     IPC_MESSAGE_HANDLER(FrameHostMsg_FrameDidCallFocus, OnFrameDidCallFocus)
     IPC_MESSAGE_HANDLER(FrameHostMsg_RenderFallbackContentInParentProcess,
                         OnRenderFallbackContentInParentProcess)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_DownloadUrl, OnDownloadUrl)
+    IPC_MESSAGE_HANDLER(FrameHostMsg_SaveImageFromDataURL,
+                        OnSaveImageFromDataURL)
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
     IPC_MESSAGE_HANDLER(FrameHostMsg_ShowPopup, OnShowPopup)
     IPC_MESSAGE_HANDLER(FrameHostMsg_HidePopup, OnHidePopup)
@@ -1538,8 +1642,8 @@ void RenderFrameHostImpl::OnAssociatedInterfaceRequest(
     mojo::ScopedInterfaceEndpointHandle handle) {
   ContentBrowserClient* browser_client = GetContentClient()->browser();
   if (!associated_registry_->TryBindInterface(interface_name, &handle) &&
-      !browser_client->BindAssociatedInterfaceRequestFromFrame(
-          this, interface_name, &handle)) {
+      !browser_client->BindAssociatedReceiverFromFrame(this, interface_name,
+                                                       &handle)) {
     delegate_->OnAssociatedInterfaceRequest(this, interface_name,
                                             std::move(handle));
   }
@@ -1557,6 +1661,12 @@ bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
   return false;
 }
 
+void RenderFrameHostImpl::AccessibilityViewSetFocus() {
+  RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView();
+  if (view)
+    view->Focus();
+}
+
 gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
   RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView();
   if (view)
@@ -1591,7 +1701,7 @@ void RenderFrameHostImpl::AccessibilityFatalError() {
 }
 
 gfx::AcceleratedWidget
-    RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
+RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
   // Only the main frame's current frame host is connected to the native
   // widget tree for accessibility, so return null if this is queried on
   // any other frame.
@@ -1606,7 +1716,7 @@ gfx::AcceleratedWidget
 }
 
 gfx::NativeViewAccessible
-    RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
+RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetWidget()->GetView());
   if (view)
@@ -1701,12 +1811,16 @@ void RenderFrameHostImpl::RenderProcessExited(
   // the last block of code here.
 }
 
-void RenderFrameHostImpl::RenderProcessGone(SiteInstanceImpl* site_instance) {
+void RenderFrameHostImpl::RenderProcessGone(
+    SiteInstanceImpl* site_instance,
+    const ChildProcessTerminationInfo& info) {
   DCHECK_EQ(site_instance_.get(), site_instance);
 
   if (is_in_back_forward_cache_) {
-    // Note: Evicting from the BackForwardCache deletes |this|.
-    EvictFromBackForwardCache();
+    EvictFromBackForwardCacheWithReason(
+        info.status == base::TERMINATION_STATUS_PROCESS_CRASHED
+            ? BackForwardCacheMetrics::EvictedReason::kRendererProcessCrashed
+            : BackForwardCacheMetrics::EvictedReason::kRendererProcessKilled);
     return;
   }
 
@@ -1858,18 +1972,6 @@ bool RenderFrameHostImpl::CreateRenderFrame(int previous_routing_id,
   params->has_committed_real_load =
       frame_tree_node()->has_committed_real_load();
 
-  params->widget_params = mojom::CreateFrameWidgetParams::New();
-  if (GetLocalRenderWidgetHost()) {
-    params->widget_params->routing_id =
-        GetLocalRenderWidgetHost()->GetRoutingID();
-  } else {
-    // MSG_ROUTING_NONE will prevent a new RenderWidget from being created in
-    // the renderer process.
-    params->widget_params->routing_id = MSG_ROUTING_NONE;
-  }
-
-  GetProcess()->GetRendererInterface()->CreateFrame(std::move(params));
-
   // The RenderWidgetHost takes ownership of its view. It is tied to the
   // lifetime of the current RenderProcessHost for this RenderFrameHost.
   // TODO(avi): This will need to change to initialize a
@@ -1884,6 +1986,16 @@ bool RenderFrameHostImpl::CreateRenderFrame(int previous_routing_id,
     DCHECK(!rwhv->IsShowing());
   }
 
+  if (GetLocalRenderWidgetHost()) {
+    params->widget_params = mojom::CreateFrameWidgetParams::New();
+    params->widget_params->routing_id =
+        GetLocalRenderWidgetHost()->GetRoutingID();
+    params->widget_params->visual_properties =
+        GetLocalRenderWidgetHost()->GetVisualProperties();
+  }
+
+  GetProcess()->GetRendererInterface()->CreateFrame(std::move(params));
+
   if (previous_routing_id != MSG_ROUTING_NONE) {
     RenderFrameProxyHost* proxy = RenderFrameProxyHost::FromID(
         GetProcess()->GetID(), previous_routing_id);
@@ -1902,7 +2014,7 @@ bool RenderFrameHostImpl::CreateRenderFrame(int previous_routing_id,
 }
 
 void RenderFrameHostImpl::DeleteRenderFrame(FrameDeleteIntention intent) {
-  if (!is_active())
+  if (unload_state_ != UnloadState::NotRun)
     return;
 
   if (render_frame_created_) {
@@ -1954,8 +2066,9 @@ void RenderFrameHostImpl::SetRenderFrameCreated(bool created) {
   }
 
   if (created && GetLocalRenderWidgetHost()) {
-    mojom::WidgetPtr widget;
-    GetRemoteInterfaces()->GetInterface(&widget);
+    mojo::PendingRemote<mojom::Widget> widget;
+    GetRemoteInterfaces()->GetInterface(
+        widget.InitWithNewPipeAndPassReceiver());
     GetLocalRenderWidgetHost()->SetWidget(std::move(widget));
     GetLocalRenderWidgetHost()->SetFrameInputHandler(
         frame_input_handler_.get());
@@ -1989,7 +2102,10 @@ void RenderFrameHostImpl::Init() {
         std::move(pending_navigate_->blob_url_loader_factory),
         std::move(pending_navigate_->navigation_client),
         std::move(pending_navigate_->navigation_initiator),
-        EnsurePrefetchedSignedExchangeCache());
+        EnsurePrefetchedSignedExchangeCache(),
+        bundled_exchanges_handle_
+            ? bundled_exchanges_handle_->MaybeCreateTracker()
+            : nullptr);
     pending_navigate_.reset();
   }
 }
@@ -2109,6 +2225,10 @@ void RenderFrameHostImpl::DidNavigate(
     ResetFeaturePolicy();
     active_sandbox_flags_ = frame_tree_node()->active_sandbox_flags();
   }
+
+  // Reset the salt so that media device IDs are reset after the new navigation
+  // if necessary.
+  media_device_id_salt_base_ = BrowserContext::CreateRandomMediaDeviceIDSalt();
 }
 
 void RenderFrameHostImpl::SetLastCommittedOrigin(const url::Origin& origin) {
@@ -2121,6 +2241,20 @@ void RenderFrameHostImpl::SetLastCommittedOriginForTesting(
   SetLastCommittedOrigin(origin);
 }
 
+const url::Origin& RenderFrameHostImpl::ComputeTopFrameOrigin(
+    const url::Origin& frame_origin) const {
+  if (frame_tree_node_->IsMainFrame()) {
+    return frame_origin;
+  }
+
+  DCHECK(parent_);
+  RenderFrameHostImpl* host = parent_;
+  while (host->parent_) {
+    host = host->parent_;
+  }
+  return host->GetLastCommittedOrigin();
+}
+
 GURL RenderFrameHostImpl::ComputeSiteForCookiesForNavigation(
     const GURL& destination) const {
   // For top-level navigation, |site_for_cookies| will always be the destination
@@ -2128,19 +2262,33 @@ GURL RenderFrameHostImpl::ComputeSiteForCookiesForNavigation(
   if (frame_tree_node_->IsMainFrame())
     return destination;
 
-  GURL base_url;
+  // Check if everything above the frame being navigated is consistent. It's OK
+  // to skip checking the frame itself since it will be validated against
+  // |site_for_cookies| anyway.
+  return ComputeSiteForCookiesInternal(parent_);
+}
+
+GURL RenderFrameHostImpl::ComputeSiteForCookies() const {
+  return ComputeSiteForCookiesInternal(this);
+}
+
+GURL RenderFrameHostImpl::ComputeSiteForCookiesInternal(
+    const RenderFrameHostImpl* render_frame_host) const {
 #if defined(OS_ANDROID)
   // On Android, a base URL can be set for the frame. If this the case, it is
   // the URL to use for cookies.
   NavigationEntry* last_committed_entry =
       frame_tree_node_->navigator()->GetController()->GetLastCommittedEntry();
-  if (last_committed_entry)
-    base_url = last_committed_entry->GetBaseURLForDataURL();
+  if (last_committed_entry &&
+      !last_committed_entry->GetBaseURLForDataURL().is_empty()) {
+    return last_committed_entry->GetBaseURLForDataURL();
+  }
 #endif
-  // This is pre-navigation, but since at this point the frame being navigated
-  // is known to not be the main frame, it's correct post-navigation as well.
-  const GURL& top_document_url =
-      !base_url.is_empty() ? base_url : frame_tree_->root()->current_url();
+
+  const GURL& top_document_url = frame_tree_->root()
+                                     ->current_frame_host()
+                                     ->GetLastCommittedOrigin()
+                                     .GetURL();
 
   if (GetContentClient()
           ->browser()
@@ -2149,27 +2297,18 @@ GURL RenderFrameHostImpl::ComputeSiteForCookiesForNavigation(
     return top_document_url;
   }
 
-  // Check if everything above the frame being navigated is consistent. It's OK
-  // to skip checking the frame itself since it will be validated against
-  // |site_for_cookies| anyway.
-  const FrameTreeNode* current = frame_tree_node_->parent();
-  bool ancestors_are_same_site = true;
-  while (current && ancestors_are_same_site) {
-    // Skip over srcdoc documents, as they are always same-origin with their
-    // closest non-srcdoc parent.
-    while (current->current_url().IsAboutSrcdoc())
-      current = current->parent();
-
+  // Make sure every ancestors are same-domain with the main document. Otherwise
+  // this will be a 3rd party cookie.
+  for (const RenderFrameHostImpl* rfh = render_frame_host; rfh;
+       rfh = rfh->parent_) {
     if (!net::registry_controlled_domains::SameDomainOrHost(
-            top_document_url, current->current_url(),
+            top_document_url, rfh->last_committed_origin_,
             net::registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES)) {
-      ancestors_are_same_site = false;
+      return GURL::EmptyGURL();
     }
-    current = current->parent();
   }
 
-  return (ancestors_are_same_site || !base_url.is_empty()) ? top_document_url
-                                                           : GURL::EmptyGURL();
+  return top_document_url;
 }
 
 void RenderFrameHostImpl::SetOriginOfNewFrame(
@@ -2339,6 +2478,9 @@ void RenderFrameHostImpl::UpdateActiveSchedulerTrackedFeatures(
     uint64_t features_mask) {
   TRACE_EVENT0("toplevel", "UpdateActiveSchedulerTrackedFeatures");
   renderer_reported_scheduler_tracked_features_ = features_mask;
+
+  MaybeEvictFromBackForwardCache(
+      BackForwardCacheMetrics::EvictedReason::kSchedulerTrackedFeatureUsed);
 }
 
 void RenderFrameHostImpl::OnSchedulerTrackedFeatureUsed(
@@ -2346,6 +2488,9 @@ void RenderFrameHostImpl::OnSchedulerTrackedFeatureUsed(
   TRACE_EVENT0("toplevel", "OnSchedulerTrackedFeatureUsed");
   browser_reported_scheduler_tracked_features_ |=
       1 << static_cast<uint64_t>(feature);
+
+  MaybeEvictFromBackForwardCache(
+      BackForwardCacheMetrics::EvictedReason::kSchedulerTrackedFeatureUsed);
 }
 
 bool RenderFrameHostImpl::IsFrozen() {
@@ -2422,7 +2567,8 @@ void RenderFrameHostImpl::DidCommitBackForwardCacheNavigation(
   // been fired.
   is_loading_ = true;
 
-  DidCommitNavigationInternal(std::move(owned_request), validated_params.get(),
+  DidCommitNavigationInternal(std::move(owned_request),
+                              std::move(validated_params),
                               /*is_same_document_navigation=*/false);
 
   // Now that the restored frame has been committed, unfreeze it.
@@ -2491,7 +2637,7 @@ void RenderFrameHostImpl::DidCommitSameDocumentNavigation(
   if (!DidCommitNavigationInternal(
           is_browser_initiated ? std::move(same_document_navigation_request_)
                                : nullptr,
-          validated_params.get(), true /* is_same_document_navigation*/)) {
+          std::move(validated_params), true /* is_same_document_navigation*/)) {
     return;
   }
 
@@ -2533,11 +2679,6 @@ GlobalFrameRoutingId RenderFrameHostImpl::GetGlobalFrameRoutingId() {
   return GlobalFrameRoutingId(GetProcess()->GetID(), GetRoutingID());
 }
 
-NavigationHandleImpl* RenderFrameHostImpl::GetNavigationHandle() {
-  return navigation_request() ? navigation_request()->navigation_handle()
-                              : nullptr;
-}
-
 void RenderFrameHostImpl::ResetNavigationRequests() {
   navigation_request_.reset();
   same_document_navigation_request_.reset();
@@ -2556,9 +2697,8 @@ void RenderFrameHostImpl::SetNavigationRequest(
       std::move(navigation_request);
 }
 
-void RenderFrameHostImpl::SwapOut(
-    RenderFrameProxyHost* proxy,
-    bool is_loading) {
+void RenderFrameHostImpl::SwapOut(RenderFrameProxyHost* proxy,
+                                  bool is_loading) {
   // The end of this event is in OnSwapOutACK when the RenderFrame has completed
   // the operation and sends back an IPC message.
   // The trace event may not end properly if the ACK times out.  We expect this
@@ -2892,6 +3032,13 @@ void RenderFrameHostImpl::OnRunJavaScriptDialog(
     const base::string16& default_prompt,
     JavaScriptDialogType dialog_type,
     IPC::Message* reply_msg) {
+  // If a dialog tries to show for a document in the BackForwardCache, evict it.
+  if (is_in_back_forward_cache_) {
+    EvictFromBackForwardCacheWithReason(
+        BackForwardCacheMetrics::EvictedReason::kDialog);
+    return;
+  }
+
   // Don't show the dialog if it's triggered on a frame that's pending deletion
   // (e.g., from an unload handler), or when the tab is being closed.
   if (IsWaitingForUnloadACK()) {
@@ -2907,9 +3054,8 @@ void RenderFrameHostImpl::OnRunJavaScriptDialog(
                                  reply_msg);
 }
 
-void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(
-    bool is_reload,
-    IPC::Message* reply_msg) {
+void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(bool is_reload,
+                                                   IPC::Message* reply_msg) {
   TRACE_EVENT1("navigation", "RenderFrameHostImpl::OnRunBeforeUnloadConfirm",
                "frame_tree_node", frame_tree_node_->frame_tree_node_id());
 
@@ -2962,13 +3108,18 @@ void RenderFrameHostImpl::OnRunBeforeUnloadConfirm(
 }
 
 void RenderFrameHostImpl::RequestTextSurroundingSelection(
-    TextSurroundingSelectionCallback callback,
+    blink::mojom::Frame::GetTextSurroundingSelectionCallback callback,
     int max_length) {
   DCHECK(!callback.is_null());
   GetAssociatedFrameRemote()->GetTextSurroundingSelection(max_length,
                                                           std::move(callback));
 }
 
+void RenderFrameHostImpl::SendInterventionReport(const std::string& id,
+                                                 const std::string& message) {
+  GetAssociatedFrameRemote()->SendInterventionReport(id, message);
+}
+
 void RenderFrameHostImpl::AllowBindings(int bindings_flags) {
   // Never grant any bindings to browser plugin guests.
   if (GetProcess()->IsForGuestsOnly()) {
@@ -3082,8 +3233,8 @@ void RenderFrameHostImpl::UpdateSubresourceLoaderFactories() {
           std::make_unique<blink::URLLoaderFactoryBundleInfo>(
               std::move(default_factory_info),
               blink::URLLoaderFactoryBundleInfo::SchemeMap(),
-              CreateInitiatorSpecificURLLoaderFactories(
-                  initiators_requiring_separate_url_loader_factory_),
+              CreateURLLoaderFactoriesForIsolatedWorlds(
+                  isolated_worlds_requiring_separate_url_loader_factory_),
               bypass_redirect_checks);
   GetNavigationControl()->UpdateSubresourceLoaderFactories(
       std::move(subresource_loader_factories));
@@ -3207,8 +3358,8 @@ void RenderFrameHostImpl::OnDidChangeFramePolicy(
 void RenderFrameHostImpl::OnDidChangeFrameOwnerProperties(
     int32_t frame_routing_id,
     const FrameOwnerProperties& properties) {
-  FrameTreeNode* child = FindAndVerifyChild(
-      frame_routing_id, bad_message::RFH_OWNER_PROPERTY);
+  FrameTreeNode* child =
+      FindAndVerifyChild(frame_routing_id, bad_message::RFH_OWNER_PROPERTY);
   if (!child)
     return;
 
@@ -3245,7 +3396,12 @@ void RenderFrameHostImpl::OnUpdateTitle(
 void RenderFrameHostImpl::UpdateEncoding(const std::string& encoding_name) {
   // This message is only sent for top-level frames. TODO(avi): when frame tree
   // mirroring works correctly, add a check here to enforce it.
-  delegate_->UpdateEncoding(this, encoding_name);
+  if (encoding_name == last_reported_encoding_)
+    return;
+  last_reported_encoding_ = encoding_name;
+
+  canonical_encoding_ =
+      base::GetCanonicalEncodingNameByAliasName(encoding_name);
 }
 
 void RenderFrameHostImpl::FrameSizeChanged(const gfx::Size& frame_size) {
@@ -3276,6 +3432,11 @@ void RenderFrameHostImpl::VisibilityChanged(
   UpdateFrameFrozenState();
 }
 
+void RenderFrameHostImpl::DidChangeThemeColor(
+    const base::Optional<SkColor>& theme_color) {
+  delegate_->OnThemeColorChanged(this, theme_color);
+}
+
 void RenderFrameHostImpl::SetCommitCallbackInterceptorForTesting(
     CommitCallbackInterceptor* interceptor) {
   // This DCHECK's aims to avoid unexpected replacement of an interceptor.
@@ -3427,6 +3588,24 @@ void RenderFrameHostImpl::OnAccessibilityEvents(
   Send(new AccessibilityMsg_EventBundle_ACK(routing_id_, ack_token));
 }
 
+void RenderFrameHostImpl::UpdateBrowserControlsState(
+    BrowserControlsState constraints,
+    BrowserControlsState current,
+    bool animate) {
+  if (frame_)
+    frame_->UpdateBrowserControlsState(constraints, current, animate);
+}
+
+void RenderFrameHostImpl::Reload() {
+  if (!IsRenderFrameLive())
+    return;
+
+  // TODO(https://crbug.com/995428). This IPC is deprecated. Navigations are
+  // handled from the browser process. There is no need to send an IPC to the
+  // renderer process for this.
+  Send(new FrameMsg_Reload(GetRoutingID()));
+}
+
 void RenderFrameHostImpl::SendAccessibilityEventsToManager(
     const AXEventNotificationDetails& details) {
   if (browser_accessibility_manager_ &&
@@ -3437,8 +3616,21 @@ void RenderFrameHostImpl::SendAccessibilityEventsToManager(
 }
 
 void RenderFrameHostImpl::EvictFromBackForwardCache() {
+  TRACE_EVENT0("navigation", "RenderFrameHostImpl::EvictFromBackForwardCache");
+
+  // TODO(hajimehoshi): This function should take the reason from the renderer
+  // side.
+  EvictFromBackForwardCacheWithReason(
+      BackForwardCacheMetrics::EvictedReason::kJavaScriptExecution);
+}
+
+void RenderFrameHostImpl::EvictFromBackForwardCacheWithReason(
+    base::Optional<BackForwardCacheMetrics::EvictedReason> reason) {
   DCHECK(IsBackForwardCacheEnabled());
 
+  if (is_evicted_from_back_forward_cache_)
+    return;
+
   bool in_back_forward_cache = is_in_back_forward_cache();
 
   RenderFrameHostImpl* top_document = this;
@@ -3447,7 +3639,17 @@ void RenderFrameHostImpl::EvictFromBackForwardCache() {
     DCHECK_EQ(top_document->is_in_back_forward_cache(), in_back_forward_cache);
   }
 
+  // TODO(hajimehoshi): Record the 'race condition' by JavaScript execution when
+  // |is_in_back_forward_cache()| is false.
+  BackForwardCacheMetrics* metrics = top_document->GetBackForwardCacheMetrics();
+  if (is_in_back_forward_cache() && reason && metrics)
+    metrics->MarkEvictedFromBackForwardCacheWithReason(reason.value());
+
   if (!in_back_forward_cache) {
+    BackForwardCacheMetrics::RecordEvictedAfterDocumentRestored(
+        BackForwardCacheMetrics::EvictedAfterDocumentRestoredReason::
+            kByJavaScript);
+
     // A document is evicted from the BackForwardCache, but it has already been
     // restored. The current document should be reloaded, because it is not
     // salvageable.
@@ -3465,21 +3667,21 @@ void RenderFrameHostImpl::EvictFromBackForwardCache() {
        in_flight_navigation_request->rfh_restored_from_back_forward_cache() ==
            top_document);
 
-  // Hold onto a pointer to the navigation controller, in case we need it to
-  // reissue the navigation after |this| has been destroyed.
   NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
       frame_tree_node_->navigator()->GetController());
-  frame_tree_node_->render_manager()->EvictFromBackForwardCache(top_document);
 
-  // DO NOT REFERENCER ANY MEMBERS after this. The previous call destroyed
-  // |this|.
+  // Evict the frame and schedule it to be destroyed. Eviction happens
+  // immediately, but destruction is delayed, so that callers don't have to
+  // worry about use-after-free of |this|.
+  top_document->is_evicted_from_back_forward_cache_ = true;
+  controller->GetBackForwardCache().PostTaskToDestroyEvictedFrames();
 
   if (!is_navigation_to_evicted_frame_in_flight)
     return;
 
-  // If we are currently navigating to the frame that was just destroyed, we
+  // If we are currently navigating to the frame that was just evicted, we
   // must restart the navigation. This is important because restarting the
-  // navigation deletes the NavigationRequest associated with the destroyed
+  // navigation deletes the NavigationRequest associated with the evicted
   // frame (preventing use-after-free).
   int nav_index = controller->GetEntryIndexWithUniqueID(
       in_flight_navigation_request->nav_entry_id());
@@ -3524,9 +3726,9 @@ void RenderFrameHostImpl::OnAccessibilityFindInPageResult(
     BrowserAccessibilityManager* manager =
         GetOrCreateBrowserAccessibilityManager();
     if (manager) {
-      manager->OnFindInPageResult(
-          params.request_id, params.match_index, params.start_id,
-          params.start_offset, params.end_id, params.end_offset);
+      manager->OnFindInPageResult(params.request_id, params.match_index,
+                                  params.start_id, params.start_offset,
+                                  params.end_id, params.end_offset);
     }
   }
 }
@@ -3583,8 +3785,7 @@ void RenderFrameHostImpl::OnAccessibilitySnapshotResponse(
     dst_snapshot.root_id = snapshot.root_id;
     dst_snapshot.nodes.resize(snapshot.nodes.size());
     for (size_t i = 0; i < snapshot.nodes.size(); ++i) {
-      AXContentNodeDataToAXNodeData(snapshot.nodes[i],
-                                    &dst_snapshot.nodes[i]);
+      AXContentNodeDataToAXNodeData(snapshot.nodes[i], &dst_snapshot.nodes[i]);
     }
     if (snapshot.has_tree_data) {
       ax_content_tree_data_ = snapshot.tree_data;
@@ -3600,8 +3801,8 @@ void RenderFrameHostImpl::OnAccessibilitySnapshotResponse(
 
 // TODO(alexmos): When the allowFullscreen flag is known in the browser
 // process, use it to double-check that fullscreen can be entered here.
-void RenderFrameHostImpl::OnEnterFullscreen(
-    const blink::WebFullscreenOptions& options) {
+void RenderFrameHostImpl::EnterFullscreen(
+    blink::mojom::FullscreenOptionsPtr options) {
   // Entering fullscreen from a cross-process subframe also affects all
   // renderers for ancestor frames, which will need to apply fullscreen CSS to
   // appropriate ancestor <iframe> elements, fire fullscreenchange events, etc.
@@ -3630,7 +3831,7 @@ void RenderFrameHostImpl::OnEnterFullscreen(
   }
 
   // TODO(alexmos): See if this can use the last committed origin instead.
-  delegate_->EnterFullscreenMode(GetLastCommittedURL().GetOrigin(), options);
+  delegate_->EnterFullscreenMode(GetLastCommittedURL().GetOrigin(), *options);
   delegate_->FullscreenStateChanged(this, true /* is_fullscreen */);
 
   // The previous call might change the fullscreen state. We need to make sure
@@ -3646,7 +3847,7 @@ void RenderFrameHostImpl::OnEnterFullscreen(
 
 // TODO(alexmos): When the allowFullscreen flag is known in the browser
 // process, use it to double-check that fullscreen can be entered here.
-void RenderFrameHostImpl::OnExitFullscreen() {
+void RenderFrameHostImpl::ExitFullscreen() {
   delegate_->ExitFullscreenMode(/* will_cause_resize */ true);
 
   // The previous call might change the fullscreen state. We need to make sure
@@ -3662,7 +3863,7 @@ void RenderFrameHostImpl::OnExitFullscreen() {
 
 void RenderFrameHostImpl::OnSuddenTerminationDisablerChanged(
     bool present,
-    blink::WebSuddenTerminationDisablerType disabler_type) {
+    blink::SuddenTerminationDisablerType disabler_type) {
   DCHECK_NE(GetSuddenTerminationDisablerState(disabler_type), present);
   if (present) {
     sudden_termination_disabler_types_enabled_ |= disabler_type;
@@ -3672,10 +3873,15 @@ void RenderFrameHostImpl::OnSuddenTerminationDisablerChanged(
 }
 
 bool RenderFrameHostImpl::GetSuddenTerminationDisablerState(
-    blink::WebSuddenTerminationDisablerType disabler_type) {
+    blink::SuddenTerminationDisablerType disabler_type) {
   return (sudden_termination_disabler_types_enabled_ & disabler_type) != 0;
 }
 
+void RenderFrameHostImpl::OnDidFinishDocumentLoad() {
+  dom_content_loaded_ = true;
+  delegate_->DOMContentLoaded(this);
+}
+
 void RenderFrameHostImpl::OnDidStopLoading() {
   TRACE_EVENT1("navigation", "RenderFrameHostImpl::OnDidStopLoading",
                "frame_tree_node", frame_tree_node_->frame_tree_node_id());
@@ -3820,6 +4026,91 @@ void RenderFrameHostImpl::OnRenderFallbackContentInParentProcess() {
   }
 }
 
+void RenderFrameHostImpl::OnDownloadUrl(
+    const FrameHostMsg_DownloadUrl_Params& params) {
+  mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token;
+  if (!VerifyDownloadUrlParams(GetSiteInstance(), params, &blob_url_token))
+    return;
+
+  DownloadUrl(params.url, params.referrer, params.initiator_origin,
+              params.suggested_name, false, params.cross_origin_redirects,
+              std::move(blob_url_token));
+}
+
+void RenderFrameHostImpl::OnSaveImageFromDataURL(const std::string& url_str) {
+  // Please refer to RenderFrameImpl::SaveImageFromDataURL().
+  if (url_str.length() >= kMaxLengthOfDataURLString)
+    return;
+
+  GURL data_url(url_str);
+  if (!data_url.is_valid() || !data_url.SchemeIs(url::kDataScheme))
+    return;
+
+  DownloadUrl(data_url, Referrer(), url::Origin(), base::string16(), true,
+              network::mojom::RedirectMode::kFollow, mojo::NullRemote());
+}
+
+void RenderFrameHostImpl::DownloadUrl(
+    const GURL& url,
+    const Referrer& referrer,
+    const url::Origin& initiator,
+    const base::string16& suggested_name,
+    const bool use_prompt,
+    const network::mojom::RedirectMode cross_origin_redirects,
+    mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token) {
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("renderer_initiated_download", R"(
+        semantics {
+          sender: "Download from Renderer"
+          description:
+            "The frame has either navigated to a URL that was determined to be "
+            "a download via one of the renderer's classification mechanisms, "
+            "or WebView has requested a <canvas> or <img> element at a "
+            "specific location be to downloaded."
+          trigger:
+            "The user navigated to a destination that was categorized as a "
+            "download, or WebView triggered saving a <canvas> or <img> tag."
+          data: "Only the URL we are attempting to download."
+          destination: WEBSITE
+        }
+        policy {
+          cookies_allowed: YES
+          cookies_store: "user"
+          setting: "This feature cannot be disabled by settings."
+          chrome_policy {
+            DownloadRestrictions {
+              DownloadRestrictions: 3
+            }
+          }
+        })");
+  std::unique_ptr<download::DownloadUrlParameters> parameters(
+      new download::DownloadUrlParameters(url, GetProcess()->GetID(),
+                                          GetRenderViewHost()->GetRoutingID(),
+                                          GetRoutingID(), traffic_annotation));
+  parameters->set_content_initiated(true);
+  parameters->set_suggested_name(suggested_name);
+  parameters->set_prompt(use_prompt);
+  parameters->set_cross_origin_redirects(cross_origin_redirects);
+  parameters->set_referrer(referrer.url);
+  parameters->set_referrer_policy(
+      Referrer::ReferrerPolicyForUrlRequest(referrer.policy));
+  parameters->set_initiator(initiator);
+  parameters->set_download_source(download::DownloadSource::FROM_RENDERER);
+
+  BrowserContext* browser_context = GetSiteInstance()->GetBrowserContext();
+  scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory;
+  if (blob_url_token) {
+    blob_url_loader_factory =
+        ChromeBlobStorageContext::URLLoaderFactoryForToken(
+            browser_context, std::move(blob_url_token));
+  }
+
+  DownloadManager* download_manager =
+      BrowserContext::GetDownloadManager(browser_context);
+  download_manager->DownloadUrl(std::move(parameters),
+                                std::move(blob_url_loader_factory));
+}
+
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
 void RenderFrameHostImpl::OnShowPopup(
     const FrameHostMsg_ShowPopup_Params& params) {
@@ -3864,6 +4155,8 @@ void RenderFrameHostImpl::BindInterfaceProviderRequest(
       FilterRendererExposedInterfaces(mojom::kNavigation_FrameSpec,
                                       GetProcess()->GetID(),
                                       std::move(interface_provider_request)));
+  document_scoped_interface_provider_binding_.SetFilter(
+      std::make_unique<ActiveURLMessageFilter>(this));
 }
 
 void RenderFrameHostImpl::BindDocumentInterfaceBrokerReceiver(
@@ -3874,15 +4167,20 @@ void RenderFrameHostImpl::BindDocumentInterfaceBrokerReceiver(
   DCHECK(!document_interface_broker_content_receiver_.is_bound());
   DCHECK(content_receiver.is_valid());
   document_interface_broker_content_receiver_.Bind(std::move(content_receiver));
+  document_interface_broker_content_receiver_.SetFilter(
+      std::make_unique<ActiveURLMessageFilter>(this));
   DCHECK(!document_interface_broker_blink_receiver_.is_bound());
   DCHECK(blink_receiver.is_valid());
   document_interface_broker_blink_receiver_.Bind(std::move(blink_receiver));
+  document_interface_broker_blink_receiver_.SetFilter(
+      std::make_unique<ActiveURLMessageFilter>(this));
 }
 
 void RenderFrameHostImpl::BindBrowserInterfaceBrokerReceiver(
     mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker> receiver) {
   DCHECK(receiver.is_valid());
   broker_receiver_.Bind(std::move(receiver));
+  broker_receiver_.SetFilter(std::make_unique<ActiveURLMessageFilter>(this));
 }
 
 void RenderFrameHostImpl::SetKeepAliveTimeoutForTesting(
@@ -3917,15 +4215,19 @@ RenderFrameHostImpl::CreateCrossOriginPrefetchLoaderFactoryBundle() {
   return std::make_unique<blink::URLLoaderFactoryBundleInfo>(
       std::move(pending_default_factory),
       blink::URLLoaderFactoryBundleInfo::SchemeMap(),
-      CreateInitiatorSpecificURLLoaderFactories(
-          initiators_requiring_separate_url_loader_factory_),
+      CreateURLLoaderFactoriesForIsolatedWorlds(
+          isolated_worlds_requiring_separate_url_loader_factory_),
       bypass_redirect_checks);
 }
 
+base::WeakPtr<RenderFrameHostImpl> RenderFrameHostImpl::GetWeakPtr() {
+  return weak_ptr_factory_.GetWeakPtr();
+}
+
 void RenderFrameHostImpl::TransferUserActivationFrom(
     int32_t source_routing_id) {
-  RenderFrameHostImpl* source_rfh =
-      RenderFrameHostImpl::FromID(GetProcess()->GetID(), source_routing_id);
+  RenderFrameHostImpl* source_rfh = RenderFrameHostImpl::FromID(
+      GlobalFrameRoutingId(GetProcess()->GetID(), source_routing_id));
   if (source_rfh &&
       source_rfh->frame_tree_node()->HasTransientUserActivation()) {
     frame_tree_node()->TransferUserActivationFrom(source_rfh);
@@ -3948,10 +4250,6 @@ void RenderFrameHostImpl::CreateNewWindow(
   // are legal arguments to window.open) make it here; FilterURL rewrites them
   // to "about:blank" -- they shouldn't be cancelled.
   GetProcess()->FilterURL(false, &params->target_url);
-  if (!GetContentClient()->browser()->ShouldAllowOpenURL(GetSiteInstance(),
-                                                         params->target_url)) {
-    params->target_url = GURL(url::kAboutBlankURL);
-  }
 
   bool effective_transient_activation_state =
       params->mimic_user_gesture ||
@@ -3977,9 +4275,7 @@ void RenderFrameHostImpl::CreateNewWindow(
     // with calling renderer.
     was_consumed = frame_tree_node_->UpdateUserActivationState(
         blink::UserActivationUpdateType::kConsumeTransientActivation);
-  }
-
-  if (!can_create_window) {
+  } else {
     std::move(callback).Run(mojom::CreateNewWindowStatus::kIgnore, nullptr);
     return;
   }
@@ -4015,15 +4311,8 @@ void RenderFrameHostImpl::CreateNewWindow(
   // means the current renderer process will not be able to route messages to
   // it. Because of this, we will immediately show and navigate the window
   // in OnCreateNewWindowOnUI, using the params provided here.
-  int render_view_route_id = MSG_ROUTING_NONE;
-  int main_frame_route_id = MSG_ROUTING_NONE;
-  int main_frame_widget_route_id = MSG_ROUTING_NONE;
-  int render_process_id = GetProcess()->GetID();
-  if (!params->opener_suppressed && !no_javascript_access) {
-    render_view_route_id = GetProcess()->GetNextRoutingID();
-    main_frame_route_id = GetProcess()->GetNextRoutingID();
-    main_frame_widget_route_id = GetProcess()->GetNextRoutingID();
-  }
+  bool is_new_browsing_instance =
+      params->opener_suppressed || no_javascript_access;
 
   DCHECK(IsRenderFrameLive());
 
@@ -4031,35 +4320,21 @@ void RenderFrameHostImpl::CreateNewWindow(
   if (base::FeatureList::IsEnabled(features::kUserActivationV2))
     opened_by_user_activation = was_consumed;
 
-  delegate_->CreateNewWindow(this, render_view_route_id, main_frame_route_id,
-                             main_frame_widget_route_id, *params,
-                             opened_by_user_activation, cloned_namespace.get());
-
-  if (main_frame_route_id == MSG_ROUTING_NONE) {
-    // Opener suppressed or Javascript access disabled. Never tell the renderer
-    // about the new window.
-    std::move(callback).Run(mojom::CreateNewWindowStatus::kIgnore, nullptr);
-    return;
-  }
+  // The non-owning pointer |new_window| is valid in this stack frame since
+  // nothing can delete it until this thread is freed up again.
+  RenderFrameHostDelegate* new_window = delegate_->CreateNewWindow(
+      this, *params, is_new_browsing_instance, opened_by_user_activation,
+      cloned_namespace.get());
 
-  bool succeeded =
-      RenderWidgetHost::FromID(render_process_id, main_frame_widget_route_id) !=
-      nullptr;
-  if (!succeeded) {
-    // If we did not create a WebContents to host the renderer-created
-    // RenderFrame/RenderView/RenderWidget objects, signal failure to the
-    // renderer.
-    DCHECK(!RenderFrameHost::FromID(render_process_id, main_frame_route_id));
-    DCHECK(!RenderViewHost::FromID(render_process_id, render_view_route_id));
+  if (is_new_browsing_instance || !new_window) {
+    // Opener suppressed, Javascript access disabled, or delegate did not
+    // provide a handle to any windows it created. In these cases, never tell
+    // the renderer about the new window.
     std::move(callback).Run(mojom::CreateNewWindowStatus::kIgnore, nullptr);
     return;
   }
 
-  // The view, widget, and frame should all be routable now.
-  DCHECK(RenderViewHost::FromID(render_process_id, render_view_route_id));
-  RenderFrameHostImpl* rfh =
-      RenderFrameHostImpl::FromID(GetProcess()->GetID(), main_frame_route_id);
-  DCHECK(rfh);
+  RenderFrameHostImpl* main_frame = new_window->GetMainFrame();
 
   // When the popup is created, it hasn't committed any navigation yet - its
   // initial empty document should inherit the origin of its opener (the origin
@@ -4069,18 +4344,18 @@ void RenderFrameHostImpl::CreateNewWindow(
   // Checking sandbox flags of the new frame should be safe at this point,
   // because the flags should be already inherited by the CreateNewWindow call
   // above.
-  rfh->SetOriginOfNewFrame(GetLastCommittedOrigin());
+  main_frame->SetOriginOfNewFrame(GetLastCommittedOrigin());
 
-  if (rfh->waiting_for_init_) {
+  if (main_frame->waiting_for_init_) {
     // Need to check |waiting_for_init_| as some paths inside CreateNewWindow
-    // call above (namely, if WebContentsDelegate::ShouldCreateWebContents
-    // returns false) will resume requests by calling RenderFrameHostImpl::Init.
-    rfh->frame_->BlockRequests();
+    // call above (eg if WebContentsDelegate::IsWebContentsCreationOverridden()
+    // returns true) will resume requests by calling RenderFrameHostImpl::Init.
+    main_frame->frame_->BlockRequests();
   }
 
   service_manager::mojom::InterfaceProviderPtrInfo
       main_frame_interface_provider_info;
-  rfh->BindInterfaceProviderRequest(
+  main_frame->BindInterfaceProviderRequest(
       mojo::MakeRequest(&main_frame_interface_provider_info));
 
   mojo::PendingRemote<blink::mojom::DocumentInterfaceBroker>
@@ -4088,23 +4363,35 @@ void RenderFrameHostImpl::CreateNewWindow(
 
   mojo::PendingRemote<blink::mojom::DocumentInterfaceBroker>
       document_interface_broker_blink;
-  rfh->BindDocumentInterfaceBrokerReceiver(
+  main_frame->BindDocumentInterfaceBrokerReceiver(
       document_interface_broker_content.InitWithNewPipeAndPassReceiver(),
       document_interface_broker_blink.InitWithNewPipeAndPassReceiver());
 
   mojo::PendingRemote<blink::mojom::BrowserInterfaceBroker>
       browser_interface_broker;
-  rfh->BindBrowserInterfaceBrokerReceiver(
+  main_frame->BindBrowserInterfaceBrokerReceiver(
       browser_interface_broker.InitWithNewPipeAndPassReceiver());
 
+  // TODO(danakj): The main frame's RenderWidgetHost has no RenderWidgetHostView
+  // yet here. It seems like it should though? In the meantime we send some
+  // nonsense with a semi-valid but incorrect ScreenInfo (it needs a
+  // RenderWidgetHostView to be correct). An updates VisualProperties will get
+  // to the RenderWidget eventually.
+  VisualProperties visual_properties;
+  main_frame->GetLocalRenderWidgetHost()->GetScreenInfo(
+      &visual_properties.screen_info);
+
   mojom::CreateNewWindowReplyPtr reply = mojom::CreateNewWindowReply::New(
-      render_view_route_id, main_frame_route_id, main_frame_widget_route_id,
+      main_frame->GetRenderViewHost()->GetRoutingID(),
+      main_frame->GetRoutingID(),
+      main_frame->GetLocalRenderWidgetHost()->GetRoutingID(), visual_properties,
       mojom::DocumentScopedInterfaceBundle::New(
           std::move(main_frame_interface_provider_info),
           std::move(document_interface_broker_content),
           std::move(document_interface_broker_blink),
           std::move(browser_interface_broker)),
-      cloned_namespace->id(), rfh->GetDevToolsFrameToken());
+      cloned_namespace->id(), main_frame->GetDevToolsFrameToken());
+
   std::move(callback).Run(mojom::CreateNewWindowStatus::kSuccess,
                           std::move(reply));
 }
@@ -4146,7 +4433,7 @@ void RenderFrameHostImpl::AdoptPortal(
 }
 
 void RenderFrameHostImpl::IssueKeepAliveHandle(
-    mojom::KeepAliveHandleRequest request) {
+    mojo::PendingReceiver<mojom::KeepAliveHandle> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (GetProcess()->IsKeepAliveRefCountDisabled())
     return;
@@ -4160,7 +4447,7 @@ void RenderFrameHostImpl::IssueKeepAliveHandle(
         std::make_unique<KeepAliveHandleFactory>(GetProcess());
     keep_alive_handle_factory_->SetTimeout(keep_alive_timeout_);
   }
-  keep_alive_handle_factory_->Create(std::move(request));
+  keep_alive_handle_factory_->Create(std::move(receiver));
 }
 
 // TODO(ahemery): Move checks to mojo bad message reporting.
@@ -4168,7 +4455,7 @@ void RenderFrameHostImpl::BeginNavigation(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::BeginNavigationParamsPtr begin_params,
     mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token,
-    mojom::NavigationClientAssociatedPtrInfo navigation_client,
+    mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
     mojo::PendingRemote<blink::mojom::NavigationInitiator>
         navigation_initiator) {
   if (frame_tree_node_->render_manager()->is_attaching_inner_delegate()) {
@@ -4232,7 +4519,10 @@ void RenderFrameHostImpl::BeginNavigation(
   frame_tree_node()->navigator()->OnBeginNavigation(
       frame_tree_node(), std::move(validated_params), std::move(begin_params),
       std::move(blob_url_loader_factory), std::move(navigation_client),
-      std::move(navigation_initiator), EnsurePrefetchedSignedExchangeCache());
+      std::move(navigation_initiator), EnsurePrefetchedSignedExchangeCache(),
+      bundled_exchanges_handle_
+          ? bundled_exchanges_handle_->MaybeCreateTracker()
+          : nullptr);
 }
 
 void RenderFrameHostImpl::SubresourceResponseStarted(
@@ -4262,13 +4552,6 @@ void RenderFrameHostImpl::ResourceLoadComplete(
 void RenderFrameHostImpl::RegisterMojoInterfaces() {
   auto* command_line = base::CommandLine::ForCurrentProcess();
 
-#if !defined(OS_ANDROID)
-  // The default (no-op) implementation of InstalledAppProvider. On Android, the
-  // real implementation is provided in Java.
-  registry_->AddInterface(
-      base::BindRepeating(&InstalledAppProviderImplDefault::Create));
-#endif  // !defined(OS_ANDROID)
-
   PermissionControllerImpl* permission_controller =
       PermissionControllerImpl::FromBrowserContext(
           GetProcess()->GetBrowserContext());
@@ -4282,50 +4565,16 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
       // |interface_registry_| is declared after |geolocation_service_|, so it
       // will be destroyed prior to |geolocation_service_|.
       registry_->AddInterface(
-          base::Bind(&GeolocationServiceImpl::Bind,
-                     base::Unretained(geolocation_service_.get())));
+          base::BindRepeating(&GeolocationServiceImpl::Bind,
+                              base::Unretained(geolocation_service_.get())));
     }
   }
 
-#if defined(OS_ANDROID)
-  if (base::FeatureList::IsEnabled(features::kWebNfc)) {
-    registry_->AddInterface<device::mojom::NFC>(base::Bind(
-        &RenderFrameHostImpl::BindNFCRequest, base::Unretained(this)));
-  }
-#endif
-
-  if (!permission_service_context_)
-    permission_service_context_.reset(new PermissionServiceContext(this));
-
-  registry_->AddInterface(
-      base::BindRepeating(&PermissionServiceContext::CreateService,
-                          base::Unretained(permission_service_context_.get())));
-
-  registry_->AddInterface(base::BindRepeating(
-      [](RenderFrameHostImpl* frame,
-         mojo::PendingReceiver<blink::mojom::PresentationService> receiver) {
-        if (!frame->presentation_service_)
-          frame->presentation_service_ = PresentationServiceImpl::Create(frame);
-
-        frame->presentation_service_->Bind(std::move(receiver));
-      },
-      base::Unretained(this)));
-
-  registry_->AddInterface(
-      base::Bind(&MediaSessionServiceImpl::Create, base::Unretained(this)));
-
-  registry_->AddInterface(base::Bind(
-      base::IgnoreResult(&RenderFrameHostImpl::CreateWebBluetoothService),
+  registry_->AddInterface<media::mojom::InterfaceFactory>(base::BindRepeating(
+      &RenderFrameHostImpl::BindMediaInterfaceFactoryRequest,
       base::Unretained(this)));
 
   registry_->AddInterface(base::BindRepeating(
-      &RenderFrameHostImpl::CreateWebUsbService, base::Unretained(this)));
-
-  registry_->AddInterface<media::mojom::InterfaceFactory>(
-      base::Bind(&RenderFrameHostImpl::BindMediaInterfaceFactoryRequest,
-                 base::Unretained(this)));
-
-  registry_->AddInterface(base::BindRepeating(
       &RenderFrameHostImpl::CreateWebSocketConnector, base::Unretained(this)));
 
   registry_->AddInterface(base::BindRepeating(
@@ -4335,11 +4584,6 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
   registry_->AddInterface(base::BindRepeating(
       &SharedWorkerConnectorImpl::Create, process_->GetID(), routing_id_));
 
-  registry_->AddInterface(base::BindRepeating(&device::GamepadMonitor::Create));
-
-  registry_->AddInterface<device::mojom::VRService>(base::Bind(
-      &WebvrServiceProvider::BindWebvrService, base::Unretained(this)));
-
   registry_->AddInterface(
       base::BindRepeating(&RenderFrameHostImpl::CreateAudioInputStreamFactory,
                           base::Unretained(this)));
@@ -4348,52 +4592,10 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
       base::BindRepeating(&RenderFrameHostImpl::CreateAudioOutputStreamFactory,
                           base::Unretained(this)));
 
-  // BrowserMainLoop::GetInstance() may be null on unit tests.
-  if (BrowserMainLoop::GetInstance()) {
-    // BrowserMainLoop, which owns MediaStreamManager, is alive for the lifetime
-    // of Mojo communication (see BrowserMainLoop::ShutdownThreadsAndCleanUp(),
-    // which shuts down Mojo). Hence, passing that MediaStreamManager instance
-    // as a raw pointer here is safe.
-    MediaStreamManager* media_stream_manager =
-        BrowserMainLoop::GetInstance()->media_stream_manager();
-    registry_->AddInterface(
-        base::Bind(&MediaDevicesDispatcherHost::Create, GetProcess()->GetID(),
-                   GetRoutingID(), base::Unretained(media_stream_manager)),
-        base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
-
-    registry_->AddInterface(
-        base::BindRepeating(&MediaStreamDispatcherHost::Create,
-                            GetProcess()->GetID(), GetRoutingID(),
-                            base::Unretained(media_stream_manager)),
-        base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
-  }
-
 #if BUILDFLAG(ENABLE_MEDIA_REMOTING)
-  registry_->AddInterface(base::Bind(&RemoterFactoryImpl::Bind,
-                                     GetProcess()->GetID(), GetRoutingID()));
-#endif  // BUILDFLAG(ENABLE_MEDIA_REMOTING)
-
   registry_->AddInterface(base::BindRepeating(
-      &KeyboardLockServiceImpl::CreateMojoService, base::Unretained(this)));
-
-  registry_->AddInterface(base::Bind(&ImageCaptureImpl::Create));
-
-  sensor_provider_proxy_.reset(
-      new SensorProviderProxyImpl(permission_controller, this));
-  registry_->AddInterface(
-      base::Bind(&SensorProviderProxyImpl::Bind,
-                 base::Unretained(sensor_provider_proxy_.get())));
-
-#if !defined(OS_ANDROID)
-  if (command_line->HasSwitch(
-          switches::kEnableExperimentalWebPlatformFeatures)) {
-    registry_->AddInterface(
-        base::BindRepeating(&RenderFrameHostImpl::BindSerialServiceRequest,
-                            base::Unretained(this)));
-    registry_->AddInterface(
-        base::BindRepeating(&HidService::Create, base::Unretained(this)));
-  }
-#endif  // !defined(OS_ANDROID)
+      &RemoterFactoryImpl::Bind, GetProcess()->GetID(), GetRoutingID()));
+#endif  // BUILDFLAG(ENABLE_MEDIA_REMOTING)
 
   // Only save decode stats when BrowserContext provides a VideoPerfHistory.
   // Off-the-record contexts will internally use an ephemeral history DB.
@@ -4441,44 +4643,28 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
           weak_ptr_factory_.GetWeakPtr())));
 
   if (command_line->HasSwitch(cc::switches::kEnableGpuBenchmarking)) {
-    registry_->AddInterface(
-        base::Bind(&InputInjectorImpl::Create, weak_ptr_factory_.GetWeakPtr()));
+    registry_->AddInterface(base::BindRepeating(
+        &InputInjectorImpl::Create, weak_ptr_factory_.GetWeakPtr()));
   }
 
   // TODO(crbug.com/775792): Move to RendererInterfaceBinders.
   registry_->AddInterface(base::BindRepeating(
       &QuotaDispatcherHost::CreateForFrame, GetProcess(), routing_id_));
 
-  registry_->AddInterface(
-      base::BindRepeating(SpeechRecognitionDispatcherHost::Create,
-                          GetProcess()->GetID(), routing_id_),
-      base::CreateSingleThreadTaskRunner({BrowserThread::IO}));
-
   file_system_manager_.reset(new FileSystemManagerImpl(
       GetProcess()->GetID(),
       GetProcess()->GetStoragePartition()->GetFileSystemContext(),
       ChromeBlobStorageContext::GetFor(GetProcess()->GetBrowserContext())));
 
-  registry_->AddInterface(base::BindRepeating(&ContactsManagerImpl::Create,
-                                              base::Unretained(this)));
-
-  registry_->AddInterface(
-      base::BindRepeating(&FileChooserImpl::Create, base::Unretained(this)));
-
-  registry_->AddInterface(base::BindRepeating(&WakeLockServiceImpl::Create,
-                                              base::Unretained(this)));
-
-  registry_->AddInterface(base::BindRepeating(
-      &PictureInPictureServiceImpl::Create, base::Unretained(this)));
-
   if (base::FeatureList::IsEnabled(blink::features::kNativeFileSystemAPI)) {
     registry_->AddInterface(base::BindRepeating(
         [](RenderFrameHostImpl* frame,
            mojo::PendingReceiver<blink::mojom::NativeFileSystemManager>
                receiver) {
-          NativeFileSystemManagerImpl::BindReceiverFromUIThread(
-              static_cast<StoragePartitionImpl*>(
-                  frame->GetProcess()->GetStoragePartition()),
+          auto* storage_partition = static_cast<StoragePartitionImpl*>(
+              frame->GetProcess()->GetStoragePartition());
+          auto* manager = storage_partition->GetNativeFileSystemManager();
+          manager->BindReceiver(
               NativeFileSystemManagerImpl::BindingContext(
                   frame->GetLastCommittedOrigin(), frame->GetLastCommittedURL(),
                   frame->GetProcess()->GetID(), frame->GetRoutingID()),
@@ -4490,11 +4676,6 @@ void RenderFrameHostImpl::RegisterMojoInterfaces() {
   registry_->AddInterface(base::BindRepeating(
       &GetRestrictedCookieManager, base::Unretained(this),
       GetProcess()->GetID(), routing_id_, GetProcess()->GetStoragePartition()));
-
-  if (base::FeatureList::IsEnabled(features::kSmsReceiver)) {
-    registry_->AddInterface(base::BindRepeating(
-        &RenderFrameHostImpl::BindSmsReceiverReceiver, base::Unretained(this)));
-  }
 }
 
 void RenderFrameHostImpl::ResetWaitingState() {
@@ -4512,16 +4693,15 @@ void RenderFrameHostImpl::ResetWaitingState() {
   }
   send_before_unload_start_time_ = base::TimeTicks();
   render_view_host_->is_waiting_for_close_ack_ = false;
-  network_service_connection_error_handler_holder_.reset();
 }
 
-RenderFrameHostImpl::CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
+CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
     const url::Origin& origin,
     const GURL& url) {
   // If the --disable-web-security flag is specified, all bets are off and the
   // renderer process can send any origin it wishes.
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kDisableWebSecurity)) {
+          switches::kDisableWebSecurity)) {
     return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
   }
 
@@ -4560,42 +4740,34 @@ RenderFrameHostImpl::CanCommitStatus RenderFrameHostImpl::CanCommitOriginAndUrl(
   if (!GetContentClient()->browser()->CanCommitURL(GetProcess(), url))
     return CanCommitStatus::CANNOT_COMMIT_URL;
 
-  // TODO(nasko): This check should be updated to apply to all URLs, not just
-  // standard ones.
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
-  if (url.IsStandard() &&
-      !policy->CanAccessDataForOrigin(GetProcess()->GetID(), url)) {
-    return CanCommitStatus::CANNOT_COMMIT_URL;
+  const CanCommitStatus can_commit_status = policy->CanCommitOriginAndUrl(
+      GetProcess()->GetID(), GetSiteInstance()->GetIsolationContext(), origin,
+      url);
+  if (can_commit_status != CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL)
+    return can_commit_status;
+
+  const auto origin_tuple_or_precursor_tuple =
+      origin.GetTupleOrPrecursorTupleIfOpaque();
+  if (!origin_tuple_or_precursor_tuple.IsInvalid()) {
+    // Verify that the origin/precursor is allowed to commit in this process.
+    // Note: This also handles non-standard cases for |url|, such as
+    // about:blank, data, and blob URLs.
+
+    // Renderer-debug URLs can never be committed.
+    if (IsRendererDebugURL(origin_tuple_or_precursor_tuple.GetURL()))
+      return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
+
+    // Give the client a chance to disallow origin URLs from committing.
+    // TODO(acolwell): Fix this code to work with opaque origins. Currently
+    // some opaque origin precursors, like chrome-extension schemes, can trigger
+    // the commit to fail. These need to be investigated.
+    if (!origin.opaque() && !GetContentClient()->browser()->CanCommitURL(
+                                GetProcess(), origin.GetURL())) {
+      return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
+    }
   }
 
-  // It is safe to commit into a opaque origin, regardless of the URL, as it is
-  // restricted from accessing other origins.
-  if (origin.opaque())
-    return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
-
-  // Standard URLs must match the reported origin.
-  if (url.IsStandard() && !origin.IsSameOriginWith(url::Origin::Create(url)))
-    return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
-
-  // A non-opaque origin must be a valid URL, which allows us to safely do a
-  // conversion to GURL.
-  GURL origin_url = origin.GetURL();
-
-  if (!policy->CanAccessDataForOrigin(GetProcess()->GetID(), origin))
-    return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
-
-  // Verify that the origin is allowed to commit in this process.
-  // Note: This also handles non-standard cases for |url|, such as
-  // about:blank, data, and blob URLs.
-
-  // Renderer-debug URLs can never be committed.
-  if (IsRendererDebugURL(origin_url))
-    return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
-
-  // Give the client a chance to disallow URLs from committing.
-  if (!GetContentClient()->browser()->CanCommitURL(GetProcess(), origin_url))
-    return CanCommitStatus::CANNOT_COMMIT_ORIGIN;
-
   return CanCommitStatus::CAN_COMMIT_ORIGIN_AND_URL;
 }
 
@@ -4649,7 +4821,7 @@ void RenderFrameHostImpl::DispatchBeforeUnload(BeforeUnloadType type,
     // Cancel any pending navigations, to avoid their navigation commit/fail
     // event from wiping out the is_waiting_for_beforeunload_ack_ state.
     if (frame_tree_node_->navigation_request() &&
-        frame_tree_node_->navigation_request()->navigation_handle()) {
+        frame_tree_node_->navigation_request()->IsNavigationStarted()) {
       frame_tree_node_->navigation_request()->set_net_error(net::ERR_ABORTED);
     }
     frame_tree_node_->ResetNavigationRequest(false, true);
@@ -4966,7 +5138,7 @@ void RenderFrameHostImpl::CommitNavigation(
     NavigationRequest* navigation_request,
     mojom::CommonNavigationParamsPtr common_params,
     mojom::CommitNavigationParamsPtr commit_params,
-    network::ResourceResponse* response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
     network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
     bool is_view_source,
@@ -5079,8 +5251,12 @@ void RenderFrameHostImpl::CommitNavigation(
     render_view_host()->Send(new FrameMsg_EnableViewSourceMode(routing_id_));
   }
 
-  const network::ResourceResponseHead head =
-      response_head ? response_head->head : network::ResourceResponseHead();
+  // TODO(lfg): The renderer is not able to handle a null response, so the
+  // browser provides an empty response instead. See the DCHECK in the beginning
+  // of this method for the edge cases where a response isn't provided.
+  network::mojom::URLResponseHeadPtr head =
+      response_head ? std::move(response_head)
+                    : network::mojom::URLResponseHead::New();
   const bool is_same_document =
       NavigationTypeUtils::IsSameDocument(common_params->navigation_type);
 
@@ -5096,11 +5272,8 @@ void RenderFrameHostImpl::CommitNavigation(
   // instead of creating one from a URL which lacks opacity information.
   if (!is_same_document) {
     const url::Origin frame_origin = url::Origin::Create(common_params->url);
-    const url::Origin top_frame_origin =
-        frame_tree_node_->IsMainFrame() ? frame_origin
-                                        : frame_tree_->root()->current_origin();
-    network_isolation_key_ =
-        net::NetworkIsolationKey(top_frame_origin, frame_origin);
+    network_isolation_key_ = net::NetworkIsolationKey(
+        ComputeTopFrameOrigin(frame_origin), frame_origin);
   }
 
   std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -5198,13 +5371,20 @@ void RenderFrameHostImpl::CommitNavigation(
           bypass_redirect_checks);
     }
 
+    bool navigation_to_bundled_exchanges = false;
+
     if (bundled_exchanges_handle_ &&
         bundled_exchanges_handle_->IsReadyForLoading()) {
+      navigation_to_bundled_exchanges = true;
       mojo::Remote<network::mojom::URLLoaderFactory> fallback_factory(
           std::move(pending_default_factory));
       bundled_exchanges_handle_->CreateURLLoaderFactory(
           pending_default_factory.InitWithNewPipeAndPassReceiver(),
           std::move(fallback_factory));
+      if (bundled_exchanges_handle_->base_url_override().is_valid()) {
+        commit_params->base_url_override_for_bundled_exchanges =
+            bundled_exchanges_handle_->base_url_override();
+      }
     }
 
     DCHECK(pending_default_factory);
@@ -5216,7 +5396,10 @@ void RenderFrameHostImpl::CommitNavigation(
     // Other URLs like about:srcdoc or about:blank might be able load files, but
     // only because they will inherit loaders from their parents instead of the
     // ones provided by the browser process here.
-    if (common_params->url.SchemeIsFile()) {
+    //
+    // For loading bundled exchanges files, we don't set FileURLLoaderFactory.
+    // Because loading local files from bundled exchanges file is prohibited.
+    if (common_params->url.SchemeIsFile() && !navigation_to_bundled_exchanges) {
       auto file_factory = std::make_unique<FileURLLoaderFactory>(
           browser_context->GetPath(),
           browser_context->GetSharedCorsOriginAccessList(),
@@ -5284,9 +5467,9 @@ void RenderFrameHostImpl::CommitNavigation(
           factory.first, std::move(pending_factory_proxy));
     }
 
-    subresource_loader_factories->pending_initiator_specific_factories() =
-        CreateInitiatorSpecificURLLoaderFactories(
-            initiators_requiring_separate_url_loader_factory_);
+    subresource_loader_factories->pending_isolated_world_factories() =
+        CreateURLLoaderFactoriesForIsolatedWorlds(
+            isolated_worlds_requiring_separate_url_loader_factory_);
   }
 
   // It is imperative that cross-document navigations always provide a set of
@@ -5302,8 +5485,7 @@ void RenderFrameHostImpl::CommitNavigation(
         std::move(common_params), std::move(commit_params),
         base::BindOnce(&RenderFrameHostImpl::OnSameDocumentCommitProcessed,
                        base::Unretained(this),
-                       same_document_navigation_request_->navigation_handle()
-                           ->GetNavigationId(),
+                       same_document_navigation_request_->GetNavigationId(),
                        should_replace_current_entry));
   } else {
     // Pass the controller service worker info if we have one.
@@ -5412,9 +5594,10 @@ void RenderFrameHostImpl::CommitNavigation(
     if (IsURLHandledByNetworkStack(common_params->url))
       last_navigation_previews_state_ = common_params->previews_state;
 
+    dom_content_loaded_ = false;
     SendCommitNavigation(
         navigation_client, navigation_request, std::move(common_params),
-        std::move(commit_params), head, std::move(response_body),
+        std::move(commit_params), std::move(head), std::move(response_body),
         std::move(url_loader_client_endpoints),
         std::move(subresource_loader_factories),
         std::move(subresource_overrides), std::move(controller),
@@ -5486,8 +5669,9 @@ void RenderFrameHostImpl::FailedNavigation(
 
   // An error page is expected to commit, hence why is_loading_ is set to true.
   is_loading_ = true;
-  DCHECK(navigation_request && navigation_request->navigation_handle() &&
-         navigation_request->navigation_handle()->GetNetErrorCode() != net::OK);
+  dom_content_loaded_ = false;
+  DCHECK(navigation_request && navigation_request->IsNavigationStarted() &&
+         navigation_request->GetNetErrorCode() != net::OK);
 }
 
 void RenderFrameHostImpl::HandleRendererDebugURL(const GURL& url) {
@@ -5513,12 +5697,15 @@ void RenderFrameHostImpl::SetUpMojoIfNeeded() {
   associated_registry_ = std::make_unique<blink::AssociatedInterfaceRegistry>();
   registry_ = std::make_unique<service_manager::BinderRegistry>();
 
-  auto make_binding = [](RenderFrameHostImpl* impl,
-                         mojom::FrameHostAssociatedRequest request) {
-    impl->frame_host_associated_binding_.Bind(std::move(request));
-  };
+  auto bind_frame_host_receiver =
+      [](RenderFrameHostImpl* impl,
+         mojo::PendingAssociatedReceiver<mojom::FrameHost> receiver) {
+        impl->frame_host_associated_receiver_.Bind(std::move(receiver));
+        impl->frame_host_associated_receiver_.SetFilter(
+            std::make_unique<ActiveURLMessageFilter>(impl));
+      };
   associated_registry_->AddInterface(
-      base::BindRepeating(make_binding, base::Unretained(this)));
+      base::BindRepeating(bind_frame_host_receiver, base::Unretained(this)));
 
   associated_registry_->AddInterface(base::BindRepeating(
       [](RenderFrameHostImpl* self,
@@ -5527,10 +5714,20 @@ void RenderFrameHostImpl::SetUpMojoIfNeeded() {
       },
       base::Unretained(this)));
 
+  associated_registry_->AddInterface(base::BindRepeating(
+      [](RenderFrameHostImpl* impl,
+         mojo::PendingAssociatedReceiver<blink::mojom::LocalFrameHost>
+             receiver) {
+        impl->local_frame_host_receiver_.Bind(std::move(receiver));
+        impl->local_frame_host_receiver_.SetFilter(
+            std::make_unique<ActiveURLMessageFilter>(impl));
+      },
+      base::Unretained(this)));
   RegisterMojoInterfaces();
-  mojom::FrameFactoryPtr frame_factory;
+  mojo::PendingRemote<mojom::FrameFactory> frame_factory;
   BindInterface(GetProcess(), &frame_factory);
-  frame_factory->CreateFrame(routing_id_, MakeRequest(&frame_));
+  mojo::Remote<mojom::FrameFactory>(std::move(frame_factory))
+      ->CreateFrame(routing_id_, frame_.BindNewPipeAndPassReceiver());
 
   service_manager::mojom::InterfaceProviderPtr remote_interfaces;
   frame_->GetInterfaceProvider(mojo::MakeRequest(&remote_interfaces));
@@ -5546,9 +5743,10 @@ void RenderFrameHostImpl::InvalidateMojoConnection() {
 
   frame_.reset();
   frame_bindings_control_.reset();
-  frame_host_associated_binding_.Close();
+  frame_host_associated_receiver_.reset();
   navigation_control_.reset();
   frame_input_handler_.reset();
+  find_in_page_.reset();
 
   // Disconnect with ImageDownloader Mojo service in Blink.
   mojo_image_downloader_.reset();
@@ -5558,6 +5756,9 @@ void RenderFrameHostImpl::InvalidateMojoConnection() {
   // removed.
   geolocation_service_.reset();
   sensor_provider_proxy_.reset();
+
+  local_frame_host_receiver_.reset();
+  associated_registry_.reset();
 }
 
 bool RenderFrameHostImpl::IsFocused() {
@@ -5676,8 +5877,7 @@ RenderFrameHostImpl::GetMojoImageDownloader() {
 
 const mojo::AssociatedRemote<blink::mojom::FindInPage>&
 RenderFrameHostImpl::GetFindInPage() {
-  if (!find_in_page_ || !find_in_page_.is_bound() ||
-      !find_in_page_.is_connected())
+  if (!find_in_page_)
     GetRemoteAssociatedInterfaces()->GetInterface(&find_in_page_);
   return find_in_page_;
 }
@@ -5794,10 +5994,9 @@ void RenderFrameHostImpl::SetTextTrackSettings(
 }
 
 BrowserAccessibilityManager*
-    RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
+RenderFrameHostImpl::GetOrCreateBrowserAccessibilityManager() {
   RenderWidgetHostViewBase* view = GetViewForAccessibility();
-  if (view &&
-      !browser_accessibility_manager_ &&
+  if (view && !browser_accessibility_manager_ &&
       !no_create_browser_accessibility_manager_for_testing_) {
     bool is_root_frame = !frame_tree_node()->parent();
     browser_accessibility_manager_.reset(
@@ -5872,8 +6071,8 @@ void RenderFrameHostImpl::DidSelectPopupMenuItems(
 }
 
 void RenderFrameHostImpl::DidCancelPopupMenu() {
-  Send(new FrameMsg_SelectPopupMenuItems(
-      routing_id_, true, std::vector<int>()));
+  Send(
+      new FrameMsg_SelectPopupMenuItems(routing_id_, true, std::vector<int>()));
 }
 
 #endif
@@ -5901,8 +6100,7 @@ void RenderFrameHostImpl::UpdatePermissionsForNavigation(
   if (!GetProcess()->IsForGuestsOnly()) {
     ChildProcessSecurityPolicyImpl::GetInstance()->GrantCommitURL(
         GetProcess()->GetID(), common_params.url);
-    if (common_params.url.SchemeIs(url::kDataScheme) &&
-        !common_params.base_url_for_data_url.is_empty()) {
+    if (IsLoadDataWithBaseURL(common_params)) {
       // When there's a base URL specified for the data URL, we also need to
       // grant access to the base URL. This allows file: and other unexpected
       // schemes to be accepted at commit time and during CORS checks (e.g., for
@@ -5930,20 +6128,11 @@ void RenderFrameHostImpl::UpdatePermissionsForNavigation(
     GrantFileAccessFromResourceRequestBody(*common_params.post_data);
 }
 
-std::set<int> RenderFrameHostImpl::GetNavigationEntryIdsPendingCommit() {
-  std::set<int> result;
-  if (navigation_request_)
-    result.insert(navigation_request_->nav_entry_id());
-  for (auto const& requests : navigation_requests_)
-    result.insert(requests.second->nav_entry_id());
-  return result;
-}
-
-mojom::NavigationClientAssociatedPtr
+mojo::AssociatedRemote<mojom::NavigationClient>
 RenderFrameHostImpl::GetNavigationClientFromInterfaceProvider() {
-  mojom::NavigationClientAssociatedPtr navigation_client_ptr;
-  GetRemoteAssociatedInterfaces()->GetInterface(&navigation_client_ptr);
-  return navigation_client_ptr;
+  mojo::AssociatedRemote<mojom::NavigationClient> navigation_client_remote;
+  GetRemoteAssociatedInterfaces()->GetInterface(&navigation_client_remote);
+  return navigation_client_remote;
 }
 
 void RenderFrameHostImpl::NavigationRequestCancelled(
@@ -6040,10 +6229,8 @@ bool RenderFrameHostImpl::CreateNetworkServiceDefaultFactoryInternal(
 }
 
 bool RenderFrameHostImpl::CanExecuteJavaScript() {
-#if defined(OS_ANDROID) || defined(OS_FUCHSIA) || defined(IS_CHROMECAST)
   if (g_allow_injecting_javascript)
     return true;
-#endif
   return !frame_tree_node_->current_url().is_valid() ||
          frame_tree_node_->current_url().SchemeIs(kChromeDevToolsScheme) ||
          ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
@@ -6137,8 +6324,7 @@ void RenderFrameHostImpl::AXContentNodeDataToAXNodeData(
   }
 }
 
-void RenderFrameHostImpl::AXContentTreeDataToAXTreeData(
-    ui::AXTreeData* dst) {
+void RenderFrameHostImpl::AXContentTreeDataToAXTreeData(ui::AXTreeData* dst) {
   const AXContentTreeData& src = ax_content_tree_data_;
 
   // Copy the common fields.
@@ -6165,17 +6351,34 @@ void RenderFrameHostImpl::AXContentTreeDataToAXTreeData(
   dst->focused_tree_id = focused_frame->GetAXTreeID();
 }
 
-WebBluetoothServiceImpl* RenderFrameHostImpl::CreateWebBluetoothService(
-    blink::mojom::WebBluetoothServiceRequest request) {
+void RenderFrameHostImpl::CreatePaymentManager(
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
+  if (!IsFeatureEnabled(blink::mojom::FeaturePolicyFeature::kPayment)) {
+    mojo::ReportBadMessage("Feature policy blocks Payment");
+    return;
+  }
+  GetProcess()->CreatePaymentManagerForOrigin(GetLastCommittedOrigin(),
+                                              std::move(receiver));
+}
+
+void RenderFrameHostImpl::CreateWebBluetoothService(
+    mojo::PendingReceiver<blink::mojom::WebBluetoothService> receiver) {
+  BackForwardCache::DisableForRenderFrameHost(this, "WebBluetooth");
   // RFHI owns |web_bluetooth_services_| and |web_bluetooth_service| owns the
-  // |binding_| which may run the error handler. |binding_| can't run the error
-  // handler after it's destroyed so it can't run after the RFHI is destroyed.
+  // |receiver_| which may run the error handler. |receiver_| can't run the
+  // error handler after it's destroyed so it can't run after the RFHI is
+  // destroyed.
   auto web_bluetooth_service =
-      std::make_unique<WebBluetoothServiceImpl>(this, std::move(request));
+      std::make_unique<WebBluetoothServiceImpl>(this, std::move(receiver));
   web_bluetooth_service->SetClientConnectionErrorHandler(
       base::BindOnce(&RenderFrameHostImpl::DeleteWebBluetoothService,
                      base::Unretained(this), web_bluetooth_service.get()));
   web_bluetooth_services_.push_back(std::move(web_bluetooth_service));
+}
+
+WebBluetoothServiceImpl*
+RenderFrameHostImpl::GetWebBluetoothServiceForTesting() {
+  DCHECK(web_bluetooth_services_.back());
   return web_bluetooth_services_.back().get();
 }
 
@@ -6193,6 +6396,7 @@ void RenderFrameHostImpl::DeleteWebBluetoothService(
 
 void RenderFrameHostImpl::CreateWebUsbService(
     mojo::PendingReceiver<blink::mojom::WebUsbService> receiver) {
+  BackForwardCache::DisableForRenderFrameHost(this, "WebUSB");
   GetContentClient()->browser()->CreateWebUsbService(this, std::move(receiver));
 }
 
@@ -6215,12 +6419,12 @@ void RenderFrameHostImpl::ResetFeaturePolicy() {
 }
 
 void RenderFrameHostImpl::CreateAudioInputStreamFactory(
-    mojom::RendererAudioInputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver) {
   BrowserMainLoop* browser_main_loop = BrowserMainLoop::GetInstance();
   DCHECK(browser_main_loop);
   if (base::FeatureList::IsEnabled(features::kAudioServiceAudioStreams)) {
     MediaStreamManager* msm = browser_main_loop->media_stream_manager();
-    audio_service_audio_input_stream_factory_.emplace(std::move(request), msm,
+    audio_service_audio_input_stream_factory_.emplace(std::move(receiver), msm,
                                                       this);
   } else {
     in_content_audio_input_stream_factory_ =
@@ -6231,26 +6435,26 @@ void RenderFrameHostImpl::CreateAudioInputStreamFactory(
                                 browser_main_loop->user_input_monitor(),
                                 GetProcess()->GetID(), GetRoutingID()),
             browser_main_loop->media_stream_manager(), GetProcess()->GetID(),
-            GetRoutingID(), std::move(request));
+            GetRoutingID(), std::move(receiver));
   }
 }
 
 void RenderFrameHostImpl::CreateAudioOutputStreamFactory(
-    mojom::RendererAudioOutputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver) {
   if (base::FeatureList::IsEnabled(features::kAudioServiceAudioStreams)) {
     media::AudioSystem* audio_system =
         BrowserMainLoop::GetInstance()->audio_system();
     MediaStreamManager* media_stream_manager =
         BrowserMainLoop::GetInstance()->media_stream_manager();
     audio_service_audio_output_stream_factory_.emplace(
-        this, audio_system, media_stream_manager, std::move(request));
+        this, audio_system, media_stream_manager, std::move(receiver));
   } else {
     RendererAudioOutputStreamFactoryContext* factory_context =
         GetProcess()->GetRendererAudioOutputStreamFactoryContext();
     DCHECK(factory_context);
     in_content_audio_output_stream_factory_ =
         RenderFrameAudioOutputStreamFactoryHandle::CreateFactory(
-            factory_context, GetRoutingID(), std::move(request));
+            factory_context, GetRoutingID(), std::move(receiver));
   }
 }
 
@@ -6259,8 +6463,9 @@ void RenderFrameHostImpl::BindMediaInterfaceFactoryRequest(
   DCHECK(!media_interface_proxy_);
   media_interface_proxy_.reset(new MediaInterfaceProxy(
       this, std::move(request),
-      base::Bind(&RenderFrameHostImpl::OnMediaInterfaceFactoryConnectionError,
-                 base::Unretained(this))));
+      base::BindOnce(
+          &RenderFrameHostImpl::OnMediaInterfaceFactoryConnectionError,
+          base::Unretained(this))));
 }
 
 void RenderFrameHostImpl::CreateWebSocketConnector(
@@ -6285,7 +6490,8 @@ void RenderFrameHostImpl::OnMediaInterfaceFactoryConnectionError() {
 }
 
 #if defined(OS_ANDROID)
-void RenderFrameHostImpl::BindNFCRequest(device::mojom::NFCRequest request) {
+void RenderFrameHostImpl::BindNFCReceiver(
+    mojo::PendingReceiver<device::mojom::NFC> receiver) {
   // https://w3c.github.io/web-nfc/#security-policies
   // WebNFC API must be only accessible from top level browsing context.
   if (GetParent()) {
@@ -6294,13 +6500,13 @@ void RenderFrameHostImpl::BindNFCRequest(device::mojom::NFCRequest request) {
     return;
   }
   if (delegate_)
-    delegate_->GetNFC(std::move(request));
+    delegate_->GetNFC(std::move(receiver));
 }
 #endif
 
 #if !defined(OS_ANDROID)
-void RenderFrameHostImpl::BindSerialServiceRequest(
-    blink::mojom::SerialServiceRequest request) {
+void RenderFrameHostImpl::BindSerialService(
+    mojo::PendingReceiver<blink::mojom::SerialService> receiver) {
   if (!IsFeatureEnabled(blink::mojom::FeaturePolicyFeature::kSerial)) {
     mojo::ReportBadMessage("Feature policy blocks access to Serial.");
     return;
@@ -6309,16 +6515,21 @@ void RenderFrameHostImpl::BindSerialServiceRequest(
   if (!serial_service_)
     serial_service_ = std::make_unique<SerialService>(this);
 
-  serial_service_->Bind(std::move(request));
+  serial_service_->Bind(std::move(receiver));
 }
 
-void RenderFrameHostImpl::BindAuthenticatorRequest(
+void RenderFrameHostImpl::BindAuthenticatorReceiver(
     mojo::PendingReceiver<blink::mojom::Authenticator> receiver) {
   if (!authenticator_impl_)
     authenticator_impl_.reset(new AuthenticatorImpl(this));
 
   authenticator_impl_->Bind(std::move(receiver));
 }
+
+void RenderFrameHostImpl::GetHidService(
+    mojo::PendingReceiver<blink::mojom::HidService> receiver) {
+  HidService::Create(this, std::move(receiver));
+}
 #endif
 
 void RenderFrameHostImpl::GetIdleManager(
@@ -6332,6 +6543,13 @@ void RenderFrameHostImpl::GetIdleManager(
       ->CreateService(std::move(receiver));
 }
 
+void RenderFrameHostImpl::GetPresentationService(
+    mojo::PendingReceiver<blink::mojom::PresentationService> receiver) {
+  if (!presentation_service_)
+    presentation_service_ = PresentationServiceImpl::Create(this);
+  presentation_service_->Bind(std::move(receiver));
+}
+
 void RenderFrameHostImpl::GetSpeechSynthesis(
     mojo::PendingReceiver<blink::mojom::SpeechSynthesis> receiver) {
   if (!speech_synthesis_impl_) {
@@ -6341,9 +6559,26 @@ void RenderFrameHostImpl::GetSpeechSynthesis(
   speech_synthesis_impl_->AddReceiver(std::move(receiver));
 }
 
-blink::mojom::FileChooserPtr RenderFrameHostImpl::BindFileChooserForTesting() {
-  blink::mojom::FileChooserPtr chooser;
-  FileChooserImpl::Create(this, mojo::MakeRequest(&chooser));
+void RenderFrameHostImpl::GetFileChooser(
+    mojo::PendingReceiver<blink::mojom::FileChooser> receiver) {
+  FileChooserImpl::Create(this, std::move(receiver));
+}
+
+void RenderFrameHostImpl::GetSensorProvider(
+    mojo::PendingReceiver<device::mojom::SensorProvider> receiver) {
+  if (!sensor_provider_proxy_) {
+    sensor_provider_proxy_.reset(new SensorProviderProxyImpl(
+        PermissionControllerImpl::FromBrowserContext(
+            GetProcess()->GetBrowserContext()),
+        this));
+  }
+  sensor_provider_proxy_->Bind(std::move(receiver));
+}
+
+mojo::Remote<blink::mojom::FileChooser>
+RenderFrameHostImpl::BindFileChooserForTesting() {
+  mojo::Remote<blink::mojom::FileChooser> chooser;
+  FileChooserImpl::Create(this, chooser.BindNewPipeAndPassReceiver());
   return chooser;
 }
 
@@ -6407,20 +6642,45 @@ void RenderFrameHostImpl::GetAudioContextManager(
   AudioContextManagerImpl::Create(this, std::move(receiver));
 }
 
+void RenderFrameHostImpl::GetContactsManager(
+    mojo::PendingReceiver<blink::mojom::ContactsManager> receiver) {
+  ContactsManagerImpl::Create(this, std::move(receiver));
+}
+
 void RenderFrameHostImpl::GetFileSystemManager(
     mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver) {
   // This is safe because file_system_manager_ is deleted on the IO thread
   base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&FileSystemManagerImpl::BindRequest,
+                 base::BindOnce(&FileSystemManagerImpl::BindReceiver,
                                 base::Unretained(file_system_manager_.get()),
                                 std::move(receiver)));
 }
 
+void RenderFrameHostImpl::CreateLockManager(
+    mojo::PendingReceiver<blink::mojom::LockManager> receiver) {
+  GetProcess()->CreateLockManager(GetRoutingID(), GetLastCommittedOrigin(),
+                                  std::move(receiver));
+}
+
+void RenderFrameHostImpl::CreateIDBFactory(
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
+  GetProcess()->BindIndexedDB(GetRoutingID(), GetLastCommittedOrigin(),
+                              std::move(receiver));
+}
+
+void RenderFrameHostImpl::CreatePermissionService(
+    mojo::PendingReceiver<blink::mojom::PermissionService> receiver) {
+  if (!permission_service_context_)
+    permission_service_context_.reset(new PermissionServiceContext(this));
+
+  permission_service_context_->CreateService(std::move(receiver));
+}
+
 void RenderFrameHostImpl::GetAuthenticator(
     mojo::PendingReceiver<blink::mojom::Authenticator> receiver) {
 #if !defined(OS_ANDROID)
   if (base::FeatureList::IsEnabled(features::kWebAuth)) {
-    BindAuthenticatorRequest(std::move(receiver));
+    BindAuthenticatorReceiver(std::move(receiver));
   }
 #else
   GetJavaInterfaces()->GetInterface(std::move(receiver));
@@ -6537,7 +6797,8 @@ class RenderFrameHostImpl::JavaInterfaceProvider
     : public service_manager::mojom::InterfaceProvider {
  public:
   using BindCallback =
-      base::Callback<void(const std::string&, mojo::ScopedMessagePipeHandle)>;
+      base::RepeatingCallback<void(const std::string&,
+                                   mojo::ScopedMessagePipeHandle)>;
 
   JavaInterfaceProvider(
       const BindCallback& bind_callback,
@@ -6566,8 +6827,9 @@ RenderFrameHostImpl::GetJavaRenderFrameHost() {
   if (!render_frame_host_android) {
     service_manager::mojom::InterfaceProviderPtr interface_provider_ptr;
     java_interface_registry_ = std::make_unique<JavaInterfaceProvider>(
-        base::Bind(&RenderFrameHostImpl::ForwardGetInterfaceToRenderFrame,
-                   weak_ptr_factory_.GetWeakPtr()),
+        base::BindRepeating(
+            &RenderFrameHostImpl::ForwardGetInterfaceToRenderFrame,
+            weak_ptr_factory_.GetWeakPtr()),
         mojo::MakeRequest(&interface_provider_ptr));
     render_frame_host_android =
         new RenderFrameHostAndroid(this, std::move(interface_provider_ptr));
@@ -6595,7 +6857,7 @@ void RenderFrameHostImpl::ForwardGetInterfaceToRenderFrame(
 #endif
 
 void RenderFrameHostImpl::ForEachImmediateLocalRoot(
-    const base::Callback<void(RenderFrameHostImpl*)>& callback) {
+    const base::RepeatingCallback<void(RenderFrameHostImpl*)>& callback) {
   if (!frame_tree_node_->child_count())
     return;
 
@@ -6615,7 +6877,7 @@ void RenderFrameHostImpl::ForEachImmediateLocalRoot(
 }
 
 void RenderFrameHostImpl::SetVisibilityForChildViews(bool visible) {
-  ForEachImmediateLocalRoot(base::Bind(
+  ForEachImmediateLocalRoot(base::BindRepeating(
       [](bool is_visible, RenderFrameHostImpl* frame_host) {
         if (auto* view = frame_host->GetView())
           return is_visible ? view->Show() : view->Hide();
@@ -6659,8 +6921,7 @@ bool RenderFrameHostImpl::ValidateDidCommitParams(
     // commit in the old renderer process.  This may be true for subframe
     // navigations even when error page isolation is enabled for main frames.
     if (navigation_request &&
-        navigation_request->navigation_handle()->GetNetErrorCode() ==
-            net::ERR_BLOCKED_BY_CLIENT) {
+        navigation_request->GetNetErrorCode() == net::ERR_BLOCKED_BY_CLIENT) {
       bypass_checks_for_error_page = true;
     }
   }
@@ -6682,7 +6943,23 @@ bool RenderFrameHostImpl::ValidateDidCommitParams(
       bypass_checks_for_file_scheme = true;
   }
 
-  if (!bypass_checks_for_error_page && !bypass_checks_for_file_scheme) {
+  // WebView's loadDataWithBaseURL API is allowed to bypass normal commit
+  // checks because it is allowed to commit anything into its unlocked process
+  // and its data: URL and non-opaque origin would fail the normal commit
+  // checks.
+  bool bypass_checks_for_webview = false;
+  if ((navigation_request &&
+       IsLoadDataWithBaseURL(navigation_request->common_params())) ||
+      (is_same_document_navigation &&
+       IsLoadDataWithBaseURL(*validated_params))) {
+    // Allow bypass if the process isn't locked. Otherwise run normal checks.
+    bypass_checks_for_webview = ChildProcessSecurityPolicyImpl::GetInstance()
+                                    ->GetOriginLock(process->GetID())
+                                    .is_empty();
+  }
+
+  if (!bypass_checks_for_error_page && !bypass_checks_for_file_scheme &&
+      !bypass_checks_for_webview) {
     // Attempts to commit certain off-limits URL should be caught more strictly
     // than our FilterURL checks.  If a renderer violates this policy, it
     // should be killed.
@@ -6692,6 +6969,12 @@ bool RenderFrameHostImpl::ValidateDidCommitParams(
         // The origin and URL are safe to commit.
         break;
       case CanCommitStatus::CANNOT_COMMIT_URL:
+        DLOG(ERROR) << "CANNOT_COMMIT_URL url '" << validated_params->url << "'"
+                    << " origin '" << validated_params->origin << "'"
+                    << " lock '"
+                    << ChildProcessSecurityPolicyImpl::GetInstance()
+                           ->GetOriginLock(process->GetID())
+                    << "'";
         VLOG(1) << "Blocked URL " << validated_params->url.spec();
         LogCannotCommitUrlCrashKeys(validated_params->url,
                                     is_same_document_navigation,
@@ -6702,6 +6985,13 @@ bool RenderFrameHostImpl::ValidateDidCommitParams(
             process, bad_message::RFH_CAN_COMMIT_URL_BLOCKED);
         return false;
       case CanCommitStatus::CANNOT_COMMIT_ORIGIN:
+        DLOG(ERROR) << "CANNOT_COMMIT_ORIGIN url '" << validated_params->url
+                    << "'"
+                    << " origin '" << validated_params->origin << "'"
+                    << " lock '"
+                    << ChildProcessSecurityPolicyImpl::GetInstance()
+                           ->GetOriginLock(process->GetID())
+                    << "'";
         DEBUG_ALIAS_FOR_ORIGIN(origin_debug_alias, validated_params->origin);
         LogCannotCommitOriginCrashKeys(is_same_document_navigation,
                                        navigation_request);
@@ -6755,7 +7045,8 @@ void RenderFrameHostImpl::UpdateSiteURL(const GURL& url,
 
 bool RenderFrameHostImpl::DidCommitNavigationInternal(
     std::unique_ptr<NavigationRequest> navigation_request,
-    FrameHostMsg_DidCommitProvisionalLoad_Params* validated_params,
+    std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
+        validated_params,
     bool is_same_document_navigation) {
   // Sanity-check the page transition for frame type.
   DCHECK_EQ(ui::PageTransitionIsMainFrame(validated_params->transition),
@@ -6809,7 +7100,7 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
     }
   }
 
-  if (!ValidateDidCommitParams(navigation_request.get(), validated_params,
+  if (!ValidateDidCommitParams(navigation_request.get(), validated_params.get(),
                                is_same_document_navigation)) {
     return false;
   }
@@ -6845,7 +7136,7 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
   }
 
   DCHECK(navigation_request);
-  DCHECK(navigation_request->navigation_handle());
+  DCHECK(navigation_request->IsNavigationStarted());
 
   // Update the page transition. For subframe navigations, the renderer process
   // only gives the correct page transition at commit time.
@@ -6857,6 +7148,7 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
                                            NavigationGestureUser);
 
   last_http_status_code_ = validated_params->http_status_code;
+  last_http_method_ = validated_params->method;
   UpdateSiteURL(validated_params->url, validated_params->url_is_unreachable);
 
   // Set the state whether this navigation is to an MHTML document, since there
@@ -6873,6 +7165,12 @@ bool RenderFrameHostImpl::DidCommitNavigationInternal(
                                               std::move(navigation_request),
                                               is_same_document_navigation);
 
+  if (IsBackForwardCacheEnabled()) {
+    // Store the Commit params so they can be reused if the page is ever
+    // restored from the BackForwardCache.
+    last_commit_params_ = std::move(validated_params);
+  }
+
   if (!is_same_document_navigation) {
     cookie_no_samesite_deprecation_url_hashes_.clear();
     cookie_samesite_none_insecure_deprecation_url_hashes_.clear();
@@ -6890,8 +7188,7 @@ void RenderFrameHostImpl::OnSameDocumentCommitProcessed(
   // If the NavigationRequest was deleted, another navigation commit started to
   // be processed. Let the latest commit go through and stop doing anything.
   if (!same_document_navigation_request_ ||
-      same_document_navigation_request_->navigation_handle()
-              ->GetNavigationId() != navigation_id) {
+      same_document_navigation_request_->GetNavigationId() != navigation_id) {
     return;
   }
 
@@ -7007,7 +7304,7 @@ void RenderFrameHostImpl::SendCommitNavigation(
     NavigationRequest* navigation_request,
     mojom::CommonNavigationParamsPtr common_params,
     mojom::CommitNavigationParamsPtr commit_params,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
     network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
     std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -7021,8 +7318,9 @@ void RenderFrameHostImpl::SendCommitNavigation(
     const base::UnguessableToken& devtools_navigation_token) {
   if (navigation_client) {
     navigation_client->CommitNavigation(
-        std::move(common_params), std::move(commit_params), response_head,
-        std::move(response_body), std::move(url_loader_client_endpoints),
+        std::move(common_params), std::move(commit_params),
+        std::move(response_head), std::move(response_body),
+        std::move(url_loader_client_endpoints),
         std::move(subresource_loader_factories),
         std::move(subresource_overrides), std::move(controller),
         std::move(provider_info), std::move(prefetch_loader_factory),
@@ -7030,8 +7328,9 @@ void RenderFrameHostImpl::SendCommitNavigation(
         BuildNavigationClientCommitNavigationCallback(navigation_request));
   } else {
     GetNavigationControl()->CommitNavigation(
-        std::move(common_params), std::move(commit_params), response_head,
-        std::move(response_body), std::move(url_loader_client_endpoints),
+        std::move(common_params), std::move(commit_params),
+        std::move(response_head), std::move(response_body),
+        std::move(url_loader_client_endpoints),
         std::move(subresource_loader_factories),
         std::move(subresource_overrides), std::move(controller),
         std::move(provider_info), std::move(prefetch_loader_factory),
@@ -7073,16 +7372,16 @@ void RenderFrameHostImpl::DidCommitNavigation(
     std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
         validated_params,
     mojom::DidCommitProvisionalLoadInterfaceParamsPtr interface_params) {
-  NavigationHandleImpl* navigation_handle;
+  NavigationRequest* request;
   if (committing_navigation_request) {
-    navigation_handle = committing_navigation_request->navigation_handle();
+    request = committing_navigation_request.get();
   } else {
-    navigation_handle = GetNavigationHandle();
+    request = navigation_request();
   }
 
-  if (navigation_handle) {
+  if (request && request->IsNavigationStarted()) {
     main_frame_request_ids_ = {validated_params->request_id,
-                               navigation_handle->GetGlobalRequestID()};
+                               request->GetGlobalRequestID()};
     if (deferred_main_frame_load_info_)
       ResourceLoadComplete(std::move(deferred_main_frame_load_info_));
   }
@@ -7179,7 +7478,7 @@ void RenderFrameHostImpl::DidCommitNavigation(
   }
 
   if (!DidCommitNavigationInternal(std::move(committing_navigation_request),
-                                   validated_params.get(),
+                                   std::move(validated_params),
                                    false /* is_same_document_navigation */)) {
     return;
   }
@@ -7453,10 +7752,12 @@ void RenderFrameHostImpl::LogCannotCommitUrlCrashKeys(
                                           base::debug::CrashKeySize::Size256),
       GetSiteInstance()->lock_url().spec());
 
-  base::debug::SetCrashKeyString(
-      base::debug::AllocateCrashKeyString("original_url_origin",
-                                          base::debug::CrashKeySize::Size256),
-      GetSiteInstance()->original_url().GetOrigin().spec());
+  if (!GetSiteInstance()->IsDefaultSiteInstance()) {
+    base::debug::SetCrashKeyString(
+        base::debug::AllocateCrashKeyString("original_url_origin",
+                                            base::debug::CrashKeySize::Size256),
+        GetSiteInstance()->original_url().GetOrigin().spec());
+  }
 
   base::debug::SetCrashKeyString(
       base::debug::AllocateCrashKeyString("is_transfer_needed",
@@ -7480,27 +7781,26 @@ void RenderFrameHostImpl::LogCannotCommitUrlCrashKeys(
                                           base::debug::CrashKeySize::Size256),
       last_successful_url().GetOrigin().spec());
 
-  if (navigation_request && navigation_request->navigation_handle()) {
-    NavigationHandleImpl* handle = navigation_request->navigation_handle();
+  if (navigation_request && navigation_request->IsNavigationStarted()) {
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_renderer_initiated",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->IsRendererInitiated()));
+        bool_to_crash_key(navigation_request->IsRendererInitiated()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_server_redirect",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->WasServerRedirect()));
+        bool_to_crash_key(navigation_request->WasServerRedirect()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_form_submission",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->IsFormSubmission()));
+        bool_to_crash_key(navigation_request->IsFormSubmission()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_error_page",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->IsErrorPage()));
+        bool_to_crash_key(navigation_request->IsErrorPage()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("from_begin_navigation",
@@ -7510,25 +7810,25 @@ void RenderFrameHostImpl::LogCannotCommitUrlCrashKeys(
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("net_error",
                                             base::debug::CrashKeySize::Size32),
-        base::NumberToString(navigation_request->net_error()));
+        base::NumberToString(navigation_request->GetNetErrorCode()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("initiator_origin",
                                             base::debug::CrashKeySize::Size64),
-        handle->GetInitiatorOrigin()
-            ? handle->GetInitiatorOrigin()->GetDebugString()
+        navigation_request->GetInitiatorOrigin()
+            ? navigation_request->GetInitiatorOrigin()->GetDebugString()
             : "none");
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("starting_site_instance",
                                             base::debug::CrashKeySize::Size64),
-        handle->GetStartingSiteInstance()->GetSiteURL().spec());
+        navigation_request->GetStartingSiteInstance()->GetSiteURL().spec());
 
     // Recompute the target SiteInstance to see if it matches the current
     // one at commit time.
     scoped_refptr<SiteInstance> dest_instance =
         frame_tree_node_->render_manager()->GetSiteInstanceForNavigationRequest(
-            *navigation_request);
+            navigation_request);
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString(
             "does_recomputed_site_instance_match",
@@ -7537,6 +7837,24 @@ void RenderFrameHostImpl::LogCannotCommitUrlCrashKeys(
   }
 }
 
+void RenderFrameHostImpl::MaybeEvictFromBackForwardCache(
+    BackForwardCacheMetrics::EvictedReason reason) {
+  if (!is_in_back_forward_cache_)
+    return;
+
+  NavigationControllerImpl* controller = static_cast<NavigationControllerImpl*>(
+      frame_tree_node_->navigator()->GetController());
+  auto can_store = controller->GetBackForwardCache().CanStoreDocument(this);
+  TRACE_EVENT1("navigation",
+               "RenderFrameHostImpl::MaybeEvictFromBackForwardCache",
+               "can_store", can_store.ToString());
+
+  if (can_store)
+    return;
+
+  EvictFromBackForwardCacheWithReason(reason);
+}
+
 void RenderFrameHostImpl::LogCannotCommitOriginCrashKeys(
     bool is_same_document_navigation,
     NavigationRequest* navigation_request) {
@@ -7570,40 +7888,65 @@ void RenderFrameHostImpl::LogCannotCommitOriginCrashKeys(
                                           base::debug::CrashKeySize::Size32),
       bool_to_crash_key(IsCrossProcessSubframe()));
 
-  if (navigation_request && navigation_request->navigation_handle()) {
-    NavigationHandleImpl* handle = navigation_request->navigation_handle();
+  if (navigation_request && navigation_request->IsNavigationStarted()) {
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_renderer_initiated",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->IsRendererInitiated()));
+        bool_to_crash_key(navigation_request->IsRendererInitiated()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_server_redirect",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->WasServerRedirect()));
+        bool_to_crash_key(navigation_request->WasServerRedirect()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_form_submission",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->IsFormSubmission()));
+        bool_to_crash_key(navigation_request->IsFormSubmission()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_error_page",
                                             base::debug::CrashKeySize::Size32),
-        bool_to_crash_key(handle->IsErrorPage()));
+        bool_to_crash_key(navigation_request->IsErrorPage()));
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("initiator_origin",
                                             base::debug::CrashKeySize::Size64),
-        handle->GetInitiatorOrigin()
-            ? handle->GetInitiatorOrigin()->GetDebugString()
+        navigation_request->GetInitiatorOrigin()
+            ? navigation_request->GetInitiatorOrigin()->GetDebugString()
             : "none");
 
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("starting_site_instance",
                                             base::debug::CrashKeySize::Size64),
-        handle->GetStartingSiteInstance()->GetSiteURL().spec());
+        navigation_request->GetStartingSiteInstance()->GetSiteURL().spec());
   }
 }
 
+void RenderFrameHostImpl::EnableMojoJsBindings() {
+  // This method should only be called on RenderFrameHost which is for a WebUI.
+  DCHECK_NE(WebUI::kNoWebUI,
+            WebUIControllerFactoryRegistry::GetInstance()->GetWebUIType(
+                GetSiteInstance()->GetBrowserContext(),
+                site_instance_->GetSiteURL()));
+
+  if (!frame_bindings_control_)
+    GetRemoteAssociatedInterfaces()->GetInterface(&frame_bindings_control_);
+  frame_bindings_control_->EnableMojoJsBindings();
+}
+
+BackForwardCacheMetrics* RenderFrameHostImpl::GetBackForwardCacheMetrics() {
+  NavigationEntryImpl* navigation_entry =
+      static_cast<NavigationControllerImpl*>(
+          frame_tree_node_->navigator()->GetController())
+          ->GetEntryWithUniqueID(nav_entry_id());
+  if (!navigation_entry)
+    return nullptr;
+  return navigation_entry->back_forward_cache_metrics();
+}
+
+bool RenderFrameHostImpl::HasPendingCommitNavigationForTesting() {
+  return navigation_request_ || !navigation_requests_.empty();
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl.h b/chromium/content/browser/frame_host/render_frame_host_impl.h
index d2e127139b7..d8628575bbe 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl.h
+++ b/chromium/content/browser/frame_host/render_frame_host_impl.h
@@ -33,6 +33,8 @@
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/browser_interface_broker_impl.h"
+#include "content/browser/can_commit_status.h"
+#include "content/browser/frame_host/back_forward_cache_metrics.h"
 #include "content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.h"
 #include "content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.h"
 #include "content/browser/renderer_host/media/render_frame_audio_input_stream_factory.h"
@@ -57,7 +59,9 @@
 #include "content/public/common/previews_state.h"
 #include "content/public/common/transferrable_url_loader.mojom.h"
 #include "media/mojo/mojom/interface_factory.mojom.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -65,7 +69,9 @@
 #include "net/base/network_isolation_key.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/http/http_response_headers.h"
+#include "services/device/public/mojom/sensor_provider.mojom.h"
 #include "services/device/public/mojom/wake_lock_context.mojom.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "services/viz/public/mojom/hit_test/input_target_client.mojom.h"
@@ -73,9 +79,11 @@
 #include "third_party/blink/public/common/frame/blocked_navigation_types.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/user_activation_update_type.h"
+#include "third_party/blink/public/common/sudden_termination_disabler_type.h"
 #include "third_party/blink/public/mojom/bluetooth/web_bluetooth.mojom.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "third_party/blink/public/mojom/commit_result/commit_result.mojom.h"
+#include "third_party/blink/public/mojom/contacts/contacts_manager.mojom.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom.h"
 #include "third_party/blink/public/mojom/frame/document_interface_broker.mojom.h"
 #include "third_party/blink/public/mojom/frame/find_in_page.mojom.h"
@@ -83,6 +91,8 @@
 #include "third_party/blink/public/mojom/frame/navigation_initiator.mojom.h"
 #include "third_party/blink/public/mojom/idle/idle_manager.mojom.h"
 #include "third_party/blink/public/mojom/image_downloader/image_downloader.mojom.h"
+#include "third_party/blink/public/mojom/payments/payment_app.mojom.h"
+#include "third_party/blink/public/mojom/permissions/permission.mojom.h"
 #include "third_party/blink/public/mojom/presentation/presentation.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
 #include "third_party/blink/public/mojom/sms/sms_receiver.mojom-forward.h"
@@ -90,14 +100,15 @@
 #include "third_party/blink/public/mojom/usb/web_usb_service.mojom.h"
 #include "third_party/blink/public/mojom/webaudio/audio_context_manager.mojom-forward.h"
 #include "third_party/blink/public/mojom/webauthn/authenticator.mojom.h"
+#include "third_party/blink/public/mojom/webauthn/virtual_authenticator.mojom.h"
 #include "third_party/blink/public/mojom/websockets/websocket_connector.mojom.h"
 #include "third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.h"
 #include "third_party/blink/public/platform/web_focus_type.h"
 #include "third_party/blink/public/platform/web_insecure_request_policy.h"
 #include "third_party/blink/public/platform/web_scroll_types.h"
-#include "third_party/blink/public/platform/web_sudden_termination_disabler_type.h"
 #include "third_party/blink/public/web/web_text_direction.h"
 #include "third_party/blink/public/web/web_tree_scope_type.h"
+#include "third_party/skia/include/core/SkColor.h"
 #include "ui/accessibility/ax_action_handler.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/accessibility/ax_node_data.h"
@@ -107,6 +118,7 @@
 #if defined(OS_ANDROID)
 #include "services/device/public/mojom/nfc.mojom.h"
 #else
+#include "third_party/blink/public/mojom/hid/hid.mojom.h"
 #include "third_party/blink/public/mojom/serial/serial.mojom.h"
 #endif
 
@@ -114,6 +126,7 @@ class GURL;
 struct AccessibilityHostMsg_EventBundleParams;
 struct AccessibilityHostMsg_FindInPageResultParams;
 struct AccessibilityHostMsg_LocationChangeParams;
+struct FrameHostMsg_DownloadUrl_Params;
 struct FrameHostMsg_OpenURL_Params;
 struct FrameMsg_TextTrackSettings_Params;
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
@@ -125,7 +138,6 @@ class AssociatedInterfaceProvider;
 class AssociatedInterfaceRegistry;
 struct FramePolicy;
 struct TransferableMessage;
-struct WebFullscreenOptions;
 struct WebScrollIntoViewParams;
 
 namespace mojom {
@@ -139,7 +151,6 @@ class Range;
 
 namespace network {
 class ResourceRequestBody;
-struct ResourceResponse;
 }  // namespace network
 
 namespace content {
@@ -152,7 +163,6 @@ class GeolocationServiceImpl;
 class KeepAliveHandleFactory;
 class MediaInterfaceProxy;
 class NavigationEntryImpl;
-class NavigationHandleImpl;
 class NavigationRequest;
 class PermissionServiceContext;
 class PrefetchedSignedExchangeCache;
@@ -177,8 +187,6 @@ struct PendingNavigation;
 struct ResourceTimingInfo;
 struct SubresourceLoaderParams;
 
-class MediaStreamDispatcherHost;
-
 // To be called when a RenderFrameHostImpl receives an event.
 // Provides the host, the event fired, and which node id the event was for.
 typedef base::RepeatingCallback<
@@ -194,6 +202,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       public SiteInstanceImpl::Observer,
       public service_manager::mojom::InterfaceProvider,
       public blink::mojom::DocumentInterfaceBroker,
+      public blink::mojom::LocalFrameHost,
       public CSPContext,
       public ui::AXActionHandler {
  public:
@@ -205,6 +214,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // this happens more than this many times, kill the renderer.
   static const int kMaxAccessibilityResets = 5;
 
+  static RenderFrameHostImpl* FromID(GlobalFrameRoutingId id);
   static RenderFrameHostImpl* FromID(int process_id, int routing_id);
   static RenderFrameHostImpl* FromAXTreeID(ui::AXTreeID ax_tree_id);
   static RenderFrameHostImpl* FromOverlayRoutingToken(
@@ -215,7 +225,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // This method must be called either on the UI thread or before threads start.
   // This callback is run on the UI thread.
   using CreateNetworkFactoryCallback = base::RepeatingCallback<void(
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       int process_id,
       network::mojom::URLLoaderFactoryPtrInfo original_factory)>;
   static void SetNetworkFactoryForTesting(
@@ -233,6 +243,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   RenderProcessHost* GetProcess() override;
   RenderWidgetHostView* GetView() override;
   RenderFrameHostImpl* GetParent() override;
+  std::vector<RenderFrameHost*> GetFramesInSubtree() override;
   bool IsDescendantOf(RenderFrameHost*) override;
   int GetFrameTreeNodeId() override;
   base::UnguessableToken GetDevToolsFrameToken() override;
@@ -272,14 +283,16 @@ class CONTENT_EXPORT RenderFrameHostImpl
   size_t GetProxyCount() override;
   bool HasSelection() override;
   void RequestTextSurroundingSelection(
-      TextSurroundingSelectionCallback callback,
+      blink::mojom::Frame::GetTextSurroundingSelectionCallback callback,
       int max_length) override;
+  void SendInterventionReport(const std::string& id,
+                              const std::string& message) override;
   void AllowBindings(int binding_flags) override;
   int GetEnabledBindings() override;
   void DisableBeforeUnloadHangMonitorForTesting() override;
   bool IsBeforeUnloadHangMonitorDisabledForTesting() override;
   bool GetSuddenTerminationDisablerState(
-      blink::WebSuddenTerminationDisablerType disabler_type) override;
+      blink::SuddenTerminationDisablerType disabler_type) override;
   bool IsFeatureEnabled(blink::mojom::FeaturePolicyFeature feature) override;
   bool IsFeatureEnabled(blink::mojom::FeaturePolicyFeature feature,
                         blink::PolicyValue threshold_value) override;
@@ -290,9 +303,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
       const gfx::Point&,
       const blink::WebMediaPlayerAction& action) override;
   bool CreateNetworkServiceDefaultFactory(
-      network::mojom::URLLoaderFactoryRequest default_factory_request) override;
-  void MarkInitiatorsAsRequiringSeparateURLLoaderFactory(
-      base::flat_set<url::Origin> request_initiators,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+          default_factory_receiver) override;
+  void MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory(
+      base::flat_set<url::Origin> isolated_world_origins,
       bool push_to_renderer_now) override;
   bool IsSandboxed(blink::WebSandboxFlags flags) override;
   void FlushNetworkAndNavigationInterfacesForTesting() override;
@@ -301,10 +315,16 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void UpdateSubresourceLoaderFactories() override;
   blink::FrameOwnerElementType GetFrameOwnerElementType() override;
   bool HasTransientUserActivation() override;
+  void UpdateBrowserControlsState(BrowserControlsState constraints,
+                                  BrowserControlsState current,
+                                  bool animate) override;
+  void Reload() override;
 
   void SendAccessibilityEventsToManager(
       const AXEventNotificationDetails& details);
-  void EvictFromBackForwardCache() override;
+
+  void EvictFromBackForwardCacheWithReason(
+      base::Optional<BackForwardCacheMetrics::EvictedReason> reason);
 
   // IPC::Sender
   bool Send(IPC::Message* msg) override;
@@ -318,6 +338,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // BrowserAccessibilityDelegate
   void AccessibilityPerformAction(const ui::AXActionData& data) override;
   bool AccessibilityViewHasFocus() const override;
+  void AccessibilityViewSetFocus() override;
   gfx::Rect AccessibilityGetViewBounds() const override;
   float AccessibilityGetDeviceScaleFactor() const override;
   void AccessibilityFatalError() override;
@@ -333,7 +354,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
                            const ChildProcessTerminationInfo& info) override;
 
   // SiteInstanceImpl::Observer
-  void RenderProcessGone(SiteInstanceImpl* site_instance) override;
+  void RenderProcessGone(SiteInstanceImpl* site_instance,
+                         const ChildProcessTerminationInfo& info) override;
 
   // CSPContext
   void ReportContentSecurityPolicyViolation(
@@ -448,13 +470,30 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // cases, use GetLastCommittedURL instead.
   const GURL& last_successful_url() { return last_successful_url_; }
 
+  // Return the http method of the last committed navigation.
+  const std::string& last_http_method() { return last_http_method_; }
+
   // Return the http status code of the last committed navigation.
   int last_http_status_code() { return last_http_status_code_; }
 
+  // Returns |frame_origin| if this frame is the top (i.e. root) frame in the
+  // frame tree. Otherwise, it returns the top frame's origin.
+  const url::Origin& ComputeTopFrameOrigin(
+      const url::Origin& frame_origin) const;
+
   // Computes site_for_cookies to be used when navigating this frame to
   // |destination|.
   GURL ComputeSiteForCookiesForNavigation(const GURL& destination) const;
 
+  // Computes site_for_cookies for this frame. A non-empty result denotes which
+  // domains are considered first-party to the top-level site when resources are
+  // loaded inside this frame. An empty result means that nothing will be
+  // first-party, as the frame hierarchy makes this context third-party already.
+  //
+  // The result can be used to check if cookies (including storage APIs and
+  // shared/service workers) are accessible.
+  GURL ComputeSiteForCookies() const;
+
   // Allows overriding the last committed origin in tests.
   void SetLastCommittedOriginForTesting(const url::Origin& origin);
 
@@ -471,11 +510,21 @@ class CONTENT_EXPORT RenderFrameHostImpl
     return should_reuse_web_ui_ ? web_ui_.get() : pending_web_ui_.get();
   }
 
+  // Enable Mojo JavaScript bindings in the renderer process. It will be
+  // effective on the first creation of script context after the call is made.
+  // If called at frame creation time (RenderFrameCreated) or just before a
+  // document is committed (ReadyToCommitNavigation), the resulting document
+  // will have the JS bindings enabled.
+  void EnableMojoJsBindings();
+
   // Returns this RenderFrameHost's loading state. This method is only used by
   // FrameTreeNode. The proper way to check whether a frame is loading is to
   // call FrameTreeNode::IsLoading.
   bool is_loading() const { return is_loading_; }
 
+  // Returns true if this frame has fired DOMContentLoaded.
+  bool dom_content_loaded() const { return dom_content_loaded_; }
+
   // Returns true if this is a top-level frame, or if this frame's RenderFrame
   // is in a different process from its parent frame. Local roots are
   // distinguished by owning a RenderWidgetHost, which manages input events
@@ -513,10 +562,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
     return same_document_navigation_request_.get();
   }
 
-  // Returns the NavigationHandleImpl stored in the NavigationRequest returned
-  // by GetNavigationRequest(), if any.
-  NavigationHandleImpl* GetNavigationHandle();
-
   // Resets the NavigationRequests stored in this RenderFrameHost.
   void ResetNavigationRequests();
 
@@ -704,7 +749,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       NavigationRequest* navigation_request,
       mojom::CommonNavigationParamsPtr common_params,
       mojom::CommitNavigationParamsPtr commit_params,
-      network::ResourceResponse* response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       mojo::ScopedDataPipeConsumerHandle response_body,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       bool is_view_source,
@@ -860,8 +905,9 @@ class CONTENT_EXPORT RenderFrameHostImpl
       mojo::PendingReceiver<blink::mojom::BrowserInterfaceBroker>);
 
   // Exposed so that tests can swap out the implementation and intercept calls.
-  mojo::AssociatedBinding<mojom::FrameHost>& frame_host_binding_for_testing() {
-    return frame_host_associated_binding_;
+  mojo::AssociatedReceiver<mojom::FrameHost>&
+  frame_host_receiver_for_testing() {
+    return frame_host_associated_receiver_;
   }
 
   mojo::Binding<service_manager::mojom::InterfaceProvider>&
@@ -890,37 +936,60 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // for unload handler processing.
   void SetSubframeUnloadTimeoutForTesting(const base::TimeDelta& timeout);
 
-  // Returns the list of NavigationEntry ids corresponding to NavigationRequests
-  // waiting to commit in this RenderFrameHost.
-  std::set<int> GetNavigationEntryIdsPendingCommit();
-
   service_manager::BinderRegistry& BinderRegistryForTesting() {
     return *registry_;
   }
-  blink::mojom::FileChooserPtr BindFileChooserForTesting();
+
+  mojo::Remote<blink::mojom::FileChooser> BindFileChooserForTesting();
 
   // Called when the WebAudio AudioContext given by |audio_context_id| has
   // started (or stopped) playing audible audio.
   void AudioContextPlaybackStarted(int audio_context_id);
   void AudioContextPlaybackStopped(int audio_context_id);
 
-  // BackForwardCache:
-  //
-  // When a RenderFrameHostImpl enters the BackForwardCache, the document enters
-  // in a "Frozen" state where no Javascript can run.
-  void EnterBackForwardCache();  // The document enters the BackForwardCache.
-  void LeaveBackForwardCache();  // The document leaves the BackForwardCache.
+  // Called when this RenderFrameHostImpl enters the BackForwardCache, the
+  // document enters in a "Frozen" state where no Javascript can run.
+  void EnterBackForwardCache();
+
+  // Called when this RenderFrameHostImpl leaves the BackForwardCache. This
+  // occurs immediately before a restored document is committed.
+  void LeaveBackForwardCache();
+
+  // Take ownership over the DidCommitProvisionalLoad_Params that
+  // were last used to commit this navigation.
+  // This is used by the BackForwardCache to re-commit when navigating to a
+  // restored page.
+  std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
+  TakeLastCommitParams();
+
+  // Start a timer that will evict this RenderFrameHost from the
+  // BackForwardCache after time to live.
+  void StartBackForwardCacheEvictionTimer();
+
   bool is_in_back_forward_cache() { return is_in_back_forward_cache_; }
 
+  bool is_back_forward_cache_disallowed() const {
+    return is_back_forward_cache_disallowed_;
+  }
+
+  // Prevents this frame (along with its parents/children) from being added to
+  // the BackForwardCache. If the frame is already in the cache an eviction is
+  // triggered.
+  void DisallowBackForwardCache();
+
+  bool is_evicted_from_back_forward_cache() {
+    return is_evicted_from_back_forward_cache_;
+  }
+
   // Called to taint |this| so the pages which have requested MediaStream
   // (audio/video/etc capture stream) access would not enter BackForwardCache.
   void OnGrantedMediaStreamAccess();
   bool was_granted_media_access() { return was_granted_media_access_; }
 
   // Request a new NavigationClient interface from the renderer and returns the
-  // ownership of the AssociatedPtr. This is intended for use by the
+  // ownership of the mojo::AssociatedRemote. This is intended for use by the
   // NavigationRequest. Only used with PerNavigationMojoInterface enabled.
-  mojom::NavigationClientAssociatedPtr
+  mojo::AssociatedRemote<mojom::NavigationClient>
   GetNavigationClientFromInterfaceProvider();
 
   // Called to signify the RenderFrameHostImpl that one of its ongoing
@@ -947,6 +1016,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   // mojom::FrameHost:
   void VisibilityChanged(blink::mojom::FrameVisibility) override;
+  void DidChangeThemeColor(const base::Optional<SkColor>& theme_color) override;
 
   blink::mojom::FrameVisibility visibility() const { return visibility_; }
 
@@ -1024,15 +1094,72 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void GetAudioContextManager(
       mojo::PendingReceiver<blink::mojom::AudioContextManager> receiver);
 
+  void GetContactsManager(
+      mojo::PendingReceiver<blink::mojom::ContactsManager> receiver);
+
   void GetFileSystemManager(
       mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver);
 
+#if !defined(OS_ANDROID)
+  void GetHidService(mojo::PendingReceiver<blink::mojom::HidService> receiver);
+
+  void BindSerialService(
+      mojo::PendingReceiver<blink::mojom::SerialService> receiver);
+#endif
+
   void GetIdleManager(
       mojo::PendingReceiver<blink::mojom::IdleManager> receiver);
 
+  void GetPresentationService(
+      mojo::PendingReceiver<blink::mojom::PresentationService> receiver);
+
   void GetSpeechSynthesis(
       mojo::PendingReceiver<blink::mojom::SpeechSynthesis> receiver);
 
+  void CreateLockManager(
+      mojo::PendingReceiver<blink::mojom::LockManager> receiver);
+
+  void CreateIDBFactory(
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver);
+
+  void GetFileChooser(
+      mojo::PendingReceiver<blink::mojom::FileChooser> receiver);
+
+  void GetSensorProvider(
+      mojo::PendingReceiver<device::mojom::SensorProvider> receiver);
+
+  void CreatePermissionService(
+      mojo::PendingReceiver<blink::mojom::PermissionService> receiver);
+
+  void CreatePaymentManager(
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
+
+  void CreateWebBluetoothService(
+      mojo::PendingReceiver<blink::mojom::WebBluetoothService> receiver);
+  void GetCredentialManager(
+      mojo::PendingReceiver<blink::mojom::CredentialManager> receiver);
+
+  void GetAuthenticator(
+      mojo::PendingReceiver<blink::mojom::Authenticator> receiver);
+
+  void GetVirtualAuthenticatorManager(
+      mojo::PendingReceiver<blink::test::mojom::VirtualAuthenticatorManager>
+          receiver);
+
+  void GetPushMessaging(
+      mojo::PendingReceiver<blink::mojom::PushMessaging> receiver);
+
+#if defined(OS_ANDROID)
+  void BindNFCReceiver(mojo::PendingReceiver<device::mojom::NFC> receiver);
+#endif
+
+  void BindSmsReceiverReceiver(
+      mojo::PendingReceiver<blink::mojom::SmsReceiver> receiver);
+
+  // Creates connections to WebUSB interfaces bound to this frame.
+  void CreateWebUsbService(
+      mojo::PendingReceiver<blink::mojom::WebUsbService> receiver);
+
   // https://mikewest.github.io/corpp/#initialize-embedder-policy-for-global
   network::mojom::CrossOriginEmbedderPolicy cross_origin_embedder_policy()
       const {
@@ -1063,6 +1190,29 @@ class CONTENT_EXPORT RenderFrameHostImpl
     return appcache_handle_.get();
   }
 
+  // Returns the BackForwardCacheMetrics associated with the last
+  // NavigationEntry this RenderFrameHostImpl committed.
+  BackForwardCacheMetrics* GetBackForwardCacheMetrics();
+
+  const std::string& GetEncoding() const { return canonical_encoding_; }
+
+  // Returns a base salt used to generate frame-specific IDs for media-device
+  // enumerations.
+  const std::string& GetMediaDeviceIDSaltBase() const {
+    return media_device_id_salt_base_;
+  }
+
+  // Return true if this contains at least one NavigationRequest waiting to
+  // commit in this RenderFrameHost.
+  bool HasPendingCommitNavigationForTesting();
+
+  base::WeakPtr<RenderFrameHostImpl> GetWeakPtr();
+
+  // blink::mojom::LocalFrameHost
+  void EnterFullscreen(blink::mojom::FullscreenOptionsPtr options) override;
+  void ExitFullscreen() override;
+  void FullscreenStateChanged(bool is_fullscreen) override;
+
  protected:
   friend class RenderFrameHostFactory;
 
@@ -1088,7 +1238,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       NavigationRequest* navigation_request,
       mojom::CommonNavigationParamsPtr common_params,
       mojom::CommitNavigationParamsPtr commit_params,
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       mojo::ScopedDataPipeConsumerHandle response_body,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -1258,11 +1408,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
       ax::mojom::Event event_to_fire);
   void OnAccessibilitySnapshotResponse(int callback_id,
                                        const AXContentTreeUpdate& snapshot);
-  void OnEnterFullscreen(const blink::WebFullscreenOptions& options);
-  void OnExitFullscreen();
   void OnSuddenTerminationDisablerChanged(
       bool present,
-      blink::WebSuddenTerminationDisablerType disabler_type);
+      blink::SuddenTerminationDisablerType disabler_type);
+  void OnDidFinishDocumentLoad();
   void OnDidStopLoading();
   void OnDidChangeLoadProgress(double load_progress);
   void OnSelectionChanged(const base::string16& text,
@@ -1281,6 +1430,14 @@ class CONTENT_EXPORT RenderFrameHostImpl
       ui::input_types::ScrollGranularity granularity);
   void OnFrameDidCallFocus();
   void OnRenderFallbackContentInParentProcess();
+  void OnDownloadUrl(const FrameHostMsg_DownloadUrl_Params& params);
+  void OnSaveImageFromDataURL(const std::string& url_str);
+
+  // To be called by ComputeSiteForCookiesForNavigation() and
+  // ComputeSiteForCookies().
+  // Starts traversing the tree from |render_frame_host|.
+  GURL ComputeSiteForCookiesInternal(
+      const RenderFrameHostImpl* render_frame_host) const;
 
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
   void OnShowPopup(const FrameHostMsg_ShowPopup_Params& params);
@@ -1304,12 +1461,14 @@ class CONTENT_EXPORT RenderFrameHostImpl
       CreatePortalCallback callback) override;
   void AdoptPortal(const base::UnguessableToken& portal_token,
                    AdoptPortalCallback callback) override;
-  void IssueKeepAliveHandle(mojom::KeepAliveHandleRequest request) override;
+  void IssueKeepAliveHandle(
+      mojo::PendingReceiver<mojom::KeepAliveHandle> receiver) override;
   void DidCommitProvisionalLoad(
       std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
           validated_params,
       mojom::DidCommitProvisionalLoadInterfaceParamsPtr interface_params)
       override;
+  void EvictFromBackForwardCache() override;
 
   // This function mimics DidCommitProvisionalLoad but is a direct mojo
   // callback from NavigationClient::CommitNavigation.
@@ -1328,7 +1487,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       mojom::CommonNavigationParamsPtr common_params,
       mojom::BeginNavigationParamsPtr begin_params,
       mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token,
-      mojom::NavigationClientAssociatedPtrInfo navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>
           navigation_initiator) override;
   void SubresourceResponseStarted(const GURL& url,
@@ -1346,7 +1505,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void CancelInitialHistoryLoad() override;
   void UpdateEncoding(const std::string& encoding) override;
   void FrameSizeChanged(const gfx::Size& frame_size) override;
-  void FullscreenStateChanged(bool is_fullscreen) override;
   void LifecycleStateChanged(blink::mojom::FrameLifecycleState state) override;
   void DocumentOnLoadCompleted() override;
   void UpdateActiveSchedulerTrackedFeatures(uint64_t features_mask) override;
@@ -1384,11 +1542,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // in cases where it is applicable. This is a more conservative check than
   // RenderProcessHost::FilterURL, since it will be used to kill processes that
   // commit unauthorized origins.
-  enum class CanCommitStatus {
-    CAN_COMMIT_ORIGIN_AND_URL,
-    CANNOT_COMMIT_ORIGIN,
-    CANNOT_COMMIT_URL
-  };
   CanCommitStatus CanCommitOriginAndUrl(const url::Origin& origin,
                                         const GURL& url);
 
@@ -1482,23 +1635,18 @@ class CONTENT_EXPORT RenderFrameHostImpl
   FrameTreeNode* FindAndVerifyChild(int32_t child_frame_routing_id,
                                     bad_message::BadMessageReason reason);
 
-  // Creates Web Bluetooth Service owned by the frame. Returns a raw pointer
-  // to it.
-  WebBluetoothServiceImpl* CreateWebBluetoothService(
-      blink::mojom::WebBluetoothServiceRequest request);
+  // Returns a raw pointer to the Web Bluetooth Service owned by the frame. Used
+  // for testing purposes only (see |TestRenderFrameHost|).
+  WebBluetoothServiceImpl* GetWebBluetoothServiceForTesting();
 
   // Deletes the Web Bluetooth Service owned by the frame.
   void DeleteWebBluetoothService(
       WebBluetoothServiceImpl* web_bluetooth_service);
 
-  // Creates connections to WebUSB interfaces bound to this frame.
-  void CreateWebUsbService(
-      mojo::PendingReceiver<blink::mojom::WebUsbService> receiver);
-
   void CreateAudioInputStreamFactory(
-      mojom::RendererAudioInputStreamFactoryRequest request);
+      mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver);
   void CreateAudioOutputStreamFactory(
-      mojom::RendererAudioOutputStreamFactoryRequest request);
+      mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver);
 
   void BindMediaInterfaceFactoryRequest(
       media::mojom::InterfaceFactoryRequest request);
@@ -1512,19 +1660,11 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Callback for connection error on the media::mojom::InterfaceFactory client.
   void OnMediaInterfaceFactoryConnectionError();
 
-#if defined(OS_ANDROID)
-  void BindNFCRequest(device::mojom::NFCRequest request);
-#endif
-
 #if !defined(OS_ANDROID)
-  void BindSerialServiceRequest(blink::mojom::SerialServiceRequest request);
-  void BindAuthenticatorRequest(
+  void BindAuthenticatorReceiver(
       mojo::PendingReceiver<blink::mojom::Authenticator> receiver);
 #endif
 
-  void BindSmsReceiverReceiver(
-      mojo::PendingReceiver<blink::mojom::SmsReceiver> receiver);
-
   // service_manager::mojom::InterfaceProvider:
   void GetInterface(const std::string& interface_name,
                     mojo::ScopedMessagePipeHandle interface_pipe) override;
@@ -1533,15 +1673,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void GetFrameHostTestInterface(
       mojo::PendingReceiver<blink::mojom::FrameHostTestInterface> receiver)
       override;
-  void GetCredentialManager(
-      mojo::PendingReceiver<blink::mojom::CredentialManager> receiver) override;
-  void GetAuthenticator(
-      mojo::PendingReceiver<blink::mojom::Authenticator> receiver) override;
-  void GetPushMessaging(
-      mojo::PendingReceiver<blink::mojom::PushMessaging> receiver) override;
-  void GetVirtualAuthenticatorManager(
-      mojo::PendingReceiver<blink::test::mojom::VirtualAuthenticatorManager>
-          receiver) override;
 
   // Allows tests to disable the swapout event timer to simulate bugs that
   // happen before it fires (to avoid flakiness).
@@ -1693,7 +1824,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // state should be restored to its pre-commit value.
   bool DidCommitNavigationInternal(
       std::unique_ptr<NavigationRequest> navigation_request,
-      FrameHostMsg_DidCommitProvisionalLoad_Params* validated_params,
+      std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
+          validated_params,
       bool is_same_document_navigation);
 
   // Called by the renderer process when it is done processing a same-document
@@ -1712,11 +1844,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
   std::unique_ptr<base::trace_event::TracedValue> CommitAsTracedValue(
       FrameHostMsg_DidCommitProvisionalLoad_Params* validated_params) const;
 
-  // Creates initiator-specific URLLoaderFactory objects for
-  // |initiator_origins|.
+  // Creates URLLoaderFactory objects for |isolated_world_origins|.
   blink::URLLoaderFactoryBundleInfo::OriginMap
-  CreateInitiatorSpecificURLLoaderFactories(
-      const base::flat_set<url::Origin>& initiator_origins);
+  CreateURLLoaderFactoriesForIsolatedWorlds(
+      const base::flat_set<url::Origin>& isolated_world_origins);
 
   // Based on the termination |status| and |exit_code|, may generate a crash
   // report to be routed to the Reporting API.
@@ -1797,6 +1928,21 @@ class CONTENT_EXPORT RenderFrameHostImpl
   void LogCannotCommitOriginCrashKeys(bool is_same_document_navigation,
                                       NavigationRequest* navigation_request);
 
+  // Evicts the document from the BackForwardCache if it is in the cache,
+  // and ineligible for caching.
+  void MaybeEvictFromBackForwardCache(
+      BackForwardCacheMetrics::EvictedReason reason);
+
+  // Helper for handling download-related IPCs.
+  void DownloadUrl(
+      const GURL& url,
+      const Referrer& referrer,
+      const url::Origin& initiator,
+      const base::string16& suggested_name,
+      const bool use_prompt,
+      const network::mojom::RedirectMode cross_origin_redirects,
+      mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token);
+
   // The RenderViewHost that this RenderFrameHost is associated with.
   //
   // It is kept alive as long as any RenderFrameHosts or RenderFrameProxyHosts
@@ -1860,6 +2006,9 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // See https://crbug.com/588314.
   GURL last_successful_url_;
 
+  // The http method of the last committed navigation.
+  std::string last_http_method_;
+
   // The http status code of the last committed navigation.
   int last_http_status_code_ = 0;
 
@@ -1936,6 +2085,10 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // document or not.
   bool is_loading_;
 
+  // Indicates whether this RenderFrameHost has completed firing
+  // DOMContentLoaded or not.
+  bool dom_content_loaded_ = false;
+
   // The unique ID of the latest NavigationEntry that this RenderFrameHost is
   // showing. This may change even when this frame hasn't committed a page,
   // such as for a new subframe navigation in a different frame.  Tracking this
@@ -2070,10 +2223,13 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   bool has_committed_any_navigation_ = false;
 
-  mojo::AssociatedBinding<mojom::FrameHost> frame_host_associated_binding_;
-  mojom::FramePtr frame_;
-  mojom::FrameBindingsControlAssociatedPtr frame_bindings_control_;
+  mojo::AssociatedReceiver<mojom::FrameHost> frame_host_associated_receiver_{
+      this};
+  mojo::Remote<mojom::Frame> frame_;
+  mojo::AssociatedRemote<mojom::FrameBindingsControl> frame_bindings_control_;
   mojo::AssociatedRemote<mojom::FrameNavigationControl> navigation_control_;
+  mojo::AssociatedReceiver<blink::mojom::LocalFrameHost>
+      local_frame_host_receiver_{this};
 
   // If this is true then this object was created in response to a renderer
   // initiated request. Init() will be called, and until then navigation
@@ -2092,7 +2248,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
       non_network_url_loader_factories_;
 
   // Bitfield for renderer-side state that blocks fast shutdown of the frame.
-  blink::WebSuddenTerminationDisablerType
+  blink::SuddenTerminationDisablerType
       sudden_termination_disabler_types_enabled_ = 0;
 
   // We switch between |audio_service_audio_output_stream_factory_| and
@@ -2109,9 +2265,6 @@ class CONTENT_EXPORT RenderFrameHostImpl
       audio_service_audio_input_stream_factory_;
   UniqueAudioInputStreamFactoryPtr in_content_audio_input_stream_factory_;
 
-  std::unique_ptr<MediaStreamDispatcherHost, BrowserThread::DeleteOnIOThread>
-      media_stream_dispatcher_host_;
-
   // Hosts media::mojom::InterfaceFactory for the RenderFrame and forwards
   // media::mojom::InterfaceFactory calls to the remote "media" service.
   std::unique_ptr<MediaInterfaceProxy> media_interface_proxy_;
@@ -2246,14 +2399,15 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   // Whether UpdateSubresourceLoaderFactories should recreate the default
   // URLLoaderFactory when handling a NetworkService crash.  In case the frame
-  // is covered by AppCache, only initiator-specific factories need to be
+  // is covered by AppCache, only isolated-world-specific factories need to be
   // refreshed, but the main, AppCache-specific factory shouldn't be refreshed.
   bool recreate_default_url_loader_factory_after_network_service_crash_ = false;
 
-  // Set of request-initiator-origins that require a separate URLLoaderFactory
+  // Set of isolated world origins that require a separate URLLoaderFactory
   // (e.g. for handling requests initiated by extension content scripts that
   // require relaxed CORS/CORB rules).
-  base::flat_set<url::Origin> initiators_requiring_separate_url_loader_factory_;
+  base::flat_set<url::Origin>
+      isolated_worlds_requiring_separate_url_loader_factory_;
 
   // Holds the renderer generated ID and global request ID for the main frame
   // request.
@@ -2293,6 +2447,15 @@ class CONTENT_EXPORT RenderFrameHostImpl
 
   // BackForwardCache:
   bool is_in_back_forward_cache_ = false;
+  bool is_evicted_from_back_forward_cache_ = false;
+  bool is_back_forward_cache_disallowed_ = false;
+  base::OneShotTimer back_forward_cache_eviction_timer_;
+
+  // This used to re-commit when restoring from the BackForwardCache, with the
+  // same params as the original navigation.
+  // Note: If BackForwardCache is not enabled, this field is not set.
+  std::unique_ptr<FrameHostMsg_DidCommitProvisionalLoad_Params>
+      last_commit_params_;
 
   blink::mojom::FrameVisibility visibility_ =
       blink::mojom::FrameVisibility::kRenderedInViewport;
@@ -2303,6 +2466,12 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // browser side state as this value is used in security checks.
   bool is_mhtml_document_ = false;
 
+  // The last reported character encoding, not canonicalized.
+  std::string last_reported_encoding_;
+
+  // The canonicalized character encoding.
+  std::string canonical_encoding_;
+
   // Used to intercept DidCommit* calls in tests.
   CommitCallbackInterceptor* commit_callback_interceptor_;
 
@@ -2348,6 +2517,9 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // Tainted once MediaStream access was granted.
   bool was_granted_media_access_ = false;
 
+  // Salt for generating frame-specific media device IDs.
+  std::string media_device_id_salt_base_;
+
   // NOTE: This must be the last member.
   base::WeakPtrFactory<RenderFrameHostImpl> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc b/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc
index 8ee0c31080f..c21e071d3f5 100644
--- a/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_impl_browsertest.cc
@@ -19,7 +19,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "base/test/test_timeouts.h"
 #include "build/build_config.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/interface_provider_filtering.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
@@ -43,9 +43,11 @@
 #include "content/public/test/url_loader_interceptor.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
+#include "content/test/data/web_ui_test_mojo_bindings.mojom.h"
 #include "content/test/did_commit_navigation_interceptor.h"
 #include "content/test/frame_host_test_interface.mojom.h"
 #include "content/test/test_content_browser_client.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/features.h"
 #include "net/base/net_errors.h"
 #include "net/cookies/cookie_constants.h"
@@ -61,6 +63,7 @@
 #include "services/network/test/test_url_loader_factory.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom-test-utils.h"
 #include "testing/gmock/include/gmock/gmock.h"
+#include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "url/gurl.h"
 #include "url/origin.h"
 
@@ -160,8 +163,7 @@ class RenderFrameHostImplBrowserTest : public ContentBrowserTest {
 };
 
 // Test that when creating a new window, the main frame is correctly focused.
-IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       IsFocused_AtLoad) {
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest, IsFocused_AtLoad) {
   EXPECT_TRUE(
       NavigateToURL(shell(), GetTestUrl("render_frame_host", "focus.html")));
 
@@ -171,17 +173,16 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 }
 
 // Test that if the content changes the focused frame, it is correctly exposed.
-IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       IsFocused_Change) {
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest, IsFocused_Change) {
   EXPECT_TRUE(
       NavigateToURL(shell(), GetTestUrl("render_frame_host", "focus.html")));
 
   WebContents* web_contents = shell()->web_contents();
 
-  std::string frames[2] = { "frame1", "frame2" };
+  std::string frames[2] = {"frame1", "frame2"};
   for (const std::string& frame : frames) {
-    ExecuteScriptAndGetValue(
-        web_contents->GetMainFrame(), "focus" + frame + "()");
+    ExecuteScriptAndGetValue(web_contents->GetMainFrame(),
+                             "focus" + frame + "()");
 
     // The main frame is not the focused frame in the frame tree but the main
     // frame is focused per RFHI rules because one of its descendant is focused.
@@ -1136,7 +1137,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest, POSTNavigation) {
   http_server.AddDefaultHandlers(GetTestDataFilePath());
   int post_counter = 0;
   http_server.RegisterRequestMonitor(
-      base::Bind(&PostRequestMonitor, &post_counter));
+      base::BindRepeating(&PostRequestMonitor, &post_counter));
   ASSERT_TRUE(http_server.Start());
 
   GURL url(http_server.GetURL("/session_history/form.html"));
@@ -1181,8 +1182,7 @@ class NavigationHandleGrabber : public WebContentsObserver {
   void ReadyToCommitNavigation(NavigationHandle* navigation_handle) override {
     if (navigation_handle->GetURL().path() != "/title2.html")
       return;
-    static_cast<NavigationHandleImpl*>(navigation_handle)
-        ->navigation_request()
+    NavigationRequest::From(navigation_handle)
         ->set_complete_callback_for_testing(
             base::Bind(&NavigationHandleGrabber::SendingNavigationCommitted,
                        base::Unretained(this), navigation_handle));
@@ -1598,10 +1598,10 @@ IN_PROC_BROWSER_TEST_F(
   service_manager::mojom::InterfaceProviderRequest
       interface_provider_request_with_pending_request =
           mojo::MakeRequest(&interface_provider_with_pending_request);
-  mojom::FrameHostTestInterfacePtr test_interface;
+  mojo::Remote<mojom::FrameHostTestInterface> test_interface;
   interface_provider_with_pending_request->GetInterface(
       mojom::FrameHostTestInterface::Name_,
-      mojo::MakeRequest(&test_interface).PassMessagePipe());
+      test_interface.BindNewPipeAndPassReceiver().PassPipe());
 
   // Replace the |interface_provider_request| argument in the next
   // DidCommitProvisionalLoad message coming from the renderer with the
@@ -1675,12 +1675,12 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
     ASSERT_TRUE(injector.original_request_of_last_commit().is_pending());
   }
 
-  // Prepare an interface request for FrameHostTestInterface.
-  mojom::FrameHostTestInterfacePtr test_interface;
-  auto test_interface_request = mojo::MakeRequest(&test_interface);
+  // Prepare an interface receiver for FrameHostTestInterface.
+  mojo::Remote<mojom::FrameHostTestInterface> test_interface;
+  auto test_interface_receiver = test_interface.BindNewPipeAndPassReceiver();
 
   // Set up |dispatched_interface_request_callback| that would be invoked if the
-  // interface request for FrameHostTestInterface was ever dispatched to the
+  // interface receiver for FrameHostTestInterface was ever dispatched to the
   // RenderFrameHostImpl.
   base::MockCallback<base::RepeatingClosure>
       dispatched_interface_request_callback;
@@ -1700,9 +1700,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   base::MockCallback<base::RepeatingClosure> navigation_finished_callback;
   DidFinishNavigationObserver navigation_finish_observer(
       main_rfh, base::BindLambdaForTesting([&]() {
-        interface_provider->GetInterface(
-            mojom::FrameHostTestInterface::Name_,
-            test_interface_request.PassMessagePipe());
+        interface_provider->GetInterface(mojom::FrameHostTestInterface::Name_,
+                                         test_interface_receiver.PassPipe());
         std::move(navigation_finished_callback).Run();
       }));
 
@@ -1710,10 +1709,13 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   // document, but whose client end is actually controlled by this test, should
   // still be alive and well.
   ASSERT_TRUE(test_interface.is_bound());
-  ASSERT_FALSE(test_interface.encountered_error());
+  ASSERT_TRUE(test_interface.is_connected());
+
+  base::RunLoop run_loop;
+  test_interface.set_disconnect_handler(run_loop.QuitWhenIdleClosure());
 
   // Expect that the GetInterface message will never be dispatched, but the
-  // DidFinishNavigation callback wll be invoked.
+  // DidFinishNavigation callback will be invoked.
   EXPECT_CALL(dispatched_interface_request_callback, Run()).Times(0);
   EXPECT_CALL(navigation_finished_callback, Run());
 
@@ -1723,11 +1725,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   // Wait for a connection error on the |test_interface| as a signal, after
   // which it can be safely assumed that no GetInterface message will ever be
   // dispatched from that old InterfaceConnection.
-  base::RunLoop run_loop;
-  test_interface.set_connection_error_handler(run_loop.QuitWhenIdleClosure());
   run_loop.Run();
 
-  EXPECT_TRUE(test_interface.encountered_error());
+  EXPECT_FALSE(test_interface.is_connected());
 }
 
 // Test the edge case where the `window` global object asssociated with the
@@ -1896,9 +1896,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 
   // Simulate two interface requests corresponding to the first navigation
   // arrived after the second navigation was committed, hence were dropped.
-  interface_provider_1->GetInterface("content.mojom.BrowserTarget",
+  interface_provider_1->GetInterface(mojom::BrowserTarget::Name_,
                                      CreateDisconnectedMessagePipeHandle());
-  interface_provider_1->GetInterface("content.mojom.BrowserTarget",
+  interface_provider_1->GetInterface(mojom::BrowserTarget::Name_,
                                      CreateDisconnectedMessagePipeHandle());
 
   // RFHI destroys the DroppedInterfaceRequestLogger from navigation `n` on
@@ -1916,7 +1916,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   }
 
   // Simulate one interface request dropped for the second URL.
-  interface_provider_2->GetInterface("content.mojom.BrowserTarget",
+  interface_provider_2->GetInterface(mojom::BrowserTarget::Name_,
                                      CreateDisconnectedMessagePipeHandle());
 
   // A final navigation should record the sample from the second URL.
@@ -1932,9 +1932,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 
   // Both the DroppedInterfaceRequestLogger for the first and second URLs are
   // destroyed -- even more interfacerequests should not cause any crashes.
-  interface_provider_1->GetInterface("content.mojom.BrowserTarget",
+  interface_provider_1->GetInterface(mojom::BrowserTarget::Name_,
                                      CreateDisconnectedMessagePipeHandle());
-  interface_provider_2->GetInterface("content.mojom.BrowserTarget",
+  interface_provider_2->GetInterface(mojom::BrowserTarget::Name_,
                                      CreateDisconnectedMessagePipeHandle());
 
   // The interface connections should be broken.
@@ -1964,7 +1964,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 }
 
 // This test makes sure that when a blocked frame commits with a different URL,
-// it doesn't lead to a leaked NavigationHandle.  This is a regression test for
+// it doesn't lead to a leaked NavigationHandle. This is a regression test for
 // https://crbug.com/872803.
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
                        ErrorPagesShouldntLeakNavigationHandles) {
@@ -1975,32 +1975,31 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   GURL blocked_url(embedded_test_server()->GetURL(
       "blocked.com", "/frame-ancestors-none.html"));
   WebContents* web_contents = shell()->web_contents();
-  NavigationHandleObserver nav_handle_observer(web_contents, blocked_url);
+  NavigationHandleObserver navigation_observer(web_contents, blocked_url);
   EXPECT_TRUE(NavigateIframeToURL(web_contents, "child0", blocked_url));
 
   // Verify that the NavigationHandle / NavigationRequest didn't leak.
   RenderFrameHostImpl* frame = static_cast<RenderFrameHostImpl*>(
       shell()->web_contents()->GetAllFrames()[1]);
-  EXPECT_EQ(0u, frame->GetNavigationEntryIdsPendingCommit().size());
+  EXPECT_FALSE(frame->HasPendingCommitNavigationForTesting());
 
   // TODO(lukasza, clamy): https://crbug.com/784904: Verify that
   // WebContentsObserver::DidFinishNavigation was called with the same
-  // NavigationHandle as WebContentsObserver::DidStartNavigation.  This requires
+  // NavigationHandle as WebContentsObserver::DidStartNavigation. This requires
   // properly matching the commit IPC to the NavigationHandle (ignoring that
   // their URLs do not match - matching instead using navigation id or mojo
   // interface identity).
-  //
-  // Subsequent checks don't make sense before WCO::DidFinishNavigation is
-  // called - this is why ASSERT_TRUE is used here.
-  //   ASSERT_TRUE(nav_handle_observer.has_committed());
-  //   EXPECT_EQ(net::ERR_BLOCKED_BY_RESPONSE,
-  //       nav_handle_observer.net_error_code());
-
-  // TODO(lukasza): https://crbug.com/759184: Verify
-  // |nav_handle_observer.last_committed_url()| below - this should be possible
-  // once we handle frame-ancestors CSP in the browser process and commit it
-  // with the original URL.
-  //   EXPECT_EQ(blocked_url, nav_handle_observer.last_committed_url());
+
+  // TODO(https://crbug.com/759184): Verify CSP frame-ancestors in the browser
+  // process. Currently, this is done by the renderer process, which commits an
+  // empty document with success instead.
+  //  EXPECT_EQ(blocked_url, navigation_observer.last_committed_url());
+  //  EXPECT_EQ(net::ERR_BLOCKED_BY_RESPONSE,
+  //            navigation_obsever.net_error_code());
+  EXPECT_TRUE(navigation_observer.has_committed());
+  EXPECT_FALSE(navigation_observer.is_error());
+  EXPECT_EQ(GURL("data:,"), navigation_observer.last_committed_url());
+  EXPECT_EQ(net::Error::OK, navigation_observer.net_error_code());
 }
 
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
@@ -2404,7 +2403,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
   auto* rfh = static_cast<RenderFrameHostImpl*>(
       shell()->web_contents()->GetMainFrame());
-  blink::mojom::FileChooserPtr chooser = rfh->BindFileChooserForTesting();
+  mojo::Remote<blink::mojom::FileChooser> chooser =
+      rfh->BindFileChooserForTesting();
 
   // Kill the renderer process.
   RenderProcessHostWatcher crash_observer(
@@ -2633,8 +2633,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   {
     WebContentsImpl* wc =
         static_cast<WebContentsImpl*>(shell()->web_contents());
-    RenderFrameHostImpl* main_frame =
-        static_cast<RenderFrameHostImpl*>(wc->GetMainFrame());
+    RenderFrameHostImpl* main_frame = wc->GetMainFrame();
 
     EXPECT_EQ("a.com", main_frame->GetLastCommittedURL().host());
     ASSERT_EQ(2u, main_frame->child_count());
@@ -2775,6 +2774,114 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       ComputeSiteForCookiesForNavigationSandbox) {
+  // Test sandboxed subframe.
+  {
+    GURL url = embedded_test_server()->GetURL(
+        "a.com",
+        "/cross_site_iframe_factory.html?a(a{sandbox-allow-scripts}(a),"
+        "a{sandbox-allow-scripts,sandbox-allow-same-origin}(a))");
+
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+
+    WebContentsImpl* wc =
+        static_cast<WebContentsImpl*>(shell()->web_contents());
+    RenderFrameHostImpl* main_frame = wc->GetMainFrame();
+
+    EXPECT_EQ("a.com", main_frame->GetLastCommittedURL().host());
+
+    ASSERT_EQ(2u, main_frame->child_count());
+    FrameTreeNode* child_a = main_frame->child_at(0);
+    EXPECT_EQ("a.com", child_a->current_url().host());
+    EXPECT_TRUE(
+        child_a->current_frame_host()->GetLastCommittedOrigin().opaque());
+
+    ASSERT_EQ(1u, child_a->child_count());
+    FrameTreeNode* child_aa = child_a->child_at(0);
+    EXPECT_EQ("a.com", child_aa->current_url().host());
+    EXPECT_TRUE(
+        child_aa->current_frame_host()->GetLastCommittedOrigin().opaque());
+
+    FrameTreeNode* child_a2 = main_frame->child_at(1);
+    EXPECT_EQ("a.com", child_a2->current_url().host());
+    EXPECT_FALSE(
+        child_a2->current_frame_host()->GetLastCommittedOrigin().opaque());
+
+    ASSERT_EQ(1u, child_a2->child_count());
+    FrameTreeNode* child_a2a = child_a2->child_at(0);
+    EXPECT_EQ("a.com", child_a2a->current_url().host());
+    EXPECT_FALSE(
+        child_a2a->current_frame_host()->GetLastCommittedOrigin().opaque());
+
+    // |child_aa| frame navigation should be cross-site since its parent is
+    // sandboxed without allow-same-origin
+    EXPECT_TRUE(child_aa->current_frame_host()
+                    ->ComputeSiteForCookiesForNavigation(url)
+                    .is_empty());
+
+    // |child_a2a| frame navigation should be same-site since its sandboxed
+    // parent is sandbox-same-origin.
+    EXPECT_EQ("a.com", child_a2a->current_frame_host()
+                           ->ComputeSiteForCookiesForNavigation(url)
+                           .host());
+  }
+
+  // Test sandboxed main frame.
+  {
+    GURL url =
+        embedded_test_server()->GetURL("a.com", "/csp_sandboxed_frame.html");
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+
+    WebContentsImpl* wc =
+        static_cast<WebContentsImpl*>(shell()->web_contents());
+    RenderFrameHostImpl* main_frame = wc->GetMainFrame();
+    EXPECT_EQ(url, main_frame->GetLastCommittedURL());
+    EXPECT_TRUE(main_frame->GetLastCommittedOrigin().opaque());
+
+    ASSERT_EQ(2u, main_frame->child_count());
+    FrameTreeNode* child_a = main_frame->child_at(0);
+    EXPECT_EQ("a.com", child_a->current_url().host());
+    EXPECT_TRUE(
+        child_a->current_frame_host()->GetLastCommittedOrigin().opaque());
+
+    EXPECT_TRUE(child_a->current_frame_host()
+                    ->ComputeSiteForCookiesForNavigation(url)
+                    .is_empty());
+  }
+}
+
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
+                       ComputeSiteForCookiesForNavigationAboutBlank) {
+  GURL url = embedded_test_server()->GetURL(
+      "a.com", "/page_with_blank_iframe_tree.html");
+
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = wc->GetMainFrame();
+
+  EXPECT_EQ("a.com", main_frame->GetLastCommittedURL().host());
+
+  ASSERT_EQ(1u, main_frame->child_count());
+  FrameTreeNode* child_a = main_frame->child_at(0);
+  EXPECT_TRUE(child_a->current_url().IsAboutBlank());
+  EXPECT_EQ("a.com",
+            child_a->current_frame_host()->GetLastCommittedOrigin().host());
+
+  ASSERT_EQ(1u, child_a->child_count());
+  FrameTreeNode* child_aa = child_a->child_at(0);
+  EXPECT_TRUE(child_aa->current_url().IsAboutBlank());
+  EXPECT_EQ("a.com",
+            child_aa->current_frame_host()->GetLastCommittedOrigin().host());
+
+  // navigating the nested about:blank iframe to a.com is fine, since the origin
+  // is inherited.
+  EXPECT_EQ("a.com", child_aa->current_frame_host()
+                         ->ComputeSiteForCookiesForNavigation(url)
+                         .host());
+}
+
+IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
                        ComputeSiteForCookiesForNavigationSrcDoc) {
   // srcdoc frames basically don't figure into site_for_cookies computation.
   GURL url = embedded_test_server()->GetURL(
@@ -2935,12 +3042,22 @@ class IPAddressSpaceCollector : public DidCommitNavigationInterceptor {
 
 }  // namespace
 
-IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       ComputeMainFrameIPAddressSpace) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      network::features::kBlockNonSecureExternalRequests);
+class RenderFrameHostImplBrowserTestWithNonSecureExternalRequestsBlocked
+    : public RenderFrameHostImplBrowserTest {
+ public:
+  RenderFrameHostImplBrowserTestWithNonSecureExternalRequestsBlocked() {
+    feature_list_.InitAndEnableFeature(
+        network::features::kBlockNonSecureExternalRequests);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
 
+// TODO(https://crbug.com/1014325): Flaky on multiple bots.
+IN_PROC_BROWSER_TEST_F(
+    RenderFrameHostImplBrowserTestWithNonSecureExternalRequestsBlocked,
+    DISABLED_ComputeMainFrameIPAddressSpace) {
   // TODO(mkwst): `about:`, `file:`, `data:`, `blob:`, and `filesystem:` URLs
   // are all treated as `kUnknown` today. This is ~incorrect, but safe, as their
   // web-facing behavior will be equivalent to "public".
@@ -2971,12 +3088,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   }
 }
 
-IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
-                       ComputeIFrameLoopbackIPAddressSpace) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      network::features::kBlockNonSecureExternalRequests);
-
+IN_PROC_BROWSER_TEST_F(
+    RenderFrameHostImplBrowserTestWithNonSecureExternalRequestsBlocked,
+    ComputeIFrameLoopbackIPAddressSpace) {
   {
     IPAddressSpaceCollector collector(shell()->web_contents());
     base::string16 expected_title(base::UTF8ToUTF16("LOADED"));
@@ -3064,4 +3178,65 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostImplBrowserTest,
   }
 }
 
+namespace {
+
+// Calls |callback| whenever a DOMContentLoaded is reached in
+// |render_frame_host|.
+class DOMContentLoadedObserver : public WebContentsObserver {
+ public:
+  DOMContentLoadedObserver(WebContents* web_contents,
+                           base::RepeatingClosure callback)
+      : WebContentsObserver(web_contents), callback_(callback) {}
+
+ protected:
+  // WebContentsObserver:
+  void DOMContentLoaded(RenderFrameHost* render_Frame_host) override {
+    callback_.Run();
+  }
+
+ private:
+  base::RepeatingClosure callback_;
+  DISALLOW_COPY_AND_ASSIGN(DOMContentLoadedObserver);
+};
+
+}  // namespace
+
+IN_PROC_BROWSER_TEST_F(ContentBrowserTest, DocumentLoaded) {
+  net::test_server::ControllableHttpResponse main_document_response(
+      embedded_test_server(), "/main_document");
+
+  EXPECT_TRUE(embedded_test_server()->Start());
+  GURL main_document_url(embedded_test_server()->GetURL("/main_document"));
+
+  WebContents* web_contents = shell()->web_contents();
+  RenderFrameHostImpl* rfhi =
+      static_cast<RenderFrameHostImpl*>(web_contents->GetMainFrame());
+  TestNavigationObserver load_observer(web_contents);
+  base::RunLoop loop_until_dcl;
+  DOMContentLoadedObserver dcl_observer(web_contents,
+                                        loop_until_dcl.QuitClosure());
+  shell()->LoadURL(main_document_url);
+
+  EXPECT_FALSE(rfhi->dom_content_loaded());
+
+  main_document_response.WaitForRequest();
+  main_document_response.Send(
+      "HTTP/1.1 200 OK\r\n"
+      "Connection: close\r\n"
+      "Content-Type: text/html; charset=utf-8\r\n"
+      "\r\n"
+      "<img src='/hung'>");
+
+  load_observer.WaitForNavigationFinished();
+  EXPECT_FALSE(rfhi->dom_content_loaded());
+
+  main_document_response.Done();
+
+  // We should reach DOMContentLoaded, but not onload, since the image resource
+  // is still loading.
+  loop_until_dcl.Run();
+  EXPECT_TRUE(rfhi->is_loading());
+  EXPECT_TRUE(rfhi->dom_content_loaded());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager.cc b/chromium/content/browser/frame_host/render_frame_host_manager.cc
index 9cf70d305a6..bf5b27f6dff 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_manager.cc
@@ -28,7 +28,6 @@
 #include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_factory.h"
@@ -52,6 +51,7 @@
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/common/child_process_host.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/mime_handler_view_mode.h"
@@ -188,8 +188,8 @@ void RenderFrameHostManager::Init(SiteInstance* site_instance,
   // Do this only for subframes, as the main frame case is taken care of by
   // WebContentsImpl::Init.
   if (!frame_tree_node_->IsMainFrame()) {
-    delegate_->NotifySwappedFromRenderManager(
-        nullptr, render_frame_host_.get(), false);
+    delegate_->NotifySwappedFromRenderManager(nullptr, render_frame_host_.get(),
+                                              false);
   }
 }
 
@@ -341,7 +341,8 @@ void RenderFrameHostManager::CommitPendingIfNecessary(
     // same-process navigation is also ongoing, it will be canceled when the
     // speculative RenderFrameHost replaces the current one in the commit call
     // below.
-    CommitPending(std::move(speculative_render_frame_host_));
+    CommitPending(std::move(speculative_render_frame_host_),
+                  std::move(bfcache_entry_to_restore_));
     frame_tree_node_->ResetNavigationRequest(false, true);
     return;
   }
@@ -499,12 +500,49 @@ void RenderFrameHostManager::SwapOutOldFrame(
   // If the old RenderFrameHost can be stored in the BackForwardCache, return
   // early without swapping out and running unload handlers, as the document may
   // be restored later.
-  BackForwardCache& back_forward_cache =
-      delegate_->GetControllerForRenderManager().back_forward_cache();
-  if (back_forward_cache.CanStoreDocument(old_render_frame_host.get())) {
-    back_forward_cache.Freeze(old_render_frame_host.get());
-    back_forward_cache.StoreDocument(std::move(old_render_frame_host));
-    return;
+  {
+    BackForwardCacheImpl& back_forward_cache =
+        delegate_->GetControllerForRenderManager().GetBackForwardCache();
+    auto can_store =
+        back_forward_cache.CanStoreDocument(old_render_frame_host.get());
+    TRACE_EVENT1("navigation", "BackForwardCache_MaybeStorePage", "can_store",
+                 can_store.ToString());
+    if (can_store) {
+      std::set<RenderViewHostImpl*> old_render_view_hosts;
+
+      // Prepare the main frame.
+      back_forward_cache.Freeze(old_render_frame_host.get());
+      old_render_view_hosts.insert(static_cast<RenderViewHostImpl*>(
+          old_render_frame_host->GetRenderViewHost()));
+
+      // Prepare the proxies.
+      RenderFrameProxyHostMap old_proxy_hosts;
+      SiteInstance* instance = old_render_frame_host->GetSiteInstance();
+      for (auto& it : proxy_hosts_) {
+        // This avoids including the proxy created when starting a
+        // new cross-process, cross-BrowsingInstance navigation, as well as any
+        // restored proxies which are also in a different BrowsingInstance.
+        if (instance->IsRelatedSiteInstance(it.second->GetSiteInstance())) {
+          old_render_view_hosts.insert(it.second->GetRenderViewHost());
+          old_proxy_hosts[it.first] = std::move(it.second);
+        }
+      }
+      // Remove the previously extracted proxies from the
+      // RenderFrameHostManager, which also remove their respective
+      // SiteInstanceImpl::Observer.
+      for (auto& it : old_proxy_hosts)
+        DeleteRenderFrameProxyHost(it.second->GetSiteInstance());
+
+      // Ensures RenderViewHosts are not reused while they are in the cache.
+      for (RenderViewHostImpl* rvh : old_render_view_hosts)
+        rvh->EnterBackForwardCache();
+
+      auto entry = std::make_unique<BackForwardCacheImpl::Entry>(
+          std::move(old_render_frame_host), std::move(old_proxy_hosts),
+          std::move(old_render_view_hosts));
+      back_forward_cache.StoreEntry(std::move(entry));
+      return;
+    }
   }
 
   // Create a replacement proxy for the old RenderFrameHost. (There should not
@@ -579,29 +617,25 @@ bool RenderFrameHostManager::DeleteFromPendingList(
 }
 
 void RenderFrameHostManager::RestoreFromBackForwardCache(
-    std::unique_ptr<RenderFrameHostImpl> rfh) {
+    std::unique_ptr<BackForwardCacheImpl::Entry> entry) {
   // Matched in CommitPending().
-  rfh->GetProcess()->AddPendingView();
+  entry->render_frame_host->GetProcess()->AddPendingView();
 
-  // speculative_render_frame_host_ will be committed during
-  // CommitPendingIfNecessary.
-  speculative_render_frame_host_ = std::move(rfh);
+  // speculative_render_frame_host_ and bfcache_entry_to_restore_ will be
+  // consumed during CommitPendingIfNecessary.
+  // TODO(ahemery): This is awkward to leave the entry in a half consumed state
+  // and it would be clearer if we could not reuse speculative_render_frame_host
+  // in the long run. For now, and to avoid complex edge cases, we simply reuse
+  // it to preserve the understood logic in CommitPending.
+  speculative_render_frame_host_ = std::move(entry->render_frame_host);
+  bfcache_entry_to_restore_ = std::move(entry);
 }
 
 void RenderFrameHostManager::UnfreezeCurrentFrameHost() {
-  delegate_->GetControllerForRenderManager().back_forward_cache().Resume(
+  delegate_->GetControllerForRenderManager().GetBackForwardCache().Resume(
       current_frame_host());
 }
 
-void RenderFrameHostManager::EvictFromBackForwardCache(
-    RenderFrameHostImpl* rfh) {
-  // TODO(hajimehoshi): Add a direct getter of BackForwardCache to
-  // RenderFrameHostDelegate.
-  BackForwardCache& back_forward_cache =
-      delegate_->GetControllerForRenderManager().back_forward_cache();
-  back_forward_cache.EvictDocument(rfh);
-}
-
 void RenderFrameHostManager::ResetProxyHosts() {
   for (const auto& pair : proxy_hosts_) {
     static_cast<SiteInstanceImpl*>(pair.second->GetSiteInstance())
@@ -622,13 +656,17 @@ void RenderFrameHostManager::ClearWebUIInstances() {
 
 void RenderFrameHostManager::DidCreateNavigationRequest(
     NavigationRequest* request) {
-  if (request->is_served_from_back_forward_cache()) {
+  if (request->IsServedFromBackForwardCache()) {
+    // Cleanup existing pending RenderFrameHost. This corresponds to what is
+    // done inside GetFrameHostForNavigation(request), but this isn't called
+    // with the back-forward cache.
+    CleanUpNavigation();
     // Since the frame from the back-forward cache is being committed to the
     // SiteInstance we already have, it is treated as current.
     request->set_associated_site_instance_type(
         NavigationRequest::AssociatedSiteInstanceType::CURRENT);
   } else {
-    RenderFrameHostImpl* dest_rfh = GetFrameHostForNavigation(*request);
+    RenderFrameHostImpl* dest_rfh = GetFrameHostForNavigation(request);
     DCHECK(dest_rfh);
     request->set_associated_site_instance_type(
         dest_rfh == render_frame_host_.get()
@@ -638,8 +676,8 @@ void RenderFrameHostManager::DidCreateNavigationRequest(
 }
 
 RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
-    const NavigationRequest& request) {
-  DCHECK(!request.common_params().url.SchemeIs(url::kJavaScriptScheme))
+    NavigationRequest* request) {
+  DCHECK(!request->common_params().url.SchemeIs(url::kJavaScriptScheme))
       << "Don't call this method for JavaScript URLs as those create a "
          "temporary  NavigationRequest and we don't want to reset an ongoing "
          "navigation's speculative RFH.";
@@ -648,7 +686,7 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
   // See https://crbug.com/926820 and https://crbug.com/927705.
   if (!current_frame_host()->is_active()) {
     NOTREACHED() << "Navigation in an inactive frame";
-    DEBUG_ALIAS_FOR_GURL(url, request.common_params().url);
+    DEBUG_ALIAS_FOR_GURL(url, request->common_params().url);
     base::debug::DumpWithoutCrashing();
   }
 
@@ -671,34 +709,16 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
     // not be recreated if the URL didn't change. So instead of calling
     // CleanUpNavigation just discard the speculative RenderFrameHost if one
     // exists.
-    if (speculative_render_frame_host_) {
-      // If the speculative RenderFrameHost is trying to commit a navigation,
-      // inform the NavigationController that the load of the corresponding
-      // NavigationEntry stopped if needed. This is the case if the new
-      // navigation was started from BeginNavigation. If the navigation was
-      // started through the NavigationController, the NavigationController has
-      // already updated its state properly, and doesn't need to be notified.
-      // Note: We query all NavigationEntry IDs fom the RenderFrameHost, however
-      // at most one call to DiscardPendingEntryIfNeeded will succeed. Since we
-      // don't know which of the entries is the pending one, we have to try them
-      // all.
-      // TODO(clamy): Clean this up.
-      if (request.from_begin_navigation()) {
-        std::set<int> ids = speculative_render_frame_host_
-                                ->GetNavigationEntryIdsPendingCommit();
-        for (int id : ids)
-          frame_tree_node_->navigator()->DiscardPendingEntryIfNeeded(id);
-      }
+    if (speculative_render_frame_host_)
       DiscardUnusedFrame(UnsetSpeculativeRenderFrameHost());
-    }
 
     // Short-term solution: avoid creating a WebUI for subframes because
     // non-PlzNavigate code path doesn't do it and some WebUI pages don't
     // support it.
     // TODO(crbug.com/713313): Make WebUI objects always be per-frame instead.
     if (frame_tree_node_->IsMainFrame()) {
-      UpdatePendingWebUIOnCurrentFrameHost(request.common_params().url,
-                                           request.bindings());
+      UpdatePendingWebUIOnCurrentFrameHost(request->common_params().url,
+                                           request->bindings());
     }
 
     navigation_rfh = render_frame_host_.get();
@@ -715,25 +735,6 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
     if (!speculative_render_frame_host_ ||
         speculative_render_frame_host_->GetSiteInstance() !=
             dest_site_instance.get()) {
-      // If there is a speculative RenderFrameHost trying to commit a
-      // navigation, inform the NavigationController that the load of the
-      // corresponding NavigationEntry stopped if needed. This is the case if
-      // the new navigation was started from BeginNavigation. If the navigation
-      // was started through the NavigationController, the NavigationController
-      // has already updated its state properly, and doesn't need to be
-      // notified.
-      // Note: We query all NavigationEntry IDs fom the RenderFrameHost, however
-      // at most one call to DiscardPendingEntryIfNeeded will succeed. Since we
-      // don't know which of the entries is the pending one, we have to try them
-      // all.
-      // TODO(clamy): Clean this up.
-      if (request.from_begin_navigation() && speculative_render_frame_host_) {
-        std::set<int> ids = speculative_render_frame_host_
-                                ->GetNavigationEntryIdsPendingCommit();
-        for (int id : ids)
-          frame_tree_node_->navigator()->DiscardPendingEntryIfNeeded(id);
-      }
-
       // If a previous speculative RenderFrameHost didn't exist or if its
       // SiteInstance differs from the one for the current URL, a new one needs
       // to be created.
@@ -750,7 +751,7 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
     // TODO(crbug.com/713313): Make WebUI objects always be per-frame instead.
     if (frame_tree_node_->IsMainFrame()) {
       bool changed_web_ui = speculative_render_frame_host_->UpdatePendingWebUI(
-          request.common_params().url, request.bindings());
+          request->common_params().url, request->bindings());
       speculative_render_frame_host_->CommitPendingWebUI();
       DCHECK_EQ(GetNavigatingWebUI(), speculative_render_frame_host_->web_ui());
       notify_webui_of_rf_creation =
@@ -777,7 +778,7 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
         navigation_rfh->Send(
             new FrameMsg_SwapIn(navigation_rfh->GetRoutingID()));
       }
-      CommitPending(std::move(speculative_render_frame_host_));
+      CommitPending(std::move(speculative_render_frame_host_), nullptr);
 
       // Notify the WebUI about the new RenderFrame if needed (the newly
       // created WebUI has just been committed by CommitPending, so
@@ -836,10 +837,10 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
   auto* policy = ChildProcessSecurityPolicyImpl::GetInstance();
   const GURL& lock_url = navigation_rfh->GetSiteInstance()->lock_url();
   if (lock_url != GURL(kUnreachableWebDataURL) &&
-      request.common_params().url.IsStandard() &&
+      request->common_params().url.IsStandard() &&
       !policy->CanAccessDataForOrigin(navigation_rfh->GetProcess()->GetID(),
-                                      request.common_params().url) &&
-      !request.IsForMhtmlSubframe()) {
+                                      request->common_params().url) &&
+      !request->IsForMhtmlSubframe()) {
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("lock_url",
                                             base::debug::CrashKeySize::Size64),
@@ -847,7 +848,7 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("commit_origin",
                                             base::debug::CrashKeySize::Size64),
-        request.common_params().url.GetOrigin().spec());
+        request->common_params().url.GetOrigin().spec());
     base::debug::SetCrashKeyString(
         base::debug::AllocateCrashKeyString("is_main_frame",
                                             base::debug::CrashKeySize::Size32),
@@ -857,7 +858,7 @@ RenderFrameHostImpl* RenderFrameHostManager::GetFrameHostForNavigation(
                                             base::debug::CrashKeySize::Size32),
         use_current_rfh ? "true" : "false");
     NOTREACHED() << "Picked an incompatible process for URL: " << lock_url
-                 << " lock vs " << request.common_params().url.GetOrigin();
+                 << " lock vs " << request->common_params().url.GetOrigin();
     base::debug::DumpWithoutCrashing();
   }
 
@@ -1002,7 +1003,9 @@ RenderFrameHostManager::SiteInstanceDescriptor::SiteInstanceDescriptor(
       browser_context(browser_context),
       relation(relation_to_current) {}
 
-void RenderFrameHostManager::RenderProcessGone(SiteInstanceImpl* instance) {
+void RenderFrameHostManager::RenderProcessGone(
+    SiteInstanceImpl* instance,
+    const ChildProcessTerminationInfo& info) {
   GetRenderFrameProxyHost(instance)->SetRenderFrameProxyCreated(false);
 }
 
@@ -1023,6 +1026,24 @@ void RenderFrameHostManager::UpdateUserActivationState(
     pair.second->Send(new FrameMsg_UpdateUserActivationState(
         pair.second->GetRoutingID(), update_type));
   }
+
+  // If any frame in an inner delegate is activated, then the FrameTreeNode that
+  // embeds the inner delegate in the outer delegate should be activated as well
+  // (crbug.com/1013447).
+  //
+  // TODO(mustaq): We should add activation consumption propagation from inner
+  // to outer delegates, and also all state propagation from outer to inner
+  // delegates. crbug.com/1026617.
+  RenderFrameProxyHost* outer_delegate_proxy = frame_tree_node_->frame_tree()
+                                                   ->root()
+                                                   ->render_manager()
+                                                   ->GetProxyToOuterDelegate();
+  if (outer_delegate_proxy &&
+      update_type == blink::UserActivationUpdateType::kNotifyActivation) {
+    outer_delegate_proxy->Send(new FrameMsg_UpdateUserActivationState(
+        outer_delegate_proxy->GetRoutingID(), update_type));
+    GetOuterDelegateNode()->UpdateUserActivationState(update_type);
+  }
 }
 
 void RenderFrameHostManager::TransferUserActivationFrom(
@@ -1172,8 +1193,8 @@ bool RenderFrameHostManager::ShouldSwapBrowsingInstancesForNavigation(
   // current_effective_url here, which uses the SiteInstance's site if there is
   // no current_entry.
   if (GetContentClient()->browser()->ShouldSwapBrowsingInstancesForNavigation(
-          render_frame_host_->GetSiteInstance(),
-          current_effective_url, new_effective_url)) {
+          render_frame_host_->GetSiteInstance(), current_effective_url,
+          new_effective_url)) {
     return true;
   }
 
@@ -1259,8 +1280,9 @@ RenderFrameHostManager::GetSiteInstanceForNavigation(
   // https://crbug.com/766630.
   NavigationEntry* current_entry =
       delegate_->GetLastCommittedNavigationEntryForRenderManager();
-  bool current_is_view_source_mode = current_entry ?
-      current_entry->IsViewSourceMode() : dest_is_view_source_mode;
+  bool current_is_view_source_mode = current_entry
+                                         ? current_entry->IsViewSourceMode()
+                                         : dest_is_view_source_mode;
 
   bool force_swap = ShouldSwapBrowsingInstancesForNavigation(
       current_effective_url, current_is_view_source_mode, dest_instance,
@@ -2190,34 +2212,33 @@ bool RenderFrameHostManager::InitRenderView(
 
 scoped_refptr<SiteInstance>
 RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
-    const NavigationRequest& request) {
+    NavigationRequest* request) {
   SiteInstance* current_site_instance = render_frame_host_->GetSiteInstance();
 
   // All children of MHTML documents must be MHTML documents. They all live in
   // the same process.
-  if (request.IsForMhtmlSubframe())
+  if (request->IsForMhtmlSubframe())
     return base::WrapRefCounted(current_site_instance);
 
   // Srcdoc documents are always in the same SiteInstance as their parent. They
   // load their content from the "srcdoc" iframe attribute which lives in the
   // parent's process.
   RenderFrameHostImpl* parent = render_frame_host_->GetParent();
-  if (parent && request.common_params().url.IsAboutSrcdoc())
+  if (parent && request->common_params().url.IsAboutSrcdoc())
     return base::WrapRefCounted(parent->GetSiteInstance());
 
   // First, check if the navigation can switch SiteInstances. If not, the
   // navigation should use the current SiteInstance.
   bool no_renderer_swap_allowed = false;
   bool should_swap_for_error_isolation = false;
-  bool was_server_redirect = request.navigation_handle() &&
-                             request.navigation_handle()->WasServerRedirect();
+  bool was_server_redirect = request->WasServerRedirect();
 
   // When error page isolation is enabled, each navigation that crosses
   // from a success to failure and vice versa needs to do a process swap.
   if (SiteIsolationPolicy::IsErrorPageIsolationEnabled(
           frame_tree_node_->IsMainFrame())) {
     should_swap_for_error_isolation =
-        (request.state() == NavigationRequest::FAILED) !=
+        (request->state() == NavigationRequest::FAILED) !=
         (current_site_instance->GetSiteURL() == GURL(kUnreachableWebDataURL));
   }
 
@@ -2230,17 +2251,17 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
     // mode, it is possible for renderer-intiated navigations to be allowed to
     // go cross-process. Check it first.
     bool can_renderer_initiate_transfer =
-        IsURLHandledByNetworkStack(request.common_params().url) &&
+        IsURLHandledByNetworkStack(request->common_params().url) &&
         IsRendererTransferNeededForNavigation(render_frame_host_.get(),
-                                              request.common_params().url);
+                                              request->common_params().url);
     no_renderer_swap_allowed |=
-        request.from_begin_navigation() && !can_renderer_initiate_transfer;
+        request->from_begin_navigation() && !can_renderer_initiate_transfer;
   } else {
     // Subframe navigations will use the current renderer, unless specifically
     // allowed to swap processes.
     no_renderer_swap_allowed |= !CanSubframeSwapProcess(
-        request.common_params().url, request.source_site_instance(),
-        request.dest_site_instance());
+        request->common_params().url, request->GetSourceSiteInstance(),
+        request->dest_site_instance());
   }
 
   if (no_renderer_swap_allowed && !should_swap_for_error_isolation)
@@ -2256,11 +2277,11 @@ RenderFrameHostManager::GetSiteInstanceForNavigationRequest(
           : nullptr;
 
   scoped_refptr<SiteInstance> dest_site_instance = GetSiteInstanceForNavigation(
-      request.common_params().url, request.source_site_instance(),
-      request.dest_site_instance(), candidate_site_instance,
-      request.common_params().transition,
-      request.state() == NavigationRequest::FAILED,
-      request.restore_type() != RestoreType::NONE, request.is_view_source(),
+      request->common_params().url, request->GetSourceSiteInstance(),
+      request->dest_site_instance(), candidate_site_instance,
+      request->common_params().transition,
+      request->state() == NavigationRequest::FAILED,
+      request->GetRestoreType() != RestoreType::NONE, request->is_view_source(),
       was_server_redirect);
 
   return dest_site_instance;
@@ -2402,11 +2423,15 @@ void RenderFrameHostManager::CommitPendingWebUI() {
 }
 
 void RenderFrameHostManager::CommitPending(
-    std::unique_ptr<RenderFrameHostImpl> pending_rfh) {
+    std::unique_ptr<RenderFrameHostImpl> pending_rfh,
+    std::unique_ptr<BackForwardCacheImpl::Entry> pending_bfcache_entry) {
   TRACE_EVENT1("navigation", "RenderFrameHostManager::CommitPending",
                "FrameTreeNode id", frame_tree_node_->frame_tree_node_id());
   DCHECK(pending_rfh);
 
+  // We should never have a pending bfcache entry if bfcache is disabled.
+  DCHECK(!pending_bfcache_entry || IsBackForwardCacheEnabled());
+
 #if defined(OS_MACOSX)
   // The old RenderWidgetHostView will be hidden before the new
   // RenderWidgetHostView takes its contents. Ensure that Cocoa sees this as
@@ -2419,7 +2444,6 @@ void RenderFrameHostManager::CommitPending(
 #endif  // defined(OS_MACOSX)
 
   RenderWidgetHostView* old_view = render_frame_host_->GetView();
-  RenderWidgetHostView* new_view = pending_rfh->GetView();
   bool is_main_frame = frame_tree_node_->IsMainFrame();
 
   // First check whether we're going to want to focus the location bar after
@@ -2458,21 +2482,45 @@ void RenderFrameHostManager::CommitPending(
         navigation_entry);
   }
 
-  // Swap in the pending frame and make it active. Also ensure the FrameTree
+  // Swap in the new frame and make it active. Also ensure the FrameTree
   // stays in sync.
   DCHECK(pending_rfh);
   std::unique_ptr<RenderFrameHostImpl> old_render_frame_host;
   old_render_frame_host = SetRenderFrameHost(std::move(pending_rfh));
 
+  // If a document is being restored from the BackForwardCache, restore all
+  // cached state now.
+  if (pending_bfcache_entry) {
+    RenderFrameProxyHostMap proxy_hosts_to_restore =
+        std::move(pending_bfcache_entry->proxy_hosts);
+    for (auto& proxy : proxy_hosts_to_restore) {
+      // We only cache pages when swapping BrowsingInstance, so we should never
+      // be reusing SiteInstances.
+      CHECK(!base::Contains(proxy_hosts_,
+                            proxy.second->GetSiteInstance()->GetId()));
+      static_cast<SiteInstanceImpl*>(proxy.second->GetSiteInstance())
+          ->AddObserver(this);
+      proxy_hosts_.insert(std::move(proxy));
+    }
+
+    std::set<RenderViewHostImpl*> render_view_hosts_to_restore =
+        std::move(pending_bfcache_entry->render_view_hosts);
+    for (RenderViewHostImpl* rvh : render_view_hosts_to_restore)
+      rvh->LeaveBackForwardCache();
+  }
+
   // For top-level frames, the RenderWidget{Host} will not be destroyed when the
   // local frame is detached. https://crbug.com/419087
+  //
   // To work around that, we hide it here. Truly this is to hit all the hide
   // paths in the browser side, but has a side effect of also hiding the
   // renderer side RenderWidget, even though it will get frozen anyway in the
   // future. However freezing doesn't do all the things hiding does at this time
   // so that's probably good.
+  //
   // Note the RenderWidgetHostView can be missing if the process for the old
   // RenderFrameHost crashed.
+  //
   // TODO(crbug.com/419087): This is only done for the main frame, as for sub
   // frames the RenderWidget and its view will be destroyed when the frame is
   // detached, but for the main frame it is not. This call to Hide() can go away
@@ -2483,9 +2531,14 @@ void RenderFrameHostManager::CommitPending(
   // without success in r426913 (https://crbug.com/658688) and r438516 (broke
   // assumptions about RenderWidgetHosts not changing RenderWidgetHostViews over
   // time).
+  //
+  // |old_rvh| and |new_rvh| can be the same when navigating same-site from a
+  // crashed RenderFrameHost. When RenderDocument will be implemented, this will
+  // happen for each same-site navigation.
   RenderViewHostImpl* old_rvh = old_render_frame_host->render_view_host();
   RenderViewHostImpl* new_rvh = render_frame_host_->render_view_host();
   if (is_main_frame && old_view) {
+    DCHECK_NE(old_rvh, new_rvh);
     // Note that this hides the RenderWidget but does not hide the Page. If it
     // did hide the Page then making a new RenderFrameHost on another call to
     // here would need to make sure it showed the RenderView when the
@@ -2496,6 +2549,7 @@ void RenderFrameHostManager::CommitPending(
   // Make sure the size is up to date.  (Fix for bug 1079768.)
   delegate_->UpdateRenderViewSizeForRenderManager(is_main_frame);
 
+  RenderWidgetHostView* new_view = render_frame_host_->GetView();
   if (will_focus_location_bar) {
     delegate_->SetFocusToLocationBar();
   } else if (focus_render_view && new_view) {
@@ -2646,12 +2700,12 @@ std::unique_ptr<RenderFrameHostImpl> RenderFrameHostManager::SetRenderFrameHost(
     // count top-level ones.  This makes the value easier for consumers to
     // interpret.
     if (render_frame_host_) {
-      render_frame_host_->GetSiteInstance()->
-          IncrementRelatedActiveContentsCount();
+      render_frame_host_->GetSiteInstance()
+          ->IncrementRelatedActiveContentsCount();
     }
     if (old_render_frame_host) {
-      old_render_frame_host->GetSiteInstance()->
-          DecrementRelatedActiveContentsCount();
+      old_render_frame_host->GetSiteInstance()
+          ->DecrementRelatedActiveContentsCount();
     }
   }
 
@@ -2755,8 +2809,8 @@ void RenderFrameHostManager::CreateOpenerProxies(
     int opener_routing_id =
         node->render_manager()->GetOpenerRoutingID(instance);
     DCHECK_NE(opener_routing_id, MSG_ROUTING_NONE);
-    proxy->Send(new FrameMsg_UpdateOpener(proxy->GetRoutingID(),
-                                          opener_routing_id));
+    proxy->Send(
+        new FrameMsg_UpdateOpener(proxy->GetRoutingID(), opener_routing_id));
   }
 }
 
@@ -2791,7 +2845,13 @@ void RenderFrameHostManager::SendPageMessage(IPC::Message* msg,
                                              SiteInstance* instance_to_skip) {
   DCHECK(IPC_MESSAGE_CLASS(*msg) == PageMsgStart);
 
-  // We should always deliver page messages through the main frame.
+  // We should always deliver page messages through the main frame. This is done
+  // because at the time, we wanted to avoid routing messages to swapped-out
+  // RenderViews. The idea was that we might introduce a separate RenderPage
+  // interface.
+  //
+  // TODO(dcheng): Now that RenderView and RenderWidget are increasingly
+  // separated, it might be possible/desirable to just route to the view.
   DCHECK(!frame_tree_node_->parent());
 
   if ((IPC_MESSAGE_CLASS(*msg) != PageMsgStart) || frame_tree_node_->parent()) {
@@ -2799,8 +2859,7 @@ void RenderFrameHostManager::SendPageMessage(IPC::Message* msg,
     return;
   }
 
-  auto send_msg = [instance_to_skip](IPC::Sender* sender,
-                                     int routing_id,
+  auto send_msg = [instance_to_skip](IPC::Sender* sender, int routing_id,
                                      IPC::Message* msg,
                                      SiteInstance* sender_instance) {
     if (sender_instance == instance_to_skip)
@@ -2965,7 +3024,7 @@ void RenderFrameHostManager::CreateNewFrameForInnerDelegateAttachIfNecessary() {
   // WebContents::AttachToOuterWebContentsFrame is called.
   speculative_render_frame_host_->Send(
       new FrameMsg_SwapIn(speculative_render_frame_host_->GetRoutingID()));
-  CommitPending(std::move(speculative_render_frame_host_));
+  CommitPending(std::move(speculative_render_frame_host_), nullptr);
   NotifyPrepareForInnerDelegateAttachComplete(true /* success */);
 }
 
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager.h b/chromium/content/browser/frame_host/render_frame_host_manager.h
index cab15ebd402..5166fca7109 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager.h
+++ b/chromium/content/browser/frame_host/render_frame_host_manager.h
@@ -16,6 +16,7 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "content/browser/frame_host/back_forward_cache_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/common/content_export.h"
@@ -94,6 +95,10 @@ struct FrameReplicationState;
 class CONTENT_EXPORT RenderFrameHostManager
     : public SiteInstanceImpl::Observer {
  public:
+  using RenderFrameProxyHostMap =
+      std::unordered_map<int32_t /* SiteInstance id */,
+                         std::unique_ptr<RenderFrameProxyHost>>;
+
   // Functions implemented by our owner that we need.
   //
   // TODO(brettw) Clean this up! These are all the functions in WebContentsImpl
@@ -125,7 +130,8 @@ class CONTENT_EXPORT RenderFrameHostManager
         int parent_routing_id,
         int previous_sibling_routing_id) = 0;
     virtual void BeforeUnloadFiredFromRenderManager(
-        bool proceed, const base::TimeTicks& proceed_time,
+        bool proceed,
+        const base::TimeTicks& proceed_time,
         bool* proceed_to_fire_unload) = 0;
     virtual void RenderProcessGoneFromRenderManager(
         RenderViewHost* render_view_host) = 0;
@@ -139,13 +145,12 @@ class CONTENT_EXPORT RenderFrameHostManager
     virtual void NotifyMainFrameSwappedFromRenderManager(
         RenderFrameHost* old_host,
         RenderFrameHost* new_host) = 0;
-    virtual NavigationControllerImpl&
-        GetControllerForRenderManager() = 0;
+    virtual NavigationControllerImpl& GetControllerForRenderManager() = 0;
 
     // Returns the navigation entry of the current navigation, or NULL if there
     // is none.
     virtual NavigationEntry*
-        GetLastCommittedNavigationEntryForRenderManager() = 0;
+    GetLastCommittedNavigationEntryForRenderManager() = 0;
 
     // Returns the interstitial page showing in the delegate, or null if there
     // is none.
@@ -306,8 +311,7 @@ class CONTENT_EXPORT RenderFrameHostManager
   RenderViewHostImpl* GetSwappedOutRenderViewHost(SiteInstance* instance) const;
 
   // Returns the RenderFrameProxyHost for the given SiteInstance, if any.
-  RenderFrameProxyHost* GetRenderFrameProxyHost(
-      SiteInstance* instance) const;
+  RenderFrameProxyHost* GetRenderFrameProxyHost(SiteInstance* instance) const;
 
   // If |render_frame_host| is on the pending deletion list, this deletes it.
   // Returns whether it was deleted.
@@ -316,8 +320,8 @@ class CONTENT_EXPORT RenderFrameHostManager
   // BackForwardCache:
   // During a history navigation, unfreezes and swaps in a document from the
   // BackForwardCache, making it active.
-  void RestoreFromBackForwardCache(std::unique_ptr<RenderFrameHostImpl>);
-  void EvictFromBackForwardCache(RenderFrameHostImpl*);
+  void RestoreFromBackForwardCache(
+      std::unique_ptr<BackForwardCacheImpl::Entry>);
 
   // BackForwardCache:
   // Unfreezes the current frame host. This is called after committing a
@@ -345,8 +349,7 @@ class CONTENT_EXPORT RenderFrameHostManager
   // appropriate RenderFrameHost for the provided URL. The returned pointer will
   // be for the current or the speculative RenderFrameHost and the instance is
   // owned by this manager.
-  RenderFrameHostImpl* GetFrameHostForNavigation(
-      const NavigationRequest& request);
+  RenderFrameHostImpl* GetFrameHostForNavigation(NavigationRequest* request);
 
   // Clean up any state for any ongoing navigation.
   void CleanUpNavigation();
@@ -464,14 +467,14 @@ class CONTENT_EXPORT RenderFrameHostManager
 
   // Returns a const reference to the map of proxy hosts. The keys are
   // SiteInstance IDs, the values are RenderFrameProxyHosts.
-  const std::unordered_map<int32_t, std::unique_ptr<RenderFrameProxyHost>>&
-  GetAllProxyHostsForTesting() const {
+  const RenderFrameProxyHostMap& GetAllProxyHostsForTesting() const {
     return proxy_hosts_;
   }
 
   // SiteInstanceImpl::Observer
   void ActiveFrameCountIsZero(SiteInstanceImpl* site_instance) override;
-  void RenderProcessGone(SiteInstanceImpl* site_instance) override;
+  void RenderProcessGone(SiteInstanceImpl* site_instance,
+                         const ChildProcessTerminationInfo& info) override;
 
   // Cancels and destroys the pending or speculative RenderFrameHost if they
   // match the provided |render_frame_host|.
@@ -496,7 +499,7 @@ class CONTENT_EXPORT RenderFrameHostManager
   // used to route IPC messages when in swapped out state.  Returns early if the
   // RenderViewHost has already been initialized for another RenderFrameHost.
   bool InitRenderView(RenderViewHostImpl* render_view_host,
-    RenderFrameProxyHost* proxy);
+                      RenderFrameProxyHost* proxy);
 
   // Returns the SiteInstance that should be used to host the navigation handled
   // by |navigation_request|.
@@ -505,7 +508,7 @@ class CONTENT_EXPORT RenderFrameHostManager
   // GetProcess() is called on the SiteInstance. In particular, calling this
   // function will never lead to a process being created for the navigation.
   scoped_refptr<SiteInstance> GetSiteInstanceForNavigationRequest(
-      const NavigationRequest& navigation_request);
+      NavigationRequest* navigation_request);
 
   // Helper to initialize the RenderFrame if it's not initialized.
   void InitializeRenderFrameIfNecessary(RenderFrameHostImpl* render_frame_host);
@@ -739,8 +742,14 @@ class CONTENT_EXPORT RenderFrameHostManager
 
   // Sets the |pending_rfh| to be the active one. Called when the pending
   // RenderFrameHost commits.
-  // BackForwardCache: Called to restore a RenderFrameHost.
-  void CommitPending(std::unique_ptr<RenderFrameHostImpl> pending_rfh);
+  //
+  // This function is also called when restoring an entry from BackForwardCache.
+  // In that case, |pending_rfh| is the RenderFrameHost to be restored, and
+  // |pending_bfcache_entry| provides additional state to be restored, such as
+  // proxies.
+  void CommitPending(
+      std::unique_ptr<RenderFrameHostImpl> pending_rfh,
+      std::unique_ptr<BackForwardCacheImpl::Entry> pending_bfcache_entry);
 
   // Helper to call CommitPending() in all necessary cases.
   void CommitPendingIfNecessary(RenderFrameHostImpl* render_frame_host,
@@ -811,8 +820,7 @@ class CONTENT_EXPORT RenderFrameHostManager
   std::unique_ptr<RenderFrameHostImpl> render_frame_host_;
 
   // Proxy hosts, indexed by site instance ID.
-  std::unordered_map<int32_t, std::unique_ptr<RenderFrameProxyHost>>
-      proxy_hosts_;
+  RenderFrameProxyHostMap proxy_hosts_;
 
   // A list of RenderFrameHosts waiting to shut down after swapping out.
   using RFHPendingDeleteList = std::list<std::unique_ptr<RenderFrameHostImpl>>;
@@ -824,12 +832,12 @@ class CONTENT_EXPORT RenderFrameHostManager
   // behavior. The speculative RenderFrameHost might be discarded later on if
   // the final URL's SiteInstance isn't compatible with the one used to create
   // it.
-  //
-  // This is also used by the BackForwardCache, which
-  // sets speculative_render_frame_host_ to the restored frame before
-  // committing.
   std::unique_ptr<RenderFrameHostImpl> speculative_render_frame_host_;
 
+  // After being set in RestoreFromBackForwardCache(), the bfcache entry is
+  // immediately consumed in CommitPending().
+  std::unique_ptr<BackForwardCacheImpl::Entry> bfcache_entry_to_restore_;
+
   // This callback is used when attaching an inner Delegate to |delegate_|
   // through |frame_tree_node_|.
   RenderFrameHost::PrepareForInnerWebContentsAttachCallback
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc b/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc
index 7d8b27e6d42..0dc3d92b537 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_manager_browsertest.cc
@@ -30,7 +30,7 @@
 #include "base/values.h"
 #include "build/build_config.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
@@ -49,6 +49,7 @@
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/browser/web_ui_message_handler.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/navigation_policy.h"
@@ -94,8 +95,8 @@ const char kOpenUrlViaClickTargetFunc[] =
 
 // Adds a link with given url and target=_blank, and clicks on it.
 void OpenUrlViaClickTarget(const ToRenderFrameHost& adapter, const GURL& url) {
-  EXPECT_TRUE(ExecuteScript(adapter,
-      std::string(kOpenUrlViaClickTargetFunc) + "(\"" + url.spec() + "\");"));
+  EXPECT_TRUE(ExecuteScript(adapter, std::string(kOpenUrlViaClickTargetFunc) +
+                                         "(\"" + url.spec() + "\");"));
 }
 
 class TestWebUIMessageHandler : public WebUIMessageHandler {
@@ -228,10 +229,10 @@ class RenderFrameHostManagerTest : public ContentBrowserTest {
   }
 
   void DisableBackForwardCache(
-      BackForwardCache::DisableForTestingReason reason) const {
+      BackForwardCacheImpl::DisableForTestingReason reason) const {
     return static_cast<WebContentsImpl*>(shell()->web_contents())
         ->GetController()
-        .back_forward_cache()
+        .GetBackForwardCache()
         .DisableForTesting(reason);
   }
 
@@ -346,8 +347,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, NoScriptAccessAfterSwapOut) {
   navigation_observer.Wait();
 
   GURL blank_url(url::kAboutBlankURL);
-  EXPECT_EQ(blank_url,
-            new_shell->web_contents()->GetLastCommittedURL());
+  EXPECT_EQ(blank_url, new_shell->web_contents()->GetLastCommittedURL());
   EXPECT_EQ(orig_site_instance, new_shell->web_contents()->GetSiteInstance());
 
   // We should have access to the opened window's location.
@@ -443,8 +443,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
       embedded_test_server()->GetURL("/click-noreferrer-links.html").spec();
   success = false;
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
-      new_shell, "window.domAutomationController.send(document.referrer == '" +
-                     expected_referrer + "');",
+      new_shell,
+      "window.domAutomationController.send(document.referrer == '" +
+          expected_referrer + "');",
       &success));
   EXPECT_TRUE(success);
 
@@ -499,8 +500,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
       embedded_test_server()->GetURL("/click-noreferrer-links.html").spec();
   success = false;
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
-      new_shell, "window.domAutomationController.send(document.referrer == '" +
-                     expected_referrer + "');",
+      new_shell,
+      "window.domAutomationController.send(document.referrer == '" +
+          expected_referrer + "');",
       &success));
   EXPECT_TRUE(success);
 
@@ -984,8 +986,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   scoped_refptr<SiteInstance> orig_site_instance(
       opener_contents->GetSiteInstance());
   EXPECT_TRUE(orig_site_instance.get() != nullptr);
-  RenderFrameHostManager* opener_manager = static_cast<WebContentsImpl*>(
-      opener_contents)->GetRenderManagerForTesting();
+  RenderFrameHostManager* opener_manager =
+      static_cast<WebContentsImpl*>(opener_contents)
+          ->GetRenderManagerForTesting();
 
   // 1) Open two more windows, one named.  These initially have openers but no
   // reference to each other.  We will later post a message between them.
@@ -1087,8 +1090,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   expected_title = ASCIIToUTF16("msg2");
   TitleWatcher title_watcher2(foo_contents, expected_title);
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
-      new_contents,
-      "window.domAutomationController.send(postToFoo('msg2'));",
+      new_contents, "window.domAutomationController.send(postToFoo('msg2'));",
       &success));
   EXPECT_TRUE(success);
   ASSERT_EQ(expected_title, title_watcher2.WaitAndGetTitle());
@@ -1128,8 +1130,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   scoped_refptr<SiteInstance> orig_site_instance(
       opener_contents->GetSiteInstance());
   EXPECT_TRUE(orig_site_instance.get() != nullptr);
-  RenderFrameHostManager* opener_manager = static_cast<WebContentsImpl*>(
-      opener_contents)->GetRenderManagerForTesting();
+  RenderFrameHostManager* opener_manager =
+      static_cast<WebContentsImpl*>(opener_contents)
+          ->GetRenderManagerForTesting();
 
   // 1) Open a named target=foo window. We will later post a message between the
   // opener and the new window.
@@ -1168,8 +1171,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   TitleWatcher title_observer(opener_contents, expected_title);
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
       opener_contents,
-      "window.domAutomationController.send(postWithPortToFoo());",
-      &success));
+      "window.domAutomationController.send(postWithPortToFoo());", &success));
   EXPECT_TRUE(success);
   ASSERT_FALSE(
       opener_manager->GetSwappedOutRenderViewHost(orig_site_instance.get()));
@@ -1362,8 +1364,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   // Navigate the first window to a different site as well.  The original
   // process should exit, since all of its views are now swapped out.
   RenderProcessHostWatcher exit_observer(
-      orig_process,
-      RenderProcessHostWatcher::WATCH_FOR_HOST_DESTRUCTION);
+      orig_process, RenderProcessHostWatcher::WATCH_FOR_HOST_DESTRUCTION);
   EXPECT_TRUE(NavigateToURLInSameBrowsingInstance(shell(), cross_site_url));
   exit_observer.Wait();
   scoped_refptr<SiteInstance> new_site_instance2(
@@ -1391,8 +1392,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, ClickLinkAfter204Error) {
   scoped_refptr<SiteInstance> post_nav_site_instance(
       shell()->web_contents()->GetSiteInstance());
   EXPECT_EQ(orig_site_instance, post_nav_site_instance);
-  EXPECT_EQ("/nocontent",
-            shell()->web_contents()->GetVisibleURL().path());
+  EXPECT_EQ("/nocontent", shell()->web_contents()->GetVisibleURL().path());
   EXPECT_FALSE(
       shell()->web_contents()->GetController().GetLastCommittedEntry());
 
@@ -2089,11 +2089,11 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   // navigation is not considered an initial navigation.
   ShellAddedObserver new_shell_observer;
   bool success = false;
-  EXPECT_TRUE(ExecuteScriptAndExtractBool(
-      orig_contents,
-      "window.domAutomationController.send("
-      "clickNoContentScriptedTargetedLink());",
-      &success));
+  EXPECT_TRUE(
+      ExecuteScriptAndExtractBool(orig_contents,
+                                  "window.domAutomationController.send("
+                                  "clickNoContentScriptedTargetedLink());",
+                                  &success));
   EXPECT_TRUE(success);
 
   // Wait for the window to open.
@@ -2246,8 +2246,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   // SiteInstance and RenderViewHost.
   EXPECT_TRUE(NavigateToURL(shell(), view_source_url));
   EXPECT_NE(blank_rvh, shell()->web_contents()->GetRenderViewHost());
-  EXPECT_NE(blank_site_instance, shell()->web_contents()->
-      GetRenderViewHost()->GetSiteInstance());
+  EXPECT_NE(blank_site_instance,
+            shell()->web_contents()->GetRenderViewHost()->GetSiteInstance());
   rvh_observers.EnsureRVHGetsDestructed(
       shell()->web_contents()->GetRenderViewHost());
 
@@ -2255,16 +2255,16 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   // This used to cause two RVH instances for the same SiteInstance, which
   // was a problem.  This is no longer the case.
   EXPECT_TRUE(NavigateToURL(shell(), navigated_url));
-  SiteInstance* site_instance1 = shell()->web_contents()->
-      GetRenderViewHost()->GetSiteInstance();
+  SiteInstance* site_instance1 =
+      shell()->web_contents()->GetRenderViewHost()->GetSiteInstance();
   rvh_observers.EnsureRVHGetsDestructed(
       shell()->web_contents()->GetRenderViewHost());
 
   EXPECT_TRUE(NavigateToURL(shell(), view_source_url));
   rvh_observers.EnsureRVHGetsDestructed(
       shell()->web_contents()->GetRenderViewHost());
-  SiteInstance* site_instance2 = shell()->web_contents()->
-      GetRenderViewHost()->GetSiteInstance();
+  SiteInstance* site_instance2 =
+      shell()->web_contents()->GetRenderViewHost()->GetSiteInstance();
 
   // Ensure that view-source navigations force a new SiteInstance.
   EXPECT_NE(site_instance1, site_instance2);
@@ -2378,8 +2378,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   RenderProcessHostWatcher crash_observer(
       shell()->web_contents(),
       RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
-  EXPECT_TRUE(
-      NavigateToURLAndExpectNoCommit(shell(), GURL(kChromeUICrashURL)));
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(shell(), GURL(kChromeUICrashURL)));
   crash_observer.Wait();
 }
 
@@ -2400,8 +2399,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   RenderProcessHostWatcher crash_observer(
       shell()->web_contents(),
       RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
-  EXPECT_TRUE(
-      NavigateToURLAndExpectNoCommit(shell(), GURL(kChromeUICrashURL)));
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(shell(), GURL(kChromeUICrashURL)));
   crash_observer.Wait();
 
   // Load the crash URL again but don't wait for any action.  If it is not
@@ -2415,10 +2413,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
       Shell::CreateNewWindow(shell()->web_contents()->GetBrowserContext(),
                              GURL(), nullptr, gfx::Size());
   RenderProcessHostWatcher crash_observer2(
-      shell2->web_contents(),
-      RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
-  EXPECT_TRUE(
-      NavigateToURLAndExpectNoCommit(shell2, GURL(kChromeUIKillURL)));
+      shell2->web_contents(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(shell2, GURL(kChromeUIKillURL)));
   crash_observer2.Wait();
 }
 
@@ -2432,8 +2428,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, ClearPendingWebUIOnCommit) {
   EXPECT_TRUE(NavigateToURL(shell(), webui_url));
   EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
       shell()->web_contents()->GetMainFrame()->GetProcess()->GetID()));
-  WebContentsImpl* web_contents = static_cast<WebContentsImpl*>(
-      shell()->web_contents());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
   FrameTreeNode* root = web_contents->GetFrameTree()->root();
   WebUIImpl* webui = root->current_frame_host()->web_ui();
   EXPECT_TRUE(webui);
@@ -2516,8 +2512,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, WebUIGetsBindings) {
   OpenUrlViaClickTarget(shell(), url2);
   nav_observer.Wait();
   Shell* new_shell = shao.GetShell();
-  WebContentsImpl* new_web_contents = static_cast<WebContentsImpl*>(
-      new_shell->web_contents());
+  WebContentsImpl* new_web_contents =
+      static_cast<WebContentsImpl*>(new_shell->web_contents());
   SiteInstance* site_instance2 = new_web_contents->GetSiteInstance();
   int process2_id = site_instance2->GetProcess()->GetID();
 
@@ -2527,8 +2523,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, WebUIGetsBindings) {
   EXPECT_NE(site_instance2, site_instance1);
   EXPECT_TRUE(site_instance2->IsRelatedSiteInstance(site_instance1));
 
-  RenderViewHost* initial_rvh = new_web_contents->
-      GetRenderManagerForTesting()->GetSwappedOutRenderViewHost(site_instance1);
+  RenderViewHost* initial_rvh =
+      new_web_contents->GetRenderManagerForTesting()
+          ->GetSwappedOutRenderViewHost(site_instance1);
   ASSERT_TRUE(initial_rvh);
 
   // Navigate to url1 and check bindings.
@@ -3524,8 +3521,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   shell()->LoadURL(cross_site_url);
   EXPECT_TRUE(stalled_navigation.WaitForResponse());
 
-  WebContentsImpl* web_contents = static_cast<WebContentsImpl*>(
-      shell()->web_contents());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
   RenderFrameHostImpl* next_rfh =
       web_contents->GetRenderManagerForTesting()->speculative_frame_host();
   ASSERT_TRUE(next_rfh);
@@ -3805,7 +3802,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest, LastCommittedOrigin) {
 
   // Disable the back-forward cache so that documents are always deleted when
   // navigating.
-  DisableBackForwardCache(BackForwardCache::TEST_ASSUMES_NO_CACHING);
+  DisableBackForwardCache(BackForwardCacheImpl::TEST_ASSUMES_NO_CACHING);
 
   GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
   EXPECT_TRUE(NavigateToURL(shell(), url_a));
@@ -5526,7 +5523,7 @@ class RenderFrameHostManagerUnloadBrowserTest
 IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerUnloadBrowserTest,
                        SubframeTerminationPing_SendBeacon) {
   // See BackForwardCache::DisableForTestingReason for explanation.
-  DisableBackForwardCache(BackForwardCache::TEST_USES_UNLOAD_EVENT);
+  DisableBackForwardCache(BackForwardCacheImpl::TEST_USES_UNLOAD_EVENT);
 
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
@@ -5559,7 +5556,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerUnloadBrowserTest,
 IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerUnloadBrowserTest,
                        SubframeTerminationPing_Image) {
   // See BackForwardCache::DisableForTestingReason for explanation.
-  DisableBackForwardCache(BackForwardCache::TEST_USES_UNLOAD_EVENT);
+  DisableBackForwardCache(BackForwardCacheImpl::TEST_USES_UNLOAD_EVENT);
 
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
@@ -5633,7 +5630,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerUnloadBrowserTest,
 IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerUnloadBrowserTest,
                        SubframeProcessGoesAwayAfterUnloadTimeout) {
   // See BackForwardCache::DisableForTestingReason for explanation.
-  DisableBackForwardCache(BackForwardCache::TEST_USES_UNLOAD_EVENT);
+  DisableBackForwardCache(BackForwardCacheImpl::TEST_USES_UNLOAD_EVENT);
 
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
@@ -5804,36 +5801,6 @@ class AssertForegroundHelper {
   DISALLOW_COPY_AND_ASSIGN(AssertForegroundHelper);
 };
 
-// Observer class that waits until the OS process for a specific
-// RenderProcessHost is ready to be used.
-// TODO(nasko): Consider moving this into RenderProcessHostWatcher.
-class RenderProcessReadyObserver : public RenderProcessHostObserver {
- public:
-  explicit RenderProcessReadyObserver(RenderProcessHost* render_process_host)
-      : render_process_host_(render_process_host),
-        quit_closure_(run_loop_.QuitClosure()) {
-    render_process_host_->AddObserver(this);
-  }
-  ~RenderProcessReadyObserver() override {
-    render_process_host_->RemoveObserver(this);
-  }
-
-  // Waits until the renderer process is ready.
-  void Wait() { run_loop_.Run(); }
-
- private:
-  // RenderProcessHostObserver overrides.
-  void RenderProcessReady(RenderProcessHost* host) override {
-    std::move(quit_closure_).Run();
-  }
-
-  RenderProcessHost* render_process_host_;
-  base::RunLoop run_loop_;
-  base::OnceClosure quit_closure_;
-
-  DISALLOW_COPY_AND_ASSIGN(RenderProcessReadyObserver);
-};
-
 }  // namespace
 
 // This is a regression test for https://crbug.com/560446. It ensures the
@@ -5887,7 +5854,8 @@ IN_PROC_BROWSER_TEST_F(
 
   // Wait for the underlying OS process to have launched and be ready to
   // receive IPCs.
-  RenderProcessReadyObserver process_observer(speculative_rph);
+  RenderProcessHostWatcher process_observer(
+      speculative_rph, RenderProcessHostWatcher::WATCH_FOR_PROCESS_READY);
   process_observer.Wait();
 
   // Kick off an infinite check against self that the process used for
@@ -5995,6 +5963,8 @@ IN_PROC_BROWSER_TEST_F(
   EXPECT_EQ(speculative_rph, web_contents->GetMainFrame()->GetProcess());
 }
 
+namespace {
+
 // ContentBrowserClient that skips assigning a site URL for all URLs that match
 // a given URL's scheme and host.
 class DontAssignSiteContentBrowserClient : public TestContentBrowserClient {
@@ -6015,6 +5985,8 @@ class DontAssignSiteContentBrowserClient : public TestContentBrowserClient {
   DISALLOW_COPY_AND_ASSIGN(DontAssignSiteContentBrowserClient);
 };
 
+}  // namespace
+
 // Ensure that coming back to a NavigationEntry with a previously unassigned
 // SiteInstance (which is now used for another site) properly switches processes
 // and SiteInstances.  See https://crbug.com/945399.
@@ -6117,10 +6089,8 @@ IN_PROC_BROWSER_TEST_F(RenderFrameHostManagerTest,
   // either, so that it can be used for subsequent navigations.
   content::RenderProcessHost* new_process = new_instance->GetProcess();
   auto* policy = ChildProcessSecurityPolicy::GetInstance();
-  EXPECT_TRUE(
-      policy->CanAccessDataForOrigin(new_process->GetID(), url1));
-  EXPECT_TRUE(
-      policy->CanAccessDataForOrigin(new_process->GetID(), url2));
+  EXPECT_TRUE(policy->CanAccessDataForOrigin(new_process->GetID(), url1));
+  EXPECT_TRUE(policy->CanAccessDataForOrigin(new_process->GetID(), url2));
 
   SetBrowserClientForTesting(old_client);
 }
diff --git a/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc b/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc
index 9f4dc706ab4..c45fbed414f 100644
--- a/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc
+++ b/chromium/content/browser/frame_host/render_frame_host_manager_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/files/file_path.h"
+#include "base/hash/hash.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
@@ -128,34 +129,16 @@ bool FindMessageForRoutingId(const IPC::TestSink& sink,
 class RenderFrameHostManagerTestWebUIControllerFactory
     : public WebUIControllerFactory {
  public:
-  RenderFrameHostManagerTestWebUIControllerFactory()
-      : should_create_webui_(false), type_(1) {
-    CHECK_NE(reinterpret_cast<WebUI::TypeID>(type_), WebUI::kNoWebUI);
-  }
+  RenderFrameHostManagerTestWebUIControllerFactory() {}
   ~RenderFrameHostManagerTestWebUIControllerFactory() override {}
 
-  void set_should_create_webui(bool should_create_webui) {
-    should_create_webui_ = should_create_webui;
-  }
-
-  // This method simulates the expectation that different WebUI instance types
-  // would be created. The |type| value will be returned by GetWebUIType casted
-  // to WebUI::TypeID.
-  // As WebUI::TypeID is a typedef to void pointer, factory implementations
-  // return values that they know to be unique to their respective cases. So
-  // values set here should be safe if kept very low (just above zero).
-  void set_webui_type(uintptr_t type) {
-    CHECK_NE(reinterpret_cast<WebUI::TypeID>(type), WebUI::kNoWebUI);
-    type_ = type;
-  }
-
   // WebUIFactory implementation.
   std::unique_ptr<WebUIController> CreateWebUIControllerForURL(
       WebUI* web_ui,
       const GURL& url) override {
     // If WebUI creation is enabled for the test and this is a WebUI URL,
     // returns a new instance.
-    if (should_create_webui_ && HasWebUIScheme(url))
+    if (HasWebUIScheme(url))
       return std::make_unique<WebUIController>(web_ui);
     return nullptr;
   }
@@ -164,8 +147,8 @@ class RenderFrameHostManagerTestWebUIControllerFactory
                              const GURL& url) override {
     // If WebUI creation is enabled for the test and this is a WebUI URL,
     // returns a mock WebUI type.
-    if (should_create_webui_ && HasWebUIScheme(url)) {
-      return reinterpret_cast<WebUI::TypeID>(type_);
+    if (HasWebUIScheme(url)) {
+      return reinterpret_cast<WebUI::TypeID>(base::Hash(url.host()));
     }
     return WebUI::kNoWebUI;
   }
@@ -181,9 +164,6 @@ class RenderFrameHostManagerTestWebUIControllerFactory
   }
 
  private:
-  bool should_create_webui_;
-  uintptr_t type_;
-
   DISALLOW_COPY_AND_ASSIGN(RenderFrameHostManagerTestWebUIControllerFactory);
 };
 
@@ -236,9 +216,7 @@ class RenderViewHostDeletedObserver : public WebContentsObserver {
     }
   }
 
-  bool deleted() {
-    return deleted_;
-  }
+  bool deleted() { return deleted_; }
 
  private:
   int process_id_;
@@ -259,9 +237,7 @@ class RenderFrameHostCreatedObserver : public WebContentsObserver {
     created_ = true;
   }
 
-  bool created() {
-    return created_;
-  }
+  bool created() { return created_; }
 
  private:
   bool created_;
@@ -315,13 +291,8 @@ class PluginFaviconMessageObserver : public WebContentsObserver {
     favicon_received_ = true;
   }
 
-  bool plugin_crashed() {
-    return plugin_crashed_;
-  }
-
-  bool favicon_received() {
-    return favicon_received_;
-  }
+  bool plugin_crashed() { return plugin_crashed_; }
+  bool favicon_received() { return favicon_received_; }
 
  private:
   bool plugin_crashed_;
@@ -361,12 +332,6 @@ class RenderFrameHostManagerTest : public RenderViewHostImplTestHarness {
     WebUIControllerFactory::UnregisterFactoryForTesting(&factory_);
   }
 
-  void set_should_create_webui(bool should_create_webui) {
-    factory_.set_should_create_webui(should_create_webui);
-  }
-
-  void set_webui_type(int type) { factory_.set_webui_type(type); }
-
   GURL isolated_cross_site_url() const {
     return GURL("http://isolated-cross-site.com");
   }
@@ -458,14 +423,13 @@ class RenderFrameHostManagerTest : public RenderViewHostImplTestHarness {
     // And also simulates the 2nd and final call to GetFrameHostForNavigation
     // that determines the final frame that will commit the navigation.
     TestRenderFrameHost* frame_host = static_cast<TestRenderFrameHost*>(
-        manager->GetFrameHostForNavigation(*navigation_request));
+        manager->GetFrameHostForNavigation(navigation_request.get()));
     CHECK(frame_host);
     return frame_host;
   }
 
   // Returns the speculative RenderFrameHost.
-  RenderFrameHostImpl* GetPendingFrameHost(
-      RenderFrameHostManager* manager) {
+  RenderFrameHostImpl* GetPendingFrameHost(RenderFrameHostManager* manager) {
     return manager->speculative_render_frame_host_.get();
   }
 
@@ -487,15 +451,13 @@ class RenderFrameHostManagerTest : public RenderViewHostImplTestHarness {
 // different SiteInstances, BrowsingInstances, and RenderProcessHosts. This is
 // a regression test for bug 9364.
 TEST_F(RenderFrameHostManagerTest, ChromeSchemeProcesses) {
-  set_should_create_webui(true);
   const GURL kChromeUrl(GetWebUIURL("foo"));
   const GURL kDestUrl("http://www.google.com/");
 
   // Navigate our first tab to the chrome url and then to the destination,
   // ensuring we grant bindings to the chrome URL.
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(), kChromeUrl);
-  EXPECT_TRUE(main_rfh()->GetEnabledBindings() &
-              BINDINGS_POLICY_WEB_UI);
+  EXPECT_TRUE(main_rfh()->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(), kDestUrl);
 
   EXPECT_FALSE(contents()->GetPendingMainFrame());
@@ -528,7 +490,7 @@ TEST_F(RenderFrameHostManagerTest, ChromeSchemeProcesses) {
   EXPECT_NE(contents()->GetMainFrame()->GetSiteInstance(),
             dest_rfh2->GetSiteInstance());
   EXPECT_FALSE(dest_rfh2->GetSiteInstance()->IsRelatedSiteInstance(
-                   contents()->GetMainFrame()->GetSiteInstance()));
+      contents()->GetMainFrame()->GetSiteInstance()));
 
   // Navigate both to a chrome://... URL, and verify that they have a separate
   // RenderProcessHost and a separate SiteInstance.
@@ -981,7 +943,6 @@ TEST_F(RenderFrameHostManagerTest, Navigate) {
 
 // Tests WebUI creation.
 TEST_F(RenderFrameHostManagerTest, WebUI) {
-  set_should_create_webui(true);
   scoped_refptr<SiteInstance> instance =
       SiteInstance::Create(browser_context());
 
@@ -1032,7 +993,6 @@ TEST_F(RenderFrameHostManagerTest, WebUI) {
 // Tests that we can open a WebUI link in a new tab from a WebUI page and still
 // grant the correct bindings.  http://crbug.com/189101.
 TEST_F(RenderFrameHostManagerTest, WebUIInNewTab) {
-  set_should_create_webui(true);
   scoped_refptr<SiteInstance> blank_instance =
       SiteInstance::Create(browser_context());
   blank_instance->GetProcess()->Init();
@@ -1104,8 +1064,6 @@ TEST_F(RenderFrameHostManagerTest, WebUIInNewTab) {
 
 // Tests that a WebUI is correctly reused between chrome:// pages.
 TEST_F(RenderFrameHostManagerTest, WebUIWasReused) {
-  set_should_create_webui(true);
-
   // Navigate to a WebUI page.
   const GURL kUrl1(GetWebUIURL("foo"));
   contents()->NavigateAndCommit(kUrl1);
@@ -1122,8 +1080,6 @@ TEST_F(RenderFrameHostManagerTest, WebUIWasReused) {
 // Tests that a WebUI is correctly cleaned up when navigating from a chrome://
 // page to a non-chrome:// page.
 TEST_F(RenderFrameHostManagerTest, WebUIWasCleared) {
-  set_should_create_webui(true);
-
   // Navigate to a WebUI page.
   const GURL kUrl1(GetWebUIURL("foo"));
   contents()->NavigateAndCommit(kUrl1);
@@ -1240,14 +1196,14 @@ TEST_F(RenderFrameHostManagerTest, CreateSwappedOutOpenerRFHs) {
 
   // No scripting is allowed across BrowsingInstances, so we should not create
   // swapped out RVHs for the opener chain in this case.
-  EXPECT_FALSE(opener1_manager->GetRenderFrameProxyHost(
-                   rfh3->GetSiteInstance()));
-  EXPECT_FALSE(opener1_manager->GetSwappedOutRenderViewHost(
-                   rfh3->GetSiteInstance()));
-  EXPECT_FALSE(opener2_manager->GetRenderFrameProxyHost(
-                   rfh3->GetSiteInstance()));
-  EXPECT_FALSE(opener2_manager->GetSwappedOutRenderViewHost(
-                   rfh3->GetSiteInstance()));
+  EXPECT_FALSE(
+      opener1_manager->GetRenderFrameProxyHost(rfh3->GetSiteInstance()));
+  EXPECT_FALSE(
+      opener1_manager->GetSwappedOutRenderViewHost(rfh3->GetSiteInstance()));
+  EXPECT_FALSE(
+      opener2_manager->GetRenderFrameProxyHost(rfh3->GetSiteInstance()));
+  EXPECT_FALSE(
+      opener2_manager->GetSwappedOutRenderViewHost(rfh3->GetSiteInstance()));
 }
 
 // Test that a page can disown the opener of the WebContents.
@@ -1449,50 +1405,6 @@ TEST_F(RenderFrameHostManagerTest, CleanUpSwappedOutRVHOnProcessCrash) {
       rfh2->GetRenderViewHost()->opener_frame_route_id());
 }
 
-// Test that RenderViewHosts created for WebUI navigations are properly
-// granted WebUI bindings even if an unprivileged swapped out RenderViewHost
-// is in the same process (http://crbug.com/79918).
-TEST_F(RenderFrameHostManagerTest, EnableWebUIWithSwappedOutOpener) {
-  set_should_create_webui(true);
-  const GURL kSettingsUrl(GetWebUIURL("chrome/settings"));
-  const GURL kPluginUrl(GetWebUIURL("plugins"));
-
-  // Navigate to an initial WebUI URL.
-  contents()->NavigateAndCommit(kSettingsUrl);
-
-  // Ensure the RVH has WebUI bindings.
-  TestRenderViewHost* rvh1 = test_rvh();
-  EXPECT_TRUE(rvh1->GetMainFrame()->GetEnabledBindings() &
-              BINDINGS_POLICY_WEB_UI);
-
-  // Create a new tab and simulate it being the opener for the main
-  // tab.  It should be in the same SiteInstance.
-  std::unique_ptr<TestWebContents> opener1(
-      TestWebContents::Create(browser_context(), rvh1->GetSiteInstance()));
-  RenderFrameHostManager* opener1_manager =
-      opener1->GetRenderManagerForTesting();
-  contents()->SetOpener(opener1.get());
-
-  // Navigate to a different WebUI URL (different SiteInstance, same
-  // BrowsingInstance).
-  contents()->NavigateAndCommit(kPluginUrl);
-  TestRenderViewHost* rvh2 = test_rvh();
-  EXPECT_NE(rvh1->GetSiteInstance(), rvh2->GetSiteInstance());
-  EXPECT_TRUE(rvh1->GetSiteInstance()->IsRelatedSiteInstance(
-                  rvh2->GetSiteInstance()));
-
-  // Ensure a proxy and swapped out RVH are created in the first opener tab.
-  EXPECT_TRUE(
-      opener1_manager->GetRenderFrameProxyHost(rvh2->GetSiteInstance()));
-  TestRenderViewHost* opener1_rvh = static_cast<TestRenderViewHost*>(
-      opener1_manager->GetSwappedOutRenderViewHost(rvh2->GetSiteInstance()));
-  EXPECT_FALSE(opener1_rvh->is_active());
-
-  // Ensure the new RVH has WebUI bindings.
-  EXPECT_TRUE(rvh2->GetMainFrame()->GetEnabledBindings() &
-              BINDINGS_POLICY_WEB_UI);
-}
-
 // Test that we reuse the same guest SiteInstance if we navigate across sites.
 TEST_F(RenderFrameHostManagerTest, NoSwapOnGuestNavigations) {
   GURL guest_url(std::string(kGuestScheme).append("://abc123"));
@@ -1652,8 +1564,8 @@ TEST_F(RenderFrameHostManagerTest, CloseWithPendingWhileUnresponsive) {
   EXPECT_TRUE(rfh1->render_view_host()->is_waiting_for_close_ack());
 
   // Start a navigation to a new site.
-  controller().LoadURL(
-      kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
+  controller().LoadURL(kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK,
+                       std::string());
   rfh1->PrepareForCommit();
   EXPECT_TRUE(contents()->CrossProcessNavigationPending());
 
@@ -1750,8 +1662,7 @@ TEST_F(RenderFrameHostManagerTest, SwapOutFrameAfterSwapOutACK) {
 // new renderer commits before sending the SwapOut message to the old renderer.
 // This simulates a cross-site navigation to a synchronously committing URL
 // (e.g., a data URL) and ensures it works properly.
-TEST_F(RenderFrameHostManagerTest,
-       CommitNewNavigationBeforeSendingSwapOut) {
+TEST_F(RenderFrameHostManagerTest, CommitNewNavigationBeforeSendingSwapOut) {
   const GURL kUrl1("http://www.google.com/");
   const GURL kUrl2("http://www.chromium.org/");
 
@@ -1788,14 +1699,16 @@ TEST_F(RenderFrameHostManagerTest,
 
   // rfh1 should be deleted.
   EXPECT_TRUE(rfh_deleted_observer.deleted());
-  EXPECT_TRUE(contents()->GetFrameTree()->root()->render_manager()
-              ->GetRenderFrameProxyHost(site_instance.get()));
+  EXPECT_TRUE(contents()
+                  ->GetFrameTree()
+                  ->root()
+                  ->render_manager()
+                  ->GetRenderFrameProxyHost(site_instance.get()));
 }
 
 // Test that a RenderFrameHost is properly deleted when a cross-site navigation
 // is cancelled.
-TEST_F(RenderFrameHostManagerTest,
-       CancelPendingProperlyDeletesOrSwaps) {
+TEST_F(RenderFrameHostManagerTest, CancelPendingProperlyDeletesOrSwaps) {
   const GURL kUrl1("http://www.google.com/");
   const GURL kUrl2 = isolated_cross_site_url();
   RenderFrameHostImpl* pending_rfh = nullptr;
@@ -1807,8 +1720,8 @@ TEST_F(RenderFrameHostManagerTest,
   EXPECT_TRUE(rfh1->is_active());
 
   // Navigate to a new site, starting a cross-site navigation.
-  controller().LoadURL(
-      kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
+  controller().LoadURL(kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK,
+                       std::string());
   {
     pending_rfh = contents()->GetPendingMainFrame();
     RenderFrameDeletedObserver rfh_deleted_observer(pending_rfh);
@@ -1824,8 +1737,8 @@ TEST_F(RenderFrameHostManagerTest,
   }
 
   // Start another cross-site navigation.
-  controller().LoadURL(
-      kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
+  controller().LoadURL(kUrl2, Referrer(), ui::PAGE_TRANSITION_LINK,
+                       std::string());
   {
     pending_rfh = contents()->GetPendingMainFrame();
     RenderFrameDeletedObserver rfh_deleted_observer(pending_rfh);
@@ -1842,8 +1755,11 @@ TEST_F(RenderFrameHostManagerTest,
     EXPECT_FALSE(contents()->CrossProcessNavigationPending());
 
     EXPECT_TRUE(rfh_deleted_observer.deleted());
-    EXPECT_TRUE(contents()->GetFrameTree()->root()->render_manager()
-                ->GetRenderFrameProxyHost(site_instance.get()));
+    EXPECT_TRUE(contents()
+                    ->GetFrameTree()
+                    ->root()
+                    ->render_manager()
+                    ->GetRenderFrameProxyHost(site_instance.get()));
   }
 }
 
@@ -1931,7 +1847,7 @@ TEST_F(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
   EXPECT_NE(iframe1->current_frame_host(), GetPendingFrameHost(iframe1));
   EXPECT_NE(iframe2->current_frame_host(), GetPendingFrameHost(iframe2));
   EXPECT_FALSE(contents()->CrossProcessNavigationPending())
-    << "There should be no top-level pending navigation.";
+      << "There should be no top-level pending navigation.";
 
   RenderFrameDeletedObserver delete_watcher1(GetPendingFrameHost(iframe1));
   RenderFrameDeletedObserver delete_watcher2(GetPendingFrameHost(iframe2));
@@ -1948,10 +1864,8 @@ TEST_F(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
   // Proxies should exist.
   EXPECT_NE(nullptr,
             root_manager->GetRenderFrameProxyHost(site_instance.get()));
-  EXPECT_NE(nullptr,
-            iframe1->GetRenderFrameProxyHost(site_instance.get()));
-  EXPECT_NE(nullptr,
-            iframe2->GetRenderFrameProxyHost(site_instance.get()));
+  EXPECT_NE(nullptr, iframe1->GetRenderFrameProxyHost(site_instance.get()));
+  EXPECT_NE(nullptr, iframe2->GetRenderFrameProxyHost(site_instance.get()));
 
   // Detach the first child FrameTreeNode. This should kill the pending host but
   // not yet destroy proxies in |site_instance| since the other child remains.
@@ -1966,8 +1880,7 @@ TEST_F(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
   // Proxies should still exist.
   EXPECT_NE(nullptr,
             root_manager->GetRenderFrameProxyHost(site_instance.get()));
-  EXPECT_NE(nullptr,
-            iframe2->GetRenderFrameProxyHost(site_instance.get()));
+  EXPECT_NE(nullptr, iframe2->GetRenderFrameProxyHost(site_instance.get()));
 
   // Detach the second child FrameTreeNode. This should trigger cleanup of
   // RenderFrameProxyHosts in |site_instance|.
@@ -1979,8 +1892,7 @@ TEST_F(RenderFrameHostManagerTestWithSiteIsolation, DetachPendingChild) {
   EXPECT_TRUE(delete_watcher2.deleted());
 
   EXPECT_EQ(0U, site_instance->active_frame_count());
-  EXPECT_EQ(nullptr,
-            root_manager->GetRenderFrameProxyHost(site_instance.get()))
+  EXPECT_EQ(nullptr, root_manager->GetRenderFrameProxyHost(site_instance.get()))
       << "Proxies should have been cleaned up";
   EXPECT_TRUE(site_instance->HasOneRef())
       << "This SiteInstance should be destroyable now.";
@@ -2068,8 +1980,6 @@ TEST_F(RenderFrameHostManagerTestWithSiteIsolation,
 // See https://crbug.com/536145.
 TEST_F(RenderFrameHostManagerTestWithSiteIsolation,
        DontGrantPendingWebUIToSubframe) {
-  set_should_create_webui(true);
-
   // Make sure the initial process is live so that the pending WebUI navigation
   // does not commit immediately.  Give the page a subframe as well.
   const GURL kUrl1("http://foo.com");
@@ -2527,8 +2437,6 @@ TEST_F(RenderFrameHostManagerTest,
 
 // Checks that a restore navigation to a WebUI works.
 TEST_F(RenderFrameHostManagerTest, RestoreNavigationToWebUI) {
-  set_should_create_webui(true);
-
   const GURL kInitUrl(GetWebUIURL("foo"));
   scoped_refptr<SiteInstanceImpl> initial_instance =
       SiteInstanceImpl::Create(browser_context());
@@ -2587,7 +2495,6 @@ TEST_F(RenderFrameHostManagerTest, RestoreNavigationToWebUI) {
 // Simulates two simultaneous navigations involving one WebUI where the current
 // RenderFrameHost commits.
 TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithOneWebUI1) {
-  set_should_create_webui(true);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(),
                                                     GetWebUIURL("foo/"));
 
@@ -2631,7 +2538,7 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithOneWebUI1) {
   EXPECT_FALSE(host2->pending_web_ui());
   EXPECT_NE(web_ui, host2->web_ui());
 
-    // The current RenderFrameHost commits; its WebUI should still be in place.
+  // The current RenderFrameHost commits; its WebUI should still be in place.
   reload->Commit();
   EXPECT_EQ(host1, manager->current_frame_host());
   EXPECT_EQ(web_ui, host1->web_ui());
@@ -2649,7 +2556,6 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithOneWebUI1) {
 // Simulates two simultaneous navigations involving one WebUI where the new,
 // cross-site RenderFrameHost commits.
 TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithOneWebUI2) {
-  set_should_create_webui(true);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(),
                                                     GetWebUIURL("foo/"));
 
@@ -2707,8 +2613,6 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithOneWebUI2) {
 // Simulates two simultaneous navigations involving two WebUIs where the current
 // RenderFrameHost commits.
 TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs1) {
-  set_should_create_webui(true);
-  set_webui_type(1);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(),
                                                     GetWebUIURL("foo"));
 
@@ -2729,8 +2633,7 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs1) {
   EXPECT_EQ(web_ui1, host1->pending_web_ui());
   EXPECT_FALSE(GetPendingFrameHost(manager));
 
-  // Navigation another WebUI page, with a different type.
-  set_webui_type(2);
+  // Navigate to another WebUI page.
   const GURL kUrl(GetWebUIURL("bar"));
   auto navigation =
       NavigationSimulator::CreateBrowserInitiated(kUrl, contents());
@@ -2755,7 +2658,7 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs1) {
   EXPECT_EQ(web_ui2, host2->web_ui());
   EXPECT_FALSE(host2->pending_web_ui());
 
-    // The current RenderFrameHost commits; its WebUI should still be active.
+  // The current RenderFrameHost commits; its WebUI should still be active.
   reload->Commit();
   EXPECT_EQ(host1, manager->current_frame_host());
   EXPECT_EQ(web_ui1, host1->web_ui());
@@ -2773,8 +2676,6 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs1) {
 // Simulates two simultaneous navigations involving two WebUIs where the new,
 // cross-site RenderFrameHost commits.
 TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs2) {
-  set_should_create_webui(true);
-  set_webui_type(1);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(),
                                                     GetWebUIURL("foo/"));
 
@@ -2795,8 +2696,7 @@ TEST_F(RenderFrameHostManagerTest, SimultaneousNavigationWithTwoWebUIs2) {
   EXPECT_EQ(web_ui1, host1->pending_web_ui());
   EXPECT_FALSE(GetPendingFrameHost(manager));
 
-  // Navigation another WebUI page, with a different type.
-  set_webui_type(2);
+  // Navigate to another WebUI page.
   const GURL kUrl(GetWebUIURL("bar/"));
   auto navigation =
       NavigationSimulator::CreateBrowserInitiated(kUrl, contents());
@@ -2840,22 +2740,22 @@ TEST_F(RenderFrameHostManagerTest, CanCommitOrigin) {
     const char* const origin;
     bool mismatch;
   } cases[] = {
-    // Positive case where the two match.
-    { "http://a.com/foo.html", "http://a.com", false },
+      // Positive case where the two match.
+      {"http://a.com/foo.html", "http://a.com", false},
 
-    // Host mismatches.
-    { "http://a.com/", "http://b.com", true },
-    { "http://b.com/", "http://a.com", true },
+      // Host mismatches.
+      {"http://a.com/", "http://b.com", true},
+      {"http://b.com/", "http://a.com", true},
 
-    // Scheme mismatches.
-    { "file://", "http://a.com", true },
-    { "https://a.com/", "http://a.com", true },
+      // Scheme mismatches.
+      {"file://", "http://a.com", true},
+      {"https://a.com/", "http://a.com", true},
 
-    // about:blank URLs inherit the origin of the context that navigated them.
-    { "about:blank", "http://a.com", false },
+      // about:blank URLs inherit the origin of the context that navigated them.
+      {"about:blank", "http://a.com", false},
 
-    // Unique origin.
-    { "http://a.com", "null", false },
+      // Unique origin.
+      {"http://a.com", "null", false},
   };
 
   for (const auto& test_case : cases) {
@@ -2875,16 +2775,14 @@ TEST_F(RenderFrameHostManagerTest, CanCommitOrigin) {
     navigation->Commit();
 
     EXPECT_EQ(expected_bad_msg_count, process()->bad_msg_count())
-      << " url:" << test_case.url
-      << " origin:" << test_case.origin
-      << " mismatch:" << test_case.mismatch;
+        << " url:" << test_case.url << " origin:" << test_case.origin
+        << " mismatch:" << test_case.mismatch;
   }
 }
 
 // Tests that the correct intermediary and final navigation states are reached
 // when navigating from a renderer that is not live to a WebUI URL.
 TEST_F(RenderFrameHostManagerTest, NavigateFromDeadRendererToWebUI) {
-  set_should_create_webui(true);
   RenderFrameHostManager* manager = contents()->GetRenderManagerForTesting();
 
   RenderFrameHostImpl* initial_host = manager->current_frame_host();
@@ -2937,7 +2835,7 @@ TEST_F(RenderFrameHostManagerTest, NavigateFromDeadRendererToWebUI) {
   EXPECT_FALSE(GetPendingFrameHost(manager));
 
   // Prepare to commit, update the navigating RenderFrameHost.
-  EXPECT_EQ(host, manager->GetFrameHostForNavigation(*navigation_request));
+  EXPECT_EQ(host, manager->GetFrameHostForNavigation(navigation_request.get()));
 
   // There should be a pending WebUI set to reuse the current one.
   EXPECT_EQ(web_ui, host->web_ui());
@@ -2960,7 +2858,6 @@ TEST_F(RenderFrameHostManagerTest, NavigateFromDeadRendererToWebUI) {
 // Tests that the correct intermediary and final navigation states are reached
 // when navigating same-site between two WebUIs of the same type.
 TEST_F(RenderFrameHostManagerTest, NavigateSameSiteBetweenWebUIs) {
-  set_should_create_webui(true);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(),
                                                     GetWebUIURL("foo"));
 
@@ -3003,8 +2900,6 @@ TEST_F(RenderFrameHostManagerTest, NavigateSameSiteBetweenWebUIs) {
 TEST_F(RenderFrameHostManagerTest, NavigateCrossSiteBetweenWebUIs) {
   // Cross-site navigations will always cause the change of the WebUI instance
   // but for consistency sake different types will be set for each navigation.
-  set_should_create_webui(true);
-  set_webui_type(1);
   NavigationSimulator::NavigateAndCommitFromBrowser(contents(),
                                                     GetWebUIURL("foo"));
 
@@ -3013,12 +2908,9 @@ TEST_F(RenderFrameHostManagerTest, NavigateCrossSiteBetweenWebUIs) {
   EXPECT_TRUE(host->IsRenderFrameLive());
   EXPECT_TRUE(host->web_ui());
 
-  // Set the WebUI controller to return a different WebUIType value. This will
-  // cause the next navigation to "chrome://bar" to require a different WebUI
-  // than the current one, forcing it to be treated as cross-site.
-  set_webui_type(2);
-
-  // Navigation request.
+  // Navigate to different WebUI. This will cause the next navigation to
+  // "chrome://bar" to require a different WebUI than the current one,
+  // forcing it to be treated as cross-site.
   const GURL kUrl(GetWebUIURL("bar"));
   auto web_ui_navigation =
       NavigationSimulator::CreateBrowserInitiated(kUrl, contents());
@@ -3033,15 +2925,8 @@ TEST_F(RenderFrameHostManagerTest, NavigateCrossSiteBetweenWebUIs) {
   WebUIImpl* next_web_ui = manager->GetNavigatingWebUI();
   EXPECT_TRUE(next_web_ui);
   EXPECT_EQ(next_web_ui, speculative_host->web_ui());
-  EXPECT_NE(next_web_ui, manager->current_frame_host()->web_ui());
-  EXPECT_FALSE(speculative_host->pending_web_ui());
-
-  EXPECT_TRUE(manager->current_frame_host()->web_ui());
-  EXPECT_FALSE(manager->current_frame_host()->pending_web_ui());
-  EXPECT_EQ(speculative_host, GetPendingFrameHost(manager));
-  EXPECT_NE(next_web_ui, manager->current_frame_host()->web_ui());
-  EXPECT_EQ(next_web_ui, speculative_host->web_ui());
   EXPECT_EQ(next_web_ui, manager->GetNavigatingWebUI());
+  EXPECT_NE(next_web_ui, manager->current_frame_host()->web_ui());
   EXPECT_FALSE(speculative_host->pending_web_ui());
 
   // The RenderFrameHost committed.
diff --git a/chromium/content/browser/frame_host/render_frame_message_filter.cc b/chromium/content/browser/frame_host/render_frame_message_filter.cc
index 1202e49da23..e4972dba25a 100644
--- a/chromium/content/browser/frame_host/render_frame_message_filter.cc
+++ b/chromium/content/browser/frame_host/render_frame_message_filter.cc
@@ -19,7 +19,6 @@
 #include "base/task/post_task.h"
 #include "base/unguessable_token.h"
 #include "build/build_config.h"
-#include "components/download/public/common/download_url_parameters.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
 #include "content/browser/child_process_security_policy_impl.h"
@@ -29,15 +28,14 @@
 #include "content/browser/renderer_host/render_widget_helper.h"
 #include "content/browser/resource_context_impl.h"
 #include "content/browser/storage_partition_impl.h"
-#include "content/common/content_constants_internal.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
-#include "content/public/browser/download_manager.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "gpu/GLES2/gl2extchromium.h"
@@ -107,37 +105,6 @@ void CreateChildFrameOnUI(
   }
 }
 
-// |blob_data_handle| is only here for the legacy code path. With network
-// service enabled |blob_url_token| should be provided and will be used instead
-// to download the correct blob.
-void DownloadUrlOnUIThread(
-    std::unique_ptr<download::DownloadUrlParameters> parameters,
-    std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
-    mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-
-  RenderProcessHost* render_process_host =
-      RenderProcessHost::FromID(parameters->render_process_host_id());
-  if (!render_process_host)
-    return;
-
-  BrowserContext* browser_context = render_process_host->GetBrowserContext();
-
-  scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory;
-  if (blob_url_token) {
-    blob_url_loader_factory =
-        ChromeBlobStorageContext::URLLoaderFactoryForToken(
-            browser_context, std::move(blob_url_token));
-  }
-
-  DownloadManager* download_manager =
-      BrowserContext::GetDownloadManager(browser_context);
-  parameters->set_download_source(download::DownloadSource::FROM_RENDERER);
-  download_manager->DownloadUrl(std::move(parameters),
-                                std::move(blob_data_handle),
-                                std::move(blob_url_loader_factory));
-}
-
 // Common functionality for converting a sync renderer message to a callback
 // function in the browser. Derive from this, create it on the heap when
 // issuing your callback. When done, write your reply parameters into
@@ -146,9 +113,7 @@ class RenderMessageCompletionCallback {
  public:
   RenderMessageCompletionCallback(RenderFrameMessageFilter* filter,
                                   IPC::Message* reply_msg)
-      : filter_(filter),
-        reply_msg_(reply_msg) {
-  }
+      : filter_(filter), reply_msg_(reply_msg) {}
 
   virtual ~RenderMessageCompletionCallback() {
     if (reply_msg_) {
@@ -182,9 +147,7 @@ class RenderFrameMessageFilter::OpenChannelToPpapiBrokerCallback
  public:
   OpenChannelToPpapiBrokerCallback(RenderFrameMessageFilter* filter,
                                    int routing_id)
-      : filter_(filter),
-        routing_id_(routing_id) {
-  }
+      : filter_(filter), routing_id_(routing_id) {}
 
   ~OpenChannelToPpapiBrokerCallback() override {}
 
@@ -200,8 +163,7 @@ class RenderFrameMessageFilter::OpenChannelToPpapiBrokerCallback
   void OnPpapiChannelOpened(const IPC::ChannelHandle& channel_handle,
                             base::ProcessId plugin_pid,
                             int /* plugin_child_id */) override {
-    filter_->Send(new ViewMsg_PpapiBrokerChannelCreated(routing_id_,
-                                                        plugin_pid,
+    filter_->Send(new ViewMsg_PpapiBrokerChannelCreated(routing_id_, plugin_pid,
                                                         channel_handle));
     delete this;
   }
@@ -273,9 +235,6 @@ bool RenderFrameMessageFilter::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(RenderFrameMessageFilter, message)
     IPC_MESSAGE_HANDLER(FrameHostMsg_CreateChildFrame, OnCreateChildFrame)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DownloadUrl, OnDownloadUrl)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_SaveImageFromDataURL,
-                        OnSaveImageFromDataURL)
     IPC_MESSAGE_HANDLER(FrameHostMsg_Are3DAPIsBlocked, OnAre3DAPIsBlocked)
 #if BUILDFLAG(ENABLE_PLUGINS)
     IPC_MESSAGE_HANDLER(FrameHostMsg_GetPluginInfo, OnGetPluginInfo)
@@ -309,77 +268,6 @@ void RenderFrameMessageFilter::OverrideThreadForMessage(
 #endif  // ENABLE_PLUGINS
 }
 
-void RenderFrameMessageFilter::DownloadUrl(
-    int render_view_id,
-    int render_frame_id,
-    const GURL& url,
-    const Referrer& referrer,
-    const url::Origin& initiator,
-    const base::string16& suggested_name,
-    const bool use_prompt,
-    const bool follow_cross_origin_redirects,
-    mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token) const {
-  if (!resource_context_)
-    return;
-
-  net::NetworkTrafficAnnotationTag traffic_annotation =
-      net::DefineNetworkTrafficAnnotation("renderer_initiated_download", R"(
-        semantics {
-          sender: "Download from Renderer"
-          description:
-            "The frame has either navigated to a URL that was determined to be "
-            "a download via one of the renderer's classification mechanisms, "
-            "or WebView has requested a <canvas> or <img> element at a "
-            "specific location be to downloaded."
-          trigger:
-            "The user navigated to a destination that was categorized as a "
-            "download, or WebView triggered saving a <canvas> or <img> tag."
-          data: "Only the URL we are attempting to download."
-          destination: WEBSITE
-        }
-        policy {
-          cookies_allowed: YES
-          cookies_store: "user"
-          setting: "This feature cannot be disabled by settings."
-          chrome_policy {
-            DownloadRestrictions {
-              DownloadRestrictions: 3
-            }
-          }
-        })");
-  std::unique_ptr<download::DownloadUrlParameters> parameters(
-      new download::DownloadUrlParameters(url, render_process_id_,
-                                          render_view_id, render_frame_id,
-                                          traffic_annotation));
-  parameters->set_content_initiated(true);
-  parameters->set_suggested_name(suggested_name);
-  parameters->set_prompt(use_prompt);
-  parameters->set_follow_cross_origin_redirects(follow_cross_origin_redirects);
-  parameters->set_referrer(referrer.url);
-  parameters->set_referrer_policy(
-      Referrer::ReferrerPolicyForUrlRequest(referrer.policy));
-  parameters->set_initiator(initiator);
-
-  // If network service is enabled we should always have a |blob_url_token|,
-  // which will be used to download the correct blob. But in the legacy
-  // non-network service code path we still need to look up the BlobDataHandle
-  // for the URL here, to make sure the correct blob ends up getting downloaded.
-  std::unique_ptr<storage::BlobDataHandle> blob_data_handle;
-  if (url.SchemeIsBlob()) {
-    ChromeBlobStorageContext* blob_context =
-        GetChromeBlobStorageContextForResourceContext(resource_context_);
-
-    blob_data_handle = blob_context->context()->GetBlobDataFromPublicURL(url);
-    // Don't care if the above fails. We are going to let the download go
-    // through and allow it to be interrupted so that the embedder can deal.
-  }
-
-  base::PostTask(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&DownloadUrlOnUIThread, std::move(parameters),
-                     std::move(blob_data_handle), std::move(blob_url_token)));
-}
-
 void RenderFrameMessageFilter::OnCreateChildFrame(
     const FrameHostMsg_CreateChildFrame_Params& params,
     FrameHostMsg_CreateChildFrame_Params_Reply* params_reply) {
@@ -427,34 +315,6 @@ void RenderFrameMessageFilter::OnCreateChildFrame(
           browser_interface_broker_receiver.PassPipe()));
 }
 
-void RenderFrameMessageFilter::OnDownloadUrl(
-    const FrameHostMsg_DownloadUrl_Params& params) {
-  mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token;
-  if (!VerifyDownloadUrlParams(render_process_id_, params, &blob_url_token))
-    return;
-
-  DownloadUrl(params.render_view_id, params.render_frame_id, params.url,
-              params.referrer, params.initiator_origin, params.suggested_name,
-              false, params.follow_cross_origin_redirects,
-              std::move(blob_url_token));
-}
-
-void RenderFrameMessageFilter::OnSaveImageFromDataURL(
-    int render_view_id,
-    int render_frame_id,
-    const std::string& url_str) {
-  // Please refer to RenderFrameImpl::saveImageFromDataURL().
-  if (url_str.length() >= kMaxLengthOfDataURLString)
-    return;
-
-  GURL data_url(url_str);
-  if (!data_url.is_valid() || !data_url.SchemeIs(url::kDataScheme))
-    return;
-
-  DownloadUrl(render_view_id, render_frame_id, data_url, Referrer(),
-              url::Origin(), base::string16(), true, true, mojo::NullRemote());
-}
-
 void RenderFrameMessageFilter::OnAre3DAPIsBlocked(int render_frame_id,
                                                   const GURL& top_origin_url,
                                                   ThreeDAPIType requester,
@@ -526,8 +386,8 @@ void RenderFrameMessageFilter::OnDidDeleteOutOfProcessPepperInstance(
     if (host)
       host->DeleteInstance(pp_instance);
   } else {
-    PpapiPluginProcessHost::DidDeleteOutOfProcessInstance(
-        plugin_child_id, pp_instance);
+    PpapiPluginProcessHost::DidDeleteOutOfProcessInstance(plugin_child_id,
+                                                          pp_instance);
   }
 }
 
diff --git a/chromium/content/browser/frame_host/render_frame_message_filter.h b/chromium/content/browser/frame_host/render_frame_message_filter.h
index d3510133b2d..307a119bb9d 100644
--- a/chromium/content/browser/frame_host/render_frame_message_filter.h
+++ b/chromium/content/browser/frame_host/render_frame_message_filter.h
@@ -8,6 +8,7 @@
 #include <stdint.h>
 
 #include <set>
+#include <string>
 
 #include "base/optional.h"
 #include "content/common/frame_replication_state.h"
@@ -26,7 +27,6 @@
 
 struct FrameHostMsg_CreateChildFrame_Params;
 struct FrameHostMsg_CreateChildFrame_Params_Reply;
-struct FrameHostMsg_DownloadUrl_Params;
 class GURL;
 
 namespace url {
@@ -36,7 +36,6 @@ class Origin;
 namespace content {
 class BrowserContext;
 class PluginServiceImpl;
-struct Referrer;
 class RenderWidgetHelper;
 class ResourceContext;
 class StoragePartition;
@@ -65,21 +64,6 @@ class CONTENT_EXPORT RenderFrameMessageFilter : public BrowserMessageFilter {
   // Clears |resource_context_| to prevent accessing it after deletion.
   void ClearResourceContext();
 
- protected:
-  friend class TestSaveImageFromDataURL;
-
-  // This method will be overridden by TestSaveImageFromDataURL class for test.
-  virtual void DownloadUrl(
-      int render_view_id,
-      int render_frame_id,
-      const GURL& url,
-      const Referrer& referrer,
-      const url::Origin& initiator,
-      const base::string16& suggested_name,
-      const bool use_prompt,
-      const bool follow_cross_origin_redirects,
-      mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token) const;
-
  private:
   friend class BrowserThread;
   friend class base::DeleteHelper<RenderFrameMessageFilter>;
@@ -95,11 +79,6 @@ class CONTENT_EXPORT RenderFrameMessageFilter : public BrowserMessageFilter {
       const FrameHostMsg_CreateChildFrame_Params& params,
       FrameHostMsg_CreateChildFrame_Params_Reply* params_reply);
 
-  void OnDownloadUrl(const FrameHostMsg_DownloadUrl_Params& params);
-
-  void OnSaveImageFromDataURL(int render_view_id,
-                              int render_frame_id,
-                              const std::string& url_str);
 
   void OnAre3DAPIsBlocked(int render_frame_id,
                           const GURL& top_origin_url,
@@ -128,8 +107,7 @@ class CONTENT_EXPORT RenderFrameMessageFilter : public BrowserMessageFilter {
   void OnDidDeleteOutOfProcessPepperInstance(int plugin_child_id,
                                              int32_t pp_instance,
                                              bool is_external);
-  void OnOpenChannelToPpapiBroker(int routing_id,
-                                  const base::FilePath& path);
+  void OnOpenChannelToPpapiBroker(int routing_id, const base::FilePath& path);
   void OnPluginInstanceThrottleStateChange(int plugin_child_id,
                                            int32_t pp_instance,
                                            bool is_throttled);
diff --git a/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc b/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc
index b06c83bfb56..3029ecc8ac5 100644
--- a/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc
+++ b/chromium/content/browser/frame_host/render_frame_message_filter_browsertest.cc
@@ -23,6 +23,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -182,8 +183,7 @@ IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, Cookies) {
   // TLS page writes secure cookie.
   EXPECT_TRUE(ExecuteScript(web_contents_https->GetMainFrame(),
                             "document.cookie = 'C=3;secure;';"));
-  EXPECT_EQ("B=2; C=3",
-            GetCookieFromJS(web_contents_https->GetMainFrame()));
+  EXPECT_EQ("B=2; C=3", GetCookieFromJS(web_contents_https->GetMainFrame()));
   EXPECT_EQ("B=2", GetCookieFromJS(web_contents_http->GetMainFrame()));
 
   // TLS page writes not-secure cookie.
@@ -252,9 +252,9 @@ IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, SameSiteCookies) {
   std::string a_hostname = "localhost";
   std::string b_hostname = "127.0.0.1";
   GURL url = a_server.GetURL(a_hostname, cookies_to_set);
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   url = b_server.GetURL(b_hostname, cookies_to_set);
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   // TODO(crbug.com/984685): Make it less painful to set up https cross-site
   // iframe tests.
   std::string a_hostname_and_port =
@@ -343,6 +343,8 @@ class CookieStoreContentBrowserClient : public ContentBrowserClient {
       network::mojom::RestrictedCookieManagerRole role,
       content::BrowserContext* browser_context,
       const url::Origin& origin,
+      const GURL& site_for_cookies,
+      const url::Origin& top_frame_origin,
       bool is_service_worker,
       int process_id,
       int routing_id,
diff --git a/chromium/content/browser/frame_host/render_frame_proxy_host.cc b/chromium/content/browser/frame_host/render_frame_proxy_host.cc
index 3235bc0ccd4..7c7fcf73b79 100644
--- a/chromium/content/browser/frame_host/render_frame_proxy_host.cc
+++ b/chromium/content/browser/frame_host/render_frame_proxy_host.cc
@@ -29,6 +29,7 @@
 #include "content/common/frame_owner_properties.h"
 #include "content/common/unfreezable_frame_messages.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "ipc/ipc_message.h"
 
@@ -135,11 +136,12 @@ RenderViewHostImpl* RenderFrameProxyHost::GetRenderViewHost() {
 }
 
 RenderWidgetHostView* RenderFrameProxyHost::GetRenderWidgetHostView() {
-  return frame_tree_node_->parent()->render_manager()
+  return frame_tree_node_->parent()
+      ->render_manager()
       ->GetRenderWidgetHostView();
 }
 
-bool RenderFrameProxyHost::Send(IPC::Message *msg) {
+bool RenderFrameProxyHost::Send(IPC::Message* msg) {
   return GetProcess()->Send(msg);
 }
 
@@ -215,7 +217,8 @@ bool RenderFrameProxyHost::InitRenderFrameProxy() {
   }
 
   int view_routing_id = frame_tree_node_->frame_tree()
-      ->GetRenderViewHost(site_instance_.get())->GetRoutingID();
+                            ->GetRenderViewHost(site_instance_.get())
+                            ->GetRoutingID();
   GetProcess()->GetRendererInterface()->CreateFrameProxy(
       routing_id_, view_routing_id, opener_routing_id, parent_routing_id,
       frame_tree_node_->current_replication_state(),
@@ -514,11 +517,10 @@ void RenderFrameProxyHost::OnAdvanceFocus(blink::WebFocusType type,
   RenderFrameHostImpl* source_rfh =
       RenderFrameHostImpl::FromID(GetProcess()->GetID(), source_routing_id);
   RenderFrameProxyHost* source_proxy =
-      source_rfh
-          ? source_rfh->frame_tree_node()
-                ->render_manager()
-                ->GetRenderFrameProxyHost(target_rfh->GetSiteInstance())
-          : nullptr;
+      source_rfh ? source_rfh->frame_tree_node()
+                       ->render_manager()
+                       ->GetRenderFrameProxyHost(target_rfh->GetSiteInstance())
+                 : nullptr;
 
   target_rfh->AdvanceFocus(type, source_proxy);
   frame_tree_node_->current_frame_host()->delegate()->OnAdvanceFocus(
diff --git a/chromium/content/browser/frame_host/render_frame_proxy_host.h b/chromium/content/browser/frame_host/render_frame_proxy_host.h
index 74b68270e6c..df460158eda 100644
--- a/chromium/content/browser/frame_host/render_frame_proxy_host.h
+++ b/chromium/content/browser/frame_host/render_frame_proxy_host.h
@@ -75,21 +75,15 @@ class RenderFrameProxyHost : public IPC::Listener,
                        FrameTreeNode* frame_tree_node);
   ~RenderFrameProxyHost() override;
 
-  RenderProcessHost* GetProcess() {
-    return process_;
-  }
+  RenderProcessHost* GetProcess() { return process_; }
 
   // Initializes the object and creates the RenderFrameProxy in the process
   // for the SiteInstance.
   bool InitRenderFrameProxy();
 
-  int GetRoutingID() {
-    return routing_id_;
-  }
+  int GetRoutingID() { return routing_id_; }
 
-  SiteInstance* GetSiteInstance() {
-    return site_instance_.get();
-  }
+  SiteInstance* GetSiteInstance() { return site_instance_.get(); }
 
   FrameTreeNode* frame_tree_node() const { return frame_tree_node_; }
 
@@ -201,6 +195,6 @@ class RenderFrameProxyHost : public IPC::Listener,
   DISALLOW_COPY_AND_ASSIGN(RenderFrameProxyHost);
 };
 
-}  // namespace
+}  // namespace content
 
 #endif  // CONTENT_BROWSER_FRAME_HOST_RENDER_FRAME_PROXY_HOST_H_
diff --git a/chromium/content/browser/frame_host/render_widget_host_view_guest.cc b/chromium/content/browser/frame_host/render_widget_host_view_guest.cc
index 9d94d90b656..5d4752e1d80 100644
--- a/chromium/content/browser/frame_host/render_widget_host_view_guest.cc
+++ b/chromium/content/browser/frame_host/render_widget_host_view_guest.cc
@@ -125,8 +125,7 @@ bool RenderWidgetHostViewGuest::OnMessageReceivedFromEmbedder(
     const IPC::Message& message,
     RenderWidgetHostImpl* embedder) {
   bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(RenderWidgetHostViewGuest, message,
-                                   embedder)
+  IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(RenderWidgetHostViewGuest, message, embedder)
     IPC_MESSAGE_HANDLER(BrowserPluginHostMsg_HandleInputEvent,
                         OnHandleInputEvent)
     IPC_MESSAGE_UNHANDLED(handled = false)
@@ -161,11 +160,8 @@ void RenderWidgetHostViewGuest::Hide() {
   host()->WasHidden();
 }
 
-void RenderWidgetHostViewGuest::SetSize(const gfx::Size& size) {
-}
-
-void RenderWidgetHostViewGuest::SetBounds(const gfx::Rect& rect) {
-}
+void RenderWidgetHostViewGuest::SetSize(const gfx::Size& size) {}
+void RenderWidgetHostViewGuest::SetBounds(const gfx::Rect& rect) {}
 
 void RenderWidgetHostViewGuest::Focus() {
   // InterstitialPageImpl focuses views directly, so we place focus logic here.
@@ -331,14 +327,14 @@ RenderWidgetHostViewBase* RenderWidgetHostViewGuest::GetRootView() {
   return GetRootView(this);
 }
 
-void RenderWidgetHostViewGuest::InitAsChild(
-    gfx::NativeView parent_view) {
+void RenderWidgetHostViewGuest::InitAsChild(gfx::NativeView parent_view) {
   // This should never get called.
   NOTREACHED();
 }
 
 void RenderWidgetHostViewGuest::InitAsPopup(
-    RenderWidgetHostView* parent_host_view, const gfx::Rect& bounds) {
+    RenderWidgetHostView* parent_host_view,
+    const gfx::Rect& bounds) {
   // This should never get called.
   NOTREACHED();
 }
@@ -429,9 +425,9 @@ void RenderWidgetHostViewGuest::ImeCompositionRangeChanged(
     return;
   std::vector<gfx::Rect> guest_character_bounds;
   for (size_t i = 0; i < character_bounds.size(); ++i) {
-    guest_character_bounds.push_back(gfx::Rect(
-        guest_->GetScreenCoordinates(character_bounds[i].origin()),
-        character_bounds[i].size()));
+    guest_character_bounds.push_back(
+        gfx::Rect(guest_->GetScreenCoordinates(character_bounds[i].origin()),
+                  character_bounds[i].size()));
   }
   // Forward the information to embedding RWHV.
   rwhv->ImeCompositionRangeChanged(range, guest_character_bounds);
diff --git a/chromium/content/browser/frame_host/render_widget_host_view_guest.h b/chromium/content/browser/frame_host/render_widget_host_view_guest.h
index 910b3398915..ab8506afd86 100644
--- a/chromium/content/browser/frame_host/render_widget_host_view_guest.h
+++ b/chromium/content/browser/frame_host/render_widget_host_view_guest.h
@@ -24,7 +24,12 @@
 #include "ui/gfx/geometry/vector2d_f.h"
 #include "ui/gfx/native_widget_types.h"
 
+namespace IPC {
+class Message;
+}  // namespace IPC
+
 namespace content {
+
 class BrowserPluginGuest;
 class RenderWidgetHost;
 class RenderWidgetHostImpl;
diff --git a/chromium/content/browser/frame_host/render_widget_host_view_guest_unittest.cc b/chromium/content/browser/frame_host/render_widget_host_view_guest_unittest.cc
index bcf22d526ab..c7d01bfc320 100644
--- a/chromium/content/browser/frame_host/render_widget_host_view_guest_unittest.cc
+++ b/chromium/content/browser/frame_host/render_widget_host_view_guest_unittest.cc
@@ -32,6 +32,7 @@
 #include "content/test/mock_widget_impl.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/compositor/compositor.h"
@@ -52,8 +53,9 @@ class RenderWidgetHostViewGuestTest : public testing::Test {
     MockRenderProcessHost* process_host =
         new MockRenderProcessHost(browser_context_.get());
     int32_t routing_id = process_host->GetNextRoutingID();
-    mojom::WidgetPtr widget;
-    widget_impl_ = std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+    mojo::PendingRemote<mojom::Widget> widget;
+    widget_impl_ = std::make_unique<MockWidgetImpl>(
+        widget.InitWithNewPipeAndPassReceiver());
 
     widget_host_ = new RenderWidgetHostImpl(
         &delegate_, process_host, routing_id, std::move(widget), false);
@@ -118,8 +120,7 @@ class TestBrowserPluginGuest : public BrowserPluginGuest {
 
 // TODO(wjmaclean): we should restructure RenderWidgetHostViewChildFrameTest to
 // look more like this one, and then this one could be derived from it.
-class RenderWidgetHostViewGuestSurfaceTest
-    : public testing::Test {
+class RenderWidgetHostViewGuestSurfaceTest : public testing::Test {
  public:
   RenderWidgetHostViewGuestSurfaceTest()
       : widget_host_(nullptr), view_(nullptr) {}
@@ -138,8 +139,9 @@ class RenderWidgetHostViewGuestSurfaceTest
         web_contents_.get(), &browser_plugin_guest_delegate_);
 
     int32_t routing_id = process_host->GetNextRoutingID();
-    mojom::WidgetPtr widget;
-    widget_impl_ = std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+    mojo::PendingRemote<mojom::Widget> widget;
+    widget_impl_ = std::make_unique<MockWidgetImpl>(
+        widget.InitWithNewPipeAndPassReceiver());
 
     widget_host_ = new RenderWidgetHostImpl(
         &delegate_, process_host, routing_id, std::move(widget), false);
@@ -184,7 +186,8 @@ class RenderWidgetHostViewGuestSurfaceTest
   RenderWidgetHostViewGuest* view_;
 
  private:
-  viz::mojom::CompositorFrameSinkClientPtr renderer_compositor_frame_sink_ptr_;
+  mojo::Remote<viz::mojom::CompositorFrameSinkClient>
+      renderer_compositor_frame_sink_remote_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewGuestSurfaceTest);
 };
diff --git a/chromium/content/browser/frame_host/sec_fetch_browsertest.cc b/chromium/content/browser/frame_host/sec_fetch_browsertest.cc
index fc809563b89..976fae5da04 100644
--- a/chromium/content/browser/frame_host/sec_fetch_browsertest.cc
+++ b/chromium/content/browser/frame_host/sec_fetch_browsertest.cc
@@ -31,18 +31,18 @@ namespace content {
 class SecFetchBrowserTest : public ContentBrowserTest {
  public:
   SecFetchBrowserTest()
-      : https_test_server_(net::EmbeddedTestServer::TYPE_HTTPS) {}
+      : https_test_server_(net::EmbeddedTestServer::TYPE_HTTPS) {
+    feature_list_.InitWithFeatures(
+        {network::features::kFetchMetadata,
+         network::features::kFetchMetadataDestination},
+        {});
+  }
 
   void SetUpOnMainThread() override {
     host_resolver()->AddRule("*", "127.0.0.1");
     https_test_server_.AddDefaultHandlers(GetTestDataFilePath());
     https_test_server_.SetSSLConfig(net::EmbeddedTestServer::CERT_OK);
     ASSERT_TRUE(https_test_server_.Start());
-
-    feature_list_.InitWithFeatures(
-        {network::features::kFetchMetadata,
-         network::features::kFetchMetadataDestination},
-        {});
   }
 
   WebContents* web_contents() { return shell()->web_contents(); }
diff --git a/chromium/content/browser/frame_host/webui_navigation_throttle.cc b/chromium/content/browser/frame_host/webui_navigation_throttle.cc
index 90c03d6fe34..c28ea136168 100644
--- a/chromium/content/browser/frame_host/webui_navigation_throttle.cc
+++ b/chromium/content/browser/frame_host/webui_navigation_throttle.cc
@@ -6,7 +6,7 @@
 
 #include "base/command_line.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/common/content_switches.h"
@@ -47,11 +47,10 @@ WebUINavigationThrottle::CreateThrottleForNavigation(
   if (navigation_handle->IsInMainFrame())
     return nullptr;
 
-  RenderFrameHostImpl* parent =
-      static_cast<NavigationHandleImpl*>(navigation_handle)
-          ->frame_tree_node()
-          ->parent()
-          ->current_frame_host();
+  RenderFrameHostImpl* parent = NavigationRequest::From(navigation_handle)
+                                    ->frame_tree_node()
+                                    ->parent()
+                                    ->current_frame_host();
 
   // Throttle if the renderer process has WebUI bindings, or if the parent frame
   // is on a WebUI page.
diff --git a/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc b/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc
index 43c72da1bd8..aa6ecda6048 100644
--- a/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc
+++ b/chromium/content/browser/generic_sensor/generic_sensor_browsertest.cc
@@ -19,8 +19,7 @@
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_javascript_dialog_manager.h"
 #include "device/base/synchronization/one_writer_seqlock.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/buffer.h"
 #include "net/dns/mock_host_resolver.h"
 #include "services/device/public/cpp/device_features.h"
@@ -51,7 +50,7 @@ class GenericSensorBrowserTest : public ContentBrowserTest {
     service_manager::ServiceBinding::OverrideInterfaceBinderForTesting(
         device::mojom::kServiceName,
         base::BindRepeating(
-            &GenericSensorBrowserTest::BindSensorProviderRequest,
+            &GenericSensorBrowserTest::BindSensorProviderReceiver,
             base::Unretained(this)));
   }
 
@@ -78,7 +77,8 @@ class GenericSensorBrowserTest : public ContentBrowserTest {
     command_line->AppendSwitch(switches::kIgnoreCertificateErrors);
   }
 
-  void BindSensorProviderRequest(device::mojom::SensorProviderRequest request) {
+  void BindSensorProviderReceiver(
+      mojo::PendingReceiver<device::mojom::SensorProvider> receiver) {
     if (!sensor_provider_available_)
       return;
 
@@ -87,7 +87,7 @@ class GenericSensorBrowserTest : public ContentBrowserTest {
       fake_sensor_provider_->SetAmbientLightSensorData(50);
     }
 
-    fake_sensor_provider_->Bind(std::move(request));
+    fake_sensor_provider_->Bind(std::move(receiver));
   }
 
   void set_sensor_provider_available(bool sensor_provider_available) {
diff --git a/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc b/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc
index 7bcfa2e1bb7..ecb2498b16e 100644
--- a/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc
+++ b/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.cc
@@ -38,8 +38,8 @@ SensorProviderProxyImpl::SensorProviderProxyImpl(
 SensorProviderProxyImpl::~SensorProviderProxyImpl() = default;
 
 void SensorProviderProxyImpl::Bind(
-    device::mojom::SensorProviderRequest request) {
-  binding_set_.AddBinding(this, std::move(request));
+    mojo::PendingReceiver<device::mojom::SensorProvider> receiver) {
+  receiver_set_.Add(this, std::move(receiver));
 }
 
 void SensorProviderProxyImpl::GetSensor(SensorType type,
@@ -57,9 +57,9 @@ void SensorProviderProxyImpl::GetSensor(SensorType type,
       return;
     }
 
-    connector->BindInterface(device::mojom::kServiceName,
-                             mojo::MakeRequest(&sensor_provider_));
-    sensor_provider_.set_connection_error_handler(base::BindOnce(
+    connector->Connect(device::mojom::kServiceName,
+                       sensor_provider_.BindNewPipeAndPassReceiver());
+    sensor_provider_.set_disconnect_handler(base::BindOnce(
         &SensorProviderProxyImpl::OnConnectionError, base::Unretained(this)));
   }
 
@@ -126,9 +126,9 @@ bool SensorProviderProxyImpl::CheckFeaturePolicies(SensorType type) const {
 }
 
 void SensorProviderProxyImpl::OnConnectionError() {
-  // Close all the upstream bindings to notify them of this failure as the
+  // Close all the bindings to notify them of this failure as the
   // GetSensorCallbacks will never be called.
-  binding_set_.CloseAllBindings();
+  receiver_set_.Clear();
   sensor_provider_.reset();
 }
 
diff --git a/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.h b/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.h
index dc481221fff..68494f69115 100644
--- a/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.h
+++ b/chromium/content/browser/generic_sensor/sensor_provider_proxy_impl.h
@@ -7,7 +7,9 @@
 
 #include "base/memory/weak_ptr.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/device/public/mojom/sensor_provider.mojom.h"
 #include "third_party/blink/public/mojom/permissions/permission_status.mojom.h"
 
@@ -25,7 +27,7 @@ class SensorProviderProxyImpl final : public device::mojom::SensorProvider {
                           RenderFrameHost* render_frame_host);
   ~SensorProviderProxyImpl() override;
 
-  void Bind(device::mojom::SensorProviderRequest request);
+  void Bind(mojo::PendingReceiver<device::mojom::SensorProvider> receiver);
 
  private:
   // SensorProvider implementation.
@@ -38,10 +40,10 @@ class SensorProviderProxyImpl final : public device::mojom::SensorProvider {
                                     blink::mojom::PermissionStatus);
   void OnConnectionError();
 
-  mojo::BindingSet<device::mojom::SensorProvider> binding_set_;
+  mojo::ReceiverSet<device::mojom::SensorProvider> receiver_set_;
   PermissionControllerImpl* permission_controller_;
   RenderFrameHost* render_frame_host_;
-  device::mojom::SensorProviderPtr sensor_provider_;
+  mojo::Remote<device::mojom::SensorProvider> sensor_provider_;
 
   base::WeakPtrFactory<SensorProviderProxyImpl> weak_factory_{this};
 
diff --git a/chromium/content/browser/geolocation/geolocation_service_impl.cc b/chromium/content/browser/geolocation/geolocation_service_impl.cc
index 42b9a4d6e07..67b32637c6a 100644
--- a/chromium/content/browser/geolocation/geolocation_service_impl.cc
+++ b/chromium/content/browser/geolocation/geolocation_service_impl.cc
@@ -24,7 +24,7 @@ GeolocationServiceImplContext::~GeolocationServiceImplContext() {
 void GeolocationServiceImplContext::RequestPermission(
     RenderFrameHost* render_frame_host,
     bool user_gesture,
-    const base::Callback<void(blink::mojom::PermissionStatus)>& callback) {
+    base::OnceCallback<void(blink::mojom::PermissionStatus)> callback) {
   if (request_id_ != PermissionController::kNoPendingOperation) {
     mojo::ReportBadMessage(
         "GeolocationService client may only create one Geolocation at a "
@@ -35,15 +35,15 @@ void GeolocationServiceImplContext::RequestPermission(
   request_id_ = permission_controller_->RequestPermission(
       PermissionType::GEOLOCATION, render_frame_host,
       render_frame_host->GetLastCommittedOrigin().GetURL(), user_gesture,
-      base::Bind(&GeolocationServiceImplContext::HandlePermissionStatus,
-                 weak_factory_.GetWeakPtr(), std::move(callback)));
+      base::BindOnce(&GeolocationServiceImplContext::HandlePermissionStatus,
+                     weak_factory_.GetWeakPtr(), std::move(callback)));
 }
 
 void GeolocationServiceImplContext::HandlePermissionStatus(
-    const base::Callback<void(blink::mojom::PermissionStatus)>& callback,
+    base::OnceCallback<void(blink::mojom::PermissionStatus)> callback,
     blink::mojom::PermissionStatus permission_status) {
   request_id_ = PermissionController::kNoPendingOperation;
-  callback.Run(permission_status);
+  std::move(callback).Run(permission_status);
 }
 
 GeolocationServiceImpl::GeolocationServiceImpl(
@@ -86,9 +86,10 @@ void GeolocationServiceImpl::CreateGeolocation(
       render_frame_host_, user_gesture,
       // There is an assumption here that the GeolocationServiceImplContext will
       // outlive the GeolocationServiceImpl.
-      base::Bind(&GeolocationServiceImpl::CreateGeolocationWithPermissionStatus,
-                 base::Unretained(this), base::Passed(&receiver),
-                 base::Passed(&scoped_callback)));
+      base::BindOnce(
+          &GeolocationServiceImpl::CreateGeolocationWithPermissionStatus,
+          base::Unretained(this), base::Passed(&receiver),
+          base::Passed(&scoped_callback)));
 }
 
 void GeolocationServiceImpl::CreateGeolocationWithPermissionStatus(
diff --git a/chromium/content/browser/geolocation/geolocation_service_impl.h b/chromium/content/browser/geolocation/geolocation_service_impl.h
index d737f1da802..840bc6bbc7a 100644
--- a/chromium/content/browser/geolocation/geolocation_service_impl.h
+++ b/chromium/content/browser/geolocation/geolocation_service_impl.h
@@ -30,14 +30,14 @@ class GeolocationServiceImplContext {
   void RequestPermission(
       RenderFrameHost* render_frame_host,
       bool user_gesture,
-      const base::Callback<void(blink::mojom::PermissionStatus)>& callback);
+      base::OnceCallback<void(blink::mojom::PermissionStatus)> callback);
 
  private:
   PermissionControllerImpl* permission_controller_;
   int request_id_;
 
   void HandlePermissionStatus(
-      const base::Callback<void(blink::mojom::PermissionStatus)>& callback,
+      base::OnceCallback<void(blink::mojom::PermissionStatus)> callback,
       blink::mojom::PermissionStatus permission_status);
 
   base::WeakPtrFactory<GeolocationServiceImplContext> weak_factory_{this};
diff --git a/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc b/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc
index 9f29a84c215..45804e581c1 100644
--- a/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc
+++ b/chromium/content/browser/geolocation/geolocation_service_impl_unittest.cc
@@ -16,6 +16,7 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_service_manager_context.h"
 #include "content/test/test_render_frame_host.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/device/public/cpp/test/scoped_geolocation_overrider.h"
 #include "services/device/public/mojom/constants.mojom.h"
 #include "services/device/public/mojom/geolocation.mojom.h"
@@ -26,11 +27,11 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
-using blink::mojom::PermissionStatus;
-using device::mojom::GeolocationPtr;
-using device::mojom::GeopositionPtr;
 using blink::mojom::GeolocationService;
 using blink::mojom::GeolocationServicePtr;
+using blink::mojom::PermissionStatus;
+using device::mojom::Geolocation;
+using device::mojom::GeopositionPtr;
 
 namespace content {
 namespace {
@@ -91,12 +92,12 @@ class GeolocationServiceTest : public RenderViewHostImplTestHarness {
     geolocation_overrider_ =
         std::make_unique<device::ScopedGeolocationOverrider>(kMockLatitude,
                                                              kMockLongitude);
-    GetSystemConnector()->BindInterface(device::mojom::kServiceName,
-                                        mojo::MakeRequest(&context_ptr_));
+    GetSystemConnector()->Connect(device::mojom::kServiceName,
+                                  context_.BindNewPipeAndPassReceiver());
   }
 
   void TearDown() override {
-    context_ptr_.reset();
+    context_.reset();
     geolocation_overrider_.reset();
     service_manager_context_.reset();
     browser_context_.reset();
@@ -119,7 +120,7 @@ class GeolocationServiceTest : public RenderViewHostImplTestHarness {
     embedded_rfh = navigation_simulator->GetFinalRenderFrameHost();
 
     service_.reset(new GeolocationServiceImpl(
-        context_ptr_.get(), permission_controller_.get(), embedded_rfh));
+        context_.get(), permission_controller_.get(), embedded_rfh));
     service_->Bind(mojo::MakeRequest(&service_ptr_));
   }
 
@@ -142,7 +143,7 @@ class GeolocationServiceTest : public RenderViewHostImplTestHarness {
   std::unique_ptr<PermissionControllerImpl> permission_controller_;
   std::unique_ptr<GeolocationServiceImpl> service_;
   GeolocationServicePtr service_ptr_;
-  device::mojom::GeolocationContextPtr context_ptr_;
+  mojo::Remote<device::mojom::GeolocationContext> context_;
 
   DISALLOW_COPY_AND_ASSIGN(GeolocationServiceTest);
 };
@@ -150,22 +151,22 @@ class GeolocationServiceTest : public RenderViewHostImplTestHarness {
 }  // namespace
 
 TEST_F(GeolocationServiceTest, PermissionGrantedPolicyViolation) {
-  // The embedded frame is not whitelisted.
+  // The embedded frame is not allowed.
   CreateEmbeddedFrameAndGeolocationService(/*allow_via_feature_policy=*/false);
 
   permission_manager()->SetRequestCallback(
       base::BindRepeating([](PermissionCallback callback) {
         ADD_FAILURE() << "Permissions checked unexpectedly.";
       }));
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::DENIED, status);
       }));
 
   base::RunLoop loop;
-  geolocation.set_connection_error_handler(loop.QuitClosure());
+  geolocation.set_disconnect_handler(loop.QuitClosure());
 
   geolocation->QueryNextPosition(base::BindOnce([](GeopositionPtr geoposition) {
     ADD_FAILURE() << "Position updated unexpectedly";
@@ -174,22 +175,22 @@ TEST_F(GeolocationServiceTest, PermissionGrantedPolicyViolation) {
 }
 
 TEST_F(GeolocationServiceTest, PermissionGrantedNoPolicyViolation) {
-  // Whitelist the embedded frame.
+  // Allow the embedded frame.
   CreateEmbeddedFrameAndGeolocationService(/*allow_via_feature_policy=*/true);
 
   permission_manager()->SetRequestCallback(
       base::BindRepeating([](PermissionCallback callback) {
         std::move(callback).Run(PermissionStatus::GRANTED);
       }));
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::GRANTED, status);
       }));
 
   base::RunLoop loop;
-  geolocation.set_connection_error_handler(base::BindOnce(
+  geolocation.set_disconnect_handler(base::BindOnce(
       [] { ADD_FAILURE() << "Connection error handler called unexpectedly"; }));
 
   geolocation->QueryNextPosition(base::BindOnce(
@@ -208,15 +209,15 @@ TEST_F(GeolocationServiceTest, PermissionGrantedSync) {
       base::BindRepeating([](PermissionCallback callback) {
         std::move(callback).Run(PermissionStatus::GRANTED);
       }));
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::GRANTED, status);
       }));
 
   base::RunLoop loop;
-  geolocation.set_connection_error_handler(base::BindOnce(
+  geolocation.set_disconnect_handler(base::BindOnce(
       [] { ADD_FAILURE() << "Connection error handler called unexpectedly"; }));
 
   geolocation->QueryNextPosition(base::BindOnce(
@@ -235,15 +236,15 @@ TEST_F(GeolocationServiceTest, PermissionDeniedSync) {
       base::BindRepeating([](PermissionCallback callback) {
         std::move(callback).Run(PermissionStatus::DENIED);
       }));
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::DENIED, status);
       }));
 
   base::RunLoop loop;
-  geolocation.set_connection_error_handler(loop.QuitClosure());
+  geolocation.set_disconnect_handler(loop.QuitClosure());
 
   geolocation->QueryNextPosition(base::BindOnce([](GeopositionPtr geoposition) {
     ADD_FAILURE() << "Position updated unexpectedly";
@@ -260,15 +261,15 @@ TEST_F(GeolocationServiceTest, PermissionGrantedAsync) {
             FROM_HERE, base::BindOnce(std::move(permission_callback),
                                       PermissionStatus::GRANTED));
       }));
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::GRANTED, status);
       }));
 
   base::RunLoop loop;
-  geolocation.set_connection_error_handler(base::BindOnce(
+  geolocation.set_disconnect_handler(base::BindOnce(
       [] { ADD_FAILURE() << "Connection error handler called unexpectedly"; }));
 
   geolocation->QueryNextPosition(base::BindOnce(
@@ -290,15 +291,15 @@ TEST_F(GeolocationServiceTest, PermissionDeniedAsync) {
             FROM_HERE, base::BindOnce(std::move(permission_callback),
                                       PermissionStatus::DENIED));
       }));
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus status) {
         EXPECT_EQ(blink::mojom::PermissionStatus::DENIED, status);
       }));
 
   base::RunLoop loop;
-  geolocation.set_connection_error_handler(loop.QuitClosure());
+  geolocation.set_disconnect_handler(loop.QuitClosure());
 
   geolocation->QueryNextPosition(base::BindOnce([](GeopositionPtr geoposition) {
     ADD_FAILURE() << "Position updated unexpectedly";
@@ -309,9 +310,9 @@ TEST_F(GeolocationServiceTest, PermissionDeniedAsync) {
 TEST_F(GeolocationServiceTest, ServiceClosedBeforePermissionResponse) {
   CreateEmbeddedFrameAndGeolocationService(/*allow_via_feature_policy=*/true);
   permission_manager()->SetRequestId(42);
-  GeolocationPtr geolocation;
+  mojo::Remote<Geolocation> geolocation;
   service()->CreateGeolocation(
-      mojo::MakeRequest(&geolocation), true,
+      geolocation.BindNewPipeAndPassReceiver(), true,
       base::BindRepeating([](blink::mojom::PermissionStatus) {
         ADD_FAILURE() << "PositionStatus received unexpectedly.";
       }));
diff --git a/chromium/content/browser/gpu/browser_gpu_channel_host_factory.cc b/chromium/content/browser/gpu/browser_gpu_channel_host_factory.cc
index 4666b18c911..fb67fb43c61 100644
--- a/chromium/content/browser/gpu/browser_gpu_channel_host_factory.cc
+++ b/chromium/content/browser/gpu/browser_gpu_channel_host_factory.cc
@@ -273,10 +273,9 @@ BrowserGpuChannelHostFactory::BrowserGpuChannelHostFactory()
               gpu_client_id_, cache_dir));
     }
 
-    bool use_gr_shader_cache =
-        base::FeatureList::IsEnabled(
-            features::kDefaultEnableOopRasterization) ||
-        base::FeatureList::IsEnabled(features::kUseSkiaRenderer);
+    bool use_gr_shader_cache = base::FeatureList::IsEnabled(
+                                   features::kDefaultEnableOopRasterization) ||
+                               features::IsUsingSkiaRenderer();
     if (use_gr_shader_cache) {
       base::FilePath gr_cache_dir =
           GetContentClient()->browser()->GetGrShaderDiskCacheDirectory();
diff --git a/chromium/content/browser/gpu/chromeos/delegate_to_browser_gpu_service_accelerator_factory.cc b/chromium/content/browser/gpu/chromeos/delegate_to_browser_gpu_service_accelerator_factory.cc
index 3277721e09c..a670024409f 100644
--- a/chromium/content/browser/gpu/chromeos/delegate_to_browser_gpu_service_accelerator_factory.cc
+++ b/chromium/content/browser/gpu/chromeos/delegate_to_browser_gpu_service_accelerator_factory.cc
@@ -9,8 +9,10 @@
 namespace content {
 
 void DelegateToBrowserGpuServiceAcceleratorFactory::CreateJpegDecodeAccelerator(
-    chromeos_camera::mojom::MjpegDecodeAcceleratorRequest jda_request) {
-  VideoCaptureDependencies::CreateJpegDecodeAccelerator(std::move(jda_request));
+    mojo::PendingReceiver<chromeos_camera::mojom::MjpegDecodeAccelerator>
+        jda_receiver) {
+  VideoCaptureDependencies::CreateJpegDecodeAccelerator(
+      std::move(jda_receiver));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/gpu/chromeos/video_capture_dependencies.cc b/chromium/content/browser/gpu/chromeos/video_capture_dependencies.cc
index e941ce73174..d98be022de4 100644
--- a/chromium/content/browser/gpu/chromeos/video_capture_dependencies.cc
+++ b/chromium/content/browser/gpu/chromeos/video_capture_dependencies.cc
@@ -14,7 +14,8 @@ namespace content {
 
 // static
 void VideoCaptureDependencies::CreateJpegDecodeAccelerator(
-    chromeos_camera::mojom::MjpegDecodeAcceleratorRequest accelerator) {
+    mojo::PendingReceiver<chromeos_camera::mojom::MjpegDecodeAccelerator>
+        accelerator) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     base::PostTask(
         FROM_HERE, {BrowserThread::IO},
@@ -35,7 +36,8 @@ void VideoCaptureDependencies::CreateJpegDecodeAccelerator(
 #if defined(OS_CHROMEOS)
 // static
 void VideoCaptureDependencies::CreateJpegEncodeAccelerator(
-    chromeos_camera::mojom::JpegEncodeAcceleratorRequest accelerator) {
+    mojo::PendingReceiver<chromeos_camera::mojom::JpegEncodeAccelerator>
+        accelerator) {
   if (!BrowserThread::CurrentlyOn(BrowserThread::IO)) {
     base::PostTask(
         FROM_HERE, {BrowserThread::IO},
diff --git a/chromium/content/browser/gpu/chromeos/video_capture_dependencies.h b/chromium/content/browser/gpu/chromeos/video_capture_dependencies.h
index 4848c9f0679..b93e36996e6 100644
--- a/chromium/content/browser/gpu/chromeos/video_capture_dependencies.h
+++ b/chromium/content/browser/gpu/chromeos/video_capture_dependencies.h
@@ -6,6 +6,7 @@
 #define CONTENT_BROWSER_GPU_CHROMEOS_VIDEO_CAPTURE_DEPENDENCIES_H_
 
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/viz/privileged/mojom/gl/gpu_service.mojom.h"
 
 namespace content {
@@ -14,9 +15,11 @@ namespace content {
 class CONTENT_EXPORT VideoCaptureDependencies {
  public:
   static void CreateJpegDecodeAccelerator(
-      chromeos_camera::mojom::MjpegDecodeAcceleratorRequest accelerator);
+      mojo::PendingReceiver<chromeos_camera::mojom::MjpegDecodeAccelerator>
+          accelerator);
   static void CreateJpegEncodeAccelerator(
-      chromeos_camera::mojom::JpegEncodeAcceleratorRequest accelerator);
+      mojo::PendingReceiver<chromeos_camera::mojom::JpegEncodeAccelerator>
+          accelerator);
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/gpu/compositor_util.cc b/chromium/content/browser/gpu/compositor_util.cc
index 47598e84da6..069bb6e737f 100644
--- a/chromium/content/browser/gpu/compositor_util.cc
+++ b/chromium/content/browser/gpu/compositor_util.cc
@@ -27,13 +27,15 @@
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "gpu/config/gpu_blacklist.h"
+#include "gpu/command_buffer/service/gpu_switches.h"
+#include "gpu/config/gpu_blocklist.h"
 #include "gpu/config/gpu_driver_bug_list.h"
 #include "gpu/config/gpu_driver_bug_workaround_type.h"
 #include "gpu/config/gpu_feature_type.h"
 #include "gpu/config/gpu_finch_features.h"
 #include "gpu/config/gpu_switches.h"
 #include "gpu/ipc/host/gpu_memory_buffer_support.h"
+#include "gpu/vulkan/buildflags.h"
 #include "media/media_buildflags.h"
 #include "ui/gl/gl_switches.h"
 
@@ -180,6 +182,13 @@ const GpuFeatureData GetGpuFeatureData(
      !base::FeatureList::IsEnabled(features::kMetal) /* disabled */,
      DisableInfo::NotProblem(), false /* fallback_to_software */},
 #endif
+#if BUILDFLAG(ENABLE_VULKAN)
+    {"vulkan",
+     SafeGetFeatureStatus(gpu_feature_info, gpu::GPU_FEATURE_TYPE_VULKAN),
+     !base::FeatureList::IsEnabled(features::kVulkan) &&
+         !command_line.HasSwitch(switches::kUseVulkan) /* disabled */,
+     DisableInfo::NotProblem(), false /* fallback_to_software */},
+#endif
     {"multiple_raster_threads", gpu::kGpuFeatureStatusEnabled,
      NumberOfRendererRasterThreads() == 1,
      DisableInfo::Problem("Raster is using a single thread."), false},
@@ -267,6 +276,7 @@ std::unique_ptr<base::DictionaryValue> GetFeatureStatusImpl(
         status += "_on";
       }
       if (gpu_feature_data.name == "metal" ||
+          gpu_feature_data.name == "vulkan" ||
           gpu_feature_data.name == "surface_control") {
         status += "_on";
       }
@@ -288,7 +298,7 @@ std::unique_ptr<base::ListValue> GetProblemsImpl(GpuFeatureInfoType type) {
 
   auto problem_list = std::make_unique<base::ListValue>();
   if (!gpu_feature_info.applied_gpu_blacklist_entries.empty()) {
-    std::unique_ptr<gpu::GpuBlacklist> blacklist(gpu::GpuBlacklist::Create());
+    std::unique_ptr<gpu::GpuBlocklist> blacklist(gpu::GpuBlocklist::Create());
     blacklist->GetReasons(problem_list.get(), "disabledFeatures",
                           gpu_feature_info.applied_gpu_blacklist_entries);
   }
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl.cc b/chromium/content/browser/gpu/gpu_data_manager_impl.cc
index 3a735b1ac14..ee0a185cf30 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl.cc
@@ -35,9 +35,11 @@ bool GpuDataManagerImpl::GpuAccessAllowed(std::string* reason) {
   return private_->GpuAccessAllowed(reason);
 }
 
-void GpuDataManagerImpl::RequestCompleteGpuInfoIfNeeded() {
+void GpuDataManagerImpl::RequestDxdiagDx12VulkanGpuInfoIfNeeded(
+    GpuInfoRequest request,
+    bool delayed) {
   base::AutoLock auto_lock(lock_);
-  private_->RequestCompleteGpuInfoIfNeeded();
+  private_->RequestDxdiagDx12VulkanGpuInfoIfNeeded(request, delayed);
 }
 
 bool GpuDataManagerImpl::IsEssentialGpuInfoAvailable() {
@@ -95,11 +97,6 @@ void GpuDataManagerImpl::AppendGpuCommandLine(base::CommandLine* command_line,
   private_->AppendGpuCommandLine(command_line, kind);
 }
 
-void GpuDataManagerImpl::RequestGpuSupportedRuntimeVersion(bool delayed) const {
-  base::AutoLock auto_lock(lock_);
-  private_->RequestGpuSupportedRuntimeVersion(delayed);
-}
-
 bool GpuDataManagerImpl::GpuProcessStartAllowed() const {
   base::AutoLock auto_lock(lock_);
   return private_->GpuProcessStartAllowed();
@@ -125,10 +122,20 @@ void GpuDataManagerImpl::UpdateDx12VulkanInfo(
   private_->UpdateDx12VulkanInfo(dx12_vulkan_version_info);
 }
 
+void GpuDataManagerImpl::UpdateDxDiagNodeRequestStatus(bool request_continues) {
+  base::AutoLock auto_lock(lock_);
+  private_->UpdateDxDiagNodeRequestStatus(request_continues);
+}
+
 void GpuDataManagerImpl::UpdateDx12VulkanRequestStatus(bool request_continues) {
   base::AutoLock auto_lock(lock_);
   private_->UpdateDx12VulkanRequestStatus(request_continues);
 }
+
+bool GpuDataManagerImpl::Dx12VulkanRequested() const {
+  base::AutoLock auto_lock(lock_);
+  return private_->Dx12VulkanRequested();
+}
 #endif
 
 void GpuDataManagerImpl::UpdateGpuFeatureInfo(
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl.h b/chromium/content/browser/gpu/gpu_data_manager_impl.h
index 08f29a16c7d..9c20ae8a2ef 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl.h
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl.h
@@ -49,7 +49,8 @@ class CONTENT_EXPORT GpuDataManagerImpl : public GpuDataManager {
   void BlacklistWebGLForTesting() override;
   gpu::GPUInfo GetGPUInfo() override;
   bool GpuAccessAllowed(std::string* reason) override;
-  void RequestCompleteGpuInfoIfNeeded() override;
+  void RequestDxdiagDx12VulkanGpuInfoIfNeeded(GpuInfoRequest request,
+                                              bool delayed) override;
   bool IsEssentialGpuInfoAvailable() override;
   void RequestVideoMemoryUsageStatsUpdate(
       VideoMemoryUsageStatsCallback callback) override;
@@ -65,7 +66,6 @@ class CONTENT_EXPORT GpuDataManagerImpl : public GpuDataManager {
   void AppendGpuCommandLine(base::CommandLine* command_line,
                             GpuProcessKind kind) override;
 
-  void RequestGpuSupportedRuntimeVersion(bool delayed) const;
   bool GpuProcessStartAllowed() const;
 
   bool IsDx12VulkanVersionAvailable() const;
@@ -76,10 +76,12 @@ class CONTENT_EXPORT GpuDataManagerImpl : public GpuDataManager {
       const gpu::GPUInfo& gpu_info,
       const base::Optional<gpu::GPUInfo>& gpu_info_for_hardware_gpu);
 #if defined(OS_WIN)
+  void UpdateDxDiagNode(const gpu::DxDiagNode& dx_diagnostics);
   void UpdateDx12VulkanInfo(
       const gpu::Dx12VulkanVersionInfo& dx12_vulkan_version_info);
-  void UpdateDxDiagNode(const gpu::DxDiagNode& dx_diagnostics);
+  void UpdateDxDiagNodeRequestStatus(bool request_continues);
   void UpdateDx12VulkanRequestStatus(bool request_continues);
+  bool Dx12VulkanRequested() const;
 #endif
   // Update the GPU feature info. This updates the blacklist and enabled status
   // of GPU rasterization. In the future this will be used for more features.
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc b/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
index ad38e4480f8..610171043a4 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl_private.cc
@@ -12,10 +12,12 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/command_line.h"
+#include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/metrics/field_trial.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
+#include "base/rand_util.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/task/post_task.h"
@@ -35,7 +37,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "gpu/command_buffer/service/gpu_switches.h"
-#include "gpu/config/gpu_blacklist.h"
+#include "gpu/config/gpu_blocklist.h"
 #include "gpu/config/gpu_driver_bug_list.h"
 #include "gpu/config/gpu_driver_bug_workaround_type.h"
 #include "gpu/config/gpu_feature_info.h"
@@ -57,6 +59,9 @@
 #include "ui/gl/gl_switches.h"
 #include "ui/gl/gpu_switching_manager.h"
 
+#if defined(OS_ANDROID)
+#include "base/android/application_status_listener.h"
+#endif
 #if defined(USE_OZONE)
 #include "ui/ozone/public/ozone_platform.h"
 #endif
@@ -71,6 +76,22 @@ namespace content {
 
 namespace {
 
+#if defined(OS_ANDROID)
+// NOINLINE to ensure this function is used in crash reports.
+NOINLINE void FatalGpuProcessLaunchFailureOnBackground() {
+  if (!base::android::ApplicationStatusListener::HasVisibleActivities()) {
+    // We expect the platform to aggressively kill services when the app is
+    // backgrounded. A FATAL error creates a dialog notifying users that the
+    // app has crashed which doesn't look good. So we use SIGKILL instead. But
+    // still do a crash dump for 1% cases to make sure we're not regressing this
+    // case.
+    if (base::RandInt(1, 100) == 1)
+      base::debug::DumpWithoutCrashing();
+    kill(getpid(), SIGKILL);
+  }
+}
+#endif
+
 #if defined(OS_WIN)
 int GetGpuBlacklistHistogramValueWin(gpu::GpuFeatureStatus status) {
   // The enums are defined as:
@@ -93,7 +114,7 @@ int GetGpuBlacklistHistogramValueWin(gpu::GpuFeatureStatus status) {
 // Send UMA histograms about the enabled features and GPU properties.
 void UpdateFeatureStats(const gpu::GpuFeatureInfo& gpu_feature_info) {
   // Update applied entry stats.
-  std::unique_ptr<gpu::GpuBlacklist> blacklist(gpu::GpuBlacklist::Create());
+  std::unique_ptr<gpu::GpuBlocklist> blacklist(gpu::GpuBlocklist::Create());
   DCHECK(blacklist.get() && blacklist->max_entry_id() > 0);
   uint32_t max_entry_id = blacklist->max_entry_id();
   // Use entry 0 to capture the total number of times that data
@@ -251,36 +272,6 @@ void RequestVideoMemoryUsageStats(
       base::BindOnce(&OnVideoMemoryUsageStats, std::move(callback)));
 }
 
-#if defined(OS_WIN)
-void UpdateDxDiagNodeOnIO(const gpu::DxDiagNode& dx_diagnostics) {
-  // This function is called on the IO thread, but GPUInfo on GpuDataManagerImpl
-  // should be updated on the UI thread since it can call into functions that
-  // expect to run in the UI thread.
-  base::PostTask(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(
-          [](const gpu::DxDiagNode& dx_diagnostics) {
-            GpuDataManagerImpl::GetInstance()->UpdateDxDiagNode(dx_diagnostics);
-          },
-          dx_diagnostics));
-}
-
-void UpdateDx12VulkanInfoOnIO(
-    const gpu::Dx12VulkanVersionInfo& dx12_vulkan_version_info) {
-  // This function is called on the IO thread, but GPUInfo on GpuDataManagerImpl
-  // should be updated on the UI thread since it can call into functions that
-  // expect to run in the UI thread.
-  base::PostTask(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(
-          [](const gpu::Dx12VulkanVersionInfo& dx12_vulkan_version_info) {
-            GpuDataManagerImpl::GetInstance()->UpdateDx12VulkanInfo(
-                dx12_vulkan_version_info);
-          },
-          dx12_vulkan_version_info));
-}
-#endif
-
 // Determines if SwiftShader is available as a fallback for WebGL.
 bool SwiftShaderAllowed() {
 #if !BUILDFLAG(ENABLE_SWIFTSHADER)
@@ -390,38 +381,48 @@ bool GpuDataManagerImplPrivate::GpuProcessStartAllowed() const {
   return false;
 }
 
-void GpuDataManagerImplPrivate::RequestCompleteGpuInfoIfNeeded() {
-  if (complete_gpu_info_already_requested_)
-    return;
-  if (!NeedsCompleteGpuInfoCollection())
-    return;
+void GpuDataManagerImplPrivate::RequestDxdiagDx12VulkanGpuInfoIfNeeded(
+    GpuInfoRequest request,
+    bool delayed) {
+  if (request & kGpuInfoRequestDxDiag) {
+    // Delay is not supported in DxDiag request
+    DCHECK(!delayed);
+    RequestDxDiagNodeData();
+  }
 
+  if (request & kGpuInfoRequestDx12Vulkan)
+    RequestGpuSupportedRuntimeVersion(delayed);
+}
+
+void GpuDataManagerImplPrivate::RequestDxDiagNodeData() {
 #if defined(OS_WIN)
-  complete_gpu_info_already_requested_ = true;
-  GpuProcessHost::CallOnIO(GPU_PROCESS_KIND_UNSANDBOXED_NO_GL,
-                           true /* force_create */,
-                           base::BindOnce([](GpuProcessHost* host) {
-                             if (!host)
-                               return;
-                             host->gpu_service()->RequestCompleteGpuInfo(
-                                 base::BindOnce(&UpdateDxDiagNodeOnIO));
-                           }));
-#else
-  // NeedsCompleteGpuInfoCollection() always returns false on platforms other
-  // than Windows.
-  NOTREACHED();
+  if (gpu_info_dx_diag_requested_)
+    return;
+  gpu_info_dx_diag_requested_ = true;
+  GpuProcessHost::CallOnIO(
+      GPU_PROCESS_KIND_UNSANDBOXED_NO_GL, true /* force_create */,
+      base::BindOnce([](GpuProcessHost* host) {
+        if (!host) {
+          GpuDataManagerImpl::GetInstance()->UpdateDxDiagNodeRequestStatus(
+              false);
+          return;
+        }
+        GpuDataManagerImpl::GetInstance()->UpdateDxDiagNodeRequestStatus(true);
+        host->gpu_service()->RequestCompleteGpuInfo(
+            base::BindOnce([](const gpu::DxDiagNode& dx_diagnostics) {
+              GpuDataManagerImpl::GetInstance()->UpdateDxDiagNode(
+                  dx_diagnostics);
+            }));
+      }));
 #endif
 }
 
 void GpuDataManagerImplPrivate::RequestGpuSupportedRuntimeVersion(
     bool delayed) {
 #if defined(OS_WIN)
-  if (gpu_info_dx12_vulkan_valid_) {
-    NotifyGpuInfoUpdate();
-    return;
-  }
-
   base::OnceClosure task = base::BindOnce([]() {
+    if (GpuDataManagerImpl::GetInstance()->Dx12VulkanRequested())
+      return;
     GpuProcessHost* host = GpuProcessHost::Get(
         GPU_PROCESS_KIND_UNSANDBOXED_NO_GL, true /* force_create */);
     if (!host) {
@@ -430,20 +431,17 @@ void GpuDataManagerImplPrivate::RequestGpuSupportedRuntimeVersion(
     }
     GpuDataManagerImpl::GetInstance()->UpdateDx12VulkanRequestStatus(true);
     host->gpu_service()->GetGpuSupportedRuntimeVersion(
-        base::BindOnce(&UpdateDx12VulkanInfoOnIO));
+        base::BindOnce([](const gpu::Dx12VulkanVersionInfo& info) {
+          GpuDataManagerImpl::GetInstance()->UpdateDx12VulkanInfo(info);
+        }));
   });
 
   if (delayed) {
     base::PostDelayedTask(FROM_HERE, {BrowserThread::IO}, std::move(task),
                           base::TimeDelta::FromSeconds(120));
   } else {
-    gpu_info_dx12_vulkan_requested_ = true;
-    gpu_info_dx12_vulkan_request_failed_ = false;
     base::PostTask(FROM_HERE, {BrowserThread::IO}, std::move(task));
   }
-
-#else
-  NOTREACHED();
 #endif
 }
 
@@ -454,10 +452,11 @@ bool GpuDataManagerImplPrivate::IsEssentialGpuInfoAvailable() const {
 
 bool GpuDataManagerImplPrivate::IsDx12VulkanVersionAvailable() const {
 #if defined(OS_WIN)
-  // gpu_integration_test needs dx12/Vulkan info. If this info is needed,
-  // --no-delay-for-dx12-vulkan-info-collection should be added to the browser
-  // command line. This function returns the status of availability to the tests
-  // based on whether gpu info has been requested or not.
+  // Certain gpu_integration_test needs dx12/Vulkan info. If this info is
+  // needed, --no-delay-for-dx12-vulkan-info-collection should be added to the
+  // browser command line, so that the collection of this info isn't delayed.
+  // This function returns the status of availability to the tests based on
+  // whether gpu info has been requested or not.
 
   return gpu_info_dx12_vulkan_valid_ || !gpu_info_dx12_vulkan_requested_ ||
          gpu_info_dx12_vulkan_request_failed_;
@@ -557,8 +556,6 @@ void GpuDataManagerImplPrivate::UpdateGpuInfo(
 void GpuDataManagerImplPrivate::UpdateDxDiagNode(
     const gpu::DxDiagNode& dx_diagnostics) {
   gpu_info_.dx_diagnostics = dx_diagnostics;
-  if (complete_gpu_info_already_requested_)
-    complete_gpu_info_already_requested_ = false;
   // No need to call GetContentClient()->SetGpuInfo().
   NotifyGpuInfoUpdate();
 }
@@ -572,6 +569,14 @@ void GpuDataManagerImplPrivate::UpdateDx12VulkanInfo(
   NotifyGpuInfoUpdate();
 }
 
+void GpuDataManagerImplPrivate::UpdateDxDiagNodeRequestStatus(
+    bool request_continues) {
+  gpu_info_dx_diag_request_failed_ = !request_continues;
+
+  if (gpu_info_dx_diag_request_failed_)
+    NotifyGpuInfoUpdate();
+}
+
 void GpuDataManagerImplPrivate::UpdateDx12VulkanRequestStatus(
     bool request_continues) {
   gpu_info_dx12_vulkan_requested_ = true;
@@ -580,6 +585,10 @@ void GpuDataManagerImplPrivate::UpdateDx12VulkanRequestStatus(
   if (gpu_info_dx12_vulkan_request_failed_)
     NotifyGpuInfoUpdate();
 }
+
+bool GpuDataManagerImplPrivate::Dx12VulkanRequested() const {
+  return gpu_info_dx12_vulkan_requested_;
+}
 #endif
 
 void GpuDataManagerImplPrivate::UpdateGpuFeatureInfo(
@@ -952,14 +961,6 @@ int64_t GpuDataManagerImplPrivate::GetBlockAllDomainsDurationInMs() const {
   return kBlockAllDomainsMs;
 }
 
-bool GpuDataManagerImplPrivate::NeedsCompleteGpuInfoCollection() const {
-#if defined(OS_WIN)
-  return gpu_info_.dx_diagnostics.IsEmpty();
-#else
-  return false;
-#endif
-}
-
 gpu::GpuMode GpuDataManagerImplPrivate::GetGpuMode() const {
   return gpu_mode_;
 }
@@ -969,6 +970,9 @@ void GpuDataManagerImplPrivate::FallBackToNextGpuMode() {
   // Android and Chrome OS can't switch to software compositing. If the GPU
   // process initialization fails or GPU process is too unstable then crash the
   // browser process to reset everything.
+#if defined(OS_ANDROID)
+  FatalGpuProcessLaunchFailureOnBackground();
+#endif
   LOG(FATAL) << "GPU process isn't usable. Goodbye.";
 #else
   switch (gpu_mode_) {
diff --git a/chromium/content/browser/gpu/gpu_data_manager_impl_private.h b/chromium/content/browser/gpu/gpu_data_manager_impl_private.h
index 8fc37d8b29f..83fa48555a0 100644
--- a/chromium/content/browser/gpu/gpu_data_manager_impl_private.h
+++ b/chromium/content/browser/gpu/gpu_data_manager_impl_private.h
@@ -44,8 +44,8 @@ class CONTENT_EXPORT GpuDataManagerImplPrivate {
   gpu::GPUInfo GetGPUInfoForHardwareGpu() const;
   bool GpuAccessAllowed(std::string* reason) const;
   bool GpuProcessStartAllowed() const;
-  void RequestCompleteGpuInfoIfNeeded();
-  void RequestGpuSupportedRuntimeVersion(bool delayed);
+  void RequestDxdiagDx12VulkanGpuInfoIfNeeded(GpuInfoRequest request,
+                                              bool delayed);
   bool IsEssentialGpuInfoAvailable() const;
   bool IsDx12VulkanVersionAvailable() const;
   bool IsGpuFeatureInfoAvailable() const;
@@ -66,6 +66,8 @@ class CONTENT_EXPORT GpuDataManagerImplPrivate {
   void UpdateDx12VulkanInfo(
       const gpu::Dx12VulkanVersionInfo& dx12_vulkan_version_info);
   void UpdateDx12VulkanRequestStatus(bool request_continues);
+  void UpdateDxDiagNodeRequestStatus(bool request_continues);
+  bool Dx12VulkanRequested() const;
 #endif
   void UpdateGpuFeatureInfo(const gpu::GpuFeatureInfo& gpu_feature_info,
                             const base::Optional<gpu::GpuFeatureInfo>&
@@ -177,21 +179,19 @@ class CONTENT_EXPORT GpuDataManagerImplPrivate {
                                            base::Time at_time) const;
   int64_t GetBlockAllDomainsDurationInMs() const;
 
-  // This is platform specific. At the moment:
-  //   1) on Windows, if DxDiagnostics are missing, this returns true;
-  //   2) all other platforms, this returns false.
-  bool NeedsCompleteGpuInfoCollection() const;
-
   // Notify all observers whenever there is a GPU info update.
   void NotifyGpuInfoUpdate();
 
-  GpuDataManagerImpl* const owner_;
+  void RequestDxDiagNodeData();
+  void RequestGpuSupportedRuntimeVersion(bool delayed);
 
-  bool complete_gpu_info_already_requested_ = false;
+  GpuDataManagerImpl* const owner_;
 
   gpu::GpuFeatureInfo gpu_feature_info_;
   gpu::GPUInfo gpu_info_;
 #if defined(OS_WIN)
+  bool gpu_info_dx_diag_requested_ = false;
+  bool gpu_info_dx_diag_request_failed_ = false;
   bool gpu_info_dx12_vulkan_valid_ = false;
   bool gpu_info_dx12_vulkan_requested_ = false;
   bool gpu_info_dx12_vulkan_request_failed_ = false;
diff --git a/chromium/content/browser/gpu/gpu_internals_ui.cc b/chromium/content/browser/gpu/gpu_internals_ui.cc
index 788c2781fe5..96023f25d5b 100644
--- a/chromium/content/browser/gpu/gpu_internals_ui.cc
+++ b/chromium/content/browser/gpu/gpu_internals_ui.cc
@@ -41,6 +41,7 @@
 #include "gpu/config/gpu_feature_type.h"
 #include "gpu/config/gpu_info.h"
 #include "gpu/config/gpu_lists_version.h"
+#include "gpu/config/gpu_util.h"
 #include "gpu/ipc/common/gpu_memory_buffer_support.h"
 #include "gpu/ipc/host/gpu_memory_buffer_support.h"
 #include "skia/ext/skia_commit_hash.h"
@@ -114,28 +115,7 @@ std::unique_ptr<base::ListValue> DxDiagNodeToList(const gpu::DxDiagNode& node) {
   }
   return list;
 }
-
-std::string D3dFeaturelevelToString(uint32_t d3d_feature_level) {
-  if (d3d_feature_level == 0) {
-    return "Not supported";
-  } else {
-    return base::StringPrintf("D3D %d.%d", (d3d_feature_level >> 12) & 0xF,
-                              (d3d_feature_level >> 8) & 0xF);
-  }
-}
-
-std::string VulkanVersionToString(uint32_t vulkan_version) {
-  if (vulkan_version == 0) {
-    return "Not supported";
-  } else {
-    // Vulkan version number VK_MAKE_VERSION(major, minor, patch)
-    // (((major) << 22) | ((minor) << 12) | (patch))
-    return base::StringPrintf(
-        "Vulkan API %d.%d.%d", (vulkan_version >> 22) & 0x3FF,
-        (vulkan_version >> 12) & 0x3FF, vulkan_version & 0xFFF);
-  }
-}
-#endif
+#endif  // OS_WIN
 
 std::string GPUDeviceToString(const gpu::GPUInfo::GPUDevice& gpu) {
   std::string vendor = base::StringPrintf("0x%04x", gpu.vendor_id);
@@ -144,8 +124,17 @@ std::string GPUDeviceToString(const gpu::GPUInfo::GPUDevice& gpu) {
   std::string device = base::StringPrintf("0x%04x", gpu.device_id);
   if (!gpu.device_string.empty())
     device += " [" + gpu.device_string + "]";
-  return base::StringPrintf("VENDOR = %s, DEVICE= %s%s",
-      vendor.c_str(), device.c_str(), gpu.active ? " *ACTIVE*" : "");
+  std::string rt = base::StringPrintf("VENDOR= %s, DEVICE=%s", vendor.c_str(),
+                                      device.c_str());
+#if defined(OS_WIN)
+  if (gpu.sub_sys_id || gpu.revision) {
+    rt += base::StringPrintf(", SUBSYS=0x%08x, REV=%u", gpu.sub_sys_id,
+                             gpu.revision);
+  }
+#endif
+  if (gpu.active)
+    rt += " *ACTIVE*";
+  return rt;
 }
 
 std::unique_ptr<base::ListValue> BasicGpuInfoAsListValue(
@@ -212,12 +201,13 @@ std::unique_ptr<base::ListValue> BasicGpuInfoAsListValue(
 
   basic_info->Append(NewDescriptionValuePair(
       "Driver D3D12 feature level",
-      D3dFeaturelevelToString(
+      gpu::D3DFeatureLevelToString(
           gpu_info.dx12_vulkan_version_info.d3d12_feature_level)));
 
   basic_info->Append(NewDescriptionValuePair(
       "Driver Vulkan API version",
-      VulkanVersionToString(gpu_info.dx12_vulkan_version_info.vulkan_version)));
+      gpu::VulkanVersionToString(
+          gpu_info.dx12_vulkan_version_info.vulkan_version)));
 #endif
 
   basic_info->Append(
@@ -485,8 +475,9 @@ std::unique_ptr<base::ListValue> GetVideoAcceleratorsInfo() {
     std::string codec_string =
         base::StringPrintf("Decode %s", GetProfileName(profile.profile));
     std::string resolution_string = base::StringPrintf(
-        "up to %s pixels %s", profile.max_resolution.ToString().c_str(),
-        profile.encrypted_only ? "(encrypted)" : "");
+        "%s to %s pixels%s", profile.min_resolution.ToString().c_str(),
+        profile.max_resolution.ToString().c_str(),
+        profile.encrypted_only ? " (encrypted)" : "");
     info->Append(NewDescriptionValuePair(codec_string, resolution_string));
   }
 
@@ -495,7 +486,8 @@ std::unique_ptr<base::ListValue> GetVideoAcceleratorsInfo() {
     std::string codec_string =
         base::StringPrintf("Encode %s", GetProfileName(profile.profile));
     std::string resolution_string = base::StringPrintf(
-        "up to %s pixels and/or %.3f fps",
+        "%s to %s pixels, and/or %.3f fps",
+        profile.min_resolution.ToString().c_str(),
         profile.max_resolution.ToString().c_str(),
         static_cast<double>(profile.max_framerate_numerator) /
             profile.max_framerate_denominator);
@@ -515,6 +507,7 @@ std::unique_ptr<base::ListValue> GetANGLEFeatures() {
     angle_feature->SetString("description", feature.description);
     angle_feature->SetString("bug", feature.bug);
     angle_feature->SetString("status", feature.status);
+    angle_feature->SetString("condition", feature.condition);
     angle_features_list->Append(std::move(angle_feature));
   }
 
@@ -643,7 +636,8 @@ void GpuMessageHandler::OnBrowserBridgeInitialized(
 
   // Tell GpuDataManager it should have full GpuInfo. If the
   // Gpu process has not run yet, this will trigger its launch.
-  GpuDataManagerImpl::GetInstance()->RequestCompleteGpuInfoIfNeeded();
+  GpuDataManagerImpl::GetInstance()->RequestDxdiagDx12VulkanGpuInfoIfNeeded(
+      kGpuInfoRequestAll, /*delayed*/ false);
 
   // Run callback immediately in case the info is ready and no update in the
   // future.
@@ -727,7 +721,8 @@ void GpuMessageHandler::OnGpuInfoUpdate() {
 }
 
 void GpuMessageHandler::OnGpuSwitched() {
-  GpuDataManagerImpl::GetInstance()->RequestCompleteGpuInfoIfNeeded();
+  // Currently, about:gpu page does not update GPU info after the GPU switch.
+  // If there is something to be updated, the code should be added here.
 }
 
 }  // namespace
diff --git a/chromium/content/browser/gpu/gpu_process_host.cc b/chromium/content/browser/gpu/gpu_process_host.cc
index 25c87b7abbe..0f1e4a151a1 100644
--- a/chromium/content/browser/gpu/gpu_process_host.cc
+++ b/chromium/content/browser/gpu/gpu_process_host.cc
@@ -23,6 +23,7 @@
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
+#include "base/numerics/ranges.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
@@ -45,6 +46,7 @@
 #include "content/browser/service_manager/service_manager_context.h"
 #include "content/common/child_process.mojom.h"
 #include "content/common/child_process_host_impl.h"
+#include "content/common/field_trial_recorder.mojom.h"
 #include "content/common/in_process_child_thread_params.h"
 #include "content/common/service_manager/child_connection.h"
 #include "content/common/view_messages.h"
@@ -54,7 +56,6 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/gpu_utils.h"
 #include "content/public/common/bind_interface_helpers.h"
-#include "content/public/common/connection_filter.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/result_codes.h"
@@ -72,6 +73,8 @@
 #include "media/base/media_switches.h"
 #include "media/media_buildflags.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/generic_pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
@@ -167,6 +170,10 @@ GpuTerminationStatus ConvertToGpuTerminationStatus(
     case base::TERMINATION_STATUS_PROCESS_WAS_KILLED:
       return GpuTerminationStatus::PROCESS_WAS_KILLED;
     case base::TERMINATION_STATUS_PROCESS_CRASHED:
+#if defined(OS_WIN)
+    // Treat integrity failure as a crash on Windows.
+    case base::TERMINATION_STATUS_INTEGRITY_FAILURE:
+#endif
       return GpuTerminationStatus::PROCESS_CRASHED;
     case base::TERMINATION_STATUS_STILL_RUNNING:
       return GpuTerminationStatus::STILL_RUNNING;
@@ -429,10 +436,10 @@ class GpuSandboxedProcessLauncherDelegate
 };
 
 #if defined(OS_ANDROID)
-template <typename Interface>
-void BindJavaInterface(mojo::InterfaceRequest<Interface> request) {
+void BindAndroidOverlayProvider(
+    mojo::PendingReceiver<media::mojom::AndroidOverlayProvider> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  content::GetGlobalJavaInterfaces()->GetInterface(std::move(request));
+  content::GetGlobalJavaInterfaces()->GetInterface(std::move(receiver));
 }
 #endif  // defined(OS_ANDROID)
 
@@ -447,55 +454,27 @@ void RecordAppContainerStatus(int error_code, bool crashed_before) {
 }
 #endif  // defined(OS_WIN)
 
-void BindDiscardableMemoryRequestOnIO(
-    discardable_memory::mojom::DiscardableSharedMemoryManagerRequest request,
+void BindDiscardableMemoryReceiverOnIO(
+    mojo::PendingReceiver<
+        discardable_memory::mojom::DiscardableSharedMemoryManager> receiver,
     discardable_memory::DiscardableSharedMemoryManager* manager) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  service_manager::BindSourceInfo source_info;
-  manager->Bind(std::move(request), source_info);
+  manager->Bind(std::move(receiver));
 }
 
-void BindDiscardableMemoryRequestOnUI(
-    discardable_memory::mojom::DiscardableSharedMemoryManagerRequest request) {
+void BindDiscardableMemoryReceiverOnUI(
+    mojo::PendingReceiver<
+        discardable_memory::mojom::DiscardableSharedMemoryManager> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
-          &BindDiscardableMemoryRequestOnIO, std::move(request),
+          &BindDiscardableMemoryReceiverOnIO, std::move(receiver),
           discardable_memory::DiscardableSharedMemoryManager::Get()));
 }
 
 }  // anonymous namespace
 
-class GpuProcessHost::ConnectionFilterImpl : public ConnectionFilter {
- public:
-  explicit ConnectionFilterImpl(int gpu_process_id) {
-    auto task_runner = base::CreateSingleThreadTaskRunner({BrowserThread::UI});
-#if defined(OS_ANDROID)
-    registry_.AddInterface(
-        base::BindRepeating(
-            &BindJavaInterface<media::mojom::AndroidOverlayProvider>),
-        task_runner);
-#endif
-  }
-
- private:
-  // ConnectionFilter:
-  void OnBindInterface(const service_manager::BindSourceInfo& source_info,
-                       const std::string& interface_name,
-                       mojo::ScopedMessagePipeHandle* interface_pipe,
-                       service_manager::Connector* connector) override {
-    if (!registry_.TryBindInterface(interface_name, interface_pipe)) {
-      GetContentClient()->browser()->BindInterfaceRequest(
-          source_info, interface_name, interface_pipe);
-    }
-  }
-
-  service_manager::BinderRegistry registry_;
-
-  DISALLOW_COPY_AND_ASSIGN(ConnectionFilterImpl);
-};
-
 // static
 bool GpuProcessHost::ValidateHost(GpuProcessHost* host) {
   // The Gpu process is invalid if it's not using SwiftShader, the card is
@@ -599,8 +578,9 @@ void GpuProcessHost::BindInterface(
     mojo::ScopedMessagePipeHandle interface_pipe) {
   if (interface_name ==
       discardable_memory::mojom::DiscardableSharedMemoryManager::Name_) {
-    BindDiscardableMemoryRequest(
-        discardable_memory::mojom::DiscardableSharedMemoryManagerRequest(
+    BindDiscardableMemoryReceiver(
+        mojo::PendingReceiver<
+            discardable_memory::mojom::DiscardableSharedMemoryManager>(
             std::move(interface_pipe)));
     return;
   }
@@ -608,13 +588,28 @@ void GpuProcessHost::BindInterface(
                                               std::move(interface_pipe));
 }
 
-void GpuProcessHost::BindHostReceiver(mojo::GenericPendingReceiver receiver) {
-  if (auto field_trial_receiver = receiver.As<mojom::FieldTrialRecorder>()) {
-    mojom::FieldTrialRecorderRequest request(std::move(field_trial_receiver));
+void GpuProcessHost::BindHostReceiver(
+    mojo::GenericPendingReceiver generic_receiver) {
+  if (auto field_trial_receiver =
+          generic_receiver.As<mojom::FieldTrialRecorder>()) {
+    mojo::PendingReceiver<mojom::FieldTrialRecorder> receiver(
+        std::move(field_trial_receiver));
     base::PostTask(
         FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&FieldTrialRecorder::Create, std::move(request)));
+        base::BindOnce(&FieldTrialRecorder::Create, std::move(receiver)));
+    return;
+  }
+
+#if defined(OS_ANDROID)
+  if (auto r = generic_receiver.As<media::mojom::AndroidOverlayProvider>()) {
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&BindAndroidOverlayProvider, std::move(r)));
+    return;
   }
+#endif
+
+  GetContentClient()->browser()->BindGpuHostReceiver(
+      std::move(generic_receiver));
 }
 
 void GpuProcessHost::RunService(
@@ -682,9 +677,7 @@ GpuProcessHost::GpuProcessHost(int host_id, GpuProcessKind kind)
       valid_(true),
       in_process_(false),
       kind_(kind),
-      process_launched_(false),
-      connection_filter_id_(
-          ServiceManagerConnection::kInvalidConnectionFilterId) {
+      process_launched_(false) {
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSingleProcess) ||
       base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -748,7 +741,7 @@ GpuProcessHost::~GpuProcessHost() {
         // Windows always returns PROCESS_CRASHED on abnormal termination, as it
         // doesn't have a way to distinguish the two.
         base::UmaHistogramSparse("GPU.GPUProcessExitCode",
-                                 std::max(0, std::min(100, info.exit_code)));
+                                 base::ClampToRange(info.exit_code, 0, 100));
       }
 
       message = "The GPU process ";
@@ -775,7 +768,7 @@ GpuProcessHost::~GpuProcessHost() {
         UMA_HISTOGRAM_ENUMERATION("GPU.GPUProcessTerminationOrigin",
                                   termination_origin_,
                                   GpuTerminationOrigin::kMax);
-        message += "was killded by you! Why?";
+        message += "was killed by you! Why?";
         break;
       case base::TERMINATION_STATUS_PROCESS_CRASHED:
         message += "crashed!";
@@ -799,6 +792,11 @@ GpuProcessHost::~GpuProcessHost() {
       case base::TERMINATION_STATUS_OOM:
         message += "died due to out of memory.";
         break;
+#if defined(OS_WIN)
+      case base::TERMINATION_STATUS_INTEGRITY_FAILURE:
+        message += "failed integrity checks.";
+        break;
+#endif
       case base::TERMINATION_STATUS_MAX_ENUM:
         NOTREACHED();
         break;
@@ -813,11 +811,6 @@ GpuProcessHost::~GpuProcessHost() {
   // client 3D APIs without prompting.
   if (block_offscreen_contexts && gpu_host_)
     gpu_host_->BlockLiveOffscreenContexts();
-
-  if (ServiceManagerConnection::GetForProcess()) {
-    ServiceManagerConnection::GetForProcess()->RemoveConnectionFilter(
-        connection_filter_id_);
-  }
 }
 
 bool GpuProcessHost::Init() {
@@ -825,13 +818,6 @@ bool GpuProcessHost::Init() {
 
   TRACE_EVENT_INSTANT0("gpu", "LaunchGpuProcess", TRACE_EVENT_SCOPE_THREAD);
 
-  // May be null during test execution.
-  if (ServiceManagerConnection::GetForProcess()) {
-    connection_filter_id_ =
-        ServiceManagerConnection::GetForProcess()->AddConnectionFilter(
-            std::make_unique<ConnectionFilterImpl>(process_->GetData().id));
-  }
-
   process_->GetHost()->CreateChannelMojo();
 
   mode_ = GpuDataManagerImpl::GetInstance()->GetGpuMode();
@@ -857,8 +843,6 @@ bool GpuProcessHost::Init() {
     if (base::FeatureList::IsEnabled(features::kGpuUseDisplayThreadPriority))
       options.priority = base::ThreadPriority::DISPLAY;
     in_process_gpu_thread_->StartWithOptions(options);
-
-    OnProcessLaunched();  // Fake a callback that the process is ready.
   } else if (!LaunchGpuProcess()) {
     return false;
   }
@@ -870,7 +854,6 @@ bool GpuProcessHost::Init() {
           viz_main_pending_remote.InitWithNewEndpointAndPassReceiver());
   viz::GpuHostImpl::InitParams params;
   params.restart_id = host_id_;
-  params.in_process = in_process_;
   params.disable_gpu_shader_disk_cache =
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableGpuShaderDiskCache);
@@ -882,6 +865,11 @@ bool GpuProcessHost::Init() {
   gpu_host_ = std::make_unique<viz::GpuHostImpl>(
       this, std::move(viz_main_pending_remote), std::move(params));
 
+  if (in_process_) {
+    // Fake a callback that the process is ready.
+    OnProcessLaunched();
+  }
+
 #if BUILDFLAG(USE_VIZ_DEVTOOLS)
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kEnableVizDevTools)) {
@@ -943,10 +931,14 @@ void GpuProcessHost::OnProcessLaunched() {
     RecordAppContainerStatus(sandbox::SBOX_ALL_OK, crashed_before_);
 #endif  // defined(OS_WIN)
 
-  if (!in_process_) {
+  DCHECK(gpu_host_);
+  if (in_process_) {
+    // Don't set |process_id_| as it is publicly available through process_id().
+    gpu_host_->SetProcessId(base::GetCurrentProcId());
+  } else {
     process_id_ = process_->GetProcess().Pid();
     DCHECK_NE(base::kNullProcessId, process_id_);
-    gpu_host_->OnProcessLaunched(process_id_);
+    gpu_host_->SetProcessId(process_id_);
   }
 }
 
@@ -1056,11 +1048,12 @@ void GpuProcessHost::RecordLogMessage(int32_t severity,
   GpuDataManagerImpl::GetInstance()->AddLogMessage(severity, header, message);
 }
 
-void GpuProcessHost::BindDiscardableMemoryRequest(
-    discardable_memory::mojom::DiscardableSharedMemoryManagerRequest request) {
+void GpuProcessHost::BindDiscardableMemoryReceiver(
+    mojo::PendingReceiver<
+        discardable_memory::mojom::DiscardableSharedMemoryManager> receiver) {
   base::PostTask(
       FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&BindDiscardableMemoryRequestOnUI, std::move(request)));
+      base::BindOnce(&BindDiscardableMemoryReceiverOnUI, std::move(receiver)));
 }
 
 GpuProcessKind GpuProcessHost::kind() {
diff --git a/chromium/content/browser/gpu/gpu_process_host.h b/chromium/content/browser/gpu/gpu_process_host.h
index 555bfedce40..41f861124ac 100644
--- a/chromium/content/browser/gpu/gpu_process_host.h
+++ b/chromium/content/browser/gpu/gpu_process_host.h
@@ -33,8 +33,8 @@
 #include "gpu/config/gpu_mode.h"
 #include "gpu/ipc/common/surface_handle.h"
 #include "ipc/ipc_sender.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.h"
 #include "services/viz/privileged/mojom/gl/gpu_host.mojom.h"
 #include "services/viz/privileged/mojom/gl/gpu_service.mojom.h"
@@ -110,8 +110,6 @@ class GpuProcessHost : public BrowserChildProcessHostDelegate,
   viz::GpuHostImpl* gpu_host() { return gpu_host_.get(); }
 
  private:
-  class ConnectionFilterImpl;
-
   enum class GpuTerminationOrigin {
     kUnknownOrigin = 0,
     kOzoneWaylandProxy = 1,
@@ -156,12 +154,13 @@ class GpuProcessHost : public BrowserChildProcessHostDelegate,
   void RecordLogMessage(int32_t severity,
                         const std::string& header,
                         const std::string& message) override;
-  void BindDiscardableMemoryRequest(
-      discardable_memory::mojom::DiscardableSharedMemoryManagerRequest request)
+  void BindDiscardableMemoryReceiver(
+      mojo::PendingReceiver<
+          discardable_memory::mojom::DiscardableSharedMemoryManager> receiver)
       override;
   void BindInterface(const std::string& interface_name,
                      mojo::ScopedMessagePipeHandle interface_pipe) override;
-  void BindHostReceiver(mojo::GenericPendingReceiver receiver) override;
+  void BindHostReceiver(mojo::GenericPendingReceiver generic_receiver) override;
   void RunService(
       const std::string& service_name,
       mojo::PendingReceiver<service_manager::mojom::Service> receiver) override;
@@ -211,8 +210,6 @@ class GpuProcessHost : public BrowserChildProcessHostDelegate,
   // Time Init started.  Used to log total GPU process startup time to UMA.
   base::TimeTicks init_start_time_;
 
-  int connection_filter_id_;
-
   // The GPU process reported failure to initialize.
   bool did_fail_initialize_ = false;
 
diff --git a/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl.cc b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl.cc
new file mode 100644
index 00000000000..8c8e83f8e3f
--- /dev/null
+++ b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl.cc
@@ -0,0 +1,83 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/gpu/peak_gpu_memory_tracker_impl.h"
+
+#include <memory>
+
+#include "base/bind.h"
+#include "base/location.h"
+#include "base/task/post_task.h"
+#include "base/threading/thread_task_runner_handle.h"
+#include "content/browser/gpu/gpu_process_host.h"
+#include "content/public/browser/gpu_data_manager.h"
+#include "services/viz/privileged/mojom/gl/gpu_service.mojom.h"
+
+namespace content {
+
+// static
+std::unique_ptr<PeakGpuMemoryTracker> PeakGpuMemoryTracker::Create(
+    PeakMemoryCallback callback) {
+  return std::make_unique<PeakGpuMemoryTrackerImpl>(std::move(callback));
+}
+
+// static
+uint32_t PeakGpuMemoryTrackerImpl::next_sequence_number_ = 0;
+
+PeakGpuMemoryTrackerImpl::PeakGpuMemoryTrackerImpl(PeakMemoryCallback callback)
+    : callback_(std::move(callback)),
+      callback_task_runner_(base::ThreadTaskRunnerHandle::Get()) {
+  // Actually performs request to GPU service to begin memory tracking for
+  // |sequence_number_|. This will normally be created from the UI thread, so
+  // repost to the IO thread.
+  GpuProcessHost::CallOnIO(
+      GPU_PROCESS_KIND_SANDBOXED, /* force_create=*/false,
+      base::BindOnce(
+          [](uint32_t sequence_num, GpuProcessHost* host) {
+            // There may be no host nor service available. This may occur during
+            // shutdown, when the service is fully disabled, and in some tests.
+            // In those cases do nothing.
+            if (!host)
+              return;
+            if (auto* gpu_service = host->gpu_service()) {
+              gpu_service->StartPeakMemoryMonitor(sequence_num);
+            }
+          },
+          sequence_num_));
+}
+
+PeakGpuMemoryTrackerImpl::~PeakGpuMemoryTrackerImpl() {
+  // The reply arrives on the IO Thread, repost to the callback's thread.
+  auto wrap_callback = base::BindOnce(
+      [](base::SingleThreadTaskRunner* task_runner, PeakMemoryCallback callback,
+         const uint64_t peak_memory) {
+        task_runner->PostTask(FROM_HERE,
+                              base::BindOnce(std::move(callback), peak_memory));
+      },
+      base::RetainedRef(std::move(callback_task_runner_)),
+      std::move(callback_));
+
+  GpuProcessHost::CallOnIO(
+      GPU_PROCESS_KIND_SANDBOXED, /* force_create=*/false,
+      base::BindOnce(
+          [](uint32_t sequence_num, PeakMemoryCallback callback,
+             GpuProcessHost* host) {
+            // There may be no host nor service available. This may occur during
+            // shutdown, when the service is fully disabled, and in some tests.
+            // In those cases run the callback, reporting 0 memory usage. This
+            // will signify a failure state, and allow for the callback to
+            // perform any needed cleanup.
+            if (!host) {
+              std::move(callback).Run(0u);
+              return;
+            }
+            if (auto* gpu_service = host->gpu_service()) {
+              gpu_service->GetPeakMemoryUsage(sequence_num,
+                                              std::move(callback));
+            }
+          },
+          sequence_num_, std::move(wrap_callback)));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl.h b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl.h
new file mode 100644
index 00000000000..07539d86cc3
--- /dev/null
+++ b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl.h
@@ -0,0 +1,46 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_GPU_PEAK_GPU_MEMORY_TRACKER_IMPL_H_
+#define CONTENT_BROWSER_GPU_PEAK_GPU_MEMORY_TRACKER_IMPL_H_
+
+#include "base/single_thread_task_runner.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/peak_gpu_memory_tracker.h"
+
+namespace content {
+
+// Tracks the peak memory of the GPU service for its lifetime. Upon its
+// destruction a report will be requested from the GPU service. The peak will be
+// reported to the provided PeakMemoryCallback. This will occur on the thread
+// that this was created on.
+//
+// If the GPU is lost during this objects lifetime, upon destruction the
+// PeakMemoryCallback will be ran with "0" as the reported peak usage. The same
+// for if there is never a successful GPU connection.
+//
+// This is instaniated via PeakGpuMemoryTracker::Create.
+class CONTENT_EXPORT PeakGpuMemoryTrackerImpl : public PeakGpuMemoryTracker {
+ public:
+  // Requests the GPU service to begin peak memory tracking.
+  PeakGpuMemoryTrackerImpl(PeakMemoryCallback callback);
+  // Requests the GPU service provides the peak memory, the result is passed to
+  // |callback_|.
+  ~PeakGpuMemoryTrackerImpl() override;
+
+  PeakGpuMemoryTrackerImpl(const PeakGpuMemoryTrackerImpl*) = delete;
+  PeakGpuMemoryTrackerImpl& operator=(const PeakGpuMemoryTrackerImpl&) = delete;
+
+ private:
+  // Provides the unique identifier for each PeakGpuMemoryTrackerImpl.
+  static uint32_t next_sequence_number_;
+
+  PeakMemoryCallback callback_;
+  scoped_refptr<base::SingleThreadTaskRunner> callback_task_runner_;
+  uint32_t sequence_num_ = next_sequence_number_++;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_GPU_PEAK_GPU_MEMORY_TRACKER_IMPL_H_
diff --git a/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc
new file mode 100644
index 00000000000..3e3448e002d
--- /dev/null
+++ b/chromium/content/browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc
@@ -0,0 +1,221 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/gpu/peak_gpu_memory_tracker_impl.h"
+
+#include "base/bind.h"
+#include "base/callback_forward.h"
+#include "base/location.h"
+#include "base/run_loop.h"
+#include "base/task/post_task.h"
+#include "build/build_config.h"
+#include "components/viz/test/gpu_host_impl_test_api.h"
+#include "content/browser/gpu/gpu_process_host.h"
+#include "content/public/browser/browser_task_traits.h"
+#include "content/public/browser/browser_thread.h"
+#include "content/public/test/browser_test.h"
+#include "content/public/test/content_browser_test.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "services/viz/privileged/mojom/gl/gpu_service.mojom.h"
+
+namespace content {
+
+namespace {
+
+const uint64_t kPeakMemory = 42u;
+
+// Test implementation of viz::mojom::GpuService which only implements the peak
+// memory monitoring aspects.
+class TestGpuService : public viz::mojom::GpuService {
+ public:
+  TestGpuService() = default;
+  TestGpuService(const TestGpuService*) = delete;
+  ~TestGpuService() override = default;
+  TestGpuService& operator=(const TestGpuService&) = delete;
+
+  // mojom::GpuService:
+  void StartPeakMemoryMonitor(uint32_t sequence_num) override {
+    peak_memory_monitor_started_ = true;
+  }
+
+  void GetPeakMemoryUsage(uint32_t sequence_num,
+                          GetPeakMemoryUsageCallback callback) override {
+    std::move(callback).Run(kPeakMemory);
+  }
+
+  bool peak_memory_monitor_started() const {
+    return peak_memory_monitor_started_;
+  }
+
+ private:
+  // mojom::GpuService:
+  void EstablishGpuChannel(int32_t client_id,
+                           uint64_t client_tracing_id,
+                           bool is_gpu_host,
+                           bool cache_shaders_on_disk,
+                           EstablishGpuChannelCallback callback) override {}
+  void CloseChannel(int32_t client_id) override {}
+#if defined(OS_CHROMEOS)
+  void CreateArcVideoDecodeAccelerator(
+      mojo::PendingReceiver<arc::mojom::VideoDecodeAccelerator> vda_receiver)
+      override {}
+  void CreateArcVideoEncodeAccelerator(
+      mojo::PendingReceiver<arc::mojom::VideoEncodeAccelerator> vea_receiver)
+      override {}
+  void CreateArcVideoProtectedBufferAllocator(
+      mojo::PendingReceiver<arc::mojom::VideoProtectedBufferAllocator>
+          pba_receiver) override {}
+  void CreateArcProtectedBufferManager(
+      mojo::PendingReceiver<arc::mojom::ProtectedBufferManager> pbm_receiver)
+      override {}
+  void CreateJpegDecodeAccelerator(
+      mojo::PendingReceiver<chromeos_camera::mojom::MjpegDecodeAccelerator>
+          jda_receiver) override {}
+  void CreateJpegEncodeAccelerator(
+      mojo::PendingReceiver<chromeos_camera::mojom::JpegEncodeAccelerator>
+          jea_receiver) override {}
+#endif  // defined(OS_CHROMEOS)
+  void CreateVideoEncodeAcceleratorProvider(
+      mojo::PendingReceiver<media::mojom::VideoEncodeAcceleratorProvider>
+          receiver) override {}
+  void CreateGpuMemoryBuffer(gfx::GpuMemoryBufferId id,
+                             const gfx::Size& size,
+                             gfx::BufferFormat format,
+                             gfx::BufferUsage usage,
+                             int client_id,
+                             gpu::SurfaceHandle surface_handle,
+                             CreateGpuMemoryBufferCallback callback) override {}
+  void DestroyGpuMemoryBuffer(gfx::GpuMemoryBufferId id,
+                              int client_id,
+                              const gpu::SyncToken& sync_token) override {}
+  void GetVideoMemoryUsageStats(
+      GetVideoMemoryUsageStatsCallback callback) override {}
+#if defined(OS_WIN)
+  void RequestCompleteGpuInfo(
+      RequestCompleteGpuInfoCallback callback) override {}
+  void GetGpuSupportedRuntimeVersion(
+      GetGpuSupportedRuntimeVersionCallback callback) override {}
+#endif
+  void RequestHDRStatus(RequestHDRStatusCallback callback) override {}
+  void LoadedShader(int32_t client_id,
+                    const std::string& key,
+                    const std::string& data) override {}
+  void WakeUpGpu() override {}
+  void GpuSwitched() override {}
+  void DestroyAllChannels() override {}
+  void OnBackgroundCleanup() override {}
+  void OnBackgrounded() override {}
+  void OnForegrounded() override {}
+#if defined(OS_MACOSX)
+  void BeginCATransaction() override {}
+  void CommitCATransaction(CommitCATransactionCallback callback) override {}
+#endif
+  void Crash() override {}
+  void Hang() override {}
+  void ThrowJavaException() override {}
+  void Stop(StopCallback callback) override {}
+
+  bool peak_memory_monitor_started_ = false;
+};
+
+// Runs |task| on the Browser's IO thread, and blocks the Main thread until that
+// task has ran.
+void PostTaskToIOThreadAndWait(base::OnceClosure task) {
+  base::RunLoop run_loop;
+  base::PostTaskAndReply(FROM_HERE, {content::BrowserThread::IO},
+                         std::move(task), run_loop.QuitClosure());
+  run_loop.Run();
+}
+
+}  // namespace
+
+class PeakGpuMemoryTrackerImplTest : public ContentBrowserTest {
+ public:
+  PeakGpuMemoryTrackerImplTest() = default;
+  ~PeakGpuMemoryTrackerImplTest() override = default;
+
+  // Waits until all messages to the mojo::Remote<viz::mojom::GpuService> have
+  // been processed.
+  void FlushRemoteForTesting() {
+    PostTaskToIOThreadAndWait(
+        base::BindOnce(&viz::GpuHostImplTestApi::FlushRemoteForTesting,
+                       base::Unretained(gpu_host_impl_test_api_.get())));
+  }
+
+  // Initializes the TestGpuService, and installs it as the active service.
+  void InitOnIOThread() {
+    gpu_host_impl_test_api_ = std::make_unique<viz::GpuHostImplTestApi>(
+        GpuProcessHost::Get()->gpu_host());
+    test_gpu_service_ = std::make_unique<TestGpuService>();
+    mojo::Remote<viz::mojom::GpuService> gpu_service_remote;
+    gpu_service_receiver_ =
+        std::make_unique<mojo::Receiver<viz::mojom::GpuService>>(
+            test_gpu_service_.get(),
+            gpu_service_remote.BindNewPipeAndPassReceiver());
+    gpu_host_impl_test_api_->SetGpuService(std::move(gpu_service_remote));
+  }
+
+  // Callback to provide to a PeakGpuMemoryTracker. Tests must provide
+  // |runloop_closure| and run the base::RunLoop. This will then quit the loop
+  // once the response from mojo has been received and reposted to the main
+  // thread.
+  void PeakMemoryCallback(base::OnceClosure runloop_closure,
+                          uint64_t peak_memory) {
+    peak_memory_ = peak_memory;
+    std::move(runloop_closure).Run();
+  }
+
+  uint64_t peak_memory() const { return peak_memory_; }
+
+  // Provides access to the TestGpuService on the Main Thread for test
+  // verifications. All mojo calls should be performed on the IO Thread.
+  TestGpuService* gpu_service() const { return test_gpu_service_.get(); }
+
+  // Setup requires that we have the Browser threads still initialized.
+  // ContentBrowserTest:
+  void PreRunTestOnMainThread() override {
+    ContentBrowserTest::PreRunTestOnMainThread();
+    PostTaskToIOThreadAndWait(base::BindOnce(
+        &PeakGpuMemoryTrackerImplTest::InitOnIOThread, base::Unretained(this)));
+  }
+  void PostRunTestOnMainThread() override {
+    PostTaskToIOThreadAndWait(base::BindOnce(
+        [](std::unique_ptr<mojo::Receiver<viz::mojom::GpuService>>
+               gpu_service_receiver) {},
+        std::move(gpu_service_receiver_)));
+    ContentBrowserTest::PostRunTestOnMainThread();
+  }
+
+ private:
+  uint64_t peak_memory_ = 0;
+  std::unique_ptr<TestGpuService> test_gpu_service_ = nullptr;
+  std::unique_ptr<viz::GpuHostImplTestApi> gpu_host_impl_test_api_ = nullptr;
+  std::unique_ptr<mojo::Receiver<viz::mojom::GpuService>>
+      gpu_service_receiver_ = nullptr;
+};
+
+// Verifies that when a PeakGpuMemoryTracker is destroyed, that the client's
+// callback is appropriately called.
+IN_PROC_BROWSER_TEST_F(PeakGpuMemoryTrackerImplTest, PeakGpuMemoryCallback) {
+  base::RunLoop run_loop;
+  std::unique_ptr<PeakGpuMemoryTracker> tracker = PeakGpuMemoryTracker::Create(
+      base::BindOnce(&PeakGpuMemoryTrackerImplTest::PeakMemoryCallback,
+                     base::Unretained(this), run_loop.QuitClosure()));
+  FlushRemoteForTesting();
+  // No report in response to creation.
+  EXPECT_EQ(0u, peak_memory());
+  // However the serive should have started monitoring.
+  EXPECT_TRUE(gpu_service()->peak_memory_monitor_started());
+
+  // Deleting the tracker should start a request for peak Gpu memory usage, with
+  // the callback being a posted task.
+  tracker.reset();
+  FlushRemoteForTesting();
+  // Wait for PeakMemoryCallback to be ran on this thread.
+  run_loop.Run();
+  EXPECT_EQ(kPeakMemory, peak_memory());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/gpu/viz_devtools_connector.cc b/chromium/content/browser/gpu/viz_devtools_connector.cc
index b79710214bc..b3da62dff7c 100644
--- a/chromium/content/browser/gpu/viz_devtools_connector.cc
+++ b/chromium/content/browser/gpu/viz_devtools_connector.cc
@@ -12,6 +12,8 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
@@ -28,12 +30,13 @@ void OnSocketCreated(base::OnceCallback<void(int, int)> callback,
 }
 
 void CreateSocketOnUiThread(
-    network::mojom::TCPServerSocketRequest server_socket_request,
+    mojo::PendingReceiver<network::mojom::TCPServerSocket>
+        server_socket_receiver,
     int port,
     base::OnceCallback<void(int, int)> callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   ui_devtools::UiDevToolsServer::CreateTCPServerSocket(
-      std::move(server_socket_request),
+      std::move(server_socket_receiver),
       GetContentClient()->browser()->GetSystemNetworkContext(), port,
       ui_devtools::UiDevToolsServer::kVizDevtoolsServerTag,
       base::BindOnce(&OnSocketCreated, std::move(callback)));
@@ -47,9 +50,7 @@ VizDevToolsConnector::~VizDevToolsConnector() {}
 
 void VizDevToolsConnector::ConnectVizDevTools() {
   constexpr int kVizDevToolsDefaultPort = 9229;
-  network::mojom::TCPServerSocketPtr server_socket;
-  network::mojom::TCPServerSocketRequest server_socket_request =
-      mojo::MakeRequest(&server_socket);
+  mojo::PendingRemote<network::mojom::TCPServerSocket> server_socket;
   int port = ui_devtools::UiDevToolsServer::GetUiDevToolsPort(
       switches::kEnableVizDevTools, kVizDevToolsDefaultPort);
   // Jump to the UI thread to get the network context, create the socket, then
@@ -57,14 +58,15 @@ void VizDevToolsConnector::ConnectVizDevTools() {
   base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
-          &CreateSocketOnUiThread, std::move(server_socket_request), port,
+          &CreateSocketOnUiThread,
+          server_socket.InitWithNewPipeAndPassReceiver(), port,
           base::BindOnce(&VizDevToolsConnector::OnVizDevToolsSocketCreated,
                          weak_ptr_factory_.GetWeakPtr(),
-                         server_socket.PassInterface())));
+                         std::move(server_socket))));
 }
 
 void VizDevToolsConnector::OnVizDevToolsSocketCreated(
-    network::mojom::TCPServerSocketPtrInfo socket,
+    mojo::PendingRemote<network::mojom::TCPServerSocket> socket,
     int result,
     int port) {
   viz::mojom::VizDevToolsParamsPtr params =
diff --git a/chromium/content/browser/gpu/viz_devtools_connector.h b/chromium/content/browser/gpu/viz_devtools_connector.h
index 6f44bb08826..77651a78b64 100644
--- a/chromium/content/browser/gpu/viz_devtools_connector.h
+++ b/chromium/content/browser/gpu/viz_devtools_connector.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/network/public/mojom/tcp_socket.mojom.h"
 
 namespace content {
@@ -22,9 +23,10 @@ class CONTENT_EXPORT VizDevToolsConnector {
   void ConnectVizDevTools();
 
  private:
-  void OnVizDevToolsSocketCreated(network::mojom::TCPServerSocketPtrInfo socket,
-                                  int result,
-                                  int port);
+  void OnVizDevToolsSocketCreated(
+      mojo::PendingRemote<network::mojom::TCPServerSocket> socket,
+      int result,
+      int port);
 
   base::WeakPtrFactory<VizDevToolsConnector> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/hid/hid_browsertest.cc b/chromium/content/browser/hid/hid_browsertest.cc
index 219679476db..00c6383880b 100644
--- a/chromium/content/browser/hid/hid_browsertest.cc
+++ b/chromium/content/browser/hid/hid_browsertest.cc
@@ -10,6 +10,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/hid_chooser.h"
 #include "content/public/browser/hid_delegate.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -65,7 +66,7 @@ class HidTest : public ContentBrowserTest {
 }  // namespace
 
 IN_PROC_BROWSER_TEST_F(HidTest, GetDevices) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   // Three devices are added but only two will have permission granted.
   for (int i = 0; i < 3; i++) {
@@ -86,7 +87,7 @@ IN_PROC_BROWSER_TEST_F(HidTest, GetDevices) {
 }
 
 IN_PROC_BROWSER_TEST_F(HidTest, RequestDevice) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   EXPECT_CALL(delegate(), CanRequestDevicePermission(_, _))
       .WillOnce(Return(true));
@@ -104,7 +105,7 @@ IN_PROC_BROWSER_TEST_F(HidTest, RequestDevice) {
 }
 
 IN_PROC_BROWSER_TEST_F(HidTest, DisallowRequestDevice) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   EXPECT_CALL(delegate(), CanRequestDevicePermission(_, _))
       .WillOnce(Return(false));
diff --git a/chromium/content/browser/hid/hid_service.cc b/chromium/content/browser/hid/hid_service.cc
index 8c520861407..d273b5b2d00 100644
--- a/chromium/content/browser/hid/hid_service.cc
+++ b/chromium/content/browser/hid/hid_service.cc
@@ -12,21 +12,22 @@
 #include "content/public/browser/hid_chooser.h"
 #include "content/public/browser/hid_delegate.h"
 #include "content/public/browser/render_frame_host.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "content/public/common/content_client.h"
 #include "mojo/public/cpp/bindings/message.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 namespace content {
 
 HidService::HidService(RenderFrameHost* render_frame_host,
-                       blink::mojom::HidServiceRequest request)
-    : FrameServiceBase(render_frame_host, std::move(request)) {}
+                       mojo::PendingReceiver<blink::mojom::HidService> receiver)
+    : FrameServiceBase(render_frame_host, std::move(receiver)) {}
 
 HidService::~HidService() = default;
 
 // static
-void HidService::Create(RenderFrameHost* render_frame_host,
-                        blink::mojom::HidServiceRequest request) {
+void HidService::Create(
+    RenderFrameHost* render_frame_host,
+    mojo::PendingReceiver<blink::mojom::HidService> receiver) {
   DCHECK(render_frame_host);
 
   if (!render_frame_host->IsFeatureEnabled(
@@ -43,7 +44,7 @@ void HidService::Create(RenderFrameHost* render_frame_host,
   // HidService owns itself. It will self-destruct when a mojo interface error
   // occurs, the render frame host is deleted, or the render frame host
   // navigates to a new document.
-  new HidService(render_frame_host, std::move(request));
+  new HidService(render_frame_host, std::move(receiver));
 }
 
 void HidService::GetDevices(GetDevicesCallback callback) {
@@ -108,10 +109,11 @@ void HidService::FinishRequestDevice(RequestDeviceCallback callback,
   std::move(callback).Run(std::move(device));
 }
 
-void HidService::FinishConnect(ConnectCallback callback,
-                               device::mojom::HidConnectionPtr connection) {
+void HidService::FinishConnect(
+    ConnectCallback callback,
+    mojo::PendingRemote<device::mojom::HidConnection> connection) {
   if (!connection) {
-    std::move(callback).Run(nullptr);
+    std::move(callback).Run(mojo::NullRemote());
     return;
   }
 
diff --git a/chromium/content/browser/hid/hid_service.h b/chromium/content/browser/hid/hid_service.h
index 2d1b6a11859..471eb53619b 100644
--- a/chromium/content/browser/hid/hid_service.h
+++ b/chromium/content/browser/hid/hid_service.h
@@ -12,7 +12,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/public/browser/frame_service_base.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/device/public/mojom/hid.mojom.h"
 #include "third_party/blink/public/mojom/hid/hid.mojom.h"
@@ -26,7 +26,8 @@ class RenderFrameHost;
 // interface is used by Blink to implement the WebHID API.
 class HidService : public content::FrameServiceBase<blink::mojom::HidService> {
  public:
-  static void Create(RenderFrameHost*, blink::mojom::HidServiceRequest);
+  static void Create(RenderFrameHost*,
+                     mojo::PendingReceiver<blink::mojom::HidService>);
 
   // blink::mojom::HidService:
   void GetDevices(GetDevicesCallback callback) override;
@@ -37,15 +38,16 @@ class HidService : public content::FrameServiceBase<blink::mojom::HidService> {
                ConnectCallback callback) override;
 
  private:
-  HidService(RenderFrameHost*, blink::mojom::HidServiceRequest);
+  HidService(RenderFrameHost*, mojo::PendingReceiver<blink::mojom::HidService>);
   ~HidService() override;
 
   void FinishGetDevices(GetDevicesCallback callback,
                         std::vector<device::mojom::HidDeviceInfoPtr> devices);
   void FinishRequestDevice(RequestDeviceCallback callback,
                            device::mojom::HidDeviceInfoPtr device);
-  void FinishConnect(ConnectCallback callback,
-                     device::mojom::HidConnectionPtr connection);
+  void FinishConnect(
+      ConnectCallback callback,
+      mojo::PendingRemote<device::mojom::HidConnection> connection);
 
   // The last shown HID chooser UI.
   std::unique_ptr<HidChooser> chooser_;
diff --git a/chromium/content/browser/hid/hid_service_unittest.cc b/chromium/content/browser/hid/hid_service_unittest.cc
index 4d2b00d936a..7a87119188b 100644
--- a/chromium/content/browser/hid/hid_service_unittest.cc
+++ b/chromium/content/browser/hid/hid_service_unittest.cc
@@ -11,6 +11,9 @@
 #include "content/public/common/content_switches.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/device/public/cpp/hid/fake_hid_manager.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -25,10 +28,12 @@ const char kTestGuid[] = "test-guid";
 
 class FakeHidConnectionClient : public device::mojom::HidConnectionClient {
  public:
-  FakeHidConnectionClient() : binding_(this) {}
+  FakeHidConnectionClient() = default;
+  ~FakeHidConnectionClient() override = default;
 
-  void Bind(device::mojom::HidConnectionClientRequest request) {
-    binding_.Bind(std::move(request));
+  void Bind(
+      mojo::PendingReceiver<device::mojom::HidConnectionClient> receiver) {
+    receiver_.Bind(std::move(receiver));
   }
 
   // mojom::HidConnectionClient:
@@ -36,7 +41,7 @@ class FakeHidConnectionClient : public device::mojom::HidConnectionClient {
                      const std::vector<uint8_t>& buffer) override {}
 
  private:
-  mojo::Binding<device::mojom::HidConnectionClient> binding_;
+  mojo::Receiver<device::mojom::HidConnectionClient> receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(FakeHidConnectionClient);
 };
@@ -81,10 +86,9 @@ class HidServiceTest : public RenderViewHostImplTestHarness {
 TEST_F(HidServiceTest, GetDevicesWithPermission) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  blink::mojom::HidServicePtr service;
-  contents()->GetMainFrame()->BinderRegistryForTesting().BindInterface(
-      blink::mojom::HidService::Name_,
-      mojo::MakeRequest(&service).PassMessagePipe());
+  mojo::Remote<blink::mojom::HidService> service;
+  contents()->GetMainFrame()->GetHidService(
+      service.BindNewPipeAndPassReceiver());
 
   auto device_info = device::mojom::HidDeviceInfo::New();
   device_info->guid = kTestGuid;
@@ -107,10 +111,9 @@ TEST_F(HidServiceTest, GetDevicesWithPermission) {
 TEST_F(HidServiceTest, GetDevicesWithoutPermission) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  blink::mojom::HidServicePtr service;
-  contents()->GetMainFrame()->BinderRegistryForTesting().BindInterface(
-      blink::mojom::HidService::Name_,
-      mojo::MakeRequest(&service).PassMessagePipe());
+  mojo::Remote<blink::mojom::HidService> service;
+  contents()->GetMainFrame()->GetHidService(
+      service.BindNewPipeAndPassReceiver());
 
   auto device_info = device::mojom::HidDeviceInfo::New();
   device_info->guid = kTestGuid;
@@ -133,10 +136,9 @@ TEST_F(HidServiceTest, GetDevicesWithoutPermission) {
 TEST_F(HidServiceTest, RequestDevice) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  blink::mojom::HidServicePtr service;
-  contents()->GetMainFrame()->BinderRegistryForTesting().BindInterface(
-      blink::mojom::HidService::Name_,
-      mojo::MakeRequest(&service).PassMessagePipe());
+  mojo::Remote<blink::mojom::HidService> service;
+  contents()->GetMainFrame()->GetHidService(
+      service.BindNewPipeAndPassReceiver());
 
   auto device_info = device::mojom::HidDeviceInfo::New();
   device_info->guid = kTestGuid;
@@ -163,10 +165,9 @@ TEST_F(HidServiceTest, RequestDevice) {
 TEST_F(HidServiceTest, OpenAndCloseHidConnection) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  blink::mojom::HidServicePtr service;
-  contents()->GetMainFrame()->BinderRegistryForTesting().BindInterface(
-      blink::mojom::HidService::Name_,
-      mojo::MakeRequest(&service).PassMessagePipe());
+  mojo::Remote<blink::mojom::HidService> service;
+  contents()->GetMainFrame()->GetHidService(
+      service.BindNewPipeAndPassReceiver());
 
   auto device_info = device::mojom::HidDeviceInfo::New();
   device_info->guid = kTestGuid;
@@ -177,11 +178,12 @@ TEST_F(HidServiceTest, OpenAndCloseHidConnection) {
       hid_connection_client.InitWithNewPipeAndPassReceiver());
 
   base::RunLoop run_loop;
-  device::mojom::HidConnectionPtr connection;
+  mojo::PendingRemote<device::mojom::HidConnection> connection;
   service->Connect(
       kTestGuid, std::move(hid_connection_client),
       base::BindLambdaForTesting(
-          [&run_loop, &connection](device::mojom::HidConnectionPtr c) {
+          [&run_loop,
+           &connection](mojo::PendingRemote<device::mojom::HidConnection> c) {
             connection = std::move(c);
             run_loop.Quit();
           }));
diff --git a/chromium/content/browser/histogram_controller.cc b/chromium/content/browser/histogram_controller.cc
index 63a20515b3d..789144c1e41 100644
--- a/chromium/content/browser/histogram_controller.cc
+++ b/chromium/content/browser/histogram_controller.cc
@@ -101,12 +101,18 @@ template <class T>
 void HistogramController::SetHistogramMemory(
     T* host,
     base::WritableSharedMemoryRegion shared_region) {
-  content::mojom::ChildHistogramFetcherFactoryPtr
-      child_histogram_fetcher_factory;
-  content::mojom::ChildHistogramFetcherPtr child_histogram_fetcher;
-  content::BindInterface(host, &child_histogram_fetcher_factory);
+  mojo::PendingRemote<content::mojom::ChildHistogramFetcherFactory>
+      pending_child_histogram_fetcher_factory;
+  content::BindInterface(host, &pending_child_histogram_fetcher_factory);
+
+  mojo::Remote<content::mojom::ChildHistogramFetcherFactory>
+      child_histogram_fetcher_factory(
+          std::move(pending_child_histogram_fetcher_factory));
+  mojo::Remote<content::mojom::ChildHistogramFetcher> child_histogram_fetcher;
+
   child_histogram_fetcher_factory->CreateFetcher(
-      std::move(shared_region), mojo::MakeRequest(&child_histogram_fetcher));
+      std::move(shared_region),
+      child_histogram_fetcher.BindNewPipeAndPassReceiver());
   InsertChildHistogramFetcherInterface(host,
                                        std::move(child_histogram_fetcher));
 }
@@ -114,10 +120,11 @@ void HistogramController::SetHistogramMemory(
 template <class T>
 void HistogramController::InsertChildHistogramFetcherInterface(
     T* host,
-    content::mojom::ChildHistogramFetcherPtr child_histogram_fetcher) {
+    mojo::Remote<content::mojom::ChildHistogramFetcher>
+        child_histogram_fetcher) {
   // Broken pipe means remove this from the map. The map size is a proxy for
   // the number of known processes
-  child_histogram_fetcher.set_connection_error_handler(base::BindOnce(
+  child_histogram_fetcher.set_disconnect_handler(base::BindOnce(
       &HistogramController::RemoveChildHistogramFetcherInterface<T>,
       base::Unretained(this), base::Unretained(host)));
   GetChildHistogramFetcherMap<T>()[host] = std::move(child_histogram_fetcher);
diff --git a/chromium/content/browser/histogram_controller.h b/chromium/content/browser/histogram_controller.h
index 76bb24c4fb6..5e123e9e30c 100644
--- a/chromium/content/browser/histogram_controller.h
+++ b/chromium/content/browser/histogram_controller.h
@@ -13,6 +13,7 @@
 #include "base/memory/singleton.h"
 #include "base/memory/writable_shared_memory_region.h"
 #include "content/common/histogram_fetcher.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace content {
 
@@ -80,12 +81,13 @@ class HistogramController {
 
   template <class T>
   using ChildHistogramFetcherMap =
-      std::map<T*, content::mojom::ChildHistogramFetcherPtr>;
+      std::map<T*, mojo::Remote<content::mojom::ChildHistogramFetcher>>;
 
   template <class T>
   void InsertChildHistogramFetcherInterface(
       T* host,
-      content::mojom::ChildHistogramFetcherPtr child_histogram_fetcher);
+      mojo::Remote<content::mojom::ChildHistogramFetcher>
+          child_histogram_fetcher);
 
   template <class T>
   content::mojom::ChildHistogramFetcher* GetChildHistogramFetcherInterface(
diff --git a/chromium/content/browser/histogram_synchronizer.cc b/chromium/content/browser/histogram_synchronizer.cc
index 9c792bbb2a4..833d972017a 100644
--- a/chromium/content/browser/histogram_synchronizer.cc
+++ b/chromium/content/browser/histogram_synchronizer.cc
@@ -47,12 +47,11 @@ class HistogramSynchronizer::RequestContext {
   // A map from sequence_number_ to the actual RequestContexts.
   typedef std::map<int, RequestContext*> RequestContextMap;
 
-  RequestContext(const base::Closure& callback, int sequence_number)
-      : callback_(callback),
+  RequestContext(base::OnceClosure callback, int sequence_number)
+      : callback_(std::move(callback)),
         sequence_number_(sequence_number),
         received_process_group_count_(0),
-        processes_pending_(0) {
-  }
+        processes_pending_(0) {}
   ~RequestContext() {}
 
   void SetReceivedProcessGroupCount(bool done) {
@@ -84,10 +83,11 @@ class HistogramSynchronizer::RequestContext {
 
   // Register |callback| in |outstanding_requests_| map for the given
   // |sequence_number|.
-  static void Register(const base::Closure& callback, int sequence_number) {
+  static void Register(base::OnceClosure callback, int sequence_number) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-    RequestContext* request = new RequestContext(callback, sequence_number);
+    RequestContext* request =
+        new RequestContext(std::move(callback), sequence_number);
     outstanding_requests_.Get()[sequence_number] = request;
   }
 
@@ -120,7 +120,7 @@ class HistogramSynchronizer::RequestContext {
     bool received_process_group_count = request->received_process_group_count_;
     int unresponsive_processes = request->processes_pending_;
 
-    request->callback_.Run();
+    std::move(request->callback_).Run();
 
     delete request;
     outstanding_requests_.Get().erase(it);
@@ -142,7 +142,7 @@ class HistogramSynchronizer::RequestContext {
   }
 
   // Requests are made to asynchronously send data to the |callback_|.
-  base::Closure callback_;
+  base::OnceClosure callback_;
 
   // The sequence number used by the most recent update request to contact all
   // processes.
@@ -236,10 +236,9 @@ void HistogramSynchronizer::RegisterAndNotifyAllProcesses(
 
   int sequence_number = GetNextAvailableSequenceNumber(requester);
 
-  base::Closure callback = base::Bind(
+  base::OnceClosure callback = base::BindOnce(
       &HistogramSynchronizer::ForceHistogramSynchronizationDoneCallback,
-      base::Unretained(this),
-      sequence_number);
+      base::Unretained(this), sequence_number);
 
   RequestContext::Register(std::move(callback), sequence_number);
 
diff --git a/chromium/content/browser/histograms_internals_ui.cc b/chromium/content/browser/histograms_internals_ui.cc
index 276cc683491..4b9a018bda1 100644
--- a/chromium/content/browser/histograms_internals_ui.cc
+++ b/chromium/content/browser/histograms_internals_ui.cc
@@ -80,7 +80,7 @@ void HistogramsMessageHandler::HandleRequestHistograms(
     std::string ascii_output;
     histogram->WriteHTMLGraph(&ascii_output);
     ascii_output += "<br><hr><br>";
-    histograms_list.GetList().emplace_back(std::move(ascii_output));
+    histograms_list.Append(std::move(ascii_output));
   }
 
   ResolveJavascriptCallback(base::Value(callback_id),
diff --git a/chromium/content/browser/host_zoom_map_impl.cc b/chromium/content/browser/host_zoom_map_impl.cc
index d1acf73a8e5..45fbb2e9f46 100644
--- a/chromium/content/browser/host_zoom_map_impl.cc
+++ b/chromium/content/browser/host_zoom_map_impl.cc
@@ -24,9 +24,9 @@
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/common/page_zoom.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/url_util.h"
+#include "third_party/blink/public/common/page/page_zoom.h"
 
 namespace content {
 
@@ -225,7 +225,7 @@ void HostZoomMapImpl::SetZoomLevelForHostInternal(const std::string& host,
                                                   base::Time last_modified) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  if (ZoomValuesEqual(level, default_zoom_level_)) {
+  if (blink::PageZoomValuesEqual(level, default_zoom_level_)) {
     host_zoom_levels_.erase(host);
   } else {
     ZoomLevel& zoomLevel = host_zoom_levels_[host];
@@ -273,14 +273,14 @@ double HostZoomMapImpl::GetDefaultZoomLevel() {
 void HostZoomMapImpl::SetDefaultZoomLevel(double level) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  if (ZoomValuesEqual(level, default_zoom_level_))
-      return;
+  if (blink::PageZoomValuesEqual(level, default_zoom_level_))
+    return;
 
   default_zoom_level_ = level;
 
   // First, remove all entries that match the new default zoom level.
   for (auto it = host_zoom_levels_.begin(); it != host_zoom_levels_.end();) {
-    if (ZoomValuesEqual(it->second.level, default_zoom_level_))
+    if (blink::PageZoomValuesEqual(it->second.level, default_zoom_level_))
       it = host_zoom_levels_.erase(it);
     else
       it++;
diff --git a/chromium/content/browser/host_zoom_map_observer.cc b/chromium/content/browser/host_zoom_map_observer.cc
deleted file mode 100644
index 84203456779..00000000000
--- a/chromium/content/browser/host_zoom_map_observer.cc
+++ /dev/null
@@ -1,58 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/host_zoom_map_observer.h"
-
-#include "content/browser/frame_host/render_frame_host_impl.h"
-#include "content/browser/host_zoom_map_impl.h"
-#include "content/public/browser/navigation_handle.h"
-#include "content/public/browser/render_view_host.h"
-#include "content/public/browser/storage_partition.h"
-#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
-
-namespace content {
-
-HostZoomMapObserver::HostZoomMapObserver(WebContents* web_contents)
-    : WebContentsObserver(web_contents) {}
-
-HostZoomMapObserver::~HostZoomMapObserver() {}
-
-void HostZoomMapObserver::ReadyToCommitNavigation(
-    NavigationHandle* navigation_handle) {
-  if (!navigation_handle->IsInMainFrame())
-    return;
-
-  RenderFrameHost* render_frame_host =
-      navigation_handle->GetRenderFrameHost();
-  const auto& entry = host_zoom_ptrs_.find(render_frame_host);
-  if (entry == host_zoom_ptrs_.end())
-    return;
-
-  const mojom::HostZoomAssociatedPtr& host_zoom = entry->second;
-  DCHECK(host_zoom.is_bound());
-  if (host_zoom.encountered_error())
-    return;
-
-  RenderProcessHost* render_process_host = render_frame_host->GetProcess();
-  HostZoomMapImpl* host_zoom_map = static_cast<HostZoomMapImpl*>(
-      render_process_host->GetStoragePartition()->GetHostZoomMap());
-  double zoom_level = host_zoom_map->GetZoomLevelForView(
-      navigation_handle->GetURL(), render_process_host->GetID(),
-      render_frame_host->GetRenderViewHost()->GetRoutingID());
-  host_zoom->SetHostZoomLevel(navigation_handle->GetURL(), zoom_level);
-}
-
-void HostZoomMapObserver::RenderFrameCreated(RenderFrameHost* rfh) {
-  mojom::HostZoomAssociatedPtr host_zoom;
-  rfh->GetRemoteAssociatedInterfaces()->GetInterface(&host_zoom);
-  host_zoom_ptrs_[rfh] = std::move(host_zoom);
-}
-
-void HostZoomMapObserver::RenderFrameDeleted(RenderFrameHost* rfh) {
-  const auto& entry = host_zoom_ptrs_.find(rfh);
-  DCHECK(entry != host_zoom_ptrs_.end());
-  host_zoom_ptrs_.erase(entry);
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/host_zoom_map_observer.h b/chromium/content/browser/host_zoom_map_observer.h
deleted file mode 100644
index b61bad0b5f0..00000000000
--- a/chromium/content/browser/host_zoom_map_observer.h
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_HOST_ZOOM_MAP_OBSERVER_H_
-#define CONTENT_BROWSER_HOST_ZOOM_MAP_OBSERVER_H_
-
-#include "content/common/host_zoom.mojom.h"
-#include "content/public/browser/web_contents_observer.h"
-
-namespace content {
-
-class RenderFrameHost;
-
-class HostZoomMapObserver : private WebContentsObserver {
- public:
-  explicit HostZoomMapObserver(WebContents* web_contents);
-  ~HostZoomMapObserver() override;
-
- private:
-  // WebContentsObserver implementation:
-  void ReadyToCommitNavigation(NavigationHandle* navigation_handle) override;
-  void RenderFrameCreated(RenderFrameHost* rfh) override;
-  void RenderFrameDeleted(RenderFrameHost* rfh) override;
-
-  std::map<RenderFrameHost*, mojom::HostZoomAssociatedPtr> host_zoom_ptrs_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_HOST_ZOOM_MAP_OBSERVER_H_
diff --git a/chromium/content/browser/idle/idle_browsertest.cc b/chromium/content/browser/idle/idle_browsertest.cc
index d4ede6c2842..31c351d9f53 100644
--- a/chromium/content/browser/idle/idle_browsertest.cc
+++ b/chromium/content/browser/idle/idle_browsertest.cc
@@ -45,7 +45,7 @@ class IdleTest : public ContentBrowserTest {
 }  // namespace
 
 IN_PROC_BROWSER_TEST_F(IdleTest, Start) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   auto mock_time_provider = std::make_unique<NiceMock<MockIdleTimeProvider>>();
   auto* rph = static_cast<RenderProcessHostImpl*>(
diff --git a/chromium/content/browser/image_capture/image_capture_impl.cc b/chromium/content/browser/image_capture/image_capture_impl.cc
index 51ab2353269..9ef9af820da 100644
--- a/chromium/content/browser/image_capture/image_capture_impl.cc
+++ b/chromium/content/browser/image_capture/image_capture_impl.cc
@@ -20,7 +20,7 @@
 #include "media/capture/mojom/image_capture_types.h"
 #include "media/capture/video/video_capture_device.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 
 namespace content {
@@ -80,9 +80,9 @@ ImageCaptureImpl::~ImageCaptureImpl() {}
 
 // static
 void ImageCaptureImpl::Create(
-    media::mojom::ImageCaptureRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<ImageCaptureImpl>(),
-                          std::move(request));
+    mojo::PendingReceiver<media::mojom::ImageCapture> receiver) {
+  mojo::MakeSelfOwnedReceiver(std::make_unique<ImageCaptureImpl>(),
+                              std::move(receiver));
 }
 
 void ImageCaptureImpl::GetPhotoState(const std::string& source_id,
diff --git a/chromium/content/browser/image_capture/image_capture_impl.h b/chromium/content/browser/image_capture/image_capture_impl.h
index 3a4342b9845..b7bc6f891c6 100644
--- a/chromium/content/browser/image_capture/image_capture_impl.h
+++ b/chromium/content/browser/image_capture/image_capture_impl.h
@@ -6,6 +6,7 @@
 #define CONTENT_BROWSER_IMAGE_CAPTURE_IMAGE_CAPTURE_IMPL_H_
 
 #include "media/capture/mojom/image_capture.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
@@ -14,7 +15,8 @@ class ImageCaptureImpl : public media::mojom::ImageCapture {
   ImageCaptureImpl();
   ~ImageCaptureImpl() override;
 
-  static void Create(media::mojom::ImageCaptureRequest request);
+  static void Create(
+      mojo::PendingReceiver<media::mojom::ImageCapture> receiver);
 
   void GetPhotoState(const std::string& source_id,
                      GetPhotoStateCallback callback) override;
diff --git a/chromium/content/browser/indexed_db/database_impl.cc b/chromium/content/browser/indexed_db/database_impl.cc
index 3f382904a3e..e071f7dbd1e 100644
--- a/chromium/content/browser/indexed_db/database_impl.cc
+++ b/chromium/content/browser/indexed_db/database_impl.cc
@@ -105,7 +105,7 @@ void DatabaseImpl::CreateTransaction(
     int64_t transaction_id,
     const std::vector<int64_t>& object_store_ids,
     blink::mojom::IDBTransactionMode mode,
-    bool relaxed_durability) {
+    blink::mojom::IDBTransactionDurability durability) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (!connection_->IsConnected())
     return;
@@ -125,7 +125,7 @@ void DatabaseImpl::CreateTransaction(
       transaction_id,
       std::set<int64_t>(object_store_ids.begin(), object_store_ids.end()), mode,
       new IndexedDBBackingStore::Transaction(
-          connection_->database()->backing_store(), relaxed_durability));
+          connection_->database()->backing_store(), durability));
   connection_->database()->RegisterAndScheduleTransaction(transaction);
 
   dispatcher_host_->CreateAndBindTransactionImpl(
diff --git a/chromium/content/browser/indexed_db/database_impl.h b/chromium/content/browser/indexed_db/database_impl.h
index 92eb2c657cb..ce181bdb766 100644
--- a/chromium/content/browser/indexed_db/database_impl.h
+++ b/chromium/content/browser/indexed_db/database_impl.h
@@ -44,12 +44,13 @@ class DatabaseImpl : public blink::mojom::IDBDatabase {
   void RenameObjectStore(int64_t transaction_id,
                          int64_t object_store_id,
                          const base::string16& new_name) override;
-  void CreateTransaction(mojo::PendingAssociatedReceiver<
-                             blink::mojom::IDBTransaction> transaction_receiver,
-                         int64_t transaction_id,
-                         const std::vector<int64_t>& object_store_ids,
-                         blink::mojom::IDBTransactionMode mode,
-                         bool relaxed_durability) override;
+  void CreateTransaction(
+      mojo::PendingAssociatedReceiver<blink::mojom::IDBTransaction>
+          transaction_receiver,
+      int64_t transaction_id,
+      const std::vector<int64_t>& object_store_ids,
+      blink::mojom::IDBTransactionMode mode,
+      blink::mojom::IDBTransactionDurability durability) override;
   void Close() override;
   void VersionChangeIgnored() override;
   void AddObserver(int64_t transaction_id,
diff --git a/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.cc b/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.cc
index 584d42cf37e..5fff8f09588 100644
--- a/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.cc
@@ -119,17 +119,17 @@ void IndexedDBActiveBlobRegistry::ReleaseBlobRefThreadSafe(
 IndexedDBBlobInfo::ReleaseCallback
 IndexedDBActiveBlobRegistry::GetFinalReleaseCallback(int64_t database_id,
                                                      int64_t blob_key) {
-  return base::Bind(
+  return base::BindRepeating(
       &IndexedDBActiveBlobRegistry::ReleaseBlobRefThreadSafe,
       scoped_refptr<base::TaskRunner>(backing_store_->task_runner()),
       weak_factory_.GetWeakPtr(), database_id, blob_key);
 }
 
-base::Closure IndexedDBActiveBlobRegistry::GetAddBlobRefCallback(
+base::RepeatingClosure IndexedDBActiveBlobRegistry::GetAddBlobRefCallback(
     int64_t database_id,
     int64_t blob_key) {
-  return base::Bind(&IndexedDBActiveBlobRegistry::AddBlobRef,
-                    weak_factory_.GetWeakPtr(), database_id, blob_key);
+  return base::BindRepeating(&IndexedDBActiveBlobRegistry::AddBlobRef,
+                             weak_factory_.GetWeakPtr(), database_id, blob_key);
 }
 
 void IndexedDBActiveBlobRegistry::ForceShutdown() {
diff --git a/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.h b/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.h
index 45904630e6d..36eef6430fd 100644
--- a/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.h
+++ b/chromium/content/browser/indexed_db/indexed_db_active_blob_registry.h
@@ -39,7 +39,8 @@ class CONTENT_EXPORT IndexedDBActiveBlobRegistry {
       int64_t blob_key);
   // This closure holds a raw pointer to the IndexedDBActiveBlobRegistry,
   // and may not be called after it is deleted.
-  base::Closure GetAddBlobRefCallback(int64_t database_id, int64_t blob_key);
+  base::RepeatingClosure GetAddBlobRefCallback(int64_t database_id,
+                                               int64_t blob_key);
   // Call this to force the registry to drop its use counts, permitting the
   // factory to drop any blob-related refcount for the backing store.
   // This will also turn any outstanding callbacks into no-ops.
diff --git a/chromium/content/browser/indexed_db/indexed_db_backing_store.cc b/chromium/content/browser/indexed_db/indexed_db_backing_store.cc
index 87ced3c85d0..e9d1db7ac4d 100644
--- a/chromium/content/browser/indexed_db/indexed_db_backing_store.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_backing_store.cc
@@ -17,7 +17,7 @@
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/strings/string_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
@@ -327,7 +327,7 @@ bool IsPathTooLong(const FilePath& leveldb_dir) {
     const int min = 140;
     const int max = 300;
     const int num_buckets = 12;
-    UMA_HISTOGRAM_CUSTOM_COUNTS(
+    base::UmaHistogramCustomCounts(
         "WebCore.IndexedDB.BackingStore.OverlyLargeOriginLength",
         component_length, min, max, num_buckets);
     return true;
@@ -831,9 +831,21 @@ V2SchemaCorruptionStatus IndexedDBBackingStore::HasV2SchemaCorruption() {
 }
 
 std::unique_ptr<IndexedDBBackingStore::Transaction>
-IndexedDBBackingStore::CreateTransaction(bool relaxed_durability) {
-  return std::make_unique<IndexedDBBackingStore::Transaction>(
-      this, relaxed_durability);
+IndexedDBBackingStore::CreateTransaction(
+    blink::mojom::IDBTransactionDurability durability) {
+  return std::make_unique<IndexedDBBackingStore::Transaction>(this, durability);
+}
+
+// static
+bool IndexedDBBackingStore::ShouldSyncOnCommit(
+    blink::mojom::IDBTransactionDurability durability) {
+  switch (durability) {
+    case blink::mojom::IDBTransactionDurability::Default:
+    case blink::mojom::IDBTransactionDurability::Strict:
+      return true;
+    case blink::mojom::IDBTransactionDurability::Relaxed:
+      return false;
+  }
 }
 
 leveldb::Status IndexedDBBackingStore::GetCompleteMetadata(
@@ -1361,10 +1373,10 @@ class IndexedDBBackingStore::Transaction::ChainedBlobWriterImpl
       int64_t database_id,
       base::WeakPtr<IndexedDBBackingStore> backing_store,
       WriteDescriptorVec* blobs,
-      bool relaxed_durability_,
+      blink::mojom::IDBTransactionDurability durability,
       IndexedDBBackingStore::BlobWriteCallback callback) {
     auto writer = base::WrapRefCounted(new ChainedBlobWriterImpl(
-        database_id, backing_store, relaxed_durability_, std::move(callback)));
+        database_id, backing_store, durability, std::move(callback)));
     writer->blobs_.swap(*blobs);
     writer->iter_ = writer->blobs_.begin();
     backing_store->task_runner()->PostTask(
@@ -1406,17 +1418,18 @@ class IndexedDBBackingStore::Transaction::ChainedBlobWriterImpl
   }
 
   storage::FlushPolicy GetFlushPolicy() const override {
-    return relaxed_durability_ ? storage::FlushPolicy::NO_FLUSH_ON_COMPLETION
-                               : storage::FlushPolicy::FLUSH_ON_COMPLETION;
+    return IndexedDBBackingStore::ShouldSyncOnCommit(durability_)
+               ? storage::FlushPolicy::FLUSH_ON_COMPLETION
+               : storage::FlushPolicy::NO_FLUSH_ON_COMPLETION;
   }
 
  private:
   ChainedBlobWriterImpl(int64_t database_id,
                         base::WeakPtr<IndexedDBBackingStore> backing_store,
-                        bool relaxed_durability,
+                        blink::mojom::IDBTransactionDurability durability,
                         IndexedDBBackingStore::BlobWriteCallback callback)
       : waiting_for_callback_(false),
-        relaxed_durability_(relaxed_durability),
+        durability_(durability),
         database_id_(database_id),
         backing_store_(backing_store),
         callback_(std::move(callback)),
@@ -1444,7 +1457,7 @@ class IndexedDBBackingStore::Transaction::ChainedBlobWriterImpl
   }
 
   bool waiting_for_callback_;
-  bool relaxed_durability_;
+  blink::mojom::IDBTransactionDurability durability_;
   scoped_refptr<ChainedBlobWriterImpl> self_ref_;
   WriteDescriptorVec blobs_;
   WriteDescriptorVec::const_iterator iter_;
@@ -1519,7 +1532,7 @@ class LocalWriteClosure : public FileWriterDelegate::DelegateWriteCallback,
     this->last_modified_ = last_modified;
 
     delegate->Start(blob->CreateReader(),
-                    base::Bind(&LocalWriteClosure::Run, this));
+                    base::BindRepeating(&LocalWriteClosure::Run, this));
     chained_blob_writer_->set_delegate(std::move(delegate));
   }
 
@@ -1578,8 +1591,6 @@ bool IndexedDBBackingStore::WriteBlobFile(
     return false;
 
   bool use_copy_file = descriptor.is_file() && !descriptor.file_path().empty();
-  UMA_HISTOGRAM_BOOLEAN("Storage.IndexedDB.WriteBlobFileViaCopy",
-                        use_copy_file);
 
   FilePath path = GetBlobFileName(database_id, descriptor.key());
 
@@ -2849,13 +2860,13 @@ void IndexedDBBackingStore::ForceRunBlobCleanup() {
 // |backing_store| can be null in unittests (see FakeTransaction).
 IndexedDBBackingStore::Transaction::Transaction(
     IndexedDBBackingStore* backing_store,
-    bool relaxed_durability)
+    blink::mojom::IDBTransactionDurability durability)
     : backing_store_(backing_store),
       leveldb_factory_(backing_store ? backing_store->leveldb_factory_
                                      : nullptr),
       database_id_(-1),
       committing_(false),
-      relaxed_durability_(relaxed_durability) {}
+      durability_(durability) {}
 
 IndexedDBBackingStore::Transaction::~Transaction() {
   DCHECK(!committing_);
@@ -3079,8 +3090,8 @@ Status IndexedDBBackingStore::Transaction::CommitPhaseTwo() {
   // Actually commit. If this succeeds, the journals will appropriately
   // reflect pending blob work - dead files that should be deleted
   // immediately, and live files to monitor.
-  bool sync_on_commit = !relaxed_durability_;
-  s = transaction_->Commit(sync_on_commit);
+  s = transaction_->Commit(
+      IndexedDBBackingStore::ShouldSyncOnCommit(durability_));
   transaction_ = nullptr;
 
   if (!s.ok()) {
@@ -3149,7 +3160,7 @@ leveldb::Status IndexedDBBackingStore::Transaction::WriteNewBlobs(
   // can be destructed before the callback is triggered.
   chained_blob_writer_ = ChainedBlobWriterImpl::Create(
       database_id_, backing_store_->AsWeakPtr(), new_files_to_write,
-      relaxed_durability_,
+      durability_,
       base::BindOnce(
           [](base::WeakPtr<IndexedDBBackingStore::Transaction> transaction,
              void* tracing_end_ptr, BlobWriteCallback final_callback,
diff --git a/chromium/content/browser/indexed_db/indexed_db_backing_store.h b/chromium/content/browser/indexed_db/indexed_db_backing_store.h
index 58eec91c366..e4507e061de 100644
--- a/chromium/content/browser/indexed_db/indexed_db_backing_store.h
+++ b/chromium/content/browser/indexed_db/indexed_db_backing_store.h
@@ -137,7 +137,7 @@ class CONTENT_EXPORT IndexedDBBackingStore {
   class CONTENT_EXPORT Transaction {
    public:
     explicit Transaction(IndexedDBBackingStore* backing_store,
-                         bool relaxed_durability);
+                         blink::mojom::IDBTransactionDurability durability);
     virtual ~Transaction();
 
     virtual void Begin(std::vector<ScopeLock> locks);
@@ -300,10 +300,9 @@ class CONTENT_EXPORT IndexedDBBackingStore {
     // has been bumped, and journal cleaning should be deferred.
     bool committing_;
 
-    // This flag is passed to LevelDBScopes as |sync_on_commit|.
-    // If |relaxed_durability| is false, the commit flushes to disk.
-    // If true, it avoids the flush for performance at the cost of durability.
-    bool relaxed_durability_;
+    // This flag is passed to LevelDBScopes as |sync_on_commit|, converted
+    // via ShouldSyncOnCommit.
+    blink::mojom::IDBTransactionDurability durability_;
 
     base::WeakPtrFactory<Transaction> ptr_factory_{this};
 
@@ -584,12 +583,15 @@ class CONTENT_EXPORT IndexedDBBackingStore {
   bool is_incognito() const { return backing_store_mode_ == Mode::kInMemory; }
 
   virtual std::unique_ptr<Transaction> CreateTransaction(
-      bool relaxed_durability);
+      blink::mojom::IDBTransactionDurability durability);
 
   base::WeakPtr<IndexedDBBackingStore> AsWeakPtr() {
     return weak_factory_.GetWeakPtr();
   }
 
+  static bool ShouldSyncOnCommit(
+      blink::mojom::IDBTransactionDurability durability);
+
  protected:
   friend class IndexedDBOriginState;
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
index 9922fc6f6d8..c4c3fd5a75e 100644
--- a/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_backing_store_unittest.cc
@@ -467,8 +467,7 @@ TEST_F(IndexedDBBackingStoreTest, PutGetConsistency) {
         IndexedDBValue value = value1_;
         {
           IndexedDBBackingStore::Transaction transaction1(
-              backing_store(),
-              /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction1.Begin(CreateDummyLock());
           IndexedDBBackingStore::RecordIdentifier record;
           leveldb::Status s = backing_store()->PutRecord(&transaction1, 1, 1,
@@ -485,8 +484,7 @@ TEST_F(IndexedDBBackingStoreTest, PutGetConsistency) {
 
         {
           IndexedDBBackingStore::Transaction transaction2(
-              backing_store(),
-              /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction2.Begin(CreateDummyLock());
           IndexedDBValue result_value;
           EXPECT_TRUE(backing_store()
@@ -518,7 +516,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, PutGetConsistencyWithBlobs) {
       FROM_HERE, base::BindLambdaForTesting([&]() {
         // Initiate transaction1 - writing blobs.
         transaction1 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction1->Begin(CreateDummyLock());
         IndexedDBBackingStore::RecordIdentifier record;
         EXPECT_TRUE(
@@ -541,7 +539,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, PutGetConsistencyWithBlobs) {
 
         // Initiate transaction2, reading blobs.
         IndexedDBBackingStore::Transaction transaction2(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction2.Begin(CreateDummyLock());
         IndexedDBValue result_value;
         EXPECT_TRUE(backing_store()
@@ -562,7 +560,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, PutGetConsistencyWithBlobs) {
 
         // Initiate transaction3, deleting blobs.
         transaction3 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction3->Begin(CreateDummyLock());
         EXPECT_TRUE(backing_store()
                         ->DeleteRange(transaction3.get(), 1, 1,
@@ -643,7 +641,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, DeleteRange) {
 
           // Initiate transaction1 - write records.
           transaction1 = std::make_unique<IndexedDBBackingStore::Transaction>(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction1->Begin(CreateDummyLock());
           IndexedDBBackingStore::RecordIdentifier record;
           for (size_t i = 0; i < values.size(); ++i) {
@@ -670,7 +668,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, DeleteRange) {
 
           // Initiate transaction 2 - delete range.
           transaction2 = std::make_unique<IndexedDBBackingStore::Transaction>(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction2->Begin(CreateDummyLock());
           IndexedDBValue result_value;
           EXPECT_TRUE(backing_store()
@@ -762,7 +760,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, DeleteRangeEmptyRange) {
 
           // Initiate transaction1 - write records.
           transaction1 = std::make_unique<IndexedDBBackingStore::Transaction>(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction1->Begin(CreateDummyLock());
 
           IndexedDBBackingStore::RecordIdentifier record;
@@ -789,7 +787,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, DeleteRangeEmptyRange) {
 
           // Initiate transaction 2 - delete range.
           transaction2 = std::make_unique<IndexedDBBackingStore::Transaction>(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction2->Begin(CreateDummyLock());
           IndexedDBValue result_value;
           EXPECT_TRUE(backing_store()
@@ -832,7 +830,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, BlobJournalInterleavedTransactions) {
       FROM_HERE, base::BindLambdaForTesting([&]() {
         // Initiate transaction1.
         transaction1 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction1->Begin(CreateDummyLock());
         IndexedDBBackingStore::RecordIdentifier record1;
         EXPECT_TRUE(
@@ -855,7 +853,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, BlobJournalInterleavedTransactions) {
 
         // Initiate transaction2.
         transaction2 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction2->Begin(CreateDummyLock());
         IndexedDBBackingStore::RecordIdentifier record2;
         EXPECT_TRUE(
@@ -900,7 +898,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, LiveBlobJournal) {
   idb_context_->TaskRunner()->PostTask(
       FROM_HERE, base::BindLambdaForTesting([&]() {
         transaction1 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction1->Begin(CreateDummyLock());
         IndexedDBBackingStore::RecordIdentifier record;
         EXPECT_TRUE(
@@ -921,7 +919,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, LiveBlobJournal) {
         EXPECT_TRUE(transaction1->CommitPhaseTwo().ok());
 
         IndexedDBBackingStore::Transaction transaction2(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction2.Begin(CreateDummyLock());
         EXPECT_TRUE(
             backing_store()
@@ -942,7 +940,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, LiveBlobJournal) {
         }
 
         transaction3 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction3->Begin(CreateDummyLock());
         EXPECT_TRUE(backing_store()
                         ->DeleteRange(transaction3.get(), 1, 1,
@@ -1016,8 +1014,7 @@ TEST_F(IndexedDBBackingStoreTest, HighIds) {
         EncodeIDBKey(index_key, &index_key_raw);
         {
           IndexedDBBackingStore::Transaction transaction1(
-              backing_store(),
-              /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction1.Begin(CreateDummyLock());
           IndexedDBBackingStore::RecordIdentifier record;
           leveldb::Status s = backing_store()->PutRecord(
@@ -1046,8 +1043,7 @@ TEST_F(IndexedDBBackingStoreTest, HighIds) {
 
         {
           IndexedDBBackingStore::Transaction transaction2(
-              backing_store(),
-              /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction2.Begin(CreateDummyLock());
           IndexedDBValue result_value;
           leveldb::Status s = backing_store()->GetRecord(
@@ -1100,7 +1096,7 @@ TEST_F(IndexedDBBackingStoreTest, InvalidIds) {
         IndexedDBValue result_value;
 
         IndexedDBBackingStore::Transaction transaction1(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction1.Begin(CreateDummyLock());
 
         IndexedDBBackingStore::RecordIdentifier record;
@@ -1191,7 +1187,7 @@ TEST_F(IndexedDBBackingStoreTest, CreateDatabase) {
           database_id = database.id;
 
           IndexedDBBackingStore::Transaction transaction(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction.Begin(CreateDummyLock());
 
           IndexedDBObjectStoreMetadata object_store;
@@ -1392,7 +1388,7 @@ TEST_F(IndexedDBBackingStoreTest, SchemaUpgradeWithoutBlobsSurvives) {
           database_id = database.id;
 
           IndexedDBBackingStore::Transaction transaction(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction.Begin(CreateDummyLock());
 
           IndexedDBObjectStoreMetadata object_store;
@@ -1419,7 +1415,7 @@ TEST_F(IndexedDBBackingStoreTest, SchemaUpgradeWithoutBlobsSurvives) {
 
         // Save a value.
         IndexedDBBackingStore::Transaction transaction1(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction1.Begin(CreateDummyLock());
         IndexedDBBackingStore::RecordIdentifier record;
         leveldb::Status s = backing_store()->PutRecord(
@@ -1452,7 +1448,7 @@ TEST_F(IndexedDBBackingStoreTest, SchemaUpgradeWithoutBlobsSurvives) {
         IndexedDBValue value = value1_;
 
         IndexedDBBackingStore::Transaction transaction2(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction2.Begin(CreateDummyLock());
         IndexedDBValue result_value;
         EXPECT_TRUE(backing_store()
@@ -1519,7 +1515,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, SchemaUpgradeWithBlobsCorrupt) {
           database_id = database.id;
 
           IndexedDBBackingStore::Transaction transaction(
-              backing_store(), /*relaxed_durability=*/true);
+              backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
           transaction.Begin(CreateDummyLock());
 
           IndexedDBObjectStoreMetadata object_store;
@@ -1544,7 +1540,7 @@ TEST_F(IndexedDBBackingStoreTestWithBlobs, SchemaUpgradeWithBlobsCorrupt) {
       FROM_HERE, base::BindLambdaForTesting([&]() {
         // Initiate transaction1 - writing blobs.
         transaction1 = std::make_unique<IndexedDBBackingStore::Transaction>(
-            backing_store(), /*relaxed_durability=*/true);
+            backing_store(), blink::mojom::IDBTransactionDurability::Relaxed);
         transaction1->Begin(CreateDummyLock());
         IndexedDBBackingStore::RecordIdentifier record;
         EXPECT_TRUE(backing_store()
diff --git a/chromium/content/browser/indexed_db/indexed_db_blob_info.h b/chromium/content/browser/indexed_db/indexed_db_blob_info.h
index 0f1f29c4e46..1af66b4825f 100644
--- a/chromium/content/browser/indexed_db/indexed_db_blob_info.h
+++ b/chromium/content/browser/indexed_db/indexed_db_blob_info.h
@@ -60,7 +60,7 @@ class CONTENT_EXPORT IndexedDBBlobInfo {
   int64_t key() const { return key_; }
   const base::FilePath& file_path() const { return file_path_; }
   const base::Time& last_modified() const { return last_modified_; }
-  const base::Closure& mark_used_callback() const {
+  const base::RepeatingClosure& mark_used_callback() const {
     return mark_used_callback_;
   }
   const ReleaseCallback& release_callback() const { return release_callback_; }
@@ -69,7 +69,7 @@ class CONTENT_EXPORT IndexedDBBlobInfo {
   void set_file_path(const base::FilePath& file_path);
   void set_last_modified(const base::Time& time);
   void set_key(int64_t key);
-  void set_mark_used_callback(const base::Closure& mark_used_callback);
+  void set_mark_used_callback(const base::RepeatingClosure& mark_used_callback);
   void set_release_callback(const ReleaseCallback& release_callback);
 
  private:
@@ -84,7 +84,7 @@ class CONTENT_EXPORT IndexedDBBlobInfo {
 
   // Valid only when this comes out of the database.
   int64_t key_;
-  base::Closure mark_used_callback_;
+  base::RepeatingClosure mark_used_callback_;
   ReleaseCallback release_callback_;
 };
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_browsertest.cc b/chromium/content/browser/indexed_db/indexed_db_browsertest.cc
index 460ec5de7dc..ff0d1362c91 100644
--- a/chromium/content/browser/indexed_db/indexed_db_browsertest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_browsertest.cc
@@ -133,7 +133,7 @@ class IndexedDBBrowserTest : public ContentBrowserTest,
 
     base::string16 expected_title16(ASCIIToUTF16(expected_string));
     TitleWatcher title_watcher(shell->web_contents(), expected_title16);
-    NavigateToURL(shell, url);
+    EXPECT_TRUE(NavigateToURL(shell, url));
     EXPECT_EQ(expected_title16, title_watcher.WaitAndGetTitle());
   }
 
@@ -897,9 +897,9 @@ IN_PROC_BROWSER_TEST_P(IndexedDBBrowserTest, OperationOnCorruptedOpenDatabase) {
   ASSERT_TRUE(embedded_test_server()->Started() ||
               embedded_test_server()->InitializeAndListen());
   const Origin origin = Origin::Create(embedded_test_server()->base_url());
-  embedded_test_server()->RegisterRequestHandler(
-      base::Bind(&CorruptDBRequestHandler, base::Unretained(GetContext()),
-                 origin, s_corrupt_db_test_prefix, this));
+  embedded_test_server()->RegisterRequestHandler(base::BindRepeating(
+      &CorruptDBRequestHandler, base::Unretained(GetContext()), origin,
+      s_corrupt_db_test_prefix, this));
   embedded_test_server()->StartAcceptingConnections();
 
   std::string test_file = std::string(s_corrupt_db_test_prefix) +
@@ -1021,7 +1021,7 @@ IN_PROC_BROWSER_TEST_F(
 
   // Start on a different URL to force a new renderer process.
   Shell* new_shell = CreateBrowser();
-  NavigateToURL(new_shell, GURL(url::kAboutBlankURL));
+  EXPECT_TRUE(NavigateToURL(new_shell, GURL(url::kAboutBlankURL)));
   NavigateAndWaitForTitle(new_shell, "version_change_blocked.html", "#tab2",
                           "setVersion(3) blocked");
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_callbacks.cc b/chromium/content/browser/indexed_db/indexed_db_callbacks.cc
index 792d1b442bd..14923809951 100644
--- a/chromium/content/browser/indexed_db/indexed_db_callbacks.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_callbacks.cc
@@ -130,7 +130,7 @@ IndexedDBCallbacks::IndexedDBValueBlob::IndexedDBValueBlob(
     uuid_ = base::GenerateGUID();
   }
   (*blob_or_file_info)->uuid = uuid_;
-  receiver_ = mojo::MakeRequest(&(*blob_or_file_info)->blob);
+  receiver_ = (*blob_or_file_info)->blob.InitWithNewPipeAndPassReceiver();
 }
 IndexedDBCallbacks::IndexedDBValueBlob::IndexedDBValueBlob(
     IndexedDBValueBlob&& other) = default;
diff --git a/chromium/content/browser/indexed_db/indexed_db_connection.cc b/chromium/content/browser/indexed_db/indexed_db_connection.cc
index 6c847a63662..d970dd76c5d 100644
--- a/chromium/content/browser/indexed_db/indexed_db_connection.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_connection.cc
@@ -27,7 +27,8 @@ static int32_t g_next_indexed_db_connection_id;
 }  // namespace
 
 IndexedDBConnection::IndexedDBConnection(
-    int child_process_id,
+    IndexedDBExecutionContextConnectionTracker::Handle
+        execution_context_connection_handle,
     IndexedDBOriginStateHandle origin_state_handle,
     IndexedDBClassFactory* indexed_db_class_factory,
     base::WeakPtr<IndexedDBDatabase> database,
@@ -35,7 +36,8 @@ IndexedDBConnection::IndexedDBConnection(
     base::OnceCallback<void(IndexedDBConnection*)> on_close,
     scoped_refptr<IndexedDBDatabaseCallbacks> callbacks)
     : id_(g_next_indexed_db_connection_id++),
-      child_process_id_(child_process_id),
+      execution_context_connection_handle_(
+          std::move(execution_context_connection_handle)),
       origin_state_handle_(std::move(origin_state_handle)),
       indexed_db_class_factory_(indexed_db_class_factory),
       database_(std::move(database)),
@@ -43,6 +45,7 @@ IndexedDBConnection::IndexedDBConnection(
       on_close_(std::move(on_close)),
       callbacks_(callbacks) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  DCHECK(!execution_context_connection_handle_.is_null());
 }
 
 IndexedDBConnection::~IndexedDBConnection() {
diff --git a/chromium/content/browser/indexed_db/indexed_db_connection.h b/chromium/content/browser/indexed_db/indexed_db_connection.h
index 002b596b48f..4c0b381b005 100644
--- a/chromium/content/browser/indexed_db/indexed_db_connection.h
+++ b/chromium/content/browser/indexed_db/indexed_db_connection.h
@@ -14,6 +14,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "content/browser/indexed_db/indexed_db_database.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/browser/indexed_db/indexed_db_origin_state_handle.h"
 #include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
@@ -26,7 +27,8 @@ class IndexedDBOriginStateHandle;
 
 class CONTENT_EXPORT IndexedDBConnection {
  public:
-  IndexedDBConnection(int child_process_id,
+  IndexedDBConnection(IndexedDBExecutionContextConnectionTracker::Handle
+                          execution_context_connection_handle,
                       IndexedDBOriginStateHandle origin_state_handle,
                       IndexedDBClassFactory* indexed_db_class_factory,
                       base::WeakPtr<IndexedDBDatabase> database,
@@ -58,7 +60,9 @@ class CONTENT_EXPORT IndexedDBConnection {
   virtual void RemoveObservers(const std::vector<int32_t>& remove_observer_ids);
 
   int32_t id() const { return id_; }
-  int child_process_id() const { return child_process_id_; }
+  int child_process_id() const {
+    return execution_context_connection_handle_.render_process_id();
+  }
 
   base::WeakPtr<IndexedDBDatabase> database() const { return database_; }
   IndexedDBDatabaseCallbacks* callbacks() const { return callbacks_.get(); }
@@ -105,9 +109,10 @@ class CONTENT_EXPORT IndexedDBConnection {
 
   const int32_t id_;
 
-  // The process id of the child process this connection is associated with.
-  // Tracked for IndexedDBContextImpl::GetAllOriginsDetails and debugging.
-  const int child_process_id_;
+  // Allows IndexedDBExecutionContextConnectionTracker to keep track of the
+  // number of connections per execution context.
+  const IndexedDBExecutionContextConnectionTracker::Handle
+      execution_context_connection_handle_;
 
   // Keeps the factory for this origin alive.
   IndexedDBOriginStateHandle origin_state_handle_;
diff --git a/chromium/content/browser/indexed_db/indexed_db_connection_coordinator.cc b/chromium/content/browser/indexed_db/indexed_db_connection_coordinator.cc
index fbfe2dbb7f5..c0618ae4e94 100644
--- a/chromium/content/browser/indexed_db/indexed_db_connection_coordinator.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_connection_coordinator.cc
@@ -123,15 +123,14 @@ class IndexedDBConnectionCoordinator::OpenRequest
               IndexedDBDatabase* db,
               std::unique_ptr<IndexedDBPendingConnection> pending_connection,
               IndexedDBConnectionCoordinator* connection_coordinator,
-
               TasksAvailableCallback tasks_available_callback)
       : ConnectionRequest(std::move(origin_state_handle),
                           db,
                           connection_coordinator,
-
                           std::move(tasks_available_callback)),
         pending_(std::move(pending_connection)) {
     db_->metadata_.was_cold_open = pending_->was_cold_open;
+    DCHECK(!pending_->execution_context_connection_handle.is_null());
   }
 
   // Note: the |tasks_available_callback_| is NOT called here because the state
@@ -171,9 +170,9 @@ class IndexedDBConnectionCoordinator::OpenRequest
       // DEFAULT_VERSION throws exception.)
       DCHECK(is_new_database);
       pending_->callbacks->OnSuccess(
-          db_->CreateConnection(std::move(origin_state_handle_),
-                                pending_->database_callbacks,
-                                pending_->child_process_id),
+          db_->CreateConnection(
+              std::move(origin_state_handle_), pending_->database_callbacks,
+              std::move(pending_->execution_context_connection_handle)),
           db_->metadata_);
       state_ = RequestState::kDone;
       return;
@@ -183,9 +182,9 @@ class IndexedDBConnectionCoordinator::OpenRequest
         (new_version == old_version ||
          new_version == IndexedDBDatabaseMetadata::NO_VERSION)) {
       pending_->callbacks->OnSuccess(
-          db_->CreateConnection(std::move(origin_state_handle_),
-                                pending_->database_callbacks,
-                                pending_->child_process_id),
+          db_->CreateConnection(
+              std::move(origin_state_handle_), pending_->database_callbacks,
+              std::move(pending_->execution_context_connection_handle)),
           db_->metadata_);
       state_ = RequestState::kDone;
       return;
@@ -278,9 +277,9 @@ class IndexedDBConnectionCoordinator::OpenRequest
     DCHECK(state_ == RequestState::kPendingLocks);
 
     DCHECK(!lock_receiver_.locks.empty());
-    connection_ = db_->CreateConnection(std::move(origin_state_handle_),
-                                        pending_->database_callbacks,
-                                        pending_->child_process_id);
+    connection_ = db_->CreateConnection(
+        std::move(origin_state_handle_), pending_->database_callbacks,
+        std::move(pending_->execution_context_connection_handle));
     DCHECK(!connection_ptr_for_close_comparision_);
     connection_ptr_for_close_comparision_ = connection_.get();
     DCHECK_EQ(db_->connections().count(connection_.get()), 1UL);
@@ -288,12 +287,13 @@ class IndexedDBConnectionCoordinator::OpenRequest
     std::vector<int64_t> object_store_ids;
 
     state_ = RequestState::kPendingTransactionComplete;
-    bool relaxed_durability = false;
     IndexedDBTransaction* transaction = connection_->CreateTransaction(
         pending_->transaction_id,
         std::set<int64_t>(object_store_ids.begin(), object_store_ids.end()),
         blink::mojom::IDBTransactionMode::VersionChange,
-        db_->backing_store()->CreateTransaction(relaxed_durability).release());
+        db_->backing_store()
+            ->CreateTransaction(blink::mojom::IDBTransactionDurability::Strict)
+            .release());
 
     // Save a WeakPtr<IndexedDBTransaction> for the CreateAndBindTransaction
     // function to use later.
diff --git a/chromium/content/browser/indexed_db/indexed_db_context_impl.cc b/chromium/content/browser/indexed_db/indexed_db_context_impl.cc
index 93e50c529c0..5b1ae30a307 100644
--- a/chromium/content/browser/indexed_db/indexed_db_context_impl.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_context_impl.cc
@@ -13,7 +13,7 @@
 #include "base/files/file_enumerator.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/sequenced_task_runner.h"
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -382,9 +382,8 @@ void IndexedDBContextImpl::CopyOriginData(const Origin& origin,
 void IndexedDBContextImpl::ForceClose(const Origin origin,
                                       ForceCloseReason reason) {
   DCHECK(TaskRunner()->RunsTasksInCurrentSequence());
-  UMA_HISTOGRAM_ENUMERATION("WebCore.IndexedDB.Context.ForceCloseReason",
-                            reason, FORCE_CLOSE_REASON_MAX);
-
+  base::UmaHistogramEnumeration("WebCore.IndexedDB.Context.ForceCloseReason",
+                                reason, FORCE_CLOSE_REASON_MAX);
   if (!HasOrigin(origin))
     return;
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_database.cc b/chromium/content/browser/indexed_db/indexed_db_database.cc
index fb2f104d580..11520bd130e 100644
--- a/chromium/content/browser/indexed_db/indexed_db_database.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_database.cc
@@ -1671,10 +1671,14 @@ Status IndexedDBDatabase::OpenInternal() {
 std::unique_ptr<IndexedDBConnection> IndexedDBDatabase::CreateConnection(
     IndexedDBOriginStateHandle origin_state_handle,
     scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks,
-    int child_process_id) {
+    IndexedDBExecutionContextConnectionTracker::Handle
+        execution_context_connection_handle) {
+  const int render_process_id =
+      execution_context_connection_handle.render_process_id();
   std::unique_ptr<IndexedDBConnection> connection =
       std::make_unique<IndexedDBConnection>(
-          child_process_id, std::move(origin_state_handle), class_factory_,
+          std::move(execution_context_connection_handle),
+          std::move(origin_state_handle), class_factory_,
           weak_factory_.GetWeakPtr(),
           base::BindRepeating(&IndexedDBDatabase::VersionChangeIgnored,
                               weak_factory_.GetWeakPtr()),
@@ -1682,7 +1686,7 @@ std::unique_ptr<IndexedDBConnection> IndexedDBDatabase::CreateConnection(
                          weak_factory_.GetWeakPtr()),
           database_callbacks);
   connections_.insert(connection.get());
-  backing_store_->GrantChildProcessPermissions(child_process_id);
+  backing_store_->GrantChildProcessPermissions(render_process_id);
   return connection;
 }
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_database.h b/chromium/content/browser/indexed_db/indexed_db_database.h
index 7f1b003d97c..2c3ab733c4c 100644
--- a/chromium/content/browser/indexed_db/indexed_db_database.h
+++ b/chromium/content/browser/indexed_db/indexed_db_database.h
@@ -27,6 +27,7 @@
 #include "content/browser/indexed_db/indexed_db_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_connection_coordinator.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/browser/indexed_db/indexed_db_observer.h"
 #include "content/browser/indexed_db/indexed_db_origin_state_handle.h"
 #include "content/browser/indexed_db/indexed_db_pending_connection.h"
@@ -358,7 +359,8 @@ class CONTENT_EXPORT IndexedDBDatabase {
   std::unique_ptr<IndexedDBConnection> CreateConnection(
       IndexedDBOriginStateHandle origin_state_handle,
       scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks,
-      int child_process_id);
+      IndexedDBExecutionContextConnectionTracker::Handle
+          execution_context_connection_handle);
 
   // Ack that one of the connections notified with a "versionchange" event did
   // not promptly close. Therefore a "blocked" event should be fired at the
diff --git a/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc
index 26061954643..f94b056bab8 100644
--- a/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_database_unittest.cc
@@ -25,6 +25,7 @@
 #include "content/browser/indexed_db/indexed_db_class_factory.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_cursor.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/browser/indexed_db/indexed_db_factory_impl.h"
 #include "content/browser/indexed_db/indexed_db_fake_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_leveldb_coding.h"
@@ -43,10 +44,6 @@ using blink::IndexedDBIndexKeys;
 using blink::IndexedDBKey;
 using blink::IndexedDBKeyPath;
 
-namespace {
-const int kFakeChildProcessId = 0;
-}
-
 namespace content {
 namespace {
 
@@ -126,8 +123,10 @@ TEST_F(IndexedDBDatabaseTest, ConnectionLifecycle) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection1(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id1,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id1, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
           std::move(create_transaction_callback1)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection1));
@@ -141,8 +140,10 @@ TEST_F(IndexedDBDatabaseTest, ConnectionLifecycle) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection2(
       std::make_unique<IndexedDBPendingConnection>(
-          request2, callbacks2, kFakeChildProcessId, transaction_id2,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+          request2, callbacks2,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id2, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
           std::move(create_transaction_callback2)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection2));
@@ -170,8 +171,10 @@ TEST_F(IndexedDBDatabaseTest, ForcedClose) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection(
       std::make_unique<IndexedDBPendingConnection>(
-          request, callbacks, kFakeChildProcessId, upgrade_transaction_id,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+          request, callbacks,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          upgrade_transaction_id, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
           std::move(create_transaction_callback)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection));
@@ -181,12 +184,12 @@ TEST_F(IndexedDBDatabaseTest, ForcedClose) {
 
   const int64_t transaction_id = 123;
   const std::vector<int64_t> scope;
-  const bool relaxed_durability = true;
   IndexedDBTransaction* transaction = request->connection()->CreateTransaction(
       transaction_id, std::set<int64_t>(scope.begin(), scope.end()),
       blink::mojom::IDBTransactionMode::ReadOnly,
-      new IndexedDBBackingStore::Transaction(backing_store_.get(),
-                                             relaxed_durability));
+      new IndexedDBBackingStore::Transaction(
+          backing_store_.get(),
+          blink::mojom::IDBTransactionDurability::Relaxed));
   db_->RegisterAndScheduleTransaction(transaction);
 
   request->connection()->CloseAndReportForceClose();
@@ -231,8 +234,10 @@ TEST_F(IndexedDBDatabaseTest, PendingDelete) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id1,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id1, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
           std::move(create_transaction_callback1)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection));
@@ -280,8 +285,11 @@ TEST_F(IndexedDBDatabaseTest, OpenDeleteClear) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection1(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id1,
-          kDatabaseVersion, std::move(create_transaction_callback1)));
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id1, kDatabaseVersion,
+          std::move(create_transaction_callback1)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection1));
   RunPostedTasks();
@@ -299,8 +307,11 @@ TEST_F(IndexedDBDatabaseTest, OpenDeleteClear) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection2(
       std::make_unique<IndexedDBPendingConnection>(
-          request2, callbacks2, kFakeChildProcessId, transaction_id2,
-          kDatabaseVersion, std::move(create_transaction_callback2)));
+          request2, callbacks2,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id2, kDatabaseVersion,
+          std::move(create_transaction_callback2)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection2));
   RunPostedTasks();
@@ -318,8 +329,11 @@ TEST_F(IndexedDBDatabaseTest, OpenDeleteClear) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection3(
       std::make_unique<IndexedDBPendingConnection>(
-          request3, callbacks3, kFakeChildProcessId, transaction_id3,
-          kDatabaseVersion, std::move(create_transaction_callback3)));
+          request3, callbacks3,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id3, kDatabaseVersion,
+          std::move(create_transaction_callback3)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection3));
   RunPostedTasks();
@@ -351,8 +365,10 @@ TEST_F(IndexedDBDatabaseTest, ForceDelete) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id1,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id1, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
           std::move(create_transaction_callback1)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection));
@@ -388,8 +404,10 @@ TEST_F(IndexedDBDatabaseTest, ForceCloseWhileOpenPending) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id1,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id1, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
           std::move(create_transaction_callback1)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection));
@@ -408,8 +426,10 @@ TEST_F(IndexedDBDatabaseTest, ForceCloseWhileOpenPending) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection2(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id2, 3,
-          std::move(create_transaction_callback2)));
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id2, 3, std::move(create_transaction_callback2)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection2));
   RunPostedTasks();
@@ -431,11 +451,12 @@ TEST_F(IndexedDBDatabaseTest, ForceCloseWhileOpenAndDeletePending) {
   const int64_t transaction_id1 = 1;
   auto create_transaction_callback1 =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
-  std::unique_ptr<IndexedDBPendingConnection> connection =
-      std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id1,
-          IndexedDBDatabaseMetadata::DEFAULT_VERSION,
-          std::move(create_transaction_callback1));
+  std::unique_ptr<IndexedDBPendingConnection> connection = std::make_unique<
+      IndexedDBPendingConnection>(
+      request1, callbacks1,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id1, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+      std::move(create_transaction_callback1));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection));
   RunPostedTasks();
@@ -451,8 +472,10 @@ TEST_F(IndexedDBDatabaseTest, ForceCloseWhileOpenAndDeletePending) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   std::unique_ptr<IndexedDBPendingConnection> connection2(
       std::make_unique<IndexedDBPendingConnection>(
-          request1, callbacks1, kFakeChildProcessId, transaction_id2, 3,
-          std::move(create_transaction_callback2)));
+          request1, callbacks1,
+          IndexedDBExecutionContextConnectionTracker::Handle::
+              CreateForTesting(),
+          transaction_id2, 3, std::move(create_transaction_callback2)));
   db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                               std::move(connection2));
   RunPostedTasks();
@@ -508,8 +531,10 @@ class IndexedDBDatabaseOperationTest : public testing::Test {
         base::BindOnce(&CreateAndBindTransactionPlaceholder);
     std::unique_ptr<IndexedDBPendingConnection> connection(
         std::make_unique<IndexedDBPendingConnection>(
-            request_, callbacks_, kFakeChildProcessId, transaction_id,
-            IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+            request_, callbacks_,
+            IndexedDBExecutionContextConnectionTracker::Handle::
+                CreateForTesting(),
+            transaction_id, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
             std::move(create_transaction_callback1)));
     db_->ScheduleOpenConnection(IndexedDBOriginStateHandle(),
                                 std::move(connection));
diff --git a/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.cc b/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.cc
index c293c4411d5..8a5794bedc4 100644
--- a/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.cc
@@ -79,12 +79,17 @@ IndexedDBDispatcherHost::~IndexedDBDispatcherHost() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 }
 
-void IndexedDBDispatcherHost::AddBinding(
-    blink::mojom::IDBFactoryRequest request,
-    const url::Origin& origin) {
+void IndexedDBDispatcherHost::AddReceiver(
+    int render_process_id,
+    int render_frame_id,
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::IDBFactory> pending_receiver) {
   DCHECK(IDBTaskRunner()->RunsTasksInCurrentSequence());
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  bindings_.AddBinding(this, std::move(request), {origin});
+  DCHECK_EQ(render_process_id, ipc_process_id_);
+  receivers_.Add(this, std::move(pending_receiver),
+                 {origin, IndexedDBExecutionContextConnectionTracker(
+                              render_process_id, render_frame_id)});
 }
 
 void IndexedDBDispatcherHost::AddDatabaseBinding(
@@ -143,7 +148,7 @@ void IndexedDBDispatcherHost::GetDatabaseInfo(
         pending_callbacks) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  const auto& context = bindings_.dispatch_context();
+  const auto& context = receivers_.current_context();
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this->AsWeakPtr(), context.origin,
                              std::move(pending_callbacks), IDBTaskRunner()));
@@ -157,7 +162,7 @@ void IndexedDBDispatcherHost::GetDatabaseNames(
         pending_callbacks) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  const auto& context = bindings_.dispatch_context();
+  const auto& context = receivers_.current_context();
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this->AsWeakPtr(), context.origin,
                              std::move(pending_callbacks), IDBTaskRunner()));
@@ -177,7 +182,7 @@ void IndexedDBDispatcherHost::Open(
     int64_t transaction_id) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  const auto& context = bindings_.dispatch_context();
+  const auto& context = receivers_.current_context();
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this->AsWeakPtr(), context.origin,
                              std::move(pending_callbacks), IDBTaskRunner()));
@@ -192,8 +197,9 @@ void IndexedDBDispatcherHost::Open(
       std::move(transaction_receiver), context.origin);
   std::unique_ptr<IndexedDBPendingConnection> connection =
       std::make_unique<IndexedDBPendingConnection>(
-          std::move(callbacks), std::move(database_callbacks), ipc_process_id_,
-          transaction_id, version, std::move(create_transaction_callback));
+          std::move(callbacks), std::move(database_callbacks),
+          context.connection_tracker.CreateHandle(), transaction_id, version,
+          std::move(create_transaction_callback));
   // TODO(dgrogan): Don't let a non-existing database be opened (and therefore
   // created) if this origin is already over quota.
   indexed_db_context_->GetIDBFactory()->Open(name, std::move(connection),
@@ -206,7 +212,7 @@ void IndexedDBDispatcherHost::DeleteDatabase(
     bool force_close) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  const auto& context = bindings_.dispatch_context();
+  const auto& context = receivers_.current_context();
   scoped_refptr<IndexedDBCallbacks> callbacks(
       new IndexedDBCallbacks(this->AsWeakPtr(), context.origin,
                              std::move(pending_callbacks), IDBTaskRunner()));
@@ -219,7 +225,7 @@ void IndexedDBDispatcherHost::AbortTransactionsAndCompactDatabase(
     AbortTransactionsAndCompactDatabaseCallback mojo_callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  const auto& context = bindings_.dispatch_context();
+  const auto& context = receivers_.current_context();
   base::OnceCallback<void(leveldb::Status)> callback_on_io = base::BindOnce(
       &CallCompactionStatusCallbackOnIDBThread, std::move(mojo_callback));
   indexed_db_context_->GetIDBFactory()->AbortTransactionsAndCompactDatabase(
@@ -230,7 +236,7 @@ void IndexedDBDispatcherHost::AbortTransactionsForDatabase(
     AbortTransactionsForDatabaseCallback mojo_callback) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  const auto& context = bindings_.dispatch_context();
+  const auto& context = receivers_.current_context();
   base::OnceCallback<void(leveldb::Status)> callback_on_io = base::BindOnce(
       &CallAbortStatusCallbackOnIDBThread, std::move(mojo_callback));
   indexed_db_context_->GetIDBFactory()->AbortTransactionsForDatabase(
diff --git a/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.h b/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.h
index bc7f56ebc78..c5b2c3e0aa4 100644
--- a/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.h
+++ b/chromium/content/browser/indexed_db/indexed_db_dispatcher_host.h
@@ -18,12 +18,13 @@
 #include "base/sequence_checker.h"
 #include "base/strings/string16.h"
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host_observer.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/unique_associated_receiver_set.h"
 #include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom.h"
 
@@ -52,8 +53,11 @@ class CONTENT_EXPORT IndexedDBDispatcherHost
       scoped_refptr<IndexedDBContextImpl> indexed_db_context,
       scoped_refptr<ChromeBlobStorageContext> blob_storage_context);
 
-  void AddBinding(blink::mojom::IDBFactoryRequest request,
-                  const url::Origin& origin);
+  void AddReceiver(
+      int render_process_id,
+      int render_frame_id,
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::IDBFactory> pending_receiver);
 
   void AddDatabaseBinding(
       std::unique_ptr<blink::mojom::IDBDatabase> database,
@@ -135,12 +139,15 @@ class CONTENT_EXPORT IndexedDBDispatcherHost
   // Used to set file permissions for blob storage.
   const int ipc_process_id_;
 
-  // State for each client held in |bindings_|.
-  struct BindingState {
+  // State for each client held in |receivers_|.
+  struct ReceiverState {
     url::Origin origin;
+
+    // Tracks connections for this receiver.
+    IndexedDBExecutionContextConnectionTracker connection_tracker;
   };
 
-  mojo::BindingSet<blink::mojom::IDBFactory, BindingState> bindings_;
+  mojo::ReceiverSet<blink::mojom::IDBFactory, ReceiverState> receivers_;
   mojo::UniqueAssociatedReceiverSet<blink::mojom::IDBDatabase>
       database_receivers_;
   mojo::UniqueAssociatedReceiverSet<blink::mojom::IDBCursor> cursor_receivers_;
diff --git a/chromium/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
index 65b8a030f9a..dd4693b87dd 100644
--- a/chromium/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_dispatcher_host_unittest.cc
@@ -33,6 +33,8 @@
 #include "content/public/test/test_utils.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "storage/browser/test/mock_quota_manager.h"
 #include "storage/browser/test/mock_quota_manager_proxy.h"
 #include "storage/browser/test/mock_special_storage_policy.h"
@@ -45,8 +47,6 @@
 using blink::IndexedDBDatabaseMetadata;
 using blink::IndexedDBIndexKeys;
 using blink::IndexedDBKey;
-using blink::mojom::IDBFactory;
-using blink::mojom::IDBFactoryPtr;
 using blink::mojom::IDBValue;
 using blink::mojom::IDBValuePtr;
 using testing::_;
@@ -117,7 +117,7 @@ struct TestDatabaseConnection {
       default;
   ~TestDatabaseConnection() {}
 
-  void Open(IDBFactory* factory) {
+  void Open(blink::mojom::IDBFactory* factory) {
     factory->Open(
         open_callbacks->CreateInterfacePtrAndBind(),
         connection_callbacks->CreateInterfacePtrAndBind(), db_name, version,
@@ -201,7 +201,7 @@ class IndexedDBDispatcherHostTest : public testing::Test {
     base::RunLoop loop;
     context_impl_->TaskRunner()->PostTask(FROM_HERE,
                                           base::BindLambdaForTesting([&]() {
-                                            idb_mojo_factory_ = nullptr;
+                                            idb_mojo_factory_.reset();
                                             loop.Quit();
                                           }));
     loop.Run();
@@ -217,8 +217,10 @@ class IndexedDBDispatcherHostTest : public testing::Test {
     base::RunLoop loop;
     context_impl_->TaskRunner()->PostTask(
         FROM_HERE, base::BindLambdaForTesting([&]() {
-          host_->AddBinding(::mojo::MakeRequest(&idb_mojo_factory_),
-                            {url::Origin::Create(GURL(kOrigin))});
+          constexpr int kRenderFrameId = 42;
+          host_->AddReceiver(kFakeProcessId, kRenderFrameId,
+                             url::Origin::Create(GURL(kOrigin)),
+                             idb_mojo_factory_.BindNewPipeAndPassReceiver());
           loop.Quit();
         }));
     loop.Run();
@@ -233,7 +235,7 @@ class IndexedDBDispatcherHostTest : public testing::Test {
   scoped_refptr<MockQuotaManager> quota_manager_;
   scoped_refptr<IndexedDBContextImpl> context_impl_;
   std::unique_ptr<IndexedDBDispatcherHost, base::OnTaskRunnerDeleter> host_;
-  IDBFactoryPtr idb_mojo_factory_;
+  mojo::Remote<blink::mojom::IDBFactory> idb_mojo_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(IndexedDBDispatcherHostTest);
 };
@@ -277,7 +279,8 @@ TEST_F(IndexedDBDispatcherHostTest, CloseConnectionBeforeUpgrade) {
   loop2.Run();
 }
 
-TEST_F(IndexedDBDispatcherHostTest, CloseAfterUpgrade) {
+// Flaky on multiple platforms.  http://crbug.com/1001265
+TEST_F(IndexedDBDispatcherHostTest, DISABLED_CloseAfterUpgrade) {
   const int64_t kDBVersion = 1;
   const int64_t kTransactionId = 1;
   const int64_t kObjectStoreId = 10;
@@ -346,14 +349,8 @@ TEST_F(IndexedDBDispatcherHostTest, CloseAfterUpgrade) {
   loop3.Run();
 }
 
-// TODO(https://crbug.com/995716) Test is flaky on Mac ASan.
-#if defined(OS_MACOSX) && defined(ADDRESS_SANITIZER)
-#define MAYBE_OpenNewConnectionWhileUpgrading \
-  DISABLED_OpenNewConnectionWhileUpgrading
-#else
-#define MAYBE_OpenNewConnectionWhileUpgrading OpenNewConnectionWhileUpgrading
-#endif
-TEST_F(IndexedDBDispatcherHostTest, MAYBE_OpenNewConnectionWhileUpgrading) {
+// TODO(https://crbug.com/995716) Test is flaky on multiple platforms.
+TEST_F(IndexedDBDispatcherHostTest, DISABLED_OpenNewConnectionWhileUpgrading) {
   const int64_t kDBVersion = 1;
   const int64_t kTransactionId = 1;
   const int64_t kObjectStoreId = 10;
@@ -453,12 +450,7 @@ MATCHER_P(IsCallbackError, error_code, "") {
 }
 
 // See https://crbug.com/989723 for more context, this test seems to flake.
-#if defined(OS_WIN) || (defined(OS_MACOSX) && defined(ADDRESS_SANITIZER))
-#define MAYBE_PutWithInvalidBlob DISABLED_PutWithInvalidBlob
-#else
-#define MAYBE_PutWithInvalidBlob PutWithInvalidBlob
-#endif
-TEST_F(IndexedDBDispatcherHostTest, MAYBE_PutWithInvalidBlob) {
+TEST_F(IndexedDBDispatcherHostTest, DISABLED_PutWithInvalidBlob) {
   const int64_t kDBVersion = 1;
   const int64_t kTransactionId = 1;
   const int64_t kObjectStoreId = 10;
@@ -527,9 +519,10 @@ TEST_F(IndexedDBDispatcherHostTest, MAYBE_PutWithInvalidBlob) {
             blink::IndexedDBKeyPath(), false);
         // Call Put with an invalid blob.
         std::vector<blink::mojom::IDBBlobInfoPtr> blobs;
-        blink::mojom::BlobPtrInfo blob;
-        // Ignore the result of MakeRequest, to end up with an invalid blob.
-        mojo::MakeRequest(&blob);
+        mojo::PendingRemote<blink::mojom::Blob> blob;
+        // Ignore the result of InitWithNewPipeAndPassReceiver, to end up with
+        // an invalid blob.
+        ignore_result(blob.InitWithNewPipeAndPassReceiver());
         blobs.push_back(blink::mojom::IDBBlobInfo::New(
             std::move(blob), "fakeUUID", base::string16(), 100, nullptr));
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker.cc b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker.cc
new file mode 100644
index 00000000000..b095b14af94
--- /dev/null
+++ b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker.cc
@@ -0,0 +1,84 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
+
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/lock_observer.h"
+#include "content/public/common/content_client.h"
+
+namespace content {
+
+namespace {
+
+LockObserver* GetLockObserver() {
+  return GetContentClient()->browser()->GetLockObserver();
+}
+
+}  // namespace
+
+IndexedDBExecutionContextConnectionTracker::Handle::Handle(
+    scoped_refptr<State> state)
+    : state_(std::move(state)) {
+  DCHECK(state_);
+  int prev_num_connections = state_->num_connections++;
+  if (state_->IsFrame() && prev_num_connections == 0) {
+    LockObserver* lock_observer = GetLockObserver();
+    if (lock_observer) {
+      lock_observer->OnFrameStartsHoldingIndexedDBConnections(
+          state_->render_process_id, state_->render_frame_id);
+    }
+  }
+}
+
+IndexedDBExecutionContextConnectionTracker::Handle::Handle(Handle&& other) =
+    default;
+
+IndexedDBExecutionContextConnectionTracker::Handle&
+IndexedDBExecutionContextConnectionTracker::Handle::operator=(Handle&& other) =
+    default;
+
+IndexedDBExecutionContextConnectionTracker::Handle::~Handle() {
+  if (state_ && state_->IsFrame()) {
+    DCHECK_GT(state_->num_connections, 0);
+    --state_->num_connections;
+    if (state_->num_connections == 0) {
+      LockObserver* lock_observer = GetLockObserver();
+      if (lock_observer) {
+        lock_observer->OnFrameStopsHoldingIndexedDBConnections(
+            state_->render_process_id, state_->render_frame_id);
+      }
+    }
+  }
+}
+
+// static
+IndexedDBExecutionContextConnectionTracker::Handle
+IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting() {
+  return Handle(
+      base::MakeRefCounted<State>(MSG_ROUTING_NONE, MSG_ROUTING_NONE));
+}
+
+IndexedDBExecutionContextConnectionTracker::
+    IndexedDBExecutionContextConnectionTracker(int render_process_id,
+                                               int render_frame_id)
+    : state_(base::MakeRefCounted<State>(render_process_id, render_frame_id)) {}
+
+IndexedDBExecutionContextConnectionTracker::
+    IndexedDBExecutionContextConnectionTracker(
+        IndexedDBExecutionContextConnectionTracker&& other) = default;
+
+IndexedDBExecutionContextConnectionTracker::
+    ~IndexedDBExecutionContextConnectionTracker() {}
+
+IndexedDBExecutionContextConnectionTracker::Handle
+IndexedDBExecutionContextConnectionTracker::CreateHandle() const {
+  return Handle(state_);
+}
+
+IndexedDBExecutionContextConnectionTracker::State::State(int render_process_id,
+                                                         int render_frame_id)
+    : render_process_id(render_process_id), render_frame_id(render_frame_id) {}
+
+}  // namespace content
diff --git a/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h
new file mode 100644
index 00000000000..2d74c6ce4a2
--- /dev/null
+++ b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h
@@ -0,0 +1,102 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_EXECUTION_CONTEXT_CONNECTION_TRACKER_H_
+#define CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_EXECUTION_CONTEXT_CONNECTION_TRACKER_H_
+
+#include "base/logging.h"
+#include "base/memory/ref_counted.h"
+#include "content/common/content_export.h"
+#include "ipc/ipc_message.h"
+
+namespace content {
+
+// Tracks the number of connections (pending or active) for an execution
+// context. Notifies content::LockObserver when the number switches between zero
+// and non-zero.
+//
+// There should be one IndexedDBExecutionContextConnectionTracker per execution
+// context that uses IndexedDB. Each connection (pending or active) should own a
+// Handle obtained from that IndexedDBExecutionContextConnectionTracker.
+//
+// TODO(https://crbug.com/980533): Currently, this only notifies LockObserver
+// for connections held by frame. We should also notify for connections held by
+// worker. This requires finding a unique type to identify a frame or a worker.
+class CONTENT_EXPORT IndexedDBExecutionContextConnectionTracker {
+ private:
+  struct State;
+
+ public:
+  // Each connection (pending or active) should own a non-null Handle that
+  // allows keeping track of the number of connections for the parent execution
+  // context.
+  class CONTENT_EXPORT Handle {
+   public:
+    Handle(scoped_refptr<State> state);
+    Handle(Handle&& other);
+    Handle& operator=(Handle&& other);
+    ~Handle();
+
+    // Creates a dummy non-null Handle for testing.
+    static Handle CreateForTesting();
+
+    // Returns true if this Handle is null. A connection should be associated
+    // with a non-null Handle.
+    bool is_null() const { return !state_; }
+
+    // Returns the routing id of the process hosting the execution context for
+    // which this Handle tracks connections.
+    int render_process_id() const {
+      DCHECK(!is_null());
+      return state_->render_process_id;
+    }
+
+   private:
+    scoped_refptr<State> state_;
+
+    Handle(const Handle&) = delete;
+    Handle& operator=(const Handle& other) = delete;
+  };
+
+  // |render_process_id| identifies the process hosting the execution context.
+  // |render_frame_id| identifies the frame if the execution context is a frame,
+  // or is MSG_ROUTING_NONE if the execution context is a worker.
+  IndexedDBExecutionContextConnectionTracker(int render_process_id,
+                                             int render_frame_id);
+
+  IndexedDBExecutionContextConnectionTracker(
+      IndexedDBExecutionContextConnectionTracker&& other);
+
+  ~IndexedDBExecutionContextConnectionTracker();
+
+  // Creates a handle that will be owned by a connection (pending or active) in
+  // the execution context.
+  Handle CreateHandle() const;
+
+ private:
+  struct State : public base::RefCounted<State> {
+    State(int render_process_id, int render_frame_id);
+
+    bool IsFrame() const { return render_frame_id != MSG_ROUTING_NONE; }
+
+    const int render_process_id;
+    const int render_frame_id;
+    int num_connections = 0;
+
+   private:
+    friend class base::RefCounted<State>;
+    ~State() = default;
+  };
+
+  scoped_refptr<State> state_;
+
+  IndexedDBExecutionContextConnectionTracker(
+      const IndexedDBExecutionContextConnectionTracker&) = delete;
+  IndexedDBExecutionContextConnectionTracker& operator=(
+      const IndexedDBExecutionContextConnectionTracker& other) = delete;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_INDEXED_DB_INDEXED_DB_EXECUTION_CONTEXT_CONNECTION_TRACKER_H_
diff --git a/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker_browsertest.cc b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker_browsertest.cc
new file mode 100644
index 00000000000..d34ac4ff698
--- /dev/null
+++ b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker_browsertest.cc
@@ -0,0 +1,348 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
+
+#include "base/macros.h"
+#include "base/test/test_timeouts.h"
+#include "build/build_config.h"
+#include "components/network_session_configurator/common/network_switches.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/lock_observer.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/common/content_client.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+#if defined(OS_ANDROID)
+#include "base/android/build_info.h"
+#endif
+
+namespace content {
+
+namespace {
+
+void RunLoopWithTimeout() {
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+}
+
+class TestBrowserClient : public ContentBrowserClient {
+ public:
+  explicit TestBrowserClient(LockObserver* lock_observer)
+      : lock_observer_(lock_observer) {}
+  ~TestBrowserClient() override = default;
+
+  LockObserver* GetLockObserver() override { return lock_observer_; }
+
+ private:
+  LockObserver* const lock_observer_;
+
+  TestBrowserClient(const TestBrowserClient&) = delete;
+  TestBrowserClient& operator=(const TestBrowserClient&) = delete;
+};
+
+class MockObserver : public LockObserver {
+ public:
+  MockObserver() = default;
+  ~MockObserver() = default;
+
+  // LockObserver:
+  MOCK_METHOD2(OnFrameStartsHoldingWebLocks,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStopsHoldingWebLocks,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStartsHoldingIndexedDBConnections,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStopsHoldingIndexedDBConnections,
+               void(int render_process_id, int render_frame_id));
+};
+
+class IndexedDBExecutionContextConnectionTrackerBrowserTest
+    : public ContentBrowserTest {
+ public:
+  IndexedDBExecutionContextConnectionTrackerBrowserTest() = default;
+  ~IndexedDBExecutionContextConnectionTrackerBrowserTest() override = default;
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ContentBrowserTest::SetUpCommandLine(command_line);
+    command_line->AppendSwitch(switches::kIgnoreCertificateErrors);
+  }
+
+  void SetUpOnMainThread() override {
+    ContentBrowserTest::SetUpOnMainThread();
+
+    // TODO(https://crbug.com/1011765): Navigation fails on Android Kit Kat.
+    if (!ShouldRunTest())
+      return;
+
+    original_client_ = SetBrowserClientForTesting(&test_browser_client_);
+
+    host_resolver()->AddRule("*", "127.0.0.1");
+    server_.ServeFilesFromSourceDirectory(GetTestDataFilePath());
+    ASSERT_TRUE(server_.Start());
+
+    ASSERT_TRUE(NavigateToURL(shell(), GetTestURL("a.com")));
+  }
+
+  void TearDownOnMainThread() override {
+    ContentBrowserTest::TearDownOnMainThread();
+    if (original_client_)
+      SetBrowserClientForTesting(original_client_);
+  }
+
+  bool ShouldRunTest() const {
+#if defined(OS_ANDROID)
+    // Don't run the test if we couldn't override BrowserClient. It happens only
+    // on Android Kitkat or older systems.
+    if (!original_client_)
+      return false;
+
+    // TODO(https://crbug.com/1011765): Navigation fails on Android Kit Kat.
+    if (base::android::BuildInfo::GetInstance()->sdk_int() <=
+        base::android::SDK_VERSION_KITKAT) {
+      return false;
+    }
+#endif
+    return true;
+  }
+
+  GURL GetTestURL(const std::string& hostname) const {
+    return server_.GetURL(hostname,
+                          "/indexeddb/open_connection/open_connection.html");
+  }
+
+  testing::StrictMock<MockObserver> mock_observer_;
+
+ private:
+  net::EmbeddedTestServer server_{net::EmbeddedTestServer::TYPE_HTTPS};
+  ContentBrowserClient* original_client_ = nullptr;
+  TestBrowserClient test_browser_client_{&mock_observer_};
+
+  IndexedDBExecutionContextConnectionTrackerBrowserTest(
+      const IndexedDBExecutionContextConnectionTrackerBrowserTest&) = delete;
+  IndexedDBExecutionContextConnectionTrackerBrowserTest& operator=(
+      const IndexedDBExecutionContextConnectionTrackerBrowserTest&) = delete;
+};
+
+bool OpenConnectionA(RenderFrameHost* rfh) {
+  return EvalJs(rfh, R"(
+      (async () => {
+        return await OpenConnection('A');
+      }) ();
+  )")
+      .ExtractBool();
+}
+
+bool OpenConnectionB(RenderFrameHost* rfh) {
+  return EvalJs(rfh, R"(
+      (async () => {
+        return await OpenConnection('B');
+      }) ();
+  )")
+      .ExtractBool();
+}
+
+}  // namespace
+
+// Verify that content::LockObserver is notified when a frame opens/closes an
+// IndexedDB connection.
+IN_PROC_BROWSER_TEST_F(IndexedDBExecutionContextConnectionTrackerBrowserTest,
+                       ObserverSingleConnection) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Open a connection. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingIndexedDBConnections(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(OpenConnectionA(rfh));
+    // Quit when OnFrameStartsHoldingIndexedDBConnections(process_id, frame_id)
+    // is invoked.
+    run_loop.Run();
+  }
+
+  {
+    // Close the connection. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingIndexedDBConnections(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "CloseConnection('A');"));
+    // Quit when OnFrameStopsHoldingIndexedDBConnections(process_id, frame_id)
+    // is invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is notified when a frame opens multiple
+// IndexedDB connections (notifications only when the number of held connections
+// switches between zero and non-zero).
+IN_PROC_BROWSER_TEST_F(IndexedDBExecutionContextConnectionTrackerBrowserTest,
+                       ObserverTwoLocks) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Open a connection. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingIndexedDBConnections(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(OpenConnectionA(rfh));
+    // Quit when OnFrameStartsHoldingIndexedDBConnections(process_id, frame_id)
+    // is invoked.
+    run_loop.Run();
+  }
+
+  // Open a second connection. Don't expect a notification.
+  EXPECT_TRUE(OpenConnectionB(rfh));
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+
+  // Close the connection. Don't expect a notification.
+  EXPECT_TRUE(ExecJs(rfh, "CloseConnection('B');"));
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+
+  {
+    // Close the connection. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingIndexedDBConnections(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "CloseConnection('A');"));
+    // Quit when OnFrameStopsHoldingIndexedDBConnections(process_id, frame_id)
+    // is invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is notified when a frame with active
+// IndexedDB connections is navigated away.
+IN_PROC_BROWSER_TEST_F(IndexedDBExecutionContextConnectionTrackerBrowserTest,
+                       ObserverNavigate) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Open a connection. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingIndexedDBConnections(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(OpenConnectionA(rfh));
+    // Quit when OnFrameStartsHoldingIndexedDBConnections(process_id, frame_id)
+    // is invoked.
+    run_loop.Run();
+  }
+
+  {
+    // Navigate away. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingIndexedDBConnections(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(shell(), GetTestURL("b.com")));
+    // Quit when OnFrameStopsHoldingIndexedDBConnections(process_id, frame_id)
+    // is invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is *not* notified when a dedicated worker
+// opens/closes an IndexedDB connection.
+IN_PROC_BROWSER_TEST_F(IndexedDBExecutionContextConnectionTrackerBrowserTest,
+                       ObserverDedicatedWorker) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+
+  // Use EvalJs() instead of ExecJs() to ensure that this doesn't return before
+  // the lock is acquired and released by the worker.
+  EXPECT_TRUE(EvalJs(rfh, R"(
+      (async () => {
+        await OpenConnectionFromDedicatedWorker();
+        return true;
+      }) ();
+  )")
+                  .ExtractBool());
+
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+}
+
+// SharedWorkers are not enabled on Android. https://crbug.com/154571
+#if !defined(OS_ANDROID)
+// Verify that content::LockObserver is *not* notified when a shared worker
+// opens/closes an IndexedDB connection.
+IN_PROC_BROWSER_TEST_F(IndexedDBExecutionContextConnectionTrackerBrowserTest,
+                       ObserverSharedWorker) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+
+  // Use EvalJs() instead of ExecJs() to ensure that this doesn't return before
+  // the lock is acquired and released by the worker.
+  EXPECT_TRUE(EvalJs(rfh, R"(
+      (async () => {
+        await OpenConnectionFromSharedWorker();
+        return true;
+      }) ();
+  )")
+                  .ExtractBool());
+
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+}
+#endif  // !defined(OS_ANDROID)
+
+// Verify that content::LockObserver is *not* notified when a service worker
+// opens/closes an IndexedDB connection.
+IN_PROC_BROWSER_TEST_F(IndexedDBExecutionContextConnectionTrackerBrowserTest,
+                       ObserverServiceWorker) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+
+  // Use EvalJs() instead of ExecJs() to ensure that this doesn't return before
+  // the lock is acquired and released by the worker.
+  EXPECT_TRUE(EvalJs(rfh, R"(
+      (async () => {
+        await OpenConnectionFromServiceWorker();
+        return true;
+      }) ();
+  )")
+                  .ExtractBool());
+
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker_unittest.cc
new file mode 100644
index 00000000000..3acabce799a
--- /dev/null
+++ b/chromium/content/browser/indexed_db/indexed_db_execution_context_connection_tracker_unittest.cc
@@ -0,0 +1,168 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
+
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/lock_observer.h"
+#include "content/public/common/content_client.h"
+#include "testing/gmock/include/gmock/gmock.h"
+
+namespace content {
+
+namespace {
+
+class TestBrowserClient : public ContentBrowserClient {
+ public:
+  explicit TestBrowserClient(LockObserver* lock_observer)
+      : lock_observer_(lock_observer) {}
+  ~TestBrowserClient() override = default;
+
+  LockObserver* GetLockObserver() override { return lock_observer_; }
+
+ private:
+  LockObserver* const lock_observer_;
+
+  TestBrowserClient(const TestBrowserClient&) = delete;
+  TestBrowserClient& operator=(const TestBrowserClient&) = delete;
+};
+
+class MockObserver : public LockObserver {
+ public:
+  MockObserver() = default;
+  ~MockObserver() = default;
+
+  // LockObserver:
+  MOCK_METHOD2(OnFrameStartsHoldingWebLocks,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStopsHoldingWebLocks,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStartsHoldingIndexedDBConnections,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStopsHoldingIndexedDBConnections,
+               void(int render_process_id, int render_frame_id));
+};
+
+constexpr int kTestRenderProcessId = 4;
+constexpr int kTestRenderFrameId = 2;
+
+class IndexedDBExecutionContextConnectionTrackerTest : public testing::Test {
+ protected:
+  IndexedDBExecutionContextConnectionTrackerTest() = default;
+
+  void SetUp() {
+    testing::Test::SetUp();
+    original_client_ = SetBrowserClientForTesting(&test_browser_client_);
+  }
+
+  void TearDown() {
+    SetBrowserClientForTesting(original_client_);
+    testing::Test::TearDown();
+  }
+
+  testing::StrictMock<MockObserver> observer_;
+
+ private:
+  TestBrowserClient test_browser_client_{&observer_};
+  ContentBrowserClient* original_client_ = nullptr;
+};
+
+}  // namespace
+
+TEST_F(IndexedDBExecutionContextConnectionTrackerTest, SingleHandle) {
+  IndexedDBExecutionContextConnectionTracker tracker(kTestRenderProcessId,
+                                                     kTestRenderFrameId);
+
+  {
+    // Expect a notification that the execution context started holding
+    // connections when the first handle is created.
+    EXPECT_CALL(observer_, OnFrameStartsHoldingIndexedDBConnections(
+                               kTestRenderProcessId, kTestRenderFrameId));
+    IndexedDBExecutionContextConnectionTracker::Handle handle =
+        tracker.CreateHandle();
+    testing::Mock::VerifyAndClear(&observer_);
+
+    // Expect a notification that the execution context stopped holding
+    // connections when the handle goes out of scope.
+    EXPECT_CALL(observer_, OnFrameStopsHoldingIndexedDBConnections(
+                               kTestRenderProcessId, kTestRenderFrameId));
+  }
+  testing::Mock::VerifyAndClear(&observer_);
+}
+
+TEST_F(IndexedDBExecutionContextConnectionTrackerTest, TwoHandles) {
+  IndexedDBExecutionContextConnectionTracker tracker(kTestRenderProcessId,
+                                                     kTestRenderFrameId);
+
+  {
+    // Expect a notification that the execution context started holding
+    // connections when the first handle is created.
+    EXPECT_CALL(observer_, OnFrameStartsHoldingIndexedDBConnections(
+                               kTestRenderProcessId, kTestRenderFrameId));
+    IndexedDBExecutionContextConnectionTracker::Handle handle =
+        tracker.CreateHandle();
+    testing::Mock::VerifyAndClear(&observer_);
+
+    {
+      // Don't expect notifications when a second handle is created and
+      // destroyed.
+      IndexedDBExecutionContextConnectionTracker::Handle other_handle =
+          tracker.CreateHandle();
+    }
+
+    // Expect a notification that the execution context stopped holding
+    // connections when the handle goes out of scope.
+    EXPECT_CALL(observer_, OnFrameStopsHoldingIndexedDBConnections(
+                               kTestRenderProcessId, kTestRenderFrameId));
+  }
+  testing::Mock::VerifyAndClear(&observer_);
+}
+
+TEST_F(IndexedDBExecutionContextConnectionTrackerTest, MoveHandle) {
+  IndexedDBExecutionContextConnectionTracker tracker(kTestRenderProcessId,
+                                                     kTestRenderFrameId);
+  std::unique_ptr<IndexedDBExecutionContextConnectionTracker::Handle>
+      moved_handle;
+
+  {
+    // Expect a notification that the execution context started holding
+    // connections when the first handle is created.
+    EXPECT_CALL(observer_, OnFrameStartsHoldingIndexedDBConnections(
+                               kTestRenderProcessId, kTestRenderFrameId));
+    IndexedDBExecutionContextConnectionTracker::Handle handle =
+        tracker.CreateHandle();
+    testing::Mock::VerifyAndClear(&observer_);
+
+    // Move |handle| to |moved_handle|.
+    moved_handle =
+        std::make_unique<IndexedDBExecutionContextConnectionTracker::Handle>(
+            std::move(handle));
+
+    // Don't expect a notification when |handle| goes out of scope, because it
+    // was moved to |moved_handle|.
+  }
+
+  // Expect a notification that the execution context stopped holding
+  // connections when |moved_handle| is destroyed.
+  EXPECT_CALL(observer_, OnFrameStopsHoldingIndexedDBConnections(
+                             kTestRenderProcessId, kTestRenderFrameId));
+  moved_handle.reset();
+  testing::Mock::VerifyAndClear(&observer_);
+}
+
+TEST_F(IndexedDBExecutionContextConnectionTrackerTest, WorkerHandle) {
+  // Passing MSG_ROUTING_NONE as |render_frame_id| to indicate that this is a
+  // worker execution context.
+  IndexedDBExecutionContextConnectionTracker tracker(kTestRenderProcessId,
+                                                     MSG_ROUTING_NONE);
+
+  {
+    // Don't expect observer notifications when a handle is created and goes out
+    // of scope.
+    IndexedDBExecutionContextConnectionTracker::Handle handle =
+        tracker.CreateHandle();
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/indexed_db/indexed_db_factory_impl.cc b/chromium/content/browser/indexed_db/indexed_db_factory_impl.cc
index 8b48f8a8f8d..1996d41ccc1 100644
--- a/chromium/content/browser/indexed_db/indexed_db_factory_impl.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_factory_impl.cc
@@ -19,7 +19,7 @@
 #include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/sequenced_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/strcat.h"
@@ -466,7 +466,7 @@ void IndexedDBFactoryImpl::HandleBackingStoreCorruption(
       path_base.Append(indexed_db::GetLevelDBFileName(saved_origin));
   leveldb::Status s = leveldb_factory_->DestroyLevelDB(file_path);
   DLOG_IF(ERROR, !s.ok()) << "Unable to delete backing store: " << s.ToString();
-  UMA_HISTOGRAM_ENUMERATION(
+  base::UmaHistogramEnumeration(
       "WebCore.IndexedDB.DestroyCorruptBackingStoreStatus",
       leveldb_env::GetLevelDBStatusUMAValue(s),
       leveldb_env::LEVELDB_STATUS_MAX);
@@ -827,7 +827,7 @@ IndexedDBFactoryImpl::OpenAndVerifyIndexedDBBackingStore(
       // This is a special case where we want to make sure the database is
       // deleted, so we try to delete again.
       status = leveldb_factory_->DestroyLevelDB(database_path);
-      UMA_HISTOGRAM_ENUMERATION(
+      base::UmaHistogramEnumeration(
           "WebCore.IndexedDB.DestroyCorruptBackingStoreStatus",
           leveldb_env::GetLevelDBStatusUMAValue(status),
           leveldb_env::LEVELDB_STATUS_MAX);
diff --git a/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc
index 40d7bfa170d..2563efc6d89 100644
--- a/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_factory_unittest.cc
@@ -23,6 +23,7 @@
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 #include "content/browser/indexed_db/indexed_db_data_format_version.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/browser/indexed_db/indexed_db_factory_impl.h"
 #include "content/browser/indexed_db/indexed_db_origin_state.h"
 #include "content/browser/indexed_db/indexed_db_pre_close_task_queue.h"
@@ -147,8 +148,9 @@ class IndexedDBFactoryTest : public testing::Test {
     auto create_transaction_callback =
         base::BindOnce(&CreateAndBindTransactionPlaceholder);
     auto connection = std::make_unique<IndexedDBPendingConnection>(
-        callbacks, db_callbacks, /*child_process_id=*/0, transaction_id,
-        IndexedDBDatabaseMetadata::NO_VERSION,
+        callbacks, db_callbacks,
+        IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+        transaction_id, IndexedDBDatabaseMetadata::NO_VERSION,
         std::move(create_transaction_callback));
 
     // Do the first half of the upgrade, and request the upgrade from renderer.
@@ -446,8 +448,9 @@ TEST_F(IndexedDBFactoryTest, ContextDestructionClosesConnections) {
   auto create_transaction_callback =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   auto connection = std::make_unique<IndexedDBPendingConnection>(
-      callbacks, db_callbacks, /*child_process_id=*/0, transaction_id,
-      IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+      callbacks, db_callbacks,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
       std::move(create_transaction_callback));
   factory()->Open(ASCIIToUTF16("db"), std::move(connection), origin,
                   context()->data_path());
@@ -507,8 +510,9 @@ TEST_F(IndexedDBFactoryTest, ConnectionForceClose) {
   auto create_transaction_callback =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   auto connection = std::make_unique<IndexedDBPendingConnection>(
-      callbacks, db_callbacks, /*child_process_id=*/0, transaction_id,
-      IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+      callbacks, db_callbacks,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
       std::move(create_transaction_callback));
   factory()->Open(ASCIIToUTF16("db"), std::move(connection), origin,
                   context()->data_path());
@@ -538,8 +542,9 @@ TEST_F(IndexedDBFactoryTest, DatabaseForceCloseDuringUpgrade) {
   auto create_transaction_callback =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   auto connection = std::make_unique<IndexedDBPendingConnection>(
-      callbacks, db_callbacks, /*child_process_id=*/0, transaction_id,
-      IndexedDBDatabaseMetadata::NO_VERSION,
+      callbacks, db_callbacks,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id, IndexedDBDatabaseMetadata::NO_VERSION,
       std::move(create_transaction_callback));
 
   // Do the first half of the upgrade, and request the upgrade from renderer.
@@ -575,8 +580,9 @@ TEST_F(IndexedDBFactoryTest, ConnectionCloseDuringUpgrade) {
   auto create_transaction_callback =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   auto connection = std::make_unique<IndexedDBPendingConnection>(
-      callbacks, db_callbacks, /*child_process_id=*/0, transaction_id,
-      IndexedDBDatabaseMetadata::NO_VERSION,
+      callbacks, db_callbacks,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id, IndexedDBDatabaseMetadata::NO_VERSION,
       std::move(create_transaction_callback));
 
   // Do the first half of the upgrade, and request the upgrade from renderer.
@@ -714,7 +720,8 @@ TEST_F(IndexedDBFactoryTest, QuotaErrorOnDiskFull) {
   auto create_transaction_callback =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   auto connection = std::make_unique<IndexedDBPendingConnection>(
-      callbacks, dummy_database_callbacks, /*child_process_id=*/0,
+      callbacks, dummy_database_callbacks,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
       /*transaction_id=*/1, /*version=*/1,
       std::move(create_transaction_callback));
   factory()->Open(name, std::move(connection), origin, context()->data_path());
@@ -755,8 +762,8 @@ TEST_F(IndexedDBFactoryTest, DatabaseFailedOpen) {
 
   auto connection = std::make_unique<IndexedDBPendingConnection>(
       callbacks, db_callbacks,
-      /*child_process_id=*/0, transaction_id, db_version,
-      std::move(create_transaction_callback));
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id, db_version, std::move(create_transaction_callback));
   {
     base::RunLoop loop;
     callbacks->CallOnUpgradeNeeded(
@@ -790,8 +797,8 @@ TEST_F(IndexedDBFactoryTest, DatabaseFailedOpen) {
         base::BindOnce(&CreateAndBindTransactionPlaceholder);
     auto connection = std::make_unique<IndexedDBPendingConnection>(
         failed_open_callbacks, db_callbacks2,
-        /*child_process_id=*/0, transaction_id, db_version,
-        std::move(create_transaction_callback));
+        IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+        transaction_id, db_version, std::move(create_transaction_callback));
     factory()->Open(db_name, std::move(connection), origin,
                     context()->data_path());
     EXPECT_TRUE(factory()->IsDatabaseOpen(origin, db_name));
@@ -837,7 +844,9 @@ TEST_F(IndexedDBFactoryTest, DataFormatVersion) {
     auto create_transaction_callback =
         base::BindOnce(&CreateAndBindTransactionPlaceholder);
     auto pending_connection = std::make_unique<IndexedDBPendingConnection>(
-        callbacks, db_callbacks, /*child_process_id=*/0, transaction_id,
+        callbacks, db_callbacks,
+        IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+        transaction_id,
         /*version=*/1, std::move(create_transaction_callback));
 
     {
diff --git a/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.cc b/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.cc
index a753e4937d9..d48f6f6339d 100644
--- a/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.cc
@@ -158,7 +158,10 @@ IndexedDBFakeBackingStore::OpenIndexCursor(
 
 IndexedDBFakeBackingStore::FakeTransaction::FakeTransaction(
     leveldb::Status result)
-    : IndexedDBBackingStore::Transaction(nullptr, true), result_(result) {}
+    : IndexedDBBackingStore::Transaction(
+          nullptr,
+          blink::mojom::IDBTransactionDurability::Relaxed),
+      result_(result) {}
 void IndexedDBFakeBackingStore::FakeTransaction::Begin(
     std::vector<ScopeLock> locks) {}
 leveldb::Status IndexedDBFakeBackingStore::FakeTransaction::CommitPhaseOne(
@@ -177,7 +180,8 @@ leveldb::Status IndexedDBFakeBackingStore::FakeTransaction::Rollback() {
 }
 
 std::unique_ptr<IndexedDBBackingStore::Transaction>
-IndexedDBFakeBackingStore::CreateTransaction(bool relaxed_durability) {
+IndexedDBFakeBackingStore::CreateTransaction(
+    blink::mojom::IDBTransactionDurability durability) {
   return std::make_unique<FakeTransaction>(leveldb::Status::OK());
 }
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.h b/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.h
index 240fc83f81a..46725de04b1 100644
--- a/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.h
+++ b/chromium/content/browser/indexed_db/indexed_db_fake_backing_store.h
@@ -128,7 +128,7 @@ class IndexedDBFakeBackingStore : public IndexedDBBackingStore {
   };
 
   std::unique_ptr<IndexedDBBackingStore::Transaction> CreateTransaction(
-      bool relaxed_durability) override;
+      blink::mojom::IDBTransactionDurability durability) override;
 
  protected:
  private:
diff --git a/chromium/content/browser/indexed_db/indexed_db_internals_ui.cc b/chromium/content/browser/indexed_db/indexed_db_internals_ui.cc
index 9929c2764c3..08e0a6b0a68 100644
--- a/chromium/content/browser/indexed_db/indexed_db_internals_ui.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_internals_ui.cc
@@ -102,8 +102,8 @@ void IndexedDBInternalsUI::GetAllOrigins(const base::ListValue* args) {
       web_ui()->GetWebContents()->GetBrowserContext();
 
   BrowserContext::StoragePartitionCallback cb =
-      base::Bind(&IndexedDBInternalsUI::AddContextFromStoragePartition,
-                 base::Unretained(this));
+      base::BindRepeating(&IndexedDBInternalsUI::AddContextFromStoragePartition,
+                          base::Unretained(this));
   BrowserContext::ForEachStoragePartition(browser_context, std::move(cb));
 }
 
@@ -174,7 +174,7 @@ bool IndexedDBInternalsUI::GetOriginContext(
 
   StoragePartition* result_partition;
   BrowserContext::StoragePartitionCallback cb =
-      base::Bind(&FindContext, path, &result_partition, context);
+      base::BindRepeating(&FindContext, path, &result_partition, context);
   BrowserContext::ForEachStoragePartition(browser_context, std::move(cb));
 
   if (!result_partition || !(context->get()))
@@ -259,7 +259,7 @@ void IndexedDBInternalsUI::DownloadOriginDataOnIndexedDBThread(
 
   std::vector<base::FilePath> paths = context->GetStoragePaths(origin);
   zip::ZipWithFilterCallback(context->data_path(), zip_path,
-                             base::Bind(AllowWhitelistedPaths, paths));
+                             base::BindRepeating(AllowWhitelistedPaths, paths));
 
   base::PostTask(FROM_HERE, {BrowserThread::UI},
                  base::BindOnce(&IndexedDBInternalsUI::OnDownloadDataReady,
@@ -368,9 +368,9 @@ void IndexedDBInternalsUI::OnDownloadDataReady(
   // This is how to watch for the download to finish: first wait for it
   // to start, then attach a download::DownloadItem::Observer to observe the
   // state change to the finished state.
-  dl_params->set_callback(base::Bind(&IndexedDBInternalsUI::OnDownloadStarted,
-                                     base::Unretained(this), partition_path,
-                                     origin, temp_path, connection_count));
+  dl_params->set_callback(base::BindOnce(
+      &IndexedDBInternalsUI::OnDownloadStarted, base::Unretained(this),
+      partition_path, origin, temp_path, connection_count));
 
   BrowserContext* context = web_contents->GetBrowserContext();
   BrowserContext::GetDownloadManager(context)->DownloadUrl(
diff --git a/chromium/content/browser/indexed_db/indexed_db_leveldb_operations.cc b/chromium/content/browser/indexed_db/indexed_db_leveldb_operations.cc
index 7a68fa0a66a..a1f49ed13fe 100644
--- a/chromium/content/browser/indexed_db/indexed_db_leveldb_operations.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_leveldb_operations.cc
@@ -6,7 +6,7 @@
 
 #include "base/files/file_util.h"
 #include "base/json/json_reader.h"
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/no_destructor.h"
 #include "base/values.h"
 #include "content/browser/indexed_db/indexed_db_data_format_version.h"
@@ -126,7 +126,7 @@ bool IsPathTooLong(const base::FilePath& leveldb_dir) {
     const int min = 140;
     const int max = 300;
     const int num_buckets = 12;
-    UMA_HISTOGRAM_CUSTOM_COUNTS(
+    base::UmaHistogramCustomCounts(
         "WebCore.IndexedDB.BackingStore.OverlyLargeOriginLength",
         component_length, min, max, num_buckets);
     return true;
diff --git a/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc b/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc
index 7d2d81a3784..3e11fa2b1f6 100644
--- a/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_pending_connection.cc
@@ -6,22 +6,28 @@
 
 #include <utility>
 
+#include "base/logging.h"
+
 namespace content {
 
 IndexedDBPendingConnection::IndexedDBPendingConnection(
     scoped_refptr<IndexedDBCallbacks> callbacks,
     scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks,
-    int child_process_id,
+    IndexedDBExecutionContextConnectionTracker::Handle
+        execution_context_connection_handle,
     int64_t transaction_id,
     int64_t version,
     base::OnceCallback<void(base::WeakPtr<IndexedDBTransaction>)>
         create_transaction_callback)
     : callbacks(callbacks),
       database_callbacks(database_callbacks),
-      child_process_id(child_process_id),
+      execution_context_connection_handle(
+          std::move(execution_context_connection_handle)),
       transaction_id(transaction_id),
       version(version),
-      create_transaction_callback(std::move(create_transaction_callback)) {}
+      create_transaction_callback(std::move(create_transaction_callback)) {
+  DCHECK(!this->execution_context_connection_handle.is_null());
+}
 
 IndexedDBPendingConnection::~IndexedDBPendingConnection() {}
 
diff --git a/chromium/content/browser/indexed_db/indexed_db_pending_connection.h b/chromium/content/browser/indexed_db/indexed_db_pending_connection.h
index ebe7d79b4d4..f23a678b1d8 100644
--- a/chromium/content/browser/indexed_db/indexed_db_pending_connection.h
+++ b/chromium/content/browser/indexed_db/indexed_db_pending_connection.h
@@ -12,6 +12,7 @@
 #include "content/browser/indexed_db/indexed_db_callbacks.h"
 #include "content/browser/indexed_db/indexed_db_data_loss_info.h"
 #include "content/browser/indexed_db/indexed_db_database_callbacks.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/common/content_export.h"
 #include "url/origin.h"
 
@@ -24,7 +25,8 @@ struct CONTENT_EXPORT IndexedDBPendingConnection {
   IndexedDBPendingConnection(
       scoped_refptr<IndexedDBCallbacks> callbacks,
       scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks,
-      int child_process_id,
+      IndexedDBExecutionContextConnectionTracker::Handle
+          execution_context_connection_handle,
       int64_t transaction_id,
       int64_t version,
       base::OnceCallback<void(base::WeakPtr<IndexedDBTransaction>)>
@@ -32,7 +34,8 @@ struct CONTENT_EXPORT IndexedDBPendingConnection {
   ~IndexedDBPendingConnection();
   scoped_refptr<IndexedDBCallbacks> callbacks;
   scoped_refptr<IndexedDBDatabaseCallbacks> database_callbacks;
-  int child_process_id;
+  IndexedDBExecutionContextConnectionTracker::Handle
+      execution_context_connection_handle;
   int64_t transaction_id;
   int64_t version;
   IndexedDBDataLossInfo data_loss_info;
diff --git a/chromium/content/browser/indexed_db/indexed_db_reporting.cc b/chromium/content/browser/indexed_db/indexed_db_reporting.cc
index b8c4baac864..05c015aea3b 100644
--- a/chromium/content/browser/indexed_db/indexed_db_reporting.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_reporting.cc
@@ -6,6 +6,7 @@
 
 #include <string>
 
+#include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/strcat.h"
 #include "content/browser/indexed_db/indexed_db_leveldb_coding.h"
@@ -63,8 +64,8 @@ void ParseAndReportCorruptionDetails(const std::string& histogram_name,
 
 void ReportOpenStatus(IndexedDBBackingStoreOpenResult result,
                       const url::Origin& origin) {
-  UMA_HISTOGRAM_ENUMERATION("WebCore.IndexedDB.BackingStore.OpenStatus", result,
-                            INDEXED_DB_BACKING_STORE_OPEN_MAX);
+  base::UmaHistogramEnumeration("WebCore.IndexedDB.BackingStore.OpenStatus",
+                                result, INDEXED_DB_BACKING_STORE_OPEN_MAX);
   const std::string suffix = OriginToCustomHistogramSuffix(origin);
   // Data from the WebCore.IndexedDB.BackingStore.OpenStatus histogram is used
   // to generate a graph. So as not to alter the meaning of that graph,
@@ -104,7 +105,8 @@ void ReportSchemaVersion(int version, const url::Origin& origin) {
 }
 
 void ReportV2Schema(bool has_broken_blobs, const url::Origin& origin) {
-  UMA_HISTOGRAM_BOOLEAN("WebCore.IndexedDB.SchemaV2HasBlobs", has_broken_blobs);
+  base::UmaHistogramBoolean("WebCore.IndexedDB.SchemaV2HasBlobs",
+                            has_broken_blobs);
   const std::string suffix = OriginToCustomHistogramSuffix(origin);
   if (!suffix.empty()) {
     base::BooleanHistogram::FactoryGet(
diff --git a/chromium/content/browser/indexed_db/indexed_db_transaction.cc b/chromium/content/browser/indexed_db/indexed_db_transaction.cc
index c8dba541446..9492a77e2d8 100644
--- a/chromium/content/browser/indexed_db/indexed_db_transaction.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_transaction.cc
@@ -10,6 +10,7 @@
 #include "base/bind.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
@@ -166,9 +167,9 @@ leveldb::Status IndexedDBTransaction::Abort(
   if (state_ == FINISHED)
     return leveldb::Status::OK();
 
-  UMA_HISTOGRAM_ENUMERATION("WebCore.IndexedDB.TransactionAbortReason",
-                            ExceptionCodeToUmaEnum(error.code()),
-                            UmaIDBExceptionExclusiveMaxValue);
+  base::UmaHistogramEnumeration("WebCore.IndexedDB.TransactionAbortReason",
+                                ExceptionCodeToUmaEnum(error.code()),
+                                UmaIDBExceptionExclusiveMaxValue);
 
   aborted_ = true;
   timeout_timer_.Stop();
diff --git a/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc
index 5c2e384fb2c..4b27a9afa7e 100644
--- a/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_transaction_unittest.cc
@@ -18,6 +18,7 @@
 #include "content/browser/indexed_db/indexed_db_class_factory.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_database_error.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/browser/indexed_db/indexed_db_factory_impl.h"
 #include "content/browser/indexed_db/indexed_db_fake_backing_store.h"
 #include "content/browser/indexed_db/indexed_db_leveldb_coding.h"
@@ -40,8 +41,6 @@ void SetToTrue(bool* value) {
 
 }  // namespace
 
-const int kFakeProcessId = 10;
-
 class AbortObserver {
  public:
   AbortObserver() : abort_task_called_(false) {}
@@ -120,11 +119,12 @@ class IndexedDBTransactionTest : public testing::Test {
   }
 
   std::unique_ptr<IndexedDBConnection> CreateConnection() {
-    auto connection = std::unique_ptr<IndexedDBConnection>(
-        std::make_unique<IndexedDBConnection>(
-            kFakeProcessId, IndexedDBOriginStateHandle(),
-            IndexedDBClassFactory::Get(), db_->AsWeakPtr(), base::DoNothing(),
-            base::DoNothing(), new MockIndexedDBDatabaseCallbacks()));
+    auto connection = std::unique_ptr<
+        IndexedDBConnection>(std::make_unique<IndexedDBConnection>(
+        IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+        IndexedDBOriginStateHandle(), IndexedDBClassFactory::Get(),
+        db_->AsWeakPtr(), base::DoNothing(), base::DoNothing(),
+        new MockIndexedDBDatabaseCallbacks()));
     db_->AddConnectionForTesting(connection.get());
     return connection;
   }
diff --git a/chromium/content/browser/indexed_db/indexed_db_unittest.cc b/chromium/content/browser/indexed_db/indexed_db_unittest.cc
index 2aca1e69a4d..5cfb32e3aec 100644
--- a/chromium/content/browser/indexed_db/indexed_db_unittest.cc
+++ b/chromium/content/browser/indexed_db/indexed_db_unittest.cc
@@ -15,6 +15,7 @@
 #include "base/time/default_clock.h"
 #include "content/browser/indexed_db/indexed_db_connection.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
+#include "content/browser/indexed_db/indexed_db_execution_context_connection_tracker.h"
 #include "content/browser/indexed_db/indexed_db_factory_impl.h"
 #include "content/browser/indexed_db/indexed_db_origin_state.h"
 #include "content/browser/indexed_db/leveldb/leveldb_env.h"
@@ -242,7 +243,6 @@ TEST_F(IndexedDBTest, ForceCloseOpenDatabasesOnDelete) {
       base::MakeRefCounted<ForceCloseDBCallbacks>(context(), kTestOrigin);
   base::FilePath test_path = context()->GetFilePathForTesting(kTestOrigin);
 
-  const int child_process_id = 0;
   const int64_t host_transaction_id = 0;
   const int64_t version = 0;
 
@@ -252,7 +252,9 @@ TEST_F(IndexedDBTest, ForceCloseOpenDatabasesOnDelete) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   factory->Open(base::ASCIIToUTF16("opendb"),
                 std::make_unique<IndexedDBPendingConnection>(
-                    open_callbacks, open_db_callbacks, child_process_id,
+                    open_callbacks, open_db_callbacks,
+                    IndexedDBExecutionContextConnectionTracker::Handle::
+                        CreateForTesting(),
                     host_transaction_id, version,
                     std::move(create_transaction_callback1)),
                 kTestOrigin, context()->data_path());
@@ -262,7 +264,9 @@ TEST_F(IndexedDBTest, ForceCloseOpenDatabasesOnDelete) {
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   factory->Open(base::ASCIIToUTF16("closeddb"),
                 std::make_unique<IndexedDBPendingConnection>(
-                    closed_callbacks, closed_db_callbacks, child_process_id,
+                    closed_callbacks, closed_db_callbacks,
+                    IndexedDBExecutionContextConnectionTracker::Handle::
+                        CreateForTesting(),
                     host_transaction_id, version,
                     std::move(create_transaction_callback2)),
                 kTestOrigin, context()->data_path());
@@ -310,7 +314,6 @@ TEST_F(IndexedDBTest, ForceCloseOpenDatabasesOnCommitFailure) {
   auto* factory =
       static_cast<IndexedDBFactoryImpl*>(context()->GetIDBFactory());
 
-  const int child_process_id = 0;
   const int64_t transaction_id = 1;
 
   auto callbacks = base::MakeRefCounted<MockIndexedDBCallbacks>();
@@ -318,8 +321,9 @@ TEST_F(IndexedDBTest, ForceCloseOpenDatabasesOnCommitFailure) {
   auto create_transaction_callback1 =
       base::BindOnce(&CreateAndBindTransactionPlaceholder);
   auto connection = std::make_unique<IndexedDBPendingConnection>(
-      callbacks, db_callbacks, child_process_id, transaction_id,
-      IndexedDBDatabaseMetadata::DEFAULT_VERSION,
+      callbacks, db_callbacks,
+      IndexedDBExecutionContextConnectionTracker::Handle::CreateForTesting(),
+      transaction_id, IndexedDBDatabaseMetadata::DEFAULT_VERSION,
       std::move(create_transaction_callback1));
   factory->Open(base::ASCIIToUTF16("db"), std::move(connection),
                 Origin(kTestOrigin), context()->data_path());
diff --git a/chromium/content/browser/indexed_db/leveldb/leveldb_env.cc b/chromium/content/browser/indexed_db/leveldb/leveldb_env.cc
index 2a8828fe640..21de8bf8199 100644
--- a/chromium/content/browser/indexed_db/leveldb/leveldb_env.cc
+++ b/chromium/content/browser/indexed_db/leveldb/leveldb_env.cc
@@ -5,6 +5,7 @@
 #include "content/browser/indexed_db/leveldb/leveldb_env.h"
 
 #include "base/files/file_util.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
 #include "base/system/sys_info.h"
diff --git a/chromium/content/browser/indexed_db/scopes/disjoint_range_lock_manager.cc b/chromium/content/browser/indexed_db/scopes/disjoint_range_lock_manager.cc
index b40a5ab9c97..12e938573f0 100644
--- a/chromium/content/browser/indexed_db/scopes/disjoint_range_lock_manager.cc
+++ b/chromium/content/browser/indexed_db/scopes/disjoint_range_lock_manager.cc
@@ -146,8 +146,7 @@ bool DisjointRangeLockManager::AcquireLock(
     ++lock.acquired_count;
     lock.lock_mode = request.type;
     auto released_callback = base::BindOnce(
-        &DisjointRangeLockManager::LockReleased, weak_factory_.GetWeakPtr(),
-        request.level, std::move(request.range));
+        &DisjointRangeLockManager::LockReleased, weak_factory_.GetWeakPtr());
     locks_holder->locks.emplace_back(std::move(request.range), request.level,
                                      std::move(released_callback));
     std::move(acquired_callback).Run();
@@ -189,9 +188,8 @@ void DisjointRangeLockManager::LockReleased(int level, ScopeLockRange range) {
 
       ++lock.acquired_count;
       lock.lock_mode = requester.requested_type;
-      auto released_callback =
-          base::BindOnce(&DisjointRangeLockManager::LockReleased,
-                         weak_factory_.GetWeakPtr(), level, range);
+      auto released_callback = base::BindOnce(
+          &DisjointRangeLockManager::LockReleased, weak_factory_.GetWeakPtr());
       // Grant the lock.
       requester.locks_holder->locks.emplace_back(std::move(range), level,
                                                  std::move(released_callback));
diff --git a/chromium/content/browser/indexed_db/scopes/leveldb_scope.cc b/chromium/content/browser/indexed_db/scopes/leveldb_scope.cc
index 824872132e7..3740726d45d 100644
--- a/chromium/content/browser/indexed_db/scopes/leveldb_scope.cc
+++ b/chromium/content/browser/indexed_db/scopes/leveldb_scope.cc
@@ -144,8 +144,7 @@ LevelDBScope::LevelDBScope(
     map_values.emplace_back(std::move(range), false);
   }
   empty_ranges_ = base::flat_map<EmptyRange, bool, EmptyRangeLessThan>(
-      std::move(map_values), base::KEEP_FIRST_OF_DUPES,
-      EmptyRangeLessThan(level_db_->comparator()));
+      std::move(map_values), EmptyRangeLessThan(level_db_->comparator()));
 
 #if DCHECK_IS_ON()
   ValidateEmptyRanges();
diff --git a/chromium/content/browser/indexed_db/scopes/leveldb_state.cc b/chromium/content/browser/indexed_db/scopes/leveldb_state.cc
index d983bc15d7b..1a19c271693 100644
--- a/chromium/content/browser/indexed_db/scopes/leveldb_state.cc
+++ b/chromium/content/browser/indexed_db/scopes/leveldb_state.cc
@@ -5,7 +5,7 @@
 #include "content/browser/indexed_db/scopes/leveldb_state.h"
 
 #include "base/memory/ptr_util.h"
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "content/browser/indexed_db/leveldb/leveldb_env.h"
 
 namespace content {
@@ -65,8 +65,8 @@ LevelDBState::~LevelDBState() {
     return;
   base::TimeTicks begin_time = base::TimeTicks::Now();
   const_cast<std::unique_ptr<leveldb::DB>*>(&db_)->reset();
-  UMA_HISTOGRAM_MEDIUM_TIMES("WebCore.IndexedDB.LevelDB.CloseTime",
-                             base::TimeTicks::Now() - begin_time);
+  base::UmaHistogramMediumTimes("WebCore.IndexedDB.LevelDB.CloseTime",
+                                base::TimeTicks::Now() - begin_time);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/indexed_db/scopes/scope_lock.cc b/chromium/content/browser/indexed_db/scopes/scope_lock.cc
index 0ae64020d27..340f923ae66 100644
--- a/chromium/content/browser/indexed_db/scopes/scope_lock.cc
+++ b/chromium/content/browser/indexed_db/scopes/scope_lock.cc
@@ -9,42 +9,43 @@
 namespace content {
 
 ScopeLock::ScopeLock() = default;
-ScopeLock::~ScopeLock() = default;
+
+ScopeLock::~ScopeLock() {
+  Release();
+}
+
 ScopeLock::ScopeLock(ScopeLock&& other) noexcept {
-  DCHECK(!this->is_locked_)
+  DCHECK(!this->is_locked())
       << "Cannot move a lock onto an active lock: " << *this;
-  this->is_locked_ = other.is_locked_;
   this->range_ = std::move(other.range_);
   this->level_ = other.level_;
-  this->closure_runner_ = std::move(other.closure_runner_);
-  other.is_locked_ = false;
+  this->lock_released_callback_ = std::move(other.lock_released_callback_);
+  DCHECK(!other.is_locked());
 }
-ScopeLock::ScopeLock(ScopeLockRange range, int level, base::OnceClosure closure)
-    : is_locked_(!closure.is_null()),
-      range_(std::move(range)),
+ScopeLock::ScopeLock(ScopeLockRange range,
+                     int level,
+                     LockReleasedCallback lock_released_callback)
+    : range_(std::move(range)),
       level_(level),
-      closure_runner_(std::move(closure)) {}
+      lock_released_callback_(std::move(lock_released_callback)) {}
 
 ScopeLock& ScopeLock::operator=(ScopeLock&& other) noexcept {
-  DCHECK(!this->is_locked_)
+  DCHECK(!this->is_locked())
       << "Cannot move a lock onto an active lock: " << *this;
-  this->is_locked_ = other.is_locked_;
   this->range_ = std::move(other.range_);
   this->level_ = other.level_;
-  this->closure_runner_ = std::move(other.closure_runner_);
-  other.is_locked_ = false;
+  this->lock_released_callback_ = std::move(other.lock_released_callback_);
+  DCHECK(!other.is_locked());
   return *this;
 }
 
 void ScopeLock::Release() {
-  if (is_locked_) {
-    is_locked_ = false;
-    closure_runner_.RunAndReset();
-  }
+  if (is_locked())
+    std::move(lock_released_callback_).Run(level_, range_);
 }
 
 std::ostream& operator<<(std::ostream& out, const ScopeLock& lock) {
-  return out << "<ScopeLock>{is_locked_: " << lock.is_locked_
+  return out << "<ScopeLock>{is_locked_: " << lock.is_locked()
              << ", level_: " << lock.level_ << ", range_: " << lock.range_
              << "}";
 }
diff --git a/chromium/content/browser/indexed_db/scopes/scope_lock.h b/chromium/content/browser/indexed_db/scopes/scope_lock.h
index 9aa9c0260e9..50a1f141353 100644
--- a/chromium/content/browser/indexed_db/scopes/scope_lock.h
+++ b/chromium/content/browser/indexed_db/scopes/scope_lock.h
@@ -26,18 +26,23 @@ namespace content {
 // |is_locked()| result.
 class CONTENT_EXPORT ScopeLock {
  public:
+  using LockReleasedCallback =
+      base::OnceCallback<void(int level, ScopeLockRange range)>;
+
   ScopeLock();
   ~ScopeLock();
   ScopeLock(ScopeLock&&) noexcept;
-  // The |closure| is called when the lock is released, either by destruction
-  // of this object or by the |Released()| call. It will be called
+  // |lock_released_callback| is called when the lock is released, either by
+  // destruction of this object or by the |Released()| call. It will be called
   // synchronously on the sequence runner this lock is released on.
-  ScopeLock(ScopeLockRange range, int level, base::OnceClosure closure);
+  ScopeLock(ScopeLockRange range,
+            int level,
+            LockReleasedCallback lock_released_callback);
   // The lock in |other| is not released, and |this| must not be holding a lock.
   ScopeLock& operator=(ScopeLock&& other) noexcept;
 
   // Returns true if this object is holding a lock.
-  bool is_locked() const { return is_locked_; }
+  bool is_locked() const { return !lock_released_callback_.is_null(); }
 
   // Explicitly releases the granted lock.
   //
@@ -54,10 +59,11 @@ class CONTENT_EXPORT ScopeLock {
   friend bool operator==(const ScopeLock& x, const ScopeLock& y);
   friend bool operator<(const ScopeLock& x, const ScopeLock& y);
 
-  bool is_locked_ = false;
   ScopeLockRange range_;
   int level_ = 0;
-  base::ScopedClosureRunner closure_runner_;
+  // Closure to run when the lock is released. The lock is held when this is
+  // non-null.
+  LockReleasedCallback lock_released_callback_;
 
   DISALLOW_COPY_AND_ASSIGN(ScopeLock);
 };
diff --git a/chromium/content/browser/indexed_db/transaction_impl.cc b/chromium/content/browser/indexed_db/transaction_impl.cc
index 460c8e2c9c4..552bfa357f0 100644
--- a/chromium/content/browser/indexed_db/transaction_impl.cc
+++ b/chromium/content/browser/indexed_db/transaction_impl.cc
@@ -8,7 +8,7 @@
 #include <utility>
 #include <vector>
 
-#include "base/metrics/histogram_macros.h"
+#include "base/metrics/histogram_functions.h"
 #include "base/task/post_task.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/indexed_db/indexed_db_callback_helpers.h"
@@ -28,10 +28,6 @@ namespace {
 const char kInvalidBlobUuid[] = "Blob does not exist";
 const char kInvalidBlobFilePath[] = "Blob file path is invalid";
 
-void LogUMAPutBlobCount(size_t blob_count) {
-  UMA_HISTOGRAM_COUNTS_1000("WebCore.IndexedDB.PutBlobsCount", blob_count);
-}
-
 IndexedDBDatabaseError CreateBackendAbortError() {
   return IndexedDBDatabaseError(blink::kWebIDBDatabaseExceptionAbortError,
                                 "Backend aborted error");
@@ -171,7 +167,6 @@ void TransactionImpl::Put(
     result.code = IOHelper::LoadResultCode::kSuccess;
     result.value = std::move(value_ptr);
     result.blob_info = std::vector<IndexedDBBlobInfo>();
-    LogUMAPutBlobCount(result.blob_info.size());
   } else {
     // TODO(crbug.com/932869): Remove IO thread hop entirely.
     base::WaitableEvent signal_when_finished(
@@ -242,11 +237,6 @@ void TransactionImpl::Put(
         return;
       }
 
-      // Value size recorded in IDBObjectStore before we can auto-wrap in a
-      // blob. 1KB to 10MB.
-      UMA_HISTOGRAM_COUNTS_10000("WebCore.IndexedDB.PutKeySize",
-                                 key.size_estimate() / 1024);
-
       uint64_t commit_size = result.value->bits.size() + key.size_estimate();
       IndexedDBValue value;
       // TODO(crbug.com/902498): Use mojom traits to map directly to
@@ -333,14 +323,11 @@ void TransactionImpl::IOHelper::LoadBlobsOnIOThread(
     // Due to known issue crbug.com/351753, blobs can die while being passed to
     // a different process. So this case must be handled gracefully.
     // TODO(dmurph): Revert back to using mojo::ReportBadMessage once fixed.
-    UMA_HISTOGRAM_BOOLEAN("Storage.IndexedDB.PutValidBlob",
-                          handle.get() != nullptr);
     if (!handle) {
       result->code = LoadResultCode::kAbort;
       return;
     }
     uint64_t size = handle->size();
-    UMA_HISTOGRAM_MEMORY_KB("Storage.IndexedDB.PutBlobSizeKB", size / 1024ull);
     total_blob_size += size;
 
     if (info->file) {
@@ -360,13 +347,6 @@ void TransactionImpl::IOHelper::LoadBlobsOnIOThread(
           IndexedDBBlobInfo(std::move(handle), info->mime_type, info->size);
     }
   }
-  LogUMAPutBlobCount(blob_info.size());
-  uint64_t blob_size = total_blob_size.ValueOrDefault(0U);
-  if (blob_size != 0) {
-    // Bytes to kilobytes.
-    UMA_HISTOGRAM_COUNTS_1M("WebCore.IndexedDB.PutBlobsTotalSize",
-                            blob_size / 1024);
-  }
   result->code = LoadResultCode::kSuccess;
   result->value = std::move(value);
   result->blob_info = std::move(blob_info);
diff --git a/chromium/content/browser/installedapp/OWNERS b/chromium/content/browser/installedapp/OWNERS
index 9fcecf41689..9b8a6298fc9 100644
--- a/chromium/content/browser/installedapp/OWNERS
+++ b/chromium/content/browser/installedapp/OWNERS
@@ -1,3 +1,5 @@
-mgiuca@chromium.org
+peter@chromium.org
+rayankans@chromium.org
+
 # COMPONENT: Blink>AppManifest
 # TEAM: platform-capabilities@chromium.org 
diff --git a/chromium/content/browser/isolated_origin_browsertest.cc b/chromium/content/browser/isolated_origin_browsertest.cc
index 2da27014c46..6ec777e35b8 100644
--- a/chromium/content/browser/isolated_origin_browsertest.cc
+++ b/chromium/content/browser/isolated_origin_browsertest.cc
@@ -11,6 +11,7 @@
 #include "base/strings/string_util.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
+#include "components/network_session_configurator/common/network_switches.h"
 #include "content/browser/bad_message.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
@@ -1239,8 +1240,6 @@ void CreateTestStoragePartitionService(
 
 // Verify that an isolated renderer process cannot read localStorage of an
 // origin outside of its isolated site.
-// TODO(nasko): Write a test to verify the opposite - any non-isolated renderer
-// process cannot access data of an isolated site.
 IN_PROC_BROWSER_TEST_F(
     IsolatedOriginTest,
     LocalStorageOriginEnforcement_IsolatedAccessingNonIsolated) {
@@ -1253,6 +1252,7 @@ IN_PROC_BROWSER_TEST_F(
   GURL isolated_url(
       embedded_test_server()->GetURL("isolated.foo.com", "/title1.html"));
   EXPECT_TRUE(IsIsolatedOrigin(url::Origin::Create(isolated_url)));
+
   EXPECT_TRUE(NavigateToURL(shell(), isolated_url));
 
   content::RenderProcessHostKillWaiter kill_waiter(
@@ -1265,6 +1265,45 @@ IN_PROC_BROWSER_TEST_F(
   EXPECT_EQ(bad_message::RPH_MOJO_PROCESS_ERROR, kill_waiter.Wait());
 }
 
+#if defined(OS_ANDROID)
+#define MAYBE_LocalStorageOriginEnforcement_NonIsolatedAccessingIsolated \
+  LocalStorageOriginEnforcement_NonIsolatedAccessingIsolated
+#else
+// TODO(lukasza): https://crbug.com/566091: Once remote NTP is capable of
+// embedding OOPIFs, start enforcing citadel-style checks on desktop
+// platforms.
+#define MAYBE_LocalStorageOriginEnforcement_NonIsolatedAccessingIsolated \
+  DISABLED_LocalStorageOriginEnforcement_NonIsolatedAccessingIsolated
+#endif
+// Verify that a non-isolated renderer process cannot read localStorage of an
+// isolated origin.
+//
+// TODO(alexmos, lukasza): https://crbug.com/764958: Replicate this test for
+// the IO-thread case.
+IN_PROC_BROWSER_TEST_F(
+    IsolatedOriginTest,
+    MAYBE_LocalStorageOriginEnforcement_NonIsolatedAccessingIsolated) {
+  auto isolated_origin = url::Origin::Create(GURL("http://isolated.foo.com"));
+  EXPECT_TRUE(IsIsolatedOrigin(isolated_origin));
+
+  GURL nonisolated_url(
+      embedded_test_server()->GetURL("non-isolated.com", "/title1.html"));
+  EXPECT_FALSE(IsIsolatedOrigin(url::Origin::Create(nonisolated_url)));
+
+  RenderProcessHostImpl::SetStoragePartitionServiceRequestHandlerForTesting(
+      base::BindRepeating(&CreateTestStoragePartitionService, isolated_origin));
+  EXPECT_TRUE(NavigateToURL(shell(), nonisolated_url));
+
+  content::RenderProcessHostKillWaiter kill_waiter(
+      shell()->web_contents()->GetMainFrame()->GetProcess());
+  // Use ignore_result here, since on Android the renderer process is
+  // terminated, but ExecuteScript still returns true. It properly returns
+  // false on all other platforms.
+  ignore_result(ExecuteScript(shell()->web_contents()->GetMainFrame(),
+                              "localStorage.length;"));
+  EXPECT_EQ(bad_message::RPH_MOJO_PROCESS_ERROR, kill_waiter.Wait());
+}
+
 // Verify that an IPC request for reading localStorage of an *opaque* origin
 // will be rejected.
 IN_PROC_BROWSER_TEST_F(IsolatedOriginTest,
@@ -1751,12 +1790,15 @@ IN_PROC_BROWSER_TEST_F(IsolatedOriginNoFlagOverrideTest,
 // are configured at startup (isolated.foo.com and isolated.bar.com).
 class DynamicIsolatedOriginTest : public IsolatedOriginTest {
  public:
-  DynamicIsolatedOriginTest() {}
+  DynamicIsolatedOriginTest()
+      : https_server_(net::EmbeddedTestServer::TYPE_HTTPS) {}
   ~DynamicIsolatedOriginTest() override {}
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     IsolatedOriginTest::SetUpCommandLine(command_line);
     command_line->AppendSwitch(switches::kDisableSiteIsolation);
+    // This is necessary to use https with arbitrary hostnames.
+    command_line->AppendSwitch(switches::kIgnoreCertificateErrors);
 
     if (AreAllSitesIsolatedForTesting()) {
       LOG(WARNING) << "This test should be run without strict site isolation. "
@@ -1764,7 +1806,18 @@ class DynamicIsolatedOriginTest : public IsolatedOriginTest {
     }
   }
 
+  void SetUpOnMainThread() override {
+    https_server()->AddDefaultHandlers(GetTestDataFilePath());
+    ASSERT_TRUE(https_server()->Start());
+    IsolatedOriginTest::SetUpOnMainThread();
+  }
+
+  // Need an https server because third-party cookies are used, and
+  // SameSite=None cookies must be Secure.
+  net::EmbeddedTestServer* https_server() { return &https_server_; }
+
  private:
+  net::EmbeddedTestServer https_server_;
   DISALLOW_COPY_AND_ASSIGN(DynamicIsolatedOriginTest);
 };
 
@@ -2086,15 +2139,14 @@ IN_PROC_BROWSER_TEST_F(DynamicIsolatedOriginTest,
   RenderProcessHost::SetMaxRendererProcessCount(1);
 
   // Start on a non-isolated origin with same-site iframe.
-  GURL foo_url(
-      embedded_test_server()->GetURL("foo.com", "/page_with_iframe.html"));
+  GURL foo_url(https_server()->GetURL("foo.com", "/page_with_iframe.html"));
   EXPECT_TRUE(NavigateToURL(shell(), foo_url));
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
   FrameTreeNode* child = root->child_at(0);
 
   // Navigate iframe cross-site.
-  GURL bar_url(embedded_test_server()->GetURL("bar.com", "/title1.html"));
+  GURL bar_url(https_server()->GetURL("bar.com", "/title1.html"));
   NavigateIframeToURL(web_contents(), "test_iframe", bar_url);
   EXPECT_EQ(child->current_url(), bar_url);
 
@@ -2146,7 +2198,8 @@ IN_PROC_BROWSER_TEST_F(DynamicIsolatedOriginTest,
 
   // Make sure the bar.com iframe in the old foo.com process can still access
   // bar.com cookies.
-  EXPECT_TRUE(ExecuteScript(child, "document.cookie = 'foo=bar';"));
+  EXPECT_TRUE(ExecuteScript(
+      child, "document.cookie = 'foo=bar;SameSite=None;Secure';"));
   EXPECT_EQ("foo=bar", EvalJs(child, "document.cookie"));
 }
 
diff --git a/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc b/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc
index 80a109d5baa..976d92098ef 100644
--- a/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc
+++ b/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.cc
@@ -39,8 +39,8 @@ void LogKeyboardLockMethodCalled(KeyboardLockMethods method) {
 
 KeyboardLockServiceImpl::KeyboardLockServiceImpl(
     RenderFrameHost* render_frame_host,
-    blink::mojom::KeyboardLockServiceRequest request)
-    : FrameServiceBase(render_frame_host, std::move(request)),
+    mojo::PendingReceiver<blink::mojom::KeyboardLockService> receiver)
+    : FrameServiceBase(render_frame_host, std::move(receiver)),
       render_frame_host_(static_cast<RenderFrameHostImpl*>(render_frame_host)) {
   DCHECK(render_frame_host_);
 }
@@ -48,12 +48,12 @@ KeyboardLockServiceImpl::KeyboardLockServiceImpl(
 // static
 void KeyboardLockServiceImpl::CreateMojoService(
     RenderFrameHost* render_frame_host,
-    blink::mojom::KeyboardLockServiceRequest request) {
+    mojo::PendingReceiver<blink::mojom::KeyboardLockService> receiver) {
   DCHECK(render_frame_host);
 
   // The object is bound to the lifetime of |render_frame_host| and the mojo
   // connection. See FrameServiceBase for details.
-  new KeyboardLockServiceImpl(render_frame_host, std::move(request));
+  new KeyboardLockServiceImpl(render_frame_host, std::move(receiver));
 }
 
 void KeyboardLockServiceImpl::RequestKeyboardLock(
diff --git a/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.h b/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.h
index f34eda1aab7..51f0efdf91b 100644
--- a/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.h
+++ b/chromium/content/browser/keyboard_lock/keyboard_lock_service_impl.h
@@ -10,7 +10,7 @@
 
 #include "content/common/content_export.h"
 #include "content/public/browser/frame_service_base.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "third_party/blink/public/mojom/keyboard_lock/keyboard_lock.mojom.h"
 
 namespace content {
@@ -21,12 +21,13 @@ class RenderFrameHostImpl;
 class CONTENT_EXPORT KeyboardLockServiceImpl final
     : public FrameServiceBase<blink::mojom::KeyboardLockService> {
  public:
-  KeyboardLockServiceImpl(RenderFrameHost* render_frame_host,
-                          blink::mojom::KeyboardLockServiceRequest request);
+  KeyboardLockServiceImpl(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingReceiver<blink::mojom::KeyboardLockService> receiver);
 
   static void CreateMojoService(
       RenderFrameHost* render_frame_host,
-      blink::mojom::KeyboardLockServiceRequest request);
+      mojo::PendingReceiver<blink::mojom::KeyboardLockService> receiver);
 
   // blink::mojom::KeyboardLockService implementation.
   void RequestKeyboardLock(const std::vector<std::string>& key_codes,
diff --git a/chromium/content/browser/keyboard_lock_browsertest.cc b/chromium/content/browser/keyboard_lock_browsertest.cc
index 05a707e53da..0687ac9c900 100644
--- a/chromium/content/browser/keyboard_lock_browsertest.cc
+++ b/chromium/content/browser/keyboard_lock_browsertest.cc
@@ -24,7 +24,7 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
-#include "third_party/blink/public/web/web_fullscreen_options.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "ui/events/keycodes/dom/dom_code.h"
 #include "ui/events/keycodes/dom/keycode_converter.h"
 #include "ui/events/keycodes/keyboard_code_conversion.h"
@@ -149,7 +149,7 @@ class FakeKeyboardLockWebContentsDelegate : public WebContentsDelegate {
   void EnterFullscreenModeForTab(
       WebContents* web_contents,
       const GURL& origin,
-      const blink::WebFullscreenOptions& options) override;
+      const blink::mojom::FullscreenOptions& options) override;
   void ExitFullscreenModeForTab(WebContents* web_contents) override;
   bool IsFullscreenForTabOrPending(const WebContents* web_contents) override;
   void RequestKeyboardLock(WebContents* web_contents,
@@ -166,7 +166,7 @@ class FakeKeyboardLockWebContentsDelegate : public WebContentsDelegate {
 void FakeKeyboardLockWebContentsDelegate::EnterFullscreenModeForTab(
     WebContents* web_contents,
     const GURL& origin,
-    const blink::WebFullscreenOptions& options) {
+    const blink::mojom::FullscreenOptions& options) {
   is_fullscreen_ = true;
   if (keyboard_lock_requested_)
     web_contents->GotResponseToKeyboardLockRequest(/*allowed=*/true);
@@ -348,7 +348,7 @@ void KeyboardLockBrowserTest::CancelKeyboardLock(
 
 void KeyboardLockBrowserTest::EnterFullscreen(const base::Location& from_here,
                                               const GURL& gurl) {
-  web_contents()->EnterFullscreenMode(gurl, blink::WebFullscreenOptions());
+  web_contents()->EnterFullscreenMode(gurl, blink::mojom::FullscreenOptions());
 
   ASSERT_TRUE(web_contents()->IsFullscreenForCurrentTab())
       << "Location: " << from_here.ToString();
diff --git a/chromium/content/browser/loader/browser_initiated_resource_request.cc b/chromium/content/browser/loader/browser_initiated_resource_request.cc
index c83f07f3d0e..e24fde1cb98 100644
--- a/chromium/content/browser/loader/browser_initiated_resource_request.cc
+++ b/chromium/content/browser/loader/browser_initiated_resource_request.cc
@@ -8,6 +8,7 @@
 #include "base/metrics/field_trial_params.h"
 #include "content/common/content_constants_internal.h"
 #include "content/public/browser/browser_context.h"
+#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
diff --git a/chromium/content/browser/loader/cached_navigation_url_loader.cc b/chromium/content/browser/loader/cached_navigation_url_loader.cc
index 3bee02d9c47..5b20b0d13ad 100644
--- a/chromium/content/browser/loader/cached_navigation_url_loader.cc
+++ b/chromium/content/browser/loader/cached_navigation_url_loader.cc
@@ -27,10 +27,9 @@ CachedNavigationURLLoader::CachedNavigationURLLoader(
   // Normal navigations never call OnResponseStarted on the same message loop
   // iteration that the NavigationURLLoader is created, because they have to
   // make a network request.
-  base::PostTaskWithTraits(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&CachedNavigationURLLoader::OnResponseStarted,
-                     weak_factory_.GetWeakPtr()));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&CachedNavigationURLLoader::OnResponseStarted,
+                                weak_factory_.GetWeakPtr()));
 }
 
 void CachedNavigationURLLoader::OnResponseStarted() {
diff --git a/chromium/content/browser/loader/cors_file_origin_browsertest.cc b/chromium/content/browser/loader/cors_file_origin_browsertest.cc
index 5bf96e62422..3fe27e285f9 100644
--- a/chromium/content/browser/loader/cors_file_origin_browsertest.cc
+++ b/chromium/content/browser/loader/cors_file_origin_browsertest.cc
@@ -13,7 +13,6 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/test/scoped_command_line.h"
-#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
@@ -31,7 +30,6 @@
 #include "net/test/embedded_test_server/http_response.h"
 #include "net/test/embedded_test_server/request_handler_util.h"
 #include "services/network/public/cpp/cors/cors.h"
-#include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -45,33 +43,13 @@ using net::test_server::BasicHttpResponse;
 using net::test_server::HttpRequest;
 using net::test_server::HttpResponse;
 
-enum class CorsTestMode {
-  kInBlink,
-  kInNetworkService,
-};
-
 // Tests end to end Origin header and CORS check behaviors without
 // --allow-file-access-from-files flag.
-class CorsFileOriginBrowserTest
-    : public ContentBrowserTest,
-      public testing::WithParamInterface<CorsTestMode> {
+class CorsFileOriginBrowserTest : public ContentBrowserTest {
  public:
   CorsFileOriginBrowserTest()
       : pass_string_(base::ASCIIToUTF16("PASS")),
-        fail_string_(base::ASCIIToUTF16("FAIL")) {
-    switch (GetParam()) {
-      case CorsTestMode::kInBlink:
-        scoped_feature_list_.InitWithFeatures(
-            {} /* enabled */,
-            {network::features::kOutOfBlinkCors} /* disabled */);
-        break;
-      case CorsTestMode::kInNetworkService:
-        scoped_feature_list_.InitWithFeatures(
-            {network::features::kOutOfBlinkCors} /* enabled */,
-            {} /*disabled */);
-        break;
-    }
-  }
+        fail_string_(base::ASCIIToUTF16("FAIL")) {}
   ~CorsFileOriginBrowserTest() override = default;
 
  protected:
@@ -193,9 +171,6 @@ class CorsFileOriginBrowserTest
   const base::string16 pass_string_;
   const base::string16 fail_string_;
 
-  base::test::ScopedFeatureList scoped_command_line_;
-  base::test::ScopedFeatureList scoped_feature_list_;
-
   DISALLOW_COPY_AND_ASSIGN(CorsFileOriginBrowserTest);
 };
 
@@ -216,7 +191,7 @@ class CorsFileOriginBrowserTestWithDisableWebSecurity
   bool IsWebSecurityEnabled() const override { return false; }
 };
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest,
                        AccessControlAllowOriginIsNull) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -229,7 +204,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest,
   EXPECT_TRUE(is_preflight_requested());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest,
                        AccessControlAllowOriginIsFile) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -242,7 +217,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest,
   EXPECT_TRUE(is_preflight_requested());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest, AccessToSelfFileUrl) {
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest, AccessToSelfFileUrl) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
       shell(),
@@ -253,7 +228,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest, AccessToSelfFileUrl) {
   EXPECT_EQ(fail_string(), watcher->WaitAndGetTitle());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest, AccessToAnotherFileUrl) {
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest, AccessToAnotherFileUrl) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
       shell(),
@@ -271,7 +246,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest, AccessToAnotherFileUrl) {
 #else
 #define MAYBE_UniversalAccessFromFileUrls UniversalAccessFromFileUrls
 #endif
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTest,
                        MAYBE_UniversalAccessFromFileUrls) {
   const char* kScript = R"(
     fetch($1)
@@ -301,7 +276,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTest,
   EXPECT_THAT(fetch_result, ::testing::HasSubstr("This page has a title"));
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
                        AccessControlAllowOriginIsNull) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -314,7 +289,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
   EXPECT_TRUE(is_preflight_requested());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
                        AccessControlAllowOriginIsFile) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -327,7 +302,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
   EXPECT_TRUE(is_preflight_requested());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
                        AccessToSelfFileUrl) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -339,7 +314,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
   EXPECT_EQ(pass_string(), watcher->WaitAndGetTitle());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
                        AccessToAnotherFileUrl) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -351,7 +326,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
   EXPECT_EQ(pass_string(), watcher->WaitAndGetTitle());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithDisableWebSecurity,
                        AccessControlAllowOriginIsNull) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -364,7 +339,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
   EXPECT_FALSE(is_preflight_requested());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithDisableWebSecurity,
                        AccessControlAllowOriginIsFile) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -377,7 +352,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
   EXPECT_FALSE(is_preflight_requested());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithDisableWebSecurity,
                        AccessToSelfFileUrl) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -389,7 +364,7 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
   EXPECT_EQ(pass_string(), watcher->WaitAndGetTitle());
 }
 
-IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
+IN_PROC_BROWSER_TEST_F(CorsFileOriginBrowserTestWithDisableWebSecurity,
                        AccessToAnotherFileUrl) {
   std::unique_ptr<TitleWatcher> watcher = CreateWatcher();
   EXPECT_TRUE(NavigateToURL(
@@ -401,24 +376,6 @@ IN_PROC_BROWSER_TEST_P(CorsFileOriginBrowserTestWithDisableWebSecurity,
   EXPECT_EQ(pass_string(), watcher->WaitAndGetTitle());
 }
 
-INSTANTIATE_TEST_SUITE_P(
-    /* No test prefix */,
-    CorsFileOriginBrowserTest,
-    ::testing::Values(CorsTestMode::kInBlink,
-                      CorsTestMode::kInNetworkService));
-
-INSTANTIATE_TEST_SUITE_P(
-    /* No test prefix */,
-    CorsFileOriginBrowserTestWithAllowFileAccessFromFiles,
-    ::testing::Values(CorsTestMode::kInBlink,
-                      CorsTestMode::kInNetworkService));
-
-INSTANTIATE_TEST_SUITE_P(
-    /* No test prefix */,
-    CorsFileOriginBrowserTestWithDisableWebSecurity,
-    ::testing::Values(CorsTestMode::kInBlink,
-                      CorsTestMode::kInNetworkService));
-
 }  // namespace
 
 }  // namespace content
diff --git a/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc b/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc
index 0e901967622..28310a47cea 100644
--- a/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc
+++ b/chromium/content/browser/loader/cors_preflight_cache_browsertest.cc
@@ -9,7 +9,6 @@
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/synchronization/lock.h"
-#include "base/test/scoped_feature_list.h"
 #include "base/thread_annotations.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -34,10 +33,7 @@ const base::string16 kTestDone = base::string16(base::ASCIIToUTF16("DONE"));
 // Tests end to end behaviors on CORS preflight and its cache.
 class CorsPreflightCacheBrowserTest : public ContentBrowserTest {
  protected:
-  CorsPreflightCacheBrowserTest() {
-    scoped_feature_list_.InitWithFeatures({network::features::kOutOfBlinkCors},
-                                          {});
-  }
+  CorsPreflightCacheBrowserTest() = default;
   ~CorsPreflightCacheBrowserTest() override = default;
 
   void SetUpOnMainThread() override {
@@ -84,7 +80,6 @@ class CorsPreflightCacheBrowserTest : public ContentBrowserTest {
     return response;
   }
 
-  base::test::ScopedFeatureList scoped_feature_list_;
   net::EmbeddedTestServer cross_origin_test_server_;
   base::Lock lock_;
 
@@ -104,6 +99,7 @@ IN_PROC_BROWSER_TEST_F(CorsPreflightCacheBrowserTest, Default) {
   EXPECT_EQ(1u, options_count());
   EXPECT_EQ(1u, get_count());
 
+  // Make another fetch request, and OPTIONS request hits the preflight cache.
   std::unique_ptr<TitleWatcher> watcher2 =
       std::make_unique<TitleWatcher>(shell()->web_contents(), kTestDone);
   EXPECT_TRUE(NavigateToURL(
@@ -113,13 +109,16 @@ IN_PROC_BROWSER_TEST_F(CorsPreflightCacheBrowserTest, Default) {
   EXPECT_EQ(1u, options_count());
   EXPECT_EQ(2u, get_count());
 
+  // Make another fetch request with reload cache mode, and it should not hit
+  // the preflight cache. Only OOR-CORS mode take the cache mode count in.
   std::unique_ptr<TitleWatcher> watcher3 =
       std::make_unique<TitleWatcher>(shell()->web_contents(), kTestDone);
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL(base::StringPrintf(
                    "%s?;%d;reload", kTestPath, cross_origin_port()))));
   EXPECT_EQ(kTestDone, watcher3->WaitAndGetTitle());
-  EXPECT_EQ(2u, options_count());
+  EXPECT_EQ(network::features::ShouldEnableOutOfBlinkCorsForTesting() ? 2u : 1u,
+            options_count());
   EXPECT_EQ(3u, get_count());
 }
 
diff --git a/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc b/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
index bfdc53f7e12..e46dbf36539 100644
--- a/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
+++ b/chromium/content/browser/loader/cross_site_document_blocking_browsertest.cc
@@ -198,7 +198,7 @@ class RequestInterceptor {
 
   ~RequestInterceptor() {
     WaitForCleanUpOnInterceptorThread(
-        network::ResourceResponseHead(), "",
+        network::mojom::URLResponseHead::New(), "",
         network::URLLoaderCompletionStatus(net::ERR_NOT_IMPLEMENTED));
   }
 
@@ -216,8 +216,8 @@ class RequestInterceptor {
     }
 
     // Wait until IO cleanup completes.
-    WaitForCleanUpOnInterceptorThread(test_client_.response_head(), body_,
-                                      test_client_.completion_status());
+    WaitForCleanUpOnInterceptorThread(test_client_.response_head().Clone(),
+                                      body_, test_client_.completion_status());
 
     // Mark the request as completed (for DCHECK purposes).
     request_completed_ = true;
@@ -229,7 +229,7 @@ class RequestInterceptor {
     return test_client_.completion_status();
   }
 
-  const network::ResourceResponseHead& response_head() const {
+  const network::mojom::URLResponseHeadPtr& response_head() const {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     DCHECK(request_completed_);
     return test_client_.response_head();
@@ -251,8 +251,8 @@ class RequestInterceptor {
       EXPECT_EQ(0, completion_status().decoded_body_length);
 
       // Verify that other response parts have been sanitized.
-      EXPECT_EQ(0u, response_head().content_length);
-      const std::string& headers = response_head().headers->raw_headers();
+      EXPECT_EQ(0u, response_head()->content_length);
+      const std::string& headers = response_head()->headers->raw_headers();
       EXPECT_THAT(headers, Not(HasSubstr("Content-Length")));
       EXPECT_THAT(headers, Not(HasSubstr("Content-Type")));
 
@@ -345,7 +345,7 @@ class RequestInterceptor {
   }
 
   void WaitForCleanUpOnInterceptorThread(
-      network::ResourceResponseHead response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       std::string response_body,
       network::URLLoaderCompletionStatus status) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -358,8 +358,8 @@ class RequestInterceptor {
       interceptor_task_runner_->PostTaskAndReply(
           FROM_HERE,
           base::BindOnce(&RequestInterceptor::CleanUpOnInterceptorThread,
-                         base::Unretained(this), response_head, response_body,
-                         status),
+                         base::Unretained(this), std::move(response_head),
+                         response_body, status),
           run_loop.QuitClosure());
       run_loop.Run();
     }
@@ -367,16 +367,17 @@ class RequestInterceptor {
     cleanup_done_ = true;
   }
 
-  void CleanUpOnInterceptorThread(network::ResourceResponseHead response_head,
-                                  std::string response_body,
-                                  network::URLLoaderCompletionStatus status) {
+  void CleanUpOnInterceptorThread(
+      network::mojom::URLResponseHeadPtr response_head,
+      std::string response_body,
+      network::URLLoaderCompletionStatus status) {
     if (!request_intercepted_)
       return;
 
     // Tell the |original_client_| that the request has completed (and that it
     // can release its URLLoaderClient.
     if (status.error_code == net::OK) {
-      original_client_->OnReceiveResponse(response_head);
+      original_client_->OnReceiveResponse(std::move(response_head));
 
       mojo::DataPipe empty_data_pipe(response_body.size() + 1);
       original_client_->OnStartLoadingResponseBody(
@@ -506,8 +507,7 @@ class CrossSiteDocumentBlockingTestBase : public ContentBrowserTest {
 };
 
 enum class TestMode {
-  kWithoutOutOfBlinkCors,
-  kWithOutOfBlinkCors,
+  kWithCORBProtectionSniffing,
   kWithoutCORBProtectionSniffing,
 };
 class CrossSiteDocumentBlockingTest
@@ -516,17 +516,14 @@ class CrossSiteDocumentBlockingTest
  public:
   CrossSiteDocumentBlockingTest() {
     switch (GetParam()) {
-      case TestMode::kWithoutOutOfBlinkCors:
-        scoped_feature_list_.InitAndDisableFeature(
-            network::features::kOutOfBlinkCors);
-        break;
-      case TestMode::kWithOutOfBlinkCors:
+      case TestMode::kWithCORBProtectionSniffing:
         scoped_feature_list_.InitAndEnableFeature(
-            network::features::kOutOfBlinkCors);
+            network::features::kCORBProtectionSniffing);
         break;
       case TestMode::kWithoutCORBProtectionSniffing:
         scoped_feature_list_.InitAndDisableFeature(
             network::features::kCORBProtectionSniffing);
+        break;
     }
   }
   ~CrossSiteDocumentBlockingTest() override = default;
@@ -863,7 +860,7 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest, BlockHeaders) {
 
   // Verify that most response headers have been removed by CORB.
   const std::string& headers =
-      interceptor.response_head().headers->raw_headers();
+      interceptor.response_head()->headers->raw_headers();
   EXPECT_THAT(headers, HasSubstr("Access-Control-Allow-Origin: https://other"));
   EXPECT_THAT(headers, Not(HasSubstr("Cache-Control")));
   EXPECT_THAT(headers, Not(HasSubstr("Content-Language")));
@@ -882,7 +879,7 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest, BlockHeaders) {
   EXPECT_EQ(0, interceptor.completion_status().decoded_body_length);
 
   // Verify that other response parts have been sanitized.
-  EXPECT_EQ(0u, interceptor.response_head().content_length);
+  EXPECT_EQ(0u, interceptor.response_head()->content_length);
 }
 
 // TODO(lukasza): https://crbug.com/154571: Enable this test on Android once
@@ -1479,13 +1476,10 @@ IN_PROC_BROWSER_TEST_P(CrossSiteDocumentBlockingTest,
   }
 }
 
-INSTANTIATE_TEST_SUITE_P(WithoutOutOfBlinkCors,
-                         CrossSiteDocumentBlockingTest,
-                         ::testing::Values(TestMode::kWithoutOutOfBlinkCors));
-
-INSTANTIATE_TEST_SUITE_P(WithOutOfBlinkCors,
-                         CrossSiteDocumentBlockingTest,
-                         ::testing::Values(TestMode::kWithOutOfBlinkCors));
+INSTANTIATE_TEST_SUITE_P(
+    WithCORBProtectionSniffing,
+    CrossSiteDocumentBlockingTest,
+    ::testing::Values(TestMode::kWithCORBProtectionSniffing));
 
 INSTANTIATE_TEST_SUITE_P(
     WithoutCORBProtectionSniffing,
diff --git a/chromium/content/browser/loader/data_pipe_to_source_stream.cc b/chromium/content/browser/loader/data_pipe_to_source_stream.cc
deleted file mode 100644
index 3dab3a2dae3..00000000000
--- a/chromium/content/browser/loader/data_pipe_to_source_stream.cc
+++ /dev/null
@@ -1,106 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/loader/data_pipe_to_source_stream.h"
-
-#include <utility>
-
-#include "base/auto_reset.h"
-#include "base/bind.h"
-#include "net/base/io_buffer.h"
-
-namespace content {
-
-DataPipeToSourceStream::DataPipeToSourceStream(
-    mojo::ScopedDataPipeConsumerHandle body)
-    : net::SourceStream(net::SourceStream::TYPE_NONE),
-      body_(std::move(body)),
-      handle_watcher_(FROM_HERE,
-                      mojo::SimpleWatcher::ArmingPolicy::MANUAL,
-                      base::SequencedTaskRunnerHandle::Get()) {
-  handle_watcher_.Watch(
-      body_.get(), MOJO_HANDLE_SIGNAL_READABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-      base::BindRepeating(&DataPipeToSourceStream::OnReadable,
-                          base::Unretained(this)));
-}
-
-DataPipeToSourceStream::~DataPipeToSourceStream() = default;
-
-std::string DataPipeToSourceStream::Description() const {
-  return "DataPipe";
-}
-
-int DataPipeToSourceStream::Read(net::IOBuffer* buf,
-                                 int buf_size,
-                                 net::CompletionOnceCallback callback) {
-  base::AutoReset<bool> inside_read_checker(&inside_read_, true);
-
-  if (!body_.get()) {
-    // We have finished reading the pipe.
-    return 0;
-  }
-
-  const void* buffer = nullptr;
-  uint32_t available = 0;
-  MojoResult result =
-      body_->BeginReadData(&buffer, &available, MOJO_READ_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK: {
-      uint32_t consume =
-          std::min(base::checked_cast<uint32_t>(buf_size), available);
-      memcpy(buf->data(), buffer, consume);
-      body_->EndReadData(consume);
-      return base::checked_cast<int>(consume);
-    }
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // Finished reading.
-      FinishReading();
-      return 0;
-    case MOJO_RESULT_SHOULD_WAIT:
-      // Data is not available yet.
-      pending_callback_ = std::move(callback);
-      output_buf_ = buf;
-      output_buf_size_ = buf_size;
-      handle_watcher_.ArmOrNotify();
-      return net::ERR_IO_PENDING;
-  }
-  NOTREACHED() << static_cast<int>(result);
-  return net::ERR_UNEXPECTED;
-}
-
-void DataPipeToSourceStream::OnReadable(MojoResult unused) {
-  // It's not expected that we call this synchronously inside Read.
-  DCHECK(!inside_read_);
-  DCHECK(pending_callback_);
-  DCHECK(output_buf_);
-  const void* buffer = nullptr;
-  uint32_t available = 0;
-  MojoResult result =
-      body_->BeginReadData(&buffer, &available, MOJO_READ_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK: {
-      uint32_t consume =
-          std::min(base::checked_cast<uint32_t>(output_buf_size_), available);
-      memcpy(output_buf_->data(), buffer, consume);
-      body_->EndReadData(consume);
-      std::move(pending_callback_).Run(consume);
-      return;
-    }
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      FinishReading();
-      std::move(pending_callback_).Run(0);
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      handle_watcher_.ArmOrNotify();
-      return;
-  }
-  NOTREACHED() << static_cast<int>(result);
-}
-
-void DataPipeToSourceStream::FinishReading() {
-  handle_watcher_.Cancel();
-  body_.reset();
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/loader/data_pipe_to_source_stream.h b/chromium/content/browser/loader/data_pipe_to_source_stream.h
deleted file mode 100644
index f77287f0611..00000000000
--- a/chromium/content/browser/loader/data_pipe_to_source_stream.h
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_LOADER_DATA_PIPE_TO_SOURCE_STREAM_H_
-#define CONTENT_BROWSER_LOADER_DATA_PIPE_TO_SOURCE_STREAM_H_
-
-#include "content/common/content_export.h"
-#include "mojo/public/cpp/system/data_pipe.h"
-#include "mojo/public/cpp/system/simple_watcher.h"
-#include "net/base/completion_once_callback.h"
-#include "net/filter/source_stream.h"
-
-namespace content {
-
-class CONTENT_EXPORT DataPipeToSourceStream final : public net::SourceStream {
- public:
-  explicit DataPipeToSourceStream(mojo::ScopedDataPipeConsumerHandle body);
-  ~DataPipeToSourceStream() override;
-
-  int Read(net::IOBuffer* buf,
-           int buf_size,
-           net::CompletionOnceCallback callback) override;
-  std::string Description() const override;
-
- private:
-  void OnReadable(MojoResult result);
-  void FinishReading();
-
-  mojo::ScopedDataPipeConsumerHandle body_;
-  mojo::SimpleWatcher handle_watcher_;
-
-  bool inside_read_ = false;
-
-  scoped_refptr<net::IOBuffer> output_buf_;
-  int output_buf_size_ = 0;
-  net::CompletionOnceCallback pending_callback_;
-
-  DISALLOW_COPY_AND_ASSIGN(DataPipeToSourceStream);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_LOADER_DATA_PIPE_TO_SOURCE_STREAM_H_
diff --git a/chromium/content/browser/loader/data_pipe_to_source_stream_unittest.cc b/chromium/content/browser/loader/data_pipe_to_source_stream_unittest.cc
deleted file mode 100644
index 54950b50200..00000000000
--- a/chromium/content/browser/loader/data_pipe_to_source_stream_unittest.cc
+++ /dev/null
@@ -1,175 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/loader/data_pipe_to_source_stream.h"
-
-#include "base/strings/string_piece.h"
-#include "base/test/task_environment.h"
-#include "net/base/io_buffer.h"
-#include "net/base/test_completion_callback.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace content {
-
-namespace {
-
-const int kBigBufferSize = 4096;
-const int kSmallBufferSize = 1;
-const int kBigPipeCapacity = 4096;
-const int kSmallPipeCapacity = 1;
-
-enum class WriteMode {
-  // WriteToPipe tries to write as many bytes as possible.
-  EVERYTHING_AT_ONCE,
-  // WriteToPipe writes at most one byte at a time.
-  ONE_BYTE_AT_A_TIME,
-};
-
-struct DataPipeToSourceStreamTestParam {
-  DataPipeToSourceStreamTestParam(uint32_t pipe_capacity,
-                                  int buffer_size,
-                                  WriteMode write_mode)
-      : pipe_capacity(pipe_capacity),
-        buffer_size(buffer_size),
-        write_mode(write_mode) {}
-
-  const uint32_t pipe_capacity;
-  const int buffer_size;
-  const WriteMode write_mode;
-};
-
-}  // namespace
-
-class DataPipeToSourceStreamTest
-    : public ::testing::TestWithParam<DataPipeToSourceStreamTestParam> {
- protected:
-  DataPipeToSourceStreamTest()
-      : output_buffer_(base::MakeRefCounted<net::IOBufferWithSize>(
-            GetParam().buffer_size)) {}
-
-  void Init(base::StringPiece message) {
-    message_ = message;
-    const MojoCreateDataPipeOptions data_pipe_options{
-        sizeof(MojoCreateDataPipeOptions), MOJO_CREATE_DATA_PIPE_FLAG_NONE, 1,
-        GetParam().pipe_capacity};
-    mojo::ScopedDataPipeConsumerHandle consumer_end;
-    CHECK_EQ(MOJO_RESULT_OK,
-             mojo::CreateDataPipe(&data_pipe_options, &producer_end_,
-                                  &consumer_end));
-    adapter_ =
-        std::make_unique<DataPipeToSourceStream>(std::move(consumer_end));
-  }
-
-  // Makes a call to |producer_end_->WriteData| to write the content of
-  // |message_| to the data pipe, and closes the producer handle once all data
-  // has been written.
-  void WriteToPipe() {
-    if (message_.empty()) {
-      if (producer_end_.is_valid())
-        CloseProducerHandle();
-      return;
-    }
-    bool one_byte_at_a_time =
-        GetParam().write_mode == WriteMode::ONE_BYTE_AT_A_TIME;
-    uint32_t num_bytes = one_byte_at_a_time ? 1 : message_.size();
-    MojoResult result = producer_end_->WriteData(message_.data(), &num_bytes,
-                                                 MOJO_WRITE_DATA_FLAG_NONE);
-    if (result == MOJO_RESULT_OK) {
-      message_.remove_prefix(num_bytes);
-      if (message_.empty())
-        CloseProducerHandle();
-      return;
-    }
-    EXPECT_EQ(result, MOJO_RESULT_SHOULD_WAIT);
-  }
-
-  // Reads from |adapter_| until an error occurs or the EOF is reached.
-  // When an error occurs, returns the net error code. When an EOF is reached,
-  // returns 0 and appends data read to |output|.
-  int ReadLoop(std::string* output) {
-    while (true) {
-      net::TestCompletionCallback callback;
-      int rv = adapter_->Read(output_buffer_.get(), output_buffer_->size(),
-                              callback.callback());
-      if (rv == net::ERR_IO_PENDING) {
-        WriteToPipe();
-        rv = callback.WaitForResult();
-      }
-      if (rv == net::OK)
-        break;
-      if (rv < net::OK)
-        return rv;
-      EXPECT_GT(rv, net::OK);
-      output->append(output_buffer_->data(), rv);
-    }
-    return 0;
-  }
-
-  mojo::DataPipeProducerHandle producer_end() { return producer_end_.get(); }
-  void CloseProducerHandle() { producer_end_.reset(); }
-  void CloseAdapter() { adapter_ = nullptr; }
-
- private:
-  base::test::TaskEnvironment task_environment_;
-  scoped_refptr<net::IOBufferWithSize> output_buffer_;
-  std::unique_ptr<DataPipeToSourceStream> adapter_;
-  mojo::ScopedDataPipeProducerHandle producer_end_;
-  base::StringPiece message_;
-};
-
-INSTANTIATE_TEST_SUITE_P(
-    DataPipeToSourceStreamTests,
-    DataPipeToSourceStreamTest,
-    ::testing::Values(
-        DataPipeToSourceStreamTestParam(kBigPipeCapacity,
-                                        kBigBufferSize,
-                                        WriteMode::EVERYTHING_AT_ONCE),
-        DataPipeToSourceStreamTestParam(kSmallPipeCapacity,
-                                        kBigBufferSize,
-                                        WriteMode::EVERYTHING_AT_ONCE),
-        DataPipeToSourceStreamTestParam(kBigPipeCapacity,
-                                        kSmallBufferSize,
-                                        WriteMode::EVERYTHING_AT_ONCE),
-        DataPipeToSourceStreamTestParam(kSmallPipeCapacity,
-                                        kSmallBufferSize,
-                                        WriteMode::EVERYTHING_AT_ONCE),
-        DataPipeToSourceStreamTestParam(kBigPipeCapacity,
-                                        kBigBufferSize,
-                                        WriteMode::ONE_BYTE_AT_A_TIME),
-        DataPipeToSourceStreamTestParam(kSmallPipeCapacity,
-                                        kBigBufferSize,
-                                        WriteMode::ONE_BYTE_AT_A_TIME),
-        DataPipeToSourceStreamTestParam(kBigPipeCapacity,
-                                        kSmallBufferSize,
-                                        WriteMode::ONE_BYTE_AT_A_TIME),
-        DataPipeToSourceStreamTestParam(kSmallPipeCapacity,
-                                        kSmallBufferSize,
-                                        WriteMode::ONE_BYTE_AT_A_TIME)));
-
-TEST_P(DataPipeToSourceStreamTest, EmptyStream) {
-  Init("");
-  std::string output;
-  EXPECT_EQ(ReadLoop(&output), net::OK);
-  EXPECT_TRUE(output.empty());
-}
-
-TEST_P(DataPipeToSourceStreamTest, Simple) {
-  const char message[] = "Hello, world!";
-  Init(message);
-  std::string output;
-  EXPECT_EQ(ReadLoop(&output), net::OK);
-  EXPECT_EQ(output, message);
-}
-
-TEST_P(DataPipeToSourceStreamTest, DestructorClosesConsumerEnd) {
-  const char message[] = "Hello, world!";
-  Init(message);
-  CloseAdapter();
-  uint32_t num_bytes = sizeof(message) - 1;
-  MojoResult result =
-      producer_end().WriteData(message, &num_bytes, MOJO_WRITE_DATA_FLAG_NONE);
-  EXPECT_EQ(result, MOJO_RESULT_FAILED_PRECONDITION);
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/file_url_loader_factory.cc b/chromium/content/browser/loader/file_url_loader_factory.cc
index 99fb316bf60..f1803406228 100644
--- a/chromium/content/browser/file_url_loader_factory.cc
+++ b/chromium/content/browser/loader/file_url_loader_factory.cc
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "content/browser/file_url_loader_factory.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 
 #include <memory>
 #include <string>
@@ -19,11 +19,13 @@
 #include "base/numerics/safe_conversions.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -435,6 +437,10 @@ class FileURLLoader : public network::mojom::URLLoader {
              LinkFollowingPolicy link_following_policy,
              std::unique_ptr<FileURLLoaderObserver> observer,
              scoped_refptr<net::HttpResponseHeaders> extra_response_headers) {
+    // ClusterFuzz depends on the following VLOG to get resource dependencies.
+    // See crbug.com/715656.
+    VLOG(1) << "FileURLLoader::Start: " << request.url;
+
     network::ResourceResponseHead head;
     head.request_start = base::TimeTicks::Now();
     head.response_start = base::TimeTicks::Now();
@@ -490,6 +496,13 @@ class FileURLLoader : public network::mojom::URLLoader {
       return;
     }
 
+    if (file_access_policy == FileAccessPolicy::kRestricted &&
+        !GetContentClient()->browser()->IsFileAccessAllowed(
+            path, base::MakeAbsoluteFilePath(path), profile_path)) {
+      OnClientComplete(net::ERR_ACCESS_DENIED, std::move(observer));
+      return;
+    }
+
 #if defined(OS_WIN)
     base::FilePath shortcut_target;
     if (link_following_policy == LinkFollowingPolicy::kFollow &&
@@ -528,13 +541,6 @@ class FileURLLoader : public network::mojom::URLLoader {
     }
 #endif  // defined(OS_WIN)
 
-    if (file_access_policy == FileAccessPolicy::kRestricted &&
-        !GetContentClient()->browser()->IsFileAccessAllowed(
-            path, base::MakeAbsoluteFilePath(path), profile_path)) {
-      OnClientComplete(net::ERR_ACCESS_DENIED, std::move(observer));
-      return;
-    }
-
     mojo::DataPipe pipe(kDefaultFileUrlPipeSize);
     if (!pipe.consumer_handle.is_valid()) {
       OnClientComplete(net::ERR_FAILED, std::move(observer));
@@ -633,7 +639,11 @@ class FileURLLoader : public network::mojom::URLLoader {
       total_bytes_to_send -= write_size;
     }
 
-    if (!net::GetMimeTypeFromFile(path, &head.mime_type)) {
+    // TODO(crbug.com/995177): Update mime_util.cc when BundledHTTPExchanges is
+    // launched and stop using GetBundledExchangesFileMimeTypeFromFile().
+    if (!bundled_exchanges_utils::GetBundledExchangesFileMimeTypeFromFile(
+            path, &head.mime_type) &&
+        !net::GetMimeTypeFromFile(path, &head.mime_type)) {
       std::string new_type;
       net::SniffMimeType(
           initial_read_buffer.data(), read_result.bytes_read, request.url,
@@ -798,8 +808,7 @@ void FileURLLoaderFactory::CreateLoaderAndStart(
     DCHECK(shared_cors_origin_access_list_);
     cors_flag =
         shared_cors_origin_access_list_->GetOriginAccessList().CheckAccessState(
-            *request.request_initiator, request.url) !=
-        network::cors::OriginAccessList::AccessState::kAllowed;
+            request) != network::cors::OriginAccessList::AccessState::kAllowed;
   }
 
   CreateLoaderAndStartInternal(request, std::move(loader), std::move(client),
@@ -850,10 +859,10 @@ void FileURLLoaderFactory::CreateLoaderAndStartInternal(
 }
 
 void FileURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest loader) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
 
-  bindings_.AddBinding(this, std::move(loader));
+  receivers_.Add(this, std::move(loader));
 }
 
 void CreateFileURLLoader(
diff --git a/chromium/content/browser/file_url_loader_factory.h b/chromium/content/browser/loader/file_url_loader_factory.h
index 90a1dbb483d..4c0c865cc91 100644
--- a/chromium/content/browser/file_url_loader_factory.h
+++ b/chromium/content/browser/loader/file_url_loader_factory.h
@@ -2,8 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_BROWSER_FILE_URL_LOADER_FACTORY_H_
-#define CONTENT_BROWSER_FILE_URL_LOADER_FACTORY_H_
+#ifndef CONTENT_BROWSER_LOADER_FILE_URL_LOADER_FACTORY_H_
+#define CONTENT_BROWSER_LOADER_FILE_URL_LOADER_FACTORY_H_
 
 #include "base/files/file_path.h"
 #include "base/macros.h"
@@ -13,7 +13,8 @@
 #include "base/task/task_traits.h"
 #include "base/threading/thread_checker.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace content {
@@ -47,7 +48,8 @@ class CONTENT_EXPORT FileURLLoaderFactory
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest loader) override;
+  void Clone(
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> loader) override;
 
   void CreateLoaderAndStartInternal(const network::ResourceRequest request,
                                     network::mojom::URLLoaderRequest loader,
@@ -58,7 +60,7 @@ class CONTENT_EXPORT FileURLLoaderFactory
   const scoped_refptr<SharedCorsOriginAccessList>
       shared_cors_origin_access_list_;
   const scoped_refptr<base::SequencedTaskRunner> task_runner_;
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   THREAD_CHECKER(thread_checker_);
 
@@ -67,4 +69,4 @@ class CONTENT_EXPORT FileURLLoaderFactory
 
 }  // namespace content
 
-#endif  // CONTENT_BROWSER_FILE_URL_LOADER_FACTORY_H_
+#endif  // CONTENT_BROWSER_LOADER_FILE_URL_LOADER_FACTORY_H_
diff --git a/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc b/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
new file mode 100644
index 00000000000..e206fcc3394
--- /dev/null
+++ b/chromium/content/browser/loader/file_url_loader_factory_browsertest.cc
@@ -0,0 +1,404 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This must be before Windows headers
+#include "base/bind_helpers.h"
+#include "build/build_config.h"
+
+#if defined(OS_WIN)
+#include <objbase.h>
+#include <shlobj.h>
+#include <windows.h>
+#include <wrl/client.h>
+#endif
+
+#include <string>
+
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/files/scoped_temp_dir.h"
+#include "base/macros.h"
+#include "base/path_service.h"
+#include "base/strings/string_util.h"
+#include "base/strings/utf_string_conversions.h"
+#include "base/threading/thread_restrictions.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/site_instance.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_paths.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/test_navigation_observer.h"
+#include "content/shell/browser/shell.h"
+#include "content/test/test_content_browser_client.h"
+#include "net/base/filename_util.h"
+#include "net/base/net_errors.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "net/test/gtest_util.h"
+#include "url/gurl.h"
+
+namespace content {
+namespace {
+
+const char kSuccessTitle[] = "Title Of Awesomeness";
+const char kErrorTitle[] = "Error";
+
+base::FilePath TestFilePath() {
+  base::ScopedAllowBlockingForTesting allow_blocking;
+  return GetTestFilePath("", "title2.html");
+}
+
+base::FilePath AbsoluteFilePath(const base::FilePath& file_path) {
+  base::ScopedAllowBlockingForTesting allow_blocking;
+  return base::MakeAbsoluteFilePath(file_path);
+}
+
+class TestFileAccessContentBrowserClient : public TestContentBrowserClient {
+ public:
+  struct FileAccessAllowedArgs {
+    base::FilePath path;
+    base::FilePath absolute_path;
+    base::FilePath profile_path;
+  };
+
+  TestFileAccessContentBrowserClient() {
+    old_content_browser_client_ = SetBrowserClientForTesting(this);
+  }
+
+  void set_blocked_path(const base::FilePath& blocked_path) {
+    blocked_path_ = AbsoluteFilePath(blocked_path);
+  }
+
+  ~TestFileAccessContentBrowserClient() override {
+    EXPECT_EQ(this, SetBrowserClientForTesting(old_content_browser_client_));
+  }
+
+  bool IsFileAccessAllowed(const base::FilePath& path,
+                           const base::FilePath& absolute_path,
+                           const base::FilePath& profile_path) override {
+    access_allowed_args_.push_back(
+        FileAccessAllowedArgs{path, absolute_path, profile_path});
+    return blocked_path_ != absolute_path;
+  }
+
+  // Returns a vector of arguments passed to each invocation of
+  // IsFileAccessAllowed().
+  const std::vector<FileAccessAllowedArgs>& access_allowed_args() const {
+    return access_allowed_args_;
+  }
+
+  void ClearAccessAllowedArgs() { access_allowed_args_.clear(); }
+
+ private:
+  ContentBrowserClient* old_content_browser_client_;
+
+  base::FilePath blocked_path_;
+
+  std::vector<FileAccessAllowedArgs> access_allowed_args_;
+
+  DISALLOW_COPY_AND_ASSIGN(TestFileAccessContentBrowserClient);
+};
+
+// This class contains integration tests for file URLs.
+class FileURLLoaderFactoryBrowserTest : public ContentBrowserTest {
+ public:
+  FileURLLoaderFactoryBrowserTest() = default;
+
+  // ContentBrowserTest implementation:
+  void SetUpOnMainThread() override {
+    base::FilePath test_data_path;
+    EXPECT_TRUE(base::PathService::Get(DIR_TEST_DATA, &test_data_path));
+    embedded_test_server()->ServeFilesFromDirectory(test_data_path);
+    EXPECT_TRUE(embedded_test_server()->Start());
+  }
+
+  base::FilePath ProfilePath() const {
+    return shell()
+        ->web_contents()
+        ->GetSiteInstance()
+        ->GetBrowserContext()
+        ->GetPath();
+  }
+
+  GURL RedirectToFileURL() const {
+    return embedded_test_server()->GetURL(
+        "/server-redirect?" + net::FilePathToFileURL(TestFilePath()).spec());
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest, Basic) {
+  TestFileAccessContentBrowserClient test_browser_client;
+  EXPECT_TRUE(NavigateToURL(shell(), net::FilePathToFileURL(TestFilePath())));
+  EXPECT_EQ(base::ASCIIToUTF16(kSuccessTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(1u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(TestFilePath(), test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(TestFilePath()),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+}
+
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest, FileAccessNotAllowed) {
+  TestFileAccessContentBrowserClient test_browser_client;
+  test_browser_client.set_blocked_path(TestFilePath());
+
+  TestNavigationObserver navigation_observer(shell()->web_contents());
+  EXPECT_FALSE(NavigateToURL(shell(), net::FilePathToFileURL(TestFilePath())));
+  EXPECT_FALSE(navigation_observer.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer.last_net_error_code(),
+              net::test::IsError(net::ERR_ACCESS_DENIED));
+  EXPECT_EQ(net::FilePathToFileURL(TestFilePath()),
+            shell()->web_contents()->GetURL());
+  EXPECT_EQ(base::ASCIIToUTF16(kErrorTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(1u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(TestFilePath(), test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(TestFilePath()),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+}
+
+#if defined(OS_POSIX)
+
+// Test symbolic links on POSIX platforms. These act like the contents of
+// the symbolic link are the same as the contents of the file it links to.
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest, SymlinksToFiles) {
+  TestFileAccessContentBrowserClient test_browser_client;
+
+  base::ScopedAllowBlockingForTesting allow_blocking;
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+
+  // Get an absolute path since |temp_dir| can contain a symbolic link.
+  base::FilePath absolute_temp_dir = AbsoluteFilePath(temp_dir.GetPath());
+
+  // MIME sniffing uses the symbolic link's path, so this needs to end in
+  // ".html" for it to be sniffed as HTML.
+  base::FilePath sym_link = absolute_temp_dir.AppendASCII("link.html");
+  ASSERT_TRUE(
+      base::CreateSymbolicLink(AbsoluteFilePath(TestFilePath()), sym_link));
+
+  EXPECT_TRUE(NavigateToURL(shell(), net::FilePathToFileURL(sym_link)));
+  EXPECT_EQ(base::ASCIIToUTF16(kSuccessTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(1u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(sym_link, test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(sym_link),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+
+  // Test the case where access to the destination URL is blocked. Note that
+  // this is the same as blocking the symbolic link URL - the
+  // IsFileAccessAllowed() is passed both the symbolic link path and the
+  // absolute path, so rejecting on looks just like rejecting the other.
+
+  test_browser_client.ClearAccessAllowedArgs();
+  test_browser_client.set_blocked_path(TestFilePath());
+
+  TestNavigationObserver navigation_observer3(shell()->web_contents());
+  EXPECT_FALSE(NavigateToURL(shell(), net::FilePathToFileURL(sym_link)));
+  EXPECT_FALSE(navigation_observer3.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer3.last_net_error_code(),
+              net::test::IsError(net::ERR_ACCESS_DENIED));
+  EXPECT_EQ(net::FilePathToFileURL(sym_link),
+            shell()->web_contents()->GetURL());
+  EXPECT_EQ(base::ASCIIToUTF16(kErrorTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(1u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(sym_link, test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(sym_link),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+}
+
+#elif defined(OS_WIN)
+
+// Test shortcuts on Windows. These are treated as redirects.
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest, ResolveShortcutTest) {
+  TestFileAccessContentBrowserClient test_browser_client;
+
+  // Create an empty temp directory, to be sure there's no file in it.
+  base::ScopedAllowBlockingForTesting allow_blocking;
+  base::ScopedTempDir temp_dir;
+  ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
+
+  base::FilePath lnk_path =
+      temp_dir.GetPath().Append(FILE_PATH_LITERAL("foo.lnk"));
+
+  base::FilePath test = TestFilePath();
+
+  // Create a shortcut for the test.
+  {
+    Microsoft::WRL::ComPtr<IShellLink> shell;
+    ASSERT_TRUE(SUCCEEDED(::CoCreateInstance(
+        CLSID_ShellLink, nullptr, CLSCTX_INPROC_SERVER, IID_PPV_ARGS(&shell))));
+    Microsoft::WRL::ComPtr<IPersistFile> persist;
+    ASSERT_TRUE(SUCCEEDED(shell.As<IPersistFile>(&persist)));
+    EXPECT_TRUE(
+        SUCCEEDED(shell->SetPath(base::as_wcstr(TestFilePath().value()))));
+    EXPECT_TRUE(SUCCEEDED(shell->SetDescription(L"ResolveShortcutTest")));
+    base::string16 lnk_string = lnk_path.value();
+    EXPECT_TRUE(SUCCEEDED(persist->Save(base::as_wcstr(lnk_string), TRUE)));
+  }
+
+  EXPECT_TRUE(NavigateToURL(
+      shell(), net::FilePathToFileURL(lnk_path),
+      net::FilePathToFileURL(TestFilePath()) /* expect_commit_url */));
+  EXPECT_EQ(base::ASCIIToUTF16(kSuccessTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(2u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(lnk_path, test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(lnk_path),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+
+  EXPECT_EQ(TestFilePath(), test_browser_client.access_allowed_args()[1].path);
+  EXPECT_EQ(AbsoluteFilePath(TestFilePath()),
+            test_browser_client.access_allowed_args()[1].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[1].profile_path);
+
+  // Test the case where access to the shortcut URL is blocked. Should display
+  // an error page at the shortcut's file URL.
+
+  test_browser_client.ClearAccessAllowedArgs();
+  test_browser_client.set_blocked_path(lnk_path);
+
+  TestNavigationObserver navigation_observer2(shell()->web_contents());
+  EXPECT_FALSE(NavigateToURL(shell(), net::FilePathToFileURL(lnk_path)));
+  EXPECT_FALSE(navigation_observer2.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer2.last_net_error_code(),
+              net::test::IsError(net::ERR_ACCESS_DENIED));
+  EXPECT_EQ(net::FilePathToFileURL(lnk_path),
+            shell()->web_contents()->GetURL());
+  EXPECT_EQ(base::ASCIIToUTF16(kErrorTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(1u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(lnk_path, test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(lnk_path),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+
+  // Test the case where access to the destination URL is blocked. The redirect
+  // is followed, so this should end up at the shortcut destination, but
+  // displaying an error.
+
+  test_browser_client.ClearAccessAllowedArgs();
+  test_browser_client.set_blocked_path(TestFilePath());
+
+  TestNavigationObserver navigation_observer3(shell()->web_contents());
+  EXPECT_FALSE(NavigateToURL(shell(), net::FilePathToFileURL(lnk_path)));
+  EXPECT_FALSE(navigation_observer3.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer3.last_net_error_code(),
+              net::test::IsError(net::ERR_ACCESS_DENIED));
+  EXPECT_EQ(net::FilePathToFileURL(TestFilePath()),
+            shell()->web_contents()->GetURL());
+  EXPECT_EQ(base::ASCIIToUTF16(kErrorTitle),
+            shell()->web_contents()->GetTitle());
+
+  ASSERT_EQ(2u, test_browser_client.access_allowed_args().size());
+  EXPECT_EQ(lnk_path, test_browser_client.access_allowed_args()[0].path);
+  EXPECT_EQ(AbsoluteFilePath(lnk_path),
+            test_browser_client.access_allowed_args()[0].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[0].profile_path);
+
+  EXPECT_EQ(TestFilePath(), test_browser_client.access_allowed_args()[1].path);
+  EXPECT_EQ(AbsoluteFilePath(TestFilePath()),
+            test_browser_client.access_allowed_args()[1].absolute_path);
+  EXPECT_EQ(ProfilePath(),
+            test_browser_client.access_allowed_args()[1].profile_path);
+}
+
+#endif  // defined(OS_WIN)
+
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest,
+                       RedirectToFileUrlMainFrame) {
+  TestFileAccessContentBrowserClient test_browser_client;
+
+  TestNavigationObserver navigation_observer(shell()->web_contents());
+  EXPECT_FALSE(NavigateToURL(shell(), RedirectToFileURL()));
+  EXPECT_FALSE(navigation_observer.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer.last_net_error_code(),
+              net::test::IsError(net::ERR_UNSAFE_REDIRECT));
+  // The redirect should not have been followed. This is important so that a
+  // reload will show the same error.
+  EXPECT_EQ(RedirectToFileURL(), shell()->web_contents()->GetURL());
+  EXPECT_EQ(base::ASCIIToUTF16(kErrorTitle),
+            shell()->web_contents()->GetTitle());
+  // There should never have been a request for the file URL.
+  EXPECT_TRUE(test_browser_client.access_allowed_args().empty());
+
+  // Reloading returns the same error.
+  TestNavigationObserver navigation_observer2(shell()->web_contents());
+  shell()->Reload();
+  navigation_observer2.Wait();
+  EXPECT_FALSE(navigation_observer2.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer2.last_net_error_code(),
+              net::test::IsError(net::ERR_UNSAFE_REDIRECT));
+  EXPECT_EQ(RedirectToFileURL(), shell()->web_contents()->GetURL());
+  EXPECT_EQ(base::ASCIIToUTF16(kErrorTitle),
+            shell()->web_contents()->GetTitle());
+  // There should never have been a request for the file URL.
+  EXPECT_TRUE(test_browser_client.access_allowed_args().empty());
+}
+
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest,
+                       RedirectToFileUrlFetch) {
+  TestFileAccessContentBrowserClient test_browser_client;
+
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title2.html")));
+  std::string fetch_redirect_to_file = base::StringPrintf(
+      "(async () => {"
+      "  try {"
+      "    var resp = (await fetch('%s'));"
+      "    return 'ok';"
+      "  } catch (error) {"
+      "    return 'error';"
+      "  }"
+      "})();",
+      RedirectToFileURL().spec().c_str());
+  // Unfortunately, fetch doesn't provide a way to unambiguously know if the
+  // request failed due to the redirect being unsafe.
+  EXPECT_EQ("error", EvalJs(shell()->web_contents()->GetMainFrame(),
+                            fetch_redirect_to_file));
+  // There should never have been a request for the file URL.
+  EXPECT_TRUE(test_browser_client.access_allowed_args().empty());
+}
+
+IN_PROC_BROWSER_TEST_F(FileURLLoaderFactoryBrowserTest,
+                       RedirectToFileUrlSubFrame) {
+  TestFileAccessContentBrowserClient test_browser_client;
+
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/page_with_iframe.html")));
+  LOG(WARNING) << embedded_test_server()->GetURL("/page_with_iframe.html");
+
+  TestNavigationObserver navigation_observer(shell()->web_contents());
+  EXPECT_TRUE(NavigateIframeToURL(shell()->web_contents(), "test_iframe",
+                                  RedirectToFileURL()));
+  navigation_observer.Wait();
+  EXPECT_FALSE(navigation_observer.last_navigation_succeeded());
+  EXPECT_THAT(navigation_observer.last_net_error_code(),
+              net::test::IsError(net::ERR_UNSAFE_REDIRECT));
+  // There should never have been a request for the file URL.
+  EXPECT_TRUE(test_browser_client.access_allowed_args().empty());
+}
+
+}  // namespace
+}  // namespace content
diff --git a/chromium/content/browser/loader/loader_browsertest.cc b/chromium/content/browser/loader/loader_browsertest.cc
index 5f29ff1c615..d04f38f9410 100644
--- a/chromium/content/browser/loader/loader_browsertest.cc
+++ b/chromium/content/browser/loader/loader_browsertest.cc
@@ -19,13 +19,13 @@
 #include "build/build_config.h"
 #include "content/browser/download/download_manager_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
-#include "content/common/view_messages.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/network_service_util.h"
 #include "content/public/common/previews_state.h"
 #include "content/public/common/url_constants.h"
@@ -74,21 +74,15 @@ class LoaderBrowserTest : public ContentBrowserTest,
     host_resolver()->AddRule("*", "127.0.0.1");
   }
 
-  void OnDownloadCreated(DownloadManager* manager,
-                         download::DownloadItem* item) override {
-    if (!got_downloads_)
-      got_downloads_ = !!manager->InProgressCount();
-  }
-
   void CheckTitleTest(const GURL& url, const std::string& expected_title) {
     base::string16 expected_title16(ASCIIToUTF16(expected_title));
     TitleWatcher title_watcher(shell()->web_contents(), expected_title16);
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(expected_title16, title_watcher.WaitAndGetTitle());
   }
 
   bool GetPopupTitle(const GURL& url, base::string16* title) {
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
 
     ShellAddedObserver new_shell_observer;
 
@@ -152,15 +146,9 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest,
   ASSERT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL("/stale-while-revalidate.html")));
 
-  // Create new renderer preferences and force-disable the |enable_referrers|
-  // preference.
-  blink::mojom::RendererPreferences renderer_preferences;
-  renderer_preferences.enable_referrers = false;
-
-  // Send updated renderer preferences to the renderer.
-  RenderViewHost* rvh = web_contents->GetRenderViewHost();
-  rvh->Send(
-      new ViewMsg_SetRendererPrefs(rvh->GetRoutingID(), renderer_preferences));
+  // Force-disable the |enable_referrers| preference.
+  web_contents->GetMutableRendererPrefs()->enable_referrers = false;
+  web_contents->SyncRendererPrefs();
 
   // Wait for the stale-while-revalidate tests to pass by observing the page's
   // title. If the renderer crashes, the test immediately fails.
@@ -216,8 +204,8 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, ContentDispositionInline) {
 // Test for bug #1091358.
 IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest) {
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/sync_xmlhttprequest.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/sync_xmlhttprequest.html")));
 
   // Let's check the XMLHttpRequest ran successfully.
   bool success = false;
@@ -230,8 +218,9 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest) {
 // If this flakes, use http://crbug.com/62776.
 IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest_Disallowed) {
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(), embedded_test_server()->GetURL(
-                             "/sync_xmlhttprequest_disallowed.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL("/sync_xmlhttprequest_disallowed.html")));
 
   // Let's check the XMLHttpRequest ran successfully.
   bool success = false;
@@ -300,7 +289,7 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest_Cancelled) {
   if (IsInProcessNetworkService())
     return;
 
-  embedded_test_server()->RegisterRequestHandler(base::Bind(
+  embedded_test_server()->RegisterRequestHandler(base::BindRepeating(
       &CancelOnRequest, "/hung",
       shell()->web_contents()->GetMainFrame()->GetProcess()->GetID(),
       base::BindRepeating(&BrowserTestBase::SimulateNetworkServiceCrash,
@@ -309,8 +298,9 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, SyncXMLHttpRequest_Cancelled) {
   ASSERT_TRUE(embedded_test_server()->Start());
   WaitForLoadStop(shell()->web_contents());
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(
-                             "/sync_xmlhttprequest_cancelled.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL("/sync_xmlhttprequest_cancelled.html")));
 
   int status_code = -1;
   EXPECT_TRUE(ExecuteScriptAndExtractInt(
@@ -351,7 +341,7 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest,
 
   // Navigate to a cross-site page that loads immediately without making a
   // network request.  The unload event should still be run.
-  NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
   // Check that the cookie was set.
   EXPECT_EQ("onunloadCookie=foo", GetCookies(url));
@@ -380,7 +370,7 @@ std::unique_ptr<net::test_server::HttpResponse> NoContentResponseHandler(
 IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossSiteNoUnloadOn204) {
   const char kNoContentPath[] = "/nocontent";
   embedded_test_server()->RegisterRequestHandler(
-      base::Bind(&NoContentResponseHandler, kNoContentPath));
+      base::BindRepeating(&NoContentResponseHandler, kNoContentPath));
 
   ASSERT_TRUE(embedded_test_server()->Start());
 
@@ -389,7 +379,8 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossSiteNoUnloadOn204) {
   CheckTitleTest(url, "set cookie on unload");
 
   // Navigate to a cross-site URL that returns a 204 No Content response.
-  NavigateToURL(shell(), embedded_test_server()->GetURL(kNoContentPath));
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(
+      shell(), embedded_test_server()->GetURL(kNoContentPath)));
 
   // Check that the unload cookie was not set.
   EXPECT_EQ("", GetCookies(url));
@@ -410,13 +401,13 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossSiteNoUnloadOn204) {
 #endif
 IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, MAYBE_CrossSiteAfterCrash) {
   // Make sure we have a live process before trying to kill it.
-  NavigateToURL(shell(), GURL("about:blank"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
 
   // Cause the renderer to crash.
   RenderProcessHostWatcher crash_observer(
       shell()->web_contents(),
       RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
-  NavigateToURL(shell(), GURL(kChromeUICrashURL));
+  EXPECT_FALSE(NavigateToURL(shell(), GURL(kChromeUICrashURL)));
   // Wait for browser to notice the renderer crash.
   crash_observer.Wait();
 
@@ -456,9 +447,11 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest,
   // TODO(creis): If this causes crashes or hangs, it might be for the same
   // reason as ErrorPageTest::DNSError.  See bug 1199491 and
   // http://crbug.com/22877.
-  GURL failed_url =
-      net::URLRequestFailedJob::GetMockHttpUrl(net::ERR_NAME_NOT_RESOLVED);
-  NavigateToURL(shell(), failed_url);
+  GURL failed_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  std::unique_ptr<URLLoaderInterceptor> url_interceptor =
+      URLLoaderInterceptor::SetupRequestFailForURL(failed_url,
+                                                   net::ERR_NAME_NOT_RESOLVED);
+  EXPECT_FALSE(NavigateToURL(shell(), failed_url));
 
   EXPECT_NE(ASCIIToUTF16("set cookie on unload"),
             shell()->web_contents()->GetTitle());
@@ -497,15 +490,17 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossSiteNavigationErrorPage2) {
   // TODO(creis): If this causes crashes or hangs, it might be for the same
   // reason as ErrorPageTest::DNSError.  See bug 1199491 and
   // http://crbug.com/22877.
-  GURL failed_url =
-      net::URLRequestFailedJob::GetMockHttpUrl(net::ERR_NAME_NOT_RESOLVED);
+  GURL failed_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  std::unique_ptr<URLLoaderInterceptor> url_interceptor =
+      URLLoaderInterceptor::SetupRequestFailForURL(failed_url,
+                                                   net::ERR_NAME_NOT_RESOLVED);
 
-  NavigateToURL(shell(), failed_url);
+  EXPECT_FALSE(NavigateToURL(shell(), failed_url));
   EXPECT_NE(ASCIIToUTF16("Title Of Awesomeness"),
             shell()->web_contents()->GetTitle());
 
   // Repeat navigation.  We are testing that this completes.
-  NavigateToURL(shell(), failed_url);
+  EXPECT_FALSE(NavigateToURL(shell(), failed_url));
   EXPECT_NE(ASCIIToUTF16("Title Of Awesomeness"),
             shell()->web_contents()->GetTitle());
 }
@@ -535,11 +530,11 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossOriginRedirectBlocked) {
 // See bug 40250.
 IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CrossSiteFailedRequest) {
   // Visit another URL first to trigger a cross-site navigation.
-  NavigateToURL(shell(), GetTestUrl("", "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl("", "simple_page.html")));
 
   // Visit a URL that fails without calling ResourceDispatcherHost::Read.
   GURL broken_url("chrome://theme");
-  NavigateToURL(shell(), broken_url);
+  EXPECT_FALSE(NavigateToURL(shell(), broken_url));
 }
 
 namespace {
@@ -565,14 +560,18 @@ std::unique_ptr<net::test_server::HttpResponse> HandleRedirectRequest(
 // navigations.
 IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, CookiePolicy) {
   embedded_test_server()->RegisterRequestHandler(
-      base::Bind(&HandleRedirectRequest, "/redirect?"));
+      base::BindRepeating(&HandleRedirectRequest, "/redirect?"));
   ASSERT_TRUE(embedded_test_server()->Start());
 
   std::string set_cookie_url(base::StringPrintf(
       "http://localhost:%u/set_cookie.html", embedded_test_server()->port()));
   GURL url(embedded_test_server()->GetURL("/redirect?" + set_cookie_url));
 
-  CheckTitleTest(url, "cookie set");
+  base::string16 expected_title16(ASCIIToUTF16("cookie set"));
+  TitleWatcher title_watcher(shell()->web_contents(), expected_title16);
+  EXPECT_TRUE(NavigateToURL(shell(), url,
+                            GURL(set_cookie_url) /* expected_commit_url */));
+  EXPECT_EQ(expected_title16, title_watcher.WaitAndGetTitle());
 }
 
 // Test that ui::PAGE_TRANSITION_CLIENT_REDIRECT is correctly set
@@ -782,7 +781,7 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, Basic) {
   EXPECT_FALSE(first_request->initiator.has_value());
   for (size_t i = 1; i < requests.size(); i++) {
     const RequestData* request = &requests[i];
-    EXPECT_EQ(top_url, request->first_party);
+    EXPECT_EQ(top_origin, url::Origin::Create(request->first_party));
     ASSERT_TRUE(request->initiator.has_value());
     EXPECT_EQ(top_origin, request->initiator);
   }
@@ -844,15 +843,15 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, BasicCrossSite) {
   EXPECT_EQ(9u, requests.size());
 
   // The first items loaded are the top-level and nested documents. These should
-  // both have a |first_party| that match the URL of the top-level document.
+  // both have a |first_party| that match the origin of the top-level document.
   // The top-level document has no initiator and the nested frame is initiated
   // by the top-level document.
   EXPECT_EQ(top_url, requests[0].url);
-  EXPECT_EQ(top_url, requests[0].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[0].first_party));
   EXPECT_FALSE(requests[0].initiator.has_value());
 
   EXPECT_EQ(nested_url, requests[1].url);
-  EXPECT_EQ(top_url, requests[1].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[1].first_party));
   EXPECT_EQ(top_origin, requests[1].initiator);
 
   // The remaining items are loaded as subresources in the nested document, and
@@ -880,19 +879,19 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, SameOriginNested) {
   // URL to which they navigate. The navigation was initiated outside of a
   // document, so there is no |initiator|.
   EXPECT_EQ(top_url, requests[0].url);
-  EXPECT_EQ(top_url, requests[0].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[0].first_party));
   EXPECT_FALSE(requests[0].initiator.has_value());
 
   // Subresource requests have a first-party and initiator that matches the
   // document in which they're embedded.
   EXPECT_EQ(image_url, requests[1].url);
-  EXPECT_EQ(top_url, requests[1].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[1].first_party));
   EXPECT_EQ(top_origin, requests[1].initiator);
 
   // Same-origin nested frames have a first-party and initiator that matches
   // the document in which they're embedded.
   EXPECT_EQ(nested_url, requests[2].url);
-  EXPECT_EQ(top_url, requests[2].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[2].first_party));
   EXPECT_EQ(top_origin, requests[2].initiator);
 }
 
@@ -920,13 +919,14 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, SameOriginAuxiliary) {
   // URL to which they navigate, even if they fail to load. The navigation was
   // initiated outside of a document, so there is no |initiator|.
   EXPECT_EQ(top_url, requests[0].url);
-  EXPECT_EQ(top_url, requests[0].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[0].first_party));
   EXPECT_FALSE(requests[0].initiator.has_value());
 
   // Auxiliary navigations have a first-party that matches the URL to which they
   // navigate, and an initiator that matches the document that triggered them.
   EXPECT_EQ(auxiliary_url, requests[1].url);
-  EXPECT_EQ(auxiliary_url, requests[1].first_party);
+  EXPECT_EQ(url::Origin::Create(auxiliary_url),
+            url::Origin::Create(requests[1].first_party));
   EXPECT_EQ(top_origin, requests[1].initiator);
 }
 
@@ -962,13 +962,14 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, CrossOriginAuxiliary) {
   // URL to which they navigate, even if they fail to load. The navigation was
   // initiated outside of a document, so there is no initiator.
   EXPECT_EQ(top_url, requests[0].url);
-  EXPECT_EQ(top_url, requests[0].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[0].first_party));
   EXPECT_FALSE(requests[0].initiator.has_value());
 
   // Auxiliary navigations have a first-party that matches the URL to which they
   // navigate, and an initiator that matches the document that triggered them.
   EXPECT_EQ(auxiliary_url, requests[1].url);
-  EXPECT_EQ(auxiliary_url, requests[1].first_party);
+  EXPECT_EQ(url::Origin::Create(auxiliary_url),
+            url::Origin::Create(requests[1].first_party));
   EXPECT_EQ(top_origin, requests[1].initiator);
 }
 
@@ -987,7 +988,7 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, FailedNavigation) {
   // URL to which they navigate, even if they fail to load. The navigation was
   // initiated outside of a document, so there is no initiator.
   EXPECT_EQ(top_url, requests[0].url);
-  EXPECT_EQ(top_url, requests[0].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[0].first_party));
   EXPECT_FALSE(requests[0].initiator.has_value());
 }
 
@@ -1011,17 +1012,17 @@ IN_PROC_BROWSER_TEST_F(RequestDataBrowserTest, CrossOriginNested) {
   // User-initiated top-level navigations have a |first-party|. The navigation
   // was initiated outside of a document, so there are no initiator.
   EXPECT_EQ(top_url, requests[0].url);
-  EXPECT_EQ(top_url, requests[0].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[0].first_party));
   EXPECT_FALSE(requests[0].initiator.has_value());
 
   EXPECT_EQ(top_js_url, requests[1].url);
-  EXPECT_EQ(top_url, requests[1].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[1].first_party));
   EXPECT_EQ(top_origin, requests[1].initiator);
 
   // Cross-origin frames have a first-party and initiator that matches the URL
   // in which they're embedded.
   EXPECT_EQ(nested_url, requests[2].url);
-  EXPECT_EQ(top_url, requests[2].first_party);
+  EXPECT_EQ(top_origin, url::Origin::Create(requests[2].first_party));
   EXPECT_EQ(top_origin, requests[2].initiator);
 
   // Cross-origin subresource requests have a unique first-party, and an
@@ -1184,10 +1185,11 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, URLLoaderThrottleStartModify) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
   GURL url = embedded_test_server()->GetURL("/simple_page.html");
-  NavigateToURL(shell(), url);
+  GURL expected_url(url.spec() + "?foo=bar");
+  EXPECT_TRUE(
+      NavigateToURL(shell(), url, expected_url /* expected_commit_url */));
 
   {
-    GURL expected_url(url.spec() + "?foo=bar");
     base::AutoLock auto_lock(lock);
     ASSERT_TRUE(urls_requested.find(expected_url) != urls_requested.end());
     ASSERT_TRUE(header_map[expected_url]["Foo"] == "Bar");
@@ -1217,10 +1219,10 @@ IN_PROC_BROWSER_TEST_F(LoaderBrowserTest, URLLoaderThrottleRedirectModify) {
 
   GURL url =
       embedded_test_server()->GetURL("/server-redirect?simple_page.html");
-  NavigateToURL(shell(), url);
-
-  GURL expected_url;
-  expected_url = embedded_test_server()->GetURL("/simple_page.html?foo=bar");
+  GURL expected_url =
+      embedded_test_server()->GetURL("/simple_page.html?foo=bar");
+  EXPECT_TRUE(
+      NavigateToURL(shell(), url, expected_url /* expected_commit_url */));
 
   {
     base::AutoLock auto_lock(lock);
diff --git a/chromium/content/browser/loader/navigation_loader_interceptor.cc b/chromium/content/browser/loader/navigation_loader_interceptor.cc
index 22fc4ef053d..b3ab4637c04 100644
--- a/chromium/content/browser/loader/navigation_loader_interceptor.cc
+++ b/chromium/content/browser/loader/navigation_loader_interceptor.cc
@@ -20,7 +20,12 @@ bool NavigationLoaderInterceptor::MaybeCreateLoaderForResponse(
     network::mojom::URLLoaderPtr* loader,
     network::mojom::URLLoaderClientRequest* client_request,
     ThrottlingURLLoader* url_loader,
-    bool* skip_other_interceptors) {
+    bool* skip_other_interceptors,
+    bool* will_return_unsafe_redirect) {
+  return false;
+}
+
+bool NavigationLoaderInterceptor::ShouldBypassRedirectChecks() {
   return false;
 }
 
diff --git a/chromium/content/browser/loader/navigation_loader_interceptor.h b/chromium/content/browser/loader/navigation_loader_interceptor.h
index 95a240d9481..ad204af6866 100644
--- a/chromium/content/browser/loader/navigation_loader_interceptor.h
+++ b/chromium/content/browser/loader/navigation_loader_interceptor.h
@@ -107,6 +107,10 @@ class CONTENT_EXPORT NavigationLoaderInterceptor {
   // flag was introduced to skip service worker after signed exchange redirect.
   // Remove this flag when we support service worker and signed exchange
   // integration. See crbug.com/894755#c1. Nullptr is not allowed.
+  // |will_return_unsafe_redirect| is set to true when this interceptor will
+  // return an unsafe redirect response and will handle the redirected request,
+  // therefore regular safety check should be exempted for the redirect.
+  // Nullptr is not allowed.
   virtual bool MaybeCreateLoaderForResponse(
       const network::ResourceRequest& request,
       const network::ResourceResponseHead& response_head,
@@ -114,7 +118,13 @@ class CONTENT_EXPORT NavigationLoaderInterceptor {
       network::mojom::URLLoaderPtr* loader,
       network::mojom::URLLoaderClientRequest* client_request,
       ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors);
+      bool* skip_other_interceptors,
+      bool* will_return_unsafe_redirect);
+
+  // Called when MaybeCreateLoader() has called the LoaderCallback with a valid
+  // RequestHandler. Returns true when this interceptor will return an unsafe
+  // redirect response and will handle the redirected request.
+  virtual bool ShouldBypassRedirectChecks();
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl.cc b/chromium/content/browser/loader/navigation_url_loader_impl.cc
index c82860885d1..874fb88cb97 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_impl.cc
@@ -4,7 +4,9 @@
 
 #include "content/browser/loader/navigation_url_loader_impl.h"
 
+#include <map>
 #include <memory>
+#include <set>
 #include <utility>
 
 #include "base/bind.h"
@@ -24,10 +26,10 @@
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
 #include "content/browser/data_url_loader_factory.h"
 #include "content/browser/devtools/devtools_instrumentation.h"
-#include "content/browser/file_url_loader_factory.h"
 #include "content/browser/fileapi/file_system_url_loader_factory.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigation_request_info.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 #include "content/browser/loader/navigation_loader_interceptor.h"
 #include "content/browser/loader/navigation_url_loader_delegate.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
@@ -39,13 +41,13 @@
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
 #include "content/browser/web_package/prefetched_signed_exchange_cache.h"
 #include "content/browser/web_package/signed_exchange_consts.h"
 #include "content/browser/web_package/signed_exchange_request_handler.h"
 #include "content/browser/web_package/signed_exchange_utils.h"
 #include "content/browser/webui/url_data_manager_backend.h"
 #include "content/browser/webui/web_ui_url_loader_factory_internal.h"
-#include "content/common/mime_sniffing_throttle.h"
 #include "content/common/net/record_load_histograms.h"
 #include "content/common/throttling_url_loader.h"
 #include "content/public/browser/browser_context.h"
@@ -59,6 +61,7 @@
 #include "content/public/browser/shared_cors_origin_access_list.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/url_loader_request_interceptor.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/navigation_policy.h"
@@ -83,6 +86,7 @@
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "third_party/blink/public/common/loader/mime_sniffing_throttle.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
 
 #if defined(OS_ANDROID)
@@ -230,12 +234,19 @@ std::unique_ptr<network::ResourceRequest> CreateResourceRequest(
   new_request->has_user_gesture = request_info->common_params->has_user_gesture;
   new_request->enable_load_timing = true;
 
+  FrameTreeNode* frame_tree_node =
+      FrameTreeNode::GloballyFindByID(frame_tree_node_id);
   if (request_info->is_main_frame) {
-    new_request->mode = network::mojom::RequestMode::kNavigate;
+    // `<portal>` acts like a top-level navigation, but we want to represent it
+    // as a nested navigation for the purposes of security checks like
+    // `Sec-Fetch-Mode`.
+    new_request->mode =
+        frame_tree_node &&
+                WebContentsImpl::FromFrameTreeNode(frame_tree_node)->IsPortal()
+            ? network::mojom::RequestMode::kNavigateNestedFrame
+            : network::mojom::RequestMode::kNavigate;
   } else {
     new_request->mode = network::mojom::RequestMode::kNavigateNestedFrame;
-    FrameTreeNode* frame_tree_node =
-        FrameTreeNode::GloballyFindByID(frame_tree_node_id);
     if (frame_tree_node && (frame_tree_node->frame_owner_element_type() ==
                                 blink::FrameOwnerElementType::kObject ||
                             frame_tree_node->frame_owner_element_type() ==
@@ -268,15 +279,6 @@ void UnknownSchemeCallback(
       handled_externally ? net::ERR_ABORTED : net::ERR_UNKNOWN_URL_SCHEME));
 }
 
-// Determines whether it is safe to redirect from |from_url| to |to_url|.
-bool IsRedirectSafe(const GURL& from_url,
-                    const GURL& to_url,
-                    BrowserContext* browser_context) {
-  return IsSafeRedirectTarget(from_url, to_url) &&
-         GetContentClient()->browser()->IsSafeRedirectTarget(to_url,
-                                                             browser_context);
-}
-
 }  // namespace
 
 // Kept around during the lifetime of the navigation request, and is
@@ -296,7 +298,8 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
       BrowserContext* browser_context,
       const GURL& url,
       bool is_main_frame,
-      network::mojom::URLLoaderFactoryRequest proxied_factory_request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+          proxied_factory_receiver,
       network::mojom::URLLoaderFactoryPtrInfo proxied_factory_info,
       std::set<std::string> known_schemes,
       bool bypass_redirect_checks,
@@ -306,12 +309,11 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
         url_(url),
         owner_(owner),
         response_loader_binding_(this),
-        proxied_factory_request_(std::move(proxied_factory_request)),
+        proxied_factory_receiver_(std::move(proxied_factory_receiver)),
         proxied_factory_info_(std::move(proxied_factory_info)),
         known_schemes_(std::move(known_schemes)),
         bypass_redirect_checks_(bypass_redirect_checks),
-        browser_context_(browser_context) {
-  }
+        browser_context_(browser_context) {}
 
   ~URLLoaderRequestController() override {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -384,9 +386,10 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
     if (needs_loader_factory_interceptor &&
         g_loader_factory_interceptor.Get()) {
       network::mojom::URLLoaderFactoryPtr factory;
-      auto request = mojo::MakeRequest(&factory);
-      g_loader_factory_interceptor.Get().Run(&request);
-      network_loader_factory_->Clone(std::move(request));
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver =
+          mojo::MakeRequest(&factory);
+      g_loader_factory_interceptor.Get().Run(&receiver);
+      network_loader_factory_->Clone(std::move(receiver));
       network_loader_factory_ =
           base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
               std::move(factory));
@@ -542,7 +545,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
       // Intercepted requests need MimeSniffingThrottle to do mime sniffing.
       // Non-intercepted requests usually go through the regular network
       // URLLoader, which does mime sniffing.
-      throttles.push_back(std::make_unique<MimeSniffingThrottle>(
+      throttles.push_back(std::make_unique<blink::MimeSniffingThrottle>(
           base::ThreadTaskRunnerHandle::Get()));
 
       default_loader_used_ = false;
@@ -556,7 +559,8 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
 
       subresource_loader_params_ =
           interceptor->MaybeCreateSubresourceLoaderParams();
-
+      if (interceptor->ShouldBypassRedirectChecks())
+        bypass_redirect_checks_ = true;
       return;
     }
 
@@ -659,7 +663,8 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
             resource_request_->resource_type ==
                 static_cast<int>(ResourceType::kMainFrame),
             static_cast<ui::PageTransition>(resource_request_->transition_type),
-            resource_request_->has_user_gesture, &loader_factory);
+            resource_request_->has_user_gesture,
+            resource_request_->request_initiator, &loader_factory);
 
         if (loader_factory) {
           factory =
@@ -673,7 +678,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
         network::mojom::URLLoaderFactoryPtr& non_network_factory =
             non_network_url_loader_factories_[resource_request_->url.scheme()];
         if (!non_network_factory.is_bound()) {
-          owner_->BindNonNetworkURLLoaderFactoryRequest(
+          owner_->BindNonNetworkURLLoaderFactoryReceiver(
               frame_tree_node_id_, resource_request_->url,
               mojo::MakeRequest(&non_network_factory));
         }
@@ -684,9 +689,10 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
 
       if (g_loader_factory_interceptor.Get()) {
         network::mojom::URLLoaderFactoryPtr factory_ptr;
-        auto request = mojo::MakeRequest(&factory_ptr);
-        g_loader_factory_interceptor.Get().Run(&request);
-        factory->Clone(std::move(request));
+        mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver =
+            mojo::MakeRequest(&factory_ptr);
+        g_loader_factory_interceptor.Get().Run(&receiver);
+        factory->Clone(std::move(receiver));
         factory = base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
             std::move(factory_ptr));
       }
@@ -698,10 +704,10 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
       // or AppCache). Hence this code is only reachable when one of the above
       // interceptors isn't used and the URL is either a data URL or has a
       // scheme which is handled by the network service.
-      if (proxied_factory_request_.is_pending()) {
+      if (proxied_factory_receiver_.is_valid()) {
         DCHECK(proxied_factory_info_.is_valid());
         // We don't worry about reconnection since it's a single navigation.
-        network_loader_factory_->Clone(std::move(proxied_factory_request_));
+        network_loader_factory_->Clone(std::move(proxied_factory_receiver_));
         factory = base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
             std::move(proxied_factory_info_));
       } else {
@@ -910,7 +916,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   void OnReceiveRedirect(const net::RedirectInfo& redirect_info,
                          network::mojom::URLResponseHeadPtr head) override {
     if (!bypass_redirect_checks_ &&
-        !IsRedirectSafe(url_, redirect_info.new_url, browser_context_)) {
+        !IsSafeRedirectTarget(url_, redirect_info.new_url)) {
       // Call CancelWithError instead of OnComplete so that if there is an
       // intercepting URLLoaderFactory (created through the embedder's
       // ContentBrowserClient::WillCreateURLLoaderFactory) it gets notified.
@@ -1014,17 +1020,23 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   // different response. For e.g. AppCache may have fallback content.
   bool MaybeCreateLoaderForResponse(
       const network::ResourceResponseHead& response) {
-    if (!default_loader_used_)
+    if (!default_loader_used_ &&
+        !bundled_exchanges_utils::CanLoadAsBundledExchanges(
+            url_, response.mime_type)) {
       return false;
-
+    }
     for (size_t i = 0u; i < interceptors_.size(); ++i) {
       NavigationLoaderInterceptor* interceptor = interceptors_[i].get();
       network::mojom::URLLoaderClientRequest response_client_request;
       bool skip_other_interceptors = false;
+      bool will_return_unsafe_redirect = false;
       if (interceptor->MaybeCreateLoaderForResponse(
               *resource_request_, response, &response_body_,
               &response_url_loader_, &response_client_request,
-              url_loader_.get(), &skip_other_interceptors)) {
+              url_loader_.get(), &skip_other_interceptors,
+              &will_return_unsafe_redirect)) {
+        if (will_return_unsafe_redirect)
+          bypass_redirect_checks_ = true;
         if (response_loader_binding_.is_bound())
           response_loader_binding_.Close();
         response_loader_binding_.Bind(std::move(response_client_request));
@@ -1052,7 +1064,7 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
                       if (host) {
                         host->SetControllerRegistration(
                             nullptr, false /* notify_controllerchange */);
-                        host->UpdateUrls(GURL(), GURL());
+                        host->UpdateUrls(GURL(), GURL(), base::nullopt);
                       }
                     },
                     // Unretained() is safe because the handle owns the core,
@@ -1174,20 +1186,23 @@ class NavigationURLLoaderImpl::URLLoaderRequestController
   base::Optional<network::URLLoaderCompletionStatus> status_;
 
   // Before creating this URLLoaderRequestController on UI thread, the embedder
-  // may have elected to proxy the URLLoaderFactory request, in which case these
-  // fields will contain input (info) and output (request) endpoints for the
-  // proxy. If this controller is handling a request for which proxying is
-  // supported, requests will be plumbed through these endpoints.
+  // may have elected to proxy the URLLoaderFactory receiver, in which case
+  // these fields will contain input (info) and output (receiver) endpoints for
+  // the proxy. If this controller is handling a receiver for which proxying is
+  // supported, receivers will be plumbed through these endpoints.
   //
-  // Note that these are only used for requests that go to the Network Service.
-  network::mojom::URLLoaderFactoryRequest proxied_factory_request_;
+  // Note that these are only used for receivers that go to the Network Service.
+  mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+      proxied_factory_receiver_;
   network::mojom::URLLoaderFactoryPtrInfo proxied_factory_info_;
 
   // The schemes that this loader can use. For anything else we'll try external
   // protocol handlers.
   std::set<std::string> known_schemes_;
 
-  // If true, redirect checks will be handled in a proxy, and not here.
+  // True when a proxy will handle the redirect checks, or when an interceptor
+  // intentionally returned unsafe redirect response
+  // (eg: NavigationLoaderInterceptor for loading local bundled exchanges file).
   bool bypass_redirect_checks_;
 
   // Used to reset the state of ServiceWorkerProviderHost when
@@ -1269,7 +1284,8 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
   }
 
   network::mojom::URLLoaderFactoryPtrInfo proxied_factory_info;
-  network::mojom::URLLoaderFactoryRequest proxied_factory_request;
+  mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+      proxied_factory_receiver;
   mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
       header_client;
   bool bypass_redirect_checks = false;
@@ -1281,7 +1297,7 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
             frame_tree_node_id, &non_network_url_loader_factories_);
 
     // The embedder may want to proxy all network-bound URLLoaderFactory
-    // requests that it can. If it elects to do so, we'll pass its proxy
+    // receivers that it can. If it elects to do so, we'll pass its proxy
     // endpoints off to the URLLoaderRequestController where wthey will be
     // connected if the request type supports proxying.
     mojo::PendingRemote<network::mojom::URLLoaderFactory> pending_factory;
@@ -1297,7 +1313,7 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
       use_proxy = true;
     }
     if (use_proxy) {
-      proxied_factory_request = std::move(factory_receiver);
+      proxied_factory_receiver = std::move(factory_receiver);
       proxied_factory_info = std::move(pending_factory);
     }
 
@@ -1360,7 +1376,7 @@ NavigationURLLoaderImpl::NavigationURLLoaderImpl(
   request_controller_ = std::make_unique<URLLoaderRequestController>(
       std::move(initial_interceptors), std::move(new_request), browser_context,
       request_info->common_params->url, request_info->is_main_frame,
-      std::move(proxied_factory_request), std::move(proxied_factory_info),
+      std::move(proxied_factory_receiver), std::move(proxied_factory_info),
       std::move(known_schemes), bypass_redirect_checks,
       weak_factory_.GetWeakPtr());
   request_controller_->Start(
@@ -1473,7 +1489,7 @@ void NavigationURLLoaderImpl::OnRequestStarted(base::TimeTicks timestamp) {
   delegate_->OnRequestStarted(timestamp);
 }
 
-void NavigationURLLoaderImpl::BindNonNetworkURLLoaderFactoryRequest(
+void NavigationURLLoaderImpl::BindNonNetworkURLLoaderFactoryReceiver(
     int frame_tree_node_id,
     const GURL& url,
     mojo::PendingReceiver<network::mojom::URLLoaderFactory> factory_receiver) {
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl.h b/chromium/content/browser/loader/navigation_url_loader_impl.h
index baf6bd113b8..400e80b4941 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl.h
+++ b/chromium/content/browser/loader/navigation_url_loader_impl.h
@@ -14,6 +14,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/common/previews_state.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
@@ -71,7 +72,7 @@ class CONTENT_EXPORT NavigationURLLoaderImpl : public NavigationURLLoader {
   // schemes not handled by network service (e.g. files). This must be called on
   // the UI thread or before threads start.
   using URLLoaderFactoryInterceptor = base::RepeatingCallback<void(
-      network::mojom::URLLoaderFactoryRequest* request)>;
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>* receiver)>;
   static void SetURLLoaderFactoryInterceptorForTesting(
       const URLLoaderFactoryInterceptor& interceptor);
 
@@ -92,7 +93,7 @@ class CONTENT_EXPORT NavigationURLLoaderImpl : public NavigationURLLoader {
   class URLLoaderRequestController;
   void OnRequestStarted(base::TimeTicks timestamp);
 
-  void BindNonNetworkURLLoaderFactoryRequest(
+  void BindNonNetworkURLLoaderFactoryReceiver(
       int frame_tree_node_id,
       const GURL& url,
       mojo::PendingReceiver<network::mojom::URLLoaderFactory> factory_receiver);
diff --git a/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc b/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
index 1e2f87380e1..561e67b2929 100644
--- a/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
+++ b/chromium/content/browser/loader/navigation_url_loader_impl_unittest.cc
@@ -53,8 +53,7 @@ class TestNavigationLoaderInterceptor : public NavigationLoaderInterceptor {
  public:
   explicit TestNavigationLoaderInterceptor(
       base::Optional<network::ResourceRequest>* most_recent_resource_request)
-      : most_recent_resource_request_(most_recent_resource_request),
-        resource_scheduler_(false) {
+      : most_recent_resource_request_(most_recent_resource_request) {
     net::URLRequestContextBuilder context_builder;
     context_builder.set_proxy_resolution_service(
         net::ProxyResolutionService::CreateDirect());
@@ -95,7 +94,8 @@ class TestNavigationLoaderInterceptor : public NavigationLoaderInterceptor {
         std::move(request), 0 /* options */, resource_request,
         std::move(client), TRAFFIC_ANNOTATION_FOR_TESTS, &params,
         0, /* request_id */
-        resource_scheduler_client_, nullptr /* keepalive_statistics_recorder */,
+        0 /* keepalive_request_size */, resource_scheduler_client_,
+        nullptr /* keepalive_statistics_recorder */,
         nullptr /* network_usage_accumulator */, nullptr /* header_client */,
         nullptr /* origin_policy_manager */);
   }
@@ -107,7 +107,8 @@ class TestNavigationLoaderInterceptor : public NavigationLoaderInterceptor {
       network::mojom::URLLoaderPtr* loader,
       network::mojom::URLLoaderClientRequest* client_request,
       ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors) override {
+      bool* skip_other_interceptors,
+      bool* will_return_unsafe_redirect) override {
     return false;
   }
 
diff --git a/chromium/content/browser/loader/prefetch_browsertest.cc b/chromium/content/browser/loader/prefetch_browsertest.cc
index 0c989f0d38e..3337735a773 100644
--- a/chromium/content/browser/loader/prefetch_browsertest.cc
+++ b/chromium/content/browser/loader/prefetch_browsertest.cc
@@ -145,7 +145,7 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTestPrivacyChanges, RedirectNotFollowed) {
   // See https://ci.chromium.org/p/chromium/builders/ci/linux-oor-cors-rel.
   const int expected_request_count =
       (privacy_changes_enabled_ &&
-       network::features::ShouldEnableOutOfBlinkCors())
+       network::features::ShouldEnableOutOfBlinkCorsForTesting())
           ? 1
           : 2;
   EXPECT_EQ(expected_request_count, destination_counter->GetRequestCount());
@@ -587,10 +587,6 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, WithPreload) {
 }
 
 IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, CrossOriginWithPreload) {
-  // TODO(domfarolino): Remove this early-return when preloads-on-prefetch
-  // requests are working when SplitCache is enabled. See crbug.com/939317.
-  if (split_cache_enabled_)
-    return;
   const char* target_path = "/target.html";
   const char* preload_path = "/preload.js";
   RegisterResponse(
@@ -620,10 +616,11 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, CrossOriginWithPreload) {
   const GURL cross_origin_target_url =
       cross_origin_server_->GetURL(target_path);
   const char* prefetch_path = "/prefetch.html";
-  RegisterResponse(prefetch_path, ResponseEntry(base::StringPrintf(
-                                      "<body><link rel='prefetch' href='%s' "
-                                      "crossorigin=\"anonymous\"></body>",
-                                      cross_origin_target_url.spec().c_str())));
+  RegisterResponse(prefetch_path,
+                   ResponseEntry(base::StringPrintf(
+                       "<body><link rel='prefetch' href='%s' as='document' "
+                       "crossorigin='anonymous'></body>",
+                       cross_origin_target_url.spec().c_str())));
   RegisterRequestHandler(embedded_test_server());
   ASSERT_TRUE(embedded_test_server()->Start());
   EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
@@ -635,7 +632,7 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, CrossOriginWithPreload) {
   preload_waiter.Run();
   EXPECT_EQ(1, target_request_counter->GetRequestCount());
   EXPECT_EQ(1, preload_request_counter->GetRequestCount());
-  EXPECT_EQ(1, GetPrefetchURLLoaderCallCount());
+  EXPECT_EQ(split_cache_enabled_ ? 2 : 1, GetPrefetchURLLoaderCallCount());
 
   GURL cross_origin_preload_url = cross_origin_server_->GetURL(preload_path);
   WaitUntilLoaded(cross_origin_preload_url);
@@ -759,10 +756,6 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest, SignedExchangeWithPreload) {
 
 IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
                        CrossOriginSignedExchangeWithPreload) {
-  // TODO(domfarolino): Remove this early-return when preloads-on-prefetch
-  // requests are working when SplitCache is enabled. See crbug.com/939317.
-  if (split_cache_enabled_)
-    return;
   const char* prefetch_path = "/prefetch.html";
   const char* target_sxg_path = "/target.sxg";
   const char* target_path = "/target.html";
@@ -793,10 +786,11 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
   const GURL preload_url_in_sxg =
       cross_origin_server_->GetURL(preload_path_in_sxg);
 
-  RegisterResponse(prefetch_path,
-                   ResponseEntry(base::StringPrintf(
-                       "<body><link rel='prefetch' href='%s'></body>",
-                       target_sxg_url.spec().c_str())));
+  RegisterResponse(
+      prefetch_path,
+      ResponseEntry(base::StringPrintf(
+          "<body><link rel='prefetch' as='document' href='%s'></body>",
+          target_sxg_url.spec().c_str())));
   RegisterRequestHandler(embedded_test_server());
   ASSERT_TRUE(embedded_test_server()->Start());
   EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
@@ -824,7 +818,7 @@ IN_PROC_BROWSER_TEST_P(PrefetchBrowserTest,
   preload_waiter.Run();
   EXPECT_EQ(1, preload_request_counter->GetRequestCount());
 
-  EXPECT_EQ(1, GetPrefetchURLLoaderCallCount());
+  EXPECT_EQ(split_cache_enabled_ ? 2 : 1, GetPrefetchURLLoaderCallCount());
 
   WaitUntilLoaded(preload_url_in_sxg);
 
diff --git a/chromium/content/browser/loader/prefetch_url_loader.cc b/chromium/content/browser/loader/prefetch_url_loader.cc
index 494929aa947..e9029db69e7 100644
--- a/chromium/content/browser/loader/prefetch_url_loader.cc
+++ b/chromium/content/browser/loader/prefetch_url_loader.cc
@@ -13,6 +13,7 @@
 #include "content/browser/web_package/signed_exchange_prefetch_metric_recorder.h"
 #include "content/browser/web_package/signed_exchange_utils.h"
 #include "content/public/common/content_features.h"
+#include "net/base/load_flags.h"
 #include "services/network/loader_util.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -31,7 +32,7 @@ PrefetchURLLoader::PrefetchURLLoader(
     int32_t routing_id,
     int32_t request_id,
     uint32_t options,
-    base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+    int frame_tree_node_id,
     const network::ResourceRequest& resource_request,
     network::mojom::URLLoaderClientPtr client,
     const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
@@ -43,21 +44,26 @@ PrefetchURLLoader::PrefetchURLLoader(
     scoped_refptr<PrefetchedSignedExchangeCache>
         prefetched_signed_exchange_cache,
     base::WeakPtr<storage::BlobStorageContext> blob_storage_context,
-    const std::string& accept_langs)
-    : frame_tree_node_id_getter_(frame_tree_node_id_getter),
+    const std::string& accept_langs,
+    RecursivePrefetchTokenGenerator recursive_prefetch_token_generator)
+    : frame_tree_node_id_(frame_tree_node_id),
       resource_request_(resource_request),
       network_loader_factory_(std::move(network_loader_factory)),
       client_binding_(this),
       forwarding_client_(std::move(client)),
       url_loader_throttles_getter_(url_loader_throttles_getter),
-      browser_context_(browser_context),
       signed_exchange_prefetch_metric_recorder_(
           std::move(signed_exchange_prefetch_metric_recorder)),
-      accept_langs_(accept_langs) {
+      accept_langs_(accept_langs),
+      recursive_prefetch_token_generator_(
+          std::move(recursive_prefetch_token_generator)),
+      is_signed_exchange_handling_enabled_(
+          signed_exchange_utils::IsSignedExchangeHandlingEnabled(
+              browser_context)) {
   DCHECK(network_loader_factory_);
   RecordPrefetchRedirectHistogram(PrefetchRedirect::kPrefetchMade);
 
-  if (IsSignedExchangeHandlingEnabled()) {
+  if (is_signed_exchange_handling_enabled_) {
     // Set the SignedExchange accept header.
     // (https://wicg.github.io/webpackage/draft-yasskin-http-origin-signed-responses.html#internet-media-type-applicationsigned-exchange).
     resource_request_.headers.SetHeader(
@@ -67,7 +73,7 @@ PrefetchURLLoader::PrefetchURLLoader(
       prefetched_signed_exchange_cache_adapter_ =
           std::make_unique<PrefetchedSignedExchangeCacheAdapter>(
               std::move(prefetched_signed_exchange_cache),
-              BrowserContext::GetBlobStorageContext(browser_context_),
+              BrowserContext::GetBlobStorageContext(browser_context),
               resource_request.url, this);
     }
   }
@@ -142,7 +148,7 @@ void PrefetchURLLoader::ResumeReadingBodyFromNet() {
 
 void PrefetchURLLoader::OnReceiveResponse(
     network::mojom::URLResponseHeadPtr response) {
-  if (IsSignedExchangeHandlingEnabled() &&
+  if (is_signed_exchange_handling_enabled_ &&
       signed_exchange_utils::ShouldHandleAsSignedHTTPExchange(
           resource_request_.url, response)) {
     DCHECK(!signed_exchange_prefetch_handler_);
@@ -154,13 +160,29 @@ void PrefetchURLLoader::OnReceiveResponse(
     // network. (Until |this| calls the handler's FollowRedirect.)
     signed_exchange_prefetch_handler_ =
         std::make_unique<SignedExchangePrefetchHandler>(
-            frame_tree_node_id_getter_, resource_request_, response,
+            frame_tree_node_id_, resource_request_, response,
             mojo::ScopedDataPipeConsumerHandle(), std::move(loader_),
             client_binding_.Unbind(), network_loader_factory_,
             url_loader_throttles_getter_, this,
             signed_exchange_prefetch_metric_recorder_, accept_langs_);
     return;
   }
+
+  // If the response is marked as a restricted cross-origin prefetch, we
+  // populate the response's |recursive_prefetch_token| member with a unique
+  // token. The renderer will propagate this token to recursive prefetches
+  // coming from this response, in the form of preload headers. This token is
+  // later used by the PrefetchURLLoaderService to recover the correct
+  // NetworkIsolationKey to use when fetching the request. In the Signed
+  // Exchange case, we do this after redirects from the outer response, because
+  // we redirect back here for the inner response.
+  if (resource_request_.load_flags & net::LOAD_RESTRICTED_PREFETCH) {
+    DCHECK(!recursive_prefetch_token_generator_.is_null());
+    base::UnguessableToken recursive_prefetch_token =
+        std::move(recursive_prefetch_token_generator_).Run(resource_request_);
+    response->recursive_prefetch_token = recursive_prefetch_token;
+  }
+
   if (prefetched_signed_exchange_cache_adapter_ &&
       signed_exchange_prefetch_handler_) {
     prefetched_signed_exchange_cache_adapter_->OnReceiveInnerResponse(response);
@@ -182,7 +204,6 @@ void PrefetchURLLoader::OnReceiveRedirect(
 
   resource_request_.url = redirect_info.new_url;
   resource_request_.site_for_cookies = redirect_info.new_site_for_cookies;
-  resource_request_.top_frame_origin = redirect_info.new_top_frame_origin;
   resource_request_.referrer = GURL(redirect_info.new_referrer);
   resource_request_.referrer_policy = redirect_info.new_referrer_policy;
   forwarding_client_->OnReceiveRedirect(redirect_info, std::move(head));
@@ -260,9 +281,4 @@ void PrefetchURLLoader::OnNetworkConnectionError() {
   forwarding_client_.reset();
 }
 
-bool PrefetchURLLoader::IsSignedExchangeHandlingEnabled() {
-  return signed_exchange_utils::IsSignedExchangeHandlingEnabled(
-      browser_context_);
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/loader/prefetch_url_loader.h b/chromium/content/browser/loader/prefetch_url_loader.h
index d11a11f0f24..b450e293066 100644
--- a/chromium/content/browser/loader/prefetch_url_loader.h
+++ b/chromium/content/browser/loader/prefetch_url_loader.h
@@ -48,17 +48,18 @@ class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
  public:
   using URLLoaderThrottlesGetter = base::RepeatingCallback<
       std::vector<std::unique_ptr<blink::URLLoaderThrottle>>()>;
+  using RecursivePrefetchTokenGenerator =
+      base::OnceCallback<base::UnguessableToken(
+          const network::ResourceRequest&)>;
 
   // |url_loader_throttles_getter| may be used when a prefetch handler needs to
   // additionally create a request (e.g. for fetching certificate if the
-  // prefetch was for a signed exchange).  |frame_tree_node_id_getter| is called
-  // only on UI thread when NetworkService is not enabled, but can be also
-  // called on IO thread otherwise.
+  // prefetch was for a signed exchange).
   PrefetchURLLoader(
       int32_t routing_id,
       int32_t request_id,
       uint32_t options,
-      base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+      int frame_tree_node_id,
       const network::ResourceRequest& resource_request,
       network::mojom::URLLoaderClientPtr client,
       const net::MutableNetworkTrafficAnnotationTag& traffic_annotation,
@@ -70,7 +71,8 @@ class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
       scoped_refptr<PrefetchedSignedExchangeCache>
           prefetched_signed_exchange_cache,
       base::WeakPtr<storage::BlobStorageContext> blob_storage_context,
-      const std::string& accept_langs);
+      const std::string& accept_langs,
+      RecursivePrefetchTokenGenerator recursive_prefetch_token_generator);
   ~PrefetchURLLoader() override;
 
   // Sends an empty response's body to |forwarding_client_|. If failed to create
@@ -121,9 +123,7 @@ class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
 
   void OnNetworkConnectionError();
 
-  bool IsSignedExchangeHandlingEnabled();
-
-  const base::RepeatingCallback<int(void)> frame_tree_node_id_getter_;
+  const int frame_tree_node_id_;
 
   // Set in the constructor and updated when redirected.
   network::ResourceRequest resource_request_;
@@ -138,7 +138,6 @@ class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
   network::mojom::URLLoaderClientPtr forwarding_client_;
 
   URLLoaderThrottlesGetter url_loader_throttles_getter_;
-  BrowserContext* browser_context_;
 
   std::unique_ptr<mojo::DataPipeDrainer> pipe_drainer_;
 
@@ -155,6 +154,12 @@ class CONTENT_EXPORT PrefetchURLLoader : public network::mojom::URLLoader,
 
   const std::string accept_langs_;
 
+  RecursivePrefetchTokenGenerator recursive_prefetch_token_generator_;
+
+  // TODO(kinuko): This value can become stale if the preference is updated.
+  // Make this listen to the changes if it becomes a real concern.
+  bool is_signed_exchange_handling_enabled_ = false;
+
   DISALLOW_COPY_AND_ASSIGN(PrefetchURLLoader);
 };
 
diff --git a/chromium/content/browser/loader/prefetch_url_loader_service.cc b/chromium/content/browser/loader/prefetch_url_loader_service.cc
index 17989d54e5d..fc0b8e626b2 100644
--- a/chromium/content/browser/loader/prefetch_url_loader_service.cc
+++ b/chromium/content/browser/loader/prefetch_url_loader_service.cc
@@ -47,7 +47,9 @@ struct PrefetchURLLoaderService::BindContext {
         render_frame_host(other->render_frame_host),
         cross_origin_factory(other->cross_origin_factory),
         prefetched_signed_exchange_cache(
-            other->prefetched_signed_exchange_cache) {}
+            other->prefetched_signed_exchange_cache),
+        prefetch_network_isolation_keys(
+            other->prefetch_network_isolation_keys) {}
 
   ~BindContext() = default;
 
@@ -57,7 +59,17 @@ struct PrefetchURLLoaderService::BindContext {
 
   // This member is lazily initialized by EnsureCrossOriginFactory().
   scoped_refptr<network::SharedURLLoaderFactory> cross_origin_factory;
+
   scoped_refptr<PrefetchedSignedExchangeCache> prefetched_signed_exchange_cache;
+
+  // This maps recursive prefetch tokens to NetworkIsolationKeys that they
+  // should be fetched with.
+  std::map<base::UnguessableToken, net::NetworkIsolationKey>
+      prefetch_network_isolation_keys;
+
+  // This must be the last member.
+  base::WeakPtrFactory<PrefetchURLLoaderService::BindContext> weak_ptr_factory{
+      this};
 };
 
 PrefetchURLLoaderService::PrefetchURLLoaderService(
@@ -108,7 +120,7 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
 
   DCHECK_EQ(static_cast<int>(ResourceType::kPrefetch),
             resource_request.resource_type);
-  const auto& current_context = *loader_factory_receivers_.current_context();
+  auto& current_context = *loader_factory_receivers_.current_context();
 
   if (!current_context.render_frame_host) {
     client->OnComplete(network::URLLoaderCompletionStatus(net::ERR_ABORTED));
@@ -143,6 +155,32 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
         net::NetworkIsolationKey(destination_origin, destination_origin);
   }
 
+  // Recursive prefetch from a cross-origin main resource prefetch.
+  if (resource_request.recursive_prefetch_token) {
+    // A request's |recursive_prefetch_token| is only provided if the request is
+    // a recursive prefetch. This means it is expected that the current
+    // context's |cross_origin_factory| was already created.
+    DCHECK(current_context.cross_origin_factory);
+
+    // Resurrect the request's NetworkIsolationKey from the current context's
+    // map, and use it for this request.
+    auto nik_iterator = current_context.prefetch_network_isolation_keys.find(
+        resource_request.recursive_prefetch_token.value());
+
+    // An unexpected token could indicate a compromised renderer trying to fetch
+    // a request in a special way. We'll cancel the request.
+    if (nik_iterator == current_context.prefetch_network_isolation_keys.end()) {
+      client->OnComplete(
+          network::URLLoaderCompletionStatus(net::ERR_INVALID_ARGUMENT));
+      return;
+    }
+
+    resource_request.trusted_params = network::ResourceRequest::TrustedParams();
+    resource_request.trusted_params->network_isolation_key =
+        nik_iterator->second;
+    network_loader_factory_to_use = current_context.cross_origin_factory;
+  }
+
   if (prefetch_load_callback_for_testing_)
     prefetch_load_callback_for_testing_.Run();
 
@@ -153,24 +191,24 @@ void PrefetchURLLoaderService::CreateLoaderAndStart(
             ->prefetched_signed_exchange_cache;
   }
 
-  auto frame_tree_node_id_getter = base::BindRepeating(
-      [](int id) { return id; }, current_context.frame_tree_node_id);
-
   // For now we strongly bind the loader to the request, while we can
   // also possibly make the new loader owned by the factory so that
   // they can live longer than the client (i.e. run in detached mode).
   // TODO(kinuko): Revisit this.
   mojo::MakeStrongBinding(
       std::make_unique<PrefetchURLLoader>(
-          routing_id, request_id, options, frame_tree_node_id_getter,
+          routing_id, request_id, options, current_context.frame_tree_node_id,
           resource_request, std::move(client), traffic_annotation,
           std::move(network_loader_factory_to_use),
           base::BindRepeating(
               &PrefetchURLLoaderService::CreateURLLoaderThrottles, this,
-              resource_request, frame_tree_node_id_getter),
+              resource_request, current_context.frame_tree_node_id),
           browser_context_, signed_exchange_prefetch_metric_recorder_,
           std::move(prefetched_signed_exchange_cache), blob_storage_context_,
-          accept_langs_),
+          accept_langs_,
+          base::BindOnce(
+              &PrefetchURLLoaderService::GenerateRecursivePrefetchToken, this,
+              current_context.weak_ptr_factory.GetWeakPtr())),
       std::move(request));
 }
 
@@ -232,10 +270,10 @@ void PrefetchURLLoaderService::EnsureCrossOriginFactory() {
 }
 
 void PrefetchURLLoaderService::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   loader_factory_receivers_.Add(
-      this, std::move(request),
+      this, std::move(receiver),
       std::make_unique<BindContext>(
           loader_factory_receivers_.current_context()));
 }
@@ -245,11 +283,35 @@ void PrefetchURLLoaderService::NotifyUpdate(
   SetAcceptLanguages(new_prefs->accept_languages);
 }
 
+base::UnguessableToken PrefetchURLLoaderService::GenerateRecursivePrefetchToken(
+    base::WeakPtr<BindContext> current_context,
+    const network::ResourceRequest& request) {
+  // If the relevant frame has gone away before this method is called
+  // asynchronously, we cannot generate and store a
+  // {token, NetworkIsolationKey} pair in the frame's
+  // |prefetch_network_isolation_keys| map, so we'll create and return a dummy
+  // token that will not get used.
+  if (!current_context)
+    return base::UnguessableToken::Create();
+
+  // Create NetworkIsolationKey.
+  url::Origin destination_origin = url::Origin::Create(request.url);
+  net::NetworkIsolationKey preload_nik =
+      net::NetworkIsolationKey(destination_origin, destination_origin);
+
+  // Generate token.
+  base::UnguessableToken return_token = base::UnguessableToken::Create();
+
+  // Associate the two, and return the token.
+  current_context->prefetch_network_isolation_keys.insert(
+      {return_token, preload_nik});
+  return return_token;
+}
+
 std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
 PrefetchURLLoaderService::CreateURLLoaderThrottles(
     const network::ResourceRequest& request,
-    base::RepeatingCallback<int(void)> frame_tree_node_id_getter) {
-  int frame_tree_node_id = frame_tree_node_id_getter.Run();
+    int frame_tree_node_id) {
   return GetContentClient()->browser()->CreateURLLoaderThrottles(
       request, browser_context_,
       base::BindRepeating(&WebContents::FromFrameTreeNodeId,
diff --git a/chromium/content/browser/loader/prefetch_url_loader_service.h b/chromium/content/browser/loader/prefetch_url_loader_service.h
index bf78700299c..4fbbdbc292e 100644
--- a/chromium/content/browser/loader/prefetch_url_loader_service.h
+++ b/chromium/content/browser/loader/prefetch_url_loader_service.h
@@ -13,6 +13,7 @@
 #include "content/browser/web_package/signed_exchange_prefetch_metric_recorder.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
@@ -81,7 +82,8 @@ class CONTENT_EXPORT PrefetchURLLoaderService final
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
   // This ensures that the BindContext's |cross_origin_factory| member exists
   // by setting it to a special URLLoaderFactory created by the current
@@ -90,14 +92,17 @@ class CONTENT_EXPORT PrefetchURLLoaderService final
   bool IsValidCrossOriginPrefetch(
       const network::ResourceRequest& resource_request);
 
+  base::UnguessableToken GenerateRecursivePrefetchToken(
+      base::WeakPtr<BindContext> bind_context,
+      const network::ResourceRequest& request);
+
   // blink::mojom::RendererPreferenceWatcher.
   void NotifyUpdate(blink::mojom::RendererPreferencesPtr new_prefs) override;
 
   // For URLLoaderThrottlesGetter.
   std::vector<std::unique_ptr<blink::URLLoaderThrottle>>
-  CreateURLLoaderThrottles(
-      const network::ResourceRequest& request,
-      base::RepeatingCallback<int(void)> frame_tree_node_id_getter);
+  CreateURLLoaderThrottles(const network::ResourceRequest& request,
+                           int frame_tree_node_id);
 
   scoped_refptr<URLLoaderFactoryGetter> loader_factory_getter_;
   BrowserContext* browser_context_ = nullptr;
diff --git a/chromium/content/browser/loader/reload_cache_control_browsertest.cc b/chromium/content/browser/loader/reload_cache_control_browsertest.cc
index f5d87fa98a6..702ef948995 100644
--- a/chromium/content/browser/loader/reload_cache_control_browsertest.cc
+++ b/chromium/content/browser/loader/reload_cache_control_browsertest.cc
@@ -73,7 +73,7 @@ class ReloadCacheControlBrowserTest : public ContentBrowserTest {
     // a registered HandleFileRequest for "content/test/data".
     // Because the handler is registered as the first handler, MonitorHandler
     // is needed to capture all requests.
-    embedded_test_server()->RegisterRequestMonitor(base::Bind(
+    embedded_test_server()->RegisterRequestMonitor(base::BindRepeating(
         &ReloadCacheControlBrowserTest::MonitorRequestHandler,
         base::Unretained(this)));
 
diff --git a/chromium/content/browser/loader/single_request_url_loader_factory.cc b/chromium/content/browser/loader/single_request_url_loader_factory.cc
index 22d6ab4eaae..6e955913c72 100644
--- a/chromium/content/browser/loader/single_request_url_loader_factory.cc
+++ b/chromium/content/browser/loader/single_request_url_loader_factory.cc
@@ -93,7 +93,7 @@ void SingleRequestURLLoaderFactory::CreateLoaderAndStart(
 }
 
 void SingleRequestURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   NOTREACHED();
 }
 
diff --git a/chromium/content/browser/loader/single_request_url_loader_factory.h b/chromium/content/browser/loader/single_request_url_loader_factory.h
index dcf8336b173..996d0d0280c 100644
--- a/chromium/content/browser/loader/single_request_url_loader_factory.h
+++ b/chromium/content/browser/loader/single_request_url_loader_factory.h
@@ -8,6 +8,7 @@
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 
 #include "base/memory/ref_counted.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 
 namespace content {
@@ -33,7 +34,8 @@ class SingleRequestURLLoaderFactory : public network::SharedURLLoaderFactory {
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override;
 
  private:
diff --git a/chromium/content/browser/loader/source_stream_to_data_pipe.cc b/chromium/content/browser/loader/source_stream_to_data_pipe.cc
deleted file mode 100644
index 42793d79d0e..00000000000
--- a/chromium/content/browser/loader/source_stream_to_data_pipe.cc
+++ /dev/null
@@ -1,102 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/loader/source_stream_to_data_pipe.h"
-
-#include "base/bind.h"
-#include "net/filter/source_stream.h"
-
-namespace content {
-
-SourceStreamToDataPipe::SourceStreamToDataPipe(
-    std::unique_ptr<net::SourceStream> source,
-    mojo::ScopedDataPipeProducerHandle dest,
-    base::OnceCallback<void(int)> completion_callback)
-    : source_(std::move(source)),
-      dest_(std::move(dest)),
-      completion_callback_(std::move(completion_callback)),
-      writable_handle_watcher_(FROM_HERE,
-                               mojo::SimpleWatcher::ArmingPolicy::MANUAL,
-                               base::SequencedTaskRunnerHandle::Get()) {
-  writable_handle_watcher_.Watch(
-      dest_.get(), MOJO_HANDLE_SIGNAL_WRITABLE,
-      base::BindRepeating(&SourceStreamToDataPipe::OnDataPipeWritable,
-                          base::Unretained(this)));
-}
-
-SourceStreamToDataPipe::~SourceStreamToDataPipe() = default;
-
-void SourceStreamToDataPipe::Start() {
-  ReadMore();
-}
-
-void SourceStreamToDataPipe::ReadMore() {
-  DCHECK(!pending_write_.get());
-
-  uint32_t num_bytes;
-  MojoResult mojo_result = network::NetToMojoPendingBuffer::BeginWrite(
-      &dest_, &pending_write_, &num_bytes);
-  if (mojo_result == MOJO_RESULT_SHOULD_WAIT) {
-    // The pipe is full.  We need to wait for it to have more space.
-    writable_handle_watcher_.ArmOrNotify();
-    return;
-  } else if (mojo_result == MOJO_RESULT_FAILED_PRECONDITION) {
-    // The data pipe consumer handle has been closed.
-    OnComplete(net::ERR_ABORTED);
-    return;
-  } else if (mojo_result != MOJO_RESULT_OK) {
-    // The body stream is in a bad state. Bail out.
-    OnComplete(net::ERR_UNEXPECTED);
-    return;
-  }
-
-  scoped_refptr<net::IOBuffer> buffer(
-      new network::NetToMojoIOBuffer(pending_write_.get()));
-  int result =
-      source_->Read(buffer.get(), base::checked_cast<int>(num_bytes),
-                    base::BindRepeating(&SourceStreamToDataPipe::DidRead,
-                                        base::Unretained(this)));
-
-  if (result != net::ERR_IO_PENDING)
-    DidRead(result);
-}
-
-void SourceStreamToDataPipe::DidRead(int result) {
-  DCHECK(pending_write_);
-  if (result <= 0) {
-    // An error, or end of the stream.
-    pending_write_->Complete(0);  // Closes the data pipe.
-    OnComplete(result);
-    return;
-  }
-  dest_ = pending_write_->Complete(result);
-  pending_write_ = nullptr;
-  transferred_bytes_ += result;
-
-  base::SequencedTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE, base::BindOnce(&SourceStreamToDataPipe::ReadMore,
-                                weak_factory_.GetWeakPtr()));
-}
-
-void SourceStreamToDataPipe::OnDataPipeWritable(MojoResult result) {
-  if (result == MOJO_RESULT_FAILED_PRECONDITION) {
-    OnComplete(net::ERR_ABORTED);
-    return;
-  }
-  DCHECK_EQ(result, MOJO_RESULT_OK) << result;
-
-  ReadMore();
-}
-
-void SourceStreamToDataPipe::OnComplete(int result) {
-  // Resets the watchers, pipes and the exchange handler, so that
-  // we will never be called back.
-  writable_handle_watcher_.Cancel();
-  pending_write_ = nullptr;
-  dest_.reset();
-
-  std::move(completion_callback_).Run(result);
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/loader/source_stream_to_data_pipe.h b/chromium/content/browser/loader/source_stream_to_data_pipe.h
deleted file mode 100644
index f909755ab70..00000000000
--- a/chromium/content/browser/loader/source_stream_to_data_pipe.h
+++ /dev/null
@@ -1,56 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_BROWSER_LOADER_SOURCE_STREAM_TO_DATA_PIPE_H_
-#define CONTENT_BROWSER_LOADER_SOURCE_STREAM_TO_DATA_PIPE_H_
-
-#include "base/callback_forward.h"
-#include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-#include "mojo/public/cpp/system/data_pipe.h"
-#include "mojo/public/cpp/system/simple_watcher.h"
-#include "services/network/public/cpp/net_adapters.h"
-
-namespace net {
-class SourceStream;
-}
-
-namespace content {
-
-// A convenient adapter class to read out data from net::SourceStream
-// and write them into a data pipe.
-class CONTENT_EXPORT SourceStreamToDataPipe {
- public:
-  // Reads out the data from |source| and write into |dest|.
-  SourceStreamToDataPipe(std::unique_ptr<net::SourceStream> source,
-                         mojo::ScopedDataPipeProducerHandle dest,
-                         base::OnceCallback<void(int)> completion_callback);
-  ~SourceStreamToDataPipe();
-
-  // Start reading the source.
-  void Start();
-  int64_t TransferredBytes() const { return transferred_bytes_; }
-
- private:
-  void ReadMore();
-  void DidRead(int result);
-
-  void OnDataPipeWritable(MojoResult result);
-  void OnDataPipeClosed(MojoResult result);
-  void OnComplete(int result);
-
-  std::unique_ptr<net::SourceStream> source_;
-  mojo::ScopedDataPipeProducerHandle dest_;
-  base::OnceCallback<void(int)> completion_callback_;
-  int64_t transferred_bytes_ = 0;
-
-  scoped_refptr<network::NetToMojoPendingBuffer> pending_write_;
-  mojo::SimpleWatcher writable_handle_watcher_;
-
-  base::WeakPtrFactory<SourceStreamToDataPipe> weak_factory_{this};
-};
-
-}  // namespace content
-
-#endif  // CONTENT_BROWSER_LOADER_SOURCE_STREAM_TO_DATA_PIPE_H_
diff --git a/chromium/content/browser/loader/source_stream_to_data_pipe_unittest.cc b/chromium/content/browser/loader/source_stream_to_data_pipe_unittest.cc
deleted file mode 100644
index 5086c729121..00000000000
--- a/chromium/content/browser/loader/source_stream_to_data_pipe_unittest.cc
+++ /dev/null
@@ -1,196 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/browser/loader/source_stream_to_data_pipe.h"
-
-#include "base/bind.h"
-#include "base/optional.h"
-#include "base/test/task_environment.h"
-#include "net/filter/mock_source_stream.h"
-#include "testing/gtest/include/gtest/gtest.h"
-
-namespace content {
-
-namespace {
-
-const int kBigPipeCapacity = 4096;
-const int kSmallPipeCapacity = 1;
-
-enum class ReadResultType {
-  // Each call to AddReadResult is a separate read from the lower layer
-  // SourceStream. This doesn't work with kSmallPipeCapacity, because
-  // MockSourceStream expects that IOBuffer size is not smaller than the data
-  // chunk passed to AddReadResult.
-  EVERYTHING_AT_ONCE,
-  // Whenever AddReadResult is called, each byte is actually a separate read
-  // result.
-  ONE_BYTE_AT_A_TIME,
-};
-
-struct SourceStreamToDataPipeTestParam {
-  SourceStreamToDataPipeTestParam(uint32_t pipe_capacity,
-                                  net::MockSourceStream::Mode read_mode,
-                                  ReadResultType read_result_type)
-      : pipe_capacity(pipe_capacity),
-        mode(read_mode),
-        read_result_type(read_result_type) {}
-
-  const uint32_t pipe_capacity;
-  const net::MockSourceStream::Mode mode;
-  const ReadResultType read_result_type;
-};
-
-}  // namespace
-
-class SourceStreamToDataPipeTest
-    : public ::testing::TestWithParam<SourceStreamToDataPipeTestParam> {
- protected:
-  SourceStreamToDataPipeTest() {}
-
-  void Init() {
-    std::unique_ptr<net::MockSourceStream> source(new net::MockSourceStream());
-    if (GetParam().read_result_type == ReadResultType::ONE_BYTE_AT_A_TIME)
-      source->set_read_one_byte_at_a_time(true);
-    source_ = source.get();
-
-    const MojoCreateDataPipeOptions data_pipe_options{
-        sizeof(MojoCreateDataPipeOptions), MOJO_CREATE_DATA_PIPE_FLAG_NONE, 1,
-        GetParam().pipe_capacity};
-    mojo::ScopedDataPipeProducerHandle producer_end;
-    CHECK_EQ(MOJO_RESULT_OK,
-             mojo::CreateDataPipe(&data_pipe_options, &producer_end,
-                                  &consumer_end_));
-
-    adapter_ = std::make_unique<SourceStreamToDataPipe>(
-        std::move(source), std::move(producer_end),
-        base::BindOnce(&SourceStreamToDataPipeTest::FinishedReading,
-                       base::Unretained(this)));
-  }
-
-  void CompleteReadsIfAsync() {
-    if (GetParam().mode == net::MockSourceStream::ASYNC) {
-      while (source()->awaiting_completion())
-        source()->CompleteNextRead();
-    }
-  }
-
-  // Reads from |consumer_end_| until an error occurs or the producer end is
-  // closed. Returns the value passed to the completion callback.
-  int ReadPipe(std::string* output) {
-    MojoResult result = MOJO_RESULT_OK;
-    while (result == MOJO_RESULT_OK || result == MOJO_RESULT_SHOULD_WAIT) {
-      char buffer[16];
-      uint32_t read_size = sizeof(buffer);
-      MojoResult result =
-          consumer_end().ReadData(buffer, &read_size, MOJO_READ_DATA_FLAG_NONE);
-      if (result == MOJO_RESULT_FAILED_PRECONDITION)
-        break;
-      if (result == MOJO_RESULT_SHOULD_WAIT) {
-        RunUntilIdle();
-        CompleteReadsIfAsync();
-      } else {
-        EXPECT_EQ(result, MOJO_RESULT_OK);
-        output->append(buffer, read_size);
-      }
-    }
-    EXPECT_TRUE(CallbackResult().has_value());
-    return *CallbackResult();
-  }
-
-  SourceStreamToDataPipe* adapter() { return adapter_.get(); }
-  net::MockSourceStream* source() { return source_; }
-  mojo::DataPipeConsumerHandle consumer_end() { return consumer_end_.get(); }
-
-  void CloseConsumerHandle() { consumer_end_.reset(); }
-  void RunUntilIdle() { task_environment_.RunUntilIdle(); }
-  base::Optional<int> CallbackResult() { return callback_result_; }
-
- private:
-  void FinishedReading(int result) { callback_result_ = result; }
-
-  base::test::TaskEnvironment task_environment_;
-  net::MockSourceStream* source_;
-  std::unique_ptr<SourceStreamToDataPipe> adapter_;
-  mojo::ScopedDataPipeConsumerHandle consumer_end_;
-  base::Optional<int> callback_result_;
-};
-
-INSTANTIATE_TEST_SUITE_P(
-    SourceStreamToDataPipeTests,
-    SourceStreamToDataPipeTest,
-    ::testing::Values(
-        SourceStreamToDataPipeTestParam(kBigPipeCapacity,
-                                        net::MockSourceStream::SYNC,
-                                        ReadResultType::EVERYTHING_AT_ONCE),
-        SourceStreamToDataPipeTestParam(kBigPipeCapacity,
-                                        net::MockSourceStream::ASYNC,
-                                        ReadResultType::EVERYTHING_AT_ONCE),
-        SourceStreamToDataPipeTestParam(kBigPipeCapacity,
-                                        net::MockSourceStream::SYNC,
-                                        ReadResultType::ONE_BYTE_AT_A_TIME),
-        SourceStreamToDataPipeTestParam(kSmallPipeCapacity,
-                                        net::MockSourceStream::SYNC,
-                                        ReadResultType::ONE_BYTE_AT_A_TIME),
-        SourceStreamToDataPipeTestParam(kBigPipeCapacity,
-                                        net::MockSourceStream::ASYNC,
-                                        ReadResultType::ONE_BYTE_AT_A_TIME),
-        SourceStreamToDataPipeTestParam(kSmallPipeCapacity,
-                                        net::MockSourceStream::ASYNC,
-                                        ReadResultType::ONE_BYTE_AT_A_TIME)));
-
-TEST_P(SourceStreamToDataPipeTest, EmptyStream) {
-  Init();
-  source()->AddReadResult(nullptr, 0, net::OK, GetParam().mode);
-  adapter()->Start();
-
-  std::string output;
-  EXPECT_EQ(ReadPipe(&output), net::OK);
-  EXPECT_TRUE(output.empty());
-}
-
-TEST_P(SourceStreamToDataPipeTest, Simple) {
-  const char message[] = "Hello, world!";
-
-  Init();
-  source()->AddReadResult(message, sizeof(message) - 1, net::OK,
-                          GetParam().mode);
-  source()->AddReadResult(nullptr, 0, net::OK, GetParam().mode);
-  adapter()->Start();
-
-  std::string output;
-  EXPECT_EQ(ReadPipe(&output), net::OK);
-  EXPECT_EQ(output, message);
-}
-
-TEST_P(SourceStreamToDataPipeTest, Error) {
-  const char message[] = "Hello, world!";
-
-  Init();
-  source()->AddReadResult(message, sizeof(message) - 1, net::OK,
-                          GetParam().mode);
-  source()->AddReadResult(nullptr, 0, net::ERR_FAILED, GetParam().mode);
-  adapter()->Start();
-
-  std::string output;
-  EXPECT_EQ(ReadPipe(&output), net::ERR_FAILED);
-  EXPECT_EQ(output, message);
-}
-
-TEST_P(SourceStreamToDataPipeTest, ConsumerClosed) {
-  const char message[] = "a";
-
-  Init();
-  source()->AddReadResult(message, sizeof(message) - 1, net::OK,
-                          GetParam().mode);
-  adapter()->Start();
-
-  CloseConsumerHandle();
-  CompleteReadsIfAsync();
-  RunUntilIdle();
-
-  ASSERT_TRUE(CallbackResult().has_value());
-  EXPECT_EQ(*CallbackResult(), net::ERR_ABORTED);
-}
-
-}  // namespace content
diff --git a/chromium/content/browser/locks/lock_manager.cc b/chromium/content/browser/locks/lock_manager.cc
index 03a8a5831ab..4618ad64cfa 100644
--- a/chromium/content/browser/locks/lock_manager.cc
+++ b/chromium/content/browser/locks/lock_manager.cc
@@ -6,6 +6,7 @@
 
 #include <algorithm>
 #include <memory>
+#include <tuple>
 #include <unordered_set>
 #include <utility>
 #include <vector>
@@ -14,6 +15,10 @@
 #include "base/guid.h"
 #include "base/stl_util.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/lock_observer.h"
+#include "content/public/common/content_client.h"
+#include "ipc/ipc_message.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_associated_receiver.h"
 
@@ -74,35 +79,36 @@ class LockManager::Lock {
   Lock(const std::string& name,
        LockMode mode,
        int64_t lock_id,
-       const std::string& client_id,
+       const ReceiverState& receiver_state,
        mojo::AssociatedRemote<blink::mojom::LockRequest> request)
       : name_(name),
         mode_(mode),
-        client_id_(client_id),
         lock_id_(lock_id),
+        client_id_(receiver_state.client_id),
+        execution_context_(receiver_state.execution_context),
         request_(std::move(request)) {}
 
-  ~Lock() = default;
-
-  // Abort a lock request.
-  void Abort(const std::string& message) {
-    DCHECK(request_);
-    DCHECK(!handle_);
-
-    request_->Abort(message);
-    request_.reset();
+  ~Lock() {
+    // If the lock was ever granted, decrement the number of held locks for the
+    // frame.
+    if (lock_manager_) {
+      lock_manager_->DecrementLocksHeldByFrame(execution_context_);
+    }
   }
 
   // Grant a lock request. This mints a LockHandle and returns it over the
   // request pipe.
-  void Grant(base::WeakPtr<LockManager> context, const url::Origin& origin) {
-    DCHECK(context);
+  void Grant(LockManager* lock_manager, const url::Origin& origin) {
+    DCHECK(lock_manager);
+    DCHECK(!lock_manager_);
     DCHECK(request_);
     DCHECK(!handle_);
 
+    lock_manager_ = lock_manager->weak_ptr_factory_.GetWeakPtr();
+    lock_manager_->IncrementLocksHeldByFrame(execution_context_);
+
     mojo::PendingAssociatedRemote<blink::mojom::LockHandle> remote;
-    handle_ =
-        LockHandleImpl::Create(std::move(context), origin, lock_id_, &remote);
+    handle_ = LockHandleImpl::Create(lock_manager_, origin, lock_id_, &remote);
     request_->Granted(std::move(remote));
     request_.reset();
   }
@@ -112,6 +118,7 @@ class LockManager::Lock {
   void Break() {
     DCHECK(!request_);
     DCHECK(handle_);
+    DCHECK(lock_manager_);
 
     LockHandleImpl* impl = static_cast<LockHandleImpl*>(handle_->impl());
     // Explicitly close the LockHandle first; this ensures that when the
@@ -130,8 +137,11 @@ class LockManager::Lock {
  private:
   const std::string name_;
   const LockMode mode_;
-  const std::string client_id_;
   const int64_t lock_id_;
+  const std::string client_id_;
+  const ExecutionContext execution_context_;
+  // Set only once the lock is granted.
+  base::WeakPtr<LockManager> lock_manager_;
 
   // Exactly one of the following is non-null at any given time.
 
@@ -170,28 +180,26 @@ class LockManager::OriginState {
   void PreemptLock(int64_t lock_id,
                    const std::string& name,
                    LockMode mode,
-                   const std::string& client_id,
                    mojo::AssociatedRemote<blink::mojom::LockRequest> request,
-                   const url::Origin origin) {
+                   const ReceiverState& receiver_state) {
     // Preempting shared locks is not supported.
     DCHECK_EQ(mode, LockMode::EXCLUSIVE);
     std::list<Lock>& request_queue = resource_names_to_requests_[name];
     while (!request_queue.empty() && request_queue.front().is_granted())
       BreakFront(request_queue);
-    request_queue.emplace_front(name, mode, lock_id, client_id,
+    request_queue.emplace_front(name, mode, lock_id, receiver_state,
                                 std::move(request));
     auto it = request_queue.begin();
     lock_id_to_iterator_.emplace(it->lock_id(), it);
-    it->Grant(lock_manager_->weak_ptr_factory_.GetWeakPtr(), origin);
+    it->Grant(lock_manager_, receiver_state.origin);
   }
 
   void AddRequest(int64_t lock_id,
                   const std::string& name,
                   LockMode mode,
-                  const std::string& client_id,
                   mojo::AssociatedRemote<blink::mojom::LockRequest> request,
                   WaitMode wait,
-                  const url::Origin origin) {
+                  const ReceiverState& receiver_state) {
     DCHECK(wait != WaitMode::PREEMPT);
     std::list<Lock>& request_queue = resource_names_to_requests_[name];
     bool can_grant = request_queue.empty() ||
@@ -204,12 +212,13 @@ class LockManager::OriginState {
       return;
     }
 
-    request_queue.emplace_back(name, mode, lock_id, client_id,
+    request_queue.emplace_back(name, mode, lock_id, receiver_state,
                                std::move(request));
     auto it = --(request_queue.end());
     lock_id_to_iterator_.emplace(it->lock_id(), it);
-    if (can_grant)
-      it->Grant(lock_manager_->weak_ptr_factory_.GetWeakPtr(), origin);
+    if (can_grant) {
+      it->Grant(lock_manager_, receiver_state.origin);
+    }
   }
 
   void EraseLock(int64_t lock_id, const url::Origin& origin) {
@@ -253,8 +262,7 @@ class LockManager::OriginState {
       return;
 
     if (request_queue.front().mode() == LockMode::EXCLUSIVE) {
-      request_queue.front().Grant(lock_manager_->weak_ptr_factory_.GetWeakPtr(),
-                                  origin);
+      request_queue.front().Grant(lock_manager_, origin);
     } else {
       DCHECK(request_queue.front().mode() == LockMode::SHARED);
       for (auto grantee = request_queue.begin();
@@ -262,7 +270,7 @@ class LockManager::OriginState {
            grantee->mode() == LockMode::SHARED;
            ++grantee) {
         DCHECK(!grantee->is_granted());
-        grantee->Grant(lock_manager_->weak_ptr_factory_.GetWeakPtr(), origin);
+        grantee->Grant(lock_manager_, origin);
       }
     }
   }
@@ -307,16 +315,19 @@ class LockManager::OriginState {
   LockManager* lock_manager_;
 };
 
-void LockManager::CreateService(
-    mojo::PendingReceiver<blink::mojom::LockManager> receiver,
-    const url::Origin& origin) {
+void LockManager::BindReceiver(
+    int render_process_id,
+    int render_frame_id,
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::LockManager> receiver) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   // TODO(jsbell): This should reflect the 'environment id' from HTML,
   // and be the same opaque string seen in Service Worker client ids.
   const std::string client_id = base::GenerateGUID();
 
-  receivers_.Add(this, std::move(receiver), {origin, client_id});
+  receivers_.Add(this, std::move(receiver),
+                 {client_id, {render_process_id, render_frame_id}, origin});
 }
 
 void LockManager::RequestLock(
@@ -351,11 +362,10 @@ void LockManager::RequestLock(
 
   OriginState& origin_state = origins_.find(context.origin)->second;
   if (wait == WaitMode::PREEMPT) {
-    origin_state.PreemptLock(lock_id, name, mode, context.client_id,
-                             std::move(request), context.origin);
+    origin_state.PreemptLock(lock_id, name, mode, std::move(request), context);
   } else
-    origin_state.AddRequest(lock_id, name, mode, context.client_id,
-                            std::move(request), wait, context.origin);
+    origin_state.AddRequest(lock_id, name, mode, std::move(request), wait,
+                            context);
 }
 
 void LockManager::ReleaseLock(const url::Origin& origin, int64_t lock_id) {
@@ -388,10 +398,63 @@ void LockManager::QueryState(QueryStateCallback callback) {
                           std::move(requested_held_pair.second));
 }
 
+bool LockManager::ExecutionContext::IsWorker() const {
+  return render_frame_id == MSG_ROUTING_NONE;
+}
+
 int64_t LockManager::NextLockId() {
   int64_t lock_id = ++next_lock_id_;
   DCHECK_GT(lock_id, kPreemptiveLockId);
   return lock_id;
 }
 
+void LockManager::IncrementLocksHeldByFrame(
+    const ExecutionContext& execution_context) {
+  // Locks held by workers are not tracked because there is no current use case.
+  // If we had a use case, we would need to find a type to identify a frame OR a
+  // worker.
+  if (execution_context.IsWorker())
+    return;
+
+  int previous_num_locks = num_locks_held_by_frame_[execution_context]++;
+
+  if (previous_num_locks > 0)
+    return;
+
+  LockObserver* observer = GetContentClient()->browser()->GetLockObserver();
+  if (observer) {
+    observer->OnFrameStartsHoldingWebLocks(execution_context.render_process_id,
+                                           execution_context.render_frame_id);
+  }
+}
+
+void LockManager::DecrementLocksHeldByFrame(
+    const ExecutionContext& execution_context) {
+  if (execution_context.IsWorker())
+    return;
+
+  auto it = num_locks_held_by_frame_.find(execution_context);
+  DCHECK(it != num_locks_held_by_frame_.end());
+  DCHECK_GT(it->second, 0);
+
+  --it->second;
+  if (it->second > 0)
+    return;
+
+  num_locks_held_by_frame_.erase(it);
+
+  LockObserver* observer = GetContentClient()->browser()->GetLockObserver();
+  if (observer) {
+    observer->OnFrameStopsHoldingWebLocks(execution_context.render_process_id,
+                                          execution_context.render_frame_id);
+  }
+}
+
+bool LockManager::ExecutionContextComparator::operator()(
+    const ExecutionContext& left,
+    const ExecutionContext& right) const {
+  return std::tie(left.render_process_id, left.render_frame_id) <
+         std::tie(right.render_process_id, right.render_frame_id);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/locks/lock_manager.h b/chromium/content/browser/locks/lock_manager.h
index 7b023dfbc76..507e843437c 100644
--- a/chromium/content/browser/locks/lock_manager.h
+++ b/chromium/content/browser/locks/lock_manager.h
@@ -26,8 +26,13 @@ class LockManager : public base::RefCountedThreadSafe<LockManager>,
  public:
   LockManager();
 
-  void CreateService(mojo::PendingReceiver<blink::mojom::LockManager> receiver,
-                     const url::Origin& origin);
+  // Binds |receiver| to this LockManager. |receiver| belongs to a frame or
+  // worker at |origin| hosted by |render_process_id|. If it belongs to a frame,
+  // |render_frame_id| identifies it, otherwise it is MSG_ROUTING_NONE.
+  void BindReceiver(int render_process_id,
+                    int render_frame_id,
+                    const url::Origin& origin,
+                    mojo::PendingReceiver<blink::mojom::LockManager> receiver);
 
   // Request a lock. When the lock is acquired, |callback| will be invoked with
   // a LockHandle.
@@ -54,31 +59,54 @@ class LockManager : public base::RefCountedThreadSafe<LockManager>,
   // State for a particular origin.
   class OriginState;
 
+  // Describes a frame or a worker.
+  struct ExecutionContext {
+    // The identifier of the process hosting this frame or worker.
+    int render_process_id;
+
+    // The frame identifier, or MSG_ROUTING_NONE if this describes a worker
+    // (this means that dedicated/shared/service workers are not distinguished).
+    int render_frame_id;
+
+    // Returns true if this is a worker.
+    bool IsWorker() const;
+  };
+
+  // Comparator to use ExecutionContext in a map.
+  struct ExecutionContextComparator {
+    bool operator()(const ExecutionContext& left,
+                    const ExecutionContext& right) const;
+  };
+
   // State for each client held in |receivers_|.
   struct ReceiverState {
-    url::Origin origin;
     std::string client_id;
-  };
 
-  bool IsGrantable(const url::Origin& origin,
-                   const std::string& name,
-                   blink::mojom::LockMode mode) const;
+    // ExecutionContext owning this receiver.
+    ExecutionContext execution_context;
+
+    // Origin of the frame or worker owning this receiver.
+    url::Origin origin;
+  };
 
   // Mints a monotonically increasing identifier. Used both for lock requests
   // and granted locks as keys in ordered maps.
   int64_t NextLockId();
 
-  void Break(const url::Origin& origin, const std::string& name);
-
-  // Called when a lock is requested and optionally when a lock is released,
-  // to process outstanding requests within the origin.
-  void ProcessRequests(const url::Origin& origin);
+  // Increments/decrements the number of locks held by the frame described by
+  // |execution_context|. No-ops if |execution_context| describes a worker.
+  void IncrementLocksHeldByFrame(const ExecutionContext& execution_context);
+  void DecrementLocksHeldByFrame(const ExecutionContext& execution_context);
 
   mojo::ReceiverSet<blink::mojom::LockManager, ReceiverState> receivers_;
 
   int64_t next_lock_id_ = 0;
   std::map<url::Origin, OriginState> origins_;
 
+  // Number of Locks held per frame.
+  std::map<ExecutionContext, int, ExecutionContextComparator>
+      num_locks_held_by_frame_{ExecutionContextComparator()};
+
   SEQUENCE_CHECKER(sequence_checker_);
   base::WeakPtrFactory<LockManager> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/locks/lock_manager_browsertest.cc b/chromium/content/browser/locks/lock_manager_browsertest.cc
new file mode 100644
index 00000000000..0d6fe75d552
--- /dev/null
+++ b/chromium/content/browser/locks/lock_manager_browsertest.cc
@@ -0,0 +1,376 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string>
+
+#include "base/macros.h"
+#include "base/test/test_timeouts.h"
+#include "build/build_config.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/lock_observer.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/common/content_client.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/content_mock_cert_verifier.h"
+#include "content/shell/browser/shell.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+#if defined(OS_ANDROID)
+#include "base/android/build_info.h"
+#endif
+
+namespace content {
+
+namespace {
+
+class TestBrowserClient : public ContentBrowserClient {
+ public:
+  explicit TestBrowserClient(LockObserver* lock_observer)
+      : lock_observer_(lock_observer) {}
+  ~TestBrowserClient() override = default;
+
+  LockObserver* GetLockObserver() override { return lock_observer_; }
+
+ private:
+  LockObserver* const lock_observer_;
+
+  TestBrowserClient(const TestBrowserClient&) = delete;
+  TestBrowserClient& operator=(const TestBrowserClient&) = delete;
+};
+
+class MockObserver : public LockObserver {
+ public:
+  MockObserver() = default;
+  ~MockObserver() = default;
+
+  // LockObserver:
+  MOCK_METHOD2(OnFrameStartsHoldingWebLocks,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStopsHoldingWebLocks,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStartsHoldingIndexedDBConnections,
+               void(int render_process_id, int render_frame_id));
+  MOCK_METHOD2(OnFrameStopsHoldingIndexedDBConnections,
+               void(int render_process_id, int render_frame_id));
+};
+
+void RunLoopWithTimeout() {
+  base::RunLoop run_loop;
+  base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+      FROM_HERE, run_loop.QuitClosure(), TestTimeouts::tiny_timeout());
+  run_loop.Run();
+}
+
+}  // namespace
+
+class LockManagerBrowserTest : public ContentBrowserTest {
+ public:
+  LockManagerBrowserTest() = default;
+  ~LockManagerBrowserTest() override = default;
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    ContentBrowserTest::SetUpCommandLine(command_line);
+    // This is required to allow navigation to test https:// URLs. Service
+    // workers are not exposed to http:// URLs.
+    cert_verifier_.SetUpCommandLine(command_line);
+  }
+
+  void SetUpInProcessBrowserTestFixture() override {
+    ContentBrowserTest::SetUpInProcessBrowserTestFixture();
+    cert_verifier_.SetUpInProcessBrowserTestFixture();
+  }
+
+  void SetUpOnMainThread() override {
+    ContentBrowserTest::SetUpOnMainThread();
+
+    // TODO(https://crbug.com/1011765): Navigation fails on Android Kit Kat.
+    if (!ShouldRunTest())
+      return;
+
+    original_client_ = SetBrowserClientForTesting(&test_browser_client_);
+
+    host_resolver()->AddRule("*", "127.0.0.1");
+    cert_verifier_.mock_cert_verifier()->set_default_result(net::OK);
+    server_.ServeFilesFromSourceDirectory(GetTestDataFilePath());
+    ASSERT_TRUE(server_.Start());
+
+    ASSERT_TRUE(NavigateToURL(shell(), GetLocksURL("a.com")));
+  }
+
+  void TearDownInProcessBrowserTestFixture() override {
+    ContentBrowserTest::TearDownInProcessBrowserTestFixture();
+    cert_verifier_.TearDownInProcessBrowserTestFixture();
+  }
+
+  void TearDownOnMainThread() override {
+    ContentBrowserTest::TearDownOnMainThread();
+    if (original_client_)
+      SetBrowserClientForTesting(original_client_);
+  }
+
+  bool ShouldRunTest() const {
+#if defined(OS_ANDROID)
+    // Don't run the test if we couldn't override BrowserClient. It happens only
+    // on Android Kitkat or older systems.
+    if (!original_client_)
+      return false;
+
+    // TODO(https://crbug.com/1011765): Navigation fails on Android Kit Kat.
+    if (base::android::BuildInfo::GetInstance()->sdk_int() <=
+        base::android::SDK_VERSION_KITKAT) {
+      return false;
+    }
+#endif
+    return true;
+  }
+
+  GURL GetLocksURL(const std::string& hostname) const {
+    return server_.GetURL(hostname, "/locks/locks.html");
+  }
+
+  testing::StrictMock<MockObserver> mock_observer_;
+
+ private:
+  ContentMockCertVerifier cert_verifier_;
+  net::EmbeddedTestServer server_{net::EmbeddedTestServer::TYPE_HTTPS};
+  ContentBrowserClient* original_client_ = nullptr;
+  TestBrowserClient test_browser_client_{&mock_observer_};
+
+  LockManagerBrowserTest(const LockManagerBrowserTest&) = delete;
+  LockManagerBrowserTest& operator=(const LockManagerBrowserTest&) = delete;
+};
+
+// Verify that content::LockObserver is notified when a frame acquires a single
+// locks.
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverSingleLock) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Acquire a lock. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "AcquireLock('lock_a');"));
+    // Quit when OnFrameStartsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+
+  {
+    // Release a lock. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "ReleaseLock('lock_a');"));
+    // Quit when OnFrameStopsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is notified when a frame acquires multiple
+// locks (notifications only when the number of held locks switches between zero
+// and non-zero).
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverTwoLocks) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Acquire a lock. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "AcquireLock('lock_a');"));
+    // Quit when OnFrameStartsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+
+  // Acquire a second lock. Don't expect a notification.
+  EXPECT_TRUE(ExecJs(rfh, "AcquireLock('lock_b');"));
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+
+  // Release a lock. Don't expect a notification.
+  EXPECT_TRUE(ExecJs(rfh, "ReleaseLock('lock_a');"));
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+
+  {
+    // Release a lock. Expect observer notification, because number of held
+    // locks is now zero.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "ReleaseLock('lock_b');"));
+    // Quit when OnFrameStopsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is notified that a frame stopped holding
+// locks when it is navigated away.
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverNavigate) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Acquire a lock. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "AcquireLock('lock_a');"));
+    // Quit when OnFrameStartsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+  {
+    // Navigate away. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(NavigateToURL(shell(), GetLocksURL("b.com")));
+    // Quit when OnFrameStopsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is notified when a frame steals a lock from
+// another frame.
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverStealLock) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+  int frame_id = rfh->GetRoutingID();
+  int process_id = rfh->GetProcess()->GetID();
+
+  {
+    // Acquire a lock in first WebContents lock. Expect observer notification.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStartsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) { run_loop.Quit(); });
+    EXPECT_TRUE(ExecJs(rfh, "AcquireLock('lock_a');"));
+    // Quit when OnFrameStartsHoldingWebLocks(process_id, frame_id) is invoked.
+    run_loop.Run();
+  }
+
+  // Open another WebContents and navigate.
+  Shell* other_shell =
+      Shell::CreateNewWindow(shell()->web_contents()->GetBrowserContext(),
+                             GURL(), nullptr, gfx::Size());
+  EXPECT_TRUE(NavigateToURL(other_shell, GetLocksURL("a.com")));
+  RenderFrameHost* other_rfh = other_shell->web_contents()->GetMainFrame();
+  int other_frame_id = other_rfh->GetRoutingID();
+  int other_process_id = other_rfh->GetProcess()->GetID();
+
+  {
+    // Steal the lock from other WebContents. Expect observer notifications.
+    base::RunLoop run_loop;
+    EXPECT_CALL(mock_observer_,
+                OnFrameStopsHoldingWebLocks(process_id, frame_id))
+        .WillOnce([&](int, int) {
+          EXPECT_CALL(mock_observer_, OnFrameStartsHoldingWebLocks(
+                                          other_process_id, other_frame_id))
+              .WillOnce([&](int, int) { run_loop.Quit(); });
+        });
+    EXPECT_TRUE(ExecJs(other_rfh, "StealLock('lock_a');"));
+    // Quit when OnFrameStopsHoldingWebLocks(process_id, frame_id) and
+    // OnFrameStartsHoldingWebLocks(other_process_id, other_frame_id) are
+    // invoked.
+    run_loop.Run();
+  }
+}
+
+// Verify that content::LockObserver is *not* notified when a lock is acquired
+// by a dedicated worker.
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverDedicatedWorker) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+
+  // Use EvalJs() instead of ExecJs() to ensure that this doesn't return before
+  // the lock is acquired and released by the worker.
+  EXPECT_TRUE(EvalJs(rfh, R"(
+      (async () => {
+        await AcquireReleaseLockFromDedicatedWorker();
+        return true;
+      }) ();
+  )")
+                  .ExtractBool());
+
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+}
+
+// SharedWorkers are not enabled on Android. https://crbug.com/154571
+#if !defined(OS_ANDROID)
+// Verify that content::LockObserver is *not* notified when a lock is acquired
+// by a shared worker.
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverSharedWorker) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+
+  // Use EvalJs() instead of ExecJs() to ensure that this doesn't return before
+  // the lock is acquired and released by the worker.
+  EXPECT_TRUE(EvalJs(rfh, R"(
+      (async () => {
+        await AcquireReleaseLockFromSharedWorker();
+        return true;
+      }) ();
+  )")
+                  .ExtractBool());
+
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+}
+#endif  // !defined(OS_ANDROID)
+
+// Verify that content::LockObserver is *not* notified when a lock is acquired
+// by a service worker.
+IN_PROC_BROWSER_TEST_F(LockManagerBrowserTest, ObserverServiceWorker) {
+  if (!ShouldRunTest())
+    return;
+
+  RenderFrameHost* rfh = shell()->web_contents()->GetMainFrame();
+
+  // Use EvalJs() instead of ExecJs() to ensure that this doesn't return before
+  // the lock is acquired and released by the worker.
+  EXPECT_TRUE(EvalJs(rfh, R"(
+      (async () => {
+        await AcquireReleaseLockFromServiceWorker();
+        return true;
+      }) ();
+  )")
+                  .ExtractBool());
+
+  // Wait a short timeout to make sure that the observer is not notified.
+  RunLoopWithTimeout();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/manifest/manifest_browsertest.cc b/chromium/content/browser/manifest/manifest_browsertest.cc
index e8d62299f79..969930b6630 100644
--- a/chromium/content/browser/manifest/manifest_browsertest.cc
+++ b/chromium/content/browser/manifest/manifest_browsertest.cc
@@ -19,6 +19,7 @@
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/shell/browser/shell.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
@@ -98,13 +99,13 @@ class ManifestBrowserTest : public ContentBrowserTest,
     // The IPCs reporting console errors are not FIFO with the manifest IPCs.
     // Waiting for a round-trip channel-associated message will wait until any
     // already enqueued channel-associated IPCs arrive at the browser process.
-    blink::mojom::ManifestManagerAssociatedPtr ptr;
+    mojo::AssociatedRemote<blink::mojom::ManifestManager> remote;
     shell()
         ->web_contents()
         ->GetMainFrame()
         ->GetRemoteAssociatedInterfaces()
-        ->GetInterface(&ptr);
-    ptr.FlushForTesting();
+        ->GetInterface(&remote);
+    remote.FlushForTesting();
     return console_error_count_;
   }
 
@@ -576,7 +577,7 @@ IN_PROC_BROWSER_TEST_F(ManifestBrowserTest, UseCredentialsSendCookies) {
   std::unique_ptr<net::EmbeddedTestServer> custom_embedded_test_server(
       new net::EmbeddedTestServer());
   custom_embedded_test_server->RegisterRequestHandler(
-      base::Bind(&CustomHandleRequestForCookies));
+      base::BindRepeating(&CustomHandleRequestForCookies));
 
   ASSERT_TRUE(custom_embedded_test_server->Start());
 
@@ -636,7 +637,7 @@ IN_PROC_BROWSER_TEST_F(ManifestBrowserTest, NoUseCredentialsNoCookies) {
   std::unique_ptr<net::EmbeddedTestServer> custom_embedded_test_server(
       new net::EmbeddedTestServer());
   custom_embedded_test_server->RegisterRequestHandler(
-      base::Bind(&CustomHandleRequestForNoCookies));
+      base::BindRepeating(&CustomHandleRequestForNoCookies));
 
   ASSERT_TRUE(custom_embedded_test_server->Start());
 
diff --git a/chromium/content/browser/media/android/media_resource_getter_impl.cc b/chromium/content/browser/media/android/media_resource_getter_impl.cc
index 64f22554394..260638f7dbf 100644
--- a/chromium/content/browser/media/android/media_resource_getter_impl.cc
+++ b/chromium/content/browser/media/android/media_resource_getter_impl.cc
@@ -22,6 +22,7 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/auth.h"
 #include "net/http/http_auth.h"
+#include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/restricted_cookie_manager.mojom.h"
 #include "url/gurl.h"
 #include "url/origin.h"
@@ -36,6 +37,8 @@ namespace {
 mojo::PendingRemote<network::mojom::RestrictedCookieManager>
 GetRestrictedCookieManagerForContext(BrowserContext* browser_context,
                                      const GURL& url,
+                                     const GURL& site_for_cookies,
+                                     const url::Origin& top_frame_origin,
                                      int render_process_id,
                                      int render_frame_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -47,6 +50,7 @@ GetRestrictedCookieManagerForContext(BrowserContext* browser_context,
   mojo::PendingRemote<network::mojom::RestrictedCookieManager> pipe;
   storage_partition->CreateRestrictedCookieManager(
       network::mojom::RestrictedCookieManagerRole::NETWORK, origin,
+      site_for_cookies, top_frame_origin,
       /* is_service_worker = */ false, render_process_id, render_frame_id,
       pipe.InitWithNewPipeAndPassReceiver());
   return pipe;
@@ -144,7 +148,8 @@ void MediaResourceGetterImpl::GetCookies(const GURL& url,
 
   mojo::Remote<network::mojom::RestrictedCookieManager> cookie_manager(
       GetRestrictedCookieManagerForContext(
-          browser_context_, url, render_process_id_, render_frame_id_));
+          browser_context_, url, site_for_cookies, top_frame_origin,
+          render_process_id_, render_frame_id_));
   network::mojom::RestrictedCookieManager* cookie_manager_ptr =
       cookie_manager.get();
   cookie_manager_ptr->GetCookiesString(
diff --git a/chromium/content/browser/media/audio_input_stream_broker.cc b/chromium/content/browser/media/audio_input_stream_broker.cc
index 0189a686804..54124a1395b 100644
--- a/chromium/content/browser/media/audio_input_stream_broker.cc
+++ b/chromium/content/browser/media/audio_input_stream_broker.cc
@@ -23,7 +23,6 @@
 #include "media/audio/audio_logging.h"
 #include "media/base/media_switches.h"
 #include "media/base/user_input_monitor.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 
 #if defined(OS_CHROMEOS)
@@ -70,7 +69,8 @@ AudioInputStreamBroker::AudioInputStreamBroker(
     bool enable_agc,
     audio::mojom::AudioProcessingConfigPtr processing_config,
     AudioStreamBroker::DeleterCallback deleter,
-    mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client)
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        renderer_factory_client)
     : AudioStreamBroker(render_process_id, render_frame_id),
       device_id_(device_id),
       params_(params),
@@ -79,7 +79,7 @@ AudioInputStreamBroker::AudioInputStreamBroker(
       enable_agc_(enable_agc),
       deleter_(std::move(deleter)),
       processing_config_(std::move(processing_config)),
-      renderer_factory_client_(renderer_factory_client.PassInterface()) {
+      renderer_factory_client_(std::move(renderer_factory_client)) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(renderer_factory_client_);
   DCHECK(deleter_);
diff --git a/chromium/content/browser/media/audio_input_stream_broker.h b/chromium/content/browser/media/audio_input_stream_broker.h
index 7ff1631d205..7cdfb9a59e5 100644
--- a/chromium/content/browser/media/audio_input_stream_broker.h
+++ b/chromium/content/browser/media/audio_input_stream_broker.h
@@ -16,6 +16,7 @@
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
@@ -43,7 +44,8 @@ class CONTENT_EXPORT AudioInputStreamBroker final
       bool enable_agc,
       audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client);
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          renderer_factory_client);
 
   ~AudioInputStreamBroker() final;
 
diff --git a/chromium/content/browser/media/audio_input_stream_broker_unittest.cc b/chromium/content/browser/media/audio_input_stream_broker_unittest.cc
index b77cc0641c4..b85bb27e7aa 100644
--- a/chromium/content/browser/media/audio_input_stream_broker_unittest.cc
+++ b/chromium/content/browser/media/audio_input_stream_broker_unittest.cc
@@ -11,7 +11,8 @@
 #include "base/test/mock_callback.h"
 #include "content/public/test/browser_task_environment.h"
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "services/audio/public/cpp/fake_stream_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -46,10 +47,9 @@ class MockRendererAudioInputStreamFactoryClient
   MockRendererAudioInputStreamFactoryClient() = default;
   ~MockRendererAudioInputStreamFactoryClient() override = default;
 
-  mojom::RendererAudioInputStreamFactoryClientPtr MakePtr() {
-    mojom::RendererAudioInputStreamFactoryClientPtr ret;
-    binding_.Bind(mojo::MakeRequest(&ret));
-    return ret;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+  MakeRemote() {
+    return receiver_.BindNewPipeAndPassRemote();
   }
 
   MOCK_METHOD0(OnStreamCreated, void());
@@ -66,10 +66,10 @@ class MockRendererAudioInputStreamFactoryClient
     OnStreamCreated();
   }
 
-  void CloseBinding() { binding_.Close(); }
+  void CloseReceiver() { receiver_.reset(); }
 
  private:
-  mojo::Binding<mojom::RendererAudioInputStreamFactoryClient> binding_{this};
+  mojo::Receiver<mojom::RendererAudioInputStreamFactoryClient> receiver_{this};
   media::mojom::AudioInputStreamPtr input_stream_;
   media::mojom::AudioInputStreamClientRequest client_request_;
   DISALLOW_COPY_AND_ASSIGN(MockRendererAudioInputStreamFactoryClient);
@@ -150,7 +150,7 @@ struct TestEnvironment {
             kEnableAgc,
             nullptr,
             deleter.Get(),
-            renderer_factory_client.MakePtr())) {}
+            renderer_factory_client.MakeRemote())) {}
 
   void RunUntilIdle() { task_environment.RunUntilIdle(); }
 
@@ -159,7 +159,8 @@ struct TestEnvironment {
   StrictMock<MockRendererAudioInputStreamFactoryClient> renderer_factory_client;
   std::unique_ptr<AudioInputStreamBroker> broker;
   MockStreamFactory stream_factory;
-  audio::mojom::StreamFactoryPtr factory_ptr{stream_factory.MakeRemote()};
+  mojo::Remote<audio::mojom::StreamFactory> factory_ptr{
+      stream_factory.MakeRemote()};
 };
 
 }  // namespace
@@ -172,7 +173,7 @@ TEST(AudioInputStreamBrokerTest, StoresProcessAndFrameId) {
   AudioInputStreamBroker broker(
       kRenderProcessId, kRenderFrameId, kDeviceId, TestParams(), kShMemCount,
       nullptr /*user_input_monitor*/, kEnableAgc, nullptr, deleter.Get(),
-      renderer_factory_client.MakePtr());
+      renderer_factory_client.MakeRemote());
 
   EXPECT_EQ(kRenderProcessId, broker.render_process_id());
   EXPECT_EQ(kRenderFrameId, broker.render_frame_id());
@@ -240,7 +241,7 @@ TEST(AudioInputStreamBrokerTest, RendererFactoryClientDisconnect_CallsDeleter) {
 
   EXPECT_CALL(env.deleter, Run(env.broker.release()))
       .WillOnce(testing::DeleteArg<0>());
-  env.renderer_factory_client.CloseBinding();
+  env.renderer_factory_client.CloseReceiver();
   env.RunUntilIdle();
   Mock::VerifyAndClear(&env.deleter);
 
diff --git a/chromium/content/browser/media/audio_loopback_stream_broker.cc b/chromium/content/browser/media/audio_loopback_stream_broker.cc
index fe5816912f9..72a08384f60 100644
--- a/chromium/content/browser/media/audio_loopback_stream_broker.cc
+++ b/chromium/content/browser/media/audio_loopback_stream_broker.cc
@@ -25,7 +25,8 @@ AudioLoopbackStreamBroker::AudioLoopbackStreamBroker(
     uint32_t shared_memory_count,
     bool mute_source,
     AudioStreamBroker::DeleterCallback deleter,
-    mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client)
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        renderer_factory_client)
     : AudioStreamBroker(render_process_id, render_frame_id),
       source_(source),
       params_(params),
@@ -43,7 +44,7 @@ AudioLoopbackStreamBroker::AudioLoopbackStreamBroker(
   }
 
   // Unretained is safe because |this| owns |renderer_factory_client_|.
-  renderer_factory_client_.set_connection_error_handler(base::BindOnce(
+  renderer_factory_client_.set_disconnect_handler(base::BindOnce(
       &AudioLoopbackStreamBroker::Cleanup, base::Unretained(this)));
 
   // Notify the source that we are capturing from it.
diff --git a/chromium/content/browser/media/audio_loopback_stream_broker.h b/chromium/content/browser/media/audio_loopback_stream_broker.h
index 88b888553e6..e6da91661af 100644
--- a/chromium/content/browser/media/audio_loopback_stream_broker.h
+++ b/chromium/content/browser/media/audio_loopback_stream_broker.h
@@ -18,6 +18,8 @@
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace audio {
 namespace mojom {
@@ -42,7 +44,8 @@ class CONTENT_EXPORT AudioLoopbackStreamBroker final
       uint32_t shared_memory_count,
       bool mute_source,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client);
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          renderer_factory_client);
 
   ~AudioLoopbackStreamBroker() final;
 
@@ -72,7 +75,8 @@ class CONTENT_EXPORT AudioLoopbackStreamBroker final
   // loopback stream is running.
   base::Optional<AudioMutingSession> muter_;
 
-  mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client_;
+  mojo::Remote<mojom::RendererAudioInputStreamFactoryClient>
+      renderer_factory_client_;
   mojo::Binding<AudioInputStreamObserver> observer_binding_;
   media::mojom::AudioInputStreamClientRequest client_request_;
 
diff --git a/chromium/content/browser/media/audio_loopback_stream_broker_unittest.cc b/chromium/content/browser/media/audio_loopback_stream_broker_unittest.cc
index 608ea361268..05fe53d3b5d 100644
--- a/chromium/content/browser/media/audio_loopback_stream_broker_unittest.cc
+++ b/chromium/content/browser/media/audio_loopback_stream_broker_unittest.cc
@@ -11,6 +11,9 @@
 #include "base/test/mock_callback.h"
 #include "content/public/test/browser_task_environment.h"
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "services/audio/public/cpp/fake_stream_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -56,13 +59,12 @@ using MockDeleterCallback = StrictMock<
 class MockRendererAudioInputStreamFactoryClient
     : public mojom::RendererAudioInputStreamFactoryClient {
  public:
-  MockRendererAudioInputStreamFactoryClient() : binding_(this) {}
+  MockRendererAudioInputStreamFactoryClient() = default;
   ~MockRendererAudioInputStreamFactoryClient() override {}
 
-  mojom::RendererAudioInputStreamFactoryClientPtr MakePtr() {
-    mojom::RendererAudioInputStreamFactoryClientPtr ret;
-    binding_.Bind(mojo::MakeRequest(&ret));
-    return ret;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+  MakeRemote() {
+    return receiver_.BindNewPipeAndPassRemote();
   }
 
   MOCK_METHOD0(OnStreamCreated, void());
@@ -80,10 +82,10 @@ class MockRendererAudioInputStreamFactoryClient
     OnStreamCreated();
   }
 
-  void CloseBinding() { binding_.Close(); }
+  void CloseReceiver() { receiver_.reset(); }
 
  private:
-  mojo::Binding<mojom::RendererAudioInputStreamFactoryClient> binding_;
+  mojo::Receiver<mojom::RendererAudioInputStreamFactoryClient> receiver_{this};
   media::mojom::AudioInputStreamPtr input_stream_;
   media::mojom::AudioInputStreamClientRequest client_request_;
 };
@@ -110,7 +112,7 @@ class MockStreamFactory : public audio::FakeStreamFactory {
     base::UnguessableToken group_id;
     mojo::ScopedSharedBufferHandle key_press_count_buffer;
     CreateLoopbackStreamCallback created_callback;
-    audio::mojom::LocalMuterAssociatedRequest muter_request;
+    mojo::PendingAssociatedReceiver<audio::mojom::LocalMuter> muter_receiver;
   };
 
   void ExpectStreamCreation(StreamRequestData* ex) {
@@ -143,7 +145,7 @@ class MockStreamFactory : public audio::FakeStreamFactory {
   void BindMuter(
       mojo::PendingAssociatedReceiver<audio::mojom::LocalMuter> receiver,
       const base::UnguessableToken& group_id) final {
-    stream_request_data_->muter_request = std::move(receiver);
+    stream_request_data_->muter_receiver = std::move(receiver);
     IsMuting(group_id);
   }
 
@@ -161,7 +163,7 @@ struct TestEnvironment {
     EXPECT_CALL(source, AddLoopbackSink(_));
     broker = std::make_unique<AudioLoopbackStreamBroker>(
         kRenderProcessId, kRenderFrameId, &source, TestParams(), kShMemCount,
-        mute_source, deleter.Get(), renderer_factory_client.MakePtr());
+        mute_source, deleter.Get(), renderer_factory_client.MakeRemote());
   }
 
   void RunUntilIdle() { task_environment.RunUntilIdle(); }
@@ -172,7 +174,8 @@ struct TestEnvironment {
   StrictMock<MockRendererAudioInputStreamFactoryClient> renderer_factory_client;
   std::unique_ptr<AudioLoopbackStreamBroker> broker;
   MockStreamFactory stream_factory;
-  audio::mojom::StreamFactoryPtr factory_ptr{stream_factory.MakeRemote()};
+  mojo::Remote<audio::mojom::StreamFactory> factory_ptr{
+      stream_factory.MakeRemote()};
 };
 
 }  // namespace
@@ -188,7 +191,7 @@ TEST(AudioLoopbackStreamBrokerTest, StoresProcessAndFrameId) {
 
   AudioLoopbackStreamBroker broker(
       kRenderProcessId, kRenderFrameId, &source, TestParams(), kShMemCount,
-      !kMuteSource, deleter.Get(), renderer_factory_client.MakePtr());
+      !kMuteSource, deleter.Get(), renderer_factory_client.MakeRemote());
 
   EXPECT_EQ(kRenderProcessId, broker.render_process_id());
   EXPECT_EQ(kRenderFrameId, broker.render_frame_id());
@@ -329,7 +332,7 @@ TEST(AudioLoopbackStreamBrokerTest,
 
   EXPECT_CALL(env.deleter, Run(env.broker.release()))
       .WillOnce(testing::DeleteArg<0>());
-  env.renderer_factory_client.CloseBinding();
+  env.renderer_factory_client.CloseReceiver();
   env.RunUntilIdle();
   Mock::VerifyAndClear(&env.deleter);
 
diff --git a/chromium/content/browser/media/audio_output_stream_broker.cc b/chromium/content/browser/media/audio_output_stream_broker.cc
index 434b363ffa6..22d3bd1ecf1 100644
--- a/chromium/content/browser/media/audio_output_stream_broker.cc
+++ b/chromium/content/browser/media/audio_output_stream_broker.cc
@@ -69,7 +69,7 @@ AudioOutputStreamBroker::AudioOutputStreamBroker(
     const base::UnguessableToken& group_id,
     const base::Optional<base::UnguessableToken>& processing_id,
     DeleterCallback deleter,
-    media::mojom::AudioOutputStreamProviderClientPtr client)
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client)
     : AudioStreamBroker(render_process_id, render_frame_id),
       output_device_id_(output_device_id),
       params_(params),
@@ -92,7 +92,7 @@ AudioOutputStreamBroker::AudioOutputStreamBroker(
     media_observer->OnCreatingAudioStream(render_process_id, render_frame_id);
 
   // Unretained is safe because |this| owns |client_|
-  client_.set_connection_error_handler(
+  client_.set_disconnect_handler(
       base::BindOnce(&AudioOutputStreamBroker::Cleanup, base::Unretained(this),
                      DisconnectReason::kTerminatedByClient));
 }
@@ -175,8 +175,7 @@ void AudioOutputStreamBroker::StreamCreated(
     return;
   }
 
-  client_->Created(media::mojom::AudioOutputStreamPtr(std::move(stream)),
-                   std::move(data_pipe));
+  client_->Created(std::move(stream), std::move(data_pipe));
 }
 
 void AudioOutputStreamBroker::ObserverBindingLost(
diff --git a/chromium/content/browser/media/audio_output_stream_broker.h b/chromium/content/browser/media/audio_output_stream_broker.h
index e4c963375d2..d209cb22d7b 100644
--- a/chromium/content/browser/media/audio_output_stream_broker.h
+++ b/chromium/content/browser/media/audio_output_stream_broker.h
@@ -19,6 +19,7 @@
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
 
 namespace content {
@@ -37,7 +38,8 @@ class CONTENT_EXPORT AudioOutputStreamBroker final : public AudioStreamBroker {
       const base::UnguessableToken& group_id,
       const base::Optional<base::UnguessableToken>& processing_id,
       DeleterCallback deleter,
-      media::mojom::AudioOutputStreamProviderClientPtr client);
+      mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+          client);
 
   ~AudioOutputStreamBroker() final;
 
@@ -67,7 +69,7 @@ class CONTENT_EXPORT AudioOutputStreamBroker final : public AudioStreamBroker {
 
   DeleterCallback deleter_;
 
-  media::mojom::AudioOutputStreamProviderClientPtr client_;
+  mojo::Remote<media::mojom::AudioOutputStreamProviderClient> client_;
 
   AudioOutputStreamObserverImpl observer_;
   mojo::AssociatedReceiver<media::mojom::AudioOutputStreamObserver>
diff --git a/chromium/content/browser/media/audio_output_stream_broker_unittest.cc b/chromium/content/browser/media/audio_output_stream_broker_unittest.cc
index c4b9717cbf4..124acf473eb 100644
--- a/chromium/content/browser/media/audio_output_stream_broker_unittest.cc
+++ b/chromium/content/browser/media/audio_output_stream_broker_unittest.cc
@@ -17,8 +17,10 @@
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/buffer.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "services/audio/public/cpp/fake_stream_factory.h"
@@ -50,10 +52,10 @@ using MockDeleterCallback = StrictMock<
 class MockAudioOutputStreamProviderClient
     : public media::mojom::AudioOutputStreamProviderClient {
  public:
-  MockAudioOutputStreamProviderClient() : binding_(this) {}
+  MockAudioOutputStreamProviderClient() = default;
   ~MockAudioOutputStreamProviderClient() override {}
 
-  void Created(media::mojom::AudioOutputStreamPtr,
+  void Created(mojo::PendingRemote<media::mojom::AudioOutputStream>,
                media::mojom::ReadWriteAudioDataPipePtr) override {
     OnCreated();
   }
@@ -62,19 +64,21 @@ class MockAudioOutputStreamProviderClient
 
   MOCK_METHOD2(ConnectionError, void(uint32_t, const std::string&));
 
-  media::mojom::AudioOutputStreamProviderClientPtr MakePtr() {
-    media::mojom::AudioOutputStreamProviderClientPtr ptr;
-    binding_.Bind(mojo::MakeRequest(&ptr));
-    binding_.set_connection_error_with_reason_handler(
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+  MakePendingRemote() {
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+        pending_remote;
+    receiver_.Bind(pending_remote.InitWithNewPipeAndPassReceiver());
+    receiver_.set_disconnect_with_reason_handler(
         base::BindOnce(&MockAudioOutputStreamProviderClient::ConnectionError,
                        base::Unretained(this)));
-    return ptr;
+    return pending_remote;
   }
 
-  void CloseBinding() { binding_.Close(); }
+  void CloseReceiver() { receiver_.reset(); }
 
  private:
-  mojo::Binding<media::mojom::AudioOutputStreamProviderClient> binding_;
+  mojo::Receiver<media::mojom::AudioOutputStreamProviderClient> receiver_{this};
   DISALLOW_COPY_AND_ASSIGN(MockAudioOutputStreamProviderClient);
 };
 
@@ -95,7 +99,7 @@ class MockStreamFactory : public audio::FakeStreamFactory {
           group_id(group_id) {}
 
     bool requested = false;
-    media::mojom::AudioOutputStreamRequest stream_request;
+    mojo::PendingReceiver<media::mojom::AudioOutputStream> stream_receiver;
     media::mojom::AudioOutputStreamObserverAssociatedPtrInfo observer_info;
     media::mojom::AudioLogPtr log;
     const std::string output_device_id;
@@ -125,7 +129,7 @@ class MockStreamFactory : public audio::FakeStreamFactory {
     EXPECT_TRUE(stream_request_data_->params.Equals(params));
     EXPECT_EQ(stream_request_data_->group_id, group_id);
     stream_request_data_->requested = true;
-    stream_request_data_->stream_request = std::move(stream_receiver);
+    stream_request_data_->stream_receiver = std::move(stream_receiver);
     stream_request_data_->observer_info = std::move(observer);
     stream_request_data_->log.Bind(std ::move(log));
     stream_request_data_->created_callback = std::move(created_callback);
@@ -148,7 +152,7 @@ struct TestEnvironment {
             group,
             base::nullopt,
             deleter.Get(),
-            provider_client.MakePtr())) {}
+            provider_client.MakePendingRemote())) {}
 
   void RunUntilIdle() { env.RunUntilIdle(); }
 
@@ -158,7 +162,8 @@ struct TestEnvironment {
   StrictMock<MockAudioOutputStreamProviderClient> provider_client;
   std::unique_ptr<AudioOutputStreamBroker> broker;
   MockStreamFactory stream_factory;
-  audio::mojom::StreamFactoryPtr factory_ptr{stream_factory.MakeRemote()};
+  mojo::Remote<audio::mojom::StreamFactory> factory_ptr{
+      stream_factory.MakeRemote()};
 };
 
 }  // namespace
@@ -171,7 +176,7 @@ TEST(AudioOutputStreamBrokerTest, StoresProcessAndFrameId) {
   AudioOutputStreamBroker broker(
       kRenderProcessId, kRenderFrameId, kStreamId, kDeviceId, TestParams(),
       base::UnguessableToken::Create(), base::nullopt, deleter.Get(),
-      provider_client.MakePtr());
+      provider_client.MakePendingRemote());
 
   EXPECT_EQ(kRenderProcessId, broker.render_process_id());
   EXPECT_EQ(kRenderFrameId, broker.render_frame_id());
@@ -182,7 +187,7 @@ TEST(AudioOutputStreamBrokerTest, ClientDisconnect_CallsDeleter) {
 
   EXPECT_CALL(env.deleter, Run(env.broker.release()))
       .WillOnce(testing::DeleteArg<0>());
-  env.provider_client.CloseBinding();
+  env.provider_client.CloseReceiver();
   env.RunUntilIdle();
 }
 
diff --git a/chromium/content/browser/media/audio_stream_broker.cc b/chromium/content/browser/media/audio_stream_broker.cc
index ed153e4af25..184f4088c0c 100644
--- a/chromium/content/browser/media/audio_stream_broker.cc
+++ b/chromium/content/browser/media/audio_stream_broker.cc
@@ -35,8 +35,8 @@ class AudioStreamBrokerFactoryImpl final : public AudioStreamBrokerFactory {
       bool enable_agc,
       audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client)
-      final {
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          renderer_factory_client) final {
     return std::make_unique<AudioInputStreamBroker>(
         render_process_id, render_frame_id, device_id, params,
         shared_memory_count, user_input_monitor, enable_agc,
@@ -52,8 +52,8 @@ class AudioStreamBrokerFactoryImpl final : public AudioStreamBrokerFactory {
       uint32_t shared_memory_count,
       bool mute_source,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client)
-      final {
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          renderer_factory_client) final {
     return std::make_unique<AudioLoopbackStreamBroker>(
         render_process_id, render_frame_id, source, params, shared_memory_count,
         mute_source, std::move(deleter), std::move(renderer_factory_client));
@@ -68,7 +68,8 @@ class AudioStreamBrokerFactoryImpl final : public AudioStreamBrokerFactory {
       const base::UnguessableToken& group_id,
       const base::Optional<base::UnguessableToken>& processing_id,
       AudioStreamBroker::DeleterCallback deleter,
-      media::mojom::AudioOutputStreamProviderClientPtr client) final {
+      mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client)
+      final {
     return std::make_unique<AudioOutputStreamBroker>(
         render_process_id, render_frame_id, stream_id, output_device_id, params,
         group_id, processing_id, std::move(deleter), std::move(client));
diff --git a/chromium/content/browser/media/audio_stream_broker.h b/chromium/content/browser/media/audio_stream_broker.h
index 90fdfdc28d4..65b69641882 100644
--- a/chromium/content/browser/media/audio_stream_broker.h
+++ b/chromium/content/browser/media/audio_stream_broker.h
@@ -16,6 +16,7 @@
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 
 namespace audio {
@@ -107,7 +108,7 @@ class CONTENT_EXPORT AudioStreamBrokerFactory {
       bool enable_agc,
       audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
           renderer_factory_client) = 0;
 
   virtual std::unique_ptr<AudioStreamBroker> CreateAudioLoopbackStreamBroker(
@@ -118,7 +119,7 @@ class CONTENT_EXPORT AudioStreamBrokerFactory {
       uint32_t shared_memory_count,
       bool mute_source,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
           renderer_factory_client) = 0;
 
   virtual std::unique_ptr<AudioStreamBroker> CreateAudioOutputStreamBroker(
@@ -130,7 +131,8 @@ class CONTENT_EXPORT AudioStreamBrokerFactory {
       const base::UnguessableToken& group_id,
       const base::Optional<base::UnguessableToken>& processing_id,
       AudioStreamBroker::DeleterCallback deleter,
-      media::mojom::AudioOutputStreamProviderClientPtr client) = 0;
+      mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+          client) = 0;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(AudioStreamBrokerFactory);
diff --git a/chromium/content/browser/media/audio_stream_monitor.cc b/chromium/content/browser/media/audio_stream_monitor.cc
index 17125d9e5de..7d9a14019e6 100644
--- a/chromium/content/browser/media/audio_stream_monitor.cc
+++ b/chromium/content/browser/media/audio_stream_monitor.cc
@@ -208,7 +208,7 @@ void AudioStreamMonitor::MaybeToggle() {
 
   if (should_indicator_be_on != indicator_is_on_) {
     indicator_is_on_ = should_indicator_be_on;
-    web_contents_->NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+    web_contents_->NotifyNavigationStateChanged(INVALIDATE_TYPE_AUDIO);
   }
 
   if (should_stop_timer) {
diff --git a/chromium/content/browser/media/audio_stream_monitor_unittest.cc b/chromium/content/browser/media/audio_stream_monitor_unittest.cc
index ed9ac835bbf..d6d1c8b7044 100644
--- a/chromium/content/browser/media/audio_stream_monitor_unittest.cc
+++ b/chromium/content/browser/media/audio_stream_monitor_unittest.cc
@@ -99,12 +99,11 @@ class AudioStreamMonitorTest : public RenderViewHostTestHarness {
     EXPECT_CALL(
         mock_web_contents_delegate_,
         NavigationStateChanged(RenderViewHostTestHarness::web_contents(),
-                               INVALIDATE_TYPE_TAB))
+                               INVALIDATE_TYPE_AUDIO))
         .WillOnce(InvokeWithoutArgs(
-            this,
-            new_recently_audible
-                ? &AudioStreamMonitorTest::ExpectWasRecentlyAudible
-                : &AudioStreamMonitorTest::ExpectNotRecentlyAudible))
+            this, new_recently_audible
+                      ? &AudioStreamMonitorTest::ExpectWasRecentlyAudible
+                      : &AudioStreamMonitorTest::ExpectNotRecentlyAudible))
         .RetiresOnSaturation();
   }
 
@@ -112,12 +111,11 @@ class AudioStreamMonitorTest : public RenderViewHostTestHarness {
     EXPECT_CALL(
         mock_web_contents_delegate_,
         NavigationStateChanged(RenderViewHostTestHarness::web_contents(),
-                               INVALIDATE_TYPE_TAB))
+                               INVALIDATE_TYPE_AUDIO))
         .WillOnce(InvokeWithoutArgs(
-            this,
-            new_audible
-                ? &AudioStreamMonitorTest::ExpectIsCurrentlyAudible
-                : &AudioStreamMonitorTest::ExpectNotCurrentlyAudible))
+            this, new_audible
+                      ? &AudioStreamMonitorTest::ExpectIsCurrentlyAudible
+                      : &AudioStreamMonitorTest::ExpectNotCurrentlyAudible))
         .RetiresOnSaturation();
   }
 
diff --git a/chromium/content/browser/media/capture/desktop_streams_registry_impl.cc b/chromium/content/browser/media/capture/desktop_streams_registry_impl.cc
index 88ba5d4b869..b8ce040a132 100644
--- a/chromium/content/browser/media/capture/desktop_streams_registry_impl.cc
+++ b/chromium/content/browser/media/capture/desktop_streams_registry_impl.cc
@@ -51,7 +51,7 @@ DesktopStreamsRegistryImpl::~DesktopStreamsRegistryImpl() {}
 std::string DesktopStreamsRegistryImpl::RegisterStream(
     int render_process_id,
     int render_frame_id,
-    const GURL& origin,
+    const url::Origin& origin,
     const DesktopMediaID& source,
     const std::string& extension_name,
     const DesktopStreamRegistryType type) {
@@ -80,7 +80,7 @@ DesktopMediaID DesktopStreamsRegistryImpl::RequestMediaForStreamId(
     const std::string& id,
     int render_process_id,
     int render_frame_id,
-    const GURL& origin,
+    const url::Origin& origin,
     std::string* extension_name,
     const DesktopStreamRegistryType type) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
diff --git a/chromium/content/browser/media/capture/desktop_streams_registry_impl.h b/chromium/content/browser/media/capture/desktop_streams_registry_impl.h
index baa45e15439..ef094ebd821 100644
--- a/chromium/content/browser/media/capture/desktop_streams_registry_impl.h
+++ b/chromium/content/browser/media/capture/desktop_streams_registry_impl.h
@@ -11,7 +11,7 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/desktop_media_id.h"
 #include "content/public/browser/desktop_streams_registry.h"
-#include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -26,7 +26,7 @@ class CONTENT_EXPORT DesktopStreamsRegistryImpl
 
   std::string RegisterStream(int render_process_id,
                              int render_frame_id,
-                             const GURL& origin,
+                             const url::Origin& origin,
                              const DesktopMediaID& source,
                              const std::string& extension_name,
                              const DesktopStreamRegistryType type) override;
@@ -35,7 +35,7 @@ class CONTENT_EXPORT DesktopStreamsRegistryImpl
       const std::string& id,
       int render_process_id,
       int render_frame_id,
-      const GURL& origin,
+      const url::Origin& origin,
       std::string* extension_name,
       const DesktopStreamRegistryType type) override;
 
@@ -46,7 +46,7 @@ class CONTENT_EXPORT DesktopStreamsRegistryImpl
 
     int render_process_id;
     int render_frame_id;
-    GURL origin;
+    url::Origin origin;
     DesktopMediaID source;
     std::string extension_name;
     DesktopStreamRegistryType type;
diff --git a/chromium/content/browser/media/capture/frame_sink_video_capture_device_unittest.cc b/chromium/content/browser/media/capture/frame_sink_video_capture_device_unittest.cc
index 00de06a5b84..92483a8ee10 100644
--- a/chromium/content/browser/media/capture/frame_sink_video_capture_device_unittest.cc
+++ b/chromium/content/browser/media/capture/frame_sink_video_capture_device_unittest.cc
@@ -20,6 +20,8 @@
 #include "media/capture/video_capture_types.h"
 #include "mojo/public/cpp/base/shared_memory_utils.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/viz/privileged/mojom/compositing/frame_sink_video_capture.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -104,9 +106,10 @@ class MockFrameSinkVideoCapturer : public viz::mojom::FrameSinkVideoCapturer {
     MockChangeTarget(frame_sink_id ? *frame_sink_id : viz::FrameSinkId());
   }
   MOCK_METHOD1(MockChangeTarget, void(const viz::FrameSinkId& frame_sink_id));
-  void Start(viz::mojom::FrameSinkVideoConsumerPtr consumer) final {
+  void Start(
+      mojo::PendingRemote<viz::mojom::FrameSinkVideoConsumer> consumer) final {
     DCHECK_NOT_ON_DEVICE_THREAD();
-    consumer_ = std::move(consumer);
+    consumer_.Bind(std::move(consumer));
     MockStart(consumer_.get());
   }
   MOCK_METHOD1(MockStart, void(viz::mojom::FrameSinkVideoConsumer* consumer));
@@ -117,13 +120,15 @@ class MockFrameSinkVideoCapturer : public viz::mojom::FrameSinkVideoCapturer {
   }
   MOCK_METHOD0(MockStop, void());
   MOCK_METHOD0(RequestRefreshFrame, void());
-  MOCK_METHOD2(CreateOverlay,
-               void(int32_t stacking_index,
-                    viz::mojom::FrameSinkVideoCaptureOverlayRequest request));
+  MOCK_METHOD2(
+      CreateOverlay,
+      void(int32_t stacking_index,
+           mojo::PendingReceiver<viz::mojom::FrameSinkVideoCaptureOverlay>
+               receiver));
 
  private:
   mojo::Binding<viz::mojom::FrameSinkVideoCapturer> binding_;
-  viz::mojom::FrameSinkVideoConsumerPtr consumer_;
+  mojo::Remote<viz::mojom::FrameSinkVideoConsumer> consumer_;
 };
 
 // Represents the FrameSinkVideoConsumerFrameCallbacks instance in the VIZ
diff --git a/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.cc b/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.cc
index d15ff3a651a..95497843db9 100644
--- a/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.cc
+++ b/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.cc
@@ -8,6 +8,7 @@
 #include <cmath>
 
 #include "base/bind.h"
+#include "base/numerics/ranges.h"
 #include "base/numerics/safe_conversions.h"
 #include "content/browser/media/capture/lame_window_capturer_chromeos.h"
 #include "media/base/video_frame.h"
@@ -22,10 +23,10 @@ LameCaptureOverlayChromeOS::Owner::~Owner() = default;
 
 LameCaptureOverlayChromeOS::LameCaptureOverlayChromeOS(
     Owner* owner,
-    viz::mojom::FrameSinkVideoCaptureOverlayRequest request)
-    : binding_(this, std::move(request)) {
+    mojo::PendingReceiver<viz::mojom::FrameSinkVideoCaptureOverlay> receiver)
+    : receiver_(this, std::move(receiver)) {
   if (owner) {
-    binding_.set_connection_error_handler(base::BindOnce(
+    receiver_.set_disconnect_handler(base::BindOnce(
         &Owner::OnOverlayConnectionLost, base::Unretained(owner), this));
   }
 }
@@ -81,12 +82,9 @@ gfx::Rect ToAbsoluteBoundsForI420(const gfx::RectF& relative,
                    std::max(0, snapped_bottom - snapped_top));
 }
 
-inline int clip_byte(int x) {
-  return std::max(0, std::min(x, 255));
-}
-
 inline int alpha_blend(int alpha, int src, int dst) {
-  return (src * alpha + dst * (255 - alpha)) / 255;
+  alpha = (src * alpha + dst * (255 - alpha)) / 255;
+  return base::ClampToRange(alpha, 0, 255);
 }
 
 }  // namespace
@@ -155,7 +153,7 @@ LameCaptureOverlayChromeOS::MakeRenderer(const gfx::Rect& region_in_frame) {
             const int color_b = SkColorGetB(color);
             const int color_y =
                 ((color_r * 66 + color_g * 129 + color_b * 25 + 128) >> 8) + 16;
-            yplane[x] = clip_byte(alpha_blend(alpha, color_y, yplane[x]));
+            yplane[x] = alpha_blend(alpha, color_y, yplane[x]);
 
             // Only sample U and V at even coordinates.
             if ((x % 2 == 0) && (y % 2 == 0)) {
@@ -165,10 +163,8 @@ LameCaptureOverlayChromeOS::MakeRenderer(const gfx::Rect& region_in_frame) {
               const int color_v =
                   ((color_r * 112 + color_g * -94 + color_b * -18 + 128) >> 8) +
                   128;
-              uplane[x / 2] =
-                  clip_byte(alpha_blend(alpha, color_u, uplane[x / 2]));
-              vplane[x / 2] =
-                  clip_byte(alpha_blend(alpha, color_v, vplane[x / 2]));
+              uplane[x / 2] = alpha_blend(alpha, color_u, uplane[x / 2]);
+              vplane[x / 2] = alpha_blend(alpha, color_v, vplane[x / 2]);
             }
           }
         }
diff --git a/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.h b/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.h
index 9f8c5220167..fc912f0fd8a 100644
--- a/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.h
+++ b/chromium/content/browser/media/capture/lame_capture_overlay_chromeos.h
@@ -9,7 +9,8 @@
 #include "base/macros.h"
 #include "base/sequence_checker.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/viz/privileged/mojom/compositing/frame_sink_video_capture.mojom.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -54,7 +55,7 @@ class CONTENT_EXPORT LameCaptureOverlayChromeOS
 
   LameCaptureOverlayChromeOS(
       Owner* owner,
-      viz::mojom::FrameSinkVideoCaptureOverlayRequest request);
+      mojo::PendingReceiver<viz::mojom::FrameSinkVideoCaptureOverlay> receiver);
   ~LameCaptureOverlayChromeOS() final;
 
   // viz::mojom::FrameSinkVideoCaptureOverlay implementation.
@@ -70,7 +71,7 @@ class CONTENT_EXPORT LameCaptureOverlayChromeOS
  private:
   SEQUENCE_CHECKER(sequence_checker_);
 
-  mojo::Binding<viz::mojom::FrameSinkVideoCaptureOverlay> binding_;
+  mojo::Receiver<viz::mojom::FrameSinkVideoCaptureOverlay> receiver_;
 
   SkBitmap image_;
   gfx::RectF bounds_;
diff --git a/chromium/content/browser/media/capture/lame_capture_overlay_chromeos_unittest.cc b/chromium/content/browser/media/capture/lame_capture_overlay_chromeos_unittest.cc
index 879262929a2..6c29a34c3f4 100644
--- a/chromium/content/browser/media/capture/lame_capture_overlay_chromeos_unittest.cc
+++ b/chromium/content/browser/media/capture/lame_capture_overlay_chromeos_unittest.cc
@@ -12,6 +12,7 @@
 #include "base/test/task_environment.h"
 #include "base/time/time.h"
 #include "media/base/video_frame.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/gfx/geometry/rect.h"
@@ -68,8 +69,9 @@ class LameCaptureOverlayChromeOSTest : public testing::Test {
 };
 
 TEST_F(LameCaptureOverlayChromeOSTest, UnsetImageNotRenderedOnFrame) {
+  mojo::Remote<viz::mojom::FrameSinkVideoCaptureOverlay> overlay_remote;
   LameCaptureOverlayChromeOS overlay(
-      nullptr, viz::mojom::FrameSinkVideoCaptureOverlayRequest());
+      nullptr, overlay_remote.BindNewPipeAndPassReceiver());
 
   // Bounds set, but no image. → Should not render anything.
   overlay.SetBounds(kSpanOfEntireFrame);
@@ -81,8 +83,9 @@ TEST_F(LameCaptureOverlayChromeOSTest, UnsetImageNotRenderedOnFrame) {
 }
 
 TEST_F(LameCaptureOverlayChromeOSTest, HiddenImageNotRenderedOnFrame) {
+  mojo::Remote<viz::mojom::FrameSinkVideoCaptureOverlay> overlay_remote;
   LameCaptureOverlayChromeOS overlay(
-      nullptr, viz::mojom::FrameSinkVideoCaptureOverlayRequest());
+      nullptr, overlay_remote.BindNewPipeAndPassReceiver());
 
   // Both image and bounds set. → Should render something.
   overlay.SetImageAndBounds(CreateTestBitmap(), kSpanOfEntireFrame);
@@ -94,8 +97,9 @@ TEST_F(LameCaptureOverlayChromeOSTest, HiddenImageNotRenderedOnFrame) {
 }
 
 TEST_F(LameCaptureOverlayChromeOSTest, OutOfBoundsOverlayNotRenderedOnFrame) {
+  mojo::Remote<viz::mojom::FrameSinkVideoCaptureOverlay> overlay_remote;
   LameCaptureOverlayChromeOS overlay(
-      nullptr, viz::mojom::FrameSinkVideoCaptureOverlayRequest());
+      nullptr, overlay_remote.BindNewPipeAndPassReceiver());
 
   // Both image and bounds set. → Should render something.
   overlay.SetImageAndBounds(CreateTestBitmap(), kSpanOfEntireFrame);
@@ -107,8 +111,9 @@ TEST_F(LameCaptureOverlayChromeOSTest, OutOfBoundsOverlayNotRenderedOnFrame) {
 }
 
 TEST_F(LameCaptureOverlayChromeOSTest, ImageRenderedOnFrame) {
+  mojo::Remote<viz::mojom::FrameSinkVideoCaptureOverlay> overlay_remote;
   LameCaptureOverlayChromeOS overlay(
-      nullptr, viz::mojom::FrameSinkVideoCaptureOverlayRequest());
+      nullptr, overlay_remote.BindNewPipeAndPassReceiver());
 
   // Create blank black frame. No non-zero pixels should be present.
   const auto frame = media::VideoFrame::CreateZeroInitializedFrame(
@@ -159,14 +164,14 @@ TEST_F(LameCaptureOverlayChromeOSTest, ReportsLostMojoConnection) {
                  void(LameCaptureOverlayChromeOS* overlay));
   } mock_owner;
 
-  viz::mojom::FrameSinkVideoCaptureOverlayPtr overlay_ptr;
-  LameCaptureOverlayChromeOS overlay(&mock_owner,
-                                     mojo::MakeRequest(&overlay_ptr));
-  ASSERT_TRUE(overlay_ptr);
+  mojo::Remote<viz::mojom::FrameSinkVideoCaptureOverlay> overlay_remote;
+  LameCaptureOverlayChromeOS overlay(
+      &mock_owner, overlay_remote.BindNewPipeAndPassReceiver());
+  ASSERT_TRUE(overlay_remote);
   RunUntilIdle();  // Propagate mojo tasks.
 
   EXPECT_CALL(mock_owner, OnOverlayConnectionLost(&overlay));
-  overlay_ptr.reset();
+  overlay_remote.reset();
   RunUntilIdle();  // Propagate mojo tasks.
 }
 
diff --git a/chromium/content/browser/media/capture/lame_window_capturer_chromeos.cc b/chromium/content/browser/media/capture/lame_window_capturer_chromeos.cc
index 8258354f049..97bf732158e 100644
--- a/chromium/content/browser/media/capture/lame_window_capturer_chromeos.cc
+++ b/chromium/content/browser/media/capture/lame_window_capturer_chromeos.cc
@@ -106,15 +106,15 @@ void LameWindowCapturerChromeOS::ChangeTarget(
 }
 
 void LameWindowCapturerChromeOS::Start(
-    viz::mojom::FrameSinkVideoConsumerPtr consumer) {
+    mojo::PendingRemote<viz::mojom::FrameSinkVideoConsumer> consumer) {
   DCHECK(consumer);
 
   Stop();
 
-  consumer_ = std::move(consumer);
+  consumer_.Bind(std::move(consumer));
   // In the future, if the connection to the consumer is lost before a call to
   // Stop(), make that call on its behalf.
-  consumer_.set_connection_error_handler(base::BindOnce(
+  consumer_.set_disconnect_handler(base::BindOnce(
       &LameWindowCapturerChromeOS::Stop, base::Unretained(this)));
 
   timer_.Start(FROM_HERE, capture_period_, this,
@@ -141,11 +141,11 @@ void LameWindowCapturerChromeOS::RequestRefreshFrame() {
 
 void LameWindowCapturerChromeOS::CreateOverlay(
     int32_t stacking_index,
-    viz::mojom::FrameSinkVideoCaptureOverlayRequest request) {
+    mojo::PendingReceiver<viz::mojom::FrameSinkVideoCaptureOverlay> receiver) {
   // LameWindowCapturerChromeOS only supports one overlay at a time. If one
   // already exists, the following will cause it to be dropped.
   overlay_ =
-      std::make_unique<LameCaptureOverlayChromeOS>(this, std::move(request));
+      std::make_unique<LameCaptureOverlayChromeOS>(this, std::move(receiver));
 }
 
 class LameWindowCapturerChromeOS::InFlightFrame
diff --git a/chromium/content/browser/media/capture/lame_window_capturer_chromeos.h b/chromium/content/browser/media/capture/lame_window_capturer_chromeos.h
index 2ea025fa6a0..98b83068b47 100644
--- a/chromium/content/browser/media/capture/lame_window_capturer_chromeos.h
+++ b/chromium/content/browser/media/capture/lame_window_capturer_chromeos.h
@@ -17,6 +17,9 @@
 #include "base/unguessable_token.h"
 #include "content/browser/media/capture/lame_capture_overlay_chromeos.h"
 #include "media/base/video_frame.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/viz/privileged/mojom/compositing/frame_sink_video_capture.mojom.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_observer.h"
@@ -65,12 +68,14 @@ class LameWindowCapturerChromeOS : public viz::mojom::FrameSinkVideoCapturer,
   void SetAutoThrottlingEnabled(bool enabled) final;
   void ChangeTarget(
       const base::Optional<viz::FrameSinkId>& frame_sink_id) final;
-  void Start(viz::mojom::FrameSinkVideoConsumerPtr consumer) final;
+  void Start(
+      mojo::PendingRemote<viz::mojom::FrameSinkVideoConsumer> consumer) final;
   void Stop() final;
   void RequestRefreshFrame() final;
   void CreateOverlay(
       int32_t stacking_index,
-      viz::mojom::FrameSinkVideoCaptureOverlayRequest request) final;
+      mojo::PendingReceiver<viz::mojom::FrameSinkVideoCaptureOverlay> receiver)
+      final;
 
  private:
   // Represents an in-flight frame, being populated by this capturer and then
@@ -106,7 +111,7 @@ class LameWindowCapturerChromeOS : public viz::mojom::FrameSinkVideoCapturer,
   gfx::Size capture_size_ = gfx::Size(640, 360);
 
   // The current consumer. This is set by Start() and cleared by Stop().
-  viz::mojom::FrameSinkVideoConsumerPtr consumer_;
+  mojo::Remote<viz::mojom::FrameSinkVideoConsumer> consumer_;
 
   // A timer that calls CaptureNextFrame() periodically, according to the
   // currently-set |capture_period_|. This timer is only running while a
diff --git a/chromium/content/browser/media/capture/web_contents_audio_input_stream.cc b/chromium/content/browser/media/capture/web_contents_audio_input_stream.cc
index 9acca584b09..26b35f6817a 100644
--- a/chromium/content/browser/media/capture/web_contents_audio_input_stream.cc
+++ b/chromium/content/browser/media/capture/web_contents_audio_input_stream.cc
@@ -385,7 +385,7 @@ WebContentsAudioInputStream* WebContentsAudioInputStream::Create(
 
   return new WebContentsAudioInputStream(
       media_id.render_process_id, media_id.main_render_frame_id,
-      audio_mirroring_manager, new WebContentsTracker(false),
+      audio_mirroring_manager, new WebContentsTracker(),
       new media::VirtualAudioInputStream(
           params, worker_task_runner,
           media::VirtualAudioInputStream::AfterCloseCallback()),
diff --git a/chromium/content/browser/media/capture/web_contents_audio_input_stream_unittest.cc b/chromium/content/browser/media/capture/web_contents_audio_input_stream_unittest.cc
index 1dcf4f6f0a7..0469f64879d 100644
--- a/chromium/content/browser/media/capture/web_contents_audio_input_stream_unittest.cc
+++ b/chromium/content/browser/media/capture/web_contents_audio_input_stream_unittest.cc
@@ -77,8 +77,7 @@ class MockAudioMirroringManager : public AudioMirroringManager {
 
 class MockWebContentsTracker : public WebContentsTracker {
  public:
-  MockWebContentsTracker() : WebContentsTracker(false) {}
-
+  MockWebContentsTracker() = default;
   MOCK_METHOD3(Start,
                void(int render_process_id, int render_frame_id,
                     const ChangeCallback& callback));
diff --git a/chromium/content/browser/media/capture/web_contents_tracker.cc b/chromium/content/browser/media/capture/web_contents_tracker.cc
index 9a62779db7f..e88e0fcd0cb 100644
--- a/chromium/content/browser/media/capture/web_contents_tracker.cc
+++ b/chromium/content/browser/media/capture/web_contents_tracker.cc
@@ -15,9 +15,7 @@
 
 namespace content {
 
-WebContentsTracker::WebContentsTracker(bool track_fullscreen_rwhv)
-    : track_fullscreen_rwhv_(track_fullscreen_rwhv),
-      last_target_view_(nullptr) {}
+WebContentsTracker::WebContentsTracker() : last_target_view_(nullptr) {}
 
 WebContentsTracker::~WebContentsTracker() {
   // Likely unintentional BUG if Stop() was not called before this point.
@@ -64,11 +62,6 @@ RenderWidgetHostView* WebContentsTracker::GetTargetView() const {
   if (!wc)
     return nullptr;
 
-  if (track_fullscreen_rwhv_) {
-    if (auto* view = wc->GetFullscreenRenderWidgetHostView())
-      return view;
-  }
-
   if (auto* view = wc->GetRenderWidgetHostView()) {
     // Make sure the RWHV is still associated with a RWH before considering the
     // view "alive." This is because a null RWH indicates the RWHV has had its
diff --git a/chromium/content/browser/media/capture/web_contents_tracker.h b/chromium/content/browser/media/capture/web_contents_tracker.h
index 0805772a8f8..e306cb99af6 100644
--- a/chromium/content/browser/media/capture/web_contents_tracker.h
+++ b/chromium/content/browser/media/capture/web_contents_tracker.h
@@ -33,11 +33,7 @@ class CONTENT_EXPORT WebContentsTracker
     : public base::RefCountedThreadSafe<WebContentsTracker>,
       public WebContentsObserver {
  public:
-  // If |track_fullscreen_rwhv| is true, the ChangeCallback will be run when a
-  // WebContents shows/destroys a fullscreen RenderWidgetHostView. If false,
-  // fullscreen events are ignored. Normally, specify true for video capture and
-  // false for audio capture.
-  explicit WebContentsTracker(bool track_fullscreen_rwhv);
+  WebContentsTracker();
 
   // Callback to indicate a new RenderWidgetHostView should be targeted for
   // capture. This is also invoked with false to indicate tracking will not
@@ -116,10 +112,6 @@ class CONTENT_EXPORT WebContentsTracker
   void DidShowFullscreenWidget() final;
   void DidDestroyFullscreenWidget() final;
 
-  // If true, the client is interested in the showing/destruction of fullscreen
-  // RenderWidgetHostViews.
-  const bool track_fullscreen_rwhv_;
-
   // Pointer to the RenderWidgetHostView provided in the last run of
   // |callback_|. This is used to eliminate duplicate callback runs.
   RenderWidgetHostView* last_target_view_;
diff --git a/chromium/content/browser/media/cdm_file_impl.cc b/chromium/content/browser/media/cdm_file_impl.cc
index 9c3b5b87781..0e62e90d793 100644
--- a/chromium/content/browser/media/cdm_file_impl.cc
+++ b/chromium/content/browser/media/cdm_file_impl.cc
@@ -434,7 +434,6 @@ void CdmFileImpl::Read(ReadCallback callback) {
   DVLOG(3) << __func__ << " file: " << file_name_;
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK(file_locked_);
-  DCHECK(!file_reader_);
 
   // Only 1 Read() or Write() is allowed at any time.
   if (read_callback_ || write_callback_) {
@@ -488,7 +487,6 @@ void CdmFileImpl::Write(const std::vector<uint8_t>& data,
   DVLOG(3) << __func__ << " file: " << file_name_ << ", size: " << data.size();
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
   DCHECK(file_locked_);
-  DCHECK(!file_writer_);
 
   // Only 1 Read() or Write() is allowed at any time.
   if (read_callback_ || write_callback_) {
diff --git a/chromium/content/browser/media/cdm_storage_impl_unittest.cc b/chromium/content/browser/media/cdm_storage_impl_unittest.cc
index 4e3ba1fe453..29ac94a4d88 100644
--- a/chromium/content/browser/media/cdm_storage_impl_unittest.cc
+++ b/chromium/content/browser/media/cdm_storage_impl_unittest.cc
@@ -41,6 +41,34 @@ void SimulateNavigation(RenderFrameHost** rfh, const GURL& url) {
   *rfh = navigation_simulator->GetFinalRenderFrameHost();
 }
 
+// Helper that wraps a base::RunLoop and only quits the RunLoop
+// if the expected number of quit calls have happened.
+class RunLoopWithExpectedCount {
+ public:
+  RunLoopWithExpectedCount() = default;
+  ~RunLoopWithExpectedCount() { DCHECK_EQ(0, remaining_quit_calls_); }
+
+  void Run(int expected_quit_calls) {
+    DCHECK_GT(expected_quit_calls, 0);
+    DCHECK_EQ(remaining_quit_calls_, 0);
+    remaining_quit_calls_ = expected_quit_calls;
+    run_loop_.reset(new base::RunLoop());
+    run_loop_->Run();
+  }
+
+  void Quit() {
+    if (--remaining_quit_calls_ > 0)
+      return;
+    run_loop_->Quit();
+  }
+
+ private:
+  std::unique_ptr<base::RunLoop> run_loop_;
+  int remaining_quit_calls_ = 0;
+
+  DISALLOW_COPY_AND_ASSIGN(RunLoopWithExpectedCount);
+};
+
 }  // namespace
 
 class CdmStorageTest : public RenderViewHostTestHarness {
@@ -78,7 +106,7 @@ class CdmStorageTest : public RenderViewHostTestHarness {
     cdm_storage_->Open(
         name, base::BindOnce(&CdmStorageTest::OpenDone, base::Unretained(this),
                              &status, cdm_file));
-    RunAndWaitForResult();
+    RunAndWaitForResult(1);
     return status == CdmStorage::Status::kSuccess;
   }
 
@@ -91,10 +119,27 @@ class CdmStorageTest : public RenderViewHostTestHarness {
     CdmFile::Status status;
     cdm_file->Read(base::BindOnce(&CdmStorageTest::FileRead,
                                   base::Unretained(this), &status, data));
-    RunAndWaitForResult();
+    RunAndWaitForResult(1);
     return status == CdmFile::Status::kSuccess;
   }
 
+  // Attempts to reads the contents of the previously opened |cdm_file| twice.
+  // We don't really care about the data, just that 1 read succeeds and the
+  // other fails.
+  void ReadTwice(CdmFile* cdm_file,
+                 CdmFile::Status* status1,
+                 CdmFile::Status* status2) {
+    DVLOG(3) << __func__;
+    std::vector<uint8_t> data1;
+    std::vector<uint8_t> data2;
+
+    cdm_file->Read(base::BindOnce(&CdmStorageTest::FileRead,
+                                  base::Unretained(this), status1, &data1));
+    cdm_file->Read(base::BindOnce(&CdmStorageTest::FileRead,
+                                  base::Unretained(this), status2, &data2));
+    RunAndWaitForResult(2);
+  }
+
   // Writes |data| to the previously opened |cdm_file|, replacing the contents
   // of the file. Returns true if successful, false otherwise.
   bool Write(CdmFile* cdm_file, const std::vector<uint8_t>& data) {
@@ -103,10 +148,25 @@ class CdmStorageTest : public RenderViewHostTestHarness {
     CdmFile::Status status;
     cdm_file->Write(data, base::BindOnce(&CdmStorageTest::FileWritten,
                                          base::Unretained(this), &status));
-    RunAndWaitForResult();
+    RunAndWaitForResult(1);
     return status == CdmFile::Status::kSuccess;
   }
 
+  // Attempts to write the contents of the previously opened |cdm_file| twice.
+  // We don't really care about the data, just that 1 read succeeds and the
+  // other fails.
+  void WriteTwice(CdmFile* cdm_file,
+                  CdmFile::Status* status1,
+                  CdmFile::Status* status2) {
+    DVLOG(3) << __func__;
+
+    cdm_file->Write({1, 2, 3}, base::BindOnce(&CdmStorageTest::FileWritten,
+                                              base::Unretained(this), status1));
+    cdm_file->Write({4, 5, 6}, base::BindOnce(&CdmStorageTest::FileWritten,
+                                              base::Unretained(this), status2));
+    RunAndWaitForResult(2);
+  }
+
  private:
   void OpenDone(CdmStorage::Status* status,
                 CdmFileAssociatedPtr* cdm_file,
@@ -120,7 +180,7 @@ class CdmStorageTest : public RenderViewHostTestHarness {
     CdmFileAssociatedPtr cdm_file_ptr;
     cdm_file_ptr.Bind(std::move(actual_cdm_file));
     *cdm_file = std::move(cdm_file_ptr);
-    run_loop_->Quit();
+    run_loop_with_count_->Quit();
   }
 
   void FileRead(CdmFile::Status* status,
@@ -130,24 +190,24 @@ class CdmStorageTest : public RenderViewHostTestHarness {
     DVLOG(3) << __func__;
     *status = actual_status;
     *data = actual_data;
-    run_loop_->Quit();
+    run_loop_with_count_->Quit();
   }
 
   void FileWritten(CdmFile::Status* status, CdmFile::Status actual_status) {
     DVLOG(3) << __func__;
     *status = actual_status;
-    run_loop_->Quit();
+    run_loop_with_count_->Quit();
   }
 
   // Start running and allow the asynchronous IO operations to complete.
-  void RunAndWaitForResult() {
-    run_loop_.reset(new base::RunLoop());
-    run_loop_->Run();
+  void RunAndWaitForResult(int expected_quit_calls) {
+    run_loop_with_count_ = std::make_unique<RunLoopWithExpectedCount>();
+    run_loop_with_count_->Run(expected_quit_calls);
   }
 
   RenderFrameHost* rfh_ = nullptr;
   CdmStoragePtr cdm_storage_;
-  std::unique_ptr<base::RunLoop> run_loop_;
+  std::unique_ptr<RunLoopWithExpectedCount> run_loop_with_count_;
 };
 
 TEST_F(CdmStorageTest, InvalidFileSystemIdWithSlash) {
@@ -303,4 +363,42 @@ TEST_F(CdmStorageTest, ReadThenWriteEmptyFile) {
   EXPECT_EQ(0u, data_read.size());
 }
 
+TEST_F(CdmStorageTest, ParallelRead) {
+  Initialize(kTestFileSystemId);
+
+  const char kFileName[] = "duplicate_read_file_name";
+  CdmFileAssociatedPtr cdm_file;
+  EXPECT_TRUE(Open(kFileName, &cdm_file));
+  EXPECT_TRUE(cdm_file.is_bound());
+
+  CdmFile::Status status1;
+  CdmFile::Status status2;
+  ReadTwice(cdm_file.get(), &status1, &status2);
+
+  // One call should succeed, one should fail.
+  EXPECT_TRUE((status1 == CdmFile::Status::kSuccess &&
+               status2 == CdmFile::Status::kFailure) ||
+              (status1 == CdmFile::Status::kFailure &&
+               status2 == CdmFile::Status::kSuccess));
+}
+
+TEST_F(CdmStorageTest, ParallelWrite) {
+  Initialize(kTestFileSystemId);
+
+  const char kFileName[] = "duplicate_write_file_name";
+  CdmFileAssociatedPtr cdm_file;
+  EXPECT_TRUE(Open(kFileName, &cdm_file));
+  EXPECT_TRUE(cdm_file.is_bound());
+
+  CdmFile::Status status1;
+  CdmFile::Status status2;
+  WriteTwice(cdm_file.get(), &status1, &status2);
+
+  // One call should succeed, one should fail.
+  EXPECT_TRUE((status1 == CdmFile::Status::kSuccess &&
+               status2 == CdmFile::Status::kFailure) ||
+              (status1 == CdmFile::Status::kFailure &&
+               status2 == CdmFile::Status::kSuccess));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/media/encrypted_media_browsertest.cc b/chromium/content/browser/media/encrypted_media_browsertest.cc
index 77af37be024..c4356ecdb81 100644
--- a/chromium/content/browser/media/encrypted_media_browsertest.cc
+++ b/chromium/content/browser/media/encrypted_media_browsertest.cc
@@ -28,11 +28,27 @@
 #include "base/win/windows_version.h"
 #endif
 
+// External Clear Key is a test-only key system that has mostly the same
+// functionality as Clear Key key system. Unlike Clear Key, which is implemented
+// by AesDecryptor in the render process directly, External Clear Key is
+// implemented by hosting a CDM that supports Clear Key (e.g. AesDecryptor) in a
+// remote processes to cover the code path used by a real production CDM, which
+// is otherwise hard to cover by tests.
+// - When ENABLE_LIBRARY_CDMS is true, a "Clear Key CDM" that implements the
+//   "Library CDM API" is hosted in the CDM/utility process to do decryption and
+//   decoding. This covers MojoCdm, MojoDecryptor, CdmAdapter, CdmFileIO etc.
+//   See //media/cdm/library_cdm/clear_key_cdm/README.md.
+// - Otherwise when ENABLE_MOJO_CDM is true, External Clear Key is supported in
+//   content/shell/ by using MojoCdm with AesDecryptor running in a remote
+//   process, e.g. GPU or Browser, as specified by |mojo_media_host|. The
+//   connection between the media pipeline and the CDM varies on different
+//   platforms. For example, the media pipeline could choose the default
+//   RendererImpl in the render process, which can use the remote CDM to do
+//   decryption via MojoDecryptor. The media pipeline could also choose
+//   MojoRenderer, which hosts a RendererImpl in the remote process, which uses
+//   the Decryptor exposed by the AesDecryptor directly in the remote process.
+//   See TestMojoMediaClient for details on this path.
 #if BUILDFLAG(ENABLE_MOJO_CDM) && !BUILDFLAG(ENABLE_LIBRARY_CDMS)
-// When mojo CDM is enabled, External Clear Key is supported in //content/shell/
-// by using mojo CDM with AesDecryptor running in the remote (e.g. GPU or
-// Browser) process. When pepper CDM is supported, External Clear Key is
-// supported in chrome/, which is tested in browser_tests.
 #define SUPPORTS_EXTERNAL_CLEAR_KEY_IN_CONTENT_SHELL
 #endif
 
@@ -314,7 +330,16 @@ IN_PROC_BROWSER_TEST_P(EncryptedMediaTest, ConfigChangeVideo_ClearToClear) {
   TestConfigChange(ConfigChangeType::CLEAR_TO_CLEAR);
 }
 
-IN_PROC_BROWSER_TEST_P(EncryptedMediaTest, ConfigChangeVideo_ClearToEncrypted) {
+// Failed on Android, see https://crbug.com/1014540.
+#if defined(OS_ANDROID)
+#define MAYBE_ConfigChangeVideo_ClearToEncrypted \
+  DISABLED_ConfigChangeVideo_ClearToEncrypted
+#else
+#define MAYBE_ConfigChangeVideo_ClearToEncrypted \
+  ConfigChangeVideo_ClearToEncrypted
+#endif
+IN_PROC_BROWSER_TEST_P(EncryptedMediaTest,
+                       MAYBE_ConfigChangeVideo_ClearToEncrypted) {
   TestConfigChange(ConfigChangeType::CLEAR_TO_ENCRYPTED);
 }
 
diff --git a/chromium/content/browser/media/flinging_renderer.cc b/chromium/content/browser/media/flinging_renderer.cc
index 74235083dff..9e55c87ec07 100644
--- a/chromium/content/browser/media/flinging_renderer.cc
+++ b/chromium/content/browser/media/flinging_renderer.cc
@@ -105,10 +105,10 @@ void FlingingRenderer::StartPlayingFrom(base::TimeDelta time) {
 void FlingingRenderer::SetPlaybackRate(double playback_rate) {
   DVLOG(2) << __func__;
   if (playback_rate == 0) {
-    SetTargetPlayState(PlayState::PAUSED);
+    SetExpectedPlayState(PlayState::PAUSED);
     controller_->GetMediaController()->Pause();
   } else {
-    SetTargetPlayState(PlayState::PLAYING);
+    SetExpectedPlayState(PlayState::PLAYING);
     controller_->GetMediaController()->Play();
   }
 }
@@ -122,18 +122,19 @@ base::TimeDelta FlingingRenderer::GetMediaTime() {
   return controller_->GetApproximateCurrentTime();
 }
 
-void FlingingRenderer::SetTargetPlayState(PlayState state) {
+void FlingingRenderer::SetExpectedPlayState(PlayState state) {
   DVLOG(3) << __func__ << " : state " << static_cast<int>(state);
   DCHECK(state == PlayState::PLAYING || state == PlayState::PAUSED);
-  reached_target_play_state_ = false;
-  target_play_state_ = state;
+
+  expected_play_state_ = state;
+  play_state_is_stable_ = (expected_play_state_ == last_play_state_received_);
 }
 
 void FlingingRenderer::OnMediaStatusUpdated(const media::MediaStatus& status) {
   const auto& current_state = status.state;
 
-  if (current_state == target_play_state_)
-    reached_target_play_state_ = true;
+  if (current_state == expected_play_state_)
+    play_state_is_stable_ = true;
 
   // Because we can get a MediaStatus update at any time from the device, only
   // handle state updates after we have reached the target state.
@@ -146,7 +147,7 @@ void FlingingRenderer::OnMediaStatusUpdated(const media::MediaStatus& status) {
   //   queue a new PLAYING.
   // - The local device enters a tick/tock feedback loop of constantly
   //   requesting the wrong state of PLAYING/PAUSED.
-  if (!reached_target_play_state_)
+  if (!play_state_is_stable_)
     return;
 
   // Ignore all non PLAYING/PAUSED states.
@@ -160,10 +161,12 @@ void FlingingRenderer::OnMediaStatusUpdated(const media::MediaStatus& status) {
     return;
   }
 
-  // We previously reached a stable target PlayState, and the cast device has
-  // reached a new stable PlayState without WMPI having asked for it.
-  // Let WMPI know it should update itself.
-  if (current_state != target_play_state_)
+  // Save whether the remote device is currently playing or paused.
+  last_play_state_received_ = current_state;
+
+  // If the remote device's play state has toggled and we didn't initiate it,
+  // notify WMPI to update it's own play/pause state.
+  if (last_play_state_received_ != expected_play_state_)
     client_extension_->OnRemotePlayStateChange(current_state);
 }
 
diff --git a/chromium/content/browser/media/flinging_renderer.h b/chromium/content/browser/media/flinging_renderer.h
index 6196e1488ad..6b7c16ff989 100644
--- a/chromium/content/browser/media/flinging_renderer.h
+++ b/chromium/content/browser/media/flinging_renderer.h
@@ -64,13 +64,19 @@ class CONTENT_EXPORT FlingingRenderer : public media::Renderer,
       std::unique_ptr<media::FlingingController> controller,
       ClientExtensionPtr client_extension);
 
-  void SetTargetPlayState(PlayState state);
+  void SetExpectedPlayState(PlayState state);
 
-  // The state that we expect the remotely playing video to transition into.
-  // This is used to differentiate between state changes that originated from
-  // this device versus external devices.
-  PlayState target_play_state_ = PlayState::UNKNOWN;
-  bool reached_target_play_state_ = false;
+  // The play state that we expect the remote device to reach.
+  // Updated whenever WMPI sends play/pause commands.
+  PlayState expected_play_state_ = PlayState::UNKNOWN;
+
+  // True when the remote device has reached the expected play state.
+  // False when it is transitioning.
+  bool play_state_is_stable_ = false;
+
+  // The last "stable" play state received from the cast device.
+  // Only updated when |play_state_is_stable_| is true.
+  PlayState last_play_state_received_ = PlayState::UNKNOWN;
 
   media::RendererClient* client_;
 
diff --git a/chromium/content/browser/media/forwarding_audio_stream_factory.cc b/chromium/content/browser/media/forwarding_audio_stream_factory.cc
index 141b5e0707d..ff35b5157c9 100644
--- a/chromium/content/browser/media/forwarding_audio_stream_factory.cc
+++ b/chromium/content/browser/media/forwarding_audio_stream_factory.cc
@@ -61,7 +61,8 @@ void ForwardingAudioStreamFactory::Core::CreateInputStream(
     uint32_t shared_memory_count,
     bool enable_agc,
     audio::mojom::AudioProcessingConfigPtr processing_config,
-    mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client) {
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        renderer_factory_client) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   // |this| owns |inputs_|, so Unretained is safe.
@@ -95,7 +96,7 @@ void ForwardingAudioStreamFactory::Core::CreateOutputStream(
     const std::string& device_id,
     const media::AudioParameters& params,
     const base::Optional<base::UnguessableToken>& processing_id,
-    media::mojom::AudioOutputStreamProviderClientPtr client) {
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   // |this| owns |outputs_|, so Unretained is safe.
@@ -117,7 +118,8 @@ void ForwardingAudioStreamFactory::Core::CreateLoopbackStream(
     const media::AudioParameters& params,
     uint32_t shared_memory_count,
     bool mute_source,
-    mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client) {
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        renderer_factory_client) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(loopback_source);
 
@@ -315,10 +317,10 @@ audio::mojom::StreamFactory* ForwardingAudioStreamFactory::Core::GetFactory() {
     TRACE_EVENT_INSTANT1(
         "audio", "ForwardingAudioStreamFactory: Binding new factory",
         TRACE_EVENT_SCOPE_THREAD, "group", group_id_.GetLowForSerialization());
-    connector_->BindInterface(audio::mojom::kServiceName,
-                              mojo::MakeRequest(&remote_factory_));
+    connector_->Connect(audio::mojom::kServiceName,
+                        remote_factory_.BindNewPipeAndPassReceiver());
     // Unretained is safe because |this| owns |remote_factory_|.
-    remote_factory_.set_connection_error_handler(base::BindOnce(
+    remote_factory_.set_disconnect_handler(base::BindOnce(
         &ForwardingAudioStreamFactory::Core::ResetRemoteFactoryPtr,
         base::Unretained(this)));
 
diff --git a/chromium/content/browser/media/forwarding_audio_stream_factory.h b/chromium/content/browser/media/forwarding_audio_stream_factory.h
index 295af3efad1..21fe74694e4 100644
--- a/chromium/content/browser/media/forwarding_audio_stream_factory.h
+++ b/chromium/content/browser/media/forwarding_audio_stream_factory.h
@@ -21,6 +21,8 @@
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
 
@@ -83,7 +85,7 @@ class CONTENT_EXPORT ForwardingAudioStreamFactory final
         uint32_t shared_memory_count,
         bool enable_agc,
         audio::mojom::AudioProcessingConfigPtr processing_config,
-        mojom::RendererAudioInputStreamFactoryClientPtr
+        mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
             renderer_factory_client);
 
     void AssociateInputAndOutputForAec(
@@ -96,7 +98,8 @@ class CONTENT_EXPORT ForwardingAudioStreamFactory final
         const std::string& device_id,
         const media::AudioParameters& params,
         const base::Optional<base::UnguessableToken>& processing_id,
-        media::mojom::AudioOutputStreamProviderClientPtr client);
+        mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+            client);
 
     void CreateLoopbackStream(
         int render_process_id,
@@ -105,7 +108,7 @@ class CONTENT_EXPORT ForwardingAudioStreamFactory final
         const media::AudioParameters& params,
         uint32_t shared_memory_count,
         bool mute_source,
-        mojom::RendererAudioInputStreamFactoryClientPtr
+        mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
             renderer_factory_client);
 
     // Sets the muting state for all output streams created through this
@@ -153,7 +156,7 @@ class CONTENT_EXPORT ForwardingAudioStreamFactory final
     // since we want to clean up the service when not in use. If we have active
     // muting but nothing else, we should stop it and start it again when we
     // need to reacquire the factory for some other reason.
-    audio::mojom::StreamFactoryPtr remote_factory_;
+    mojo::Remote<audio::mojom::StreamFactory> remote_factory_;
 
     // Running id used for tracking audible streams. We keep count here to avoid
     // collisions.
diff --git a/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc b/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc
index 0e1e6546981..6a95d99e838 100644
--- a/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc
+++ b/chromium/content/browser/media/forwarding_audio_stream_factory_unittest.cc
@@ -20,6 +20,7 @@
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/audio/public/cpp/fake_stream_factory.h"
 #include "services/audio/public/mojom/constants.mojom.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
@@ -111,8 +112,8 @@ class MockBrokerFactory : public AudioStreamBrokerFactory {
       bool enable_agc,
       audio::mojom::AudioProcessingConfigPtr processing_config,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client)
-      final {
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          renderer_factory_client) final {
     std::unique_ptr<MockBroker> prepared_broker =
         std::move(prepared_input_stream_brokers_.front());
     prepared_input_stream_brokers_.pop();
@@ -132,7 +133,8 @@ class MockBrokerFactory : public AudioStreamBrokerFactory {
       const base::UnguessableToken& group_id,
       const base::Optional<base::UnguessableToken>& processing_id,
       AudioStreamBroker::DeleterCallback deleter,
-      media::mojom::AudioOutputStreamProviderClientPtr client) final {
+      mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client)
+      final {
     std::unique_ptr<MockBroker> prepared_broker =
         std::move(prepared_output_stream_brokers_.front());
     prepared_output_stream_brokers_.pop();
@@ -151,8 +153,8 @@ class MockBrokerFactory : public AudioStreamBrokerFactory {
       uint32_t shared_memory_count,
       bool mute_source,
       AudioStreamBroker::DeleterCallback deleter,
-      mojom::RendererAudioInputStreamFactoryClientPtr renderer_factory_client)
-      final {
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          renderer_factory_client) final {
     std::unique_ptr<MockBroker> prepared_broker =
         std::move(prepared_loopback_stream_brokers_.front());
     prepared_loopback_stream_brokers_.pop();
@@ -262,7 +264,7 @@ const bool kMuteSource = true;
 }  // namespace
 
 TEST_F(ForwardingAudioStreamFactoryTest, CreateInputStream_CreatesInputStream) {
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
   base::WeakPtr<MockBroker> broker = ExpectInputBrokerConstruction(main_rfh());
 
   ForwardingAudioStreamFactory factory(
@@ -270,7 +272,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, CreateInputStream_CreatesInputStream) {
       std::move(broker_factory_));
 
   EXPECT_CALL(*broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&client);
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateInputStream(main_rfh()->GetProcess()->GetID(),
                                     main_rfh()->GetRoutingID(), kInputDeviceId,
                                     kParams, kSharedMemoryCount, kEnableAgc,
@@ -280,7 +282,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, CreateInputStream_CreatesInputStream) {
 TEST_F(ForwardingAudioStreamFactoryTest,
        CreateLoopbackStream_CreatesLoopbackStream) {
   std::unique_ptr<WebContents> source_contents = CreateTestWebContents();
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
   base::WeakPtr<MockBroker> broker =
       ExpectLoopbackBrokerConstruction(main_rfh());
 
@@ -296,7 +298,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
       std::move(other_connector), std::make_unique<MockBrokerFactory>());
 
   EXPECT_CALL(*broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&client);
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateLoopbackStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
       source_factory.core(), kParams, kSharedMemoryCount, kMuteSource,
@@ -305,7 +307,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
 TEST_F(ForwardingAudioStreamFactoryTest,
        CreateOutputStream_CreatesOutputStream) {
-  media::mojom::AudioOutputStreamProviderClientPtr client;
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
   base::WeakPtr<MockBroker> broker = ExpectOutputBrokerConstruction(main_rfh());
 
   ForwardingAudioStreamFactory factory(
@@ -313,7 +315,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
       std::move(broker_factory_));
 
   EXPECT_CALL(*broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&client);
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
       kOutputDeviceId, kParams, base::nullopt, std::move(client));
@@ -321,7 +323,6 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
 TEST_F(ForwardingAudioStreamFactoryTest,
        InputBrokerDeleterCalled_DestroysInputStream) {
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
   base::WeakPtr<MockBroker> main_rfh_broker =
       ExpectInputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_broker =
@@ -333,7 +334,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
   {
     EXPECT_CALL(*main_rfh_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
@@ -342,7 +344,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
   }
   {
     EXPECT_CALL(*other_rfh_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
@@ -359,7 +362,6 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 TEST_F(ForwardingAudioStreamFactoryTest,
        LoopbackBrokerDeleterCalled_DestroysInputStream) {
   std::unique_ptr<WebContents> source_contents = CreateTestWebContents();
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
   base::WeakPtr<MockBroker> main_rfh_broker =
       ExpectLoopbackBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_broker =
@@ -378,7 +380,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
   {
     EXPECT_CALL(*main_rfh_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateLoopbackStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         source_factory.core(), kParams, kSharedMemoryCount, kMuteSource,
@@ -387,7 +390,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
   }
   {
     EXPECT_CALL(*other_rfh_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateLoopbackStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         source_factory.core(), kParams, kSharedMemoryCount, kMuteSource,
@@ -403,7 +407,6 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
 TEST_F(ForwardingAudioStreamFactoryTest,
        OutputBrokerDeleterCalled_DestroysOutputStream) {
-  media::mojom::AudioOutputStreamProviderClientPtr client;
   base::WeakPtr<MockBroker> main_rfh_broker =
       ExpectOutputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_broker =
@@ -415,7 +418,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
   {
     EXPECT_CALL(*main_rfh_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(client));
@@ -423,7 +427,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
   }
   {
     EXPECT_CALL(*other_rfh_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(client));
@@ -439,7 +444,6 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
   std::unique_ptr<WebContents> source_contents = CreateTestWebContents();
 
-  mojom::RendererAudioInputStreamFactoryClientPtr input_client;
   base::WeakPtr<MockBroker> main_rfh_input_broker =
       ExpectInputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_input_broker =
@@ -450,7 +454,6 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
   base::WeakPtr<MockBroker> other_rfh_loopback_broker =
       ExpectLoopbackBrokerConstruction(other_rfh());
 
-  media::mojom::AudioOutputStreamProviderClientPtr output_client;
   base::WeakPtr<MockBroker> main_rfh_output_broker =
       ExpectOutputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_output_broker =
@@ -469,7 +472,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
 
   {
     EXPECT_CALL(*main_rfh_input_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&input_client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        input_client;
+    ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
@@ -478,7 +483,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
   }
   {
     EXPECT_CALL(*other_rfh_input_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&input_client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        input_client;
+    ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
@@ -488,7 +495,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
 
   {
     EXPECT_CALL(*main_rfh_loopback_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&input_client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        input_client;
+    ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateLoopbackStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         source_factory.core(), kParams, kSharedMemoryCount, kMuteSource,
@@ -497,7 +506,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
   }
   {
     EXPECT_CALL(*other_rfh_loopback_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&input_client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        input_client;
+    ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateLoopbackStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         source_factory.core(), kParams, kSharedMemoryCount, kMuteSource,
@@ -507,7 +518,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
 
   {
     EXPECT_CALL(*main_rfh_output_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&output_client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+        output_client;
+    ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
@@ -515,7 +528,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
   }
   {
     EXPECT_CALL(*other_rfh_output_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&output_client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+        output_client;
+    ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
@@ -537,11 +552,13 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyFrame_DestroysRelatedStreams) {
 }
 
 TEST_F(ForwardingAudioStreamFactoryTest, DestroyWebContents_DestroysStreams) {
-  mojom::RendererAudioInputStreamFactoryClientPtr input_client;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+      input_client;
   base::WeakPtr<MockBroker> input_broker =
       ExpectInputBrokerConstruction(main_rfh());
 
-  media::mojom::AudioOutputStreamProviderClientPtr output_client;
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+      output_client;
   base::WeakPtr<MockBroker> output_broker =
       ExpectOutputBrokerConstruction(main_rfh());
 
@@ -550,14 +567,14 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyWebContents_DestroysStreams) {
       std::move(broker_factory_));
 
   EXPECT_CALL(*input_broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&input_client);
+  ignore_result(input_client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateInputStream(main_rfh()->GetProcess()->GetID(),
                                     main_rfh()->GetRoutingID(), kInputDeviceId,
                                     kParams, kSharedMemoryCount, kEnableAgc,
                                     nullptr, std::move(input_client));
 
   EXPECT_CALL(*output_broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&output_client);
+  ignore_result(output_client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
       kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
@@ -572,13 +589,11 @@ TEST_F(ForwardingAudioStreamFactoryTest, DestroyWebContents_DestroysStreams) {
 }
 
 TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
-  mojom::RendererAudioInputStreamFactoryClientPtr input_client;
   base::WeakPtr<MockBroker> main_rfh_input_broker =
       ExpectInputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_input_broker =
       ExpectInputBrokerConstruction(other_rfh());
 
-  media::mojom::AudioOutputStreamProviderClientPtr output_client;
   base::WeakPtr<MockBroker> main_rfh_output_broker =
       ExpectOutputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> other_rfh_output_broker =
@@ -590,7 +605,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
 
   {
     EXPECT_CALL(*main_rfh_input_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&input_client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        input_client;
+    ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
@@ -599,7 +616,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
   }
   {
     EXPECT_CALL(*other_rfh_input_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&input_client);
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        input_client;
+    ignore_result(input_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateInputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         kInputDeviceId, kParams, kSharedMemoryCount, kEnableAgc, nullptr,
@@ -609,7 +628,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
 
   {
     EXPECT_CALL(*main_rfh_output_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&output_client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+        output_client;
+    ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
@@ -617,7 +638,9 @@ TEST_F(ForwardingAudioStreamFactoryTest, LastStreamDeleted_ClearsFactoryPtr) {
   }
   {
     EXPECT_CALL(*other_rfh_output_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&output_client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+        output_client;
+    ignore_result(output_client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         other_rfh()->GetProcess()->GetID(), other_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(output_client));
@@ -666,14 +689,14 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 }
 
 TEST_F(ForwardingAudioStreamFactoryTest, MuteWithOutputStream_ConnectsMuter) {
-  media::mojom::AudioOutputStreamProviderClientPtr client;
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
   base::WeakPtr<MockBroker> broker = ExpectOutputBrokerConstruction(main_rfh());
   ForwardingAudioStreamFactory factory(
       web_contents(), nullptr /*user_input_monitor*/, std::move(connector_),
       std::move(broker_factory_));
 
   EXPECT_CALL(*broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&client);
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
       kOutputDeviceId, kParams, base::nullopt, std::move(client));
@@ -698,7 +721,7 @@ TEST_F(ForwardingAudioStreamFactoryTest, MuteWithOutputStream_ConnectsMuter) {
 
 TEST_F(ForwardingAudioStreamFactoryTest,
        WhenMuting_ConnectedWhenOutputStreamExists) {
-  media::mojom::AudioOutputStreamProviderClientPtr client;
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
   base::WeakPtr<MockBroker> broker = ExpectOutputBrokerConstruction(main_rfh());
   ForwardingAudioStreamFactory factory(
       web_contents(), nullptr /*user_input_monitor*/, std::move(connector_),
@@ -714,7 +737,7 @@ TEST_F(ForwardingAudioStreamFactoryTest,
   EXPECT_FALSE(stream_factory_.IsMuterConnected());
 
   EXPECT_CALL(*broker, CreateStream(NotNull()));
-  mojo::MakeRequest(&client);
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
   factory.core()->CreateOutputStream(
       main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
       kOutputDeviceId, kParams, base::nullopt, std::move(client));
@@ -734,7 +757,6 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
 TEST_F(ForwardingAudioStreamFactoryTest,
        WhenMuting_AddRemoveSecondStream_DoesNotChangeMuting) {
-  media::mojom::AudioOutputStreamProviderClientPtr client;
   base::WeakPtr<MockBroker> broker = ExpectOutputBrokerConstruction(main_rfh());
   base::WeakPtr<MockBroker> another_broker =
       ExpectOutputBrokerConstruction(main_rfh());
@@ -744,7 +766,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
   {
     EXPECT_CALL(*broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(client));
@@ -762,7 +785,8 @@ TEST_F(ForwardingAudioStreamFactoryTest,
 
   {
     EXPECT_CALL(*another_broker, CreateStream(NotNull()));
-    mojo::MakeRequest(&client);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
     factory.core()->CreateOutputStream(
         main_rfh()->GetProcess()->GetID(), main_rfh()->GetRoutingID(),
         kOutputDeviceId, kParams, base::nullopt, std::move(client));
diff --git a/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc b/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc
index eaf99f8ffd9..86d2149f9d1 100644
--- a/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc
+++ b/chromium/content/browser/media/in_process_audio_loopback_stream_creator.cc
@@ -20,7 +20,8 @@
 #include "content/public/browser/system_connector.h"
 #include "media/audio/audio_device_description.h"
 #include "media/base/user_input_monitor.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/service_manager/public/cpp/connector.h"
 
 namespace content {
@@ -64,32 +65,28 @@ void CreateLoopbackStreamHelper(
     AudioStreamBroker::LoopbackSource* loopback_source,
     const media::AudioParameters& params,
     uint32_t total_segments,
-    mojom::RendererAudioInputStreamFactoryClientPtrInfo client_ptr_info) {
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        client_remote) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   const bool mute_source = true;
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  client.Bind(std::move(client_ptr_info));
-
   factory->CreateLoopbackStream(-1, -1, loopback_source, params, total_segments,
-                                mute_source, std::move(client));
+                                mute_source, std::move(client_remote));
 }
 
 void CreateSystemWideLoopbackStreamHelper(
     ForwardingAudioStreamFactory::Core* factory,
     const media::AudioParameters& params,
     uint32_t total_segments,
-    mojom::RendererAudioInputStreamFactoryClientPtrInfo client_ptr_info) {
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        client_remote) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   const bool enable_agc = false;
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  client.Bind(std::move(client_ptr_info));
-
   factory->CreateInputStream(
       -1, -1, media::AudioDeviceDescription::kLoopbackWithMuteDeviceId, params,
       total_segments, enable_agc, nullptr /* processing_config */,
-      std::move(client));
+      std::move(client_remote));
 }
 
 }  // namespace
@@ -115,10 +112,10 @@ void InProcessAudioLoopbackStreamCreator::CreateLoopbackStream(
     uint32_t total_segments,
     const StreamCreatedCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  mojom::RendererAudioInputStreamFactoryClientPtrInfo client;
-  mojo::MakeStrongBinding(
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+  mojo::MakeSelfOwnedReceiver(
       std::make_unique<StreamCreatedCallbackAdapter>(callback),
-      mojo::MakeRequest(&client));
+      client.InitWithNewPipeAndPassReceiver());
   // Deletion of factory_.core() is posted to the IO thread when |factory_| is
   // destroyed, so Unretained is safe below.
   if (loopback_source) {
diff --git a/chromium/content/browser/media/media_browsertest.cc b/chromium/content/browser/media/media_browsertest.cc
index 8c57976100f..82c75d1a35b 100644
--- a/chromium/content/browser/media/media_browsertest.cc
+++ b/chromium/content/browser/media/media_browsertest.cc
@@ -9,10 +9,13 @@
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
+#include "content/shell/common/shell_switches.h"
+#include "media/audio/audio_features.h"
 #include "media/base/media_switches.h"
 #include "media/base/test_data_util.h"
 #include "media/media_buildflags.h"
@@ -30,9 +33,22 @@ void MediaBrowserTest::SetUpCommandLine(base::CommandLine* command_line) {
   command_line->AppendSwitchASCII(
       switches::kAutoplayPolicy,
       switches::autoplay::kNoUserGestureRequiredPolicy);
-  // Disable fallback after decode error to avoid unexpected test pass on the
-  // fallback path.
-  scoped_feature_list_.InitAndDisableFeature(media::kFallbackAfterDecodeError);
+  command_line->AppendSwitch(switches::kExposeInternalsForTesting);
+
+  std::vector<base::Feature> disabled_features = {
+    // Disable fallback after decode error to avoid unexpected test pass on
+    // the fallback path.
+    media::kFallbackAfterDecodeError,
+
+#if defined(OS_LINUX)
+    // Disable out of process audio on Linux due to process spawn
+    // failures. http://crbug.com/986021
+    features::kAudioServiceOutOfProcess,
+#endif
+  };
+
+  scoped_feature_list_.InitWithFeatures({/* enabled_features */},
+                                        disabled_features);
 }
 
 void MediaBrowserTest::RunMediaTestPage(const std::string& html_page,
@@ -280,13 +296,7 @@ IN_PROC_BROWSER_TEST_P(MediaTest, AudioBearFlacOgg) {
   PlayVideo("bear-flac.ogg", GetParam());
 }
 
-// Flaky on Linux. See https://crbug.com/979259
-#if defined(OS_LINUX)
-#define MAYBE_VideoBearWavAlaw DISABLED_VideoBearWavAlaw
-#else
-#define MAYBE_VideoBearWavAlaw VideoBearWavAlaw
-#endif
-IN_PROC_BROWSER_TEST_P(MediaTest, MAYBE_VideoBearWavAlaw) {
+IN_PROC_BROWSER_TEST_P(MediaTest, VideoBearWavAlaw) {
   PlayAudio("bear_alaw.wav", GetParam());
 }
 
diff --git a/chromium/content/browser/media/media_devices_permission_checker_unittest.cc b/chromium/content/browser/media/media_devices_permission_checker_unittest.cc
index 40d9d8010f1..e47200bf23a 100644
--- a/chromium/content/browser/media/media_devices_permission_checker_unittest.cc
+++ b/chromium/content/browser/media/media_devices_permission_checker_unittest.cc
@@ -53,11 +53,11 @@ class MediaDevicesPermissionCheckerTest : public RenderViewHostImplTestHarness {
   void RefreshPageAndSetHeaderPolicy(blink::mojom::FeaturePolicyFeature feature,
                                      bool enabled) {
     NavigateAndCommit(origin_.GetURL());
-    std::vector<url::Origin> whitelist;
+    std::vector<url::Origin> allowlist;
     if (enabled)
-      whitelist.push_back(origin_);
+      allowlist.push_back(origin_);
     RenderFrameHostTester::For(main_rfh())
-        ->SimulateFeaturePolicyHeader(feature, whitelist);
+        ->SimulateFeaturePolicyHeader(feature, allowlist);
   }
 
   bool CheckPermission(blink::MediaDeviceType device_type) {
diff --git a/chromium/content/browser/media/media_devices_util.cc b/chromium/content/browser/media/media_devices_util.cc
index e71561803fa..564a090acbb 100644
--- a/chromium/content/browser/media/media_devices_util.cc
+++ b/chromium/content/browser/media/media_devices_util.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/media_device_id.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
 #include "media/base/media_switches.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 
@@ -130,22 +131,49 @@ void GetDefaultMediaDeviceID(
 MediaDeviceSaltAndOrigin GetMediaDeviceSaltAndOrigin(int render_process_id,
                                                      int render_frame_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  RenderFrameHost* frame_host =
-      RenderFrameHost::FromID(render_process_id, render_frame_id);
+  RenderFrameHostImpl* frame_host =
+      RenderFrameHostImpl::FromID(render_process_id, render_frame_id);
   RenderProcessHost* process_host =
       RenderProcessHost::FromID(render_process_id);
-  WebContentsImpl* web_contents = static_cast<WebContentsImpl*>(
-      WebContents::FromRenderFrameHost(frame_host));
-
-  std::string device_id_salt =
-      process_host ? process_host->GetBrowserContext()->GetMediaDeviceIDSalt()
-                   : std::string();
-  std::string group_id_salt =
-      device_id_salt + (web_contents
-                            ? web_contents->GetMediaDeviceGroupIDSaltBase()
-                            : std::string());
-  url::Origin origin =
-      frame_host ? frame_host->GetLastCommittedOrigin() : url::Origin();
+
+  url::Origin origin;
+  GURL url;
+  GURL site_for_cookies;
+  url::Origin top_level_origin;
+  std::string frame_salt;
+
+  if (frame_host) {
+    origin = frame_host->GetLastCommittedOrigin();
+    url = frame_host->GetLastCommittedURL();
+    site_for_cookies = frame_host->ComputeSiteForCookies();
+    top_level_origin = frame_host->frame_tree_node()
+                           ->frame_tree()
+                           ->GetMainFrame()
+                           ->GetLastCommittedOrigin();
+    frame_salt = frame_host->GetMediaDeviceIDSaltBase();
+  }
+
+  bool are_persistent_ids_allowed = false;
+  std::string device_id_salt;
+  std::string group_id_salt;
+  if (process_host) {
+    are_persistent_ids_allowed =
+        GetContentClient()->browser()->ArePersistentMediaDeviceIDsAllowed(
+            process_host->GetBrowserContext(), url, site_for_cookies,
+            top_level_origin);
+    device_id_salt = process_host->GetBrowserContext()->GetMediaDeviceIDSalt();
+    group_id_salt = device_id_salt;
+  }
+
+  // If persistent IDs are not allowed, append |frame_salt| to make it
+  // specific to the current document.
+  if (!are_persistent_ids_allowed)
+    device_id_salt += frame_salt;
+
+  // |group_id_salt| must be unique per document, but it must also change if
+  // cookies are cleared. Also, it must be different from |device_id_salt|,
+  // thus appending a constant.
+  group_id_salt += frame_salt + "groupid";
 
   return {std::move(device_id_salt), std::move(group_id_salt),
           std::move(origin)};
diff --git a/chromium/content/browser/media/media_devices_util.h b/chromium/content/browser/media/media_devices_util.h
index 76650004a2a..1dbf23c62a3 100644
--- a/chromium/content/browser/media/media_devices_util.h
+++ b/chromium/content/browser/media/media_devices_util.h
@@ -39,8 +39,8 @@ struct CONTENT_EXPORT MediaDeviceSaltAndOrigin {
 // unique media-device IDs for each origin and renderer process. These values
 // should not be cached since the user can explicitly change them at any time.
 // This function must run on the UI thread.
-MediaDeviceSaltAndOrigin GetMediaDeviceSaltAndOrigin(int render_process_id,
-                                                     int render_frame_id);
+CONTENT_EXPORT MediaDeviceSaltAndOrigin
+GetMediaDeviceSaltAndOrigin(int render_process_id, int render_frame_id);
 
 // Returns a translated version of |device_info| suitable for use in a renderer
 // process.
diff --git a/chromium/content/browser/media/media_interface_factory_holder.cc b/chromium/content/browser/media/media_interface_factory_holder.cc
new file mode 100644
index 00000000000..7eb12465695
--- /dev/null
+++ b/chromium/content/browser/media/media_interface_factory_holder.cc
@@ -0,0 +1,56 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/media/media_interface_factory_holder.h"
+
+#include "base/bind.h"
+#include "content/public/common/service_manager_connection.h"
+#include "media/mojo/mojom/media_service.mojom.h"
+#include "services/service_manager/public/cpp/connector.h"
+
+namespace content {
+
+MediaInterfaceFactoryHolder::MediaInterfaceFactoryHolder(
+    const std::string& service_name,
+    CreateInterfaceProviderCB create_interface_provider_cb)
+    : service_name_(service_name),
+      create_interface_provider_cb_(std::move(create_interface_provider_cb)) {}
+
+MediaInterfaceFactoryHolder::~MediaInterfaceFactoryHolder() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+}
+
+media::mojom::InterfaceFactory* MediaInterfaceFactoryHolder::Get() {
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  if (!interface_factory_ptr_)
+    ConnectToMediaService();
+
+  return interface_factory_ptr_.get();
+}
+
+void MediaInterfaceFactoryHolder::ConnectToMediaService() {
+  media::mojom::MediaServicePtr media_service;
+
+  // TODO(slan): Use the BrowserContext Connector instead. See crbug.com/638950.
+  service_manager::Connector* connector =
+      ServiceManagerConnection::GetForProcess()->GetConnector();
+  connector->BindInterface(service_name_, &media_service);
+
+  media_service->CreateInterfaceFactory(MakeRequest(&interface_factory_ptr_),
+                                        create_interface_provider_cb_.Run());
+
+  interface_factory_ptr_.set_connection_error_handler(base::BindOnce(
+      &MediaInterfaceFactoryHolder::OnMediaServiceConnectionError,
+      base::Unretained(this)));
+}
+
+void MediaInterfaceFactoryHolder::OnMediaServiceConnectionError() {
+  DVLOG(1) << __func__;
+  DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
+
+  interface_factory_ptr_.reset();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/media/media_interface_factory_holder.h b/chromium/content/browser/media/media_interface_factory_holder.h
new file mode 100644
index 00000000000..cfb5e716c96
--- /dev/null
+++ b/chromium/content/browser/media/media_interface_factory_holder.h
@@ -0,0 +1,50 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_MEDIA_MEDIA_INTERFACE_FACTORY_HOLDER_H_
+#define CONTENT_BROWSER_MEDIA_MEDIA_INTERFACE_FACTORY_HOLDER_H_
+
+#include <string>
+
+#include "base/callback.h"
+#include "base/macros.h"
+#include "base/threading/thread_checker.h"
+#include "media/mojo/mojom/interface_factory.mojom.h"
+#include "services/service_manager/public/mojom/interface_provider.mojom.h"
+
+namespace content {
+
+// Helper class to get media::mojom::InterfaceFactoryPtr.
+// Get() lazily connects to the media service specified by |service_name_|.
+class MediaInterfaceFactoryHolder {
+ public:
+  using CreateInterfaceProviderCB =
+      base::RepeatingCallback<service_manager::mojom::InterfaceProviderPtr()>;
+
+  MediaInterfaceFactoryHolder(
+      const std::string& service_name,
+      CreateInterfaceProviderCB create_interface_provider_cb);
+  ~MediaInterfaceFactoryHolder();
+
+  // Gets the MediaService |interface_factory_ptr_|. The returned pointer is
+  // still owned by this class.
+  media::mojom::InterfaceFactory* Get();
+
+ private:
+  void ConnectToMediaService();
+
+  // Callback for connection error from |interface_factory_ptr_|.
+  void OnMediaServiceConnectionError();
+
+  const std::string service_name_;
+  CreateInterfaceProviderCB create_interface_provider_cb_;
+  media::mojom::InterfaceFactoryPtr interface_factory_ptr_;
+
+  THREAD_CHECKER(thread_checker_);
+
+  DISALLOW_COPY_AND_ASSIGN(MediaInterfaceFactoryHolder);
+};
+
+}  // namespace content
+#endif  // CONTENT_BROWSER_MEDIA_MEDIA_INTERFACE_FACTORY_HOLDER_H_
diff --git a/chromium/content/browser/media/media_interface_proxy.cc b/chromium/content/browser/media/media_interface_proxy.cc
index c5fdc4dd9f9..2abb7e491ed 100644
--- a/chromium/content/browser/media/media_interface_proxy.cc
+++ b/chromium/content/browser/media/media_interface_proxy.cc
@@ -118,17 +118,29 @@ class SeatbeltExtensionTokenProviderImpl
 MediaInterfaceProxy::MediaInterfaceProxy(
     RenderFrameHost* render_frame_host,
     media::mojom::InterfaceFactoryRequest request,
-    const base::Closure& error_handler)
+    base::OnceClosure error_handler)
     : render_frame_host_(render_frame_host),
       binding_(this, std::move(request)) {
   DVLOG(1) << __func__;
   DCHECK(render_frame_host_);
   DCHECK(!error_handler.is_null());
 
-  binding_.set_connection_error_handler(error_handler);
+  auto create_interface_provider_cb =
+      base::BindRepeating(&MediaInterfaceProxy::GetFrameServices,
+                          base::Unretained(this), base::Token(), std::string());
+  media_interface_factory_ptr_ = std::make_unique<MediaInterfaceFactoryHolder>(
+      media::mojom::kMediaServiceName, create_interface_provider_cb);
 
-  // |interface_factory_ptr_| and |cdm_factory_map_| will be lazily
-  // connected in GetMediaInterfaceFactory() and GetCdmFactory().
+#if BUILDFLAG(ENABLE_CAST_RENDERER)
+  media_renderer_interface_factory_ptr_ =
+      std::make_unique<MediaInterfaceFactoryHolder>(
+          media::mojom::kMediaRendererServiceName,
+          std::move(create_interface_provider_cb));
+#endif  // BUILDFLAG(ENABLE_CAST_RENDERER)
+
+  binding_.set_connection_error_handler(std::move(error_handler));
+
+  // |cdm_factory_map_| will be lazily connected in GetCdmFactory().
 }
 
 MediaInterfaceProxy::~MediaInterfaceProxy() {
@@ -137,17 +149,17 @@ MediaInterfaceProxy::~MediaInterfaceProxy() {
 }
 
 void MediaInterfaceProxy::CreateAudioDecoder(
-    media::mojom::AudioDecoderRequest request) {
+    mojo::PendingReceiver<media::mojom::AudioDecoder> receiver) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  InterfaceFactory* factory = GetMediaInterfaceFactory();
+  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
   if (factory)
-    factory->CreateAudioDecoder(std::move(request));
+    factory->CreateAudioDecoder(std::move(receiver));
 }
 
 void MediaInterfaceProxy::CreateVideoDecoder(
     media::mojom::VideoDecoderRequest request) {
   DCHECK(thread_checker_.CalledOnValidThread());
-  InterfaceFactory* factory = GetMediaInterfaceFactory();
+  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
   if (factory)
     factory->CreateVideoDecoder(std::move(request));
 }
@@ -157,7 +169,7 @@ void MediaInterfaceProxy::CreateDefaultRenderer(
     media::mojom::RendererRequest request) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
-  InterfaceFactory* factory = GetMediaInterfaceFactory();
+  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
   if (factory)
     factory->CreateDefaultRenderer(audio_device_id, std::move(request));
 }
@@ -168,7 +180,8 @@ void MediaInterfaceProxy::CreateCastRenderer(
     media::mojom::RendererRequest request) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
-  InterfaceFactory* factory = GetMediaInterfaceFactory();
+  // CastRenderer is always hosted in "media_renderer" service.
+  InterfaceFactory* factory = media_renderer_interface_factory_ptr_->Get();
   if (factory)
     factory->CreateCastRenderer(overlay_plane_id, std::move(request));
 }
@@ -181,11 +194,15 @@ void MediaInterfaceProxy::CreateFlingingRenderer(
     media::mojom::RendererRequest request) {
   DCHECK(thread_checker_.CalledOnValidThread());
 
-  media::MojoRendererService::Create(
-      nullptr,
+  std::unique_ptr<FlingingRenderer> flinging_renderer =
       FlingingRenderer::Create(render_frame_host_, presentation_id,
-                               std::move(client_extension)),
-      std::move(request));
+                               std::move(client_extension));
+
+  if (!flinging_renderer)
+    return;
+
+  media::MojoRendererService::Create(nullptr, std::move(flinging_renderer),
+                                     std::move(request));
 }
 
 void MediaInterfaceProxy::CreateMediaPlayerRenderer(
@@ -213,28 +230,32 @@ void MediaInterfaceProxy::CreateCdm(
     const std::string& key_system,
     media::mojom::ContentDecryptionModuleRequest request) {
   DCHECK(thread_checker_.CalledOnValidThread());
-#if !BUILDFLAG(ENABLE_LIBRARY_CDMS)
-  auto* factory = GetMediaInterfaceFactory();
-  if (factory)
-    factory->CreateCdm(key_system, std::move(request));
-#else
+#if BUILDFLAG(ENABLE_LIBRARY_CDMS)
   auto* factory = GetCdmFactory(key_system);
+#elif BUILDFLAG(ENABLE_CAST_RENDERER)
+  // CDM service lives together with renderer service if cast renderer is
+  // enabled, because cast renderer creates its own audio/video decoder.
+  auto* factory = media_renderer_interface_factory_ptr_->Get();
+#else
+  // CDM service lives together with audio/video decoder service.
+  auto* factory = media_interface_factory_ptr_->Get();
+#endif
+
   if (factory)
     factory->CreateCdm(key_system, std::move(request));
-#endif
 }
 
 void MediaInterfaceProxy::CreateDecryptor(
     int cdm_id,
-    media::mojom::DecryptorRequest request) {
-  InterfaceFactory* factory = GetMediaInterfaceFactory();
+    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {
+  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
   if (factory)
-    factory->CreateDecryptor(cdm_id, std::move(request));
+    factory->CreateDecryptor(cdm_id, std::move(receiver));
 }
 
 void MediaInterfaceProxy::CreateCdmProxy(
     const base::Token& cdm_guid,
-    media::mojom::CdmProxyRequest request) {
+    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
   NOTREACHED() << "The CdmProxy should only be created by a CDM.";
 }
 
@@ -280,42 +301,6 @@ MediaInterfaceProxy::GetFrameServices(const base::Token& cdm_guid,
   return interfaces;
 }
 
-media::mojom::InterfaceFactory*
-MediaInterfaceProxy::GetMediaInterfaceFactory() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  if (!interface_factory_ptr_)
-    ConnectToMediaService();
-
-  return interface_factory_ptr_.get();
-}
-
-void MediaInterfaceProxy::ConnectToMediaService() {
-  DVLOG(1) << __func__;
-  DCHECK(!interface_factory_ptr_);
-
-  media::mojom::MediaServicePtr media_service;
-
-  // TODO(slan): Use the BrowserContext Connector instead. See crbug.com/638950.
-  GetSystemConnector()->BindInterface(media::mojom::kMediaServiceName,
-                                      &media_service);
-
-  media_service->CreateInterfaceFactory(
-      MakeRequest(&interface_factory_ptr_),
-      GetFrameServices(base::Token{}, std::string()));
-
-  interface_factory_ptr_.set_connection_error_handler(
-      base::BindOnce(&MediaInterfaceProxy::OnMediaServiceConnectionError,
-                     base::Unretained(this)));
-}
-
-void MediaInterfaceProxy::OnMediaServiceConnectionError() {
-  DVLOG(1) << __func__;
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  interface_factory_ptr_.reset();
-}
-
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
 media::mojom::CdmFactory* MediaInterfaceProxy::GetCdmFactory(
@@ -401,13 +386,13 @@ void MediaInterfaceProxy::OnCdmServiceConnectionError(
 
 void MediaInterfaceProxy::CreateCdmProxyInternal(
     const base::Token& cdm_guid,
-    media::mojom::CdmProxyRequest request) {
+    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
   DVLOG(1) << __func__;
   DCHECK(thread_checker_.CalledOnValidThread());
 
-  InterfaceFactory* factory = GetMediaInterfaceFactory();
+  InterfaceFactory* factory = media_interface_factory_ptr_->Get();
   if (factory)
-    factory->CreateCdmProxy(cdm_guid, std::move(request));
+    factory->CreateCdmProxy(cdm_guid, std::move(receiver));
 }
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 }  // namespace content
diff --git a/chromium/content/browser/media/media_interface_proxy.h b/chromium/content/browser/media/media_interface_proxy.h
index 770f4de760e..0b003eebc14 100644
--- a/chromium/content/browser/media/media_interface_proxy.h
+++ b/chromium/content/browser/media/media_interface_proxy.h
@@ -14,11 +14,13 @@
 #include "base/token.h"
 #include "base/unguessable_token.h"
 #include "build/build_config.h"
+#include "content/browser/media/media_interface_factory_holder.h"
 #include "media/media_buildflags.h"
 #include "media/mojo/buildflags.h"
 #include "media/mojo/mojom/content_decryption_module.mojom.h"
 #include "media/mojo/mojom/interface_factory.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 
 namespace media {
@@ -43,11 +45,12 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
   // called, which could destroy |this|.
   MediaInterfaceProxy(RenderFrameHost* render_frame_host,
                       media::mojom::InterfaceFactoryRequest request,
-                      const base::Closure& error_handler);
+                      base::OnceClosure error_handler);
   ~MediaInterfaceProxy() final;
 
   // media::mojom::InterfaceFactory implementation.
-  void CreateAudioDecoder(media::mojom::AudioDecoderRequest request) final;
+  void CreateAudioDecoder(
+      mojo::PendingReceiver<media::mojom::AudioDecoder> receiver) final;
   void CreateVideoDecoder(media::mojom::VideoDecoderRequest request) final;
   void CreateDefaultRenderer(const std::string& audio_device_id,
                              media::mojom::RendererRequest request) final;
@@ -68,10 +71,12 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
 #endif  // defined(OS_ANDROID)
   void CreateCdm(const std::string& key_system,
                  media::mojom::ContentDecryptionModuleRequest request) final;
-  void CreateDecryptor(int cdm_id,
-                       media::mojom::DecryptorRequest request) final;
-  void CreateCdmProxy(const base::Token& cdm_guid,
-                      media::mojom::CdmProxyRequest request) final;
+  void CreateDecryptor(
+      int cdm_id,
+      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
+  void CreateCdmProxy(
+      const base::Token& cdm_guid,
+      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
 
  private:
   // Gets services provided by the browser (at RenderFrameHost level) to the
@@ -81,15 +86,6 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
       const base::Token& cdm_guid,
       const std::string& cdm_file_system_id);
 
-  // Gets the MediaService |interface_factory_ptr_|. Returns null if unexpected
-  // error happened.
-  InterfaceFactory* GetMediaInterfaceFactory();
-
-  void ConnectToMediaService();
-
-  // Callback for connection error from |interface_factory_ptr_|.
-  void OnMediaServiceConnectionError();
-
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
   // Gets a CdmFactory pointer for |key_system|. Returns null if unexpected
   // error happened.
@@ -112,8 +108,9 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
   // Creates a CdmProxy for the CDM in CdmService. Not implemented in
   // CreateCdmProxy() because we don't want any client to be able to create
   // a CdmProxy.
-  void CreateCdmProxyInternal(const base::Token& cdm_guid,
-                              media::mojom::CdmProxyRequest request);
+  void CreateCdmProxyInternal(
+      const base::Token& cdm_guid,
+      mojo::PendingReceiver<media::mojom::CdmProxy> receiver);
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
   // Safe to hold a raw pointer since |this| is owned by RenderFrameHostImpl.
@@ -130,7 +127,16 @@ class MediaInterfaceProxy : public media::mojom::InterfaceFactory {
   // in the service named kMediaServiceName hosted in the process specified by
   // the "mojo_media_host" gn argument. Available options are browser, GPU and
   // utility processes.
-  media::mojom::InterfaceFactoryPtr interface_factory_ptr_;
+  std::unique_ptr<MediaInterfaceFactoryHolder> media_interface_factory_ptr_;
+
+#if BUILDFLAG(ENABLE_CAST_RENDERER)
+  // InterfacePtr to the remote InterfaceFactory implementation
+  // in the service named kMediaRendererServiceName hosted. It provides the
+  // remote implementation of media::Renderer and
+  // media::ContentDecryptionModule.
+  std::unique_ptr<MediaInterfaceFactoryHolder>
+      media_renderer_interface_factory_ptr_;
+#endif  // BUILDFLAG(ENABLE_CAST_RENDERER)
 
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
   // CDM GUID to CDM InterfaceFactoryPtr mapping, where the InterfaceFactory
diff --git a/chromium/content/browser/media/media_internals.cc b/chromium/content/browser/media/media_internals.cc
index f1895dd5abe..3f72dbd1819 100644
--- a/chromium/content/browser/media/media_internals.cc
+++ b/chromium/content/browser/media/media_internals.cc
@@ -41,6 +41,7 @@
 #include "media/webrtc/webrtc_switches.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "services/service_manager/sandbox/features.h"
+#include "services/service_manager/sandbox/sandbox_type.h"
 
 #if !defined(OS_ANDROID)
 #include "media/filters/decrypting_video_decoder.h"
@@ -429,6 +430,11 @@ void MediaInternals::SendGeneralAudioInformation() {
                                                           : "Disabled"));
   };
 
+  auto set_explicit_feature_data = [&](auto& feature, bool feature_value) {
+    audio_info_data.SetKey(feature.name,
+                           base::Value(feature_value ? "Enabled" : "Disabled"));
+  };
+
   set_feature_data(features::kAudioServiceAudioStreams);
   set_feature_data(features::kAudioServiceOutOfProcess);
 
@@ -448,8 +454,10 @@ void MediaInternals::SendGeneralAudioInformation() {
                          base::Value(feature_value_string));
 
   set_feature_data(features::kAudioServiceLaunchOnStartup);
-  set_feature_data(service_manager::features::kAudioServiceSandbox);
-  set_feature_data(features::kWebRtcApmInAudioService);
+  set_explicit_feature_data(service_manager::features::kAudioServiceSandbox,
+                            service_manager::IsAudioSandboxEnabled());
+  set_explicit_feature_data(features::kWebRtcApmInAudioService,
+                            media::IsWebRtcApmInAudioServiceEnabled());
 
   base::string16 audio_info_update =
       SerializeUpdate("media.updateGeneralAudioInformation", &audio_info_data);
diff --git a/chromium/content/browser/media/media_internals_audio_focus_helper.cc b/chromium/content/browser/media/media_internals_audio_focus_helper.cc
index 7ba13c00ef1..24f4a90c67c 100644
--- a/chromium/content/browser/media/media_internals_audio_focus_helper.cc
+++ b/chromium/content/browser/media/media_internals_audio_focus_helper.cc
@@ -60,7 +60,7 @@ void MediaInternalsAudioFocusHelper::SendAudioFocusState() {
     return;
 
   // Get the audio focus state from the media session service.
-  audio_focus_ptr_->GetFocusRequests(base::BindOnce(
+  audio_focus_->GetFocusRequests(base::BindOnce(
       &MediaInternalsAudioFocusHelper::DidGetAudioFocusRequestList,
       base::Unretained(this)));
 }
@@ -93,8 +93,8 @@ void MediaInternalsAudioFocusHelper::SetEnabled(bool enabled) {
   EnsureServiceConnection();
 
   if (!enabled) {
-    audio_focus_ptr_.reset();
-    audio_focus_debug_ptr_.reset();
+    audio_focus_.reset();
+    audio_focus_debug_.reset();
     receiver_.reset();
   }
 }
@@ -111,25 +111,25 @@ bool MediaInternalsAudioFocusHelper::EnsureServiceConnection() {
     return false;
 
   // Connect to the media session service.
-  if (!audio_focus_ptr_.is_bound()) {
-    connector->BindInterface(media_session::mojom::kServiceName,
-                             mojo::MakeRequest(&audio_focus_ptr_));
-    audio_focus_ptr_.set_connection_error_handler(base::BindRepeating(
+  if (!audio_focus_.is_bound()) {
+    connector->Connect(media_session::mojom::kServiceName,
+                       audio_focus_.BindNewPipeAndPassReceiver());
+    audio_focus_.set_disconnect_handler(base::BindRepeating(
         &MediaInternalsAudioFocusHelper::OnMojoError, base::Unretained(this)));
   }
 
   // Connect to the media session service debug interface.
-  if (!audio_focus_debug_ptr_.is_bound()) {
-    connector->BindInterface(media_session::mojom::kServiceName,
-                             mojo::MakeRequest(&audio_focus_debug_ptr_));
-    audio_focus_debug_ptr_.set_connection_error_handler(
+  if (!audio_focus_debug_.is_bound()) {
+    connector->Connect(media_session::mojom::kServiceName,
+                       audio_focus_debug_.BindNewPipeAndPassReceiver());
+    audio_focus_debug_.set_disconnect_handler(
         base::BindRepeating(&MediaInternalsAudioFocusHelper::OnDebugMojoError,
                             base::Unretained(this)));
   }
 
   // Add the observer to receive audio focus events.
   if (!receiver_.is_bound()) {
-    audio_focus_ptr_->AddObserver(receiver_.BindNewPipeAndPassRemote());
+    audio_focus_->AddObserver(receiver_.BindNewPipeAndPassRemote());
 
     receiver_.set_disconnect_handler(base::BindRepeating(
         &MediaInternalsAudioFocusHelper::OnMojoError, base::Unretained(this)));
@@ -139,12 +139,12 @@ bool MediaInternalsAudioFocusHelper::EnsureServiceConnection() {
 }
 
 void MediaInternalsAudioFocusHelper::OnMojoError() {
-  audio_focus_ptr_.reset();
+  audio_focus_.reset();
   receiver_.reset();
 }
 
 void MediaInternalsAudioFocusHelper::OnDebugMojoError() {
-  audio_focus_debug_ptr_.reset();
+  audio_focus_debug_.reset();
 }
 
 void MediaInternalsAudioFocusHelper::DidGetAudioFocusRequestList(
@@ -167,11 +167,11 @@ void MediaInternalsAudioFocusHelper::DidGetAudioFocusRequestList(
     std::string id_string = session->request_id.value().ToString();
     base::DictionaryValue media_session_data;
     media_session_data.SetKey(kAudioFocusIdKey, base::Value(id_string));
-    stack_data.GetList().push_back(std::move(media_session_data));
+    stack_data.Append(std::move(media_session_data));
 
     request_state_.emplace(id_string, session.Clone());
 
-    audio_focus_debug_ptr_->GetDebugInfoForRequest(
+    audio_focus_debug_->GetDebugInfoForRequest(
         session->request_id.value(),
         base::BindOnce(
             &MediaInternalsAudioFocusHelper::DidGetAudioFocusDebugInfo,
diff --git a/chromium/content/browser/media/media_internals_audio_focus_helper.h b/chromium/content/browser/media/media_internals_audio_focus_helper.h
index 9d3d461f3d6..2863eda8776 100644
--- a/chromium/content/browser/media/media_internals_audio_focus_helper.h
+++ b/chromium/content/browser/media/media_internals_audio_focus_helper.h
@@ -8,7 +8,9 @@
 #include <map>
 
 #include "base/macros.h"
+#include "base/values.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/mojom/audio_focus.mojom.h"
 
 namespace content {
@@ -61,9 +63,9 @@ class MediaInternalsAudioFocusHelper
       const media_session::mojom::AudioFocusRequestStatePtr& state,
       const std::string& provided_state) const;
 
-  // Holds a pointer to the media session service and it's debug interface.
-  media_session::mojom::AudioFocusManagerPtr audio_focus_ptr_;
-  media_session::mojom::AudioFocusManagerDebugPtr audio_focus_debug_ptr_;
+  // Holds a remote to the media session service and it's debug interface.
+  mojo::Remote<media_session::mojom::AudioFocusManager> audio_focus_;
+  mojo::Remote<media_session::mojom::AudioFocusManagerDebug> audio_focus_debug_;
 
   // Must only be accessed on the UI thread.
   base::DictionaryValue audio_focus_data_;
diff --git a/chromium/content/browser/media/media_internals_ui.cc b/chromium/content/browser/media/media_internals_ui.cc
index 7de27afacbc..f3e1eefcca5 100644
--- a/chromium/content/browser/media/media_internals_ui.cc
+++ b/chromium/content/browser/media/media_internals_ui.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/web_ui_data_source.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
+#include "media/base/media_switches.h"
 
 namespace content {
 namespace {
@@ -22,7 +23,13 @@ WebUIDataSource* CreateMediaInternalsHTMLSource() {
 
   source->UseStringsJs();
 
-  source->AddResourcePath("media_internals.js", IDR_MEDIA_INTERNALS_JS);
+  if (base::FeatureList::IsEnabled(media::kMediaInspectorLogging)) {
+    source->AddResourcePath("media_internals.js",
+                            IDR_MEDIA_INTERNALS_JS_DISABLED);
+  } else {
+    source->AddResourcePath("media_internals.js", IDR_MEDIA_INTERNALS_JS);
+  }
+
   source->SetDefaultResource(IDR_MEDIA_INTERNALS_HTML);
   return source;
 }
diff --git a/chromium/content/browser/media/media_internals_unittest.cc b/chromium/content/browser/media/media_internals_unittest.cc
index bedb044e5a3..7cb93a4a33c 100644
--- a/chromium/content/browser/media/media_internals_unittest.cc
+++ b/chromium/content/browser/media/media_internals_unittest.cc
@@ -25,6 +25,7 @@
 #include "media/base/channel_layout.h"
 #include "media/base/media_log.h"
 #include "media/base/media_switches.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/cpp/features.h"
 #include "services/media_session/public/mojom/audio_focus.mojom.h"
 #include "services/media_session/public/mojom/constants.mojom.h"
@@ -341,8 +342,9 @@ class MediaInternalsAudioFocusTest : public RenderViewHostTestHarness,
                             base::Unretained(this));
     run_loop_ = std::make_unique<base::RunLoop>();
 
-    content::GetSystemConnector()->BindInterface(
-        media_session::mojom::kServiceName, &audio_focus_ptr_);
+    content::GetSystemConnector()->Connect(
+        media_session::mojom::kServiceName,
+        audio_focus_.BindNewPipeAndPassReceiver());
 
     content::MediaInternals::GetInstance()->AddUpdateCallback(update_cb_);
   }
@@ -404,14 +406,14 @@ class MediaInternalsAudioFocusTest : public RenderViewHostTestHarness,
   std::string GetRequestIdForTopFocusRequest() {
     std::string result;
 
-    audio_focus_ptr_->GetFocusRequests(base::BindOnce(
+    audio_focus_->GetFocusRequests(base::BindOnce(
         [](std::string* out, std::vector<AudioFocusRequestStatePtr> requests) {
           DCHECK(!requests.empty());
           *out = requests.back()->request_id.value().ToString();
         },
         &result));
 
-    audio_focus_ptr_.FlushForTesting();
+    audio_focus_.FlushForTesting();
     return result;
   }
 
@@ -424,7 +426,7 @@ class MediaInternalsAudioFocusTest : public RenderViewHostTestHarness,
   base::Lock lock_;
   std::unique_ptr<base::RunLoop> run_loop_;
 
-  media_session::mojom::AudioFocusManagerPtr audio_focus_ptr_;
+  mojo::Remote<media_session::mojom::AudioFocusManager> audio_focus_;
 };
 
 TEST_F(MediaInternalsAudioFocusTest, AudioFocusStateIsUpdated) {
diff --git a/chromium/content/browser/media/media_web_contents_observer.cc b/chromium/content/browser/media/media_web_contents_observer.cc
index 6f253c598df..a4b94b2c3cd 100644
--- a/chromium/content/browser/media/media_web_contents_observer.cc
+++ b/chromium/content/browser/media/media_web_contents_observer.cc
@@ -220,6 +220,9 @@ void MediaWebContentsObserver::OnMediaPlaying(
   if (is_remote)
     return;
 
+  BackForwardCache::DisableForRenderFrameHost(
+      render_frame_host, "MediaWebContentsObserver::OnMediaPlaying");
+
   const MediaPlayerId id(render_frame_host, delegate_id);
   if (has_audio)
     AddMediaPlayerEntry(id, &active_audio_players_);
diff --git a/chromium/content/browser/media/midi_host.cc b/chromium/content/browser/media/midi_host.cc
index 34997ce0afc..94b363fe1a0 100644
--- a/chromium/content/browser/media/midi_host.cc
+++ b/chromium/content/browser/media/midi_host.cc
@@ -17,7 +17,7 @@
 #include "media/midi/message_util.h"
 #include "media/midi/midi_message_queue.h"
 #include "media/midi/midi_service.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
 namespace {
@@ -59,13 +59,14 @@ MidiHost::~MidiHost() {
 }
 
 // static
-void MidiHost::BindRequest(int render_process_id,
-                           midi::MidiService* midi_service,
-                           midi::mojom::MidiSessionProviderRequest request) {
+void MidiHost::BindReceiver(
+    int render_process_id,
+    midi::MidiService* midi_service,
+    mojo::PendingReceiver<midi::mojom::MidiSessionProvider> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  mojo::MakeStrongBinding(
+  mojo::MakeSelfOwnedReceiver(
       base::WrapUnique(new MidiHost(render_process_id, midi_service)),
-      std::move(request));
+      std::move(receiver));
 }
 
 void MidiHost::CompleteStartSession(Result result) {
diff --git a/chromium/content/browser/media/midi_host.h b/chromium/content/browser/media/midi_host.h
index abb3006514a..d9c5fef67e4 100644
--- a/chromium/content/browser/media/midi_host.h
+++ b/chromium/content/browser/media/midi_host.h
@@ -43,11 +43,12 @@ class CONTENT_EXPORT MidiHost : public midi::MidiManagerClient,
  public:
   ~MidiHost() override;
 
-  // Creates an instance of MidiHost and binds |request| to the instance using
-  // a strong binding. Should be called on the IO thread.
-  static void BindRequest(int render_process_id,
-                          midi::MidiService* midi_service,
-                          midi::mojom::MidiSessionProviderRequest request);
+  // Creates an instance of MidiHost and binds |receiver| to the instance using
+  // a self owned receiver. Should be called on the IO thread.
+  static void BindReceiver(
+      int render_process_id,
+      midi::MidiService* midi_service,
+      mojo::PendingReceiver<midi::mojom::MidiSessionProvider> receiver);
 
   // MidiManagerClient implementation. These methods can be called on any thread
   // by platform specific implementations of MidiManager, so use locks
diff --git a/chromium/content/browser/media/midi_host_unittest.cc b/chromium/content/browser/media/midi_host_unittest.cc
index f63d5f70c67..629672002e4 100644
--- a/chromium/content/browser/media/midi_host_unittest.cc
+++ b/chromium/content/browser/media/midi_host_unittest.cc
@@ -18,8 +18,8 @@
 #include "media/midi/midi_service.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
@@ -137,9 +137,8 @@ class MidiHostTest : public testing::Test {
     mojo::PendingRemote<midi::mojom::MidiSessionClient> client_remote;
     mojo::MakeSelfOwnedReceiver(std::make_unique<MidiSessionClientForTesting>(),
                                 client_remote.InitWithNewPipeAndPassReceiver());
-    midi::mojom::MidiSessionRequest session_request =
-        mojo::MakeRequest(&session_);
-    host_->StartSession(std::move(session_request), std::move(client_remote));
+    host_->StartSession(session_.BindNewPipeAndPassReceiver(),
+                        std::move(client_remote));
   }
   ~MidiHostTest() override {
     session_.reset();
@@ -195,7 +194,7 @@ class MidiHostTest : public testing::Test {
   base::WeakPtr<FakeMidiManagerFactory> factory_;
   std::unique_ptr<midi::MidiService> service_;
   std::unique_ptr<MidiHostForTesting> host_;
-  midi::mojom::MidiSessionPtr session_;
+  mojo::Remote<midi::mojom::MidiSession> session_;
 
   DISALLOW_COPY_AND_ASSIGN(MidiHostTest);
 };
diff --git a/chromium/content/browser/media/mpris_notifier.cc b/chromium/content/browser/media/mpris_notifier.cc
index 0839cdd8fae..3b34a30a06f 100644
--- a/chromium/content/browser/media/mpris_notifier.cc
+++ b/chromium/content/browser/media/mpris_notifier.cc
@@ -35,11 +35,11 @@ void MprisNotifier::Initialize() {
   connector_->BindInterface(media_session::mojom::kServiceName,
                             mojo::MakeRequest(&controller_manager_ptr));
   controller_manager_ptr->CreateActiveMediaController(
-      mojo::MakeRequest(&media_controller_ptr_));
+      media_controller_.BindNewPipeAndPassReceiver());
 
   // Observe the active media controller for changes to playback state and
   // supported actions.
-  media_controller_ptr_->AddObserver(
+  media_controller_->AddObserver(
       media_controller_observer_receiver_.BindNewPipeAndPassRemote());
 }
 
diff --git a/chromium/content/browser/media/mpris_notifier.h b/chromium/content/browser/media/mpris_notifier.h
index 8813ed1062a..9610800e024 100644
--- a/chromium/content/browser/media/mpris_notifier.h
+++ b/chromium/content/browser/media/mpris_notifier.h
@@ -10,6 +10,7 @@
 
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/mojom/media_controller.mojom.h"
 
 namespace mpris {
@@ -61,7 +62,7 @@ class CONTENT_EXPORT MprisNotifier
   service_manager::Connector* connector_;
 
   // Tracks current media session state/metadata.
-  media_session::mojom::MediaControllerPtr media_controller_ptr_;
+  mojo::Remote<media_session::mojom::MediaController> media_controller_;
   media_session::mojom::MediaSessionInfoPtr session_info_;
 
   // Used to receive updates to the active media controller.
diff --git a/chromium/content/browser/media/now_playing_info_center_notifier.cc b/chromium/content/browser/media/now_playing_info_center_notifier.cc
index e586a4d8c15..25fc859e4c1 100644
--- a/chromium/content/browser/media/now_playing_info_center_notifier.cc
+++ b/chromium/content/browser/media/now_playing_info_center_notifier.cc
@@ -30,11 +30,11 @@ NowPlayingInfoCenterNotifier::NowPlayingInfoCenterNotifier(
   connector->BindInterface(media_session::mojom::kServiceName,
                            mojo::MakeRequest(&controller_manager_ptr));
   controller_manager_ptr->CreateActiveMediaController(
-      mojo::MakeRequest(&media_controller_ptr_));
+      media_controller_.BindNewPipeAndPassReceiver());
 
   // Observe the active media controller for changes to playback state and
   // supported actions.
-  media_controller_ptr_->AddObserver(
+  media_controller_->AddObserver(
       media_controller_observer_receiver_.BindNewPipeAndPassRemote());
 }
 
diff --git a/chromium/content/browser/media/now_playing_info_center_notifier.h b/chromium/content/browser/media/now_playing_info_center_notifier.h
index 9eb9d7e176b..9189e870ede 100644
--- a/chromium/content/browser/media/now_playing_info_center_notifier.h
+++ b/chromium/content/browser/media/now_playing_info_center_notifier.h
@@ -10,6 +10,7 @@
 
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/mojom/media_controller.mojom.h"
 
 namespace now_playing {
@@ -54,7 +55,7 @@ class CONTENT_EXPORT NowPlayingInfoCenterNotifier
       now_playing_info_center_delegate_;
 
   // Tracks current media session state/metadata.
-  media_session::mojom::MediaControllerPtr media_controller_ptr_;
+  mojo::Remote<media_session::mojom::MediaController> media_controller_;
   media_session::mojom::MediaSessionInfoPtr session_info_;
 
   // Used to receive updates to the active media controller.
diff --git a/chromium/content/browser/media/session/audio_focus_delegate_default.cc b/chromium/content/browser/media/session/audio_focus_delegate_default.cc
index 516c47547bd..9dbb2f0985f 100644
--- a/chromium/content/browser/media/session/audio_focus_delegate_default.cc
+++ b/chromium/content/browser/media/session/audio_focus_delegate_default.cc
@@ -12,6 +12,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/system_connector.h"
 #include "media/base/media_switches.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/cpp/features.h"
 #include "services/media_session/public/mojom/audio_focus.mojom.h"
 #include "services/media_session/public/mojom/constants.mojom.h"
@@ -60,14 +61,14 @@ class AudioFocusDelegateDefault : public AudioFocusDelegate {
   // Finishes an async audio focus request.
   void FinishAudioFocusRequest(AudioFocusType type, bool success);
 
-  // Ensures that |audio_focus_ptr_| is connected.
+  // Ensures that |audio_focus_| is connected.
   void EnsureServiceConnection();
 
   // Holds the latest MediaSessionInfo for |media_session_|.
   media_session::mojom::MediaSessionInfoPtr session_info_;
 
-  // Holds a pointer to the Media Session service.
-  media_session::mojom::AudioFocusManagerPtr audio_focus_ptr_;
+  // Holds a remote to the Media Session service.
+  mojo::Remote<media_session::mojom::AudioFocusManager> audio_focus_;
 
   // If the media session has acquired audio focus then this will contain a
   // pointer to that requests AudioFocusRequestClient.
@@ -118,7 +119,7 @@ AudioFocusDelegateDefault::RequestAudioFocus(AudioFocusType audio_focus_type) {
     mojo::PendingRemote<media_session::mojom::MediaSession> media_session =
         media_session_->AddRemote();
 
-    audio_focus_ptr_->RequestGroupedAudioFocus(
+    audio_focus_->RequestGroupedAudioFocus(
         request_id_, request_client_remote_.BindNewPipeAndPassReceiver(),
         std::move(media_session), session_info_.Clone(), audio_focus_type,
         GetAudioFocusGroupId(media_session_),
@@ -140,7 +141,7 @@ void AudioFocusDelegateDefault::AbandonAudioFocus() {
 
   request_client_remote_->AbandonAudioFocus();
   request_client_remote_.reset();
-  audio_focus_ptr_.reset();
+  audio_focus_.reset();
 }
 
 base::Optional<media_session::mojom::AudioFocusType>
@@ -176,19 +177,18 @@ void AudioFocusDelegateDefault::EnsureServiceConnection() {
     return;
   }
 
-  if (audio_focus_ptr_.is_bound() && !audio_focus_ptr_.encountered_error())
+  if (audio_focus_.is_bound() && audio_focus_.is_connected())
     return;
 
-  audio_focus_ptr_.reset();
+  audio_focus_.reset();
 
-  // Connect to the Media Session service and bind |audio_focus_ptr_| to it.
-  GetSystemConnector()->BindInterface(media_session::mojom::kServiceName,
-                                      mojo::MakeRequest(&audio_focus_ptr_));
+  // Connect to the Media Session service and bind |audio_focus_| to it.
+  GetSystemConnector()->Connect(media_session::mojom::kServiceName,
+                                audio_focus_.BindNewPipeAndPassReceiver());
 
   // We associate all media sessions with the browser context so we can filter
   // by browser context in the UI.
-  audio_focus_ptr_->SetSource(media_session_->GetSourceId(),
-                              kAudioFocusSourceName);
+  audio_focus_->SetSource(media_session_->GetSourceId(), kAudioFocusSourceName);
 }
 
 // static
diff --git a/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc b/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc
index 4dc34260ebf..c75b8b4c391 100644
--- a/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc
+++ b/chromium/content/browser/media/session/audio_focus_delegate_default_browsertest.cc
@@ -14,6 +14,7 @@
 #include "content/shell/browser/shell.h"
 #include "media/base/media_content_type.h"
 #include "media/base/media_switches.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/cpp/features.h"
 #include "services/media_session/public/cpp/test/audio_focus_test_util.h"
 #include "services/media_session/public/cpp/test/mock_media_session.h"
@@ -36,8 +37,8 @@ class AudioFocusDelegateDefaultBrowserTest : public ContentBrowserTest {
   void SetUpOnMainThread() override {
     ContentBrowserTest::SetUpOnMainThread();
 
-    GetSystemConnector()->BindInterface(media_session::mojom::kServiceName,
-                                        mojo::MakeRequest(&audio_focus_ptr_));
+    GetSystemConnector()->Connect(media_session::mojom::kServiceName,
+                                  audio_focus_.BindNewPipeAndPassReceiver());
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
@@ -48,14 +49,14 @@ class AudioFocusDelegateDefaultBrowserTest : public ContentBrowserTest {
   }
 
   void CheckSessionSourceName() {
-    audio_focus_ptr_->GetFocusRequests(base::BindOnce(
+    audio_focus_->GetFocusRequests(base::BindOnce(
         [](std::vector<media_session::mojom::AudioFocusRequestStatePtr>
                requests) {
           for (auto& request : requests)
             EXPECT_EQ(kExpectedSourceName, request->source_name.value());
         }));
 
-    audio_focus_ptr_.FlushForTesting();
+    audio_focus_.FlushForTesting();
   }
 
   void Run(WebContents* start_contents,
@@ -155,12 +156,12 @@ class AudioFocusDelegateDefaultBrowserTest : public ContentBrowserTest {
   std::unique_ptr<TestAudioFocusObserver> CreateObserver() {
     std::unique_ptr<TestAudioFocusObserver> observer =
         std::make_unique<TestAudioFocusObserver>();
-    audio_focus_ptr_->AddObserver(observer->BindNewPipeAndPassRemote());
-    audio_focus_ptr_.FlushForTesting();
+    audio_focus_->AddObserver(observer->BindNewPipeAndPassRemote());
+    audio_focus_.FlushForTesting();
     return observer;
   }
 
-  media_session::mojom::AudioFocusManagerPtr audio_focus_ptr_;
+  mojo::Remote<media_session::mojom::AudioFocusManager> audio_focus_;
 
   base::test::ScopedFeatureList scoped_feature_list_;
 };
diff --git a/chromium/content/browser/media/session/media_session_browsertest.cc b/chromium/content/browser/media/session/media_session_browsertest.cc
index e96e187270b..d5376cb1725 100644
--- a/chromium/content/browser/media/session/media_session_browsertest.cc
+++ b/chromium/content/browser/media/session/media_session_browsertest.cc
@@ -12,14 +12,19 @@
 #include "base/synchronization/lock.h"
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_features.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/media_start_stop_observer.h"
+#include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "media/base/media_switches.h"
+#include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "services/media_session/public/cpp/features.h"
 #include "services/media_session/public/cpp/test/audio_focus_test_util.h"
@@ -70,11 +75,11 @@ class MediaImageGetterHelper {
 // Integration tests for content::MediaSession that do not take into
 // consideration the implementation details contrary to
 // MediaSessionImplBrowserTest.
-class MediaSessionBrowserTest : public ContentBrowserTest {
+class MediaSessionBrowserTestBase : public ContentBrowserTest {
  public:
-  MediaSessionBrowserTest() {
+  MediaSessionBrowserTestBase() {
     embedded_test_server()->RegisterRequestMonitor(base::BindRepeating(
-        &MediaSessionBrowserTest::OnServerRequest, base::Unretained(this)));
+        &MediaSessionBrowserTestBase::OnServerRequest, base::Unretained(this)));
   }
 
   void SetUp() override {
@@ -86,14 +91,6 @@ class MediaSessionBrowserTest : public ContentBrowserTest {
     command_line->AppendSwitchASCII(
         switches::kAutoplayPolicy,
         switches::autoplay::kNoUserGestureRequiredPolicy);
-
-    scoped_feature_list_.InitAndEnableFeature(media::kInternalMediaSession);
-  }
-
-  void DisableInternalMediaSession() {
-    disabled_feature_list_.InitWithFeatures(
-        {}, {media::kInternalMediaSession,
-             media_session::features::kMediaSessionService});
   }
 
   void StartPlaybackAndWait(Shell* shell, const std::string& id) {
@@ -169,40 +166,6 @@ class MediaSessionBrowserTest : public ContentBrowserTest {
   }
 
  private:
-  class MediaStartStopObserver : public WebContentsObserver {
-   public:
-    enum class Type { kStart, kStop };
-
-    MediaStartStopObserver(WebContents* web_contents, Type type)
-        : WebContentsObserver(web_contents), type_(type) {}
-
-    void MediaStartedPlaying(const MediaPlayerInfo& info,
-                             const MediaPlayerId& id) override {
-      if (type_ != Type::kStart)
-        return;
-
-      run_loop_.Quit();
-    }
-
-    void MediaStoppedPlaying(
-        const MediaPlayerInfo& info,
-        const MediaPlayerId& id,
-        WebContentsObserver::MediaStoppedReason reason) override {
-      if (type_ != Type::kStop)
-        return;
-
-      run_loop_.Quit();
-    }
-
-    void Wait() { run_loop_.Run(); }
-
-   private:
-    base::RunLoop run_loop_;
-    Type type_;
-
-    DISALLOW_COPY_AND_ASSIGN(MediaStartStopObserver);
-  };
-
   void OnServerRequest(const net::test_server::HttpRequest& request) {
     // Note this method is called on the EmbeddedTestServer's background thread.
     base::AutoLock lock(visited_urls_lock_);
@@ -215,17 +178,57 @@ class MediaSessionBrowserTest : public ContentBrowserTest {
   base::Lock visited_urls_lock_;
   std::set<GURL> visited_urls_;
 
-  base::test::ScopedFeatureList scoped_feature_list_;
+  DISALLOW_COPY_AND_ASSIGN(MediaSessionBrowserTestBase);
+};
+
+class MediaSessionBrowserTest : public MediaSessionBrowserTestBase {
+ public:
+  MediaSessionBrowserTest() {
+    feature_list_.InitAndEnableFeature(media::kInternalMediaSession);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+class MediaSessionBrowserTestWithoutInternalMediaSession
+    : public MediaSessionBrowserTestBase {
+ public:
+  MediaSessionBrowserTestWithoutInternalMediaSession() {
+    disabled_feature_list_.InitWithFeatures(
+        {}, {media::kInternalMediaSession,
+             media_session::features::kMediaSessionService});
+  }
+
+ private:
   base::test::ScopedFeatureList disabled_feature_list_;
+};
+
+// A MediaSessionBrowserTest with BackForwardCache enabled.
+class MediaSessionBrowserTestWithBackForwardCache
+    : public MediaSessionBrowserTestBase {
+ public:
+  MediaSessionBrowserTestWithBackForwardCache() {
+    feature_list_.InitWithFeaturesAndParameters(
+        {{features::kBackForwardCache,
+          {{"TimeToLiveInBackForwardCacheInSeconds", "3600"}}},
+         {media::kInternalMediaSession, {}}},
+        /*disabled_features=*/{});
+  }
+
+  void SetUpOnMainThread() override {
+    host_resolver()->AddRule("*", "127.0.0.1");
+    MediaSessionBrowserTestBase::SetUpOnMainThread();
+  }
 
-  DISALLOW_COPY_AND_ASSIGN(MediaSessionBrowserTest);
+ private:
+  base::test::ScopedFeatureList feature_list_;
 };
 
 }  // anonymous namespace
 
-IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTest, MediaSessionNoOpWhenDisabled) {
-  DisableInternalMediaSession();
-
+IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTestWithoutInternalMediaSession,
+                       MediaSessionNoOpWhenDisabled) {
   EXPECT_TRUE(NavigateToURL(shell(),
                             GetTestUrl("media/session", "media-session.html")));
 
@@ -428,4 +431,43 @@ IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTest,
   EXPECT_FALSE(WasURLVisited(image.src));
 }
 
+IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTestWithBackForwardCache,
+                       DoNotCacheIfMediaSessionExists) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // 1) Navigate to a page containing media.
+  EXPECT_TRUE(NavigateToURL(shell(),
+                            GetTestUrl("media/session", "media-session.html")));
+
+  RenderFrameHost* rfh_a = shell()->web_contents()->GetMainFrame();
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Navigate away.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
+
+  // The page should not have been cached in the back forward cache.
+  delete_observer_rfh_a.WaitUntilDeleted();
+}
+
+IN_PROC_BROWSER_TEST_F(MediaSessionBrowserTestWithBackForwardCache,
+                       CachesPageWithoutMedia) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  // 1) Navigate to a page not containing any media.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
+
+  RenderFrameHostImpl* rfh_a = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+  RenderFrameDeletedObserver delete_observer_rfh_a(rfh_a);
+
+  // 2) Navigate away.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
+
+  // The page should be cached in the back forward cache.
+  EXPECT_FALSE(delete_observer_rfh_a.deleted());
+  EXPECT_TRUE(rfh_a->is_in_back_forward_cache());
+}
 }  // namespace content
diff --git a/chromium/content/browser/media/session/media_session_impl.cc b/chromium/content/browser/media/session/media_session_impl.cc
index 2243edf343c..2bfe8db7a5b 100644
--- a/chromium/content/browser/media/session/media_session_impl.cc
+++ b/chromium/content/browser/media/session/media_session_impl.cc
@@ -13,14 +13,14 @@
 #include "base/strings/string_util.h"
 #include "base/timer/timer.h"
 #include "build/build_config.h"
-#include "components/url_formatter/elide_url.h"
-#include "content/app/strings/grit/content_strings.h"
+#include "components/url_formatter/url_formatter.h"
 #include "content/browser/media/session/audio_focus_delegate.h"
 #include "content/browser/media/session/media_session_controller.h"
 #include "content/browser/media/session/media_session_player_observer.h"
 #include "content/browser/media/session/media_session_service_impl.h"
 #include "content/browser/picture_in_picture/picture_in_picture_window_controller_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/media_session.h"
 #include "content/public/browser/navigation_handle.h"
@@ -30,6 +30,7 @@
 #include "media/base/media_content_type.h"
 #include "services/media_session/public/cpp/media_image_manager.h"
 #include "services/media_session/public/mojom/audio_focus.mojom.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "ui/gfx/favicon_size.h"
 
 #if defined(OS_ANDROID)
@@ -1123,6 +1124,9 @@ void MediaSessionImpl::OnServiceCreated(MediaSessionServiceImpl* service) {
   if (!rfh)
     return;
 
+  content::BackForwardCache::DisableForRenderFrameHost(
+      rfh, "MediaSessionImpl::OnServiceCreated");
+
   services_[rfh] = service;
   UpdateRoutedService();
 }
@@ -1340,8 +1344,12 @@ void MediaSessionImpl::RebuildAndNotifyMetadataChanged() {
   base::string16 formatted_origin =
       url.SchemeIsFile()
           ? content_client->GetLocalizedString(IDS_MEDIA_SESSION_FILE_SOURCE)
-          : url_formatter::FormatOriginForSecurityDisplay(
-                url::Origin::Create(url));
+          : url_formatter::FormatUrl(
+                url::Origin::Create(url).GetURL(),
+                url_formatter::kFormatUrlOmitDefaults |
+                    url_formatter::kFormatUrlOmitHTTPS |
+                    url_formatter::kFormatUrlOmitTrivialSubdomains,
+                net::UnescapeRule::SPACES, nullptr, nullptr, nullptr);
   metadata.source_title = formatted_origin;
 
   // If we have no artwork in |images_| or the arwork has changed then we should
diff --git a/chromium/content/browser/media/session/media_session_impl_browsertest.cc b/chromium/content/browser/media/session/media_session_impl_browsertest.cc
index cdb48b2789c..b060f83c4a6 100644
--- a/chromium/content/browser/media/session/media_session_impl_browsertest.cc
+++ b/chromium/content/browser/media/session/media_session_impl_browsertest.cc
@@ -16,6 +16,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/simple_test_tick_clock.h"
+#include "build/build_config.h"
 #include "content/browser/media/session/audio_focus_delegate.h"
 #include "content/browser/media/session/mock_media_session_player_observer.h"
 #include "content/browser/media/session/mock_media_session_service_impl.h"
@@ -266,9 +267,11 @@ class MediaSessionImplBrowserTest : public content::ContentBrowserTest {
   bool IsDucking() const { return media_session_->is_ducking_; }
 
   base::string16 GetExpectedSourceTitle() {
-    return base::StrCat(
-        {kExpectedSourceTitlePrefix,
-         base::NumberToString16(embedded_test_server()->port())});
+    base::string16 expected_title =
+        base::StrCat({kExpectedSourceTitlePrefix,
+                      base::NumberToString16(embedded_test_server()->port())});
+
+    return expected_title.substr(strlen("http://"));
   }
 
  protected:
@@ -2702,7 +2705,7 @@ IN_PROC_BROWSER_TEST_F(MediaSessionImplBrowserTest,
   }
 }
 
-#if defined(OS_CHROMEOS)
+#if defined(OS_CHROMEOS) || defined(OS_ANDROID)
 // TODO(https://crbug.com/1000400): Re-enable this test.
 #define MAYBE_PositionStateRouteWithOnePlayer \
   DISABLED_PositionStateRouteWithOnePlayer
@@ -2711,8 +2714,9 @@ IN_PROC_BROWSER_TEST_F(MediaSessionImplBrowserTest,
 #endif
 IN_PROC_BROWSER_TEST_F(MediaSessionImplBrowserTest,
                        MAYBE_PositionStateRouteWithOnePlayer) {
-  NavigateToURL(shell(), embedded_test_server()->GetURL(
-                             "example.com", "/media/session/position.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("example.com",
+                                              "/media/session/position.html")));
 
   auto* main_frame = shell()->web_contents()->GetMainFrame();
   const base::TimeDelta duration = base::TimeDelta::FromMilliseconds(6060);
diff --git a/chromium/content/browser/media/session/media_session_impl_service_routing_unittest.cc b/chromium/content/browser/media/session/media_session_impl_service_routing_unittest.cc
index f38110341e4..afcf9394911 100644
--- a/chromium/content/browser/media/session/media_session_impl_service_routing_unittest.cc
+++ b/chromium/content/browser/media/session/media_session_impl_service_routing_unittest.cc
@@ -99,7 +99,7 @@ class MediaSessionImplServiceRoutingTest
     sub_frame_ = main_frame_->AppendChild("sub_frame");
 
     empty_metadata_.title = contents()->GetTitle();
-    empty_metadata_.source_title = base::ASCIIToUTF16("http://www.example.com");
+    empty_metadata_.source_title = base::ASCIIToUTF16("example.com");
   }
 
   void TearDown() override {
@@ -780,7 +780,7 @@ TEST_F(MediaSessionImplServiceRoutingTest, NotifyObserverOnNavigation) {
 
   media_session::MediaMetadata expected_metadata;
   expected_metadata.title = contents()->GetTitle();
-  expected_metadata.source_title = base::ASCIIToUTF16("http://www.google.com");
+  expected_metadata.source_title = base::ASCIIToUTF16("google.com");
   observer.WaitForExpectedMetadata(expected_metadata);
 }
 
diff --git a/chromium/content/browser/media/session/media_session_service_impl.cc b/chromium/content/browser/media/session/media_session_service_impl.cc
index f4d4c5f27a8..eb12ef11cb4 100644
--- a/chromium/content/browser/media/session/media_session_service_impl.cc
+++ b/chromium/content/browser/media/session/media_session_service_impl.cc
@@ -32,10 +32,10 @@ MediaSessionServiceImpl::~MediaSessionServiceImpl() {
 // static
 void MediaSessionServiceImpl::Create(
     RenderFrameHost* render_frame_host,
-    blink::mojom::MediaSessionServiceRequest request) {
+    mojo::PendingReceiver<blink::mojom::MediaSessionService> receiver) {
   MediaSessionServiceImpl* impl =
       new MediaSessionServiceImpl(render_frame_host);
-  impl->Bind(std::move(request));
+  impl->Bind(std::move(receiver));
 }
 
 RenderFrameHost* MediaSessionServiceImpl::GetRenderFrameHost() {
@@ -137,9 +137,9 @@ MediaSessionImpl* MediaSessionServiceImpl::GetMediaSession() {
 }
 
 void MediaSessionServiceImpl::Bind(
-    blink::mojom::MediaSessionServiceRequest request) {
+    mojo::PendingReceiver<blink::mojom::MediaSessionService> receiver) {
   receiver_.reset(new mojo::Receiver<blink::mojom::MediaSessionService>(
-      this, std::move(request)));
+      this, std::move(receiver)));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/media/session/media_session_service_impl.h b/chromium/content/browser/media/session/media_session_service_impl.h
index d88dd5eb3dc..5ecb5344a5a 100644
--- a/chromium/content/browser/media/session/media_session_service_impl.h
+++ b/chromium/content/browser/media/session/media_session_service_impl.h
@@ -6,6 +6,9 @@
 #define CONTENT_BROWSER_MEDIA_SESSION_MEDIA_SESSION_SERVICE_IMPL_H_
 
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/mediasession/media_session.mojom.h"
 
@@ -22,8 +25,9 @@ class CONTENT_EXPORT MediaSessionServiceImpl
  public:
   ~MediaSessionServiceImpl() override;
 
-  static void Create(RenderFrameHost* render_frame_host,
-                     blink::mojom::MediaSessionServiceRequest request);
+  static void Create(
+      RenderFrameHost* render_frame_host,
+      mojo::PendingReceiver<blink::mojom::MediaSessionService> receiver);
   const mojo::Remote<blink::mojom::MediaSessionClient>& GetClient() {
     return client_;
   }
@@ -63,7 +67,7 @@ class CONTENT_EXPORT MediaSessionServiceImpl
  private:
   MediaSessionImpl* GetMediaSession();
 
-  void Bind(blink::mojom::MediaSessionServiceRequest request);
+  void Bind(mojo::PendingReceiver<blink::mojom::MediaSessionService> receiver);
 
   void ClearActions();
 
diff --git a/chromium/content/browser/media/system_media_controls_notifier.cc b/chromium/content/browser/media/system_media_controls_notifier.cc
index 2fabf7959a1..0368b25a701 100644
--- a/chromium/content/browser/media/system_media_controls_notifier.cc
+++ b/chromium/content/browser/media/system_media_controls_notifier.cc
@@ -10,6 +10,7 @@
 #include "base/bind.h"
 #include "base/time/time.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "services/media_session/public/mojom/constants.mojom.h"
 #include "services/media_session/public/mojom/media_session.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
@@ -62,15 +63,15 @@ void SystemMediaControlsNotifier::Initialize() {
   connector_->BindInterface(media_session::mojom::kServiceName,
                             mojo::MakeRequest(&controller_manager_ptr));
   controller_manager_ptr->CreateActiveMediaController(
-      mojo::MakeRequest(&media_controller_ptr_));
+      media_controller_.BindNewPipeAndPassReceiver());
 
   // Observe the active media controller for changes to playback state and
   // supported actions.
-  media_controller_ptr_->AddObserver(
+  media_controller_->AddObserver(
       media_controller_observer_receiver_.BindNewPipeAndPassRemote());
 
   // Observe the active media controller for changes to provided artwork.
-  media_controller_ptr_->ObserveImages(
+  media_controller_->ObserveImages(
       media_session::mojom::MediaSessionImageType::kArtwork, kMinImageSize,
       kDesiredImageSize,
       media_controller_image_observer_receiver_.BindNewPipeAndPassRemote());
diff --git a/chromium/content/browser/media/system_media_controls_notifier.h b/chromium/content/browser/media/system_media_controls_notifier.h
index c403ea936b4..020ed074109 100644
--- a/chromium/content/browser/media/system_media_controls_notifier.h
+++ b/chromium/content/browser/media/system_media_controls_notifier.h
@@ -11,8 +11,8 @@
 #include "base/sequence_checker.h"
 #include "base/timer/timer.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/media_session/public/mojom/media_controller.mojom.h"
 
 namespace system_media_controls {
@@ -90,7 +90,7 @@ class CONTENT_EXPORT SystemMediaControlsNotifier
   service_manager::Connector* connector_;
 
   // Tracks current media session state/metadata.
-  media_session::mojom::MediaControllerPtr media_controller_ptr_;
+  mojo::Remote<media_session::mojom::MediaController> media_controller_;
   media_session::mojom::MediaSessionInfoPtr session_info_ptr_;
 
   // Used to receive updates to the active media controller.
diff --git a/chromium/content/browser/media/video_decoder_proxy.cc b/chromium/content/browser/media/video_decoder_proxy.cc
index f01a64442ad..8217faf6b8b 100644
--- a/chromium/content/browser/media/video_decoder_proxy.cc
+++ b/chromium/content/browser/media/video_decoder_proxy.cc
@@ -31,7 +31,7 @@ void VideoDecoderProxy::Add(media::mojom::InterfaceFactoryRequest request) {
 }
 
 void VideoDecoderProxy::CreateAudioDecoder(
-    media::mojom::AudioDecoderRequest request) {}
+    mojo::PendingReceiver<media::mojom::AudioDecoder> receiver) {}
 
 void VideoDecoderProxy::CreateVideoDecoder(
     media::mojom::VideoDecoderRequest request) {
@@ -71,10 +71,11 @@ void VideoDecoderProxy::CreateCdm(
 
 void VideoDecoderProxy::CreateDecryptor(
     int cdm_id,
-    media::mojom::DecryptorRequest request) {}
+    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {}
 
-void VideoDecoderProxy::CreateCdmProxy(const base::Token& cdm_guid,
-                                       media::mojom::CdmProxyRequest request) {}
+void VideoDecoderProxy::CreateCdmProxy(
+    const base::Token& cdm_guid,
+    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {}
 
 media::mojom::InterfaceFactory* VideoDecoderProxy::GetMediaInterfaceFactory() {
   DCHECK_CALLED_ON_VALID_THREAD(thread_checker_);
diff --git a/chromium/content/browser/media/video_decoder_proxy.h b/chromium/content/browser/media/video_decoder_proxy.h
index 287da369f3d..bb9398013fe 100644
--- a/chromium/content/browser/media/video_decoder_proxy.h
+++ b/chromium/content/browser/media/video_decoder_proxy.h
@@ -14,6 +14,7 @@
 #include "media/mojo/buildflags.h"
 #include "media/mojo/mojom/interface_factory.mojom.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
@@ -29,7 +30,8 @@ class VideoDecoderProxy : public media::mojom::InterfaceFactory {
   void Add(media::mojom::InterfaceFactoryRequest request);
 
   // media::mojom::InterfaceFactory implementation.
-  void CreateAudioDecoder(media::mojom::AudioDecoderRequest request) final;
+  void CreateAudioDecoder(
+      mojo::PendingReceiver<media::mojom::AudioDecoder> receiver) final;
   void CreateVideoDecoder(media::mojom::VideoDecoderRequest request) final;
   void CreateDefaultRenderer(const std::string& audio_device_id,
                              media::mojom::RendererRequest request) final;
@@ -50,10 +52,12 @@ class VideoDecoderProxy : public media::mojom::InterfaceFactory {
 #endif  // defined(OS_ANDROID)
   void CreateCdm(const std::string& key_system,
                  media::mojom::ContentDecryptionModuleRequest request) final;
-  void CreateDecryptor(int cdm_id,
-                       media::mojom::DecryptorRequest request) final;
-  void CreateCdmProxy(const base::Token& cdm_guid,
-                      media::mojom::CdmProxyRequest request) final;
+  void CreateDecryptor(
+      int cdm_id,
+      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
+  void CreateCdmProxy(
+      const base::Token& cdm_guid,
+      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
 
  private:
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
diff --git a/chromium/content/browser/mojo_sandbox_browsertest.cc b/chromium/content/browser/mojo_sandbox_browsertest.cc
index ed9218e7363..3f3eec4fcda 100644
--- a/chromium/content/browser/mojo_sandbox_browsertest.cc
+++ b/chromium/content/browser/mojo_sandbox_browsertest.cc
@@ -16,6 +16,7 @@
 #include "content/public/common/bind_interface_helpers.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/test_service.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
 namespace content {
@@ -65,12 +66,12 @@ class MojoSandboxTest : public ContentBrowserTest {
 IN_PROC_BROWSER_TEST_F(MojoSandboxTest, SubprocessSharedBuffer) {
   // Ensures that a shared buffer can be created within a sandboxed process.
 
-  mojom::TestServicePtr test_service;
-  BindInterface(host_.get(), &test_service);
+  mojo::Remote<mojom::TestService> test_service;
+  BindInterface(host_.get(), test_service.BindNewPipeAndPassReceiver());
 
   bool got_response = false;
   base::RunLoop run_loop;
-  test_service.set_connection_error_handler(run_loop.QuitClosure());
+  test_service.set_disconnect_handler(run_loop.QuitClosure());
   test_service->CreateSharedBuffer(
       kTestMessage,
       base::BindOnce(
diff --git a/chromium/content/browser/native_file_system/file_system_chooser.cc b/chromium/content/browser/native_file_system/file_system_chooser.cc
index cff54ddd83e..7b83ed39804 100644
--- a/chromium/content/browser/native_file_system/file_system_chooser.cc
+++ b/chromium/content/browser/native_file_system/file_system_chooser.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_client.h"
+#include "net/base/mime_util.h"
 #include "storage/browser/fileapi/isolated_context.h"
 #include "ui/shell_dialogs/select_file_policy.h"
 
diff --git a/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc b/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc
index 777c18b8d95..d6aaceb1e75 100644
--- a/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc
+++ b/chromium/content/browser/native_file_system/file_system_chooser_browsertest.cc
@@ -11,16 +11,19 @@
 #include "content/browser/native_file_system/file_system_chooser_test_helpers.h"
 #include "content/browser/native_file_system/mock_native_file_system_permission_context.h"
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
+#include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/test/back_forward_cache_util.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "ui/shell_dialogs/select_file_dialog.h"
 #include "ui/shell_dialogs/select_file_dialog_factory.h"
 #include "ui/shell_dialogs/select_file_policy.h"
@@ -58,6 +61,18 @@ class FileSystemChooserBrowserTest : public ContentBrowserTest {
     ui::SelectFileDialog::SetFactory(nullptr);
   }
 
+  bool IsFullscreen() {
+    WebContents* web_contents = shell()->web_contents();
+    return web_contents->IsFullscreenForCurrentTab();
+  }
+
+  void EnterFullscreen(GURL url) {
+    WebContentsImpl* web_contents_impl =
+        static_cast<WebContentsImpl*>(shell()->web_contents());
+    web_contents_impl->EnterFullscreenMode(url,
+                                           blink::mojom::FullscreenOptions());
+  }
+
   base::FilePath CreateTestFile(const std::string& contents) {
     base::ScopedAllowBlockingForTesting allow_blocking;
     base::FilePath result;
@@ -113,6 +128,25 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenFile) {
              "return await file.text(); })()"));
 }
 
+IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, FullscreenOpenFile) {
+  const std::string file_contents = "hello world!";
+  const base::FilePath test_file = CreateTestFile(file_contents);
+  SelectFileDialogParams dialog_params;
+  ui::SelectFileDialog::SetFactory(
+      new FakeSelectFileDialogFactory({test_file}, &dialog_params));
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EnterFullscreen(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(IsFullscreen());
+  EXPECT_EQ(test_file.BaseName().AsUTF8Unsafe(),
+            EvalJs(shell(),
+                   "(async () => {"
+                   "  let e = await self.chooseFileSystemEntries();"
+                   "  self.selected_entry = e;"
+                   "  return e.name; })()"));
+  EXPECT_FALSE(IsFullscreen());
+}
+
 IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, SaveFile_NonExistingFile) {
   const std::string file_contents = "file contents to write";
   const base::FilePath test_file = CreateTestFile("");
@@ -203,6 +237,25 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest,
   EXPECT_EQ(ui::SelectFileDialog::SELECT_NONE, dialog_params.type);
 }
 
+IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, FullscreenSaveFile) {
+  const base::FilePath test_file = CreateTestFile("Hello World");
+
+  SelectFileDialogParams dialog_params;
+  ui::SelectFileDialog::SetFactory(
+      new FakeSelectFileDialogFactory({test_file}, &dialog_params));
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EnterFullscreen(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_EQ(test_file.BaseName().AsUTF8Unsafe(),
+            EvalJs(shell(),
+                   "(async () => {"
+                   "  let e = await self.chooseFileSystemEntries("
+                   "      {type: 'saveFile'});"
+                   "  self.entry = e;"
+                   "  return e.name; })()"));
+  EXPECT_FALSE(IsFullscreen());
+}
+
 IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenMultipleFiles) {
   const base::FilePath test_file1 = CreateTestFile("file1");
   const base::FilePath test_file2 = CreateTestFile("file2");
@@ -221,6 +274,26 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenMultipleFiles) {
   EXPECT_EQ(ui::SelectFileDialog::SELECT_OPEN_MULTI_FILE, dialog_params.type);
 }
 
+IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest,
+                       FullscreenOpenMultipleFiles) {
+  const base::FilePath test_file1 = CreateTestFile("file1");
+  const base::FilePath test_file2 = CreateTestFile("file2");
+  SelectFileDialogParams dialog_params;
+  ui::SelectFileDialog::SetFactory(new FakeSelectFileDialogFactory(
+      {test_file1, test_file2}, &dialog_params));
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EnterFullscreen(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_EQ(ListValueOf(test_file1.BaseName().AsUTF8Unsafe(),
+                        test_file2.BaseName().AsUTF8Unsafe()),
+            EvalJs(shell(),
+                   "(async () => {"
+                   "  let e = await self.chooseFileSystemEntries("
+                   "      {multiple: true});"
+                   "  return e.map(x => x.name); })()"));
+  EXPECT_FALSE(IsFullscreen());
+}
+
 IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenDirectory) {
   base::FilePath test_dir = CreateTestDir();
   SelectFileDialogParams dialog_params;
@@ -238,6 +311,24 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenDirectory) {
   EXPECT_EQ(ui::SelectFileDialog::SELECT_FOLDER, dialog_params.type);
 }
 
+IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, FullscreenOpenDirectory) {
+  base::FilePath test_dir = CreateTestDir();
+  SelectFileDialogParams dialog_params;
+  ui::SelectFileDialog::SetFactory(
+      new FakeSelectFileDialogFactory({test_dir}, &dialog_params));
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EnterFullscreen(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_EQ(test_dir.BaseName().AsUTF8Unsafe(),
+            EvalJs(shell(),
+                   "(async () => {"
+                   "  let e = await self.chooseFileSystemEntries("
+                   "      {type: 'openDirectory'});"
+                   "  self.selected_entry = e;"
+                   "  return e.name; })()"));
+  EXPECT_FALSE(IsFullscreen());
+}
+
 IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, OpenDirectory_DenyAccess) {
   base::FilePath test_dir = CreateTestDir();
   SelectFileDialogParams dialog_params;
@@ -399,4 +490,26 @@ IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest, AcceptsOptions) {
             dialog_params.file_types->extension_description_overrides[1]);
 }
 
+IN_PROC_BROWSER_TEST_F(FileSystemChooserBrowserTest,
+                       NativeFileSystemUsageDisablesBackForwardCache) {
+  BackForwardCacheDisabledTester tester;
+
+  const base::FilePath test_file = CreateTestFile("file contents");
+  SelectFileDialogParams dialog_params;
+  ui::SelectFileDialog::SetFactory(
+      new FakeSelectFileDialogFactory({test_file}, &dialog_params));
+  ASSERT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
+  EXPECT_EQ(test_file.BaseName().AsUTF8Unsafe(),
+            EvalJs(shell(),
+                   "(async () => {"
+                   "  let e = await self.chooseFileSystemEntries();"
+                   "  self.selected_entry = e;"
+                   "  return e.name; })()"));
+  EXPECT_TRUE(tester.IsDisabledForFrameWithReason(
+      shell()->web_contents()->GetMainFrame()->GetProcess()->GetID(),
+      shell()->web_contents()->GetMainFrame()->GetRoutingID(),
+      "NativeFileSystem"));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.cc b/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.cc
index 2220295ce53..7133f72c71a 100644
--- a/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.cc
+++ b/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.cc
@@ -31,12 +31,12 @@ void MockNativeFileSystemPermissionContext::ConfirmSensitiveDirectoryAccess(
                                    frame_id, callback);
 }
 
-void MockNativeFileSystemPermissionContext::PerformSafeBrowsingChecks(
+void MockNativeFileSystemPermissionContext::PerformAfterWriteChecks(
     std::unique_ptr<NativeFileSystemWriteItem> item,
     int process_id,
     int frame_id,
-    base::OnceCallback<void(SafeBrowsingResult)> callback) {
-  PerformSafeBrowsingChecks_(item.get(), process_id, frame_id, callback);
+    base::OnceCallback<void(AfterWriteCheckResult)> callback) {
+  PerformAfterWriteChecks_(item.get(), process_id, frame_id, callback);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.h b/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.h
index a205dab66b2..fdf857ab303 100644
--- a/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.h
+++ b/chromium/content/browser/native_file_system/mock_native_file_system_permission_context.h
@@ -62,16 +62,16 @@ class MockNativeFileSystemPermissionContext
            int frame_id,
            base::OnceCallback<void(SensitiveDirectoryResult)>& callback));
 
-  void PerformSafeBrowsingChecks(
+  void PerformAfterWriteChecks(
       std::unique_ptr<NativeFileSystemWriteItem> item,
       int process_id,
       int frame_id,
-      base::OnceCallback<void(SafeBrowsingResult)> callback) override;
-  MOCK_METHOD4(PerformSafeBrowsingChecks_,
+      base::OnceCallback<void(AfterWriteCheckResult)> callback) override;
+  MOCK_METHOD4(PerformAfterWriteChecks_,
                void(NativeFileSystemWriteItem* item,
                     int process_id,
                     int frame_id,
-                    base::OnceCallback<void(SafeBrowsingResult)>& callback));
+                    base::OnceCallback<void(AfterWriteCheckResult)>& callback));
 
   MOCK_METHOD1(CanRequestWritePermission, bool(const url::Origin& origin));
 };
diff --git a/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.cc b/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.cc
index 6a55aff5cfd..63072677e72 100644
--- a/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.cc
@@ -10,6 +10,7 @@
 #include "build/build_config.h"
 #include "content/browser/native_file_system/native_file_system_error.h"
 #include "content/browser/native_file_system/native_file_system_transfer_token_impl.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/escape.h"
 #include "storage/browser/fileapi/file_system_context.h"
 #include "storage/browser/fileapi/file_system_operation_runner.h"
@@ -22,8 +23,8 @@ using blink::mojom::NativeFileSystemEntry;
 using blink::mojom::NativeFileSystemEntryPtr;
 using blink::mojom::NativeFileSystemHandle;
 using blink::mojom::NativeFileSystemStatus;
-using blink::mojom::NativeFileSystemTransferTokenPtr;
-using blink::mojom::NativeFileSystemTransferTokenRequest;
+using blink::mojom::NativeFileSystemTransferToken;
+using storage::FileSystemOperationRunner;
 
 namespace content {
 
@@ -82,7 +83,7 @@ void NativeFileSystemDirectoryHandleImpl::RequestPermission(
 void NativeFileSystemDirectoryHandleImpl::GetFile(const std::string& basename,
                                                   bool create,
                                                   GetFileCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   storage::FileSystemURL child_url;
   blink::mojom::NativeFileSystemErrorPtr get_child_url_result =
@@ -116,11 +117,12 @@ void NativeFileSystemDirectoryHandleImpl::GetFile(const std::string& basename,
         }),
         std::move(callback));
   } else {
-    operation_runner()->FileExists(
-        child_url,
+    DoFileSystemOperation(
+        FROM_HERE, &FileSystemOperationRunner::FileExists,
         base::BindOnce(&NativeFileSystemDirectoryHandleImpl::DidGetFile,
                        weak_factory_.GetWeakPtr(), child_url,
-                       std::move(callback)));
+                       std::move(callback)),
+        child_url);
   }
 }
 
@@ -128,20 +130,21 @@ void NativeFileSystemDirectoryHandleImpl::GetDirectory(
     const std::string& basename,
     bool create,
     GetDirectoryCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   storage::FileSystemURL child_url;
   blink::mojom::NativeFileSystemErrorPtr get_child_url_result =
       GetChildURL(basename, &child_url);
   if (get_child_url_result->status != NativeFileSystemStatus::kOk) {
-    std::move(callback).Run(std::move(get_child_url_result), nullptr);
+    std::move(callback).Run(std::move(get_child_url_result),
+                            mojo::NullRemote());
     return;
   }
 
   if (GetReadPermissionStatus() != PermissionStatus::GRANTED) {
     std::move(callback).Run(native_file_system_error::FromStatus(
                                 NativeFileSystemStatus::kPermissionDenied),
-                            nullptr);
+                            mojo::NullRemote());
     return;
   }
 
@@ -157,34 +160,37 @@ void NativeFileSystemDirectoryHandleImpl::GetDirectory(
           std::move(callback).Run(
               native_file_system_error::FromStatus(
                   NativeFileSystemStatus::kPermissionDenied),
-              nullptr);
+              mojo::NullRemote());
         }),
         std::move(callback));
   } else {
-    operation_runner()->DirectoryExists(
-        child_url,
+    DoFileSystemOperation(
+        FROM_HERE, &FileSystemOperationRunner::DirectoryExists,
         base::BindOnce(&NativeFileSystemDirectoryHandleImpl::DidGetDirectory,
                        weak_factory_.GetWeakPtr(), child_url,
-                       std::move(callback)));
+                       std::move(callback)),
+        child_url);
   }
 }
 
 void NativeFileSystemDirectoryHandleImpl::GetEntries(
     GetEntriesCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-
-  operation_runner()->ReadDirectory(
-      url(), base::BindRepeating(
-                 &NativeFileSystemDirectoryHandleImpl::DidReadDirectory,
-                 weak_factory_.GetWeakPtr(),
-                 base::Owned(new ReadDirectoryState{std::move(callback)})));
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::ReadDirectory,
+      base::BindRepeating(
+          &NativeFileSystemDirectoryHandleImpl::DidReadDirectory,
+          weak_factory_.GetWeakPtr(),
+          base::Owned(new ReadDirectoryState{std::move(callback)})),
+      url());
 }
 
 void NativeFileSystemDirectoryHandleImpl::RemoveEntry(
     const std::string& basename,
     bool recurse,
     RemoveEntryCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   storage::FileSystemURL child_url;
   blink::mojom::NativeFileSystemErrorPtr get_child_url_result =
@@ -205,8 +211,8 @@ void NativeFileSystemDirectoryHandleImpl::RemoveEntry(
 }
 
 void NativeFileSystemDirectoryHandleImpl::Transfer(
-    NativeFileSystemTransferTokenRequest token) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+    mojo::PendingReceiver<NativeFileSystemTransferToken> token) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   manager()->CreateTransferToken(*this, std::move(token));
 }
@@ -214,22 +220,24 @@ void NativeFileSystemDirectoryHandleImpl::Transfer(
 void NativeFileSystemDirectoryHandleImpl::GetFileWithWritePermission(
     const storage::FileSystemURL& child_url,
     GetFileCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
-  operation_runner()->CreateFile(
-      child_url, /*exclusive=*/false,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::CreateFile,
       base::BindOnce(&NativeFileSystemDirectoryHandleImpl::DidGetFile,
                      weak_factory_.GetWeakPtr(), child_url,
-                     std::move(callback)));
+                     std::move(callback)),
+      child_url,
+      /*exclusive=*/false);
 }
 
 void NativeFileSystemDirectoryHandleImpl::DidGetFile(
     const storage::FileSystemURL& url,
     GetFileCallback callback,
     base::File::Error result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (result != base::File::FILE_OK) {
     std::move(callback).Run(native_file_system_error::FromFileError(result),
@@ -245,26 +253,28 @@ void NativeFileSystemDirectoryHandleImpl::DidGetFile(
 void NativeFileSystemDirectoryHandleImpl::GetDirectoryWithWritePermission(
     const storage::FileSystemURL& child_url,
     GetDirectoryCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
-  operation_runner()->CreateDirectory(
-      child_url, /*exclusive=*/false, /*recursive=*/false,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::CreateDirectory,
       base::BindOnce(&NativeFileSystemDirectoryHandleImpl::DidGetDirectory,
                      weak_factory_.GetWeakPtr(), child_url,
-                     std::move(callback)));
+                     std::move(callback)),
+      child_url,
+      /*exclusive=*/false, /*recursive=*/false);
 }
 
 void NativeFileSystemDirectoryHandleImpl::DidGetDirectory(
     const storage::FileSystemURL& url,
     GetDirectoryCallback callback,
     base::File::Error result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (result != base::File::FILE_OK) {
     std::move(callback).Run(native_file_system_error::FromFileError(result),
-                            nullptr);
+                            mojo::NullRemote());
     return;
   }
 
@@ -278,7 +288,7 @@ void NativeFileSystemDirectoryHandleImpl::DidReadDirectory(
     base::File::Error result,
     std::vector<filesystem::mojom::DirectoryEntry> file_list,
     bool has_more) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (result != base::File::FILE_OK) {
     DCHECK(!has_more);
@@ -315,18 +325,19 @@ void NativeFileSystemDirectoryHandleImpl::RemoveEntryImpl(
     const storage::FileSystemURL& url,
     bool recurse,
     RemoveEntryCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
-  operation_runner()->Remove(
-      url, recurse,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::Remove,
       base::BindOnce(
           [](RemoveEntryCallback callback, base::File::Error result) {
             std::move(callback).Run(
                 native_file_system_error::FromFileError(result));
           },
-          std::move(callback)));
+          std::move(callback)),
+      url, recurse);
 }
 
 blink::mojom::NativeFileSystemErrorPtr
@@ -370,9 +381,7 @@ NativeFileSystemEntryPtr NativeFileSystemDirectoryHandleImpl::CreateEntry(
   if (is_directory) {
     return NativeFileSystemEntry::New(
         NativeFileSystemHandle::NewDirectory(
-            manager()
-                ->CreateDirectoryHandle(context(), url, handle_state())
-                .PassInterface()),
+            manager()->CreateDirectoryHandle(context(), url, handle_state())),
         basename);
   }
   return NativeFileSystemEntry::New(
diff --git a/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.h b/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.h
index e1e0885964f..21f71bbdb56 100644
--- a/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.h
+++ b/chromium/content/browser/native_file_system/native_file_system_directory_handle_impl.h
@@ -10,6 +10,7 @@
 #include "base/memory/weak_ptr.h"
 #include "components/services/filesystem/public/mojom/types.mojom.h"
 #include "content/browser/native_file_system/native_file_system_handle_base.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "storage/browser/fileapi/file_system_url.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_directory_handle.mojom.h"
 
@@ -19,8 +20,8 @@ namespace content {
 // owned by the NativeFileSystemManagerImpl instance passed in to the
 // constructor.
 //
-// This class is not thread safe, all methods should be called on the same
-// sequence as storage::FileSystemContext, which today always is the IO thread.
+// This class is not thread safe, all methods must be called from the same
+// sequence.
 class NativeFileSystemDirectoryHandleImpl
     : public NativeFileSystemHandleBase,
       public blink::mojom::NativeFileSystemDirectoryHandle {
@@ -47,7 +48,8 @@ class NativeFileSystemDirectoryHandleImpl
                    bool recurse,
                    RemoveEntryCallback callback) override;
   void Transfer(
-      blink::mojom::NativeFileSystemTransferTokenRequest token) override;
+      mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken> token)
+      override;
 
  private:
   // State that is kept for the duration of a GetEntries/ReadDirectory call.
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.cc b/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.cc
index ecf67ea87b5..b574e25cde1 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.cc
@@ -7,7 +7,10 @@
 #include "base/guid.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
+#include "base/task/post_task.h"
 #include "content/browser/native_file_system/native_file_system_error.h"
+#include "content/public/browser/browser_task_traits.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/mime_util.h"
 #include "storage/browser/blob/blob_data_builder.h"
 #include "storage/browser/blob/blob_impl.h"
@@ -22,6 +25,7 @@ using blink::mojom::NativeFileSystemStatus;
 using storage::BlobDataHandle;
 using storage::BlobImpl;
 using storage::FileSystemOperation;
+using storage::FileSystemOperationRunner;
 using storage::IsolatedContext;
 
 namespace content {
@@ -52,7 +56,8 @@ void NativeFileSystemFileHandleImpl::RequestPermission(
 }
 
 void NativeFileSystemFileHandleImpl::AsBlob(AsBlobCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
   if (GetReadPermissionStatus() != PermissionStatus::GRANTED) {
     std::move(callback).Run(native_file_system_error::FromStatus(
                                 NativeFileSystemStatus::kPermissionDenied),
@@ -62,19 +67,20 @@ void NativeFileSystemFileHandleImpl::AsBlob(AsBlobCallback callback) {
 
   // TODO(mek): Check backend::SupportsStreaming and create snapshot file if
   // streaming is not supported.
-  operation_runner()->GetMetadata(
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::GetMetadata,
+      base::BindOnce(&NativeFileSystemFileHandleImpl::DidGetMetaDataForBlob,
+                     weak_factory_.GetWeakPtr(), std::move(callback)),
       url(),
       FileSystemOperation::GET_METADATA_FIELD_IS_DIRECTORY |
           FileSystemOperation::GET_METADATA_FIELD_SIZE |
-          FileSystemOperation::GET_METADATA_FIELD_LAST_MODIFIED,
-      base::BindOnce(&NativeFileSystemFileHandleImpl::DidGetMetaDataForBlob,
-                     weak_factory_.GetWeakPtr(), std::move(callback)));
+          FileSystemOperation::GET_METADATA_FIELD_LAST_MODIFIED);
 }
 
 void NativeFileSystemFileHandleImpl::CreateFileWriter(
     bool keep_existing_data,
     CreateFileWriterCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   RunWithWritePermission(
       base::BindOnce(&NativeFileSystemFileHandleImpl::CreateFileWriterImpl,
@@ -88,17 +94,53 @@ void NativeFileSystemFileHandleImpl::CreateFileWriter(
 }
 
 void NativeFileSystemFileHandleImpl::Transfer(
-    blink::mojom::NativeFileSystemTransferTokenRequest token) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+    mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken> token) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   manager()->CreateTransferToken(*this, std::move(token));
 }
 
+namespace {
+
+void CreateBlobOnIOThread(
+    scoped_refptr<storage::FileSystemContext> file_system_context,
+    const scoped_refptr<ChromeBlobStorageContext>& blob_context,
+    mojo::PendingReceiver<blink::mojom::Blob> blob_receiver,
+    const storage::FileSystemURL& url,
+    const std::string& blob_uuid,
+    const std::string& content_type,
+    const base::File::Info& info) {
+  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+
+  auto blob_builder = std::make_unique<storage::BlobDataBuilder>(blob_uuid);
+  // Only append if the file has data.
+  if (info.size > 0) {
+    // Use AppendFileSystemFile here, since we're streaming the file directly
+    // from the file system backend, and the file thus might not actually be
+    // backed by a file on disk.
+    blob_builder->AppendFileSystemFile(url.ToGURL(), 0, info.size,
+                                       info.last_modified,
+                                       std::move(file_system_context));
+  }
+  blob_builder->set_content_type(content_type);
+
+  std::unique_ptr<BlobDataHandle> blob_handle =
+      blob_context->context()->AddFinishedBlob(std::move(blob_builder));
+
+  // Since the blob we're creating doesn't depend on other blobs, and doesn't
+  // require blob memory/disk quota, creating the blob can't fail.
+  DCHECK(!blob_handle->IsBroken());
+
+  BlobImpl::Create(std::move(blob_handle), std::move(blob_receiver));
+}
+
+}  // namespace
+
 void NativeFileSystemFileHandleImpl::DidGetMetaDataForBlob(
     AsBlobCallback callback,
     base::File::Error result,
     const base::File::Info& info) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (result != base::File::FILE_OK) {
     std::move(callback).Run(native_file_system_error::FromFileError(result),
@@ -107,12 +149,7 @@ void NativeFileSystemFileHandleImpl::DidGetMetaDataForBlob(
   }
 
   std::string uuid = base::GenerateGUID();
-  auto blob_builder = std::make_unique<storage::BlobDataBuilder>(uuid);
-  // Use AppendFileSystemFile here, since we're streaming the file directly
-  // from the file system backend, and the file thus might not actually be
-  // backed by a file on disk.
-  blob_builder->AppendFileSystemFile(url().ToGURL(), 0, -1, info.last_modified,
-                                     file_system_context());
+  std::string content_type;
 
   base::FilePath::StringType extension = url().path().Extension();
   if (!extension.empty()) {
@@ -122,33 +159,33 @@ void NativeFileSystemFileHandleImpl::DidGetMetaDataForBlob(
     // however that method can potentially block and thus can't be called from
     // the IO thread.
     if (net::GetWellKnownMimeTypeFromExtension(extension.substr(1), &mime_type))
-      blob_builder->set_content_type(mime_type);
+      content_type = std::move(mime_type);
   }
+  // TODO(https://crbug.com/962306): Consider some kind of fallback type when
+  // the above mime type detection fails.
 
-  std::unique_ptr<BlobDataHandle> blob_handle =
-      blob_context()->AddFinishedBlob(std::move(blob_builder));
-  if (blob_handle->IsBroken()) {
-    std::move(callback).Run(
-        native_file_system_error::FromStatus(
-            NativeFileSystemStatus::kOperationFailed, "Failed to create blob."),
-        nullptr);
-    return;
-  }
-
-  std::string content_type = blob_handle->content_type();
-  blink::mojom::BlobPtr blob_ptr;
-  BlobImpl::Create(std::move(blob_handle), mojo::MakeRequest(&blob_ptr));
+  mojo::PendingRemote<blink::mojom::Blob> blob_remote;
+  mojo::PendingReceiver<blink::mojom::Blob> blob_receiver =
+      blob_remote.InitWithNewPipeAndPassReceiver();
 
   std::move(callback).Run(
       native_file_system_error::Ok(),
       blink::mojom::SerializedBlob::New(uuid, content_type, info.size,
-                                        blob_ptr.PassInterface()));
+                                        std::move(blob_remote)));
+
+  base::PostTask(
+      FROM_HERE, {BrowserThread::IO},
+      base::BindOnce(&CreateBlobOnIOThread,
+                     base::WrapRefCounted(file_system_context()),
+                     base::WrapRefCounted(manager()->blob_context()),
+                     std::move(blob_receiver), url(), std::move(uuid),
+                     std::move(content_type), info));
 }
 
 void NativeFileSystemFileHandleImpl::CreateFileWriterImpl(
     bool keep_existing_data,
     CreateFileWriterCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
@@ -166,7 +203,7 @@ void NativeFileSystemFileHandleImpl::CreateSwapFile(
     int count,
     bool keep_existing_data,
     CreateFileWriterCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(count >= 0);
   DCHECK(max_swap_files_ >= 0);
 
@@ -222,13 +259,13 @@ void NativeFileSystemFileHandleImpl::CreateSwapFile(
     swap_file_system = std::move(handle.file_system);
   }
 
-  operation_runner()->CreateFile(
-      swap_url,
-      /*exclusive=*/true,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::CreateFile,
       base::BindOnce(&NativeFileSystemFileHandleImpl::DidCreateSwapFile,
                      weak_factory_.GetWeakPtr(), count, swap_url,
-                     swap_file_system, keep_existing_data,
-                     std::move(callback)));
+                     swap_file_system, keep_existing_data, std::move(callback)),
+      swap_url,
+      /*exclusive=*/true);
 }
 
 void NativeFileSystemFileHandleImpl::DidCreateSwapFile(
@@ -238,7 +275,7 @@ void NativeFileSystemFileHandleImpl::DidCreateSwapFile(
     bool keep_existing_data,
     CreateFileWriterCallback callback,
     base::File::Error result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (result == base::File::FILE_ERROR_EXISTS) {
     // Creation attempt failed. We need to find an unused filename.
     CreateSwapFile(count + 1, keep_existing_data, std::move(callback));
@@ -266,14 +303,15 @@ void NativeFileSystemFileHandleImpl::DidCreateSwapFile(
     return;
   }
 
-  operation_runner()->Copy(
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::Copy,
+      base::BindOnce(&NativeFileSystemFileHandleImpl::DidCopySwapFile,
+                     weak_factory_.GetWeakPtr(), swap_url, swap_file_system,
+                     std::move(callback)),
       url(), swap_url,
       storage::FileSystemOperation::OPTION_PRESERVE_LAST_MODIFIED,
       storage::FileSystemOperation::ERROR_BEHAVIOR_ABORT,
-      storage::FileSystemOperation::CopyProgressCallback(),
-      base::BindOnce(&NativeFileSystemFileHandleImpl::DidCopySwapFile,
-                     weak_factory_.GetWeakPtr(), swap_url, swap_file_system,
-                     std::move(callback)));
+      storage::FileSystemOperation::CopyProgressCallback());
 }
 
 void NativeFileSystemFileHandleImpl::DidCopySwapFile(
@@ -281,7 +319,7 @@ void NativeFileSystemFileHandleImpl::DidCopySwapFile(
     storage::IsolatedContext::ScopedFSHandle swap_file_system,
     CreateFileWriterCallback callback,
     base::File::Error result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (result != base::File::FILE_OK) {
     DLOG(ERROR) << "Error Creating Swap File, status: "
                 << base::File::ErrorToString(result)
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.h b/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.h
index ed2e3f9d10e..1bc285c6f26 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.h
+++ b/chromium/content/browser/native_file_system/native_file_system_file_handle_impl.h
@@ -10,6 +10,7 @@
 #include "content/browser/native_file_system/native_file_system_handle_base.h"
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "storage/browser/fileapi/file_system_url.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_file_handle.mojom.h"
 
@@ -20,13 +21,8 @@ namespace content {
 // owned by the NativeFileSystemManagerImpl instance passed in to the
 // constructor.
 //
-// This class is not thread safe, all methods should be called on the IO thread.
-// The link to the IO thread is due to its dependencies on both the blob system
-// (via storage::BlobStorageContext) and the file system backends (via
-// storage::FileSystemContext and storage::FileSystemOperationRunner, which both
-// expect some of their methods to always be called on the IO thread).
-// See https://crbug.com/957249 for some thoughts about the blob system aspect
-// of this.
+// This class is not thread safe, all methods must be called from the same
+// sequence.
 class CONTENT_EXPORT NativeFileSystemFileHandleImpl
     : public NativeFileSystemHandleBase,
       public blink::mojom::NativeFileSystemFileHandle {
@@ -46,7 +42,8 @@ class CONTENT_EXPORT NativeFileSystemFileHandleImpl
   void CreateFileWriter(bool keep_existing_data,
                         CreateFileWriterCallback callback) override;
   void Transfer(
-      blink::mojom::NativeFileSystemTransferTokenRequest token) override;
+      mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken> token)
+      override;
 
   void set_max_swap_files_for_testing(int max) { max_swap_files_ = max; }
 
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_handle_impl_unittest.cc b/chromium/content/browser/native_file_system/native_file_system_file_handle_impl_unittest.cc
index 2f205cbe35d..28c50d487a0 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_handle_impl_unittest.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_file_handle_impl_unittest.cc
@@ -72,6 +72,8 @@ class NativeFileSystemFileHandleImplTest : public testing::Test {
             allow_grant_, allow_grant_, /*file_system=*/{}));
   }
 
+  void TearDown() override { task_environment_.RunUntilIdle(); }
+
   std::string ReadFile(const FileSystemURL& url) {
     std::unique_ptr<storage::FileStreamReader> reader =
         file_system_context_->CreateFileStreamReader(
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.cc b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.cc
index f4992ddb496..5a50abda3bb 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.cc
@@ -14,12 +14,14 @@
 #include "crypto/secure_hash.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/fileapi/file_system_operation_runner.h"
+#include "third_party/blink/public/common/blob/blob_utils.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_error.mojom.h"
 
 using blink::mojom::NativeFileSystemStatus;
 using storage::BlobDataHandle;
 using storage::FileSystemOperation;
+using storage::FileSystemOperationRunner;
 
 namespace {
 
@@ -34,7 +36,7 @@ quarantine::mojom::QuarantineFileResult AnnotateFileSync(
   return result;
 }
 
-// For safe browsing we need the hash and size of the file. That data is
+// For after write checks we need the hash and size of the file. That data is
 // calculated on a worker thread, and this struct is used to pass it back.
 struct HashResult {
   base::File::Error status;
@@ -98,17 +100,19 @@ NativeFileSystemFileWriterImpl::NativeFileSystemFileWriterImpl(
 
 NativeFileSystemFileWriterImpl::~NativeFileSystemFileWriterImpl() {
   if (can_purge()) {
-    manager()->operation_runner()->RemoveFile(
-        swap_url(), base::BindOnce(
-                        [](const storage::FileSystemURL& swap_url,
-                           base::File::Error result) {
-                          if (result != base::File::FILE_OK) {
-                            DLOG(ERROR) << "Error Deleting Swap File, status: "
-                                        << base::File::ErrorToString(result)
-                                        << " path: " << swap_url.path();
-                          }
-                        },
-                        swap_url()));
+    DoFileSystemOperation(FROM_HERE, &FileSystemOperationRunner::RemoveFile,
+                          base::BindOnce(
+                              [](const storage::FileSystemURL& swap_url,
+                                 base::File::Error result) {
+                                if (result != base::File::FILE_OK) {
+                                  DLOG(ERROR)
+                                      << "Error Deleting Swap File, status: "
+                                      << base::File::ErrorToString(result)
+                                      << " path: " << swap_url.path();
+                                }
+                              },
+                              swap_url()),
+                          swap_url());
   }
 }
 
@@ -116,7 +120,7 @@ void NativeFileSystemFileWriterImpl::Write(
     uint64_t offset,
     mojo::PendingRemote<blink::mojom::Blob> data,
     WriteCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   RunWithWritePermission(
       base::BindOnce(&NativeFileSystemFileWriterImpl::WriteImpl,
@@ -133,7 +137,7 @@ void NativeFileSystemFileWriterImpl::WriteStream(
     uint64_t offset,
     mojo::ScopedDataPipeConsumerHandle stream,
     WriteStreamCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   RunWithWritePermission(
       base::BindOnce(&NativeFileSystemFileWriterImpl::WriteStreamImpl,
@@ -148,7 +152,7 @@ void NativeFileSystemFileWriterImpl::WriteStream(
 
 void NativeFileSystemFileWriterImpl::Truncate(uint64_t length,
                                               TruncateCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   RunWithWritePermission(
       base::BindOnce(&NativeFileSystemFileWriterImpl::TruncateImpl,
@@ -161,7 +165,7 @@ void NativeFileSystemFileWriterImpl::Truncate(uint64_t length,
 }
 
 void NativeFileSystemFileWriterImpl::Close(CloseCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   RunWithWritePermission(
       base::BindOnce(&NativeFileSystemFileWriterImpl::CloseImpl,
@@ -177,7 +181,7 @@ void NativeFileSystemFileWriterImpl::WriteImpl(
     uint64_t offset,
     mojo::PendingRemote<blink::mojom::Blob> data,
     WriteCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
@@ -190,38 +194,38 @@ void NativeFileSystemFileWriterImpl::WriteImpl(
     return;
   }
 
-  blob_context()->GetBlobDataFromBlobRemote(
-      std::move(data),
-      base::BindOnce(&NativeFileSystemFileWriterImpl::DoWriteBlob,
-                     weak_factory_.GetWeakPtr(), std::move(callback), offset));
-}
-
-void NativeFileSystemFileWriterImpl::DoWriteBlob(
-    WriteCallback callback,
-    uint64_t position,
-    std::unique_ptr<BlobDataHandle> blob) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-
-  if (!blob) {
+  MojoCreateDataPipeOptions options;
+  options.struct_size = sizeof(MojoCreateDataPipeOptions);
+  options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
+  options.element_num_bytes = 1;
+  options.capacity_num_bytes =
+      blink::BlobUtils::GetDataPipeCapacity(blink::BlobUtils::kUnknownSize);
+
+  mojo::ScopedDataPipeProducerHandle producer_handle;
+  mojo::ScopedDataPipeConsumerHandle consumer_handle;
+  MojoResult rv =
+      mojo::CreateDataPipe(&options, &producer_handle, &consumer_handle);
+  if (rv != MOJO_RESULT_OK) {
     std::move(callback).Run(
         native_file_system_error::FromStatus(
-            NativeFileSystemStatus::kInvalidArgument, "Blob does not exist"),
+            NativeFileSystemStatus::kOperationFailed,
+            "Internal read error: failed to create mojo data pipe."),
         /*bytes_written=*/0);
     return;
   }
 
-  operation_runner()->Write(
-      swap_url(), std::move(blob), position,
-      base::BindRepeating(&NativeFileSystemFileWriterImpl::DidWrite,
-                          weak_factory_.GetWeakPtr(),
-                          base::Owned(new WriteState{std::move(callback)})));
+  // TODO(mek): We can do this transformation from Blob to DataPipe in the
+  // renderer, and simplify the mojom exposed interface.
+  mojo::Remote<blink::mojom::Blob> blob(std::move(data));
+  blob->ReadAll(std::move(producer_handle), mojo::NullRemote());
+  WriteStreamImpl(offset, std::move(consumer_handle), std::move(callback));
 }
 
 void NativeFileSystemFileWriterImpl::WriteStreamImpl(
     uint64_t offset,
     mojo::ScopedDataPipeConsumerHandle stream,
     WriteStreamCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
@@ -234,18 +238,19 @@ void NativeFileSystemFileWriterImpl::WriteStreamImpl(
     return;
   }
 
-  operation_runner()->Write(
-      swap_url(), std::move(stream), offset,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::WriteStream,
       base::BindRepeating(&NativeFileSystemFileWriterImpl::DidWrite,
                           weak_factory_.GetWeakPtr(),
-                          base::Owned(new WriteState{std::move(callback)})));
+                          base::Owned(new WriteState{std::move(callback)})),
+      swap_url(), std::move(stream), offset);
 }
 
 void NativeFileSystemFileWriterImpl::DidWrite(WriteState* state,
                                               base::File::Error result,
                                               int64_t bytes,
                                               bool complete) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   DCHECK(state);
   state->bytes_written += bytes;
@@ -258,7 +263,7 @@ void NativeFileSystemFileWriterImpl::DidWrite(WriteState* state,
 
 void NativeFileSystemFileWriterImpl::TruncateImpl(uint64_t length,
                                                   TruncateCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
 
@@ -269,18 +274,19 @@ void NativeFileSystemFileWriterImpl::TruncateImpl(uint64_t length,
     return;
   }
 
-  operation_runner()->Truncate(
-      swap_url(), length,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::Truncate,
       base::BindOnce(
           [](TruncateCallback callback, base::File::Error result) {
             std::move(callback).Run(
                 native_file_system_error::FromFileError(result));
           },
-          std::move(callback)));
+          std::move(callback)),
+      swap_url(), length);
 }
 
 void NativeFileSystemFileWriterImpl::CloseImpl(CloseCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(GetWritePermissionStatus(),
             blink::mojom::PermissionStatus::GRANTED);
   if (is_closed()) {
@@ -292,22 +298,22 @@ void NativeFileSystemFileWriterImpl::CloseImpl(CloseCallback callback) {
 
   // Should the writer be destructed at this point, we want to allow the
   // close operation to run its course, so we should not purge the swap file.
-  // If the safe browsing check fails, the callback for that will clean up the
+  // If the after write check fails, the callback for that will clean up the
   // swap file even if the writer was destroyed at that point.
   state_ = State::kClosePending;
 
-  if (!require_safe_browsing_check() || !manager()->permission_context()) {
-    DidPassSafeBrowsingCheck(std::move(callback));
+  if (!RequireAfterWriteCheck() || !manager()->permission_context()) {
+    DidPassAfterWriteCheck(std::move(callback));
     return;
   }
 
   ComputeHashForSwapFile(base::BindOnce(
-      &NativeFileSystemFileWriterImpl::DoSafeBrowsingCheck,
+      &NativeFileSystemFileWriterImpl::DoAfterWriteCheck,
       weak_factory_.GetWeakPtr(), swap_url().path(), std::move(callback)));
 }
 
 // static
-void NativeFileSystemFileWriterImpl::DoSafeBrowsingCheck(
+void NativeFileSystemFileWriterImpl::DoAfterWriteCheck(
     base::WeakPtr<NativeFileSystemFileWriterImpl> file_writer,
     const base::FilePath& swap_path,
     NativeFileSystemFileWriterImpl::CloseCallback callback,
@@ -326,6 +332,8 @@ void NativeFileSystemFileWriterImpl::DoSafeBrowsingCheck(
     return;
   }
 
+  DCHECK_CALLED_ON_VALID_SEQUENCE(file_writer->sequence_checker_);
+
   auto item = std::make_unique<NativeFileSystemWriteItem>();
   item->target_file_path = file_writer->url().path();
   item->full_path = file_writer->swap_url().path();
@@ -333,22 +341,23 @@ void NativeFileSystemFileWriterImpl::DoSafeBrowsingCheck(
   item->size = size;
   item->frame_url = file_writer->context().url;
   item->has_user_gesture = file_writer->has_transient_user_activation_;
-  file_writer->manager()->permission_context()->PerformSafeBrowsingChecks(
+  file_writer->manager()->permission_context()->PerformAfterWriteChecks(
       std::move(item), file_writer->context().process_id,
       file_writer->context().frame_id,
-      base::BindOnce(&NativeFileSystemFileWriterImpl::DidSafeBrowsingCheck,
+      base::BindOnce(&NativeFileSystemFileWriterImpl::DidAfterWriteCheck,
                      file_writer, swap_path, std::move(callback)));
 }
 
 // static
-void NativeFileSystemFileWriterImpl::DidSafeBrowsingCheck(
+void NativeFileSystemFileWriterImpl::DidAfterWriteCheck(
     base::WeakPtr<NativeFileSystemFileWriterImpl> file_writer,
     const base::FilePath& swap_path,
     NativeFileSystemFileWriterImpl::CloseCallback callback,
-    NativeFileSystemPermissionContext::SafeBrowsingResult result) {
+    NativeFileSystemPermissionContext::AfterWriteCheckResult result) {
   if (file_writer &&
-      result == NativeFileSystemPermissionContext::SafeBrowsingResult::kAllow) {
-    file_writer->DidPassSafeBrowsingCheck(std::move(callback));
+      result ==
+          NativeFileSystemPermissionContext::AfterWriteCheckResult::kAllow) {
+    file_writer->DidPassAfterWriteCheck(std::move(callback));
     return;
   }
 
@@ -364,24 +373,25 @@ void NativeFileSystemFileWriterImpl::DidSafeBrowsingCheck(
   return;
 }
 
-void NativeFileSystemFileWriterImpl::DidPassSafeBrowsingCheck(
+void NativeFileSystemFileWriterImpl::DidPassAfterWriteCheck(
     CloseCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // If the move operation succeeds, the path pointing to the swap file
   // will not exist anymore.
   // In case of error, the swap file URL will point to a valid filesystem
   // location. The file at this URL will be deleted when the mojo pipe closes.
-  operation_runner()->Move(
-      swap_url(), url(),
-      storage::FileSystemOperation::OPTION_PRESERVE_LAST_MODIFIED,
+  DoFileSystemOperation(
+      FROM_HERE, &FileSystemOperationRunner::Move,
       base::BindOnce(&NativeFileSystemFileWriterImpl::DidSwapFileBeforeClose,
-                     weak_factory_.GetWeakPtr(), std::move(callback)));
+                     weak_factory_.GetWeakPtr(), std::move(callback)),
+      swap_url(), url(),
+      storage::FileSystemOperation::OPTION_PRESERVE_LAST_MODIFIED);
 }
 
 void NativeFileSystemFileWriterImpl::DidSwapFileBeforeClose(
     CloseCallback callback,
     base::File::Error result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (result != base::File::FILE_OK) {
     state_ = State::kCloseError;
     DLOG(ERROR) << "Swap file move operation failed source: "
@@ -413,7 +423,7 @@ void NativeFileSystemFileWriterImpl::DidSwapFileBeforeClose(
 void NativeFileSystemFileWriterImpl::DidAnnotateFile(
     CloseCallback callback,
     quarantine::mojom::QuarantineFileResult result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   state_ = State::kClosed;
 
   if (result != quarantine::mojom::QuarantineFileResult::OK &&
@@ -433,6 +443,7 @@ void NativeFileSystemFileWriterImpl::DidAnnotateFile(
 
 void NativeFileSystemFileWriterImpl::ComputeHashForSwapFile(
     HashCallback callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK_EQ(swap_url().type(), storage::kFileSystemTypeNativeLocal);
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {base::ThreadPool(), base::MayBlock()},
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.h b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.h
index 7e81909bf4b..797cb4a2613 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.h
+++ b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl.h
@@ -23,13 +23,8 @@ namespace content {
 // owned by the NativeFileSystemManagerImpl instance passed in to the
 // constructor.
 //
-// This class is not thread safe, all methods should be called on the IO thread.
-// The link to the IO thread is due to its dependencies on both the blob system
-// (via storage::BlobStorageContext) and the file system backends (via
-// storage::FileSystemContext and storage::FileSystemOperationRunner, which both
-// expect some of their methods to always be called on the IO thread).
-// See https://crbug.com/957249 for some thoughts about the blob system aspect
-// of this.
+// This class is not thread safe, all methods must be called from the same
+// sequence.
 class CONTENT_EXPORT NativeFileSystemFileWriterImpl
     : public NativeFileSystemHandleBase,
       public blink::mojom::NativeFileSystemFileWriter {
@@ -76,9 +71,6 @@ class CONTENT_EXPORT NativeFileSystemFileWriterImpl
   void WriteImpl(uint64_t offset,
                  mojo::PendingRemote<blink::mojom::Blob> data,
                  WriteCallback callback);
-  void DoWriteBlob(WriteCallback callback,
-                   uint64_t position,
-                   std::unique_ptr<storage::BlobDataHandle> blob);
   void WriteStreamImpl(uint64_t offset,
                        mojo::ScopedDataPipeConsumerHandle stream,
                        WriteStreamCallback callback);
@@ -90,25 +82,25 @@ class CONTENT_EXPORT NativeFileSystemFileWriterImpl
   void CloseImpl(CloseCallback callback);
   // The following two methods are static, because they need to be invoked to
   // perform cleanup even if the writer was deleted before they were invoked.
-  static void DoSafeBrowsingCheck(
+  static void DoAfterWriteCheck(
       base::WeakPtr<NativeFileSystemFileWriterImpl> file_writer,
       const base::FilePath& swap_path,
       NativeFileSystemFileWriterImpl::CloseCallback callback,
       base::File::Error hash_result,
       const std::string& hash,
       int64_t size);
-  static void DidSafeBrowsingCheck(
+  static void DidAfterWriteCheck(
       base::WeakPtr<NativeFileSystemFileWriterImpl> file_writer,
       const base::FilePath& swap_path,
       NativeFileSystemFileWriterImpl::CloseCallback callback,
-      NativeFileSystemPermissionContext::SafeBrowsingResult result);
-  void DidPassSafeBrowsingCheck(CloseCallback callback);
+      NativeFileSystemPermissionContext::AfterWriteCheckResult result);
+  void DidPassAfterWriteCheck(CloseCallback callback);
   void DidSwapFileBeforeClose(CloseCallback callback, base::File::Error result);
   void DidAnnotateFile(CloseCallback callback,
                        quarantine::mojom::QuarantineFileResult result);
 
-  // Safe browsing checks only apply to native local paths.
-  bool require_safe_browsing_check() {
+  // After write checks only apply to native local paths.
+  bool RequireAfterWriteCheck() const {
     return url().type() == storage::kFileSystemTypeNativeLocal;
   }
 
@@ -149,7 +141,7 @@ class CONTENT_EXPORT NativeFileSystemFileWriterImpl
 
   bool skip_quarantine_check_for_testing_ = false;
 
-  // Keeps track of user activation state at creation time for SafeBrowsing
+  // Keeps track of user activation state at creation time for after write
   // checks.
   bool has_transient_user_activation_ = false;
 
diff --git a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_unittest.cc b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_unittest.cc
index 2bcae929acd..dc9292a79a3 100644
--- a/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_unittest.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_file_writer_impl_unittest.cc
@@ -109,6 +109,9 @@ class NativeFileSystemFileWriterImplTest : public testing::Test {
   }
 
   void TearDown() override {
+    handle_.reset();
+    manager_.reset();
+
     task_environment_.RunUntilIdle();
     EXPECT_TRUE(dir_.Delete());
   }
@@ -277,13 +280,17 @@ INSTANTIATE_TEST_SUITE_P(NativeFileSystemFileWriterImplTest,
                          ::testing::Bool());
 
 TEST_F(NativeFileSystemFileWriterImplTest, WriteInvalidBlob) {
+  // This test primarily verifies behavior of the browser process in the
+  // presence of a compromised renderer process. The situation this tests for
+  // normally can't occur. As such it doesn't really matter what status the
+  // write operation returns, the important part is that nothing crashes.
+
   mojo::PendingRemote<blink::mojom::Blob> blob;
   ignore_result(blob.InitWithNewPipeAndPassReceiver());
 
   uint64_t bytes_written;
   NativeFileSystemStatus result =
       WriteBlobSync(0, std::move(blob), &bytes_written);
-  EXPECT_EQ(result, NativeFileSystemStatus::kInvalidArgument);
   EXPECT_EQ(bytes_written, 0u);
 
   result = CloseSync();
@@ -419,7 +426,7 @@ TEST_P(NativeFileSystemFileWriterImplWriteTest, WriteWithOffsetPastFile) {
   result = CloseSync();
   EXPECT_EQ(result, NativeFileSystemStatus::kOk);
 
-  using namespace std::string_literals;
+  using std::string_literals::operator""s;
   EXPECT_EQ("\0\0\0\0abc"s, ReadFile(test_file_url_));
 }
 
@@ -497,7 +504,7 @@ TEST_P(NativeFileSystemFileWriterImplWriteTest, WriteAfterCloseNotOK) {
 
 // TODO(mek): More tests, particularly for error conditions.
 
-class NativeFileSystemFileWriterSafeBrowsingTest
+class NativeFileSystemFileWriterAfterWriteChecksTest
     : public NativeFileSystemFileWriterImplTest {
  public:
   NativeFileSystemPermissionContext* permission_context() override {
@@ -509,7 +516,7 @@ class NativeFileSystemFileWriterSafeBrowsingTest
       permission_context_;
 };
 
-TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, Allow) {
+TEST_F(NativeFileSystemFileWriterAfterWriteChecksTest, Allow) {
   uint64_t bytes_written;
   NativeFileSystemStatus result = WriteSync(0, "abc", &bytes_written);
   EXPECT_EQ(result, NativeFileSystemStatus::kOk);
@@ -523,7 +530,7 @@ TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, Allow) {
 
   EXPECT_CALL(
       permission_context_,
-      PerformSafeBrowsingChecks_(
+      PerformAfterWriteChecks_(
           AllOf(
               Field(&NativeFileSystemWriteItem::target_file_path,
                     Eq(test_file_url_.path())),
@@ -535,7 +542,7 @@ TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, Allow) {
               Field(&NativeFileSystemWriteItem::has_user_gesture, Eq(false))),
           kProcessId, kFrameId, _))
       .WillOnce(base::test::RunOnceCallback<3>(
-          NativeFileSystemPermissionContext::SafeBrowsingResult::kAllow));
+          NativeFileSystemPermissionContext::AfterWriteCheckResult::kAllow));
 
   result = CloseSync();
   EXPECT_EQ(result, NativeFileSystemStatus::kOk);
@@ -548,16 +555,16 @@ TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, Allow) {
                                               test_file_url_, 3));
 }
 
-TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, Block) {
+TEST_F(NativeFileSystemFileWriterAfterWriteChecksTest, Block) {
   uint64_t bytes_written;
   NativeFileSystemStatus result = WriteSync(0, "abc", &bytes_written);
   EXPECT_EQ(result, NativeFileSystemStatus::kOk);
   EXPECT_EQ(bytes_written, 3u);
 
   EXPECT_CALL(permission_context_,
-              PerformSafeBrowsingChecks_(_, kProcessId, kFrameId, _))
+              PerformAfterWriteChecks_(_, kProcessId, kFrameId, _))
       .WillOnce(base::test::RunOnceCallback<3>(
-          NativeFileSystemPermissionContext::SafeBrowsingResult::kBlock));
+          NativeFileSystemPermissionContext::AfterWriteCheckResult::kBlock));
 
   result = CloseSync();
   EXPECT_EQ(result, NativeFileSystemStatus::kOperationAborted);
@@ -570,17 +577,17 @@ TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, Block) {
                                               test_file_url_, 0));
 }
 
-TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, HandleCloseDuringCheck) {
+TEST_F(NativeFileSystemFileWriterAfterWriteChecksTest, HandleCloseDuringCheck) {
   uint64_t bytes_written;
   NativeFileSystemStatus result = WriteSync(0, "abc", &bytes_written);
   EXPECT_EQ(result, NativeFileSystemStatus::kOk);
   EXPECT_EQ(bytes_written, 3u);
 
   using SBCallback = base::OnceCallback<void(
-      NativeFileSystemPermissionContext::SafeBrowsingResult)>;
+      NativeFileSystemPermissionContext::AfterWriteCheckResult)>;
   SBCallback sb_callback;
   base::RunLoop loop;
-  EXPECT_CALL(permission_context_, PerformSafeBrowsingChecks_)
+  EXPECT_CALL(permission_context_, PerformAfterWriteChecks_)
       .WillOnce(
           testing::Invoke([&](NativeFileSystemWriteItem* item, int process_id,
                               int frame_id, SBCallback& callback) {
@@ -600,7 +607,7 @@ TEST_F(NativeFileSystemFileWriterSafeBrowsingTest, HandleCloseDuringCheck) {
       AsyncFileTestHelper::kDontCheckSize));
 
   std::move(sb_callback)
-      .Run(NativeFileSystemPermissionContext::SafeBrowsingResult::kAllow);
+      .Run(NativeFileSystemPermissionContext::AfterWriteCheckResult::kAllow);
 
   // Swap file should now be deleted, target file should be unmodified.
   task_environment_.RunUntilIdle();
diff --git a/chromium/content/browser/native_file_system/native_file_system_handle_base.cc b/chromium/content/browser/native_file_system/native_file_system_handle_base.cc
index b92e673e4d6..58e4de87baa 100644
--- a/chromium/content/browser/native_file_system/native_file_system_handle_base.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_handle_base.cc
@@ -7,6 +7,7 @@
 #include "base/task/post_task.h"
 #include "content/browser/native_file_system/native_file_system_error.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/web_contents_observer.h"
 
@@ -24,6 +25,10 @@ class NativeFileSystemHandleBase::UsageIndicatorTracker
         is_directory_(is_directory),
         directory_path_(directory_path) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    // Disable back-forward cache as native file system's usage of
+    // RenderFrameHost::IsCurrent at the moment is not compatible with bfcache.
+    BackForwardCache::DisableForRenderFrameHost(
+        GlobalFrameRoutingId(process_id, frame_id), "NativeFileSystem");
     if (web_contents()) {
       web_contents()->IncrementNativeFileSystemHandleCount();
       if (is_directory_)
@@ -132,6 +137,7 @@ NativeFileSystemHandleBase::NativeFileSystemHandleBase(
 }
 
 NativeFileSystemHandleBase::~NativeFileSystemHandleBase() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   // It is fine to remove an observer that never was added, so no need to check
   // for URL type and/or the same grant being used for read and write access.
   handle_state_.read_grant->RemoveObserver(this);
@@ -140,11 +146,13 @@ NativeFileSystemHandleBase::~NativeFileSystemHandleBase() {
 
 NativeFileSystemHandleBase::PermissionStatus
 NativeFileSystemHandleBase::GetReadPermissionStatus() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return handle_state_.read_grant->GetStatus();
 }
 
 NativeFileSystemHandleBase::PermissionStatus
 NativeFileSystemHandleBase::GetWritePermissionStatus() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   UpdateUsage();
   // It is not currently possible to have write only handles, so first check the
   // read permission status. See also:
@@ -159,6 +167,7 @@ NativeFileSystemHandleBase::GetWritePermissionStatus() {
 void NativeFileSystemHandleBase::DoGetPermissionStatus(
     bool writable,
     base::OnceCallback<void(PermissionStatus)> callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   std::move(callback).Run(writable ? GetWritePermissionStatus()
                                    : GetReadPermissionStatus());
 }
@@ -167,6 +176,7 @@ void NativeFileSystemHandleBase::DoRequestPermission(
     bool writable,
     base::OnceCallback<void(blink::mojom::NativeFileSystemErrorPtr,
                             PermissionStatus)> callback) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   PermissionStatus current_status =
       writable ? GetWritePermissionStatus() : GetReadPermissionStatus();
   // If we already have a valid permission status, just return that. Also just
@@ -205,6 +215,7 @@ void NativeFileSystemHandleBase::DidRequestPermission(
     base::OnceCallback<void(blink::mojom::NativeFileSystemErrorPtr,
                             PermissionStatus)> callback,
     NativeFileSystemPermissionGrant::PermissionRequestOutcome outcome) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   using Outcome = NativeFileSystemPermissionGrant::PermissionRequestOutcome;
   switch (outcome) {
     case Outcome::kInvalidFrame:
@@ -236,6 +247,7 @@ void NativeFileSystemHandleBase::DidRequestPermission(
 }
 
 void NativeFileSystemHandleBase::UpdateUsage() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   if (!usage_indicator_tracker_)
     return;
   bool is_readable =
@@ -253,6 +265,7 @@ void NativeFileSystemHandleBase::UpdateUsage() {
 }
 
 void NativeFileSystemHandleBase::OnPermissionStatusChanged() {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   UpdateUsage();
 }
 
diff --git a/chromium/content/browser/native_file_system/native_file_system_handle_base.h b/chromium/content/browser/native_file_system/native_file_system_handle_base.h
index 15fe351ef49..025e80ed0eb 100644
--- a/chromium/content/browser/native_file_system/native_file_system_handle_base.h
+++ b/chromium/content/browser/native_file_system/native_file_system_handle_base.h
@@ -8,9 +8,11 @@
 #include <vector>
 
 #include "base/memory/weak_ptr.h"
+#include "base/sequence_checker.h"
 #include "base/threading/sequence_bound.h"
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
 #include "content/common/content_export.h"
+#include "storage/browser/fileapi/file_system_operation_runner.h"
 #include "storage/browser/fileapi/file_system_url.h"
 #include "storage/browser/fileapi/isolated_context.h"
 #include "third_party/blink/public/mojom/permissions/permission_status.mojom.h"
@@ -18,7 +20,6 @@
 namespace storage {
 class FileSystemContext;
 class FileSystemOperationRunner;
-class BlobStorageContext;
 }  // namespace storage
 
 namespace content {
@@ -28,10 +29,10 @@ namespace content {
 // such as permission requests. Instances of this class should be owned by the
 // NativeFileSystemManagerImpl instance passed in to the constructor.
 //
-// This class is not thread safe, all methods should only be called on the IO
-// thread. This is because code interacts directly with the file system backends
-// (via storage::FileSystemContext and store::FileSystemOperationRunner, which
-// both expect some of their methods to only be called on the IO thread).
+// This class is not thread safe, all methods must be called from the same
+// sequence. That sequence also has to be the same sequence on which the
+// NativeFileSystemPermissionContext expects to be interacted with, which
+// is the UI thread.
 class CONTENT_EXPORT NativeFileSystemHandleBase
     : public NativeFileSystemPermissionGrant::Observer {
  public:
@@ -79,21 +80,106 @@ class CONTENT_EXPORT NativeFileSystemHandleBase
  protected:
   NativeFileSystemManagerImpl* manager() { return manager_; }
   const BindingContext& context() { return context_; }
-  storage::FileSystemOperationRunner* operation_runner() {
-    return manager()->operation_runner();
-  }
   storage::FileSystemContext* file_system_context() {
     return manager()->context();
   }
-  storage::BlobStorageContext* blob_context() {
-    return manager()->blob_context();
-  }
 
   virtual base::WeakPtr<NativeFileSystemHandleBase> AsWeakPtr() = 0;
 
   // NativeFileSystemPermissionGrant::Observer:
   void OnPermissionStatusChanged() override;
 
+  // Invokes |method| on the correct sequence on this handle's
+  // FileSystemOperationRunner, passing |args| and a callback to the method. The
+  // passed in |callback| is wrapped to make sure it is called on the correct
+  // sequence before passing it off to the |method|.
+  //
+  // Note that |callback| is passed to this method before other arguments, while
+  // the wrapped callback will be passed as last argument to the underlying
+  // FileSystemOperation |method|.
+  //
+  // TODO(mek): Once Promises are a thing, this can be done a lot cleaner, and
+  // mostly just be integrated in base::SequenceBound, eliminating the need for
+  // these helper methods.
+  template <typename... MethodArgs,
+            typename... ArgsMinusCallback,
+            typename... CallbackArgs>
+  void DoFileSystemOperation(
+      const base::Location& from_here,
+      storage::FileSystemOperationRunner::OperationID (
+          storage::FileSystemOperationRunner::*method)(MethodArgs...),
+      base::OnceCallback<void(CallbackArgs...)> callback,
+      ArgsMinusCallback&&... args) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    // Wrap the passed in callback in one that posts a task back to the current
+    // sequence.
+    auto wrapped_callback = base::BindOnce(
+        [](scoped_refptr<base::SequencedTaskRunner> runner,
+           base::OnceCallback<void(CallbackArgs...)> callback,
+           CallbackArgs... args) {
+          runner->PostTask(FROM_HERE,
+                           base::BindOnce(std::move(callback),
+                                          std::forward<CallbackArgs>(args)...));
+        },
+        base::SequencedTaskRunnerHandle::Get(), std::move(callback));
+
+    // And then post a task to the sequence bound operation runner to run the
+    // provided method with the provided arguments (and the wrapped callback).
+    manager()->operation_runner().PostTaskWithThisObject(
+        from_here,
+        base::BindOnce(
+            [](scoped_refptr<storage::FileSystemContext>,
+               storage::FileSystemOperationRunner::OperationID (
+                   storage::FileSystemOperationRunner::*method)(MethodArgs...),
+               MethodArgs... args, storage::FileSystemOperationRunner* runner) {
+              (runner->*method)(std::forward<MethodArgs>(args)...);
+            },
+            base::WrapRefCounted(file_system_context()), method,
+            std::forward<ArgsMinusCallback>(args)...,
+            std::move(wrapped_callback)));
+  }
+  // Same as the previous overload, but using RepeatingCallback and
+  // BindRepeating instead.
+  template <typename... MethodArgs,
+            typename... ArgsMinusCallback,
+            typename... CallbackArgs>
+  void DoFileSystemOperation(
+      const base::Location& from_here,
+      storage::FileSystemOperationRunner::OperationID (
+          storage::FileSystemOperationRunner::*method)(MethodArgs...),
+      base::RepeatingCallback<void(CallbackArgs...)> callback,
+      ArgsMinusCallback&&... args) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    // Wrap the passed in callback in one that posts a task back to the current
+    // sequence.
+    auto wrapped_callback = base::BindRepeating(
+        [](scoped_refptr<base::SequencedTaskRunner> runner,
+           const base::RepeatingCallback<void(CallbackArgs...)>& callback,
+           CallbackArgs... args) {
+          runner->PostTask(
+              FROM_HERE,
+              base::BindOnce(callback, std::forward<CallbackArgs>(args)...));
+        },
+        base::SequencedTaskRunnerHandle::Get(), std::move(callback));
+
+    // And then post a task to the sequence bound operation runner to run the
+    // provided method with the provided arguments (and the wrapped callback).
+    manager()->operation_runner().PostTaskWithThisObject(
+        from_here,
+        base::BindOnce(
+            [](scoped_refptr<storage::FileSystemContext>,
+               storage::FileSystemOperationRunner::OperationID (
+                   storage::FileSystemOperationRunner::*method)(MethodArgs...),
+               MethodArgs... args, storage::FileSystemOperationRunner* runner) {
+              (runner->*method)(std::forward<MethodArgs>(args)...);
+            },
+            base::WrapRefCounted(file_system_context()), method,
+            std::forward<ArgsMinusCallback>(args)...,
+            std::move(wrapped_callback)));
+  }
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
  private:
   void DidRequestPermission(
       bool writable,
@@ -122,6 +208,7 @@ void NativeFileSystemHandleBase::RunWithWritePermission(
     base::OnceCallback<void(CallbackArgType)> callback,
     base::OnceCallback<void(CallbackArgType)> no_permission_callback,
     CallbackArgType callback_arg) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DoRequestPermission(
       /*writable=*/true,
       base::BindOnce(
diff --git a/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc b/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc
index fc4e19a1128..7b3b4c47a62 100644
--- a/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_manager_impl.cc
@@ -37,6 +37,7 @@ using blink::mojom::NativeFileSystemStatus;
 using PermissionStatus = NativeFileSystemPermissionGrant::PermissionStatus;
 using SensitiveDirectoryResult =
     NativeFileSystemPermissionContext::SensitiveDirectoryResult;
+using storage::FileSystemContext;
 
 namespace {
 
@@ -92,6 +93,9 @@ void ShowFilePickerOnUIThread(const url::Origin& requesting_origin,
     return;
   }
 
+  // Drop fullscreen mode so that the user sees the URL bar.
+  web_contents->ForSecurityDropFullscreen();
+
   FileSystemChooser::CreateAndShow(web_contents, options, std::move(callback),
                                    std::move(callback_runner));
 }
@@ -144,49 +148,49 @@ NativeFileSystemManagerImpl::NativeFileSystemManagerImpl(
 }
 
 NativeFileSystemManagerImpl::~NativeFileSystemManagerImpl() {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 }
 
 void NativeFileSystemManagerImpl::BindReceiver(
     const BindingContext& binding_context,
     mojo::PendingReceiver<blink::mojom::NativeFileSystemManager> receiver) {
   DCHECK(base::FeatureList::IsEnabled(blink::features::kNativeFileSystemAPI));
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-
-  DCHECK(network::IsOriginPotentiallyTrustworthy(binding_context.origin));
-  receivers_.Add(this, std::move(receiver), binding_context);
-}
-
-// static
-void NativeFileSystemManagerImpl::BindReceiverFromUIThread(
-    StoragePartitionImpl* storage_partition,
-    const BindingContext& binding_context,
-    mojo::PendingReceiver<blink::mojom::NativeFileSystemManager> receiver) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
   if (!network::IsOriginPotentiallyTrustworthy(binding_context.origin)) {
     mojo::ReportBadMessage("Native File System access from Unsecure Origin");
     return;
   }
 
-  auto* manager = storage_partition->GetNativeFileSystemManager();
-  base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&NativeFileSystemManagerImpl::BindReceiver,
-                                base::Unretained(manager), binding_context,
-                                std::move(receiver)));
+  receivers_.Add(this, std::move(receiver), binding_context);
 }
 
 void NativeFileSystemManagerImpl::GetSandboxedFileSystem(
     GetSandboxedFileSystemCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  url::Origin origin = receivers_.current_context().origin;
-
-  context()->OpenFileSystem(
-      origin.GetURL(), storage::kFileSystemTypeTemporary,
-      storage::OPEN_FILE_SYSTEM_CREATE_IF_NONEXISTENT,
-      base::BindOnce(&NativeFileSystemManagerImpl::DidOpenSandboxedFileSystem,
-                     weak_factory_.GetWeakPtr(), receivers_.current_context(),
-                     std::move(callback)));
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+  auto response_callback = base::BindOnce(
+      [](base::WeakPtr<NativeFileSystemManagerImpl> manager,
+         const BindingContext& binding_context,
+         GetSandboxedFileSystemCallback callback,
+         scoped_refptr<base::SequencedTaskRunner> task_runner, const GURL& root,
+         const std::string& fs_name, base::File::Error result) {
+        task_runner->PostTask(
+            FROM_HERE,
+            base::BindOnce(
+                &NativeFileSystemManagerImpl::DidOpenSandboxedFileSystem,
+                std::move(manager), binding_context, std::move(callback), root,
+                fs_name, result));
+      },
+      weak_factory_.GetWeakPtr(), receivers_.current_context(),
+      std::move(callback), base::SequencedTaskRunnerHandle::Get());
+
+  GURL origin = receivers_.current_context().origin.GetURL();
+  base::PostTask(FROM_HERE, {BrowserThread::IO},
+                 base::BindOnce(&FileSystemContext::OpenFileSystem, context(),
+                                origin, storage::kFileSystemTypeTemporary,
+                                storage::OPEN_FILE_SYSTEM_CREATE_IF_NONEXISTENT,
+                                std::move(response_callback)));
 }
 
 void NativeFileSystemManagerImpl::ChooseEntries(
@@ -194,7 +198,7 @@ void NativeFileSystemManagerImpl::ChooseEntries(
     std::vector<blink::mojom::ChooseFileSystemEntryAcceptsOptionPtr> accepts,
     bool include_accepts_all,
     ChooseEntriesCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   const BindingContext& context = receivers_.current_context();
 
   // ChooseEntries API is only available to windows, as we need a frame to
@@ -226,7 +230,7 @@ void NativeFileSystemManagerImpl::ChooseEntries(
           base::BindOnce(&NativeFileSystemManagerImpl::DidChooseEntries,
                          weak_factory_.GetWeakPtr(), context, options,
                          std::move(callback)),
-          base::CreateSingleThreadTaskRunner({BrowserThread::IO})));
+          base::SequencedTaskRunnerHandle::Get()));
 }
 
 blink::mojom::NativeFileSystemEntryPtr
@@ -242,7 +246,7 @@ blink::mojom::NativeFileSystemEntryPtr
 NativeFileSystemManagerImpl::CreateDirectoryEntryFromPath(
     const BindingContext& binding_context,
     const base::FilePath& directory_path) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   auto url =
       CreateFileSystemURLFromPath(binding_context.origin, directory_path);
 
@@ -272,12 +276,10 @@ NativeFileSystemManagerImpl::CreateDirectoryEntryFromPath(
   }
 
   return blink::mojom::NativeFileSystemEntry::New(
-      blink::mojom::NativeFileSystemHandle::NewDirectory(
-          CreateDirectoryHandle(
-              binding_context, url.url,
-              SharedHandleState(std::move(read_grant), std::move(write_grant),
-                                std::move(url.file_system)))
-              .PassInterface()),
+      blink::mojom::NativeFileSystemHandle::NewDirectory(CreateDirectoryHandle(
+          binding_context, url.url,
+          SharedHandleState(std::move(read_grant), std::move(write_grant),
+                            std::move(url.file_system)))),
       url.base_name);
 }
 
@@ -295,7 +297,7 @@ NativeFileSystemManagerImpl::CreateFileHandle(
     const BindingContext& binding_context,
     const storage::FileSystemURL& url,
     const SharedHandleState& handle_state) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(url.is_valid());
   DCHECK_EQ(url.mount_type() == storage::kFileSystemTypeIsolated,
             handle_state.file_system.is_valid())
@@ -308,22 +310,22 @@ NativeFileSystemManagerImpl::CreateFileHandle(
   return result;
 }
 
-blink::mojom::NativeFileSystemDirectoryHandlePtr
+mojo::PendingRemote<blink::mojom::NativeFileSystemDirectoryHandle>
 NativeFileSystemManagerImpl::CreateDirectoryHandle(
     const BindingContext& binding_context,
     const storage::FileSystemURL& url,
     const SharedHandleState& handle_state) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(url.is_valid());
   DCHECK_EQ(url.mount_type() == storage::kFileSystemTypeIsolated,
             handle_state.file_system.is_valid())
       << url.mount_type();
 
-  blink::mojom::NativeFileSystemDirectoryHandlePtr result;
-  directory_bindings_.AddBinding(
+  mojo::PendingRemote<blink::mojom::NativeFileSystemDirectoryHandle> result;
+  directory_receivers_.Add(
       std::make_unique<NativeFileSystemDirectoryHandleImpl>(
           this, binding_context, url, handle_state),
-      mojo::MakeRequest(&result));
+      result.InitWithNewPipeAndPassReceiver());
   return result;
 }
 
@@ -333,13 +335,13 @@ NativeFileSystemManagerImpl::CreateFileWriter(
     const storage::FileSystemURL& url,
     const storage::FileSystemURL& swap_url,
     const SharedHandleState& handle_state) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   mojo::PendingRemote<blink::mojom::NativeFileSystemFileWriter> result;
   mojo::PendingReceiver<blink::mojom::NativeFileSystemFileWriter>
       writer_receiver = result.InitWithNewPipeAndPassReceiver();
 
-  base::PostTaskWithTraitsAndReplyWithResult(
+  base::PostTaskAndReplyWithResult(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&HasTransientUserActivation, binding_context.process_id,
                      binding_context.frame_id),
@@ -351,36 +353,44 @@ NativeFileSystemManagerImpl::CreateFileWriter(
 
 void NativeFileSystemManagerImpl::CreateTransferToken(
     const NativeFileSystemFileHandleImpl& file,
-    blink::mojom::NativeFileSystemTransferTokenRequest request) {
+    mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+        receiver) {
   return CreateTransferTokenImpl(file.url(), file.handle_state(),
-                                 /*is_directory=*/false, std::move(request));
+                                 /*is_directory=*/false, std::move(receiver));
 }
 
 void NativeFileSystemManagerImpl::CreateTransferToken(
     const NativeFileSystemDirectoryHandleImpl& directory,
-    blink::mojom::NativeFileSystemTransferTokenRequest request) {
+    mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+        receiver) {
   return CreateTransferTokenImpl(directory.url(), directory.handle_state(),
-                                 /*is_directory=*/true, std::move(request));
+                                 /*is_directory=*/true, std::move(receiver));
 }
 
 void NativeFileSystemManagerImpl::ResolveTransferToken(
-    blink::mojom::NativeFileSystemTransferTokenPtr token,
+    mojo::PendingRemote<blink::mojom::NativeFileSystemTransferToken> token,
     ResolvedTokenCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
-  auto* raw_token = token.get();
+  mojo::Remote<blink::mojom::NativeFileSystemTransferToken> token_remote(
+      std::move(token));
+  auto* raw_token = token_remote.get();
   raw_token->GetInternalID(mojo::WrapCallbackWithDefaultInvokeIfNotRun(
       base::BindOnce(&NativeFileSystemManagerImpl::DoResolveTransferToken,
-                     weak_factory_.GetWeakPtr(), std::move(token),
+                     weak_factory_.GetWeakPtr(), std::move(token_remote),
                      std::move(callback)),
       base::UnguessableToken()));
 }
 
-storage::FileSystemOperationRunner*
+const base::SequenceBound<storage::FileSystemOperationRunner>&
 NativeFileSystemManagerImpl::operation_runner() {
-  if (!operation_runner_)
-    operation_runner_ = context()->CreateFileSystemOperationRunner();
-  return operation_runner_.get();
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
+  if (!operation_runner_) {
+    operation_runner_ =
+        context()->CreateSequenceBoundFileSystemOperationRunner();
+  }
+  return operation_runner_;
 }
 
 void NativeFileSystemManagerImpl::DidOpenSandboxedFileSystem(
@@ -389,11 +399,11 @@ void NativeFileSystemManagerImpl::DidOpenSandboxedFileSystem(
     const GURL& root,
     const std::string& filesystem_name,
     base::File::Error result) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   if (result != base::File::FILE_OK) {
     std::move(callback).Run(native_file_system_error::FromFileError(result),
-                            nullptr);
+                            mojo::NullRemote());
     return;
   }
 
@@ -415,6 +425,8 @@ void NativeFileSystemManagerImpl::DidChooseEntries(
     ChooseEntriesCallback callback,
     blink::mojom::NativeFileSystemErrorPtr result,
     std::vector<base::FilePath> entries) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+
   if (result->status != NativeFileSystemStatus::kOk) {
     std::move(callback).Run(
         std::move(result),
@@ -446,6 +458,7 @@ void NativeFileSystemManagerImpl::DidVerifySensitiveDirectoryAccess(
     ChooseEntriesCallback callback,
     std::vector<base::FilePath> entries,
     SensitiveDirectoryResult result) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   base::UmaHistogramEnumeration(
       "NativeFileSystemAPI.SensitiveDirectoryAccessResult", result);
 
@@ -466,7 +479,7 @@ void NativeFileSystemManagerImpl::DidVerifySensitiveDirectoryAccess(
             base::BindOnce(&NativeFileSystemManagerImpl::DidChooseEntries,
                            weak_factory_.GetWeakPtr(), binding_context, options,
                            std::move(callback)),
-            base::CreateSingleThreadTaskRunner({BrowserThread::IO})));
+            base::SequencedTaskRunnerHandle::Get()));
     return;
   }
 
@@ -514,6 +527,7 @@ void NativeFileSystemManagerImpl::DidCreateOrTruncateSaveFile(
     const base::FilePath& path,
     ChooseEntriesCallback callback,
     bool success) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   std::vector<blink::mojom::NativeFileSystemEntryPtr> result_entries;
   if (!success) {
     std::move(callback).Run(
@@ -534,6 +548,7 @@ void NativeFileSystemManagerImpl::DidChooseDirectory(
     const base::FilePath& path,
     ChooseEntriesCallback callback,
     NativeFileSystemPermissionContext::PermissionStatus permission) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   base::UmaHistogramEnumeration(
       "NativeFileSystemAPI.ConfirmReadDirectoryResult", permission);
 
@@ -554,44 +569,38 @@ void NativeFileSystemManagerImpl::CreateTransferTokenImpl(
     const storage::FileSystemURL& url,
     const SharedHandleState& handle_state,
     bool is_directory,
-    blink::mojom::NativeFileSystemTransferTokenRequest request) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+    mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+        receiver) {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   auto token_impl = std::make_unique<NativeFileSystemTransferTokenImpl>(
       url, handle_state,
       is_directory ? NativeFileSystemTransferTokenImpl::HandleType::kDirectory
-                   : NativeFileSystemTransferTokenImpl::HandleType::kFile);
+                   : NativeFileSystemTransferTokenImpl::HandleType::kFile,
+      this, std::move(receiver));
   auto token = token_impl->token();
-  blink::mojom::NativeFileSystemTransferTokenPtr result;
-  auto emplace_result = transfer_tokens_.emplace(
-      std::piecewise_construct, std::forward_as_tuple(token),
-      std::forward_as_tuple(std::move(token_impl), std::move(request)));
-  DCHECK(emplace_result.second);
-  emplace_result.first->second.set_connection_error_handler(base::BindOnce(
-      &NativeFileSystemManagerImpl::TransferTokenConnectionErrorHandler,
-      base::Unretained(this), token));
+  transfer_tokens_.emplace(token, std::move(token_impl));
 }
 
-void NativeFileSystemManagerImpl::TransferTokenConnectionErrorHandler(
+void NativeFileSystemManagerImpl::RemoveToken(
     const base::UnguessableToken& token) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   size_t count_removed = transfer_tokens_.erase(token);
   DCHECK_EQ(1u, count_removed);
 }
 
 void NativeFileSystemManagerImpl::DoResolveTransferToken(
-    blink::mojom::NativeFileSystemTransferTokenPtr,
+    mojo::Remote<blink::mojom::NativeFileSystemTransferToken>,
     ResolvedTokenCallback callback,
     const base::UnguessableToken& token) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   auto it = transfer_tokens_.find(token);
   if (it == transfer_tokens_.end()) {
     std::move(callback).Run(nullptr);
   } else {
-    std::move(callback).Run(
-        static_cast<NativeFileSystemTransferTokenImpl*>(it->second.impl()));
+    std::move(callback).Run(it->second.get());
   }
 }
 
@@ -599,7 +608,7 @@ NativeFileSystemManagerImpl::FileSystemURLAndFSHandle
 NativeFileSystemManagerImpl::CreateFileSystemURLFromPath(
     const url::Origin& origin,
     const base::FilePath& path) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
 
   auto* isolated_context = storage::IsolatedContext::GetInstance();
   DCHECK(isolated_context);
@@ -624,7 +633,7 @@ NativeFileSystemManagerImpl::CreateFileEntryFromPathImpl(
     const BindingContext& binding_context,
     const base::FilePath& file_path,
     NativeFileSystemPermissionContext::UserAction user_action) {
-  DCHECK_CURRENTLY_ON(BrowserThread::IO);
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   auto url = CreateFileSystemURLFromPath(binding_context.origin, file_path);
 
   scoped_refptr<NativeFileSystemPermissionGrant> read_grant, write_grant;
diff --git a/chromium/content/browser/native_file_system/native_file_system_manager_impl.h b/chromium/content/browser/native_file_system/native_file_system_manager_impl.h
index eed954bb189..1138f36246f 100644
--- a/chromium/content/browser/native_file_system/native_file_system_manager_impl.h
+++ b/chromium/content/browser/native_file_system/native_file_system_manager_impl.h
@@ -7,15 +7,17 @@
 
 #include "base/files/file_path.h"
 #include "base/memory/weak_ptr.h"
+#include "base/threading/sequence_bound.h"
 #include "content/browser/blob_storage/chrome_blob_storage_context.h"
 #include "content/browser/native_file_system/file_system_chooser.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/native_file_system_entry_factory.h"
 #include "content/public/browser/native_file_system_permission_context.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
-#include "mojo/public/cpp/bindings/strong_binding_set.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/unique_receiver_set.h"
 #include "storage/browser/fileapi/file_system_url.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_file_writer.mojom.h"
@@ -42,8 +44,8 @@ class StoragePartitionImpl;
 // NativeFileSystemDirectoryHandleImpl and NativeFileSystemTransferTokenImpl
 // instances for a specific storage partition.
 //
-// This class is not thread safe, it is constructed on the UI thread, and after
-// that all methods should be called on the IO thread.
+// This class is not thread safe, it must be constructed and used on the UI
+// thread only.
 class CONTENT_EXPORT NativeFileSystemManagerImpl
     : public NativeFileSystemEntryFactory,
       public blink::mojom::NativeFileSystemManager {
@@ -83,11 +85,6 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
       const BindingContext& binding_context,
       mojo::PendingReceiver<blink::mojom::NativeFileSystemManager> receiver);
 
-  static void BindReceiverFromUIThread(
-      StoragePartitionImpl* storage_partition,
-      const BindingContext& binding_context,
-      mojo::PendingReceiver<blink::mojom::NativeFileSystemManager> receiver);
-
   // blink::mojom::NativeFileSystemManager:
   void GetSandboxedFileSystem(GetSandboxedFileSystemCallback callback) override;
   void ChooseEntries(
@@ -120,10 +117,10 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
 
   // Creates a new NativeFileSystemDirectoryHandleImpl for a given url. Assumes
   // the passed in URL is valid and represents a directory.
-  blink::mojom::NativeFileSystemDirectoryHandlePtr CreateDirectoryHandle(
-      const BindingContext& context,
-      const storage::FileSystemURL& url,
-      const SharedHandleState& handle_state);
+  mojo::PendingRemote<blink::mojom::NativeFileSystemDirectoryHandle>
+  CreateDirectoryHandle(const BindingContext& context,
+                        const storage::FileSystemURL& url,
+                        const SharedHandleState& handle_state);
 
   // Creates a new NativeFileSystemFileWriterImpl for a given target and
   // swap file URLs. Assumes the passed in URLs are valid and represent files.
@@ -136,10 +133,12 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
   // Create a transfer token for a specific file or directory.
   void CreateTransferToken(
       const NativeFileSystemFileHandleImpl& file,
-      blink::mojom::NativeFileSystemTransferTokenRequest request);
+      mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+          receiver);
   void CreateTransferToken(
       const NativeFileSystemDirectoryHandleImpl& directory,
-      blink::mojom::NativeFileSystemTransferTokenRequest request);
+      mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+          receiver);
 
   // Given a mojom transfer token, looks up the token in our internal list of
   // valid tokens. Calls the callback with the found token, or nullptr if no
@@ -147,17 +146,16 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
   using ResolvedTokenCallback =
       base::OnceCallback<void(NativeFileSystemTransferTokenImpl*)>;
   void ResolveTransferToken(
-      blink::mojom::NativeFileSystemTransferTokenPtr token,
+      mojo::PendingRemote<blink::mojom::NativeFileSystemTransferToken> token,
       ResolvedTokenCallback callback);
 
   storage::FileSystemContext* context() {
-    DCHECK_CURRENTLY_ON(BrowserThread::IO);
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     return context_.get();
   }
-  storage::BlobStorageContext* blob_context() {
-    return blob_context_->context();
-  }
-  storage::FileSystemOperationRunner* operation_runner();
+  ChromeBlobStorageContext* blob_context() { return blob_context_.get(); }
+  const base::SequenceBound<storage::FileSystemOperationRunner>&
+  operation_runner();
 
   NativeFileSystemPermissionContext* permission_context() {
     return permission_context_;
@@ -170,6 +168,10 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
     permission_context_ = permission_context;
   }
 
+  // Remove |token| from |transfer_tokens_|. It is an error to try to remove a
+  // token that doesn't exist.
+  void RemoveToken(const base::UnguessableToken& token);
+
  private:
   friend class NativeFileSystemFileHandleImpl;
 
@@ -205,11 +207,12 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
       const storage::FileSystemURL& url,
       const SharedHandleState& handle_state,
       bool is_directory,
-      blink::mojom::NativeFileSystemTransferTokenRequest request);
-  void TransferTokenConnectionErrorHandler(const base::UnguessableToken& token);
-  void DoResolveTransferToken(blink::mojom::NativeFileSystemTransferTokenPtr,
-                              ResolvedTokenCallback callback,
-                              const base::UnguessableToken& token);
+      mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+          receiver);
+  void DoResolveTransferToken(
+      mojo::Remote<blink::mojom::NativeFileSystemTransferToken>,
+      ResolvedTokenCallback callback,
+      const base::UnguessableToken& token);
 
   // Creates a FileSystemURL which corresponds to a FilePath and Origin.
   struct FileSystemURLAndFSHandle {
@@ -235,9 +238,11 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
           writer_receiver,
       bool has_transient_user_activation);
 
+  SEQUENCE_CHECKER(sequence_checker_);
+
   const scoped_refptr<storage::FileSystemContext> context_;
   const scoped_refptr<ChromeBlobStorageContext> blob_context_;
-  std::unique_ptr<storage::FileSystemOperationRunner> operation_runner_;
+  base::SequenceBound<storage::FileSystemOperationRunner> operation_runner_;
   NativeFileSystemPermissionContext* permission_context_;
 
   // All the mojo receivers for this NativeFileSystemManager itself. Keeps track
@@ -247,25 +252,22 @@ class CONTENT_EXPORT NativeFileSystemManagerImpl
   mojo::ReceiverSet<blink::mojom::NativeFileSystemManager, BindingContext>
       receivers_;
 
-  // All the bindings and receivers for file and directory handles that have
-  // references to them.
+  // All the receivers for file and directory handles that have references to
+  // them.
   mojo::UniqueReceiverSet<blink::mojom::NativeFileSystemFileHandle>
       file_receivers_;
-  mojo::StrongBindingSet<blink::mojom::NativeFileSystemDirectoryHandle>
-      directory_bindings_;
+  mojo::UniqueReceiverSet<blink::mojom::NativeFileSystemDirectoryHandle>
+      directory_receivers_;
   mojo::UniqueReceiverSet<blink::mojom::NativeFileSystemFileWriter>
       writer_receivers_;
 
   bool off_the_record_;
 
-  // Transfer token bindings are stored in what is effectively a
-  // StrongBindingMap. The Binding instances own the implementation, and tokens
-  // are removed from this map when the mojo connection is closed.
-  using TransferTokenBinding =
-      mojo::Binding<blink::mojom::NativeFileSystemTransferToken,
-                    mojo::UniquePtrImplRefTraits<
-                        blink::mojom::NativeFileSystemTransferToken>>;
-  std::map<base::UnguessableToken, TransferTokenBinding> transfer_tokens_;
+  // NativeFileSystemTransferTokenImpl owns a Transfer token receiver and is
+  // removed from this map when the mojo connection is closed.
+  std::map<base::UnguessableToken,
+           std::unique_ptr<NativeFileSystemTransferTokenImpl>>
+      transfer_tokens_;
 
   base::WeakPtrFactory<NativeFileSystemManagerImpl> weak_factory_{this};
   DISALLOW_COPY_AND_ASSIGN(NativeFileSystemManagerImpl);
diff --git a/chromium/content/browser/native_file_system/native_file_system_manager_impl_unittest.cc b/chromium/content/browser/native_file_system/native_file_system_manager_impl_unittest.cc
index 4cbb26dc6fc..9b914b12e75 100644
--- a/chromium/content/browser/native_file_system/native_file_system_manager_impl_unittest.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_manager_impl_unittest.cc
@@ -13,6 +13,8 @@
 #include "content/browser/native_file_system/fixed_native_file_system_permission_grant.h"
 #include "content/browser/native_file_system/mock_native_file_system_permission_context.h"
 #include "content/public/test/browser_task_environment.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "storage/browser/blob/blob_storage_context.h"
 #include "storage/browser/test/async_file_test_helper.h"
 #include "storage/browser/test/test_file_system_context.h"
@@ -92,16 +94,20 @@ class NativeFileSystemManagerImplTest : public testing::Test {
 };
 
 TEST_F(NativeFileSystemManagerImplTest, GetSandboxedFileSystem_Permissions) {
-  blink::mojom::NativeFileSystemDirectoryHandlePtr root;
+  mojo::PendingRemote<blink::mojom::NativeFileSystemDirectoryHandle>
+      directory_remote;
   base::RunLoop loop;
   manager_remote_->GetSandboxedFileSystem(base::BindLambdaForTesting(
       [&](blink::mojom::NativeFileSystemErrorPtr result,
-          blink::mojom::NativeFileSystemDirectoryHandlePtr handle) {
+          mojo::PendingRemote<blink::mojom::NativeFileSystemDirectoryHandle>
+              handle) {
         EXPECT_EQ(blink::mojom::NativeFileSystemStatus::kOk, result->status);
-        root = std::move(handle);
+        directory_remote = std::move(handle);
         loop.Quit();
       }));
   loop.Run();
+  mojo::Remote<blink::mojom::NativeFileSystemDirectoryHandle> root(
+      std::move(directory_remote));
   ASSERT_TRUE(root);
   EXPECT_EQ(PermissionStatus::GRANTED,
             GetPermissionStatusSync(/*writable=*/false, root.get()));
@@ -180,7 +186,7 @@ TEST_F(NativeFileSystemManagerImplTest,
 
   blink::mojom::NativeFileSystemEntryPtr entry =
       manager_->CreateDirectoryEntryFromPath(kBindingContext, kTestPath);
-  blink::mojom::NativeFileSystemDirectoryHandlePtr handle(
+  mojo::Remote<blink::mojom::NativeFileSystemDirectoryHandle> handle(
       std::move(entry->entry_handle->get_directory()));
   EXPECT_EQ(PermissionStatus::GRANTED,
             GetPermissionStatusSync(/*writable=*/false, handle.get()));
diff --git a/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.cc b/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.cc
index 8dd98bb6796..d0066bdf90e 100644
--- a/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.cc
+++ b/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.cc
@@ -9,19 +9,34 @@ namespace content {
 NativeFileSystemTransferTokenImpl::NativeFileSystemTransferTokenImpl(
     const storage::FileSystemURL& url,
     const SharedHandleState& handle_state,
-    HandleType type)
+    HandleType type,
+    NativeFileSystemManagerImpl* manager,
+    mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken> receiver)
     : token_(base::UnguessableToken::Create()),
       url_(url),
       handle_state_(handle_state),
-      type_(type) {
+      type_(type),
+      manager_(manager),
+      receiver_(this, std::move(receiver)) {
+  DCHECK(manager_);
   DCHECK_EQ(url_.mount_type() == storage::kFileSystemTypeIsolated,
             handle_state_.file_system.is_valid())
       << url_.mount_type();
+  receiver_.set_disconnect_handler(
+      base::BindOnce(&NativeFileSystemTransferTokenImpl::OnMojoDisconnect,
+                     base::Unretained(this)));
 }
 
+NativeFileSystemTransferTokenImpl::~NativeFileSystemTransferTokenImpl() =
+    default;
+
 void NativeFileSystemTransferTokenImpl::GetInternalID(
     GetInternalIDCallback callback) {
   std::move(callback).Run(token_);
 }
 
+void NativeFileSystemTransferTokenImpl::OnMojoDisconnect() {
+  manager_->RemoveToken(token_);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.h b/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.h
index 0c1e3a3050f..31649d8b497 100644
--- a/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.h
+++ b/chromium/content/browser/native_file_system/native_file_system_transfer_token_impl.h
@@ -6,6 +6,8 @@
 #define CONTENT_BROWSER_NATIVE_FILE_SYSTEM_NATIVE_FILE_SYSTEM_TRANSFER_TOKEN_IMPL_H_
 
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "storage/browser/fileapi/file_system_url.h"
 #include "storage/browser/fileapi/isolated_context.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_transfer_token.mojom.h"
@@ -24,9 +26,14 @@ class NativeFileSystemTransferTokenImpl
 
   enum class HandleType { kFile, kDirectory };
 
-  NativeFileSystemTransferTokenImpl(const storage::FileSystemURL& url,
-                                    const SharedHandleState& handle_state,
-                                    HandleType type);
+  NativeFileSystemTransferTokenImpl(
+      const storage::FileSystemURL& url,
+      const SharedHandleState& handle_state,
+      HandleType type,
+      NativeFileSystemManagerImpl* manager,
+      mojo::PendingReceiver<blink::mojom::NativeFileSystemTransferToken>
+          receiver);
+  ~NativeFileSystemTransferTokenImpl() override;
 
   const base::UnguessableToken& token() const { return token_; }
   const storage::FileSystemURL& url() const { return url_; }
@@ -36,10 +43,15 @@ class NativeFileSystemTransferTokenImpl
   void GetInternalID(GetInternalIDCallback callback) override;
 
  private:
+  void OnMojoDisconnect();
+
   const base::UnguessableToken token_;
   const storage::FileSystemURL url_;
   const SharedHandleState handle_state_;
   const HandleType type_;
+  // Raw pointer since NativeFileSystemManagerImpl owns |this|.
+  NativeFileSystemManagerImpl* const manager_;
+  mojo::Receiver<blink::mojom::NativeFileSystemTransferToken> receiver_;
 
   DISALLOW_COPY_AND_ASSIGN(NativeFileSystemTransferTokenImpl);
 };
diff --git a/chromium/content/browser/navigation_browsertest.cc b/chromium/content/browser/navigation_browsertest.cc
index 0519eef32d7..1fedbf64367 100644
--- a/chromium/content/browser/navigation_browsertest.cc
+++ b/chromium/content/browser/navigation_browsertest.cc
@@ -16,8 +16,8 @@
 #include "base/test/test_timeouts.h"
 #include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
+#include "content/browser/browser_url_handler_impl.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/frame_messages.h"
@@ -33,6 +33,7 @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/navigation_policy.h"
@@ -54,11 +55,11 @@
 #include "content/shell/browser/shell_download_manager_delegate.h"
 #include "content/test/content_browser_test_utils_internal.h"
 #include "content/test/did_commit_navigation_interceptor.h"
+#include "content/test/fake_network_url_loader_factory.h"
 #include "ipc/ipc_security_test_util.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/features.h"
-#include "net/base/filename_util.h"
 #include "net/base/load_flags.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
@@ -218,24 +219,26 @@ const char* non_cacheable_html_response =
 // default server.
 class NavigationBaseBrowserTest : public ContentBrowserTest,
                                   public ::testing::WithParamInterface<bool> {
+ public:
+  NavigationBaseBrowserTest() { ToggleNavigationImmediateResponse(); }
+
  protected:
   void SetUpOnMainThread() override {
-    ToggleNavigationImmediateResponse();
     host_resolver()->AddRule("*", "127.0.0.1");
   }
 
  private:
   void ToggleNavigationImmediateResponse() {
     if (GetParam()) {
-      feature_list.InitAndDisableFeature(
+      feature_list_.InitAndDisableFeature(
           features::kNavigationImmediateResponseBody);
     } else {
-      feature_list.InitAndEnableFeature(
+      feature_list_.InitAndEnableFeature(
           features::kNavigationImmediateResponseBody);
     }
   }
 
-  base::test::ScopedFeatureList feature_list;
+  base::test::ScopedFeatureList feature_list_;
 };
 
 INSTANTIATE_TEST_SUITE_P(/* no prefix */,
@@ -257,8 +260,8 @@ INSTANTIATE_TEST_SUITE_P(/* no prefix */,
 class NetworkIsolationNavigationBrowserTest
     : public ContentBrowserTest,
       public ::testing::WithParamInterface<bool> {
- protected:
-  void SetUpOnMainThread() override {
+ public:
+  NetworkIsolationNavigationBrowserTest() {
     if (GetParam()) {
       feature_list_.InitAndEnableFeature(
           net::features::kAppendFrameOriginToNetworkIsolationKey);
@@ -266,6 +269,10 @@ class NetworkIsolationNavigationBrowserTest
       feature_list_.InitAndDisableFeature(
           net::features::kAppendFrameOriginToNetworkIsolationKey);
     }
+  }
+
+ protected:
+  void SetUpOnMainThread() override {
     ASSERT_TRUE(embedded_test_server()->Start());
     ContentBrowserTest::SetUpOnMainThread();
   }
@@ -320,13 +327,41 @@ INSTANTIATE_TEST_SUITE_P(/* no prefix */,
                          NetworkIsolationNavigationBrowserTest,
                          ::testing::Bool());
 
+class NavigationBrowserTestReferrerPolicy
+    : public ContentBrowserTest,
+      public ::testing::WithParamInterface<network::mojom::ReferrerPolicy> {
+ protected:
+  void SetUpOnMainThread() override {
+    ASSERT_TRUE(embedded_test_server()->Start());
+    ContentBrowserTest::SetUpOnMainThread();
+  }
+
+  network::mojom::ReferrerPolicy GetReferrerPolicy() const {
+    return GetParam();
+  }
+};
+
+INSTANTIATE_TEST_SUITE_P(
+    /* no prefix */,
+    NavigationBrowserTestReferrerPolicy,
+    ::testing::Values(network::mojom::ReferrerPolicy::kAlways,
+                      network::mojom::ReferrerPolicy::kDefault,
+                      network::mojom::ReferrerPolicy::kNoReferrerWhenDowngrade,
+                      network::mojom::ReferrerPolicy::kNever,
+                      network::mojom::ReferrerPolicy::kOrigin,
+                      network::mojom::ReferrerPolicy::kOriginWhenCrossOrigin,
+                      network::mojom::ReferrerPolicy::
+                          kNoReferrerWhenDowngradeOriginWhenCrossOrigin,
+                      network::mojom::ReferrerPolicy::kSameOrigin,
+                      network::mojom::ReferrerPolicy::kStrictOrigin));
+
 // Ensure that browser initiated basic navigations work.
 IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, BrowserInitiatedNavigations) {
   // Perform a navigation with no live renderer.
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL url(embedded_test_server()->GetURL("/title1.html"));
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
@@ -342,7 +377,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, BrowserInitiatedNavigations) {
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL url(embedded_test_server()->GetURL("/title2.html"));
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
@@ -358,7 +393,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, BrowserInitiatedNavigations) {
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL url = embedded_test_server()->GetURL("foo.com", "/title3.html");
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
@@ -378,7 +413,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL url(embedded_test_server()->GetURL("/simple_links.html"));
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
     EXPECT_FALSE(observer.last_initiator_origin().has_value());
@@ -420,7 +455,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL url(embedded_test_server()->GetURL("/simple_links.html"));
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
   }
@@ -478,7 +513,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, FailedNavigation) {
   {
     TestNavigationObserver observer(shell()->web_contents());
     GURL url(embedded_test_server()->GetURL("/title1.html"));
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
     EXPECT_EQ(url, observer.last_navigation_url());
     EXPECT_TRUE(observer.last_navigation_succeeded());
   }
@@ -489,7 +524,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, FailedNavigation) {
     GURL error_url(embedded_test_server()->GetURL("/close-socket"));
     base::PostTask(FROM_HERE, {BrowserThread::IO},
                    base::BindOnce(&net::URLRequestFailedJob::AddUrlHandler));
-    NavigateToURL(shell(), error_url);
+    EXPECT_FALSE(NavigateToURL(shell(), error_url));
     EXPECT_EQ(error_url, observer.last_navigation_url());
     NavigationEntry* entry =
         shell()->web_contents()->GetController().GetLastCommittedEntry();
@@ -504,7 +539,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
   GURL url(embedded_test_server()->GetURL("/title1.html"));
   GURL view_source_url(content::kViewSourceScheme + std::string(":") +
                        url.spec());
-  NavigateToURL(shell(), view_source_url);
+  EXPECT_TRUE(NavigateToURL(shell(), view_source_url));
   EXPECT_EQ(url, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 }
@@ -514,7 +549,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
                        ViewSourceNavigation_RendererInitiated) {
   TestNavigationObserver observer(shell()->web_contents());
   GURL kUrl(embedded_test_server()->GetURL("/simple_links.html"));
-  NavigateToURL(shell(), kUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kUrl));
   EXPECT_EQ(kUrl, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 
@@ -544,7 +579,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
                        GoogleChromeNavigation_RendererInitiated) {
   TestNavigationObserver observer(shell()->web_contents());
   GURL kUrl(embedded_test_server()->GetURL("/simple_links.html"));
-  NavigateToURL(shell(), kUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kUrl));
   EXPECT_EQ(kUrl, observer.last_navigation_url());
   EXPECT_TRUE(observer.last_navigation_succeeded());
 
@@ -599,8 +634,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, SanitizeReferrer) {
                             ->GetMainFrame()
                             ->frame_tree_node();
   ASSERT_TRUE(root->navigation_request());
-  EXPECT_EQ(GURL(),
-            root->navigation_request()->navigation_handle()->GetReferrer().url);
+  EXPECT_EQ(GURL(), root->navigation_request()->GetReferrer().url);
 
   // The navigation should commit without being blocked.
   EXPECT_TRUE(manager.WaitForResponse());
@@ -608,6 +642,57 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, SanitizeReferrer) {
   EXPECT_EQ(kInsecureUrl, shell()->web_contents()->GetLastCommittedURL());
 }
 
+// Ensure the correctness of a navigation request's referrer. This is a
+// regression test for https://crbug.com/1004083.
+IN_PROC_BROWSER_TEST_P(NavigationBrowserTestReferrerPolicy, ReferrerPolicy) {
+  const GURL kDestination(embedded_test_server()->GetURL("/title1.html"));
+  const GURL kReferrerURL(embedded_test_server()->GetURL("/referrer-page"));
+  const url::Origin kReferrerOrigin = url::Origin::Create(kReferrerURL);
+
+  // It is possible that the referrer URL does not match what the policy
+  // demands (e.g., non-empty URL and kNever policy), so we'll test that the
+  // correct referrer is generated, and that the navigation succeeds.
+  const Referrer referrer(kReferrerURL, GetReferrerPolicy());
+
+  // Navigate to a resource whose destination URL is same-origin with the
+  // navigation's referrer. The final referrer should be generated correctly.
+  NavigationController::LoadURLParams load_params(kDestination);
+  load_params.referrer = referrer;
+  TestNavigationManager manager(shell()->web_contents(), kDestination);
+  shell()->web_contents()->GetController().LoadURLWithParams(load_params);
+  EXPECT_TRUE(manager.WaitForRequestStart());
+
+  // The referrer should have been sanitized.
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetMainFrame()
+                            ->frame_tree_node();
+  ASSERT_TRUE(root->navigation_request());
+  switch (GetReferrerPolicy()) {
+    case network::mojom::ReferrerPolicy::kAlways:
+    case network::mojom::ReferrerPolicy::kDefault:
+    case network::mojom::ReferrerPolicy::kNoReferrerWhenDowngrade:
+    case network::mojom::ReferrerPolicy::kOriginWhenCrossOrigin:
+    case network::mojom::ReferrerPolicy::
+        kNoReferrerWhenDowngradeOriginWhenCrossOrigin:
+    case network::mojom::ReferrerPolicy::kSameOrigin:
+      EXPECT_EQ(kReferrerURL, root->navigation_request()->GetReferrer().url);
+      break;
+    case network::mojom::ReferrerPolicy::kNever:
+      EXPECT_EQ(GURL(), root->navigation_request()->GetReferrer().url);
+      break;
+    case network::mojom::ReferrerPolicy::kOrigin:
+    case network::mojom::ReferrerPolicy::kStrictOrigin:
+      EXPECT_EQ(kReferrerOrigin.GetURL(),
+                root->navigation_request()->GetReferrer().url);
+      break;
+  }
+
+  // The navigation should commit without being blocked.
+  EXPECT_TRUE(manager.WaitForResponse());
+  manager.WaitForNavigationFinished();
+  EXPECT_EQ(kDestination, shell()->web_contents()->GetLastCommittedURL());
+}
+
 // Test to verify that an exploited renderer process trying to upload a file
 // it hasn't been explicitly granted permissions to is correctly terminated.
 IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, PostUploadIllegalFilePath) {
@@ -699,124 +784,12 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
             controller.GetLastCommittedEntry()->GetVirtualURL());
 }
 
-class NavigationDisableWebSecurityTest : public NavigationBrowserTest {
- public:
-  NavigationDisableWebSecurityTest() {}
-
- protected:
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    // Simulate a compromised renderer, otherwise the cross-origin request to
-    // file: is blocked.
-    command_line->AppendSwitch(switches::kDisableWebSecurity);
-    NavigationBrowserTest::SetUpCommandLine(command_line);
-  }
-};
-
-// Test to verify that an exploited renderer process trying to specify a
-// non-empty URL for base_url_for_data_url on navigation is correctly
-// terminated.
-// TODO(nasko): Move this test to security_exploit_browsertest.cc.
-IN_PROC_BROWSER_TEST_P(NavigationDisableWebSecurityTest,
-                       ValidateBaseUrlForDataUrl) {
-  GURL start_url(embedded_test_server()->GetURL("/title1.html"));
-  EXPECT_TRUE(NavigateToURL(shell(), start_url));
-
-  RenderFrameHostImpl* rfh = static_cast<RenderFrameHostImpl*>(
-      shell()->web_contents()->GetMainFrame());
-
-  GURL data_url("data:text/html,foo");
-  base::FilePath file_path = GetTestFilePath("", "simple_page.html");
-  GURL file_url = net::FilePathToFileURL(file_path);
-
-  // To get around DataUrlNavigationThrottle. Other attempts at getting around
-  // it don't work, i.e.:
-  // -if the request is made in a child frame then the frame is torn down
-  // immediately on process killing so the navigation doesn't complete
-  // -if it's classified as same document, then a DCHECK in
-  // NavigationRequest::CreateRendererInitiated fires
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      features::kAllowContentInitiatedDataUrlNavigations);
-  // Setup a BeginNavigate IPC with non-empty base_url_for_data_url.
-  mojom::CommonNavigationParamsPtr common_params =
-      mojom::CommonNavigationParams::New(
-          data_url, url::Origin::Create(data_url),
-          blink::mojom::Referrer::New(), ui::PAGE_TRANSITION_LINK,
-          mojom::NavigationType::DIFFERENT_DOCUMENT, NavigationDownloadPolicy(),
-          false /* should_replace_current_entry */,
-          file_url, /* base_url_for_data_url */
-          GURL() /* history_url_for_data_url */, PREVIEWS_UNSPECIFIED,
-          base::TimeTicks::Now() /* navigation_start */, "GET",
-          nullptr /* post_data */, base::Optional<SourceLocation>(),
-          false /* started_from_context_menu */, false /* has_user_gesture */,
-          InitiatorCSPInfo(),
-          std::vector<int>() /* initiator_origin_trial_features */,
-          std::string() /* href_translate */,
-          false /* is_history_navigation_in_new_child_frame */,
-          base::TimeTicks());
-  mojom::BeginNavigationParamsPtr begin_params =
-      mojom::BeginNavigationParams::New(
-          std::string() /* headers */, net::LOAD_NORMAL,
-          false /* skip_service_worker */,
-          blink::mojom::RequestContextType::LOCATION,
-          blink::WebMixedContentContextType::kBlockable,
-          false /* is_form_submission */,
-          false /* was_initiated_by_link_click */,
-          GURL() /* searchable_form_url */,
-          std::string() /* searchable_form_encoding */,
-          GURL() /* client_side_redirect_url */,
-          base::nullopt /* devtools_initiator_info */);
-
-  // Receiving the invalid IPC message should lead to renderer process
-  // termination.
-  RenderProcessHostKillWaiter process_kill_waiter(rfh->GetProcess());
-
-  mojom::NavigationClientAssociatedPtr navigation_client;
-  if (IsPerNavigationMojoInterfaceEnabled()) {
-    auto navigation_client_request =
-        mojo::MakeRequestAssociatedWithDedicatedPipe(&navigation_client);
-    rfh->frame_host_binding_for_testing().impl()->BeginNavigation(
-        std::move(common_params), std::move(begin_params), mojo::NullRemote(),
-        navigation_client.PassInterface(), mojo::NullRemote());
-  } else {
-    rfh->frame_host_binding_for_testing().impl()->BeginNavigation(
-        std::move(common_params), std::move(begin_params), mojo::NullRemote(),
-        nullptr, mojo::NullRemote());
-  }
-  EXPECT_EQ(bad_message::RFH_BASE_URL_FOR_DATA_URL_SPECIFIED,
-            process_kill_waiter.Wait());
-
-  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->CanReadFile(
-      rfh->GetProcess()->GetID(), file_path));
-
-  // Reload the page to create another renderer process.
-  TestNavigationObserver tab_observer(shell()->web_contents(), 1);
-  shell()->web_contents()->GetController().Reload(ReloadType::NORMAL, false);
-  tab_observer.Wait();
-
-  // Make an XHR request to check if the page has access.
-  std::string script = base::StringPrintf(
-      "var xhr = new XMLHttpRequest()\n"
-      "xhr.open('GET', '%s', false);\n"
-      "try { xhr.send(); } catch (e) {}\n"
-      "window.domAutomationController.send(xhr.responseText);",
-      file_url.spec().c_str());
-  std::string result;
-  EXPECT_TRUE(
-      ExecuteScriptAndExtractString(shell()->web_contents(), script, &result));
-  EXPECT_TRUE(result.empty());
-}
-
-INSTANTIATE_TEST_SUITE_P(/* no prefix */,
-                         NavigationDisableWebSecurityTest,
-                         ::testing::Bool());
-
 IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, BackFollowedByReload) {
   // First, make two history entries.
   GURL url1(embedded_test_server()->GetURL("/title1.html"));
   GURL url2(embedded_test_server()->GetURL("/title2.html"));
-  NavigateToURL(shell(), url1);
-  NavigateToURL(shell(), url2);
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+  EXPECT_TRUE(NavigateToURL(shell(), url2));
 
   // Then execute a back navigation in Javascript followed by a reload.
   TestNavigationObserver navigation_observer(shell()->web_contents());
@@ -1001,7 +974,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, RendererNavigationInitiator) {
   url::Origin starting_page_origin;
   starting_page_origin = starting_page_origin.Create(starting_page);
 
-  NavigateToURL(shell(), starting_page);
+  EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   GURL url(embedded_test_server()->GetURL("/title2.html"));
 
@@ -1018,7 +991,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, RendererNavigationInitiator) {
 // navigated by Javascript from some starting page to another page.
 IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, SubFrameJsNavigationInitiator) {
   GURL starting_page(embedded_test_server()->GetURL("/frame_tree/top.html"));
-  NavigateToURL(shell(), starting_page);
+  EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
@@ -1059,7 +1032,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
   // Go to a page on a.com with an iframe that is on b.com
   GURL starting_page(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
-  NavigateToURL(shell(), starting_page);
+  EXPECT_TRUE(NavigateToURL(shell(), starting_page));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
@@ -1171,7 +1144,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
   EXPECT_TRUE(embedded_test_server()->Start());
 
   GURL url(embedded_test_server()->GetURL("/title1.html"));
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   DOMMessageQueue dom_message_queue(WebContents::FromRenderFrameHost(
       shell()->web_contents()->GetMainFrame()));
@@ -1646,7 +1619,8 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, OpenerNavigation_DownloadPolicy) {
               ->GetBrowserContext()
               ->GetDownloadManagerDelegate());
   delegate->SetDownloadBehaviorForTesting(download_dir.GetPath());
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
   WebContents* opener = shell()->web_contents();
 
   // Open a popup.
@@ -1688,8 +1662,8 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
               ->GetBrowserContext()
               ->GetDownloadManagerDelegate());
   delegate->SetDownloadBehaviorForTesting(download_dir.GetPath());
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
   WebContents* opener = shell()->web_contents();
 
   // Open a popup.
@@ -1731,7 +1705,7 @@ IN_PROC_BROWSER_TEST_P(NavigationDownloadBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
 
   GURL url(embedded_test_server()->GetURL("/title1.html"));
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // Block every iframe in WillProcessResponse.
   content::TestNavigationThrottleInserter throttle_inserter(
@@ -1774,12 +1748,11 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest, AddRequestHeaderOnRedirect) {
       base::BindLambdaForTesting(
           [](NavigationHandle* handle) -> std::unique_ptr<NavigationThrottle> {
             auto throttle = std::make_unique<TestNavigationThrottle>(handle);
-            NavigationHandleImpl* handle_impl =
-                static_cast<NavigationHandleImpl*>(handle);
+            NavigationRequest* request = NavigationRequest::From(handle);
             throttle->SetCallback(TestNavigationThrottle::WILL_REDIRECT_REQUEST,
-                                  base::BindLambdaForTesting([handle_impl]() {
-                                    handle_impl->SetRequestHeader(
-                                        "header_name", "header_value");
+                                  base::BindLambdaForTesting([request]() {
+                                    request->SetRequestHeader("header_name",
+                                                              "header_value");
                                   }));
             return throttle;
           }));
@@ -1813,17 +1786,16 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
       base::BindLambdaForTesting(
           [](NavigationHandle* handle) -> std::unique_ptr<NavigationThrottle> {
             auto throttle = std::make_unique<TestNavigationThrottle>(handle);
-            NavigationHandleImpl* handle_impl =
-                static_cast<NavigationHandleImpl*>(handle);
+            NavigationRequest* request = NavigationRequest::From(handle);
             throttle->SetCallback(TestNavigationThrottle::WILL_START_REQUEST,
-                                  base::BindLambdaForTesting([handle_impl]() {
-                                    handle_impl->SetRequestHeader(
-                                        "header_name", "header_value");
+                                  base::BindLambdaForTesting([request]() {
+                                    request->SetRequestHeader("header_name",
+                                                              "header_value");
                                   }));
             throttle->SetCallback(TestNavigationThrottle::WILL_REDIRECT_REQUEST,
-                                  base::BindLambdaForTesting([handle_impl]() {
-                                    handle_impl->SetRequestHeader(
-                                        "header_name", "other_value");
+                                  base::BindLambdaForTesting([request]() {
+                                    request->SetRequestHeader("header_name",
+                                                              "other_value");
                                   }));
             return throttle;
           }));
@@ -1856,19 +1828,17 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
       shell()->web_contents(),
       base::BindLambdaForTesting(
           [](NavigationHandle* handle) -> std::unique_ptr<NavigationThrottle> {
-            NavigationHandleImpl* handle_impl =
-                static_cast<NavigationHandleImpl*>(handle);
+            NavigationRequest* request = NavigationRequest::From(handle);
             auto throttle = std::make_unique<TestNavigationThrottle>(handle);
             throttle->SetCallback(TestNavigationThrottle::WILL_START_REQUEST,
-                                  base::BindLambdaForTesting([handle_impl]() {
-                                    handle_impl->SetRequestHeader(
-                                        "header_name", "header_value");
+                                  base::BindLambdaForTesting([request]() {
+                                    request->SetRequestHeader("header_name",
+                                                              "header_value");
+                                  }));
+            throttle->SetCallback(TestNavigationThrottle::WILL_REDIRECT_REQUEST,
+                                  base::BindLambdaForTesting([request]() {
+                                    request->RemoveRequestHeader("header_name");
                                   }));
-            throttle->SetCallback(
-                TestNavigationThrottle::WILL_REDIRECT_REQUEST,
-                base::BindLambdaForTesting([handle_impl]() {
-                  handle_impl->RemoveRequestHeader("header_name");
-                }));
             return throttle;
           }));
 
@@ -2058,7 +2028,7 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, BlockedSrcDocRendererInitiated) {
 // browser process. It means RenderFrameHostImpl::BeginNavigation() is called.
 IN_PROC_BROWSER_TEST_P(NavigationBrowserTest, AboutSrcDocUsesBeginNavigation) {
   GURL url(embedded_test_server()->GetURL("/title1.html"));
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // If DidStartNavigation is called before DidCommitProvisionalLoad, then it
   // means the navigation was driven by the browser process, otherwise by the
@@ -2121,7 +2091,7 @@ INSTANTIATE_TEST_SUITE_P(/* no prefix */,
 IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest, EnabledOnUserNavigation) {
   GURL url(embedded_test_server()->GetURL("/target_text_link.html"));
   GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#targetText=text"));
+      "/scrollable_page_with_content.html#:~:text=text"));
 
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
@@ -2148,7 +2118,7 @@ IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest, EnabledOnUserNavigation) {
 IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest,
                        EnabledOnBrowserNavigation) {
   GURL url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#targetText=text"));
+      "/scrollable_page_with_content.html#:~:text=text"));
   WebContents* main_contents = shell()->web_contents();
   RenderFrameSubmissionObserver frame_observer(main_contents);
 
@@ -2163,7 +2133,7 @@ IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest,
                        EnabledOnUserGestureScriptNavigation) {
   GURL url(embedded_test_server()->GetURL("/empty.html"));
   GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#targetText=text"));
+      "/scrollable_page_with_content.html#:~:text=text"));
 
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
@@ -2186,7 +2156,7 @@ IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest,
                        DisabledOnScriptNavigation) {
   GURL url(embedded_test_server()->GetURL("/empty.html"));
   GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#targetText=text"));
+      "/scrollable_page_with_content.html#:~:text=text"));
 
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
@@ -2210,7 +2180,7 @@ IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest,
 IN_PROC_BROWSER_TEST_P(TextFragmentAnchorBrowserTest,
                        DisabledOnScriptHistoryNavigation) {
   GURL target_text_url(embedded_test_server()->GetURL(
-      "/scrollable_page_with_content.html#targetText=text"));
+      "/scrollable_page_with_content.html#:~:text=text"));
   GURL url(embedded_test_server()->GetURL("/empty.html"));
 
   EXPECT_TRUE(NavigateToURL(shell(), target_text_url));
@@ -2372,6 +2342,16 @@ IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
 // Regression test for https://crbug.com/998284.
 IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
                        BackForwardInOldDocumentCancelPendingNavigation) {
+  // This test expects a new request to be made when navigating back, which is
+  // not happening with back-forward cache enabled.
+  // See BackForwardCacheBrowserTest.RestoreWhilePendingCommit which covers the
+  // same scenario for back-forward cache.
+  shell()
+      ->web_contents()
+      ->GetController()
+      .GetBackForwardCache()
+      .DisableForTesting(BackForwardCacheImpl::TEST_ASSUMES_NO_CACHING);
+
   using Response = net::test_server::ControllableHttpResponse;
   Response response_A1(embedded_test_server(), "/A");
   Response response_A2(embedded_test_server(), "/A");
@@ -2431,8 +2411,6 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
 
   // 5. Start history cross-document navigation, cancelling 4.
   EXPECT_TRUE(ExecJs(shell()->web_contents(), "history.back()"));
-  // TODO(arthursonzogni): The embedder_url_tracker should update the visible
-  // URL here.
   {
     EXPECT_EQ(url_b, shell()->web_contents()->GetVisibleURL());
     EXPECT_EQ(url_b, embedder_url_tracker.url());
@@ -2454,9 +2432,41 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
     EXPECT_EQ(url_b, shell()->web_contents()->GetVisibleURL());
     EXPECT_EQ(url_b, embedder_url_tracker.url());
   }
+}
+
+// Regression test for https://crbug.com/999932.
+IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest, CanceledNavigationBug999932) {
+  using Response = net::test_server::ControllableHttpResponse;
+  Response response_A1(embedded_test_server(), "/A");
+  Response response_A2(embedded_test_server(), "/A");
+  Response response_B1(embedded_test_server(), "/B");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
 
-  // TODO(https://crbug.com/998284): The URL tracked by the embedder should have
-  // been invalidated. At some point, |url_b| should be displayed, not |url_c|.
+  GURL url_a = embedded_test_server()->GetURL("a.com", "/A");
+  GURL url_b = embedded_test_server()->GetURL("b.com", "/B");
+
+  // 1. Navigate to A.
+  shell()->LoadURL(url_a);
+  response_A1.WaitForRequest();
+  response_A1.Send(non_cacheable_html_response);
+  response_A1.Done();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  // 2. Start pending navigation to B.
+  shell()->LoadURL(url_b);
+  EXPECT_EQ(url_b, shell()->web_contents()->GetVisibleURL());
+  EXPECT_TRUE(shell()->web_contents()->GetController().GetPendingEntry());
+
+  // 3. Cancel (2) with renderer-initiated reload with a UserGesture.
+  EXPECT_TRUE(ExecJs(shell()->web_contents(), "location.reload()"));
+  EXPECT_EQ(url_a, shell()->web_contents()->GetVisibleURL());
+  EXPECT_FALSE(shell()->web_contents()->GetController().GetPendingEntry());
+
+  // 4. Cancel (3) using document.open();
+  EXPECT_TRUE(ExecJs(shell()->web_contents(), "document.open()"));
+  EXPECT_EQ(url_a, shell()->web_contents()->GetVisibleURL());
+  EXPECT_FALSE(shell()->web_contents()->GetController().GetPendingEntry());
 }
 
 // Regression test for https://crbug.com/1001283
@@ -2569,4 +2579,588 @@ IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest,
   console_delegate_2->Wait();
 }
 
+// Test how cookies are inherited in about:srcdoc iframes.
+//
+// Regression test: https://crbug.com/1003167.
+IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest, CookiesInheritedSrcDoc) {
+  using Response = net::test_server::ControllableHttpResponse;
+  Response response_1(embedded_test_server(), "/response_1");
+  Response response_2(embedded_test_server(), "/response_2");
+  Response response_3(embedded_test_server(), "/response_3");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    let iframe = document.createElement("iframe");
+    iframe.srcdoc = "foo";
+    document.body.appendChild(iframe);
+  )"));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  RenderFrameHostImpl* main_document = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+  RenderFrameHostImpl* sub_document_1 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ(url::kAboutSrcdocURL, sub_document_1->GetLastCommittedURL());
+  EXPECT_EQ(url::Origin::Create(url_a),
+            sub_document_1->GetLastCommittedOrigin());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_1->GetSiteInstance());
+
+  // 0. The default state doesn't contain any cookies.
+  EXPECT_EQ("", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_1, "document.cookie"));
+
+  // 1. Set a cookie in the main document, it affects its child too.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'a=0';"));
+
+  EXPECT_EQ("a=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0", EvalJs(sub_document_1, "document.cookie"));
+
+  // 2. Set a cookie in the child, it affects its parent too.
+  EXPECT_TRUE(ExecJs(sub_document_1, "document.cookie = 'b=0';"));
+
+  EXPECT_EQ("a=0; b=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0", EvalJs(sub_document_1, "document.cookie"));
+
+  // 3. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_1, "fetch('/response_1');"));
+  response_1.WaitForRequest();
+  EXPECT_EQ("a=0; b=0", response_1.http_request()->headers.at("Cookie"));
+
+  // 4. Navigate the iframe elsewhere.
+  EXPECT_TRUE(ExecJs(sub_document_1, JsReplace("location.href = $1", url_b)));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_2 =
+      main_document->child_at(0)->current_frame_host();
+
+  EXPECT_EQ("a=0; b=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_2, "document.cookie"));
+
+  // 5. Set a cookie in the main document. It doesn't affect its child.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'c=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_2, "document.cookie"));
+
+  // 6. Set a cookie in the child. It doesn't affect its parent.
+  EXPECT_TRUE(ExecJs(sub_document_2, "document.cookie = 'd=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("d=0", EvalJs(sub_document_2, "document.cookie"));
+
+  // 7. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_2, "fetch('/response_2');"));
+  response_2.WaitForRequest();
+  EXPECT_EQ("d=0", response_2.http_request()->headers.at("Cookie"));
+
+  // 8. Navigate the iframe back to about:srcdoc.
+  shell()->web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_3 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ(url_a, main_document->GetLastCommittedURL());
+  EXPECT_EQ(url::kAboutSrcdocURL, sub_document_3->GetLastCommittedURL());
+  EXPECT_EQ(url::Origin::Create(url_a),
+            sub_document_3->GetLastCommittedOrigin());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_3->GetSiteInstance());
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(sub_document_3, "document.cookie"));
+
+  // 9. Set cookie in the main document. It should be inherited by the child.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'e=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0; e=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0", EvalJs(sub_document_3, "document.cookie"));
+
+  // 11. Set cookie in the child document. It should be reflected on its parent.
+  EXPECT_TRUE(ExecJs(sub_document_3, "document.cookie = 'f=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            EvalJs(sub_document_3, "document.cookie"));
+
+  // 12. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_3, "fetch('/response_3');"));
+  response_3.WaitForRequest();
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            response_3.http_request()->headers.at("Cookie"));
+}
+
+// Test how cookies are inherited in about:blank iframes.
+IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest, CookiesInheritedAboutBlank) {
+  // This test expects several cross-site navigation to happen.
+  if (!AreAllSitesIsolatedForTesting())
+    return;
+
+  using Response = net::test_server::ControllableHttpResponse;
+  Response response_1(embedded_test_server(), "/response_1");
+  Response response_2(embedded_test_server(), "/response_2");
+  Response response_3(embedded_test_server(), "/response_3");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+
+  EXPECT_TRUE(
+      ExecJs(shell(), JsReplace("let iframe = document.createElement('iframe');"
+                                "iframe.src = $1;"
+                                "document.body.appendChild(iframe);",
+                                url_b)));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    document.querySelector('iframe').src = "about:blank"
+  )"));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  RenderFrameHostImpl* main_document = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+  RenderFrameHostImpl* sub_document_1 =
+      main_document->child_at(0)->current_frame_host();
+
+  EXPECT_EQ(url::kAboutBlankURL, sub_document_1->GetLastCommittedURL());
+  EXPECT_EQ(url::Origin::Create(url_a),
+            sub_document_1->GetLastCommittedOrigin());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_1->GetSiteInstance());
+
+  // 0. The default state doesn't contain any cookies.
+  EXPECT_EQ("", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_1, "document.cookie"));
+
+  // 1. Set a cookie in the main document, it affects its child too.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'a=0';"));
+
+  EXPECT_EQ("a=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0", EvalJs(sub_document_1, "document.cookie"));
+
+  // 2. Set a cookie in the child, it affects its parent too.
+  EXPECT_TRUE(ExecJs(sub_document_1, "document.cookie = 'b=0';"));
+
+  EXPECT_EQ("a=0; b=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0", EvalJs(sub_document_1, "document.cookie"));
+
+  // 3. Checks cookies are sent while requesting resources.
+  GURL url_response_1 = embedded_test_server()->GetURL("a.com", "/response_1");
+  EXPECT_TRUE(ExecJs(sub_document_1, JsReplace("fetch($1)", url_response_1)));
+  response_1.WaitForRequest();
+  EXPECT_EQ("a=0; b=0", response_1.http_request()->headers.at("Cookie"));
+
+  // 4. Navigate the iframe elsewhere.
+  EXPECT_TRUE(ExecJs(sub_document_1, JsReplace("location.href = $1", url_b)));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_2 =
+      main_document->child_at(0)->current_frame_host();
+
+  EXPECT_EQ("a=0; b=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_2, "document.cookie"));
+
+  // 5. Set a cookie in the main document. It doesn't affect its child.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'c=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_2, "document.cookie"));
+
+  // 6. Set a cookie in the child. It doesn't affect its parent.
+  EXPECT_TRUE(ExecJs(sub_document_2, "document.cookie = 'd=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("d=0", EvalJs(sub_document_2, "document.cookie"));
+
+  // 7. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_2, "fetch('/response_2');"));
+  response_2.WaitForRequest();
+  EXPECT_EQ("d=0", response_2.http_request()->headers.at("Cookie"));
+
+  // 8. Navigate the iframe back to about:blank.
+  shell()->web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_3 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ(url_a, main_document->GetLastCommittedURL());
+  EXPECT_EQ(url::kAboutBlankURL, sub_document_3->GetLastCommittedURL());
+  EXPECT_EQ(url::Origin::Create(url_a),
+            sub_document_3->GetLastCommittedOrigin());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_3->GetSiteInstance());
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(sub_document_3, "document.cookie"));
+
+  // 9. Set cookie in the main document. It affects the iframe.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'e=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0; e=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0", EvalJs(sub_document_3, "document.cookie"));
+
+  // 10. Set cookie in the iframe. It affects the main frame.
+  EXPECT_TRUE(ExecJs(sub_document_3, "document.cookie = 'f=0';"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            EvalJs(sub_document_3, "document.cookie"));
+
+  // 11. Even if document.cookie is empty, cookies are sent.
+  EXPECT_TRUE(ExecJs(sub_document_3, "fetch('/response_3');"));
+  response_3.WaitForRequest();
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            response_3.http_request()->headers.at("Cookie"));
+}
+
+// Test how cookies are inherited in about:blank iframes.
+//
+// This is a variation of NavigationBaseBrowserTest.CookiesInheritedAboutBlank.
+// Instead of requesting an history navigation, a new navigation is requested
+// from the main frame. The navigation is cross-site instead of being same-site.
+IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest, CookiesInheritedAboutBlank2) {
+  // This test expects several cross-site navigation to happen.
+  if (!AreAllSitesIsolatedForTesting())
+    return;
+
+  using Response = net::test_server::ControllableHttpResponse;
+  Response response_1(embedded_test_server(), "/response_1");
+  Response response_2(embedded_test_server(), "/response_2");
+  Response response_3(embedded_test_server(), "/response_3");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+
+  EXPECT_TRUE(
+      ExecJs(shell(), JsReplace("let iframe = document.createElement('iframe');"
+                                "iframe.src = $1;"
+                                "document.body.appendChild(iframe);",
+                                url_b)));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    document.querySelector('iframe').src = "about:blank"
+  )"));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  RenderFrameHostImpl* main_document = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+  RenderFrameHostImpl* sub_document_1 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ(url::kAboutBlankURL, sub_document_1->GetLastCommittedURL());
+  EXPECT_EQ(url::Origin::Create(url_a),
+            sub_document_1->GetLastCommittedOrigin());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_1->GetSiteInstance());
+
+  // 0. The default state doesn't contain any cookies.
+  EXPECT_EQ("", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_1, "document.cookie"));
+
+  // 1. Set a cookie in the main document, it affects its child too.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'a=0';"));
+
+  EXPECT_EQ("a=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0", EvalJs(sub_document_1, "document.cookie"));
+
+  // 2. Set a cookie in the child, it affects its parent too.
+  EXPECT_TRUE(ExecJs(sub_document_1, "document.cookie = 'b=0';"));
+
+  EXPECT_EQ("a=0; b=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0", EvalJs(sub_document_1, "document.cookie"));
+
+  // 3. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_1, "fetch('/response_1');"));
+  response_1.WaitForRequest();
+  EXPECT_EQ("a=0; b=0", response_1.http_request()->headers.at("Cookie"));
+
+  // 4. Navigate the iframe elsewhere.
+  EXPECT_TRUE(ExecJs(sub_document_1, JsReplace("location.href = $1", url_b)));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_2 =
+      main_document->child_at(0)->current_frame_host();
+
+  EXPECT_EQ("a=0; b=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_2, "document.cookie"));
+
+  // 5. Set a cookie in the main document. It doesn't affect its child.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'c=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("", EvalJs(sub_document_2, "document.cookie"));
+
+  // 6. Set a cookie in the child. It doesn't affect its parent.
+  EXPECT_TRUE(ExecJs(sub_document_2, "document.cookie = 'd=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("d=0", EvalJs(sub_document_2, "document.cookie"));
+
+  // 7. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_2, "fetch('/response_2');"));
+  response_2.WaitForRequest();
+  EXPECT_EQ("d=0", response_2.http_request()->headers.at("Cookie"));
+
+  // 8. Ask the top-level, a.com frame to navigate the subframe to about:blank.
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    document.querySelector('iframe').src = "about:blank";
+  )"));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_3 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ(url::kAboutBlankURL, sub_document_3->GetLastCommittedURL());
+  EXPECT_EQ(url::Origin::Create(url_a),
+            sub_document_3->GetLastCommittedOrigin());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_3->GetSiteInstance());
+
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0", EvalJs(sub_document_3, "document.cookie"));
+
+  // 9. Set cookie in the main document.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'e=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0; e=0", EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0", EvalJs(sub_document_3, "document.cookie"));
+
+  // 10. Set cookie in the child document.
+  EXPECT_TRUE(ExecJs(sub_document_3, "document.cookie = 'f=0';"));
+
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            EvalJs(main_document, "document.cookie"));
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            EvalJs(sub_document_3, "document.cookie"));
+
+  // 11. Checks cookies are sent while requesting resources.
+  EXPECT_TRUE(ExecJs(sub_document_3, "fetch('/response_3');"));
+  response_3.WaitForRequest();
+  EXPECT_EQ("a=0; b=0; c=0; e=0; f=0",
+            response_3.http_request()->headers.at("Cookie"));
+}
+
+// Test how cookies are inherited in data-URL iframes.
+IN_PROC_BROWSER_TEST_P(NavigationBaseBrowserTest, CookiesInheritedDataUrl) {
+  using Response = net::test_server::ControllableHttpResponse;
+  Response response_1(embedded_test_server(), "/response_1");
+  Response response_2(embedded_test_server(), "/response_2");
+  Response response_3(embedded_test_server(), "/response_3");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  GURL url_b(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+
+  EXPECT_TRUE(ExecJs(shell(), R"(
+    let iframe = document.createElement("iframe");
+    iframe.src = "data:text/html,";
+    document.body.appendChild(iframe);
+  )"));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+  RenderFrameHostImpl* main_document = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+  RenderFrameHostImpl* sub_document_1 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ("data:text/html,", sub_document_1->GetLastCommittedURL());
+  EXPECT_TRUE(sub_document_1->GetLastCommittedOrigin().opaque());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_1->GetSiteInstance());
+
+  // 1. Writing a cookie inside a data-URL document is forbidden.
+  auto console_delegate_1 = std::make_unique<ConsoleObserverDelegate>(
+      shell()->web_contents(),
+      "*Failed to set the 'cookie' property on 'Document': Cookies are "
+      "disabled inside 'data:' URLs.*");
+  shell()->web_contents()->SetDelegate(console_delegate_1.get());
+  ExecuteScriptAsync(sub_document_1, "document.cookie = 'a=0';");
+  console_delegate_1->Wait();
+
+  // 2. Reading a cookie inside a data-URL document is forbidden.
+  auto console_delegate_2 = std::make_unique<ConsoleObserverDelegate>(
+      shell()->web_contents(),
+      "*Failed to read the 'cookie' property from 'Document': Cookies are "
+      "disabled inside 'data:' URLs.*");
+  shell()->web_contents()->SetDelegate(console_delegate_2.get());
+  ExecuteScriptAsync(sub_document_1, "document.cookie");
+  console_delegate_2->Wait();
+
+  // 3. Set cookie in the main document. No cookies are sent when requested from
+  // the data-URL.
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'a=0;SameSite=Lax'"));
+  EXPECT_TRUE(ExecJs(main_document, "document.cookie = 'b=0;SameSite=Strict'"));
+  GURL url_response_1 = embedded_test_server()->GetURL("a.com", "/response_1");
+  EXPECT_TRUE(ExecJs(sub_document_1, JsReplace("fetch($1)", url_response_1)));
+  response_1.WaitForRequest();
+  EXPECT_EQ(0u, response_1.http_request()->headers.count("Cookie"));
+
+  // 4. Navigate the iframe elsewhere and back using history navigation.
+  EXPECT_TRUE(ExecJs(sub_document_1, JsReplace("location.href = $1", url_b)));
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  shell()->web_contents()->GetController().GoBack();
+  EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+  RenderFrameHostImpl* sub_document_2 =
+      main_document->child_at(0)->current_frame_host();
+  EXPECT_EQ(url_a, main_document->GetLastCommittedURL());
+  EXPECT_EQ("data:text/html,", sub_document_2->GetLastCommittedURL());
+  EXPECT_TRUE(sub_document_2->GetLastCommittedOrigin().opaque());
+  EXPECT_EQ(main_document->GetSiteInstance(),
+            sub_document_2->GetSiteInstance());
+
+  // 5. Writing a cookie inside a data-URL document is still forbidden.
+  auto console_delegate_3 = std::make_unique<ConsoleObserverDelegate>(
+      shell()->web_contents(),
+      "*Failed to set the 'cookie' property on 'Document': Cookies are "
+      "disabled inside 'data:' URLs.*");
+  shell()->web_contents()->SetDelegate(console_delegate_3.get());
+  ExecuteScriptAsync(sub_document_2, "document.cookie = 'c=0';");
+  console_delegate_3->Wait();
+
+  // 6. Reading a cookie inside a data-URL document is still forbidden.
+  auto console_delegate_4 = std::make_unique<ConsoleObserverDelegate>(
+      shell()->web_contents(),
+      "*Failed to read the 'cookie' property from 'Document': Cookies are "
+      "disabled inside 'data:' URLs.*");
+  shell()->web_contents()->SetDelegate(console_delegate_4.get());
+  ExecuteScriptAsync(sub_document_2, "document.cookie");
+  console_delegate_4->Wait();
+
+  // 7. No cookies are sent when requested from the data-URL.
+  GURL url_response_2 = embedded_test_server()->GetURL("a.com", "/response_2");
+  EXPECT_TRUE(ExecJs(sub_document_2, JsReplace("fetch($1)", url_response_2)));
+  response_2.WaitForRequest();
+  EXPECT_EQ(0u, response_2.http_request()->headers.count("Cookie"));
+}
+
+// Tests for validating URL rewriting behavior like chrome://history to
+// chrome-native://history.
+class NavigationUrlRewriteBrowserTest : public NavigationBaseBrowserTest {
+ protected:
+  static constexpr const char* kRewriteURL = "http://a.com/rewrite";
+  static constexpr const char* kNoAccessScheme = "no-access";
+  static constexpr const char* kNoAccessURL = "no-access://testing/";
+
+  class BrowserClient : public ContentBrowserClient {
+   public:
+    void BrowserURLHandlerCreated(BrowserURLHandler* handler) override {
+      handler->AddHandlerPair(RewriteUrl,
+                              BrowserURLHandlerImpl::null_handler());
+    }
+
+    void RegisterNonNetworkNavigationURLLoaderFactories(
+        int frame_tree_node_id,
+        NonNetworkURLLoaderFactoryMap* factories) override {
+      auto url_loader_factory = std::make_unique<FakeNetworkURLLoaderFactory>(
+          "HTTP/1.1 200 OK\nContent-Type: text/html\n\n", "This is a test",
+          /* network_accessed */ true, net::OK);
+      factories->emplace(std::string(kNoAccessScheme),
+                         std::move(url_loader_factory));
+    }
+
+    bool ShouldAssignSiteForURL(const GURL& url) override {
+      return !url.SchemeIs(kNoAccessScheme);
+    }
+
+    static bool RewriteUrl(GURL* url, BrowserContext* browser_context) {
+      if (*url == GURL(kRewriteURL)) {
+        *url = GURL(kNoAccessURL);
+        return true;
+      }
+      return false;
+    }
+  };
+
+  void SetUp() override {
+    url::AddStandardScheme(kNoAccessScheme, url::SCHEME_WITH_HOST);
+    url::AddNoAccessScheme(kNoAccessScheme);
+
+    NavigationBaseBrowserTest::SetUp();
+  }
+
+  void SetUpOnMainThread() override {
+    NavigationBaseBrowserTest::SetUpOnMainThread();
+    ASSERT_TRUE(embedded_test_server()->Start());
+
+    browser_client_ = std::make_unique<BrowserClient>();
+    old_browser_client_ = SetBrowserClientForTesting(browser_client_.get());
+  }
+
+  void TearDownOnMainThread() override {
+    SetBrowserClientForTesting(old_browser_client_);
+    old_browser_client_ = nullptr;
+    browser_client_.reset();
+
+    NavigationBaseBrowserTest::TearDownOnMainThread();
+  }
+
+  GURL GetRewriteToNoAccessURL() const { return GURL(kRewriteURL); }
+
+ private:
+  std::unique_ptr<BrowserClient> browser_client_;
+  ContentBrowserClient* old_browser_client_;
+};
+
+INSTANTIATE_TEST_SUITE_P(/* no prefix */,
+                         NavigationUrlRewriteBrowserTest,
+                         ::testing::Bool());
+
+// Tests navigating to a URL that gets rewritten to a "no access" URL. This
+// mimics the behavior of navigating to special URLs like chrome://newtab and
+// chrome://history which get rewritten to "no access" chrome-native:// URLs.
+IN_PROC_BROWSER_TEST_P(NavigationUrlRewriteBrowserTest, RewriteToNoAccess) {
+  // Perform an initial navigation.
+  {
+    TestNavigationObserver observer(shell()->web_contents());
+    GURL url = embedded_test_server()->GetURL("a.com", "/title1.html");
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    EXPECT_EQ(url, observer.last_navigation_url());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_FALSE(observer.last_initiator_origin().has_value());
+  }
+
+  // Navigate to the URL that will get rewritten to a "no access" URL.
+  {
+    auto* web_contents = shell()->web_contents();
+    TestNavigationObserver observer(web_contents);
+
+    // Note: We are using LoadURLParams here because we need to have the
+    // initiator_origin set and NavigateToURL() does not do that.
+    NavigationController::LoadURLParams params(GetRewriteToNoAccessURL());
+    params.initiator_origin =
+        web_contents->GetMainFrame()->GetLastCommittedOrigin();
+    web_contents->GetController().LoadURLWithParams(params);
+    web_contents->Focus();
+    observer.Wait();
+
+    EXPECT_EQ(GURL(kNoAccessURL), observer.last_navigation_url());
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_TRUE(observer.last_initiator_origin().has_value());
+  }
+}
+
+// Update the fragment part of the URL while it is currently displaying an error
+// page. Regression test https://crbug.com/1018385
+IN_PROC_BROWSER_TEST_P(NavigationBrowserTest,
+                       SameDocumentNavigationInErrorPage) {
+  WebContents* wc = shell()->web_contents();
+  NavigationHandleCommitObserver navigation_0(wc, GURL("about:srcdoc#0"));
+  NavigationHandleCommitObserver navigation_1(wc, GURL("about:srcdoc#1"));
+
+  // Big warning: about:srcdoc is not supposed to be valid browser-initiated
+  // main-frame navigation, it is currently blocked by the NavigationRequest.
+  // It is used here to reproduce bug https://crbug.com/1018385. Please avoid
+  // copying this kind of navigation in your own tests.
+  EXPECT_FALSE(NavigateToURL(shell(), GURL("about:srcdoc#0")));
+  EXPECT_FALSE(NavigateToURL(shell(), GURL("about:srcdoc#1")));
+
+  EXPECT_TRUE(navigation_0.has_committed());
+  EXPECT_TRUE(navigation_1.has_committed());
+  EXPECT_FALSE(navigation_0.was_same_document());
+  EXPECT_FALSE(navigation_1.was_same_document());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/net/accept_header_browsertest.cc b/chromium/content/browser/net/accept_header_browsertest.cc
index c4ab85ad880..5af3ff3098a 100644
--- a/chromium/content/browser/net/accept_header_browsertest.cc
+++ b/chromium/content/browser/net/accept_header_browsertest.cc
@@ -91,18 +91,19 @@ class AcceptHeaderTest : public ContentBrowserTest {
 };
 
 IN_PROC_BROWSER_TEST_F(AcceptHeaderTest, Check) {
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/accept-header.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/accept-header.html")));
 
   // ResourceType::kMainFrame
   EXPECT_EQ(
       "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,"
-      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3",
+      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
       GetFor("/accept-header.html"));
 
   // ResourceType::kSubFrame
   EXPECT_EQ(
       "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,"
-      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3",
+      "image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
       GetFor("/iframe.html"));
 
   // ResourceType::kStylesheet
diff --git a/chromium/content/browser/net_info_browsertest.cc b/chromium/content/browser/net_info_browsertest.cc
index 64bb6f4b86d..2a898f25592 100644
--- a/chromium/content/browser/net_info_browsertest.cc
+++ b/chromium/content/browser/net_info_browsertest.cc
@@ -12,6 +12,7 @@
 #include "base/test/metrics/histogram_tester.h"
 #include "build/build_config.h"
 #include "content/browser/net/network_quality_observer_impl.h"
+#include "content/public/browser/render_process_host.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -177,7 +178,7 @@ IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, VerifyNetworkStateInitialized) {
   net::NetworkChangeNotifier::DisableForTest disable_for_test;
   MockNetworkChangeNotifierWifi mock_notifier;
 
-  NavigateToURL(shell(), content::GetTestUrl("", "net_info.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), content::GetTestUrl("", "net_info.html")));
   EXPECT_TRUE(RunScriptExtractBool("getOnLine()"));
   EXPECT_EQ("wifi", RunScriptExtractString("getType()"));
   EXPECT_EQ(net::NetworkChangeNotifier::GetMaxBandwidthMbpsForConnectionSubtype(
@@ -188,7 +189,7 @@ IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, VerifyNetworkStateInitialized) {
 // Make sure that type changes in the browser make their way to
 // navigator.connection.type.
 IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, NetworkChangePlumbsToNavigator) {
-  NavigateToURL(shell(), content::GetTestUrl("", "net_info.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), content::GetTestUrl("", "net_info.html")));
   SetConnectionType(net::NetworkChangeNotifier::CONNECTION_WIFI,
                     net::NetworkChangeNotifier::SUBTYPE_WIFI_N);
   EXPECT_EQ("wifi", RunScriptExtractString("getType()"));
@@ -207,7 +208,7 @@ IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, NetworkChangePlumbsToNavigator) {
 // Make sure that type changes in the browser make their way to
 // navigator.isOnline.
 IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, IsOnline) {
-  NavigateToURL(shell(), content::GetTestUrl("", "net_info.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), content::GetTestUrl("", "net_info.html")));
   SetConnectionType(net::NetworkChangeNotifier::CONNECTION_ETHERNET,
                     net::NetworkChangeNotifier::SUBTYPE_GIGABIT_ETHERNET);
   EXPECT_TRUE(RunScriptExtractBool("getOnLine()"));
@@ -224,7 +225,7 @@ IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, IsOnline) {
 IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest, TwoRenderViewsInOneProcess) {
   SetConnectionType(net::NetworkChangeNotifier::CONNECTION_ETHERNET,
                     net::NetworkChangeNotifier::SUBTYPE_GIGABIT_ETHERNET);
-  NavigateToURL(shell(), content::GetTestUrl("", "net_info.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), content::GetTestUrl("", "net_info.html")));
   EXPECT_TRUE(RunScriptExtractBool("getOnLine()"));
 
   SetConnectionType(net::NetworkChangeNotifier::CONNECTION_NONE,
@@ -285,14 +286,13 @@ IN_PROC_BROWSER_TEST_F(NetInfoBrowserTest,
   // effective connection type.
   GetNetworkQualityTracker()->ReportEffectiveConnectionTypeForTesting(
       net::EFFECTIVE_CONNECTION_TYPE_2G);
-  base::RunLoop().RunUntilIdle();
   EXPECT_EQ("2g", RunScriptExtractString("getEffectiveType()"));
+
   GetNetworkQualityTracker()->ReportEffectiveConnectionTypeForTesting(
       net::EFFECTIVE_CONNECTION_TYPE_3G);
-  base::RunLoop().RunUntilIdle();
   EXPECT_EQ("3g", RunScriptExtractString("getEffectiveType()"));
+
   FetchHistogramsFromChildProcesses();
-  base::RunLoop().RunUntilIdle();
   EXPECT_GT(GetTotalSampleCount(&histogram_tester, "NQE.RenderThreadNotified"),
             samples);
 }
diff --git a/chromium/content/browser/network_service_browsertest.cc b/chromium/content/browser/network_service_browsertest.cc
index 41456f06bb0..0055fa4bd6b 100644
--- a/chromium/content/browser/network_service_browsertest.cc
+++ b/chromium/content/browser/network_service_browsertest.cc
@@ -11,7 +11,6 @@
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/network_service_instance.h"
-#include "content/public/browser/system_connector.h"
 #include "content/public/browser/url_data_source.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -20,7 +19,6 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
-#include "content/public/common/service_names.mojom.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -29,6 +27,7 @@
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/http/http_response_headers.h"
 #include "net/test/embedded_test_server/default_handlers.h"
@@ -39,7 +38,6 @@
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/network_service_test.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
 
 #if defined(OS_ANDROID)
 #include "base/android/application_status_listener.h"
@@ -247,12 +245,12 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest,
   base::ScopedAllowBlockingForTesting allow_blocking;
 
   // Create network context with cache pointing to the temp cache dir.
-  network::mojom::NetworkContextPtr network_context;
+  mojo::Remote<network::mojom::NetworkContext> network_context;
   network::mojom::NetworkContextParamsPtr context_params =
       network::mojom::NetworkContextParams::New();
   context_params->http_cache_path = GetCacheDirectory();
-  GetNetworkService()->CreateNetworkContext(mojo::MakeRequest(&network_context),
-                                            std::move(context_params));
+  GetNetworkService()->CreateNetworkContext(
+      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
 
   network::mojom::URLLoaderFactoryParamsPtr params =
       network::mojom::URLLoaderFactoryParams::New();
@@ -343,9 +341,9 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest,
   if (IsInProcessNetworkService())
     return;
 
-  network::mojom::NetworkServiceTestPtr network_service_test;
-  GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                      &network_service_test);
+  mojo::Remote<network::mojom::NetworkServiceTest> network_service_test;
+  GetNetworkService()->BindTestInterface(
+      network_service_test.BindNewPipeAndPassReceiver());
   // TODO(crbug.com/901026): Make sure the network process is started to avoid a
   // deadlock on Android.
   network_service_test.FlushForTesting();
@@ -372,20 +370,19 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest, SyncXHROnCrash) {
   if (IsInProcessNetworkService())
     return;
 
-  network::mojom::NetworkServiceTestPtr network_service_test;
-  GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                      &network_service_test);
-  network::mojom::NetworkServiceTestPtrInfo network_service_test_info =
-      network_service_test.PassInterface();
+  mojo::PendingRemote<network::mojom::NetworkServiceTest>
+      pending_network_service_test;
+  GetNetworkService()->BindTestInterface(
+      pending_network_service_test.InitWithNewPipeAndPassReceiver());
 
   net::EmbeddedTestServer http_server;
   http_server.AddDefaultHandlers(GetTestDataFilePath());
   http_server.RegisterRequestMonitor(base::BindLambdaForTesting(
       [&](const net::test_server::HttpRequest& request) {
         if (request.relative_url == "/hung") {
-          network::mojom::NetworkServiceTestPtr network_service_test2(
-              std::move(network_service_test_info));
-          network_service_test2->SimulateCrash();
+          mojo::Remote<network::mojom::NetworkServiceTest> network_service_test(
+              std::move(pending_network_service_test));
+          network_service_test->SimulateCrash();
         }
       }));
   EXPECT_TRUE(http_server.Start());
@@ -401,9 +398,9 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceBrowserTest, SyncCookieGetOnCrash) {
   if (IsInProcessNetworkService())
     return;
 
-  network::mojom::NetworkServiceTestPtr network_service_test;
-  GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                      &network_service_test);
+  mojo::Remote<network::mojom::NetworkServiceTest> network_service_test;
+  GetNetworkService()->BindTestInterface(
+      network_service_test.BindNewPipeAndPassReceiver());
   network_service_test->CrashOnGetCookieList();
 
   EXPECT_TRUE(
diff --git a/chromium/content/browser/network_service_client.cc b/chromium/content/browser/network_service_client.cc
index 7b0b5606b4a..754d7054bea 100644
--- a/chromium/content/browser/network_service_client.cc
+++ b/chromium/content/browser/network_service_client.cc
@@ -24,10 +24,10 @@
 #include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/network_service_instance.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/network_service_util.h"
 #include "content/public/common/resource_type.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 #include "services/network/public/cpp/load_info_util.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
@@ -49,8 +49,9 @@ WebContents* GetWebContents(int process_id, int routing_id) {
 }  // namespace
 
 NetworkServiceClient::NetworkServiceClient(
-    network::mojom::NetworkServiceClientRequest network_service_client_request)
-    : binding_(this, std::move(network_service_client_request))
+    mojo::PendingReceiver<network::mojom::NetworkServiceClient>
+        network_service_client_receiver)
+    : receiver_(this, std::move(network_service_client_receiver))
 #if defined(OS_ANDROID)
       ,
       app_status_listener_(base::android::ApplicationStatusListener::New(
@@ -71,7 +72,7 @@ NetworkServiceClient::NetworkServiceClient(
             &NetworkServiceClient::OnMemoryPressure, base::Unretained(this)));
 
 #if defined(OS_ANDROID)
-    DCHECK(net::NetworkChangeNotifier::HasNetworkChangeNotifier());
+    DCHECK(!net::NetworkChangeNotifier::CreateIfNeeded());
     GetNetworkService()->GetNetworkChangeManager(
         mojo::MakeRequest(&network_change_manager_));
     net::NetworkChangeNotifier::AddConnectionTypeObserver(this);
diff --git a/chromium/content/browser/network_service_client.h b/chromium/content/browser/network_service_client.h
index 1df7126c270..855afdfce74 100644
--- a/chromium/content/browser/network_service_client.h
+++ b/chromium/content/browser/network_service_client.h
@@ -14,7 +14,8 @@
 #include "base/unguessable_token.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "net/cert/cert_database.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "url/gurl.h"
@@ -37,8 +38,9 @@ class CONTENT_EXPORT NetworkServiceClient
 #endif
       public net::CertDatabase::Observer {
  public:
-  explicit NetworkServiceClient(network::mojom::NetworkServiceClientRequest
-                                    network_service_client_request);
+  explicit NetworkServiceClient(
+      mojo::PendingReceiver<network::mojom::NetworkServiceClient>
+          network_service_client_receiver);
   ~NetworkServiceClient() override;
 
   // network::mojom::NetworkServiceClient implementation:
@@ -91,7 +93,7 @@ class CONTENT_EXPORT NetworkServiceClient
 #endif
 
  private:
-  mojo::Binding<network::mojom::NetworkServiceClient> binding_;
+  mojo::Receiver<network::mojom::NetworkServiceClient> receiver_;
 
   std::unique_ptr<base::MemoryPressureListener> memory_pressure_listener_;
 
diff --git a/chromium/content/browser/network_service_instance_impl.cc b/chromium/content/browser/network_service_instance_impl.cc
index 7a3e98e1e46..20e29ca82d2 100644
--- a/chromium/content/browser/network_service_instance_impl.cc
+++ b/chromium/content/browser/network_service_instance_impl.cc
@@ -13,6 +13,7 @@
 #include "base/deferred_sequenced_task_runner.h"
 #include "base/environment.h"
 #include "base/feature_list.h"
+#include "base/message_loop/message_pump_type.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/no_destructor.h"
 #include "base/strings/string_util.h"
@@ -20,6 +21,7 @@
 #include "base/synchronization/waitable_event.h"
 #include "base/task/post_task.h"
 #include "base/threading/sequence_local_storage_slot.h"
+#include "base/threading/thread.h"
 #include "build/build_config.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/network_service_client.h"
@@ -27,16 +29,21 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/network_service_instance.h"
+#include "content/public/browser/service_process_host.h"
 #include "content/public/browser/system_connector.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/network_service_util.h"
 #include "content/public/common/service_names.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/log/net_log_util.h"
 #include "services/network/network_service.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/mojom/net_log.mojom.h"
 #include "services/network/public/mojom/network_change_manager.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
+#include "services/network/public/mojom/network_service.mojom.h"
+#include "services/network/public/mojom/network_service_test.mojom.h"
 
 namespace content {
 
@@ -50,7 +57,8 @@ constexpr char kKrb5ConfEnvName[] = "KRB5_CONFIG";
 #endif
 
 bool g_force_create_network_service_directly = false;
-network::mojom::NetworkServicePtr* g_network_service_ptr = nullptr;
+mojo::Remote<network::mojom::NetworkService>* g_network_service_remote =
+    nullptr;
 network::NetworkConnectionTracker* g_network_connection_tracker;
 bool g_network_service_is_responding = false;
 base::Time g_last_network_service_crash;
@@ -68,6 +76,55 @@ std::unique_ptr<network::NetworkService>& GetLocalNetworkService() {
   return service->GetOrCreateValue();
 }
 
+// If this feature is enabled, the Network Service will run on its own thread
+// when running in-process; otherwise it will run on the IO thread.
+//
+// On Chrome OS, the Network Service must run on the IO thread because
+// ProfileIOData and NetworkContext both try to set up NSS, which has to be
+// called from the IO thread.
+const base::Feature kNetworkServiceDedicatedThread {
+  "NetworkServiceDedicatedThread",
+#if defined(OS_CHROMEOS)
+      base::FEATURE_DISABLED_BY_DEFAULT
+#else
+      base::FEATURE_ENABLED_BY_DEFAULT
+#endif
+};
+
+base::Thread& GetNetworkServiceDedicatedThread() {
+  static base::NoDestructor<base::Thread> thread{"NetworkService"};
+  DCHECK(base::FeatureList::IsEnabled(kNetworkServiceDedicatedThread));
+  return *thread;
+}
+
+void CreateInProcessNetworkServiceOnThread(
+    mojo::PendingReceiver<network::mojom::NetworkService> receiver) {
+  // The test interface doesn't need to be implemented in the in-process case.
+  auto registry = std::make_unique<service_manager::BinderRegistry>();
+  registry->AddInterface(base::BindRepeating(
+      [](mojo::PendingReceiver<network::mojom::NetworkServiceTest>) {}));
+  static base::NoDestructor<network::NetworkService> service(
+      std::move(registry), std::move(receiver),
+      true /* delay_initialization_until_set_client */);
+}
+
+void CreateInProcessNetworkService(
+    mojo::PendingReceiver<network::mojom::NetworkService> receiver) {
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner;
+  if (base::FeatureList::IsEnabled(kNetworkServiceDedicatedThread)) {
+    base::Thread::Options options(base::MessagePumpType::IO, 0);
+    GetNetworkServiceDedicatedThread().StartWithOptions(options);
+    task_runner = GetNetworkServiceDedicatedThread().task_runner();
+  } else {
+    task_runner = base::CreateSingleThreadTaskRunner({BrowserThread::IO});
+  }
+
+  GetNetworkTaskRunner()->StartWithTaskRunner(task_runner);
+  task_runner->PostTask(FROM_HERE,
+                        base::BindOnce(&CreateInProcessNetworkServiceOnThread,
+                                       std::move(receiver)));
+}
+
 network::mojom::NetworkServiceParamsPtr CreateNetworkServiceParams() {
   network::mojom::NetworkServiceParamsPtr network_service_params =
       network::mojom::NetworkServiceParams::New();
@@ -99,22 +156,26 @@ network::mojom::NetworkServiceParamsPtr CreateNetworkServiceParams() {
 }
 
 void CreateNetworkServiceOnIOForTesting(
-    network::mojom::NetworkServiceRequest request,
+    mojo::PendingReceiver<network::mojom::NetworkService> receiver,
     base::WaitableEvent* completion_event) {
   if (GetLocalNetworkService()) {
-    GetLocalNetworkService()->Bind(std::move(request));
+    GetLocalNetworkService()->Bind(std::move(receiver));
     return;
   }
 
-  GetLocalNetworkService() =
-      std::make_unique<network::NetworkService>(nullptr, std::move(request));
+  GetLocalNetworkService() = std::make_unique<network::NetworkService>(
+      nullptr /* registry */, std::move(receiver),
+      true /* delay_initialization_until_set_client */);
+  GetLocalNetworkService()->Initialize(
+      network::mojom::NetworkServiceParams::New(),
+      true /* mock_network_change_notifier */);
   if (completion_event)
     completion_event->Signal();
 }
 
-void BindNetworkChangeManagerRequest(
-    network::mojom::NetworkChangeManagerRequest request) {
-  GetNetworkService()->GetNetworkChangeManager(std::move(request));
+void BindNetworkChangeManagerReceiver(
+    mojo::PendingReceiver<network::mojom::NetworkChangeManager> receiver) {
+  GetNetworkService()->GetNetworkChangeManager(std::move(receiver));
 }
 
 base::CallbackList<void()>& GetCrashHandlersList() {
@@ -124,9 +185,9 @@ base::CallbackList<void()>& GetCrashHandlersList() {
 
 void OnNetworkServiceCrash() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
-  DCHECK(g_network_service_ptr);
-  DCHECK(g_network_service_ptr->is_bound());
-  DCHECK(g_network_service_ptr->encountered_error());
+  DCHECK(g_network_service_remote);
+  DCHECK(g_network_service_remote->is_bound());
+  DCHECK(!g_network_service_remote->is_connected());
   g_last_network_service_crash = base::Time::Now();
   GetCrashHandlersList().Notify();
   AddNetworkServiceDebugEvent("ONSC");
@@ -166,55 +227,73 @@ net::NetLogCaptureMode GetNetCaptureModeFromCommandLine(
   return net::NetLogCaptureMode::kDefault;
 }
 
+scoped_refptr<base::DeferredSequencedTaskRunner>&
+GetNetworkTaskRunnerStorage() {
+  static base::NoDestructor<scoped_refptr<base::DeferredSequencedTaskRunner>>
+      storage;
+  return *storage;
+}
+
 }  // namespace
 
 network::mojom::NetworkService* GetNetworkService() {
-  if (!g_network_service_ptr)
-    g_network_service_ptr = new network::mojom::NetworkServicePtr;
+  if (!g_network_service_remote)
+    g_network_service_remote = new mojo::Remote<network::mojom::NetworkService>;
   static NetworkServiceClient* g_client;
-  if (!g_network_service_ptr->is_bound() ||
-      g_network_service_ptr->encountered_error()) {
+  if (!g_network_service_remote->is_bound() ||
+      !g_network_service_remote->is_connected()) {
+    g_network_service_remote->reset();
     if (GetContentClient()->browser()->IsShuttingDown()) {
       // This happens at system shutdown, since in other scenarios the network
       // process would only be torn down once the message loop stopped running.
       // We don't want to want to start the network service again so just create
       // message pipe that's not bound to stop consumers from requesting
       // creation of the service.
-      auto request = mojo::MakeRequest(g_network_service_ptr);
-      auto leaked_pipe = request.PassMessagePipe().release();
+      auto receiver = g_network_service_remote->BindNewPipeAndPassReceiver();
+      auto leaked_pipe = receiver.PassPipe().release();
     } else {
-      if (GetSystemConnector() &&  // null in unit tests.
-          !g_force_create_network_service_directly) {
-        GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                            g_network_service_ptr);
-        g_network_service_ptr->set_connection_error_handler(
+      if (!g_force_create_network_service_directly) {
+        mojo::PendingReceiver<network::mojom::NetworkService> receiver =
+            g_network_service_remote->BindNewPipeAndPassReceiver();
+        g_network_service_remote->set_disconnect_handler(
             base::BindOnce(&OnNetworkServiceCrash));
+        if (IsInProcessNetworkService()) {
+          CreateInProcessNetworkService(std::move(receiver));
+        } else {
+          ServiceProcessHost::Launch(
+              std::move(receiver),
+              ServiceProcessHost::Options()
+                  .WithSandboxType(service_manager::SANDBOX_TYPE_NETWORK)
+                  .WithDisplayName(base::UTF8ToUTF16("Network Service"))
+                  .Pass());
+        }
       } else {
         // This should only be reached in unit tests.
         if (BrowserThread::CurrentlyOn(BrowserThread::IO)) {
           CreateNetworkServiceOnIOForTesting(
-              mojo::MakeRequest(g_network_service_ptr),
+              g_network_service_remote->BindNewPipeAndPassReceiver(),
               /*completion_event=*/nullptr);
         } else {
           base::WaitableEvent event;
-          base::PostTaskWithTraits(
+          base::PostTask(
               FROM_HERE, {BrowserThread::IO},
-              base::BindOnce(CreateNetworkServiceOnIOForTesting,
-                             mojo::MakeRequest(g_network_service_ptr),
-                             base::Unretained(&event)));
+              base::BindOnce(
+                  CreateNetworkServiceOnIOForTesting,
+                  g_network_service_remote->BindNewPipeAndPassReceiver(),
+                  base::Unretained(&event)));
           event.Wait();
         }
       }
 
       AddNetworkServiceDebugEvent("START");
-      network::mojom::NetworkServiceClientPtr client_ptr;
-      auto client_request = mojo::MakeRequest(&client_ptr);
+      mojo::PendingRemote<network::mojom::NetworkServiceClient> client_remote;
+      auto client_receiver = client_remote.InitWithNewPipeAndPassReceiver();
       // Call SetClient before creating NetworkServiceClient, as the latter
       // might make requests to NetworkService that depend on initialization.
-      (*g_network_service_ptr)
-          ->SetClient(std::move(client_ptr), CreateNetworkServiceParams());
+      (*g_network_service_remote)
+          ->SetClient(std::move(client_remote), CreateNetworkServiceParams());
       g_network_service_is_responding = false;
-      g_network_service_ptr->QueryVersion(base::BindRepeating(
+      g_network_service_remote->QueryVersion(base::BindRepeating(
           [](base::Time start_time, uint32_t) {
             AddNetworkServiceDebugEvent("RESP");
             g_network_service_is_responding = true;
@@ -232,7 +311,7 @@ network::mojom::NetworkService* GetNetworkService() {
           base::Time::Now()));
 
       delete g_client;  // In case we're recreating the network service.
-      g_client = new NetworkServiceClient(std::move(client_request));
+      g_client = new NetworkServiceClient(std::move(client_receiver));
 
       const base::CommandLine* command_line =
           base::CommandLine::ForCurrentProcess();
@@ -248,7 +327,7 @@ network::mojom::NetworkService* GetNetworkService() {
         if (!file.IsValid()) {
           LOG(ERROR) << "Failed opening NetLog: " << log_path.value();
         } else {
-          (*g_network_service_ptr)
+          (*g_network_service_remote)
               ->StartNetLog(std::move(file),
                             GetNetCaptureModeFromCommandLine(*command_line),
                             std::move(client_constants));
@@ -288,15 +367,15 @@ network::mojom::NetworkService* GetNetworkService() {
         } else {
           UMA_HISTOGRAM_ENUMERATION(kSSLKeyLogFileHistogram,
                                     SSLKeyLogFileAction::kLogFileEnabled);
-          (*g_network_service_ptr)->SetSSLKeyLogFile(std::move(file));
+          (*g_network_service_remote)->SetSSLKeyLogFile(std::move(file));
         }
       }
 
       GetContentClient()->browser()->OnNetworkServiceCreated(
-          g_network_service_ptr->get());
+          g_network_service_remote->get());
     }
   }
-  return g_network_service_ptr->get();
+  return g_network_service_remote->get();
 }
 
 std::unique_ptr<base::CallbackList<void()>::Subscription>
@@ -316,8 +395,8 @@ net::NetworkChangeNotifier* GetNetworkChangeNotifier() {
 void FlushNetworkServiceInstanceForTesting() {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
 
-  if (g_network_service_ptr)
-    g_network_service_ptr->FlushForTesting();
+  if (g_network_service_remote)
+    g_network_service_remote->FlushForTesting();
 }
 
 network::NetworkConnectionTracker* GetNetworkConnectionTracker() {
@@ -325,7 +404,7 @@ network::NetworkConnectionTracker* GetNetworkConnectionTracker() {
          !BrowserThread::IsThreadInitialized(BrowserThread::UI));
   if (!g_network_connection_tracker) {
     g_network_connection_tracker = new network::NetworkConnectionTracker(
-        base::BindRepeating(&BindNetworkChangeManagerRequest));
+        base::BindRepeating(&BindNetworkChangeManagerReceiver));
   }
   return g_network_connection_tracker;
 }
@@ -368,9 +447,10 @@ void SetNetworkConnectionTrackerForTesting(
 
 scoped_refptr<base::DeferredSequencedTaskRunner> GetNetworkTaskRunner() {
   DCHECK(IsInProcessNetworkService());
-  static base::NoDestructor<scoped_refptr<base::DeferredSequencedTaskRunner>>
-      instance(new base::DeferredSequencedTaskRunner());
-  return instance->get();
+  auto& storage = GetNetworkTaskRunnerStorage();
+  if (!storage)
+    storage = base::MakeRefCounted<base::DeferredSequencedTaskRunner>();
+  return storage;
 }
 
 void ForceCreateNetworkServiceDirectlyForTesting() {
@@ -378,16 +458,21 @@ void ForceCreateNetworkServiceDirectlyForTesting() {
 }
 
 void ResetNetworkServiceForTesting() {
-  delete g_network_service_ptr;
-  g_network_service_ptr = nullptr;
+  ShutDownNetworkService();
+}
+
+void ShutDownNetworkService() {
+  delete g_network_service_remote;
+  g_network_service_remote = nullptr;
+  GetNetworkTaskRunnerStorage().reset();
 }
 
 NetworkServiceAvailability GetNetworkServiceAvailability() {
-  if (!g_network_service_ptr)
+  if (!g_network_service_remote)
     return NetworkServiceAvailability::NOT_CREATED;
-  else if (!g_network_service_ptr->is_bound())
+  else if (!g_network_service_remote->is_bound())
     return NetworkServiceAvailability::NOT_BOUND;
-  else if (g_network_service_ptr->encountered_error())
+  else if (!g_network_service_remote->is_connected())
     return NetworkServiceAvailability::ENCOUNTERED_ERROR;
   else if (!g_network_service_is_responding)
     return NetworkServiceAvailability::NOT_RESPONDING;
@@ -404,7 +489,7 @@ base::TimeDelta GetTimeSinceLastNetworkServiceCrash() {
 void PingNetworkService(base::OnceClosure closure) {
   GetNetworkService();
   // Unfortunately, QueryVersion requires a RepeatingCallback.
-  g_network_service_ptr->QueryVersion(base::BindRepeating(
+  g_network_service_remote->QueryVersion(base::BindRepeating(
       [](base::OnceClosure closure, uint32_t) {
         if (closure)
           std::move(closure).Run();
diff --git a/chromium/content/browser/network_service_instance_impl.h b/chromium/content/browser/network_service_instance_impl.h
index 6e2ea1def6e..ba346286d55 100644
--- a/chromium/content/browser/network_service_instance_impl.h
+++ b/chromium/content/browser/network_service_instance_impl.h
@@ -18,9 +18,10 @@ CONTENT_EXPORT void ForceCreateNetworkServiceDirectlyForTesting();
 // Resets the interface ptr to the network service.
 CONTENT_EXPORT void ResetNetworkServiceForTesting();
 
-// Registers |handler| to run (on UI thread) after NetworkServicePtr encounters
-// an error.  Note that there are no ordering guarantees wrt error handlers for
-// other interfaces (e.g. NetworkContextPtr and/or URLLoaderFactoryPtr).
+// Registers |handler| to run (on UI thread) after mojo::Remote<NetworkService>
+// encounters an error.  Note that there are no ordering guarantees wrt error
+// handlers for other interfaces (e.g. mojo::Remote<NetworkContext> and/or
+// URLLoaderFactoryPtr).
 //
 // Can only be called on the UI thread.  No-op if NetworkService is disabled.
 CONTENT_EXPORT std::unique_ptr<base::CallbackList<void()>::Subscription>
@@ -58,6 +59,10 @@ CONTENT_EXPORT void PingNetworkService(base::OnceClosure closure);
 CONTENT_EXPORT void AddNetworkServiceDebugEvent(const std::string& event);
 CONTENT_EXPORT std::string GetNetworkServiceDebugEventsString();
 
+// Shuts down the in-process network service or disconnects from the out-of-
+// process one, allowing it to shut down.
+CONTENT_EXPORT void ShutDownNetworkService();
+
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_NETWORK_SERVICE_INSTANCE_IMPL_H_
diff --git a/chromium/content/browser/network_service_restart_browsertest.cc b/chromium/content/browser/network_service_restart_browsertest.cc
index 33be4cb2645..15c6d94c37b 100644
--- a/chromium/content/browser/network_service_restart_browsertest.cc
+++ b/chromium/content/browser/network_service_restart_browsertest.cc
@@ -11,6 +11,7 @@
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_command_line.h"
 #include "base/test/scoped_environment_variable_override.h"
+#include "base/test/scoped_feature_list.h"
 #include "base/test/test_timeouts.h"
 #include "base/thread_annotations.h"
 #include "base/threading/thread_restrictions.h"
@@ -28,11 +29,9 @@
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/network_service_instance.h"
-#include "content/public/browser/system_connector.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
-#include "content/public/common/service_names.mojom.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -42,6 +41,8 @@
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_browser_context.h"
 #include "content/test/storage_partition_test_utils.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/sync_call_restrictions.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/http_request.h"
@@ -49,7 +50,7 @@
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/network_service_test.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
+#include "third_party/blink/public/common/features.h"
 
 #if BUILDFLAG(ENABLE_PLUGINS)
 #include "content/public/test/ppapi_test_utils.h"
@@ -62,12 +63,13 @@ namespace {
 using SharedURLLoaderFactoryGetterCallback =
     base::OnceCallback<scoped_refptr<network::SharedURLLoaderFactory>()>;
 
-network::mojom::NetworkContextPtr CreateNetworkContext() {
-  network::mojom::NetworkContextPtr network_context;
+mojo::PendingRemote<network::mojom::NetworkContext> CreateNetworkContext() {
+  mojo::PendingRemote<network::mojom::NetworkContext> network_context;
   network::mojom::NetworkContextParamsPtr context_params =
       network::mojom::NetworkContextParams::New();
-  GetNetworkService()->CreateNetworkContext(mojo::MakeRequest(&network_context),
-                                            std::move(context_params));
+  GetNetworkService()->CreateNetworkContext(
+      network_context.InitWithNewPipeAndPassReceiver(),
+      std::move(context_params));
   return network_context;
 }
 
@@ -125,30 +127,24 @@ void WaitForCondition(base::RepeatingCallback<bool()> condition) {
 
 class ServiceWorkerStatusObserver : public ServiceWorkerContextCoreObserver {
  public:
-  void WaitForState(EmbeddedWorkerStatus expected_status) {
-    for (const auto& status : statuses_in_past_) {
-      if (status == expected_status)
-        return;
-    }
+  void WaitForStopped() {
+    if (stopped_)
+      return;
 
-    expected_status_ = expected_status;
     base::RunLoop loop;
     callback_ = loop.QuitClosure();
     loop.Run();
   }
 
  private:
-  void OnRunningStateChanged(int64_t version_id,
-                             EmbeddedWorkerStatus running_status) override {
-    statuses_in_past_.push_back(running_status);
-    if (expected_status_.has_value() &&
-        running_status == expected_status_.value()) {
+  void OnStopped(int64_t version_id) override {
+    stopped_ = true;
+
+    if (callback_)
       std::move(callback_).Run();
-    }
   }
 
-  base::Optional<EmbeddedWorkerStatus> expected_status_;
-  std::vector<EmbeddedWorkerStatus> statuses_in_past_;
+  bool stopped_ = false;
   base::OnceClosure callback_;
 };
 
@@ -313,29 +309,31 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest,
                        NetworkServiceProcessRecovery) {
   if (IsInProcessNetworkService())
     return;
-  network::mojom::NetworkContextPtr network_context = CreateNetworkContext();
+  mojo::Remote<network::mojom::NetworkContext> network_context(
+      CreateNetworkContext());
   EXPECT_EQ(net::OK, LoadBasicRequest(network_context.get(), GetTestURL()));
   EXPECT_TRUE(network_context.is_bound());
-  EXPECT_FALSE(network_context.encountered_error());
+  EXPECT_TRUE(network_context.is_connected());
 
   // Crash the NetworkService process. Existing interfaces should receive error
   // notifications at some point.
   SimulateNetworkServiceCrash();
   // |network_context| will receive an error notification, but it's not
-  // guaranteed to have arrived at this point. Flush the pointer to make sure
+  // guaranteed to have arrived at this point. Flush the remote to make sure
   // the notification has been received.
   network_context.FlushForTesting();
   EXPECT_TRUE(network_context.is_bound());
-  EXPECT_TRUE(network_context.encountered_error());
+  EXPECT_FALSE(network_context.is_connected());
   // Make sure we could get |net::ERR_FAILED| with an invalid |network_context|.
   EXPECT_EQ(net::ERR_FAILED,
             LoadBasicRequest(network_context.get(), GetTestURL()));
 
   // NetworkService should restart automatically and return valid interface.
-  network::mojom::NetworkContextPtr network_context2 = CreateNetworkContext();
+  mojo::Remote<network::mojom::NetworkContext> network_context2(
+      CreateNetworkContext());
   EXPECT_EQ(net::OK, LoadBasicRequest(network_context2.get(), GetTestURL()));
   EXPECT_TRUE(network_context2.is_bound());
-  EXPECT_FALSE(network_context2.encountered_error());
+  EXPECT_TRUE(network_context2.is_connected());
 }
 
 void IncrementInt(int* i) {
@@ -347,7 +345,8 @@ void IncrementInt(int* i) {
 IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, CrashHandlers) {
   if (IsInProcessNetworkService())
     return;
-  network::mojom::NetworkContextPtr network_context = CreateNetworkContext();
+  mojo::Remote<network::mojom::NetworkContext> network_context(
+      CreateNetworkContext());
   EXPECT_TRUE(network_context.is_bound());
 
   // Register 2 crash handlers.
@@ -361,18 +360,19 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, CrashHandlers) {
   // Crash the NetworkService process.
   SimulateNetworkServiceCrash();
   // |network_context| will receive an error notification, but it's not
-  // guaranteed to have arrived at this point. Flush the pointer to make sure
+  // guaranteed to have arrived at this point. Flush the remote to make sure
   // the notification has been received.
   network_context.FlushForTesting();
   EXPECT_TRUE(network_context.is_bound());
-  EXPECT_TRUE(network_context.encountered_error());
+  EXPECT_FALSE(network_context.is_connected());
 
   // Verify the crash handlers executed.
   EXPECT_EQ(1, counter1);
   EXPECT_EQ(1, counter2);
 
   // Revive the NetworkService process.
-  network_context = CreateNetworkContext();
+  network_context.reset();
+  network_context.Bind(CreateNetworkContext());
   EXPECT_TRUE(network_context.is_bound());
 
   // Unregister one of the handlers.
@@ -381,11 +381,11 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, CrashHandlers) {
   // Crash the NetworkService process.
   SimulateNetworkServiceCrash();
   // |network_context| will receive an error notification, but it's not
-  // guaranteed to have arrived at this point. Flush the pointer to make sure
+  // guaranteed to have arrived at this point. Flush the remote to make sure
   // the notification has been received.
   network_context.FlushForTesting();
   EXPECT_TRUE(network_context.is_bound());
-  EXPECT_TRUE(network_context.encountered_error());
+  EXPECT_FALSE(network_context.is_connected());
 
   // Verify only the first crash handler executed.
   EXPECT_EQ(2, counter1);
@@ -665,8 +665,34 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, WindowOpenXHR) {
   EXPECT_EQ(last_request_relative_url(), "/title2.html");
 }
 
+// Run tests with PlzDedicatedWorker.
+// TODO(https://crbug.com/906991): Merge this test fixture into
+// NetworkServiceRestartBrowserTest once PlzDedicatedWorker is enabled by
+// default.
+class NetworkServiceRestartForWorkerBrowserTest
+    : public NetworkServiceRestartBrowserTest,
+      public ::testing::WithParamInterface<bool> {
+ public:
+  NetworkServiceRestartForWorkerBrowserTest() {
+    if (GetParam()) {
+      scoped_feature_list_.InitAndEnableFeature(
+          blink::features::kPlzDedicatedWorker);
+    } else {
+      scoped_feature_list_.InitAndDisableFeature(
+          blink::features::kPlzDedicatedWorker);
+    }
+  }
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+};
+
+INSTANTIATE_TEST_SUITE_P(,
+                         NetworkServiceRestartForWorkerBrowserTest,
+                         ::testing::Values(false, true));
+
 // Make sure worker fetch works after crash.
-IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, WorkerFetch) {
+IN_PROC_BROWSER_TEST_P(NetworkServiceRestartForWorkerBrowserTest, WorkerFetch) {
   if (IsInProcessNetworkService())
     return;
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
@@ -691,7 +717,8 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, WorkerFetch) {
 }
 
 // Make sure multiple workers are tracked correctly and work after crash.
-IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, MultipleWorkerFetch) {
+IN_PROC_BROWSER_TEST_P(NetworkServiceRestartForWorkerBrowserTest,
+                       MultipleWorkerFetch) {
   if (IsInProcessNetworkService())
     return;
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
@@ -766,7 +793,7 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest,
   partition->FlushNetworkInterfaceForTesting();
 
   // Service worker should be stopped when network service crashes.
-  observer.WaitForState(EmbeddedWorkerStatus::STOPPED);
+  observer.WaitForStopped();
 
   // Fetch from the controlled page again.
   EXPECT_EQ("Echo", EvalJs(shell(), script));
@@ -809,7 +836,7 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest,
   partition->FlushNetworkInterfaceForTesting();
 
   // Service worker should be stopped when network service crashes.
-  observer.WaitForState(EmbeddedWorkerStatus::STOPPED);
+  observer.WaitForStopped();
 
   // Fetch from the controlled page again.
   EXPECT_EQ("Echo", EvalJs(shell(), script));
@@ -853,7 +880,7 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest,
   partition->FlushNetworkInterfaceForTesting();
 
   // Service worker should be stopped when network service crashes.
-  observer.WaitForState(EmbeddedWorkerStatus::STOPPED);
+  observer.WaitForStopped();
 
   // Fetch from the controlled page again.
   EXPECT_EQ("Echo", EvalJs(shell(), script));
@@ -892,7 +919,7 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest, ServiceWorkerFetch) {
   partition->FlushNetworkInterfaceForTesting();
 
   // Service worker should be stopped when network service crashes.
-  observer.WaitForState(EmbeddedWorkerStatus::STOPPED);
+  observer.WaitForStopped();
 
   // Fetch from the service worker again.
   EXPECT_EQ("Echo", EvalJs(shell(), script));
@@ -1172,18 +1199,19 @@ IN_PROC_BROWSER_TEST_F(NetworkServiceRestartBrowserTest,
                        MAYBE_SyncCallDuringRestart) {
   if (IsInProcessNetworkService())
     return;
-  network::mojom::NetworkServiceTestPtr network_service_test;
   base::RunLoop run_loop;
-  GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                      &network_service_test);
+  mojo::Remote<network::mojom::NetworkServiceTest> network_service_test;
+  content::GetNetworkService()->BindTestInterface(
+      network_service_test.BindNewPipeAndPassReceiver());
 
   // Crash the network service, but do not wait for full startup.
-  network_service_test.set_connection_error_handler(run_loop.QuitClosure());
+  network_service_test.set_disconnect_handler(run_loop.QuitClosure());
   network_service_test->SimulateCrash();
   run_loop.Run();
 
-  GetSystemConnector()->BindInterface(mojom::kNetworkServiceName,
-                                      &network_service_test);
+  network_service_test.reset();
+  content::GetNetworkService()->BindTestInterface(
+      network_service_test.BindNewPipeAndPassReceiver());
 
   // Sync call should be fine, even though network process is still starting up.
   mojo::ScopedAllowSyncCallForTesting allow_sync_call;
diff --git a/chromium/content/browser/notifications/blink_notification_service_impl_unittest.cc b/chromium/content/browser/notifications/blink_notification_service_impl_unittest.cc
index ce997528ce2..b0c806c9ad0 100644
--- a/chromium/content/browser/notifications/blink_notification_service_impl_unittest.cc
+++ b/chromium/content/browser/notifications/blink_notification_service_impl_unittest.cc
@@ -24,6 +24,7 @@
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/public/browser/permission_type.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/mock_permission_manager.h"
diff --git a/chromium/content/browser/notifications/devtools_event_logging.cc b/chromium/content/browser/notifications/devtools_event_logging.cc
index 0dacfeb5974..1e04df75ea5 100644
--- a/chromium/content/browser/notifications/devtools_event_logging.cc
+++ b/chromium/content/browser/notifications/devtools_event_logging.cc
@@ -7,6 +7,7 @@
 #include "base/callback.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/time/time_to_iso8601.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/devtools_background_services_context.h"
 #include "content/public/browser/notification_database_data.h"
@@ -115,8 +116,7 @@ void LogNotificationScheduledEventToDevTools(
 
   std::move(callback).Run(
       /* event_name= */ "Notification scheduled",
-      {{"Show Trigger Timestamp",
-        base::NumberToString(show_trigger_timestamp.ToJsTime())},
+      {{"Show Trigger Timestamp", base::TimeToISO8601(show_trigger_timestamp)},
        {"Title", base::UTF16ToUTF8(data.notification_data.title)},
        {"Body", base::UTF16ToUTF8(data.notification_data.body)}});
 }
diff --git a/chromium/content/browser/notifications/notification_database_conversions.cc b/chromium/content/browser/notifications/notification_database_conversions.cc
index e53145547a2..ab336f370af 100644
--- a/chromium/content/browser/notifications/notification_database_conversions.cc
+++ b/chromium/content/browser/notifications/notification_database_conversions.cc
@@ -17,6 +17,7 @@
 #include "content/browser/notifications/notification_database_resources.pb.h"
 #include "content/public/browser/notification_database_data.h"
 #include "third_party/blink/public/common/notifications/notification_resources.h"
+#include "third_party/blink/public/mojom/notifications/notification.mojom.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/gfx/codec/png_codec.h"
 
diff --git a/chromium/content/browser/notifications/notification_database_conversions_unittest.cc b/chromium/content/browser/notifications/notification_database_conversions_unittest.cc
index fbd1bb422ad..dda490bfa1d 100644
--- a/chromium/content/browser/notifications/notification_database_conversions_unittest.cc
+++ b/chromium/content/browser/notifications/notification_database_conversions_unittest.cc
@@ -17,8 +17,9 @@
 #include "content/public/browser/notification_database_data.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/notifications/notification_constants.h"
 #include "third_party/blink/public/common/notifications/notification_resources.h"
-#include "third_party/blink/public/platform/modules/notifications/web_notification_constants.h"
+#include "third_party/blink/public/mojom/notifications/notification.mojom.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 
 namespace content {
@@ -88,7 +89,7 @@ TEST(NotificationDatabaseConversionsTest, SerializeAndDeserializeData) {
   notification_data.show_trigger_timestamp =
       base::Time::FromJsTime(kShowTriggerTimestamp);
   notification_data.data = developer_data;
-  for (size_t i = 0; i < blink::kWebNotificationMaxActions; i++) {
+  for (size_t i = 0; i < blink::kNotificationMaxActions; i++) {
     blink::PlatformNotificationAction notification_action;
     notification_action.type = kNotificationActionType;
     notification_action.action = base::NumberToString(i);
@@ -195,7 +196,7 @@ TEST(NotificationDatabaseConversionsTest, SerializeAndDeserializeData) {
 TEST(NotificationDatabaseConversionsTest, ActionDeserializationIsNotAdditive) {
   NotificationDatabaseData database_data;
 
-  for (size_t i = 0; i < blink::kWebNotificationMaxActions; ++i)
+  for (size_t i = 0; i < blink::kNotificationMaxActions; ++i)
     database_data.notification_data.actions.emplace_back();
 
   std::string serialized_data;
@@ -209,7 +210,7 @@ TEST(NotificationDatabaseConversionsTest, ActionDeserializationIsNotAdditive) {
                                                   &copied_database_data));
 
   EXPECT_EQ(copied_database_data.notification_data.actions.size(),
-            blink::kWebNotificationMaxActions);
+            blink::kNotificationMaxActions);
 
   // Deserialize it again in the same |copied_database_data|. The number of
   // actions in the structure should not be affected.
@@ -217,7 +218,7 @@ TEST(NotificationDatabaseConversionsTest, ActionDeserializationIsNotAdditive) {
                                                   &copied_database_data));
 
   EXPECT_EQ(copied_database_data.notification_data.actions.size(),
-            blink::kWebNotificationMaxActions);
+            blink::kNotificationMaxActions);
 }
 
 TEST(NotificationDatabaseConversionsTest, SerializeAndDeserializeActionTypes) {
diff --git a/chromium/content/browser/notifications/notification_database_unittest.cc b/chromium/content/browser/notifications/notification_database_unittest.cc
index 494987205df..1868c8563ab 100644
--- a/chromium/content/browser/notifications/notification_database_unittest.cc
+++ b/chromium/content/browser/notifications/notification_database_unittest.cc
@@ -17,6 +17,7 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/notifications/notification_resources.h"
 #include "third_party/blink/public/common/notifications/platform_notification_data.h"
+#include "third_party/blink/public/mojom/notifications/notification.mojom.h"
 #include "third_party/leveldatabase/src/include/leveldb/db.h"
 #include "third_party/leveldatabase/src/include/leveldb/write_batch.h"
 #include "url/gurl.h"
diff --git a/chromium/content/browser/notifications/platform_notification_context_impl.cc b/chromium/content/browser/notifications/platform_notification_context_impl.cc
index 93ae69a720d..9ada5345a00 100644
--- a/chromium/content/browser/notifications/platform_notification_context_impl.cc
+++ b/chromium/content/browser/notifications/platform_notification_context_impl.cc
@@ -26,6 +26,7 @@
 #include "content/public/browser/permission_controller.h"
 #include "content/public/browser/permission_type.h"
 #include "content/public/browser/platform_notification_service.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "third_party/blink/public/common/notifications/notification_resources.h"
 
@@ -438,6 +439,11 @@ void PlatformNotificationContextImpl::DoTriggerNotification(
     return;
   }
 
+  base::Time timestamp =
+      database_data.notification_data.show_trigger_timestamp.value();
+  UMA_HISTOGRAM_LONG_TIMES("Notifications.Triggers.DisplayDelay",
+                           base::Time::Now() - timestamp);
+
   // Remove resources from DB as we don't need them anymore.
   database_->DeleteNotificationResources(write_database_data.notification_id,
                                          write_database_data.origin);
diff --git a/chromium/content/browser/notifications/platform_notification_context_trigger_unittest.cc b/chromium/content/browser/notifications/platform_notification_context_trigger_unittest.cc
index 403973d1d88..1ea7a31cac7 100644
--- a/chromium/content/browser/notifications/platform_notification_context_trigger_unittest.cc
+++ b/chromium/content/browser/notifications/platform_notification_context_trigger_unittest.cc
@@ -7,12 +7,14 @@
 #include "base/bind.h"
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
+#include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/time/time.h"
 #include "content/browser/notifications/notification_trigger_constants.h"
 #include "content/browser/notifications/platform_notification_context_impl.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/public/browser/notification_database_data.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
@@ -277,4 +279,22 @@ TEST_F(PlatformNotificationContextTriggerTest, EnforcesLimitOnUpdate) {
           TimeDelta::FromSeconds(kMaximumScheduledNotificationsPerOrigin + 1)));
 }
 
+TEST_F(PlatformNotificationContextTriggerTest, RecordDisplayDelay) {
+  base::HistogramTester histogram_tester;
+  base::TimeDelta trigger_delay = TimeDelta::FromSeconds(10);
+  base::TimeDelta display_delay = TimeDelta::FromSeconds(8);
+
+  WriteNotificationData("1", Time::Now() + trigger_delay);
+  ASSERT_EQ(0u, GetDisplayedNotifications().size());
+
+  // Forward time until after the expected trigger time.
+  task_environment_.FastForwardBy(trigger_delay + display_delay);
+
+  // Trigger notification |display_delay| after it should have been displayed.
+  TriggerNotifications();
+
+  histogram_tester.ExpectUniqueSample("Notifications.Triggers.DisplayDelay",
+                                      display_delay.InMilliseconds(), 1);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/notifications/platform_notification_context_unittest.cc b/chromium/content/browser/notifications/platform_notification_context_unittest.cc
index 6f3f6f99551..410b5896b0b 100644
--- a/chromium/content/browser/notifications/platform_notification_context_unittest.cc
+++ b/chromium/content/browser/notifications/platform_notification_context_unittest.cc
@@ -17,6 +17,7 @@
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/public/browser/notification_database_data.h"
 #include "content/public/browser/permission_type.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/mock_permission_manager.h"
diff --git a/chromium/content/browser/notifications/platform_notification_service_proxy.cc b/chromium/content/browser/notifications/platform_notification_service_proxy.cc
index c91adb0cb36..2e534dbdf11 100644
--- a/chromium/content/browser/notifications/platform_notification_service_proxy.cc
+++ b/chromium/content/browser/notifications/platform_notification_service_proxy.cc
@@ -15,6 +15,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/notification_database_data.h"
 #include "content/public/browser/platform_notification_service.h"
+#include "content/public/common/content_client.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/origin_trials/origin_trials_browsertest.cc b/chromium/content/browser/origin_trials/origin_trials_browsertest.cc
index df382c0d463..c618de3f47a 100644
--- a/chromium/content/browser/origin_trials/origin_trials_browsertest.cc
+++ b/chromium/content/browser/origin_trials/origin_trials_browsertest.cc
@@ -71,7 +71,7 @@ class OriginTrialsBrowserTest : public content::ContentBrowserTest {
 };
 
 IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest, Basic) {
-  NavigateToURL(shell(), GURL("https://example.test/basic.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("https://example.test/basic.html")));
   // Ensure we can invoke normalMethod(), which is only available when the
   // Frobulate OT is enabled.
   EXPECT_TRUE(content::ExecJs(shell()->web_contents()->GetMainFrame(),
@@ -80,7 +80,7 @@ IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest, Basic) {
 
 IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest,
                        NonNavigationTrialNotActivatedAcrossNavigations) {
-  NavigateToURL(shell(), GURL("https://example.test/basic.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("https://example.test/basic.html")));
   EXPECT_TRUE(content::ExecJs(shell()->web_contents()->GetMainFrame(),
                               "internals.originTrialsTest().normalMethod();"));
   NavigateViaRenderer(shell()->web_contents(),
@@ -92,7 +92,8 @@ IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest, Navigation) {
-  NavigateToURL(shell(), GURL("https://example.test/navigation.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GURL("https://example.test/navigation.html")));
   // Ensure we can invoke navigationMethod(), which is only available when the
   // FrobulateNavigation OT is enabled.
   EXPECT_TRUE(
@@ -102,7 +103,8 @@ IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest, Navigation) {
 
 IN_PROC_BROWSER_TEST_F(OriginTrialsBrowserTest,
                        NavigationTrialActivatedAcrossNavigations) {
-  NavigateToURL(shell(), GURL("https://example.test/navigation.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GURL("https://example.test/navigation.html")));
   EXPECT_TRUE(
       content::ExecJs(shell()->web_contents()->GetMainFrame(),
                       "internals.originTrialsTest().navigationMethod();"));
diff --git a/chromium/content/browser/payments/payment_app.proto b/chromium/content/browser/payments/payment_app.proto
index 35848b1d5da..71f3144c93e 100644
--- a/chromium/content/browser/payments/payment_app.proto
+++ b/chromium/content/browser/payments/payment_app.proto
@@ -41,6 +41,13 @@ message StoredRelatedApplicationProto {
   optional string id = 2;
 }
 
+message SupportedDelegationsProto {
+  optional bool shipping_address = 1;
+  optional bool payer_name = 2;
+  optional bool payer_phone = 3;
+  optional bool payer_email = 4;
+}
+
 message StoredPaymentAppProto {
   optional int64 registration_id = 1;
   optional string scope = 2;
@@ -49,4 +56,5 @@ message StoredPaymentAppProto {
   optional bool prefer_related_applications = 5;
   repeated StoredRelatedApplicationProto related_applications = 6;
   optional string user_hint = 7;
+  optional SupportedDelegationsProto supported_delegations = 8;
 }
diff --git a/chromium/content/browser/payments/payment_app_content_unittest_base.cc b/chromium/content/browser/payments/payment_app_content_unittest_base.cc
index d0df2e50688..8ddbdce61d5 100644
--- a/chromium/content/browser/payments/payment_app_content_unittest_base.cc
+++ b/chromium/content/browser/payments/payment_app_content_unittest_base.cc
@@ -25,6 +25,7 @@
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -221,8 +222,8 @@ PaymentManager* PaymentAppContentUnitTestBase::CreatePaymentManager(
 
   // Create a new payment manager.
   mojo::Remote<payments::mojom::PaymentManager> manager;
-  payment_app_context()->CreatePaymentManager(
-      manager.BindNewPipeAndPassReceiver());
+  payment_app_context()->CreatePaymentManagerForOrigin(
+      url::Origin::Create(scope_url), manager.BindNewPipeAndPassReceiver());
   payment_managers_.push_back(std::move(manager));
   base::RunLoop().RunUntilIdle();
 
diff --git a/chromium/content/browser/payments/payment_app_context_impl.cc b/chromium/content/browser/payments/payment_app_context_impl.cc
index c67b2416b74..59ee6153b6c 100644
--- a/chromium/content/browser/payments/payment_app_context_impl.cc
+++ b/chromium/content/browser/payments/payment_app_context_impl.cc
@@ -44,14 +44,16 @@ void PaymentAppContextImpl::Shutdown() {
       base::BindOnce(&PaymentAppContextImpl::ShutdownOnCoreThread, this));
 }
 
-void PaymentAppContextImpl::CreatePaymentManager(
+void PaymentAppContextImpl::CreatePaymentManagerForOrigin(
+    const url::Origin& origin,
     mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   RunOrPostTaskOnThread(
       FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
-      base::BindOnce(&PaymentAppContextImpl::CreatePaymentManagerOnCoreThread,
-                     this, std::move(receiver)));
+      base::BindOnce(
+          &PaymentAppContextImpl::CreatePaymentManagerForOriginOnCoreThread,
+          this, origin, std::move(receiver)));
 }
 
 void PaymentAppContextImpl::PaymentManagerHadConnectionError(
@@ -81,11 +83,12 @@ void PaymentAppContextImpl::CreatePaymentAppDatabaseOnCoreThread(
       std::make_unique<PaymentAppDatabase>(service_worker_context);
 }
 
-void PaymentAppContextImpl::CreatePaymentManagerOnCoreThread(
+void PaymentAppContextImpl::CreatePaymentManagerForOriginOnCoreThread(
+    const url::Origin& origin,
     mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   auto payment_manager =
-      std::make_unique<PaymentManager>(this, std::move(receiver));
+      std::make_unique<PaymentManager>(this, origin, std::move(receiver));
   payment_managers_[payment_manager.get()] = std::move(payment_manager);
 }
 
diff --git a/chromium/content/browser/payments/payment_app_context_impl.h b/chromium/content/browser/payments/payment_app_context_impl.h
index 239c083603f..a8940a5e8ed 100644
--- a/chromium/content/browser/payments/payment_app_context_impl.h
+++ b/chromium/content/browser/payments/payment_app_context_impl.h
@@ -40,7 +40,7 @@ class ServiceWorkerContextWrapper;
 //   1) Constructor
 //   2) Init()
 //   3) Can now call other public methods in this class in any order.
-//     - Can call CreatePaymentManager() on UI thread.
+//     - Can call CreatePaymentManagerForOrigin() on UI thread.
 //     - Can call GetAllPaymentApps() on UI thread.
 //     - Can call PaymentManagerHadConnectionError() on core thread.
 //     - Can call payment_app_database() on the core thread.
@@ -60,9 +60,9 @@ class CONTENT_EXPORT PaymentAppContextImpl
   // Shutdown must be called before deleting this. Call on the UI thread.
   void Shutdown();
 
-  // Create a PaymentManager that is owned by this. Call on the UI
-  // thread.
-  void CreatePaymentManager(
+  // Create a PaymentManager that is owned by this. Call on the UI thread.
+  void CreatePaymentManagerForOrigin(
+      const url::Origin& origin,
       mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
 
   // Called by PaymentManager objects so that they can
@@ -82,7 +82,8 @@ class CONTENT_EXPORT PaymentAppContextImpl
   void CreatePaymentAppDatabaseOnCoreThread(
       scoped_refptr<ServiceWorkerContextWrapper> service_worker_context);
 
-  void CreatePaymentManagerOnCoreThread(
+  void CreatePaymentManagerForOriginOnCoreThread(
+      const url::Origin& origin,
       mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
 
   void ShutdownOnCoreThread();
diff --git a/chromium/content/browser/payments/payment_app_database.cc b/chromium/content/browser/payments/payment_app_database.cc
index 29765ac105b..376f1b3b410 100644
--- a/chromium/content/browser/payments/payment_app_database.cc
+++ b/chromium/content/browser/payments/payment_app_database.cc
@@ -26,6 +26,7 @@
 namespace content {
 namespace {
 
+using ::payments::mojom::PaymentDelegation;
 using ::payments::mojom::PaymentHandlerStatus;
 using ::payments::mojom::PaymentInstrument;
 using ::payments::mojom::PaymentInstrumentPtr;
@@ -86,6 +87,28 @@ PaymentInstrumentPtr ToPaymentInstrumentForMojo(const std::string& input) {
   return instrument;
 }
 
+SupportedDelegations ToSupportedDelegations(
+    const content::SupportedDelegationsProto& supported_delegations_proto) {
+  SupportedDelegations supported_delegations;
+  if (supported_delegations_proto.has_shipping_address()) {
+    supported_delegations.shipping_address =
+        supported_delegations_proto.shipping_address();
+  }
+  if (supported_delegations_proto.has_payer_name()) {
+    supported_delegations.payer_name = supported_delegations_proto.payer_name();
+  }
+  if (supported_delegations_proto.has_payer_email()) {
+    supported_delegations.payer_email =
+        supported_delegations_proto.payer_email();
+  }
+  if (supported_delegations_proto.has_payer_phone()) {
+    supported_delegations.payer_phone =
+        supported_delegations_proto.payer_phone();
+  }
+
+  return supported_delegations;
+}
+
 std::unique_ptr<StoredPaymentApp> ToStoredPaymentApp(const std::string& input) {
   StoredPaymentAppProto app_proto;
   if (!app_proto.ParseFromString(input))
@@ -102,6 +125,8 @@ std::unique_ptr<StoredPaymentApp> ToStoredPaymentApp(const std::string& input) {
     app->related_applications.back().id = related_app.id();
   }
   app->user_hint = app_proto.user_hint();
+  app->supported_delegations =
+      ToSupportedDelegations(app_proto.supported_delegations());
 
   if (!app_proto.icon().empty()) {
     std::string icon_raw_data;
@@ -368,6 +393,99 @@ void PaymentAppDatabase::SetPaymentAppUserHint(const GURL& scope,
           weak_ptr_factory_.GetWeakPtr(), user_hint));
 }
 
+void PaymentAppDatabase::EnablePaymentAppDelegations(
+    const GURL& scope,
+    const std::vector<PaymentDelegation>& delegations,
+    EnableDelegationsCallback callback) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+
+  service_worker_context_->FindReadyRegistrationForScope(
+      scope,
+      base::BindOnce(
+          &PaymentAppDatabase::DidFindRegistrationToEnablePaymentAppDelegations,
+          weak_ptr_factory_.GetWeakPtr(), delegations, std::move(callback)));
+}
+
+void PaymentAppDatabase::DidFindRegistrationToEnablePaymentAppDelegations(
+    const std::vector<PaymentDelegation>& delegations,
+    EnableDelegationsCallback callback,
+    blink::ServiceWorkerStatusCode status,
+    scoped_refptr<ServiceWorkerRegistration> registration) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  if (status != blink::ServiceWorkerStatusCode::kOk) {
+    std::move(callback).Run(PaymentHandlerStatus::NO_ACTIVE_WORKER);
+    return;
+  }
+
+  service_worker_context_->GetRegistrationUserDataByKeyPrefix(
+      registration->id(), CreatePaymentAppKey(registration->scope().spec()),
+      base::BindOnce(
+          &PaymentAppDatabase::DidGetPaymentAppInfoToEnableDelegations,
+          weak_ptr_factory_.GetWeakPtr(), delegations, std::move(callback),
+          registration->id(), registration->scope()));
+}
+
+void PaymentAppDatabase::DidGetPaymentAppInfoToEnableDelegations(
+    const std::vector<PaymentDelegation>& delegations,
+    EnableDelegationsCallback callback,
+    int64_t registration_id,
+    const GURL& pattern,
+    const std::vector<std::string>& data,
+    blink::ServiceWorkerStatusCode status) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  if (status != blink::ServiceWorkerStatusCode::kOk) {
+    std::move(callback).Run(PaymentHandlerStatus::NOT_FOUND);
+    return;
+  }
+
+  DCHECK_LE(data.size(), 1U);
+  StoredPaymentAppProto app_proto;
+  if (data.size() == 1U) {
+    app_proto.ParseFromString(data[0]);
+  }
+
+  auto supported_delegations_proto =
+      std::make_unique<SupportedDelegationsProto>();
+  for (auto delegation : delegations) {
+    switch (delegation) {
+      case PaymentDelegation::SHIPPING_ADDRESS:
+        supported_delegations_proto->set_shipping_address(true);
+        break;
+      case PaymentDelegation::PAYER_NAME:
+        supported_delegations_proto->set_payer_name(true);
+        break;
+      case PaymentDelegation::PAYER_PHONE:
+        supported_delegations_proto->set_payer_phone(true);
+        break;
+      case PaymentDelegation::PAYER_EMAIL:
+        supported_delegations_proto->set_payer_email(true);
+        break;
+    }
+  }
+  app_proto.set_allocated_supported_delegations(
+      supported_delegations_proto.release());
+
+  std::string serialized_payment_app;
+  bool success = app_proto.SerializeToString(&serialized_payment_app);
+  DCHECK(success);
+
+  service_worker_context_->StoreRegistrationUserData(
+      registration_id, pattern.GetOrigin(),
+      {{CreatePaymentAppKey(pattern.spec()), serialized_payment_app}},
+      base::BindOnce(&PaymentAppDatabase::DidEnablePaymentAppDelegations,
+                     weak_ptr_factory_.GetWeakPtr(), std::move(callback)));
+}
+
+void PaymentAppDatabase::DidEnablePaymentAppDelegations(
+    EnableDelegationsCallback callback,
+    blink::ServiceWorkerStatusCode status) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  return std::move(callback).Run(
+      status == blink::ServiceWorkerStatusCode::kOk
+          ? PaymentHandlerStatus::SUCCESS
+          : PaymentHandlerStatus::STORAGE_OPERATION_FAILED);
+}
+
 void PaymentAppDatabase::DidFindRegistrationToSetPaymentAppUserHint(
     const std::string& user_hint,
     blink::ServiceWorkerStatusCode status,
@@ -423,6 +541,7 @@ void PaymentAppDatabase::SetPaymentAppInfoForRegisteredServiceWorker(
     const std::string& name,
     const std::string& icon,
     const std::string& method,
+    const SupportedDelegations& supported_delegations,
     SetPaymentAppInfoCallback callback) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
@@ -430,7 +549,7 @@ void PaymentAppDatabase::SetPaymentAppInfoForRegisteredServiceWorker(
       registration_id,
       base::BindOnce(&PaymentAppDatabase::DidFindRegistrationToSetPaymentApp,
                      weak_ptr_factory_.GetWeakPtr(), instrument_key, name, icon,
-                     method, std::move(callback)));
+                     method, supported_delegations, std::move(callback)));
 }
 
 void PaymentAppDatabase::DidFindRegistrationToSetPaymentApp(
@@ -438,6 +557,7 @@ void PaymentAppDatabase::DidFindRegistrationToSetPaymentApp(
     const std::string& name,
     const std::string& icon,
     const std::string& method,
+    const SupportedDelegations& supported_delegations,
     SetPaymentAppInfoCallback callback,
     blink::ServiceWorkerStatusCode status,
     scoped_refptr<ServiceWorkerRegistration> registration) {
@@ -454,6 +574,19 @@ void PaymentAppDatabase::DidFindRegistrationToSetPaymentApp(
   payment_app_proto.set_name(name);
   payment_app_proto.set_icon(icon);
 
+  // Set supported delegations.
+  auto supported_delegations_proto =
+      std::make_unique<SupportedDelegationsProto>();
+  supported_delegations_proto->set_shipping_address(
+      supported_delegations.shipping_address);
+  supported_delegations_proto->set_payer_name(supported_delegations.payer_name);
+  supported_delegations_proto->set_payer_phone(
+      supported_delegations.payer_phone);
+  supported_delegations_proto->set_payer_email(
+      supported_delegations.payer_email);
+  payment_app_proto.set_allocated_supported_delegations(
+      supported_delegations_proto.release());
+
   std::string serialized_payment_app;
   bool success = payment_app_proto.SerializeToString(&serialized_payment_app);
   DCHECK(success);
diff --git a/chromium/content/browser/payments/payment_app_database.h b/chromium/content/browser/payments/payment_app_database.h
index 9c1cbb47439..92ef8f871e1 100644
--- a/chromium/content/browser/payments/payment_app_database.h
+++ b/chromium/content/browser/payments/payment_app_database.h
@@ -48,6 +48,8 @@ class CONTENT_EXPORT PaymentAppDatabase {
       base::OnceCallback<void(payments::mojom::PaymentHandlerStatus)>;
   using SetPaymentAppInfoCallback =
       base::OnceCallback<void(payments::mojom::PaymentHandlerStatus)>;
+  using EnableDelegationsCallback =
+      base::OnceCallback<void(payments::mojom::PaymentHandlerStatus)>;
 
   explicit PaymentAppDatabase(
       scoped_refptr<ServiceWorkerContextWrapper> service_worker_context);
@@ -77,12 +79,17 @@ class CONTENT_EXPORT PaymentAppDatabase {
   void ClearPaymentInstruments(const GURL& scope,
                                ClearPaymentInstrumentsCallback callback);
   void SetPaymentAppUserHint(const GURL& scope, const std::string& user_hint);
+  void EnablePaymentAppDelegations(
+      const GURL& scope,
+      const std::vector<payments::mojom::PaymentDelegation>& delegations,
+      EnableDelegationsCallback callback);
   void SetPaymentAppInfoForRegisteredServiceWorker(
       int64_t registration_id,
       const std::string& instrument_key,
       const std::string& name,
       const std::string& icon,
       const std::string& method,
+      const SupportedDelegations& supported_delegations,
       SetPaymentAppInfoCallback callback);
 
  private:
@@ -205,12 +212,29 @@ class CONTENT_EXPORT PaymentAppDatabase {
                                          blink::ServiceWorkerStatusCode status);
   void DidSetPaymentAppUserHint(blink::ServiceWorkerStatusCode status);
 
+  // EnablePaymentAppDelegations callbacks.
+  void DidFindRegistrationToEnablePaymentAppDelegations(
+      const std::vector<payments::mojom::PaymentDelegation>& delegations,
+      EnableDelegationsCallback callback,
+      blink::ServiceWorkerStatusCode status,
+      scoped_refptr<ServiceWorkerRegistration> registration);
+  void DidGetPaymentAppInfoToEnableDelegations(
+      const std::vector<payments::mojom::PaymentDelegation>& delegations,
+      EnableDelegationsCallback callback,
+      int64_t registration_id,
+      const GURL& pattern,
+      const std::vector<std::string>& data,
+      blink::ServiceWorkerStatusCode status);
+  void DidEnablePaymentAppDelegations(EnableDelegationsCallback callback,
+                                      blink::ServiceWorkerStatusCode status);
+
   // SetPaymentAppInfoForRegisteredServiceWorker callbacks.
   void DidFindRegistrationToSetPaymentApp(
       const std::string& instrument_key,
       const std::string& name,
       const std::string& icon,
       const std::string& method,
+      const SupportedDelegations& supported_delegations,
       SetPaymentAppInfoCallback callback,
       blink::ServiceWorkerStatusCode status,
       scoped_refptr<ServiceWorkerRegistration> registration);
diff --git a/chromium/content/browser/payments/payment_app_installer.cc b/chromium/content/browser/payments/payment_app_installer.cc
index 2cbc1013c56..7d5827eb9c9 100644
--- a/chromium/content/browser/payments/payment_app_installer.cc
+++ b/chromium/content/browser/payments/payment_app_installer.cc
@@ -35,12 +35,14 @@ class SelfDeleteInstaller
                       const GURL& sw_url,
                       const GURL& scope,
                       const std::string& method,
+                      const SupportedDelegations& supported_delegations,
                       PaymentAppInstaller::InstallPaymentAppCallback callback)
       : app_name_(app_name),
         app_icon_(app_icon),
         sw_url_(sw_url),
         scope_(scope),
         method_(method),
+        supported_delegations_(supported_delegations),
         callback_(std::move(callback)) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
   }
@@ -142,7 +144,8 @@ class SelfDeleteInstaller
         FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
         base::BindOnce(&SelfDeleteInstaller::SetPaymentAppInfoOnCoreThread,
                        this, payment_app_context, registration_id_,
-                       scope_.spec(), app_name_, app_icon_, method_));
+                       scope_.spec(), app_name_, app_icon_, method_,
+                       supported_delegations_));
   }
 
   void SetPaymentAppInfoOnCoreThread(
@@ -151,12 +154,14 @@ class SelfDeleteInstaller
       const std::string& instrument_key,
       const std::string& name,
       const std::string& app_icon,
-      const std::string& method) {
+      const std::string& method,
+      const SupportedDelegations& supported_delegations) {
     DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
     payment_app_context->payment_app_database()
         ->SetPaymentAppInfoForRegisteredServiceWorker(
             registration_id, instrument_key, name, app_icon, method,
+            supported_delegations,
             base::BindOnce(&SelfDeleteInstaller::OnSetPaymentAppInfo, this));
   }
 
@@ -199,6 +204,7 @@ class SelfDeleteInstaller
   GURL sw_url_;
   GURL scope_;
   std::string method_;
+  SupportedDelegations supported_delegations_;
   PaymentAppInstaller::InstallPaymentAppCallback callback_;
 
   int64_t registration_id_ = -1;  // Take -1 as an invalid registration Id.
@@ -210,18 +216,21 @@ class SelfDeleteInstaller
 }  // namespace.
 
 // Static
-void PaymentAppInstaller::Install(WebContents* web_contents,
-                                  const std::string& app_name,
-                                  const std::string& app_icon,
-                                  const GURL& sw_url,
-                                  const GURL& scope,
-                                  bool use_cache,
-                                  const std::string& method,
-                                  InstallPaymentAppCallback callback) {
+void PaymentAppInstaller::Install(
+    WebContents* web_contents,
+    const std::string& app_name,
+    const std::string& app_icon,
+    const GURL& sw_url,
+    const GURL& scope,
+    bool use_cache,
+    const std::string& method,
+    const SupportedDelegations& supported_delegations,
+    InstallPaymentAppCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   auto installer = base::MakeRefCounted<SelfDeleteInstaller>(
-      app_name, app_icon, sw_url, scope, method, std::move(callback));
+      app_name, app_icon, sw_url, scope, method, supported_delegations,
+      std::move(callback));
   installer->Init(web_contents, use_cache);
 }
 
diff --git a/chromium/content/browser/payments/payment_app_installer.h b/chromium/content/browser/payments/payment_app_installer.h
index 6522799aae6..bdba077fcb5 100644
--- a/chromium/content/browser/payments/payment_app_installer.h
+++ b/chromium/content/browser/payments/payment_app_installer.h
@@ -10,6 +10,7 @@
 
 #include "base/callback.h"
 #include "base/macros.h"
+#include "content/public/browser/supported_delegations.h"
 
 class GURL;
 
@@ -33,6 +34,7 @@ class PaymentAppInstaller {
   // |scope| is the registration scope.
   // |use_cache| indicates whether to use cache.
   // |enabled_methods| are the enabled methods of the app.
+  // |supported_delegations| are the supported delegations of the payment app.
   // |callback| to send back registration result.
   static void Install(WebContents* web_contents,
                       const std::string& app_name,
@@ -41,6 +43,7 @@ class PaymentAppInstaller {
                       const GURL& scope,
                       bool use_cache,
                       const std::string& method,
+                      const SupportedDelegations& supported_delegations,
                       InstallPaymentAppCallback callback);
 
  private:
diff --git a/chromium/content/browser/payments/payment_app_provider_impl.cc b/chromium/content/browser/payments/payment_app_provider_impl.cc
index 9a84066912f..3b813cb22c1 100644
--- a/chromium/content/browser/payments/payment_app_provider_impl.cc
+++ b/chromium/content/browser/payments/payment_app_provider_impl.cc
@@ -47,6 +47,15 @@ using ServiceWorkerStartCallback =
     base::OnceCallback<void(scoped_refptr<ServiceWorkerVersion>,
                             blink::ServiceWorkerStatusCode)>;
 
+payments::mojom::PaymentHandlerResponsePtr CreateBlankPaymentHandlerResponse(
+    PaymentEventResponseType response_type) {
+  return payments::mojom::PaymentHandlerResponse::New(
+      "" /*=method_name*/, "" /*=stringified_details*/, response_type,
+      base::nullopt /*=payer_name*/, base::nullopt /*=payer_email*/,
+      base::nullopt /*=payer_phone*/, nullptr /*=shipping_address*/,
+      base::nullopt /*=shipping_option*/);
+}
+
 class RespondWithCallbacks;
 
 // A repository to store invoking payment app callback. It is used to abort
@@ -173,8 +182,7 @@ class RespondWithCallbacks
       RunOrPostTaskOnThread(
           FROM_HERE, BrowserThread::UI,
           base::BindOnce(std::move(invoke_payment_app_callback_),
-                         payments::mojom::PaymentHandlerResponse::New(
-                             "", "", response_type)));
+                         CreateBlankPaymentHandlerResponse(response_type)));
     } else if (event_type_ ==
                    ServiceWorkerMetrics::EventType::CAN_MAKE_PAYMENT ||
                event_type_ == ServiceWorkerMetrics::EventType::ABORT_PAYMENT) {
@@ -337,8 +345,7 @@ void DispatchPaymentRequestEvent(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             std::move(callback),
-            payments::mojom::PaymentHandlerResponse::New(
-                "", "",
+            CreateBlankPaymentHandlerResponse(
                 PaymentEventResponseType::PAYMENT_EVENT_BROWSER_ERROR)));
     return;
   }
@@ -420,8 +427,8 @@ void OnInstallPaymentApp(
         browser_context, registration_id, sw_origin, std::move(event_data),
         std::move(callback));
   } else {
-    std::move(callback).Run(payments::mojom::PaymentHandlerResponse::New(
-        "", "", PaymentEventResponseType::PAYMENT_EVENT_BROWSER_ERROR));
+    std::move(callback).Run(CreateBlankPaymentHandlerResponse(
+        PaymentEventResponseType::PAYMENT_EVENT_BROWSER_ERROR));
   }
 }
 
@@ -650,6 +657,7 @@ void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
     const std::string& sw_scope,
     bool sw_use_cache,
     const std::string& method,
+    const SupportedDelegations& supported_delegations,
     RegistrationIdCallback registration_id_callback,
     InvokePaymentAppCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -663,8 +671,7 @@ void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             std::move(callback),
-            payments::mojom::PaymentHandlerResponse::New(
-                "", "",
+            CreateBlankPaymentHandlerResponse(
                 PaymentEventResponseType::PAYMENT_EVENT_BROWSER_ERROR)));
     return;
   }
@@ -681,7 +688,7 @@ void PaymentAppProviderImpl::InstallAndInvokePaymentApp(
 
   PaymentAppInstaller::Install(
       web_contents, app_name, string_encoded_icon, url, scope, sw_use_cache,
-      method,
+      method, supported_delegations,
       base::BindOnce(&OnInstallPaymentApp, url::Origin::Create(scope),
                      std::move(event_data), std::move(registration_id_callback),
                      std::move(callback)));
diff --git a/chromium/content/browser/payments/payment_app_provider_impl.h b/chromium/content/browser/payments/payment_app_provider_impl.h
index b73a9241bd5..28a5424c9ac 100644
--- a/chromium/content/browser/payments/payment_app_provider_impl.h
+++ b/chromium/content/browser/payments/payment_app_provider_impl.h
@@ -35,6 +35,7 @@ class CONTENT_EXPORT PaymentAppProviderImpl : public PaymentAppProvider {
       const std::string& sw_scope,
       bool sw_use_cache,
       const std::string& method,
+      const SupportedDelegations& supported_delegations,
       RegistrationIdCallback registration_id_callback,
       InvokePaymentAppCallback callback) override;
   void CanMakePayment(BrowserContext* browser_context,
diff --git a/chromium/content/browser/payments/payment_manager.cc b/chromium/content/browser/payments/payment_manager.cc
index 6ad629fdb02..b4a4eddb7ad 100644
--- a/chromium/content/browser/payments/payment_manager.cc
+++ b/chromium/content/browser/payments/payment_manager.cc
@@ -8,52 +8,83 @@
 
 #include "base/bind.h"
 #include "base/optional.h"
+#include "base/strings/string_util.h"
 #include "content/browser/payments/payment_app.pb.h"
 #include "content/browser/payments/payment_app_context_impl.h"
 #include "content/browser/payments/payment_app_database.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/public/browser/browser_thread.h"
-#include "url/origin.h"
+#include "content/public/browser/service_worker_context.h"
 
 namespace content {
 
-PaymentManager::~PaymentManager() {
-  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-}
-
 PaymentManager::PaymentManager(
     PaymentAppContextImpl* payment_app_context,
-    mojo::InterfaceRequest<payments::mojom::PaymentManager> request)
+    const url::Origin& origin,
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver)
     : payment_app_context_(payment_app_context),
-      binding_(this, std::move(request)) {
+      origin_(origin),
+      receiver_(this, std::move(receiver)) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK(payment_app_context);
 
-  binding_.set_connection_error_handler(base::BindOnce(
+  receiver_.set_disconnect_handler(base::BindOnce(
       &PaymentManager::OnConnectionError, weak_ptr_factory_.GetWeakPtr()));
 }
 
-void PaymentManager::Init(const GURL& context_url, const std::string& scope) {
+PaymentManager::~PaymentManager() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+}
 
-  should_set_payment_app_info_ = true;
-  context_url_ = context_url;
-  scope_ = GURL(scope);
+void PaymentManager::Init(const GURL& context_url, const std::string& scope) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
 
-  if (!context_url_.is_valid()) {
-    binding_.CloseWithReason(0U, "Invalid context URL.");
+  enum class ReasonCode : uint32_t {
+    kInvalidContextUrl,
+    kNonUnicodeScopeString,
+    kInvalidScopeUrl,
+    kCrossOriginContextAndScope,
+    kCrossOriginDataAccess,
+    kRenderProcessCannotAccessOrigin,
+  };
+
+  if (!context_url.is_valid()) {
+    receiver_.ResetWithReason(
+        static_cast<uint32_t>(ReasonCode::kInvalidContextUrl),
+        "Invalid context URL.");
     return;
   }
-  if (!scope_.is_valid()) {
-    binding_.CloseWithReason(1U, "Invalid scope URL.");
+  // GURL constructors CHECKs when the input string is not unicode.
+  if (!base::IsStringUTF8(scope)) {
+    receiver_.ResetWithReason(
+        static_cast<uint32_t>(ReasonCode::kNonUnicodeScopeString),
+        "Scope string is not UTF8.");
     return;
   }
-  if (!url::IsSameOriginWith(context_url_, scope_)) {
-    binding_.CloseWithReason(
-        2U, "Scope URL is not from the same origin of the context URL.");
+  GURL scope_url(scope);
+  if (!scope_url.is_valid()) {
+    receiver_.ResetWithReason(
+        static_cast<uint32_t>(ReasonCode::kInvalidScopeUrl),
+        "Invalid scope URL.");
     return;
   }
+  if (!url::IsSameOriginWith(context_url, scope_url)) {
+    receiver_.ResetWithReason(
+        static_cast<uint32_t>(ReasonCode::kCrossOriginContextAndScope),
+        "Scope URL is not from the same origin of the context URL.");
+    return;
+  }
+  if (!origin_.IsSameOriginWith(url::Origin::Create(context_url))) {
+    receiver_.ResetWithReason(
+        static_cast<uint32_t>(ReasonCode::kCrossOriginDataAccess),
+        "Cross origin data access.");
+    return;
+  }
+
+  should_set_payment_app_info_ = true;
+  context_url_ = context_url;
+  scope_ = scope_url;
 }
 
 void PaymentManager::DeletePaymentInstrument(
@@ -138,6 +169,15 @@ void PaymentManager::SetUserHint(const std::string& user_hint) {
       scope_, user_hint);
 }
 
+void PaymentManager::EnableDelegations(
+    const std::vector<payments::mojom::PaymentDelegation>& delegations,
+    PaymentManager::EnableDelegationsCallback callback) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+
+  payment_app_context_->payment_app_database()->EnablePaymentAppDelegations(
+      scope_, delegations, std::move(callback));
+}
+
 void PaymentManager::OnConnectionError() {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   payment_app_context_->PaymentManagerHadConnectionError(this);
diff --git a/chromium/content/browser/payments/payment_manager.h b/chromium/content/browser/payments/payment_manager.h
index b35ec0d2aa4..8c0b89b6554 100644
--- a/chromium/content/browser/payments/payment_manager.h
+++ b/chromium/content/browser/payments/payment_manager.h
@@ -10,9 +10,11 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "third_party/blink/public/mojom/payments/payment_app.mojom.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -22,7 +24,8 @@ class CONTENT_EXPORT PaymentManager : public payments::mojom::PaymentManager {
  public:
   PaymentManager(
       PaymentAppContextImpl* payment_app_context,
-      mojo::InterfaceRequest<payments::mojom::PaymentManager> request);
+      const url::Origin& origin,
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
 
   ~PaymentManager() override;
 
@@ -48,21 +51,23 @@ class CONTENT_EXPORT PaymentManager : public payments::mojom::PaymentManager {
   void ClearPaymentInstruments(
       ClearPaymentInstrumentsCallback callback) override;
   void SetUserHint(const std::string& user_hint) override;
+  void EnableDelegations(
+      const std::vector<payments::mojom::PaymentDelegation>& delegations,
+      EnableDelegationsCallback callback) override;
 
-  // Called when an error is detected on binding_.
+  // Called when an error is detected on receiver_.
   void OnConnectionError();
 
   void SetPaymentInstrumentIntermediateCallback(
       PaymentManager::SetPaymentInstrumentCallback callback,
       payments::mojom::PaymentHandlerStatus status);
 
-  // PaymentAppContextImpl owns PaymentManager
-  PaymentAppContextImpl* payment_app_context_;
-
+  PaymentAppContextImpl* const payment_app_context_;  // Owns PaymentManager.
+  const url::Origin origin_;
+  mojo::Receiver<payments::mojom::PaymentManager> receiver_;
   bool should_set_payment_app_info_;
   GURL context_url_;
   GURL scope_;
-  mojo::Binding<payments::mojom::PaymentManager> binding_;
   base::WeakPtrFactory<PaymentManager> weak_ptr_factory_{this};
   DISALLOW_COPY_AND_ASSIGN(PaymentManager);
 };
diff --git a/chromium/content/browser/permissions/permission_controller_impl.cc b/chromium/content/browser/permissions/permission_controller_impl.cc
index a018bcbfeaf..09fe4c54389 100644
--- a/chromium/content/browser/permissions/permission_controller_impl.cc
+++ b/chromium/content/browser/permissions/permission_controller_impl.cc
@@ -125,7 +125,7 @@ struct PermissionControllerImpl::Subscription {
   GURL embedding_origin;
   int render_frame_id = -1;
   int render_process_id = -1;
-  base::Callback<void(blink::mojom::PermissionStatus)> callback;
+  base::RepeatingCallback<void(blink::mojom::PermissionStatus)> callback;
   int delegate_subscription_id;
 };
 
@@ -166,7 +166,7 @@ PermissionControllerImpl::GetSubscriptionsStatuses(
 
 void PermissionControllerImpl::NotifyChangedSubscriptions(
     const SubscriptionsStatusMap& old_statuses) {
-  std::vector<base::Closure> callbacks;
+  std::vector<base::OnceClosure> callbacks;
   for (const auto& it : old_statuses) {
     auto key = it.first;
     Subscription* subscription = subscriptions_.Lookup(key);
@@ -176,10 +176,10 @@ void PermissionControllerImpl::NotifyChangedSubscriptions(
     blink::mojom::PermissionStatus new_status =
         GetSubscriptionCurrentValue(*subscription);
     if (new_status != old_status)
-      callbacks.push_back(base::Bind(subscription->callback, new_status));
+      callbacks.push_back(base::BindOnce(subscription->callback, new_status));
   }
-  for (const auto& callback : callbacks)
-    callback.Run();
+  for (auto& callback : callbacks)
+    std::move(callback).Run();
 }
 
 PermissionControllerImpl::OverrideStatus
@@ -256,25 +256,26 @@ int PermissionControllerImpl::RequestPermission(
     RenderFrameHost* render_frame_host,
     const GURL& requesting_origin,
     bool user_gesture,
-    const base::Callback<void(blink::mojom::PermissionStatus)>& callback) {
+    base::OnceCallback<void(blink::mojom::PermissionStatus)> callback) {
   NotifySchedulerAboutPermissionRequest(render_frame_host, permission);
 
   base::Optional<blink::mojom::PermissionStatus> status_override =
       devtools_permission_overrides_.Get(url::Origin::Create(requesting_origin),
                                          permission);
   if (status_override.has_value()) {
-    callback.Run(*status_override);
+    std::move(callback).Run(*status_override);
     return kNoPendingOperation;
   }
 
   PermissionControllerDelegate* delegate =
       browser_context_->GetPermissionControllerDelegate();
   if (!delegate) {
-    callback.Run(blink::mojom::PermissionStatus::DENIED);
+    std::move(callback).Run(blink::mojom::PermissionStatus::DENIED);
     return kNoPendingOperation;
   }
   return delegate->RequestPermission(permission, render_frame_host,
-                                     requesting_origin, user_gesture, callback);
+                                     requesting_origin, user_gesture,
+                                     std::move(callback));
 }
 
 int PermissionControllerImpl::RequestPermissions(
@@ -282,8 +283,8 @@ int PermissionControllerImpl::RequestPermissions(
     RenderFrameHost* render_frame_host,
     const GURL& requesting_origin,
     bool user_gesture,
-    const base::Callback<
-        void(const std::vector<blink::mojom::PermissionStatus>&)>& callback) {
+    base::OnceCallback<void(const std::vector<blink::mojom::PermissionStatus>&)>
+        callback) {
   for (PermissionType permission : permissions)
     NotifySchedulerAboutPermissionRequest(render_frame_host, permission);
 
@@ -382,7 +383,8 @@ int PermissionControllerImpl::SubscribePermissionStatusChange(
     PermissionType permission,
     RenderFrameHost* render_frame_host,
     const GURL& requesting_origin,
-    const base::Callback<void(blink::mojom::PermissionStatus)>& callback) {
+    const base::RepeatingCallback<void(blink::mojom::PermissionStatus)>&
+        callback) {
   auto subscription = std::make_unique<Subscription>();
   subscription->permission = permission;
   subscription->callback = callback;
@@ -408,7 +410,7 @@ int PermissionControllerImpl::SubscribePermissionStatusChange(
     subscription->delegate_subscription_id =
         delegate->SubscribePermissionStatusChange(
             permission, render_frame_host, requesting_origin,
-            base::Bind(
+            base::BindRepeating(
                 &PermissionControllerImpl::OnDelegatePermissionStatusChange,
                 base::Unretained(this), subscription.get()));
   } else {
diff --git a/chromium/content/browser/permissions/permission_controller_impl.h b/chromium/content/browser/permissions/permission_controller_impl.h
index 86f121c80e9..0c5e6528fd2 100644
--- a/chromium/content/browser/permissions/permission_controller_impl.h
+++ b/chromium/content/browser/permissions/permission_controller_impl.h
@@ -57,15 +57,15 @@ class CONTENT_EXPORT PermissionControllerImpl : public PermissionController {
       RenderFrameHost* render_frame_host,
       const GURL& requesting_origin,
       bool user_gesture,
-      const base::Callback<void(blink::mojom::PermissionStatus)>& callback);
+      base::OnceCallback<void(blink::mojom::PermissionStatus)> callback);
 
   int RequestPermissions(
       const std::vector<PermissionType>& permission,
       RenderFrameHost* render_frame_host,
       const GURL& requesting_origin,
       bool user_gesture,
-      const base::Callback<
-          void(const std::vector<blink::mojom::PermissionStatus>&)>& callback);
+      base::OnceCallback<
+          void(const std::vector<blink::mojom::PermissionStatus>&)> callback);
 
   void ResetPermission(PermissionType permission,
                        const GURL& requesting_origin,
@@ -75,7 +75,8 @@ class CONTENT_EXPORT PermissionControllerImpl : public PermissionController {
       PermissionType permission,
       RenderFrameHost* render_frame_host,
       const GURL& requesting_origin,
-      const base::Callback<void(blink::mojom::PermissionStatus)>& callback);
+      const base::RepeatingCallback<void(blink::mojom::PermissionStatus)>&
+          callback);
 
   void UnsubscribePermissionStatusChange(int subscription_id);
 
diff --git a/chromium/content/browser/permissions/permission_controller_impl_unittest.cc b/chromium/content/browser/permissions/permission_controller_impl_unittest.cc
index c408b18ce4e..2685e74920e 100644
--- a/chromium/content/browser/permissions/permission_controller_impl_unittest.cc
+++ b/chromium/content/browser/permissions/permission_controller_impl_unittest.cc
@@ -23,8 +23,8 @@ namespace content {
 namespace {
 using ::testing::Unused;
 using OverrideStatus = PermissionControllerImpl::OverrideStatus;
-using RequestsCallback =
-    base::Callback<void(const std::vector<blink::mojom::PermissionStatus>&)>;
+using RequestsCallback = base::OnceCallback<void(
+    const std::vector<blink::mojom::PermissionStatus>&)>;
 
 constexpr char kTestUrl[] = "https://google.com";
 
diff --git a/chromium/content/browser/permissions/permission_service_context.cc b/chromium/content/browser/permissions/permission_service_context.cc
index ed539c40e6d..c3ab81294ed 100644
--- a/chromium/content/browser/permissions/permission_service_context.cc
+++ b/chromium/content/browser/permissions/permission_service_context.cc
@@ -28,6 +28,8 @@ class PermissionServiceContext::PermissionSubscription {
     observer_.set_disconnect_handler(base::BindOnce(
         &PermissionSubscription::OnConnectionError, base::Unretained(this)));
   }
+  PermissionSubscription(const PermissionSubscription&) = delete;
+  PermissionSubscription& operator=(const PermissionSubscription&) = delete;
 
   ~PermissionSubscription() {
     DCHECK_NE(id_, 0);
@@ -50,7 +52,7 @@ class PermissionServiceContext::PermissionSubscription {
   void set_id(int id) { id_ = id; }
 
  private:
-  PermissionServiceContext* context_;
+  PermissionServiceContext* const context_;
   mojo::Remote<blink::mojom::PermissionObserver> observer_;
   int id_ = 0;
 };
@@ -81,8 +83,8 @@ void PermissionServiceContext::CreateService(
 }
 
 void PermissionServiceContext::CreateServiceForWorker(
-    mojo::PendingReceiver<blink::mojom::PermissionService> receiver,
-    const url::Origin& origin) {
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::PermissionService> receiver) {
   services_.Add(std::make_unique<PermissionServiceImpl>(this, origin),
                 std::move(receiver));
 }
@@ -110,16 +112,16 @@ void PermissionServiceContext::CreateSubscription(
       PermissionControllerImpl::FromBrowserContext(browser_context)
           ->SubscribePermissionStatusChange(
               permission_type, render_frame_host_, requesting_origin,
-              base::Bind(&PermissionSubscription::OnPermissionStatusChanged,
-                         base::Unretained(subscription.get())));
+              base::BindRepeating(
+                  &PermissionSubscription::OnPermissionStatusChanged,
+                  base::Unretained(subscription.get())));
   subscription->set_id(subscription_id);
   subscriptions_[subscription_id] = std::move(subscription);
 }
 
 void PermissionServiceContext::ObserverHadConnectionError(int subscription_id) {
-  auto it = subscriptions_.find(subscription_id);
-  DCHECK(it != subscriptions_.end());
-  subscriptions_.erase(it);
+  size_t erased = subscriptions_.erase(subscription_id);
+  DCHECK_EQ(1u, erased);
 }
 
 void PermissionServiceContext::RenderFrameHostChanged(
@@ -168,8 +170,4 @@ GURL PermissionServiceContext::GetEmbeddingOrigin() const {
                         : GURL();
 }
 
-RenderFrameHost* PermissionServiceContext::render_frame_host() const {
-  return render_frame_host_;
-}
-
-} // namespace content
+}  // namespace content
diff --git a/chromium/content/browser/permissions/permission_service_context.h b/chromium/content/browser/permissions/permission_service_context.h
index 4b6d362ba93..4f93be504fd 100644
--- a/chromium/content/browser/permissions/permission_service_context.h
+++ b/chromium/content/browser/permissions/permission_service_context.h
@@ -5,7 +5,9 @@
 #ifndef CONTENT_BROWSER_PERMISSIONS_PERMISSION_SERVICE_CONTEXT_H_
 #define CONTENT_BROWSER_PERMISSIONS_PERMISSION_SERVICE_CONTEXT_H_
 
-#include "base/macros.h"
+#include <memory>
+#include <unordered_map>
+
 #include "content/common/content_export.h"
 #include "content/public/browser/permission_type.h"
 #include "content/public/browser/web_contents_observer.h"
@@ -32,13 +34,15 @@ class CONTENT_EXPORT PermissionServiceContext : public WebContentsObserver {
  public:
   explicit PermissionServiceContext(RenderFrameHost* render_frame_host);
   explicit PermissionServiceContext(RenderProcessHost* render_process_host);
+  PermissionServiceContext(const PermissionServiceContext&) = delete;
+  PermissionServiceContext& operator=(const PermissionServiceContext&) = delete;
   ~PermissionServiceContext() override;
 
   void CreateService(
       mojo::PendingReceiver<blink::mojom::PermissionService> receiver);
   void CreateServiceForWorker(
-      mojo::PendingReceiver<blink::mojom::PermissionService> receiver,
-      const url::Origin& origin);
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::PermissionService> receiver);
 
   void CreateSubscription(
       PermissionType permission_type,
@@ -55,7 +59,7 @@ class CONTENT_EXPORT PermissionServiceContext : public WebContentsObserver {
 
   GURL GetEmbeddingOrigin() const;
 
-  RenderFrameHost* render_frame_host() const;
+  RenderFrameHost* render_frame_host() const { return render_frame_host_; }
   RenderProcessHost* render_process_host() const {
     return render_process_host_;
   }
@@ -69,15 +73,13 @@ class CONTENT_EXPORT PermissionServiceContext : public WebContentsObserver {
   void FrameDeleted(RenderFrameHost* render_frame_host) override;
   void DidFinishNavigation(NavigationHandle* navigation_handle) override;
 
-  void CloseBindings(RenderFrameHost*);
+  void CloseBindings(RenderFrameHost* render_frame_host);
 
-  RenderFrameHost* render_frame_host_;
-  RenderProcessHost* render_process_host_;
+  RenderFrameHost* const render_frame_host_;
+  RenderProcessHost* const render_process_host_;
   mojo::UniqueReceiverSet<blink::mojom::PermissionService> services_;
   std::unordered_map<int, std::unique_ptr<PermissionSubscription>>
       subscriptions_;
-
-  DISALLOW_COPY_AND_ASSIGN(PermissionServiceContext);
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/permissions/permission_service_impl.cc b/chromium/content/browser/permissions/permission_service_impl.cc
index 4fffcddf2e2..c6345e0119f 100644
--- a/chromium/content/browser/permissions/permission_service_impl.cc
+++ b/chromium/content/browser/permissions/permission_service_impl.cc
@@ -211,13 +211,13 @@ void PermissionServiceImpl::RequestPermissions(
       std::make_unique<PendingRequest>(types, std::move(callback));
 
   int pending_request_id = pending_requests_.Add(std::move(pending_request));
-  int id =
-      PermissionControllerImpl::FromBrowserContext(browser_context)
-          ->RequestPermissions(
-              types, context_->render_frame_host(), origin_.GetURL(),
-              user_gesture,
-              base::Bind(&PermissionServiceImpl::OnRequestPermissionsResponse,
-                         weak_factory_.GetWeakPtr(), pending_request_id));
+  int id = PermissionControllerImpl::FromBrowserContext(browser_context)
+               ->RequestPermissions(
+                   types, context_->render_frame_host(), origin_.GetURL(),
+                   user_gesture,
+                   base::BindOnce(
+                       &PermissionServiceImpl::OnRequestPermissionsResponse,
+                       weak_factory_.GetWeakPtr(), pending_request_id));
 
   // Check if the request still exists. It may have been removed by the
   // the response callback.
diff --git a/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc b/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc
index ce37baaa3f9..093a1e9efde 100644
--- a/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc
+++ b/chromium/content/browser/picture_in_picture/picture_in_picture_service_impl_unittest.cc
@@ -12,6 +12,7 @@
 #include "content/common/media/media_player_delegate_messages.h"
 #include "content/public/browser/overlay_window.h"
 #include "content/public/browser/web_contents_delegate.h"
+#include "content/public/common/content_client.h"
 #include "content/test/test_content_browser_client.h"
 #include "content/test/test_render_frame_host.h"
 #include "content/test/test_render_view_host.h"
diff --git a/chromium/content/browser/plugin_service_impl.cc b/chromium/content/browser/plugin_service_impl.cc
index 06bd3e74a1c..4461a489227 100644
--- a/chromium/content/browser/plugin_service_impl.cc
+++ b/chromium/content/browser/plugin_service_impl.cc
@@ -38,6 +38,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
diff --git a/chromium/content/browser/pointer_lock_browsertest.cc b/chromium/content/browser/pointer_lock_browsertest.cc
index e576b641418..e9b3cfaaa24 100644
--- a/chromium/content/browser/pointer_lock_browsertest.cc
+++ b/chromium/content/browser/pointer_lock_browsertest.cc
@@ -135,6 +135,16 @@ class PointerLockBrowserTest : public ContentBrowserTest {
   MockPointerLockWebContentsDelegate web_contents_delegate_;
 };
 
+class PointerLockBrowserTestWithOptions : public PointerLockBrowserTest {
+ public:
+  PointerLockBrowserTestWithOptions() {
+    feature_list_.InitAndEnableFeature(features::kPointerLockOptions);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
 IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockBasic) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
@@ -616,10 +626,9 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, PointerLockWidgetHidden) {
   EXPECT_EQ(nullptr, web_contents()->GetMouseLockWidget());
 }
 
-IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
-                       PointerLockRequestUnadjustedMovement) {
-  base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndEnableFeature(features::kPointerLockOptions);
+// Flaky. https://crbug.com/1014324
+IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions,
+                       DISABLED_PointerLockRequestUnadjustedMovement) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ -667,9 +676,7 @@ IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest,
 }
 
 #if defined(USE_AURA)
-IN_PROC_BROWSER_TEST_F(PointerLockBrowserTest, UnadjustedMovement) {
-  base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndEnableFeature(features::kPointerLockOptions);
+IN_PROC_BROWSER_TEST_F(PointerLockBrowserTestWithOptions, UnadjustedMovement) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
diff --git a/chromium/content/browser/portal/OWNERS b/chromium/content/browser/portal/OWNERS
new file mode 100644
index 00000000000..bf4f80209da
--- /dev/null
+++ b/chromium/content/browser/portal/OWNERS
@@ -0,0 +1,3 @@
+file://third_party/blink/renderer/core/html/portal/OWNERS
+
+# COMPONENT: Blink>HTML>Portal
diff --git a/chromium/content/browser/portal/portal.cc b/chromium/content/browser/portal/portal.cc
index 4be98c396d3..bbc42610f93 100644
--- a/chromium/content/browser/portal/portal.cc
+++ b/chromium/content/browser/portal/portal.cc
@@ -54,6 +54,7 @@ Portal::~Portal() {
       portal_contents_impl_->GetOuterDelegateFrameTreeNodeId());
   if (outer_node)
     outer_node->RemoveObserver(this);
+  portal_contents_impl_->set_portal(nullptr);
 
   g_portal_token_map.Get().erase(portal_token_);
 }
@@ -77,6 +78,13 @@ Portal* Portal::Create(
     RenderFrameHostImpl* owner_render_frame_host,
     mojo::PendingAssociatedReceiver<blink::mojom::Portal> receiver,
     mojo::PendingAssociatedRemote<blink::mojom::PortalClient> client) {
+  if (!IsEnabled()) {
+    mojo::ReportBadMessage(
+        "blink.mojom.Portal can only be used if the Portals feature is "
+        "enabled.");
+    return nullptr;
+  }
+
   auto portal_ptr = base::WrapUnique(new Portal(owner_render_frame_host));
   Portal* portal = portal_ptr.get();
   portal->binding_ = mojo::MakeStrongAssociatedBinding<blink::mojom::Portal>(
@@ -96,6 +104,13 @@ void Portal::BindPortalHostReceiver(
     RenderFrameHostImpl* frame,
     mojo::PendingAssociatedReceiver<blink::mojom::PortalHost>
         pending_receiver) {
+  if (!IsEnabled()) {
+    mojo::ReportBadMessage(
+        "blink.mojom.PortalHost can only be used if the Portals feature is "
+        "enabled.");
+    return;
+  }
+
   WebContentsImpl* web_contents =
       static_cast<WebContentsImpl*>(WebContents::FromRenderFrameHost(frame));
 
@@ -174,7 +189,9 @@ RenderFrameProxyHost* Portal::CreateProxyAndAttachPortal() {
   return proxy_host;
 }
 
-void Portal::Navigate(const GURL& url, blink::mojom::ReferrerPtr referrer) {
+void Portal::Navigate(const GURL& url,
+                      blink::mojom::ReferrerPtr referrer,
+                      NavigateCallback callback) {
   if (!url.SchemeIsHTTPOrHTTPS()) {
     mojo::ReportBadMessage("Portal::Navigate tried to use non-HTTP protocol.");
     binding_->Close();  // Also deletes |this|.
@@ -197,6 +214,8 @@ void Portal::Navigate(const GURL& url, blink::mojom::ReferrerPtr referrer) {
       owner_render_frame_host_->GetSiteInstance(),
       mojo::ConvertTo<Referrer>(referrer), ui::PAGE_TRANSITION_LINK, false,
       download_policy, "GET", nullptr, "", nullptr, false);
+
+  std::move(callback).Run();
 }
 
 namespace {
@@ -246,19 +265,20 @@ void Portal::Activate(blink::TransferableMessage data,
 
   auto* outer_contents_main_frame_view = static_cast<RenderWidgetHostViewBase*>(
       outer_contents->GetMainFrame()->GetView());
+  auto* portal_contents_main_frame_view =
+      static_cast<RenderWidgetHostViewBase*>(
+          portal_contents_impl_->GetMainFrame()->GetView());
+
+  std::vector<std::unique_ptr<ui::TouchEvent>> touch_events;
+
   if (outer_contents_main_frame_view) {
     // Take fallback contents from previous WebContents so that the activation
     // is smooth without flashes.
-    auto* portal_contents_main_frame_view =
-        static_cast<RenderWidgetHostViewBase*>(
-            portal_contents_impl_->GetMainFrame()->GetView());
     portal_contents_main_frame_view->TakeFallbackContentFrom(
         outer_contents_main_frame_view);
-
-    outer_contents_main_frame_view->CancelActiveTouches();
+    touch_events =
+        outer_contents_main_frame_view->ExtractAndCancelActiveTouches();
     FlushTouchEventQueues(outer_contents_main_frame_view->host());
-
-    outer_contents_main_frame_view->Destroy();
   }
 
   std::unique_ptr<WebContents> predecessor_web_contents =
@@ -266,6 +286,16 @@ void Portal::Activate(blink::TransferableMessage data,
                                 true, is_loading);
   CHECK_EQ(predecessor_web_contents.get(), outer_contents);
 
+  if (outer_contents_main_frame_view) {
+    portal_contents_main_frame_view->TransferTouches(touch_events);
+    // Takes ownership of SyntheticGestureController from the predecessor's
+    // RenderWidgetHost. This allows the controller to continue sending events
+    // to the new RenderWidgetHostView.
+    portal_contents_main_frame_view->host()->TakeSyntheticGestureController(
+        outer_contents_main_frame_view->host());
+    outer_contents_main_frame_view->Destroy();
+  }
+
   portal_contents_impl_->set_portal(nullptr);
 
   mojo::PendingAssociatedRemote<blink::mojom::Portal> pending_portal;
diff --git a/chromium/content/browser/portal/portal.h b/chromium/content/browser/portal/portal.h
index fe054795de1..dcd6f5930d5 100644
--- a/chromium/content/browser/portal/portal.h
+++ b/chromium/content/browser/portal/portal.h
@@ -68,7 +68,9 @@ class CONTENT_EXPORT Portal : public blink::mojom::Portal,
   RenderFrameProxyHost* CreateProxyAndAttachPortal();
 
   // blink::mojom::Portal implementation.
-  void Navigate(const GURL& url, blink::mojom::ReferrerPtr referrer) override;
+  void Navigate(const GURL& url,
+                blink::mojom::ReferrerPtr referrer,
+                NavigateCallback callback) override;
   void Activate(blink::TransferableMessage data,
                 ActivateCallback callback) override;
   void PostMessageToGuest(
diff --git a/chromium/content/browser/portal/portal_browsertest.cc b/chromium/content/browser/portal/portal_browsertest.cc
index cc158f12485..d44f9089a6b 100644
--- a/chromium/content/browser/portal/portal_browsertest.cc
+++ b/chromium/content/browser/portal/portal_browsertest.cc
@@ -12,11 +12,13 @@
 #include "content/browser/frame_host/render_frame_host_manager.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
 #include "content/browser/portal/portal.h"
+#include "content/browser/portal/portal_created_observer.h"
+#include "content/browser/portal/portal_interceptor_for_testing.h"
+#include "content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.h"
 #include "content/browser/renderer_host/input/synthetic_tap_gesture.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/browser/web_contents/web_contents_impl.h"
-#include "content/common/frame.mojom-test-utils.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
@@ -32,7 +34,6 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/mojom/portal/portal.mojom-test-utils.h"
 #include "third_party/blink/public/mojom/portal/portal.mojom.h"
 #include "url/url_constants.h"
 
@@ -40,200 +41,6 @@ using testing::_;
 
 namespace content {
 
-// The PortalInterceptorForTesting can be used in tests to inspect Portal IPCs.
-class PortalInterceptorForTesting final
-    : public blink::mojom::PortalInterceptorForTesting {
- public:
-  static PortalInterceptorForTesting* Create(
-      RenderFrameHostImpl* render_frame_host_impl,
-      mojo::PendingAssociatedReceiver<blink::mojom::Portal> receiver,
-      mojo::AssociatedRemote<blink::mojom::PortalClient> client);
-  static PortalInterceptorForTesting* Create(
-      RenderFrameHostImpl* render_frame_host_impl,
-      content::Portal* portal);
-  static PortalInterceptorForTesting* From(content::Portal* portal);
-
-  void Activate(blink::TransferableMessage data,
-                ActivateCallback callback) override {
-    portal_activated_ = true;
-
-    if (run_loop_) {
-      run_loop_->Quit();
-      run_loop_ = nullptr;
-    }
-
-    // |this| can be destroyed after Activate() is called.
-    portal_->Activate(std::move(data), std::move(callback));
-  }
-
-  void Navigate(const GURL& url, blink::mojom::ReferrerPtr referrer) override {
-    if (navigate_callback_) {
-      navigate_callback_.Run(url, std::move(referrer));
-      return;
-    }
-
-    portal_->Navigate(url, std::move(referrer));
-  }
-
-  void WaitForActivate() {
-    if (portal_activated_)
-      return;
-
-    base::RunLoop run_loop;
-    run_loop_ = &run_loop;
-    run_loop.Run();
-  }
-
-  // Test getters.
-  content::Portal* GetPortal() { return portal_.get(); }
-  WebContents* GetPortalContents() { return portal_->GetPortalContents(); }
-
-  // IPC callbacks
-  base::RepeatingCallback<void(const GURL&, blink::mojom::ReferrerPtr)>
-      navigate_callback_;
-
- private:
-  explicit PortalInterceptorForTesting(
-      RenderFrameHostImpl* render_frame_host_impl)
-      : portal_(content::Portal::CreateForTesting(render_frame_host_impl)) {}
-  PortalInterceptorForTesting(RenderFrameHostImpl* render_frame_host_impl,
-                              std::unique_ptr<content::Portal> portal)
-      : portal_(std::move(portal)) {}
-
-  blink::mojom::Portal* GetForwardingInterface() override {
-    return portal_.get();
-  }
-
-  std::unique_ptr<content::Portal> portal_;
-  bool portal_activated_ = false;
-  base::RunLoop* run_loop_ = nullptr;
-};
-
-// static
-PortalInterceptorForTesting* PortalInterceptorForTesting::Create(
-    RenderFrameHostImpl* render_frame_host_impl,
-    mojo::PendingAssociatedReceiver<blink::mojom::Portal> receiver,
-    mojo::AssociatedRemote<blink::mojom::PortalClient> client) {
-  auto test_portal_ptr =
-      base::WrapUnique(new PortalInterceptorForTesting(render_frame_host_impl));
-  PortalInterceptorForTesting* test_portal = test_portal_ptr.get();
-  test_portal->GetPortal()->SetBindingForTesting(
-      mojo::MakeStrongAssociatedBinding<blink::mojom::Portal>(
-          std::move(test_portal_ptr), std::move(receiver)));
-  test_portal->GetPortal()->SetClientForTesting(std::move(client));
-  return test_portal;
-}
-
-PortalInterceptorForTesting* PortalInterceptorForTesting::Create(
-    RenderFrameHostImpl* render_frame_host_impl,
-    content::Portal* portal) {
-  // Take ownership of the portal.
-  std::unique_ptr<blink::mojom::Portal> mojom_portal_ptr =
-      portal->GetBindingForTesting()->SwapImplForTesting(nullptr);
-  std::unique_ptr<content::Portal> portal_ptr = base::WrapUnique(
-      static_cast<content::Portal*>(mojom_portal_ptr.release()));
-
-  // Create PortalInterceptorForTesting.
-  auto test_portal_ptr = base::WrapUnique(new PortalInterceptorForTesting(
-      render_frame_host_impl, std::move(portal_ptr)));
-  PortalInterceptorForTesting* test_portal = test_portal_ptr.get();
-
-  // Set the binding for the PortalInterceptorForTesting.
-  portal->GetBindingForTesting()->SwapImplForTesting(
-      std::move(test_portal_ptr));
-
-  return test_portal;
-}
-
-// static
-PortalInterceptorForTesting* PortalInterceptorForTesting::From(
-    content::Portal* portal) {
-  blink::mojom::Portal* impl = portal->GetBindingForTesting()->impl();
-  auto* interceptor = static_cast<PortalInterceptorForTesting*>(impl);
-  CHECK_NE(static_cast<blink::mojom::Portal*>(portal), impl);
-  CHECK_EQ(interceptor->GetPortal(), portal);
-  return interceptor;
-}
-
-// The PortalCreatedObserver observes portal creations on
-// |render_frame_host_impl|. This observer can be used to monitor for multiple
-// Portal creations on the same RenderFrameHost, by repeatedly calling
-// WaitUntilPortalCreated().
-class PortalCreatedObserver : public mojom::FrameHostInterceptorForTesting {
- public:
-  explicit PortalCreatedObserver(RenderFrameHostImpl* render_frame_host_impl)
-      : render_frame_host_impl_(render_frame_host_impl) {
-    old_impl_ = render_frame_host_impl_->frame_host_binding_for_testing()
-                    .SwapImplForTesting(this);
-  }
-
-  ~PortalCreatedObserver() override {
-    render_frame_host_impl_->frame_host_binding_for_testing()
-        .SwapImplForTesting(old_impl_);
-  }
-
-  FrameHost* GetForwardingInterface() override {
-    return render_frame_host_impl_;
-  }
-
-  void CreatePortal(
-      mojo::PendingAssociatedReceiver<blink::mojom::Portal> portal,
-      mojo::PendingAssociatedRemote<blink::mojom::PortalClient> client,
-      CreatePortalCallback callback) override {
-    PortalInterceptorForTesting* portal_interceptor =
-        PortalInterceptorForTesting::Create(
-            render_frame_host_impl_, std::move(portal),
-            mojo::AssociatedRemote<blink::mojom::PortalClient>(
-                std::move(client)));
-    portal_ = portal_interceptor->GetPortal();
-    RenderFrameProxyHost* proxy_host = portal_->CreateProxyAndAttachPortal();
-    std::move(callback).Run(proxy_host->GetRoutingID(), portal_->portal_token(),
-                            portal_->GetDevToolsFrameToken());
-
-    if (run_loop_)
-      run_loop_->Quit();
-  }
-
-  void AdoptPortal(const base::UnguessableToken& portal_token,
-                   AdoptPortalCallback callback) override {
-    Portal* portal = Portal::FromToken(portal_token);
-    PortalInterceptorForTesting* portal_interceptor =
-        PortalInterceptorForTesting::Create(render_frame_host_impl_, portal);
-    portal_ = portal_interceptor->GetPortal();
-    RenderFrameProxyHost* proxy_host = portal_->CreateProxyAndAttachPortal();
-    std::move(callback).Run(
-        proxy_host->GetRoutingID(),
-        proxy_host->frame_tree_node()->current_replication_state(),
-        portal->GetDevToolsFrameToken());
-
-    if (run_loop_)
-      run_loop_->Quit();
-  }
-
-  Portal* WaitUntilPortalCreated() {
-    Portal* portal = portal_;
-    if (portal) {
-      portal_ = nullptr;
-      return portal;
-    }
-
-    base::RunLoop run_loop;
-    run_loop_ = &run_loop;
-    run_loop.Run();
-    run_loop_ = nullptr;
-
-    portal = portal_;
-    portal_ = nullptr;
-    return portal;
-  }
-
- private:
-  RenderFrameHostImpl* render_frame_host_impl_;
-  mojom::FrameHost* old_impl_;
-  base::RunLoop* run_loop_ = nullptr;
-  Portal* portal_ = nullptr;
-};
-
 class PortalBrowserTest : public ContentBrowserTest {
  protected:
   PortalBrowserTest() {}
@@ -245,6 +52,8 @@ class PortalBrowserTest : public ContentBrowserTest {
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitch(switches::kValidateInputEventStream);
+    command_line->AppendSwitchASCII("--enable-blink-features",
+                                    "OverscrollCustomization");
   }
 
   void SetUpOnMainThread() override {
@@ -505,6 +314,7 @@ class PortalHitTestBrowserTest : public PortalBrowserTest,
  protected:
   void SetUpCommandLine(base::CommandLine* command_line) override {
     PortalBrowserTest::SetUpCommandLine(command_line);
+    IsolateAllSitesForTesting(command_line);
     const bool use_viz_hit_test_surface_layer = GetParam();
     if (use_viz_hit_test_surface_layer) {
       feature_list_.InitAndEnableFeature(
@@ -602,6 +412,84 @@ IN_PROC_BROWSER_TEST_P(PortalHitTestBrowserTest, DispatchInputEvent) {
   EXPECT_EQ(false, EvalJs(portal_frame, "clicked"));
 }
 
+// Tests that input events performed over on OOPIF inside a portal are targeted
+// to the portal's parent.
+IN_PROC_BROWSER_TEST_P(PortalHitTestBrowserTest, NoInputToOOPIFInPortal) {
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("portal.test", "/title1.html")));
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
+
+  // Create portal and wait for navigation.
+  // In the case of crbug.com/1002228 , this does not appear to reproduce if the
+  // portal element is too small, so we give it an explicit size.
+  Portal* portal = nullptr;
+  PortalCreatedObserver portal_created_observer(main_frame);
+  GURL a_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(ExecJs(main_frame,
+                     JsReplace("var portal = document.createElement('portal');"
+                               "portal.src = $1;"
+                               "portal.style.width = '500px';"
+                               "portal.style.height = '500px';"
+                               "portal.style.border = 'solid';"
+                               "document.body.appendChild(portal);",
+                               a_url)));
+  portal = portal_created_observer.WaitUntilPortalCreated();
+  WebContentsImpl* portal_contents = portal->GetPortalContents();
+  RenderFrameHostImpl* portal_frame = portal_contents->GetMainFrame();
+  TestNavigationObserver navigation_observer(portal_contents);
+  navigation_observer.Wait();
+  WaitForHitTestData(portal_frame);
+
+  // Add an out-of-process iframe to the portal.
+  GURL b_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  TestNavigationObserver iframe_navigation_observer(portal_contents);
+  EXPECT_TRUE(ExecJs(portal_frame,
+                     JsReplace("var iframe = document.createElement('iframe');"
+                               "iframe.src = $1;"
+                               "document.body.appendChild(iframe);",
+                               b_url)));
+  iframe_navigation_observer.Wait();
+  EXPECT_EQ(b_url, iframe_navigation_observer.last_navigation_url());
+  RenderFrameHostImpl* portal_iframe =
+      portal_frame->child_at(0)->current_frame_host();
+  EXPECT_TRUE(static_cast<RenderWidgetHostViewBase*>(portal_iframe->GetView())
+                  ->IsRenderWidgetHostViewChildFrame());
+  RenderWidgetHostViewChildFrame* oopif_view =
+      static_cast<RenderWidgetHostViewChildFrame*>(portal_iframe->GetView());
+  EXPECT_NE(portal_frame->GetSiteInstance(), portal_iframe->GetSiteInstance());
+  WaitForHitTestData(portal_iframe);
+
+  FailOnInputEvent no_input_to_portal_frame(
+      portal_frame->GetRenderWidgetHost());
+  FailOnInputEvent no_input_to_oopif(portal_iframe->GetRenderWidgetHost());
+  EXPECT_TRUE(ExecJs(main_frame,
+                     "var clicked = false;"
+                     "portal.onmousedown = _ => clicked = true;"));
+  EXPECT_TRUE(ExecJs(portal_frame,
+                     "var clicked = false;"
+                     "document.body.onmousedown = _ => clicked = true;"));
+  EXPECT_TRUE(ExecJs(portal_iframe,
+                     "var clicked = false;"
+                     "document.body.onmousedown = _ => clicked = true;"));
+
+  // Route the mouse event.
+  gfx::Point root_location =
+      oopif_view->TransformPointToRootCoordSpace(gfx::Point(5, 5));
+  InputEventAckWaiter waiter(main_frame->GetRenderWidgetHost(),
+                             blink::WebInputEvent::kMouseDown);
+  SimulateRoutedMouseEvent(web_contents_impl, blink::WebInputEvent::kMouseDown,
+                           blink::WebPointerProperties::Button::kLeft,
+                           root_location);
+  waiter.Wait();
+
+  // Check that the click event was only received by the main frame.
+  EXPECT_EQ(true, EvalJs(main_frame, "clicked"));
+  EXPECT_EQ(false, EvalJs(portal_frame, "clicked"));
+  EXPECT_EQ(false, EvalJs(portal_iframe, "clicked"));
+}
+
 // Tests that async hit testing does not target portals.
 IN_PROC_BROWSER_TEST_F(PortalBrowserTest, AsyncEventTargetingIgnoresPortals) {
   EXPECT_TRUE(NavigateToURL(
@@ -675,12 +563,13 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, NavigateToChrome) {
       PortalInterceptorForTesting::From(portal);
 
   // Try to navigate to chrome://settings and wait for the process to die.
-  portal_interceptor->navigate_callback_ = base::BindRepeating(
-      [](Portal* portal, const GURL& url, blink::mojom::ReferrerPtr referrer) {
+  portal_interceptor->SetNavigateCallback(base::BindRepeating(
+      [](Portal* portal, const GURL& url, blink::mojom::ReferrerPtr referrer,
+         blink::mojom::Portal::NavigateCallback callback) {
         GURL chrome_url("chrome://settings");
-        portal->Navigate(chrome_url, std::move(referrer));
+        portal->Navigate(chrome_url, std::move(referrer), std::move(callback));
       },
-      portal);
+      portal));
   RenderProcessHostKillWaiter kill_waiter(main_frame->GetProcess());
   GURL a_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
   ignore_result(ExecJs(main_frame, JsReplace("portal.src = $1;", a_url)));
@@ -743,16 +632,9 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, TouchAckAfterActivate) {
   input_event_ack_waiter.Wait();
 }
 
-#if defined(OS_MACOSX)
-//  TODO(crbug.com/941824): Test flaky on MAC
-#define MAYBE_TouchAckAfterActivateAndAdopt \
-  DISABLED_TouchAckAfterActivateAndAdopt
-#else
-#define MAYBE_TouchAckAfterActivateAndAdopt TouchAckAfterActivateAndAdopt
-#endif
 // Regression test for crbug.com/973647. Tests that receiving a touch ack
 // after activation and predecessor adoption doesn't cause a crash.
-IN_PROC_BROWSER_TEST_F(PortalBrowserTest, MAYBE_TouchAckAfterActivateAndAdopt) {
+IN_PROC_BROWSER_TEST_F(PortalBrowserTest, TouchAckAfterActivateAndAdopt) {
   EXPECT_TRUE(NavigateToURL(
       shell(), embedded_test_server()->GetURL("portal.test", "/title1.html")));
   WebContentsImpl* web_contents_impl =
@@ -807,10 +689,15 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, MAYBE_TouchAckAfterActivateAndAdopt) {
 
   std::unique_ptr<SyntheticTapGesture> gesture =
       std::make_unique<SyntheticTapGesture>(params);
-  render_widget_host->QueueSyntheticGesture(
-      std::move(gesture), base::Bind([](SyntheticGesture::Result) {}));
-  portal_interceptor->WaitForActivate();
-  EXPECT_EQ(portal_contents, shell()->web_contents());
+  {
+    PortalCreatedObserver adoption_observer(portal_frame);
+    render_widget_host->QueueSyntheticGesture(
+        std::move(gesture), base::Bind([](SyntheticGesture::Result) {}));
+    portal_interceptor->WaitForActivate();
+    EXPECT_EQ(portal_contents, shell()->web_contents());
+    // Wait for predecessor to be adopted.
+    adoption_observer.WaitUntilPortalCreated();
+  }
 
   // Wait for a touch ack to be sent from the predecessor.
   input_event_ack_waiter.Wait();
@@ -947,8 +834,8 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, TouchStateClearedBeforeActivation) {
         std::make_unique<SyntheticTapGesture>(params);
     InputEventAckWaiter input_event_ack_waiter(
         render_widget_host, blink::WebInputEvent::Type::kTouchCancel);
-    render_widget_host->QueueSyntheticGesture(
-        std::move(gesture), base::Bind([](SyntheticGesture::Result) {}));
+    render_widget_host->QueueSyntheticGestureCompleteImmediately(
+        std::move(gesture));
     // Wait for synthetic cancel event to be sent.
     input_event_ack_waiter.Wait();
     portal_interceptor->WaitForActivate();
@@ -1028,8 +915,8 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, GestureCleanedUpBeforeActivation) {
     PortalCreatedObserver adoption_observer(portal_frame);
     std::unique_ptr<SyntheticTapGesture> gesture =
         std::make_unique<SyntheticTapGesture>(params);
-    render_widget_host->QueueSyntheticGesture(
-        std::move(gesture), base::Bind([](SyntheticGesture::Result) {}));
+    render_widget_host->QueueSyntheticGestureCompleteImmediately(
+        std::move(gesture));
     portal_interceptor->WaitForActivate();
     EXPECT_EQ(portal_contents, shell()->web_contents());
     adopted_portal = adoption_observer.WaitUntilPortalCreated();
@@ -1053,6 +940,123 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, GestureCleanedUpBeforeActivation) {
 }
 #endif
 
+// Touch input transfer is only implemented in the content layer for Aura.
+#if defined(USE_AURA)
+IN_PROC_BROWSER_TEST_F(PortalBrowserTest, TouchInputTransferAcrossActivation) {
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL("portal.test", "/portals/scroll.html")));
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
+  RenderWidgetHostImpl* render_widget_host = main_frame->GetRenderWidgetHost();
+
+  // Create portal and wait for navigation.
+  Portal* portal = nullptr;
+  {
+    PortalCreatedObserver portal_created_observer(main_frame);
+    GURL portal_url(embedded_test_server()->GetURL(
+        "portal.test", "/portals/scroll-portal.html"));
+    EXPECT_TRUE(ExecJs(
+        main_frame, JsReplace("var portal = document.createElement('portal');"
+                              "portal.src = $1;"
+                              "document.body.appendChild(portal);",
+                              portal_url)));
+    portal = portal_created_observer.WaitUntilPortalCreated();
+  }
+  WebContentsImpl* portal_contents = portal->GetPortalContents();
+  RenderFrameHostImpl* portal_frame = portal_contents->GetMainFrame();
+  // The portal should not have navigated yet, wait for the first navigation.
+  TestNavigationObserver navigation_observer(portal_contents);
+  navigation_observer.Wait();
+  WaitForHitTestData(portal_frame);
+
+  // Create and dispatch a synthetic scroll to trigger activation.
+  SyntheticSmoothScrollGestureParams params;
+  params.gesture_source_type = SyntheticGestureParams::TOUCH_INPUT;
+  params.anchor = gfx::PointF(50, 150);
+  params.distances.push_back(-gfx::Vector2d(0, 100));
+
+  std::unique_ptr<SyntheticSmoothScrollGesture> gesture =
+      std::make_unique<SyntheticSmoothScrollGesture>(params);
+  base::RunLoop run_loop;
+  render_widget_host->QueueSyntheticGesture(
+      std::move(gesture),
+      base::BindLambdaForTesting([&](SyntheticGesture::Result result) {
+        EXPECT_EQ(SyntheticGesture::Result::GESTURE_FINISHED, result);
+        run_loop.Quit();
+      }));
+  run_loop.Run();
+
+  // Check if the activated page scrolled.
+  EXPECT_NE(0, EvalJs(portal_frame, "window.scrollY"));
+}
+#endif
+
+// TODO(crbug.com/1010675): Test fails flakily.
+// Touch input transfer is only implemented in the content layer for Aura.
+#if defined(USE_AURA)
+IN_PROC_BROWSER_TEST_F(PortalBrowserTest,
+                       DISABLED_TouchInputTransferAcrossReactivation) {
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL(
+                   "portal.test",
+                   "/portals/touch-input-transfer-across-reactivation.html")));
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
+  RenderWidgetHostImpl* render_widget_host = main_frame->GetRenderWidgetHost();
+
+  // Create portal and wait for navigation.
+  Portal* portal = nullptr;
+  {
+    PortalCreatedObserver portal_created_observer(main_frame);
+    GURL portal_url(embedded_test_server()->GetURL(
+        "portal.test", "/portals/reactivate-predecessor.html"));
+    EXPECT_TRUE(ExecJs(
+        main_frame, JsReplace("var portal = document.createElement('portal');"
+                              "portal.src = $1;"
+                              "document.body.appendChild(portal);",
+                              portal_url)));
+    portal = portal_created_observer.WaitUntilPortalCreated();
+  }
+  WebContentsImpl* portal_contents = portal->GetPortalContents();
+  // The portal should not have navigated yet, wait for the first navigation.
+  TestNavigationObserver navigation_observer(portal_contents);
+  navigation_observer.Wait();
+
+  PortalInterceptorForTesting* portal_interceptor =
+      PortalInterceptorForTesting::From(portal);
+
+  // Create and dispatch a synthetic scroll to trigger activation.
+  SyntheticSmoothScrollGestureParams params;
+  params.gesture_source_type = SyntheticGestureParams::TOUCH_INPUT;
+  params.anchor = gfx::PointF(50, 150);
+  params.distances.push_back(-gfx::Vector2d(0, 1000));
+
+  std::unique_ptr<SyntheticSmoothScrollGesture> gesture =
+      std::make_unique<SyntheticSmoothScrollGesture>(params);
+  base::RunLoop run_loop;
+  render_widget_host->QueueSyntheticGesture(
+      std::move(gesture),
+      base::BindLambdaForTesting([&](SyntheticGesture::Result result) {
+        EXPECT_EQ(SyntheticGesture::Result::GESTURE_FINISHED, result);
+        run_loop.Quit();
+      }));
+  // Portal should activate when the gesture begins.
+  portal_interceptor->WaitForActivate();
+  // Wait till the scroll gesture finishes.
+  run_loop.Run();
+  // The predecessor should have been reactivated (we should be back to the
+  // starting page).
+  EXPECT_EQ(web_contents_impl, shell()->web_contents());
+  // The starting page should have scrolled.
+  // NOTE: This assumes that the scroll gesture is long enough that touch events
+  // are still sent after the predecessor is reactivated.
+  EXPECT_NE(0, EvalJs(main_frame, "window.scrollY"));
+}
+#endif
+
 // Tests that the outer FrameTreeNode is deleted after activation.
 IN_PROC_BROWSER_TEST_F(PortalBrowserTest, FrameDeletedAfterActivation) {
   EXPECT_TRUE(NavigateToURL(
@@ -1180,6 +1184,45 @@ IN_PROC_BROWSER_TEST_F(PortalBrowserTest, OrphanedNavigation) {
   main_frame_navigation_observer.Wait();
 }
 
+// Tests that the browser doesn't crash if the renderer tries to create the
+// PortalHost after the parent renderer dropped the portal.
+IN_PROC_BROWSER_TEST_F(PortalBrowserTest,
+                       AccessPortalHostAfterPortalDestruction) {
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("portal.test", "/title1.html")));
+  WebContentsImpl* web_contents_impl =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderFrameHostImpl* main_frame = web_contents_impl->GetMainFrame();
+
+  Portal* portal = nullptr;
+  {
+    PortalCreatedObserver portal_created_observer(main_frame);
+    GURL a_url(embedded_test_server()->GetURL("a.com", "/title1.html"));
+    EXPECT_TRUE(ExecJs(
+        main_frame, JsReplace("var portal = document.createElement('portal');"
+                              "portal.src = $1;"
+                              "document.body.appendChild(portal);",
+                              a_url)));
+    portal = portal_created_observer.WaitUntilPortalCreated();
+  }
+  WebContentsImpl* portal_contents = portal->GetPortalContents();
+  RenderFrameHostImpl* portal_frame = portal_contents->GetMainFrame();
+
+  // The portal should not have navigated yet; wait for the first navigation.
+  TestNavigationObserver navigation_observer(portal_contents);
+  navigation_observer.Wait();
+
+  // Simulate the portal being dropped, but not the destruction of the
+  // WebContents.
+  portal->GetBindingForTesting()->SwapImplForTesting(nullptr);
+
+  // Get the portal renderer to access the WebContents.
+  RenderProcessHostKillWaiter kill_waiter(portal_frame->GetProcess());
+  ExecuteScriptAsync(portal_frame,
+                     "window.portalHost.postMessage('message', '*');");
+  EXPECT_EQ(bad_message::RPH_MOJO_PROCESS_ERROR, kill_waiter.Wait());
+}
+
 class PortalOOPIFBrowserTest : public PortalBrowserTest {
  protected:
   PortalOOPIFBrowserTest() {}
diff --git a/chromium/content/browser/portal/portal_created_observer.cc b/chromium/content/browser/portal/portal_created_observer.cc
new file mode 100644
index 00000000000..1a563fffe61
--- /dev/null
+++ b/chromium/content/browser/portal/portal_created_observer.cc
@@ -0,0 +1,86 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/portal/portal_created_observer.h"
+
+#include <utility>
+#include "base/run_loop.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/frame_host/render_frame_proxy_host.h"
+#include "content/browser/portal/portal.h"
+#include "content/browser/portal/portal_interceptor_for_testing.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+
+namespace content {
+
+PortalCreatedObserver::PortalCreatedObserver(
+    RenderFrameHostImpl* render_frame_host_impl)
+    : render_frame_host_impl_(render_frame_host_impl) {
+  old_impl_ = render_frame_host_impl_->frame_host_receiver_for_testing()
+                  .SwapImplForTesting(this);
+}
+
+PortalCreatedObserver::~PortalCreatedObserver() {
+  render_frame_host_impl_->frame_host_receiver_for_testing().SwapImplForTesting(
+      old_impl_);
+}
+
+mojom::FrameHost* PortalCreatedObserver::GetForwardingInterface() {
+  return render_frame_host_impl_;
+}
+
+void PortalCreatedObserver::CreatePortal(
+    mojo::PendingAssociatedReceiver<blink::mojom::Portal> portal,
+    mojo::PendingAssociatedRemote<blink::mojom::PortalClient> client,
+    CreatePortalCallback callback) {
+  PortalInterceptorForTesting* portal_interceptor =
+      PortalInterceptorForTesting::Create(
+          render_frame_host_impl_, std::move(portal),
+          mojo::AssociatedRemote<blink::mojom::PortalClient>(
+              std::move(client)));
+  portal_ = portal_interceptor->GetPortal();
+  RenderFrameProxyHost* proxy_host = portal_->CreateProxyAndAttachPortal();
+  std::move(callback).Run(proxy_host->GetRoutingID(), portal_->portal_token(),
+                          portal_->GetDevToolsFrameToken());
+
+  if (run_loop_)
+    run_loop_->Quit();
+}
+
+void PortalCreatedObserver::AdoptPortal(
+    const base::UnguessableToken& portal_token,
+    AdoptPortalCallback callback) {
+  Portal* portal = Portal::FromToken(portal_token);
+  PortalInterceptorForTesting* portal_interceptor =
+      PortalInterceptorForTesting::Create(render_frame_host_impl_, portal);
+  portal_ = portal_interceptor->GetPortal();
+  RenderFrameProxyHost* proxy_host = portal_->CreateProxyAndAttachPortal();
+  std::move(callback).Run(
+      proxy_host->GetRoutingID(),
+      proxy_host->frame_tree_node()->current_replication_state(),
+      portal->GetDevToolsFrameToken());
+
+  if (run_loop_)
+    run_loop_->Quit();
+}
+
+Portal* PortalCreatedObserver::WaitUntilPortalCreated() {
+  Portal* portal = portal_;
+  if (portal) {
+    portal_ = nullptr;
+    return portal;
+  }
+
+  base::RunLoop run_loop;
+  run_loop_ = &run_loop;
+  run_loop.Run();
+  run_loop_ = nullptr;
+
+  portal = portal_;
+  portal_ = nullptr;
+  return portal;
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/portal/portal_created_observer.h b/chromium/content/browser/portal/portal_created_observer.h
new file mode 100644
index 00000000000..a638cbca6f4
--- /dev/null
+++ b/chromium/content/browser/portal/portal_created_observer.h
@@ -0,0 +1,51 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_PORTAL_PORTAL_CREATED_OBSERVER_H_
+#define CONTENT_BROWSER_PORTAL_PORTAL_CREATED_OBSERVER_H_
+
+#include "content/common/frame.mojom-test-utils.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "third_party/blink/public/mojom/portal/portal.mojom.h"
+
+namespace base {
+class RunLoop;
+}  // namespace base
+
+namespace content {
+
+class Portal;
+class RenderFrameHostImpl;
+
+// The PortalCreatedObserver observes portal creations on
+// |render_frame_host_impl|. This observer can be used to monitor for multiple
+// Portal creations on the same RenderFrameHost, by repeatedly calling
+// WaitUntilPortalCreated().
+class PortalCreatedObserver : public mojom::FrameHostInterceptorForTesting {
+ public:
+  explicit PortalCreatedObserver(RenderFrameHostImpl* render_frame_host_impl);
+  ~PortalCreatedObserver() override;
+
+  // mojom::FrameHostInterceptorForTesting
+  mojom::FrameHost* GetForwardingInterface() override;
+  void CreatePortal(
+      mojo::PendingAssociatedReceiver<blink::mojom::Portal> portal,
+      mojo::PendingAssociatedRemote<blink::mojom::PortalClient> client,
+      CreatePortalCallback callback) override;
+  void AdoptPortal(const base::UnguessableToken& portal_token,
+                   AdoptPortalCallback callback) override;
+
+  Portal* WaitUntilPortalCreated();
+
+ private:
+  RenderFrameHostImpl* render_frame_host_impl_;
+  mojom::FrameHost* old_impl_;
+  base::RunLoop* run_loop_ = nullptr;
+  Portal* portal_ = nullptr;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_PORTAL_PORTAL_CREATED_OBSERVER_H_
diff --git a/chromium/content/browser/portal/portal_interceptor_for_testing.cc b/chromium/content/browser/portal/portal_interceptor_for_testing.cc
new file mode 100644
index 00000000000..00339b0e261
--- /dev/null
+++ b/chromium/content/browser/portal/portal_interceptor_for_testing.cc
@@ -0,0 +1,111 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/portal/portal_interceptor_for_testing.h"
+
+#include <utility>
+#include "base/logging.h"
+#include "base/memory/ptr_util.h"
+#include "base/run_loop.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "mojo/public/cpp/bindings/strong_associated_binding.h"
+
+namespace content {
+
+// static
+PortalInterceptorForTesting* PortalInterceptorForTesting::Create(
+    RenderFrameHostImpl* render_frame_host_impl,
+    mojo::PendingAssociatedReceiver<blink::mojom::Portal> receiver,
+    mojo::AssociatedRemote<blink::mojom::PortalClient> client) {
+  auto test_portal_ptr =
+      base::WrapUnique(new PortalInterceptorForTesting(render_frame_host_impl));
+  PortalInterceptorForTesting* test_portal = test_portal_ptr.get();
+  test_portal->GetPortal()->SetBindingForTesting(
+      mojo::MakeStrongAssociatedBinding<blink::mojom::Portal>(
+          std::move(test_portal_ptr), std::move(receiver)));
+  test_portal->GetPortal()->SetClientForTesting(std::move(client));
+  return test_portal;
+}
+
+PortalInterceptorForTesting* PortalInterceptorForTesting::Create(
+    RenderFrameHostImpl* render_frame_host_impl,
+    content::Portal* portal) {
+  // Take ownership of the portal.
+  std::unique_ptr<blink::mojom::Portal> mojom_portal_ptr =
+      portal->GetBindingForTesting()->SwapImplForTesting(nullptr);
+  std::unique_ptr<content::Portal> portal_ptr = base::WrapUnique(
+      static_cast<content::Portal*>(mojom_portal_ptr.release()));
+
+  // Create PortalInterceptorForTesting.
+  auto test_portal_ptr = base::WrapUnique(new PortalInterceptorForTesting(
+      render_frame_host_impl, std::move(portal_ptr)));
+  PortalInterceptorForTesting* test_portal = test_portal_ptr.get();
+
+  // Set the binding for the PortalInterceptorForTesting.
+  portal->GetBindingForTesting()->SwapImplForTesting(
+      std::move(test_portal_ptr));
+
+  return test_portal;
+}
+
+// static
+PortalInterceptorForTesting* PortalInterceptorForTesting::From(
+    content::Portal* portal) {
+  blink::mojom::Portal* impl = portal->GetBindingForTesting()->impl();
+  auto* interceptor = static_cast<PortalInterceptorForTesting*>(impl);
+  CHECK_NE(static_cast<blink::mojom::Portal*>(portal), impl);
+  CHECK_EQ(interceptor->GetPortal(), portal);
+  return interceptor;
+}
+
+PortalInterceptorForTesting::PortalInterceptorForTesting(
+    RenderFrameHostImpl* render_frame_host_impl)
+    : portal_(content::Portal::CreateForTesting(render_frame_host_impl)) {}
+
+PortalInterceptorForTesting::PortalInterceptorForTesting(
+    RenderFrameHostImpl* render_frame_host_impl,
+    std::unique_ptr<content::Portal> portal)
+    : portal_(std::move(portal)) {}
+
+PortalInterceptorForTesting::~PortalInterceptorForTesting() = default;
+
+blink::mojom::Portal* PortalInterceptorForTesting::GetForwardingInterface() {
+  return portal_.get();
+}
+
+void PortalInterceptorForTesting::Activate(blink::TransferableMessage data,
+                                           ActivateCallback callback) {
+  portal_activated_ = true;
+
+  if (run_loop_) {
+    run_loop_->Quit();
+    run_loop_ = nullptr;
+  }
+
+  // |this| can be destroyed after Activate() is called.
+  portal_->Activate(std::move(data), std::move(callback));
+}
+
+void PortalInterceptorForTesting::Navigate(
+    const GURL& url,
+    blink::mojom::ReferrerPtr referrer,
+    blink::mojom::Portal::NavigateCallback callback) {
+  if (navigate_callback_) {
+    navigate_callback_.Run(url, std::move(referrer), std::move(callback));
+    return;
+  }
+
+  portal_->Navigate(url, std::move(referrer), std::move(callback));
+}
+
+void PortalInterceptorForTesting::WaitForActivate() {
+  if (portal_activated_)
+    return;
+
+  base::RunLoop run_loop;
+  run_loop_ = &run_loop;
+  run_loop.Run();
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/portal/portal_interceptor_for_testing.h b/chromium/content/browser/portal/portal_interceptor_for_testing.h
new file mode 100644
index 00000000000..ff8bab4c865
--- /dev/null
+++ b/chromium/content/browser/portal/portal_interceptor_for_testing.h
@@ -0,0 +1,77 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_PORTAL_PORTAL_INTERCEPTOR_FOR_TESTING_H_
+#define CONTENT_BROWSER_PORTAL_PORTAL_INTERCEPTOR_FOR_TESTING_H_
+
+#include <memory>
+
+#include "base/callback.h"
+#include "content/browser/portal/portal.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "third_party/blink/public/mojom/portal/portal.mojom-test-utils.h"
+#include "third_party/blink/public/mojom/portal/portal.mojom.h"
+
+namespace base {
+class RunLoop;
+}  // namespace base
+
+namespace content {
+
+class RenderFrameHostImpl;
+
+// The PortalInterceptorForTesting can be used in tests to inspect Portal IPCs.
+class PortalInterceptorForTesting final
+    : public blink::mojom::PortalInterceptorForTesting {
+ public:
+  static PortalInterceptorForTesting* Create(
+      RenderFrameHostImpl* render_frame_host_impl,
+      mojo::PendingAssociatedReceiver<blink::mojom::Portal> receiver,
+      mojo::AssociatedRemote<blink::mojom::PortalClient> client);
+  static PortalInterceptorForTesting* Create(
+      RenderFrameHostImpl* render_frame_host_impl,
+      content::Portal* portal);
+  static PortalInterceptorForTesting* From(content::Portal* portal);
+
+  ~PortalInterceptorForTesting() override;
+
+  // blink::mojom::PortalInterceptorForTesting
+  blink::mojom::Portal* GetForwardingInterface() override;
+  void Activate(blink::TransferableMessage data,
+                ActivateCallback callback) override;
+  void Navigate(const GURL& url,
+                blink::mojom::ReferrerPtr referrer,
+                blink::mojom::Portal::NavigateCallback callback) override;
+
+  // If set, will be used to replace the implementation of Navigate.
+  using NavigateCallback =
+      base::RepeatingCallback<void(const GURL&,
+                                   blink::mojom::ReferrerPtr,
+                                   blink::mojom::Portal::NavigateCallback)>;
+  void SetNavigateCallback(NavigateCallback callback) {
+    navigate_callback_ = std::move(callback);
+  }
+
+  void WaitForActivate();
+
+  // Test getters.
+  content::Portal* GetPortal() { return portal_.get(); }
+  WebContentsImpl* GetPortalContents() { return portal_->GetPortalContents(); }
+
+ private:
+  explicit PortalInterceptorForTesting(
+      RenderFrameHostImpl* render_frame_host_impl);
+  PortalInterceptorForTesting(RenderFrameHostImpl* render_frame_host_impl,
+                              std::unique_ptr<content::Portal> portal);
+
+  std::unique_ptr<content::Portal> portal_;
+  NavigateCallback navigate_callback_;
+  bool portal_activated_ = false;
+  base::RunLoop* run_loop_ = nullptr;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_PORTAL_PORTAL_INTERCEPTOR_FOR_TESTING_H_
diff --git a/chromium/content/browser/power_monitor_browsertest.cc b/chromium/content/browser/power_monitor_browsertest.cc
index 667d4d9c465..998a1913e18 100644
--- a/chromium/content/browser/power_monitor_browsertest.cc
+++ b/chromium/content/browser/power_monitor_browsertest.cc
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
@@ -9,23 +11,26 @@
 #include "base/task/post_task.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/utility_process_host.h"
+#include "content/public/browser/browser_child_process_host.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/child_process_data.h"
 #include "content/public/browser/gpu_service_registry.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
-#include "content/public/common/service_names.mojom.h"
+#include "content/public/common/process_type.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/shell/common/power_monitor_test.mojom.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
-#include "mojo/public/cpp/bindings/interface_ptr_set.h"
-#include "services/device/public/mojom/constants.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/remote_set.h"
 #include "services/device/public/mojom/power_monitor.mojom.h"
-#include "services/service_manager/public/cpp/service_binding.h"
 
 namespace content {
 
@@ -44,17 +49,19 @@ void VerifyPowerStateInChildProcess(mojom::PowerMonitorTest* power_monitor_test,
   run_loop.Run();
 }
 
-void StartUtilityProcessOnIOThread(mojom::PowerMonitorTestRequest request) {
+void StartUtilityProcessOnIOThread(
+    mojo::PendingReceiver<mojom::PowerMonitorTest> receiver) {
   UtilityProcessHost* host = new UtilityProcessHost();
   host->SetMetricsName("test_process");
   host->SetName(base::ASCIIToUTF16("TestProcess"));
   EXPECT_TRUE(host->Start());
 
-  BindInterface(host, std::move(request));
+  BindInterface(host, std::move(receiver));
 }
 
-void BindInterfaceForGpuOnIOThread(mojom::PowerMonitorTestRequest request) {
-  BindInterfaceInGpuProcess(std::move(request));
+void BindInterfaceForGpuOnIOThread(
+    mojo::PendingReceiver<mojom::PowerMonitorTest> receiver) {
+  BindInterfaceInGpuProcess(std::move(receiver));
 }
 
 class MockPowerMonitorMessageBroadcaster : public device::mojom::PowerMonitor {
@@ -62,30 +69,38 @@ class MockPowerMonitorMessageBroadcaster : public device::mojom::PowerMonitor {
   MockPowerMonitorMessageBroadcaster() = default;
   ~MockPowerMonitorMessageBroadcaster() override = default;
 
-  void Bind(device::mojom::PowerMonitorRequest request) {
-    bindings_.AddBinding(this, std::move(request));
+  void Bind(mojo::PendingReceiver<device::mojom::PowerMonitor> receiver) {
+    base::PostTask(
+        FROM_HERE, {BrowserThread::UI},
+        base::BindOnce(&MockPowerMonitorMessageBroadcaster::BindOnMainThread,
+                       base::Unretained(this), std::move(receiver)));
   }
 
   // device::mojom::PowerMonitor:
-  void AddClient(
-      device::mojom::PowerMonitorClientPtr power_monitor_client) override {
+  void AddClient(mojo::PendingRemote<device::mojom::PowerMonitorClient>
+                     pending_power_monitor_client) override {
+    mojo::Remote<device::mojom::PowerMonitorClient> power_monitor_client(
+        std::move(pending_power_monitor_client));
     power_monitor_client->PowerStateChange(on_battery_power_);
-    clients_.AddPtr(std::move(power_monitor_client));
+    clients_.Add(std::move(power_monitor_client));
   }
 
   void OnPowerStateChange(bool on_battery_power) {
     on_battery_power_ = on_battery_power;
-    clients_.ForAllPtrs(
-        [&on_battery_power](device::mojom::PowerMonitorClient* client) {
-          client->PowerStateChange(on_battery_power);
-        });
+    for (auto& client : clients_)
+      client->PowerStateChange(on_battery_power);
   }
 
  private:
+  void BindOnMainThread(
+      mojo::PendingReceiver<device::mojom::PowerMonitor> receiver) {
+    receivers_.Add(this, std::move(receiver));
+  }
+
   bool on_battery_power_ = false;
 
-  mojo::BindingSet<device::mojom::PowerMonitor> bindings_;
-  mojo::InterfacePtrSet<device::mojom::PowerMonitorClient> clients_;
+  mojo::ReceiverSet<device::mojom::PowerMonitor> receivers_;
+  mojo::RemoteSet<device::mojom::PowerMonitorClient> clients_;
 
   DISALLOW_COPY_AND_ASSIGN(MockPowerMonitorMessageBroadcaster);
 };
@@ -93,39 +108,53 @@ class MockPowerMonitorMessageBroadcaster : public device::mojom::PowerMonitor {
 class PowerMonitorTest : public ContentBrowserTest {
  public:
   PowerMonitorTest() {
-    // Because Device Service also runs in this process(browser process), we can
-    // set our binder to intercept requests for PowerMonitor interface to it.
-    service_manager::ServiceBinding::OverrideInterfaceBinderForTesting(
-        device::mojom::kServiceName,
-        base::Bind(&PowerMonitorTest::BindPowerMonitor,
-                   base::Unretained(this)));
+    // Intercept PowerMonitor binding requests from all types of child
+    // processes.
+    RenderProcessHost::InterceptBindHostReceiverForTesting(base::BindRepeating(
+        &PowerMonitorTest::BindForRenderer, base::Unretained(this)));
+    BrowserChildProcessHost::InterceptBindHostReceiverForTesting(
+        base::BindRepeating(&PowerMonitorTest::BindForNonRenderer,
+                            base::Unretained(this)));
   }
 
   ~PowerMonitorTest() override {
-    service_manager::ServiceBinding::ClearInterfaceBinderOverrideForTesting<
-        device::mojom::PowerMonitor>(device::mojom::kServiceName);
+    RenderProcessHost::InterceptBindHostReceiverForTesting(
+        base::NullCallback());
+    BrowserChildProcessHost::InterceptBindHostReceiverForTesting(
+        base::NullCallback());
   }
 
-  void BindPowerMonitor(const service_manager::BindSourceInfo& source_info,
-                        device::mojom::PowerMonitorRequest request) {
-    if (source_info.identity.name() == mojom::kRendererServiceName) {
-      // We can receive binding requests for the spare RenderProcessHost - this
-      // might happen before the test has provided the
-      // |renderer_bound_closure_|.
-      if (renderer_bound_closure_) {
-        ++request_count_from_renderer_;
-        std::move(renderer_bound_closure_).Run();
-      } else {
-        DCHECK(RenderProcessHostImpl::GetSpareRenderProcessHostForTesting());
-      }
-    } else if (source_info.identity.name() == mojom::kUtilityServiceName) {
-      // If the network service is enabled, it will create utility processes
-      // without a utility closure.
+  void BindForRenderer(int render_process_id,
+                       mojo::GenericPendingReceiver* receiver) {
+    auto r = receiver->As<device::mojom::PowerMonitor>();
+    if (!r)
+      return;
+
+    // We can receiver binding requests for the spare RenderProcessHost -- this
+    // might happen before the test has provided the |renderer_bound_closure_|.
+    if (renderer_bound_closure_) {
+      ++request_count_from_renderer_;
+      std::move(renderer_bound_closure_).Run();
+    } else {
+      DCHECK(RenderProcessHostImpl::GetSpareRenderProcessHostForTesting());
+    }
+
+    power_monitor_message_broadcaster_.Bind(std::move(r));
+  }
+
+  void BindForNonRenderer(BrowserChildProcessHost* process_host,
+                          mojo::GenericPendingReceiver* receiver) {
+    auto r = receiver->As<device::mojom::PowerMonitor>();
+    if (!r)
+      return;
+
+    const int type = process_host->GetData().process_type;
+    if (type == PROCESS_TYPE_UTILITY) {
       if (utility_bound_closure_) {
         ++request_count_from_utility_;
         std::move(utility_bound_closure_).Run();
       }
-    } else if (source_info.identity.name() == mojom::kGpuServiceName) {
+    } else if (type == PROCESS_TYPE_GPU) {
       ++request_count_from_gpu_;
 
       // We ignore null gpu_bound_closure_ here for two possible scenarios:
@@ -140,16 +169,18 @@ class PowerMonitorTest : public ContentBrowserTest {
         std::move(gpu_bound_closure_).Run();
     }
 
-    power_monitor_message_broadcaster_.Bind(std::move(request));
+    power_monitor_message_broadcaster_.Bind(std::move(r));
   }
 
  protected:
-  void StartUtilityProcess(mojom::PowerMonitorTestPtr* power_monitor_test,
-                           base::Closure utility_bound_closure) {
+  void StartUtilityProcess(
+      mojo::Remote<mojom::PowerMonitorTest>* power_monitor_test,
+      base::Closure utility_bound_closure) {
     utility_bound_closure_ = std::move(utility_bound_closure);
-    base::PostTask(FROM_HERE, {BrowserThread::IO},
-                   base::BindOnce(&StartUtilityProcessOnIOThread,
-                                  mojo::MakeRequest(power_monitor_test)));
+    base::PostTask(
+        FROM_HERE, {BrowserThread::IO},
+        base::BindOnce(&StartUtilityProcessOnIOThread,
+                       power_monitor_test->BindNewPipeAndPassReceiver()));
   }
 
   void set_renderer_bound_closure(base::Closure closure) {
@@ -189,14 +220,16 @@ IN_PROC_BROWSER_TEST_F(PowerMonitorTest, TestRendererProcess) {
   run_loop.Run();
   EXPECT_EQ(1, request_count_from_renderer());
 
-  mojom::PowerMonitorTestPtr power_monitor_renderer;
+  mojo::PendingRemote<mojom::PowerMonitorTest> pending_power_monitor_renderer;
   RenderProcessHost* rph =
       shell()->web_contents()->GetMainFrame()->GetProcess();
-  BindInterface(rph, &power_monitor_renderer);
+  BindInterface(rph, &pending_power_monitor_renderer);
 
   // Ensure that the PowerMonitorTestImpl instance has been created and is
   // observing power state changes in the child process before simulating a
   // power state change.
+  mojo::Remote<mojom::PowerMonitorTest> power_monitor_renderer(
+      std::move(pending_power_monitor_renderer));
   power_monitor_renderer.FlushForTesting();
 
   SimulatePowerStateChange(true);
@@ -209,7 +242,7 @@ IN_PROC_BROWSER_TEST_F(PowerMonitorTest, TestRendererProcess) {
 }
 
 IN_PROC_BROWSER_TEST_F(PowerMonitorTest, TestUtilityProcess) {
-  mojom::PowerMonitorTestPtr power_monitor_utility;
+  mojo::Remote<mojom::PowerMonitorTest> power_monitor_utility;
 
   ASSERT_EQ(0, request_count_from_utility());
   base::RunLoop run_loop;
@@ -245,10 +278,11 @@ IN_PROC_BROWSER_TEST_F(PowerMonitorTest, TestGpuProcess) {
   }
   EXPECT_EQ(1, request_count_from_gpu());
 
-  mojom::PowerMonitorTestPtr power_monitor_gpu;
-  base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&BindInterfaceForGpuOnIOThread,
-                                mojo::MakeRequest(&power_monitor_gpu)));
+  mojo::Remote<mojom::PowerMonitorTest> power_monitor_gpu;
+  base::PostTask(
+      FROM_HERE, {BrowserThread::IO},
+      base::BindOnce(&BindInterfaceForGpuOnIOThread,
+                     power_monitor_gpu.BindNewPipeAndPassReceiver()));
 
   // Ensure that the PowerMonitorTestImpl instance has been created and is
   // observing power state changes in the child process before simulating a
diff --git a/chromium/content/browser/ppapi_plugin_process_host.cc b/chromium/content/browser/ppapi_plugin_process_host.cc
index e1a977f1a71..b906149ca57 100644
--- a/chromium/content/browser/ppapi_plugin_process_host.cc
+++ b/chromium/content/browser/ppapi_plugin_process_host.cc
@@ -27,6 +27,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/network_service_instance.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/pepper_plugin_info.h"
@@ -50,11 +51,6 @@
 #include "ui/gfx/font_render_params.h"
 #endif
 
-#if defined(OS_LINUX)
-#include "components/services/font/public/mojom/font_service.mojom.h"  // nogncheck
-#include "content/browser/font_service.h"  // nogncheck
-#endif
-
 #if BUILDFLAG(USE_ZYGOTE_HANDLE)
 #include "services/service_manager/zygote/common/zygote_handle.h"  // nogncheck
 #endif
@@ -487,21 +483,13 @@ void PpapiPluginProcessHost::OnProcessLaunched() {
 
 void PpapiPluginProcessHost::OnProcessCrashed(int exit_code) {
   VLOG(1) << "ppapi plugin process crashed.";
-  base::PostTaskWithTraits(
+  base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&PluginServiceImpl::RegisterPluginCrash,
                      base::Unretained(PluginServiceImpl::GetInstance()),
                      plugin_path_));
 }
 
-void PpapiPluginProcessHost::BindHostReceiver(
-    mojo::GenericPendingReceiver receiver) {
-#if defined(OS_LINUX)
-  if (auto font_receiver = receiver.As<font_service::mojom::FontService>())
-    ConnectToFontService(std::move(font_receiver));
-#endif
-}
-
 bool PpapiPluginProcessHost::OnMessageReceived(const IPC::Message& msg) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(PpapiPluginProcessHost, msg)
diff --git a/chromium/content/browser/ppapi_plugin_process_host_receiver_bindings.cc b/chromium/content/browser/ppapi_plugin_process_host_receiver_bindings.cc
new file mode 100644
index 00000000000..28bac363b53
--- /dev/null
+++ b/chromium/content/browser/ppapi_plugin_process_host_receiver_bindings.cc
@@ -0,0 +1,26 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This exposes services in the browser to the PPAPI process.
+
+#include "content/browser/ppapi_plugin_process_host.h"
+
+#include "build/build_config.h"
+
+#if defined(OS_LINUX)
+#include "components/services/font/public/mojom/font_service.mojom.h"  // nogncheck
+#include "content/browser/font_service.h"  // nogncheck
+#endif
+
+namespace content {
+
+void PpapiPluginProcessHost::BindHostReceiver(
+    mojo::GenericPendingReceiver receiver) {
+#if defined(OS_LINUX)
+  if (auto font_receiver = receiver.As<font_service::mojom::FontService>())
+    ConnectToFontService(std::move(font_receiver));
+#endif
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/process_internals/process_internals_browsertest.cc b/chromium/content/browser/process_internals/process_internals_browsertest.cc
new file mode 100644
index 00000000000..0febc131890
--- /dev/null
+++ b/chromium/content/browser/process_internals/process_internals_browsertest.cc
@@ -0,0 +1,36 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/child_process_security_policy_impl.h"
+#include "content/browser/renderer_host/render_process_host_impl.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+
+namespace content {
+
+class ProcessInternalsWebUiBrowserTest : public ContentBrowserTest {};
+
+// This test verifies that loading of the process-internals WebUI works
+// correctly and the process rendering it has no WebUI bindings.
+IN_PROC_BROWSER_TEST_F(ProcessInternalsWebUiBrowserTest, NoProcessBindings) {
+  GURL url("chrome://process-internals/#web-contents");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetMainFrame()->GetProcess()->GetID()));
+
+  // Execute script to ensure the page has loaded correctly and was successful
+  // at retrieving data from the browser process.
+  // Note: This requires using an isolated world in which to execute the
+  // script because WebUI has a default CSP policy denying "eval()", which is
+  // what EvalJs uses under the hood.
+  EXPECT_NE(-1,
+            EvalJs(shell()->web_contents()->GetMainFrame(),
+                   "document.body.innerHTML.search('Process Model Internals');",
+                   EXECUTE_SCRIPT_DEFAULT_OPTIONS, 1 /* world_id */));
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/process_internals/process_internals_handler_impl.cc b/chromium/content/browser/process_internals/process_internals_handler_impl.cc
index ef1c8617468..5cb68ab97b2 100644
--- a/chromium/content/browser/process_internals/process_internals_handler_impl.cc
+++ b/chromium/content/browser/process_internals/process_internals_handler_impl.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/process_internals/process_internals_handler_impl.h"
 
+#include <string>
 #include <utility>
 #include <vector>
 
@@ -13,6 +14,9 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 
 namespace content {
 
@@ -76,8 +80,8 @@ std::string IsolatedOriginSourceToString(IsolatedOriginSource source) {
 
 ProcessInternalsHandlerImpl::ProcessInternalsHandlerImpl(
     BrowserContext* browser_context,
-    mojo::InterfaceRequest<::mojom::ProcessInternalsHandler> request)
-    : browser_context_(browser_context), binding_(this, std::move(request)) {}
+    mojo::PendingReceiver<::mojom::ProcessInternalsHandler> receiver)
+    : browser_context_(browser_context), receiver_(this, std::move(receiver)) {}
 
 ProcessInternalsHandlerImpl::~ProcessInternalsHandlerImpl() = default;
 
diff --git a/chromium/content/browser/process_internals/process_internals_handler_impl.h b/chromium/content/browser/process_internals/process_internals_handler_impl.h
index 9b58e192831..51a7f01abe1 100644
--- a/chromium/content/browser/process_internals/process_internals_handler_impl.h
+++ b/chromium/content/browser/process_internals/process_internals_handler_impl.h
@@ -7,7 +7,8 @@
 
 #include "content/browser/process_internals/process_internals.mojom.h"
 #include "content/public/browser/web_contents_observer.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 
 namespace content {
 
@@ -18,7 +19,7 @@ class ProcessInternalsHandlerImpl : public ::mojom::ProcessInternalsHandler {
  public:
   ProcessInternalsHandlerImpl(
       BrowserContext* browser_context,
-      mojo::InterfaceRequest<::mojom::ProcessInternalsHandler> request);
+      mojo::PendingReceiver<::mojom::ProcessInternalsHandler> receiver);
   ~ProcessInternalsHandlerImpl() override;
 
   // mojom::ProcessInternalsHandler overrides:
@@ -31,7 +32,7 @@ class ProcessInternalsHandlerImpl : public ::mojom::ProcessInternalsHandler {
 
  private:
   BrowserContext* browser_context_;
-  mojo::Binding<::mojom::ProcessInternalsHandler> binding_;
+  mojo::Receiver<::mojom::ProcessInternalsHandler> receiver_;
 
   DISALLOW_COPY_AND_ASSIGN(ProcessInternalsHandlerImpl);
 };
diff --git a/chromium/content/browser/process_internals/process_internals_ui.cc b/chromium/content/browser/process_internals/process_internals_ui.cc
index e72756365b2..3c7cb28071b 100644
--- a/chromium/content/browser/process_internals/process_internals_ui.cc
+++ b/chromium/content/browser/process_internals/process_internals_ui.cc
@@ -5,9 +5,14 @@
 #include "content/browser/process_internals/process_internals_ui.h"
 
 #include <memory>
+#include <string>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/macros.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/process_internals/process_internals.mojom.h"
+#include "content/browser/process_internals/process_internals_handler_impl.h"
 #include "content/grit/content_resources.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
@@ -16,20 +21,16 @@
 #include "content/public/browser/web_ui_message_handler.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/url_constants.h"
-
-#include "content/browser/process_internals/process_internals.mojom.h"
-#include "content/browser/process_internals/process_internals_handler_impl.h"
-
-#include "content/public/common/bindings_policy.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 
 namespace content {
 
 ProcessInternalsUI::ProcessInternalsUI(WebUI* web_ui)
     : WebUIController(web_ui), WebContentsObserver(web_ui->GetWebContents()) {
-  // Grant only Mojo WebUI bindings, since this WebUI will not use
-  // chrome.send().
-  web_ui->SetBindings(content::BINDINGS_POLICY_MOJO_WEB_UI);
+  // This WebUI does not require any process bindings, so disable it early in
+  // initialization time.
+  web_ui->SetBindings(0);
 
   // Create a WebUIDataSource to serve the HTML/JS files to the WebUI.
   WebUIDataSource* source =
@@ -50,12 +51,18 @@ ProcessInternalsUI::ProcessInternalsUI(WebUI* web_ui)
 
 ProcessInternalsUI::~ProcessInternalsUI() = default;
 
+void ProcessInternalsUI::RenderFrameCreated(RenderFrameHost* rfh) {
+  // Enable the JavaScript Mojo bindings in the renderer process, so the JS
+  // code can call the Mojo APIs exposed by this WebUI.
+  static_cast<RenderFrameHostImpl*>(rfh)->EnableMojoJsBindings();
+}
+
 void ProcessInternalsUI::BindProcessInternalsHandler(
-    ::mojom::ProcessInternalsHandlerRequest request,
+    mojo::PendingReceiver<::mojom::ProcessInternalsHandler> receiver,
     RenderFrameHost* render_frame_host) {
   ui_handler_ = std::make_unique<ProcessInternalsHandlerImpl>(
       render_frame_host->GetSiteInstance()->GetBrowserContext(),
-      std::move(request));
+      std::move(receiver));
 }
 
 void ProcessInternalsUI::OnInterfaceRequestFromFrame(
diff --git a/chromium/content/browser/process_internals/process_internals_ui.h b/chromium/content/browser/process_internals/process_internals_ui.h
index bd2bdc6f0d3..2af16530bc2 100644
--- a/chromium/content/browser/process_internals/process_internals_ui.h
+++ b/chromium/content/browser/process_internals/process_internals_ui.h
@@ -5,9 +5,16 @@
 #ifndef CONTENT_BROWSER_PROCESS_INTERNALS_PROCESS_INTERNALS_UI_H_
 #define CONTENT_BROWSER_PROCESS_INTERNALS_PROCESS_INTERNALS_UI_H_
 
+#include <memory>
+#include <string>
+#include <utility>
+
 #include "content/browser/process_internals/process_internals.mojom.h"
+#include "content/common/frame.mojom.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/browser/web_ui_controller.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/system/message_pipe.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 
 namespace content {
@@ -26,13 +33,14 @@ class ProcessInternalsUI : public WebUIController, public WebContentsObserver {
       content::RenderFrameHost* render_frame_host,
       const std::string& interface_name,
       mojo::ScopedMessagePipeHandle* interface_pipe) override;
+  void RenderFrameCreated(RenderFrameHost* render_frame_host) override;
 
   template <typename Binder>
   void AddHandlerToRegistry(Binder binder) {
     registry_.AddInterface(std::move(binder));
   }
   void BindProcessInternalsHandler(
-      ::mojom::ProcessInternalsHandlerRequest request,
+      mojo::PendingReceiver<::mojom::ProcessInternalsHandler> receiver,
       RenderFrameHost* render_frame_host);
 
  private:
diff --git a/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc b/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc
index 68005176d11..bdfa4f9f076 100644
--- a/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc
+++ b/chromium/content/browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc
@@ -67,7 +67,7 @@ class AccessibilityTreeLinkageWinBrowserTest
 };
 
 IN_PROC_BROWSER_TEST_P(AccessibilityTreeLinkageWinBrowserTest, Linkage) {
-  NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
   GetParentWindow()->SetProperty(
       aura::client::kParentNativeViewAccessibleKey,
diff --git a/chromium/content/browser/renderer_host/clipboard_host_impl.cc b/chromium/content/browser/renderer_host/clipboard_host_impl.cc
index efc7f219a00..4932d48cd82 100644
--- a/chromium/content/browser/renderer_host/clipboard_host_impl.cc
+++ b/chromium/content/browser/renderer_host/clipboard_host_impl.cc
@@ -165,6 +165,32 @@ void ClipboardHostImpl::WriteCustomData(
       pickle, ui::ClipboardFormatType::GetWebCustomDataType());
 }
 
+void ClipboardHostImpl::WriteRawData(const base::string16& format,
+                                     mojo_base::BigBuffer data) {
+  // Windows / X11 clipboards enter an unrecoverable state after registering
+  // some amount of unique formats, and there's no way to un-register these
+  // formats. For these clipboards, use a conservative limit to avoid
+  // registering too many formats, as:
+  // (1) Other native applications may also register clipboard formats.
+  // (2) |registered_formats| only persists over one Chrome Clipboard session.
+  // (3) Chrome also registers other clipboard formats.
+  //
+  // The limit is based on Windows, which has the smallest limit, at 0x4000.
+  // Windows represents clipboard formats using values in 0xC000 - 0xFFFF.
+  // Therefore, Windows supports at most 0x4000 registered formats. Reference:
+  // https://docs.microsoft.com/en-us/windows/win32/api/winuser/nf-winuser-registerclipboardformata
+  static constexpr int kMaxWindowsClipboardFormats = 0x4000;
+  static constexpr int kMaxRegisteredFormats = kMaxWindowsClipboardFormats / 4;
+  static base::NoDestructor<std::set<base::string16>> registered_formats;
+  if (!base::Contains(*registered_formats, format)) {
+    if (registered_formats->size() >= kMaxRegisteredFormats)
+      return;
+    registered_formats->emplace(format);
+  }
+
+  clipboard_writer_->WriteData(format, std::move(data));
+}
+
 void ClipboardHostImpl::WriteBookmark(const std::string& url,
                                       const base::string16& title) {
   clipboard_writer_->WriteBookmark(title, url);
diff --git a/chromium/content/browser/renderer_host/clipboard_host_impl.h b/chromium/content/browser/renderer_host/clipboard_host_impl.h
index 432389d6c66..b16345d10e9 100644
--- a/chromium/content/browser/renderer_host/clipboard_host_impl.h
+++ b/chromium/content/browser/renderer_host/clipboard_host_impl.h
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/base/big_buffer.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "third_party/blink/public/mojom/clipboard/clipboard.mojom.h"
 #include "ui/base/clipboard/clipboard.h"
@@ -62,6 +63,7 @@ class CONTENT_EXPORT ClipboardHostImpl : public blink::mojom::ClipboardHost {
   void WriteSmartPasteMarker() override;
   void WriteCustomData(
       const base::flat_map<base::string16, base::string16>& data) override;
+  void WriteRawData(const base::string16&, mojo_base::BigBuffer) override;
   void WriteBookmark(const std::string& url,
                      const base::string16& title) override;
   void WriteImage(const SkBitmap& bitmap) override;
diff --git a/chromium/content/browser/renderer_host/code_cache_host_impl.cc b/chromium/content/browser/renderer_host/code_cache_host_impl.cc
index ef6d89d72c1..405fba59997 100644
--- a/chromium/content/browser/renderer_host/code_cache_host_impl.cc
+++ b/chromium/content/browser/renderer_host/code_cache_host_impl.cc
@@ -142,7 +142,8 @@ void CodeCacheHostImpl::DidGenerateCacheableMetadata(
   if (!origin_lock)
     return;
 
-  code_cache->WriteData(url, *origin_lock, expected_response_time, data);
+  code_cache->WriteEntry(url, *origin_lock, expected_response_time,
+                         std::move(data));
 }
 
 void CodeCacheHostImpl::FetchCachedCode(blink::mojom::CodeCacheType cache_type,
diff --git a/chromium/content/browser/renderer_host/compositor_dependencies_android.cc b/chromium/content/browser/renderer_host/compositor_dependencies_android.cc
index f741e0cb359..a9bb7e44345 100644
--- a/chromium/content/browser/renderer_host/compositor_dependencies_android.cc
+++ b/chromium/content/browser/renderer_host/compositor_dependencies_android.cc
@@ -4,6 +4,8 @@
 
 #include "content/browser/renderer_host/compositor_dependencies_android.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/system/sys_info.h"
 #include "base/task/post_task.h"
@@ -20,6 +22,7 @@
 #include "content/browser/gpu/gpu_process_host.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 
 namespace content {
 
@@ -95,16 +98,19 @@ CompositorDependenciesAndroid::CompositorDependenciesAndroid()
 CompositorDependenciesAndroid::~CompositorDependenciesAndroid() = default;
 
 void CompositorDependenciesAndroid::CreateVizFrameSinkManager() {
-  viz::mojom::FrameSinkManagerPtr frame_sink_manager;
-  viz::mojom::FrameSinkManagerRequest frame_sink_manager_request =
-      mojo::MakeRequest(&frame_sink_manager);
-  viz::mojom::FrameSinkManagerClientPtr frame_sink_manager_client;
-  viz::mojom::FrameSinkManagerClientRequest frame_sink_manager_client_request =
-      mojo::MakeRequest(&frame_sink_manager_client);
+  mojo::PendingRemote<viz::mojom::FrameSinkManager> frame_sink_manager;
+  mojo::PendingReceiver<viz::mojom::FrameSinkManager>
+      frame_sink_manager_receiver =
+          frame_sink_manager.InitWithNewPipeAndPassReceiver();
+  mojo::PendingRemote<viz::mojom::FrameSinkManagerClient>
+      frame_sink_manager_client;
+  mojo::PendingReceiver<viz::mojom::FrameSinkManagerClient>
+      frame_sink_manager_client_receiver =
+          frame_sink_manager_client.InitWithNewPipeAndPassReceiver();
 
   // Setup HostFrameSinkManager with interface endpoints.
   host_frame_sink_manager_.BindAndSetManager(
-      std::move(frame_sink_manager_client_request),
+      std::move(frame_sink_manager_client_receiver),
       base::ThreadTaskRunnerHandle::Get(), std::move(frame_sink_manager));
 
   // Set up a callback to automatically re-connect if we lose our
@@ -117,8 +123,8 @@ void CompositorDependenciesAndroid::CreateVizFrameSinkManager() {
   // connected to the GPU process.
   pending_connect_viz_on_io_thread_ = base::BindOnce(
       &CompositorDependenciesAndroid::ConnectVizFrameSinkManagerOnIOThread,
-      std::move(frame_sink_manager_request),
-      frame_sink_manager_client.PassInterface());
+      std::move(frame_sink_manager_receiver),
+      std::move(frame_sink_manager_client));
 }
 
 cc::TaskGraphRunner* CompositorDependenciesAndroid::GetTaskGraphRunner() {
@@ -144,12 +150,12 @@ void CompositorDependenciesAndroid::TryEstablishVizConnectionIfNeeded() {
 // re-run when the request is deleted (goes out of scope).
 // static
 void CompositorDependenciesAndroid::ConnectVizFrameSinkManagerOnIOThread(
-    viz::mojom::FrameSinkManagerRequest request,
-    viz::mojom::FrameSinkManagerClientPtrInfo client) {
+    mojo::PendingReceiver<viz::mojom::FrameSinkManager> receiver,
+    mojo::PendingRemote<viz::mojom::FrameSinkManagerClient> client) {
   auto* gpu_process_host = GpuProcessHost::Get();
   if (!gpu_process_host)
     return;
-  gpu_process_host->gpu_host()->ConnectFrameSinkManager(std::move(request),
+  gpu_process_host->gpu_host()->ConnectFrameSinkManager(std::move(receiver),
                                                         std::move(client));
 }
 
diff --git a/chromium/content/browser/renderer_host/compositor_dependencies_android.h b/chromium/content/browser/renderer_host/compositor_dependencies_android.h
index b647c706932..d31f4a7c87f 100644
--- a/chromium/content/browser/renderer_host/compositor_dependencies_android.h
+++ b/chromium/content/browser/renderer_host/compositor_dependencies_android.h
@@ -13,6 +13,8 @@
 #include "base/no_destructor.h"
 #include "components/viz/common/surfaces/frame_sink_id_allocator.h"
 #include "components/viz/host/host_frame_sink_manager.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/viz/privileged/mojom/compositing/frame_sink_manager.mojom.h"
 
 namespace cc {
@@ -50,8 +52,8 @@ class CompositorDependenciesAndroid {
   friend class base::NoDestructor<CompositorDependenciesAndroid>;
 
   static void ConnectVizFrameSinkManagerOnIOThread(
-      viz::mojom::FrameSinkManagerRequest request,
-      viz::mojom::FrameSinkManagerClientPtrInfo client);
+      mojo::PendingReceiver<viz::mojom::FrameSinkManager> receiver,
+      mojo::PendingRemote<viz::mojom::FrameSinkManagerClient> client);
 
   CompositorDependenciesAndroid();
   ~CompositorDependenciesAndroid();
diff --git a/chromium/content/browser/renderer_host/compositor_impl_android.cc b/chromium/content/browser/renderer_host/compositor_impl_android.cc
index 4512ee4bea4..e48d1508762 100644
--- a/chromium/content/browser/renderer_host/compositor_impl_android.cc
+++ b/chromium/content/browser/renderer_host/compositor_impl_android.cc
@@ -33,6 +33,7 @@
 #include "cc/base/switches.h"
 #include "cc/input/input_handler.h"
 #include "cc/layers/layer.h"
+#include "cc/metrics/begin_main_frame_metrics.h"
 #include "cc/mojo_embedder/async_layer_tree_frame_sink.h"
 #include "cc/resources/ui_resource_manager.h"
 #include "cc/trees/layer_tree_host.h"
@@ -69,13 +70,13 @@
 #include "gpu/ipc/client/command_buffer_proxy_impl.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
 #include "gpu/ipc/common/gpu_surface_tracker.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom.h"
 #include "third_party/khronos/GLES2/gl2.h"
 #include "third_party/khronos/GLES2/gl2ext.h"
 #include "third_party/skia/include/core/SkMallocPixelRef.h"
 #include "ui/android/window_android.h"
-#include "ui/compositor/host/external_begin_frame_controller_client_impl.h"
 #include "ui/display/display.h"
 #include "ui/display/screen.h"
 #include "ui/gfx/ca_layer_params.h"
@@ -121,8 +122,6 @@ gfx::OverlayTransform RotationToDisplayTransform(
   return gfx::OVERLAY_TRANSFORM_NONE;
 }
 
-const unsigned int kMaxDisplaySwapBuffers = 1U;
-
 gpu::SharedMemoryLimits GetCompositorContextSharedMemoryLimits(
     gfx::NativeWindow window) {
   const gfx::Size screen_size = display::Screen::GetScreen()
@@ -214,121 +213,6 @@ void CreateContextProviderAfterGpuChannelEstablished(
   callback.Run(std::move(context_provider));
 }
 
-class AndroidOutputSurface : public viz::OutputSurface {
- public:
-  AndroidOutputSurface(
-      scoped_refptr<viz::ContextProviderCommandBuffer> context_provider,
-      base::RepeatingCallback<void(const gfx::Size&)> swap_buffers_callback)
-      : viz::OutputSurface(std::move(context_provider)),
-        swap_buffers_callback_(std::move(swap_buffers_callback)) {
-    capabilities_.max_frames_pending = kMaxDisplaySwapBuffers;
-  }
-
-  ~AndroidOutputSurface() override = default;
-
-  void SwapBuffers(viz::OutputSurfaceFrame frame) override {
-    auto callback =
-        base::BindOnce(&AndroidOutputSurface::OnSwapBuffersCompleted,
-                       weak_ptr_factory_.GetWeakPtr(),
-                       std::move(frame.latency_info), frame.size);
-    uint32_t flags = 0;
-    gpu::ContextSupport::PresentationCallback presentation_callback;
-    presentation_callback = base::BindOnce(
-        &AndroidOutputSurface::OnPresentation, weak_ptr_factory_.GetWeakPtr());
-    if (frame.sub_buffer_rect) {
-      DCHECK(frame.sub_buffer_rect->IsEmpty());
-      context_provider_->ContextSupport()->CommitOverlayPlanes(
-          flags, std::move(callback), std::move(presentation_callback));
-    } else {
-      context_provider_->ContextSupport()->Swap(
-          flags, std::move(callback), std::move(presentation_callback));
-    }
-  }
-
-  void BindToClient(viz::OutputSurfaceClient* client) override {
-    DCHECK(client);
-    DCHECK(!client_);
-    client_ = client;
-  }
-
-  void EnsureBackbuffer() override {}
-
-  void DiscardBackbuffer() override {
-    context_provider()->ContextGL()->DiscardBackbufferCHROMIUM();
-  }
-
-  void BindFramebuffer() override {
-    context_provider()->ContextGL()->BindFramebuffer(GL_FRAMEBUFFER, 0);
-  }
-
-  void SetDrawRectangle(const gfx::Rect& rect) override {}
-
-  void Reshape(const gfx::Size& size,
-               float device_scale_factor,
-               const gfx::ColorSpace& color_space,
-               bool has_alpha,
-               bool use_stencil) override {
-    context_provider()->ContextGL()->ResizeCHROMIUM(
-        size.width(), size.height(), device_scale_factor,
-        gl::ColorSpaceUtils::GetGLColorSpace(color_space), has_alpha);
-  }
-
-  bool IsDisplayedAsOverlayPlane() const override { return false; }
-  unsigned GetOverlayTextureId() const override { return 0; }
-  gfx::BufferFormat GetOverlayBufferFormat() const override {
-    return gfx::BufferFormat::RGBX_8888;
-  }
-  bool HasExternalStencilTest() const override { return false; }
-  void ApplyExternalStencil() override {}
-
-  uint32_t GetFramebufferCopyTextureFormat() override {
-    auto* gl =
-        static_cast<viz::ContextProviderCommandBuffer*>(context_provider());
-    return gl->GetCopyTextureInternalFormat();
-  }
-
-  unsigned UpdateGpuFence() override { return 0; }
-
-  void SetUpdateVSyncParametersCallback(
-      viz::UpdateVSyncParametersCallback callback) override {}
-
-  void SetDisplayTransformHint(gfx::OverlayTransform transform) override {}
-  gfx::OverlayTransform GetDisplayTransform() override {
-    return gfx::OVERLAY_TRANSFORM_NONE;
-  }
-
- private:
-  gpu::CommandBufferProxyImpl* GetCommandBufferProxy() {
-    viz::ContextProviderCommandBuffer* provider_command_buffer =
-        static_cast<viz::ContextProviderCommandBuffer*>(
-            context_provider_.get());
-    gpu::CommandBufferProxyImpl* command_buffer_proxy =
-        provider_command_buffer->GetCommandBufferProxy();
-    DCHECK(command_buffer_proxy);
-    return command_buffer_proxy;
-  }
-
-  void OnSwapBuffersCompleted(std::vector<ui::LatencyInfo> latency_info,
-                              gfx::Size swap_size,
-                              const gpu::SwapBuffersCompleteParams& params) {
-    client_->DidReceiveSwapBuffersAck(params.swap_response.timings);
-    swap_buffers_callback_.Run(swap_size);
-    UpdateLatencyInfoOnSwap(params.swap_response, &latency_info);
-    latency_tracker_.OnGpuSwapBuffersCompleted(latency_info);
-  }
-
-  void OnPresentation(const gfx::PresentationFeedback& feedback) {
-    client_->DidReceivePresentationFeedback(feedback);
-  }
-
- private:
-  viz::OutputSurfaceClient* client_ = nullptr;
-  base::RepeatingCallback<void(const gfx::Size&)> swap_buffers_callback_;
-  ui::LatencyTracker latency_tracker_;
-
-  base::WeakPtrFactory<AndroidOutputSurface> weak_ptr_factory_{this};
-};
-
 static bool g_initialized = false;
 
 }  // anonymous namespace
@@ -534,7 +418,6 @@ void CompositorImpl::CreateLayerTreeHost() {
 
   cc::LayerTreeSettings settings;
   settings.use_zero_copy = true;
-  settings.enable_surface_synchronization = true;
   settings.build_hit_test_data = features::IsVizHitTestingSurfaceLayerEnabled();
 
   base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
@@ -655,6 +538,10 @@ void CompositorImpl::SetNeedsComposite() {
   host_->SetNeedsAnimate();
 }
 
+void CompositorImpl::SetNeedsRedraw() {
+  host_->SetNeedsRedrawRect(host_->device_viewport_rect());
+}
+
 void CompositorImpl::DidUpdateLayers() {
   // Dump property trees and layers if run with:
   //   --vmodule=compositor_impl_android=3
@@ -819,6 +706,11 @@ void CompositorImpl::DidCommit() {
   root_window_->OnCompositingDidCommit();
 }
 
+std::unique_ptr<cc::BeginMainFrameMetrics>
+CompositorImpl::GetBeginMainFrameMetrics() {
+  return nullptr;
+}
+
 void CompositorImpl::AttachLayerForReadback(scoped_refptr<cc::Layer> layer) {
   readback_layer_tree_->AddChild(layer);
 }
@@ -929,10 +821,12 @@ void CompositorImpl::InitializeVizLayerTreeFrameSink(
   root_params->send_swap_size_notifications = true;
 
   // Create interfaces for a root CompositorFrameSink.
-  viz::mojom::CompositorFrameSinkAssociatedPtrInfo sink_info;
-  root_params->compositor_frame_sink = mojo::MakeRequest(&sink_info);
-  viz::mojom::CompositorFrameSinkClientRequest client_request =
-      mojo::MakeRequest(&root_params->compositor_frame_sink_client);
+  mojo::PendingAssociatedRemote<viz::mojom::CompositorFrameSink> sink_remote;
+  root_params->compositor_frame_sink =
+      sink_remote.InitWithNewEndpointAndPassReceiver();
+  mojo::PendingReceiver<viz::mojom::CompositorFrameSinkClient> client_receiver =
+      root_params->compositor_frame_sink_client
+          .InitWithNewPipeAndPassReceiver();
   root_params->display_private = mojo::MakeRequest(&display_private_);
   display_client_ = std::make_unique<AndroidHostDisplayClient>(this);
   root_params->display_client =
@@ -965,8 +859,8 @@ void CompositorImpl::InitializeVizLayerTreeFrameSink(
   params.gpu_memory_buffer_manager = BrowserMainLoop::GetInstance()
                                          ->gpu_channel_establish_factory()
                                          ->GetGpuMemoryBufferManager();
-  params.pipes.compositor_frame_sink_associated_info = std::move(sink_info);
-  params.pipes.client_request = std::move(client_request);
+  params.pipes.compositor_frame_sink_associated_remote = std::move(sink_remote);
+  params.pipes.client_receiver = std::move(client_receiver);
   params.hit_test_data_provider =
       std::make_unique<viz::HitTestDataProviderDrawQuad>(
           false /* should_ask_for_child_region */,
diff --git a/chromium/content/browser/renderer_host/compositor_impl_android.h b/chromium/content/browser/renderer_host/compositor_impl_android.h
index 97ab42c4cbc..58573a01fcf 100644
--- a/chromium/content/browser/renderer_host/compositor_impl_android.h
+++ b/chromium/content/browser/renderer_host/compositor_impl_android.h
@@ -37,7 +37,6 @@
 #include "ui/android/window_android.h"
 #include "ui/android/window_android_compositor.h"
 #include "ui/compositor/compositor_lock.h"
-#include "ui/compositor/external_begin_frame_client.h"
 #include "ui/display/display_observer.h"
 
 struct ANativeWindow;
@@ -48,10 +47,6 @@ class Layer;
 class LayerTreeHost;
 }
 
-namespace ui {
-class ExternalBeginFrameControllerClientImpl;
-}
-
 namespace viz {
 class FrameSinkId;
 class HostDisplayClient;
@@ -103,6 +98,7 @@ class CONTENT_EXPORT CompositorImpl
   void SetWindowBounds(const gfx::Size& size) override;
   void SetRequiresAlphaChannel(bool flag) override;
   void SetNeedsComposite() override;
+  void SetNeedsRedraw() override;
   ui::UIResourceProvider& GetUIResourceProvider() override;
   ui::ResourceManager& GetResourceManager() override;
   void CacheBackBufferForCurrentSurface() override;
@@ -140,6 +136,8 @@ class CONTENT_EXPORT CompositorImpl
       const gfx::PresentationFeedback& feedback) override {}
   void RecordStartOfFrameMetrics() override {}
   void RecordEndOfFrameMetrics(base::TimeTicks frame_begin_time) override {}
+  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
+      override;
 
   // LayerTreeHostSingleThreadClient implementation.
   void DidSubmitCompositorFrame() override;
diff --git a/chromium/content/browser/renderer_host/cursor_manager_unittest.cc b/chromium/content/browser/renderer_host/cursor_manager_unittest.cc
index 42ba564565d..e65b24a78fe 100644
--- a/chromium/content/browser/renderer_host/cursor_manager_unittest.cc
+++ b/chromium/content/browser/renderer_host/cursor_manager_unittest.cc
@@ -16,6 +16,7 @@
 #include "content/test/mock_render_widget_host_delegate.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/test_render_view_host.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 // CursorManager is only instantiated on Aura and Mac.
@@ -51,9 +52,10 @@ class MockRenderWidgetHost : public RenderWidgetHostImpl {
   static MockRenderWidgetHost* Create(RenderWidgetHostDelegate* delegate,
                                       RenderProcessHost* process,
                                       int32_t routing_id) {
-    mojom::WidgetPtr widget;
+    mojo::PendingRemote<mojom::Widget> widget;
     std::unique_ptr<MockWidgetImpl> widget_impl =
-        std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+        std::make_unique<MockWidgetImpl>(
+            widget.InitWithNewPipeAndPassReceiver());
 
     return new MockRenderWidgetHost(delegate, process, routing_id,
                                     std::move(widget_impl), std::move(widget));
@@ -64,7 +66,7 @@ class MockRenderWidgetHost : public RenderWidgetHostImpl {
                        RenderProcessHost* process,
                        int routing_id,
                        std::unique_ptr<MockWidgetImpl> widget_impl,
-                       mojom::WidgetPtr widget)
+                       mojo::PendingRemote<mojom::Widget> widget)
       : RenderWidgetHostImpl(delegate,
                              process,
                              routing_id,
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_event_handler_win.h b/chromium/content/browser/renderer_host/direct_manipulation_event_handler_win.h
index e654c5f1a45..4b34a5752d7 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_event_handler_win.h
+++ b/chromium/content/browser/renderer_host/direct_manipulation_event_handler_win.h
@@ -22,7 +22,7 @@ class WindowEventTarget;
 namespace content {
 
 class DirectManipulationHelper;
-class DirectManipulationBrowserTest;
+class DirectManipulationBrowserTestBase;
 class DirectManipulationUnitTest;
 
 // DirectManipulationEventHandler receives status update and gesture events from
@@ -48,7 +48,7 @@ class DirectManipulationEventHandler
   void SetDirectManipulationHelper(DirectManipulationHelper* helper);
 
  private:
-  friend class DirectManipulationBrowserTest;
+  friend class DirectManipulationBrowserTestBase;
   friend DirectManipulationUnitTest;
 
   // DirectManipulationEventHandler();
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_helper_win.cc b/chromium/content/browser/renderer_host/direct_manipulation_helper_win.cc
index 6ce09b9f7b8..fe416c89c7f 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_helper_win.cc
+++ b/chromium/content/browser/renderer_host/direct_manipulation_helper_win.cc
@@ -268,7 +268,9 @@ void DirectManipulationHelper::Destroy() {
   if (has_animation_observer_)
     RemoveAnimationObserver();
   compositor_ = nullptr;
-  event_handler_->SetDirectManipulationHelper(nullptr);
+
+  if (event_handler_)
+    event_handler_->SetDirectManipulationHelper(nullptr);
 
   HRESULT hr;
   if (viewport_) {
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_helper_win.h b/chromium/content/browser/renderer_host/direct_manipulation_helper_win.h
index adf19d6849f..bc3f3d13e32 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_helper_win.h
+++ b/chromium/content/browser/renderer_host/direct_manipulation_helper_win.h
@@ -28,7 +28,7 @@ class WindowEventTarget;
 
 namespace content {
 
-class DirectManipulationBrowserTest;
+class DirectManipulationBrowserTestBase;
 class DirectManipulationUnitTest;
 
 // TODO(crbug.com/914914) This is added for help us getting debug log on
@@ -83,7 +83,7 @@ class CONTENT_EXPORT DirectManipulationHelper
   void RemoveAnimationObserver();
 
  private:
-  friend class content::DirectManipulationBrowserTest;
+  friend class DirectManipulationBrowserTestBase;
   friend class DirectManipulationUnitTest;
 
   DirectManipulationHelper(HWND window, ui::Compositor* compositor);
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc b/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc
new file mode 100644
index 00000000000..60e3c2b19b2
--- /dev/null
+++ b/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.cc
@@ -0,0 +1,76 @@
+// Copyright (c) 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/renderer_host/direct_manipulation_test_helper_win.h"
+
+namespace content {
+MockDirectManipulationContent::MockDirectManipulationContent() {}
+MockDirectManipulationContent::~MockDirectManipulationContent() = default;
+
+void MockDirectManipulationContent::SetContentTransform(float scale,
+                                                        float scroll_x,
+                                                        float scroll_y) {
+  // Values in position 1 and 2 are both 0, because those store rotation
+  // transforms. 0 and 3 are both scale because 0 stores the x scale and 3
+  // stores the y scale. See comment in header file for more information.
+  transforms_[0] = scale;
+  transforms_[1] = 0.0f;
+  transforms_[2] = 0.0f;
+  transforms_[3] = scale;
+  transforms_[4] = scroll_x;
+  transforms_[5] = scroll_y;
+}
+
+HRESULT MockDirectManipulationContent::GetContentTransform(float* transforms,
+                                                           DWORD point_count) {
+  DCHECK_EQ(point_count, transforms_.size());
+
+  for (size_t i = 0; i < transforms_.size(); ++i)
+    transforms[i] = transforms_[i];
+  return S_OK;
+}
+
+// Other Overrides
+HRESULT MockDirectManipulationContent::GetContentRect(RECT* contentSize) {
+  NOTREACHED();
+  return S_OK;
+}
+
+HRESULT
+MockDirectManipulationContent::SetContentRect(const RECT* contentSize) {
+  NOTREACHED();
+  return S_OK;
+}
+
+HRESULT MockDirectManipulationContent::GetViewport(REFIID riid, void** object) {
+  NOTREACHED();
+  return S_OK;
+}
+
+HRESULT MockDirectManipulationContent::GetTag(REFIID riid,
+                                              void** object,
+                                              UINT32* id) {
+  NOTREACHED();
+  return S_OK;
+}
+
+HRESULT MockDirectManipulationContent::SetTag(IUnknown* object, UINT32 id) {
+  NOTREACHED();
+  return S_OK;
+}
+
+HRESULT MockDirectManipulationContent::GetOutputTransform(float* matrix,
+                                                          DWORD point_count) {
+  NOTREACHED();
+  return S_OK;
+}
+
+HRESULT
+MockDirectManipulationContent::SyncContentTransform(const float* matrix,
+                                                    DWORD point_count) {
+  NOTREACHED();
+  return S_OK;
+}
+
+}  // namespace content
\ No newline at end of file
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.h b/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.h
new file mode 100644
index 00000000000..156d6a1014e
--- /dev/null
+++ b/chromium/content/browser/renderer_host/direct_manipulation_test_helper_win.h
@@ -0,0 +1,86 @@
+// Copyright (c) 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_RENDERER_HOST_DIRECT_MANIPULATION_TEST_HELPER_WIN_H_
+#define CONTENT_BROWSER_RENDERER_HOST_DIRECT_MANIPULATION_TEST_HELPER_WIN_H_
+
+#include <directmanipulation.h>
+#include <windows.h>
+#include <wrl.h>
+#include <array>
+
+#include "base/logging.h"
+#include "base/macros.h"
+
+namespace content {
+class PrecisionTouchpadBrowserTest;
+
+// Size of the |transforms_| array. The DirectManipulationContent API specifies
+// that the size is always 6 for direct manipulation transforms.
+static constexpr int kTransformMatrixSize = 6;
+
+// This class is used for setting up mock content to be used for testing direct
+// manipulation and precision touchpad code paths. Most of its methods aren't
+// used, and its only real purpose is to store, update, and provide the
+// transforms scale, scroll_x, and scroll_y.
+class MockDirectManipulationContent
+    : public Microsoft::WRL::RuntimeClass<
+          Microsoft::WRL::RuntimeClassFlags<
+              Microsoft::WRL::RuntimeClassType::ClassicCom>,
+          Microsoft::WRL::Implements<
+              Microsoft::WRL::RuntimeClassFlags<
+                  Microsoft::WRL::RuntimeClassType::ClassicCom>,
+              Microsoft::WRL::FtmBase,
+              IDirectManipulationContent>> {
+ public:
+  MockDirectManipulationContent();
+
+  // IDirectManipulationContent:
+  ~MockDirectManipulationContent() override;
+
+  void SetContentTransform(float scale, float scroll_x, float scroll_y);
+
+  // IDirectManipulationContent:
+  HRESULT STDMETHODCALLTYPE GetContentTransform(float* transforms,
+                                                DWORD point_count) override;
+
+  // Other Overrides, also from IDirectManipulationContent
+  HRESULT STDMETHODCALLTYPE GetContentRect(RECT* contentSize) override;
+
+  HRESULT STDMETHODCALLTYPE SetContentRect(const RECT* contentSize) override;
+
+  HRESULT STDMETHODCALLTYPE GetViewport(REFIID riid, void** object) override;
+
+  HRESULT STDMETHODCALLTYPE GetTag(REFIID riid,
+                                   void** object,
+                                   UINT32* id) override;
+
+  HRESULT STDMETHODCALLTYPE SetTag(IUnknown* object, UINT32 id) override;
+
+  HRESULT STDMETHODCALLTYPE GetOutputTransform(float* matrix,
+                                               DWORD point_count) override;
+
+  HRESULT STDMETHODCALLTYPE SyncContentTransform(const float* matrix,
+                                                 DWORD point_count) override;
+
+ private:
+  friend class PrecisionTouchpadBrowserTest;
+
+  // IDirectManipulationContent provides a 3x2 transform matrix, written out
+  // flatly as M = [(1,1), (1,2), (2,1), (2,2), (3,1), (3,2)].
+  // Each element stores the following information:
+  // (1,1) - x scale
+  // (1,2) - y rotation (0 when rotation is not allowed, such as in Chromium)
+  // (2,1) - x rotation (0 when rotation is not allowed)
+  // (2,2) - y scale
+  // (3,1) - x offset
+  // (3,2) - y offset.
+  std::array<float, kTransformMatrixSize> transforms_;
+
+  DISALLOW_COPY_AND_ASSIGN(MockDirectManipulationContent);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_RENDERER_HOST_DIRECT_MANIPULATION_TEST_HELPER_WIN_H_
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc b/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc
index 1f10e20c066..30ce46b0f22 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc
+++ b/chromium/content/browser/renderer_host/direct_manipulation_win_browsertest.cc
@@ -4,14 +4,13 @@
 
 #include "content/browser/renderer_host/direct_manipulation_helper_win.h"
 
-#include <windows.h>
-
-#include "base/macros.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/win/windows_version.h"
+#include "content/browser/renderer_host/direct_manipulation_test_helper_win.h"
 #include "content/browser/renderer_host/legacy_render_widget_host_win.h"
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -25,23 +24,9 @@
 
 namespace content {
 
-class DirectManipulationBrowserTest : public ContentBrowserTest,
-                                      public testing::WithParamInterface<bool> {
+class DirectManipulationBrowserTestBase : public ContentBrowserTest {
  public:
-  DirectManipulationBrowserTest() {
-    if (GetParam()) {
-      scoped_feature_list_.InitWithFeatures(
-          {features::kPrecisionTouchpad,
-           features::kPrecisionTouchpadScrollPhase},
-          {});
-    } else {
-      scoped_feature_list_.InitWithFeatures(
-          {features::kPrecisionTouchpad},
-          {features::kPrecisionTouchpadScrollPhase});
-    }
-  }
-
-  ~DirectManipulationBrowserTest() override {}
+  DirectManipulationBrowserTestBase() {}
 
   LegacyRenderWidgetHostHWND* GetLegacyRenderWidgetHostHWND() {
     RenderWidgetHostViewAura* rwhva = static_cast<RenderWidgetHostViewAura*>(
@@ -68,6 +53,40 @@ class DirectManipulationBrowserTest : public ContentBrowserTest,
         ->HasAnimationObserver(lrwhh->direct_manipulation_helper_.get());
   }
 
+  void StartNewSequence() {
+    LegacyRenderWidgetHostHWND* lrwhh = GetLegacyRenderWidgetHostHWND();
+
+    lrwhh->direct_manipulation_helper_->event_handler_->OnViewportStatusChanged(
+        lrwhh->direct_manipulation_helper_->viewport_.Get(),
+        DIRECTMANIPULATION_READY, DIRECTMANIPULATION_RUNNING);
+  }
+
+  void UpdateContents(MockDirectManipulationContent* content) {
+    LegacyRenderWidgetHostHWND* lrwhh = GetLegacyRenderWidgetHostHWND();
+    lrwhh->direct_manipulation_helper_->event_handler_->OnContentUpdated(
+        lrwhh->direct_manipulation_helper_->viewport_.Get(), content);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(DirectManipulationBrowserTestBase);
+};
+
+class DirectManipulationBrowserTest : public DirectManipulationBrowserTestBase,
+                                      public testing::WithParamInterface<bool> {
+ public:
+  DirectManipulationBrowserTest() {
+    if (GetParam()) {
+      scoped_feature_list_.InitWithFeatures(
+          {features::kPrecisionTouchpad,
+           features::kPrecisionTouchpadScrollPhase},
+          {});
+    } else {
+      scoped_feature_list_.InitWithFeatures(
+          {features::kPrecisionTouchpad},
+          {features::kPrecisionTouchpadScrollPhase});
+    }
+  }
+
  private:
   base::test::ScopedFeatureList scoped_feature_list_;
 
@@ -85,7 +104,7 @@ IN_PROC_BROWSER_TEST_P(DirectManipulationBrowserTest,
   if (base::win::GetVersion() < base::win::Version::WIN10)
     return;
 
-  NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
   LegacyRenderWidgetHostHWND* lrwhh = GetLegacyRenderWidgetHostHWND();
   ASSERT_TRUE(lrwhh);
@@ -137,7 +156,7 @@ IN_PROC_BROWSER_TEST_P(DirectManipulationBrowserTest, EventConvert) {
   if (base::win::GetVersion() < base::win::Version::WIN10)
     return;
 
-  NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
   LegacyRenderWidgetHostHWND* lrwhh = GetLegacyRenderWidgetHostHWND();
   ASSERT_TRUE(lrwhh);
@@ -307,4 +326,175 @@ IN_PROC_BROWSER_TEST_P(DirectManipulationBrowserTest, EventConvert) {
   dwthw->RemoveEventRewriter(&event_logger);
 }
 
+class PrecisionTouchpadBrowserTest : public DirectManipulationBrowserTestBase {
+ public:
+  PrecisionTouchpadBrowserTest() {
+    content_ = Microsoft::WRL::Make<MockDirectManipulationContent>();
+  }
+
+  void UpdateContents(float scale, float scroll_x, float scroll_y) {
+    content_->SetContentTransform(scale, scroll_x, scroll_y);
+    DirectManipulationBrowserTestBase::UpdateContents(content_.Get());
+  }
+
+  void UseCenterPointAsMockCursorPosition(WebContentsImpl* web_contents) {
+    SetMockCursorPositionForTesting(
+        web_contents, web_contents->GetContainerBounds().CenterPoint());
+  }
+
+ private:
+  Microsoft::WRL::ComPtr<MockDirectManipulationContent> content_;
+
+  DISALLOW_COPY_AND_ASSIGN(PrecisionTouchpadBrowserTest);
+};
+
+// Confirm that preventDefault correctly prevents pinch zoom on precision
+// touchpad.
+IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest,
+                       DISABLED_PreventDefaultPinchZoom) {
+  if (base::win::GetVersion() < base::win::Version::WIN10)
+    return;
+
+  ASSERT_TRUE(NavigateToURL(shell(), GURL(R"HTML(data:text/html,<!DOCTYPE html>
+        <html>
+          Hello, world
+        </html>)HTML")));
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderWidgetHostImpl* rwhi = web_contents->GetRenderWidgetHostWithPageFocus();
+
+  UseCenterPointAsMockCursorPosition(web_contents);
+
+  EXPECT_EQ(1, EvalJs(web_contents, "window.visualViewport.scale"));
+
+  // Initial amount to try zooming by.
+  const int kInitialZoom = 2;
+
+  // First, test a standard zoom.
+  UpdateContents(kInitialZoom, 0, 0);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(kInitialZoom, EvalJs(web_contents, "window.visualViewport.scale"));
+
+  // In order for the end event to be fired and state reset, a new sequence has
+  // to be started. This simulates lifting fingers off of the touch pad.
+  StartNewSequence();
+
+  // Now add the preventDefault to confirm zooming does not happen.
+  EXPECT_TRUE(ExecJs(web_contents,
+                     R"(var handler = function (e) {e.preventDefault(); };
+      document.addEventListener('wheel', handler, {passive: false}); )"));
+  RunUntilInputProcessed(rwhi);
+
+  // Arbitrary zoom amount chosen here to make the test fail if it does zoom.
+  UpdateContents(3.5, 0, 0);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(kInitialZoom, EvalJs(web_contents, "window.visualViewport.scale"));
+
+  // Confirm a zoom back out to 1 works as expected.
+  StartNewSequence();
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_TRUE(ExecJs(
+      web_contents,
+      R"(document.removeEventListener('wheel', handler, {passive: false}); )"));
+
+  const float kEndZoom = 0.5;
+
+  UpdateContents(kEndZoom, 0, 0);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(static_cast<int>(kInitialZoom * kEndZoom),
+            EvalJs(web_contents, "window.visualViewport.scale"));
+}
+
+// Confirm that preventDefault correctly prevents scrolling on precision
+// touchpad.
+IN_PROC_BROWSER_TEST_F(PrecisionTouchpadBrowserTest,
+                       DISABLED_PreventDefaultScroll) {
+  if (base::win::GetVersion() < base::win::Version::WIN10)
+    return;
+
+  ASSERT_TRUE(NavigateToURL(shell(), GURL(R"HTML(data:text/html,<!DOCTYPE html>
+    <html>
+      <body style='height:2000px; width:2000px;'>
+        Hello, world
+      </body>
+    </html>)HTML")));
+
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  RenderWidgetHostImpl* rwhi = web_contents->GetRenderWidgetHostWithPageFocus();
+
+  UseCenterPointAsMockCursorPosition(web_contents);
+
+  EXPECT_EQ(0, EvalJs(web_contents, "document.documentElement.scrollLeft"));
+  EXPECT_EQ(0, EvalJs(web_contents, "document.documentElement.scrollTop"));
+
+  // The distance to try scrolling. Note that scrolling down or right is
+  // considered the negative direction, so this value will be negated when
+  // passed to UpdateContents.
+  const int kInitialScrollDistance = 200;
+
+  // First, test scrolling vertically
+  UpdateContents(1, 0, -kInitialScrollDistance);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(0, EvalJs(web_contents, "document.documentElement.scrollLeft"));
+  EXPECT_EQ(kInitialScrollDistance,
+            EvalJs(web_contents, "document.documentElement.scrollTop"));
+
+  // Then, horizontally. Note that a new sequence is not starting between these,
+  // which is why the y value remains the same.
+  UpdateContents(1, -kInitialScrollDistance, -kInitialScrollDistance);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(kInitialScrollDistance,
+            EvalJs(web_contents, "document.documentElement.scrollLeft"));
+  EXPECT_EQ(kInitialScrollDistance,
+            EvalJs(web_contents, "document.documentElement.scrollTop"));
+
+  // In order for the end event to be fired and state reset, a new sequence has
+  // to be started. This simulates lifting fingers off of the touch pad.
+  StartNewSequence();
+
+  // Now add the preventDefault to confirm scrolling does not happen.
+  EXPECT_TRUE(ExecJs(web_contents,
+                     R"(var handler = function (e) {e.preventDefault(); };
+      document.addEventListener('wheel', handler, {passive: false}); )"));
+  RunUntilInputProcessed(rwhi);
+
+  // Updating with arbitrarily chosen numbers that should make it obvious where
+  // values are coming from when this test fails.
+  UpdateContents(1, 354, 291);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(kInitialScrollDistance,
+            EvalJs(web_contents, "document.documentElement.scrollLeft"));
+  EXPECT_EQ(kInitialScrollDistance,
+            EvalJs(web_contents, "document.documentElement.scrollTop"));
+
+  // Confirm a scroll back towards the origin works after removing the event
+  // listener.
+  StartNewSequence();
+
+  EXPECT_TRUE(ExecJs(
+      web_contents,
+      R"(document.removeEventListener('wheel', handler, {passive: false}); )"));
+
+  // Values arbitrarily chosen so to confirm that scrolling up and left works
+  // without going all the way to the origin.
+  const int kScrollXDistance = 120;
+  const int kScrollYDistance = 150;
+  UpdateContents(1, kScrollXDistance, kScrollYDistance);
+  RunUntilInputProcessed(rwhi);
+
+  EXPECT_EQ(kInitialScrollDistance - kScrollXDistance,
+            EvalJs(web_contents, "document.documentElement.scrollLeft"));
+  EXPECT_EQ(kInitialScrollDistance - kScrollYDistance,
+            EvalJs(web_contents, "document.documentElement.scrollTop"));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/direct_manipulation_win_unittest.cc b/chromium/content/browser/renderer_host/direct_manipulation_win_unittest.cc
index 71f1a2e82f9..4bcfaba38ae 100644
--- a/chromium/content/browser/renderer_host/direct_manipulation_win_unittest.cc
+++ b/chromium/content/browser/renderer_host/direct_manipulation_win_unittest.cc
@@ -6,9 +6,9 @@
 
 #include <objbase.h>
 
-#include "base/macros.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/win/windows_version.h"
+#include "content/browser/renderer_host/direct_manipulation_test_helper_win.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/base/win/window_event_target.h"
@@ -173,80 +173,6 @@ class MockDirectManipulationViewport
   DISALLOW_COPY_AND_ASSIGN(MockDirectManipulationViewport);
 };
 
-class MockDirectManipulationContent
-    : public Microsoft::WRL::RuntimeClass<
-          Microsoft::WRL::RuntimeClassFlags<
-              Microsoft::WRL::RuntimeClassType::ClassicCom>,
-          Microsoft::WRL::Implements<
-              Microsoft::WRL::RuntimeClassFlags<
-                  Microsoft::WRL::RuntimeClassType::ClassicCom>,
-              Microsoft::WRL::FtmBase,
-              IDirectManipulationContent>> {
- public:
-  MockDirectManipulationContent() {}
-
-  ~MockDirectManipulationContent() override {}
-
-  void SetContentTransform(float scale, float scroll_x, float scroll_y) {
-    for (int i = 0; i < 6; ++i)
-      transforms_[i] = 0;
-    transforms_[0] = scale;
-    transforms_[4] = scroll_x;
-    transforms_[5] = scroll_y;
-  }
-
-  HRESULT STDMETHODCALLTYPE
-  GetContentTransform(_Out_writes_(point_count) float* transforms,
-                      _In_ DWORD point_count) override {
-    for (int i = 0; i < 6; ++i)
-      transforms[i] = transforms_[i];
-    return S_OK;
-  }
-
-  // Other Overrides
-  HRESULT STDMETHODCALLTYPE GetContentRect(_Out_ RECT* contentSize) override {
-    return S_OK;
-  }
-
-  HRESULT STDMETHODCALLTYPE
-  SetContentRect(_In_ const RECT* contentSize) override {
-    return S_OK;
-  }
-
-  HRESULT STDMETHODCALLTYPE GetViewport(_In_ REFIID riid,
-                                        _COM_Outptr_ void** object) override {
-    return S_OK;
-  }
-
-  HRESULT STDMETHODCALLTYPE GetTag(_In_ REFIID riid,
-                                   _COM_Outptr_opt_ void** object,
-                                   _Out_opt_ UINT32* id) override {
-    return S_OK;
-  }
-
-  HRESULT STDMETHODCALLTYPE SetTag(_In_opt_ IUnknown* object,
-                                   _In_ UINT32 id) override {
-    return S_OK;
-  }
-
-  HRESULT STDMETHODCALLTYPE
-  GetOutputTransform(_Out_writes_(point_count) float* matrix,
-                     _In_ DWORD point_count) override {
-    return S_OK;
-  }
-
-  HRESULT STDMETHODCALLTYPE
-  SyncContentTransform(_In_reads_(point_count) const float* matrix,
-                       _In_ DWORD point_count) override {
-    return S_OK;
-  }
-
- private:
-  float transforms_[6];
-
-  DISALLOW_COPY_AND_ASSIGN(MockDirectManipulationContent);
-};
-
 enum class EventGesture {
   kScrollBegin,
   kScroll,
diff --git a/chromium/content/browser/renderer_host/dwrite_font_file_util_win.cc b/chromium/content/browser/renderer_host/dwrite_font_file_util_win.cc
index a87727fd823..855b57c5f3d 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_file_util_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_file_util_win.cc
@@ -17,10 +17,6 @@
 
 namespace content {
 
-using namespace dwrite_font_uma_logging;
-
-namespace dwrite_font_file_util {
-
 bool FontFilePathAndTtcIndex(IDWriteFont* font,
                              base::string16& file_path,
                              uint32_t& ttc_index) {
@@ -178,5 +174,4 @@ base::string16 GetWindowsFontsPath() {
   return base::i18n::FoldCase(font_path_chars.data());
 }
 
-}  // namespace dwrite_font_file_util
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/dwrite_font_file_util_win.h b/chromium/content/browser/renderer_host/dwrite_font_file_util_win.h
index 994c9fad7af..5631a9e10d9 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_file_util_win.h
+++ b/chromium/content/browser/renderer_host/dwrite_font_file_util_win.h
@@ -15,8 +15,6 @@
 
 namespace content {
 
-namespace dwrite_font_file_util {
-
 bool FontFilePathAndTtcIndex(IDWriteFontFace* font,
                              base::string16& file_path,
                              uint32_t& ttc_index);
@@ -31,8 +29,6 @@ bool AddFilesForFont(IDWriteFont* font,
 
 base::string16 GetWindowsFontsPath();
 
-}  // namespace dwrite_font_file_util
-
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_DWRITE_FONT_FILE_UTIL_WIN_H_
diff --git a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
index f8ba1076969..84d44143e08 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.cc
@@ -32,6 +32,7 @@
 #include "content/browser/renderer_host/dwrite_font_proxy_impl_win.h"
 #include "content/browser/renderer_host/dwrite_font_uma_logging_win.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "third_party/blink/public/common/font_unique_name_lookup/font_table_matcher.h"
 #include "third_party/blink/public/common/font_unique_name_lookup/font_table_persistence.h"
@@ -40,9 +41,6 @@
 
 namespace content {
 
-using namespace dwrite_font_file_util;
-using namespace dwrite_font_uma_logging;
-
 namespace {
 
 const base::FilePath::CharType kProtobufFilename[] =
@@ -388,6 +386,11 @@ void DWriteFontLookupTableBuilder::PrepareFontUniqueNameTable() {
         FROM_HERE, base::BlockingType::MAY_BLOCK);
 
     outstanding_family_results_ = collection_->GetFontFamilyCount();
+    family_results_empty_ = 0;
+    family_results_non_empty_ = 0;
+    UMA_HISTOGRAM_CUSTOM_COUNTS(
+        "DirectWrite.Fonts.Proxy.FamilyCountIndexingStart",
+        outstanding_family_results_, 1, 5000, 50);
   }
   for (UINT32 family_index = 0; family_index < outstanding_family_results_;
        ++family_index) {
@@ -400,9 +403,8 @@ void DWriteFontLookupTableBuilder::PrepareFontUniqueNameTable() {
          base::ThreadPolicy::MUST_USE_FOREGROUND,
          base::TaskShutdownBehavior::CONTINUE_ON_SHUTDOWN},
         base::BindOnce(
-            &DWriteFontLookupTableBuilder::ExtractPathAndNamesFromFamily,
-            collection_, family_index, start_time_table_build_,
-            slow_down_mode_for_testing_,
+            &ExtractPathAndNamesFromFamily, collection_, family_index,
+            start_time_table_build_, slow_down_mode_for_testing_,
             OptionalOrNullptr(hang_event_for_testing_), IndexingTimeout()),
         base::BindOnce(&DWriteFontLookupTableBuilder::
                            AppendFamilyResultAndFinalizeIfNeeded,
@@ -554,6 +556,11 @@ void DWriteFontLookupTableBuilder::AppendFamilyResultAndFinalizeIfNeeded(
   if (font_table_built_.IsSignaled())
     return;
 
+  if (!family_result.size())
+    family_results_empty_++;
+  else
+    family_results_non_empty_++;
+
   for (const FontFileWithUniqueNames& font_of_family : family_result) {
     blink::FontUniqueNameTable_UniqueFont* added_unique_font =
         font_unique_name_table_->add_fonts();
@@ -597,6 +604,13 @@ void DWriteFontLookupTableBuilder::FinalizeFontTable() {
   UMA_HISTOGRAM_BOOLEAN("DirectWrite.Fonts.Proxy.TableBuildTimedOut",
                         timed_out);
 
+  int empty_family_results_percentage =
+      round(((family_results_empty_ * 1.0f) /
+             (family_results_empty_ + family_results_non_empty_)) *
+            100.0);
+  UMA_HISTOGRAM_PERCENTAGE("DirectWrite.Fonts.Proxy.EmptyFamilyResultsRatio",
+                           empty_family_results_percentage);
+
   unsigned num_font_files = font_unique_name_table->fonts_size();
 
   blink::FontTableMatcher::SortUniqueNameTableForSearch(
diff --git a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h
index 4d23f8ac3da..3597b8119c7 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h
+++ b/chromium/content/browser/renderer_host/dwrite_font_lookup_table_builder_win.h
@@ -201,6 +201,8 @@ class CONTENT_EXPORT DWriteFontLookupTableBuilder {
   Microsoft::WRL::ComPtr<IDWriteFactory3> factory3_;
   SlowDownMode slow_down_mode_for_testing_ = SlowDownMode::kNoSlowdown;
   uint32_t outstanding_family_results_ = 0;
+  uint32_t family_results_non_empty_ = 0;
+  uint32_t family_results_empty_ = 0;
   base::TimeTicks start_time_table_ready_;
   base::TimeTicks start_time_table_build_;
   base::FilePath cache_directory_;
diff --git a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc
index e9e20bd0795..af1162728dd 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.cc
@@ -4,12 +4,12 @@
 
 #include "content/browser/renderer_host/dwrite_font_proxy_impl_win.h"
 
-#include <dwrite.h>
 #include <shlobj.h>
 #include <stddef.h>
 #include <stdint.h>
 
 #include <algorithm>
+#include <memory>
 #include <set>
 #include <utility>
 
@@ -30,7 +30,7 @@
 #include "content/browser/renderer_host/dwrite_font_uma_logging_win.h"
 #include "content/public/common/content_features.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/common/font_unique_name_lookup/font_unique_name_table.pb.h"
 #include "third_party/blink/public/common/font_unique_name_lookup/icu_fold_case_util.h"
 #include "third_party/skia/include/core/SkFontMgr.h"
@@ -43,9 +43,6 @@ namespace mswr = Microsoft::WRL;
 
 namespace content {
 
-using namespace dwrite_font_uma_logging;
-using namespace dwrite_font_file_util;
-
 namespace {
 
 // These are the fonts that Blink tries to load in getLastResortFallbackFont,
@@ -123,10 +120,9 @@ DWriteFontProxyImpl::~DWriteFontProxyImpl() = default;
 
 // static
 void DWriteFontProxyImpl::Create(
-    blink::mojom::DWriteFontProxyRequest request,
-    const service_manager::BindSourceInfo& source_info) {
-  mojo::MakeStrongBinding(std::make_unique<DWriteFontProxyImpl>(),
-                          std::move(request));
+    mojo::PendingReceiver<blink::mojom::DWriteFontProxy> receiver) {
+  mojo::MakeSelfOwnedReceiver(std::make_unique<DWriteFontProxyImpl>(),
+                              std::move(receiver));
 }
 
 void DWriteFontProxyImpl::SetWindowsFontsPathForTesting(base::string16 path) {
@@ -508,14 +504,18 @@ void DWriteFontProxyImpl::GetUniqueNameLookupTable(
       base::SequencedTaskRunnerHandle::Get(), std::move(callback));
 }
 
-void DWriteFontProxyImpl::FallbackFamilyNameForCodepoint(
+void DWriteFontProxyImpl::FallbackFamilyAndStyleForCodepoint(
     const std::string& base_family_name,
     const std::string& locale_name,
     uint32_t codepoint,
-    FallbackFamilyNameForCodepointCallback callback) {
+    FallbackFamilyAndStyleForCodepointCallback callback) {
   InitializeDirectWrite();
-  callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(std::move(callback),
-                                                         std::string());
+  callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(
+      std::move(callback),
+      blink::mojom::FallbackFamilyAndStyle::New("",
+                                                /* weight */ 0,
+                                                /* width */ 0,
+                                                /* slant */ 0));
 
   if (!codepoint)
     return;
@@ -536,7 +536,13 @@ void DWriteFontProxyImpl::FallbackFamilyNameForCodepoint(
 
   SkString family_name;
   typeface->getFamilyName(&family_name);
-  std::move(callback).Run(family_name.c_str());
+
+  SkFontStyle font_style = typeface->fontStyle();
+
+  auto result_fallback_and_style = blink::mojom::FallbackFamilyAndStyle::New(
+      family_name.c_str(), font_style.weight(), font_style.width(),
+      font_style.slant());
+  std::move(callback).Run(std::move(result_fallback_and_style));
 }
 
 void DWriteFontProxyImpl::InitializeDirectWrite() {
diff --git a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.h b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.h
index 994540612e2..09e449102ce 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.h
+++ b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win.h
@@ -9,8 +9,7 @@
 #include <dwrite_2.h>
 #include <dwrite_3.h>
 #include <wrl.h>
-#include <set>
-#include <utility>
+#include <string>
 #include <vector>
 
 #include "base/location.h"
@@ -22,12 +21,9 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_message_filter.h"
 #include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "third_party/blink/public/mojom/dwrite_font_proxy/dwrite_font_proxy.mojom.h"
 
-namespace service_manager {
-struct BindSourceInfo;
-}
-
 namespace content {
 
 // Implements a message filter that handles the dwrite font proxy messages.
@@ -39,8 +35,8 @@ class CONTENT_EXPORT DWriteFontProxyImpl
   DWriteFontProxyImpl();
   ~DWriteFontProxyImpl() override;
 
-  static void Create(blink::mojom::DWriteFontProxyRequest request,
-                     const service_manager::BindSourceInfo& source_info);
+  static void Create(
+      mojo::PendingReceiver<blink::mojom::DWriteFontProxy> receiver);
 
   void SetWindowsFontsPathForTesting(base::string16 path);
 
@@ -70,11 +66,11 @@ class CONTENT_EXPORT DWriteFontProxyImpl
   void GetUniqueNameLookupTable(
       GetUniqueNameLookupTableCallback callback) override;
 
-  void FallbackFamilyNameForCodepoint(
+  void FallbackFamilyAndStyleForCodepoint(
       const std::string& base_family_name,
       const std::string& locale_name,
       uint32_t codepoint,
-      FallbackFamilyNameForCodepointCallback callback) override;
+      FallbackFamilyAndStyleForCodepointCallback callback) override;
 
   void InitializeDirectWrite();
 
@@ -99,4 +95,4 @@ class CONTENT_EXPORT DWriteFontProxyImpl
 
 }  // namespace content
 
-#endif  // CONTENT_BROWSER_RENDERER_HOST_DWRITE_FONT_PROXY_MESSAGE_FILTER_WIN_H_
+#endif  // CONTENT_BROWSER_RENDERER_HOST_DWRITE_FONT_PROXY_IMPL_WIN_H_
diff --git a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win_unittest.cc b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win_unittest.cc
index 71c515c0734..fa5c3fb1987 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win_unittest.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_proxy_impl_win_unittest.cc
@@ -22,7 +22,8 @@
 #include "base/win/windows_version.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/browser_task_environment.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/dwrite_rasterizer_support/dwrite_rasterizer_support.h"
@@ -57,7 +58,7 @@ constexpr int kDWriteMajorVersionSupportingSingleLookups = 10;
 class DWriteFontProxyImplUnitTest : public testing::Test {
  public:
   DWriteFontProxyImplUnitTest()
-      : binding_(&impl_, mojo::MakeRequest(&dwrite_font_proxy_)) {}
+      : receiver_(&impl_, dwrite_font_proxy_.BindNewPipeAndPassReceiver()) {}
 
   blink::mojom::DWriteFontProxy& dwrite_font_proxy() {
     return *dwrite_font_proxy_;
@@ -70,9 +71,9 @@ class DWriteFontProxyImplUnitTest : public testing::Test {
   }
 
   base::test::TaskEnvironment task_environment_;
-  blink::mojom::DWriteFontProxyPtr dwrite_font_proxy_;
+  mojo::Remote<blink::mojom::DWriteFontProxy> dwrite_font_proxy_;
   DWriteFontProxyImpl impl_;
-  mojo::Binding<blink::mojom::DWriteFontProxy> binding_;
+  mojo::Receiver<blink::mojom::DWriteFontProxy> receiver_;
 };
 
 // Derived class for tests that exercise font unique local matching mojo methods
@@ -268,24 +269,31 @@ TEST_F(DWriteFontProxyImplUnitTest, FallbackFamily) {
     if (fallback_request.is_win10 && !on_win10)
       continue;
 
-    std::string family_name;
+    blink::mojom::FallbackFamilyAndStylePtr fallback_family_and_style;
     UChar32 codepoint;
     U16_GET(fallback_request.text.c_str(), 0, 0, fallback_request.text.size(),
             codepoint);
-    dwrite_font_proxy().FallbackFamilyNameForCodepoint(
+    dwrite_font_proxy().FallbackFamilyAndStyleForCodepoint(
         "Times New Roman", fallback_request.language_tag, codepoint,
-        &family_name);
+        &fallback_family_and_style);
 
     auto find_result_it =
         std::find(fallback_request.fallback_fonts.begin(),
-                  fallback_request.fallback_fonts.end(), family_name);
+                  fallback_request.fallback_fonts.end(),
+                  fallback_family_and_style->fallback_family_name);
 
     EXPECT_TRUE(find_result_it != fallback_request.fallback_fonts.end())
         << "Did not find expected fallback font for language: "
         << fallback_request.language_tag << ", codepoint U+" << std::hex
-        << codepoint << " DWrite returned font name: \"" << family_name << "\""
+        << codepoint << " DWrite returned font name: \""
+        << fallback_family_and_style->fallback_family_name << "\""
         << ", expected: "
         << base::JoinString(fallback_request.fallback_fonts, ", ");
+    EXPECT_EQ(fallback_family_and_style->weight, 400u);
+    EXPECT_EQ(fallback_family_and_style->width,
+              5u);  // SkFontStyle::Width::kNormal_Width
+    EXPECT_EQ(fallback_family_and_style->slant,
+              0u);  // SkFontStyle::Slant::kUpright_Slant
   }
 }
 
diff --git a/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.cc b/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.cc
index 9c180db4154..5600ffae80a 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.cc
+++ b/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.cc
@@ -8,7 +8,6 @@
 #include "base/metrics/histogram_macros.h"
 
 namespace content {
-namespace dwrite_font_uma_logging {
 
 void LogLoaderType(DirectWriteFontLoaderType loader_type) {
   UMA_HISTOGRAM_ENUMERATION("DirectWrite.Fonts.Proxy.LoaderType", loader_type);
@@ -29,5 +28,4 @@ void LogMessageFilterError(MessageFilterError error) {
                             error);
 }
 
-}  // namespace dwrite_font_uma_logging
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.h b/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.h
index daf9d239d34..80224985052 100644
--- a/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.h
+++ b/chromium/content/browser/renderer_host/dwrite_font_uma_logging_win.h
@@ -7,8 +7,6 @@
 
 namespace content {
 
-namespace dwrite_font_uma_logging {
-
 // This enum is used to define the buckets for an enumerated UMA histogram.
 // Hence,
 //   (a) existing enumerated constants should never be deleted or reordered, and
@@ -53,7 +51,6 @@ void LogLastResortFontFileCount(size_t count);
 
 void LogMessageFilterError(MessageFilterError error);
 
-}  // namespace dwrite_font_uma_logging
 }  // namespace content
 
 #endif  // CONTENT_BROWSER_RENDERER_HOST_DWRITE_FONT_UMA_LOGGING_WIN_H_
diff --git a/chromium/content/browser/renderer_host/embedded_frame_sink_impl.cc b/chromium/content/browser/renderer_host/embedded_frame_sink_impl.cc
index edaf6d1c048..72d351a108c 100644
--- a/chromium/content/browser/renderer_host/embedded_frame_sink_impl.cc
+++ b/chromium/content/browser/renderer_host/embedded_frame_sink_impl.cc
@@ -55,8 +55,7 @@ void EmbeddedFrameSinkImpl::CreateCompositorFrameSink(
   }
 
   host_frame_sink_manager_->CreateCompositorFrameSink(
-      frame_sink_id_, std::move(receiver),
-      viz::mojom::CompositorFrameSinkClientPtr(std::move(client)));
+      frame_sink_id_, std::move(receiver), std::move(client));
 
   has_created_compositor_frame_sink_ = true;
 }
diff --git a/chromium/content/browser/renderer_host/embedded_frame_sink_provider_impl_unittest.cc b/chromium/content/browser/renderer_host/embedded_frame_sink_provider_impl_unittest.cc
index 112ba8098c4..edda33e2fbb 100644
--- a/chromium/content/browser/renderer_host/embedded_frame_sink_provider_impl_unittest.cc
+++ b/chromium/content/browser/renderer_host/embedded_frame_sink_provider_impl_unittest.cc
@@ -22,6 +22,7 @@
 #include "components/viz/test/mock_compositor_frame_sink_client.h"
 #include "content/browser/compositor/surface_utils.h"
 #include "content/browser/renderer_host/embedded_frame_sink_impl.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -47,7 +48,7 @@ constexpr viz::FrameSinkId kFrameSinkB(kRendererClientId, 4);
 template <class T>
 void WaitForConnectionError(T* endpoint) {
   base::RunLoop run_loop;
-  endpoint->set_connection_error_handler(run_loop.QuitClosure());
+  endpoint->set_disconnect_handler(run_loop.QuitClosure());
   run_loop.Run();
 }
 
@@ -182,8 +183,7 @@ TEST_F(EmbeddedFrameSinkProviderImplTest,
   viz::MockCompositorFrameSinkClient compositor_frame_sink_client;
   mojo::Remote<blink::mojom::SurfaceEmbedder> surface_embedder;
   provider()->CreateCompositorFrameSink(
-      kFrameSinkA,
-      compositor_frame_sink_client.BindInterfacePtr().PassInterface(),
+      kFrameSinkA, compositor_frame_sink_client.BindInterfaceRemote(),
       compositor_frame_sink.BindNewPipeAndPassReceiver());
   provider()->ConnectToEmbedder(kFrameSinkA,
                                 surface_embedder.BindNewPipeAndPassReceiver());
@@ -257,14 +257,13 @@ TEST_F(EmbeddedFrameSinkProviderImplTest, ProviderClosesConnections) {
 // EmbeddedFrameSink connection fails.
 TEST_F(EmbeddedFrameSinkProviderImplTest, ClientConnectionWrongOrder) {
   // Mimic connection from the renderer main or worker thread.
-  viz::mojom::CompositorFrameSinkPtr compositor_frame_sink;
+  mojo::Remote<viz::mojom::CompositorFrameSink> compositor_frame_sink;
   viz::MockCompositorFrameSinkClient compositor_frame_sink_client;
   // Try to connect CompositorFrameSink without first making
   // EmbeddedFrameSink connection. This should fail.
   provider()->CreateCompositorFrameSink(
-      kFrameSinkA,
-      compositor_frame_sink_client.BindInterfacePtr().PassInterface(),
-      mojo::MakeRequest(&compositor_frame_sink));
+      kFrameSinkA, compositor_frame_sink_client.BindInterfaceRemote(),
+      compositor_frame_sink.BindNewPipeAndPassReceiver());
 
   // The request will fail and trigger a connection error.
   WaitForConnectionError(&compositor_frame_sink);
@@ -277,14 +276,13 @@ TEST_F(EmbeddedFrameSinkProviderImplTest, ParentNotRegistered) {
   provider()->RegisterEmbeddedFrameSink(kFrameSinkA, kFrameSinkB,
                                         efs_client.GetInterfaceRemote());
 
-  viz::mojom::CompositorFrameSinkPtr compositor_frame_sink;
+  mojo::Remote<viz::mojom::CompositorFrameSink> compositor_frame_sink;
   viz::MockCompositorFrameSinkClient compositor_frame_sink_client;
   // The embedder, kFrameSinkA, has already been invalidated and isn't
   // registered at this point. This request should fail.
   provider()->CreateCompositorFrameSink(
-      kFrameSinkB,
-      compositor_frame_sink_client.BindInterfacePtr().PassInterface(),
-      mojo::MakeRequest(&compositor_frame_sink));
+      kFrameSinkB, compositor_frame_sink_client.BindInterfaceRemote(),
+      compositor_frame_sink.BindNewPipeAndPassReceiver());
 
   // The request will fail and trigger a connection error.
   WaitForConnectionError(&compositor_frame_sink);
diff --git a/chromium/content/browser/renderer_host/file_utilities_host_impl.cc b/chromium/content/browser/renderer_host/file_utilities_host_impl.cc
index 3ac5de41d00..f959c867cf5 100644
--- a/chromium/content/browser/renderer_host/file_utilities_host_impl.cc
+++ b/chromium/content/browser/renderer_host/file_utilities_host_impl.cc
@@ -4,12 +4,14 @@
 
 #include "content/browser/renderer_host/file_utilities_host_impl.h"
 
+#include <memory>
 #include <utility>
 
 #include "base/files/file_util.h"
 #include "base/optional.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
 
@@ -20,9 +22,9 @@ FileUtilitiesHostImpl::~FileUtilitiesHostImpl() = default;
 
 void FileUtilitiesHostImpl::Create(
     int process_id,
-    blink::mojom::FileUtilitiesHostRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<FileUtilitiesHostImpl>(process_id),
-                          std::move(request));
+    mojo::PendingReceiver<blink::mojom::FileUtilitiesHost> receiver) {
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<FileUtilitiesHostImpl>(process_id), std::move(receiver));
 }
 
 void FileUtilitiesHostImpl::GetFileInfo(const base::FilePath& path,
diff --git a/chromium/content/browser/renderer_host/file_utilities_host_impl.h b/chromium/content/browser/renderer_host/file_utilities_host_impl.h
index 23fe4807e3b..75295a8d109 100644
--- a/chromium/content/browser/renderer_host/file_utilities_host_impl.h
+++ b/chromium/content/browser/renderer_host/file_utilities_host_impl.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_BROWSER_RENDERER_HOST_FILE_UTILITIES_HOST_IMPL_H_
 #define CONTENT_BROWSER_RENDERER_HOST_FILE_UTILITIES_HOST_IMPL_H_
 
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "third_party/blink/public/mojom/file/file_utilities.mojom.h"
 
 namespace content {
@@ -14,8 +15,9 @@ class FileUtilitiesHostImpl : public blink::mojom::FileUtilitiesHost {
   explicit FileUtilitiesHostImpl(int process_id);
   ~FileUtilitiesHostImpl() override;
 
-  static void Create(int process_id,
-                     blink::mojom::FileUtilitiesHostRequest request);
+  static void Create(
+      int process_id,
+      mojo::PendingReceiver<blink::mojom::FileUtilitiesHost> receiver);
 
  private:
   // blink::mojom::FileUtilitiesHost implementation.
diff --git a/chromium/content/browser/renderer_host/frame_sink_provider_impl.cc b/chromium/content/browser/renderer_host/frame_sink_provider_impl.cc
index b984d94d725..22062e8bf57 100644
--- a/chromium/content/browser/renderer_host/frame_sink_provider_impl.cc
+++ b/chromium/content/browser/renderer_host/frame_sink_provider_impl.cc
@@ -7,27 +7,30 @@
 namespace content {
 
 FrameSinkProviderImpl::FrameSinkProviderImpl(int32_t process_id)
-    : process_id_(process_id), binding_(this) {}
+    : process_id_(process_id) {}
 
 FrameSinkProviderImpl::~FrameSinkProviderImpl() = default;
 
-void FrameSinkProviderImpl::Bind(mojom::FrameSinkProviderRequest request) {
-  if (binding_.is_bound()) {
+void FrameSinkProviderImpl::Bind(
+    mojo::PendingReceiver<mojom::FrameSinkProvider> receiver) {
+  if (receiver_.is_bound()) {
     DLOG(ERROR) << "Received multiple requests for FrameSinkProvider. "
                 << "There should be only one instance per renderer.";
     return;
   }
-  binding_.Bind(std::move(request));
+  receiver_.Bind(std::move(receiver));
 }
 
 void FrameSinkProviderImpl::Unbind() {
-  binding_.Close();
+  receiver_.reset();
 }
 
 void FrameSinkProviderImpl::CreateForWidget(
     int32_t widget_id,
-    viz::mojom::CompositorFrameSinkRequest compositor_frame_sink_request,
-    viz::mojom::CompositorFrameSinkClientPtr compositor_frame_sink_client) {
+    mojo::PendingReceiver<viz::mojom::CompositorFrameSink>
+        compositor_frame_sink_receiver,
+    mojo::PendingRemote<viz::mojom::CompositorFrameSinkClient>
+        compositor_frame_sink_client) {
   RenderWidgetHostImpl* render_widget_host_impl =
       RenderWidgetHostImpl::FromID(process_id_, widget_id);
   if (!render_widget_host_impl) {
@@ -36,15 +39,16 @@ void FrameSinkProviderImpl::CreateForWidget(
     return;
   }
   render_widget_host_impl->RequestCompositorFrameSink(
-      std::move(compositor_frame_sink_request),
+      std::move(compositor_frame_sink_receiver),
       std::move(compositor_frame_sink_client));
 }
 
 void FrameSinkProviderImpl::RegisterRenderFrameMetadataObserver(
     int32_t widget_id,
-    mojom::RenderFrameMetadataObserverClientRequest
-        render_frame_metadata_observer_client_request,
-    mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer) {
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_client_receiver,
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+        render_frame_metadata_observer) {
   RenderWidgetHostImpl* render_widget_host_impl =
       RenderWidgetHostImpl::FromID(process_id_, widget_id);
   if (!render_widget_host_impl) {
@@ -53,7 +57,7 @@ void FrameSinkProviderImpl::RegisterRenderFrameMetadataObserver(
     return;
   }
   render_widget_host_impl->RegisterRenderFrameMetadataObserver(
-      std::move(render_frame_metadata_observer_client_request),
+      std::move(render_frame_metadata_observer_client_receiver),
       std::move(render_frame_metadata_observer));
 }
 
diff --git a/chromium/content/browser/renderer_host/frame_sink_provider_impl.h b/chromium/content/browser/renderer_host/frame_sink_provider_impl.h
index ff610d3afc7..832a2683ca9 100644
--- a/chromium/content/browser/renderer_host/frame_sink_provider_impl.h
+++ b/chromium/content/browser/renderer_host/frame_sink_provider_impl.h
@@ -7,7 +7,9 @@
 
 #include "content/common/frame_sink_provider.mojom.h"
 #include "content/common/render_frame_metadata.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 
 namespace content {
 
@@ -18,24 +20,26 @@ class FrameSinkProviderImpl : public mojom::FrameSinkProvider {
   explicit FrameSinkProviderImpl(int32_t process_id);
   ~FrameSinkProviderImpl() override;
 
-  void Bind(mojom::FrameSinkProviderRequest request);
+  void Bind(mojo::PendingReceiver<mojom::FrameSinkProvider> receiver);
   void Unbind();
 
   // mojom::FrameSinkProvider implementation.
   void CreateForWidget(
       int32_t widget_id,
-      viz::mojom::CompositorFrameSinkRequest compositor_frame_sink_request,
-      viz::mojom::CompositorFrameSinkClientPtr compositor_frame_sink_client)
-      override;
+      mojo::PendingReceiver<viz::mojom::CompositorFrameSink>
+          compositor_frame_sink_receiver,
+      mojo::PendingRemote<viz::mojom::CompositorFrameSinkClient>
+          compositor_frame_sink_client) override;
   void RegisterRenderFrameMetadataObserver(
       int32_t widget_id,
-      mojom::RenderFrameMetadataObserverClientRequest
-          render_frame_metadata_observer_client_request,
-      mojom::RenderFrameMetadataObserverPtr observer) override;
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+          render_frame_metadata_observer_client_receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserver> observer)
+      override;
 
  private:
   const int32_t process_id_;
-  mojo::Binding<mojom::FrameSinkProvider> binding_;
+  mojo::Receiver<mojom::FrameSinkProvider> receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(FrameSinkProviderImpl);
 };
diff --git a/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc b/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc
index 5ec783ee857..fca74bc6ef4 100644
--- a/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/autoscroll_browsertest.cc
@@ -269,7 +269,9 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest,
   RenderFrameSubmissionObserver observer(
       GetWidgetHost()->render_frame_metadata_provider());
   blink::WebMouseWheelEvent wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, -53, 0, true);
+      SyntheticWebMouseWheelEventBuilder::Build(
+          10, 10, 0, -53, 0,
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
   wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
   GetWidgetHost()->ForwardWheelEvent(wheel_event);
   WaitForScroll(observer);
@@ -288,7 +290,9 @@ IN_PROC_BROWSER_TEST_F(AutoscrollBrowserTest,
   RenderFrameSubmissionObserver observer(
       GetWidgetHost()->render_frame_metadata_provider());
   blink::WebMouseWheelEvent wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, -53, 0, true);
+      SyntheticWebMouseWheelEventBuilder::Build(
+          10, 10, 0, -53, 0,
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
   wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
   GetWidgetHost()->ForwardWheelEvent(wheel_event);
 
diff --git a/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc b/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc
index 8c577c879a7..99c2be18af7 100644
--- a/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/composited_scrolling_browsertest.cc
@@ -9,6 +9,7 @@
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "base/strings/utf_string_conversions.h"
+#include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/browser/renderer_host/input/synthetic_gesture.h"
 #include "content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.h"
@@ -61,8 +62,13 @@ namespace content {
 
 class CompositedScrollingBrowserTest : public ContentBrowserTest {
  public:
-  CompositedScrollingBrowserTest() {}
-  ~CompositedScrollingBrowserTest() override {}
+  CompositedScrollingBrowserTest() {
+    // Disable scroll resampling because this is checking scroll distance.
+    scoped_feature_list_.InitAndDisableFeature(
+        features::kResamplingScrollEvents);
+  }
+
+  ~CompositedScrollingBrowserTest() override = default;
 
   void SetUpCommandLine(base::CommandLine* cmd) override {
     cmd->AppendSwitch(switches::kEnablePreferCompositingToLCDText);
@@ -148,6 +154,7 @@ class CompositedScrollingBrowserTest : public ContentBrowserTest {
   }
 
  private:
+  base::test::ScopedFeatureList scoped_feature_list_;
   scoped_refptr<MessageLoopRunner> runner_;
 
   DISALLOW_COPY_AND_ASSIGN(CompositedScrollingBrowserTest);
diff --git a/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc b/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc
index c12f8150556..1377b66ce03 100644
--- a/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/compositor_event_ack_browsertest.cc
@@ -165,7 +165,9 @@ class CompositorEventAckBrowserTest : public ContentBrowserTest {
     // This event never completes its processing. As kCompositorEventAckDataURL
     // will block the renderer's main thread once it is received.
     blink::WebMouseWheelEvent wheel_event =
-        SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, -53, 0, true);
+        SyntheticWebMouseWheelEventBuilder::Build(
+            10, 10, 0, -53, 0,
+            ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
     wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
     GetWidgetHost()->ForwardWheelEvent(wheel_event);
 
diff --git a/chromium/content/browser/renderer_host/input/fling_browsertest.cc b/chromium/content/browser/renderer_host/input/fling_browsertest.cc
index b5812323168..252b8653dd0 100644
--- a/chromium/content/browser/renderer_host/input/fling_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/fling_browsertest.cc
@@ -198,7 +198,7 @@ class BrowserSideFlingBrowserTest : public ContentBrowserTest {
     blink::WebMouseWheelEvent wheel_event =
         SyntheticWebMouseWheelEventBuilder::Build(
             10, 10, fling_velocity.x() / 1000, fling_velocity.y() / 1000, 0,
-            true);
+            ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
     wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
     const gfx::PointF position_in_widget(1, 1);
     const gfx::PointF position_in_root =
diff --git a/chromium/content/browser/renderer_host/input/fling_controller.cc b/chromium/content/browser/renderer_host/input/fling_controller.cc
index 77761670e59..4ebe835f7dd 100644
--- a/chromium/content/browser/renderer_host/input/fling_controller.cc
+++ b/chromium/content/browser/renderer_host/input/fling_controller.cc
@@ -96,17 +96,22 @@ bool FlingController::ObserveAndFilterForTapSuppression(
 
 bool FlingController::ObserveAndMaybeConsumeGestureEvent(
     const GestureEventWithLatencyInfo& gesture_event) {
+  TRACE_EVENT0("input", "FlingController::ObserveAndMaybeConsumeGestureEvent");
   // FlingCancel events arrive when a finger is touched down regardless of
   // whether there is an ongoing fling. These can affect state so if there's no
   // on-going fling we should just discard these without letting the rest of
   // the fling system see it.
   if (gesture_event.event.GetType() == WebInputEvent::kGestureFlingCancel &&
       !fling_curve_) {
+    TRACE_EVENT_INSTANT0("input", "NoActiveFling", TRACE_EVENT_SCOPE_THREAD);
     return true;
   }
 
-  if (ObserveAndFilterForTapSuppression(gesture_event))
+  if (ObserveAndFilterForTapSuppression(gesture_event)) {
+    TRACE_EVENT_INSTANT0("input", "FilterTapSuppression",
+                         TRACE_EVENT_SCOPE_THREAD);
     return true;
+  }
 
   if (gesture_event.event.GetType() == WebInputEvent::kGestureScrollUpdate) {
     last_seen_scroll_update_ = gesture_event.event.TimeStamp();
@@ -257,9 +262,10 @@ void FlingController::GenerateAndSendWheelEvents(
   MouseWheelEventWithLatencyInfo synthetic_wheel(
       WebInputEvent::kMouseWheel, current_fling_parameters_.modifiers,
       clock_->NowTicks(), ui::LatencyInfo(ui::SourceEventType::WHEEL));
+  synthetic_wheel.event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   synthetic_wheel.event.delta_x = delta.x();
   synthetic_wheel.event.delta_y = delta.y();
-  synthetic_wheel.event.has_precise_scrolling_deltas = true;
   synthetic_wheel.event.momentum_phase = phase;
   synthetic_wheel.event.has_synthetic_phase = true;
   synthetic_wheel.event.SetPositionInWidget(current_fling_parameters_.point);
diff --git a/chromium/content/browser/renderer_host/input/gesture_event_queue.cc b/chromium/content/browser/renderer_host/input/gesture_event_queue.cc
index 412bb16989b..d318665e29f 100644
--- a/chromium/content/browser/renderer_host/input/gesture_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/gesture_event_queue.cc
@@ -56,7 +56,6 @@ bool GestureEventQueue::DebounceOrForwardEvent(
 
 bool GestureEventQueue::PassToFlingController(
     const GestureEventWithLatencyInfo& gesture_event) {
-  TRACE_EVENT0("input", "GestureEventQueue::QueueEvent");
   return fling_controller_.ObserveAndMaybeConsumeGestureEvent(gesture_event);
 }
 
diff --git a/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc b/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc
index 03189ee0bcd..2145050b5d3 100644
--- a/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/input_router_impl_unittest.cc
@@ -262,7 +262,9 @@ class InputRouterImplTestBase : public testing::Test {
                           bool precise,
                           WebMouseWheelEvent::Phase phase) {
     WebMouseWheelEvent wheel_event = SyntheticWebMouseWheelEventBuilder::Build(
-        x, y, dX, dY, modifiers, precise);
+        x, y, dX, dY, modifiers,
+        precise ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+                : ui::input_types::ScrollGranularity::kScrollByPixel);
     wheel_event.phase = phase;
     input_router_->SendWheelEvent(MouseWheelEventWithLatencyInfo(wheel_event));
   }
diff --git a/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc b/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc
index 23caf0ab8f0..4501a44e814 100644
--- a/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_latency_browsertest.cc
@@ -29,6 +29,7 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
 namespace {
@@ -77,7 +78,7 @@ class TracingRenderWidgetHost : public RenderWidgetHostImpl {
   TracingRenderWidgetHost(RenderWidgetHostDelegate* delegate,
                           RenderProcessHost* process,
                           int32_t routing_id,
-                          mojom::WidgetPtr widget,
+                          mojo::PendingRemote<mojom::Widget> widget,
                           bool hidden)
       : RenderWidgetHostImpl(delegate,
                              process,
@@ -139,7 +140,7 @@ class TracingRenderWidgetHostFactory : public RenderWidgetHostFactory {
       RenderWidgetHostDelegate* delegate,
       RenderProcessHost* process,
       int32_t routing_id,
-      mojom::WidgetPtr widget_interface,
+      mojo::PendingRemote<mojom::Widget> widget_interface,
       bool hidden) override {
     return std::make_unique<TracingRenderWidgetHost>(
         delegate, process, routing_id, std::move(widget_interface), hidden);
@@ -164,11 +165,9 @@ class MouseLatencyBrowserTest : public ContentBrowserTest {
     runner_->Quit();
   }
 
-  void OnTraceDataCollected(
-      std::unique_ptr<const base::DictionaryValue> metadata,
-      base::RefCountedString* trace_data_string) {
+  void OnTraceDataCollected(std::unique_ptr<std::string> trace_data_string) {
     std::unique_ptr<base::Value> trace_data =
-        base::JSONReader::ReadDeprecated(trace_data_string->data());
+        base::JSONReader::ReadDeprecated(*trace_data_string);
     ASSERT_TRUE(trace_data);
     trace_data_ = trace_data->Clone();
     runner_->Quit();
@@ -263,8 +262,8 @@ class MouseLatencyBrowserTest : public ContentBrowserTest {
   const base::Value& StopTracing() {
     bool success = TracingController::GetInstance()->StopTracing(
         TracingController::CreateStringEndpoint(
-            base::Bind(&MouseLatencyBrowserTest::OnTraceDataCollected,
-                       base::Unretained(this))));
+            base::BindOnce(&MouseLatencyBrowserTest::OnTraceDataCollected,
+                           base::Unretained(this))));
     EXPECT_TRUE(success);
 
     // Runs until we get the OnTraceDataCollected callback, which populates
@@ -352,7 +351,7 @@ IN_PROC_BROWSER_TEST_F(MouseLatencyBrowserTest,
       GetWidgetHost(), blink::WebInputEvent::kMouseUp);
   StartTracing();
   DoSyncClick(gfx::PointF(100, 100));
-  EXPECT_EQ(INPUT_EVENT_ACK_STATE_CONSUMED,
+  EXPECT_EQ(INPUT_EVENT_ACK_STATE_NOT_CONSUMED,
             filter->GetAckStateWaitIfNecessary());
   const base::Value& trace_data = StopTracing();
 
@@ -416,8 +415,9 @@ IN_PROC_BROWSER_TEST_F(MouseLatencyBrowserTest,
   AssertTraceIdsBeginAndEnd(trace_data, "InputLatency::MouseMove");
 }
 
+// TODO(https://crbug.com/923627): This is flaky on multiple platforms.
 IN_PROC_BROWSER_TEST_F(MouseLatencyBrowserTest,
-                       CoalescedMouseWheelsCorrectlyTerminated) {
+                       DISABLED_CoalescedMouseWheelsCorrectlyTerminated) {
   LoadURL();
 
   StartTracing();
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc
index f42f9a81d26..25bed3d0b72 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue.cc
@@ -165,10 +165,19 @@ void MouseWheelEventQueue::ProcessMouseWheelAck(
       scroll_update.data.scroll_update.inertial_phase =
           WebGestureEvent::InertialPhaseState::kNonMomentum;
     }
-    if (event_sent_for_gesture_ack_->event.scroll_by_page) {
-      scroll_update.data.scroll_update.delta_units =
-          ui::input_types::ScrollGranularity::kScrollByPage;
 
+    // WebMouseWheelEvent only supports these units for the delta.
+    DCHECK(event_sent_for_gesture_ack_->event.delta_units ==
+               ui::input_types::ScrollGranularity::kScrollByPage ||
+           event_sent_for_gesture_ack_->event.delta_units ==
+               ui::input_types::ScrollGranularity::kScrollByPrecisePixel ||
+           event_sent_for_gesture_ack_->event.delta_units ==
+               ui::input_types::ScrollGranularity::kScrollByPixel);
+    scroll_update.data.scroll_update.delta_units =
+        event_sent_for_gesture_ack_->event.delta_units;
+
+    if (event_sent_for_gesture_ack_->event.delta_units ==
+        ui::input_types::ScrollGranularity::kScrollByPage) {
       // Turn page scrolls into a *single* page scroll because
       // the magnitude the number of ticks is lost when coalescing.
       if (scroll_update.data.scroll_update.delta_x)
@@ -178,11 +187,6 @@ void MouseWheelEventQueue::ProcessMouseWheelAck(
         scroll_update.data.scroll_update.delta_y =
             scroll_update.data.scroll_update.delta_y > 0 ? 1 : -1;
     } else {
-      scroll_update.data.scroll_update.delta_units =
-          event_sent_for_gesture_ack_->event.has_precise_scrolling_deltas
-              ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
-              : ui::input_types::ScrollGranularity::kScrollByPixel;
-
       if (event_sent_for_gesture_ack_->event.rails_mode ==
           WebInputEvent::kRailsModeVertical)
         scroll_update.data.scroll_update.delta_x = 0;
diff --git a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc
index bb54c90076e..07d4b0214eb 100644
--- a/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/mouse_wheel_event_queue_unittest.cc
@@ -240,7 +240,10 @@ class MouseWheelEventQueueTest : public testing::Test,
                       WebInputEvent::RailsMode rails_mode,
                       bool has_synthetic_phase = false) {
     WebMouseWheelEvent event = SyntheticWebMouseWheelEventBuilder::Build(
-        x, y, global_x, global_y, dX, dY, modifiers, high_precision);
+        x, y, global_x, global_y, dX, dY, modifiers,
+        high_precision
+            ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+            : ui::input_types::ScrollGranularity::kScrollByPixel);
     event.phase = phase;
     event.momentum_phase = momentum_phase;
     event.rails_mode = rails_mode;
diff --git a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc
index dd26e353559..fe3e63e2326 100644
--- a/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/passthrough_touch_event_queue.cc
@@ -207,6 +207,9 @@ bool PassthroughTouchEventQueue::Empty() const {
 }
 
 void PassthroughTouchEventQueue::FlushQueue() {
+  // Don't allow acks to be processed in AckCompletedEvents as that can
+  // interfere with gesture event dispatch ordering.
+  base::AutoReset<bool> process_acks(&processing_acks_, true);
   drop_remaining_touches_in_sequence_ = true;
   client_->FlushDeferredGestureQueue();
   while (!outstanding_touches_.empty()) {
diff --git a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc
index 5f4d05e088e..0ae8336ee98 100644
--- a/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/render_widget_host_latency_tracker_unittest.cc
@@ -13,6 +13,7 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/input/synthetic_web_input_event_builders.h"
 #include "content/public/browser/native_web_keyboard_event.h"
+#include "content/public/common/content_client.h"
 #include "content/test/test_content_browser_client.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
diff --git a/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc b/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc
index a074c6360a6..cbe4dc84e8e 100644
--- a/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/scroll_latency_browsertest.cc
@@ -101,7 +101,6 @@ class ScrollLatencyBrowserTest : public ContentBrowserTest {
     // instead of starting a new one.
     command_line->AppendSwitchASCII(
         cc::switches::kCCScrollAnimationDurationForTesting, "10000000");
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
   }
 
   void LoadURL() {
@@ -275,12 +274,9 @@ class ScrollLatencyScrollbarBrowserTest : public ScrollLatencyBrowserTest {
   void SetUpCommandLine(base::CommandLine* command_line) override {
     ScrollLatencyBrowserTest::SetUpCommandLine(command_line);
     command_line->AppendSwitch(::switches::kDisableSmoothScrolling);
-    // Enable |kScrollbarInjectScrollGestures|, as these tests depend on it
-    // being on. Disable kOverlayScrollbar since overlay scrollbars are not
+    // Disable kOverlayScrollbar since overlay scrollbars are not
     // hit-testable (thus input is not routed to scrollbars).
-    scoped_feature_list_.InitWithFeatures(
-        {blink::features::kScrollbarInjectScrollGestures},
-        {features::kOverlayScrollbar});
+    scoped_feature_list_.InitAndDisableFeature({features::kOverlayScrollbar});
   }
 
   ~ScrollLatencyScrollbarBrowserTest() override {}
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.cc
index 8a99d729521..67febf3e2e2 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.cc
@@ -51,6 +51,13 @@ void SyntheticGestureController::EnsureRendererInitialized(
       SyntheticGestureParams::DEFAULT_INPUT, std::move(wrapper));
 }
 
+void SyntheticGestureController::UpdateSyntheticGestureTarget(
+    std::unique_ptr<SyntheticGestureTarget> gesture_target,
+    Delegate* delegate) {
+  gesture_target_ = std::move(gesture_target);
+  delegate_ = delegate;
+}
+
 void SyntheticGestureController::QueueSyntheticGesture(
     std::unique_ptr<SyntheticGesture> synthetic_gesture,
     OnGestureCompleteCallback completion_callback) {
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.h b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.h
index 0528ecf18d2..4765002cf88 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller.h
@@ -56,6 +56,10 @@ class CONTENT_EXPORT SyntheticGestureController {
 
   void EnsureRendererInitialized(base::OnceClosure on_completed);
 
+  void UpdateSyntheticGestureTarget(
+      std::unique_ptr<SyntheticGestureTarget> gesture_target,
+      Delegate* delegate);
+
  private:
   friend class SyntheticGestureControllerTestBase;
 
@@ -72,7 +76,7 @@ class CONTENT_EXPORT SyntheticGestureController {
   void GestureCompleted(SyntheticGesture::Result result);
   void ResolveCompletionCallback();
 
-  Delegate* const delegate_;
+  Delegate* delegate_;
   std::unique_ptr<SyntheticGestureTarget> gesture_target_;
 
   // A queue of gesture/callback/bool tuples.  Implemented as multiple queues to
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc
index b31d0fe45fd..2d1e4a3ea85 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_controller_unittest.cc
@@ -205,8 +205,7 @@ class MockMoveGestureTarget : public MockSyntheticGestureTarget {
  public:
   MockMoveGestureTarget()
       : total_abs_move_distance_length_(0),
-        precise_scrolling_deltas_(false),
-        scroll_by_page_(false) {}
+        granularity_(ui::input_types::ScrollGranularity::kScrollByPixel) {}
   ~MockMoveGestureTarget() override {}
 
   gfx::Vector2dF start_to_end_distance() const {
@@ -215,14 +214,15 @@ class MockMoveGestureTarget : public MockSyntheticGestureTarget {
   float total_abs_move_distance_length() const {
     return total_abs_move_distance_length_;
   }
-  bool precise_scrolling_deltas() const { return precise_scrolling_deltas_; }
-  bool scroll_by_page() const { return scroll_by_page_; }
+
+  ui::input_types::ScrollGranularity granularity() const {
+    return granularity_;
+  }
 
  protected:
   gfx::Vector2dF start_to_end_distance_;
   float total_abs_move_distance_length_;
-  bool precise_scrolling_deltas_;
-  bool scroll_by_page_;
+  ui::input_types::ScrollGranularity granularity_;
 };
 
 class MockScrollMouseTarget : public MockMoveGestureTarget {
@@ -237,8 +237,7 @@ class MockScrollMouseTarget : public MockMoveGestureTarget {
     gfx::Vector2dF delta(mouse_wheel_event.delta_x, mouse_wheel_event.delta_y);
     start_to_end_distance_ += delta;
     total_abs_move_distance_length_ += delta.Length();
-    precise_scrolling_deltas_ = mouse_wheel_event.has_precise_scrolling_deltas;
-    scroll_by_page_ = mouse_wheel_event.scroll_by_page;
+    granularity_ = mouse_wheel_event.delta_units;
   }
 };
 
@@ -1284,7 +1283,8 @@ TEST_F(SyntheticGestureControllerTest, SingleScrollGestureMousePreciseScroll) {
   params.input_type = SyntheticSmoothMoveGestureParams::MOUSE_WHEEL_INPUT;
   params.start_point.SetPoint(39, 86);
   params.distances.push_back(gfx::Vector2d(0, -132));
-  params.precise_scrolling_deltas = true;
+  params.granularity =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
 
   std::unique_ptr<SyntheticSmoothMoveGesture> gesture(
       new SyntheticSmoothMoveGesture(params));
@@ -1295,8 +1295,7 @@ TEST_F(SyntheticGestureControllerTest, SingleScrollGestureMousePreciseScroll) {
       static_cast<MockMoveGestureTarget*>(target_);
   EXPECT_EQ(1, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(params.precise_scrolling_deltas,
-            scroll_target->precise_scrolling_deltas());
+  EXPECT_EQ(params.granularity, scroll_target->granularity());
 }
 
 TEST_F(SyntheticGestureControllerTest, SingleScrollGestureMouseScrollByPage) {
@@ -1306,7 +1305,7 @@ TEST_F(SyntheticGestureControllerTest, SingleScrollGestureMouseScrollByPage) {
   params.input_type = SyntheticSmoothMoveGestureParams::MOUSE_WHEEL_INPUT;
   params.start_point.SetPoint(39, 86);
   params.distances.push_back(gfx::Vector2d(0, -132));
-  params.scroll_by_page = true;
+  params.granularity = ui::input_types::ScrollGranularity::kScrollByPage;
 
   std::unique_ptr<SyntheticSmoothMoveGesture> gesture(
       new SyntheticSmoothMoveGesture(params));
@@ -1317,7 +1316,7 @@ TEST_F(SyntheticGestureControllerTest, SingleScrollGestureMouseScrollByPage) {
       static_cast<MockMoveGestureTarget*>(target_);
   EXPECT_EQ(1, num_success_);
   EXPECT_EQ(0, num_failure_);
-  EXPECT_EQ(params.scroll_by_page, scroll_target->scroll_by_page());
+  EXPECT_EQ(params.granularity, scroll_target->granularity());
 }
 
 void CheckIsWithinRangeMulti(float scroll_distance,
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
index e74bb829ea4..dd41deb7b71 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_aura.cc
@@ -84,11 +84,13 @@ void SyntheticGestureTargetAura::DispatchWebMouseWheelEventToPlatform(
   }
   base::TimeTicks timestamp = web_wheel.TimeStamp();
   int modifiers = ui::EF_NONE;
-  if (web_wheel.has_precise_scrolling_deltas)
+  if (web_wheel.delta_units ==
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel) {
     modifiers |= ui::EF_PRECISION_SCROLLING_DELTA;
-
-  if (web_wheel.scroll_by_page)
+  } else if (web_wheel.delta_units ==
+             ui::input_types::ScrollGranularity::kScrollByPage) {
     modifiers |= ui::EF_SCROLL_BY_PAGE;
+  }
 
   gfx::PointF location(web_wheel.PositionInWidget().x,
                        web_wheel.PositionInWidget().y);
diff --git a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm
index 449627c936c..d96301d31e6 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm
+++ b/chromium/content/browser/renderer_host/input/synthetic_gesture_target_mac.mm
@@ -4,7 +4,6 @@
 
 #include "content/browser/renderer_host/input/synthetic_gesture_target_mac.h"
 
-#include "base/mac/scoped_nsautorelease_pool.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #import "content/app_shim_remote_cocoa/render_widget_host_view_cocoa.h"
@@ -88,42 +87,42 @@ void SyntheticGestureTargetMac::DispatchWebGestureEventToPlatform(
     const ui::LatencyInfo& latency_info) {
   // Create an autorelease pool so that we clean up any synthetic events we
   // generate.
-  base::mac::ScopedNSAutoreleasePool pool;
-
-  NSPoint content_local = NSMakePoint(
-      web_gesture.PositionInWidget().x,
-      [cocoa_view_ frame].size.height - web_gesture.PositionInWidget().y);
-  NSPoint location_in_window =
-      [cocoa_view_ convertPoint:content_local toView:nil];
-
-  switch (web_gesture.GetType()) {
-    case WebInputEvent::kGesturePinchBegin: {
-      id cocoa_event =
-          [SyntheticPinchEvent eventWithMagnification:0.0f
-                                     locationInWindow:location_in_window
-                                                phase:NSEventPhaseBegan];
-      [cocoa_view_ handleBeginGestureWithEvent:cocoa_event
-                       isSyntheticallyInjected:YES];
-      return;
+  @autoreleasepool {
+    NSPoint content_local = NSMakePoint(
+        web_gesture.PositionInWidget().x,
+        [cocoa_view_ frame].size.height - web_gesture.PositionInWidget().y);
+    NSPoint location_in_window = [cocoa_view_ convertPoint:content_local
+                                                    toView:nil];
+
+    switch (web_gesture.GetType()) {
+      case WebInputEvent::kGesturePinchBegin: {
+        id cocoa_event =
+            [SyntheticPinchEvent eventWithMagnification:0.0f
+                                       locationInWindow:location_in_window
+                                                  phase:NSEventPhaseBegan];
+        [cocoa_view_ handleBeginGestureWithEvent:cocoa_event
+                         isSyntheticallyInjected:YES];
+        return;
+      }
+      case WebInputEvent::kGesturePinchEnd: {
+        id cocoa_event =
+            [SyntheticPinchEvent eventWithMagnification:0.0f
+                                       locationInWindow:location_in_window
+                                                  phase:NSEventPhaseEnded];
+        [cocoa_view_ handleEndGestureWithEvent:cocoa_event];
+        return;
+      }
+      case WebInputEvent::kGesturePinchUpdate: {
+        id cocoa_event = [SyntheticPinchEvent
+            eventWithMagnification:web_gesture.data.pinch_update.scale - 1.0f
+                  locationInWindow:location_in_window
+                             phase:NSEventPhaseChanged];
+        [cocoa_view_ magnifyWithEvent:cocoa_event];
+        return;
+      }
+      default:
+        NOTREACHED();
     }
-    case WebInputEvent::kGesturePinchEnd: {
-      id cocoa_event =
-          [SyntheticPinchEvent eventWithMagnification:0.0f
-                                     locationInWindow:location_in_window
-                                                phase:NSEventPhaseEnded];
-      [cocoa_view_ handleEndGestureWithEvent:cocoa_event];
-      return;
-    }
-    case WebInputEvent::kGesturePinchUpdate: {
-      id cocoa_event = [SyntheticPinchEvent
-          eventWithMagnification:web_gesture.data.pinch_update.scale - 1.0f
-                locationInWindow:location_in_window
-                           phase:NSEventPhaseChanged];
-      [cocoa_view_ magnifyWithEvent:cocoa_event];
-      return;
-    }
-    default:
-      NOTREACHED();
   }
 }
 
diff --git a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc
index acb270cbc50..6e321ffd062 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.cc
@@ -27,8 +27,7 @@ SyntheticSmoothMoveGestureParams::SyntheticSmoothMoveGestureParams()
       fling_velocity_y(0),
       prevent_fling(true),
       add_slop(true),
-      precise_scrolling_deltas(false),
-      scroll_by_page(false) {}
+      granularity(ui::input_types::ScrollGranularity::kScrollByPixel) {}
 
 SyntheticSmoothMoveGestureParams::SyntheticSmoothMoveGestureParams(
     const SyntheticSmoothMoveGestureParams& other) = default;
@@ -264,9 +263,8 @@ void SyntheticSmoothMoveGesture::ForwardMouseWheelEvent(
     const blink::WebMouseWheelEvent::Phase phase,
     const base::TimeTicks& timestamp) const {
   blink::WebMouseWheelEvent mouse_wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(
-          0, 0, delta.x(), delta.y(), 0, params_.precise_scrolling_deltas,
-          params_.scroll_by_page);
+      SyntheticWebMouseWheelEventBuilder::Build(0, 0, delta.x(), delta.y(), 0,
+                                                params_.granularity);
 
   mouse_wheel_event.SetPositionInWidget(
       current_move_segment_start_position_.x(),
diff --git a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h
index 353b10d30a7..0b3220b0db4 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h
+++ b/chromium/content/browser/renderer_host/input/synthetic_smooth_move_gesture.h
@@ -16,6 +16,7 @@
 #include "content/common/input/synthetic_smooth_drag_gesture_params.h"
 #include "content/common/input/synthetic_smooth_scroll_gesture_params.h"
 #include "third_party/blink/public/platform/web_input_event.h"
+#include "ui/events/types/scroll_types.h"
 #include "ui/gfx/geometry/vector2d.h"
 #include "ui/gfx/geometry/vector2d_f.h"
 
@@ -38,8 +39,7 @@ class CONTENT_EXPORT SyntheticSmoothMoveGestureParams {
   int fling_velocity_y;
   bool prevent_fling;
   bool add_slop;
-  bool precise_scrolling_deltas;
-  bool scroll_by_page;
+  ui::input_types::ScrollGranularity granularity;
 };
 
 // This class is used as helper class for simulation of scroll and drag.
diff --git a/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc b/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc
index 395806d5009..62a532f3b9f 100644
--- a/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc
+++ b/chromium/content/browser/renderer_host/input/synthetic_smooth_scroll_gesture.cc
@@ -57,8 +57,7 @@ bool SyntheticSmoothScrollGesture::InitializeMoveGesture(
     move_params.prevent_fling = params_.prevent_fling;
     move_params.input_type = GetInputSourceType(gesture_type);
     move_params.add_slop = true;
-    move_params.precise_scrolling_deltas = params_.precise_scrolling_deltas;
-    move_params.scroll_by_page = params_.scroll_by_page;
+    move_params.granularity = params_.granularity;
     move_gesture_.reset(new SyntheticSmoothMoveGesture(move_params));
     return true;
   }
diff --git a/chromium/content/browser/renderer_host/input/timeout_monitor.h b/chromium/content/browser/renderer_host/input/timeout_monitor.h
index ddec7c10dbb..ff7ae6dc840 100644
--- a/chromium/content/browser/renderer_host/input/timeout_monitor.h
+++ b/chromium/content/browser/renderer_host/input/timeout_monitor.h
@@ -16,7 +16,7 @@ namespace content {
 // Utility class for handling a timeout callback with periodic starts and stops.
 class CONTENT_EXPORT TimeoutMonitor {
  public:
-  typedef base::Closure TimeoutHandler;
+  typedef base::RepeatingClosure TimeoutHandler;
 
   explicit TimeoutMonitor(const TimeoutHandler& timeout_handler);
   ~TimeoutMonitor();
diff --git a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc
index 30ec4821aa7..7d87da23b09 100644
--- a/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/touch_selection_controller_client_aura_browsertest.cc
@@ -184,11 +184,6 @@ class TouchSelectionControllerClientAuraTest : public ContentBrowserTest {
         ui::test::MockMotionEvent(ui::MotionEvent::Action::DOWN));
   }
 
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    ContentBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
-  }
-
   void SetUpOnMainThread() override {
     ContentBrowserTest::SetUpOnMainThread();
     if (!ui::TouchSelectionMenuRunner::GetInstance())
@@ -352,7 +347,7 @@ class TouchSelectionControllerClientAuraSiteIsolationTest
   void SendTouch(RenderWidgetHostViewAura* view,
                  ui::EventType type,
                  gfx::Point point) {
-    DCHECK(type >= ui::ET_TOUCH_RELEASED && type << ui::ET_TOUCH_CANCELLED);
+    DCHECK(type >= ui::ET_TOUCH_RELEASED && type <= ui::ET_TOUCH_CANCELLED);
     // If we want the GestureRecognizer to create the gestures for us, we must
     // register the outgoing touch event with it by sending it through the
     // window's event dispatching system.
@@ -879,7 +874,6 @@ class TouchSelectionControllerClientAuraScaleFactorTest
     : public TouchSelectionControllerClientAuraTest {
  public:
   void SetUpCommandLine(base::CommandLine* command_line) override {
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
     command_line->AppendSwitchASCII(switches::kForceDeviceScaleFactor, "2");
   }
 };
diff --git a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc
index c19f5d8135c..c8478a0cb18 100644
--- a/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc
+++ b/chromium/content/browser/renderer_host/input/touchpad_pinch_event_queue.cc
@@ -51,11 +51,11 @@ blink::WebMouseWheelEvent CreateSyntheticWheelFromTouchpadPinchEvent(
       pinch_event.TimeStamp());
   wheel_event.SetPositionInWidget(pinch_event.PositionInWidget());
   wheel_event.SetPositionInScreen(pinch_event.PositionInScreen());
+  wheel_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   wheel_event.delta_x = 0;
   wheel_event.delta_y = delta_y;
 
-  wheel_event.has_precise_scrolling_deltas = true;
-
   wheel_event.phase = phase;
   wheel_event.wheel_ticks_x = 0;
   wheel_event.wheel_ticks_y = wheel_ticks_y;
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc b/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc
index 1815eb076d0..80d1624ed00 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_android.cc
@@ -158,7 +158,8 @@ WebMouseWheelEvent WebMouseWheelEventBuilder::Build(
   result.SetPositionInWidget(motion_event.GetX(0), motion_event.GetY(0));
   result.SetPositionInScreen(motion_event.GetRawX(0), motion_event.GetRawY(0));
   result.button = WebMouseEvent::Button::kNoButton;
-  result.has_precise_scrolling_deltas = true;
+  result.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   result.delta_x = motion_event.ticks_x() * motion_event.GetTickMultiplier();
   result.delta_y = motion_event.ticks_y() * motion_event.GetTickMultiplier();
   result.wheel_ticks_x = motion_event.ticks_x();
diff --git a/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm b/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
index af5cacd70b3..c58128fce66 100644
--- a/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
+++ b/chromium/content/browser/renderer_host/input/web_input_event_builders_mac.mm
@@ -517,13 +517,14 @@ blink::WebMouseWheelEvent WebMouseWheelEventBuilder::Build(
   // from data from any other continuous device.
 
   if (CGEventGetIntegerValueField(cg_event, kCGScrollWheelEventIsContinuous)) {
+    result.delta_units =
+        ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
     result.delta_x = CGEventGetIntegerValueField(
         cg_event, kCGScrollWheelEventPointDeltaAxis2);
     result.delta_y = CGEventGetIntegerValueField(
         cg_event, kCGScrollWheelEventPointDeltaAxis1);
     result.wheel_ticks_x = result.delta_x / ui::kScrollbarPixelsPerCocoaTick;
     result.wheel_ticks_y = result.delta_y / ui::kScrollbarPixelsPerCocoaTick;
-    result.has_precise_scrolling_deltas = true;
   } else {
     result.delta_x = [event deltaX] * ui::kScrollbarPixelsPerCocoaTick;
     result.delta_y = [event deltaY] * ui::kScrollbarPixelsPerCocoaTick;
diff --git a/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc b/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc
index 3315fc0675c..56352181b51 100644
--- a/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/wheel_event_listener_browsertest.cc
@@ -84,8 +84,9 @@ class WheelEventListenerBrowserTest : public ContentBrowserTest {
     double x = 10;
     double y = 10;
     blink::WebMouseWheelEvent wheel_event =
-        SyntheticWebMouseWheelEventBuilder::Build(x, y, x, y, -20, -20, 0,
-                                                  true);
+        SyntheticWebMouseWheelEventBuilder::Build(
+            x, y, x, y, -20, -20, 0,
+            ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
     wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
     GetWidgetHost()->ForwardWheelEvent(wheel_event);
     EXPECT_EQ(INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING,
diff --git a/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc b/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
index 8aa9b0a1d53..9b01cf7380a 100644
--- a/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
+++ b/chromium/content/browser/renderer_host/input/wheel_scroll_latching_browsertest.cc
@@ -166,8 +166,9 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest, MAYBE_WheelEventTarget) {
   float delta_x = 0;
   float delta_y = -0.6 * scrollable_div_top;
   blink::WebMouseWheelEvent wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(x, y, x, y, delta_x, delta_y, 0,
-                                                true);
+      SyntheticWebMouseWheelEventBuilder::Build(
+          x, y, x, y, delta_x, delta_y, 0,
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
 
   wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
   GetRouter()->RouteMouseWheelEvent(GetRootView(), &wheel_event,
@@ -219,8 +220,9 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
   float delta_x = 0;
   float delta_y = -0.6 * scrollable_div_top;
   blink::WebMouseWheelEvent wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(x, y, x, y, delta_x, delta_y, 0,
-                                                true);
+      SyntheticWebMouseWheelEventBuilder::Build(
+          x, y, x, y, delta_x, delta_y, 0,
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
   wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
   GetRouter()->RouteMouseWheelEvent(GetRootView(), &wheel_event,
                                     ui::LatencyInfo());
@@ -378,7 +380,9 @@ IN_PROC_BROWSER_TEST_F(WheelScrollLatchingBrowserTest,
   auto wheel_msg_watcher = std::make_unique<InputMsgWatcher>(
       GetWidgetHost(), blink::WebInputEvent::kMouseWheel);
   blink::WebMouseWheelEvent wheel_event =
-      SyntheticWebMouseWheelEventBuilder::Build(x, y, x, y, 1, 1, 0, true);
+      SyntheticWebMouseWheelEventBuilder::Build(
+          x, y, x, y, 1, 1, 0,
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
   wheel_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
   GetRouter()->RouteMouseWheelEvent(GetRootView(), &wheel_event,
                                     ui::LatencyInfo());
diff --git a/chromium/content/browser/renderer_host/legacy_render_widget_host_win.h b/chromium/content/browser/renderer_host/legacy_render_widget_host_win.h
index 0bffdc09c2e..24165a271b2 100644
--- a/chromium/content/browser/renderer_host/legacy_render_widget_host_win.h
+++ b/chromium/content/browser/renderer_host/legacy_render_widget_host_win.h
@@ -29,7 +29,7 @@ class WindowEventTarget;
 
 namespace content {
 
-class DirectManipulationBrowserTest;
+class DirectManipulationBrowserTestBase;
 class DirectManipulationHelper;
 class RenderWidgetHostViewAura;
 
@@ -135,7 +135,7 @@ class CONTENT_EXPORT LegacyRenderWidgetHostHWND
 
  private:
   friend class AccessibilityObjectLifetimeWinBrowserTest;
-  friend class DirectManipulationBrowserTest;
+  friend class DirectManipulationBrowserTestBase;
 
   explicit LegacyRenderWidgetHostHWND(HWND parent);
   ~LegacyRenderWidgetHostHWND() override;
diff --git a/chromium/content/browser/renderer_host/media/OWNERS b/chromium/content/browser/renderer_host/media/OWNERS
index 097cb21387b..0cd4b457c70 100644
--- a/chromium/content/browser/renderer_host/media/OWNERS
+++ b/chromium/content/browser/renderer_host/media/OWNERS
@@ -5,9 +5,8 @@ guidou@chromium.org
 tommi@chromium.org
 olka@chromium.org
 
+# Original (legacy) owners.
 per-file *video*=chfremer@chromium.org
-
-# Original (legacy) owner.
 per-file *video*=emircan@chromium.org
 per-file *video*=mcasas@chromium.org
 
diff --git a/chromium/content/browser/renderer_host/media/audio_input_stream_handle.cc b/chromium/content/browser/renderer_host/media/audio_input_stream_handle.cc
index 2ad6372e4f4..b0bb2333eb0 100644
--- a/chromium/content/browser/renderer_host/media/audio_input_stream_handle.cc
+++ b/chromium/content/browser/renderer_host/media/audio_input_stream_handle.cc
@@ -24,13 +24,14 @@ media::mojom::AudioInputStreamClientPtr CreatePtrAndStoreRequest(
 }  // namespace
 
 AudioInputStreamHandle::AudioInputStreamHandle(
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+        client_pending_remote,
     media::MojoAudioInputStream::CreateDelegateCallback
         create_delegate_callback,
     DeleterCallback deleter_callback)
     : stream_id_(base::UnguessableToken::Create()),
       deleter_callback_(std::move(deleter_callback)),
-      client_(std::move(client)),
+      client_remote_(std::move(client_pending_remote)),
       stream_ptr_(),
       stream_client_request_(),
       stream_(mojo::MakeRequest(&stream_ptr_),
@@ -40,10 +41,10 @@ AudioInputStreamHandle::AudioInputStreamHandle(
                              base::Unretained(this)),
               base::BindOnce(&AudioInputStreamHandle::CallDeleter,
                              base::Unretained(this))) {
-  // Unretained is safe since |this| owns |stream_| and |client_|.
-  DCHECK(client_);
+  // Unretained is safe since |this| owns |stream_| and |client_remote_|.
+  DCHECK(client_remote_);
   DCHECK(deleter_callback_);
-  client_.set_connection_error_handler(base::BindOnce(
+  client_remote_.set_disconnect_handler(base::BindOnce(
       &AudioInputStreamHandle::CallDeleter, base::Unretained(this)));
 }
 
@@ -61,12 +62,12 @@ void AudioInputStreamHandle::OnCreated(
     media::mojom::ReadOnlyAudioDataPipePtr data_pipe,
     bool initially_muted) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DCHECK(client_);
+  DCHECK(client_remote_);
   DCHECK(deleter_callback_)
       << "|deleter_callback_| was called, but |this| hasn't been destructed!";
-  client_->StreamCreated(std::move(stream_ptr_),
-                         std::move(stream_client_request_),
-                         std::move(data_pipe), initially_muted, stream_id_);
+  client_remote_->StreamCreated(
+      std::move(stream_ptr_), std::move(stream_client_request_),
+      std::move(data_pipe), initially_muted, stream_id_);
 }
 
 void AudioInputStreamHandle::CallDeleter() {
diff --git a/chromium/content/browser/renderer_host/media/audio_input_stream_handle.h b/chromium/content/browser/renderer_host/media/audio_input_stream_handle.h
index 1147dd319c3..728113b34f9 100644
--- a/chromium/content/browser/renderer_host/media/audio_input_stream_handle.h
+++ b/chromium/content/browser/renderer_host/media/audio_input_stream_handle.h
@@ -13,6 +13,8 @@
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
 #include "media/mojo/services/mojo_audio_input_stream.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/buffer.h"
 #include "mojo/public/cpp/system/handle.h"
 
@@ -26,10 +28,12 @@ class CONTENT_EXPORT AudioInputStreamHandle {
 
   // |deleter_callback| will be called when encountering an error, in which
   // case |this| should be synchronously destructed by its owner.
-  AudioInputStreamHandle(mojom::RendererAudioInputStreamFactoryClientPtr client,
-                         media::MojoAudioInputStream::CreateDelegateCallback
-                             create_delegate_callback,
-                         DeleterCallback deleter_callback);
+  AudioInputStreamHandle(
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+          client_pending_remote,
+      media::MojoAudioInputStream::CreateDelegateCallback
+          create_delegate_callback,
+      DeleterCallback deleter_callback);
 
   ~AudioInputStreamHandle();
 
@@ -44,7 +48,7 @@ class CONTENT_EXPORT AudioInputStreamHandle {
   SEQUENCE_CHECKER(sequence_checker_);
   const base::UnguessableToken stream_id_;
   DeleterCallback deleter_callback_;
-  mojom::RendererAudioInputStreamFactoryClientPtr client_;
+  mojo::Remote<mojom::RendererAudioInputStreamFactoryClient> client_remote_;
   media::mojom::AudioInputStreamPtr stream_ptr_;
   media::mojom::AudioInputStreamClientRequest stream_client_request_;
   media::MojoAudioInputStream stream_;
diff --git a/chromium/content/browser/renderer_host/media/audio_input_stream_handle_unittest.cc b/chromium/content/browser/renderer_host/media/audio_input_stream_handle_unittest.cc
index ffeeea06971..a83a0fd4197 100644
--- a/chromium/content/browser/renderer_host/media/audio_input_stream_handle_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/audio_input_stream_handle_unittest.cc
@@ -14,7 +14,8 @@
 #include "base/test/mock_callback.h"
 #include "base/test/task_environment.h"
 #include "media/audio/audio_input_delegate.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -80,9 +81,11 @@ std::unique_ptr<media::AudioInputDelegate> CreateFakeDelegate(
 class AudioInputStreamHandleTest : public Test {
  public:
   AudioInputStreamHandleTest()
-      : client_binding_(&client_, mojo::MakeRequest(&client_ptr_)),
+      : client_receiver_(
+            &client_,
+            client_pending_remote_.InitWithNewPipeAndPassReceiver()),
         handle_(std::make_unique<AudioInputStreamHandle>(
-            std::move(client_ptr_),
+            std::move(client_pending_remote_),
             base::BindOnce(&CreateFakeDelegate, &event_handler_),
             deleter_.Get())),
         local_(std::make_unique<base::CancelableSyncSocket>()),
@@ -109,7 +112,7 @@ class AudioInputStreamHandleTest : public Test {
 
   MockRendererAudioInputStreamFactoryClient* client() { return &client_; }
 
-  void UnbindClientBinding() { client_binding_.Unbind(); }
+  void ResetClientReceiver() { client_receiver_.reset(); }
 
   void ExpectHandleWillCallDeleter() {
     EXPECT_CALL(deleter_, Run(handle_.release()))
@@ -124,8 +127,9 @@ class AudioInputStreamHandleTest : public Test {
  private:
   base::test::SingleThreadTaskEnvironment task_environment_;
   StrictMock<MockRendererAudioInputStreamFactoryClient> client_;
-  mojom::RendererAudioInputStreamFactoryClientPtr client_ptr_;
-  mojo::Binding<mojom::RendererAudioInputStreamFactoryClient> client_binding_;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+      client_pending_remote_;
+  mojo::Receiver<mojom::RendererAudioInputStreamFactoryClient> client_receiver_;
   StrictMock<MockDeleter> deleter_;
   media::AudioInputDelegate::EventHandler* event_handler_ = nullptr;
   std::unique_ptr<AudioInputStreamHandle> handle_;
@@ -148,7 +152,7 @@ TEST_F(AudioInputStreamHandleTest,
        DestructClientBeforeCreationFinishes_CancelsStreamCreation) {
   ExpectHandleWillCallDeleter();
 
-  UnbindClientBinding();
+  ResetClientReceiver();
   base::RunLoop().RunUntilIdle();
 
   VerifyDeleterWasCalled();
@@ -165,7 +169,7 @@ TEST_F(AudioInputStreamHandleTest,
 
   ExpectHandleWillCallDeleter();
 
-  UnbindClientBinding();
+  ResetClientReceiver();
   base::RunLoop().RunUntilIdle();
 
   VerifyDeleterWasCalled();
diff --git a/chromium/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc b/chromium/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc
index 480536fb77f..e370b5ff4f8 100644
--- a/chromium/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/audio_output_authorization_handler_unittest.cc
@@ -42,10 +42,6 @@ const char kInvalidDeviceId[] = "invalid-device-id";
 using MockAuthorizationCallback = base::MockCallback<
     AudioOutputAuthorizationHandler::AuthorizationCompletedCallback>;
 
-url::Origin SecurityOrigin() {
-  return url::Origin::Create(GURL(kSecurityOriginString));
-}
-
 // TestBrowserContext has a URLRequestContextGetter which uses a NullTaskRunner.
 // This causes it to be destroyed on the wrong thread. This BrowserContext
 // instead uses the IO thread task runner for the URLRequestContextGetter.
@@ -229,8 +225,10 @@ TEST_F(AudioOutputAuthorizationHandlerTest,
 TEST_F(AudioOutputAuthorizationHandlerTest,
        AuthorizeNondefaultDeviceIdWithoutPermission_NotAuthorized) {
   std::string raw_nondefault_id = GetRawNondefaultId();
+  MediaDeviceSaltAndOrigin salt_and_origin = GetMediaDeviceSaltAndOrigin(
+      process()->GetID(), main_rfh()->GetRoutingID());
   std::string hashed_id = MediaStreamManager::GetHMACForMediaDeviceID(
-      browser_context()->GetMediaDeviceIDSalt(), SecurityOrigin(),
+      salt_and_origin.device_id_salt, salt_and_origin.origin,
       raw_nondefault_id);
 
   MockAuthorizationCallback listener;
@@ -263,8 +261,10 @@ TEST_F(AudioOutputAuthorizationHandlerTest,
 TEST_F(AudioOutputAuthorizationHandlerTest,
        AuthorizeNondefaultDeviceIdWithPermission_Ok) {
   std::string raw_nondefault_id = GetRawNondefaultId();
+  MediaDeviceSaltAndOrigin salt_and_origin = GetMediaDeviceSaltAndOrigin(
+      process()->GetID(), main_rfh()->GetRoutingID());
   std::string hashed_id = MediaStreamManager::GetHMACForMediaDeviceID(
-      browser_context()->GetMediaDeviceIDSalt(), SecurityOrigin(),
+      salt_and_origin.device_id_salt, salt_and_origin.origin,
       raw_nondefault_id);
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
@@ -376,8 +376,10 @@ TEST_F(AudioOutputAuthorizationHandlerTest,
 TEST_F(AudioOutputAuthorizationHandlerTest,
        AuthorizeNondefaultDeviceIdAfterSaltChange_NotFound) {
   std::string raw_nondefault_id = GetRawNondefaultId();
+  MediaDeviceSaltAndOrigin salt_and_origin = GetMediaDeviceSaltAndOrigin(
+      process()->GetID(), main_rfh()->GetRoutingID());
   std::string hashed_id = MediaStreamManager::GetHMACForMediaDeviceID(
-      browser_context()->GetMediaDeviceIDSalt(), SecurityOrigin(),
+      salt_and_origin.device_id_salt, salt_and_origin.origin,
       raw_nondefault_id);
   MockAuthorizationCallback listener;
   std::unique_ptr<AudioOutputAuthorizationHandler> handler =
diff --git a/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.cc b/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.cc
index 24c53622b9a..f78d75a8a2c 100644
--- a/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.cc
+++ b/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.cc
@@ -103,7 +103,8 @@ std::unique_ptr<media::AudioOutputDelegate> AudioOutputDelegateImpl::Create(
     int render_frame_id,
     int render_process_id,
     const media::AudioParameters& params,
-    media::mojom::AudioOutputStreamObserverPtr observer,
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        pending_observer,
     const std::string& output_device_id) {
   auto socket = std::make_unique<base::CancelableSyncSocket>();
   auto reader = media::AudioSyncReader::Create(
@@ -115,7 +116,7 @@ std::unique_ptr<media::AudioOutputDelegate> AudioOutputDelegateImpl::Create(
   return std::make_unique<AudioOutputDelegateImpl>(
       std::move(reader), std::move(socket), handler, audio_manager,
       std::move(audio_log), media_observer, stream_id, render_frame_id,
-      render_process_id, params, std::move(observer), output_device_id);
+      render_process_id, params, std::move(pending_observer), output_device_id);
 }
 
 AudioOutputDelegateImpl::AudioOutputDelegateImpl(
@@ -129,14 +130,15 @@ AudioOutputDelegateImpl::AudioOutputDelegateImpl(
     int render_frame_id,
     int render_process_id,
     const media::AudioParameters& params,
-    media::mojom::AudioOutputStreamObserverPtr observer,
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        pending_observer,
     const std::string& output_device_id)
     : subscriber_(handler),
       audio_log_(std::move(audio_log)),
       reader_(std::move(reader)),
       foreign_socket_(std::move(foreign_socket)),
       stream_id_(stream_id),
-      observer_(std::move(observer)) {
+      observer_(std::move(pending_observer)) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   DCHECK(subscriber_);
   DCHECK(audio_manager);
diff --git a/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.h b/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.h
index 0629eb2c2d4..33cda79c239 100644
--- a/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.h
+++ b/chromium/content/browser/renderer_host/media/audio_output_delegate_impl.h
@@ -15,6 +15,8 @@
 #include "media/audio/audio_output_delegate.h"
 #include "media/mojo/mojom/audio_logging.mojom.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace content {
 class MediaObserver;
@@ -43,7 +45,8 @@ class CONTENT_EXPORT AudioOutputDelegateImpl
       int render_frame_id,
       int render_process_id,
       const media::AudioParameters& params,
-      media::mojom::AudioOutputStreamObserverPtr observer,
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          pending_observer,
       const std::string& output_device_id);
 
   AudioOutputDelegateImpl(
@@ -57,7 +60,8 @@ class CONTENT_EXPORT AudioOutputDelegateImpl
       int render_frame_id,
       int render_process_id,
       const media::AudioParameters& params,
-      media::mojom::AudioOutputStreamObserverPtr observer,
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          pending_observer,
       const std::string& output_device_id);
 
   ~AudioOutputDelegateImpl() override;
@@ -100,7 +104,7 @@ class CONTENT_EXPORT AudioOutputDelegateImpl
   base::RepeatingTimer poll_timer_;
   bool is_audible_ = false;
   // |observer_| is notified about changes in the audible state of the stream.
-  media::mojom::AudioOutputStreamObserverPtr observer_;
+  mojo::Remote<media::mojom::AudioOutputStreamObserver> observer_;
 
   base::WeakPtrFactory<AudioOutputDelegateImpl> weak_factory_{this};
 
diff --git a/chromium/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc b/chromium/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc
index 8899779f147..a46c81ac3a4 100644
--- a/chromium/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/audio_output_delegate_impl_unittest.cc
@@ -28,6 +28,8 @@
 #include "media/base/bind_to_current_loop.h"
 #include "media/base/media_switches.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -167,19 +169,20 @@ class AudioOutputDelegateTest : public testing::Test {
 
   ~AudioOutputDelegateTest() override { audio_manager_->Shutdown(); }
 
-  mojo::StrongBindingPtr<media::mojom::AudioOutputStreamObserver>
-  CreateObserverBinding(
-      media::mojom::AudioOutputStreamObserverPtr* observer_ptr) {
-    return mojo::MakeStrongBinding(
+  mojo::SelfOwnedReceiverRef<media::mojom::AudioOutputStreamObserver>
+  CreateObserverReceiver(
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>*
+          observer_remote) {
+    return mojo::MakeSelfOwnedReceiver(
         std::make_unique<MockAudioOutputStreamObserver>(),
-        mojo::MakeRequest(observer_ptr));
+        observer_remote->InitWithNewPipeAndPassReceiver());
   }
 
   MockAudioOutputStreamObserver& GetMockObserver(
       mojo::StrongBindingPtr<media::mojom::AudioOutputStreamObserver>*
-          observer_binding) {
+          observer_receiver) {
     return *static_cast<MockAudioOutputStreamObserver*>(
-        (*observer_binding)->impl());
+        (*observer_receiver)->impl());
   }
 
   // Test bodies are here, so that we can run them on the IO thread.
@@ -189,10 +192,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(event_handler_, GotOnStreamCreated());
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying()).Times(0);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying()).Times(0);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
+        .Times(0);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying()).Times(0);
 
     {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
@@ -202,7 +207,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       SyncWithAllThreads();
 
@@ -218,12 +223,13 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(event_handler_, GotOnStreamCreated());
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
     if (use_bound_observer) {
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying())
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
           .Times(0);
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying())
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying())
           .Times(0);
     }
 
@@ -231,22 +237,23 @@ class AudioOutputDelegateTest : public testing::Test {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
       auto reader = media::AudioSyncReader::Create(base::BindRepeating(&NoLog),
                                                    Params(), socket.get());
-      media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-      auto observer_binding = CreateObserverBinding(&observer_ptr);
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          observer_remote;
+      auto observer_receiver = CreateObserverReceiver(&observer_remote);
       if (use_bound_observer) {
         InSequence s;
-        EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying());
-        EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying());
+        EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying());
+        EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying());
       }
 
       AudioOutputDelegateImpl delegate(
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       if (!use_bound_observer)
-        observer_binding->Close();
+        observer_receiver->Close();
 
       delegate.OnPlayStream();
 
@@ -264,10 +271,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(event_handler_, GotOnStreamCreated());
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying()).Times(0);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying()).Times(0);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
+        .Times(0);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying()).Times(0);
 
     {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
@@ -277,7 +286,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       delegate.OnPauseStream();
 
@@ -300,19 +309,20 @@ class AudioOutputDelegateTest : public testing::Test {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
       auto reader = media::AudioSyncReader::Create(base::BindRepeating(&NoLog),
                                                    Params(), socket.get());
-      media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-      auto observer_binding = CreateObserverBinding(&observer_ptr);
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          observer_remote;
+      auto observer_receiver = CreateObserverReceiver(&observer_remote);
       InSequence s;
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying());
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying());
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying());
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying());
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying());
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying());
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying());
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying());
 
       AudioOutputDelegateImpl delegate(
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       delegate.OnPlayStream();
       delegate.OnPauseStream();
@@ -337,17 +347,18 @@ class AudioOutputDelegateTest : public testing::Test {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
       auto reader = media::AudioSyncReader::Create(base::BindRepeating(&NoLog),
                                                    Params(), socket.get());
-      media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-      auto observer_binding = CreateObserverBinding(&observer_ptr);
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          observer_remote;
+      auto observer_receiver = CreateObserverReceiver(&observer_remote);
       InSequence s;
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying());
-      EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying());
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying());
+      EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying());
 
       AudioOutputDelegateImpl delegate(
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       delegate.OnPlayStream();
       delegate.OnPlayStream();
@@ -366,10 +377,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(event_handler_, GotOnStreamCreated());
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying()).Times(0);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying()).Times(0);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
+        .Times(0);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying()).Times(0);
 
     DummyAudioOutputStream stream;
     {
@@ -380,7 +393,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       delegate.GetControllerForTesting()->StartDiverting(&stream);
 
@@ -407,8 +420,8 @@ class AudioOutputDelegateTest : public testing::Test {
       AudioOutputDelegateImpl delegate(
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
-          kStreamId, kRenderFrameId, kRenderProcessId, Params(), nullptr,
-          kDefaultDeviceId);
+          kStreamId, kRenderFrameId, kRenderProcessId, Params(),
+          mojo::NullRemote(), kDefaultDeviceId);
 
       delegate.GetControllerForTesting()->StartDiverting(&stream);
 
@@ -429,11 +442,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(event_handler_, GotOnStreamCreated());
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
     InSequence s;
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying());
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying());
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying());
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying());
 
     DummyAudioOutputStream stream;
     {
@@ -444,7 +458,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       delegate.OnPlayStream();
       delegate.GetControllerForTesting()->StartDiverting(&stream);
@@ -472,10 +486,11 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
     EXPECT_CALL(mirroring_manager_, RemoveDiverter(NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying());
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying());
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying());
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying());
 
     auto socket = std::make_unique<base::CancelableSyncSocket>();
     auto reader = media::AudioSyncReader::Create(base::BindRepeating(&NoLog),
@@ -484,7 +499,7 @@ class AudioOutputDelegateTest : public testing::Test {
         std::move(reader), std::move(socket), &event_handler_,
         audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
         kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-        std::move(observer_ptr), kDefaultDeviceId);
+        std::move(observer_remote), kDefaultDeviceId);
 
     delegate->OnPlayStream();
     delegate->GetControllerForTesting()->OnError();
@@ -504,10 +519,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
     EXPECT_CALL(mirroring_manager_, RemoveDiverter(NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying()).Times(0);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying()).Times(0);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
+        .Times(0);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying()).Times(0);
 
     {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
@@ -517,7 +534,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
     }
     SyncWithAllThreads();
     base::PostTask(FROM_HERE, {BrowserThread::UI}, std::move(done));
@@ -530,10 +547,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
     EXPECT_CALL(mirroring_manager_, RemoveDiverter(NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying()).Times(0);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying()).Times(0);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
+        .Times(0);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying()).Times(0);
 
     {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
@@ -543,7 +562,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
 
       SyncWithAllThreads();
 
@@ -560,10 +579,12 @@ class AudioOutputDelegateTest : public testing::Test {
     EXPECT_CALL(mirroring_manager_,
                 AddDiverter(kRenderProcessId, kRenderFrameId, NotNull()));
     EXPECT_CALL(mirroring_manager_, RemoveDiverter(NotNull()));
-    media::mojom::AudioOutputStreamObserverPtr observer_ptr;
-    auto observer_binding = CreateObserverBinding(&observer_ptr);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStartPlaying()).Times(0);
-    EXPECT_CALL(GetMockObserver(&observer_binding), DidStopPlaying()).Times(0);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        observer_remote;
+    auto observer_receiver = CreateObserverReceiver(&observer_remote);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStartPlaying())
+        .Times(0);
+    EXPECT_CALL(GetMockObserver(&observer_receiver), DidStopPlaying()).Times(0);
 
     {
       auto socket = std::make_unique<base::CancelableSyncSocket>();
@@ -573,7 +594,7 @@ class AudioOutputDelegateTest : public testing::Test {
           std::move(reader), std::move(socket), &event_handler_,
           audio_manager_.get(), CreateDummyMojoAudioLog(), &media_observer_,
           kStreamId, kRenderFrameId, kRenderProcessId, Params(),
-          std::move(observer_ptr), kDefaultDeviceId);
+          std::move(observer_remote), kDefaultDeviceId);
       SyncWithAllThreads();
 
       delegate.GetControllerForTesting()->OnError();
diff --git a/chromium/content/browser/renderer_host/media/fake_video_capture_device_launcher.cc b/chromium/content/browser/renderer_host/media/fake_video_capture_device_launcher.cc
index 9207600873e..c52e8052c55 100644
--- a/chromium/content/browser/renderer_host/media/fake_video_capture_device_launcher.cc
+++ b/chromium/content/browser/renderer_host/media/fake_video_capture_device_launcher.cc
@@ -78,7 +78,7 @@ void FakeVideoCaptureDeviceLauncher::LaunchDeviceAsync(
   scoped_refptr<media::VideoCaptureBufferPool> buffer_pool(
       new media::VideoCaptureBufferPoolImpl(
           std::make_unique<media::VideoCaptureBufferTrackerFactoryImpl>(),
-          kMaxBufferCount));
+          media::VideoCaptureBufferType::kSharedMemory, kMaxBufferCount));
 #if defined(OS_CHROMEOS)
   auto device_client = std::make_unique<media::VideoCaptureDeviceClient>(
       media::VideoCaptureBufferType::kSharedMemory,
diff --git a/chromium/content/browser/renderer_host/media/in_process_launched_video_capture_device.cc b/chromium/content/browser/renderer_host/media/in_process_launched_video_capture_device.cc
index 7d9cb114213..a9c0ad67795 100644
--- a/chromium/content/browser/renderer_host/media/in_process_launched_video_capture_device.cc
+++ b/chromium/content/browser/renderer_host/media/in_process_launched_video_capture_device.cc
@@ -9,10 +9,12 @@
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/metrics/histogram_macros.h"
+#include "build/build_config.h"
+#include "content/common/buildflags.h"
 #include "content/public/browser/browser_thread.h"
 #include "media/media_buildflags.h"
 
-#if defined(ENABLE_SCREEN_CAPTURE) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_SCREEN_CAPTURE) && !defined(OS_ANDROID)
 #include "content/browser/media/capture/desktop_capture_device.h"
 #endif
 
diff --git a/chromium/content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc b/chromium/content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc
index 21249f5d854..c9ba78a9d21 100644
--- a/chromium/content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc
+++ b/chromium/content/browser/renderer_host/media/in_process_video_capture_device_launcher.cc
@@ -15,6 +15,7 @@
 #include "build/build_config.h"
 #include "content/browser/renderer_host/media/in_process_launched_video_capture_device.h"
 #include "content/browser/renderer_host/media/video_capture_controller.h"
+#include "content/common/buildflags.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/desktop_media_id.h"
@@ -29,7 +30,7 @@
 #include "media/capture/video/video_frame_receiver_on_task_runner.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 
-#if defined(ENABLE_SCREEN_CAPTURE)
+#if BUILDFLAG(ENABLE_SCREEN_CAPTURE)
 #include "content/browser/media/capture/desktop_capture_device_uma_types.h"
 #if defined(OS_ANDROID)
 #include "content/browser/media/capture/screen_capture_device_android.h"
@@ -40,7 +41,7 @@
 #endif
 #include "content/browser/media/capture/desktop_capture_device.h"
 #endif  // defined(OS_ANDROID)
-#endif  // defined(ENABLE_SCREEN_CAPTURE)
+#endif  // BUILDFLAG(ENABLE_SCREEN_CAPTURE)
 
 #if defined(OS_CHROMEOS)
 #include "content/browser/gpu/chromeos/video_capture_dependencies.h"
@@ -140,7 +141,7 @@ void InProcessVideoCaptureDeviceLauncher::LaunchDeviceAsync(
       break;
     }
 
-#if defined(ENABLE_SCREEN_CAPTURE)
+#if BUILDFLAG(ENABLE_SCREEN_CAPTURE)
 #if !defined(OS_ANDROID)
     case blink::mojom::MediaStreamType::GUM_TAB_VIDEO_CAPTURE:
       start_capture_closure = base::BindOnce(
@@ -221,7 +222,7 @@ void InProcessVideoCaptureDeviceLauncher::LaunchDeviceAsync(
           std::move(after_start_capture_callback));
       break;
     }
-#endif  // defined(ENABLE_SCREEN_CAPTURE)
+#endif  // BUILDFLAG(ENABLE_SCREEN_CAPTURE)
 
     default: {
       NOTIMPLEMENTED();
@@ -251,7 +252,7 @@ InProcessVideoCaptureDeviceLauncher::CreateDeviceClient(
   scoped_refptr<media::VideoCaptureBufferPool> buffer_pool =
       new media::VideoCaptureBufferPoolImpl(
           std::make_unique<media::VideoCaptureBufferTrackerFactoryImpl>(),
-          buffer_pool_max_buffer_count);
+          requested_buffer_type, buffer_pool_max_buffer_count);
 
 #if defined(OS_CHROMEOS)
   return std::make_unique<media::VideoCaptureDeviceClient>(
@@ -329,7 +330,7 @@ void InProcessVideoCaptureDeviceLauncher::DoStartDeviceCaptureOnDeviceThread(
   std::move(result_callback).Run(std::move(video_capture_device));
 }
 
-#if defined(ENABLE_SCREEN_CAPTURE)
+#if BUILDFLAG(ENABLE_SCREEN_CAPTURE)
 
 #if !defined(OS_ANDROID)
 void InProcessVideoCaptureDeviceLauncher::DoStartTabCaptureOnDeviceThread(
@@ -407,7 +408,7 @@ void InProcessVideoCaptureDeviceLauncher::DoStartDesktopCaptureOnDeviceThread(
   std::move(result_callback).Run(std::move(video_capture_device));
 }
 
-#endif  // defined(ENABLE_SCREEN_CAPTURE)
+#endif  // BUILDFLAG(ENABLE_SCREEN_CAPTURE)
 
 void InProcessVideoCaptureDeviceLauncher::
     DoStartFakeDisplayCaptureOnDeviceThread(
diff --git a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.cc b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.cc
index d82c46a8d28..5ddc4c6ca2e 100644
--- a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.cc
+++ b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.cc
@@ -25,7 +25,7 @@
 #include "media/audio/audio_system.h"
 #include "media/base/media_switches.h"
 #include "media/base/video_facing.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/common/mediastream/media_devices.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
@@ -64,12 +64,12 @@ void MediaDevicesDispatcherHost::Create(
     int render_process_id,
     int render_frame_id,
     MediaStreamManager* media_stream_manager,
-    blink::mojom::MediaDevicesDispatcherHostRequest request) {
+    mojo::PendingReceiver<blink::mojom::MediaDevicesDispatcherHost> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  mojo::MakeStrongBinding(
+  mojo::MakeSelfOwnedReceiver(
       std::make_unique<MediaDevicesDispatcherHost>(
           render_process_id, render_frame_id, media_stream_manager),
-      std::move(request));
+      std::move(receiver));
 }
 
 MediaDevicesDispatcherHost::MediaDevicesDispatcherHost(
diff --git a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.h b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.h
index cb4a0f1645e..662bb22302a 100644
--- a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.h
+++ b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host.h
@@ -15,6 +15,7 @@
 #include "content/browser/renderer_host/media/media_devices_manager.h"
 #include "content/common/content_export.h"
 #include "media/capture/video/video_capture_device_descriptor.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "third_party/blink/public/mojom/mediastream/media_devices.mojom.h"
 #include "url/origin.h"
 
@@ -30,10 +31,11 @@ class CONTENT_EXPORT MediaDevicesDispatcherHost
                              MediaStreamManager* media_stream_manager);
   ~MediaDevicesDispatcherHost() override;
 
-  static void Create(int render_process_id,
-                     int render_frame_id,
-                     MediaStreamManager* media_stream_manager,
-                     blink::mojom::MediaDevicesDispatcherHostRequest request);
+  static void Create(
+      int render_process_id,
+      int render_frame_id,
+      MediaStreamManager* media_stream_manager,
+      mojo::PendingReceiver<blink::mojom::MediaDevicesDispatcherHost> receiver);
 
   // blink::mojom::MediaDevicesDispatcherHost implementation.
   void EnumerateDevices(bool request_audio_input,
diff --git a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
index 506bff6ad68..4817447d388 100644
--- a/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/media_devices_dispatcher_host_unittest.cc
@@ -89,7 +89,6 @@ class MediaDevicesDispatcherHostTest : public testing::TestWithParam<GURL> {
  public:
   MediaDevicesDispatcherHostTest()
       : task_environment_(content::BrowserTaskEnvironment::IO_MAINLOOP),
-        browser_context_(new TestBrowserContext()),
         origin_(url::Origin::Create(GetParam())) {
     // Make sure we use fake devices to avoid long delays.
     base::CommandLine::ForCurrentProcess()->AppendSwitchASCII(
@@ -178,9 +177,11 @@ class MediaDevicesDispatcherHostTest : public testing::TestWithParam<GURL> {
   void VideoInputCapabilitiesCallback(
       std::vector<blink::mojom::VideoInputDeviceCapabilitiesPtr> capabilities) {
     MockVideoInputCapabilitiesCallback();
+    MediaDeviceSaltAndOrigin salt_and_origin =
+        GetMediaDeviceSaltAndOrigin(-1, -1);
     std::string expected_first_device_id =
-        GetHMACForMediaDeviceID(browser_context_->GetMediaDeviceIDSalt(),
-                                origin_, kDefaultVideoDeviceID);
+        GetHMACForMediaDeviceID(salt_and_origin.device_id_salt,
+                                salt_and_origin.origin, kDefaultVideoDeviceID);
     EXPECT_EQ(kNumFakeVideoDevices, capabilities.size());
     EXPECT_EQ(expected_first_device_id, capabilities[0]->device_id);
     for (const auto& capability : capabilities) {
@@ -206,9 +207,11 @@ class MediaDevicesDispatcherHostTest : public testing::TestWithParam<GURL> {
     // MediaDevicesManager always returns 3 fake audio input devices.
     const size_t kNumExpectedEntries = 3;
     EXPECT_EQ(kNumExpectedEntries, capabilities.size());
+    MediaDeviceSaltAndOrigin salt_and_origin =
+        GetMediaDeviceSaltAndOrigin(-1, -1);
     std::string expected_first_device_id =
-        GetHMACForMediaDeviceID(browser_context_->GetMediaDeviceIDSalt(),
-                                origin_, kDefaultAudioDeviceID);
+        GetHMACForMediaDeviceID(salt_and_origin.device_id_salt,
+                                salt_and_origin.origin, kDefaultAudioDeviceID);
     EXPECT_EQ(expected_first_device_id, capabilities[0]->device_id);
     for (const auto& capability : capabilities)
       EXPECT_TRUE(capability->parameters.IsValid());
@@ -304,12 +307,14 @@ class MediaDevicesDispatcherHostTest : public testing::TestWithParam<GURL> {
   bool DoesEveryDeviceMapToRawId(
       const std::vector<std::vector<blink::WebMediaDeviceInfo>>& enumeration,
       const url::Origin& origin) {
+    MediaDeviceSaltAndOrigin salt_and_origin =
+        GetMediaDeviceSaltAndOrigin(-1, -1);
     for (size_t i = 0; i < blink::NUM_MEDIA_DEVICE_TYPES; ++i) {
       for (const auto& device_info : enumeration[i]) {
         bool found_match = false;
         for (const auto& raw_device_info : physical_devices_[i]) {
           if (DoesMediaDeviceIDMatchHMAC(
-                  browser_context_->GetMediaDeviceIDSalt(), origin,
+                  salt_and_origin.device_id_salt, salt_and_origin.origin,
                   device_info.device_id, raw_device_info.device_id)) {
             EXPECT_FALSE(found_match);
             found_match = true;
@@ -392,8 +397,7 @@ class MediaDevicesDispatcherHostTest : public testing::TestWithParam<GURL> {
 
   MediaDeviceSaltAndOrigin GetSaltAndOrigin(int /* process_id */,
                                             int /* frame_id */) {
-    return MediaDeviceSaltAndOrigin(browser_context_->GetMediaDeviceIDSalt(),
-                                    "fake_group_id_salt", origin_);
+    return GetMediaDeviceSaltAndOrigin(-1, -1);
   }
 
   // The order of these members is important on teardown:
@@ -407,7 +411,6 @@ class MediaDevicesDispatcherHostTest : public testing::TestWithParam<GURL> {
   std::unique_ptr<media::AudioManager> audio_manager_;
   std::unique_ptr<media::AudioSystem> audio_system_;
   media::FakeVideoCaptureDeviceFactory* video_capture_device_factory_;
-  std::unique_ptr<TestBrowserContext> browser_context_;
   MediaDeviceEnumeration physical_devices_;
   url::Origin origin_;
 
@@ -486,9 +489,11 @@ TEST_P(MediaDevicesDispatcherHostTest, GetAllVideoInputDeviceFormats) {
   base::RunLoop run_loop;
   EXPECT_CALL(*this, MockAllVideoInputDeviceFormatsCallback())
       .WillOnce(InvokeWithoutArgs([&run_loop]() { run_loop.Quit(); }));
+  MediaDeviceSaltAndOrigin salt_and_origin =
+      GetMediaDeviceSaltAndOrigin(-1, -1);
   host_->GetAllVideoInputDeviceFormats(
-      GetHMACForMediaDeviceID(browser_context_->GetMediaDeviceIDSalt(), origin_,
-                              kDefaultVideoDeviceID),
+      GetHMACForMediaDeviceID(salt_and_origin.device_id_salt,
+                              salt_and_origin.origin, kDefaultVideoDeviceID),
       base::BindOnce(
           &MediaDevicesDispatcherHostTest::AllVideoInputDeviceFormatsCallback,
           base::Unretained(this)));
@@ -499,45 +504,17 @@ TEST_P(MediaDevicesDispatcherHostTest, GetAvailableVideoInputDeviceFormats) {
   base::RunLoop run_loop;
   EXPECT_CALL(*this, MockAvailableVideoInputDeviceFormatsCallback())
       .WillOnce(InvokeWithoutArgs([&run_loop]() { run_loop.Quit(); }));
+  MediaDeviceSaltAndOrigin salt_and_origin =
+      GetMediaDeviceSaltAndOrigin(-1, -1);
   host_->GetAvailableVideoInputDeviceFormats(
-      GetHMACForMediaDeviceID(browser_context_->GetMediaDeviceIDSalt(), origin_,
-                              kNormalVideoDeviceID),
+      GetHMACForMediaDeviceID(salt_and_origin.device_id_salt,
+                              salt_and_origin.origin, kNormalVideoDeviceID),
       base::BindOnce(&MediaDevicesDispatcherHostTest::
                          AvailableVideoInputDeviceFormatsCallback,
                      base::Unretained(this)));
   run_loop.Run();
 }
 
-TEST_P(MediaDevicesDispatcherHostTest, Salt) {
-  EnumerateDevicesAndWaitForResult(true, true, true);
-  auto devices = enumerated_devices_;
-  EnumerateDevicesAndWaitForResult(true, true, true);
-  // Expect two enumerations with the same salt to produce the same device IDs
-  EXPECT_EQ(devices.size(), enumerated_devices_.size());
-  for (size_t i = 0; i < enumerated_devices_.size(); ++i) {
-    EXPECT_EQ(devices[i].size(), enumerated_devices_[i].size());
-    for (size_t j = 0; j < devices[i].size(); ++j)
-      EXPECT_EQ(devices[i][j].device_id, enumerated_devices_[i][j].device_id);
-  }
-
-  // Reset the salt and expect different device IDs in a new enumeration, except
-  // for default audio devices, which are always hashed to the same constant.
-  browser_context_ = std::make_unique<TestBrowserContext>();
-  EnumerateDevicesAndWaitForResult(true, true, true);
-  EXPECT_EQ(devices.size(), enumerated_devices_.size());
-  for (size_t i = 0; i < enumerated_devices_.size(); ++i) {
-    EXPECT_EQ(devices[i].size(), enumerated_devices_[i].size());
-    for (size_t j = 0; j < devices[i].size(); ++j) {
-      if (media::AudioDeviceDescription::IsDefaultDevice(
-              devices[i][j].device_id)) {
-        EXPECT_EQ(devices[i][j].device_id, enumerated_devices_[i][j].device_id);
-      } else {
-        EXPECT_NE(devices[i][j].device_id, enumerated_devices_[i][j].device_id);
-      }
-    }
-  }
-}
-
 INSTANTIATE_TEST_SUITE_P(,
                          MediaDevicesDispatcherHostTest,
                          testing::Values(GURL(), GURL("https://test.com")));
diff --git a/chromium/content/browser/renderer_host/media/media_devices_manager.cc b/chromium/content/browser/renderer_host/media/media_devices_manager.cc
index 4e26f6a9301..03d283023a8 100644
--- a/chromium/content/browser/renderer_host/media/media_devices_manager.cc
+++ b/chromium/content/browser/renderer_host/media/media_devices_manager.cc
@@ -33,7 +33,8 @@
 #include "media/audio/audio_device_description.h"
 #include "media/audio/audio_system.h"
 #include "media/base/media_switches.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/mojom/constants.mojom.h"
 #include "services/audio/public/mojom/device_notifications.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
@@ -299,8 +300,7 @@ MediaDevicesManager::SubscriptionRequest::operator=(SubscriptionRequest&&) =
 class MediaDevicesManager::AudioServiceDeviceListener
     : public audio::mojom::DeviceListener {
  public:
-  explicit AudioServiceDeviceListener(service_manager::Connector* connector)
-      : binding_(this) {
+  explicit AudioServiceDeviceListener(service_manager::Connector* connector) {
     TryConnectToService(connector);
   }
   ~AudioServiceDeviceListener() override = default;
@@ -337,22 +337,21 @@ class MediaDevicesManager::AudioServiceDeviceListener
   void DoConnectToService(service_manager::Connector* connector) {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     DCHECK(!mojo_audio_device_notifier_);
-    DCHECK(!binding_);
-    connector->BindInterface(audio::mojom::kServiceName,
-                             mojo::MakeRequest(&mojo_audio_device_notifier_));
-    mojo_audio_device_notifier_.set_connection_error_handler(base::BindOnce(
+    DCHECK(!receiver_.is_bound());
+    connector->Connect(
+        audio::mojom::kServiceName,
+        mojo_audio_device_notifier_.BindNewPipeAndPassReceiver());
+    mojo_audio_device_notifier_.set_disconnect_handler(base::BindOnce(
         &MediaDevicesManager::AudioServiceDeviceListener::OnConnectionError,
         weak_factory_.GetWeakPtr(), connector));
-    audio::mojom::DeviceListenerPtr audio_device_listener_ptr;
-    binding_.Bind(mojo::MakeRequest(&audio_device_listener_ptr));
     mojo_audio_device_notifier_->RegisterListener(
-        audio_device_listener_ptr.PassInterface());
+        receiver_.BindNewPipeAndPassRemote());
   }
 
   void OnConnectionError(service_manager::Connector* connector) {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
     mojo_audio_device_notifier_.reset();
-    binding_.Close();
+    receiver_.reset();
 
     // Resetting the error handler in a posted task since doing it synchronously
     // results in a browser crash. See https://crbug.com/845142.
@@ -362,8 +361,8 @@ class MediaDevicesManager::AudioServiceDeviceListener
                        weak_factory_.GetWeakPtr(), connector));
   }
 
-  mojo::Binding<audio::mojom::DeviceListener> binding_;
-  audio::mojom::DeviceNotifierPtr mojo_audio_device_notifier_;
+  mojo::Receiver<audio::mojom::DeviceListener> receiver_{this};
+  mojo::Remote<audio::mojom::DeviceNotifier> mojo_audio_device_notifier_;
 
   SEQUENCE_CHECKER(sequence_checker_);
 
diff --git a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
index d3c26f7980d..1a3b5b446bb 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.cc
@@ -16,6 +16,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
@@ -25,16 +26,16 @@ namespace content {
 
 namespace {
 
-void BindMediaStreamDeviceObserverRequest(
+void BindMediaStreamDeviceObserverReceiver(
     int render_process_id,
     int render_frame_id,
-    blink::mojom::MediaStreamDeviceObserverRequest request) {
+    mojo::PendingReceiver<blink::mojom::MediaStreamDeviceObserver> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   RenderFrameHost* render_frame_host =
       RenderFrameHost::FromID(render_process_id, render_frame_id);
   if (render_frame_host)
-    render_frame_host->GetRemoteInterfaces()->GetInterface(std::move(request));
+    render_frame_host->GetRemoteInterfaces()->GetInterface(std::move(receiver));
 }
 
 }  // namespace
@@ -89,23 +90,22 @@ void MediaStreamDispatcherHost::OnDeviceChanged(
                                                   new_device);
 }
 
-const blink::mojom::MediaStreamDeviceObserverPtr&
+const mojo::Remote<blink::mojom::MediaStreamDeviceObserver>&
 MediaStreamDispatcherHost::GetMediaStreamDeviceObserver() {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   if (media_stream_device_observer_)
     return media_stream_device_observer_;
 
-  blink::mojom::MediaStreamDeviceObserverPtr observer;
-  auto dispatcher_request = mojo::MakeRequest(&observer);
-  observer.set_connection_error_handler(base::BindOnce(
+  auto dispatcher_receiver =
+      media_stream_device_observer_.BindNewPipeAndPassReceiver();
+  media_stream_device_observer_.set_disconnect_handler(base::BindOnce(
       &MediaStreamDispatcherHost::OnMediaStreamDeviceObserverConnectionError,
       weak_factory_.GetWeakPtr()));
   base::PostTask(
       FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&BindMediaStreamDeviceObserverRequest, render_process_id_,
-                     render_frame_id_, std::move(dispatcher_request)));
-  media_stream_device_observer_ = std::move(observer);
+      base::BindOnce(&BindMediaStreamDeviceObserverReceiver, render_process_id_,
+                     render_frame_id_, std::move(dispatcher_receiver)));
   return media_stream_device_observer_;
 }
 
diff --git a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.h b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.h
index fbd601c2e7c..7b6617b2c29 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.h
+++ b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host.h
@@ -13,6 +13,8 @@
 #include "content/browser/media/media_devices_util.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/common/mediastream/media_stream_controls.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
 
@@ -41,14 +43,14 @@ class CONTENT_EXPORT MediaStreamDispatcherHost
     salt_and_origin_callback_ = std::move(callback);
   }
   void SetMediaStreamDeviceObserverForTesting(
-      blink::mojom::MediaStreamDeviceObserverPtr observer) {
-    media_stream_device_observer_ = std::move(observer);
+      mojo::PendingRemote<blink::mojom::MediaStreamDeviceObserver> observer) {
+    media_stream_device_observer_.Bind(std::move(observer));
   }
 
  private:
   friend class MockMediaStreamDispatcherHost;
 
-  const blink::mojom::MediaStreamDeviceObserverPtr&
+  const mojo::Remote<blink::mojom::MediaStreamDeviceObserver>&
   GetMediaStreamDeviceObserver();
   void OnMediaStreamDeviceObserverConnectionError();
   void CancelAllRequests();
@@ -100,7 +102,8 @@ class CONTENT_EXPORT MediaStreamDispatcherHost
   const int render_frame_id_;
   const int requester_id_;
   MediaStreamManager* media_stream_manager_;
-  blink::mojom::MediaStreamDeviceObserverPtr media_stream_device_observer_;
+  mojo::Remote<blink::mojom::MediaStreamDeviceObserver>
+      media_stream_device_observer_;
   MediaDeviceSaltAndOriginCallback salt_and_origin_callback_;
 
   base::WeakPtrFactory<MediaStreamDispatcherHost> weak_factory_{this};
diff --git a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
index fab4eeba01e..5d4c6b4f463 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_dispatcher_host_unittest.cc
@@ -35,7 +35,7 @@
 #include "media/audio/mock_audio_manager.h"
 #include "media/audio/test_audio_thread.h"
 #include "media/base/media_switches.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom-shared.h"
@@ -85,8 +85,7 @@ class MockMediaStreamDispatcherHost
                                 int render_frame_id,
                                 MediaStreamManager* manager)
       : MediaStreamDispatcherHost(render_process_id, render_frame_id, manager),
-        task_runner_(base::ThreadTaskRunnerHandle::Get()),
-        binding_(this) {}
+        task_runner_(base::ThreadTaskRunnerHandle::Get()) {}
   ~MockMediaStreamDispatcherHost() override {}
 
   // A list of mock methods.
@@ -145,10 +144,9 @@ class MockMediaStreamDispatcherHost
                        const blink::MediaStreamDevice& old_device,
                        const blink::MediaStreamDevice& new_device) override {}
 
-  blink::mojom::MediaStreamDeviceObserverPtr CreateInterfacePtrAndBind() {
-    blink::mojom::MediaStreamDeviceObserverPtr observer;
-    binding_.Bind(mojo::MakeRequest(&observer));
-    return observer;
+  mojo::PendingRemote<blink::mojom::MediaStreamDeviceObserver>
+  BindNewPipeAndPassRemote() {
+    return receiver_.BindNewPipeAndPassRemote();
   }
 
   std::string label_;
@@ -220,7 +218,7 @@ class MockMediaStreamDispatcherHost
 
   const scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   base::queue<base::Closure> quit_closures_;
-  mojo::Binding<blink::mojom::MediaStreamDeviceObserver> binding_;
+  mojo::Receiver<blink::mojom::MediaStreamDeviceObserver> receiver_{this};
 };
 
 class MockMediaStreamUIProxy : public FakeMediaStreamUIProxy {
@@ -265,7 +263,7 @@ class MediaStreamDispatcherHostTest : public testing::Test {
         base::BindRepeating(&MediaStreamDispatcherHostTest::GetSaltAndOrigin,
                             base::Unretained(this)));
     host_->SetMediaStreamDeviceObserverForTesting(
-        host_->CreateInterfacePtrAndBind());
+        host_->BindNewPipeAndPassRemote());
 
 #if defined(OS_CHROMEOS)
     chromeos::CrasAudioClient::InitializeFake();
@@ -590,7 +588,7 @@ TEST_F(MediaStreamDispatcherHostTest, GenerateStreamsDifferentRenderId) {
       base::BindRepeating(&MediaStreamDispatcherHostTest::GetSaltAndOrigin,
                           base::Unretained(this)));
   host_->SetMediaStreamDeviceObserverForTesting(
-      host_->CreateInterfacePtrAndBind());
+      host_->BindNewPipeAndPassRemote());
 
   GenerateStreamAndWaitForResult(kPageRequestId + 1, controls);
 
diff --git a/chromium/content/browser/renderer_host/media/media_stream_manager.cc b/chromium/content/browser/renderer_host/media/media_stream_manager.cc
index 6b49aeaeea9..0ad75a52d9b 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_manager.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_manager.cc
@@ -1372,8 +1372,8 @@ DesktopMediaID MediaStreamManager::ResolveTabCaptureDeviceIdOnUIThread(
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   // Resolve DesktopMediaID for the specified device id.
   return DesktopStreamsRegistry::GetInstance()->RequestMediaForStreamId(
-      capture_device_id, requesting_process_id, requesting_frame_id, origin,
-      nullptr, kRegistryStreamTypeTab);
+      capture_device_id, requesting_process_id, requesting_frame_id,
+      url::Origin::Create(origin), nullptr, kRegistryStreamTypeTab);
 }
 
 void MediaStreamManager::FinishTabCaptureRequestSetupWithDeviceId(
diff --git a/chromium/content/browser/renderer_host/media/media_stream_manager_unittest.cc b/chromium/content/browser/renderer_host/media/media_stream_manager_unittest.cc
index 410c9365b8b..4b243b107bf 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_manager_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_manager_unittest.cc
@@ -21,6 +21,7 @@
 #include "content/browser/renderer_host/media/mock_video_capture_provider.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/media_observer.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_service_manager_context.h"
diff --git a/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.cc b/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.cc
index 800a5f833ef..88c4a16af38 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.cc
@@ -28,9 +28,9 @@ MediaStreamTrackMetricsHost::~MediaStreamTrackMetricsHost() {
   tracks_.clear();
 }
 
-void MediaStreamTrackMetricsHost::BindRequest(
-    blink::mojom::MediaStreamTrackMetricsHostRequest request) {
-  bindings_.AddBinding(this, std::move(request));
+void MediaStreamTrackMetricsHost::BindReceiver(
+    mojo::PendingReceiver<blink::mojom::MediaStreamTrackMetricsHost> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
 void MediaStreamTrackMetricsHost::AddTrack(uint64_t id,
diff --git a/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.h b/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.h
index 4e1d4a05035..32b42689170 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.h
+++ b/chromium/content/browser/renderer_host/media/media_stream_track_metrics_host.h
@@ -11,7 +11,8 @@
 #include <string>
 
 #include "base/time/time.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
 
 namespace content {
@@ -34,7 +35,9 @@ class MediaStreamTrackMetricsHost
   explicit MediaStreamTrackMetricsHost();
 
   ~MediaStreamTrackMetricsHost() override;
-  void BindRequest(blink::mojom::MediaStreamTrackMetricsHostRequest request);
+  void BindReceiver(
+      mojo::PendingReceiver<blink::mojom::MediaStreamTrackMetricsHost>
+          receiver);
 
  private:
   void AddTrack(uint64_t id, bool is_audio, bool is_remote) override;
@@ -57,7 +60,7 @@ class MediaStreamTrackMetricsHost
   typedef std::map<uint64_t, TrackInfo> TrackMap;
   TrackMap tracks_;
 
-  mojo::BindingSet<blink::mojom::MediaStreamTrackMetricsHost> bindings_;
+  mojo::ReceiverSet<blink::mojom::MediaStreamTrackMetricsHost> receivers_;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc b/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc
index 988967420d3..2e92ce49363 100644
--- a/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/media_stream_ui_proxy_unittest.cc
@@ -374,9 +374,9 @@ class MediaStreamUIProxyFeaturePolicyTest
   void RefreshPageAndSetHeaderPolicy(
       blink::mojom::FeaturePolicyFeature feature) {
     NavigateAndCommit(main_rfh()->GetLastCommittedURL());
-    std::vector<url::Origin> empty_whitelist;
+    std::vector<url::Origin> empty_allowlist;
     RenderFrameHostTester::For(main_rfh())
-        ->SimulateFeaturePolicyHeader(feature, empty_whitelist);
+        ->SimulateFeaturePolicyHeader(feature, empty_allowlist);
   }
 
   void GetResultForRequest(std::unique_ptr<MediaStreamRequest> request,
diff --git a/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.cc b/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.cc
index 37a9f6941b4..60da40363ce 100644
--- a/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.cc
+++ b/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.cc
@@ -65,7 +65,7 @@ RenderFrameAudioInputStreamFactoryHandle::CreateFactory(
     content::MediaStreamManager* media_stream_manager,
     int render_process_id,
     int render_frame_id,
-    mojom::RendererAudioInputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver) {
   std::unique_ptr<RenderFrameAudioInputStreamFactoryHandle,
                   BrowserThread::DeleteOnIOThread>
       handle(new RenderFrameAudioInputStreamFactoryHandle(
@@ -76,7 +76,7 @@ RenderFrameAudioInputStreamFactoryHandle::CreateFactory(
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&RenderFrameAudioInputStreamFactoryHandle::Init,
-                     base::Unretained(handle.get()), std::move(request)));
+                     base::Unretained(handle.get()), std::move(receiver)));
   return handle;
 }
 
@@ -96,12 +96,12 @@ RenderFrameAudioInputStreamFactoryHandle::
             media_stream_manager,
             render_process_id,
             render_frame_id),
-      binding_(&impl_) {}
+      receiver_(&impl_) {}
 
 void RenderFrameAudioInputStreamFactoryHandle::Init(
-    mojom::RendererAudioInputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  binding_.Bind(std::move(request));
+  receiver_.Bind(std::move(receiver));
 }
 
 OldRenderFrameAudioInputStreamFactory::OldRenderFrameAudioInputStreamFactory(
@@ -124,7 +124,7 @@ OldRenderFrameAudioInputStreamFactory::
 }
 
 void OldRenderFrameAudioInputStreamFactory::CreateStream(
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
     const base::UnguessableToken& session_id,
     const media::AudioParameters& audio_params,
     bool automatic_gain_control,
@@ -151,7 +151,7 @@ void OldRenderFrameAudioInputStreamFactory::CreateStream(
 }
 
 void OldRenderFrameAudioInputStreamFactory::DoCreateStream(
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
     const base::UnguessableToken& session_id,
     const media::AudioParameters& audio_params,
     bool automatic_gain_control,
diff --git a/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.h b/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.h
index 63d17a529ca..b32580408f5 100644
--- a/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.h
+++ b/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory.h
@@ -24,7 +24,9 @@
 #include "content/public/browser/browser_thread.h"
 #include "media/audio/audio_input_delegate.h"
 #include "media/mojo/mojom/audio_logging.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 
 namespace media {
@@ -71,20 +73,21 @@ class CONTENT_EXPORT OldRenderFrameAudioInputStreamFactory
 
   // mojom::RendererAudioInputStreamFactory implementation.
   void CreateStream(
-      mojom::RendererAudioInputStreamFactoryClientPtr client,
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
       const base::UnguessableToken& session_id,
       const media::AudioParameters& audio_params,
       bool automatic_gain_control,
       uint32_t shared_memory_count,
       audio::mojom::AudioProcessingConfigPtr processing_config) override;
 
-  void DoCreateStream(mojom::RendererAudioInputStreamFactoryClientPtr client,
-                      const base::UnguessableToken& session_id,
-                      const media::AudioParameters& audio_params,
-                      bool automatic_gain_control,
-                      uint32_t shared_memory_count,
-                      AudioInputDeviceManager::KeyboardMicRegistration
-                          keyboard_mic_registration);
+  void DoCreateStream(
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
+      const base::UnguessableToken& session_id,
+      const media::AudioParameters& audio_params,
+      bool automatic_gain_control,
+      uint32_t shared_memory_count,
+      AudioInputDeviceManager::KeyboardMicRegistration
+          keyboard_mic_registration);
 
   void AssociateInputAndOutputForAec(
       const base::UnguessableToken& input_stream_id,
@@ -112,19 +115,20 @@ class CONTENT_EXPORT OldRenderFrameAudioInputStreamFactory
   DISALLOW_COPY_AND_ASSIGN(OldRenderFrameAudioInputStreamFactory);
 };
 
-// This class is a convenient bundle of factory and binding.
+// This class is a convenient bundle of factory and receiver.
 // It can be created on any thread, but should be destroyed on the IO thread
 // (hence the DeleteOnIOThread pointer).
 class CONTENT_EXPORT RenderFrameAudioInputStreamFactoryHandle {
  public:
   static std::unique_ptr<RenderFrameAudioInputStreamFactoryHandle,
                          BrowserThread::DeleteOnIOThread>
-  CreateFactory(OldRenderFrameAudioInputStreamFactory::CreateDelegateCallback
-                    create_delegate_callback,
-                MediaStreamManager* media_stream_manager,
-                int render_process_id,
-                int render_frame_id,
-                mojom::RendererAudioInputStreamFactoryRequest request);
+  CreateFactory(
+      OldRenderFrameAudioInputStreamFactory::CreateDelegateCallback
+          create_delegate_callback,
+      MediaStreamManager* media_stream_manager,
+      int render_process_id,
+      int render_frame_id,
+      mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver);
 
   ~RenderFrameAudioInputStreamFactoryHandle();
 
@@ -136,10 +140,11 @@ class CONTENT_EXPORT RenderFrameAudioInputStreamFactoryHandle {
       int render_process_id,
       int render_frame_id);
 
-  void Init(mojom::RendererAudioInputStreamFactoryRequest request);
+  void Init(
+      mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver);
 
   OldRenderFrameAudioInputStreamFactory impl_;
-  mojo::Binding<mojom::RendererAudioInputStreamFactory> binding_;
+  mojo::Receiver<mojom::RendererAudioInputStreamFactory> receiver_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameAudioInputStreamFactoryHandle);
 };
diff --git a/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory_unittest.cc b/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory_unittest.cc
index 8617d8d8920..d1a122e1c4f 100644
--- a/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/old_render_frame_audio_input_stream_factory_unittest.cc
@@ -24,6 +24,9 @@
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -113,13 +116,15 @@ class OldOldRenderFrameAudioInputStreamFactoryTest : public testing::Test {
         audio_manager_(std::make_unique<media::TestAudioThread>()),
         audio_system_(&audio_manager_),
         media_stream_manager_(&audio_system_, audio_manager_.GetTaskRunner()),
-        client_binding_(&client_, mojo::MakeRequest(&client_ptr_)),
+        client_receiver_(
+            &client_,
+            client_pending_remote_.InitWithNewPipeAndPassReceiver()),
         factory_handle_(RenderFrameAudioInputStreamFactoryHandle::CreateFactory(
             base::BindRepeating(&CreateFakeDelegate, &event_handler_),
             &media_stream_manager_,
             kRenderProcessID,
             kRenderFrameID,
-            mojo::MakeRequest(&factory_ptr_))) {}
+            factory_remote_.BindNewPipeAndPassReceiver())) {}
 
   ~OldOldRenderFrameAudioInputStreamFactoryTest() override {
     audio_manager_.Shutdown();
@@ -144,20 +149,21 @@ class OldOldRenderFrameAudioInputStreamFactoryTest : public testing::Test {
   media::AudioSystemImpl audio_system_;
   MediaStreamManager media_stream_manager_;
 
-  mojom::RendererAudioInputStreamFactoryPtr factory_ptr_;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory> factory_remote_;
   media::mojom::AudioInputStreamPtr stream_ptr_;
   MockRendererAudioInputStreamFactoryClient client_;
-  mojom::RendererAudioInputStreamFactoryClientPtr client_ptr_;
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+      client_pending_remote_;
   media::AudioInputDelegate::EventHandler* event_handler_ = nullptr;
-  mojo::Binding<mojom::RendererAudioInputStreamFactoryClient> client_binding_;
+  mojo::Receiver<mojom::RendererAudioInputStreamFactoryClient> client_receiver_;
   UniqueAudioInputStreamFactoryPtr factory_handle_;
 };
 
 TEST_F(OldOldRenderFrameAudioInputStreamFactoryTest, CreateStream) {
   const base::UnguessableToken kSessionId = base::UnguessableToken::Create();
-  factory_ptr_->CreateStream(std::move(client_ptr_), kSessionId,
-                             GetTestAudioParameters(), kAGC, kSharedMemoryCount,
-                             nullptr);
+  factory_remote_->CreateStream(std::move(client_pending_remote_), kSessionId,
+                                GetTestAudioParameters(), kAGC,
+                                kSharedMemoryCount, nullptr);
 
   // Wait for delegate to be created and |event_handler| set.
   base::RunLoop().RunUntilIdle();
diff --git a/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.cc b/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.cc
index 90611c550c6..faf0da33067 100644
--- a/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.cc
+++ b/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.cc
@@ -28,7 +28,7 @@ std::unique_ptr<RenderFrameAudioOutputStreamFactoryHandle,
 RenderFrameAudioOutputStreamFactoryHandle::CreateFactory(
     RendererAudioOutputStreamFactoryContext* context,
     int render_frame_id,
-    mojom::RendererAudioOutputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver) {
   std::unique_ptr<RenderFrameAudioOutputStreamFactoryHandle,
                   BrowserThread::DeleteOnIOThread>
       handle(new RenderFrameAudioOutputStreamFactoryHandle(context,
@@ -38,7 +38,7 @@ RenderFrameAudioOutputStreamFactoryHandle::CreateFactory(
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&RenderFrameAudioOutputStreamFactoryHandle::Init,
-                     base::Unretained(handle.get()), std::move(request)));
+                     base::Unretained(handle.get()), std::move(receiver)));
   return handle;
 }
 
@@ -51,12 +51,12 @@ RenderFrameAudioOutputStreamFactoryHandle::
     RenderFrameAudioOutputStreamFactoryHandle(
         RendererAudioOutputStreamFactoryContext* context,
         int render_frame_id)
-    : impl_(render_frame_id, context), binding_(&impl_) {}
+    : impl_(render_frame_id, context), receiver_(&impl_) {}
 
 void RenderFrameAudioOutputStreamFactoryHandle::Init(
-    mojom::RendererAudioOutputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  binding_.Bind(std::move(request));
+  receiver_.Bind(std::move(receiver));
 }
 
 OldRenderFrameAudioOutputStreamFactory::OldRenderFrameAudioOutputStreamFactory(
@@ -76,7 +76,8 @@ OldRenderFrameAudioOutputStreamFactory::
 }
 
 void OldRenderFrameAudioOutputStreamFactory::RequestDeviceAuthorization(
-    media::mojom::AudioOutputStreamProviderRequest stream_provider_request,
+    mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+        stream_provider_receiver,
     const base::Optional<base::UnguessableToken>& session_id,
     const std::string& device_id,
     RequestDeviceAuthorizationCallback callback) {
@@ -89,12 +90,12 @@ void OldRenderFrameAudioOutputStreamFactory::RequestDeviceAuthorization(
       base::BindOnce(
           &OldRenderFrameAudioOutputStreamFactory::AuthorizationCompleted,
           weak_ptr_factory_.GetWeakPtr(), auth_start_time,
-          std::move(stream_provider_request), std::move(callback)));
+          std::move(stream_provider_receiver), std::move(callback)));
 }
 
 void OldRenderFrameAudioOutputStreamFactory::AuthorizationCompleted(
     base::TimeTicks auth_start_time,
-    media::mojom::AudioOutputStreamProviderRequest request,
+    mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider> receiver,
     RequestDeviceAuthorizationCallback callback,
     media::OutputDeviceStatus status,
     const media::AudioParameters& params,
@@ -119,7 +120,7 @@ void OldRenderFrameAudioOutputStreamFactory::AuthorizationCompleted(
   // unretained is safe.
   stream_providers_.insert(
       std::make_unique<media::MojoAudioOutputStreamProvider>(
-          std::move(request),
+          std::move(receiver),
           base::BindOnce(
               &RendererAudioOutputStreamFactoryContext::CreateDelegate,
               base::Unretained(context_), raw_device_id, render_frame_id_,
diff --git a/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.h b/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.h
index 2f0ad92661f..ab566649b7e 100644
--- a/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.h
+++ b/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.h
@@ -14,13 +14,14 @@
 #include "content/common/content_export.h"
 #include "content/common/media/renderer_audio_output_stream_factory.mojom.h"
 #include "content/public/browser/browser_thread.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 
 namespace content {
 
 class RendererAudioOutputStreamFactoryContext;
 
-// Handles a RendererAudioOutputStreamFactory request for a render frame host,
+// Handles a RendererAudioOutputStreamFactory receiver for a render frame host,
 // using the provided RendererAudioOutputStreamFactoryContext. This class may
 // be constructed on any thread, but must be used on the IO thread after that.
 // This class is used for creating streams hosted by the browser. It is being
@@ -42,7 +43,8 @@ class CONTENT_EXPORT OldRenderFrameAudioOutputStreamFactory
 
   // mojom::RendererAudioOutputStreamFactory implementation.
   void RequestDeviceAuthorization(
-      media::mojom::AudioOutputStreamProviderRequest stream_provider,
+      mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+          stream_provider,
       const base::Optional<base::UnguessableToken>& session_id,
       const std::string& device_id,
       RequestDeviceAuthorizationCallback callback) override;
@@ -53,7 +55,7 @@ class CONTENT_EXPORT OldRenderFrameAudioOutputStreamFactory
   // chosen. This id is hashed.
   void AuthorizationCompleted(
       base::TimeTicks auth_start_time,
-      media::mojom::AudioOutputStreamProviderRequest request,
+      mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider> receiver,
       RequestDeviceAuthorizationCallback callback,
       media::OutputDeviceStatus status,
       const media::AudioParameters& params,
@@ -77,14 +79,15 @@ class CONTENT_EXPORT OldRenderFrameAudioOutputStreamFactory
   DISALLOW_COPY_AND_ASSIGN(OldRenderFrameAudioOutputStreamFactory);
 };
 
-// This class is a convenient bundle of factory and binding.
+// This class is a convenient bundle of factory and receiver.
 class CONTENT_EXPORT RenderFrameAudioOutputStreamFactoryHandle {
  public:
   static std::unique_ptr<RenderFrameAudioOutputStreamFactoryHandle,
                          BrowserThread::DeleteOnIOThread>
-  CreateFactory(RendererAudioOutputStreamFactoryContext* context,
-                int render_frame_id,
-                mojom::RendererAudioOutputStreamFactoryRequest request);
+  CreateFactory(
+      RendererAudioOutputStreamFactoryContext* context,
+      int render_frame_id,
+      mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver);
 
   ~RenderFrameAudioOutputStreamFactoryHandle();
 
@@ -93,10 +96,11 @@ class CONTENT_EXPORT RenderFrameAudioOutputStreamFactoryHandle {
       RendererAudioOutputStreamFactoryContext* context,
       int render_frame_id);
 
-  void Init(mojom::RendererAudioOutputStreamFactoryRequest request);
+  void Init(
+      mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver);
 
   OldRenderFrameAudioOutputStreamFactory impl_;
-  mojo::Binding<mojom::RendererAudioOutputStreamFactory> binding_;
+  mojo::Receiver<mojom::RendererAudioOutputStreamFactory> receiver_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameAudioOutputStreamFactoryHandle);
 };
diff --git a/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory_unittest.cc b/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory_unittest.cc
index 30796499468..b1d157f1264 100644
--- a/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory_unittest.cc
@@ -19,7 +19,9 @@
 #include "content/public/test/test_browser_context.h"
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -29,25 +31,6 @@ namespace content {
 namespace {
 
 using testing::Test;
-using AudioOutputStreamFactory = mojom::RendererAudioOutputStreamFactory;
-using AudioOutputStreamFactoryPtr =
-    mojo::InterfacePtr<AudioOutputStreamFactory>;
-using AudioOutputStreamFactoryRequest =
-    mojo::InterfaceRequest<AudioOutputStreamFactory>;
-using AudioOutputStream = media::mojom::AudioOutputStream;
-using AudioOutputStreamPtr = mojo::InterfacePtr<AudioOutputStream>;
-using AudioOutputStreamRequest = mojo::InterfaceRequest<AudioOutputStream>;
-using AudioOutputStreamProviderClient =
-    media::mojom::AudioOutputStreamProviderClient;
-using AudioOutputStreamProviderClientPtr =
-    mojo::InterfacePtr<AudioOutputStreamProviderClient>;
-using AudioOutputStreamProviderClientRequest =
-    mojo::InterfaceRequest<AudioOutputStreamProviderClient>;
-using AudioOutputStreamProvider = media::mojom::AudioOutputStreamProvider;
-using AudioOutputStreamProviderPtr =
-    mojo::InterfacePtr<AudioOutputStreamProvider>;
-using AudioOutputStreamProviderRequest =
-    mojo::InterfaceRequest<AudioOutputStreamProvider>;
 
 const int kStreamId = 0;
 const int kRenderProcessId = 42;
@@ -134,7 +117,8 @@ class MockContext : public RendererAudioOutputStreamFactoryContext {
       int render_frame_id,
       int stream_id,
       const media::AudioParameters& params,
-      media::mojom::AudioOutputStreamObserverPtr stream_observer,
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          stream_observer,
       media::AudioOutputDelegate::EventHandler* handler) override {
     EXPECT_NE(nullptr, delegate_);
     EXPECT_NE(nullptr, delegate_event_handler_location_);
@@ -143,23 +127,23 @@ class MockContext : public RendererAudioOutputStreamFactoryContext {
     return std::move(delegate_);
   }
 
-  AudioOutputStreamFactoryPtr CreateFactory() {
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> CreateFactory() {
     DCHECK(!factory_);
-    AudioOutputStreamFactoryPtr ret;
+    mojo::Remote<mojom::RendererAudioOutputStreamFactory> remote;
     factory_ = std::make_unique<OldRenderFrameAudioOutputStreamFactory>(
         kRenderFrameId, this);
-    factory_binding_ = std::make_unique<
-        mojo::Binding<mojom::RendererAudioOutputStreamFactory>>(
-        factory_.get(), mojo::MakeRequest(&ret));
-    return ret;
+    factory_receiver_ = std::make_unique<
+        mojo::Receiver<mojom::RendererAudioOutputStreamFactory>>(
+        factory_.get(), remote.BindNewPipeAndPassReceiver());
+    return remote;
   }
 
  private:
   const std::string salt_;
   const bool auth_ok_;
   std::unique_ptr<OldRenderFrameAudioOutputStreamFactory> factory_;
-  std::unique_ptr<mojo::Binding<mojom::RendererAudioOutputStreamFactory>>
-      factory_binding_;
+  std::unique_ptr<mojo::Receiver<mojom::RendererAudioOutputStreamFactory>>
+      factory_receiver_;
   std::unique_ptr<media::AudioOutputDelegate> delegate_;
   media::AudioOutputDelegate::EventHandler** delegate_event_handler_location_ =
       nullptr;
@@ -167,21 +151,21 @@ class MockContext : public RendererAudioOutputStreamFactoryContext {
   DISALLOW_COPY_AND_ASSIGN(MockContext);
 };
 
-class MockClient : public AudioOutputStreamProviderClient {
+class MockClient : public media::mojom::AudioOutputStreamProviderClient {
  public:
-  MockClient() : provider_client_binding_(this) {}
+  MockClient() = default;
   ~MockClient() override {}
 
-  AudioOutputStreamProviderClientPtr MakeProviderClientPtr() {
-    AudioOutputStreamProviderClientPtr p;
-    provider_client_binding_.Bind(mojo::MakeRequest(&p));
-    return p;
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+  MakeProviderClientPendingRemote() {
+    return provider_client_receiver_.BindNewPipeAndPassRemote();
   }
 
-  void Created(AudioOutputStreamPtr stream,
+  void Created(mojo::PendingRemote<media::mojom::AudioOutputStream> stream,
                media::mojom::ReadWriteAudioDataPipePtr data_pipe) override {
     was_called_ = true;
-    stream_ = std::move(stream);
+    stream_.reset();
+    stream_.Bind(std::move(stream));
   }
 
   bool was_called() { return was_called_; }
@@ -189,8 +173,9 @@ class MockClient : public AudioOutputStreamProviderClient {
   MOCK_METHOD0(OnError, void());
 
  private:
-  mojo::Binding<AudioOutputStreamProviderClient> provider_client_binding_;
-  AudioOutputStreamPtr stream_;
+  mojo::Receiver<media::mojom::AudioOutputStreamProviderClient>
+      provider_client_receiver_{this};
+  mojo::Remote<media::mojom::AudioOutputStream> stream_;
   bool was_called_ = false;
 
   DISALLOW_COPY_AND_ASSIGN(MockClient);
@@ -215,19 +200,20 @@ void AuthCallback(media::OutputDeviceStatus* status_out,
 // 3. when the delegate calls OnStreamCreated, this is propagated to the client.
 TEST(OldRenderFrameAudioOutputStreamFactoryTest, CreateStream) {
   content::BrowserTaskEnvironment task_environment;
-  AudioOutputStreamProviderPtr provider;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider;
   MockClient client;
   media::AudioOutputDelegate::EventHandler* event_handler = nullptr;
   auto factory_context = std::make_unique<MockContext>(true);
   factory_context->PrepareDelegateForCreation(
       std::make_unique<MockAudioOutputDelegate>(), &event_handler);
-  AudioOutputStreamFactoryPtr factory_ptr = factory_context->CreateFactory();
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote =
+      factory_context->CreateFactory();
 
   media::OutputDeviceStatus status;
   media::AudioParameters params;
   std::string id;
-  factory_ptr->RequestDeviceAuthorization(
-      mojo::MakeRequest(&provider), base::nullopt, "default",
+  factory_remote->RequestDeviceAuthorization(
+      provider.BindNewPipeAndPassReceiver(), base::nullopt, "default",
       base::BindOnce(&AuthCallback, base::Unretained(&status),
                      base::Unretained(&params), base::Unretained(&id)));
   base::RunLoop().RunUntilIdle();
@@ -239,7 +225,7 @@ TEST(OldRenderFrameAudioOutputStreamFactoryTest, CreateStream) {
   // Ensure that we don't blow up getting a processing ID, despite not using it.
   const base::UnguessableToken kUnusedProcessingId =
       base::UnguessableToken::Create();
-  provider->Acquire(params, client.MakeProviderClientPtr(),
+  provider->Acquire(params, client.MakeProviderClientPendingRemote(),
                     kUnusedProcessingId);
   base::RunLoop().RunUntilIdle();
   ASSERT_NE(event_handler, nullptr);
@@ -262,15 +248,16 @@ TEST(OldRenderFrameAudioOutputStreamFactoryTest, CreateStream) {
 
 TEST(OldRenderFrameAudioOutputStreamFactoryTest, NotAuthorized_Denied) {
   content::BrowserTaskEnvironment task_environment;
-  AudioOutputStreamProviderPtr output_provider;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> output_provider;
   auto factory_context = std::make_unique<MockContext>(false);
-  AudioOutputStreamFactoryPtr factory_ptr = factory_context->CreateFactory();
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote =
+      factory_context->CreateFactory();
 
   media::OutputDeviceStatus status;
   media::AudioParameters params;
   std::string id;
-  factory_ptr->RequestDeviceAuthorization(
-      mojo::MakeRequest(&output_provider), base::nullopt, "default",
+  factory_remote->RequestDeviceAuthorization(
+      output_provider.BindNewPipeAndPassReceiver(), base::nullopt, "default",
       base::BindOnce(&AuthCallback, base::Unretained(&status),
                      base::Unretained(&params), base::Unretained(&id)));
   base::RunLoop().RunUntilIdle();
@@ -281,7 +268,7 @@ TEST(OldRenderFrameAudioOutputStreamFactoryTest, NotAuthorized_Denied) {
 TEST(OldRenderFrameAudioOutputStreamFactoryTest,
      ConnectionError_DeletesStream) {
   content::BrowserTaskEnvironment task_environment;
-  AudioOutputStreamProviderPtr provider;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider;
   MockClient client;
   bool delegate_is_destructed = false;
   media::AudioOutputDelegate::EventHandler* event_handler = nullptr;
@@ -291,17 +278,18 @@ TEST(OldRenderFrameAudioOutputStreamFactoryTest,
           base::BindOnce([](bool* destructed) { *destructed = true; },
                          &delegate_is_destructed)),
       &event_handler);
-  AudioOutputStreamFactoryPtr factory_ptr = factory_context->CreateFactory();
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote =
+      factory_context->CreateFactory();
 
-  factory_ptr->RequestDeviceAuthorization(
-      mojo::MakeRequest(&provider), base::nullopt, "default",
+  factory_remote->RequestDeviceAuthorization(
+      provider.BindNewPipeAndPassReceiver(), base::nullopt, "default",
       base::BindOnce([](media::OutputDeviceStatus status,
                         const media::AudioParameters& params,
                         const std::string& id) {}));
   base::RunLoop().RunUntilIdle();
 
-  provider->Acquire(GetTestAudioParameters(), client.MakeProviderClientPtr(),
-                    base::nullopt);
+  provider->Acquire(GetTestAudioParameters(),
+                    client.MakeProviderClientPendingRemote(), base::nullopt);
   base::RunLoop().RunUntilIdle();
   ASSERT_NE(event_handler, nullptr);
   EXPECT_FALSE(delegate_is_destructed);
@@ -312,7 +300,7 @@ TEST(OldRenderFrameAudioOutputStreamFactoryTest,
 
 TEST(OldRenderFrameAudioOutputStreamFactoryTest, DelegateError_DeletesStream) {
   content::BrowserTaskEnvironment task_environment;
-  AudioOutputStreamProviderPtr provider;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider;
   MockClient client;
   bool delegate_is_destructed = false;
   media::AudioOutputDelegate::EventHandler* event_handler = nullptr;
@@ -322,17 +310,18 @@ TEST(OldRenderFrameAudioOutputStreamFactoryTest, DelegateError_DeletesStream) {
           base::BindOnce([](bool* destructed) { *destructed = true; },
                          &delegate_is_destructed)),
       &event_handler);
-  AudioOutputStreamFactoryPtr factory_ptr = factory_context->CreateFactory();
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote =
+      factory_context->CreateFactory();
 
-  factory_ptr->RequestDeviceAuthorization(
-      mojo::MakeRequest(&provider), base::nullopt, "default",
+  factory_remote->RequestDeviceAuthorization(
+      provider.BindNewPipeAndPassReceiver(), base::nullopt, "default",
       base::BindOnce([](media::OutputDeviceStatus status,
                         const media::AudioParameters& params,
                         const std::string& id) {}));
   base::RunLoop().RunUntilIdle();
 
-  provider->Acquire(GetTestAudioParameters(), client.MakeProviderClientPtr(),
-                    base::nullopt);
+  provider->Acquire(GetTestAudioParameters(),
+                    client.MakeProviderClientPendingRemote(), base::nullopt);
   base::RunLoop().RunUntilIdle();
   ASSERT_NE(event_handler, nullptr);
   EXPECT_FALSE(delegate_is_destructed);
diff --git a/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.cc b/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.cc
index 75453f0d3dd..5048f9c38bd 100644
--- a/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.cc
+++ b/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.cc
@@ -24,8 +24,6 @@ bool PeerConnectionTrackerHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
 
   IPC_BEGIN_MESSAGE_MAP(PeerConnectionTrackerHost, message)
-    IPC_MESSAGE_HANDLER(PeerConnectionTrackerHost_AddPeerConnection,
-                        OnAddPeerConnection)
     IPC_MESSAGE_HANDLER(PeerConnectionTrackerHost_AddStandardStats,
                         OnAddStandardStats)
     IPC_MESSAGE_HANDLER(PeerConnectionTrackerHost_AddLegacyStats,
@@ -61,20 +59,27 @@ void PeerConnectionTrackerHost::OnChannelClosing() {
   base::PowerMonitor::RemoveObserver(this);
 }
 
-void PeerConnectionTrackerHost::OnAddPeerConnection(
-    const PeerConnectionInfo& info) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+void PeerConnectionTrackerHost::AddPeerConnection(
+    mojom::PeerConnectionInfoPtr info) {
+  // TODO(crbug.com/787254): Remove the thread jump on all the methods
+  // here, and make sure the mojo pipe is bound on the proper thread instead.
+  if (!BrowserThread::CurrentlyOn(BrowserThread::UI)) {
+    base::PostTask(FROM_HERE, {BrowserThread::UI},
+                   base::BindOnce(&PeerConnectionTrackerHost::AddPeerConnection,
+                                  this, std::move(info)));
+    return;
+  }
 
   WebRTCInternals* webrtc_internals = WebRTCInternals::GetInstance();
   if (webrtc_internals) {
     webrtc_internals->OnAddPeerConnection(
-        render_process_id_, peer_pid(), info.lid, info.url,
-        info.rtc_configuration, info.constraints);
+        render_process_id_, peer_pid(), info->lid, info->url,
+        info->rtc_configuration, info->constraints);
   }
 
   WebRtcEventLogger* const logger = WebRtcEventLogger::Get();
   if (logger) {
-    logger->PeerConnectionAdded(render_process_id_, info.lid,
+    logger->PeerConnectionAdded(render_process_id_, info->lid,
                                 base::OnceCallback<void(bool)>());
   }
 }
diff --git a/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.h b/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.h
index e1533b31e62..62a5f60f4cd 100644
--- a/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.h
+++ b/chromium/content/browser/renderer_host/media/peer_connection_tracker_host.h
@@ -14,8 +14,6 @@
 #include "content/public/browser/browser_message_filter.h"
 #include "content/public/browser/browser_thread.h"
 
-struct PeerConnectionInfo;
-
 namespace base {
 class ListValue;
 }  // namespace base
@@ -49,12 +47,12 @@ class PeerConnectionTrackerHost
 
  private:
   // Handlers for IPC messages coming from the renderer.
-  void OnAddPeerConnection(const PeerConnectionInfo& info);
   void OnAddStandardStats(int lid, const base::ListValue& value);
   void OnAddLegacyStats(int lid, const base::ListValue& value);
   void SendOnSuspendOnUIThread();
 
   // mojom::PeerConnectionTrackerHost implementation.
+  void AddPeerConnection(mojom::PeerConnectionInfoPtr info) override;
   void RemovePeerConnection(int lid) override;
   void UpdatePeerConnection(int lid,
                             const std::string& type,
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc
index 1116a60e2e0..5f6204541d9 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.cc
@@ -32,7 +32,8 @@
 #include "content/public/browser/web_contents_media_capture_id.h"
 #include "media/audio/audio_device_description.h"
 #include "media/base/audio_parameters.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
 #include "url/origin.h"
@@ -101,17 +102,18 @@ void GetSaltOriginAndPermissionsOnUIThread(
 class RenderFrameAudioInputStreamFactory::Core final
     : public mojom::RendererAudioInputStreamFactory {
  public:
-  Core(mojom::RendererAudioInputStreamFactoryRequest request,
+  Core(mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver,
        MediaStreamManager* media_stream_manager,
        RenderFrameHost* render_frame_host);
 
   ~Core() final;
 
-  void Init(mojom::RendererAudioInputStreamFactoryRequest request);
+  void Init(
+      mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver);
 
   // mojom::RendererAudioInputStreamFactory implementation.
   void CreateStream(
-      mojom::RendererAudioInputStreamFactoryClientPtr client,
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
       const base::UnguessableToken& session_id,
       const media::AudioParameters& audio_params,
       bool automatic_gain_control,
@@ -123,7 +125,7 @@ class RenderFrameAudioInputStreamFactory::Core final
       const std::string& output_device_id) final;
 
   void CreateLoopbackStream(
-      mojom::RendererAudioInputStreamFactoryClientPtr client,
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
       const media::AudioParameters& audio_params,
       uint32_t shared_memory_count,
       bool disable_local_echo,
@@ -144,7 +146,7 @@ class RenderFrameAudioInputStreamFactory::Core final
   const int frame_id_;
   const url::Origin origin_;
 
-  mojo::Binding<RendererAudioInputStreamFactory> binding_;
+  mojo::Receiver<RendererAudioInputStreamFactory> receiver_{this};
   // Always null-check this weak pointer before dereferencing it.
   base::WeakPtr<ForwardingAudioStreamFactory::Core> forwarding_factory_;
 
@@ -154,10 +156,10 @@ class RenderFrameAudioInputStreamFactory::Core final
 };
 
 RenderFrameAudioInputStreamFactory::RenderFrameAudioInputStreamFactory(
-    mojom::RendererAudioInputStreamFactoryRequest request,
+    mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver,
     MediaStreamManager* media_stream_manager,
     RenderFrameHost* render_frame_host)
-    : core_(new Core(std::move(request),
+    : core_(new Core(std::move(receiver),
                      media_stream_manager,
                      render_frame_host)) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -175,14 +177,13 @@ RenderFrameAudioInputStreamFactory::~RenderFrameAudioInputStreamFactory() {
 }
 
 RenderFrameAudioInputStreamFactory::Core::Core(
-    mojom::RendererAudioInputStreamFactoryRequest request,
+    mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver,
     MediaStreamManager* media_stream_manager,
     RenderFrameHost* render_frame_host)
     : media_stream_manager_(media_stream_manager),
       process_id_(render_frame_host->GetProcess()->GetID()),
       frame_id_(render_frame_host->GetRoutingID()),
-      origin_(render_frame_host->GetLastCommittedOrigin()),
-      binding_(this) {
+      origin_(render_frame_host->GetLastCommittedOrigin()) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   ForwardingAudioStreamFactory::Core* tmp_factory =
@@ -191,7 +192,7 @@ RenderFrameAudioInputStreamFactory::Core::Core(
   if (!tmp_factory) {
     // The only case when we not have a forwarding factory at this point is when
     // the frame belongs to an interstitial. Interstitials don't need audio, so
-    // it's fine to drop the request.
+    // it's fine to drop the receiver.
     return;
   }
 
@@ -201,7 +202,7 @@ RenderFrameAudioInputStreamFactory::Core::Core(
   // thread.
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&Core::Init, base::Unretained(this), std::move(request)));
+      base::BindOnce(&Core::Init, base::Unretained(this), std::move(receiver)));
 }
 
 RenderFrameAudioInputStreamFactory::Core::~Core() {
@@ -209,13 +210,13 @@ RenderFrameAudioInputStreamFactory::Core::~Core() {
 }
 
 void RenderFrameAudioInputStreamFactory::Core::Init(
-    mojom::RendererAudioInputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  binding_.Bind(std::move(request));
+  receiver_.Bind(std::move(receiver));
 }
 
 void RenderFrameAudioInputStreamFactory::Core::CreateStream(
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
     const base::UnguessableToken& session_id,
     const media::AudioParameters& audio_params,
     bool automatic_gain_control,
@@ -277,7 +278,7 @@ void RenderFrameAudioInputStreamFactory::Core::CreateStream(
 }
 
 void RenderFrameAudioInputStreamFactory::Core::CreateLoopbackStream(
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
     const media::AudioParameters& audio_params,
     uint32_t shared_memory_count,
     bool disable_local_echo,
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.h b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.h
index ceafa6ae239..1fe77c4d5bb 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.h
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory.h
@@ -10,21 +10,23 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
 class MediaStreamManager;
 class RenderFrameHost;
 
-// Handles a RendererAudioInputStreamFactory request for a render frame host.
-// Should be constructed and destructed on the UI thread, but will process mojo
-// messages on the IO thread. This class relates to ForwardingAudioStreamFactory
-// the same way as RenderFrameAudioOutputStreamFactory, and a class diagram can
-// be found in render_frame_audio_output_stream_factory.h
+// Handles a RendererAudioInputStreamFactory pending receiver for a render frame
+// host. Should be constructed and destructed on the UI thread, but will process
+// mojo messages on the IO thread.
+// This class relates to ForwardingAudioStreamFactory the same way as
+// RenderFrameAudioOutputStreamFactory, and a class diagram can be found in
+// render_frame_audio_output_stream_factory.h
 class CONTENT_EXPORT RenderFrameAudioInputStreamFactory final {
  public:
   RenderFrameAudioInputStreamFactory(
-      mojom::RendererAudioInputStreamFactoryRequest request,
+      mojo::PendingReceiver<mojom::RendererAudioInputStreamFactory> receiver,
       MediaStreamManager* media_stream_manager,
       RenderFrameHost* render_frame_host);
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
index a76e48d4c4d..a3f65d6a1a5 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_input_stream_factory_unittest.cc
@@ -33,8 +33,11 @@
 #include "media/audio/test_audio_thread.h"
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/cpp/fake_stream_factory.h"
 #include "services/audio/public/mojom/constants.mojom.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
@@ -94,15 +97,16 @@ class MAYBE_RenderFrameAudioInputStreamFactoryTest
     RenderViewHostTestHarness::TearDown();
   }
 
-  void BindFactory(mojo::ScopedMessagePipeHandle factory_request) {
-    audio_service_stream_factory_.binding_.Bind(
-        audio::mojom::StreamFactoryRequest(std::move(factory_request)));
+  void BindFactory(mojo::ScopedMessagePipeHandle factory_receiver) {
+    audio_service_stream_factory_.receiver_.Bind(
+        mojo::PendingReceiver<audio::mojom::StreamFactory>(
+            std::move(factory_receiver)));
   }
 
   class MockStreamFactory : public audio::FakeStreamFactory {
    public:
-    MockStreamFactory() : binding_(this) {}
-    ~MockStreamFactory() override {}
+    MockStreamFactory() = default;
+    ~MockStreamFactory() override = default;
 
     void CreateInputStream(
         mojo::PendingReceiver<media::mojom::AudioInputStream> stream_receiver,
@@ -133,7 +137,7 @@ class MAYBE_RenderFrameAudioInputStreamFactoryTest
     CreateInputStreamCallback last_created_callback;
     CreateLoopbackStreamCallback last_created_loopback_callback;
 
-    mojo::Binding<audio::mojom::StreamFactory> binding_;
+    mojo::Receiver<audio::mojom::StreamFactory> receiver_{this};
   };
 
   class FakeRendererAudioInputStreamFactoryClient
@@ -197,16 +201,18 @@ class MAYBE_RenderFrameAudioInputStreamFactoryTest
 };
 
 TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest, ConstructDestruct) {
-  mojom::RendererAudioInputStreamFactoryPtr factory_ptr;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory> factory_remote;
   RenderFrameAudioInputStreamFactory factory(
-      mojo::MakeRequest(&factory_ptr), media_stream_manager_.get(), main_rfh());
+      factory_remote.BindNewPipeAndPassReceiver(), media_stream_manager_.get(),
+      main_rfh());
 }
 
 TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
        CreateOpenedStream_ForwardsCall) {
-  mojom::RendererAudioInputStreamFactoryPtr factory_ptr;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory> factory_remote;
   RenderFrameAudioInputStreamFactory factory(
-      mojo::MakeRequest(&factory_ptr), media_stream_manager_.get(), main_rfh());
+      factory_remote.BindNewPipeAndPassReceiver(), media_stream_manager_.get(),
+      main_rfh());
 
   base::UnguessableToken session_id =
       audio_input_device_manager()->Open(blink::MediaStreamDevice(
@@ -214,10 +220,10 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
           kDeviceName));
   base::RunLoop().RunUntilIdle();
 
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  mojo::MakeRequest(&client);
-  factory_ptr->CreateStream(std::move(client), session_id, kParams, kAGC,
-                            kSharedMemoryCount, nullptr);
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
+  factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
+                               kSharedMemoryCount, nullptr);
 
   base::RunLoop().RunUntilIdle();
 
@@ -227,9 +233,10 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
 TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
        CreateWebContentsCapture_ForwardsCall) {
   std::unique_ptr<WebContents> source_contents = CreateTestWebContents();
-  mojom::RendererAudioInputStreamFactoryPtr factory_ptr;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory> factory_remote;
   RenderFrameAudioInputStreamFactory factory(
-      mojo::MakeRequest(&factory_ptr), media_stream_manager_.get(), main_rfh());
+      factory_remote.BindNewPipeAndPassReceiver(), media_stream_manager_.get(),
+      main_rfh());
 
   RenderFrameHost* main_frame = source_contents->GetMainFrame();
   WebContentsMediaCaptureId capture_id(main_frame->GetProcess()->GetID(),
@@ -240,10 +247,10 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
           capture_id.ToString(), kDeviceName));
   base::RunLoop().RunUntilIdle();
 
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  mojo::MakeRequest(&client);
-  factory_ptr->CreateStream(std::move(client), session_id, kParams, kAGC,
-                            kSharedMemoryCount, nullptr);
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
+  factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
+                               kSharedMemoryCount, nullptr);
 
   base::RunLoop().RunUntilIdle();
 
@@ -253,9 +260,10 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
 TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
        CreateWebContentsCaptureAfterCaptureSourceDestructed_Fails) {
   std::unique_ptr<WebContents> source_contents = CreateTestWebContents();
-  mojom::RendererAudioInputStreamFactoryPtr factory_ptr;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory> factory_remote;
   RenderFrameAudioInputStreamFactory factory(
-      mojo::MakeRequest(&factory_ptr), media_stream_manager_.get(), main_rfh());
+      factory_remote.BindNewPipeAndPassReceiver(), media_stream_manager_.get(),
+      main_rfh());
 
   RenderFrameHost* main_frame = source_contents->GetMainFrame();
   WebContentsMediaCaptureId capture_id(main_frame->GetProcess()->GetID(),
@@ -267,10 +275,10 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
   base::RunLoop().RunUntilIdle();
 
   source_contents.reset();
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  mojo::MakeRequest(&client);
-  factory_ptr->CreateStream(std::move(client), session_id, kParams, kAGC,
-                            kSharedMemoryCount, nullptr);
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
+  factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
+                               kSharedMemoryCount, nullptr);
 
   base::RunLoop().RunUntilIdle();
 
@@ -279,16 +287,16 @@ TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
 
 TEST_F(MAYBE_RenderFrameAudioInputStreamFactoryTest,
        CreateStreamWithoutValidSessionId_Fails) {
-  mojom::RendererAudioInputStreamFactoryPtr factory_ptr;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory> factory_remote;
   RenderFrameAudioInputStreamFactory factory(
-      mojo::MakeRequest(&factory_ptr), media_stream_manager_.get(), main_rfh());
+      factory_remote.BindNewPipeAndPassReceiver(), media_stream_manager_.get(),
+      main_rfh());
 
   base::UnguessableToken session_id = base::UnguessableToken::Create();
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  mojo::MakeRequest(&client);
-
-  factory_ptr->CreateStream(std::move(client), session_id, kParams, kAGC,
-                            kSharedMemoryCount, nullptr);
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+  ignore_result(client.InitWithNewPipeAndPassReceiver());
+  factory_remote->CreateStream(std::move(client), session_id, kParams, kAGC,
+                               kSharedMemoryCount, nullptr);
 
   base::RunLoop().RunUntilIdle();
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
index d44dedc7289..ed0cd88443d 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.cc
@@ -28,7 +28,9 @@
 #include "content/public/browser/render_process_host.h"
 #include "media/base/output_device_info.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 
 namespace content {
 
@@ -38,11 +40,12 @@ class RenderFrameAudioOutputStreamFactory::Core final
   Core(RenderFrameHost* frame,
        media::AudioSystem* audio_system,
        MediaStreamManager* media_stream_manager,
-       mojom::RendererAudioOutputStreamFactoryRequest request);
+       mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver);
 
   ~Core() final = default;
 
-  void Init(mojom::RendererAudioOutputStreamFactoryRequest request);
+  void Init(
+      mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver);
 
   size_t current_number_of_providers_for_testing() {
     return stream_providers_.size();
@@ -53,15 +56,16 @@ class RenderFrameAudioOutputStreamFactory::Core final
   // streams and cleans itself up (using the |owner| pointer) when done.
   class ProviderImpl final : public media::mojom::AudioOutputStreamProvider {
    public:
-    ProviderImpl(media::mojom::AudioOutputStreamProviderRequest request,
-                 RenderFrameAudioOutputStreamFactory::Core* owner,
-                 const std::string& device_id)
+    ProviderImpl(
+        mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider> receiver,
+        RenderFrameAudioOutputStreamFactory::Core* owner,
+        const std::string& device_id)
         : owner_(owner),
           device_id_(device_id),
-          binding_(this, std::move(request)) {
+          receiver_(this, std::move(receiver)) {
       DCHECK_CURRENTLY_ON(BrowserThread::IO);
-      // Unretained is safe since |this| owns |binding_|.
-      binding_.set_connection_error_handler(
+      // Unretained is safe since |this| owns |receiver_|.
+      receiver_.set_disconnect_handler(
           base::BindOnce(&ProviderImpl::Done, base::Unretained(this)));
     }
 
@@ -69,7 +73,8 @@ class RenderFrameAudioOutputStreamFactory::Core final
 
     void Acquire(
         const media::AudioParameters& params,
-        media::mojom::AudioOutputStreamProviderClientPtr provider_client,
+        mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+            provider_client,
         const base::Optional<base::UnguessableToken>& processing_id) final {
       DCHECK_CURRENTLY_ON(BrowserThread::IO);
       TRACE_EVENT1("audio",
@@ -95,7 +100,7 @@ class RenderFrameAudioOutputStreamFactory::Core final
     RenderFrameAudioOutputStreamFactory::Core* const owner_;
     const std::string device_id_;
 
-    mojo::Binding<media::mojom::AudioOutputStreamProvider> binding_;
+    mojo::Receiver<media::mojom::AudioOutputStreamProvider> receiver_;
 
     DISALLOW_COPY_AND_ASSIGN(ProviderImpl);
   };
@@ -106,7 +111,8 @@ class RenderFrameAudioOutputStreamFactory::Core final
 
   // mojom::RendererAudioOutputStreamFactory implementation.
   void RequestDeviceAuthorization(
-      media::mojom::AudioOutputStreamProviderRequest provider_request,
+      mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+          provider_receiver,
       const base::Optional<base::UnguessableToken>& session_id,
       const std::string& device_id,
       RequestDeviceAuthorizationCallback callback) final;
@@ -117,7 +123,7 @@ class RenderFrameAudioOutputStreamFactory::Core final
   // chosen. This id is hashed.
   void AuthorizationCompleted(
       base::TimeTicks auth_start_time,
-      media::mojom::AudioOutputStreamProviderRequest request,
+      mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider> receiver,
       RequestDeviceAuthorizationCallback callback,
       media::OutputDeviceStatus status,
       const media::AudioParameters& params,
@@ -130,7 +136,7 @@ class RenderFrameAudioOutputStreamFactory::Core final
   const int frame_id_;
   AudioOutputAuthorizationHandler authorization_handler_;
 
-  mojo::Binding<mojom::RendererAudioOutputStreamFactory> binding_;
+  mojo::Receiver<mojom::RendererAudioOutputStreamFactory> receiver_{this};
   // Always null-check this weak pointer before dereferencing it.
   base::WeakPtr<ForwardingAudioStreamFactory::Core> forwarding_factory_;
 
@@ -150,11 +156,11 @@ RenderFrameAudioOutputStreamFactory::RenderFrameAudioOutputStreamFactory(
     RenderFrameHost* frame,
     media::AudioSystem* audio_system,
     MediaStreamManager* media_stream_manager,
-    mojom::RendererAudioOutputStreamFactoryRequest request)
+    mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver)
     : core_(new Core(frame,
                      audio_system,
                      media_stream_manager,
-                     std::move(request))) {
+                     std::move(receiver))) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 }
 
@@ -179,11 +185,10 @@ RenderFrameAudioOutputStreamFactory::Core::Core(
     RenderFrameHost* frame,
     media::AudioSystem* audio_system,
     MediaStreamManager* media_stream_manager,
-    mojom::RendererAudioOutputStreamFactoryRequest request)
+    mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver)
     : process_id_(frame->GetProcess()->GetID()),
       frame_id_(frame->GetRoutingID()),
-      authorization_handler_(audio_system, media_stream_manager, process_id_),
-      binding_(this) {
+      authorization_handler_(audio_system, media_stream_manager, process_id_) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   ForwardingAudioStreamFactory::Core* tmp_factory =
@@ -202,18 +207,19 @@ RenderFrameAudioOutputStreamFactory::Core::Core(
   // thread.
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&Core::Init, base::Unretained(this), std::move(request)));
+      base::BindOnce(&Core::Init, base::Unretained(this), std::move(receiver)));
 }
 
 void RenderFrameAudioOutputStreamFactory::Core::Init(
-    mojom::RendererAudioOutputStreamFactoryRequest request) {
+    mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
-  binding_.Bind(std::move(request));
+  receiver_.Bind(std::move(receiver));
 }
 
 void RenderFrameAudioOutputStreamFactory::Core::RequestDeviceAuthorization(
-    media::mojom::AudioOutputStreamProviderRequest provider_request,
+    mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+        provider_receiver,
     const base::Optional<base::UnguessableToken>& session_id,
     const std::string& device_id,
     RequestDeviceAuthorizationCallback callback) {
@@ -230,7 +236,7 @@ void RenderFrameAudioOutputStreamFactory::Core::RequestDeviceAuthorization(
       completed_callback = base::BindOnce(
           &RenderFrameAudioOutputStreamFactory::Core::AuthorizationCompleted,
           weak_ptr_factory_.GetWeakPtr(), auth_start_time,
-          std::move(provider_request), std::move(callback));
+          std::move(provider_receiver), std::move(callback));
 
   authorization_handler_.RequestDeviceAuthorization(
       frame_id_, session_id.value_or(base::UnguessableToken()), device_id,
@@ -239,7 +245,7 @@ void RenderFrameAudioOutputStreamFactory::Core::RequestDeviceAuthorization(
 
 void RenderFrameAudioOutputStreamFactory::Core::AuthorizationCompleted(
     base::TimeTicks auth_start_time,
-    media::mojom::AudioOutputStreamProviderRequest request,
+    mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider> receiver,
     RequestDeviceAuthorizationCallback callback,
     media::OutputDeviceStatus status,
     const media::AudioParameters& params,
@@ -259,7 +265,7 @@ void RenderFrameAudioOutputStreamFactory::Core::AuthorizationCompleted(
 
   if (status == media::OUTPUT_DEVICE_STATUS_OK) {
     stream_providers_.insert(std::make_unique<ProviderImpl>(
-        std::move(request), this, std::move(raw_device_id)));
+        std::move(receiver), this, std::move(raw_device_id)));
   }
 }
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.h b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.h
index 50362670e66..34bd3afa3b0 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.h
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory.h
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/common/media/renderer_audio_output_stream_factory.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace media {
 class AudioSystem;
@@ -45,7 +46,7 @@ class CONTENT_EXPORT RenderFrameAudioOutputStreamFactory final {
       RenderFrameHost* frame,
       media::AudioSystem* audio_system,
       MediaStreamManager* media_stream_manager,
-      mojom::RendererAudioOutputStreamFactoryRequest request);
+      mojo::PendingReceiver<mojom::RendererAudioOutputStreamFactory> receiver);
 
   ~RenderFrameAudioOutputStreamFactory();
 
diff --git a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc
index 7c563f0ec13..61dd63ea79c 100644
--- a/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/render_frame_audio_output_stream_factory_unittest.cc
@@ -30,8 +30,10 @@
 #include "media/audio/test_audio_thread.h"
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/cpp/fake_stream_factory.h"
 #include "services/audio/public/mojom/constants.mojom.h"
 #include "services/audio/public/mojom/stream_factory.mojom.h"
@@ -133,24 +135,24 @@ class RenderFrameAudioOutputStreamFactoryTest
 };
 
 TEST_F(RenderFrameAudioOutputStreamFactoryTest, ConstructDestruct) {
-  mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
-  RenderFrameAudioOutputStreamFactory factory(main_rfh(), audio_system_.get(),
-                                              media_stream_manager_.get(),
-                                              mojo::MakeRequest(&factory_ptr));
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote;
+  RenderFrameAudioOutputStreamFactory factory(
+      main_rfh(), audio_system_.get(), media_stream_manager_.get(),
+      factory_remote.BindNewPipeAndPassReceiver());
 }
 
 TEST_F(RenderFrameAudioOutputStreamFactoryTest,
        RequestDeviceAuthorizationForDefaultDevice_StatusOk) {
-  mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
-  RenderFrameAudioOutputStreamFactory factory(main_rfh(), audio_system_.get(),
-                                              media_stream_manager_.get(),
-                                              mojo::MakeRequest(&factory_ptr));
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote;
+  RenderFrameAudioOutputStreamFactory factory(
+      main_rfh(), audio_system_.get(), media_stream_manager_.get(),
+      factory_remote.BindNewPipeAndPassReceiver());
 
-  media::mojom::AudioOutputStreamProviderPtr provider_ptr;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider_remote;
   MockAuthorizationCallback mock_callback;
-  factory_ptr->RequestDeviceAuthorization(mojo::MakeRequest(&provider_ptr),
-                                          base::nullopt, kDefaultDeviceId,
-                                          mock_callback.Get());
+  factory_remote->RequestDeviceAuthorization(
+      provider_remote.BindNewPipeAndPassReceiver(), base::nullopt,
+      kDefaultDeviceId, mock_callback.Get());
 
   EXPECT_CALL(mock_callback,
               Run(media::OUTPUT_DEVICE_STATUS_OK, _, std::string()));
@@ -163,17 +165,17 @@ TEST_F(RenderFrameAudioOutputStreamFactoryTest,
 TEST_F(
     RenderFrameAudioOutputStreamFactoryTest,
     RequestDeviceAuthorizationForDefaultDeviceAndDestroyProviderPtr_CleansUp) {
-  mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
-  RenderFrameAudioOutputStreamFactory factory(main_rfh(), audio_system_.get(),
-                                              media_stream_manager_.get(),
-                                              mojo::MakeRequest(&factory_ptr));
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote;
+  RenderFrameAudioOutputStreamFactory factory(
+      main_rfh(), audio_system_.get(), media_stream_manager_.get(),
+      factory_remote.BindNewPipeAndPassReceiver());
 
-  media::mojom::AudioOutputStreamProviderPtr provider_ptr;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider_remote;
   MockAuthorizationCallback mock_callback;
-  factory_ptr->RequestDeviceAuthorization(mojo::MakeRequest(&provider_ptr),
-                                          base::nullopt, kDefaultDeviceId,
-                                          mock_callback.Get());
-  provider_ptr.reset();
+  factory_remote->RequestDeviceAuthorization(
+      provider_remote.BindNewPipeAndPassReceiver(), base::nullopt,
+      kDefaultDeviceId, mock_callback.Get());
+  provider_remote.reset();
 
   EXPECT_CALL(mock_callback,
               Run(media::OUTPUT_DEVICE_STATUS_OK, _, std::string()));
@@ -186,16 +188,16 @@ TEST_F(
 TEST_F(
     RenderFrameAudioOutputStreamFactoryTest,
     RequestDeviceAuthorizationForNondefaultDeviceWithoutAuthorization_Fails) {
-  mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
-  RenderFrameAudioOutputStreamFactory factory(main_rfh(), audio_system_.get(),
-                                              media_stream_manager_.get(),
-                                              mojo::MakeRequest(&factory_ptr));
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote;
+  RenderFrameAudioOutputStreamFactory factory(
+      main_rfh(), audio_system_.get(), media_stream_manager_.get(),
+      factory_remote.BindNewPipeAndPassReceiver());
 
-  media::mojom::AudioOutputStreamProviderPtr provider_ptr;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider_remote;
   MockAuthorizationCallback mock_callback;
-  factory_ptr->RequestDeviceAuthorization(mojo::MakeRequest(&provider_ptr),
-                                          base::nullopt, kDeviceId,
-                                          mock_callback.Get());
+  factory_remote->RequestDeviceAuthorization(
+      provider_remote.BindNewPipeAndPassReceiver(), base::nullopt, kDeviceId,
+      mock_callback.Get());
 
   EXPECT_CALL(mock_callback,
               Run(Ne(media::OUTPUT_DEVICE_STATUS_OK), _, std::string()));
@@ -207,20 +209,20 @@ TEST_F(
 
 TEST_F(RenderFrameAudioOutputStreamFactoryTest,
        CreateStream_CreatesStreamAndFreesProvider) {
-  mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
-  RenderFrameAudioOutputStreamFactory factory(main_rfh(), audio_system_.get(),
-                                              media_stream_manager_.get(),
-                                              mojo::MakeRequest(&factory_ptr));
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote;
+  RenderFrameAudioOutputStreamFactory factory(
+      main_rfh(), audio_system_.get(), media_stream_manager_.get(),
+      factory_remote.BindNewPipeAndPassReceiver());
 
-  media::mojom::AudioOutputStreamProviderPtr provider_ptr;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider_remote;
   MockAuthorizationCallback mock_callback;
-  factory_ptr->RequestDeviceAuthorization(mojo::MakeRequest(&provider_ptr),
-                                          base::nullopt, kDefaultDeviceId,
-                                          mock_callback.Get());
+  factory_remote->RequestDeviceAuthorization(
+      provider_remote.BindNewPipeAndPassReceiver(), base::nullopt,
+      kDefaultDeviceId, mock_callback.Get());
   {
-    media::mojom::AudioOutputStreamProviderClientPtr client;
-    mojo::MakeRequest(&client);
-    provider_ptr->Acquire(kParams, std::move(client), base::nullopt);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
+    provider_remote->Acquire(kParams, std::move(client), base::nullopt);
   }
 
   audio::mojom::StreamFactory::CreateOutputStreamCallback created_callback;
@@ -235,18 +237,18 @@ TEST_F(RenderFrameAudioOutputStreamFactoryTest,
 
 TEST_F(RenderFrameAudioOutputStreamFactoryTest,
        CreateStreamAfterFactoryDestruction_Fails) {
-  media::mojom::AudioOutputStreamProviderPtr provider_ptr;
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> provider_remote;
   MockAuthorizationCallback mock_callback;
 
   {
-    mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
+    mojo::Remote<mojom::RendererAudioOutputStreamFactory> factory_remote;
     RenderFrameAudioOutputStreamFactory factory(
         main_rfh(), audio_system_.get(), media_stream_manager_.get(),
-        mojo::MakeRequest(&factory_ptr));
+        factory_remote.BindNewPipeAndPassReceiver());
 
-    factory_ptr->RequestDeviceAuthorization(mojo::MakeRequest(&provider_ptr),
-                                            base::nullopt, kDefaultDeviceId,
-                                            mock_callback.Get());
+    factory_remote->RequestDeviceAuthorization(
+        provider_remote.BindNewPipeAndPassReceiver(), base::nullopt,
+        kDefaultDeviceId, mock_callback.Get());
 
     audio::mojom::StreamFactory::CreateOutputStreamCallback created_callback;
     EXPECT_CALL(mock_callback,
@@ -255,9 +257,9 @@ TEST_F(RenderFrameAudioOutputStreamFactoryTest,
   }
   // Now factory is destructed. Trying to create a stream should fail.
   {
-    media::mojom::AudioOutputStreamProviderClientPtr client;
-    mojo::MakeRequest(&client);
-    provider_ptr->Acquire(kParams, std::move(client), base::nullopt);
+    mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient> client;
+    ignore_result(client.InitWithNewPipeAndPassReceiver());
+    provider_remote->Acquire(kParams, std::move(client), base::nullopt);
   }
 
   base::RunLoop().RunUntilIdle();
diff --git a/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context.h b/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context.h
index be85d7e60f8..9dea211e99e 100644
--- a/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context.h
+++ b/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context.h
@@ -12,6 +12,7 @@
 #include "content/common/content_export.h"
 #include "media/audio/audio_output_delegate.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 
 namespace media {
 class AudioParameters;
@@ -44,7 +45,8 @@ class CONTENT_EXPORT RendererAudioOutputStreamFactoryContext {
       int render_frame_id,
       int stream_id,
       const media::AudioParameters& params,
-      media::mojom::AudioOutputStreamObserverPtr stream_observer,
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          stream_observer,
       media::AudioOutputDelegate::EventHandler* handler) = 0;
 };
 
diff --git a/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.cc b/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.cc
index 8120a005bbf..72ca8d96f64 100644
--- a/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.cc
+++ b/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.cc
@@ -10,6 +10,7 @@
 #include "content/browser/renderer_host/media/audio_output_delegate_impl.h"
 #include "content/browser/renderer_host/media/media_stream_manager.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "media/audio/audio_system.h"
 #include "media/mojo/mojom/audio_logging.mojom.h"
@@ -56,7 +57,8 @@ RendererAudioOutputStreamFactoryContextImpl::CreateDelegate(
     int render_frame_id,
     int stream_id,
     const media::AudioParameters& params,
-    media::mojom::AudioOutputStreamObserverPtr stream_observer,
+    mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+        stream_observer,
     media::AudioOutputDelegate::EventHandler* handler) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   MediaObserver* const media_observer =
diff --git a/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.h b/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.h
index a07a5dfd92d..0156798c031 100644
--- a/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.h
+++ b/chromium/content/browser/renderer_host/media/renderer_audio_output_stream_factory_context_impl.h
@@ -12,6 +12,7 @@
 #include "content/browser/renderer_host/media/old_render_frame_audio_output_stream_factory.h"
 #include "content/browser/renderer_host/media/renderer_audio_output_stream_factory_context.h"
 #include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 
 namespace media {
 class AudioManager;
@@ -68,7 +69,8 @@ class CONTENT_EXPORT RendererAudioOutputStreamFactoryContextImpl
       int render_frame_id,
       int stream_id,
       const media::AudioParameters& params,
-      media::mojom::AudioOutputStreamObserverPtr stream_observer,
+      mojo::PendingRemote<media::mojom::AudioOutputStreamObserver>
+          stream_observer,
       media::AudioOutputDelegate::EventHandler* handler) override;
 
  private:
diff --git a/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc b/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc
index f0f41d17b4c..084a6e249b4 100644
--- a/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc
+++ b/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher.cc
@@ -8,13 +8,16 @@
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
+#include "base/command_line.h"
 #include "base/task/post_task.h"
 #include "content/browser/renderer_host/media/service_launched_video_capture_device.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "media/base/media_switches.h"
 #include "media/capture/video/video_capture_device.h"
 #include "media/capture/video/video_frame_receiver_on_task_runner.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "services/video_capture/public/cpp/receiver_media_to_mojo_adapter.h"
 
 namespace content {
@@ -114,9 +117,10 @@ void ServiceVideoCaptureDeviceLauncher::LaunchDeviceAsync(
           std::make_unique<media::VideoFrameReceiverOnTaskRunner>(
               std::move(receiver),
               base::CreateSingleThreadTaskRunner({BrowserThread::IO})));
-  video_capture::mojom::ReceiverPtr receiver_proxy;
-  mojo::MakeStrongBinding<video_capture::mojom::Receiver>(
-      std::move(receiver_adapter), mojo::MakeRequest(&receiver_proxy));
+  mojo::PendingRemote<video_capture::mojom::Receiver> pending_remote_proxy;
+  mojo::MakeSelfOwnedReceiver(
+      std::move(receiver_adapter),
+      pending_remote_proxy.InitWithNewPipeAndPassReceiver());
 
   video_capture::mojom::PushVideoStreamSubscriptionPtr subscription;
   // Create message pipe so that we can subsequently call
@@ -134,6 +138,14 @@ void ServiceVideoCaptureDeviceLauncher::LaunchDeviceAsync(
   new_params.power_line_frequency =
       media::VideoCaptureDevice::GetPowerLineFrequency(params);
 
+  // GpuMemoryBuffer-based VideoCapture buffer works only on the Chrome OS
+  // VideoCaptureDevice implementation. It's not supported by
+  // FakeVideoCaptureDevice.
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kVideoCaptureUseGpuMemoryBuffer)) {
+    new_params.buffer_type = media::VideoCaptureBufferType::kGpuMemoryBuffer;
+  }
+
   // Note that we set |force_reopen_with_new_settings| to true in order
   // to avoid the situation that a requests to open (or reopen) a device
   // that has just been closed with different settings ends up getting the old
@@ -142,7 +154,7 @@ void ServiceVideoCaptureDeviceLauncher::LaunchDeviceAsync(
   // have to refactor code here and upstream to wait for a callback from the
   // service indicating that the device closing is complete.
   source->CreatePushSubscription(
-      std::move(receiver_proxy), new_params,
+      std::move(pending_remote_proxy), new_params,
       true /*force_reopen_with_new_settings*/, std::move(subscription_request),
       base::BindOnce(
           // Use of Unretained |this| is safe, because |done_cb_| guarantees
diff --git a/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher_unittest.cc b/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher_unittest.cc
index 86a7572a5f3..03eda4dcb79 100644
--- a/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/service_video_capture_device_launcher_unittest.cc
@@ -14,6 +14,8 @@
 #include "content/public/test/browser_task_environment.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/video_capture/public/cpp/mock_push_subscription.h"
 #include "services/video_capture/public/cpp/mock_video_source.h"
 #include "services/video_capture/public/cpp/mock_video_source_provider.h"
@@ -93,13 +95,15 @@ class ServiceVideoCaptureDeviceLauncherTest : public testing::Test {
 
     ON_CALL(mock_source_, DoCreatePushSubscription(_, _, _, _, _))
         .WillByDefault(Invoke(
-            [this](video_capture::mojom::ReceiverPtr& subscriber,
-                   const media::VideoCaptureParams& requested_settings,
-                   bool force_reopen_with_new_settings,
-                   video_capture::mojom::PushVideoStreamSubscriptionRequest&
-                       subscription,
-                   video_capture::mojom::VideoSource::
-                       CreatePushSubscriptionCallback& callback) {
+            [this](
+                mojo::PendingRemote<video_capture::mojom::Receiver> subscriber,
+                const media::VideoCaptureParams& requested_settings,
+                bool force_reopen_with_new_settings,
+                mojo::PendingReceiver<
+                    video_capture::mojom::PushVideoStreamSubscription>
+                    subscription,
+                video_capture::mojom::VideoSource::
+                    CreatePushSubscriptionCallback& callback) {
               subscription_bindings_.AddBinding(&mock_subscription_,
                                                 std::move(subscription));
               std::move(callback).Run(
@@ -202,10 +206,11 @@ void ServiceVideoCaptureDeviceLauncherTest::RunLaunchingDeviceIsAbortedTest(
       .WillOnce(Invoke(
           [&create_push_subscription_success_answer_cb, &step_1_run_loop,
            service_result_code](
-              video_capture::mojom::ReceiverPtr& subscriber,
+              mojo::PendingRemote<video_capture::mojom::Receiver> subscriber,
               const media::VideoCaptureParams& requested_settings,
               bool force_reopen_with_new_settings,
-              video_capture::mojom::PushVideoStreamSubscriptionRequest&
+              mojo::PendingReceiver<
+                  video_capture::mojom::PushVideoStreamSubscription>
                   subscription,
               video_capture::mojom::VideoSource::CreatePushSubscriptionCallback&
                   callback) {
@@ -256,10 +261,11 @@ TEST_F(ServiceVideoCaptureDeviceLauncherTest,
 
   EXPECT_CALL(mock_source_, DoCreatePushSubscription(_, _, _, _, _))
       .WillOnce(Invoke(
-          [](video_capture::mojom::ReceiverPtr& subscriber,
+          [](mojo::PendingRemote<video_capture::mojom::Receiver> subscriber,
              const media::VideoCaptureParams& requested_settings,
              bool force_reopen_with_new_settings,
-             video_capture::mojom::PushVideoStreamSubscriptionRequest&
+             mojo::PendingReceiver<
+                 video_capture::mojom::PushVideoStreamSubscription>
                  subscription,
              video_capture::mojom::VideoSource::CreatePushSubscriptionCallback&
                  callback) {
@@ -268,7 +274,8 @@ TEST_F(ServiceVideoCaptureDeviceLauncherTest,
             base::ThreadTaskRunnerHandle::Get()->PostTask(
                 FROM_HERE,
                 base::BindOnce(
-                    [](video_capture::mojom::ReceiverPtr subscriber,
+                    [](mojo::PendingRemote<video_capture::mojom::Receiver>
+                           subscriber,
                        const media::VideoCaptureParams& requested_settings,
                        video_capture::mojom::PushVideoStreamSubscriptionRequest
                            subscription,
@@ -334,10 +341,11 @@ TEST_F(ServiceVideoCaptureDeviceLauncherTest,
   EXPECT_CALL(mock_source_, DoCreatePushSubscription(_, _, _, _, _))
       .WillOnce(Invoke(
           [&create_subscription_cb](
-              video_capture::mojom::ReceiverPtr& subscriber,
+              mojo::PendingRemote<video_capture::mojom::Receiver> subscriber,
               const media::VideoCaptureParams& requested_settings,
               bool force_reopen_with_new_settings,
-              video_capture::mojom::PushVideoStreamSubscriptionRequest&
+              mojo::PendingReceiver<
+                  video_capture::mojom::PushVideoStreamSubscription>
                   subscription,
               video_capture::mojom::VideoSource::CreatePushSubscriptionCallback&
                   callback) {
diff --git a/chromium/content/browser/renderer_host/media/service_video_capture_provider_unittest.cc b/chromium/content/browser/renderer_host/media/service_video_capture_provider_unittest.cc
index 672fcc37896..b34a0036b76 100644
--- a/chromium/content/browser/renderer_host/media/service_video_capture_provider_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/service_video_capture_provider_unittest.cc
@@ -17,6 +17,8 @@
 #include "content/public/test/browser_task_environment.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/video_capture/public/cpp/mock_push_subscription.h"
 #include "services/video_capture/public/cpp/mock_video_capture_service.h"
 #include "services/video_capture/public/cpp/mock_video_source.h"
@@ -101,15 +103,17 @@ class ServiceVideoCaptureProviderTest : public testing::Test {
 
     ON_CALL(mock_source_, DoCreatePushSubscription(_, _, _, _, _))
         .WillByDefault(Invoke(
-            [this](video_capture::mojom::ReceiverPtr& subscriber,
-                   const media::VideoCaptureParams& requested_settings,
-                   bool force_reopen_with_new_settings,
-                   video_capture::mojom::PushVideoStreamSubscriptionRequest&
-                       subscription,
-                   video_capture::mojom::VideoSource::
-                       CreatePushSubscriptionCallback& callback) {
-              subscription_bindings_.AddBinding(&mock_subscription_,
-                                                std::move(subscription));
+            [this](
+                mojo::PendingRemote<video_capture::mojom::Receiver> subscriber,
+                const media::VideoCaptureParams& requested_settings,
+                bool force_reopen_with_new_settings,
+                mojo::PendingReceiver<
+                    video_capture::mojom::PushVideoStreamSubscription>
+                    subscription,
+                video_capture::mojom::VideoSource::
+                    CreatePushSubscriptionCallback& callback) {
+              subscription_receivers_.Add(&mock_subscription_,
+                                          std::move(subscription));
               std::move(callback).Run(
                   video_capture::mojom::CreatePushSubscriptionResultCode::
                       kCreatedWithRequestedSettings,
@@ -127,8 +131,8 @@ class ServiceVideoCaptureProviderTest : public testing::Test {
   video_capture::MockVideoSource mock_source_;
   mojo::BindingSet<video_capture::mojom::VideoSource> source_bindings_;
   video_capture::MockPushSubcription mock_subscription_;
-  mojo::BindingSet<video_capture::mojom::PushVideoStreamSubscription>
-      subscription_bindings_;
+  mojo::ReceiverSet<video_capture::mojom::PushVideoStreamSubscription>
+      subscription_receivers_;
   std::unique_ptr<ServiceVideoCaptureProvider> provider_;
   base::MockCallback<VideoCaptureProvider::GetDeviceInfosCallback> results_cb_;
   base::MockCallback<
diff --git a/chromium/content/browser/renderer_host/media/video_capture_buffer_pool_unittest.cc b/chromium/content/browser/renderer_host/media/video_capture_buffer_pool_unittest.cc
index f420479c69e..96a1bc868d8 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_buffer_pool_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_buffer_pool_unittest.cc
@@ -63,6 +63,7 @@ class VideoCaptureBufferPoolTest
       : expected_dropped_id_(0),
         pool_(new media::VideoCaptureBufferPoolImpl(
             std::make_unique<media::VideoCaptureBufferTrackerFactoryImpl>(),
+            media::VideoCaptureBufferType::kSharedMemory,
             kTestBufferPoolSize)) {}
 
   void ExpectDroppedId(int expected_dropped_id) {
@@ -93,7 +94,7 @@ class VideoCaptureBufferPoolTest
         new Buffer(pool_, std::move(buffer_handle), buffer_id));
   }
 
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   int expected_dropped_id_;
   scoped_refptr<media::VideoCaptureBufferPool> pool_;
 
diff --git a/chromium/content/browser/renderer_host/media/video_capture_controller.cc b/chromium/content/browser/renderer_host/media/video_capture_controller.cc
index 7bb8091f6f8..effb80cd200 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_controller.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_controller.cc
@@ -243,6 +243,9 @@ VideoCaptureController::BufferContext::CloneBufferHandle() {
     DCHECK(result->get_read_only_shmem_region().IsValid());
   } else if (buffer_handle_->is_mailbox_handles()) {
     result->set_mailbox_handles(buffer_handle_->get_mailbox_handles()->Clone());
+  } else if (buffer_handle_->is_gpu_memory_buffer_handle()) {
+    result->set_gpu_memory_buffer_handle(
+        buffer_handle_->get_gpu_memory_buffer_handle().Clone());
   } else {
     NOTREACHED() << "Unexpected video buffer handle type";
   }
diff --git a/chromium/content/browser/renderer_host/media/video_capture_controller_unittest.cc b/chromium/content/browser/renderer_host/media/video_capture_controller_unittest.cc
index 8484009f337..9b2c8642a2b 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_controller_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_controller_unittest.cc
@@ -168,7 +168,7 @@ class VideoCaptureControllerTest
   void InitializeNewDeviceClientAndBufferPoolInstances() {
     buffer_pool_ = new media::VideoCaptureBufferPoolImpl(
         std::make_unique<media::VideoCaptureBufferTrackerFactoryImpl>(),
-        kPoolSize);
+        media::VideoCaptureBufferType::kSharedMemory, kPoolSize);
 #if defined(OS_CHROMEOS)
     device_client_.reset(new media::VideoCaptureDeviceClient(
         media::VideoCaptureBufferType::kSharedMemory,
diff --git a/chromium/content/browser/renderer_host/media/video_capture_host.cc b/chromium/content/browser/renderer_host/media/video_capture_host.cc
index c1ecb28ce61..01604726735 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_host.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_host.cc
@@ -15,7 +15,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
 
@@ -73,14 +73,15 @@ VideoCaptureHost::VideoCaptureHost(
 }
 
 // static
-void VideoCaptureHost::Create(uint32_t render_process_id,
-                              MediaStreamManager* media_stream_manager,
-                              media::mojom::VideoCaptureHostRequest request) {
+void VideoCaptureHost::Create(
+    uint32_t render_process_id,
+    MediaStreamManager* media_stream_manager,
+    mojo::PendingReceiver<media::mojom::VideoCaptureHost> receiver) {
   DVLOG(1) << __func__;
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  mojo::MakeStrongBinding(std::make_unique<VideoCaptureHost>(
-                              render_process_id, media_stream_manager),
-                          std::move(request));
+  mojo::MakeSelfOwnedReceiver(std::make_unique<VideoCaptureHost>(
+                                  render_process_id, media_stream_manager),
+                              std::move(receiver));
 }
 
 VideoCaptureHost::~VideoCaptureHost() {
@@ -181,17 +182,18 @@ void VideoCaptureHost::OnStarted(
 void VideoCaptureHost::OnStartedUsingGpuDecode(
     const VideoCaptureControllerID& id) {}
 
-void VideoCaptureHost::Start(const base::UnguessableToken& device_id,
-                             const base::UnguessableToken& session_id,
-                             const media::VideoCaptureParams& params,
-                             media::mojom::VideoCaptureObserverPtr observer) {
+void VideoCaptureHost::Start(
+    const base::UnguessableToken& device_id,
+    const base::UnguessableToken& session_id,
+    const media::VideoCaptureParams& params,
+    mojo::PendingRemote<media::mojom::VideoCaptureObserver> observer) {
   DVLOG(1) << __func__ << " session_id=" << session_id
            << ", device_id=" << device_id << ", format="
            << media::VideoCaptureFormat::ToString(params.requested_format);
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
 
   DCHECK(!base::Contains(device_id_to_observer_map_, device_id));
-  device_id_to_observer_map_[device_id] = std::move(observer);
+  device_id_to_observer_map_[device_id].Bind(std::move(observer));
 
   const VideoCaptureControllerID controller_id(device_id);
   if (controllers_.find(controller_id) != controllers_.end()) {
diff --git a/chromium/content/browser/renderer_host/media/video_capture_host.h b/chromium/content/browser/renderer_host/media/video_capture_host.h
index 0cb78826d11..0e5ff7d7b73 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_host.h
+++ b/chromium/content/browser/renderer_host/media/video_capture_host.h
@@ -16,6 +16,7 @@
 #include "content/browser/renderer_host/media/video_capture_controller_event_handler.h"
 #include "content/common/content_export.h"
 #include "media/capture/mojom/video_capture.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace content {
 class MediaStreamManager;
@@ -36,9 +37,10 @@ class CONTENT_EXPORT VideoCaptureHost
                    MediaStreamManager* media_stream_manager);
   ~VideoCaptureHost() override;
 
-  static void Create(uint32_t render_process_id,
-                     MediaStreamManager* media_stream_manager,
-                     media::mojom::VideoCaptureHostRequest request);
+  static void Create(
+      uint32_t render_process_id,
+      MediaStreamManager* media_stream_manager,
+      mojo::PendingReceiver<media::mojom::VideoCaptureHost> receiver);
 
   // Interface for notifying RenderProcessHost instance about active video
   // capture stream changes.
@@ -73,7 +75,8 @@ class CONTENT_EXPORT VideoCaptureHost
   void Start(const base::UnguessableToken& device_id,
              const base::UnguessableToken& session_id,
              const media::VideoCaptureParams& params,
-             media::mojom::VideoCaptureObserverPtr observer) override;
+             mojo::PendingRemote<media::mojom::VideoCaptureObserver> observer)
+      override;
   void Stop(const base::UnguessableToken& device_id) override;
   void Pause(const base::UnguessableToken& device_id) override;
   void Resume(const base::UnguessableToken& device_id,
@@ -129,7 +132,8 @@ class CONTENT_EXPORT VideoCaptureHost
 
   // VideoCaptureObservers map, each one is used and should be valid between
   // Start() and the corresponding Stop().
-  std::map<base::UnguessableToken, media::mojom::VideoCaptureObserverPtr>
+  std::map<base::UnguessableToken,
+           mojo::Remote<media::mojom::VideoCaptureObserver>>
       device_id_to_observer_map_;
 
   base::WeakPtrFactory<VideoCaptureHost> weak_factory_{this};
diff --git a/chromium/content/browser/renderer_host/media/video_capture_manager_unittest.cc b/chromium/content/browser/renderer_host/media/video_capture_manager_unittest.cc
index ef5236920da..53f7440fdac 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_manager_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_manager_unittest.cc
@@ -24,6 +24,7 @@
 #include "content/browser/renderer_host/media/video_capture_controller_event_handler.h"
 #include "content/browser/screenlock_monitor/screenlock_monitor.h"
 #include "content/browser/screenlock_monitor/screenlock_monitor_source.h"
+#include "content/common/buildflags.h"
 #include "content/public/browser/desktop_media_id.h"
 #include "content/public/test/browser_task_environment.h"
 #include "media/capture/video/fake_video_capture_device_factory.h"
@@ -907,7 +908,7 @@ TEST_F(VideoCaptureManagerTest, DeviceCaptureDeviceNotClosedOnScreenlock) {
   vcm_->UnregisterListener(listener_.get());
 }
 
-#if defined(ENABLE_SCREEN_CAPTURE) && !defined(OS_ANDROID)
+#if BUILDFLAG(ENABLE_SCREEN_CAPTURE) && !defined(OS_ANDROID)
 // Try to open, start a desktop capture device, and confirm it's closed on
 // ScreenLocked event on desktop platforms.
 TEST_F(VideoCaptureManagerTest, DesktopCaptureDeviceClosedOnScreenlock) {
@@ -941,7 +942,7 @@ TEST_F(VideoCaptureManagerTest, DesktopCaptureDeviceClosedOnScreenlock) {
   base::RunLoop().RunUntilIdle();
   vcm_->UnregisterListener(listener_.get());
 }
-#endif  // ENABLE_SCREEN_CAPTURE && !OS_ANDROID
+#endif  // ENABLE_SCREEN_CAPTURE && !defined(OS_ANDROID)
 
 // TODO(mcasas): Add a test to check consolidation of the supported formats
 // provided by the device when http://crbug.com/323913 is closed.
diff --git a/chromium/content/browser/renderer_host/media/video_capture_unittest.cc b/chromium/content/browser/renderer_host/media/video_capture_unittest.cc
index 64bbcd9b29e..bb9f2922211 100644
--- a/chromium/content/browser/renderer_host/media/video_capture_unittest.cc
+++ b/chromium/content/browser/renderer_host/media/video_capture_unittest.cc
@@ -22,6 +22,7 @@
 #include "content/browser/renderer_host/media/media_stream_ui_proxy.h"
 #include "content/browser/renderer_host/media/video_capture_host.h"
 #include "content/browser/renderer_host/media/video_capture_manager.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
@@ -31,7 +32,7 @@
 #include "media/audio/test_audio_thread.h"
 #include "media/base/media_switches.h"
 #include "media/capture/video_capture_types.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "net/url_request/url_request_context.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -98,8 +99,7 @@ class VideoCaptureTest : public testing::Test,
             std::make_unique<media::TestAudioThread>())),
         audio_system_(
             std::make_unique<media::AudioSystemImpl>(audio_manager_.get())),
-        task_runner_(base::ThreadTaskRunnerHandle::Get()),
-        observer_binding_(this) {}
+        task_runner_(base::ThreadTaskRunnerHandle::Get()) {}
   ~VideoCaptureTest() override { audio_manager_->Shutdown(); }
 
   void SetUp() override {
@@ -145,11 +145,13 @@ class VideoCaptureTest : public testing::Test,
       base::RunLoop run_loop;
       MediaDevicesManager::BoolDeviceTypes devices_to_enumerate;
       devices_to_enumerate[blink::MEDIA_DEVICE_TYPE_VIDEO_INPUT] = true;
+      MediaDeviceSaltAndOrigin salt_and_origin =
+          GetMediaDeviceSaltAndOrigin(render_process_id, render_frame_id);
       media_stream_manager_->media_devices_manager()->EnumerateDevices(
           devices_to_enumerate,
           base::BindOnce(&VideoInputDevicesEnumerated, run_loop.QuitClosure(),
-                         browser_context_.GetMediaDeviceIDSalt(),
-                         security_origin, &video_devices));
+                         salt_and_origin.device_id_salt, salt_and_origin.origin,
+                         &video_devices));
       run_loop.Run();
     }
     ASSERT_FALSE(video_devices.empty());
@@ -161,9 +163,7 @@ class VideoCaptureTest : public testing::Test,
           render_process_id, render_frame_id, requester_id, page_request_id,
           video_devices[0].device_id,
           blink::mojom::MediaStreamType::DEVICE_VIDEO_CAPTURE,
-          MediaDeviceSaltAndOrigin{browser_context_.GetMediaDeviceIDSalt(),
-                                   browser_context_.GetMediaDeviceIDSalt(),
-                                   security_origin},
+          GetMediaDeviceSaltAndOrigin(render_process_id, render_frame_id),
           base::BindOnce(&VideoCaptureTest::OnDeviceOpened,
                          base::Unretained(this), run_loop.QuitClosure()),
           MediaStreamManager::DeviceStoppedCallback());
@@ -210,9 +210,8 @@ class VideoCaptureTest : public testing::Test,
         .Times(AnyNumber())
         .WillRepeatedly(ExitMessageLoop(task_runner_, run_loop.QuitClosure()));
 
-    media::mojom::VideoCaptureObserverPtr observer;
-    observer_binding_.Bind(mojo::MakeRequest(&observer));
-    host_->Start(DeviceId(), opened_session_id_, params, std::move(observer));
+    host_->Start(DeviceId(), opened_session_id_, params,
+                 observer_receiver_.BindNewPipeAndPassRemote());
 
     run_loop.Run();
   }
@@ -231,9 +230,8 @@ class VideoCaptureTest : public testing::Test,
     // capture is stopped immediately.
     EXPECT_CALL(*this, OnStateChanged(media::mojom::VideoCaptureState::STARTED))
         .Times(AtMost(1));
-    media::mojom::VideoCaptureObserverPtr observer;
-    observer_binding_.Bind(mojo::MakeRequest(&observer));
-    host_->Start(DeviceId(), opened_session_id_, params, std::move(observer));
+    host_->Start(DeviceId(), opened_session_id_, params,
+                 observer_receiver_.BindNewPipeAndPassRemote());
 
     EXPECT_CALL(*this,
                 OnStateChanged(media::mojom::VideoCaptureState::STOPPED));
@@ -317,7 +315,7 @@ class VideoCaptureTest : public testing::Test,
   std::string opened_device_label_;
 
   std::unique_ptr<VideoCaptureHost> host_;
-  mojo::Binding<media::mojom::VideoCaptureObserver> observer_binding_;
+  mojo::Receiver<media::mojom::VideoCaptureObserver> observer_receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(VideoCaptureTest);
 };
diff --git a/chromium/content/browser/renderer_host/mock_render_widget_host.cc b/chromium/content/browser/renderer_host/mock_render_widget_host.cc
index 3cfdc060da3..0b65bc7ae22 100644
--- a/chromium/content/browser/renderer_host/mock_render_widget_host.cc
+++ b/chromium/content/browser/renderer_host/mock_render_widget_host.cc
@@ -61,8 +61,9 @@ void MockRenderWidgetHost::ExpectForceEnableZoom(bool enable) {
 // |mock_renderer_compositor_frame_sink|.
 void MockRenderWidgetHost::SetMockRendererCompositorFrameSink(
     viz::MockCompositorFrameSinkClient* mock_renderer_compositor_frame_sink) {
-  renderer_compositor_frame_sink_ =
-      mock_renderer_compositor_frame_sink->BindInterfacePtr();
+  renderer_compositor_frame_sink_.reset();
+  renderer_compositor_frame_sink_.Bind(
+      mock_renderer_compositor_frame_sink->BindInterfaceRemote());
 }
 
 void MockRenderWidgetHost::SetupForInputRouterTest() {
@@ -81,9 +82,9 @@ MockRenderWidgetHost* MockRenderWidgetHost::Create(
     RenderWidgetHostDelegate* delegate,
     RenderProcessHost* process,
     int32_t routing_id) {
-  mojom::WidgetPtr widget;
+  mojo::PendingRemote<mojom::Widget> widget;
   std::unique_ptr<MockWidgetImpl> widget_impl =
-      std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+      std::make_unique<MockWidgetImpl>(widget.InitWithNewPipeAndPassReceiver());
 
   return new MockRenderWidgetHost(delegate, process, routing_id,
                                   std::move(widget_impl), std::move(widget));
@@ -102,7 +103,7 @@ MockRenderWidgetHost::MockRenderWidgetHost(
     RenderProcessHost* process,
     int routing_id,
     std::unique_ptr<MockWidgetImpl> widget_impl,
-    mojom::WidgetPtr widget)
+    mojo::PendingRemote<mojom::Widget> widget)
     : RenderWidgetHostImpl(delegate,
                            process,
                            routing_id,
diff --git a/chromium/content/browser/renderer_host/mock_render_widget_host.h b/chromium/content/browser/renderer_host/mock_render_widget_host.h
index 8e82f2e5b1e..481ec043efc 100644
--- a/chromium/content/browser/renderer_host/mock_render_widget_host.h
+++ b/chromium/content/browser/renderer_host/mock_render_widget_host.h
@@ -14,6 +14,7 @@
 #include "content/public/common/input_event_ack_state.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/mock_widget_input_handler.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/platform/web_input_event.h"
 
 namespace viz {
@@ -90,7 +91,7 @@ class MockRenderWidgetHost : public RenderWidgetHostImpl {
                        RenderProcessHost* process,
                        int routing_id,
                        std::unique_ptr<MockWidgetImpl> widget_impl,
-                       mojom::WidgetPtr widget);
+                       mojo::PendingRemote<mojom::Widget> widget);
 
   std::unique_ptr<MockWidgetImpl> widget_impl_;
 
diff --git a/chromium/content/browser/renderer_host/overscroll_controller.cc b/chromium/content/browser/renderer_host/overscroll_controller.cc
index f8b5aaeb7c5..95a0dd7a076 100644
--- a/chromium/content/browser/renderer_host/overscroll_controller.cc
+++ b/chromium/content/browser/renderer_host/overscroll_controller.cc
@@ -8,6 +8,7 @@
 
 #include "base/command_line.h"
 #include "base/logging.h"
+#include "base/numerics/ranges.h"
 #include "content/browser/renderer_host/overscroll_controller_delegate.h"
 #include "content/public/browser/overscroll_configuration.h"
 #include "content/public/common/content_features.h"
@@ -45,7 +46,7 @@ bool IsGestureScrollUpdateInertialEvent(const blink::WebInputEvent& event) {
 
 float ClampAbsoluteValue(float value, float max_abs) {
   DCHECK_LT(0.f, max_abs);
-  return std::max(-max_abs, std::min(value, max_abs));
+  return base::ClampToRange(value, -max_abs, max_abs);
 }
 
 }  // namespace
diff --git a/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc b/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc
index 41407c7493c..5d1a7eaf1a8 100644
--- a/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc
+++ b/chromium/content/browser/renderer_host/overscroll_controller_unittest.cc
@@ -43,7 +43,9 @@ class OverscrollControllerTest : public ::testing::Test {
   bool SimulateMouseWheel(float dx, float dy) {
     DCHECK(!current_event_);
     current_event_ = std::make_unique<blink::WebMouseWheelEvent>(
-        SyntheticWebMouseWheelEventBuilder::Build(0, 0, dx, dy, 0, true));
+        SyntheticWebMouseWheelEventBuilder::Build(
+            0, 0, dx, dy, 0,
+            ui::input_types::ScrollGranularity::kScrollByPrecisePixel));
     return controller_->WillHandleEvent(*current_event_);
   }
 
diff --git a/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.cc b/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.cc
index f4e3923063a..455a34fbc4d 100644
--- a/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.cc
+++ b/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.cc
@@ -252,8 +252,9 @@ std::unique_ptr<ppapi::host::ResourceHost>
 ContentBrowserPepperHostFactory::CreateAcceptedTCPSocket(
     PP_Instance instance,
     ppapi::TCPSocketVersion version,
-    network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream) {
   if (!CanCreateSocket())
@@ -262,7 +263,7 @@ ContentBrowserPepperHostFactory::CreateAcceptedTCPSocket(
       base::MakeRefCounted<PepperTCPSocketMessageFilter>(
           nullptr /* factory */, host_, instance, version));
   tcp_socket->SetConnectedSocket(
-      std::move(connected_socket), std::move(socket_observer_request),
+      std::move(connected_socket), std::move(socket_observer_receiver),
       std::move(receive_stream), std::move(send_stream));
   return std::unique_ptr<ppapi::host::ResourceHost>(
       new ppapi::host::MessageFilterHost(host_->GetPpapiHost(), instance, 0,
diff --git a/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.h b/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.h
index 4c755131198..5c1c3355457 100644
--- a/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.h
+++ b/chromium/content/browser/renderer_host/pepper/content_browser_pepper_host_factory.h
@@ -10,6 +10,8 @@
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "ppapi/c/pp_resource.h"
 #include "ppapi/host/host_factory.h"
@@ -42,8 +44,9 @@ class ContentBrowserPepperHostFactory : public ppapi::host::HostFactory {
   std::unique_ptr<ppapi::host::ResourceHost> CreateAcceptedTCPSocket(
       PP_Instance instance,
       ppapi::TCPSocketVersion version,
-      network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream);
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc
index 34ad47257e1..ac22f6a2ae4 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.cc
@@ -86,8 +86,7 @@ PepperHostResolverMessageFilter::PepperHostResolverMessageFilter(
     : external_plugin_(host->external_plugin()),
       private_api_(private_api),
       render_process_id_(0),
-      render_frame_id_(0),
-      binding_(this) {
+      render_frame_id_(0) {
   DCHECK(host);
 
   if (!host->GetRenderFrameIDsForInstance(
@@ -145,19 +144,16 @@ int32_t PepperHostResolverMessageFilter::OnMsgResolve(
   // thread pending). Balanced in OnComplete();
   AddRef();
 
-  network::mojom::ResolveHostClientPtr client_ptr;
-  binding_.Bind(mojo::MakeRequest(&client_ptr));
-  binding_.set_connection_error_handler(
-      base::BindOnce(&PepperHostResolverMessageFilter::OnComplete,
-                     base::Unretained(this), net::ERR_FAILED, base::nullopt));
-
   network::mojom::ResolveHostParametersPtr parameters =
       network::mojom::ResolveHostParameters::New();
   PrepareRequestInfo(hint, parameters.get());
 
   storage_partition->GetNetworkContext()->ResolveHost(
       net::HostPortPair(host_port.host, host_port.port), std::move(parameters),
-      std::move(client_ptr));
+      receiver_.BindNewPipeAndPassRemote());
+  receiver_.set_disconnect_handler(
+      base::BindOnce(&PepperHostResolverMessageFilter::OnComplete,
+                     base::Unretained(this), net::ERR_FAILED, base::nullopt));
   host_resolve_context_ = context->MakeReplyMessageContext();
 
   return PP_OK_COMPLETIONPENDING;
@@ -167,7 +163,7 @@ void PepperHostResolverMessageFilter::OnComplete(
     int result,
     const base::Optional<net::AddressList>& resolved_addresses) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  binding_.Close();
+  receiver_.reset();
 
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.h b/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.h
index 63203dadf4b..1d6859f8b58 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.h
+++ b/chromium/content/browser/renderer_host/pepper/pepper_host_resolver_message_filter.h
@@ -14,7 +14,7 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/public/common/process_type.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "ppapi/c/pp_instance.h"
 #include "ppapi/host/resource_message_filter.h"
 #include "services/network/public/cpp/resolve_host_client_base.h"
@@ -88,9 +88,9 @@ class CONTENT_EXPORT PepperHostResolverMessageFilter
 
   // The following members are only accessed on the UI thread.
 
-  // A reference to |this| must always be taken while |binding_| is bound to
+  // A reference to |this| must always be taken while |receiver_| is bound to
   // ensure that if the error callback is called the object is alive.
-  mojo::Binding<network::mojom::ResolveHostClient> binding_;
+  mojo::Receiver<network::mojom::ResolveHostClient> receiver_{this};
 
   ppapi::host::ReplyMessageContext host_resolve_context_;
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_network_proxy_host.cc b/chromium/content/browser/renderer_host/pepper/pepper_network_proxy_host.cc
index 06a80147574..41e984ebeaf 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_network_proxy_host.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_network_proxy_host.cc
@@ -17,6 +17,7 @@
 #include "content/public/browser/site_instance.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/socket_permission_request.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/proxy_resolution/proxy_info.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/host/dispatch_host_message.h"
@@ -33,7 +34,8 @@ bool LookUpProxyForURLCallback(
     int render_process_host_id,
     int render_frame_host_id,
     const GURL& url,
-    network::mojom::ProxyLookupClientPtr proxy_lookup_client) {
+    mojo::PendingRemote<network::mojom::ProxyLookupClient>
+        proxy_lookup_client) {
   RenderFrameHost* render_frame_host =
       RenderFrameHost::FromID(render_process_host_id, render_frame_host_id);
   if (!render_frame_host)
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc
index 465aacd085d..cb99530791c 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.cc
@@ -13,8 +13,7 @@
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "net/base/net_errors.h"
 #include "url/gurl.h"
 
@@ -29,8 +28,7 @@ class PepperProxyLookupHelper::UIThreadHelper
   UIThreadHelper(const GURL& url,
                  LookUpProxyForURLCallback look_up_proxy_for_url_callback,
                  LookUpCompleteCallback look_up_complete_callback)
-      : binding_(this),
-        look_up_complete_callback_(std::move(look_up_complete_callback)),
+      : look_up_complete_callback_(std::move(look_up_complete_callback)),
         callback_task_runner_(base::SequencedTaskRunnerHandle::Get()) {
     base::PostTask(
         FROM_HERE, {BrowserThread::UI},
@@ -45,9 +43,9 @@ class PepperProxyLookupHelper::UIThreadHelper
                    LookUpProxyForURLCallback look_up_proxy_for_url_callback) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-    network::mojom::ProxyLookupClientPtr proxy_lookup_client;
-    binding_.Bind(mojo::MakeRequest(&proxy_lookup_client));
-    binding_.set_connection_error_handler(base::BindOnce(
+    mojo::PendingRemote<network::mojom::ProxyLookupClient> proxy_lookup_client =
+        receiver_.BindNewPipeAndPassRemote();
+    receiver_.set_disconnect_handler(base::BindOnce(
         &UIThreadHelper::OnProxyLookupComplete, base::Unretained(this),
         net::ERR_ABORTED, base::nullopt));
     if (!std::move(look_up_proxy_for_url_callback)
@@ -61,13 +59,13 @@ class PepperProxyLookupHelper::UIThreadHelper
       const base::Optional<net::ProxyInfo>& proxy_info) override {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-    binding_.Close();
+    receiver_.reset();
     callback_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce(std::move(look_up_complete_callback_), proxy_info));
   }
 
-  mojo::Binding<network::mojom::ProxyLookupClient> binding_;
+  mojo::Receiver<network::mojom::ProxyLookupClient> receiver_{this};
 
   LookUpCompleteCallback look_up_complete_callback_;
   scoped_refptr<base::SequencedTaskRunner> callback_task_runner_;
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.h b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.h
index b184fb4017d..0d6b70ab879 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.h
+++ b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper.h
@@ -13,6 +13,7 @@
 #include "base/optional.h"
 #include "base/sequence_checker.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/network/public/mojom/proxy_lookup_client.mojom.h"
 
 class GURL;
@@ -32,7 +33,8 @@ class CONTENT_EXPORT PepperProxyLookupHelper {
   // testing. Returns false if unable to make the call, for whatever reason.
   using LookUpProxyForURLCallback = base::OnceCallback<bool(
       const GURL& url,
-      network::mojom::ProxyLookupClientPtr proxy_lookup_client)>;
+      mojo::PendingRemote<network::mojom::ProxyLookupClient>
+          proxy_lookup_client)>;
 
   // Callback to invoke when complete. Invoked on thread the
   // PepperProxyLookupHelper was created on.
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc
index 74885486449..808d02c3089 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_proxy_lookup_helper_unittest.cc
@@ -18,6 +18,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/test/browser_task_environment.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/net_errors.h"
 #include "net/proxy_resolution/proxy_info.h"
 #include "services/network/public/mojom/proxy_lookup_client.mojom.h"
@@ -51,10 +52,10 @@ class PepperProxyLookupHelperTest : public testing::Test {
       EXPECT_TRUE(proxy_lookup_client_);
   }
 
-  // Takes the |ProxyLookupClientPtr| passed by |lookup_helper_| to
+  // Takes the |mojo::Remote<ProxyLookupClient>| passed by |lookup_helper_| to
   // LookUpProxyForURLOnUIThread(). May only be called after |lookup_helper_|
   // has successfully called into LookUpProxyForURLOnUIThread().
-  network::mojom::ProxyLookupClientPtr ClaimProxyLookupClient() {
+  mojo::Remote<network::mojom::ProxyLookupClient> ClaimProxyLookupClient() {
     EXPECT_TRUE(proxy_lookup_client_);
     return std::move(proxy_lookup_client_);
   }
@@ -112,7 +113,8 @@ class PepperProxyLookupHelperTest : public testing::Test {
   bool LookUpProxyForURLOnUIThread(
       base::OnceClosure closure,
       const GURL& url,
-      network::mojom::ProxyLookupClientPtr proxy_lookup_client) {
+      mojo::PendingRemote<network::mojom::ProxyLookupClient>
+          proxy_lookup_client) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
     std::move(closure).Run();
@@ -121,7 +123,7 @@ class PepperProxyLookupHelperTest : public testing::Test {
       return false;
 
     EXPECT_EQ(GURL(kTestURL), url);
-    proxy_lookup_client_ = std::move(proxy_lookup_client);
+    proxy_lookup_client_.Bind(std::move(proxy_lookup_client));
     return true;
   }
 
@@ -147,7 +149,7 @@ class PepperProxyLookupHelperTest : public testing::Test {
   std::unique_ptr<PepperProxyLookupHelper> lookup_helper_;
 
   base::Optional<net::ProxyInfo> proxy_info_;
-  network::mojom::ProxyLookupClientPtr proxy_lookup_client_;
+  mojo::Remote<network::mojom::ProxyLookupClient> proxy_lookup_client_;
 
   base::RunLoop lookup_complete_run_loop_;
 };
@@ -196,9 +198,9 @@ TEST_F(PepperProxyLookupHelperTest, FailToStartRequest) {
 TEST_F(PepperProxyLookupHelperTest, DestroyBeforeComplete) {
   StartLookup();
   base::RunLoop run_loop;
-  network::mojom::ProxyLookupClientPtr proxy_lookup_client =
+  mojo::Remote<network::mojom::ProxyLookupClient> proxy_lookup_client =
       ClaimProxyLookupClient();
-  proxy_lookup_client.set_connection_error_handler(run_loop.QuitClosure());
+  proxy_lookup_client.set_disconnect_handler(run_loop.QuitClosure());
   DestroyLookupHelper();
   run_loop.Run();
 }
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.cc
index d1886bd7ffb..a28065a3e5f 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.cc
@@ -21,7 +21,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/socket_permission_request.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/net_errors.h"
@@ -175,7 +175,7 @@ int32_t PepperTCPServerSocketMessageFilter::OnMsgListen(
   network_context->CreateTCPServerSocket(
       net::IPEndPoint(net::IPAddress(address), port), backlog,
       pepper_socket_utils::PepperTCPNetworkAnnotationTag(),
-      mojo::MakeRequest(&socket_),
+      socket_.BindNewPipeAndPassReceiver(),
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           base::BindOnce(&PepperTCPServerSocketMessageFilter::OnListenCompleted,
                          weak_ptr_factory_.GetWeakPtr(), reply_context),
@@ -196,17 +196,16 @@ int32_t PepperTCPServerSocketMessageFilter::OnMsgAccept(
   ppapi::host::ReplyMessageContext reply_context(
       context->MakeReplyMessageContext());
 
-  network::mojom::SocketObserverPtr socket_observer;
-  network::mojom::SocketObserverRequest socket_observer_request =
-      mojo::MakeRequest(&socket_observer);
+  mojo::PendingRemote<network::mojom::SocketObserver> socket_observer;
+  auto socket_observer_receiver =
+      socket_observer.InitWithNewPipeAndPassReceiver();
   socket_->Accept(
       std::move(socket_observer),
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           base::BindOnce(&PepperTCPServerSocketMessageFilter::OnAcceptCompleted,
                          base::Unretained(this), reply_context,
-                         std::move(socket_observer_request)),
-          net::ERR_FAILED, base::nullopt /* remote_addr */,
-          network::mojom::TCPConnectedSocketPtr(),
+                         std::move(socket_observer_receiver)),
+          net::ERR_FAILED, base::nullopt /* remote_addr */, mojo::NullRemote(),
           mojo::ScopedDataPipeConsumerHandle(),
           mojo::ScopedDataPipeProducerHandle()));
   return PP_OK_COMPLETIONPENDING;
@@ -287,10 +286,11 @@ void PepperTCPServerSocketMessageFilter::OnFirewallHoleOpened(
 
 void PepperTCPServerSocketMessageFilter::OnAcceptCompleted(
     const ppapi::host::ReplyMessageContext& context,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     int net_result,
     const base::Optional<net::IPEndPoint>& remote_addr,
-    network::mojom::TCPConnectedSocketPtr connected_socket,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -310,12 +310,12 @@ void PepperTCPServerSocketMessageFilter::OnAcceptCompleted(
     return;
   }
 
-  if (!remote_addr || !connected_socket.is_bound()) {
+  if (!remote_addr || !connected_socket.is_valid()) {
     SendAcceptError(context, NetErrorToPepperError(net_result));
     return;
   }
 
-  DCHECK(socket_observer_request.is_pending());
+  DCHECK(socket_observer_receiver.is_valid());
 
   PP_NetAddress_Private pp_remote_addr =
       NetAddressPrivateImpl::kInvalidNetAddress;
@@ -331,15 +331,16 @@ void PepperTCPServerSocketMessageFilter::OnAcceptCompleted(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(
           &PepperTCPServerSocketMessageFilter::OnAcceptCompletedOnIOThread,
-          this, context, connected_socket.PassInterface(),
-          std::move(socket_observer_request), std::move(receive_stream),
+          this, context, std::move(connected_socket),
+          std::move(socket_observer_receiver), std::move(receive_stream),
           std::move(send_stream), bound_addr_, pp_remote_addr));
 }
 
 void PepperTCPServerSocketMessageFilter::OnAcceptCompletedOnIOThread(
     const ppapi::host::ReplyMessageContext& context,
-    network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream,
     PP_NetAddress_Private pp_local_addr,
@@ -352,7 +353,7 @@ void PepperTCPServerSocketMessageFilter::OnAcceptCompletedOnIOThread(
   std::unique_ptr<ppapi::host::ResourceHost> host =
       factory_->CreateAcceptedTCPSocket(
           instance_, ppapi::TCP_SOCKET_VERSION_PRIVATE,
-          std::move(connected_socket), std::move(socket_observer_request),
+          std::move(connected_socket), std::move(socket_observer_receiver),
           std::move(receive_stream), std::move(send_stream));
   if (!host) {
     SendAcceptError(context, PP_ERROR_NOSPACE);
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.h b/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.h
index 0e18bc1403f..79939fccb3d 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.h
+++ b/chromium/content/browser/renderer_host/pepper/pepper_tcp_server_socket_message_filter.h
@@ -17,6 +17,9 @@
 #include "base/optional.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/ip_endpoint.h"
 #include "ppapi/c/pp_instance.h"
@@ -97,16 +100,18 @@ class CONTENT_EXPORT PepperTCPServerSocketMessageFilter
                          const base::Optional<net::IPEndPoint>& local_addr);
   void OnAcceptCompleted(
       const ppapi::host::ReplyMessageContext& context,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       int net_result,
       const base::Optional<net::IPEndPoint>& remote_addr,
-      network::mojom::TCPConnectedSocketPtr connected_socket,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream);
   void OnAcceptCompletedOnIOThread(
       const ppapi::host::ReplyMessageContext& context,
-      network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream,
       PP_NetAddress_Private pp_local_addr,
@@ -144,7 +149,7 @@ class CONTENT_EXPORT PepperTCPServerSocketMessageFilter
   PP_Instance instance_;
 
   State state_;
-  network::mojom::TCPServerSocketPtr socket_;
+  mojo::Remote<network::mojom::TCPServerSocket> socket_;
 
   PP_NetAddress_Private bound_addr_;
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc
index c8892ffc530..8c8670f986f 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.cc
@@ -23,7 +23,7 @@
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/socket_permission_request.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/address_family.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/io_buffer.h"
@@ -74,8 +74,6 @@ PepperTCPSocketMessageFilter::PepperTCPSocketMessageFilter(
       external_plugin_(host->external_plugin()),
       render_process_id_(0),
       render_frame_id_(0),
-      binding_(this),
-      socket_observer_binding_(this),
       state_(TCPSocketState::INITIAL),
       bind_input_addr_(NetAddressPrivateImpl::kInvalidNetAddress),
       socket_options_(SOCKET_OPTION_NODELAY),
@@ -102,8 +100,9 @@ PepperTCPSocketMessageFilter::PepperTCPSocketMessageFilter(
 }
 
 void PepperTCPSocketMessageFilter::SetConnectedSocket(
-    network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
@@ -116,7 +115,7 @@ void PepperTCPSocketMessageFilter::SetConnectedSocket(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(
           &PepperTCPSocketMessageFilter::SetConnectedSocketOnUIThread, this,
-          std::move(connected_socket), std::move(socket_observer_request),
+          std::move(connected_socket), std::move(socket_observer_receiver),
           std::move(receive_stream), std::move(send_stream)));
 }
 
@@ -135,8 +134,9 @@ PepperTCPSocketMessageFilter::~PepperTCPSocketMessageFilter() {
 }
 
 void PepperTCPSocketMessageFilter::SetConnectedSocketOnUIThread(
-    network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -144,8 +144,8 @@ void PepperTCPSocketMessageFilter::SetConnectedSocketOnUIThread(
 
   state_ = TCPSocketState(TCPSocketState::CONNECTED);
   connected_socket_.Bind(std::move(connected_socket));
-  socket_observer_binding_.Bind(std::move(socket_observer_request));
-  socket_observer_binding_.set_connection_error_handler(
+  socket_observer_receiver_.Bind(std::move(socket_observer_receiver));
+  socket_observer_receiver_.set_disconnect_handler(
       base::BindOnce(&PepperTCPSocketMessageFilter::OnSocketObserverError,
                      base::Unretained(this)));
 
@@ -248,7 +248,7 @@ void PepperTCPSocketMessageFilter::OnComplete(
     int result,
     const base::Optional<net::AddressList>& resolved_addresses) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  binding_.Close();
+  receiver_.reset();
 
   if (!host_resolve_context_.is_valid())
     return;
@@ -306,7 +306,7 @@ void PepperTCPSocketMessageFilter::OnWriteError(int net_error) {
 
 void PepperTCPSocketMessageFilter::OnSocketObserverError() {
   // Note that this method may be called while a connection is still being made.
-  socket_observer_binding_.Close();
+  socket_observer_receiver_.reset();
 
   // Treat this as a read and write error. If read and write errors have already
   // been received, these calls will do nothing.
@@ -363,7 +363,7 @@ int32_t PepperTCPSocketMessageFilter::OnMsgBind(
   network_context->CreateTCPBoundSocket(
       net::IPEndPoint(net::IPAddress(address), port),
       pepper_socket_utils::PepperTCPNetworkAnnotationTag(),
-      mojo::MakeRequest(&bound_socket_),
+      bound_socket_.BindNewPipeAndPassReceiver(),
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           base::BindOnce(&PepperTCPSocketMessageFilter::OnBindCompleted,
                          weak_ptr_factory_.GetWeakPtr(),
@@ -403,13 +403,11 @@ int32_t PepperTCPSocketMessageFilter::OnMsgConnect(
   if (!network_context)
     return PP_ERROR_FAILED;
 
-  network::mojom::ResolveHostClientPtr client_ptr;
-  binding_.Bind(mojo::MakeRequest(&client_ptr));
-  binding_.set_connection_error_handler(
+  network_context->ResolveHost(net::HostPortPair(host, port), nullptr,
+                               receiver_.BindNewPipeAndPassRemote());
+  receiver_.set_disconnect_handler(
       base::BindOnce(&PepperTCPSocketMessageFilter::OnComplete,
                      base::Unretained(this), net::ERR_FAILED, base::nullopt));
-  network_context->ResolveHost(net::HostPortPair(host, port), nullptr,
-                               std::move(client_ptr));
 
   state_.SetPendingTransition(TCPSocketState::CONNECT);
   host_resolve_context_ = context->MakeReplyMessageContext();
@@ -484,13 +482,7 @@ int32_t PepperTCPSocketMessageFilter::OnMsgSSLHandshake(
   read_watcher_.reset();
   send_stream_.reset();
   write_watcher_.reset();
-  socket_observer_binding_.Close();
-
-  network::mojom::SocketObserverPtr socket_observer;
-  socket_observer_binding_.Bind(mojo::MakeRequest(&socket_observer));
-  socket_observer_binding_.set_connection_error_handler(
-      base::BindOnce(&PepperTCPSocketMessageFilter::OnSocketObserverError,
-                     base::Unretained(this)));
+  socket_observer_receiver_.reset();
 
   state_.SetPendingTransition(TCPSocketState::SSL_CONNECT);
 
@@ -501,7 +493,8 @@ int32_t PepperTCPSocketMessageFilter::OnMsgSSLHandshake(
   connected_socket_->UpgradeToTLS(
       host_port_pair, std::move(tls_client_socket_options),
       pepper_socket_utils::PepperTCPNetworkAnnotationTag(),
-      mojo::MakeRequest(&tls_client_socket_), std::move(socket_observer),
+      tls_client_socket_.BindNewPipeAndPassReceiver(),
+      socket_observer_receiver_.BindNewPipeAndPassRemote(),
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           base::BindOnce(&PepperTCPSocketMessageFilter::OnSSLHandshakeCompleted,
                          base::Unretained(this),
@@ -509,6 +502,10 @@ int32_t PepperTCPSocketMessageFilter::OnMsgSSLHandshake(
           net::ERR_FAILED, mojo::ScopedDataPipeConsumerHandle(),
           mojo::ScopedDataPipeProducerHandle(), base::nullopt /* ssl_info */));
 
+  socket_observer_receiver_.set_disconnect_handler(
+      base::BindOnce(&PepperTCPSocketMessageFilter::OnSocketObserverError,
+                     base::Unretained(this)));
+
   return PP_OK_COMPLETIONPENDING;
 }
 
@@ -593,7 +590,7 @@ int32_t PepperTCPSocketMessageFilter::OnMsgListen(
   state_.SetPendingTransition(TCPSocketState::LISTEN);
 
   bound_socket_->Listen(
-      backlog, mojo::MakeRequest(&server_socket_),
+      backlog, server_socket_.BindNewPipeAndPassReceiver(),
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           base::BindOnce(&PepperTCPSocketMessageFilter::OnListenCompleted,
                          base::Unretained(this),
@@ -615,18 +612,17 @@ int32_t PepperTCPSocketMessageFilter::OnMsgAccept(
 
   pending_accept_ = true;
 
-  network::mojom::SocketObserverPtr socket_observer;
-  network::mojom::SocketObserverRequest socket_observer_request =
-      mojo::MakeRequest(&socket_observer);
+  mojo::PendingRemote<network::mojom::SocketObserver> socket_observer;
+  auto socket_observer_receiver =
+      socket_observer.InitWithNewPipeAndPassReceiver();
   server_socket_->Accept(
       std::move(socket_observer),
       mojo::WrapCallbackWithDefaultInvokeIfNotRun(
           base::BindOnce(&PepperTCPSocketMessageFilter::OnAcceptCompleted,
                          base::Unretained(this),
                          context->MakeReplyMessageContext(),
-                         std::move(socket_observer_request)),
-          net::ERR_FAILED, base::nullopt /* remote_addr */,
-          network::mojom::TCPConnectedSocketPtr(),
+                         std::move(socket_observer_receiver)),
+          net::ERR_FAILED, base::nullopt /* remote_addr */, mojo::NullRemote(),
           mojo::ScopedDataPipeConsumerHandle(),
           mojo::ScopedDataPipeProducerHandle()));
   return PP_OK_COMPLETIONPENDING;
@@ -757,7 +753,7 @@ void PepperTCPSocketMessageFilter::TryRead() {
       // If no read error has been received yet, wait to receive one through
       // the SocketObserver interface.
       if (pending_read_pp_error_ == PP_OK_COMPLETIONPENDING) {
-        DCHECK(socket_observer_binding_.is_bound());
+        DCHECK(socket_observer_receiver_.is_bound());
         break;
       }
 
@@ -817,7 +813,7 @@ void PepperTCPSocketMessageFilter::TryWrite() {
   while (true) {
     if (!send_stream_.is_valid()) {
       if (pending_write_pp_error_ == PP_OK_COMPLETIONPENDING) {
-        DCHECK(socket_observer_binding_.is_bound());
+        DCHECK(socket_observer_receiver_.is_bound());
         break;
       }
       SendWriteReply(pending_write_pp_error_);
@@ -868,10 +864,8 @@ void PepperTCPSocketMessageFilter::StartConnect(
   DCHECK(state_.IsPending(TCPSocketState::CONNECT));
   DCHECK(!address_list.empty());
 
-  network::mojom::SocketObserverPtr socket_observer;
-  socket_observer_binding_.Bind(mojo::MakeRequest(&socket_observer));
-
-  socket_observer_binding_.set_connection_error_handler(
+  auto socket_observer = socket_observer_receiver_.BindNewPipeAndPassRemote();
+  socket_observer_receiver_.set_disconnect_handler(
       base::BindOnce(&PepperTCPSocketMessageFilter::OnSocketObserverError,
                      base::Unretained(this)));
 
@@ -892,7 +886,7 @@ void PepperTCPSocketMessageFilter::StartConnect(
           mojo::ScopedDataPipeProducerHandle());
   if (bound_socket_) {
     bound_socket_->Connect(address_list, std::move(socket_options),
-                           mojo::MakeRequest(&connected_socket_),
+                           connected_socket_.BindNewPipeAndPassReceiver(),
                            std::move(socket_observer), std::move(callback));
   } else {
     network::mojom::NetworkContext* network_context = GetNetworkContext();
@@ -904,8 +898,8 @@ void PepperTCPSocketMessageFilter::StartConnect(
     network_context->CreateTCPConnectedSocket(
         base::nullopt /* local_addr */, address_list, std::move(socket_options),
         pepper_socket_utils::PepperTCPNetworkAnnotationTag(),
-        mojo::MakeRequest(&connected_socket_), std::move(socket_observer),
-        std::move(callback));
+        connected_socket_.BindNewPipeAndPassReceiver(),
+        std::move(socket_observer), std::move(callback));
   }
 }
 
@@ -960,7 +954,7 @@ void PepperTCPSocketMessageFilter::OnConnectCompleted(
   // Handle errors.
 
   // This can happen even when the network service is behaving correctly, as
-  // we may see the |socket_observer_binding_| closed before receiving an
+  // we may see the |socket_observer_receiver_| closed before receiving an
   // error.
   pending_read_pp_error_ = PP_OK_COMPLETIONPENDING;
   pending_write_pp_error_ = PP_OK_COMPLETIONPENDING;
@@ -1076,10 +1070,11 @@ void PepperTCPSocketMessageFilter::OnListenCompleted(
 
 void PepperTCPSocketMessageFilter::OnAcceptCompleted(
     const ppapi::host::ReplyMessageContext& context,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     int net_result,
     const base::Optional<net::IPEndPoint>& remote_addr,
-    network::mojom::TCPConnectedSocketPtr connected_socket,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -1091,12 +1086,12 @@ void PepperTCPSocketMessageFilter::OnAcceptCompleted(
     return;
   }
 
-  if (!remote_addr || !connected_socket.is_bound()) {
+  if (!remote_addr || !connected_socket.is_valid()) {
     SendAcceptError(context, NetErrorToPepperError(net_result));
     return;
   }
 
-  DCHECK(socket_observer_request.is_pending());
+  DCHECK(socket_observer_receiver.is_valid());
 
   PP_NetAddress_Private pp_remote_addr =
       NetAddressPrivateImpl::kInvalidNetAddress;
@@ -1120,16 +1115,17 @@ void PepperTCPSocketMessageFilter::OnAcceptCompleted(
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
       base::BindOnce(&PepperTCPSocketMessageFilter::OnAcceptCompletedOnIOThread,
-                     this, context, connected_socket.PassInterface(),
-                     std::move(socket_observer_request),
+                     this, context, std::move(connected_socket),
+                     std::move(socket_observer_receiver),
                      std::move(receive_stream), std::move(send_stream),
                      bound_address, pp_remote_addr));
 }
 
 void PepperTCPSocketMessageFilter::OnAcceptCompletedOnIOThread(
     const ppapi::host::ReplyMessageContext& context,
-    network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-    network::mojom::SocketObserverRequest socket_observer_request,
+    mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+    mojo::PendingReceiver<network::mojom::SocketObserver>
+        socket_observer_receiver,
     mojo::ScopedDataPipeConsumerHandle receive_stream,
     mojo::ScopedDataPipeProducerHandle send_stream,
     PP_NetAddress_Private pp_local_addr,
@@ -1144,7 +1140,7 @@ void PepperTCPSocketMessageFilter::OnAcceptCompletedOnIOThread(
   std::unique_ptr<ppapi::host::ResourceHost> host =
       factory_->CreateAcceptedTCPSocket(
           instance_, version_, std::move(connected_socket),
-          std::move(socket_observer_request), std::move(receive_stream),
+          std::move(socket_observer_receiver), std::move(receive_stream),
           std::move(send_stream));
   if (!host) {
     SendAcceptError(context, PP_ERROR_NOSPACE);
@@ -1358,8 +1354,8 @@ void PepperTCPSocketMessageFilter::Close() {
   connected_socket_.reset();
   tls_client_socket_.reset();
   server_socket_.reset();
-  binding_.Close();
-  socket_observer_binding_.Close();
+  receiver_.reset();
+  socket_observer_receiver_.reset();
 
   read_watcher_.reset();
   receive_stream_.reset();
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.h b/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.h
index 8874de1dd48..192ab6caffb 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.h
+++ b/chromium/content/browser/renderer_host/pepper/pepper_tcp_socket_message_filter.h
@@ -20,7 +20,10 @@
 #include "build/build_config.h"
 #include "content/browser/renderer_host/pepper/browser_ppapi_host_impl.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/address_list.h"
 #include "net/base/ip_endpoint.h"
@@ -74,8 +77,9 @@ class CONTENT_EXPORT PepperTCPSocketMessageFilter
   // Switches state to CONNECTED using the provided pipes. May only be called
   // before any messages are received,
   void SetConnectedSocket(
-      network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream);
 
@@ -96,8 +100,9 @@ class CONTENT_EXPORT PepperTCPSocketMessageFilter
   ~PepperTCPSocketMessageFilter() override;
 
   void SetConnectedSocketOnUIThread(
-      network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream);
 
@@ -196,17 +201,19 @@ class CONTENT_EXPORT PepperTCPSocketMessageFilter
 
   void OnAcceptCompleted(
       const ppapi::host::ReplyMessageContext& context,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       int net_result,
       const base::Optional<net::IPEndPoint>& remote_addr,
-      network::mojom::TCPConnectedSocketPtr connected_socket,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream);
 
   void OnAcceptCompletedOnIOThread(
       const ppapi::host::ReplyMessageContext& context,
-      network::mojom::TCPConnectedSocketPtrInfo connected_socket,
-      network::mojom::SocketObserverRequest socket_observer_request,
+      mojo::PendingRemote<network::mojom::TCPConnectedSocket> connected_socket,
+      mojo::PendingReceiver<network::mojom::SocketObserver>
+          socket_observer_receiver,
       mojo::ScopedDataPipeConsumerHandle receive_stream,
       mojo::ScopedDataPipeProducerHandle send_stream,
       PP_NetAddress_Private pp_local_addr,
@@ -292,10 +299,11 @@ class CONTENT_EXPORT PepperTCPSocketMessageFilter
   int render_process_id_;
   int render_frame_id_;
 
-  // A reference to |this| must always be taken while |binding_| is bound to
+  // A reference to |this| must always be taken while |receiver_| is bound to
   // ensure that if the error callback is called the object is alive.
-  mojo::Binding<network::mojom::ResolveHostClient> binding_;
-  mojo::Binding<network::mojom::SocketObserver> socket_observer_binding_;
+  mojo::Receiver<network::mojom::ResolveHostClient> receiver_{this};
+  mojo::Receiver<network::mojom::SocketObserver> socket_observer_receiver_{
+      this};
 
   ppapi::TCPSocketState state_;
 
@@ -323,13 +331,13 @@ class CONTENT_EXPORT PepperTCPSocketMessageFilter
 
   // Holds socket if Bind() is called. Will be used to create a connected or
   // server socket, depending on the next call.
-  network::mojom::TCPBoundSocketPtr bound_socket_;
+  mojo::Remote<network::mojom::TCPBoundSocket> bound_socket_;
   // Holds socket if Connect() is called.
-  network::mojom::TCPConnectedSocketPtr connected_socket_;
+  mojo::Remote<network::mojom::TCPConnectedSocket> connected_socket_;
   // Holds socket if socket was upgraded to SSL.
-  network::mojom::TLSClientSocketPtr tls_client_socket_;
+  mojo::Remote<network::mojom::TLSClientSocket> tls_client_socket_;
   // Holds socket if Listen() is called.
-  network::mojom::TCPServerSocketPtr server_socket_;
+  mojo::Remote<network::mojom::TCPServerSocket> server_socket_;
 
   // Read/write pipes and their watchers. Both the watchers are configured so
   // that they must be armed to receive a notification.
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_mac.mm b/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_mac.mm
index bfaf5babbb8..91fd4ca362d 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_mac.mm
+++ b/chromium/content/browser/renderer_host/pepper/pepper_truetype_font_list_mac.mm
@@ -6,7 +6,6 @@
 
 #import <Cocoa/Cocoa.h>
 
-#include "base/mac/scoped_nsautorelease_pool.h"
 #include "base/stl_util.h"
 #include "base/strings/sys_string_conversions.h"
 #include "ppapi/c/dev/ppb_truetype_font_dev.h"
@@ -36,47 +35,49 @@ const NSInteger kPepperFontWeightsLength = base::size(kPepperFontWeights);
 }  // namespace
 
 void GetFontFamilies_SlowBlocking(std::vector<std::string>* font_families) {
-  base::mac::ScopedNSAutoreleasePool autorelease_pool;
-  NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
-  NSArray* fonts = [fontManager availableFontFamilies];
-  font_families->reserve([fonts count]);
-  for (NSString* family_name in fonts)
-    font_families->push_back(base::SysNSStringToUTF8(family_name));
+  @autoreleasepool {
+    NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
+    NSArray* fonts = [fontManager availableFontFamilies];
+    font_families->reserve([fonts count]);
+    for (NSString* family_name in fonts)
+      font_families->push_back(base::SysNSStringToUTF8(family_name));
+  }
 }
 
 void GetFontsInFamily_SlowBlocking(
     const std::string& family,
     std::vector<ppapi::proxy::SerializedTrueTypeFontDesc>* fonts_in_family) {
-  base::mac::ScopedNSAutoreleasePool autorelease_pool;
-  NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
-  NSString* ns_family = base::SysUTF8ToNSString(family);
-  NSArray* ns_fonts_in_family =
-      [fontManager availableMembersOfFontFamily:ns_family];
+  @autoreleasepool {
+    NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
+    NSString* ns_family = base::SysUTF8ToNSString(family);
+    NSArray* ns_fonts_in_family =
+        [fontManager availableMembersOfFontFamily:ns_family];
 
-  for (NSArray* font_info in ns_fonts_in_family) {
-    ppapi::proxy::SerializedTrueTypeFontDesc desc;
-    desc.family = family;
-    NSInteger font_weight = [[font_info objectAtIndex:2] intValue];
-    font_weight = std::max(static_cast<NSInteger>(0), font_weight);
-    font_weight = std::min(kPepperFontWeightsLength - 1, font_weight);
-    desc.weight = kPepperFontWeights[font_weight];
+    for (NSArray* font_info in ns_fonts_in_family) {
+      ppapi::proxy::SerializedTrueTypeFontDesc desc;
+      desc.family = family;
+      NSInteger font_weight = [[font_info objectAtIndex:2] intValue];
+      font_weight = std::max(static_cast<NSInteger>(0), font_weight);
+      font_weight = std::min(kPepperFontWeightsLength - 1, font_weight);
+      desc.weight = kPepperFontWeights[font_weight];
 
-    NSFontTraitMask font_traits =
-        [[font_info objectAtIndex:3] unsignedIntValue];
-    desc.style = PP_TRUETYPEFONTSTYLE_NORMAL;
-    if (font_traits & NSItalicFontMask)
-      desc.style = PP_TRUETYPEFONTSTYLE_ITALIC;
+      NSFontTraitMask font_traits =
+          [[font_info objectAtIndex:3] unsignedIntValue];
+      desc.style = PP_TRUETYPEFONTSTYLE_NORMAL;
+      if (font_traits & NSItalicFontMask)
+        desc.style = PP_TRUETYPEFONTSTYLE_ITALIC;
 
-    desc.width = PP_TRUETYPEFONTWIDTH_NORMAL;
-    if (font_traits & NSCondensedFontMask)
-      desc.width = PP_TRUETYPEFONTWIDTH_CONDENSED;
-    else if (font_traits & NSExpandedFontMask)
-      desc.width = PP_TRUETYPEFONTWIDTH_EXPANDED;
+      desc.width = PP_TRUETYPEFONTWIDTH_NORMAL;
+      if (font_traits & NSCondensedFontMask)
+        desc.width = PP_TRUETYPEFONTWIDTH_CONDENSED;
+      else if (font_traits & NSExpandedFontMask)
+        desc.width = PP_TRUETYPEFONTWIDTH_EXPANDED;
 
-    // Mac doesn't support requesting non-default character sets.
-    desc.charset = PP_TRUETYPEFONTCHARSET_DEFAULT;
+      // Mac doesn't support requesting non-default character sets.
+      desc.charset = PP_TRUETYPEFONTCHARSET_DEFAULT;
 
-    fonts_in_family->push_back(desc);
+      fonts_in_family->push_back(desc);
+    }
   }
 }
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc b/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc
index 8df45c8f681..0f465dfe2ef 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc
+++ b/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.cc
@@ -92,12 +92,7 @@ PepperUDPSocketMessageFilter::PepperUDPSocketMessageFilter(
       render_process_id_(0),
       render_frame_id_(0),
       is_potentially_secure_plugin_context_(
-          host->IsPotentiallySecurePluginContext(instance)),
-      binding_(this)
-#if defined(OS_CHROMEOS)
-
-#endif  //  defined(OS_CHROMEOS)
-{
+          host->IsPotentiallySecurePluginContext(instance)) {
   ++g_num_udp_filter_instances;
   DCHECK(host);
 
@@ -110,7 +105,7 @@ PepperUDPSocketMessageFilter::PepperUDPSocketMessageFilter(
 PepperUDPSocketMessageFilter::~PepperUDPSocketMessageFilter() {
   DCHECK(closed_);
   DCHECK(!socket_);
-  DCHECK(!binding_);
+  DCHECK(!receiver_.is_bound());
   --g_num_udp_filter_instances;
 }
 
@@ -384,12 +379,12 @@ int32_t PepperUDPSocketMessageFilter::OnMsgBind(
   if (!render_frame_host)
     return PP_ERROR_NOACCESS;
 
-  network::mojom::UDPSocketListenerPtr udp_socket_listener;
+  mojo::PendingRemote<network::mojom::UDPSocketListener> udp_socket_listener;
   // Avoid binding the listener until the socket has been successfully Bound (in
   // a socket sense), to avoid providing read data to the caller until it has
   // been told that the socket was bound.
-  network::mojom::UDPSocketListenerRequest listener_request =
-      mojo::MakeRequest(&udp_socket_listener);
+  mojo::PendingReceiver<network::mojom::UDPSocketListener> listener_receiver =
+      udp_socket_listener.InitWithNewPipeAndPassReceiver();
 
   SiteInstance* site_instance = render_frame_host->GetSiteInstance();
   network::mojom::NetworkContext* network_context =
@@ -398,17 +393,17 @@ int32_t PepperUDPSocketMessageFilter::OnMsgBind(
           ->GetNetworkContext();
   if (g_create_udp_socket_callback_for_testing) {
     g_create_udp_socket_callback_for_testing->Run(
-        network_context, mojo::MakeRequest(&socket_),
+        network_context, socket_.BindNewPipeAndPassReceiver(),
         std::move(udp_socket_listener));
   } else {
-    network_context->CreateUDPSocket(mojo::MakeRequest(&socket_),
+    network_context->CreateUDPSocket(socket_.BindNewPipeAndPassReceiver(),
                                      std::move(udp_socket_listener));
   }
 
   ppapi::host::ReplyMessageContext reply_context =
       context->MakeReplyMessageContext();
   // Watch the socket for errors during the the Bind call.
-  socket_.set_connection_error_handler(
+  socket_.set_disconnect_handler(
       base::BindOnce(&PepperUDPSocketMessageFilter::SendBindError,
                      base::Unretained(this), reply_context, PP_ERROR_FAILED));
 
@@ -416,7 +411,7 @@ int32_t PepperUDPSocketMessageFilter::OnMsgBind(
   socket_->Bind(end_point, std::move(udp_socket_options),
                 base::BindOnce(&PepperUDPSocketMessageFilter::DoBindCallback,
                                base::Unretained(this),
-                               std::move(listener_request), reply_context));
+                               std::move(listener_receiver), reply_context));
 
   return PP_OK_COMPLETIONPENDING;
 }
@@ -428,9 +423,9 @@ int32_t PepperUDPSocketMessageFilter::OnMsgSendTo(
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(context);
 
-  // Check |binding_| instead of |socket_| because |binding_| is only set
+  // Check |receiver_| instead of |socket_| because |receiver_| is only set
   // after the Bind() call completes.
-  if (closed_ || !binding_)
+  if (closed_ || !receiver_.is_bound())
     return PP_ERROR_FAILED;
 
   SocketPermissionRequest request =
@@ -492,7 +487,7 @@ int32_t PepperUDPSocketMessageFilter::OnMsgRecvSlotAvailable(
       UDPSocketResourceConstants::kPluginReceiveBufferSlots) {
     // If the pipe was closed, but the consumer has not yet closed the UDP
     // socket, keep the read buffer filled with errors.
-    if (!binding_) {
+    if (!receiver_.is_bound()) {
       PepperUDPSocketMessageFilter::SendRecvFromError(PP_ERROR_FAILED);
       return PP_OK;
     }
@@ -555,7 +550,7 @@ int32_t PepperUDPSocketMessageFilter::OnMsgLeaveGroup(
 }
 
 void PepperUDPSocketMessageFilter::DoBindCallback(
-    network::mojom::UDPSocketListenerRequest listener_request,
+    mojo::PendingReceiver<network::mojom::UDPSocketListener> listener_receiver,
     const ppapi::host::ReplyMessageContext& context,
     int result,
     const base::Optional<net::IPEndPoint>& local_addr_out) {
@@ -579,15 +574,15 @@ void PepperUDPSocketMessageFilter::DoBindCallback(
       *local_addr_out,
       base::BindRepeating(&PepperUDPSocketMessageFilter::OnFirewallHoleOpened,
                           firewall_hole_weak_ptr_factory_.GetWeakPtr(),
-                          base::Passed(std::move(listener_request)), context,
+                          base::Passed(std::move(listener_receiver)), context,
                           net_address));
 #else   // !defined(OS_CHROMEOS)
-  OnBindComplete(std::move(listener_request), context, net_address);
+  OnBindComplete(std::move(listener_receiver), context, net_address);
 #endif  // !defined(OS_CHROMEOS)
 }
 
 void PepperUDPSocketMessageFilter::OnBindComplete(
-    network::mojom::UDPSocketListenerRequest listener_request,
+    mojo::PendingReceiver<network::mojom::UDPSocketListener> listener_receiver,
     const ppapi::host::ReplyMessageContext& context,
     const PP_NetAddress_Private& net_address) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -595,17 +590,17 @@ void PepperUDPSocketMessageFilter::OnBindComplete(
 
   SendBindReply(context, PP_OK, net_address);
 
-  binding_.Bind(std::move(listener_request));
-  binding_.set_connection_error_handler(base::BindOnce(
+  receiver_.Bind(std::move(listener_receiver));
+  receiver_.set_disconnect_handler(base::BindOnce(
       &PepperUDPSocketMessageFilter::PipeClosed, base::Unretained(this)));
-  socket_.set_connection_error_handler(base::BindOnce(
+  socket_.set_disconnect_handler(base::BindOnce(
       &PepperUDPSocketMessageFilter::PipeClosed, base::Unretained(this)));
   socket_->ReceiveMore(UDPSocketResourceConstants::kPluginReceiveBufferSlots);
 }
 
 #if defined(OS_CHROMEOS)
 void PepperUDPSocketMessageFilter::OnFirewallHoleOpened(
-    network::mojom::UDPSocketListenerRequest listener_request,
+    mojo::PendingReceiver<network::mojom::UDPSocketListener> listener_receiver,
     const ppapi::host::ReplyMessageContext& context,
     const PP_NetAddress_Private& net_address,
     std::unique_ptr<chromeos::FirewallHole> hole) {
@@ -614,7 +609,7 @@ void PepperUDPSocketMessageFilter::OnFirewallHoleOpened(
   LOG_IF(WARNING, !hole.get()) << "Firewall hole could not be opened.";
   firewall_hole_.reset(hole.release());
 
-  OnBindComplete(std::move(listener_request), context, net_address);
+  OnBindComplete(std::move(listener_receiver), context, net_address);
 }
 #endif  // defined(OS_CHROMEOS)
 
@@ -636,7 +631,7 @@ void PepperUDPSocketMessageFilter::StartPendingSend() {
 void PepperUDPSocketMessageFilter::Close() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   socket_.reset();
-  binding_.Close();
+  receiver_.reset();
   closed_ = true;
 }
 
diff --git a/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.h b/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.h
index 13ce9f7c23f..ca0eb1e248d 100644
--- a/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.h
+++ b/chromium/content/browser/renderer_host/pepper/pepper_udp_socket_message_filter.h
@@ -21,7 +21,10 @@
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/common/process_type.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/ip_address.h"
 #include "net/base/ip_endpoint.h"
 #include "ppapi/c/pp_instance.h"
@@ -66,8 +69,8 @@ class CONTENT_EXPORT PepperUDPSocketMessageFilter
 
   using CreateUDPSocketCallback = base::RepeatingCallback<void(
       network::mojom::NetworkContext* network_context,
-      network::mojom::UDPSocketRequest socket_request,
-      network::mojom::UDPSocketListenerPtr socket_listener)>;
+      mojo::PendingReceiver<network::mojom::UDPSocket> socket_receiver,
+      mojo::PendingRemote<network::mojom::UDPSocketListener> socket_listener)>;
 
   static void SetCreateUDPSocketCallbackForTesting(
       const CreateUDPSocketCallback* create_udp_socket_callback);
@@ -125,16 +128,19 @@ class CONTENT_EXPORT PepperUDPSocketMessageFilter
   int32_t OnMsgLeaveGroup(const ppapi::host::HostMessageContext* context,
                           const PP_NetAddress_Private& addr);
 
-  void DoBindCallback(network::mojom::UDPSocketListenerRequest listener_request,
+  void DoBindCallback(mojo::PendingReceiver<network::mojom::UDPSocketListener>
+                          listener_receiver,
                       const ppapi::host::ReplyMessageContext& context,
                       int result,
                       const base::Optional<net::IPEndPoint>& local_addr_out);
-  void OnBindComplete(network::mojom::UDPSocketListenerRequest listener_request,
+  void OnBindComplete(mojo::PendingReceiver<network::mojom::UDPSocketListener>
+                          listener_receiver,
                       const ppapi::host::ReplyMessageContext& context,
                       const PP_NetAddress_Private& net_address);
 #if defined(OS_CHROMEOS)
   void OnFirewallHoleOpened(
-      network::mojom::UDPSocketListenerRequest listener_request,
+      mojo::PendingReceiver<network::mojom::UDPSocketListener>
+          listener_receiver,
       const ppapi::host::ReplyMessageContext& context,
       const PP_NetAddress_Private& net_address,
       std::unique_ptr<chromeos::FirewallHole> hole);
@@ -209,13 +215,13 @@ class CONTENT_EXPORT PepperUDPSocketMessageFilter
   // Bound (in a Mojo sense) when binding (in a network sense) starts. Closed in
   // Close() and on Mojo pipe errors. Must only be accessed (and destroyed) on
   // UI thread.
-  network::mojom::UDPSocketPtr socket_;
+  mojo::Remote<network::mojom::UDPSocket> socket_;
 
   // Bound (in a Mojo sense) when binding (in a network sense) completes.
   // Binding late avoids receiving data when still setting up the socket. Closed
   // in Close() and on Mojo pipe errors. Must only be accessed (and destroyed)
   // on UI thread.
-  mojo::Binding<network::mojom::UDPSocketListener> binding_;
+  mojo::Receiver<network::mojom::UDPSocketListener> receiver_{this};
 
 #if defined(OS_CHROMEOS)
   std::unique_ptr<chromeos::FirewallHole,
diff --git a/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.cc b/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.cc
index 0b18a0297f3..498d3330486 100644
--- a/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.cc
+++ b/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.cc
@@ -13,8 +13,7 @@ RenderFrameMetadataProviderImpl::RenderFrameMetadataProviderImpl(
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
     FrameTokenMessageQueue* frame_token_message_queue)
     : task_runner_(task_runner),
-      frame_token_message_queue_(frame_token_message_queue),
-      render_frame_metadata_observer_client_binding_(this) {}
+      frame_token_message_queue_(frame_token_message_queue) {}
 
 RenderFrameMetadataProviderImpl::~RenderFrameMetadataProviderImpl() = default;
 
@@ -27,12 +26,14 @@ void RenderFrameMetadataProviderImpl::RemoveObserver(Observer* observer) {
 }
 
 void RenderFrameMetadataProviderImpl::Bind(
-    mojom::RenderFrameMetadataObserverClientRequest client_request,
-    mojom::RenderFrameMetadataObserverPtr observer) {
-  render_frame_metadata_observer_ptr_ = std::move(observer);
-  render_frame_metadata_observer_client_binding_.Close();
-  render_frame_metadata_observer_client_binding_.Bind(std::move(client_request),
-                                                      task_runner_);
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+        client_receiver,
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserver> observer) {
+  render_frame_metadata_observer_remote_.reset();
+  render_frame_metadata_observer_remote_.Bind(std::move(observer));
+  render_frame_metadata_observer_client_receiver_.reset();
+  render_frame_metadata_observer_client_receiver_.Bind(
+      std::move(client_receiver), task_runner_);
 
 #if defined(OS_ANDROID)
   if (pending_report_all_root_scrolls_for_accessibility_.has_value()) {
@@ -51,24 +52,24 @@ void RenderFrameMetadataProviderImpl::Bind(
 #if defined(OS_ANDROID)
 void RenderFrameMetadataProviderImpl::ReportAllRootScrollsForAccessibility(
     bool enabled) {
-  if (!render_frame_metadata_observer_ptr_) {
+  if (!render_frame_metadata_observer_remote_) {
     pending_report_all_root_scrolls_for_accessibility_ = enabled;
     return;
   }
 
-  render_frame_metadata_observer_ptr_->ReportAllRootScrollsForAccessibility(
+  render_frame_metadata_observer_remote_->ReportAllRootScrollsForAccessibility(
       enabled);
 }
 #endif
 
 void RenderFrameMetadataProviderImpl::ReportAllFrameSubmissionsForTesting(
     bool enabled) {
-  if (!render_frame_metadata_observer_ptr_) {
+  if (!render_frame_metadata_observer_remote_) {
     pending_report_all_frame_submission_for_testing_ = enabled;
     return;
   }
 
-  render_frame_metadata_observer_ptr_->ReportAllFrameSubmissionsForTesting(
+  render_frame_metadata_observer_remote_->ReportAllFrameSubmissionsForTesting(
       enabled);
 }
 
diff --git a/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.h b/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.h
index f7d0ca9d357..9c0f9c8e716 100644
--- a/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.h
+++ b/chromium/content/browser/renderer_host/render_frame_metadata_provider_impl.h
@@ -11,7 +11,10 @@
 #include "build/build_config.h"
 #include "content/common/render_frame_metadata.mojom.h"
 #include "content/public/browser/render_frame_metadata_provider.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace content {
 class FrameTokenMessageQueue;
@@ -36,8 +39,9 @@ class CONTENT_EXPORT RenderFrameMetadataProviderImpl
   void AddObserver(Observer* observer) override;
   void RemoveObserver(Observer* observer) override;
 
-  void Bind(mojom::RenderFrameMetadataObserverClientRequest client_request,
-            mojom::RenderFrameMetadataObserverPtr observer);
+  void Bind(mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+                client_receiver,
+            mojo::PendingRemote<mojom::RenderFrameMetadataObserver> observer);
 
   const cc::RenderFrameMetadata& LastRenderFrameMetadata() override;
 
@@ -84,9 +88,10 @@ class CONTENT_EXPORT RenderFrameMetadataProviderImpl
   // Not owned.
   FrameTokenMessageQueue* const frame_token_message_queue_;
 
-  mojo::Binding<mojom::RenderFrameMetadataObserverClient>
-      render_frame_metadata_observer_client_binding_;
-  mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer_ptr_;
+  mojo::Receiver<mojom::RenderFrameMetadataObserverClient>
+      render_frame_metadata_observer_client_receiver_{this};
+  mojo::Remote<mojom::RenderFrameMetadataObserver>
+      render_frame_metadata_observer_remote_;
 
 #if defined(OS_ANDROID)
   base::Optional<bool> pending_report_all_root_scrolls_for_accessibility_;
diff --git a/chromium/content/browser/renderer_host/render_message_filter.cc b/chromium/content/browser/renderer_host/render_message_filter.cc
index 1ec165d53a8..cdcdaa2807c 100644
--- a/chromium/content/browser/renderer_host/render_message_filter.cc
+++ b/chromium/content/browser/renderer_host/render_message_filter.cc
@@ -129,9 +129,10 @@ void RenderMessageFilter::GenerateRoutingID(
   std::move(callback).Run(render_widget_helper_->GetNextRoutingID());
 }
 
-void RenderMessageFilter::CreateNewWidget(int32_t opener_id,
-                                          mojom::WidgetPtr widget,
-                                          CreateNewWidgetCallback callback) {
+void RenderMessageFilter::CreateNewWidget(
+    int32_t opener_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    CreateNewWidgetCallback callback) {
   int route_id = MSG_ROUTING_NONE;
   render_widget_helper_->CreateNewWidget(opener_id, std::move(widget),
                                          &route_id);
@@ -140,7 +141,7 @@ void RenderMessageFilter::CreateNewWidget(int32_t opener_id,
 
 void RenderMessageFilter::CreateFullscreenWidget(
     int opener_id,
-    mojom::WidgetPtr widget,
+    mojo::PendingRemote<mojom::Widget> widget,
     CreateFullscreenWidgetCallback callback) {
   int route_id = 0;
   render_widget_helper_->CreateNewFullscreenWidget(opener_id, std::move(widget),
diff --git a/chromium/content/browser/renderer_host/render_message_filter.h b/chromium/content/browser/renderer_host/render_message_filter.h
index fec3f047d84..db421af7e1d 100644
--- a/chromium/content/browser/renderer_host/render_message_filter.h
+++ b/chromium/content/browser/renderer_host/render_message_filter.h
@@ -25,6 +25,7 @@
 #include "content/public/common/widget_type.h"
 #include "gpu/config/gpu_info.h"
 #include "ipc/message_filter.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/gpu_memory_buffer.h"
@@ -80,10 +81,10 @@ class CONTENT_EXPORT RenderMessageFilter
   // mojom::RenderMessageFilter:
   void GenerateRoutingID(GenerateRoutingIDCallback routing_id) override;
   void CreateNewWidget(int32_t opener_id,
-                       mojom::WidgetPtr widget,
+                       mojo::PendingRemote<mojom::Widget> widget,
                        CreateNewWidgetCallback callback) override;
   void CreateFullscreenWidget(int opener_id,
-                              mojom::WidgetPtr widget,
+                              mojo::PendingRemote<mojom::Widget> widget,
                               CreateFullscreenWidgetCallback callback) override;
   void HasGpuProcess(HasGpuProcessCallback callback) override;
 #if defined(OS_LINUX)
diff --git a/chromium/content/browser/renderer_host/render_process_host_browsertest.cc b/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
index a3b61c583f3..bf3cfde2e62 100644
--- a/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_browsertest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
@@ -38,6 +39,7 @@
 #include "media/base/media_switches.h"
 #include "media/base/test_data_util.h"
 #include "media/mojo/buildflags.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/http_request.h"
@@ -50,6 +52,93 @@
 namespace content {
 namespace {
 
+namespace {
+
+// Similar to net::test_server::DelayedHttpResponse, but the delay is resolved
+// through Resolver.
+class DelayedHttpResponseWithResolver final
+    : public net::test_server::BasicHttpResponse {
+ public:
+  struct ResponseWithCallbacks final {
+    net::test_server::SendBytesCallback send_callback;
+    net::test_server::SendCompleteCallback done_callback;
+    std::string response_string;
+  };
+
+  class Resolver final : public base::RefCountedThreadSafe<Resolver> {
+   public:
+    void Resolve() {
+      base::AutoLock auto_lock(lock_);
+      DCHECK(!resolved_);
+      resolved_ = true;
+
+      if (!task_runner_) {
+        return;
+      }
+
+      task_runner_->PostTask(
+          FROM_HERE,
+          base::BindOnce(&Resolver::ResolveInServerTaskRunner, this));
+    }
+
+    void Add(const ResponseWithCallbacks& response) {
+      base::AutoLock auto_lock(lock_);
+
+      if (resolved_) {
+        response.send_callback.Run(response.response_string,
+                                   response.done_callback);
+        return;
+      }
+
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner =
+          base::ThreadTaskRunnerHandle::Get();
+      if (task_runner_) {
+        DCHECK_EQ(task_runner_, task_runner);
+      } else {
+        task_runner_ = std::move(task_runner);
+      }
+
+      responses_with_callbacks_.push_back(response);
+    }
+
+   private:
+    void ResolveInServerTaskRunner() {
+      auto responses_with_callbacks = std::move(responses_with_callbacks_);
+      for (const auto& response_with_callbacks : responses_with_callbacks) {
+        response_with_callbacks.send_callback.Run(
+            response_with_callbacks.response_string,
+            response_with_callbacks.done_callback);
+      }
+    }
+
+    friend class base::RefCountedThreadSafe<Resolver>;
+    ~Resolver() = default;
+
+    base::Lock lock_;
+
+    std::vector<ResponseWithCallbacks> responses_with_callbacks_;
+    bool resolved_ GUARDED_BY(lock_) = false;
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner_ GUARDED_BY(lock_);
+  };
+
+  explicit DelayedHttpResponseWithResolver(scoped_refptr<Resolver> resolver)
+      : resolver_(std::move(resolver)) {}
+
+  DelayedHttpResponseWithResolver(const DelayedHttpResponseWithResolver&) =
+      delete;
+  DelayedHttpResponseWithResolver& operator=(
+      const DelayedHttpResponseWithResolver&) = delete;
+
+  void SendResponse(
+      const net::test_server::SendBytesCallback& send,
+      const net::test_server::SendCompleteCallback& done) override {
+    resolver_->Add({send, done, ToResponseString()});
+  }
+
+ private:
+  const scoped_refptr<Resolver> resolver_;
+};
+
 std::unique_ptr<net::test_server::HttpResponse> HandleBeacon(
     const net::test_server::HttpRequest& request) {
   if (request.relative_url != "/beacon")
@@ -58,12 +147,26 @@ std::unique_ptr<net::test_server::HttpResponse> HandleBeacon(
 }
 
 std::unique_ptr<net::test_server::HttpResponse> HandleHungBeacon(
+    const base::RepeatingClosure& on_called,
     const net::test_server::HttpRequest& request) {
   if (request.relative_url != "/beacon")
     return nullptr;
+  if (on_called) {
+    on_called.Run();
+  }
   return std::make_unique<net::test_server::HungResponse>();
 }
 
+std::unique_ptr<net::test_server::HttpResponse> HandleHungBeaconWithResolver(
+    scoped_refptr<DelayedHttpResponseWithResolver::Resolver> resolver,
+    const net::test_server::HttpRequest& request) {
+  if (request.relative_url != "/beacon")
+    return nullptr;
+  return std::make_unique<DelayedHttpResponseWithResolver>(std::move(resolver));
+}
+
+}  // namespace
+
 class RenderProcessHostTest : public ContentBrowserTest,
                               public RenderProcessHostObserver {
  public:
@@ -235,9 +338,9 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, SpareRenderProcessHostKilled) {
 
   RenderProcessHost* spare_renderer =
       RenderProcessHostImpl::GetSpareRenderProcessHostForTesting();
-  mojom::TestServicePtr service;
+  mojo::Remote<mojom::TestService> service;
   ASSERT_NE(nullptr, spare_renderer);
-  BindInterface(spare_renderer, &service);
+  BindInterface(spare_renderer, service.BindNewPipeAndPassReceiver());
 
   base::RunLoop run_loop;
   set_process_exit_callback(run_loop.QuitClosure());
@@ -673,8 +776,8 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, KillProcessOnBadMojoMessage) {
   process_exits_ = 0;
   rph->AddObserver(this);
 
-  mojom::TestServicePtr service;
-  BindInterface(rph, &service);
+  mojo::Remote<mojom::TestService> service;
+  BindInterface(rph, service.BindNewPipeAndPassReceiver());
 
   base::RunLoop run_loop;
   set_process_exit_callback(run_loop.QuitClosure());
@@ -752,8 +855,8 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, KillProcessZerosAudioStreams) {
   process_exits_ = 0;
   rph->AddObserver(this);
 
-  mojom::TestServicePtr service;
-  BindInterface(rph, &service);
+  mojo::Remote<mojom::TestService> service;
+  BindInterface(rph, service.BindNewPipeAndPassReceiver());
 
   {
     // Force a bad message event to occur which will terminate the renderer.
@@ -855,8 +958,8 @@ IN_PROC_BROWSER_TEST_F(CaptureStreamRenderProcessHostTest,
   process_exits_ = 0;
   rph->AddObserver(this);
 
-  mojom::TestServicePtr service;
-  BindInterface(rph, &service);
+  mojo::Remote<mojom::TestService> service;
+  BindInterface(rph, service.BindNewPipeAndPassReceiver());
 
   {
     // Force a bad message event to occur which will terminate the renderer.
@@ -921,8 +1024,8 @@ IN_PROC_BROWSER_TEST_F(CaptureStreamRenderProcessHostTest,
   process_exits_ = 0;
   rph->AddObserver(this);
 
-  mojom::TestServicePtr service;
-  BindInterface(rph, &service);
+  mojo::Remote<mojom::TestService> service;
+  BindInterface(rph, service.BindNewPipeAndPassReceiver());
 
   {
     // Force a bad message event to occur which will terminate the renderer.
@@ -986,6 +1089,35 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, KeepAliveRendererProcess) {
     rph->RemoveObserver(this);
 }
 
+IN_PROC_BROWSER_TEST_F(RenderProcessHostTest,
+                       KeepAliveRendererProcessWithServiceWorker) {
+  base::RunLoop run_loop;
+  embedded_test_server()->RegisterRequestHandler(
+      base::BindRepeating(HandleHungBeacon, run_loop.QuitClosure()));
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL("/workers/service_worker_setup.html")));
+  EXPECT_EQ("ok", EvalJs(shell(), "setup();"));
+
+  RenderProcessHostImpl* rph = static_cast<RenderProcessHostImpl*>(
+      shell()->web_contents()->GetMainFrame()->GetProcess());
+  // 1 for the service worker.
+  EXPECT_EQ(rph->keep_alive_ref_count(), 1u);
+
+  // We use /workers/send-beacon.html, not send-beacon.html, due to the
+  // service worker scope rule.
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/workers/send-beacon.html")));
+
+  run_loop.Run();
+  // We are still using the same process.
+  ASSERT_EQ(shell()->web_contents()->GetMainFrame()->GetProcess(), rph);
+  // 1 for the service worker, 1 for the keepalive fetch.
+  EXPECT_EQ(rph->keep_alive_ref_count(), 2u);
+}
+
 // Test is flaky on Android builders: https://crbug.com/875179
 #if defined(OS_ANDROID)
 #define MAYBE_KeepAliveRendererProcess_Hung \
@@ -996,7 +1128,7 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, KeepAliveRendererProcess) {
 IN_PROC_BROWSER_TEST_F(RenderProcessHostTest,
                        MAYBE_KeepAliveRendererProcess_Hung) {
   embedded_test_server()->RegisterRequestHandler(
-      base::BindRepeating(HandleHungBeacon));
+      base::BindRepeating(HandleHungBeacon, base::RepeatingClosure()));
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(
@@ -1033,7 +1165,7 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest,
 IN_PROC_BROWSER_TEST_F(RenderProcessHostTest,
                        MAYBE_FetchKeepAliveRendererProcess_Hung) {
   embedded_test_server()->RegisterRequestHandler(
-      base::BindRepeating(HandleHungBeacon));
+      base::BindRepeating(HandleHungBeacon, base::RepeatingClosure()));
   ASSERT_TRUE(embedded_test_server()->Start());
 
   EXPECT_TRUE(NavigateToURL(
@@ -1059,6 +1191,48 @@ IN_PROC_BROWSER_TEST_F(RenderProcessHostTest,
     rph->RemoveObserver(this);
 }
 
+IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, ManyKeepaliveRequests) {
+  auto resolver =
+      base::MakeRefCounted<DelayedHttpResponseWithResolver::Resolver>();
+  embedded_test_server()->RegisterRequestHandler(
+      base::BindRepeating(HandleHungBeaconWithResolver, resolver));
+  const base::string16 title = base::ASCIIToUTF16("Resolved");
+  const base::string16 waiting = base::ASCIIToUTF16("Waiting");
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL("/fetch-keepalive.html?requests=256")));
+
+  {
+    // Wait for the page to make all the keepalive requests.
+    TitleWatcher watcher(shell()->web_contents(), waiting);
+    EXPECT_EQ(waiting, watcher.WaitAndGetTitle());
+  }
+
+  resolver->Resolve();
+
+  {
+    TitleWatcher watcher(shell()->web_contents(), title);
+    EXPECT_EQ(title, watcher.WaitAndGetTitle());
+  }
+}
+
+IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, TooManyKeepaliveRequests) {
+  embedded_test_server()->RegisterRequestHandler(
+      base::BindRepeating(HandleHungBeacon, base::RepeatingClosure()));
+  ASSERT_TRUE(embedded_test_server()->Start());
+  const base::string16 title = base::ASCIIToUTF16("Rejected");
+
+  TitleWatcher watcher(shell()->web_contents(), title);
+
+  EXPECT_TRUE(NavigateToURL(
+      shell(),
+      embedded_test_server()->GetURL("/fetch-keepalive.html?requests=257")));
+
+  EXPECT_EQ(title, watcher.WaitAndGetTitle());
+}
+
 // This test verifies properties of RenderProcessHostImpl *before* Init method
 // is called.
 IN_PROC_BROWSER_TEST_F(RenderProcessHostTest, ConstructedButNotInitializedYet) {
diff --git a/chromium/content/browser/renderer_host/render_process_host_creation_observer.cc b/chromium/content/browser/renderer_host/render_process_host_creation_observer.cc
new file mode 100644
index 00000000000..bbc34c6a9e0
--- /dev/null
+++ b/chromium/content/browser/renderer_host/render_process_host_creation_observer.cc
@@ -0,0 +1,19 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/render_process_host_creation_observer.h"
+
+#include "content/browser/renderer_host/render_process_host_impl.h"
+
+namespace content {
+
+RenderProcessHostCreationObserver::RenderProcessHostCreationObserver() {
+  RenderProcessHostImpl::RegisterCreationObserver(this);
+}
+
+RenderProcessHostCreationObserver::~RenderProcessHostCreationObserver() {
+  RenderProcessHostImpl::UnregisterCreationObserver(this);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_process_host_impl.cc b/chromium/content/browser/renderer_host/render_process_host_impl.cc
index 8379cdfcf92..323e6ebdf77 100644
--- a/chromium/content/browser/renderer_host/render_process_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_impl.cc
@@ -27,7 +27,6 @@
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file.h"
-#include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/memory/memory_pressure_monitor.h"
@@ -68,6 +67,8 @@
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "cc/base/switches.h"
+#include "components/discardable_memory/public/mojom/discardable_shared_memory_manager.mojom.h"
+#include "components/discardable_memory/service/discardable_shared_memory_manager.h"
 #include "components/metrics/single_sample_metrics.h"
 #include "components/tracing/common/tracing_switches.h"
 #include "components/viz/common/switches.h"
@@ -101,6 +102,7 @@
 #include "content/browser/histogram_controller.h"
 #include "content/browser/indexed_db/indexed_db_context_impl.h"
 #include "content/browser/indexed_db/indexed_db_dispatcher_host.h"
+#include "content/browser/locks/lock_manager.h"
 #include "content/browser/media/capture/audio_mirroring_manager.h"
 #include "content/browser/media/media_internals.h"
 #include "content/browser/media/midi_host.h"
@@ -154,16 +156,19 @@
 #include "content/public/browser/network_service_instance.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
+#include "content/public/browser/render_process_host_creation_observer.h"
 #include "content/public/browser/render_process_host_factory.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/resource_context.h"
+#include "content/public/browser/resource_coordinator_service.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/system_connector.h"
 #include "content/public/browser/webrtc_log.h"
 #include "content/public/common/bind_interface_helpers.h"
 #include "content/public/common/child_process_host.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
@@ -187,14 +192,15 @@
 #include "media/audio/audio_manager.h"
 #include "media/base/media_switches.h"
 #include "media/media_buildflags.h"
+#include "media/mojo/services/video_decode_perf_history.h"
 #include "media/webrtc/webrtc_switches.h"
 #include "mojo/public/cpp/bindings/receiver.h"
-#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/device/public/mojom/battery_monitor.mojom.h"
 #include "services/device/public/mojom/constants.mojom.h"
+#include "services/device/public/mojom/power_monitor.mojom.h"
 #include "services/device/public/mojom/screen_orientation.mojom.h"
 #include "services/device/public/mojom/time_zone_monitor.mojom.h"
 #include "services/metrics/public/mojom/constants.mojom.h"
@@ -202,6 +208,7 @@
 #include "services/network/cross_origin_read_blocking.h"
 #include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/mojom/network_service.mojom.h"
+#include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
 #include "services/service_manager/embedder/switches.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/connector.h"
@@ -220,6 +227,7 @@
 #include "ui/display/display_switches.h"
 #include "ui/gl/gl_switches.h"
 #include "ui/native_theme/native_theme_features.h"
+#include "url/origin.h"
 #include "url/url_constants.h"
 
 #if defined(OS_ANDROID)
@@ -240,12 +248,16 @@
 
 #if defined(OS_MACOSX)
 #include "content/browser/child_process_task_port_provider_mac.h"
+#include "content/browser/sandbox_support_mac_impl.h"
+#include "content/common/sandbox_support_mac.mojom.h"
 #endif
 
 #if defined(OS_WIN)
 #include "base/win/scoped_com_initializer.h"
 #include "base/win/windows_version.h"
 #include "content/browser/renderer_host/dwrite_font_proxy_impl_win.h"
+#include "content/public/common/font_cache_dispatcher_win.h"
+#include "content/public/common/font_cache_win.mojom.h"
 #include "sandbox/win/src/sandbox_policy.h"
 #include "services/service_manager/sandbox/win/sandbox_win.h"
 #include "ui/display/win/dpi.h"
@@ -314,8 +326,17 @@ void RemoveShaderInfo(int32_t id) {
 bool has_done_stun_trials = false;
 
 // the global list of all renderer processes
-base::LazyInstance<base::IDMap<RenderProcessHost*>>::Leaky g_all_hosts =
-    LAZY_INSTANCE_INITIALIZER;
+base::IDMap<RenderProcessHost*>& GetAllHosts() {
+  static base::NoDestructor<base::IDMap<RenderProcessHost*>> s_all_hosts;
+  return *s_all_hosts;
+}
+
+// Returns the global list of RenderProcessHostCreationObserver objects.
+std::vector<RenderProcessHostCreationObserver*>& GetAllCreationObservers() {
+  static base::NoDestructor<std::vector<RenderProcessHostCreationObserver*>>
+      s_all_creation_observers;
+  return *s_all_creation_observers;
+}
 
 // Map of site to process, to ensure we only have one RenderProcessHost per
 // site in process-per-site mode.  Each map is specific to a BrowserContext.
@@ -464,7 +485,7 @@ class SessionStorageHolder : public base::SupportsUserData::Data {
 // This class manages spare RenderProcessHosts.
 //
 // There is a singleton instance of this class which manages a single spare
-// renderer (g_spare_render_process_host_manager, below). This class
+// renderer (SpareRenderProcessHostManager::GetInstance(), below). This class
 // encapsulates the implementation of
 // RenderProcessHost::WarmupSpareRenderProcessHost()
 //
@@ -484,6 +505,11 @@ class SpareRenderProcessHostManager : public RenderProcessHostObserver {
  public:
   SpareRenderProcessHostManager() {}
 
+  static SpareRenderProcessHostManager& GetInstance() {
+    static base::NoDestructor<SpareRenderProcessHostManager> s_instance;
+    return *s_instance;
+  }
+
   void WarmupSpareRenderProcessHost(BrowserContext* browser_context) {
     if (spare_render_process_host_ &&
         spare_render_process_host_->GetBrowserContext() == browser_context) {
@@ -498,7 +524,7 @@ class SpareRenderProcessHostManager : public RenderProcessHostObserver {
     // got too many processes. See also ShouldTryToUseExistingProcessHost in
     // this file.
     if (RenderProcessHost::run_renderer_in_process() ||
-        g_all_hosts.Get().size() >=
+        GetAllHosts().size() >=
             RenderProcessHostImpl::GetMaxRendererProcessCount())
       return;
 
@@ -580,7 +606,7 @@ class SpareRenderProcessHostManager : public RenderProcessHostObserver {
       // If the spare shouldn't be kept around, then discard it as soon as we
       // find that the current spare was mismatched.
       CleanupSpareRenderProcessHost();
-    } else if (g_all_hosts.Get().size() >=
+    } else if (GetAllHosts().size() >=
                RenderProcessHostImpl::GetMaxRendererProcessCount()) {
       // Drop the spare if we are at a process limit and the spare wasn't taken.
       // This helps avoid process reuse.
@@ -651,72 +677,12 @@ class SpareRenderProcessHostManager : public RenderProcessHostObserver {
   }
 
   // This is a bare pointer, because RenderProcessHost manages the lifetime of
-  // all its instances; see g_all_hosts, above.
+  // all its instances; see GetAllHosts().
   RenderProcessHost* spare_render_process_host_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(SpareRenderProcessHostManager);
 };
 
-base::LazyInstance<SpareRenderProcessHostManager>::Leaky
-    g_spare_render_process_host_manager = LAZY_INSTANCE_INITIALIZER;
-
-const void* const kDefaultSubframeProcessHostHolderKey =
-    &kDefaultSubframeProcessHostHolderKey;
-
-class DefaultSubframeProcessHostHolder : public base::SupportsUserData::Data,
-                                         public RenderProcessHostObserver {
- public:
-  explicit DefaultSubframeProcessHostHolder(BrowserContext* browser_context)
-      : browser_context_(browser_context) {}
-  ~DefaultSubframeProcessHostHolder() override {}
-
-  // Gets the correct render process to use for this SiteInstance.
-  RenderProcessHost* GetProcessHost(SiteInstance* site_instance,
-                                    bool is_for_guests_only) {
-    StoragePartitionImpl* default_partition =
-        static_cast<StoragePartitionImpl*>(
-            BrowserContext::GetDefaultStoragePartition(browser_context_));
-    StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
-        BrowserContext::GetStoragePartition(browser_context_, site_instance));
-
-    // Is this the default storage partition? If it isn't, then just give it its
-    // own non-shared process.
-    if (partition != default_partition || is_for_guests_only) {
-      RenderProcessHost* host = RenderProcessHostImpl::CreateRenderProcessHost(
-          browser_context_, partition, site_instance, is_for_guests_only);
-      host->SetIsNeverSuitableForReuse();
-      return host;
-    }
-
-    // If we already have a shared host for the default storage partition, use
-    // it.
-    if (host_)
-      return host_;
-
-    host_ = RenderProcessHostImpl::CreateRenderProcessHost(
-        browser_context_, partition, site_instance,
-        false /* is for guests only */);
-    host_->SetIsNeverSuitableForReuse();
-    host_->AddObserver(this);
-
-    return host_;
-  }
-
-  // Implementation of RenderProcessHostObserver.
-  void RenderProcessHostDestroyed(RenderProcessHost* host) override {
-    DCHECK_EQ(host_, host);
-    host_->RemoveObserver(this);
-    host_ = nullptr;
-  }
-
- private:
-  BrowserContext* browser_context_;
-
-  // The default subframe render process used for the default storage partition
-  // of this BrowserContext.
-  RenderProcessHost* host_ = nullptr;
-};
-
 // Forwards service requests to Service Manager since the renderer cannot launch
 // out-of-process services on is own.
 template <typename Interface>
@@ -1209,6 +1175,13 @@ size_t GetPlatformProcessLimit() {
 }
 #endif  // !defined(OS_ANDROID) && !defined(OS_CHROMEOS)
 
+RenderProcessHost::BindHostReceiverInterceptor&
+GetBindHostReceiverInterceptor() {
+  static base::NoDestructor<RenderProcessHost::BindHostReceiverInterceptor>
+      interceptor;
+  return *interceptor;
+}
+
 }  // namespace
 
 // A RenderProcessHostImpl's IO thread implementation of the
@@ -1239,6 +1212,13 @@ class RenderProcessHostImpl::IOThreadHostImpl
 
   // mojom::ChildProcessHost implementation:
   void BindHostReceiver(mojo::GenericPendingReceiver receiver) override {
+    const auto& interceptor = GetBindHostReceiverInterceptor();
+    if (interceptor) {
+      interceptor.Run(render_process_id_, &receiver);
+      if (!receiver)
+        return;
+    }
+
 #if defined(OS_LINUX)
     if (auto font_receiver = receiver.As<font_service::mojom::FontService>()) {
       ConnectToFontService(std::move(font_receiver));
@@ -1246,6 +1226,28 @@ class RenderProcessHostImpl::IOThreadHostImpl
     }
 #endif
 
+#if defined(OS_WIN)
+    if (auto r = receiver.As<mojom::FontCacheWin>()) {
+      FontCacheDispatcher::Create(std::move(r));
+      return;
+    }
+#endif
+
+#if defined(OS_MACOSX)
+    if (auto r = receiver.As<mojom::SandboxSupportMac>()) {
+      static base::NoDestructor<SandboxSupportMacImpl> sandbox_support;
+      sandbox_support->BindReceiver(std::move(r));
+      return;
+    }
+#endif
+
+    if (auto r = receiver.As<
+                 discardable_memory::mojom::DiscardableSharedMemoryManager>()) {
+      discardable_memory::DiscardableSharedMemoryManager::Get()->Bind(
+          std::move(r));
+      return;
+    }
+
     std::string interface_name = *receiver.interface_name();
     mojo::ScopedMessagePipeHandle pipe = receiver.PassPipe();
     if (binders_->TryBindInterface(interface_name, &pipe))
@@ -1363,8 +1365,10 @@ size_t RenderProcessHost::GetMaxRendererProcessCount() {
 // static
 void RenderProcessHost::SetMaxRendererProcessCount(size_t count) {
   g_max_renderer_count_override = count;
-  if (g_all_hosts.Get().size() > count)
-    g_spare_render_process_host_manager.Get().CleanupSpareRenderProcessHost();
+  if (GetAllHosts().size() > count) {
+    SpareRenderProcessHostManager::GetInstance()
+        .CleanupSpareRenderProcessHost();
+  }
 }
 
 // static
@@ -1475,7 +1479,7 @@ RenderProcessHostImpl::RenderProcessHostImpl(
 
   CHECK(!BrowserMainRunner::ExitedMainMessageLoop());
   RegisterHost(GetID(), this);
-  g_all_hosts.Get().set_check_on_null_data(true);
+  GetAllHosts().set_check_on_null_data(true);
   // Initialize |child_process_activity_time_| to a reasonable value.
   mark_child_process_activity_time();
 
@@ -1515,7 +1519,7 @@ RenderProcessHostImpl::RenderProcessHostImpl(
 void RenderProcessHostImpl::ShutDownInProcessRenderer() {
   DCHECK(g_run_renderer_in_process);
 
-  switch (g_all_hosts.Pointer()->size()) {
+  switch (GetAllHosts().size()) {
     case 0:
       return;
     case 1: {
@@ -1801,6 +1805,7 @@ void RenderProcessHostImpl::InitializeChannelProxy() {
   // surprising behavior.
   remote_route_provider_.reset();
   channel_->GetRemoteAssociatedInterface(&remote_route_provider_);
+  renderer_interface_.reset();
   channel_->GetRemoteAssociatedInterface(&renderer_interface_);
 
   // We start the Channel in a paused state. It will be briefly unpaused again
@@ -1867,19 +1872,20 @@ void RenderProcessHostImpl::BindCacheStorage(
 }
 
 void RenderProcessHostImpl::BindIndexedDB(
-    blink::mojom::IDBFactoryRequest request,
-    const url::Origin& origin) {
+    int render_frame_id,
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   if (origin.opaque()) {
     // Opaque origins aren't valid for IndexedDB access, so we won't bind
-    // |request| to |indexed_db_factory_|.  Return early here which will cause
-    // |request| to be freed.  When |request| is freed, we expect the pipe on
-    // the client will be closed.
+    // |receiver| to |indexed_db_factory_|.  Return early here which
+    // will cause |receiver| to be freed.  When |receiver| is
+    // freed, we expect the pipe on the client will be closed.
     return;
   }
 
-  // Send the binding to IDB sequenced task runner to let IndexedDB handle Mojo
+  // Send the receiver to IDB sequenced task runner to let IndexedDB handle Mojo
   // IPC there.  |indexed_db_factory_| is being invoked on the IDB task runner,
   // and |this| owns |indexed_db_factory_| via a unique_ptr with an IDB task
   // runner deleter, so if |this| is destroyed immediately after this call,
@@ -1887,9 +1893,10 @@ void RenderProcessHostImpl::BindIndexedDB(
   // guaranteeing that the usage of base::Unretained(indexed_db_factory_.get())
   // here is safe.
   indexed_db_factory_->context()->TaskRunner()->PostTask(
-      FROM_HERE, base::BindOnce(&IndexedDBDispatcherHost::AddBinding,
-                                base::Unretained(indexed_db_factory_.get()),
-                                std::move(request), origin));
+      FROM_HERE,
+      base::BindOnce(&IndexedDBDispatcherHost::AddReceiver,
+                     base::Unretained(indexed_db_factory_.get()), GetID(),
+                     render_frame_id, origin, std::move(receiver)));
 }
 
 void RenderProcessHostImpl::ForceCrash() {
@@ -1903,11 +1910,43 @@ void RenderProcessHostImpl::BindFileSystemManager(
   // TODO(https://crbug.com/873661): Pass origin to FileSystemManager.
   base::PostTask(
       FROM_HERE, {BrowserThread::IO},
-      base::BindOnce(&FileSystemManagerImpl::BindRequest,
+      base::BindOnce(&FileSystemManagerImpl::BindReceiver,
                      base::Unretained(file_system_manager_impl_.get()),
                      std::move(receiver)));
 }
 
+void RenderProcessHostImpl::BindVideoDecodePerfHistory(
+    mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  GetBrowserContext()->GetVideoDecodePerfHistory()->BindReceiver(
+      std::move(receiver));
+}
+
+void RenderProcessHostImpl::CreateLockManager(
+    int render_frame_id,
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::LockManager> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  storage_partition_impl_->GetLockManager()->BindReceiver(
+      GetID(), render_frame_id, origin, std::move(receiver));
+}
+
+void RenderProcessHostImpl::CreatePermissionService(
+    const url::Origin& origin,
+    mojo::PendingReceiver<blink::mojom::PermissionService> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  permission_service_context_->CreateServiceForWorker(origin,
+                                                      std::move(receiver));
+}
+
+void RenderProcessHostImpl::CreatePaymentManagerForOrigin(
+    const url::Origin& origin,
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
+  static_cast<StoragePartitionImpl*>(GetStoragePartition())
+      ->GetPaymentAppContext()
+      ->CreatePaymentManagerForOrigin(origin, std::move(receiver));
+}
+
 void RenderProcessHostImpl::CancelProcessShutdownDelayForUnload() {
   if (IsKeepAliveRefCountDisabled())
     return;
@@ -1955,6 +1994,11 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
 
   AddUIThreadInterface(
       registry.get(),
+      base::BindRepeating(&ForwardRequest<device::mojom::PowerMonitor>,
+                          device::mojom::kServiceName));
+
+  AddUIThreadInterface(
+      registry.get(),
       base::BindRepeating(&ForwardRequest<ukm::mojom::UkmRecorderInterface>,
                           metrics::mojom::kMetricsServiceName));
 
@@ -2010,6 +2054,22 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
       base::BindRepeating(&RenderProcessHostImpl::BindWebDatabaseHostImpl,
                           base::Unretained(this)));
 
+  AddUIThreadInterface(
+      registry.get(),
+      base::BindRepeating(
+          [](RenderProcessHostImpl* host,
+             memory_instrumentation::mojom::CoordinatorConnectorRequest
+                 request) {
+            host->coordinator_connector_receiver_.reset();
+            host->coordinator_connector_receiver_.Bind(std::move(request));
+            if (!host->GetProcess().IsValid()) {
+              // We only want to accept messages from this interface once we
+              // have a known PID.
+              host->coordinator_connector_receiver_.Pause();
+            }
+          },
+          base::Unretained(this)));
+
   registry->AddInterface(base::BindRepeating(&MimeRegistryImpl::Create),
                          base::CreateSequencedTaskRunner(
                              {base::ThreadPool(), base::MayBlock(),
@@ -2030,9 +2090,7 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
 
 #if defined(OS_WIN)
   registry->AddInterface(
-      base::BindRepeating([](blink::mojom::DWriteFontProxyRequest request) {
-        DWriteFontProxyImpl::Create(std::move(request), {});
-      }),
+      base::BindRepeating(&DWriteFontProxyImpl::Create),
       base::CreateSequencedTaskRunner({base::ThreadPool(),
                                        base::TaskPriority::USER_BLOCKING,
                                        base::MayBlock()}));
@@ -2061,11 +2119,11 @@ void RenderProcessHostImpl::RegisterMojoInterfaces() {
   // TODO(https://crbug.com/873661): Make PepperFileSystemHost access this with
   // the RenderFrameHost's registry, and remove this registration.
   registry->AddInterface(
-      base::BindRepeating(&FileSystemManagerImpl::BindRequest,
+      base::BindRepeating(&FileSystemManagerImpl::BindReceiver,
                           base::Unretained(file_system_manager_impl_.get())));
 
   registry->AddInterface(base::BindRepeating(
-      &MidiHost::BindRequest, GetID(),
+      &MidiHost::BindReceiver, GetID(),
       base::Unretained(BrowserMainLoop::GetInstance()->midi_service())));
 
   if (gpu_client_) {
@@ -2192,20 +2250,22 @@ void RenderProcessHostImpl::BindRouteProvider(
 
 void RenderProcessHostImpl::GetRoute(
     int32_t routing_id,
-    blink::mojom::AssociatedInterfaceProviderAssociatedRequest request) {
-  DCHECK(request.is_pending());
-  associated_interface_provider_bindings_.AddBinding(
-      this, std::move(request), routing_id);
+    mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>
+        receiver) {
+  DCHECK(receiver.is_valid());
+  associated_interface_provider_receivers_.Add(this, std::move(receiver),
+                                               routing_id);
 }
 
 void RenderProcessHostImpl::GetAssociatedInterface(
     const std::string& name,
-    blink::mojom::AssociatedInterfaceAssociatedRequest request) {
+    mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterface>
+        receiver) {
   int32_t routing_id =
-      associated_interface_provider_bindings_.dispatch_context();
+      associated_interface_provider_receivers_.current_context();
   IPC::Listener* listener = listeners_.Lookup(routing_id);
   if (listener)
-    listener->OnAssociatedInterfaceRequest(name, request.PassHandle());
+    listener->OnAssociatedInterfaceRequest(name, receiver.PassHandle());
 }
 
 void RenderProcessHostImpl::CreateEmbeddedFrameSinkProvider(
@@ -2222,14 +2282,14 @@ void RenderProcessHostImpl::CreateEmbeddedFrameSinkProvider(
 }
 
 void RenderProcessHostImpl::BindFrameSinkProvider(
-    mojom::FrameSinkProviderRequest request) {
-  frame_sink_provider_.Bind(std::move(request));
+    mojo::PendingReceiver<mojom::FrameSinkProvider> receiver) {
+  frame_sink_provider_.Bind(std::move(receiver));
 }
 
 void RenderProcessHostImpl::BindCompositingModeReporter(
-    viz::mojom::CompositingModeReporterRequest request) {
+    mojo::PendingReceiver<viz::mojom::CompositingModeReporter> receiver) {
   BrowserMainLoop::GetInstance()->GetCompositingModeReporter(
-      std::move(request));
+      std::move(receiver));
 }
 
 void RenderProcessHostImpl::CreateStoragePartitionService(
@@ -2271,9 +2331,26 @@ void RenderProcessHostImpl::BindWebDatabaseHostImpl(
                      base::WrapRefCounted(db_tracker), std::move(receiver)));
 }
 
+void RenderProcessHostImpl::RegisterCoordinatorClient(
+    mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator> receiver,
+    mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
+        client_process) {
+  if (!GetProcess().IsValid()) {
+    // If the process dies before we get this message. we have no valid PID and
+    // there's nothing to register.
+    return;
+  }
+
+  GetMemoryInstrumentationCoordinatorController()->RegisterClientProcess(
+      std::move(receiver), std::move(client_process),
+      memory_instrumentation::mojom::ProcessType::RENDERER, GetProcess().Pid(),
+      /*service_name=*/base::nullopt);
+  coordinator_connector_receiver_.reset();
+}
+
 void RenderProcessHostImpl::CreateRendererHost(
-    mojom::RendererHostAssociatedRequest request) {
-  renderer_host_binding_.Bind(std::move(request));
+    mojo::PendingAssociatedReceiver<mojom::RendererHost> receiver) {
+  renderer_host_binding_.Bind(std::move(receiver));
 }
 
 int RenderProcessHostImpl::GetNextRoutingID() {
@@ -2358,7 +2435,7 @@ mojom::Renderer* RenderProcessHostImpl::GetRendererInterface() {
 }
 
 void RenderProcessHostImpl::CreateURLLoaderFactoryForRendererProcess(
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   base::Optional<url::Origin> request_initiator_site_lock;
@@ -2379,7 +2456,7 @@ void RenderProcessHostImpl::CreateURLLoaderFactoryForRendererProcess(
                          network::mojom::CrossOriginEmbedderPolicy::kNone,
                          nullptr /* preferences */, net::NetworkIsolationKey(),
                          mojo::NullRemote() /* header_client */,
-                         std::move(request));
+                         std::move(receiver));
 }
 
 void RenderProcessHostImpl::CreateURLLoaderFactory(
@@ -2389,10 +2466,10 @@ void RenderProcessHostImpl::CreateURLLoaderFactory(
     const net::NetworkIsolationKey& network_isolation_key,
     mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
         header_client,
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   CreateURLLoaderFactoryInternal(
       origin, embedder_policy, preferences, network_isolation_key,
-      std::move(header_client), std::move(request), false /* is_trusted */);
+      std::move(header_client), std::move(receiver), false /* is_trusted */);
 }
 
 void RenderProcessHostImpl::CreateTrustedURLLoaderFactory(
@@ -2401,20 +2478,20 @@ void RenderProcessHostImpl::CreateTrustedURLLoaderFactory(
     const WebPreferences* preferences,
     mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
         header_client,
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   CreateURLLoaderFactoryInternal(origin, embedder_policy, preferences,
                                  base::nullopt, std::move(header_client),
-                                 std::move(request), true /* is_trusted */);
+                                 std::move(receiver), true /* is_trusted */);
 }
 
 void RenderProcessHostImpl::CreateURLLoaderFactoryInternal(
     const base::Optional<url::Origin>& origin,
     network::mojom::CrossOriginEmbedderPolicy embedder_policy,
     const WebPreferences* preferences,
-    base::Optional<net::NetworkIsolationKey> network_isolation_key,
+    const base::Optional<net::NetworkIsolationKey>& network_isolation_key,
     mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
         header_client,
-    network::mojom::URLLoaderFactoryRequest request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
     bool is_trusted) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -2425,15 +2502,16 @@ void RenderProcessHostImpl::CreateURLLoaderFactoryInternal(
 
   network::mojom::NetworkContext* network_context =
       storage_partition_impl_->GetNetworkContext();
-  network::mojom::URLLoaderFactoryPtrInfo embedder_provided_factory;
+  mojo::PendingRemote<network::mojom::URLLoaderFactory>
+      embedder_provided_factory;
   if (origin.has_value()) {
     embedder_provided_factory =
         GetContentClient()->browser()->CreateURLLoaderFactoryForNetworkRequests(
-            this, network_context, &header_client, origin.value());
+            this, network_context, &header_client, origin.value(),
+            network_isolation_key);
   }
   if (embedder_provided_factory) {
-    mojo::FuseInterface(std::move(request),
-                        std::move(embedder_provided_factory));
+    mojo::FusePipes(std::move(receiver), std::move(embedder_provided_factory));
   } else {
     network::mojom::URLLoaderFactoryParamsPtr params =
         network::mojom::URLLoaderFactoryParams::New();
@@ -2467,19 +2545,12 @@ void RenderProcessHostImpl::CreateURLLoaderFactoryInternal(
       params->is_corb_enabled = true;
     }
 
-    network_context->CreateURLLoaderFactory(std::move(request),
+    network_context->CreateURLLoaderFactory(std::move(receiver),
                                             std::move(params));
   }
 }
 
-void RenderProcessHostImpl::SetIsNeverSuitableForReuse() {
-  is_never_suitable_for_reuse_ = true;
-}
-
 bool RenderProcessHostImpl::MayReuseHost() {
-  if (is_never_suitable_for_reuse_)
-    return false;
-
   return GetContentClient()->browser()->MayReuseHost(this);
 }
 
@@ -2723,19 +2794,20 @@ void RenderProcessHostImpl::RemoveExpectedNavigationToSite(
 // static
 void RenderProcessHostImpl::NotifySpareManagerAboutRecentlyUsedBrowserContext(
     BrowserContext* browser_context) {
-  g_spare_render_process_host_manager.Get().PrepareForFutureRequests(
+  SpareRenderProcessHostManager::GetInstance().PrepareForFutureRequests(
       browser_context);
 }
 
 // static
 RenderProcessHost*
 RenderProcessHostImpl::GetSpareRenderProcessHostForTesting() {
-  return g_spare_render_process_host_manager.Get().spare_render_process_host();
+  return SpareRenderProcessHostManager::GetInstance()
+      .spare_render_process_host();
 }
 
 // static
 void RenderProcessHostImpl::DiscardSpareRenderProcessHostForTesting() {
-  g_spare_render_process_host_manager.Get().CleanupSpareRenderProcessHost();
+  SpareRenderProcessHostManager::GetInstance().CleanupSpareRenderProcessHost();
 }
 
 // static
@@ -2879,7 +2951,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
   // Propagate the following switches to the renderer command line (along
   // with any associated values) if present in the browser command line.
   static const char* const kSwitchNames[] = {
-    network::switches::kNoReferrers,
     network::switches::kExplicitlyAllowedPorts,
     service_manager::switches::kDisableInProcessStackTraces,
     service_manager::switches::kDisableSeccompFilterSandbox,
@@ -2919,7 +2990,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kEnableDeJelly,
     switches::kDisableOriginTrialControlledBlinkFeatures,
     switches::kDisablePepper3DImageChromium,
-    switches::kDisablePerfetto,
     switches::kDisablePermissionsAPI,
     switches::kDisablePresentationAPI,
     switches::kDisableRGBA4444Textures,
@@ -2936,7 +3006,6 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kDomAutomationController,
     switches::kEnableAccessibilityObjectModel,
     switches::kEnableAutomation,
-    switches::kEnableCanvas2dSwapChain,
     switches::kEnableExperimentalAccessibilityLanguageDetection,
     switches::kEnableExperimentalAccessibilityLabelsDebugging,
     switches::kEnableExperimentalWebPlatformFeatures,
@@ -2963,17 +3032,17 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kEnableUseZoomForDSF,
     switches::kEnableViewport,
     switches::kEnableVtune,
-    switches::kEnableWebBluetoothScanning,
     switches::kEnableWebGL2ComputeContext,
     switches::kEnableWebGLDraftExtensions,
     switches::kEnableWebGLImageChromium,
-    switches::kEnableWebGLSwapChain,
     switches::kEnableWebVR,
     switches::kFileUrlPathAlias,
-    switches::kForceDisplayColorProfile,
     switches::kForceDeviceScaleFactor,
+    switches::kForceDisableWebRtcApmInAudioService,
+    switches::kForceDisplayColorProfile,
     switches::kForceGpuMemAvailableMb,
     switches::kForceGpuRasterization,
+    switches::kForceHighContrast,
     switches::kForceOverlayFullscreenVideo,
     switches::kForceVideoOverlays,
     switches::kFullMemoryCrashReport,
@@ -2997,6 +3066,8 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kProfilingFile,
     switches::kProfilingFlush,
     switches::kRegisterPepperPlugins,
+    switches::kRemoteDebuggingPipe,
+    switches::kRemoteDebuggingPort,
     switches::kRendererStartupDialog,
     switches::kReportVp9AsAnUnsupportedMimeType,
     switches::kShowLayoutShiftRegions,
@@ -3016,6 +3087,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kUseGpuInTests,
     switches::kUseMobileUserAgent,
     switches::kV,
+    switches::kVideoCaptureUseGpuMemoryBuffer,
     switches::kVideoThreads,
     switches::kVideoUnderflowThresholdMs,
     switches::kVModule,
@@ -3435,7 +3507,6 @@ void RenderProcessHostImpl::Cleanup() {
   base::ThreadTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE, this);
   deleting_soon_ = true;
 
-  io_thread_host_impl_.reset();
   if (render_frame_message_filter_) {
     // RenderFrameMessageFilter is refcounted and can outlive the
     // ResourceContext. If the BrowserContext is shutting down, after
@@ -3462,8 +3533,6 @@ void RenderProcessHostImpl::Cleanup() {
   // Remove ourself from the list of renderer processes so that we can't be
   // reused in between now and when the Delete task runs.
   UnregisterHost(GetID());
-
-  instance_weak_factory_.emplace(this);
 }
 
 void RenderProcessHostImpl::PopulateTerminationInfoRendererFields(
@@ -3567,16 +3636,16 @@ bool RenderProcessHostImpl::FastShutdownStarted() {
 
 // static
 void RenderProcessHostImpl::RegisterHost(int host_id, RenderProcessHost* host) {
-  g_all_hosts.Get().AddWithID(host, host_id);
+  GetAllHosts().AddWithID(host, host_id);
 }
 
 // static
 void RenderProcessHostImpl::UnregisterHost(int host_id) {
-  RenderProcessHost* host = g_all_hosts.Get().Lookup(host_id);
+  RenderProcessHost* host = GetAllHosts().Lookup(host_id);
   if (!host)
     return;
 
-  g_all_hosts.Get().Remove(host_id);
+  GetAllHosts().Remove(host_id);
 
   // Look up the map of site to process for the given browser_context,
   // in case we need to remove this process from it.  It will be registered
@@ -3587,12 +3656,26 @@ void RenderProcessHostImpl::UnregisterHost(int host_id) {
 }
 
 // static
+void RenderProcessHostImpl::RegisterCreationObserver(
+    RenderProcessHostCreationObserver* observer) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  GetAllCreationObservers().push_back(observer);
+}
+
+// static
+void RenderProcessHostImpl::UnregisterCreationObserver(
+    RenderProcessHostCreationObserver* observer) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  auto iter = std::find(GetAllCreationObservers().begin(),
+                        GetAllCreationObservers().end(), observer);
+  DCHECK(iter != GetAllCreationObservers().end());
+  GetAllCreationObservers().erase(iter);
+}
+
+// static
 void RenderProcessHostImpl::FilterURL(RenderProcessHost* rph,
                                       bool empty_allowed,
                                       GURL* url) {
-  ChildProcessSecurityPolicyImpl* policy =
-      ChildProcessSecurityPolicyImpl::GetInstance();
-
   if (empty_allowed && url->is_empty())
     return;
 
@@ -3605,6 +3688,8 @@ void RenderProcessHostImpl::FilterURL(RenderProcessHost* rph,
     return;
   }
 
+  ChildProcessSecurityPolicyImpl* policy =
+      ChildProcessSecurityPolicyImpl::GetInstance();
   if (!policy->CanRequestURL(rph->GetID(), *url)) {
     // If this renderer is not permitted to request this URL, we invalidate the
     // URL.  This prevents us from storing the blocked URL and becoming confused
@@ -3719,7 +3804,7 @@ bool RenderProcessHostImpl::IsSuitableHost(
 // static
 void RenderProcessHost::WarmupSpareRenderProcessHost(
     content::BrowserContext* browser_context) {
-  g_spare_render_process_host_manager.Get().WarmupSpareRenderProcessHost(
+  SpareRenderProcessHostManager::GetInstance().WarmupSpareRenderProcessHost(
       browser_context);
 }
 
@@ -3751,13 +3836,13 @@ void RenderProcessHost::SetRunRendererInProcess(bool value) {
 // static
 RenderProcessHost::iterator RenderProcessHost::AllHostsIterator() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return iterator(g_all_hosts.Pointer());
+  return iterator(&GetAllHosts());
 }
 
 // static
 RenderProcessHost* RenderProcessHost::FromID(int render_process_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return g_all_hosts.Get().Lookup(render_process_id);
+  return GetAllHosts().Lookup(render_process_id);
 }
 
 // static
@@ -3784,7 +3869,7 @@ bool RenderProcessHost::ShouldTryToUseExistingProcessHost(
   //       a renderer process for a browser context that has no existing
   //       renderers. This is OK in moderation, since the
   //       GetMaxRendererProcessCount() is conservative.
-  if (g_all_hosts.Get().size() >= GetMaxRendererProcessCount())
+  if (GetAllHosts().size() >= GetMaxRendererProcessCount())
     return true;
 
   return GetContentClient()->browser()->ShouldTryToUseExistingProcessHost(
@@ -3796,7 +3881,7 @@ RenderProcessHost* RenderProcessHostImpl::GetExistingProcessHost(
     SiteInstanceImpl* site_instance) {
   // First figure out which existing renderers we can use.
   std::vector<RenderProcessHost*> suitable_renderers;
-  suitable_renderers.reserve(g_all_hosts.Get().size());
+  suitable_renderers.reserve(GetAllHosts().size());
 
   iterator iter(AllHostsIterator());
   while (!iter.IsAtEnd()) {
@@ -3807,7 +3892,7 @@ RenderProcessHost* RenderProcessHostImpl::GetExistingProcessHost(
             site_instance->lock_url())) {
       // The spare is always considered before process reuse.
       DCHECK_NE(iter.GetCurrentValue(),
-                g_spare_render_process_host_manager.Get()
+                SpareRenderProcessHostManager::GetInstance()
                     .spare_render_process_host());
 
       suitable_renderers.push_back(iter.GetCurrentValue());
@@ -3826,6 +3911,41 @@ RenderProcessHost* RenderProcessHostImpl::GetExistingProcessHost(
 }
 
 // static
+RenderProcessHost* RenderProcessHostImpl::GetUnusedProcessHostForServiceWorker(
+    SiteInstanceImpl* site_instance) {
+  DCHECK(site_instance->is_for_service_worker());
+  if (site_instance->process_reuse_policy() !=
+      SiteInstanceImpl::ProcessReusePolicy::REUSE_PENDING_OR_COMMITTED_SITE) {
+    return nullptr;
+  }
+
+  auto& spare_process_manager = SpareRenderProcessHostManager::GetInstance();
+  iterator iter(AllHostsIterator());
+  while (!iter.IsAtEnd()) {
+    auto* host = iter.GetCurrentValue();
+    // This function tries to choose the process that will be chosen by a
+    // navigation that will use the service worker that is being started. Prefer
+    // to not take the spare process host, since if the navigation is out of the
+    // New Tab Page on Android, it will be using the existing NTP process
+    // instead of the spare process. If this function doesn't find a suitable
+    // process, the spare can still be chosen when
+    // MaybeTakeSpareRenderProcessHost() is called later.
+    bool is_spare = (host == spare_process_manager.spare_render_process_host());
+
+    if (!is_spare && iter.GetCurrentValue()->MayReuseHost() &&
+        iter.GetCurrentValue()->IsUnused() &&
+        RenderProcessHostImpl::IsSuitableHost(
+            iter.GetCurrentValue(), site_instance->GetBrowserContext(),
+            site_instance->GetIsolationContext(), site_instance->GetSiteURL(),
+            site_instance->lock_url())) {
+      return host;
+    }
+    iter.Advance();
+  }
+  return nullptr;
+}
+
+// static
 bool RenderProcessHost::ShouldUseProcessPerSite(BrowserContext* browser_context,
                                                 const GURL& url) {
   // Returns true if we should use the process-per-site model.  This will be
@@ -3957,9 +4077,18 @@ RenderProcessHost* RenderProcessHostImpl::GetProcessHostForSiteInstance(
                features::kProcessSharingWithStrictSiteInstances));
   }
 
+  // If a process hasn't been selected yet, and the site instance is for a
+  // service worker, try to use an unused process host. One might have been
+  // created for a navigation and this will let the navigation and the service
+  // worker share the same process.
+  if (base::FeatureList::IsEnabled(
+          features::kServiceWorkerPrefersUnusedProcess) &&
+      !render_process_host && is_unmatched_service_worker) {
+    render_process_host = GetUnusedProcessHostForServiceWorker(site_instance);
+  }
+
   // See if the spare RenderProcessHost can be used.
-  SpareRenderProcessHostManager& spare_process_manager =
-      g_spare_render_process_host_manager.Get();
+  auto& spare_process_manager = SpareRenderProcessHostManager::GetInstance();
   bool spare_was_taken = false;
   if (!render_process_host) {
     render_process_host = spare_process_manager.MaybeTakeSpareRenderProcessHost(
@@ -4151,9 +4280,12 @@ void RenderProcessHostImpl::ProcessDied(
 void RenderProcessHostImpl::ResetIPC() {
   if (renderer_host_binding_.is_bound())
     renderer_host_binding_.Unbind();
+
+  io_thread_host_impl_.reset();
   route_provider_receiver_.reset();
-  associated_interface_provider_bindings_.CloseAllBindings();
+  associated_interface_provider_receivers_.Clear();
   associated_interfaces_.reset();
+  coordinator_connector_receiver_.reset();
 
   // Destroy all embedded CompositorFrameSinks.
   embedded_frame_sink_provider_.reset();
@@ -4162,6 +4294,8 @@ void RenderProcessHostImpl::ResetIPC() {
     storage_partition_impl_->Unbind(binding_id);
   }
 
+  instance_weak_factory_.emplace(this);
+
   // If RenderProcessHostImpl is reused, the next renderer will send a new
   // request for FrameSinkProvider so make sure frame_sink_provider_ is ready
   // for that.
@@ -4173,6 +4307,15 @@ void RenderProcessHostImpl::ResetIPC() {
   // away first, since deleting the channel proxy will post a
   // OnChannelClosed() to IPC::ChannelProxy::Context on the IO thread.
   ResetChannelProxy();
+
+  // The PermissionServiceContext holds PermissionSubscriptions originating from
+  // service workers. These subscriptions observe the PermissionControllerImpl
+  // that is owned by the Profile corresponding to |this|. At this point, IPC
+  // are unbound so no new subscriptions can be made. Existing subscriptions
+  // need to be released here, as the Profile, and with it, the
+  // PermissionControllerImpl, can be destroyed anytime after
+  // RenderProcessHostImpl::Cleanup() returns.
+  permission_service_context_.reset();
 }
 
 size_t RenderProcessHost::GetActiveViewCount() {
@@ -4385,6 +4528,9 @@ void RenderProcessHostImpl::OnProcessLaunched() {
           child_process_launcher_->GetProcess().Duplicate());
     }
 
+    if (coordinator_connector_receiver_.is_bound())
+      coordinator_connector_receiver_.Resume();
+
 // Not all platforms launch processes in the same backgrounded state. Make
 // sure |priority_.visible| reflects this platform's initial process
 // state.
@@ -4437,6 +4583,8 @@ void RenderProcessHostImpl::OnProcessLaunched() {
   NotificationService::current()->Notify(NOTIFICATION_RENDERER_PROCESS_CREATED,
                                          Source<RenderProcessHost>(this),
                                          NotificationService::NoDetails());
+  for (auto* observer : GetAllCreationObservers())
+    observer->OnRenderProcessHostCreated(this);
 
   if (child_process_launcher_)
     channel_->Flush();
@@ -4535,18 +4683,18 @@ RenderProcessHostImpl::FindReusableProcessHostForSiteInstance(
 }
 
 void RenderProcessHostImpl::CreateMediaStreamTrackMetricsHost(
-    blink::mojom::MediaStreamTrackMetricsHostRequest request) {
+    mojo::PendingReceiver<blink::mojom::MediaStreamTrackMetricsHost> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
   if (!media_stream_track_metrics_host_)
     media_stream_track_metrics_host_.reset(new MediaStreamTrackMetricsHost());
-  media_stream_track_metrics_host_->BindRequest(std::move(request));
+  media_stream_track_metrics_host_->BindReceiver(std::move(receiver));
 }
 
 #if BUILDFLAG(ENABLE_MDNS)
 void RenderProcessHostImpl::CreateMdnsResponder(
-    network::mojom::MdnsResponderRequest request) {
+    mojo::PendingReceiver<network::mojom::MdnsResponder> receiver) {
   GetStoragePartition()->GetNetworkContext()->CreateMdnsResponder(
-      std::move(request));
+      std::move(receiver));
 }
 #endif  // BUILDFLAG(ENABLE_MDNS)
 
@@ -4597,4 +4745,10 @@ void RenderProcessHostImpl::OnBindHostReceiver(
       this, std::move(receiver));
 }
 
+// static
+void RenderProcessHost::InterceptBindHostReceiverForTesting(
+    BindHostReceiverInterceptor callback) {
+  GetBindHostReceiverInterceptor() = std::move(callback);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_process_host_impl.h b/chromium/content/browser/renderer_host/render_process_host_impl.h
index e8d094ecce9..bda387a8a66 100644
--- a/chromium/content/browser/renderer_host/render_process_host_impl.h
+++ b/chromium/content/browser/renderer_host/render_process_host_impl.h
@@ -51,17 +51,20 @@
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_platform_file.h"
 #include "media/media_buildflags.h"
-#include "mojo/public/cpp/bindings/associated_binding_set.h"
+#include "media/mojo/mojom/video_decode_perf_history.mojom.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/associated_receiver_set.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/invitation.h"
 #include "net/base/network_isolation_key.h"
 #include "services/network/public/mojom/mdns_responder.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
 #include "services/viz/public/mojom/compositing/compositing_mode_watcher.mojom.h"
@@ -85,6 +88,10 @@ class CommandLine;
 class PersistentMemoryAllocator;
 }
 
+namespace url {
+class Origin;
+}
+
 namespace viz {
 class GpuClient;
 }
@@ -103,6 +110,7 @@ class PeerConnectionTrackerHost;
 class PluginRegistryImpl;
 class PushMessagingManager;
 class RenderFrameMessageFilter;
+class RenderProcessHostCreationObserver;
 class RenderProcessHostFactory;
 class RenderWidgetHelper;
 class SiteInstance;
@@ -138,7 +146,8 @@ class CONTENT_EXPORT RenderProcessHostImpl
       public ChildProcessLauncher::Client,
       public mojom::RouteProvider,
       public blink::mojom::AssociatedInterfaceProvider,
-      public mojom::RendererHost {
+      public mojom::RendererHost,
+      public memory_instrumentation::mojom::CoordinatorConnector {
  public:
   // Special depth used when there are no PriorityClients.
   static const unsigned int kMaxFrameDepthForPriority;
@@ -230,9 +239,9 @@ class CONTENT_EXPORT RenderProcessHostImpl
       const net::NetworkIsolationKey& network_isolation_key,
       mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
           header_client,
-      network::mojom::URLLoaderFactoryRequest request) override;
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
-  void SetIsNeverSuitableForReuse() override;
   bool MayReuseHost() override;
   bool IsUnused() override;
   void SetIsUsed() override;
@@ -243,8 +252,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void BindCacheStorage(
       mojo::PendingReceiver<blink::mojom::CacheStorage> receiver,
       const url::Origin& origin) override;
-  void BindIndexedDB(blink::mojom::IDBFactoryRequest request,
-                     const url::Origin& origin) override;
+  void BindIndexedDB(
+      int render_frame_id,
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) override;
   void ForceCrash() override;
   void CleanupCorbExceptionForPluginUponDestruction() override;
 
@@ -274,7 +285,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
       const WebPreferences* preferences,
       mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
           header_client,
-      network::mojom::URLLoaderFactoryRequest request);
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver);
 
   // Call this function when it is evident that the child process is actively
   // performing some operation, for example if we just received an IPC message.
@@ -296,6 +307,11 @@ class CONTENT_EXPORT RenderProcessHostImpl
   static void RegisterHost(int host_id, RenderProcessHost* host);
   static void UnregisterHost(int host_id);
 
+  static void RegisterCreationObserver(
+      RenderProcessHostCreationObserver* observer);
+  static void UnregisterCreationObserver(
+      RenderProcessHostCreationObserver* observer);
+
   // Implementation of FilterURL below that can be shared with the mock class.
   static void FilterURL(RenderProcessHost* rph, bool empty_allowed, GURL* url);
 
@@ -494,7 +510,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void DelayProcessShutdownForUnload(const base::TimeDelta& timeout);
 
   // Binds |receiver| to the FileSystemManager instance owned by the render
-  // process host, and is used by workers via RendererInterfaceBinders.
+  // process host, and is used by workers via BrowserInterfaceBroker.
   void BindFileSystemManager(
       const url::Origin& origin,
       mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver) override;
@@ -503,6 +519,37 @@ class CONTENT_EXPORT RenderProcessHostImpl
     return file_system_manager_impl_.get();
   }
 
+  // Binds |receiver| to the VideoDecodePerfHistory instance owned by the render
+  // process host, and is used by workers via BrowserInterfaceBroker.
+  void BindVideoDecodePerfHistory(
+      mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver)
+      override;
+
+  // Binds |receiver| to the LockManager owned by |storage_partition_impl_|.
+  // |receiver| belongs to a frame or worker at |origin| hosted by this process.
+  // If it belongs to a frame, |render_frame_id| identifies it, otherwise it is
+  // MSG_ROUTING_NONE.
+  //
+  // Used by frames and workers via BrowserInterfaceBroker.
+  void CreateLockManager(
+      int render_frame_id,
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::LockManager> receiver) override;
+
+  // Binds |receiver| to the PermissionService instance owned by
+  // |permission_service_context_|, and is used by workers via
+  // BrowserInterfaceBroker.
+  void CreatePermissionService(
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::PermissionService> receiver) override;
+
+  // Binds |receiver| to the PaymentManager instance owned by
+  // |storage_partition_impl_|, and is used by workers via
+  // BrowserInterfaceBroker.
+  void CreatePaymentManagerForOrigin(
+      const url::Origin& origin,
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) override;
+
   // Adds a CORB (Cross-Origin Read Blocking) exception for |process_id|.  The
   // exception will be removed when the corresponding RenderProcessHostImpl is
   // destroyed (see |cleanup_corb_exception_for_plugin_upon_destruction_|).
@@ -513,6 +560,8 @@ class CONTENT_EXPORT RenderProcessHostImpl
     ipc_send_watcher_for_testing_ = std::move(watcher);
   }
 
+  size_t keep_alive_ref_count() const { return keep_alive_ref_count_; }
+
  protected:
   // A proxy for our IPC::Channel that lives on the IO thread.
   std::unique_ptr<IPC::ChannelProxy> channel_;
@@ -559,14 +608,16 @@ class CONTENT_EXPORT RenderProcessHostImpl
   void RegisterMojoInterfaces();
 
   // mojom::RouteProvider:
-  void GetRoute(int32_t routing_id,
-                blink::mojom::AssociatedInterfaceProviderAssociatedRequest
-                    request) override;
+  void GetRoute(
+      int32_t routing_id,
+      mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>
+          receiver) override;
 
   // blink::mojom::AssociatedInterfaceProvider:
   void GetAssociatedInterface(
       const std::string& name,
-      blink::mojom::AssociatedInterfaceAssociatedRequest request) override;
+      mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterface>
+          receiver) override;
 
   // mojom::RendererHost
   using BrowserHistogramCallback =
@@ -580,18 +631,27 @@ class CONTENT_EXPORT RenderProcessHostImpl
 
   void CreateEmbeddedFrameSinkProvider(
       mojo::PendingReceiver<blink::mojom::EmbeddedFrameSinkProvider> receiver);
-  void BindFrameSinkProvider(mojom::FrameSinkProviderRequest request);
+  void BindFrameSinkProvider(
+      mojo::PendingReceiver<mojom::FrameSinkProvider> receiver);
   void BindCompositingModeReporter(
-      viz::mojom::CompositingModeReporterRequest request);
+      mojo::PendingReceiver<viz::mojom::CompositingModeReporter> receiver);
   void CreateStoragePartitionService(
       mojo::PendingReceiver<blink::mojom::StoragePartitionService> receiver);
   void CreateBroadcastChannelProvider(
       mojo::PendingReceiver<blink::mojom::BroadcastChannelProvider> receiver);
-  void CreateRendererHost(mojom::RendererHostAssociatedRequest request);
+  void CreateRendererHost(
+      mojo::PendingAssociatedReceiver<mojom::RendererHost> receiver);
   void BindVideoDecoderService(media::mojom::InterfaceFactoryRequest request);
   void BindWebDatabaseHostImpl(
       mojo::PendingReceiver<blink::mojom::WebDatabaseHost> receiver);
 
+  // memory_instrumentation::mojom::CoordinatorConnector implementation:
+  void RegisterCoordinatorClient(
+      mojo::PendingReceiver<memory_instrumentation::mojom::Coordinator>
+          receiver,
+      mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess>
+          client_process) override;
+
   // Control message handlers.
   void OnUserMetricsRecordAction(const std::string& action);
   void OnCloseACK(int closed_widget_route_id);
@@ -644,6 +704,22 @@ class CONTENT_EXPORT RenderProcessHostImpl
   FRIEND_TEST_ALL_PREFIXES(RenderProcessHostUnitTest,
                            GuestsAreNotSuitableHosts);
 
+  // Returns an existing RenderProcessHost that has not yet been used and is
+  // suitable for the given |site_instance|, or null if no such process host
+  // exists.
+  //
+  // This function is used when finding a process for a service worker. The
+  // idea is to choose the process that will be chosen by a navigation that will
+  // use the service worker. While navigations typically try to choose the
+  // process with the relevant service worker (using
+  // UnmatchedServiceWorkerProcessTracker), navigations out of the Android New
+  // Tab Page use a SiteInstance with an empty URL by design in order to choose
+  // the NTP process, and do not go through the typical matching algorithm. The
+  // goal of this function is to return the NTP process so the service worker
+  // can also use it.
+  static RenderProcessHost* GetUnusedProcessHostForServiceWorker(
+      SiteInstanceImpl* site_instance);
+
   // Returns a RenderProcessHost that is rendering a URL corresponding to
   // |site_instance| in one of its frames, or that is expecting a navigation to
   // that SiteInstance.
@@ -651,10 +727,12 @@ class CONTENT_EXPORT RenderProcessHostImpl
       SiteInstanceImpl* site_instance);
 
   void CreateMediaStreamTrackMetricsHost(
-      blink::mojom::MediaStreamTrackMetricsHostRequest request);
+      mojo::PendingReceiver<blink::mojom::MediaStreamTrackMetricsHost>
+          receiver);
 
 #if BUILDFLAG(ENABLE_MDNS)
-  void CreateMdnsResponder(network::mojom::MdnsResponderRequest request);
+  void CreateMdnsResponder(
+      mojo::PendingReceiver<network::mojom::MdnsResponder> receiver);
 #endif  // BUILDFLAG(ENABLE_MDNS)
 
   void NotifyRendererIfLockedToSite();
@@ -720,7 +798,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // URLLoaderFactories are associated with a specific origin and an execution
   // context (e.g. a frame, a service worker or any other kind of worker).
   void CreateURLLoaderFactoryForRendererProcess(
-      network::mojom::URLLoaderFactoryRequest request);
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver);
 
   // Creates a URLLoaderFactory whose NetworkIsolationKey is set if
   // |network_isoation_key| has a value, and whose trust is given by
@@ -730,10 +808,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
       const base::Optional<url::Origin>& origin,
       network::mojom::CrossOriginEmbedderPolicy embedder_policy,
       const WebPreferences* preferences,
-      base::Optional<net::NetworkIsolationKey> network_isolation_key,
+      const base::Optional<net::NetworkIsolationKey>& network_isolation_key,
       mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
           header_client,
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       bool is_trusted);
 
   // Handles incoming requests to bind a process-scoped receiver from the
@@ -751,10 +829,6 @@ class CONTENT_EXPORT RenderProcessHostImpl
   // no longer be modified.
   bool is_keep_alive_ref_count_disabled_;
 
-  // Whether this host is never suitable for reuse as determined in the
-  // MayReuseHost() function.
-  bool is_never_suitable_for_reuse_ = false;
-
   // The registered IPC listener objects. When this list is empty, we should
   // delete ourselves.
   base::IDMap<IPC::Listener*> listeners_;
@@ -765,8 +839,9 @@ class CONTENT_EXPORT RenderProcessHostImpl
   std::unique_ptr<blink::AssociatedInterfaceRegistry> associated_interfaces_;
 
   mojo::AssociatedReceiver<mojom::RouteProvider> route_provider_receiver_{this};
-  mojo::AssociatedBindingSet<blink::mojom::AssociatedInterfaceProvider, int32_t>
-      associated_interface_provider_bindings_;
+  mojo::AssociatedReceiverSet<blink::mojom::AssociatedInterfaceProvider,
+                              int32_t>
+      associated_interface_provider_receivers_;
 
   // These fields are cached values that are updated in
   // UpdateProcessPriorityInputs, and are used to compute priority sent to
@@ -822,7 +897,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
   BrowserContext* const browser_context_;
 
   // Owned by |browser_context_|.
-  StoragePartitionImpl* storage_partition_impl_;
+  StoragePartitionImpl* const storage_partition_impl_;
 
   // Keeps track of the BindingIds  returned by storage_partition_impl_->Bind()
   // calls so we can Unbind() them on cleanup.
@@ -892,7 +967,7 @@ class CONTENT_EXPORT RenderProcessHostImpl
   base::TimeTicks keep_alive_start_time_;
 
   // Context shared for each mojom::PermissionService instance created for this
-  // RPH.
+  // RPH. This is destroyed early in ResetIPC() method.
   std::unique_ptr<PermissionServiceContext> permission_service_context_;
 
   // The memory allocator, if any, in which the renderer will write its metrics.
@@ -915,8 +990,10 @@ class CONTENT_EXPORT RenderProcessHostImpl
 
   mojo::Remote<mojom::ChildProcess> child_process_;
   mojo::AssociatedRemote<mojom::RouteProvider> remote_route_provider_;
-  mojom::RendererAssociatedPtr renderer_interface_;
+  mojo::AssociatedRemote<mojom::Renderer> renderer_interface_;
   mojo::AssociatedBinding<mojom::RendererHost> renderer_host_binding_;
+  mojo::Receiver<memory_instrumentation::mojom::CoordinatorConnector>
+      coordinator_connector_receiver_{this};
 
   // Tracks active audio and video streams within the render process; used to
   // determine if if a process should be backgrounded.
diff --git a/chromium/content/browser/renderer_host/render_process_host_unittest.cc b/chromium/content/browser/renderer_host/render_process_host_unittest.cc
index 42aaf775531..3103e1af367 100644
--- a/chromium/content/browser/renderer_host/render_process_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_process_host_unittest.cc
@@ -18,6 +18,7 @@
 #include "content/common/frame_owner_properties.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/mock_render_process_host.h"
@@ -407,18 +408,6 @@ TEST_F(RenderProcessHostUnitTest, DoNotReuseError) {
   EXPECT_NE(main_test_rfh()->GetProcess(), site_instance->GetProcess());
 }
 
-// Tests that RenderProcessHost will not consider reusing a process that is
-// marked as never suitable for reuse, according to MayReuseHost().
-TEST_F(RenderProcessHostUnitTest, DoNotReuseHostThatIsNeverSuitableForReuse) {
-  const GURL kUrl("http://foo.com");
-  NavigateAndCommit(kUrl);
-  main_test_rfh()->GetProcess()->SetIsNeverSuitableForReuse();
-  scoped_refptr<SiteInstanceImpl> site_instance =
-      SiteInstanceImpl::CreateReusableInstanceForTesting(browser_context(),
-                                                         kUrl);
-  EXPECT_NE(main_test_rfh()->GetProcess(), site_instance->GetProcess());
-}
-
 // Tests that RenderProcessHost reuse considers navigations correctly.
 // Disabled for flakiness: see https://crbug.com/826595
 TEST_F(RenderProcessHostUnitTest, DISABLED_ReuseNavigationProcess) {
diff --git a/chromium/content/browser/renderer_host/render_view_host_browsertest.cc b/chromium/content/browser/renderer_host/render_view_host_browsertest.cc
index bb33f2f11b9..b6c993a6720 100644
--- a/chromium/content/browser/renderer_host/render_view_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_browsertest.cc
@@ -8,7 +8,7 @@
 #include "base/time/time.h"
 #include "base/values.h"
 #include "build/build_config.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
diff --git a/chromium/content/browser/renderer_host/render_view_host_delegate.cc b/chromium/content/browser/renderer_host/render_view_host_delegate.cc
index f8c11d0dac5..40a4800e5ac 100644
--- a/chromium/content/browser/renderer_host/render_view_host_delegate.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_delegate.cc
@@ -65,7 +65,7 @@ bool RenderViewHostDelegate::IsSpatialNavigationDisabled() const {
   return false;
 }
 
-RenderFrameHost* RenderViewHostDelegate::GetPendingMainFrame() {
+RenderFrameHostImpl* RenderViewHostDelegate::GetPendingMainFrame() {
   return nullptr;
 }
 
diff --git a/chromium/content/browser/renderer_host/render_view_host_delegate.h b/chromium/content/browser/renderer_host/render_view_host_delegate.h
index 7ecbec7dab3..e1b01b4d694 100644
--- a/chromium/content/browser/renderer_host/render_view_host_delegate.h
+++ b/chromium/content/browser/renderer_host/render_view_host_delegate.h
@@ -16,6 +16,7 @@
 #include "content/common/content_export.h"
 #include "content/common/render_message_filter.mojom.h"
 #include "content/common/widget.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/load_states.h"
 
 class GURL;
@@ -39,7 +40,7 @@ namespace content {
 
 class BrowserContext;
 class FrameTree;
-class RenderFrameHost;
+class RenderFrameHostImpl;
 class RenderViewHost;
 class RenderViewHostImpl;
 class RenderViewHostDelegateView;
@@ -132,12 +133,15 @@ class CONTENT_EXPORT RenderViewHostDelegate {
   // happen in response to ShowCreatedWidget.
   virtual void CreateNewWidget(int32_t render_process_id,
                                int32_t widget_route_id,
-                               mojom::WidgetPtr widget) {}
+                               mojo::PendingRemote<mojom::Widget> widget,
+                               RenderViewHostImpl* render_view_host) {}
 
   // Creates a full screen RenderWidget. Similar to above.
-  virtual void CreateNewFullscreenWidget(int32_t render_process_id,
-                                         int32_t widget_route_id,
-                                         mojom::WidgetPtr widget) {}
+  virtual void CreateNewFullscreenWidget(
+      int32_t render_process_id,
+      int32_t widget_route_id,
+      mojo::PendingRemote<mojom::Widget> widget,
+      RenderViewHostImpl* render_view_host) {}
 
   // Show the newly created widget with the specified bounds.
   // The widget is identified by the route_id passed to CreateNewWidget.
@@ -189,15 +193,11 @@ class CONTENT_EXPORT RenderViewHostDelegate {
 
   // Returns the RenderFrameHost for a pending or speculative main frame
   // navigation for the page.  Returns nullptr if there is no such navigation.
-  virtual RenderFrameHost* GetPendingMainFrame();
+  virtual RenderFrameHostImpl* GetPendingMainFrame();
 
   // The RenderView finished the first visually non-empty paint.
   virtual void DidFirstVisuallyNonEmptyPaint(RenderViewHostImpl* source) {}
 
-  // The RenderView has issued a draw command, signaling the it
-  // has been visually updated.
-  virtual void DidCommitAndDrawCompositorFrame(RenderViewHostImpl* source) {}
-
   // Returns true if the render view is rendering a portal.
   virtual bool IsPortal() const;
 
diff --git a/chromium/content/browser/renderer_host/render_view_host_factory.cc b/chromium/content/browser/renderer_host/render_view_host_factory.cc
index 540a2d6173a..b92cc3c44db 100644
--- a/chromium/content/browser/renderer_host/render_view_host_factory.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_factory.cc
@@ -10,6 +10,7 @@
 #include "base/memory/ptr_util.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_factory.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 
 namespace content {
 
@@ -50,13 +51,15 @@ RenderViewHost* RenderViewHostFactory::Create(
                                           routing_id, main_frame_routing_id,
                                           widget_routing_id, swapped_out);
   }
-  return new RenderViewHostImpl(
+
+  RenderViewHostImpl* view_host = new RenderViewHostImpl(
       instance,
       RenderWidgetHostFactory::Create(widget_delegate, instance->GetProcess(),
-                                      widget_routing_id, nullptr,
+                                      widget_routing_id, mojo::NullRemote(),
                                       /*hidden=*/true),
       delegate, routing_id, main_frame_routing_id, swapped_out,
       true /* has_initialized_audio_host */);
+  return view_host;
 }
 
 // static
diff --git a/chromium/content/browser/renderer_host/render_view_host_impl.cc b/chromium/content/browser/renderer_host/render_view_host_impl.cc
index 344eba7291b..55bade49780 100644
--- a/chromium/content/browser/renderer_host/render_view_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_impl.cc
@@ -71,6 +71,7 @@
 #include "content/public/browser/render_widget_host_iterator.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
@@ -109,10 +110,11 @@
 #endif
 
 using base::TimeDelta;
+
+using blink::PluginAction;
 using blink::WebConsoleMessage;
 using blink::WebInputEvent;
 using blink::WebMediaPlayerAction;
-using blink::WebPluginAction;
 
 namespace content {
 namespace {
@@ -137,36 +139,6 @@ void GetFontInfo(gfx::win::SystemFont system_font,
 }
 #endif  // OS_WIN
 
-void GetPlatformSpecificPrefs(blink::mojom::RendererPreferences* prefs) {
-#if defined(OS_WIN)
-  // Note that what is called "height" in this struct is actually the font size;
-  // font "height" typically includes ascender, descender, and padding and is
-  // often a third or so larger than the given font size.
-  GetFontInfo(gfx::win::SystemFont::kCaption, &prefs->caption_font_family_name,
-              &prefs->caption_font_height);
-  GetFontInfo(gfx::win::SystemFont::kSmallCaption,
-              &prefs->small_caption_font_family_name,
-              &prefs->small_caption_font_height);
-  GetFontInfo(gfx::win::SystemFont::kMenu, &prefs->menu_font_family_name,
-              &prefs->menu_font_height);
-  GetFontInfo(gfx::win::SystemFont::kMessage, &prefs->message_font_family_name,
-              &prefs->message_font_height);
-  GetFontInfo(gfx::win::SystemFont::kStatus, &prefs->status_font_family_name,
-              &prefs->status_font_height);
-
-  prefs->vertical_scroll_bar_width_in_dips =
-      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CXVSCROLL);
-  prefs->horizontal_scroll_bar_height_in_dips =
-      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CYHSCROLL);
-  prefs->arrow_bitmap_height_vertical_scroll_bar_in_dips =
-      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CYVSCROLL);
-  prefs->arrow_bitmap_width_horizontal_scroll_bar_in_dips =
-      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CXHSCROLL);
-#elif defined(OS_LINUX)
-  prefs->system_font_family_name = gfx::Font().GetFontName();
-#endif
-}
-
 }  // namespace
 
 // static
@@ -209,6 +181,38 @@ RenderViewHostImpl* RenderViewHostImpl::From(RenderWidgetHost* rwh) {
   return rvh;
 }
 
+// static
+void RenderViewHostImpl::GetPlatformSpecificPrefs(
+    blink::mojom::RendererPreferences* prefs) {
+#if defined(OS_WIN)
+  // Note that what is called "height" in this struct is actually the font size;
+  // font "height" typically includes ascender, descender, and padding and is
+  // often a third or so larger than the given font size.
+  GetFontInfo(gfx::win::SystemFont::kCaption, &prefs->caption_font_family_name,
+              &prefs->caption_font_height);
+  GetFontInfo(gfx::win::SystemFont::kSmallCaption,
+              &prefs->small_caption_font_family_name,
+              &prefs->small_caption_font_height);
+  GetFontInfo(gfx::win::SystemFont::kMenu, &prefs->menu_font_family_name,
+              &prefs->menu_font_height);
+  GetFontInfo(gfx::win::SystemFont::kMessage, &prefs->message_font_family_name,
+              &prefs->message_font_height);
+  GetFontInfo(gfx::win::SystemFont::kStatus, &prefs->status_font_family_name,
+              &prefs->status_font_height);
+
+  prefs->vertical_scroll_bar_width_in_dips =
+      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CXVSCROLL);
+  prefs->horizontal_scroll_bar_height_in_dips =
+      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CYHSCROLL);
+  prefs->arrow_bitmap_height_vertical_scroll_bar_in_dips =
+      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CYVSCROLL);
+  prefs->arrow_bitmap_width_horizontal_scroll_bar_in_dips =
+      display::win::ScreenWin::GetSystemMetricsInDIP(SM_CXHSCROLL);
+#elif defined(OS_LINUX)
+  prefs->system_font_family_name = gfx::Font().GetFontName();
+#endif
+}
+
 RenderViewHostImpl::RenderViewHostImpl(
     SiteInstance* instance,
     std::unique_ptr<RenderWidgetHostImpl> widget,
@@ -222,11 +226,7 @@ RenderViewHostImpl::RenderViewHostImpl(
       instance_(static_cast<SiteInstanceImpl*>(instance)),
       is_swapped_out_(swapped_out),
       routing_id_(routing_id),
-      main_frame_routing_id_(main_frame_routing_id),
-      is_waiting_for_close_ack_(false),
-      sudden_termination_allowed_(false),
-      updating_web_preferences_(false),
-      has_notified_about_creation_(false) {
+      main_frame_routing_id_(main_frame_routing_id) {
   DCHECK(instance_.get());
   CHECK(delegate_);  // http://crbug.com/82827
   DCHECK_NE(GetRoutingID(), render_widget_host_->GetRoutingID());
@@ -237,8 +237,6 @@ RenderViewHostImpl::RenderViewHostImpl(
   CHECK(result.second) << "Inserting a duplicate item!";
   GetProcess()->AddRoute(routing_id_, this);
 
-  GetWidget()->set_owner_delegate(this);
-
   GetProcess()->AddObserver(this);
   ui::GpuSwitchingManager::GetInstance()->AddObserver(this);
 
@@ -255,6 +253,8 @@ RenderViewHostImpl::RenderViewHostImpl(
       &RenderViewHostImpl::ClosePageTimeout, weak_factory_.GetWeakPtr())));
 
   input_device_change_observer_.reset(new InputDeviceChangeObserver(this));
+
+  GetWidget()->set_owner_delegate(this);
 }
 
 RenderViewHostImpl::~RenderViewHostImpl() {
@@ -285,8 +285,12 @@ RenderViewHostImpl::~RenderViewHostImpl() {
 
   // This can be called inside the FrameTree destructor. When the delegate is
   // the InterstialPageImpl, the |frame_tree| is set to null before deleting it.
-  if (FrameTree* frame_tree = GetDelegate()->GetFrameTree())
-    frame_tree->RenderViewHostDeleted(this);
+  if (FrameTree* frame_tree = GetDelegate()->GetFrameTree()) {
+    // If |this| is in the BackForwardCache, then it was already removed from
+    // the FrameTree at the time it entered the BackForwardCache.
+    if (!is_in_back_forward_cache_)
+      frame_tree->UnregisterRenderViewHost(this);
+  }
 }
 
 RenderViewHostDelegate* RenderViewHostImpl::GetDelegate() {
@@ -334,7 +338,8 @@ bool RenderViewHostImpl::CreateRenderView(
   mojom::CreateViewParamsPtr params = mojom::CreateViewParams::New();
   params->renderer_preferences =
       delegate_->GetRendererPrefs(GetProcess()->GetBrowserContext()).Clone();
-  GetPlatformSpecificPrefs(params->renderer_preferences.get());
+  RenderViewHostImpl::GetPlatformSpecificPrefs(
+      params->renderer_preferences.get());
   params->web_preferences = GetWebkitPreferences();
   params->view_id = GetRoutingID();
   params->main_frame_routing_id = main_frame_routing_id_;
@@ -374,8 +379,11 @@ bool RenderViewHostImpl::CreateRenderView(
       GetSiteInstance()->GetSiteURL().SchemeIs(kGuestScheme);
   params->inside_portal = delegate_->IsPortal();
 
-  params->visual_properties = GetWidget()->GetVisualProperties();
-  GetWidget()->SetInitialVisualProperties(params->visual_properties);
+  // TODO(danakj): Make the visual_properties optional in the message.
+  if (proxy_route_id == MSG_ROUTING_NONE) {
+    params->visual_properties = GetWidget()->GetVisualProperties();
+    GetWidget()->SetInitialVisualProperties(params->visual_properties);
+  }
 
   // The RenderView is owned by this process. This call must be accompanied by a
   // DestroyView [see destructor] or else there will be a leak in the renderer
@@ -400,18 +408,25 @@ void RenderViewHostImpl::SetMainFrameRoutingId(int routing_id) {
   GetWidget()->UpdatePriority();
 }
 
+void RenderViewHostImpl::EnterBackForwardCache() {
+  FrameTree* frame_tree = GetDelegate()->GetFrameTree();
+  frame_tree->UnregisterRenderViewHost(this);
+  is_in_back_forward_cache_ = true;
+}
+
+void RenderViewHostImpl::LeaveBackForwardCache() {
+  FrameTree* frame_tree = GetDelegate()->GetFrameTree();
+  // At this point, the frames |this| RenderViewHostImpl belongs to are
+  // guaranteed to be committed, so it should be reused going forward.
+  frame_tree->RegisterRenderViewHost(this);
+  is_in_back_forward_cache_ = false;
+}
+
 bool RenderViewHostImpl::IsRenderViewLive() {
   return GetProcess()->IsInitializedAndNotDead() &&
          GetWidget()->renderer_initialized();
 }
 
-void RenderViewHostImpl::SyncRendererPrefs() {
-  blink::mojom::RendererPreferences renderer_preferences =
-      delegate_->GetRendererPrefs(GetProcess()->GetBrowserContext());
-  GetPlatformSpecificPrefs(&renderer_preferences);
-  Send(new ViewMsg_SetRendererPrefs(GetRoutingID(), renderer_preferences));
-}
-
 void RenderViewHostImpl::SetBackgroundOpaque(bool opaque) {
   Send(new ViewMsg_SetBackgroundOpaque(GetRoutingID(), opaque));
 }
@@ -749,8 +764,8 @@ RenderFrameHost* RenderViewHostImpl::GetMainFrame() {
   // TODO(alexmos, creis): Migrate these code paths to use RenderFrameHost APIs
   // and remove this fallback.  See https://crbug.com/763548.
   if (is_active()) {
-    return RenderFrameHost::FromID(GetProcess()->GetID(),
-                                   main_frame_routing_id_);
+    return RenderFrameHostImpl::FromID(GetProcess()->GetID(),
+                                       main_frame_routing_id_);
   }
   return delegate_->GetPendingMainFrame();
 }
@@ -787,10 +802,6 @@ void RenderViewHostImpl::RenderWidgetDidFirstVisuallyNonEmptyPaint() {
   delegate_->DidFirstVisuallyNonEmptyPaint(this);
 }
 
-void RenderViewHostImpl::RenderWidgetDidCommitAndDrawCompositorFrame() {
-  delegate_->DidCommitAndDrawCompositorFrame(this);
-}
-
 bool RenderViewHostImpl::SuddenTerminationAllowed() const {
   return sudden_termination_allowed_;
 }
@@ -853,16 +864,18 @@ void RenderViewHostImpl::RenderWidgetDidClose() {
   ClosePageIgnoringUnloadEvents();
 }
 
-void RenderViewHostImpl::CreateNewWidget(int32_t widget_route_id,
-                                         mojom::WidgetPtr widget) {
+void RenderViewHostImpl::CreateNewWidget(
+    int32_t widget_route_id,
+    mojo::PendingRemote<mojom::Widget> widget) {
   delegate_->CreateNewWidget(GetProcess()->GetID(), widget_route_id,
-                             std::move(widget));
+                             std::move(widget), this);
 }
 
-void RenderViewHostImpl::CreateNewFullscreenWidget(int32_t widget_route_id,
-                                                   mojom::WidgetPtr widget) {
+void RenderViewHostImpl::CreateNewFullscreenWidget(
+    int32_t widget_route_id,
+    mojo::PendingRemote<mojom::Widget> widget) {
   delegate_->CreateNewFullscreenWidget(GetProcess()->GetID(), widget_route_id,
-                                       std::move(widget));
+                                       std::move(widget), this);
 }
 
 void RenderViewHostImpl::OnShowWidget(int widget_route_id,
@@ -982,7 +995,13 @@ void RenderViewHostImpl::OnWebkitPreferencesChanged() {
   updating_web_preferences_ = true;
   UpdateWebkitPreferences(ComputeWebPreferences());
 #if defined(OS_ANDROID)
-  GetWidget()->SetForceEnableZoom(web_preferences_->force_enable_zoom);
+  for (FrameTreeNode* node : GetDelegate()->GetFrameTree()->Nodes()) {
+    RenderFrameHostImpl* rfh = node->current_frame_host();
+    if (rfh->is_local_root()) {
+      if (auto* rwh = rfh->GetRenderWidgetHost())
+        rwh->SetForceEnableZoom(web_preferences_->force_enable_zoom);
+    }
+  }
 #endif
   updating_web_preferences_ = false;
 }
@@ -1000,7 +1019,8 @@ void RenderViewHostImpl::EnablePreferredSizeMode() {
 }
 
 void RenderViewHostImpl::ExecutePluginActionAtLocation(
-  const gfx::Point& location, const blink::WebPluginAction& action) {
+    const gfx::Point& location,
+    const blink::PluginAction& action) {
   // TODO(wjmaclean): See if this needs to be done for OOPIFs as well.
   // https://crbug.com/776807
   gfx::PointF local_location_f =
diff --git a/chromium/content/browser/renderer_host/render_view_host_impl.h b/chromium/content/browser/renderer_host/render_view_host_impl.h
index 1a98f40d1c7..170e94a1403 100644
--- a/chromium/content/browser/renderer_host/render_view_host_impl.h
+++ b/chromium/content/browser/renderer_host/render_view_host_impl.h
@@ -29,6 +29,7 @@
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/browser/render_view_host.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/load_states.h"
 #include "third_party/blink/public/web/web_ax_enums.h"
 #include "third_party/blink/public/web/web_console_message.h"
@@ -76,6 +77,9 @@ class CONTENT_EXPORT RenderViewHostImpl
   // Convenience function, just like RenderViewHost::From.
   static RenderViewHostImpl* From(RenderWidgetHost* rwh);
 
+  static void GetPlatformSpecificPrefs(
+      blink::mojom::RendererPreferences* prefs);
+
   RenderViewHostImpl(SiteInstance* instance,
                      std::unique_ptr<RenderWidgetHostImpl> widget,
                      RenderViewHostDelegate* delegate,
@@ -93,14 +97,13 @@ class CONTENT_EXPORT RenderViewHostImpl
   void EnablePreferredSizeMode() override;
   void ExecutePluginActionAtLocation(
       const gfx::Point& location,
-      const blink::WebPluginAction& action) override;
+      const blink::PluginAction& action) override;
   RenderViewHostDelegate* GetDelegate() override;
   SiteInstanceImpl* GetSiteInstance() override;
   bool IsRenderViewLive() override;
   void NotifyMoveOrResizeStarted() override;
   void SetWebUIProperty(const std::string& name,
                         const std::string& value) override;
-  void SyncRendererPrefs() override;
   WebPreferences GetWebkitPreferences() override;
   void UpdateWebkitPreferences(const WebPreferences& prefs) override;
   void OnWebkitPreferencesChanged() override;
@@ -180,10 +183,12 @@ class CONTENT_EXPORT RenderViewHostImpl
   }
 
   // Creates a new RenderWidget with the given route id.
-  void CreateNewWidget(int32_t route_id, mojom::WidgetPtr widget);
+  void CreateNewWidget(int32_t route_id,
+                       mojo::PendingRemote<mojom::Widget> widget);
 
   // Creates a full screen RenderWidget.
-  void CreateNewFullscreenWidget(int32_t route_id, mojom::WidgetPtr widget);
+  void CreateNewFullscreenWidget(int32_t route_id,
+                                 mojo::PendingRemote<mojom::Widget> widget);
 
   // Send RenderViewReady to observers once the process is launched, but not
   // re-entrantly.
@@ -199,6 +204,15 @@ class CONTENT_EXPORT RenderViewHostImpl
   // view is not considered active.
   void SetMainFrameRoutingId(int routing_id);
 
+  // Called when the RenderFrameHostImpls/RenderFrameProxyHosts that own this
+  // RenderViewHost enter the BackForwardCache.
+  void EnterBackForwardCache();
+
+  // Called when the RenderFrameHostImpls/RenderFrameProxyHosts that own this
+  // RenderViewHost leave the BackForwardCache. This occurs immediately before a
+  // restored document is committed.
+  void LeaveBackForwardCache();
+
   // Called during frame eviction to return all SurfaceIds in the frame tree.
   // Marks all views in the frame tree as evicted.
   std::vector<viz::SurfaceId> CollectSurfaceIdsForEviction();
@@ -219,7 +233,6 @@ class CONTENT_EXPORT RenderViewHostImpl
   void RenderWidgetDidInit() override;
   void RenderWidgetDidClose() override;
   void RenderWidgetDidFirstVisuallyNonEmptyPaint() override;
-  void RenderWidgetDidCommitAndDrawCompositorFrame() override;
   void RenderWidgetGotFocus() override;
   void RenderWidgetLostFocus() override;
   void RenderWidgetDidForwardMouseEvent(
@@ -233,6 +246,7 @@ class CONTENT_EXPORT RenderViewHostImpl
   bool IsNeverVisible() override;
   WebPreferences GetWebkitPreferencesForWidget() override;
   FrameTreeNode* GetFocusedFrame() override;
+
   void ShowContextMenu(RenderFrameHost* render_frame_host,
                        const ContextMenuParams& params) override;
 
@@ -321,10 +335,10 @@ class CONTENT_EXPORT RenderViewHostImpl
   // Set to true when waiting for a ViewHostMsg_ClosePageACK.
   // TODO(creis): Move to RenderFrameHost and RenderWidgetHost.
   // See http://crbug.com/418265.
-  bool is_waiting_for_close_ack_;
+  bool is_waiting_for_close_ack_ = false;
 
   // True if the render view can be shut down suddenly.
-  bool sudden_termination_allowed_;
+  bool sudden_termination_allowed_ = false;
 
   // This is updated every time UpdateWebkitPreferences is called. That method
   // is in turn called when any of the settings change that the WebPreferences
@@ -340,14 +354,17 @@ class CONTENT_EXPORT RenderViewHostImpl
   // This monitors input changes so they can be reflected to the interaction MQ.
   std::unique_ptr<InputDeviceChangeObserver> input_device_change_observer_;
 
-  bool updating_web_preferences_;
+  bool updating_web_preferences_ = false;
 
   // This tracks whether this RenderViewHost has notified observers about its
   // creation with RenderViewCreated.  RenderViewHosts may transition from
   // active (with a RenderFrameHost for the main frame) to inactive state and
   // then back to active, and for the latter transition, this avoids firing
   // duplicate RenderViewCreated events.
-  bool has_notified_about_creation_;
+  bool has_notified_about_creation_ = false;
+
+  // BackForwardCache:
+  bool is_in_back_forward_cache_ = false;
 
   base::WeakPtrFactory<RenderViewHostImpl> weak_factory_{this};
 
diff --git a/chromium/content/browser/renderer_host/render_view_host_unittest.cc b/chromium/content/browser/renderer_host/render_view_host_unittest.cc
index ddb920aa7bc..f571c6d1e9e 100644
--- a/chromium/content/browser/renderer_host/render_view_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_view_host_unittest.cc
@@ -21,6 +21,7 @@
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/drop_data.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/mock_render_process_host.h"
@@ -30,6 +31,7 @@
 #include "content/test/test_content_browser_client.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/filename_util.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
 #include "ui/base/page_transition_types.h"
@@ -84,9 +86,9 @@ TEST_F(RenderViewHostTest, FilterAbout) {
 TEST_F(RenderViewHostTest, CreateFullscreenWidget) {
   int32_t routing_id = process()->GetNextRoutingID();
 
-  mojom::WidgetPtr widget;
+  mojo::PendingRemote<mojom::Widget> widget;
   std::unique_ptr<MockWidgetImpl> widget_impl =
-      std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+      std::make_unique<MockWidgetImpl>(widget.InitWithNewPipeAndPassReceiver());
   test_rvh()->CreateNewFullscreenWidget(routing_id, std::move(widget));
 }
 
@@ -273,72 +275,4 @@ TEST_F(RenderViewHostTest, RoutingIdSane) {
   EXPECT_NE(test_rvh()->GetRoutingID(), root_rfh->routing_id());
 }
 
-class TestSaveImageFromDataURL : public RenderFrameMessageFilter {
- public:
-  TestSaveImageFromDataURL(BrowserContext* context)
-      : RenderFrameMessageFilter(
-            0,
-            nullptr,
-            context,
-            BrowserContext::GetDefaultStoragePartition(context),
-            nullptr) {
-    Reset();
-  }
-
-  void Reset() {
-    url_string_ = std::string();
-    is_downloaded_ = false;
-  }
-
-  std::string& UrlString() const {
-    return url_string_;
-  }
-
-  bool IsDownloaded() const {
-    return is_downloaded_;
-  }
-
-  void Test(const std::string& url) {
-    OnMessageReceived(FrameHostMsg_SaveImageFromDataURL(0, 0, url));
-  }
-
- protected:
-  ~TestSaveImageFromDataURL() override {}
-  void DownloadUrl(int render_view_id,
-                   int render_frame_id,
-                   const GURL& url,
-                   const Referrer& referrer,
-                   const url::Origin& initiator,
-                   const base::string16& suggested_name,
-                   const bool use_prompt,
-                   const bool follow_cross_origin_redirects,
-                   mojo::PendingRemote<blink::mojom::BlobURLToken>
-                       blob_url_token) const override {
-    url_string_ = url.spec();
-    is_downloaded_ = true;
-  }
-
- private:
-  mutable std::string url_string_;
-  mutable bool is_downloaded_;
-};
-
-TEST_F(RenderViewHostTest, SaveImageFromDataURL) {
-  scoped_refptr<TestSaveImageFromDataURL> tester(
-      new TestSaveImageFromDataURL(browser_context()));
-
-  tester->Reset();
-  tester->Test("http://non-data-url.com");
-  EXPECT_EQ(tester->UrlString(), "");
-  EXPECT_FALSE(tester->IsDownloaded());
-
-  const std::string data_url = "data:image/gif;base64,"
-      "R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs=";
-
-  tester->Reset();
-  tester->Test(data_url);
-  EXPECT_EQ(tester->UrlString(), data_url);
-  EXPECT_TRUE(tester->IsDownloaded());
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_helper.cc b/chromium/content/browser/renderer_host/render_widget_helper.cc
index d711d4e4789..53abb69a65e 100644
--- a/chromium/content/browser/renderer_host/render_widget_helper.cc
+++ b/chromium/content/browser/renderer_host/render_widget_helper.cc
@@ -65,31 +65,32 @@ RenderWidgetHelper* RenderWidgetHelper::FromProcessHostID(
   return (ci == g_widget_helpers.Get().end())? NULL : ci->second;
 }
 
-void RenderWidgetHelper::CreateNewWidget(int opener_id,
-                                         mojom::WidgetPtr widget,
-                                         int* route_id) {
+void RenderWidgetHelper::CreateNewWidget(
+    int opener_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    int* route_id) {
   *route_id = GetNextRoutingID();
 
   base::PostTask(FROM_HERE, {BrowserThread::UI},
                  base::BindOnce(&RenderWidgetHelper::OnCreateWidgetOnUI, this,
-                                opener_id, *route_id, widget.PassInterface()));
+                                opener_id, *route_id, std::move(widget)));
 }
 
-void RenderWidgetHelper::CreateNewFullscreenWidget(int opener_id,
-                                                   mojom::WidgetPtr widget,
-                                                   int* route_id) {
+void RenderWidgetHelper::CreateNewFullscreenWidget(
+    int opener_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    int* route_id) {
   *route_id = GetNextRoutingID();
   base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&RenderWidgetHelper::OnCreateFullscreenWidgetOnUI, this,
-                     opener_id, *route_id, widget.PassInterface()));
+                     opener_id, *route_id, std::move(widget)));
 }
 
-void RenderWidgetHelper::OnCreateWidgetOnUI(int32_t opener_id,
-                                            int32_t route_id,
-                                            mojom::WidgetPtrInfo widget_info) {
-  mojom::WidgetPtr widget;
-  widget.Bind(std::move(widget_info));
+void RenderWidgetHelper::OnCreateWidgetOnUI(
+    int32_t opener_id,
+    int32_t route_id,
+    mojo::PendingRemote<mojom::Widget> widget) {
   RenderViewHostImpl* host = RenderViewHostImpl::FromID(
       render_process_id_, opener_id);
   if (host)
@@ -99,9 +100,7 @@ void RenderWidgetHelper::OnCreateWidgetOnUI(int32_t opener_id,
 void RenderWidgetHelper::OnCreateFullscreenWidgetOnUI(
     int32_t opener_id,
     int32_t route_id,
-    mojom::WidgetPtrInfo widget_info) {
-  mojom::WidgetPtr widget;
-  widget.Bind(std::move(widget_info));
+    mojo::PendingRemote<mojom::Widget> widget) {
   RenderViewHostImpl* host = RenderViewHostImpl::FromID(
       render_process_id_, opener_id);
   if (host)
diff --git a/chromium/content/browser/renderer_host/render_widget_helper.h b/chromium/content/browser/renderer_host/render_widget_helper.h
index d38ca90c3dd..a6c7da7092d 100644
--- a/chromium/content/browser/renderer_host/render_widget_helper.h
+++ b/chromium/content/browser/renderer_host/render_widget_helper.h
@@ -18,6 +18,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/global_request_id.h"
 #include "content/public/common/widget_type.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "ui/gfx/native_widget_types.h"
 
 namespace content {
@@ -46,10 +47,10 @@ class RenderWidgetHelper
 
   // IO THREAD ONLY -----------------------------------------------------------
   void CreateNewWidget(int opener_id,
-                       mojom::WidgetPtr,
+                       mojo::PendingRemote<mojom::Widget>,
                        int* route_id);
   void CreateNewFullscreenWidget(int opener_id,
-                                 mojom::WidgetPtr,
+                                 mojo::PendingRemote<mojom::Widget>,
                                  int* route_id);
 
  private:
@@ -62,12 +63,12 @@ class RenderWidgetHelper
   // Called on the UI thread to finish creating a widget.
   void OnCreateWidgetOnUI(int32_t opener_id,
                           int32_t route_id,
-                          mojom::WidgetPtrInfo widget);
+                          mojo::PendingRemote<mojom::Widget> widget);
 
   // Called on the UI thread to create a fullscreen widget.
   void OnCreateFullscreenWidgetOnUI(int32_t opener_id,
                                     int32_t route_id,
-                                    mojom::WidgetPtrInfo widget);
+                                    mojo::PendingRemote<mojom::Widget> widget);
 
   int render_process_id_;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
index 2ed69783307..446aec1af8f 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_browsertest.cc
@@ -45,7 +45,6 @@ class RenderWidgetHostSitePerProcessTest : public ContentBrowserTest {
  public:
   void SetUpCommandLine(base::CommandLine* command_line) override {
     ContentBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
     IsolateAllSitesForTesting(command_line);
   }
 
@@ -123,11 +122,6 @@ class RenderWidgetHostTouchEmulatorBrowserTest : public ContentBrowserTest {
     ASSERT_TRUE(router_);
   }
 
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    ContentBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
-  }
-
   base::TimeTicks GetNextSimulatedEventTime() {
     last_simulated_event_time_ += simulated_event_time_delta_;
     return last_simulated_event_time_;
diff --git a/chromium/content/browser/renderer_host/render_widget_host_delegate.cc b/chromium/content/browser/renderer_host/render_widget_host_delegate.cc
index 03f964a33bb..74637924d87 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_delegate.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_delegate.cc
@@ -22,6 +22,11 @@ bool RenderWidgetHostDelegate::PreHandleMouseEvent(
   return false;
 }
 
+bool RenderWidgetHostDelegate::HandleMouseEvent(
+    const blink::WebMouseEvent& event) {
+  return false;
+}
+
 bool RenderWidgetHostDelegate::HandleWheelEvent(
     const blink::WebMouseWheelEvent& event) {
   return false;
@@ -82,9 +87,9 @@ bool RenderWidgetHostDelegate::ShouldShowStaleContentOnEviction() {
   return false;
 }
 
-blink::WebDisplayMode RenderWidgetHostDelegate::GetDisplayMode(
+blink::mojom::DisplayMode RenderWidgetHostDelegate::GetDisplayMode(
     RenderWidgetHostImpl* render_widget_host) const {
-  return blink::kWebDisplayModeBrowser;
+  return blink::mojom::DisplayMode::kBrowser;
 }
 
 bool RenderWidgetHostDelegate::HasMouseLock(
diff --git a/chromium/content/browser/renderer_host/render_widget_host_delegate.h b/chromium/content/browser/renderer_host/render_widget_host_delegate.h
index d073e85d72d..f766dc15867 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_delegate.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_delegate.h
@@ -17,8 +17,8 @@
 #include "content/common/drag_event_source_info.h"
 #include "content/public/common/drop_data.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
 #include "third_party/blink/public/platform/web_input_event.h"
 #include "ui/gfx/native_widget_types.h"
@@ -48,7 +48,6 @@ class RenderViewHostDelegateView;
 class TextInputManager;
 class WebContents;
 enum class KeyboardEventProcessingResult;
-struct ScreenInfo;
 struct NativeWebKeyboardEvent;
 
 //
@@ -86,7 +85,6 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
 
   // The RenderWidget was resized.
   virtual void RenderWidgetWasResized(RenderWidgetHostImpl* render_widget_host,
-                                      const ScreenInfo& screen_info,
                                       bool width_changed) {}
 
   // The contents auto-resized and the container should match it.
@@ -108,6 +106,11 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
 
   // Callback to inform the browser that the renderer did not process the
   // specified events. This gives an opportunity to the browser to process the
+  // back/forward mouse buttons.
+  virtual bool HandleMouseEvent(const blink::WebMouseEvent& event);
+
+  // Callback to inform the browser that the renderer did not process the
+  // specified events. This gives an opportunity to the browser to process the
   // event (used for keyboard shortcuts).
   virtual bool HandleKeyboardEvent(const NativeWebKeyboardEvent& event);
 
@@ -213,7 +216,7 @@ class CONTENT_EXPORT RenderWidgetHostDelegate {
   virtual bool ShouldShowStaleContentOnEviction();
 
   // Returns the display mode for the view.
-  virtual blink::WebDisplayMode GetDisplayMode(
+  virtual blink::mojom::DisplayMode GetDisplayMode(
       RenderWidgetHostImpl* render_widget_host) const;
 
   // Notification that the widget has lost capture.
diff --git a/chromium/content/browser/renderer_host/render_widget_host_factory.cc b/chromium/content/browser/renderer_host/render_widget_host_factory.cc
index bae880134e2..db3617ceee2 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_factory.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_factory.cc
@@ -16,7 +16,7 @@ std::unique_ptr<RenderWidgetHostImpl> RenderWidgetHostFactory::Create(
     RenderWidgetHostDelegate* delegate,
     RenderProcessHost* process,
     int32_t routing_id,
-    mojom::WidgetPtr widget_interface,
+    mojo::PendingRemote<mojom::Widget> widget_interface,
     bool hidden) {
   if (factory_) {
     return factory_->CreateRenderWidgetHost(
diff --git a/chromium/content/browser/renderer_host/render_widget_host_factory.h b/chromium/content/browser/renderer_host/render_widget_host_factory.h
index e197d53a927..1032e4a45b0 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_factory.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_factory.h
@@ -11,6 +11,7 @@
 #include "base/macros.h"
 #include "content/common/content_export.h"
 #include "content/common/widget.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 
 namespace content {
 class RenderProcessHost;
@@ -29,7 +30,7 @@ class RenderWidgetHostFactory {
       RenderWidgetHostDelegate* delegate,
       RenderProcessHost* process,
       int32_t routing_id,
-      mojom::WidgetPtr widget_interface,
+      mojo::PendingRemote<mojom::Widget> widget_interface,
       bool hidden);
 
   // Returns true if there is currently a globally-registered factory.
@@ -45,7 +46,7 @@ class RenderWidgetHostFactory {
       RenderWidgetHostDelegate* delegate,
       RenderProcessHost* process,
       int32_t routing_id,
-      mojom::WidgetPtr widget_interface,
+      mojo::PendingRemote<mojom::Widget> widget_interface,
       bool hidden) = 0;
 
   // Registers your factory to be called when new RenderWidgetHostImpls are
diff --git a/chromium/content/browser/renderer_host/render_widget_host_impl.cc b/chromium/content/browser/renderer_host/render_widget_host_impl.cc
index e9e0afaa606..f9635e901a9 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_impl.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_impl.cc
@@ -340,11 +340,12 @@ base::LazyInstance<UnboundWidgetInputHandler>::Leaky g_unbound_input_handler =
 ///////////////////////////////////////////////////////////////////////////////
 // RenderWidgetHostImpl
 
-RenderWidgetHostImpl::RenderWidgetHostImpl(RenderWidgetHostDelegate* delegate,
-                                           RenderProcessHost* process,
-                                           int32_t routing_id,
-                                           mojom::WidgetPtr widget,
-                                           bool hidden)
+RenderWidgetHostImpl::RenderWidgetHostImpl(
+    RenderWidgetHostDelegate* delegate,
+    RenderProcessHost* process,
+    int32_t routing_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    bool hidden)
     : delegate_(delegate),
       process_(process),
       routing_id_(routing_id),
@@ -354,7 +355,7 @@ RenderWidgetHostImpl::RenderWidgetHostImpl(RenderWidgetHostDelegate* delegate,
       hung_renderer_delay_(TimeDelta::FromMilliseconds(kHungRendererDelayMs)),
       new_content_rendering_delay_(
           TimeDelta::FromMilliseconds(kNewContentRenderingDelayMs)),
-      compositor_frame_sink_binding_(this),
+      compositor_frame_sink_receiver_(this),
       frame_token_message_queue_(
           std::make_unique<FrameTokenMessageQueue>(this)),
       render_frame_metadata_provider_(
@@ -402,8 +403,8 @@ RenderWidgetHostImpl::RenderWidgetHostImpl(RenderWidgetHostDelegate* delegate,
 
   if (!command_line->HasSwitch(switches::kDisableNewContentRenderingTimeout)) {
     new_content_rendering_timeout_ = std::make_unique<TimeoutMonitor>(
-        base::Bind(&RenderWidgetHostImpl::ClearDisplayedGraphics,
-                   weak_factory_.GetWeakPtr()));
+        base::BindRepeating(&RenderWidgetHostImpl::ClearDisplayedGraphics,
+                            weak_factory_.GetWeakPtr()));
   }
 
   enable_viz_ = features::IsVizDisplayCompositorEnabled();
@@ -645,8 +646,6 @@ bool RenderWidgetHostImpl::OnMessageReceived(const IPC::Message &msg) {
                         OnForceRedrawComplete)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_DidFirstVisuallyNonEmptyPaint,
                         OnFirstVisuallyNonEmptyPaint)
-    IPC_MESSAGE_HANDLER(WidgetHostMsg_DidCommitAndDrawCompositorFrame,
-                        OnCommitAndDrawCompositorFrame)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_HasTouchEventHandlers,
                         OnHasTouchEventHandlers)
     IPC_MESSAGE_HANDLER(WidgetHostMsg_IntrinsicSizingInfoChanged,
@@ -763,12 +762,34 @@ void RenderWidgetHostImpl::SetImportance(ChildProcessImportance importance) {
   importance_ = importance;
   process_->UpdateClientPriority(this);
 }
+
+void RenderWidgetHostImpl::OnImeTextCommittedEvent(
+    const base::string16& text_str) {
+  for (auto& observer : ime_text_committed_observers_) {
+    observer.OnImeTextCommittedEvent(text_str);
+  }
+}
+
+void RenderWidgetHostImpl::AddImeTextCommittedEventObserver(
+    RenderWidgetHost::InputEventObserver* observer) {
+  if (!ime_text_committed_observers_.HasObserver(observer)) {
+    ime_text_committed_observers_.AddObserver(observer);
+  }
+}
+
+void RenderWidgetHostImpl::RemoveImeTextCommittedEventObserver(
+    RenderWidgetHost::InputEventObserver* observer) {
+  ime_text_committed_observers_.RemoveObserver(observer);
+}
 #endif
 
 VisualProperties RenderWidgetHostImpl::GetVisualProperties() {
   // This is only called while the RenderWidgetHost is attached to a delegate
   // still.
   DCHECK(delegate_);
+  // When the renderer process is gone, there's no need for VisualProperties
+  // which are to be sent to the renderer process.
+  DCHECK(view_);
 
   VisualProperties visual_properties;
 
@@ -807,29 +828,25 @@ VisualProperties RenderWidgetHostImpl::GetVisualProperties() {
   visual_properties.page_scale_factor = page_scale_factor_;
   visual_properties.is_pinch_gesture_active = is_pinch_gesture_active_;
 
-  if (view_) {
-    visual_properties.new_size = view_->GetRequestedRendererSize();
-    visual_properties.capture_sequence_number =
-        view_->GetCaptureSequenceNumber();
-    // For OOPIFs, use the compositor viewport received from the FrameConnector.
-    visual_properties.compositor_viewport_pixel_rect =
-        view_->IsRenderWidgetHostViewChildFrame() &&
-                !view_->IsRenderWidgetHostViewGuest()
-            ? gfx::ScaleToEnclosingRect(
-                  compositor_viewport_,
-                  IsUseZoomForDSFEnabled()
-                      ? 1.f
-                      : visual_properties.screen_info.device_scale_factor)
-            : gfx::Rect(view_->GetCompositorViewportPixelSize());
-    visual_properties.visible_viewport_size = view_->GetVisibleViewportSize();
-    // TODO(ccameron): GetLocalSurfaceId is not synchronized with the device
-    // scale factor of the surface. Fix this.
-    viz::LocalSurfaceIdAllocation local_surface_id_allocation =
-        view_->GetLocalSurfaceIdAllocation();
-    if (local_surface_id_allocation.IsValid()) {
-      visual_properties.local_surface_id_allocation =
-          local_surface_id_allocation;
-    }
+  visual_properties.new_size = view_->GetRequestedRendererSize();
+  visual_properties.capture_sequence_number = view_->GetCaptureSequenceNumber();
+  // For OOPIFs, use the compositor viewport received from the FrameConnector.
+  visual_properties.compositor_viewport_pixel_rect =
+      view_->IsRenderWidgetHostViewChildFrame() &&
+              !view_->IsRenderWidgetHostViewGuest()
+          ? gfx::ScaleToEnclosingRect(
+                compositor_viewport_,
+                IsUseZoomForDSFEnabled()
+                    ? 1.f
+                    : visual_properties.screen_info.device_scale_factor)
+          : gfx::Rect(view_->GetCompositorViewportPixelSize());
+  visual_properties.visible_viewport_size = view_->GetVisibleViewportSize();
+  // TODO(ccameron): GetLocalSurfaceId is not synchronized with the device
+  // scale factor of the surface. Fix this.
+  viz::LocalSurfaceIdAllocation local_surface_id_allocation =
+      view_->GetLocalSurfaceIdAllocation();
+  if (local_surface_id_allocation.IsValid()) {
+    visual_properties.local_surface_id_allocation = local_surface_id_allocation;
   }
 
   if (screen_orientation_type_for_testing_) {
@@ -864,6 +881,25 @@ void RenderWidgetHostImpl::SynchronizeVisualPropertiesIgnoringPendingAck() {
 
 bool RenderWidgetHostImpl::SynchronizeVisualProperties(
     bool scroll_focused_node_into_view) {
+  // If the RenderViewHost is inactive, then there is no RenderWidget that can
+  // receive visual properties yet, even though we are setting them on the
+  // browser side. Wait until the RenderWidget is not undead before sending the
+  // visual properties.
+  //
+  // When the RenderViewHost becomes active, a SynchronizeVisualProperties()
+  // call does not explicitly get made. That is because RenderWidgets for frames
+  // are created and initialized with a valid VisualProperties already, and once
+  // their initial navigation completes (and they are in the foreground) the
+  // RenderWidget will be shown, which means a VisualProperties update happens
+  // at the time where compositing begins.
+  //
+  // Note that this drops |scroll_focused_node_into_view| but this value does
+  // not make sense for an inactive RenderViewHost's top level RenderWidgetHost,
+  // because there is no frames associated with the RenderWidget when it is
+  // inactive, so there is no focused node, or anything to scroll and display.
+  if (owner_delegate_ && !owner_delegate_->IsMainFrameActive())
+    return false;
+
   // Skip if the |delegate_| has already been detached because
   // it's web contents is being deleted, or if LocalSurfaceIdAllocation is
   // suppressed, as we are first updating our internal state from a child's
@@ -884,68 +920,45 @@ bool RenderWidgetHostImpl::SynchronizeVisualProperties(
   visual_properties->scroll_focused_node_into_view =
       scroll_focused_node_into_view;
 
-  ScreenInfo screen_info = visual_properties->screen_info;
-  bool width_changed =
-      !old_visual_properties_ || old_visual_properties_->new_size.width() !=
-                                     visual_properties->new_size.width();
   bool visible_viewport_size_changed =
       !old_visual_properties_ ||
       old_visual_properties_->visible_viewport_size !=
           visual_properties->visible_viewport_size;
 
-  // TODO(jonross): Enable on ChromeOS once blocking mus bugs are fixed:
-  // https://crbug.com/920642 https://crbug.com/920006
-  // TODO(jonross): Enable on Android once root cause of crash is found and
-  // fixed: https://crbug.com/923742
-#if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
-  // When the size has changed, we must ensure that there is a new, updated
-  // viz::LocalSurfaceId. Otherwise we encounter Surface Invariants Violation at
-  // the time of frame submission. Check for this violation here in order to
-  // detect the source of the bug.
-  if (old_visual_properties_ &&
-      old_visual_properties_->new_size != visual_properties->new_size &&
-      old_visual_properties_->local_surface_id_allocation &&
-      visual_properties->local_surface_id_allocation) {
-    // We suspect that we may not be updating viz::LocalSurfaceIds correctly
-    // when auto-resize is enabled. Logging this additional information to
-    // confirm if that is the case. https://crbug.com/900948
-    CHECK_NE(old_visual_properties_->local_surface_id_allocation.value(),
-             visual_properties->local_surface_id_allocation.value())
-        << "Invalid Surface Id State: size changed without a change in "
-           "LocalSurfaceId: auto_resize_enabled "
-        << visual_properties->auto_resize_enabled << " old "
-        << old_visual_properties_->local_surface_id_allocation->ToString()
-        << " new "
-        << visual_properties->local_surface_id_allocation->ToString();
-  }
-#endif
+  Send(new WidgetMsg_UpdateVisualProperties(routing_id_, *visual_properties));
 
-  bool sent_visual_properties = false;
-  if (Send(new WidgetMsg_SynchronizeVisualProperties(routing_id_,
-                                                     *visual_properties))) {
-    TRACE_EVENT_WITH_FLOW2(
-        TRACE_DISABLED_BY_DEFAULT("viz.surface_id_flow"),
-        "RenderWidgetHostImpl::SynchronizeVisualProperties send message",
-        visual_properties->local_surface_id_allocation->local_surface_id()
-            .submission_trace_id(),
-        TRACE_EVENT_FLAG_FLOW_OUT, "message",
-        "WidgetMsg_SynchronizeVisualProperties", "local_surface_id",
-        visual_properties->local_surface_id_allocation->local_surface_id()
-            .ToString());
-    visual_properties_ack_pending_ =
-        DoesVisualPropertiesNeedAck(old_visual_properties_, *visual_properties);
-    if (delegate() && visible_viewport_size_changed) {
-      delegate()->NotifyVisibleViewportSizeChanged(
-          visual_properties->visible_viewport_size);
-    }
-    old_visual_properties_.swap(visual_properties);
-    sent_visual_properties = true;
+  // TODO(danakj): All visual properties should go through
+  // WidgetMsg_UpdateVisualProperties in order to be synchronized by the
+  // LocalSurfaceIdAllocation which synchronizes in the display compositor for
+  // a global atomic screen update across all frame widgets. This should move.
+  if (delegate() && visible_viewport_size_changed) {
+    delegate()->NotifyVisibleViewportSizeChanged(
+        visual_properties->visible_viewport_size);
   }
 
-  if (delegate_)
-    delegate_->RenderWidgetWasResized(this, screen_info, width_changed);
+  bool width_changed =
+      !old_visual_properties_ || old_visual_properties_->new_size.width() !=
+                                     visual_properties->new_size.width();
+  TRACE_EVENT_WITH_FLOW2(
+      TRACE_DISABLED_BY_DEFAULT("viz.surface_id_flow"),
+      "RenderWidgetHostImpl::SynchronizeVisualProperties send message",
+      visual_properties->local_surface_id_allocation->local_surface_id()
+          .submission_trace_id(),
+      TRACE_EVENT_FLAG_FLOW_OUT, "message",
+      "WidgetMsg_SynchronizeVisualProperties", "local_surface_id",
+      visual_properties->local_surface_id_allocation->local_surface_id()
+          .ToString());
+  visual_properties_ack_pending_ =
+      DoesVisualPropertiesNeedAck(old_visual_properties_, *visual_properties);
+  old_visual_properties_ = std::move(visual_properties);
 
-  return sent_visual_properties;
+  // Warning: |visual_properties| invalid after this point.
+
+  if (delegate_) {
+    delegate_->RenderWidgetWasResized(this, width_changed);
+  }
+
+  return true;
 }
 
 void RenderWidgetHostImpl::GotFocus() {
@@ -1490,6 +1503,17 @@ void RenderWidgetHostImpl::EnsureReadyForSyntheticGestures(
   }
 }
 
+void RenderWidgetHostImpl::TakeSyntheticGestureController(
+    RenderWidgetHostImpl* host) {
+  DCHECK(!synthetic_gesture_controller_);
+  if (host->synthetic_gesture_controller_) {
+    synthetic_gesture_controller_ =
+        std::move(host->synthetic_gesture_controller_);
+    synthetic_gesture_controller_->UpdateSyntheticGestureTarget(
+        view_->CreateSyntheticGestureTarget(), this);
+  }
+}
+
 void RenderWidgetHostImpl::SetCursor(const WebCursor& cursor) {
   if (!view_)
     return;
@@ -1716,12 +1740,12 @@ void RenderWidgetHostImpl::NotifyScreenInfoChanged() {
 }
 
 void RenderWidgetHostImpl::GetSnapshotFromBrowser(
-    const GetSnapshotFromBrowserCallback& callback,
+    GetSnapshotFromBrowserCallback callback,
     bool from_surface) {
   int snapshot_id = next_browser_snapshot_id_++;
   if (from_surface) {
     pending_surface_browser_snapshots_.insert(
-        std::make_pair(snapshot_id, callback));
+        std::make_pair(snapshot_id, std::move(callback)));
     Send(new WidgetMsg_ForceRedraw(GetRoutingID(), snapshot_id));
     return;
   }
@@ -1734,7 +1758,8 @@ void RenderWidgetHostImpl::GetSnapshotFromBrowser(
     GetWakeLock()->RequestWakeLock();
 #endif
   // TODO(nzolghadr): Remove the duplication here and the if block just above.
-  pending_browser_snapshots_.insert(std::make_pair(snapshot_id, callback));
+  pending_browser_snapshots_.insert(
+      std::make_pair(snapshot_id, std::move(callback)));
   Send(new WidgetMsg_ForceRedraw(GetRoutingID(), snapshot_id));
 }
 
@@ -1846,11 +1871,6 @@ void RenderWidgetHostImpl::OnFirstVisuallyNonEmptyPaint() {
     owner_delegate_->RenderWidgetDidFirstVisuallyNonEmptyPaint();
 }
 
-void RenderWidgetHostImpl::OnCommitAndDrawCompositorFrame() {
-  if (owner_delegate_)
-    owner_delegate_->RenderWidgetDidCommitAndDrawCompositorFrame();
-}
-
 void RenderWidgetHostImpl::RendererExited() {
   if (!renderer_initialized_)
     return;
@@ -1979,6 +1999,11 @@ void RenderWidgetHostImpl::OnMouseEventAck(
   for (auto& input_event_observer : input_event_observers_)
     input_event_observer.OnInputEventAck(ack_source, ack_result,
                                          mouse_event.event);
+
+  // Give the delegate the ability to handle a mouse event that wasn't consumed
+  // by the renderer. eg. Back/Forward mouse buttons.
+  if (delegate_ && ack_result != INPUT_EVENT_ACK_STATE_CONSUMED && !is_hidden())
+    delegate_->HandleMouseEvent(mouse_event.event);
 }
 
 bool RenderWidgetHostImpl::IsMouseLocked() const {
@@ -2356,6 +2381,8 @@ void RenderWidgetHostImpl::OnAutoscrollStart(const gfx::PointF& position) {
   GetView()->OnAutoscrollStart();
   sent_autoscroll_scroll_begin_ = false;
   autoscroll_in_progress_ = true;
+  delegate()->GetInputEventRouter()->SetAutoScrollInProgress(
+      autoscroll_in_progress_);
   autoscroll_start_position_ = position;
 }
 
@@ -2388,6 +2415,9 @@ void RenderWidgetHostImpl::OnAutoscrollFling(const gfx::Vector2dF& velocity) {
 
 void RenderWidgetHostImpl::OnAutoscrollEnd() {
   autoscroll_in_progress_ = false;
+
+  delegate()->GetInputEventRouter()->SetAutoScrollInProgress(
+      autoscroll_in_progress_);
   // Don't send a GFC if no GSB is sent.
   if (!sent_autoscroll_scroll_begin_)
     return;
@@ -2841,8 +2871,8 @@ void RenderWidgetHostImpl::WindowSnapshotReachedScreen(int snapshot_id) {
 
     ui::GrabViewSnapshotAsync(
         GetView()->GetNativeView(), snapshot_bounds,
-        base::Bind(&RenderWidgetHostImpl::OnSnapshotReceived,
-                   weak_factory_.GetWeakPtr(), snapshot_id));
+        base::BindOnce(&RenderWidgetHostImpl::OnSnapshotReceived,
+                       weak_factory_.GetWeakPtr(), snapshot_id));
   }
 }
 
@@ -2868,7 +2898,7 @@ void RenderWidgetHostImpl::OnSnapshotFromSurfaceReceived(
   auto it = pending_surface_browser_snapshots_.begin();
   while (it != pending_surface_browser_snapshots_.end()) {
     if (it->first <= snapshot_id) {
-      it->second.Run(image);
+      std::move(it->second).Run(image);
       pending_surface_browser_snapshots_.erase(it++);
     } else {
       ++it;
@@ -2883,7 +2913,7 @@ void RenderWidgetHostImpl::OnSnapshotReceived(int snapshot_id,
   auto it = pending_browser_snapshots_.begin();
   while (it != pending_browser_snapshots_.end()) {
     if (it->first <= snapshot_id) {
-      it->second.Run(image);
+      std::move(it->second).Run(image);
       pending_browser_snapshots_.erase(it++);
     } else {
       ++it;
@@ -2924,22 +2954,24 @@ void RenderWidgetHostImpl::RequestCompositionUpdates(bool immediate_request,
 }
 
 void RenderWidgetHostImpl::RequestCompositorFrameSink(
-    viz::mojom::CompositorFrameSinkRequest compositor_frame_sink_request,
-    viz::mojom::CompositorFrameSinkClientPtr compositor_frame_sink_client) {
+    mojo::PendingReceiver<viz::mojom::CompositorFrameSink>
+        compositor_frame_sink_receiver,
+    mojo::PendingRemote<viz::mojom::CompositorFrameSinkClient>
+        compositor_frame_sink_client) {
   if (enable_viz_) {
       // Connects the viz process end of CompositorFrameSink message pipes. The
       // renderer compositor may request a new CompositorFrameSink on context
       // loss, which will destroy the existing CompositorFrameSink.
       auto callback = base::BindOnce(
           [](viz::HostFrameSinkManager* manager,
-             viz::mojom::CompositorFrameSinkRequest request,
-             viz::mojom::CompositorFrameSinkClientPtr client,
+             mojo::PendingReceiver<viz::mojom::CompositorFrameSink> receiver,
+             mojo::PendingRemote<viz::mojom::CompositorFrameSinkClient> client,
              const viz::FrameSinkId& frame_sink_id) {
             manager->CreateCompositorFrameSink(
-                frame_sink_id, std::move(request), std::move(client));
+                frame_sink_id, std::move(receiver), std::move(client));
           },
           base::Unretained(GetHostFrameSinkManager()),
-          std::move(compositor_frame_sink_request),
+          std::move(compositor_frame_sink_receiver),
           std::move(compositor_frame_sink_client));
 
       if (view_)
@@ -2957,24 +2989,29 @@ void RenderWidgetHostImpl::RequestCompositorFrameSink(
     shared_bitmap_manager_->ChildDeletedSharedBitmap(id);
   owned_bitmaps_.clear();
 
-  if (compositor_frame_sink_binding_.is_bound())
-    compositor_frame_sink_binding_.Close();
-  compositor_frame_sink_binding_.Bind(
-      std::move(compositor_frame_sink_request),
+  compositor_frame_sink_receiver_.reset();
+  compositor_frame_sink_receiver_.Bind(
+      std::move(compositor_frame_sink_receiver),
       BrowserMainLoop::GetInstance()->GetResizeTaskRunner());
+
+  renderer_compositor_frame_sink_.reset();
+  renderer_compositor_frame_sink_.Bind(std::move(compositor_frame_sink_client));
+  auto* compositor_frame_sink_client_ptr =
+      renderer_compositor_frame_sink_.get();
+
   if (view_) {
     view_->DidCreateNewRendererCompositorFrameSink(
-        compositor_frame_sink_client.get());
+        compositor_frame_sink_client_ptr);
   }
-  renderer_compositor_frame_sink_ = std::move(compositor_frame_sink_client);
 }
 
 void RenderWidgetHostImpl::RegisterRenderFrameMetadataObserver(
-    mojom::RenderFrameMetadataObserverClientRequest
-        render_frame_metadata_observer_client_request,
-    mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer) {
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_client_receiver,
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+        render_frame_metadata_observer) {
   render_frame_metadata_provider_.Bind(
-      std::move(render_frame_metadata_observer_client_request),
+      std::move(render_frame_metadata_observer_client_receiver),
       std::move(render_frame_metadata_observer));
 }
 
@@ -3102,12 +3139,14 @@ void RenderWidgetHostImpl::SetInputTargetClient(
   input_target_client_ = std::move(input_target_client);
 }
 
-void RenderWidgetHostImpl::SetWidget(mojom::WidgetPtr widget) {
-  if (widget) {
+void RenderWidgetHostImpl::SetWidget(
+    mojo::PendingRemote<mojom::Widget> widget_remote) {
+  if (widget_remote) {
     // If we have a bound handler ensure that we destroy the old input router.
     if (widget_input_handler_.is_bound())
       SetupInputRouter();
 
+    mojo::Remote<mojom::Widget> widget(std::move(widget_remote));
     widget->SetupWidgetInputHandler(
         widget_input_handler_.BindNewPipeAndPassReceiver(),
         input_router_->BindNewHost());
diff --git a/chromium/content/browser/renderer_host/render_widget_host_impl.h b/chromium/content/browser/renderer_host/render_widget_host_impl.h
index 3620b4616a6..bb4e82d6e32 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_impl.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_impl.h
@@ -58,10 +58,13 @@
 #include "ipc/ipc_listener.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/viz/public/mojom/compositing/compositor_frame_sink.mojom.h"
 #include "services/viz/public/mojom/hit_test/input_target_client.mojom.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "ui/base/ime/text_input_mode.h"
 #include "ui/base/ime/text_input_type.h"
 #include "ui/base/ui_base_types.h"
@@ -166,7 +169,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   RenderWidgetHostImpl(RenderWidgetHostDelegate* delegate,
                        RenderProcessHost* process,
                        int32_t routing_id,
-                       mojom::WidgetPtr widget_interface,
+                       mojo::PendingRemote<mojom::Widget> widget_interface,
                        bool hidden);
 
   ~RenderWidgetHostImpl() override;
@@ -289,8 +292,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // Returns a gfx::Image that is backed by an NSImage on MacOS or by an
   // SkBitmap otherwise. The gfx::Image may be empty if the snapshot failed.
   using GetSnapshotFromBrowserCallback =
-      base::Callback<void(const gfx::Image&)>;
-  void GetSnapshotFromBrowser(const GetSnapshotFromBrowserCallback& callback,
+      base::OnceCallback<void(const gfx::Image&)>;
+  void GetSnapshotFromBrowser(GetSnapshotFromBrowserCallback callback,
                               bool from_surface);
 
   // Sets the View of this RenderWidgetHost.
@@ -345,6 +348,12 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // RenderProcessHost which aggregates importance of all of its widgets.
   void SetImportance(ChildProcessImportance importance);
   ChildProcessImportance importance() const { return importance_; }
+
+  void OnImeTextCommittedEvent(const base::string16& text_str);
+  void AddImeTextCommittedEventObserver(
+      RenderWidgetHost::InputEventObserver* observer) override;
+  void RemoveImeTextCommittedEventObserver(
+      RenderWidgetHost::InputEventObserver* observer) override;
 #endif
 
   // Returns true if the RenderWidget is hidden.
@@ -476,6 +485,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // caller to do so manually.
   void EnsureReadyForSyntheticGestures(base::OnceClosure on_ready);
 
+  void TakeSyntheticGestureController(RenderWidgetHostImpl* host);
+
   // Update the composition node of the renderer (or WebKit).
   // WebKit has a special node (a composition node) for input method to change
   // its text without affecting any other DOM nodes. When the input method
@@ -646,13 +657,16 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   void RequestCompositionUpdates(bool immediate_request, bool monitor_updates);
 
   void RequestCompositorFrameSink(
-      viz::mojom::CompositorFrameSinkRequest compositor_frame_sink_request,
-      viz::mojom::CompositorFrameSinkClientPtr compositor_frame_sink_client);
+      mojo::PendingReceiver<viz::mojom::CompositorFrameSink>
+          compositor_frame_sink_receiver,
+      mojo::PendingRemote<viz::mojom::CompositorFrameSinkClient>
+          compositor_frame_sink_client);
 
   void RegisterRenderFrameMetadataObserver(
-      mojom::RenderFrameMetadataObserverClientRequest
-          render_frame_metadata_observer_client_request,
-      mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer);
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+          render_frame_metadata_observer_client_receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+          render_frame_metadata_observer);
 
   RenderFrameMetadataProviderImpl* render_frame_metadata_provider() {
     return &render_frame_metadata_provider_;
@@ -685,7 +699,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
 
   // Indicate the frame input handler is now available.
   void SetFrameInputHandler(mojom::FrameInputHandler*);
-  void SetWidget(mojom::WidgetPtr widget);
+  void SetWidget(mojo::PendingRemote<mojom::Widget> widget_remote);
 
   viz::mojom::InputTargetClient* input_target_client() {
     return input_target_client_.get();
@@ -1098,6 +1112,14 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   base::ObserverList<RenderWidgetHost::InputEventObserver>::Unchecked
       input_event_observers_;
 
+#if defined(OS_ANDROID)
+  // Ime Text Committed callbacks. This is separated from
+  // input_event_observers_, because text events are not triggered by input
+  // events on Android.
+  base::ObserverList<RenderWidgetHost::InputEventObserver>::Unchecked
+      ime_text_committed_observers_;
+#endif
+
   // The observers watching us.
   base::ObserverList<RenderWidgetHostObserver> observers_;
 
@@ -1213,8 +1235,10 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   mojo::Remote<device::mojom::WakeLock> wake_lock_;
 #endif
 
-  mojo::Binding<viz::mojom::CompositorFrameSink> compositor_frame_sink_binding_;
-  viz::mojom::CompositorFrameSinkClientPtr renderer_compositor_frame_sink_;
+  mojo::Receiver<viz::mojom::CompositorFrameSink>
+      compositor_frame_sink_receiver_;
+  mojo::Remote<viz::mojom::CompositorFrameSinkClient>
+      renderer_compositor_frame_sink_;
 
   // Stash a request to create a CompositorFrameSink if it arrives before
   // we have a view. This is only used if |enable_viz_| is true.
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc
index 8eedfe4657d..9842e5a751b 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.cc
@@ -698,8 +698,12 @@ void RenderWidgetHostInputEventRouter::DispatchMouseWheelEvent(
       wheel_target_ = target;
     } else {
       if (wheel_target_) {
-        DCHECK(!target);
-        target = wheel_target_;
+        // If middle click autoscroll is in progress, browser routes all input
+        // events to single renderer. So if autoscroll is in progress, route
+        // mouse wheel events to the |target| instead of |wheel_target_|.
+        DCHECK(!target || event_targeter_->is_auto_scroll_in_progress());
+        if (!event_targeter_->is_auto_scroll_in_progress())
+          target = wheel_target_;
       } else if ((mouse_wheel_event.phase ==
                       blink::WebMouseWheelEvent::kPhaseEnded ||
                   mouse_wheel_event.momentum_phase ==
@@ -1968,4 +1972,9 @@ RenderWidgetHostInputEventRouter::GetMouseCaptureWidgetForTests() const {
   return nullptr;
 }
 
+void RenderWidgetHostInputEventRouter::SetAutoScrollInProgress(
+    bool is_autoscroll_in_progress) {
+  event_targeter_->SetIsAutoScrollInProgress(is_autoscroll_in_progress);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h
index 4099d8d4447..92ab0e74081 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router.h
@@ -189,6 +189,8 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter
     route_to_root_for_devtools_ = route;
   }
 
+  void SetAutoScrollInProgress(bool is_autoscroll_in_progress);
+
  private:
   FRIEND_TEST_ALL_PREFIXES(BrowserSideFlingBrowserTest,
                            InertialGSUBubblingStopsWhenParentCannotScroll);
diff --git a/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
index 4138930818e..dc07831f0a3 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_input_event_router_unittest.cc
@@ -22,6 +22,7 @@
 #include "content/test/mock_render_widget_host_delegate.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/test_render_view_host.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/viz/public/mojom/hit_test/input_target_client.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -199,9 +200,9 @@ class RenderWidgetHostInputEventRouterTest : public testing::Test {
 
     process_host_root_ =
         std::make_unique<MockRenderProcessHost>(browser_context_.get());
-    mojom::WidgetPtr widget_root;
-    widget_impl_root_ =
-        std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget_root));
+    mojo::PendingRemote<mojom::Widget> widget_root;
+    widget_impl_root_ = std::make_unique<MockWidgetImpl>(
+        widget_root.InitWithNewPipeAndPassReceiver());
     widget_host_root_ = std::make_unique<RenderWidgetHostImpl>(
         &delegate_, process_host_root_.get(),
         process_host_root_->GetNextRoutingID(), std::move(widget_root), false);
@@ -233,9 +234,9 @@ class RenderWidgetHostInputEventRouterTest : public testing::Test {
 
     child.process_host =
         std::make_unique<MockRenderProcessHost>(browser_context_.get());
-    mojom::WidgetPtr widget_child;
-    child.widget_impl =
-        std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget_child));
+    mojo::PendingRemote<mojom::Widget> widget_child;
+    child.widget_impl = std::make_unique<MockWidgetImpl>(
+        widget_child.InitWithNewPipeAndPassReceiver());
     child.widget_host = std::make_unique<RenderWidgetHostImpl>(
         &delegate_, child.process_host.get(),
         child.process_host->GetNextRoutingID(), std::move(widget_child), false);
@@ -908,4 +909,29 @@ TEST_F(RenderWidgetHostInputEventRouterTest, CanCallShowContextMenuAtPoint) {
                                    view_root_.get());
 }
 
+// Input events get latched to a target when middle click autoscroll is in
+// progress. This tests enusres that autoscroll latched target state is cleared
+// when the view, input events are latched to is destroyed.
+TEST_F(RenderWidgetHostInputEventRouterTest,
+       EnsureAutoScrollLatchedTargetIsCleared) {
+  ChildViewState child = MakeChildView(view_root_.get());
+
+  // Simulate middle click mouse event.
+  blink::WebMouseEvent mouse_event(
+      blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
+      blink::WebInputEvent::GetStaticTimeStampForTests());
+  mouse_event.button = blink::WebPointerProperties::Button::kMiddle;
+
+  view_root_->SetHittestResult(child.view.get(), false);
+  RenderWidgetTargeter* targeter = rwhier()->GetRenderWidgetTargeterForTests();
+  rwhier()->RouteMouseEvent(view_root_.get(), &mouse_event,
+                            ui::LatencyInfo(ui::SourceEventType::MOUSE));
+  // Set middle click autoscroll in progress to true.
+  rwhier()->SetAutoScrollInProgress(true);
+  // Destroy the view/target, middle click autoscroll is latched to.
+  rwhier()->OnRenderWidgetHostViewBaseDestroyed(child.view.get());
+
+  EXPECT_FALSE(targeter->is_auto_scroll_in_progress());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_host_owner_delegate.h b/chromium/content/browser/renderer_host/render_widget_host_owner_delegate.h
index 8f44ffb1630..a2eca4b2b44 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_owner_delegate.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_owner_delegate.h
@@ -7,6 +7,7 @@
 
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "content/common/visual_properties.h"
 
 namespace blink {
 class WebMouseEvent;
@@ -41,10 +42,6 @@ class CONTENT_EXPORT RenderWidgetHostOwnerDelegate {
   // The RenderWidget finished the first visually non-empty paint.
   virtual void RenderWidgetDidFirstVisuallyNonEmptyPaint() = 0;
 
-  // The RenderWidget has issued a draw command, signaling the widget
-  // has been visually updated.
-  virtual void RenderWidgetDidCommitAndDrawCompositorFrame() = 0;
-
   // The RenderWidgetHost got the focus.
   virtual void RenderWidgetGotFocus() = 0;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_unittest.cc
index a736944df1b..c46e127fa49 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_unittest.cc
@@ -53,8 +53,12 @@
 #include "content/test/stub_render_widget_host_owner_delegate.h"
 #include "content/test/test_render_view_host.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/page/page_zoom.h"
 #include "ui/display/screen.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/blink_features.h"
@@ -264,14 +268,15 @@ class MockRenderViewHostDelegateView : public RenderViewHostDelegateView {
 // Fake out the renderer side of mojom::RenderFrameMetadataObserver, allowing
 // for RenderWidgetHostImpl to be created.
 //
-// All methods are no-opts, the provided mojo request and info are held, but
+// All methods are no-opts, the provided mojo receiver and remote are held, but
 // never bound.
 class FakeRenderFrameMetadataObserver
     : public mojom::RenderFrameMetadataObserver {
  public:
   FakeRenderFrameMetadataObserver(
-      mojom::RenderFrameMetadataObserverRequest request,
-      mojom::RenderFrameMetadataObserverClientPtrInfo client_info);
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient>
+          client_remote);
   ~FakeRenderFrameMetadataObserver() override {}
 
 #if defined(OS_ANDROID)
@@ -280,15 +285,16 @@ class FakeRenderFrameMetadataObserver
   void ReportAllFrameSubmissionsForTesting(bool enabled) override {}
 
  private:
-  mojom::RenderFrameMetadataObserverRequest request_;
-  mojom::RenderFrameMetadataObserverClientPtrInfo client_info_;
+  mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver_;
+  mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient> client_remote_;
   DISALLOW_COPY_AND_ASSIGN(FakeRenderFrameMetadataObserver);
 };
 
 FakeRenderFrameMetadataObserver::FakeRenderFrameMetadataObserver(
-    mojom::RenderFrameMetadataObserverRequest request,
-    mojom::RenderFrameMetadataObserverClientPtrInfo client_info)
-    : request_(std::move(request)), client_info_(std::move(client_info)) {}
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver,
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient> client_remote)
+    : receiver_(std::move(receiver)),
+      client_remote_(std::move(client_remote)) {}
 
 // MockRenderWidgetHostDelegate --------------------------------------------
 
@@ -435,6 +441,8 @@ class MockRenderWidgetHostOwnerDelegate
     : public StubRenderWidgetHostOwnerDelegate {
  public:
   MOCK_METHOD1(SetBackgroundOpaque, void(bool opaque));
+  MOCK_METHOD1(UpdatePageVisualProperties,
+               void(const VisualProperties& visual_properties));
 };
 
 // RenderWidgetHostTest --------------------------------------------------------
@@ -494,36 +502,34 @@ class RenderWidgetHostTest : public testing::Test {
     host_->Init();
     host_->DisableGestureDebounce();
 
-    viz::mojom::CompositorFrameSinkPtr sink;
-    viz::mojom::CompositorFrameSinkRequest sink_request =
-        mojo::MakeRequest(&sink);
-    viz::mojom::CompositorFrameSinkClientRequest client_request =
-        mojo::MakeRequest(&renderer_compositor_frame_sink_ptr_);
+    mojo::PendingRemote<viz::mojom::CompositorFrameSink> sink;
+    mojo::PendingReceiver<viz::mojom::CompositorFrameSink> sink_receiver =
+        sink.InitWithNewPipeAndPassReceiver();
     renderer_compositor_frame_sink_ =
         std::make_unique<FakeRendererCompositorFrameSink>(
-            std::move(sink), std::move(client_request));
-
-    mojom::RenderFrameMetadataObserverPtr
-        renderer_render_frame_metadata_observer_ptr;
-    mojom::RenderFrameMetadataObserverRequest
-        render_frame_metadata_observer_request =
-            mojo::MakeRequest(&renderer_render_frame_metadata_observer_ptr);
-    mojom::RenderFrameMetadataObserverClientPtrInfo
-        render_frame_metadata_observer_client_info;
-    mojom::RenderFrameMetadataObserverClientRequest
-        render_frame_metadata_observer_client_request =
-            mojo::MakeRequest(&render_frame_metadata_observer_client_info);
+            std::move(sink), renderer_compositor_frame_sink_remote_
+                                 .BindNewPipeAndPassReceiver());
+
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+        renderer_render_frame_metadata_observer_remote;
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_remote;
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_client_receiver =
+            render_frame_metadata_observer_remote
+                .InitWithNewPipeAndPassReceiver();
     renderer_render_frame_metadata_observer_ =
         std::make_unique<FakeRenderFrameMetadataObserver>(
-            std::move(render_frame_metadata_observer_request),
-            std::move(render_frame_metadata_observer_client_info));
+            renderer_render_frame_metadata_observer_remote
+                .InitWithNewPipeAndPassReceiver(),
+            std::move(render_frame_metadata_observer_remote));
 
     host_->RequestCompositorFrameSink(
-        std::move(sink_request),
-        std::move(renderer_compositor_frame_sink_ptr_));
+        std::move(sink_receiver),
+        renderer_compositor_frame_sink_remote_.Unbind());
     host_->RegisterRenderFrameMetadataObserver(
-        std::move(render_frame_metadata_observer_client_request),
-        std::move(renderer_render_frame_metadata_observer_ptr));
+        std::move(render_frame_metadata_observer_client_receiver),
+        std::move(renderer_render_frame_metadata_observer_remote));
   }
 
   void TearDown() override {
@@ -592,7 +598,9 @@ class RenderWidgetHostTest : public testing::Test {
 
   void SimulateWheelEvent(float dX, float dY, int modifiers, bool precise) {
     host_->ForwardWheelEvent(SyntheticWebMouseWheelEventBuilder::Build(
-        0, 0, dX, dY, modifiers, precise));
+        0, 0, dX, dY, modifiers,
+        precise ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+                : ui::input_types::ScrollGranularity::kScrollByPixel));
   }
 
   void SimulateWheelEvent(float dX,
@@ -601,7 +609,9 @@ class RenderWidgetHostTest : public testing::Test {
                           bool precise,
                           WebMouseWheelEvent::Phase phase) {
     WebMouseWheelEvent wheel_event = SyntheticWebMouseWheelEventBuilder::Build(
-        0, 0, dX, dY, modifiers, precise);
+        0, 0, dX, dY, modifiers,
+        precise ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+                : ui::input_types::ScrollGranularity::kScrollByPixel);
     wheel_event.phase = phase;
     host_->ForwardWheelEvent(wheel_event);
   }
@@ -612,8 +622,10 @@ class RenderWidgetHostTest : public testing::Test {
                                          bool precise,
                                          const ui::LatencyInfo& ui_latency) {
     host_->ForwardWheelEventWithLatencyInfo(
-        SyntheticWebMouseWheelEventBuilder::Build(0, 0, dX, dY, modifiers,
-                                                  precise),
+        SyntheticWebMouseWheelEventBuilder::Build(
+            0, 0, dX, dY, modifiers,
+            precise ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+                    : ui::input_types::ScrollGranularity::kScrollByPixel),
         ui_latency);
   }
 
@@ -624,7 +636,9 @@ class RenderWidgetHostTest : public testing::Test {
                                          const ui::LatencyInfo& ui_latency,
                                          WebMouseWheelEvent::Phase phase) {
     WebMouseWheelEvent wheel_event = SyntheticWebMouseWheelEventBuilder::Build(
-        0, 0, dX, dY, modifiers, precise);
+        0, 0, dX, dY, modifiers,
+        precise ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+                : ui::input_types::ScrollGranularity::kScrollByPixel);
     wheel_event.phase = phase;
     host_->ForwardWheelEventWithLatencyInfo(wheel_event, ui_latency);
   }
@@ -714,7 +728,8 @@ class RenderWidgetHostTest : public testing::Test {
   SyntheticWebTouchEvent touch_event_;
 
   BrowserTaskEnvironment task_environment_;
-  viz::mojom::CompositorFrameSinkClientPtr renderer_compositor_frame_sink_ptr_;
+  mojo::Remote<viz::mojom::CompositorFrameSinkClient>
+      renderer_compositor_frame_sink_remote_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostTest);
 };
@@ -731,72 +746,79 @@ class RenderWidgetHostWithSourceTest
 // -----------------------------------------------------------------------------
 
 TEST_F(RenderWidgetHostTest, SynchronizeVisualProperties) {
+  sink_->ClearMessages();
+
   // The initial zoom is 0 so host should not send a sync message
   delegate_->SetZoomLevel(0);
   EXPECT_FALSE(host_->SynchronizeVisualProperties());
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
-  EXPECT_FALSE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(0u, sink_->message_count());
 
-  // The zoom has changed so host should send out a sync message
-  process_->sink().ClearMessages();
-  double new_zoom_level = content::ZoomFactorToZoomLevel(0.25);
+  sink_->ClearMessages();
+
+  // The zoom has changed so host should send out a sync message.
+  double new_zoom_level = blink::PageZoomFactorToZoomLevel(0.25);
   delegate_->SetZoomLevel(new_zoom_level);
   EXPECT_TRUE(host_->SynchronizeVisualProperties());
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_NEAR(new_zoom_level, host_->old_visual_properties_->zoom_level, 0.01);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // The initial bounds is the empty rect, so setting it to the same thing
   // shouldn't send the resize message.
-  process_->sink().ClearMessages();
   view_->SetBounds(gfx::Rect());
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
-  EXPECT_FALSE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(0u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // No visual properties ACK if the physical backing gets set, but the view
   // bounds are zero.
   view_->SetMockCompositorViewportPixelSize(gfx::Size(200, 200));
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Setting the view bounds to nonzero should send out the notification.
   // but should not expect ack for empty physical backing size.
   gfx::Rect original_size(0, 0, 100, 100);
-  process_->sink().ClearMessages();
   view_->SetBounds(original_size);
   view_->SetMockCompositorViewportPixelSize(gfx::Size());
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(original_size.size(), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Setting the bounds and physical backing size to nonzero should send out
   // the notification and expect an ack.
-  process_->sink().ClearMessages();
   view_->ClearMockCompositorViewportPixelSize();
   host_->SynchronizeVisualProperties();
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(original_size.size(), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
   cc::RenderFrameMetadata metadata;
   metadata.viewport_size_in_pixels = original_size.size();
   metadata.local_surface_id_allocation = base::nullopt;
   host_->DidUpdateVisualProperties(metadata);
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
-  process_->sink().ClearMessages();
   gfx::Rect second_size(0, 0, 110, 110);
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   view_->SetBounds(second_size);
   EXPECT_TRUE(host_->SynchronizeVisualProperties());
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
 
+  sink_->ClearMessages();
+
   // Sending out a new notification should NOT send out a new IPC message since
   // a visual properties ACK is pending.
   gfx::Rect third_size(0, 0, 120, 120);
@@ -804,78 +826,78 @@ TEST_F(RenderWidgetHostTest, SynchronizeVisualProperties) {
   view_->SetBounds(third_size);
   EXPECT_FALSE(host_->SynchronizeVisualProperties());
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
-  EXPECT_FALSE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(0u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Send a update that's a visual properties ACK, but for the original_size we
   // sent. Since this isn't the second_size, the message handler should
   // immediately send a new resize message for the new size to the renderer.
-  process_->sink().ClearMessages();
   metadata.viewport_size_in_pixels = original_size.size();
   metadata.local_surface_id_allocation = base::nullopt;
   host_->DidUpdateVisualProperties(metadata);
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(third_size.size(), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Send the visual properties ACK for the latest size.
-  process_->sink().ClearMessages();
   metadata.viewport_size_in_pixels = third_size.size();
   metadata.local_surface_id_allocation = base::nullopt;
   host_->DidUpdateVisualProperties(metadata);
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(third_size.size(), host_->old_visual_properties_->new_size);
-  EXPECT_FALSE(process_->sink().GetFirstMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(0u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Now clearing the bounds should send out a notification but we shouldn't
   // expect a visual properties ACK (since the renderer won't ack empty sizes).
   // The message should contain the new size (0x0) and not the previous one that
   // we skipped.
-  process_->sink().ClearMessages();
   view_->SetBounds(gfx::Rect());
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(gfx::Size(), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Send a rect that has no area but has either width or height set.
-  process_->sink().ClearMessages();
   view_->SetBounds(gfx::Rect(0, 0, 0, 30));
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(gfx::Size(0, 30), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // Set the same size again. It should not be sent again.
-  process_->sink().ClearMessages();
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(gfx::Size(0, 30), host_->old_visual_properties_->new_size);
-  EXPECT_FALSE(process_->sink().GetFirstMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(0u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // A different size should be sent again, however.
   view_->SetBounds(gfx::Rect(0, 0, 0, 31));
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(gfx::Size(0, 31), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
+
+  sink_->ClearMessages();
 
   // An invalid LocalSurfaceId should result in no change to the
   // |visual_properties_ack_pending_| bit.
-  process_->sink().ClearMessages();
   view_->SetBounds(gfx::Rect(25, 25));
   view_->InvalidateLocalSurfaceId();
   host_->SynchronizeVisualProperties();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
   EXPECT_EQ(gfx::Size(25, 25), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_EQ(1u, sink_->message_count());
 }
 
 // Test that a resize event is sent if SynchronizeVisualProperties() is called
@@ -888,59 +910,73 @@ TEST_F(RenderWidgetHostTest, ResizeScreenInfo) {
   screen_info.orientation_angle = 0;
   screen_info.orientation_type = SCREEN_ORIENTATION_VALUES_PORTRAIT_PRIMARY;
 
+  sink_->ClearMessages();
   view_->SetScreenInfo(screen_info);
-  host_->SynchronizeVisualProperties();
+  EXPECT_EQ(0u, sink_->message_count());
+  EXPECT_TRUE(host_->SynchronizeVisualProperties());
+  // WidgetMsg_UpdateVisualProperties sent to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  EXPECT_EQ(WidgetMsg_UpdateVisualProperties::ID,
+            sink_->GetMessageAt(0)->type());
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
-  process_->sink().ClearMessages();
 
   screen_info.orientation_angle = 180;
   screen_info.orientation_type = SCREEN_ORIENTATION_VALUES_LANDSCAPE_PRIMARY;
 
+  sink_->ClearMessages();
   view_->SetScreenInfo(screen_info);
-  host_->SynchronizeVisualProperties();
+  EXPECT_EQ(0u, sink_->message_count());
+  EXPECT_TRUE(host_->SynchronizeVisualProperties());
+  // WidgetMsg_UpdateVisualProperties sent to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  EXPECT_EQ(WidgetMsg_UpdateVisualProperties::ID,
+            sink_->GetMessageAt(0)->type());
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
-  process_->sink().ClearMessages();
 
   screen_info.device_scale_factor = 2.f;
 
+  sink_->ClearMessages();
   view_->SetScreenInfo(screen_info);
-  host_->SynchronizeVisualProperties();
+  EXPECT_EQ(0u, sink_->message_count());
+  EXPECT_TRUE(host_->SynchronizeVisualProperties());
+  // WidgetMsg_UpdateVisualProperties sent to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  EXPECT_EQ(WidgetMsg_UpdateVisualProperties::ID,
+            sink_->GetMessageAt(0)->type());
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
-  process_->sink().ClearMessages();
 
   // No screen change.
+  sink_->ClearMessages();
   view_->SetScreenInfo(screen_info);
-  host_->SynchronizeVisualProperties();
+  EXPECT_FALSE(host_->SynchronizeVisualProperties());
+  EXPECT_EQ(0u, sink_->message_count());
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
-  EXPECT_FALSE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
 }
 
 // Test for crbug.com/25097. If a renderer crashes between a resize and the
 // corresponding update message, we must be sure to clear the visual properties
 // ACK logic.
 TEST_F(RenderWidgetHostTest, ResizeThenCrash) {
-  // Clear the first Resize message that carried screen info.
-  process_->sink().ClearMessages();
-
+  sink_->ClearMessages();
   // Setting the bounds to a "real" rect should send out the notification.
-  gfx::Rect original_size(0, 0, 100, 100);
-  view_->SetBounds(original_size);
+  view_->SetBounds(gfx::Rect(100, 100));
   host_->SynchronizeVisualProperties();
+  // WidgetMsg_UpdateVisualProperties is sent to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    // Size sent to the renderer.
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+  }
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
-  EXPECT_EQ(original_size.size(), host_->old_visual_properties_->new_size);
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
 
-  // Simulate a renderer crash before the update message. Ensure all the visual
-  // properties ACK logic is cleared. Must clear the view first so it doesn't
-  // get deleted.
+  // Simulate a renderer crash before an ACK for the UpdateVisualProperties
+  // message arrives. Ensure all the visual properties ACK logic is cleared.
+  // Must clear the view first so it doesn't get deleted.
   host_->SetView(nullptr);
   host_->RendererExited();
   EXPECT_FALSE(host_->visual_properties_ack_pending_);
@@ -1625,21 +1661,28 @@ TEST_F(RenderWidgetHostInitialSizeTest, InitialSize) {
   // with the reqiest to new up the RenderView and so subsequent
   // SynchronizeVisualProperties calls should not result in new IPC (unless the
   // size has actually changed).
+  EXPECT_CALL(mock_owner_delegate_, UpdatePageVisualProperties(_)).Times(0);
   EXPECT_FALSE(host_->SynchronizeVisualProperties());
-  EXPECT_FALSE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
   EXPECT_EQ(initial_size_, host_->old_visual_properties_->new_size);
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
 }
 
 TEST_F(RenderWidgetHostTest, HideUnthrottlesResize) {
-  gfx::Size original_size(100, 100);
-  view_->SetBounds(gfx::Rect(original_size));
-  process_->sink().ClearMessages();
+  sink_->ClearMessages();
+  view_->SetBounds(gfx::Rect(100, 100));
   EXPECT_TRUE(host_->SynchronizeVisualProperties());
-  EXPECT_TRUE(process_->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
-  EXPECT_EQ(original_size, host_->old_visual_properties_->new_size);
+  // WidgetMsg_UpdateVisualProperties is sent to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    // Size sent to the renderer.
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+  }
+  // An ack is pending, throttling further updates.
   EXPECT_TRUE(host_->visual_properties_ack_pending_);
 
   // Hiding the widget should unthrottle resize.
@@ -1917,9 +1960,9 @@ TEST_F(RenderWidgetHostTest, InflightEventCountResetsAfterRebind) {
   SimulateKeyboardEvent(WebInputEvent::kRawKeyDown);
 
   EXPECT_EQ(1u, host_->in_flight_event_count());
-  mojom::WidgetPtr widget;
+  mojo::PendingRemote<mojom::Widget> widget;
   std::unique_ptr<MockWidgetImpl> widget_impl =
-      std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+      std::make_unique<MockWidgetImpl>(widget.InitWithNewPipeAndPassReceiver());
   host_->SetWidget(std::move(widget));
   EXPECT_EQ(0u, host_->in_flight_event_count());
 }
@@ -1935,9 +1978,9 @@ TEST_F(RenderWidgetHostTest, ForceEnableZoomShouldUpdateAfterRebind) {
   host_->ExpectForceEnableZoom(true);
 
   // Rebind should also update to the latest force_enable_zoom state.
-  mojom::WidgetPtr widget;
+  mojo::PendingRemote<mojom::Widget> widget;
   std::unique_ptr<MockWidgetImpl> widget_impl =
-      std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+      std::make_unique<MockWidgetImpl>(widget.InitWithNewPipeAndPassReceiver());
   host_->SetWidget(std::move(widget));
 
   SCOPED_TRACE("force_enable_zoom is true after rebind.");
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_android.cc b/chromium/content/browser/renderer_host/render_widget_host_view_android.cc
index 8875d4a69f3..671cfc0c494 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_android.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_android.cc
@@ -65,6 +65,7 @@
 #include "content/browser/renderer_host/render_widget_host_input_event_router.h"
 #include "content/browser/renderer_host/ui_events_helper.h"
 #include "content/common/content_switches_internal.h"
+#include "content/public/android/content_jni_headers/RenderWidgetHostViewImpl_jni.h"
 #include "content/public/browser/android/compositor.h"
 #include "content/public/browser/android/synchronous_compositor_client.h"
 #include "content/public/browser/browser_thread.h"
@@ -76,7 +77,6 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
-#include "content/public/android/content_jni_headers/RenderWidgetHostViewImpl_jni.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "third_party/skia/include/core/SkCanvas.h"
 #include "third_party/skia/include/core/SkColor.h"
@@ -395,7 +395,7 @@ void RenderWidgetHostViewAndroid::OnRenderFrameMetadataChangedBeforeActivation(
 
   if (!using_browser_compositor_) {
     // DevTools ScreenCast support for Android WebView.
-    last_devtools_frame_metadata_.emplace(metadata);
+    last_render_frame_metadata_ = metadata;
     // Android WebView ignores transparent background.
     is_transparent = false;
   }
@@ -526,14 +526,11 @@ void RenderWidgetHostViewAndroid::ShowContextMenuAtTouchHandle(
   }
 }
 
-void RenderWidgetHostViewAndroid::InsetViewportBottom(
+void RenderWidgetHostViewAndroid::OnViewportInsetBottomChanged(
     JNIEnv* env,
-    const base::android::JavaParamRef<jobject>& obj,
-    jint bottom_adjust_px) {
-  int pinned_bottom_adjust_dps =
-      std::max(0, (int)(bottom_adjust_px / view_.GetDipScale()));
-  gfx::Insets insets(0, 0, pinned_bottom_adjust_dps, 0);
-  SetInsets(insets);
+    const base::android::JavaParamRef<jobject>& obj) {
+  SynchronizeVisualProperties(cc::DeadlinePolicy::UseDefaultDeadline(),
+                              base::nullopt);
 }
 
 void RenderWidgetHostViewAndroid::WriteContentBitmapToDiskAsync(
@@ -639,17 +636,15 @@ gfx::Rect RenderWidgetHostViewAndroid::GetViewBounds() {
 }
 
 gfx::Size RenderWidgetHostViewAndroid::GetVisibleViewportSize() {
+  int pinned_bottom_adjust_dps =
+      std::max(0, (int)(view_.GetViewportInsetBottom() / view_.GetDipScale()));
   gfx::Rect requested_rect(GetRequestedRendererSize());
-  requested_rect.Inset(insets_);
+  requested_rect.Inset(gfx::Insets(0, 0, pinned_bottom_adjust_dps, 0));
   return requested_rect.size();
 }
 
 void RenderWidgetHostViewAndroid::SetInsets(const gfx::Insets& insets) {
-  if (insets != insets_) {
-    insets_ = insets;
-    SynchronizeVisualProperties(cc::DeadlinePolicy::UseDefaultDeadline(),
-                                base::nullopt);
-  }
+  NOTREACHED();
 }
 
 gfx::Size RenderWidgetHostViewAndroid::GetCompositorViewportPixelSize() {
@@ -1148,11 +1143,11 @@ void RenderWidgetHostViewAndroid::FrameTokenChangedForSynchronousCompositor(
     if (!in_sync_copy_contents_) {
       RenderFrameHost* frame_host =
           RenderViewHost::From(host())->GetMainFrame();
-      if (frame_host && last_devtools_frame_metadata_) {
+      if (frame_host && last_render_frame_metadata_) {
         // Update our |root_scroll_offset|, as changes to this value do not
         // trigger a new RenderFrameMetadata, and it may be out of date. This
         // is needed for devtools DOM node selection.
-        DevToolsFrameMetadata updated_metadata = *last_devtools_frame_metadata_;
+        cc::RenderFrameMetadata updated_metadata = *last_render_frame_metadata_;
         updated_metadata.root_scroll_offset =
             gfx::ScrollOffsetToVector2dF(root_scroll_offset);
         RenderFrameDevToolsAgentHost::SignalSynchronousSwapCompositorFrame(
@@ -2361,9 +2356,6 @@ void RenderWidgetHostViewAndroid::ComputeEventLatencyOSTouchHistograms(
 }
 
 void RenderWidgetHostViewAndroid::CreateOverscrollControllerIfPossible() {
-#if defined(DISABLE_OVERSCROLL)
-  return;
-#else
   // an OverscrollController is already set
   if (overscroll_controller_)
     return;
@@ -2399,7 +2391,6 @@ void RenderWidgetHostViewAndroid::CreateOverscrollControllerIfPossible() {
 
   overscroll_controller_ = std::make_unique<OverscrollControllerAndroid>(
       overscroll_refresh_handler, compositor, view_.GetDipScale());
-#endif
 }
 
 void RenderWidgetHostViewAndroid::SetOverscrollControllerForTesting(
@@ -2485,8 +2476,15 @@ void RenderWidgetHostViewAndroid::GetScreenInfo(ScreenInfo* screen_info) {
                                    window->GetDisplayWithWindowColorSpace());
 }
 
-void RenderWidgetHostViewAndroid::CancelActiveTouches() {
+std::vector<std::unique_ptr<ui::TouchEvent>>
+RenderWidgetHostViewAndroid::ExtractAndCancelActiveTouches() {
   ResetGestureDetection();
+  return {};
+}
+
+void RenderWidgetHostViewAndroid::TransferTouches(
+    const std::vector<std::unique_ptr<ui::TouchEvent>>& touches) {
+  // Touch transfer for Android is not implemented in content/.
 }
 
 void RenderWidgetHostViewAndroid::WasEvicted() {
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_android.h b/chromium/content/browser/renderer_host/render_widget_host_view_android.h
index e1113f3584e..bf7317b2a98 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_android.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_android.h
@@ -20,12 +20,12 @@
 #include "base/memory/weak_ptr.h"
 #include "base/process/process.h"
 #include "base/time/time.h"
+#include "cc/trees/render_frame_metadata.h"
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/common/frame_sinks/begin_frame_source.h"
 #include "components/viz/common/frame_timing_details_map.h"
 #include "components/viz/common/quads/selection.h"
 #include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
-#include "content/browser/devtools/devtools_frame_metadata.h"
 #include "content/browser/renderer_host/input/mouse_wheel_phase_handler.h"
 #include "content/browser/renderer_host/input/stylus_text_selector.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
@@ -194,7 +194,10 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
   viz::ScopedSurfaceIdAllocator DidUpdateVisualProperties(
       const cc::RenderFrameMetadata& metadata) override;
   void GetScreenInfo(ScreenInfo* screen_info) override;
-  void CancelActiveTouches() override;
+  std::vector<std::unique_ptr<ui::TouchEvent>> ExtractAndCancelActiveTouches()
+      override;
+  void TransferTouches(
+      const std::vector<std::unique_ptr<ui::TouchEvent>>& touches) override;
 
   // ui::EventHandlerAndroid implementation.
   bool OnTouchEvent(const ui::MotionEventAndroid& m) override;
@@ -369,13 +372,10 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
       jint x,
       jint y);
 
-  // Insets the Visual Viewport's bottom by the amount given.  The adjustment
-  // is specified in pixels and should not be negative.  An adjustment of 0
-  // returns the Visual Viewport to a non-inset viewport that matches the
-  // Layout Viewport.
-  void InsetViewportBottom(JNIEnv* env,
-                           const base::android::JavaParamRef<jobject>& obj,
-                           jint bottom_adjust_px);
+  // Notifies that the Visual Viewport's inset bottom has changed.
+  void OnViewportInsetBottomChanged(
+      JNIEnv* env,
+      const base::android::JavaParamRef<jobject>& obj);
 
   void WriteContentBitmapToDiskAsync(
       JNIEnv* env,
@@ -564,8 +564,6 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
   gfx::Point prev_mousedown_point_;
   int left_click_count_ = 0;
 
-  gfx::Insets insets_;
-
   viz::mojom::CompositorFrameSinkClient* renderer_compositor_frame_sink_ =
       nullptr;
 
@@ -586,9 +584,8 @@ class CONTENT_EXPORT RenderWidgetHostViewAndroid
   // TODO(ericrk): Make this more robust.
   bool in_sync_copy_contents_ = false;
 
-  // A cached copy of the most up to date DevToolsFrameMetadata, computed from
-  // either RenderFrameMetadata or CompositorFrameMetadata.
-  base::Optional<DevToolsFrameMetadata> last_devtools_frame_metadata_;
+  // A cached copy of the most up to date RenderFrameMetadata.
+  base::Optional<cc::RenderFrameMetadata> last_render_frame_metadata_;
 
   WebContentsAccessibilityAndroid* web_contents_accessibility_ = nullptr;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_android_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
index 44f11bfc053..caa3c5c8f77 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_android_unittest.cc
@@ -14,6 +14,7 @@
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/mock_render_widget_host_delegate.h"
+#include "content/test/test_view_android_delegate.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/android/view_android.h"
 
@@ -34,12 +35,15 @@ class RenderWidgetHostViewAndroidTest : public testing::Test {
       const base::Optional<viz::LocalSurfaceIdAllocation>&
           child_local_surface_id_allocation);
   void WasEvicted();
+  ui::ViewAndroid* GetViewAndroid() { return &native_view_; }
 
  protected:
   // testing::Test:
   void SetUp() override;
   void TearDown() override;
 
+  std::unique_ptr<TestViewAndroidDelegate> test_view_android_delegate_;
+
  private:
   std::unique_ptr<TestBrowserContext> browser_context_;
   MockRenderProcessHost* process_;  // Deleted automatically by the widget.
@@ -86,6 +90,7 @@ void RenderWidgetHostViewAndroidTest::SetUp() {
   EXPECT_EQ(&parent_view_, native_view_.parent());
   render_widget_host_view_android_ =
       new RenderWidgetHostViewAndroid(host_.get(), &native_view_);
+  test_view_android_delegate_.reset(new TestViewAndroidDelegate());
 }
 
 void RenderWidgetHostViewAndroidTest::TearDown() {
@@ -125,12 +130,9 @@ TEST_F(RenderWidgetHostViewAndroidTest, NoSurfaceSynchronizationWhileEvicted) {
 
 // Tests insetting the Visual Viewport.
 TEST_F(RenderWidgetHostViewAndroidTest, InsetVisualViewport) {
-  // Android default viewport.
+  // Android default viewport should not have an inset bottom.
   RenderWidgetHostViewAndroid* rwhva = render_widget_host_view_android();
-  int width = rwhva->GetViewBounds().width();
-  int height = rwhva->GetViewBounds().height();
-  gfx::Size full_open_size(width, height);
-  EXPECT_EQ(full_open_size, rwhva->GetVisibleViewportSize());
+  EXPECT_EQ(0, GetViewAndroid()->GetViewportInsetBottom());
 
   // Set up SurfaceId checking.
   const viz::LocalSurfaceIdAllocation& surface_id_allocation =
@@ -138,18 +140,25 @@ TEST_F(RenderWidgetHostViewAndroidTest, InsetVisualViewport) {
   viz::LocalSurfaceId original_surface =
       surface_id_allocation.local_surface_id();
 
-  // Inset all around.
-  gfx::Insets insets(2, 3, 4, 5);
-  rwhva->SetInsets(insets);
-  gfx::Size inset_size(width - insets.left() - insets.right(),
-                       height - insets.top() - insets.bottom());
-  EXPECT_EQ(inset_size, rwhva->GetVisibleViewportSize());
+  // Set up our test delegate connected to this ViewAndroid.
+  test_view_android_delegate_->SetupTestDelegate(GetViewAndroid());
+  EXPECT_EQ(0, GetViewAndroid()->GetViewportInsetBottom());
+
+  JNIEnv* env = base::android::AttachCurrentThread();
+
+  // Now inset the bottom and make sure the surface changes, and the inset is
+  // known to our ViewAndroid.
+  test_view_android_delegate_->InsetViewportBottom(100);
+  EXPECT_EQ(100, GetViewAndroid()->GetViewportInsetBottom());
+  rwhva->OnViewportInsetBottomChanged(env, nullptr);
   viz::LocalSurfaceId inset_surface = surface_id_allocation.local_surface_id();
   EXPECT_TRUE(inset_surface.IsNewerThan(original_surface));
 
-  // Reset insets; should go back to the original size as a new surface.
-  rwhva->SetInsets(gfx::Insets());
-  EXPECT_EQ(full_open_size, rwhva->GetVisibleViewportSize());
+  // Reset the bottom; should go back to the original inset and have a new
+  // surface.
+  test_view_android_delegate_->InsetViewportBottom(0);
+  rwhva->OnViewportInsetBottomChanged(env, nullptr);
+  EXPECT_EQ(0, GetViewAndroid()->GetViewportInsetBottom());
   EXPECT_TRUE(
       surface_id_allocation.local_surface_id().IsNewerThan(inset_surface));
 }
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
index 5ce941c77bc..d2bca8f54be 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura.cc
@@ -138,6 +138,22 @@ using blink::WebTouchEvent;
 
 namespace content {
 
+namespace {
+
+mojom::FrameInputHandler* GetFrameInputHandlerForFocusedFrame(
+    RenderWidgetHostImpl* host) {
+  if (!host || !host->delegate()) {
+    return nullptr;
+  }
+  RenderFrameHostImpl* render_frame_host =
+      host->delegate()->GetFocusedFrameFromFocusedDelegate();
+  if (!render_frame_host)
+    return nullptr;
+  return render_frame_host->GetFrameInputHandler();
+}
+
+}  // namespace
+
 #if defined(OS_WIN)
 
 // This class implements the ui::InputMethodKeyboardControllerObserver interface
@@ -1488,11 +1504,7 @@ bool RenderWidgetHostViewAura::ChangeTextDirectionAndLayoutAlignment(
 
 void RenderWidgetHostViewAura::ExtendSelectionAndDelete(
     size_t before, size_t after) {
-  RenderFrameHostImpl* render_frame_host =
-      host()->delegate()->GetFocusedFrameFromFocusedDelegate();
-  if (!render_frame_host)
-    return;
-  auto* input_handler = render_frame_host->GetFrameInputHandler();
+  auto* input_handler = GetFrameInputHandlerForFocusedFrame(host());
   if (!input_handler)
     return;
   input_handler->ExtendSelectionAndDelete(before, after);
@@ -1544,10 +1556,7 @@ bool RenderWidgetHostViewAura::ShouldDoLearning() {
 bool RenderWidgetHostViewAura::SetCompositionFromExistingText(
     const gfx::Range& range,
     const std::vector<ui::ImeTextSpan>& ui_ime_text_spans) {
-  RenderFrameHostImpl* frame = GetFocusedFrame();
-  if (!frame)
-    return false;
-  auto* input_handler = frame->GetFrameInputHandler();
+  auto* input_handler = GetFrameInputHandlerForFocusedFrame(host());
   if (!input_handler)
     return false;
   input_handler->SetCompositionFromExistingText(range.start(), range.end(),
@@ -2304,18 +2313,6 @@ void RenderWidgetHostViewAura::UpdateLegacyWin() {
 }
 #endif
 
-void RenderWidgetHostViewAura::SchedulePaintIfNotInClip(
-    const gfx::Rect& rect,
-    const gfx::Rect& clip) {
-  if (!clip.IsEmpty()) {
-    gfx::Rect to_paint = gfx::SubtractRects(rect, clip);
-    if (!to_paint.IsEmpty())
-      window_->SchedulePaintInRect(to_paint);
-  } else {
-    window_->SchedulePaintInRect(rect);
-  }
-}
-
 void RenderWidgetHostViewAura::AddedToRootWindow() {
   window_->GetHost()->AddObserver(this);
   UpdateScreenInfo(window_);
@@ -2527,7 +2524,7 @@ void RenderWidgetHostViewAura::OnTextSelectionChanged(
   if (GetInputMethod())
     GetInputMethod()->OnCaretBoundsChanged(this);
 
-#if defined(USE_X11)
+#if defined(USE_X11) || (defined(USE_OZONE) && !defined(OS_CHROMEOS))
   const TextInputManager::TextSelection* selection =
       GetTextInputManager()->GetTextSelection(focused_view);
   if (selection->selected_text().length()) {
@@ -2535,7 +2532,7 @@ void RenderWidgetHostViewAura::OnTextSelectionChanged(
     ui::ScopedClipboardWriter clipboard_writer(ui::ClipboardBuffer::kSelection);
     clipboard_writer.WriteText(selection->selected_text());
   }
-#endif  // defined(USE_X11)
+#endif  // defined(USE_X11) || (defined(USE_OZONE) && !defined(OS_CHROMEOS))
 }
 
 void RenderWidgetHostViewAura::SetPopupChild(
@@ -2635,9 +2632,19 @@ bool RenderWidgetHostViewAura::CanSynchronizeVisualProperties() {
   return !needs_to_update_display_metrics_;
 }
 
-void RenderWidgetHostViewAura::CancelActiveTouches() {
+std::vector<std::unique_ptr<ui::TouchEvent>>
+RenderWidgetHostViewAura::ExtractAndCancelActiveTouches() {
   aura::Env* env = aura::Env::GetInstance();
-  env->gesture_recognizer()->CancelActiveTouches(window());
+  std::vector<std::unique_ptr<ui::TouchEvent>> touches =
+      env->gesture_recognizer()->ExtractTouches(window());
+  CancelActiveTouches();
+  return touches;
+}
+
+void RenderWidgetHostViewAura::TransferTouches(
+    const std::vector<std::unique_ptr<ui::TouchEvent>>& touches) {
+  aura::Env* env = aura::Env::GetInstance();
+  env->gesture_recognizer()->TransferTouches(window(), touches);
 }
 
 void RenderWidgetHostViewAura::InvalidateLocalSurfaceIdOnEviction() {
@@ -2652,4 +2659,9 @@ void RenderWidgetHostViewAura::ProcessDisplayMetricsChanged() {
   UpdateCursorIfOverSelf();
 }
 
+void RenderWidgetHostViewAura::CancelActiveTouches() {
+  aura::Env* env = aura::Env::GetInstance();
+  env->gesture_recognizer()->CancelActiveTouches(window());
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura.h b/chromium/content/browser/renderer_host/render_widget_host_view_aura.h
index 61d49433a45..9f0bc238b33 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura.h
@@ -65,7 +65,7 @@ class LocatedEvent;
 namespace content {
 #if defined(OS_WIN)
 class LegacyRenderWidgetHostHWND;
-class DirectManipulationBrowserTest;
+class DirectManipulationBrowserTestBase;
 #endif
 
 class CursorManager;
@@ -196,7 +196,10 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
   void DidNavigate() override;
   void TakeFallbackContentFrom(RenderWidgetHostView* view) override;
   bool CanSynchronizeVisualProperties() override;
-  void CancelActiveTouches() override;
+  std::vector<std::unique_ptr<ui::TouchEvent>> ExtractAndCancelActiveTouches()
+      override;
+  void TransferTouches(
+      const std::vector<std::unique_ptr<ui::TouchEvent>>& touches) override;
 
   // Overridden from ui::TextInputClient:
   void SetCompositionText(const ui::CompositionText& composition) override;
@@ -381,7 +384,7 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
 #if defined(OS_WIN)
   friend class AccessibilityObjectLifetimeWinBrowserTest;
   friend class AccessibilityTreeLinkageWinBrowserTest;
-  friend class DirectManipulationBrowserTest;
+  friend class DirectManipulationBrowserTestBase;
 #endif
   FRIEND_TEST_ALL_PREFIXES(InputMethodResultAuraTest,
                            FinishImeCompositionSession);
@@ -513,10 +516,6 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
   // the mouse cursor is visible anywhere on the screen.
   void NotifyRendererOfCursorVisibilityState(bool is_visible);
 
-  // If |clip| is non-empty and and doesn't contain |rect| or |clip| is empty
-  // SchedulePaint() is invoked for |rect|.
-  void SchedulePaintIfNotInClip(const gfx::Rect& rect, const gfx::Rect& clip);
-
   // Called after |window_| is parented to a WindowEventDispatcher.
   void AddedToRootWindow();
 
@@ -571,6 +570,8 @@ class CONTENT_EXPORT RenderWidgetHostViewAura
   // Called to process a display metrics change.
   void ProcessDisplayMetricsChanged();
 
+  void CancelActiveTouches();
+
   // NOTE: this is null if |is_mus_browser_plugin_guest_| is true.
   aura::Window* window_;
 
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc
index c2fec1940f6..2c044cc0ef9 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura_browsertest.cc
@@ -80,7 +80,7 @@ class RenderWidgetHostViewAuraBrowserTest : public ContentBrowserTest {
 #if defined(OS_CHROMEOS)
 IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewAuraBrowserTest,
                        StaleFrameContentOnEvictionNormal) {
-  NavigateToURL(shell(), GURL(kMinimalPageDataURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kMinimalPageDataURL)));
 
   // Make sure the renderer submits at least one frame before hiding it.
   RenderFrameSubmissionObserver submission_observer(shell()->web_contents());
@@ -121,7 +121,7 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewAuraBrowserTest,
 
 IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewAuraBrowserTest,
                        StaleFrameContentOnEvictionRejected) {
-  NavigateToURL(shell(), GURL(kMinimalPageDataURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kMinimalPageDataURL)));
 
   // Wait for first frame activation when a surface is embedded.
   while (!GetDelegatedFrameHost()->HasSavedFrame())
@@ -161,7 +161,7 @@ IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewAuraBrowserTest,
 
 IN_PROC_BROWSER_TEST_F(RenderWidgetHostViewAuraBrowserTest,
                        StaleFrameContentOnEvictionNone) {
-  NavigateToURL(shell(), GURL(kMinimalPageDataURL));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(kMinimalPageDataURL)));
 
   // Wait for first frame activation when a surface is embedded.
   while (!GetDelegatedFrameHost()->HasSavedFrame())
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
index f97fbd3cfc4..cfaf408a63f 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_aura_unittest.cc
@@ -80,6 +80,9 @@
 #include "content/test/test_web_contents.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_test_sink.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "ui/aura/client/aura_constants.h"
@@ -254,16 +257,17 @@ class FakeRenderWidgetHostViewAura : public RenderWidgetHostViewAura {
   ~FakeRenderWidgetHostViewAura() override {}
 
   void CreateNewRendererCompositorFrameSink() {
-    viz::mojom::CompositorFrameSinkPtr sink;
-    viz::mojom::CompositorFrameSinkRequest sink_request =
-        mojo::MakeRequest(&sink);
-    viz::mojom::CompositorFrameSinkClientRequest client_request =
-        mojo::MakeRequest(&renderer_compositor_frame_sink_ptr_);
+    mojo::PendingRemote<viz::mojom::CompositorFrameSink> sink;
+    mojo::PendingReceiver<viz::mojom::CompositorFrameSink> sink_receiver =
+        sink.InitWithNewPipeAndPassReceiver();
+
+    renderer_compositor_frame_sink_remote_.reset();
     renderer_compositor_frame_sink_ =
         std::make_unique<FakeRendererCompositorFrameSink>(
-            std::move(sink), std::move(client_request));
+            std::move(sink), renderer_compositor_frame_sink_remote_
+                                 .BindNewPipeAndPassReceiver());
     DidCreateNewRendererCompositorFrameSink(
-        renderer_compositor_frame_sink_ptr_.get());
+        renderer_compositor_frame_sink_remote_.get());
   }
 
   void UseFakeDispatcher() {
@@ -316,7 +320,8 @@ class FakeRenderWidgetHostViewAura : public RenderWidgetHostViewAura {
  private:
   bool is_guest_view_hack_;
   FakeDelegatedFrameHostClientAura* delegated_frame_host_client_;
-  viz::mojom::CompositorFrameSinkClientPtr renderer_compositor_frame_sink_ptr_;
+  mojo::Remote<viz::mojom::CompositorFrameSinkClient>
+      renderer_compositor_frame_sink_remote_;
 
   DISALLOW_COPY_AND_ASSIGN(FakeRenderWidgetHostViewAura);
 };
@@ -392,9 +397,10 @@ class MockRenderWidgetHostImpl : public RenderWidgetHostImpl {
   static MockRenderWidgetHostImpl* Create(RenderWidgetHostDelegate* delegate,
                                           RenderProcessHost* process,
                                           int32_t routing_id) {
-    mojom::WidgetPtr widget;
+    mojo::PendingRemote<mojom::Widget> widget;
     std::unique_ptr<MockWidgetImpl> widget_impl =
-        std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+        std::make_unique<MockWidgetImpl>(
+            widget.InitWithNewPipeAndPassReceiver());
 
     return new MockRenderWidgetHostImpl(delegate, process, routing_id,
                                         std::move(widget_impl),
@@ -419,7 +425,7 @@ class MockRenderWidgetHostImpl : public RenderWidgetHostImpl {
                            RenderProcessHost* process,
                            int32_t routing_id,
                            std::unique_ptr<MockWidgetImpl> widget_impl,
-                           mojom::WidgetPtr widget)
+                           mojo::PendingRemote<mojom::Widget> widget)
       : RenderWidgetHostImpl(delegate,
                              process,
                              routing_id,
@@ -680,7 +686,7 @@ class RenderWidgetHostViewAuraTest : public testing::Test {
   MockRenderWidgetHostImpl* widget_host_;
   FakeRenderWidgetHostViewAura* view_;
 
-  IPC::TestSink* sink_;
+  IPC::TestSink* sink_ = nullptr;
   base::test::ScopedFeatureList mojo_feature_list_;
   base::test::ScopedFeatureList feature_list_;
 
@@ -828,7 +834,9 @@ class RenderWidgetHostViewAuraOverscrollTest
                           bool precise,
                           WebMouseWheelEvent::Phase phase) {
     WebMouseWheelEvent wheel_event = SyntheticWebMouseWheelEventBuilder::Build(
-        0, 0, dX, dY, modifiers, precise);
+        0, 0, dX, dY, modifiers,
+        precise ? ui::input_types::ScrollGranularity::kScrollByPrecisePixel
+                : ui::input_types::ScrollGranularity::kScrollByPixel);
     wheel_event.phase = phase;
     widget_host_->ForwardWheelEvent(wheel_event);
     base::RunLoop().RunUntilIdle();
@@ -2588,194 +2596,229 @@ TEST_F(RenderWidgetHostViewAuraTest, CompositorViewportPixelSizeWithScale) {
       view_->GetNativeView(),
       parent_view_->GetNativeView()->GetRootWindow(),
       gfx::Rect());
+
   sink_->ClearMessages();
+
   view_->SetSize(gfx::Size(100, 100));
-  EXPECT_EQ("100x100", view_->GetCompositorViewportPixelSize().ToString());
-  EXPECT_EQ(1u, sink_->message_count());
-  EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-            sink_->GetMessageAt(0)->type());
+
+  // Physical pixel size.
+  EXPECT_EQ(gfx::Size(100, 100), view_->GetCompositorViewportPixelSize());
+  // Update to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-              msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
-    EXPECT_EQ("100x100", std::get<0>(params).new_size.ToString());  // dip size
-    EXPECT_EQ("100x100",
-              std::get<0>(params)
-                  .compositor_viewport_pixel_rect.size()
-                  .ToString());  // backing size
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    // DIP size.
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+    // Physical pixel size.
+    EXPECT_EQ(gfx::Size(100, 100),
+              visual_properties.compositor_viewport_pixel_rect.size());
   }
 
   widget_host_->ResetSentVisualProperties();
   sink_->ClearMessages();
 
+  // Device scale factor changes to 2, so the physical pixel sizes should
+  // change, while the DIP sizes do not.
+
   aura_test_helper_->test_screen()->SetDeviceScaleFactor(2.0f);
-  EXPECT_EQ("200x200", view_->GetCompositorViewportPixelSize().ToString());
-  // Extra ScreenInfoChanged message for |parent_view_|.
-  // Changing the device scale factor triggers the
-  // RenderWidgetHostViewAura::OnDisplayMetricsChanged() observer callback,
-  // which sends a WidgetMsg_SynchronizeVisualProperties::ID message to the
-  // renderer.
-  EXPECT_EQ(1u, sink_->message_count());
-  EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-            sink_->GetMessageAt(0)->type());
+  // Physical pixel size.
+  EXPECT_EQ(gfx::Size(200, 200), view_->GetCompositorViewportPixelSize());
+  // Update to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    // DIP size.
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+    // Physical pixel size.
+    EXPECT_EQ(gfx::Size(200, 200),
+              visual_properties.compositor_viewport_pixel_rect.size());
+  }
 
   widget_host_->ResetSentVisualProperties();
   sink_->ClearMessages();
 
   aura_test_helper_->test_screen()->SetDeviceScaleFactor(1.0f);
-  // Extra ScreenInfoChanged message for |parent_view_|.
-  EXPECT_EQ(1u, sink_->message_count());
-  EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-            sink_->GetMessageAt(0)->type());
-  EXPECT_EQ("100x100", view_->GetCompositorViewportPixelSize().ToString());
+
+  // Physical pixel size.
+  EXPECT_EQ(gfx::Size(100, 100), view_->GetCompositorViewportPixelSize());
+  // Update to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    // DIP size.
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+    // Physical pixel size.
+    EXPECT_EQ(gfx::Size(100, 100),
+              visual_properties.compositor_viewport_pixel_rect.size());
+  }
 }
 
 // This test verifies that in AutoResize mode a new
-// WidgetMsg_SynchronizeVisualProperties message is sent when ScreenInfo
+// WidgetMsg_UpdateVisualProperties message is sent when ScreenInfo
 // changes and that message contains the latest ScreenInfo.
 TEST_F(RenderWidgetHostViewAuraTest, AutoResizeWithScale) {
   view_->InitAsChild(nullptr);
   aura::client::ParentWindowWithContext(
       view_->GetNativeView(), parent_view_->GetNativeView()->GetRootWindow(),
       gfx::Rect());
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation1(
-      view_->GetLocalSurfaceIdAllocation());
-  EXPECT_TRUE(local_surface_id_allocation1.IsValid());
+
+  viz::LocalSurfaceIdAllocation host_local_surface_id_allocation =
+      view_->GetLocalSurfaceIdAllocation();
+  EXPECT_TRUE(host_local_surface_id_allocation.IsValid());
 
   sink_->ClearMessages();
+
   view_->EnableAutoResize(gfx::Size(50, 50), gfx::Size(100, 100));
 
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation2;
+  // Update to the renderer. It includes the current LocalSurfaceIdAllocation.
   ASSERT_EQ(1u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-              msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
     VisualProperties visual_properties = std::get<0>(params);
-    EXPECT_EQ("50x50", visual_properties.min_size_for_auto_resize.ToString());
-    EXPECT_EQ("100x100", visual_properties.max_size_for_auto_resize.ToString());
+    // Auto resize parameters that we set above.
+    EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
+    // Default DSF is 1.
     EXPECT_EQ(1, visual_properties.screen_info.device_scale_factor);
-    local_surface_id_allocation2 =
-        visual_properties.local_surface_id_allocation.value_or(
-            viz::LocalSurfaceIdAllocation());
-    EXPECT_EQ(local_surface_id_allocation1, local_surface_id_allocation2);
-    EXPECT_TRUE(local_surface_id_allocation2.IsValid());
+    // Passed the original LocalSurfaceIdAllocation.
+    EXPECT_TRUE(visual_properties.local_surface_id_allocation.has_value());
+    EXPECT_EQ(host_local_surface_id_allocation,
+              visual_properties.local_surface_id_allocation.value());
   }
 
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation(
+  // Receive a changed LocalSurfaceIdAllocation from the renderer with a size.
+  viz::LocalSurfaceIdAllocation renderer_local_surface_id_allocation(
       viz::LocalSurfaceId(
-          local_surface_id_allocation1.local_surface_id()
+          host_local_surface_id_allocation.local_surface_id()
               .parent_sequence_number(),
-          local_surface_id_allocation1.local_surface_id()
+          host_local_surface_id_allocation.local_surface_id()
                   .child_sequence_number() +
               1,
-          local_surface_id_allocation1.local_surface_id().embed_token()),
+          host_local_surface_id_allocation.local_surface_id().embed_token()),
       base::TimeTicks::Now());
   {
     cc::RenderFrameMetadata metadata;
     metadata.viewport_size_in_pixels = gfx::Size(75, 75);
-    metadata.local_surface_id_allocation = local_surface_id_allocation;
+    metadata.local_surface_id_allocation = renderer_local_surface_id_allocation;
     widget_host_->DidUpdateVisualProperties(metadata);
   }
 
+  // Changing the device scale factor updates the renderer.
   sink_->ClearMessages();
   aura_test_helper_->test_screen()->SetDeviceScaleFactor(2.0f);
 
+  // Update to the renderer.
+  // TODO(samans): There should be only one message in the sink, but some
+  // testers are seeing two (crrev.com/c/839580). Investigate why.
+  ASSERT_LE(1u, sink_->message_count());
   {
-    // TODO(samans): There should be only one message in the sink, but some
-    // testers are seeing two (crrev.com/c/839580). Investigate why.
-    const IPC::Message* msg = sink_->GetFirstMessageMatching(
-        WidgetMsg_SynchronizeVisualProperties::ID);
+    const IPC::Message* msg =
+        sink_->GetFirstMessageMatching(WidgetMsg_UpdateVisualProperties::ID);
     ASSERT_TRUE(msg);
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
     VisualProperties visual_properties = std::get<0>(params);
-    EXPECT_EQ("50x50", visual_properties.min_size_for_auto_resize.ToString());
-    EXPECT_EQ("100x100", visual_properties.max_size_for_auto_resize.ToString());
+    // Auto resize parameters did not change as they DIP values.
+    EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
+    // Updated DSF for the renderer.
     EXPECT_EQ(2, visual_properties.screen_info.device_scale_factor);
-    EXPECT_NE(local_surface_id_allocation1,
-              visual_properties.local_surface_id_allocation.value_or(
-                  viz::LocalSurfaceIdAllocation()));
-    EXPECT_NE(local_surface_id_allocation2,
-              visual_properties.local_surface_id_allocation.value_or(
-                  viz::LocalSurfaceIdAllocation()));
+    // The LocalSurfaceIdAllocation has changed to the one from the renderer.
+    EXPECT_TRUE(visual_properties.local_surface_id_allocation.has_value());
+    EXPECT_NE(host_local_surface_id_allocation,
+              visual_properties.local_surface_id_allocation.value());
+    EXPECT_NE(renderer_local_surface_id_allocation,
+              visual_properties.local_surface_id_allocation.value());
   }
 }
 
 // This test verifies that in AutoResize mode a new
-// WidgetMsg_SynchronizeVisualProperties message is sent when size changes.
+// WidgetMsg_UpdateVisualProperties message is sent when size changes.
 TEST_F(RenderWidgetHostViewAuraTest, AutoResizeWithBrowserInitiatedResize) {
   view_->InitAsChild(nullptr);
   aura::client::ParentWindowWithContext(
       view_->GetNativeView(), parent_view_->GetNativeView()->GetRootWindow(),
       gfx::Rect());
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation1(
+  viz::LocalSurfaceIdAllocation host_local_surface_id_allocation(
       view_->GetLocalSurfaceIdAllocation());
-  EXPECT_TRUE(local_surface_id_allocation1.IsValid());
+  EXPECT_TRUE(host_local_surface_id_allocation.IsValid());
 
   sink_->ClearMessages();
   view_->EnableAutoResize(gfx::Size(50, 50), gfx::Size(100, 100));
 
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation2;
+  // WidgetMsg_UpdateVisualProperties is sent to the renderer.
   ASSERT_EQ(1u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-              msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
     VisualProperties visual_properties = std::get<0>(params);
-    EXPECT_EQ("50x50", visual_properties.min_size_for_auto_resize.ToString());
-    EXPECT_EQ("100x100", visual_properties.max_size_for_auto_resize.ToString());
-    EXPECT_EQ(1, visual_properties.screen_info.device_scale_factor);
-    local_surface_id_allocation2 =
-        visual_properties.local_surface_id_allocation.value_or(
-            viz::LocalSurfaceIdAllocation());
-    EXPECT_TRUE(local_surface_id_allocation2.IsValid());
-    EXPECT_EQ(local_surface_id_allocation1, local_surface_id_allocation2);
+    // Auto-resizve limits sent to the renderer.
+    EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
+    // The original LocalSurfaceIdAllocation is sent.
+    EXPECT_TRUE(visual_properties.local_surface_id_allocation.has_value());
+    EXPECT_EQ(host_local_surface_id_allocation,
+              visual_properties.local_surface_id_allocation.value());
   }
 
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation(
+  // A size arrives from the renderer with a changed LocalSurfaceIdAllocation.
+  viz::LocalSurfaceIdAllocation renderer_local_surface_id_allocation(
       viz::LocalSurfaceId(
-          local_surface_id_allocation1.local_surface_id()
+          host_local_surface_id_allocation.local_surface_id()
               .parent_sequence_number(),
-          local_surface_id_allocation1.local_surface_id()
+          host_local_surface_id_allocation.local_surface_id()
                   .child_sequence_number() +
               1,
-          local_surface_id_allocation1.local_surface_id().embed_token()),
+          host_local_surface_id_allocation.local_surface_id().embed_token()),
       base::TimeTicks::Now());
   {
     cc::RenderFrameMetadata metadata;
     metadata.viewport_size_in_pixels = gfx::Size(75, 75);
-    metadata.local_surface_id_allocation = local_surface_id_allocation;
+    metadata.local_surface_id_allocation = renderer_local_surface_id_allocation;
     widget_host_->DidUpdateVisualProperties(metadata);
   }
 
+  // Do a resize in the browser. It does not apply, but VisualProperties are
+  // sent. (Why?)
   sink_->ClearMessages();
-
   view_->SetSize(gfx::Size(120, 120));
-  viz::LocalSurfaceIdAllocation local_surface_id_allocation3;
+
+  // WidgetMsg_UpdateVisualProperties is sent to the renderer.
   ASSERT_EQ(1u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-              msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
     VisualProperties visual_properties = std::get<0>(params);
-    EXPECT_EQ("50x50", visual_properties.min_size_for_auto_resize.ToString());
-    EXPECT_EQ("100x100", visual_properties.max_size_for_auto_resize.ToString());
+    // Auto-resizve limits sent to the renderer.
+    EXPECT_EQ(gfx::Size(50, 50), visual_properties.min_size_for_auto_resize);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.max_size_for_auto_resize);
+    EXPECT_EQ(gfx::Size(120, 120), visual_properties.new_size);
     EXPECT_EQ(1, visual_properties.screen_info.device_scale_factor);
-    local_surface_id_allocation3 =
-        visual_properties.local_surface_id_allocation.value_or(
-            viz::LocalSurfaceIdAllocation());
-    EXPECT_TRUE(local_surface_id_allocation3.IsValid());
-    EXPECT_NE(local_surface_id_allocation1, local_surface_id_allocation3);
-    EXPECT_NE(local_surface_id_allocation2, local_surface_id_allocation3);
+    // A newly generated LocalSurfaceIdAllocation is sent.
+    EXPECT_TRUE(visual_properties.local_surface_id_allocation.has_value());
+    EXPECT_NE(host_local_surface_id_allocation,
+              visual_properties.local_surface_id_allocation.value());
+    EXPECT_NE(renderer_local_surface_id_allocation,
+              visual_properties.local_surface_id_allocation.value());
   }
 }
 
@@ -2813,7 +2856,7 @@ TEST_F(RenderWidgetHostViewAuraTest, ChildAllocationAcceptedInParent) {
 
 // This test verifies that if the parent is hidden when the child sends a
 // child-allocated viz::LocalSurfaceId, the parent will store it and it will
-// not send a WidgetMsg_SynchronizeVisualProperties back to the child.
+// not send a WidgetMsg_UpdateVisualProperties back to the child.
 TEST_F(RenderWidgetHostViewAuraTest,
        ChildAllocationAcceptedInParentWhileHidden) {
   view_->InitAsChild(nullptr);
@@ -2847,8 +2890,8 @@ TEST_F(RenderWidgetHostViewAuraTest,
   EXPECT_NE(local_surface_id_allocation1, local_surface_id_allocation3);
   EXPECT_EQ(local_surface_id_allocation2, local_surface_id_allocation3);
 
-  EXPECT_FALSE(sink_->GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID));
+  EXPECT_FALSE(
+      sink_->GetUniqueMessageMatching(WidgetMsg_UpdateVisualProperties::ID));
 }
 
 // This test verifies that when the child and parent both allocate their own
@@ -3131,14 +3174,13 @@ TEST_F(RenderWidgetHostViewAuraTest, DISABLED_FullscreenResize) {
   {
     // 0 is CreatingNew message.
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
+    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_UpdateVisualProperties::ID),
               msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
-    EXPECT_EQ(
-        "0,0 800x600",
-        std::get<0>(params).screen_info.available_rect.ToString());
-    EXPECT_EQ("800x600", std::get<0>(params).new_size.ToString());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    EXPECT_EQ(gfx::Rect(800, 600),
+              std::get<0>(params).screen_info.available_rect);
+    EXPECT_EQ(gfx::Size(800, 600), std::get<0>(params).new_size);
     // Resizes are blocked until we swapped a frame of the correct size, and
     // we've committed it.
     view_->SubmitCompositorFrame(
@@ -3156,17 +3198,16 @@ TEST_F(RenderWidgetHostViewAuraTest, DISABLED_FullscreenResize) {
   // Make sure the corrent screen size is set along in the resize
   // request when the screen size has changed.
   aura_test_helper_->test_screen()->SetUIScale(0.5);
-  EXPECT_EQ(1u, sink_->message_count());
+  ASSERT_EQ(1u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
+    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_UpdateVisualProperties::ID),
               msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
-    EXPECT_EQ(
-        "0,0 1600x1200",
-        std::get<0>(params).screen_info.available_rect.ToString());
-    EXPECT_EQ("1600x1200", std::get<0>(params).new_size.ToString());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    EXPECT_EQ(gfx::Rect(1600, 1200),
+              std::get<0>(params).screen_info.available_rect);
+    EXPECT_EQ(gfx::Size(1600, 1200), std::get<0>(params).new_size);
     view_->SubmitCompositorFrame(
         kArbitraryLocalSurfaceId,
         MakeDelegatedFrame(1.f, std::get<0>(params).new_size,
@@ -3178,31 +3219,35 @@ TEST_F(RenderWidgetHostViewAuraTest, DISABLED_FullscreenResize) {
 }
 
 TEST_F(RenderWidgetHostViewAuraTest, ZeroSizeStillGetsLocalSurfaceId) {
-  gfx::Size frame_size;
   parent_local_surface_id_allocator_.GenerateId();
   viz::LocalSurfaceId local_surface_id =
       parent_local_surface_id_allocator_.GetCurrentLocalSurfaceIdAllocation()
           .local_surface_id();
 
   view_->InitAsChild(nullptr);
+
+  // Set an empty size.
   aura::client::ParentWindowWithContext(
       view_->GetNativeView(), parent_view_->GetNativeView()->GetRootWindow(),
       gfx::Rect());
-  view_->SetSize(frame_size);
-  view_->Show();
 
+  // It's set on the layer.
   ui::Layer* parent_layer = view_->GetNativeView()->layer();
   EXPECT_EQ(gfx::Rect(), parent_layer->bounds());
-  EXPECT_EQ(2u, sink_->message_count());
+
+  // Update to the renderer.
+  ASSERT_EQ(2u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(1);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
-              msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
-    EXPECT_EQ(frame_size.ToString(), std::get<0>(params).new_size.ToString());
-    ASSERT_TRUE(std::get<0>(params).local_surface_id_allocation.has_value());
-    EXPECT_TRUE(std::get<0>(params).local_surface_id_allocation->IsValid());
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    // Empty size is sent.
+    EXPECT_EQ(gfx::Size(), visual_properties.new_size);
+    // A LocalSurfaceIdAllocation is sent too.
+    ASSERT_TRUE(visual_properties.local_surface_id_allocation.has_value());
+    EXPECT_TRUE(visual_properties.local_surface_id_allocation->IsValid());
   }
 }
 
@@ -3294,14 +3339,14 @@ TEST_F(RenderWidgetHostViewAuraTest, DISABLED_Resize) {
   // Resize renderer, should produce a Resize message
   view_->SetSize(size2);
   EXPECT_EQ(size2.ToString(), view_->GetRequestedRendererSize().ToString());
-  EXPECT_EQ(1u, sink_->message_count());
+  ASSERT_EQ(1u, sink_->message_count());
   {
     const IPC::Message* msg = sink_->GetMessageAt(0);
-    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_SynchronizeVisualProperties::ID),
+    EXPECT_EQ(static_cast<uint32_t>(WidgetMsg_UpdateVisualProperties::ID),
               msg->type());
-    WidgetMsg_SynchronizeVisualProperties::Param params;
-    WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
-    EXPECT_EQ(size2.ToString(), std::get<0>(params).new_size.ToString());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    EXPECT_EQ(size2, std::get<0>(params).new_size);
   }
   // Send resize ack to observe new Resize messages.
   {
@@ -3353,11 +3398,11 @@ TEST_F(RenderWidgetHostViewAuraTest, DISABLED_Resize) {
   for (uint32_t i = 0; i < sink_->message_count(); ++i) {
     const IPC::Message* msg = sink_->GetMessageAt(i);
     switch (msg->type()) {
-      case WidgetMsg_SynchronizeVisualProperties::ID: {
+      case WidgetMsg_UpdateVisualProperties::ID: {
         EXPECT_FALSE(has_resize);
-        WidgetMsg_SynchronizeVisualProperties::Param params;
-        WidgetMsg_SynchronizeVisualProperties::Read(msg, &params);
-        EXPECT_EQ(size3.ToString(), std::get<0>(params).new_size.ToString());
+        WidgetMsg_UpdateVisualProperties::Param params;
+        WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+        EXPECT_EQ(size3, std::get<0>(params).new_size);
         has_resize = true;
         break;
       }
@@ -3709,25 +3754,43 @@ TEST_F(RenderWidgetHostViewAuraTest, VisibleViewportTest) {
       view_->GetNativeView(),
       parent_view_->GetNativeView()->GetRootWindow(),
       gfx::Rect());
+
+  sink_->ClearMessages();
   view_->SetSize(view_rect.size());
   view_->Show();
 
   // Defaults to full height of the view.
   EXPECT_EQ(100, view_->GetVisibleViewportSize().height());
 
+  // Update to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.visible_viewport_size);
+  }
+
   widget_host_->ResetSentVisualProperties();
+
   sink_->ClearMessages();
   view_->SetInsets(gfx::Insets(0, 0, 40, 0));
-
   EXPECT_EQ(60, view_->GetVisibleViewportSize().height());
 
-  const IPC::Message* message =
-      sink_->GetFirstMessageMatching(WidgetMsg_SynchronizeVisualProperties::ID);
-  ASSERT_TRUE(message != nullptr);
-
-  WidgetMsg_SynchronizeVisualProperties::Param params;
-  WidgetMsg_SynchronizeVisualProperties::Read(message, &params);
-  EXPECT_EQ(60, std::get<0>(params).visible_viewport_size.height());
+  // Update to the renderer has the inset size.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties visual_properties = std::get<0>(params);
+    EXPECT_EQ(gfx::Size(100, 100), visual_properties.new_size);
+    EXPECT_EQ(gfx::Size(100, 60), visual_properties.visible_viewport_size);
+  }
 }
 
 // Ensures that touch event positions are never truncated to integers.
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_base.cc b/chromium/content/browser/renderer_host/render_widget_host_view_base.cc
index dbfcd1da5c8..50aad3c8d62 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_base.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_base.cc
@@ -710,6 +710,11 @@ bool RenderWidgetHostViewBase::CanSynchronizeVisualProperties() {
   return true;
 }
 
+std::vector<std::unique_ptr<ui::TouchEvent>>
+RenderWidgetHostViewBase::ExtractAndCancelActiveTouches() {
+  return {};
+}
+
 void RenderWidgetHostViewBase::TextInputStateChanged(
     const TextInputState& text_input_state) {
   if (GetTextInputManager())
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_base.h b/chromium/content/browser/renderer_host/render_widget_host_view_base.h
index 2bd5d56bc37..add7df1a443 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_base.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_base.h
@@ -60,6 +60,7 @@ class WebMouseWheelEvent;
 namespace ui {
 enum class DomCode;
 class LatencyInfo;
+class TouchEvent;
 struct DidOverscrollParams;
 }
 
@@ -431,9 +432,15 @@ class CONTENT_EXPORT RenderWidgetHostViewBase
   // synchronization, the default implementation returns true.
   virtual bool CanSynchronizeVisualProperties();
 
-  // Cancels any existing active pointers by dispatching synthetic cancel
-  // events.
-  virtual void CancelActiveTouches() {}
+  // Extracts information about any active pointers and cancels any existing
+  // active pointers by dispatching synthetic cancel events.
+  virtual std::vector<std::unique_ptr<ui::TouchEvent>>
+  ExtractAndCancelActiveTouches();
+
+  // Used to transfer pointer state from one view to another. It recreates the
+  // pointer state by dispatching touch down events.
+  virtual void TransferTouches(
+      const std::vector<std::unique_ptr<ui::TouchEvent>>& touches) {}
 
   //----------------------------------------------------------------------------
   // The following methods are related to IME.
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
index d426adda8c7..8e38b301038 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_child_frame_unittest.cc
@@ -29,6 +29,7 @@
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/common/frame_visual_properties.h"
+#include "content/common/view_messages.h"
 #include "content/common/widget_messages.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/test/browser_task_environment.h"
@@ -38,6 +39,9 @@
 #include "content/test/mock_render_widget_host_delegate.h"
 #include "content/test/mock_widget_impl.h"
 #include "content/test/test_render_view_host.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/frame/occlusion_state.h"
 #include "ui/base/ui_base_features.h"
@@ -112,9 +116,13 @@ class RenderWidgetHostViewChildFrameTest : public testing::Test {
 
     MockRenderProcessHost* process_host =
         new MockRenderProcessHost(browser_context_.get());
+
     int32_t routing_id = process_host->GetNextRoutingID();
-    mojom::WidgetPtr widget;
-    widget_impl_ = std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+    sink_ = &process_host->sink();
+
+    mojo::PendingRemote<mojom::Widget> widget;
+    widget_impl_ = std::make_unique<MockWidgetImpl>(
+        widget.InitWithNewPipeAndPassReceiver());
     widget_host_ = new RenderWidgetHostImpl(
         &delegate_, process_host, routing_id, std::move(widget), false);
     view_ = RenderWidgetHostViewChildFrame::Create(widget_host_);
@@ -124,19 +132,19 @@ class RenderWidgetHostViewChildFrameTest : public testing::Test {
     test_frame_connector_->SetView(view_);
     view_->SetFrameConnectorDelegate(test_frame_connector_);
 
-    viz::mojom::CompositorFrameSinkPtr sink;
-    viz::mojom::CompositorFrameSinkRequest sink_request =
-        mojo::MakeRequest(&sink);
-    viz::mojom::CompositorFrameSinkClientRequest client_request =
-        mojo::MakeRequest(&renderer_compositor_frame_sink_ptr_);
+    mojo::PendingRemote<viz::mojom::CompositorFrameSink> sink;
+    mojo::PendingReceiver<viz::mojom::CompositorFrameSink> sink_receiver =
+        sink.InitWithNewPipeAndPassReceiver();
     renderer_compositor_frame_sink_ =
         std::make_unique<FakeRendererCompositorFrameSink>(
-            std::move(sink), std::move(client_request));
+            std::move(sink), renderer_compositor_frame_sink_remote_
+                                 .BindNewPipeAndPassReceiver());
     view_->DidCreateNewRendererCompositorFrameSink(
-        renderer_compositor_frame_sink_ptr_.get());
+        renderer_compositor_frame_sink_remote_.get());
   }
 
   void TearDown() override {
+    sink_ = nullptr;
     if (view_)
       view_->Destroy();
     delete widget_host_;
@@ -164,6 +172,7 @@ class RenderWidgetHostViewChildFrameTest : public testing::Test {
   BrowserTaskEnvironment task_environment_;
 
   std::unique_ptr<BrowserContext> browser_context_;
+  IPC::TestSink* sink_ = nullptr;
   MockRenderWidgetHostDelegate delegate_;
 
   // Tests should set these to NULL if they've already triggered their
@@ -176,7 +185,8 @@ class RenderWidgetHostViewChildFrameTest : public testing::Test {
       renderer_compositor_frame_sink_;
 
  private:
-  viz::mojom::CompositorFrameSinkClientPtr renderer_compositor_frame_sink_ptr_;
+  mojo::Remote<viz::mojom::CompositorFrameSinkClient>
+      renderer_compositor_frame_sink_remote_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidgetHostViewChildFrameTest);
 };
@@ -283,30 +293,33 @@ TEST_F(RenderWidgetHostViewChildFrameTest,
       allocator.GetCurrentLocalSurfaceIdAllocation();
   constexpr viz::FrameSinkId frame_sink_id(1, 1);
 
-  process->sink().ClearMessages();
-
   FrameVisualProperties visual_properties;
   visual_properties.screen_space_rect = screen_space_rect;
   visual_properties.compositor_viewport = compositor_viewport_pixel_rect;
   visual_properties.local_frame_size = compositor_viewport_pixel_rect.size();
   visual_properties.capture_sequence_number = 123u;
   visual_properties.local_surface_id_allocation = local_surface_id_allocation;
+
+  sink_->ClearMessages();
   test_frame_connector_->SynchronizeVisualProperties(frame_sink_id,
                                                      visual_properties);
 
-  ASSERT_EQ(1u, process->sink().message_count());
-
-  const IPC::Message* resize_msg = process->sink().GetUniqueMessageMatching(
-      WidgetMsg_SynchronizeVisualProperties::ID);
-  ASSERT_NE(nullptr, resize_msg);
-  WidgetMsg_SynchronizeVisualProperties::Param params;
-  WidgetMsg_SynchronizeVisualProperties::Read(resize_msg, &params);
-  EXPECT_EQ(compositor_viewport_pixel_rect,
-            std::get<0>(params).compositor_viewport_pixel_rect);
-  EXPECT_EQ(screen_space_rect.size(), std::get<0>(params).new_size);
-  EXPECT_EQ(local_surface_id_allocation,
-            std::get<0>(params).local_surface_id_allocation);
-  EXPECT_EQ(123u, std::get<0>(params).capture_sequence_number);
+  // Update to the renderer.
+  ASSERT_EQ(1u, sink_->message_count());
+  {
+    const IPC::Message* msg = sink_->GetMessageAt(0);
+    ASSERT_EQ(WidgetMsg_UpdateVisualProperties::ID, msg->type());
+    WidgetMsg_UpdateVisualProperties::Param params;
+    WidgetMsg_UpdateVisualProperties::Read(msg, &params);
+    VisualProperties sent_visual_properties = std::get<0>(params);
+
+    EXPECT_EQ(compositor_viewport_pixel_rect,
+              sent_visual_properties.compositor_viewport_pixel_rect);
+    EXPECT_EQ(screen_space_rect.size(), sent_visual_properties.new_size);
+    EXPECT_EQ(local_surface_id_allocation,
+              sent_visual_properties.local_surface_id_allocation);
+    EXPECT_EQ(123u, sent_visual_properties.capture_sequence_number);
+  }
 }
 
 // Test that when we have a gesture scroll sequence that is not consumed by the
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac.h b/chromium/content/browser/renderer_host/render_widget_host_view_mac.h
index 0bf2a269abf..16a8769196a 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac.h
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac.h
@@ -23,7 +23,8 @@
 #include "content/common/content_export.h"
 #include "content/common/render_widget_host_ns_view.mojom.h"
 #include "ipc/ipc_sender.h"
-#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "ui/accelerated_widget_mac/accelerated_widget_mac.h"
 #include "ui/base/cocoa/accessibility_focus_overrider.h"
 #include "ui/base/cocoa/remote_layer_api.h"
@@ -524,7 +525,7 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
   void GetPageTextForSpeech(SpeechCallback callback);
 
   // Interface through which the NSView is to be manipulated. This points either
-  // to |in_process_ns_view_bridge_| or to |remote_ns_view_ptr_|.
+  // to |in_process_ns_view_bridge_| or to |remote_ns_view_|.
   remote_cocoa::mojom::RenderWidgetHostNSView* ns_view_ = nullptr;
 
   // If |ns_view_| is hosted in this process, then this will be non-null,
@@ -535,11 +536,12 @@ class CONTENT_EXPORT RenderWidgetHostViewMac
       in_process_ns_view_bridge_;
 
   // If the NSView is hosted in a remote process and accessed via mojo then
-  // - |ns_view_| will point to |remote_ns_view_ptr_|
-  // - |remote_ns_view_client_binding_| is the binding provided to the bridge.
-  remote_cocoa::mojom::RenderWidgetHostNSViewAssociatedPtr remote_ns_view_ptr_;
-  mojo::AssociatedBinding<remote_cocoa::mojom::RenderWidgetHostNSViewHost>
-      remote_ns_view_client_binding_;
+  // - |ns_view_| will point to |remote_ns_view_|
+  // - |remote_ns_view_client_receiver_| is the receiver provided to the bridge.
+  mojo::AssociatedRemote<remote_cocoa::mojom::RenderWidgetHostNSView>
+      remote_ns_view_;
+  mojo::AssociatedReceiver<remote_cocoa::mojom::RenderWidgetHostNSViewHost>
+      remote_ns_view_client_receiver_{this};
 
   // State tracked by Show/Hide/IsShowing.
   bool is_visible_ = false;
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm
index 7a3503fc687..4549c3d871d 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac.mm
@@ -174,7 +174,6 @@ RenderWidgetHostViewMac::RenderWidgetHostViewMac(RenderWidgetHost* widget,
     : RenderWidgetHostViewBase(widget),
       page_at_minimum_scale_(true),
       mouse_wheel_phase_handler_(this),
-      remote_ns_view_client_binding_(this),
       is_loading_(false),
       is_guest_view_hack_(is_guest_view_hack),
       popup_parent_host_view_(nullptr),
@@ -248,10 +247,10 @@ void RenderWidgetHostViewMac::MigrateNSViewBridge(
   remote_window_accessible_.reset();
 
   // Disconnect from the previous bridge (this will have the effect of
-  // destroying the associated bridge), and close the binding (to allow it
+  // destroying the associated bridge), and close the receiver (to allow it
   // to be re-bound). Note that |in_process_ns_view_bridge_| remains valid.
-  remote_ns_view_client_binding_.Close();
-  remote_ns_view_ptr_.reset();
+  remote_ns_view_client_receiver_.reset();
+  remote_ns_view_.reset();
 
   // Enable accessibility focus overriding for remote NSViews.
   accessibility_focus_overrider_.SetAppIsRemote(remote_cocoa_application !=
@@ -263,26 +262,26 @@ void RenderWidgetHostViewMac::MigrateNSViewBridge(
     return;
   }
 
-  remote_cocoa::mojom::RenderWidgetHostNSViewHostAssociatedPtr client;
-  remote_ns_view_client_binding_.Bind(mojo::MakeRequest(&client));
-  remote_cocoa::mojom::RenderWidgetHostNSViewAssociatedRequest bridge_request =
-      mojo::MakeRequest(&remote_ns_view_ptr_);
+  mojo::PendingAssociatedRemote<remote_cocoa::mojom::RenderWidgetHostNSViewHost>
+      client = remote_ns_view_client_receiver_.BindNewEndpointAndPassRemote();
+  mojo::PendingAssociatedReceiver<remote_cocoa::mojom::RenderWidgetHostNSView>
+      view_receiver = remote_ns_view_.BindNewEndpointAndPassReceiver();
 
   // Cast from mojom::RenderWidgetHostNSViewHostPtr and
-  // mojom::RenderWidgetHostNSViewBridgeRequest to the public interfaces
-  // accepted by the application.
+  // mojo::PendingAssociatedReceiver<mojom::RenderWidgetHostNSView> to the
+  // public interfaces accepted by the application.
   // TODO(ccameron): Remove the need for this cast.
   // https://crbug.com/888290
   mojo::AssociatedInterfacePtrInfo<remote_cocoa::mojom::StubInterface>
-      stub_client(client.PassInterface().PassHandle(), 0);
+      stub_client(client.PassHandle(), 0);
   remote_cocoa::mojom::StubInterfaceAssociatedRequest stub_bridge_request(
-      bridge_request.PassHandle());
+      view_receiver.PassHandle());
 
   remote_cocoa_application->CreateRenderWidgetHostNSView(
       std::move(stub_client), std::move(stub_bridge_request));
 
-  ns_view_ = remote_ns_view_ptr_.get();
-  remote_ns_view_ptr_->SetParentWebContentsNSView(parent_ns_view_id);
+  ns_view_ = remote_ns_view_.get();
+  remote_ns_view_->SetParentWebContentsNSView(parent_ns_view_id);
 }
 
 void RenderWidgetHostViewMac::SetParentUiLayer(ui::Layer* parent_ui_layer) {
@@ -508,6 +507,10 @@ gfx::NativeViewAccessible RenderWidgetHostViewMac::GetNativeViewAccessible() {
 }
 
 void RenderWidgetHostViewMac::Focus() {
+  // Ignore redundant calls, as they can cause unending loops of focus-setting.
+  // https://crbug.com/998123
+  if (is_first_responder_)
+    return;
   ns_view_->MakeFirstResponder();
 }
 
@@ -701,8 +704,8 @@ void RenderWidgetHostViewMac::Destroy() {
   // the other side of |ns_view_| may outlive us due to other retains.
   ns_view_ = nullptr;
   in_process_ns_view_bridge_.reset();
-  remote_ns_view_client_binding_.Close();
-  remote_ns_view_ptr_.reset();
+  remote_ns_view_client_receiver_.reset();
+  remote_ns_view_.reset();
 
   // Delete the delegated frame state, which will reach back into
   // host().
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm
index ce90b1ddbbf..4bdbb690bc4 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac_editcommand_helper_unittest.mm
@@ -20,6 +20,7 @@
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/mock_widget_impl.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/platform_test.h"
@@ -140,44 +141,45 @@ TEST_F(RenderWidgetHostViewMacEditCommandHelperWithTaskEnvTest,
   supported_factors.push_back(ui::SCALE_FACTOR_100P);
   ui::test::ScopedSetSupportedScaleFactors scoped_supported(supported_factors);
 
-  base::mac::ScopedNSAutoreleasePool pool;
+  @autoreleasepool {
+    int32_t routing_id = process_host->GetNextRoutingID();
+    mojo::PendingRemote<mojom::Widget> widget;
+    std::unique_ptr<MockWidgetImpl> widget_impl =
+        std::make_unique<MockWidgetImpl>(
+            widget.InitWithNewPipeAndPassReceiver());
 
-  int32_t routing_id = process_host->GetNextRoutingID();
-  mojom::WidgetPtr widget;
-  std::unique_ptr<MockWidgetImpl> widget_impl =
-      std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+    RenderWidgetHostImpl* render_widget = new RenderWidgetHostImpl(
+        &delegate, process_host, routing_id, std::move(widget), false);
 
-  RenderWidgetHostImpl* render_widget = new RenderWidgetHostImpl(
-      &delegate, process_host, routing_id, std::move(widget), false);
+    ui::WindowResizeHelperMac::Get()->Init(base::ThreadTaskRunnerHandle::Get());
 
-  ui::WindowResizeHelperMac::Get()->Init(base::ThreadTaskRunnerHandle::Get());
+    // Owned by its |GetInProcessNSView()|, i.e. |rwhv_cocoa|.
+    RenderWidgetHostViewMac* rwhv_mac =
+        new RenderWidgetHostViewMac(render_widget, false);
+    base::scoped_nsobject<RenderWidgetHostViewCocoa> rwhv_cocoa(
+        [rwhv_mac->GetInProcessNSView() retain]);
 
-  // Owned by its |GetInProcessNSView()|, i.e. |rwhv_cocoa|.
-  RenderWidgetHostViewMac* rwhv_mac = new RenderWidgetHostViewMac(
-      render_widget, false);
-  base::scoped_nsobject<RenderWidgetHostViewCocoa> rwhv_cocoa(
-      [rwhv_mac->GetInProcessNSView() retain]);
+    RenderWidgetHostViewMacEditCommandHelper helper;
+    NSArray* edit_command_strings = helper.GetEditSelectorNames();
+    RenderWidgetHostNSViewHostOwner* rwhwvm_owner =
+        [[[RenderWidgetHostNSViewHostOwner alloc]
+            initWithRenderWidgetHostViewMac:rwhv_mac] autorelease];
 
-  RenderWidgetHostViewMacEditCommandHelper helper;
-  NSArray* edit_command_strings = helper.GetEditSelectorNames();
-  RenderWidgetHostNSViewHostOwner* rwhwvm_owner =
-      [[[RenderWidgetHostNSViewHostOwner alloc]
-          initWithRenderWidgetHostViewMac:rwhv_mac] autorelease];
+    helper.AddEditingSelectorsToClass([rwhwvm_owner class]);
 
-  helper.AddEditingSelectorsToClass([rwhwvm_owner class]);
-
-  for (NSString* edit_command_name in edit_command_strings) {
-    NSString* sel_str = [edit_command_name stringByAppendingString:@":"];
-    [rwhwvm_owner performSelector:NSSelectorFromString(sel_str) withObject:nil];
-  }
+    for (NSString* edit_command_name in edit_command_strings) {
+      NSString* sel_str = [edit_command_name stringByAppendingString:@":"];
+      [rwhwvm_owner performSelector:NSSelectorFromString(sel_str)
+                         withObject:nil];
+    }
 
-  size_t num_edit_commands = [edit_command_strings count];
-  EXPECT_EQ(delegate.edit_command_message_count_, num_edit_commands);
-  rwhv_cocoa.reset();
-  pool.Recycle();
+    size_t num_edit_commands = [edit_command_strings count];
+    EXPECT_EQ(delegate.edit_command_message_count_, num_edit_commands);
+    rwhv_cocoa.reset();
 
-  // The |render_widget|'s process needs to be deleted within |message_loop|.
-  delete render_widget;
+    // The |render_widget|'s process needs to be deleted within |message_loop|.
+    delete render_widget;
+  }
 
   ui::WindowResizeHelperMac::Get()->ShutdownForTests();
 }
diff --git a/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm b/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
index ed5c7d561a6..f4ac9aaa6c4 100644
--- a/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
+++ b/chromium/content/browser/renderer_host/render_widget_host_view_mac_unittest.mm
@@ -49,6 +49,7 @@
 #include "content/test/test_render_view_host.h"
 #include "gpu/ipc/common/gpu_messages.h"
 #include "gpu/ipc/service/image_transport_surface.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
@@ -340,9 +341,10 @@ class MockRenderWidgetHostImpl : public RenderWidgetHostImpl {
   static MockRenderWidgetHostImpl* Create(RenderWidgetHostDelegate* delegate,
                                           RenderProcessHost* process,
                                           int32_t routing_id) {
-    mojom::WidgetPtr widget;
+    mojo::PendingRemote<mojom::Widget> widget;
     std::unique_ptr<MockWidgetImpl> widget_impl =
-        std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+        std::make_unique<MockWidgetImpl>(
+            widget.InitWithNewPipeAndPassReceiver());
 
     return new MockRenderWidgetHostImpl(delegate, process, routing_id,
                                         std::move(widget_impl),
@@ -361,7 +363,7 @@ class MockRenderWidgetHostImpl : public RenderWidgetHostImpl {
                            RenderProcessHost* process,
                            int32_t routing_id,
                            std::unique_ptr<MockWidgetImpl> widget_impl,
-                           mojom::WidgetPtr widget)
+                           mojo::PendingRemote<mojom::Widget> widget)
       : RenderWidgetHostImpl(delegate,
                              process,
                              routing_id,
@@ -475,11 +477,11 @@ class MockRenderWidgetHostOwnerDelegate
 class RenderWidgetHostViewMacTest : public RenderViewHostImplTestHarness {
  public:
   RenderWidgetHostViewMacTest() : rwhv_mac_(nullptr) {
-    mock_clock_.Advance(base::TimeDelta::FromMilliseconds(100));
-    ui::SetEventTickClockForTesting(&mock_clock_);
   }
 
   void SetUp() override {
+    mock_clock_.Advance(base::TimeDelta::FromMilliseconds(100));
+    ui::SetEventTickClockForTesting(&mock_clock_);
     RenderViewHostImplTestHarness::SetUp();
     base::test::ScopedFeatureList feature_list;
     feature_list.InitAndEnableFeature(features::kDirectManipulationStylus);
@@ -504,6 +506,7 @@ class RenderWidgetHostViewMacTest : public RenderViewHostImplTestHarness {
   }
 
   void TearDown() override {
+    ui::SetEventTickClockForTesting(nullptr);
     rwhv_cocoa_.reset();
     // RenderWidgetHostImpls with an owner delegate are not expected to be self-
     // deleting.
diff --git a/chromium/content/browser/renderer_host/render_widget_targeter.cc b/chromium/content/browser/renderer_host/render_widget_targeter.cc
index 1cdeba1d8f0..6e1211835c1 100644
--- a/chromium/content/browser/renderer_host/render_widget_targeter.cc
+++ b/chromium/content/browser/renderer_host/render_widget_targeter.cc
@@ -38,6 +38,12 @@ gfx::PointF ComputeEventLocation(const blink::WebInputEvent& event) {
   return gfx::PointF();
 }
 
+bool IsMouseMiddleClick(const blink::WebInputEvent& event) {
+  return (event.GetType() == blink::WebInputEvent::Type::kMouseDown &&
+          static_cast<const blink::WebMouseEvent&>(event).button ==
+              blink::WebPointerProperties::Button::kMiddle);
+}
+
 constexpr const char kTracingCategory[] = "input,latency";
 
 }  // namespace
@@ -241,15 +247,21 @@ void RenderWidgetTargeter::ResolveTargetingRequest(TargetingRequest request) {
 
   RenderWidgetTargetResult result;
   if (request.IsWebInputEventRequest()) {
-    result = delegate_->FindTargetSynchronously(request.GetRootView(),
-                                                request.GetEvent());
+    result = is_autoscroll_in_progress_
+                 ? middle_click_result_
+                 : delegate_->FindTargetSynchronously(request.GetRootView(),
+                                                      request.GetEvent());
+    if (!is_autoscroll_in_progress_ && IsMouseMiddleClick(request.GetEvent())) {
+      if (!result.should_query_view)
+        middle_click_result_ = result;
+    }
   } else {
     result = delegate_->FindTargetSynchronouslyAtPoint(request.GetRootView(),
                                                        request.GetLocation());
   }
   RenderWidgetHostViewBase* target = result.view;
   async_depth_ = 0;
-  if (result.should_query_view) {
+  if (!is_autoscroll_in_progress_ && result.should_query_view) {
     TRACE_EVENT_WITH_FLOW2(
         "viz,benchmark", "Event.Pipeline", TRACE_ID_GLOBAL(trace_id_),
         TRACE_EVENT_FLAG_FLOW_OUT, "step", "QueryClient(Start)",
@@ -278,12 +290,25 @@ void RenderWidgetTargeter::ResolveTargetingRequest(TargetingRequest request) {
 
 void RenderWidgetTargeter::ViewWillBeDestroyed(RenderWidgetHostViewBase* view) {
   unresponsive_views_.erase(view);
+
+  if (is_autoscroll_in_progress_ && middle_click_result_.view == view) {
+    SetIsAutoScrollInProgress(false);
+  }
 }
 
 bool RenderWidgetTargeter::HasEventsPendingDispatch() const {
   return request_in_flight_ || !requests_.empty();
 }
 
+void RenderWidgetTargeter::SetIsAutoScrollInProgress(
+    bool autoscroll_in_progress) {
+  is_autoscroll_in_progress_ = autoscroll_in_progress;
+
+  // If middle click autoscroll ends, reset |middle_click_result_|.
+  if (!autoscroll_in_progress)
+    middle_click_result_ = RenderWidgetTargetResult();
+}
+
 void RenderWidgetTargeter::QueryClientInternal(
     RenderWidgetHostViewBase* target,
     const gfx::PointF& target_location,
@@ -445,6 +470,11 @@ void RenderWidgetTargeter::FoundFrameSinkId(
                              TRACE_EVENT_FLAG_FLOW_IN, "step", "FoundTarget");
     }
 
+    if (request.IsWebInputEventRequest() &&
+        IsMouseMiddleClick(request.GetEvent())) {
+      middle_click_result_ = {view, false, transformed_location, false, false};
+    }
+
     FoundTarget(view, transformed_location, false, &request);
   } else {
     QueryClientInternal(view, transformed_location, target.get(),
diff --git a/chromium/content/browser/renderer_host/render_widget_targeter.h b/chromium/content/browser/renderer_host/render_widget_targeter.h
index 04f9ce9a544..058f01ca1e3 100644
--- a/chromium/content/browser/renderer_host/render_widget_targeter.h
+++ b/chromium/content/browser/renderer_host/render_widget_targeter.h
@@ -134,6 +134,10 @@ class RenderWidgetTargeter {
     return request_in_flight_.has_value();
   }
 
+  void SetIsAutoScrollInProgress(bool autoscroll_in_progress);
+
+  bool is_auto_scroll_in_progress() const { return is_autoscroll_in_progress_; }
+
  private:
   class TargetingRequest {
    public:
@@ -272,6 +276,12 @@ class RenderWidgetTargeter {
   // do async hit-testing.
   uint32_t async_depth_ = 0;
 
+  // Target to send events to if autoscroll is in progress
+  RenderWidgetTargetResult middle_click_result_;
+
+  // True when the user middle click's mouse for autoscroll
+  bool is_autoscroll_in_progress_ = false;
+
   // This value limits how long to wait for a response from the renderer
   // process before giving up and resuming event processing.
   base::TimeDelta async_hit_test_timeout_delay_ =
diff --git a/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm b/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm
index fbc61b9096a..28d2c588bc6 100644
--- a/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm
+++ b/chromium/content/browser/renderer_host/text_input_client_mac_unittest.mm
@@ -21,6 +21,7 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/test/mock_widget_impl.h"
 #include "ipc/ipc_test_sink.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/gtest_mac.h"
 
@@ -57,9 +58,9 @@ class TextInputClientMacTest : public testing::Test {
     RenderProcessHost* rph =
         process_factory_.CreateRenderProcessHost(&browser_context_, nullptr);
     int32_t routing_id = rph->GetNextRoutingID();
-    mojom::WidgetPtr widget;
-    mock_widget_impl_ =
-        std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+    mojo::PendingRemote<mojom::Widget> widget;
+    mock_widget_impl_ = std::make_unique<MockWidgetImpl>(
+        widget.InitWithNewPipeAndPassReceiver());
 
     widget_.reset(new RenderWidgetHostImpl(&delegate_, rph, routing_id,
                                            std::move(widget), false));
diff --git a/chromium/content/browser/renderer_interface_binders.cc b/chromium/content/browser/renderer_interface_binders.cc
index 8f30cab8754..6b584056fa0 100644
--- a/chromium/content/browser/renderer_interface_binders.cc
+++ b/chromium/content/browser/renderer_interface_binders.cc
@@ -12,13 +12,8 @@
 #include "base/no_destructor.h"
 #include "base/task/post_task.h"
 #include "content/browser/child_process_security_policy_impl.h"
-#include "content/browser/content_index/content_index_service_impl.h"
-#include "content/browser/cookie_store/cookie_store_context.h"
-#include "content/browser/gpu/gpu_process_host.h"
-#include "content/browser/locks/lock_manager.h"
 #include "content/browser/native_file_system/native_file_system_manager_impl.h"
 #include "content/browser/notifications/platform_notification_context_impl.h"
-#include "content/browser/payments/payment_manager.h"
 #include "content/browser/permissions/permission_service_context.h"
 #include "content/browser/quota_dispatcher_host.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
@@ -30,24 +25,15 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "media/mojo/mojom/video_decode_perf_history.mojom.h"
-#include "media/mojo/services/video_decode_perf_history.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
-#include "services/device/public/mojom/constants.mojom.h"
-#include "services/device/public/mojom/vibration_manager.mojom.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
-#include "services/service_manager/public/cpp/connector.h"
-#include "services/shape_detection/public/mojom/barcodedetection_provider.mojom.h"
-#include "services/shape_detection/public/mojom/facedetection_provider.mojom.h"
-#include "services/shape_detection/public/mojom/shape_detection_service.mojom.h"
-#include "services/shape_detection/public/mojom/textdetection.mojom.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
-#include "third_party/blink/public/mojom/cookie_store/cookie_store.mojom.h"
 #include "third_party/blink/public/mojom/native_file_system/native_file_system_manager.mojom.h"
 #include "third_party/blink/public/mojom/notifications/notification_service.mojom.h"
 #include "url/origin.h"
@@ -99,59 +85,6 @@ class RendererInterfaceBinders {
       parameterized_binder_registry_;
 };
 
-void BindShapeDetectionServiceOnIOThread(
-    mojo::PendingReceiver<shape_detection::mojom::ShapeDetectionService>
-        receiver) {
-  auto* gpu = GpuProcessHost::Get();
-  if (gpu)
-    gpu->RunService(std::move(receiver));
-}
-
-shape_detection::mojom::ShapeDetectionService* GetShapeDetectionService() {
-  static base::NoDestructor<
-      mojo::Remote<shape_detection::mojom::ShapeDetectionService>>
-      remote;
-  if (!*remote) {
-    base::PostTask(FROM_HERE, {BrowserThread::IO},
-                   base::BindOnce(&BindShapeDetectionServiceOnIOThread,
-                                  remote->BindNewPipeAndPassReceiver()));
-    remote->reset_on_disconnect();
-  }
-
-  return remote->get();
-}
-
-void BindBarcodeDetectionProvider(
-    shape_detection::mojom::BarcodeDetectionProviderRequest request,
-    RenderProcessHost* host,
-    const url::Origin& origin) {
-  GetShapeDetectionService()->BindBarcodeDetectionProvider(std::move(request));
-}
-
-void BindFaceDetectionProvider(
-    shape_detection::mojom::FaceDetectionProviderRequest request,
-    RenderProcessHost* host,
-    const url::Origin& origin) {
-  GetShapeDetectionService()->BindFaceDetectionProvider(std::move(request));
-}
-
-void BindTextDetection(shape_detection::mojom::TextDetectionRequest request,
-                       RenderProcessHost* host,
-                       const url::Origin& origin) {
-  GetShapeDetectionService()->BindTextDetection(std::move(request));
-}
-
-// Forwards service requests to Service Manager since the renderer cannot launch
-// out-of-process services on is own.
-template <typename Interface>
-void ForwardServiceRequest(const char* service_name,
-                           mojo::InterfaceRequest<Interface> request,
-                           RenderProcessHost* host,
-                           const url::Origin& origin) {
-  auto* connector = BrowserContext::GetConnectorFor(host->GetBrowserContext());
-  connector->BindInterface(service_name, std::move(request));
-}
-
 // Register renderer-exposed interfaces. Each registered interface binder is
 // exposed to all renderer-hosted execution context types (document/frame,
 // dedicated worker, shared worker and service worker) where the appropriate
@@ -159,17 +92,6 @@ void ForwardServiceRequest(const char* service_name,
 // interface requests from frames, binders registered on the frame itself
 // override binders registered here.
 void RendererInterfaceBinders::InitializeParameterizedBinderRegistry() {
-  parameterized_binder_registry_.AddInterface(
-      base::BindRepeating(&BindBarcodeDetectionProvider));
-  parameterized_binder_registry_.AddInterface(
-      base::BindRepeating(&BindFaceDetectionProvider));
-  parameterized_binder_registry_.AddInterface(
-      base::BindRepeating(&BindTextDetection));
-
-  parameterized_binder_registry_.AddInterface(
-      base::Bind(&ForwardServiceRequest<device::mojom::VibrationManager>,
-                 device::mojom::kServiceName));
-
   // Used for shared workers and service workers to create a websocket.
   // In other cases, RenderFrameHostImpl for documents or DedicatedWorkerHost
   // for dedicated workers handles interface requests in order to associate
@@ -180,32 +102,12 @@ void RendererInterfaceBinders::InitializeParameterizedBinderRegistry() {
   parameterized_binder_registry_.AddInterface(
       base::BindRepeating(CreateWebSocketConnector));
 
-  parameterized_binder_registry_.AddInterface(base::Bind(
-      [](mojo::PendingReceiver<payments::mojom::PaymentManager> receiver,
-         RenderProcessHost* host, const url::Origin& origin) {
-        static_cast<StoragePartitionImpl*>(host->GetStoragePartition())
-            ->GetPaymentAppContext()
-            ->CreatePaymentManager(std::move(receiver));
-      }));
   parameterized_binder_registry_.AddInterface(base::BindRepeating(
       [](mojo::PendingReceiver<blink::mojom::CacheStorage> receiver,
          RenderProcessHost* host, const url::Origin& origin) {
         static_cast<RenderProcessHostImpl*>(host)->BindCacheStorage(
             std::move(receiver), origin);
       }));
-  parameterized_binder_registry_.AddInterface(base::BindRepeating(
-      [](blink::mojom::IDBFactoryRequest request, RenderProcessHost* host,
-         const url::Origin& origin) {
-        static_cast<RenderProcessHostImpl*>(host)->BindIndexedDB(
-            std::move(request), origin);
-      }));
-  // TODO(https://crbug.com/873661): Pass origin to FileSystemMananger.
-  parameterized_binder_registry_.AddInterface(base::BindRepeating(
-      [](blink::mojom::FileSystemManagerRequest request,
-         RenderProcessHost* host, const url::Origin& origin) {
-        static_cast<RenderProcessHostImpl*>(host)->BindFileSystemManager(
-            origin, std::move(request));
-      }));
   if (base::FeatureList::IsEnabled(blink::features::kNativeFileSystemAPI)) {
     parameterized_binder_registry_.AddInterface(base::BindRepeating(
         [](mojo::PendingReceiver<blink::mojom::NativeFileSystemManager>
@@ -214,32 +116,20 @@ void RendererInterfaceBinders::InitializeParameterizedBinderRegistry() {
           // This code path is only for workers, hence always pass in
           // MSG_ROUTING_NONE as frame ID. Frames themselves go through
           // RenderFrameHostImpl instead.
-          NativeFileSystemManagerImpl::BindReceiverFromUIThread(
-              static_cast<StoragePartitionImpl*>(host->GetStoragePartition()),
+          auto* storage_partition =
+              static_cast<StoragePartitionImpl*>(host->GetStoragePartition());
+          auto* manager = storage_partition->GetNativeFileSystemManager();
+          manager->BindReceiver(
               NativeFileSystemManagerImpl::BindingContext(
                   origin,
-                  // TODO(https://crbug.com/989323): Obtain and use a better URL
-                  // for workers instead of the origin as source url. This URL
-                  // will be used for SafeBrowsing checks and for the Quarantine
-                  // Service.
+                  // TODO(https://crbug.com/989323): Obtain and use a better
+                  // URL for workers instead of the origin as source url.
+                  // This URL will be used for SafeBrowsing checks and for
+                  // the Quarantine Service.
                   origin.GetURL(), host->GetID(), MSG_ROUTING_NONE),
               std::move(receiver));
         }));
   }
-  parameterized_binder_registry_.AddInterface(base::Bind(
-      [](mojo::PendingReceiver<blink::mojom::PermissionService> receiver,
-         RenderProcessHost* host, const url::Origin& origin) {
-        static_cast<RenderProcessHostImpl*>(host)
-            ->permission_service_context()
-            .CreateServiceForWorker(std::move(receiver), origin);
-      }));
-  parameterized_binder_registry_.AddInterface(base::BindRepeating(
-      [](blink::mojom::LockManagerRequest request, RenderProcessHost* host,
-         const url::Origin& origin) {
-        static_cast<StoragePartitionImpl*>(host->GetStoragePartition())
-            ->GetLockManager()
-            ->CreateService(std::move(request), origin);
-      }));
 
   parameterized_binder_registry_.AddInterface(base::BindRepeating(
       [](blink::mojom::NotificationServiceRequest request,
@@ -250,21 +140,6 @@ void RendererInterfaceBinders::InitializeParameterizedBinderRegistry() {
       }));
   parameterized_binder_registry_.AddInterface(
       base::BindRepeating(&QuotaDispatcherHost::CreateForWorker));
-  parameterized_binder_registry_.AddInterface(base::BindRepeating(
-      [](blink::mojom::CookieStoreRequest request, RenderProcessHost* host,
-         const url::Origin& origin) {
-        static_cast<StoragePartitionImpl*>(host->GetStoragePartition())
-            ->GetCookieStoreContext()
-            ->CreateService(std::move(request), origin);
-      }));
-  parameterized_binder_registry_.AddInterface(base::BindRepeating(
-      [](media::mojom::VideoDecodePerfHistoryRequest request,
-         RenderProcessHost* host, const url::Origin& origin) {
-        host->GetBrowserContext()->GetVideoDecodePerfHistory()->BindRequest(
-            std::move(request));
-      }));
-  parameterized_binder_registry_.AddInterface(
-      base::BindRepeating(&ContentIndexServiceImpl::Create));
 }
 
 RendererInterfaceBinders& GetRendererInterfaceBinders() {
diff --git a/chromium/content/browser/resolve_proxy_msg_helper.cc b/chromium/content/browser/resolve_proxy_msg_helper.cc
index 8be56904176..e91d6d6364d 100644
--- a/chromium/content/browser/resolve_proxy_msg_helper.cc
+++ b/chromium/content/browser/resolve_proxy_msg_helper.cc
@@ -10,7 +10,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
 #include "net/proxy_resolution/proxy_info.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 
@@ -18,8 +17,7 @@ namespace content {
 
 ResolveProxyMsgHelper::ResolveProxyMsgHelper(int render_process_host_id)
     : BrowserMessageFilter(ViewMsgStart),
-      render_process_host_id_(render_process_host_id),
-      binding_(this) {}
+      render_process_host_id_(render_process_host_id) {}
 
 void ResolveProxyMsgHelper::OverrideThreadForMessage(
     const IPC::Message& message,
@@ -45,7 +43,7 @@ void ResolveProxyMsgHelper::OnResolveProxy(const GURL& url,
   pending_requests_.push_back(PendingRequest(url, reply_msg));
 
   // If nothing is in progress, start.
-  if (!binding_.is_bound()) {
+  if (!receiver_.is_bound()) {
     DCHECK_EQ(1u, pending_requests_.size());
     StartPendingRequest();
   }
@@ -53,18 +51,18 @@ void ResolveProxyMsgHelper::OnResolveProxy(const GURL& url,
 
 ResolveProxyMsgHelper::~ResolveProxyMsgHelper() {
   DCHECK(!owned_self_);
-  DCHECK(!binding_.is_bound());
+  DCHECK(!receiver_.is_bound());
 }
 
 void ResolveProxyMsgHelper::StartPendingRequest() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(!binding_.is_bound());
+  DCHECK(!receiver_.is_bound());
   DCHECK(!pending_requests_.empty());
 
   // Start the request.
-  network::mojom::ProxyLookupClientPtr proxy_lookup_client;
-  binding_.Bind(mojo::MakeRequest(&proxy_lookup_client));
-  binding_.set_connection_error_handler(
+  mojo::PendingRemote<network::mojom::ProxyLookupClient> proxy_lookup_client =
+      receiver_.BindNewPipeAndPassRemote();
+  receiver_.set_disconnect_handler(
       base::BindOnce(&ResolveProxyMsgHelper::OnProxyLookupComplete,
                      base::Unretained(this), net::ERR_ABORTED, base::nullopt));
   owned_self_ = this;
@@ -76,7 +74,8 @@ void ResolveProxyMsgHelper::StartPendingRequest() {
 
 bool ResolveProxyMsgHelper::SendRequestToNetworkService(
     const GURL& url,
-    network::mojom::ProxyLookupClientPtr proxy_lookup_client) {
+    mojo::PendingRemote<network::mojom::ProxyLookupClient>
+        proxy_lookup_client) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   RenderProcessHost* render_process_host =
@@ -96,7 +95,7 @@ void ResolveProxyMsgHelper::OnProxyLookupComplete(
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   DCHECK(!pending_requests_.empty());
 
-  binding_.Close();
+  receiver_.reset();
 
   // Need to keep |this| alive until the end of this method, and then release
   // this reference. StartPendingRequest(), if called, will grab other
diff --git a/chromium/content/browser/resolve_proxy_msg_helper.h b/chromium/content/browser/resolve_proxy_msg_helper.h
index 5bf7fcbeff6..30cfffafa6a 100644
--- a/chromium/content/browser/resolve_proxy_msg_helper.h
+++ b/chromium/content/browser/resolve_proxy_msg_helper.h
@@ -14,7 +14,8 @@
 #include "base/sequenced_task_runner_helpers.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_message_filter.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/network/public/mojom/proxy_lookup_client.mojom.h"
 #include "url/gurl.h"
 
@@ -65,7 +66,8 @@ class CONTENT_EXPORT ResolveProxyMsgHelper : public BrowserMessageFilter,
   // to the RenderProcessHost no longer existing.
   virtual bool SendRequestToNetworkService(
       const GURL& url,
-      network::mojom::ProxyLookupClientPtr proxy_lookup_client);
+      mojo::PendingRemote<network::mojom::ProxyLookupClient>
+          proxy_lookup_client);
 
   // network::mojom::ProxyLookupClient implementation.
   void OnProxyLookupComplete(
@@ -99,12 +101,12 @@ class CONTENT_EXPORT ResolveProxyMsgHelper : public BrowserMessageFilter,
 
   // Self-reference. Owned as long as there's an outstanding proxy lookup.
   // Needed to shut down safely, since this class is refcounted, with some
-  // references owned on multiple threads, while |binding_| lives on the UI
+  // references owned on multiple threads, while |receiver_| lives on the UI
   // thread, and may receive callbacks there whenever there's a pending request.
   scoped_refptr<ResolveProxyMsgHelper> owned_self_;
 
-  // Binding for the currently in-progress request, if any.
-  mojo::Binding<network::mojom::ProxyLookupClient> binding_;
+  // Receiver for the currently in-progress request, if any.
+  mojo::Receiver<network::mojom::ProxyLookupClient> receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ResolveProxyMsgHelper);
 };
diff --git a/chromium/content/browser/resolve_proxy_msg_helper_unittest.cc b/chromium/content/browser/resolve_proxy_msg_helper_unittest.cc
index 42514e443c5..56df64c4719 100644
--- a/chromium/content/browser/resolve_proxy_msg_helper_unittest.cc
+++ b/chromium/content/browser/resolve_proxy_msg_helper_unittest.cc
@@ -11,6 +11,7 @@
 #include "content/common/view_messages.h"
 #include "content/public/test/browser_task_environment.h"
 #include "ipc/ipc_test_sink.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/net_errors.h"
 #include "net/proxy_resolution/proxy_info.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
@@ -21,10 +22,11 @@ namespace content {
 
 class TestResolveProxyMsgHelper : public ResolveProxyMsgHelper {
  public:
-  // Incoming ProxyLookupClientPtrs are written to |proxy_lookup_client|.
+  // Incoming mojo::Remote<ProxyLookupClient>s are written to
+  // |proxy_lookup_client|.
   explicit TestResolveProxyMsgHelper(
       IPC::Listener* listener,
-      network::mojom::ProxyLookupClientPtr* proxy_lookup_client)
+      mojo::Remote<network::mojom::ProxyLookupClient>* proxy_lookup_client)
       : ResolveProxyMsgHelper(0 /* renderer_process_host_id */),
         listener_(listener),
         proxy_lookup_client_(proxy_lookup_client) {}
@@ -40,7 +42,8 @@ class TestResolveProxyMsgHelper : public ResolveProxyMsgHelper {
 
   bool SendRequestToNetworkService(
       const GURL& url,
-      network::mojom::ProxyLookupClientPtr proxy_lookup_client) override {
+      mojo::PendingRemote<network::mojom::ProxyLookupClient>
+          proxy_lookup_client) override {
     // Only one request should be send at a time.
     EXPECT_FALSE(*proxy_lookup_client_);
 
@@ -48,7 +51,7 @@ class TestResolveProxyMsgHelper : public ResolveProxyMsgHelper {
       return false;
 
     pending_url_ = url;
-    *proxy_lookup_client_ = std::move(proxy_lookup_client);
+    proxy_lookup_client_->Bind(std::move(proxy_lookup_client));
     return true;
   }
 
@@ -65,7 +68,7 @@ class TestResolveProxyMsgHelper : public ResolveProxyMsgHelper {
 
   bool fail_to_send_request_ = false;
 
-  network::mojom::ProxyLookupClientPtr* proxy_lookup_client_;
+  mojo::Remote<network::mojom::ProxyLookupClient>* proxy_lookup_client_;
   GURL pending_url_;
 
   DISALLOW_COPY_AND_ASSIGN(TestResolveProxyMsgHelper);
@@ -119,7 +122,7 @@ class ResolveProxyMsgHelperTest : public testing::Test, public IPC::Listener {
   scoped_refptr<TestResolveProxyMsgHelper> helper_;
   std::unique_ptr<PendingResult> pending_result_;
 
-  network::mojom::ProxyLookupClientPtr proxy_lookup_client_;
+  mojo::Remote<network::mojom::ProxyLookupClient> proxy_lookup_client_;
 
   IPC::TestSink test_sink_;
 };
@@ -265,7 +268,7 @@ TEST_F(ResolveProxyMsgHelperTest, CancelPendingRequests) {
   helper_ = nullptr;
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(proxy_lookup_client_.is_bound());
-  EXPECT_FALSE(proxy_lookup_client_.encountered_error());
+  EXPECT_FALSE(!proxy_lookup_client_.is_connected());
 
   // Send Mojo message on the pipe.
   net::ProxyInfo proxy_info;
@@ -276,7 +279,7 @@ TEST_F(ResolveProxyMsgHelperTest, CancelPendingRequests) {
   // the pipe.
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(!proxy_lookup_client_.is_bound() ||
-              proxy_lookup_client_.encountered_error());
+              !proxy_lookup_client_.is_connected());
   // The result should not have been sent.
   EXPECT_FALSE(pending_result());
 
@@ -366,7 +369,7 @@ TEST_F(ResolveProxyMsgHelperTest, Lifetime) {
   helper_ = nullptr;
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(proxy_lookup_client_.is_bound());
-  EXPECT_FALSE(proxy_lookup_client_.encountered_error());
+  EXPECT_FALSE(!proxy_lookup_client_.is_connected());
 
   // Send Mojo message on the pipe.
   net::ProxyInfo proxy_info;
@@ -377,7 +380,7 @@ TEST_F(ResolveProxyMsgHelperTest, Lifetime) {
   // the pipe.
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(!proxy_lookup_client_.is_bound() ||
-              proxy_lookup_client_.encountered_error());
+              !proxy_lookup_client_.is_connected());
   // The result should not have been sent.
   EXPECT_FALSE(pending_result());
 }
diff --git a/chromium/content/browser/resources/gpu/info_view.css b/chromium/content/browser/resources/gpu/info_view.css
index a00640784b6..730b2b8c844 100644
--- a/chromium/content/browser/resources/gpu/info_view.css
+++ b/chromium/content/browser/resources/gpu/info_view.css
@@ -42,8 +42,8 @@
 #info-view th,
 #info-view td {
   border: 1px solid #777;
-  padding-left: 4px;
-  padding-right: 4px;
+  padding-end: 4px;
+  padding-start: 4px;
   text-align: top;
 }
 
@@ -63,6 +63,10 @@
   color: rgb(255, 0, 0);
 }
 
+#info-view .feature-gray {
+  color: rgb(128, 128, 128);
+}
+
 #copy-to-clipboard {
   user-select: none;
 }
diff --git a/chromium/content/browser/resources/gpu/info_view.js b/chromium/content/browser/resources/gpu/info_view.js
index 42301d5a054..200b15a9ac9 100644
--- a/chromium/content/browser/resources/gpu/info_view.js
+++ b/chromium/content/browser/resources/gpu/info_view.js
@@ -241,6 +241,7 @@ cr.define('gpu', function() {
         'rasterization': 'Rasterization',
         'oop_rasterization': 'Out-of-process Rasterization',
         'metal': 'Metal',
+        'vulkan': 'Vulkan',
         'multiple_raster_threads': 'Multiple Raster Threads',
         'native_gpu_memory_buffers': 'Native GpuMemoryBuffers',
         'protected_video_decode': 'Hardware Protected Video Decode',
@@ -455,6 +456,13 @@ cr.define('gpu', function() {
       }
       ANGLEFeatureEl.appendChild(status);
 
+      if (ANGLEFeature.condition) {
+        const condition = document.createElement('span');
+        condition.textContent = ': ' + ANGLEFeature.condition;
+        condition.classList.add('feature-gray');
+        ANGLEFeatureEl.appendChild(condition);
+      }
+
       // if there's a description, put on new line, italicized
       if (ANGLEFeature.description) {
         const brNode = document.createElement('br');
diff --git a/chromium/content/browser/resources/media/manager_experiment_disabler.js b/chromium/content/browser/resources/media/manager_experiment_disabler.js
new file mode 100644
index 00000000000..793ebb5159d
--- /dev/null
+++ b/chromium/content/browser/resources/media/manager_experiment_disabler.js
@@ -0,0 +1,64 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/**
+ * @fileoverview Keeps track of all the existing PlayerInfo and
+ * audio stream objects and is the entry-point for messages from the backend.
+ *
+ * The events captured by Manager (add, remove, update) are relayed
+ * to the clientRenderer which it can choose to use to modify the UI.
+ */
+var Manager = (function() {
+  'use strict';
+
+  function createChild(parent, tag) {
+    const node = document.createElement(tag);
+    parent.appendChild(node);
+    node.createTextNode = function(text) {
+      const textNode = document.createTextNode(text);
+      node.appendChild(textNode);
+    };
+    return node;
+  }
+
+  function CreateNotice() {
+    const newContents = document.createElement('div');
+    createChild(newContents, 'h1')
+        .createTextNode('Media Internals Is being moved to devtools!');
+    createChild(newContents, 'h3').createTextNode('Here\'s how to use it:');
+
+    const directions = createChild(newContents, 'ol');
+
+    const devtoolsExperiments = createChild(directions, 'li');
+    devtoolsExperiments.createTextNode(
+        'Ensure Devtools Experiments is enabled.  ');
+
+    const experimentsLink = createChild(devtoolsExperiments, 'a');
+    experimentsLink.href = 'chrome://flags/#enable-devtools-experiments';
+    experimentsLink.createTextNode('Enable Flag Here');
+
+    createChild(directions, 'li')
+        .createTextNode('In devtools (F11) press F1 (open settings).');
+    createChild(directions, 'li')
+        .createTextNode(
+            'Select the "Experiments" tab on the side,' +
+            ' and check the "Media Element Inspection" box');
+    createChild(directions, 'li')
+        .createTextNode(
+            'Restart devtools, and find "Media" under the "More Tools" menu.');
+    return newContents;
+  }
+
+  function Manager(clientRenderer) {
+    this.clientRenderer_ = clientRenderer;
+    // Remove contents and add message.
+    this.media_tab_ = $('players');
+    this.media_tab_.innerHTML = '';
+    this.media_tab_.appendChild(CreateNotice());
+  }
+
+  Manager.prototype = {};
+
+  return Manager;
+}());
diff --git a/chromium/content/browser/resources/media/media_internals_disabled.js b/chromium/content/browser/resources/media/media_internals_disabled.js
new file mode 100644
index 00000000000..61772987894
--- /dev/null
+++ b/chromium/content/browser/resources/media/media_internals_disabled.js
@@ -0,0 +1,17 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var media = {};
+
+// <include src="main.js">
+// <include src="util.js">
+// <include src="player_info.js">
+// <include src="manager.js">
+// <include src="manager_experiment_disabler.js">
+// <include src="client_renderer.js">
+
+media.initialize(new Manager(new ClientRenderer()));
+if (cr.ui) {
+  cr.ui.decorate('tabbox', cr.ui.TabBox);
+}
diff --git a/chromium/content/browser/resources/media/webrtc_internals.js b/chromium/content/browser/resources/media/webrtc_internals.js
index be9a430fb61..ff007427c68 100644
--- a/chromium/content/browser/resources/media/webrtc_internals.js
+++ b/chromium/content/browser/resources/media/webrtc_internals.js
@@ -124,6 +124,7 @@ function createStatsSelectionOptionElements() {
   const p = document.createElement('p');
 
   const selectElement = document.createElement('select');
+  selectElement.setAttribute('id', 'statsSelectElement');
   selectElement.onchange = () => {
     currentGetStatsMethod = selectElement.value;
     Object.keys(peerConnectionDataStore).forEach(id => {
@@ -176,6 +177,18 @@ function requestLegacyStats() {
   }
 }
 
+/*
+ * Change to use the legacy getStats() API instead. This is used for a
+ * work-around for https://crbug.com/999136.
+ * TODO(https://crbug.com/1004239): Delete this method.
+ */
+function changeToLegacyGetStats() {
+  currentGetStatsMethod = OPTION_GETSTATS_LEGACY;
+  const selectElement = $('statsSelectElement');
+  selectElement.value = currentGetStatsMethod;
+  requestStats();
+}
+
 /**
  * A helper function for getting a peer connection element id.
  *
diff --git a/chromium/content/browser/resources/service_worker/serviceworker_internals.js b/chromium/content/browser/resources/service_worker/serviceworker_internals.js
index 05eb06a5a1f..626f37fbc0d 100644
--- a/chromium/content/browser/resources/service_worker/serviceworker_internals.js
+++ b/chromium/content/browser/resources/service_worker/serviceworker_internals.js
@@ -192,7 +192,7 @@ cr.define('serviceworker', function() {
     }
   }
 
-  function onRunningStateChanged(partition_id, version_id) {
+  function onRunningStateChanged() {
     update();
   }
 
diff --git a/chromium/content/browser/sandbox_parameters_mac.mm b/chromium/content/browser/sandbox_parameters_mac.mm
index 5eead918eb9..428dfcd9270 100644
--- a/chromium/content/browser/sandbox_parameters_mac.mm
+++ b/chromium/content/browser/sandbox_parameters_mac.mm
@@ -25,12 +25,16 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/pepper_plugin_info.h"
+#include "ppapi/buildflags/buildflags.h"
 #include "sandbox/mac/seatbelt_exec.h"
 #include "services/service_manager/sandbox/mac/sandbox_mac.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 #include "services/service_manager/sandbox/switches.h"
 
+#if BUILDFLAG(ENABLE_PLUGINS)
+#include "content/public/common/pepper_plugin_info.h"
+#endif
+
 namespace content {
 
 namespace {
@@ -53,8 +57,8 @@ std::string GetOSVersion() {
   return std::to_string(final_os_version);
 }
 
-// Retrieves the users shared cache and adds it to the profile.
-void AddDarwinUserCache(sandbox::SeatbeltExecClient* client) {
+// Retrieves the users shared darwin dirs and adds it to the profile.
+void AddDarwinDirs(sandbox::SeatbeltExecClient* client) {
   char dir_path[PATH_MAX + 1];
 
   size_t rv = confstr(_CS_DARWIN_USER_CACHE_DIR, dir_path, sizeof(dir_path));
@@ -63,6 +67,20 @@ void AddDarwinUserCache(sandbox::SeatbeltExecClient* client) {
       "DARWIN_USER_CACHE_DIR",
       service_manager::SandboxMac::GetCanonicalPath(base::FilePath(dir_path))
           .value()));
+
+  rv = confstr(_CS_DARWIN_USER_DIR, dir_path, sizeof(dir_path));
+  PCHECK(rv != 0);
+  CHECK(client->SetParameter(
+      "DARWIN_USER_DIR",
+      service_manager::SandboxMac::GetCanonicalPath(base::FilePath(dir_path))
+          .value()));
+
+  rv = confstr(_CS_DARWIN_USER_TEMP_DIR, dir_path, sizeof(dir_path));
+  PCHECK(rv != 0);
+  CHECK(client->SetParameter(
+      "DARWIN_USER_TEMP_DIR",
+      service_manager::SandboxMac::GetCanonicalPath(base::FilePath(dir_path))
+          .value()));
 }
 
 // All of the below functions populate the |client| with the parameters that the
@@ -128,7 +146,7 @@ void SetupNetworkSandboxParameters(sandbox::SeatbeltExecClient* client) {
   std::vector<base::FilePath> storage_paths =
       GetContentClient()->browser()->GetNetworkContextsParentDirectory();
 
-  AddDarwinUserCache(client);
+  AddDarwinDirs(client);
 
   CHECK(client->SetParameter("NETWORK_SERVICE_STORAGE_PATHS_COUNT",
                              base::NumberToString(storage_paths.size())));
@@ -148,6 +166,7 @@ void SetupNetworkSandboxParameters(sandbox::SeatbeltExecClient* client) {
   }
 }
 
+#if BUILDFLAG(ENABLE_PLUGINS)
 void SetupPPAPISandboxParameters(sandbox::SeatbeltExecClient* client) {
   SetupCommonSandboxParameters(client);
 
@@ -172,6 +191,7 @@ void SetupPPAPISandboxParameters(sandbox::SeatbeltExecClient* client) {
   // to n+1 more than the plugins added.
   CHECK(index <= 5);
 }
+#endif
 
 void SetupCDMSandboxParameters(sandbox::SeatbeltExecClient* client) {
   SetupCommonSandboxParameters(client);
@@ -204,7 +224,7 @@ void SetupSandboxParameters(service_manager::SandboxType sandbox_type,
       break;
     case service_manager::SANDBOX_TYPE_GPU:
       SetupCommonSandboxParameters(client);
-      AddDarwinUserCache(client);
+      AddDarwinDirs(client);
       break;
     case service_manager::SANDBOX_TYPE_CDM:
       SetupCDMSandboxParameters(client);
@@ -212,9 +232,11 @@ void SetupSandboxParameters(service_manager::SandboxType sandbox_type,
     case service_manager::SANDBOX_TYPE_NETWORK:
       SetupNetworkSandboxParameters(client);
       break;
+#if BUILDFLAG(ENABLE_PLUGINS)
     case service_manager::SANDBOX_TYPE_PPAPI:
       SetupPPAPISandboxParameters(client);
       break;
+#endif
     case service_manager::SANDBOX_TYPE_PROFILING:
     case service_manager::SANDBOX_TYPE_UTILITY:
       SetupUtilitySandboxParameters(client, command_line);
diff --git a/chromium/content/browser/sandbox_support_mac_impl.h b/chromium/content/browser/sandbox_support_mac_impl.h
index 649d359645c..dbc293f58e6 100644
--- a/chromium/content/browser/sandbox_support_mac_impl.h
+++ b/chromium/content/browser/sandbox_support_mac_impl.h
@@ -7,11 +7,8 @@
 
 #include "base/macros.h"
 #include "content/common/sandbox_support_mac.mojom.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
-
-namespace service_manager {
-struct BindSourceInfo;
-}
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 
 namespace content {
 
@@ -25,8 +22,7 @@ class SandboxSupportMacImpl : public mojom::SandboxSupportMac {
   SandboxSupportMacImpl();
   ~SandboxSupportMacImpl() override;
 
-  void BindRequest(mojom::SandboxSupportMacRequest request,
-                   const service_manager::BindSourceInfo& source_info);
+  void BindReceiver(mojo::PendingReceiver<mojom::SandboxSupportMac> receiver);
 
   // content::mojom::SandboxSupportMac:
   void GetSystemColors(GetSystemColorsCallback callback) override;
@@ -35,7 +31,7 @@ class SandboxSupportMacImpl : public mojom::SandboxSupportMac {
                 LoadFontCallback callback) override;
 
  private:
-  mojo::BindingSet<mojom::SandboxSupportMac> bindings_;
+  mojo::ReceiverSet<mojom::SandboxSupportMac> receivers_;
 
   DISALLOW_COPY_AND_ASSIGN(SandboxSupportMacImpl);
 };
diff --git a/chromium/content/browser/sandbox_support_mac_impl.mm b/chromium/content/browser/sandbox_support_mac_impl.mm
index 8bf0c31c39a..5f6b6444f07 100644
--- a/chromium/content/browser/sandbox_support_mac_impl.mm
+++ b/chromium/content/browser/sandbox_support_mac_impl.mm
@@ -17,10 +17,9 @@ SandboxSupportMacImpl::SandboxSupportMacImpl() = default;
 
 SandboxSupportMacImpl::~SandboxSupportMacImpl() = default;
 
-void SandboxSupportMacImpl::BindRequest(
-    mojom::SandboxSupportMacRequest request,
-    const service_manager::BindSourceInfo& source_info) {
-  bindings_.AddBinding(this, std::move(request));
+void SandboxSupportMacImpl::BindReceiver(
+    mojo::PendingReceiver<mojom::SandboxSupportMac> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
 void SandboxSupportMacImpl::GetSystemColors(GetSystemColorsCallback callback) {
diff --git a/chromium/content/browser/scheduler/browser_io_thread_delegate.cc b/chromium/content/browser/scheduler/browser_io_thread_delegate.cc
index ec65f10a8df..f0e5516500e 100644
--- a/chromium/content/browser/scheduler/browser_io_thread_delegate.cc
+++ b/chromium/content/browser/scheduler/browser_io_thread_delegate.cc
@@ -4,9 +4,13 @@
 
 #include "content/browser/scheduler/browser_io_thread_delegate.h"
 
+#include "base/message_loop/message_pump.h"
 #include "base/message_loop/message_pump_type.h"
 #include "base/task/sequence_manager/sequence_manager.h"
 #include "base/task/sequence_manager/task_queue.h"
+#include "base/task/task_executor.h"
+#include "base/task/task_observer.h"
+#include "content/browser/scheduler/browser_task_executor.h"
 #include "content/public/browser/browser_thread.h"
 
 namespace content {
@@ -15,34 +19,83 @@ using ::base::sequence_manager::CreateUnboundSequenceManager;
 using ::base::sequence_manager::SequenceManager;
 using ::base::sequence_manager::TaskQueue;
 
+class BrowserIOThreadDelegate::TLSMultiplexer : public base::TaskObserver {
+ public:
+  TLSMultiplexer() = default;
+  ~TLSMultiplexer() override = default;
+
+  void SetIOTaskExecutor(base::TaskExecutor* io_task_executor) {
+    io_task_executor_ = io_task_executor;
+  }
+
+  void WillProcessTask(const base::PendingTask& pending_task) override {
+    base::TaskExecutor* previous_executor =
+        base::GetTaskExecutorForCurrentThread();
+    if (previous_executor) {
+      previous_executors_.push_back(previous_executor);
+      base::SetTaskExecutorForCurrentThread(nullptr);
+    }
+    base::SetTaskExecutorForCurrentThread(io_task_executor_);
+  }
+
+  void DidProcessTask(const base::PendingTask& pending_task) override {
+    base::SetTaskExecutorForCurrentThread(nullptr);
+    if (!previous_executors_.empty()) {
+      base::SetTaskExecutorForCurrentThread(previous_executors_.back());
+      previous_executors_.pop_back();
+    }
+  }
+
+  base::TaskExecutor* io_task_executor_ = nullptr;
+  std::vector<base::TaskExecutor*> previous_executors_;
+};
+
 BrowserIOThreadDelegate::BrowserIOThreadDelegate()
-    : sequence_manager_(CreateUnboundSequenceManager(
+    : owned_sequence_manager_(CreateUnboundSequenceManager(
           SequenceManager::Settings::Builder()
               .SetMessagePumpType(base::MessagePumpType::IO)
-              .Build())) {
-  Init(sequence_manager_.get());
+              .Build())),
+      sequence_manager_(owned_sequence_manager_.get()) {
+  Init();
 }
 
 BrowserIOThreadDelegate::BrowserIOThreadDelegate(
     SequenceManager* sequence_manager)
-    : sequence_manager_(nullptr) {
-  Init(sequence_manager);
+    : sequence_manager_(sequence_manager),
+      tls_multiplexer_(std::make_unique<TLSMultiplexer>()) {
+  sequence_manager_->AddTaskObserver(tls_multiplexer_.get());
+  Init();
 }
 
-void BrowserIOThreadDelegate::Init(
-    base::sequence_manager::SequenceManager* sequence_manager) {
+void BrowserIOThreadDelegate::Init() {
   task_queues_ = std::make_unique<BrowserTaskQueues>(
-      BrowserThread::IO, sequence_manager,
-      sequence_manager->GetRealTimeDomain());
+      BrowserThread::IO, sequence_manager_,
+      sequence_manager_->GetRealTimeDomain());
   default_task_runner_ = task_queues_->GetHandle()->GetDefaultTaskRunner();
 }
 
+void BrowserIOThreadDelegate::SetTaskExecutor(
+    base::TaskExecutor* task_executor) {
+  if (tls_multiplexer_) {
+    tls_multiplexer_->SetIOTaskExecutor(task_executor);
+  } else {
+    task_executor_ = task_executor;
+  }
+}
+
 scoped_refptr<base::SingleThreadTaskRunner>
 BrowserIOThreadDelegate::GetDefaultTaskRunner() {
   return default_task_runner_;
 }
 
-BrowserIOThreadDelegate::~BrowserIOThreadDelegate() = default;
+BrowserIOThreadDelegate::~BrowserIOThreadDelegate() {
+  if (task_executor_) {
+    base::SetTaskExecutorForCurrentThread(nullptr);
+  }
+  if (tls_multiplexer_) {
+    sequence_manager_->RemoveTaskObserver(tls_multiplexer_.get());
+  }
+}
 
 void BrowserIOThreadDelegate::BindToCurrentThread(
     base::TimerSlack timer_slack) {
@@ -51,6 +104,10 @@ void BrowserIOThreadDelegate::BindToCurrentThread(
       base::MessagePump::Create(base::MessagePumpType::IO));
   sequence_manager_->SetTimerSlack(timer_slack);
   sequence_manager_->SetDefaultTaskRunner(GetDefaultTaskRunner());
+
+  if (task_executor_) {
+    base::SetTaskExecutorForCurrentThread(task_executor_);
+  }
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/scheduler/browser_io_thread_delegate.h b/chromium/content/browser/scheduler/browser_io_thread_delegate.h
index 49c337de7e5..0954c5e43b5 100644
--- a/chromium/content/browser/scheduler/browser_io_thread_delegate.h
+++ b/chromium/content/browser/scheduler/browser_io_thread_delegate.h
@@ -14,6 +14,7 @@
 
 namespace base {
 class SingleThreadTaskRunner;
+class TaskExecutor;
 
 namespace sequence_manager {
 class SequenceManager;
@@ -28,13 +29,18 @@ class CONTENT_EXPORT BrowserIOThreadDelegate : public base::Thread::Delegate {
  public:
   using Handle = BrowserTaskQueues::Handle;
 
+  // Creates a BrowserIOThreadDelegate for use with a real IO thread.
+  BrowserIOThreadDelegate();
+  ~BrowserIOThreadDelegate() override;
+
   static std::unique_ptr<BrowserIOThreadDelegate> CreateForTesting(
       base::sequence_manager::SequenceManager* sequence_manager) {
+    DCHECK(sequence_manager);
     return base::WrapUnique(new BrowserIOThreadDelegate(sequence_manager));
   }
 
-  BrowserIOThreadDelegate();
-  ~BrowserIOThreadDelegate() override;
+  // If called this must be done prior to calling BindToCurrentThread.
+  void SetTaskExecutor(base::TaskExecutor* task_executor);
 
   scoped_refptr<base::SingleThreadTaskRunner> GetDefaultTaskRunner() override;
   void BindToCurrentThread(base::TimerSlack timer_slack) override;
@@ -47,23 +53,37 @@ class CONTENT_EXPORT BrowserIOThreadDelegate : public base::Thread::Delegate {
   // tests.
   void SetAllowBlockingForTesting() { allow_blocking_for_testing_ = true; }
 
-  scoped_refptr<Handle> CreateHandle() { return task_queues_->GetHandle(); }
+  scoped_refptr<Handle> GetHandle() { return task_queues_->GetHandle(); }
 
  private:
+  class TLSMultiplexer;
+
+  // Creates a sequence funneled BrowserIOThreadDelegate for use in testing.
+  // Installs TLSMultiplexer which allows ensures the right results for
+  // base::CurrentThread when running an "IO Thread" task.
   explicit BrowserIOThreadDelegate(
       base::sequence_manager::SequenceManager* sequence_manager);
 
   // Performs the actual initialization of all the members that require a
-  // SequenceManager. Just a convenience method to avoid code duplication as in
-  // testing |sequence_manager_| will be null;
-  void Init(base::sequence_manager::SequenceManager* sequence_manager);
+  // SequenceManager.
+  void Init();
 
   bool allow_blocking_for_testing_ = false;
   // Owned SequenceManager, null if instance created via CreateForTesting.
-  std::unique_ptr<base::sequence_manager::SequenceManager> sequence_manager_;
+  const std::unique_ptr<base::sequence_manager::SequenceManager>
+      owned_sequence_manager_;
+
+  base::sequence_manager::SequenceManager* const sequence_manager_;
 
   std::unique_ptr<BrowserTaskQueues> task_queues_;
   scoped_refptr<base::SingleThreadTaskRunner> default_task_runner_;
+
+  // In unit tests the IO "thread" can be sequence funneled onto the main thread
+  // so we need to multiplex the TLS binding to ensure base::CurrentThread
+  // behaves as expected.
+  std::unique_ptr<TLSMultiplexer> tls_multiplexer_;
+
+  base::TaskExecutor* task_executor_ = nullptr;
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/scheduler/browser_io_thread_delegate_unittest.cc b/chromium/content/browser/scheduler/browser_io_thread_delegate_unittest.cc
index 2be9c024575..ed391607982 100644
--- a/chromium/content/browser/scheduler/browser_io_thread_delegate_unittest.cc
+++ b/chromium/content/browser/scheduler/browser_io_thread_delegate_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/bind.h"
 #include "base/synchronization/waitable_event.h"
 #include "base/threading/thread.h"
+#include "content/browser/scheduler/browser_task_executor.h"
 #include "content/browser/scheduler/browser_task_queues.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -20,7 +21,7 @@ TEST(BrowserIOThreadDelegateTest, CanPostTasksToThread) {
   base::Thread thread("my_thread");
 
   auto delegate = std::make_unique<BrowserIOThreadDelegate>();
-  auto handle = delegate->CreateHandle();
+  auto handle = delegate->GetHandle();
   handle->EnableAllQueues();
 
   base::Thread::Options options;
@@ -36,7 +37,7 @@ TEST(BrowserIOThreadDelegateTest, CanPostTasksToThread) {
   event.Wait();
 }
 
-TEST(BrowserIOThreadDelegateTest, DefaultTaskRunnerIsAllwaysActive) {
+TEST(BrowserIOThreadDelegateTest, DefaultTaskRunnerIsAlwaysActive) {
   base::Thread thread("my_thread");
 
   auto delegate = std::make_unique<BrowserIOThreadDelegate>();
diff --git a/chromium/content/browser/scheduler/browser_task_executor.cc b/chromium/content/browser/scheduler/browser_task_executor.cc
index f2ddb987a4d..4f786a1c21c 100644
--- a/chromium/content/browser/scheduler/browser_task_executor.cc
+++ b/chromium/content/browser/scheduler/browser_task_executor.cc
@@ -66,13 +66,112 @@ QueueType GetQueueType(const base::TaskTraits& traits,
 
 }  // namespace
 
+BaseBrowserTaskExecutor::BaseBrowserTaskExecutor() = default;
+
+BaseBrowserTaskExecutor::~BaseBrowserTaskExecutor() = default;
+
+bool BaseBrowserTaskExecutor::PostDelayedTask(const base::Location& from_here,
+                                              const base::TaskTraits& traits,
+                                              base::OnceClosure task,
+                                              base::TimeDelta delay) {
+  if (traits.extension_id() != BrowserTaskTraitsExtension::kExtensionId ||
+      traits.GetExtension<BrowserTaskTraitsExtension>().nestable()) {
+    return GetTaskRunner(traits)->PostDelayedTask(from_here, std::move(task),
+                                                  delay);
+  } else {
+    return GetTaskRunner(traits)->PostNonNestableDelayedTask(
+        from_here, std::move(task), delay);
+  }
+}
+
+scoped_refptr<base::TaskRunner> BaseBrowserTaskExecutor::CreateTaskRunner(
+    const base::TaskTraits& traits) {
+  return GetTaskRunner(traits);
+}
+
+scoped_refptr<base::SequencedTaskRunner>
+BaseBrowserTaskExecutor::CreateSequencedTaskRunner(
+    const base::TaskTraits& traits) {
+  return GetTaskRunner(traits);
+}
+
+scoped_refptr<base::SingleThreadTaskRunner>
+BaseBrowserTaskExecutor::CreateSingleThreadTaskRunner(
+    const base::TaskTraits& traits,
+    base::SingleThreadTaskRunnerThreadMode thread_mode) {
+  return GetTaskRunner(traits);
+}
+
+#if defined(OS_WIN)
+scoped_refptr<base::SingleThreadTaskRunner>
+BaseBrowserTaskExecutor::CreateCOMSTATaskRunner(
+    const base::TaskTraits& traits,
+    base::SingleThreadTaskRunnerThreadMode thread_mode) {
+  return GetTaskRunner(traits);
+}
+#endif  // defined(OS_WIN)
+
+scoped_refptr<base::SingleThreadTaskRunner>
+BaseBrowserTaskExecutor::GetTaskRunner(const base::TaskTraits& traits) const {
+  auto id_and_queue = GetThreadIdAndQueueType(traits);
+
+  switch (id_and_queue.thread_id) {
+    case BrowserThread::UI: {
+      return browser_ui_thread_handle_->GetBrowserTaskRunner(
+          id_and_queue.queue_type);
+    }
+    case BrowserThread::IO:
+      return browser_io_thread_handle_->GetBrowserTaskRunner(
+          id_and_queue.queue_type);
+    case BrowserThread::ID_COUNT:
+      NOTREACHED();
+  }
+  return nullptr;
+}
+
+BaseBrowserTaskExecutor::ThreadIdAndQueueType
+BaseBrowserTaskExecutor::GetThreadIdAndQueueType(
+    const base::TaskTraits& traits) const {
+  BrowserTaskType task_type;
+  BrowserThread::ID thread_id;
+
+  if (traits.use_current_thread()) {
+    thread_id = GetCurrentThreadID();
+
+    // BrowserTaskTraitsExtension is optional if use_current_thread() is true.
+    if (traits.extension_id() == BrowserTaskTraitsExtension::kExtensionId) {
+      task_type = traits.GetExtension<BrowserTaskTraitsExtension>().task_type();
+    } else {
+      task_type = BrowserTaskType::kDefault;
+    }
+  } else {
+    // Otherwise BrowserTaskTraitsExtension is mandatory.
+    DCHECK_EQ(BrowserTaskTraitsExtension::kExtensionId, traits.extension_id());
+    BrowserTaskTraitsExtension extension =
+        traits.GetExtension<BrowserTaskTraitsExtension>();
+
+    thread_id = extension.browser_thread();
+    DCHECK_GE(thread_id, 0);
+
+    task_type = extension.task_type();
+    DCHECK_LT(task_type, BrowserTaskType::kBrowserTaskType_Last);
+  }
+
+  return {thread_id, GetQueueType(traits, task_type)};
+}
+
 BrowserTaskExecutor::BrowserTaskExecutor(
     std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler,
     std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate)
-    : browser_ui_thread_scheduler_(std::move(browser_ui_thread_scheduler)),
-      browser_ui_thread_handle_(browser_ui_thread_scheduler_->GetHandle()),
-      browser_io_thread_delegate_(std::move(browser_io_thread_delegate)),
-      browser_io_thread_handle_(browser_io_thread_delegate_->CreateHandle()) {}
+    : ui_thread_executor_(std::make_unique<UIThreadExecutor>(
+          std::move(browser_ui_thread_scheduler))),
+      io_thread_executor_(std::make_unique<IOThreadExecutor>(
+          std::move(browser_io_thread_delegate))) {
+  browser_ui_thread_handle_ = ui_thread_executor_->GetUIThreadHandle();
+  browser_io_thread_handle_ = io_thread_executor_->GetIOThreadHandle();
+  ui_thread_executor_->SetIOThreadHandle(browser_io_thread_handle_);
+  io_thread_executor_->SetUIThreadHandle(browser_ui_thread_handle_);
+}
 
 BrowserTaskExecutor::~BrowserTaskExecutor() = default;
 
@@ -81,6 +180,7 @@ void BrowserTaskExecutor::Create() {
   DCHECK(!base::ThreadTaskRunnerHandle::IsSet());
   CreateInternal(std::make_unique<BrowserUIThreadScheduler>(),
                  std::make_unique<BrowserIOThreadDelegate>());
+  g_browser_task_executor->ui_thread_executor_->BindToCurrentThread();
 }
 
 // static
@@ -92,6 +192,11 @@ void BrowserTaskExecutor::CreateForTesting(
 }
 
 // static
+void BrowserTaskExecutor::BindToUIThreadForTesting() {
+  g_browser_task_executor->ui_thread_executor_->BindToCurrentThread();
+}
+
+// static
 void BrowserTaskExecutor::CreateInternal(
     std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler,
     std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate) {
@@ -101,6 +206,7 @@ void BrowserTaskExecutor::CreateInternal(
                               std::move(browser_io_thread_delegate));
   base::RegisterTaskExecutor(BrowserTaskTraitsExtension::kExtensionId,
                              g_browser_task_executor);
+
   g_browser_task_executor->browser_ui_thread_handle_
       ->EnableAllExceptBestEffortQueues();
 
@@ -110,12 +216,19 @@ void BrowserTaskExecutor::CreateInternal(
 }
 
 // static
+BrowserTaskExecutor* BrowserTaskExecutor::Get() {
+  DCHECK(g_browser_task_executor);
+  return g_browser_task_executor;
+}
+
+// static
 void BrowserTaskExecutor::ResetForTesting() {
 #if defined(OS_ANDROID)
   base::PostTaskAndroid::SignalNativeSchedulerShutdown();
 #endif
-
   if (g_browser_task_executor) {
+    RunAllPendingTasksOnThreadForTesting(BrowserThread::UI);
+    RunAllPendingTasksOnThreadForTesting(BrowserThread::IO);
     base::UnregisterTaskExecutorForTesting(
         BrowserTaskTraitsExtension::kExtensionId);
     delete g_browser_task_executor;
@@ -126,8 +239,8 @@ void BrowserTaskExecutor::ResetForTesting() {
 // static
 void BrowserTaskExecutor::PostFeatureListSetup() {
   DCHECK(g_browser_task_executor);
-  DCHECK(g_browser_task_executor->browser_ui_thread_scheduler_);
-  DCHECK(g_browser_task_executor->browser_io_thread_delegate_);
+  DCHECK(g_browser_task_executor->ui_thread_executor_);
+  DCHECK(g_browser_task_executor->io_thread_executor_);
   g_browser_task_executor->browser_ui_thread_handle_
       ->PostFeatureListInitializationSetup();
   g_browser_task_executor->browser_io_thread_handle_
@@ -139,7 +252,8 @@ void BrowserTaskExecutor::Shutdown() {
   if (!g_browser_task_executor)
     return;
 
-  DCHECK(g_browser_task_executor->browser_ui_thread_scheduler_);
+  DCHECK(g_browser_task_executor->ui_thread_executor_);
+  DCHECK(g_browser_task_executor->io_thread_executor_);
   // We don't delete |g_browser_task_executor| because other threads may
   // PostTask or call BrowserTaskExecutor::GetTaskRunner while we're tearing
   // things down. We don't want to add locks so we just leak instead of dealing
@@ -147,8 +261,8 @@ void BrowserTaskExecutor::Shutdown() {
   // PostTaskAndroid::SignalNativeSchedulerShutdown on Android. In tests however
   // we need to clean up, so BrowserTaskExecutor::ResetForTesting should be
   // called.
-  g_browser_task_executor->browser_ui_thread_scheduler_.reset();
-  g_browser_task_executor->browser_io_thread_delegate_.reset();
+  g_browser_task_executor->ui_thread_executor_.reset();
+  g_browser_task_executor->io_thread_executor_.reset();
 }
 
 // static
@@ -164,6 +278,12 @@ void BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
           ->ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
       break;
     case BrowserThread::IO: {
+      // In tests there may not be a functional IO thread.
+      if (!g_browser_task_executor->io_thread_executor_ ||
+          !g_browser_task_executor->io_thread_executor_
+               ->HasDelegateForTesting()) {
+        return;
+      }
       g_browser_task_executor->browser_io_thread_handle_
           ->ScheduleRunAllPendingTasksForTesting(run_loop.QuitClosure());
       break;
@@ -175,82 +295,6 @@ void BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(
   run_loop.Run();
 }
 
-bool BrowserTaskExecutor::PostDelayedTask(const base::Location& from_here,
-                                          const base::TaskTraits& traits,
-                                          base::OnceClosure task,
-                                          base::TimeDelta delay) {
-  DCHECK_EQ(BrowserTaskTraitsExtension::kExtensionId, traits.extension_id());
-  const BrowserTaskTraitsExtension& extension =
-      traits.GetExtension<BrowserTaskTraitsExtension>();
-  if (extension.nestable()) {
-    return GetTaskRunner(traits)->PostDelayedTask(from_here, std::move(task),
-                                                  delay);
-  } else {
-    return GetTaskRunner(traits)->PostNonNestableDelayedTask(
-        from_here, std::move(task), delay);
-  }
-}
-
-scoped_refptr<base::TaskRunner> BrowserTaskExecutor::CreateTaskRunner(
-    const base::TaskTraits& traits) {
-  return GetTaskRunner(traits);
-}
-
-scoped_refptr<base::SequencedTaskRunner>
-BrowserTaskExecutor::CreateSequencedTaskRunner(const base::TaskTraits& traits) {
-  return GetTaskRunner(traits);
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-BrowserTaskExecutor::CreateSingleThreadTaskRunner(
-    const base::TaskTraits& traits,
-    base::SingleThreadTaskRunnerThreadMode thread_mode) {
-  return GetTaskRunner(traits);
-}
-
-#if defined(OS_WIN)
-scoped_refptr<base::SingleThreadTaskRunner>
-BrowserTaskExecutor::CreateCOMSTATaskRunner(
-    const base::TaskTraits& traits,
-    base::SingleThreadTaskRunnerThreadMode thread_mode) {
-  return GetTaskRunner(traits);
-}
-#endif  // defined(OS_WIN)
-
-scoped_refptr<base::SingleThreadTaskRunner> BrowserTaskExecutor::GetTaskRunner(
-    const base::TaskTraits& traits) const {
-  auto id_and_queue = GetThreadIdAndQueueType(traits);
-
-  switch (id_and_queue.thread_id) {
-    case BrowserThread::UI: {
-      return browser_ui_thread_handle_->GetBrowserTaskRunner(
-          id_and_queue.queue_type);
-    }
-    case BrowserThread::IO:
-      return browser_io_thread_handle_->GetBrowserTaskRunner(
-          id_and_queue.queue_type);
-    case BrowserThread::ID_COUNT:
-      NOTREACHED();
-  }
-  return nullptr;
-}
-
-// static
-BrowserTaskExecutor::ThreadIdAndQueueType
-BrowserTaskExecutor::GetThreadIdAndQueueType(const base::TaskTraits& traits) {
-  DCHECK_EQ(BrowserTaskTraitsExtension::kExtensionId, traits.extension_id());
-  BrowserTaskTraitsExtension extension =
-      traits.GetExtension<BrowserTaskTraitsExtension>();
-
-  BrowserThread::ID thread_id = extension.browser_thread();
-  DCHECK_GE(thread_id, 0);
-
-  BrowserTaskType task_type = extension.task_type();
-  DCHECK_LT(task_type, BrowserTaskType::kBrowserTaskType_Last);
-
-  return {thread_id, GetQueueType(traits, task_type)};
-}
-
 // static
 void BrowserTaskExecutor::EnableAllQueues() {
   DCHECK(g_browser_task_executor);
@@ -267,20 +311,23 @@ void BrowserTaskExecutor::InitializeIOThread() {
 
 std::unique_ptr<BrowserProcessSubThread> BrowserTaskExecutor::CreateIOThread() {
   DCHECK(g_browser_task_executor);
-  DCHECK(g_browser_task_executor->browser_io_thread_delegate_);
+  DCHECK(g_browser_task_executor->io_thread_executor_);
+
+  std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate =
+      g_browser_task_executor->io_thread_executor_->TakeDelegate();
+
+  DCHECK(browser_io_thread_delegate);
   TRACE_EVENT0("startup", "BrowserTaskExecutor::CreateIOThread");
 
   auto io_thread = std::make_unique<BrowserProcessSubThread>(BrowserThread::IO);
 
-  if (g_browser_task_executor->browser_io_thread_delegate_
-          ->allow_blocking_for_testing()) {
+  if (browser_io_thread_delegate->allow_blocking_for_testing()) {
     io_thread->AllowBlockingForTesting();
   }
 
   base::Thread::Options options;
   options.message_pump_type = base::MessagePumpType::IO;
-  options.delegate =
-      g_browser_task_executor->browser_io_thread_delegate_.release();
+  options.delegate = browser_io_thread_delegate.release();
   // Up the priority of the |io_thread_| as some of its IPCs relate to
   // display tasks.
   if (base::FeatureList::IsEnabled(features::kBrowserUseDisplayThreadPriority))
@@ -344,4 +391,68 @@ void BrowserTaskExecutor::RemoveValidator(
 
 #endif
 
+BrowserThread::ID BrowserTaskExecutor::GetCurrentThreadID() const {
+  NOTREACHED()
+      << "Should have been routed to UIThreadExecutor or IOThreadExecutor";
+  return BrowserThread::UI;
+}
+
+BrowserTaskExecutor::UIThreadExecutor::UIThreadExecutor(
+    std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler)
+    : browser_ui_thread_scheduler_(std::move(browser_ui_thread_scheduler)) {
+  browser_ui_thread_handle_ = browser_ui_thread_scheduler_->GetHandle();
+}
+
+BrowserTaskExecutor::UIThreadExecutor::~UIThreadExecutor() {
+  if (bound_to_thread_)
+    base::SetTaskExecutorForCurrentThread(nullptr);
+}
+
+void BrowserTaskExecutor::UIThreadExecutor::BindToCurrentThread() {
+  bound_to_thread_ = true;
+  base::SetTaskExecutorForCurrentThread(this);
+}
+
+scoped_refptr<BrowserUIThreadScheduler::Handle>
+BrowserTaskExecutor::UIThreadExecutor::GetUIThreadHandle() {
+  return browser_ui_thread_handle_;
+}
+
+void BrowserTaskExecutor::UIThreadExecutor::SetIOThreadHandle(
+    scoped_refptr<BrowserUIThreadScheduler::Handle> io_thread_handle) {
+  browser_io_thread_handle_ = std::move(io_thread_handle);
+}
+
+BrowserThread::ID BrowserTaskExecutor::UIThreadExecutor::GetCurrentThreadID()
+    const {
+  return BrowserThread::UI;
+}
+
+BrowserTaskExecutor::IOThreadExecutor::IOThreadExecutor(
+    std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate)
+    : browser_io_thread_delegate_(std::move(browser_io_thread_delegate)) {
+  // |browser_io_thread_delegate_| can be null in tests.
+  if (!browser_io_thread_delegate_)
+    return;
+  browser_io_thread_delegate_->SetTaskExecutor(this);
+  browser_io_thread_handle_ = browser_io_thread_delegate_->GetHandle();
+}
+
+BrowserTaskExecutor::IOThreadExecutor::~IOThreadExecutor() = default;
+
+scoped_refptr<BrowserUIThreadScheduler::Handle>
+BrowserTaskExecutor::IOThreadExecutor::GetIOThreadHandle() {
+  return browser_io_thread_handle_;
+}
+
+void BrowserTaskExecutor::IOThreadExecutor::SetUIThreadHandle(
+    scoped_refptr<BrowserUIThreadScheduler::Handle> ui_thread_handle) {
+  browser_ui_thread_handle_ = std::move(ui_thread_handle);
+}
+
+BrowserThread::ID BrowserTaskExecutor::IOThreadExecutor::GetCurrentThreadID()
+    const {
+  return BrowserThread::IO;
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/scheduler/browser_task_executor.h b/chromium/content/browser/scheduler/browser_task_executor.h
index c873e97ae07..8754d97d563 100644
--- a/chromium/content/browser/scheduler/browser_task_executor.h
+++ b/chromium/content/browser/scheduler/browser_task_executor.h
@@ -17,14 +17,66 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 
+// The BrowserTaskExecutor's job is to map base::TaskTraits to actual task
+// queues for the browser process.
+//
+// We actually have three TaskExecutors:
+// * BrowserTaskExecutor registered for BrowserTaskTraitsExtension.
+// * BrowserTaskExecutor::UIThreadExecutor registered with UI thread TLS.
+// * BrowserTaskExecutor::IOThreadExecutor registered with IO thread TLS.
+//
+// This lets us efficiently implement base::CurrentThread on UI and IO threads.
 namespace content {
 
 class BrowserTaskExecutorTest;
 class BrowserProcessSubThread;
 
-// This class's job is to map base::TaskTraits to actual task queues for the
-// browser process.
-class CONTENT_EXPORT BrowserTaskExecutor : public base::TaskExecutor {
+class CONTENT_EXPORT BaseBrowserTaskExecutor : public base::TaskExecutor {
+ public:
+  BaseBrowserTaskExecutor();
+  ~BaseBrowserTaskExecutor() override;
+
+  // base::TaskExecutor implementation.
+  bool PostDelayedTask(const base::Location& from_here,
+                       const base::TaskTraits& traits,
+                       base::OnceClosure task,
+                       base::TimeDelta delay) override;
+
+  scoped_refptr<base::TaskRunner> CreateTaskRunner(
+      const base::TaskTraits& traits) override;
+
+  scoped_refptr<base::SequencedTaskRunner> CreateSequencedTaskRunner(
+      const base::TaskTraits& traits) override;
+
+  scoped_refptr<base::SingleThreadTaskRunner> CreateSingleThreadTaskRunner(
+      const base::TaskTraits& traits,
+      base::SingleThreadTaskRunnerThreadMode thread_mode) override;
+
+#if defined(OS_WIN)
+  scoped_refptr<base::SingleThreadTaskRunner> CreateCOMSTATaskRunner(
+      const base::TaskTraits& traits,
+      base::SingleThreadTaskRunnerThreadMode thread_mode) override;
+#endif  // defined(OS_WIN)
+
+  struct ThreadIdAndQueueType {
+    BrowserThread::ID thread_id;
+    BrowserTaskQueues::QueueType queue_type;
+  };
+
+  ThreadIdAndQueueType GetThreadIdAndQueueType(
+      const base::TaskTraits& traits) const;
+
+ protected:
+  virtual BrowserThread::ID GetCurrentThreadID() const = 0;
+
+  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(
+      const base::TaskTraits& traits) const;
+
+  scoped_refptr<BrowserUIThreadScheduler::Handle> browser_ui_thread_handle_;
+  scoped_refptr<BrowserIOThreadDelegate::Handle> browser_io_thread_handle_;
+};
+
+class CONTENT_EXPORT BrowserTaskExecutor : public BaseBrowserTaskExecutor {
  public:
   // Creates and registers a BrowserTaskExecutor on the current thread which
   // owns a BrowserUIThreadScheduler. This facilitates posting tasks to a
@@ -74,11 +126,15 @@ class CONTENT_EXPORT BrowserTaskExecutor : public base::TaskExecutor {
   // Can be called multiple times.
   static void EnableAllQueues();
 
-  // As Create but with the user provided objects.
+  // As Create but with the user provided objects. Must call
+  // BindToUIThreadForTesting before tasks can be run on the UI thread.
   static void CreateForTesting(
       std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler,
       std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate);
 
+  // Completes ui-thread set up. Must be called on the UI thread.
+  static void BindToUIThreadForTesting();
+
   // This must be called after the FeatureList has been initialized in order
   // for scheduling experiments to function.
   static void PostFeatureListSetup();
@@ -104,36 +160,6 @@ class CONTENT_EXPORT BrowserTaskExecutor : public base::TaskExecutor {
   static void RunAllPendingTasksOnThreadForTesting(
       BrowserThread::ID identifier);
 
-  struct ThreadIdAndQueueType {
-    BrowserThread::ID thread_id;
-    BrowserTaskQueues::QueueType queue_type;
-  };
-
-  static ThreadIdAndQueueType GetThreadIdAndQueueType(
-      const base::TaskTraits& traits);
-
-  // base::TaskExecutor implementation.
-  bool PostDelayedTask(const base::Location& from_here,
-                       const base::TaskTraits& traits,
-                       base::OnceClosure task,
-                       base::TimeDelta delay) override;
-
-  scoped_refptr<base::TaskRunner> CreateTaskRunner(
-      const base::TaskTraits& traits) override;
-
-  scoped_refptr<base::SequencedTaskRunner> CreateSequencedTaskRunner(
-      const base::TaskTraits& traits) override;
-
-  scoped_refptr<base::SingleThreadTaskRunner> CreateSingleThreadTaskRunner(
-      const base::TaskTraits& traits,
-      base::SingleThreadTaskRunnerThreadMode thread_mode) override;
-
-#if defined(OS_WIN)
-  scoped_refptr<base::SingleThreadTaskRunner> CreateCOMSTATaskRunner(
-      const base::TaskTraits& traits,
-      base::SingleThreadTaskRunnerThreadMode thread_mode) override;
-#endif  // defined(OS_WIN)
-
 #if DCHECK_IS_ON()
   // Adds a Validator for |traits|. It is assumed the lifetime of |validator| is
   // is longer than that of the BrowserTaskExecutor unless RemoveValidator
@@ -148,8 +174,58 @@ class CONTENT_EXPORT BrowserTaskExecutor : public base::TaskExecutor {
 #endif  // DCHECK_IS_ON()
 
  private:
+  friend class BrowserIOThreadDelegate;
   friend class BrowserTaskExecutorTest;
 
+  // Constructed on UI thread and registered with UI thread TLS. This backs the
+  // implementation of base::CurrentThread for the browser UI thread.
+  class UIThreadExecutor : public BaseBrowserTaskExecutor {
+   public:
+    explicit UIThreadExecutor(
+        std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler);
+
+    ~UIThreadExecutor() override;
+
+    scoped_refptr<BrowserUIThreadScheduler::Handle> GetUIThreadHandle();
+
+    void SetIOThreadHandle(
+        scoped_refptr<BrowserUIThreadScheduler::Handle> io_thread_handle);
+
+    void BindToCurrentThread();
+
+   private:
+    BrowserThread::ID GetCurrentThreadID() const override;
+
+    std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler_;
+    bool bound_to_thread_ = false;
+  };
+
+  // Constructed on UI thread and later registered with IO thread TLS. This
+  // backs the implementation of base::CurrentThread for the browser IO thread.
+  class IOThreadExecutor : public BaseBrowserTaskExecutor {
+   public:
+    explicit IOThreadExecutor(
+        std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate);
+
+    ~IOThreadExecutor() override;
+
+    scoped_refptr<BrowserUIThreadScheduler::Handle> GetIOThreadHandle();
+
+    void SetUIThreadHandle(
+        scoped_refptr<BrowserUIThreadScheduler::Handle> ui_thread_handle);
+
+    std::unique_ptr<BrowserIOThreadDelegate> TakeDelegate() {
+      return std::move(browser_io_thread_delegate_);
+    }
+
+    bool HasDelegateForTesting() const { return !!browser_io_thread_delegate_; }
+
+   private:
+    BrowserThread::ID GetCurrentThreadID() const override;
+
+    std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate_;
+  };
+
   static void CreateInternal(
       std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler,
       std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate);
@@ -162,19 +238,20 @@ class CONTENT_EXPORT BrowserTaskExecutor : public base::TaskExecutor {
   FRIEND_TEST_ALL_PREFIXES(BrowserTaskExecutorTest,
                            BestEffortTasksRunAfterStartup);
 
+  // For Get();
+  FRIEND_TEST_ALL_PREFIXES(BrowserTaskExecutorTest,
+                           RegisterExecutorForBothThreads);
   explicit BrowserTaskExecutor(
       std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler,
       std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate);
   ~BrowserTaskExecutor() override;
 
-  scoped_refptr<base::SingleThreadTaskRunner> GetTaskRunner(
-      const base::TaskTraits& traits) const;
+  BrowserThread::ID GetCurrentThreadID() const override;
 
-  std::unique_ptr<BrowserUIThreadScheduler> browser_ui_thread_scheduler_;
-  scoped_refptr<BrowserUIThreadScheduler::Handle> browser_ui_thread_handle_;
+  static BrowserTaskExecutor* Get();
 
-  std::unique_ptr<BrowserIOThreadDelegate> browser_io_thread_delegate_;
-  scoped_refptr<BrowserIOThreadDelegate::Handle> browser_io_thread_handle_;
+  std::unique_ptr<UIThreadExecutor> ui_thread_executor_;
+  std::unique_ptr<IOThreadExecutor> io_thread_executor_;
 
   DISALLOW_COPY_AND_ASSIGN(BrowserTaskExecutor);
 };
diff --git a/chromium/content/browser/scheduler/browser_task_executor_unittest.cc b/chromium/content/browser/scheduler/browser_task_executor_unittest.cc
index 3bae309f631..9ef50adae82 100644
--- a/chromium/content/browser/scheduler/browser_task_executor_unittest.cc
+++ b/chromium/content/browser/scheduler/browser_task_executor_unittest.cc
@@ -33,6 +33,7 @@ using ::base::TaskPriority;
 using ::testing::ElementsAre;
 using ::testing::Invoke;
 using ::testing::Mock;
+using ::testing::NotNull;
 using ::testing::SizeIs;
 
 using QueueType = BrowserTaskQueues::QueueType;
@@ -47,6 +48,21 @@ class BrowserTaskExecutorTest : public testing::Test {
 using StrictMockTask =
     testing::StrictMock<base::MockCallback<base::RepeatingCallback<void()>>>;
 
+TEST_F(BrowserTaskExecutorTest, RegisterExecutorForBothThreads) {
+  base::PostTask(FROM_HERE, {BrowserThread::UI}, base::BindOnce([]() {
+                   EXPECT_THAT(base::GetTaskExecutorForCurrentThread(),
+                               NotNull());
+                 }));
+
+  base::PostTask(FROM_HERE, {BrowserThread::IO}, base::BindOnce([]() {
+                   EXPECT_THAT(base::GetTaskExecutorForCurrentThread(),
+                               NotNull());
+                 }));
+
+  BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::UI);
+  BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::IO);
+}
+
 TEST_F(BrowserTaskExecutorTest, RunAllPendingTasksForTestingOnUI) {
   StrictMockTask task_1;
   StrictMockTask task_2;
@@ -108,6 +124,16 @@ TEST_F(BrowserTaskExecutorTest, RunAllPendingTasksForTestingOnIOIsReentrant) {
 // Helper to perform the same tets for all BrowserThread::ID values.
 class BrowserTaskTraitsMappingTest : public BrowserTaskExecutorTest {
  protected:
+  class TestExecutor : public BaseBrowserTaskExecutor {
+   public:
+    ~TestExecutor() override = default;
+
+    BrowserThread::ID GetCurrentThreadID() const override {
+      NOTREACHED();
+      return BrowserThread::UI;
+    }
+  };
+
   template <BrowserThread::ID ID>
   void CheckExpectations() {
     EXPECT_EQ(GetQueueType({ID, TaskPriority::BEST_EFFORT}),
@@ -131,8 +157,10 @@ class BrowserTaskTraitsMappingTest : public BrowserTaskExecutorTest {
 
  private:
   QueueType GetQueueType(const base::TaskTraits& traits) {
-    return BrowserTaskExecutor::GetThreadIdAndQueueType(traits).queue_type;
+    return test_executor_.GetThreadIdAndQueueType(traits).queue_type;
   }
+
+  TestExecutor test_executor_;
 };
 
 TEST_F(BrowserTaskTraitsMappingTest, BrowserTaskTraitsMapToProperPriorities) {
@@ -179,7 +207,8 @@ class BrowserTaskExecutorWithCustomSchedulerTest : public testing::Test {
               QueueType::kDefault));
       BrowserTaskExecutor::CreateForTesting(
           std::move(browser_ui_thread_scheduler),
-          std::make_unique<BrowserIOThreadDelegate>());
+          BrowserIOThreadDelegate::CreateForTesting(sequence_manager()));
+      BrowserTaskExecutor::BindToUIThreadForTesting();
     }
   };
 
@@ -239,4 +268,46 @@ TEST_F(BrowserTaskExecutorWithCustomSchedulerTest,
   task_environment_.FastForwardBy(base::TimeDelta::FromMilliseconds(100));
 }
 
+TEST_F(BrowserTaskExecutorTest, CurrentThread) {
+  base::PostTask(
+      FROM_HERE, {BrowserThread::UI}, base::BindOnce([]() {
+        base::PostTask(
+            FROM_HERE, {base::CurrentThread()}, base::BindOnce([]() {
+              EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::UI));
+            }));
+      }));
+  BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::UI);
+
+  base::PostTask(
+      FROM_HERE, {BrowserThread::IO}, base::BindOnce([]() {
+        base::PostTask(
+            FROM_HERE, {base::CurrentThread()}, base::BindOnce([]() {
+              EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::IO));
+            }));
+      }));
+
+  BrowserTaskExecutor::RunAllPendingTasksOnThreadForTesting(BrowserThread::IO);
+}
+
+TEST_F(BrowserTaskExecutorTest, CurrentThreadAndOtherTraits) {
+  EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::UI));
+
+  auto ui_task_runner = base::CreateSingleThreadTaskRunner({BrowserThread::UI});
+  auto ui_best_effort_runner = base::CreateSingleThreadTaskRunner(
+      {BrowserThread::UI, base::TaskPriority::BEST_EFFORT});
+  auto ui_best_navigation_runner = base::CreateSingleThreadTaskRunner(
+      {BrowserThread::UI, BrowserTaskType::kNavigation});
+
+  EXPECT_EQ(ui_task_runner,
+            base::CreateSingleThreadTaskRunner({base::CurrentThread()}));
+
+  EXPECT_EQ(ui_best_effort_runner,
+            base::CreateSingleThreadTaskRunner(
+                {base::CurrentThread(), base::TaskPriority::BEST_EFFORT}));
+
+  EXPECT_EQ(ui_best_navigation_runner,
+            base::CreateSingleThreadTaskRunner(
+                {base::CurrentThread(), BrowserTaskType::kNavigation}));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc b/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc
index e2b42b13e68..eeb4d0baaea 100644
--- a/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc
+++ b/chromium/content/browser/screen_orientation/screen_orientation_browsertest.cc
@@ -75,15 +75,8 @@ class ScreenOrientationBrowserTest : public ContentBrowserTest  {
     }
 
     // This simulates what the browser process does when the screen orientation
-    // is changed:
-    // 1. RenderWidgetHostImpl is notified which sends a ViweMsg_Resize message
-    // to the top-level frame.
+    // is changed.
     main_frame_rwh->SetScreenOrientationForTesting(angle, type);
-
-    // 2. The WebContents sends a PageMsg_UpdateScreenInfo to all the renderers
-    // involved in the FrameTree.
-    web_contents()->GetFrameTree()->root()->render_manager()->SendPageMessage(
-        new PageMsg_UpdateScreenInfo(MSG_ROUTING_NONE, screen_info), nullptr);
   }
 
   int GetOrientationAngle() {
diff --git a/chromium/content/browser/screen_orientation/screen_orientation_provider_unittest.cc b/chromium/content/browser/screen_orientation/screen_orientation_provider_unittest.cc
index a4b0c9ab12f..2c8bba3dfc4 100644
--- a/chromium/content/browser/screen_orientation/screen_orientation_provider_unittest.cc
+++ b/chromium/content/browser/screen_orientation/screen_orientation_provider_unittest.cc
@@ -13,6 +13,7 @@
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
 #include "third_party/blink/public/common/screen_orientation/web_screen_orientation_lock_type.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 
 namespace content {
 
@@ -63,7 +64,7 @@ class FakeWebContentsDelegate : public WebContentsDelegate {
   void EnterFullscreenModeForTab(
       WebContents* web_contents,
       const GURL& origin,
-      const blink::WebFullscreenOptions& options) override {
+      const blink::mojom::FullscreenOptions& options) override {
     fullscreened_contents_ = web_contents;
   }
 
@@ -181,8 +182,7 @@ TEST_F(ScreenOrientationProviderTest, DelegateRequireFullScreenLockOnce) {
   EXPECT_EQ(0, delegate.lock_count());
 
   // Simulates entering full screen.
-  main_test_rfh()->OnMessageReceived(FrameHostMsg_EnterFullscreen(
-      main_test_rfh()->GetRoutingID(), blink::WebFullscreenOptions()));
+  main_test_rfh()->EnterFullscreen(blink::mojom::FullscreenOptions::New());
   ASSERT_TRUE(contents()->IsFullscreenForCurrentTab());
 
   base::Optional<ScreenOrientationLockResult> result_2;
@@ -284,8 +284,7 @@ TEST_F(ScreenOrientationProviderTest, UnlockWhenExitingFullScreen) {
                        std::string());
 
   // Simulates entering full screen.
-  main_test_rfh()->OnMessageReceived(FrameHostMsg_EnterFullscreen(
-      main_test_rfh()->GetRoutingID(), blink::WebFullscreenOptions()));
+  main_test_rfh()->EnterFullscreen(blink::mojom::FullscreenOptions::New());
   ASSERT_TRUE(contents()->IsFullscreenForCurrentTab());
 
   base::Optional<ScreenOrientationLockResult> result;
@@ -299,8 +298,7 @@ TEST_F(ScreenOrientationProviderTest, UnlockWhenExitingFullScreen) {
   EXPECT_EQ(0, delegate.unlock_count());
 
   // Simulates exiting full screen.
-  main_test_rfh()->OnMessageReceived(
-      FrameHostMsg_ExitFullscreen(main_test_rfh()->GetRoutingID()));
+  main_test_rfh()->ExitFullscreen();
   ASSERT_FALSE(contents()->IsFullscreenForCurrentTab());
   // The pending lock request is cancelled.
   EXPECT_EQ(ScreenOrientationLockResult::
diff --git a/chromium/content/browser/security_exploit_browsertest.cc b/chromium/content/browser/security_exploit_browsertest.cc
index f2d649a6255..dcb687e4cca 100644
--- a/chromium/content/browser/security_exploit_browsertest.cc
+++ b/chromium/content/browser/security_exploit_browsertest.cc
@@ -14,6 +14,7 @@
 #include "base/test/scoped_feature_list.h"
 #include "build/build_config.h"
 #include "content/browser/bad_message.h"
+#include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
 #include "content/browser/frame_host/navigator.h"
@@ -37,11 +38,14 @@
 #include "content/public/browser/interstitial_page_delegate.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/navigation_policy.h"
+#include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/navigation_handle_observer.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
@@ -52,9 +56,12 @@
 #include "content/test/test_content_browser_client.h"
 #include "ipc/ipc_security_test_util.h"
 #include "mojo/core/embedder/embedder.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/strong_associated_binding.h"
 #include "mojo/public/cpp/test_support/test_utils.h"
+#include "net/base/filename_util.h"
 #include "net/base/network_isolation_key.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/controllable_http_response.h"
@@ -72,9 +79,10 @@
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/mojom/appcache/appcache.mojom.h"
 #include "third_party/blink/public/mojom/blob/blob_url_store.mojom-test-utils.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
+#include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 
 using IPC::IpcSecurityTestUtil;
 
@@ -131,7 +139,7 @@ RenderFrameHostImpl* PrepareToDuplicateHosts(Shell* shell,
       wc->GetFrameTree()->root()->current_frame_host(), extension_url,
       url::Origin::Create(foo), false, nullptr, std::string(), Referrer(),
       WindowOpenDisposition::CURRENT_TAB, false, true,
-      blink::WebTriggeringEventInfo::kFromTrustedEvent, std::string(),
+      blink::TriggeringEventInfo::kFromTrustedEvent, std::string(),
       nullptr /* blob_url_loader_factory */);
 
   // Since the navigation above requires a cross-process swap, there will be a
@@ -378,7 +386,7 @@ void SecurityExploitBrowserTest::TestFileChooserWithPath(
   params->default_file_name = path;
 
   mojo::test::BadMessageObserver bad_message_observer;
-  blink::mojom::FileChooserPtr factory =
+  mojo::Remote<blink::mojom::FileChooser> factory =
       static_cast<RenderFrameHostImpl*>(compromised_renderer)
           ->BindFileChooserForTesting();
   factory->OpenFileChooser(
@@ -435,9 +443,9 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
       shell(), embedded_test_server(), &duplicate_routing_id);
   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 
-  mojom::WidgetPtr widget;
+  mojo::PendingRemote<mojom::Widget> widget;
   std::unique_ptr<MockWidgetImpl> widget_impl =
-      std::make_unique<MockWidgetImpl>(mojo::MakeRequest(&widget));
+      std::make_unique<MockWidgetImpl>(widget.InitWithNewPipeAndPassReceiver());
 
   // Since this test executes on the UI thread and hopping threads might cause
   // different timing in the test, let's simulate a CreateNewWidget call coming
@@ -473,7 +481,7 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, UnexpectedMethodsSequence) {
   auto delegate = std::make_unique<DelayedFileChooserDelegate>();
   shell()->web_contents()->SetDelegate(delegate.get());
 
-  blink::mojom::FileChooserPtr chooser =
+  mojo::Remote<blink::mojom::FileChooser> chooser =
       static_cast<RenderFrameHostImpl*>(compromised_renderer)
           ->BindFileChooserForTesting();
   base::RunLoop run_loop1;
@@ -586,7 +594,10 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 
 class CorsExploitBrowserTest : public ContentBrowserTest {
  public:
-  CorsExploitBrowserTest() = default;
+  CorsExploitBrowserTest() {
+    feature_list_.InitAndEnableFeature(
+        blink::features::kHtmlImportsRequestInitiatorLock);
+  }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     // TODO(yoichio): This is temporary switch to support chrome internal
@@ -602,6 +613,8 @@ class CorsExploitBrowserTest : public ContentBrowserTest {
   }
 
  private:
+  base::test::ScopedFeatureList feature_list_;
+
   DISALLOW_COPY_AND_ASSIGN(CorsExploitBrowserTest);
 };
 
@@ -615,9 +628,6 @@ class CorsExploitBrowserTest : public ContentBrowserTest {
 // deprecated.
 IN_PROC_BROWSER_TEST_F(CorsExploitBrowserTest,
                        OriginHeaderSpoofViaHtmlImports) {
-  base::test::ScopedFeatureList feature_list;
-  feature_list.InitAndEnableFeature(
-      blink::features::kHtmlImportsRequestInitiatorLock);
   std::string victim_path = "/victim/secret.json";
   net::test_server::ControllableHttpResponse victim_response(
       embedded_test_server(), victim_path, false);
@@ -750,13 +760,19 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
       shell()->web_contents()->GetMainFrame());
   RenderProcessHostKillWaiter kill_waiter(frame->GetProcess());
 
+  NavigationHandleObserver navigation_observer(shell()->web_contents(),
+                                               non_same_document_url);
   ScopedInterfaceParamsReplacer replacer(shell()->web_contents(), nullptr);
-  NavigateToURLAndExpectNoCommit(shell(), non_same_document_url);
+  EXPECT_TRUE(NavigateToURLAndExpectNoCommit(shell(), non_same_document_url));
   EXPECT_EQ(bad_message::RFH_INTERFACE_PROVIDER_MISSING, kill_waiter.Wait());
 
-  // Verify that the death of the renderer process doesn't leave behing and leak
-  // NavigationRequests - see https://crbug.com/869193.
-  EXPECT_EQ(0u, frame->GetNavigationEntryIdsPendingCommit().size());
+  // Verify that the death of the renderer process doesn't leave behind and
+  // leak NavigationRequests - see https://crbug.com/869193.
+  EXPECT_FALSE(frame->HasPendingCommitNavigationForTesting());
+  EXPECT_FALSE(navigation_observer.has_committed());
+  EXPECT_TRUE(navigation_observer.is_error());
+  EXPECT_TRUE(navigation_observer.last_committed_url().is_empty());
+  EXPECT_EQ(net::OK, navigation_observer.net_error_code());
 }
 
 // Test that a compromised renderer cannot ask to upload an arbitrary file in
@@ -1298,7 +1314,7 @@ class BeginNavigationInitiatorReplacer : public FrameHostInterceptor {
       mojom::CommonNavigationParamsPtr* common_params,
       mojom::BeginNavigationParamsPtr* begin_params,
       mojo::PendingRemote<blink::mojom::BlobURLToken>* blob_url_token,
-      mojom::NavigationClientAssociatedPtrInfo* navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>*
           navigation_initiator) override {
     if (is_activated_) {
@@ -1324,9 +1340,18 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
   // platforms without site-per-process.
   IsolateOrigin("a.com");
 
+  // IsolateOrigin internally performs navigations which get stored into the
+  // back-forward cache. It needs to be flushed. The
+  // BeginNavigationInitiatorReplacer below will simulate receiving
+  // RenderFrameCreated() on every active RenderFrameHost, but it will miss the
+  // ones in the BackForwardCache. This would causes a mismatch later when it
+  // will observe RenderFrameDeleted.
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  web_contents->GetController().GetBackForwardCache().Flush();
+
   // Prepare to intercept BeginNavigation mojo IPC.  This has to be done before
   // the test creates the RenderFrameHostImpl that is the target of the IPC.
-  WebContents* web_contents = shell()->web_contents();
   BeginNavigationInitiatorReplacer injector(
       web_contents, url::Origin::Create(GURL("http://b.com")));
 
@@ -1442,7 +1467,7 @@ class BeginNavigationTransitionReplacer : public FrameHostInterceptor {
       mojom::CommonNavigationParamsPtr* common_params,
       mojom::BeginNavigationParamsPtr* begin_params,
       mojo::PendingRemote<blink::mojom::BlobURLToken>* blob_url_token,
-      mojom::NavigationClientAssociatedPtrInfo* navigation_client,
+      mojo::PendingAssociatedRemote<mojom::NavigationClient>* navigation_client,
       mojo::PendingRemote<blink::mojom::NavigationInitiator>*
           navigation_initiator) override {
     if (is_activated_) {
@@ -1501,4 +1526,191 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, NonWebbyTransition) {
   }
 }
 
+class SecurityExploitViaDisabledWebSecurityTest
+    : public SecurityExploitBrowserTest {
+ public:
+  SecurityExploitViaDisabledWebSecurityTest() {
+    // To get around BlockedSchemeNavigationThrottle. Other attempts at getting
+    // around it don't work, i.e.:
+    // -if the request is made in a child frame then the frame is torn down
+    // immediately on process killing so the navigation doesn't complete
+    // -if it's classified as same document, then a DCHECK in
+    // NavigationRequest::CreateRendererInitiated fires
+    feature_list_.InitAndEnableFeature(
+        features::kAllowContentInitiatedDataUrlNavigations);
+  }
+
+ protected:
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    // Simulate a compromised renderer, otherwise the cross-origin request to
+    // file: is blocked.
+    command_line->AppendSwitch(switches::kDisableWebSecurity);
+    SecurityExploitBrowserTest::SetUpCommandLine(command_line);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
+// Test to verify that an exploited renderer process trying to specify a
+// non-empty URL for base_url_for_data_url on navigation is correctly
+// terminated.
+IN_PROC_BROWSER_TEST_F(SecurityExploitViaDisabledWebSecurityTest,
+                       ValidateBaseUrlForDataUrl) {
+  GURL start_url(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  RenderFrameHostImpl* rfh = static_cast<RenderFrameHostImpl*>(
+      shell()->web_contents()->GetMainFrame());
+
+  GURL data_url("data:text/html,foo");
+  base::FilePath file_path = GetTestFilePath("", "simple_page.html");
+  GURL file_url = net::FilePathToFileURL(file_path);
+
+  // Setup a BeginNavigate IPC with non-empty base_url_for_data_url.
+  mojom::CommonNavigationParamsPtr common_params =
+      mojom::CommonNavigationParams::New(
+          data_url, url::Origin::Create(data_url),
+          blink::mojom::Referrer::New(), ui::PAGE_TRANSITION_LINK,
+          mojom::NavigationType::DIFFERENT_DOCUMENT, NavigationDownloadPolicy(),
+          false /* should_replace_current_entry */,
+          file_url, /* base_url_for_data_url */
+          GURL() /* history_url_for_data_url */, PREVIEWS_UNSPECIFIED,
+          base::TimeTicks::Now() /* navigation_start */, "GET",
+          nullptr /* post_data */, base::Optional<SourceLocation>(),
+          false /* started_from_context_menu */, false /* has_user_gesture */,
+          InitiatorCSPInfo(),
+          std::vector<int>() /* initiator_origin_trial_features */,
+          std::string() /* href_translate */,
+          false /* is_history_navigation_in_new_child_frame */,
+          base::TimeTicks());
+  mojom::BeginNavigationParamsPtr begin_params =
+      mojom::BeginNavigationParams::New(
+          std::string() /* headers */, net::LOAD_NORMAL,
+          false /* skip_service_worker */,
+          blink::mojom::RequestContextType::LOCATION,
+          blink::WebMixedContentContextType::kBlockable,
+          false /* is_form_submission */,
+          false /* was_initiated_by_link_click */,
+          GURL() /* searchable_form_url */,
+          std::string() /* searchable_form_encoding */,
+          GURL() /* client_side_redirect_url */,
+          base::nullopt /* devtools_initiator_info */);
+
+  // Receiving the invalid IPC message should lead to renderer process
+  // termination.
+  RenderProcessHostKillWaiter process_kill_waiter(rfh->GetProcess());
+
+  mojo::PendingAssociatedRemote<mojom::NavigationClient> navigation_client;
+  if (IsPerNavigationMojoInterfaceEnabled()) {
+    auto navigation_client_receiver =
+        navigation_client.InitWithNewEndpointAndPassReceiver();
+    rfh->frame_host_receiver_for_testing().impl()->BeginNavigation(
+        std::move(common_params), std::move(begin_params), mojo::NullRemote(),
+        std::move(navigation_client), mojo::NullRemote());
+  } else {
+    rfh->frame_host_receiver_for_testing().impl()->BeginNavigation(
+        std::move(common_params), std::move(begin_params), mojo::NullRemote(),
+        mojo::NullAssociatedRemote(), mojo::NullRemote());
+  }
+  EXPECT_EQ(bad_message::RFH_BASE_URL_FOR_DATA_URL_SPECIFIED,
+            process_kill_waiter.Wait());
+
+  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->CanReadFile(
+      rfh->GetProcess()->GetID(), file_path));
+
+  // Reload the page to create another renderer process.
+  TestNavigationObserver tab_observer(shell()->web_contents(), 1);
+  shell()->web_contents()->GetController().Reload(ReloadType::NORMAL, false);
+  tab_observer.Wait();
+
+  // Make an XHR request to check if the page has access.
+  std::string script = base::StringPrintf(
+      "var xhr = new XMLHttpRequest()\n"
+      "xhr.open('GET', '%s', false);\n"
+      "try { xhr.send(); } catch (e) {}\n"
+      "window.domAutomationController.send(xhr.responseText);",
+      file_url.spec().c_str());
+  std::string result;
+  EXPECT_TRUE(
+      ExecuteScriptAndExtractString(shell()->web_contents(), script, &result));
+  EXPECT_TRUE(result.empty());
+}
+
+// Tests what happens when a web renderer asks to begin navigating to a file
+// url.
+IN_PROC_BROWSER_TEST_F(SecurityExploitViaDisabledWebSecurityTest,
+                       WebToFileNavigation) {
+  // Navigate to a web page.
+  GURL start_url(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  // Have the webpage attempt to open a window with a file URL.
+  //
+  // Note that such attempt would normally be blocked in the renderer ("Not
+  // allowed to load local resource: file:///..."), but the test here simulates
+  // a compromised renderer by using --disable-web-security cmdline flag.
+  GURL file_url = GetTestUrl("", "simple_page.html");
+  WebContentsAddedObserver new_window_observer;
+  TestNavigationObserver nav_observer(nullptr);
+  nav_observer.StartWatchingNewWebContents();
+  ASSERT_TRUE(ExecJs(shell()->web_contents(),
+                     JsReplace("window.open($1, '_blank')", file_url)));
+  WebContents* new_window = new_window_observer.GetWebContents();
+  nav_observer.WaitForNavigationFinished();
+
+  // Verify that the navigation got blocked.
+  EXPECT_TRUE(nav_observer.last_navigation_succeeded());
+  EXPECT_EQ(GURL(kBlockedURL), nav_observer.last_navigation_url());
+  EXPECT_EQ(GURL(kBlockedURL),
+            new_window->GetMainFrame()->GetLastCommittedURL());
+  EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetLastCommittedOrigin(),
+            new_window->GetMainFrame()->GetLastCommittedOrigin());
+  EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetProcess(),
+            new_window->GetMainFrame()->GetProcess());
+
+  // Even though the navigation is blocked, we expect the opener relationship to
+  // be established between the 2 windows.
+  EXPECT_EQ(true, ExecJs(new_window, "!!window.opener"));
+}
+
+// Tests what happens when a web renderer asks to begin navigating to a
+// view-source url.
+IN_PROC_BROWSER_TEST_F(SecurityExploitViaDisabledWebSecurityTest,
+                       WebToViewSourceNavigation) {
+  // Navigate to a web page.
+  GURL start_url(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), start_url));
+
+  // Have the webpage attempt to open a window with a view-source URL.
+  //
+  // Note that such attempt would normally be blocked in the renderer ("Not
+  // allowed to load local resource: view-source:///..."), but the test here
+  // simulates a compromised renderer by using --disable-web-security flag.
+  base::FilePath file_path = GetTestFilePath("", "simple_page.html");
+  GURL view_source_url =
+      GURL(std::string(kViewSourceScheme) + ":" + start_url.spec());
+  WebContentsAddedObserver new_window_observer;
+  TestNavigationObserver nav_observer(nullptr);
+  nav_observer.StartWatchingNewWebContents();
+  ASSERT_TRUE(ExecJs(shell()->web_contents(),
+                     JsReplace("window.open($1, '_blank')", view_source_url)));
+  WebContents* new_window = new_window_observer.GetWebContents();
+  nav_observer.WaitForNavigationFinished();
+
+  // Verify that the navigation got blocked.
+  EXPECT_TRUE(nav_observer.last_navigation_succeeded());
+  EXPECT_EQ(GURL(kBlockedURL), nav_observer.last_navigation_url());
+  EXPECT_EQ(GURL(kBlockedURL),
+            new_window->GetMainFrame()->GetLastCommittedURL());
+  EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetLastCommittedOrigin(),
+            new_window->GetMainFrame()->GetLastCommittedOrigin());
+  EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetProcess(),
+            new_window->GetMainFrame()->GetProcess());
+
+  // Even though the navigation is blocked, we expect the opener relationship to
+  // be established between the 2 windows.
+  EXPECT_EQ(true, ExecJs(new_window, "!!window.opener"));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/serial/serial_browsertest.cc b/chromium/content/browser/serial/serial_browsertest.cc
index e59042d93f0..c1cf0f182c5 100644
--- a/chromium/content/browser/serial/serial_browsertest.cc
+++ b/chromium/content/browser/serial/serial_browsertest.cc
@@ -11,6 +11,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/serial_chooser.h"
 #include "content/public/browser/serial_delegate.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
@@ -64,7 +65,7 @@ class SerialTest : public ContentBrowserTest {
 }  // namespace
 
 IN_PROC_BROWSER_TEST_F(SerialTest, GetPorts) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   // Three ports are added but only two will have permission granted.
   for (size_t i = 0; i < 3; i++) {
@@ -84,7 +85,7 @@ IN_PROC_BROWSER_TEST_F(SerialTest, GetPorts) {
 }
 
 IN_PROC_BROWSER_TEST_F(SerialTest, RequestPort) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   EXPECT_CALL(delegate(), CanRequestPortPermission).WillOnce(Return(true));
 
@@ -101,7 +102,7 @@ IN_PROC_BROWSER_TEST_F(SerialTest, RequestPort) {
 }
 
 IN_PROC_BROWSER_TEST_F(SerialTest, DisallowRequestPort) {
-  NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(nullptr, "simple_page.html")));
 
   EXPECT_CALL(delegate(), CanRequestPortPermission(_)).WillOnce(Return(false));
   EXPECT_CALL(delegate(), RunChooserInternal).Times(Exactly(0));
diff --git a/chromium/content/browser/serial/serial_service.cc b/chromium/content/browser/serial/serial_service.cc
index 442c24e7f0b..492e9408a36 100644
--- a/chromium/content/browser/serial/serial_service.cc
+++ b/chromium/content/browser/serial/serial_service.cc
@@ -9,12 +9,15 @@
 #include "base/bind.h"
 #include "base/callback.h"
 #include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/serial_chooser.h"
 #include "content/public/browser/serial_delegate.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_client.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 
 namespace content {
@@ -40,7 +43,13 @@ SerialService::SerialService(RenderFrameHost* render_frame_host)
     : render_frame_host_(render_frame_host) {
   DCHECK(render_frame_host_->IsFeatureEnabled(
       blink::mojom::FeaturePolicyFeature::kSerial));
-  watchers_.set_connection_error_handler(base::BindRepeating(
+  // Serial API is not supported for back-forward cache for now because we
+  // don't have support for closing/freezing ports when the frame is added to
+  // the back-forward cache, so we mark frames that use this API as disabled
+  // for back-forward cache.
+  BackForwardCache::DisableForRenderFrameHost(render_frame_host, "Serial");
+
+  watchers_.set_disconnect_handler(base::BindRepeating(
       &SerialService::OnWatcherConnectionError, base::Unretained(this)));
 }
 
@@ -50,8 +59,9 @@ SerialService::~SerialService() {
     DecrementActiveFrameCount();
 }
 
-void SerialService::Bind(blink::mojom::SerialServiceRequest request) {
-  bindings_.AddBinding(this, std::move(request));
+void SerialService::Bind(
+    mojo::PendingReceiver<blink::mojom::SerialService> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
 void SerialService::GetPorts(GetPortsCallback callback) {
@@ -100,8 +110,8 @@ void SerialService::GetPort(
     web_contents_impl->IncrementSerialActiveFrameCount();
   }
 
-  device::mojom::SerialPortConnectionWatcherPtr watcher;
-  watchers_.AddBinding(this, mojo::MakeRequest(&watcher));
+  mojo::PendingRemote<device::mojom::SerialPortConnectionWatcher> watcher;
+  watchers_.Add(this, watcher.InitWithNewPipeAndPassReceiver());
   delegate->GetPortManager(render_frame_host_)
       ->GetPort(token, std::move(receiver), std::move(watcher));
 }
diff --git a/chromium/content/browser/serial/serial_service.h b/chromium/content/browser/serial/serial_service.h
index 2c5fa1e721a..03b8ffbf4c3 100644
--- a/chromium/content/browser/serial/serial_service.h
+++ b/chromium/content/browser/serial/serial_service.h
@@ -12,6 +12,7 @@
 #include "base/memory/weak_ptr.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/device/public/mojom/serial.mojom.h"
 #include "third_party/blink/public/mojom/serial/serial.mojom.h"
 
@@ -26,7 +27,7 @@ class SerialService : public blink::mojom::SerialService,
   explicit SerialService(RenderFrameHost* render_frame_host);
   ~SerialService() override;
 
-  void Bind(blink::mojom::SerialServiceRequest request);
+  void Bind(mojo::PendingReceiver<blink::mojom::SerialService> receiver);
 
   // SerialService implementation
   void GetPorts(GetPortsCallback callback) override;
@@ -47,14 +48,14 @@ class SerialService : public blink::mojom::SerialService,
   // This raw pointer is safe because instances of this class are owned by
   // RenderFrameHostImpl.
   RenderFrameHost* const render_frame_host_;
-  mojo::BindingSet<blink::mojom::SerialService> bindings_;
+  mojo::ReceiverSet<blink::mojom::SerialService> receivers_;
 
   // The last shown serial port chooser UI.
   std::unique_ptr<SerialChooser> chooser_;
 
   // Each pipe here watches a connection created by GetPort() in order to notify
   // the WebContentsImpl when an active connection indicator should be shown.
-  mojo::BindingSet<device::mojom::SerialPortConnectionWatcher> watchers_;
+  mojo::ReceiverSet<device::mojom::SerialPortConnectionWatcher> watchers_;
 
   base::WeakPtrFactory<SerialService> weak_factory_{this};
 
diff --git a/chromium/content/browser/serial/serial_unittest.cc b/chromium/content/browser/serial/serial_unittest.cc
index a1bf5837c8d..af30f1a0ccc 100644
--- a/chromium/content/browser/serial/serial_unittest.cc
+++ b/chromium/content/browser/serial/serial_unittest.cc
@@ -8,6 +8,7 @@
 #include "content/public/common/content_switches.h"
 #include "content/test/test_render_view_host.h"
 #include "content/test/test_web_contents.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/device/public/cpp/test/fake_serial_port_manager.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -56,10 +57,9 @@ class SerialTest : public RenderViewHostImplTestHarness {
 TEST_F(SerialTest, OpenAndClosePort) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  blink::mojom::SerialServicePtr service;
-  contents()->GetMainFrame()->BinderRegistryForTesting().BindInterface(
-      blink::mojom::SerialService::Name_,
-      mojo::MakeRequest(&service).PassMessagePipe());
+  mojo::Remote<blink::mojom::SerialService> service;
+  contents()->GetMainFrame()->BindSerialService(
+      service.BindNewPipeAndPassReceiver());
 
   auto token = base::UnguessableToken::Create();
   auto port_info = device::mojom::SerialPortInfo::New();
@@ -68,8 +68,8 @@ TEST_F(SerialTest, OpenAndClosePort) {
 
   EXPECT_FALSE(contents()->IsConnectedToSerialPort());
 
-  device::mojom::SerialPortPtr port;
-  service->GetPort(token, mojo::MakeRequest(&port));
+  mojo::Remote<device::mojom::SerialPort> port;
+  service->GetPort(token, port.BindNewPipeAndPassReceiver());
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(contents()->IsConnectedToSerialPort());
 
@@ -81,10 +81,9 @@ TEST_F(SerialTest, OpenAndClosePort) {
 TEST_F(SerialTest, OpenAndNavigateCrossOrigin) {
   NavigateAndCommit(GURL(kTestUrl));
 
-  blink::mojom::SerialServicePtr service;
-  contents()->GetMainFrame()->BinderRegistryForTesting().BindInterface(
-      blink::mojom::SerialService::Name_,
-      mojo::MakeRequest(&service).PassMessagePipe());
+  mojo::Remote<blink::mojom::SerialService> service;
+  contents()->GetMainFrame()->BindSerialService(
+      service.BindNewPipeAndPassReceiver());
 
   auto token = base::UnguessableToken::Create();
   auto port_info = device::mojom::SerialPortInfo::New();
@@ -93,8 +92,8 @@ TEST_F(SerialTest, OpenAndNavigateCrossOrigin) {
 
   EXPECT_FALSE(contents()->IsConnectedToSerialPort());
 
-  device::mojom::SerialPortPtr port;
-  service->GetPort(token, mojo::MakeRequest(&port));
+  mojo::Remote<device::mojom::SerialPort> port;
+  service->GetPort(token, port.BindNewPipeAndPassReceiver());
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(contents()->IsConnectedToSerialPort());
 
@@ -102,7 +101,7 @@ TEST_F(SerialTest, OpenAndNavigateCrossOrigin) {
   base::RunLoop().RunUntilIdle();
   EXPECT_FALSE(contents()->IsConnectedToSerialPort());
   port.FlushForTesting();
-  EXPECT_TRUE(port.encountered_error());
+  EXPECT_FALSE(port.is_connected());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/service_manager/service_manager_context.cc b/chromium/content/browser/service_manager/service_manager_context.cc
index 3c3e4e2100a..c4125dc630d 100644
--- a/chromium/content/browser/service_manager/service_manager_context.cc
+++ b/chromium/content/browser/service_manager/service_manager_context.cc
@@ -26,12 +26,10 @@
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
 #include "build/build_config.h"
-#include "content/app/strings/grit/content_strings.h"
 #include "content/browser/browser_main_loop.h"
 #include "content/browser/builtin_service_manifests.h"
 #include "content/browser/child_process_launcher.h"
 #include "content/browser/gpu/gpu_process_host.h"
-#include "content/browser/service_manager/common_browser_interfaces.h"
 #include "content/browser/system_connector_impl.h"
 #include "content/browser/utility_process_host.h"
 #include "content/browser/wake_lock/wake_lock_context_host.h"
@@ -47,7 +45,6 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/network_service_util.h"
 #include "content/public/common/service_manager_connection.h"
 #include "content/public/common/service_names.mojom.h"
 #include "media/audio/audio_manager.h"
@@ -68,11 +65,9 @@
 #include "services/media_session/public/mojom/constants.mojom.h"
 #include "services/metrics/metrics_mojo_service.h"
 #include "services/metrics/public/mojom/constants.mojom.h"
-#include "services/network/network_service.h"
 #include "services/network/public/cpp/cross_thread_shared_url_loader_factory_info.h"
 #include "services/network/public/mojom/network_service_test.mojom.h"
-#include "services/resource_coordinator/public/mojom/service_constants.mojom.h"
-#include "services/resource_coordinator/resource_coordinator_service.h"
+#include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/constants.h"
 #include "services/service_manager/public/cpp/manifest.h"
@@ -85,6 +80,7 @@
 #include "services/tracing/public/cpp/tracing_features.h"
 #include "services/tracing/public/mojom/constants.mojom.h"
 #include "services/tracing/tracing_service.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "ui/base/buildflags.h"
 #include "ui/base/ui_base_features.h"
 
@@ -104,20 +100,6 @@ base::LazyInstance<std::unique_ptr<service_manager::Connector>>::Leaky
 base::LazyInstance<std::map<std::string, base::WeakPtr<UtilityProcessHost>>>::
     Leaky g_active_process_groups;
 
-// If enabled, network service will run in it's own thread when running
-// in-process, otherwise it is run on the IO thread.
-// On ChromeOS the network service has to run on the IO thread because
-// ProfileIOData and NetworkContext both try to set up NSS, which has has to be
-// called from the IO thread.
-const base::Feature kNetworkServiceDedicatedThread{
-  "NetworkServiceDedicatedThread",
-#if defined(OS_CHROMEOS)
-      base::FEATURE_DISABLED_BY_DEFAULT
-#else
-      base::FEATURE_ENABLED_BY_DEFAULT
-#endif
-};
-
 service_manager::Manifest GetContentSystemManifest() {
   // TODO(https://crbug.com/961869): This is a bit of a temporary hack so that
   // we can make the global service instance a singleton. For now we just mirror
@@ -231,9 +213,10 @@ class DeviceServiceURLLoaderFactory : public network::SharedURLLoaderFactory {
   }
 
   // SharedURLLoaderFactory implementation:
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     GetContentClient()->browser()->GetSystemSharedURLLoaderFactory()->Clone(
-        std::move(request));
+        std::move(receiver));
   }
 
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override {
@@ -248,16 +231,6 @@ class DeviceServiceURLLoaderFactory : public network::SharedURLLoaderFactory {
   DISALLOW_COPY_AND_ASSIGN(DeviceServiceURLLoaderFactory);
 };
 
-std::unique_ptr<service_manager::Service> CreateNetworkService(
-    service_manager::mojom::ServiceRequest service_request) {
-  // The test interface doesn't need to be implemented in the in-process case.
-  auto registry = std::make_unique<service_manager::BinderRegistry>();
-  registry->AddInterface(base::BindRepeating(
-      [](network::mojom::NetworkServiceTestRequest request) {}));
-  return std::make_unique<network::NetworkService>(
-      std::move(registry), nullptr /* request */, std::move(service_request));
-}
-
 bool AudioServiceOutOfProcess() {
   // Returns true iff kAudioServiceOutOfProcess feature is enabled and if the
   // embedder does not provide its own in-process AudioManager.
@@ -318,12 +291,6 @@ void CreateInProcessAudioService(
                      BrowserMainLoop::GetAudioManager(), std::move(request)));
 }
 
-std::unique_ptr<service_manager::Service> CreateResourceCoordinatorService(
-    service_manager::mojom::ServiceRequest request) {
-  return std::make_unique<resource_coordinator::ResourceCoordinatorService>(
-      std::move(request));
-}
-
 std::unique_ptr<service_manager::Service> CreateTracingService(
     service_manager::mojom::ServiceRequest request) {
   return std::make_unique<tracing::TracingService>(std::move(request));
@@ -592,11 +559,6 @@ ServiceManagerContext::ServiceManagerContext(
   auto* system_connection = ServiceManagerConnection::GetForProcess();
   SetSystemConnector(system_connection->GetConnector()->Clone());
 
-  RegisterInProcessService(
-      resource_coordinator::mojom::kServiceName,
-      service_manager_thread_task_runner_,
-      base::BindRepeating(&CreateResourceCoordinatorService));
-
   RegisterInProcessService(metrics::mojom::kMetricsServiceName,
                            service_manager_thread_task_runner_,
                            base::BindRepeating(&metrics::CreateMetricsService));
@@ -625,20 +587,6 @@ ServiceManagerContext::ServiceManagerContext(
                              base::BindRepeating(&CreateTracingService));
   }
 
-  if (IsInProcessNetworkService()) {
-    scoped_refptr<base::SequencedTaskRunner> task_runner =
-        service_manager_thread_task_runner_;
-    if (base::FeatureList::IsEnabled(kNetworkServiceDedicatedThread)) {
-      base::Thread::Options options(base::MessagePumpType::IO, 0);
-      network_service_thread_.StartWithOptions(options);
-      task_runner = network_service_thread_.task_runner();
-    }
-
-    GetNetworkTaskRunner()->StartWithTaskRunner(task_runner);
-    RegisterInProcessService(mojom::kNetworkServiceName, task_runner,
-                             base::BindRepeating(&CreateNetworkService));
-  }
-
   in_process_context_->Start(
       manifests, std::move(system_remote),
       base::BindRepeating(&ServiceManagerContext::RunServiceInstance,
diff --git a/chromium/content/browser/service_manager/service_manager_context.h b/chromium/content/browser/service_manager/service_manager_context.h
index 540e083bd7c..1bd9a20d926 100644
--- a/chromium/content/browser/service_manager/service_manager_context.h
+++ b/chromium/content/browser/service_manager/service_manager_context.h
@@ -12,7 +12,6 @@
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
 #include "base/single_thread_task_runner.h"
-#include "base/threading/thread.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/service_manager/public/cpp/identity.h"
@@ -54,7 +53,6 @@ class CONTENT_EXPORT ServiceManagerContext {
   scoped_refptr<base::SingleThreadTaskRunner>
       service_manager_thread_task_runner_;
   scoped_refptr<InProcessServiceManagerContext> in_process_context_;
-  base::Thread network_service_thread_{"NetworkService"};
   base::WeakPtrFactory<ServiceManagerContext> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(ServiceManagerContext);
diff --git a/chromium/content/browser/service_process_host_impl.cc b/chromium/content/browser/service_process_host_impl.cc
index f0873d3dc5f..1d417b84d88 100644
--- a/chromium/content/browser/service_process_host_impl.cc
+++ b/chromium/content/browser/service_process_host_impl.cc
@@ -58,6 +58,7 @@ class ServiceProcessTracker {
         FROM_HERE,
         base::BindOnce(&ServiceProcessTracker::NotifyTerminatedOnUIThread,
                        base::Unretained(this), iter->second));
+    processes_.erase(iter);
   }
 
   void NotifyCrashed(ServiceProcessId id) {
@@ -69,6 +70,7 @@ class ServiceProcessTracker {
         FROM_HERE,
         base::BindOnce(&ServiceProcessTracker::NotifyCrashedOnUIThread,
                        base::Unretained(this), iter->second));
+    processes_.erase(iter);
   }
 
   void AddObserver(ServiceProcessHost::Observer* observer) {
@@ -147,16 +149,22 @@ class UtilityProcessClient : public UtilityProcessHost::Client {
 
   void OnProcessTerminatedNormally() override {
     GetServiceProcessTracker().NotifyTerminated(
-        process_info_.service_process_id);
+        process_info_->service_process_id);
   }
 
   void OnProcessCrashed() override {
-    GetServiceProcessTracker().NotifyCrashed(process_info_.service_process_id);
+    // TODO(https://crbug.com/1016027): It is unclear how we can observe
+    // |OnProcessCrashed()| without observing |OnProcessLaunched()| first, but
+    // it can happen on Android. Ignore the notification in this case.
+    if (!process_info_)
+      return;
+
+    GetServiceProcessTracker().NotifyCrashed(process_info_->service_process_id);
   }
 
  private:
   const std::string service_interface_name_;
-  ServiceProcessInfo process_info_;
+  base::Optional<ServiceProcessInfo> process_info_;
 
   DISALLOW_COPY_AND_ASSIGN(UtilityProcessClient);
 };
diff --git a/chromium/content/browser/service_worker/embedded_worker_instance.cc b/chromium/content/browser/service_worker/embedded_worker_instance.cc
index e664e8e961f..b3988615508 100644
--- a/chromium/content/browser/service_worker/embedded_worker_instance.cc
+++ b/chromium/content/browser/service_worker/embedded_worker_instance.cc
@@ -29,7 +29,6 @@
 #include "content/browser/service_worker/service_worker_script_loader_factory.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/common/content_switches_internal.h"
-#include "content/common/renderer.mojom.h"
 #include "content/common/url_schemes.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
@@ -37,8 +36,6 @@
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_message.h"
-#include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/loader/url_loader_factory_bundle.mojom.h"
@@ -54,6 +51,9 @@ namespace content {
 
 namespace {
 
+// Used for tracing.
+constexpr char kEmbeddedWorkerInstanceScope[] = "EmbeddedWorkerInstance";
+
 EmbeddedWorkerInstance::CreateNetworkFactoryCallback&
 GetNetworkFactoryCallbackForTest() {
   static base::NoDestructor<
@@ -207,20 +207,17 @@ void SetupOnUIThread(
   // the process. If the process dies, |client_|'s connection error callback
   // will be called on the core thread.
   if (receiver.is_valid()) {
-    rph->GetRendererInterface()->SetUpEmbeddedWorkerChannelForServiceWorker(
-        std::move(receiver));
+    BindInterface(rph, std::move(receiver));
   }
 
   // Register to DevTools and update params accordingly.
-  // TODO(dgozman): we can now remove this routing id and use something else
-  // as id when talking to ServiceWorkerDevToolsManager.
   const int routing_id = rph->GetNextRoutingID();
   ServiceWorkerDevToolsManager::GetInstance()->WorkerCreated(
       process_id, routing_id, context, weak_context,
       params->service_worker_version_id, params->script_url, params->scope,
       params->is_installed, &params->devtools_worker_token,
       &params->wait_for_debugger);
-  params->worker_devtools_agent_route_id = routing_id;
+  params->service_worker_route_id = routing_id;
   // Create DevToolsProxy here to ensure that the WorkerCreated() call is
   // balanced by DevToolsProxy's destructor calling WorkerDestroyed().
   devtools_proxy = std::make_unique<EmbeddedWorkerInstance::DevToolsProxy>(
@@ -475,21 +472,20 @@ class EmbeddedWorkerInstance::StartTask {
         skip_recording_startup_time_(instance_->devtools_attached()),
         start_time_(start_time) {
     DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-    TRACE_EVENT_NESTABLE_ASYNC_BEGIN1("ServiceWorker",
-                                      "EmbeddedWorkerInstance::Start", this,
-                                      "Script", script_url.spec());
+    TRACE_EVENT_WITH_FLOW1(
+        "ServiceWorker", "EmbeddedWorkerInstance::StartTask::StartTask",
+        TRACE_ID_WITH_SCOPE(kEmbeddedWorkerInstanceScope,
+                            instance_->embedded_worker_id()),
+        TRACE_EVENT_FLAG_FLOW_OUT, "Script", script_url.spec());
   }
 
   ~StartTask() {
     DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-    if (did_send_start_) {
-      TRACE_EVENT_NESTABLE_ASYNC_END0("ServiceWorker",
-                                      "INITIALIZING_ON_RENDERER", this);
-    }
-
-    TRACE_EVENT_NESTABLE_ASYNC_END0("ServiceWorker",
-                                    "EmbeddedWorkerInstance::Start", this);
-
+    TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                           "EmbeddedWorkerInstance::StartTask::~StartTask",
+                           TRACE_ID_WITH_SCOPE(kEmbeddedWorkerInstanceScope,
+                                               instance_->embedded_worker_id()),
+                           TRACE_EVENT_FLAG_FLOW_IN);
     if (!instance_->context_)
       return;
 
@@ -542,6 +538,12 @@ class EmbeddedWorkerInstance::StartTask {
              StatusCallback sent_start_callback) {
     DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
     DCHECK(instance_->context_);
+    TRACE_EVENT_WITH_FLOW0(
+        "ServiceWorker", "EmbeddedWorkerInstance::StartTask::Start",
+        TRACE_ID_WITH_SCOPE(kEmbeddedWorkerInstanceScope,
+                            instance_->embedded_worker_id()),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+
     base::WeakPtr<ServiceWorkerContextCore> context = instance_->context_;
     state_ = ProcessAllocationState::ALLOCATING;
     sent_start_callback_ = std::move(sent_start_callback);
@@ -553,8 +555,6 @@ class EmbeddedWorkerInstance::StartTask {
     bool can_use_existing_process =
         context->GetVersionFailureCount(params->service_worker_version_id) <
         kMaxSameProcessFailureCount;
-    TRACE_EVENT_NESTABLE_ASYNC_BEGIN0("ServiceWorker", "ALLOCATING_PROCESS",
-                                      this);
     base::WeakPtr<ServiceWorkerProcessManager> process_manager =
         context->process_manager()->AsWeakPtr();
 
@@ -616,8 +616,12 @@ class EmbeddedWorkerInstance::StartTask {
     }
 
     if (status != blink::ServiceWorkerStatusCode::kOk) {
-      TRACE_EVENT_NESTABLE_ASYNC_END1(
-          "ServiceWorker", "ALLOCATING_PROCESS", this, "Error",
+      TRACE_EVENT_WITH_FLOW1(
+          "ServiceWorker",
+          "EmbeddedWorkerInstance::StartTask::OnSetupCompleted",
+          TRACE_ID_WITH_SCOPE(kEmbeddedWorkerInstanceScope,
+                              instance_->embedded_worker_id()),
+          TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Error",
           blink::ServiceWorkerStatusToString(status));
       instance_->OnSetupFailed(std::move(sent_start_callback_), status);
       // |this| may be destroyed.
@@ -626,8 +630,11 @@ class EmbeddedWorkerInstance::StartTask {
 
     ServiceWorkerMetrics::StartSituation start_situation =
         process_info->start_situation;
-    TRACE_EVENT_NESTABLE_ASYNC_END1(
-        "ServiceWorker", "ALLOCATING_PROCESS", this, "StartSituation",
+    TRACE_EVENT_WITH_FLOW1(
+        "ServiceWorker", "EmbeddedWorkerInstance::StartTask::OnSetupCompleted",
+        TRACE_ID_WITH_SCOPE(kEmbeddedWorkerInstanceScope,
+                            instance_->embedded_worker_id()),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "StartSituation",
         ServiceWorkerMetrics::StartSituationToString(start_situation));
     if (is_installed_) {
       ServiceWorkerMetrics::RecordProcessCreated(
@@ -665,9 +672,6 @@ class EmbeddedWorkerInstance::StartTask {
     instance_->SendStartWorker(std::move(params));
     std::move(sent_start_callback_).Run(blink::ServiceWorkerStatusCode::kOk);
 
-    TRACE_EVENT_NESTABLE_ASYNC_BEGIN0("ServiceWorker",
-                                      "INITIALIZING_ON_RENDERER", this);
-    did_send_start_ = true;
     // |this|'s work is done here, but |instance_| still uses its state until
     // startup is complete.
   }
@@ -679,7 +683,6 @@ class EmbeddedWorkerInstance::StartTask {
   mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient> receiver_;
 
   StatusCallback sent_start_callback_;
-  bool did_send_start_ = false;
   ProcessAllocationState state_;
 
   // Used for UMA.
@@ -720,10 +723,9 @@ void EmbeddedWorkerInstance::Start(
   for (auto& observer : listener_list_)
     observer.OnStarting();
 
-  params->worker_devtools_agent_route_id = MSG_ROUTING_NONE;
+  // service_worker_route_id will be set later in SetupOnUIThread
+  params->service_worker_route_id = MSG_ROUTING_NONE;
   params->wait_for_debugger = false;
-  params->v8_cache_options = GetV8CacheOptions();
-
   params->subresource_loader_updater =
       subresource_loader_updater_.BindNewPipeAndPassReceiver();
 
@@ -861,6 +863,16 @@ void EmbeddedWorkerInstance::SendStartWorker(
       process_id(), MakeRequest(&params->provider_info->interface_provider),
       params->provider_info->browser_interface_broker
           .InitWithNewPipeAndPassReceiver());
+
+  // TODO(bashi): Create correct outside fetch client settings object. We need
+  // to plumb parent's fetch client settings object from renderer.
+  // See crbug.com/937177.
+  params->outside_fetch_client_settings_object =
+      blink::mojom::FetchClientSettingsObject::New(
+          network::mojom::ReferrerPolicy::kDefault,
+          /*outgoing_referrer=*/params->script_url,
+          blink::mojom::InsecureRequestsPolicy::kDoNotUpgrade);
+
   client_->StartWorker(std::move(params));
 
   starting_phase_ = is_script_streaming ? SCRIPT_STREAMING : SENT_START_WORKER;
@@ -936,6 +948,7 @@ void EmbeddedWorkerInstance::OnStarted(
     blink::mojom::ServiceWorkerStartStatus start_status,
     int thread_id,
     blink::mojom::EmbeddedWorkerStartTimingPtr start_timing) {
+  TRACE_EVENT0("ServiceWorker", "EmbeddedWorkerInstance::OnStarted");
   if (!(start_timing->start_worker_received_time <=
             start_timing->script_evaluation_start_time &&
         start_timing->script_evaluation_start_time <=
diff --git a/chromium/content/browser/service_worker/embedded_worker_instance.h b/chromium/content/browser/service_worker/embedded_worker_instance.h
index a5d060cd9d6..d8523ee23a4 100644
--- a/chromium/content/browser/service_worker/embedded_worker_instance.h
+++ b/chromium/content/browser/service_worker/embedded_worker_instance.h
@@ -26,14 +26,17 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/content_browser_client.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/controller_service_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/embedded_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom.h"
+#include "third_party/blink/public/mojom/worker/subresource_loader_updater.mojom.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -127,10 +130,11 @@ class CONTENT_EXPORT EmbeddedWorkerInstance
   // Starts the worker. It is invalid to call this when the worker is not in
   // STOPPED status.
   //
-  // |sent_start_callback| is invoked once the Start IPC is sent, or if an error
-  // prevented that from happening. The callback is not invoked in some cases,
-  // e.g., when Stop() is called and aborts the start procedure. Note that when
-  // the callback is invoked with kOk status, the service worker has not yet
+  // |sent_start_callback| is invoked once the Start IPC is sent, and in some
+  // cases may be invoked if an error prevented that from happening. It's not
+  // invoked in some cases, like if the Mojo connection fails to connect, or
+  // when Stop() is called and aborts the start procedure. Note that when the
+  // callback is invoked with kOk status, the service worker has not yet
   // finished starting. Observe OnStarted()/OnStopped() for when start completed
   // or failed.
   void Start(blink::mojom::EmbeddedWorkerStartParamsPtr params,
@@ -206,7 +210,7 @@ class CONTENT_EXPORT EmbeddedWorkerInstance
   static std::string StartingPhaseToString(StartingPhase phase);
 
   using CreateNetworkFactoryCallback = base::RepeatingCallback<void(
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       int process_id,
       network::mojom::URLLoaderFactoryPtrInfo original_factory)>;
   // Allows overriding the URLLoaderFactory creation for loading subresources
@@ -362,14 +366,14 @@ class CONTENT_EXPORT EmbeddedWorkerInstance
   // thread.
   base::SequenceBound<ServiceWorkerContentSettingsProxyImpl> content_settings_;
 
-  mojo::StrongBindingPtr<network::mojom::URLLoaderFactory>
+  mojo::SelfOwnedReceiverRef<network::mojom::URLLoaderFactory>
       script_loader_factory_;
 
   const scoped_refptr<base::SequencedTaskRunner> ui_task_runner_;
 
   // Remote interface to talk to a running service worker. Used to update
   // subresource loader factories in the service worker.
-  mojo::Remote<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
+  mojo::Remote<blink::mojom::SubresourceLoaderUpdater>
       subresource_loader_updater_;
 
   base::WeakPtrFactory<EmbeddedWorkerInstance> weak_factory_{this};
diff --git a/chromium/content/browser/service_worker/embedded_worker_instance_unittest.cc b/chromium/content/browser/service_worker/embedded_worker_instance_unittest.cc
index 620e9c679f2..41f13b70639 100644
--- a/chromium/content/browser/service_worker/embedded_worker_instance_unittest.cc
+++ b/chromium/content/browser/service_worker/embedded_worker_instance_unittest.cc
@@ -173,7 +173,7 @@ class EmbeddedWorkerInstanceTest : public testing::Test,
       scoped_refptr<ServiceWorkerVersion> version) {
     auto provider_info =
         blink::mojom::ServiceWorkerProviderInfoForStartWorker::New();
-    version->provider_host_ = ServiceWorkerProviderHost::PreCreateForController(
+    version->provider_host_ = ServiceWorkerProviderHost::CreateForServiceWorker(
         context()->AsWeakPtr(), version, &provider_info);
     return provider_info;
   }
@@ -337,6 +337,14 @@ TEST_F(EmbeddedWorkerInstanceTest, StopWhenDevToolsAttached) {
 }
 
 TEST_F(EmbeddedWorkerInstanceTest, DetachDuringProcessAllocation) {
+  if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
+    // This test calls Start() then Detach() to test detaching during process
+    // allocation. But when ServiceWorkerOnUI is enabled, Start() synchronously
+    // reaches the SetupOnUIThread() step, so process allocation occurs before
+    // Detach() is called, so this test doesn't make sense.
+    return;
+  }
+
   const GURL scope("http://example.com/");
   const GURL url("http://example.com/worker.js");
 
@@ -394,6 +402,14 @@ TEST_F(EmbeddedWorkerInstanceTest, DetachAfterSendingStartWorkerMessage) {
 }
 
 TEST_F(EmbeddedWorkerInstanceTest, StopDuringProcessAllocation) {
+  if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
+    // This test calls Start() then Stop() to test stopping during process
+    // allocation. But when ServiceWorkerOnUI is enabled, Start() synchronously
+    // reaches the SetupOnUIThread() step, so process allocation occurs before
+    // Stop() is called, so this test doesn't make sense.
+    return;
+  }
+
   const GURL scope("http://example.com/");
   const GURL url("http://example.com/worker.js");
 
diff --git a/chromium/content/browser/service_worker/embedded_worker_test_helper.cc b/chromium/content/browser/service_worker/embedded_worker_test_helper.cc
index ba45eabd52e..7c26e68a14f 100644
--- a/chromium/content/browser/service_worker/embedded_worker_test_helper.cc
+++ b/chromium/content/browser/service_worker/embedded_worker_test_helper.cc
@@ -13,7 +13,6 @@
 #include "content/browser/service_worker/service_worker_context_core.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_test_utils.h"
-#include "content/common/renderer.mojom.h"
 #include "content/public/test/mock_render_process_host.h"
 #include "content/public/test/test_browser_context.h"
 #include "content/test/fake_network_url_loader_factory.h"
@@ -25,75 +24,6 @@
 
 namespace content {
 
-class EmbeddedWorkerTestHelper::MockRendererInterface : public mojom::Renderer {
- public:
-  // |helper| must outlive this.
-  explicit MockRendererInterface(EmbeddedWorkerTestHelper* helper)
-      : helper_(helper) {}
-
-  void AddBinding(mojom::RendererAssociatedRequest request) {
-    bindings_.AddBinding(this, std::move(request));
-  }
-
- private:
-  void CreateView(mojom::CreateViewParamsPtr) override { NOTREACHED(); }
-  void DestroyView(int32_t) override { NOTREACHED(); }
-  void CreateFrame(mojom::CreateFrameParamsPtr) override { NOTREACHED(); }
-  void SetUpEmbeddedWorkerChannelForServiceWorker(
-      mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>
-          client_receiver) override {
-    helper_->OnInstanceClientReceiver(std::move(client_receiver));
-  }
-  void CreateFrameProxy(
-      int32_t routing_id,
-      int32_t render_view_routing_id,
-      int32_t opener_routing_id,
-      int32_t parent_routing_id,
-      const FrameReplicationState& replicated_state,
-      const base::UnguessableToken& devtools_frame_token) override {
-    NOTREACHED();
-  }
-  void OnNetworkConnectionChanged(
-      net::NetworkChangeNotifier::ConnectionType type,
-      double max_bandwidth_mbps) override {
-    NOTREACHED();
-  }
-  void OnNetworkQualityChanged(net::EffectiveConnectionType type,
-                               base::TimeDelta http_rtt,
-                               base::TimeDelta transport_rtt,
-                               double bandwidth_kbps) override {
-    NOTREACHED();
-  }
-  void SetWebKitSharedTimersSuspended(bool suspend) override { NOTREACHED(); }
-  void SetUserAgent(const std::string& user_agent) override { NOTREACHED(); }
-  void SetUserAgentMetadata(const blink::UserAgentMetadata& metadata) override {
-    NOTREACHED();
-  }
-  void UpdateScrollbarTheme(
-      mojom::UpdateScrollbarThemeParamsPtr params) override {
-    NOTREACHED();
-  }
-  void OnSystemColorsChanged(int32_t aqua_color_variant,
-                             const std::string& highlight_text_color,
-                             const std::string& highlight_color) override {
-    NOTREACHED();
-  }
-  void UpdateSystemColorInfo(
-      mojom::UpdateSystemColorInfoParamsPtr params) override {
-    NOTREACHED();
-  }
-  void PurgePluginListCache(bool reload_pages) override { NOTREACHED(); }
-  void SetProcessState(mojom::RenderProcessState process_state) override {
-    NOTREACHED();
-  }
-  void SetSchedulerKeepActive(bool keep_active) override { NOTREACHED(); }
-  void SetIsLockedToSite() override { NOTREACHED(); }
-  void EnableV8LowMemoryMode() override { NOTREACHED(); }
-
-  EmbeddedWorkerTestHelper* helper_;
-  mojo::AssociatedBindingSet<mojom::Renderer> bindings_;
-};
-
 EmbeddedWorkerTestHelper::EmbeddedWorkerTestHelper(
     const base::FilePath& user_data_directory)
     : browser_context_(std::make_unique<TestBrowserContext>()),
@@ -122,43 +52,26 @@ EmbeddedWorkerTestHelper::EmbeddedWorkerTestHelper(
   if (!ServiceWorkerContext::IsServiceWorkerOnUIEnabled())
     wrapper_->InitializeResourceContext(browser_context_->GetResourceContext());
 
-  // Install a mocked mojom::Renderer interface to catch requests to
-  // establish Mojo connection for EWInstanceClient.
-  mock_renderer_interface_ = std::make_unique<MockRendererInterface>(this);
-
-  auto renderer_interface_ptr =
-      std::make_unique<mojom::RendererAssociatedPtr>();
-  mock_renderer_interface_->AddBinding(
-      mojo::MakeRequestAssociatedWithDedicatedPipe(
-          renderer_interface_ptr.get()));
-  render_process_host_->OverrideRendererInterfaceForTesting(
-      std::move(renderer_interface_ptr));
-
-  auto new_renderer_interface_ptr =
-      std::make_unique<mojom::RendererAssociatedPtr>();
-  mock_renderer_interface_->AddBinding(
-      mojo::MakeRequestAssociatedWithDedicatedPipe(
-          new_renderer_interface_ptr.get()));
-  new_render_process_host_->OverrideRendererInterfaceForTesting(
-      std::move(new_renderer_interface_ptr));
-
+  render_process_host_->OverrideBinderForTesting(
+      blink::mojom::EmbeddedWorkerInstanceClient::Name_,
+      base::BindRepeating(&EmbeddedWorkerTestHelper::OnInstanceClientRequest,
+                          base::Unretained(this)));
+  new_render_process_host_->OverrideBinderForTesting(
+      blink::mojom::EmbeddedWorkerInstanceClient::Name_,
+      base::BindRepeating(&EmbeddedWorkerTestHelper::OnInstanceClientRequest,
+                          base::Unretained(this)));
+
+  // Set a basic network URL loader factory so tests don't crash. Tests that
+  // want to customize further should use URLLoaderInterceptor which will
+  // override this.
+  // TODO(falken): Just make all MockRenderProcessHosts create and own
+  // their own url loader factory.
   default_network_loader_factory_ =
       std::make_unique<FakeNetworkURLLoaderFactory>();
-  SetNetworkFactory(default_network_loader_factory_.get());
-}
-
-void EmbeddedWorkerTestHelper::SetNetworkFactory(
-    network::mojom::URLLoaderFactory* factory) {
-  if (!factory)
-    factory = default_network_loader_factory_.get();
-
-  // Reset factory in URLLoaderFactoryGetter so that we don't hit DCHECK()
-  // there.
-  url_loader_factory_getter_->SetNetworkFactoryForTesting(nullptr);
-  url_loader_factory_getter_->SetNetworkFactoryForTesting(factory);
-
-  render_process_host_->OverrideURLLoaderFactory(factory);
-  new_render_process_host_->OverrideURLLoaderFactory(factory);
+  render_process_host_->OverrideURLLoaderFactory(
+      default_network_loader_factory_.get());
+  new_render_process_host_->OverrideURLLoaderFactory(
+      default_network_loader_factory_.get());
 }
 
 void EmbeddedWorkerTestHelper::AddPendingInstanceClient(
@@ -191,6 +104,20 @@ void EmbeddedWorkerTestHelper::OnInstanceClientReceiver(
   instance_clients_.insert(std::move(client));
 }
 
+void EmbeddedWorkerTestHelper::OnInstanceClientRequest(
+    mojo::ScopedMessagePipeHandle request_handle) {
+  mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient> receiver(
+      std::move(request_handle));
+  OnInstanceClientReceiver(std::move(receiver));
+}
+
+void EmbeddedWorkerTestHelper::OnServiceWorkerRequest(
+    blink::mojom::ServiceWorkerRequest request) {
+  mojo::PendingReceiver<blink::mojom::ServiceWorker> receiver(
+      std::move(request));
+  OnServiceWorkerReceiver(std::move(receiver));
+}
+
 void EmbeddedWorkerTestHelper::OnServiceWorkerReceiver(
     mojo::PendingReceiver<blink::mojom::ServiceWorker> receiver) {
   std::unique_ptr<FakeServiceWorker> service_worker;
diff --git a/chromium/content/browser/service_worker/embedded_worker_test_helper.h b/chromium/content/browser/service_worker/embedded_worker_test_helper.h
index 6a3a0d93ba3..bee5e231547 100644
--- a/chromium/content/browser/service_worker/embedded_worker_test_helper.h
+++ b/chromium/content/browser/service_worker/embedded_worker_test_helper.h
@@ -139,6 +139,8 @@ class EmbeddedWorkerTestHelper {
           receiver);
   void OnServiceWorkerReceiver(
       mojo::PendingReceiver<blink::mojom::ServiceWorker> receiver);
+  void OnInstanceClientRequest(mojo::ScopedMessagePipeHandle request_handle);
+  void OnServiceWorkerRequest(blink::mojom::ServiceWorkerRequest request);
 
   // Called by the fakes to destroy themselves.
   void RemoveInstanceClient(FakeEmbeddedWorkerInstanceClient* instance_client);
@@ -158,16 +160,12 @@ class EmbeddedWorkerTestHelper {
   virtual std::unique_ptr<FakeServiceWorker> CreateServiceWorker();
 
  private:
-  class MockRendererInterface;
-
   std::unique_ptr<TestBrowserContext> browser_context_;
   std::unique_ptr<MockRenderProcessHost> render_process_host_;
   std::unique_ptr<MockRenderProcessHost> new_render_process_host_;
 
   scoped_refptr<ServiceWorkerContextWrapper> wrapper_;
 
-  std::unique_ptr<MockRendererInterface> mock_renderer_interface_;
-
   base::queue<std::unique_ptr<FakeEmbeddedWorkerInstanceClient>>
       pending_embedded_worker_instance_clients_;
   base::flat_set<std::unique_ptr<FakeEmbeddedWorkerInstanceClient>,
diff --git a/chromium/content/browser/service_worker/fake_service_worker.cc b/chromium/content/browser/service_worker/fake_service_worker.cc
index 090e8f08526..4435e23a694 100644
--- a/chromium/content/browser/service_worker/fake_service_worker.cc
+++ b/chromium/content/browser/service_worker/fake_service_worker.cc
@@ -40,6 +40,7 @@ void FakeServiceWorker::InitializeGlobalScope(
     mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerHost>
         service_worker_host,
     blink::mojom::ServiceWorkerRegistrationObjectInfoPtr registration_info,
+    blink::mojom::ServiceWorkerObjectInfoPtr service_worker_info,
     blink::mojom::FetchHandlerExistence fetch_handler_existence) {
   host_.Bind(std::move(service_worker_host));
 
@@ -59,7 +60,13 @@ void FakeServiceWorker::InitializeGlobalScope(
         registration_info->active->receiver.PassHandle());
   }
 
+  if (service_worker_info) {
+    mojo::AssociateWithDisconnectedPipe(
+        service_worker_info->receiver.PassHandle());
+  }
+
   registration_info_ = std::move(registration_info);
+  service_worker_info_ = std::move(service_worker_info);
   if (quit_closure_for_initialize_global_scope_)
     std::move(quit_closure_for_initialize_global_scope_).Run();
 
@@ -102,8 +109,7 @@ void FakeServiceWorker::DispatchBackgroundFetchSuccessEvent(
 }
 
 void FakeServiceWorker::DispatchCookieChangeEvent(
-    const net::CanonicalCookie& cookie,
-    ::network::mojom::CookieChangeCause cause,
+    const net::CookieChangeInfo& change,
     DispatchCookieChangeEventCallback callback) {
   std::move(callback).Run(blink::mojom::ServiceWorkerEventStatus::COMPLETED);
 }
@@ -206,13 +212,6 @@ void FakeServiceWorker::DispatchExtendableMessageEvent(
   std::move(callback).Run(blink::mojom::ServiceWorkerEventStatus::COMPLETED);
 }
 
-void FakeServiceWorker::DispatchExtendableMessageEventWithCustomTimeout(
-    blink::mojom::ExtendableMessageEventPtr event,
-    base::TimeDelta timeout,
-    DispatchExtendableMessageEventWithCustomTimeoutCallback callback) {
-  std::move(callback).Run(blink::mojom::ServiceWorkerEventStatus::COMPLETED);
-}
-
 void FakeServiceWorker::DispatchContentDeleteEvent(
     const std::string& id,
     DispatchContentDeleteEventCallback callback) {
diff --git a/chromium/content/browser/service_worker/fake_service_worker.h b/chromium/content/browser/service_worker/fake_service_worker.h
index 8689c409c79..93a7f1be76f 100644
--- a/chromium/content/browser/service_worker/fake_service_worker.h
+++ b/chromium/content/browser/service_worker/fake_service_worker.h
@@ -54,6 +54,7 @@ class FakeServiceWorker : public blink::mojom::ServiceWorker {
       mojo::PendingAssociatedRemote<blink::mojom::ServiceWorkerHost>
           service_worker_host,
       blink::mojom::ServiceWorkerRegistrationObjectInfoPtr registration_info,
+      blink::mojom::ServiceWorkerObjectInfoPtr service_worker_info,
       FetchHandlerExistence fetch_handler_existence) override;
   void DispatchInstallEvent(DispatchInstallEventCallback callback) override;
   void DispatchActivateEvent(DispatchActivateEventCallback callback) override;
@@ -70,8 +71,7 @@ class FakeServiceWorker : public blink::mojom::ServiceWorker {
       blink::mojom::BackgroundFetchRegistrationPtr registration,
       DispatchBackgroundFetchSuccessEventCallback callback) override;
   void DispatchCookieChangeEvent(
-      const net::CanonicalCookie& cookie,
-      ::network::mojom::CookieChangeCause cause,
+      const net::CookieChangeInfo& change,
       DispatchCookieChangeEventCallback callback) override;
   void DispatchFetchEventForMainResource(
       blink::mojom::DispatchFetchEventParamsPtr params,
@@ -119,11 +119,6 @@ class FakeServiceWorker : public blink::mojom::ServiceWorker {
   void DispatchExtendableMessageEvent(
       blink::mojom::ExtendableMessageEventPtr event,
       DispatchExtendableMessageEventCallback callback) override;
-  void DispatchExtendableMessageEventWithCustomTimeout(
-      blink::mojom::ExtendableMessageEventPtr event,
-      base::TimeDelta timeout,
-      DispatchExtendableMessageEventWithCustomTimeoutCallback callback)
-      override;
   void DispatchContentDeleteEvent(
       const std::string& id,
       DispatchContentDeleteEventCallback callback) override;
@@ -142,6 +137,7 @@ class FakeServiceWorker : public blink::mojom::ServiceWorker {
 
   mojo::AssociatedRemote<blink::mojom::ServiceWorkerHost> host_;
   blink::mojom::ServiceWorkerRegistrationObjectInfoPtr registration_info_;
+  blink::mojom::ServiceWorkerObjectInfoPtr service_worker_info_;
   FetchHandlerExistence fetch_handler_existence_ =
       FetchHandlerExistence::UNKNOWN;
   base::OnceClosure quit_closure_for_initialize_global_scope_;
diff --git a/chromium/content/browser/service_worker/service_worker_browsertest.cc b/chromium/content/browser/service_worker/service_worker_browsertest.cc
index 57cc541d87b..4e998c70168 100644
--- a/chromium/content/browser/service_worker/service_worker_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_browsertest.cc
@@ -17,6 +17,7 @@
 #include "base/memory/ref_counted.h"
 #include "base/metrics/statistics_recorder.h"
 #include "base/run_loop.h"
+#include "base/scoped_observer.h"
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/strings/string16.h"
@@ -74,6 +75,7 @@
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_content_browser_client.h"
 #include "content/test/test_content_browser_client.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe_drainer.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/dns/mock_host_resolver.h"
@@ -90,7 +92,6 @@
 #include "storage/browser/blob/blob_handle.h"
 #include "storage/browser/blob/blob_reader.h"
 #include "storage/browser/blob/blob_storage_context.h"
-#include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
 #include "third_party/blink/public/common/service_worker/service_worker_type_converters.h"
@@ -142,6 +143,20 @@ std::string BlobToString(blink::mojom::Blob* actual_blob) {
   return output;
 }
 
+size_t BlobSideDataLength(blink::mojom::Blob* actual_blob) {
+  size_t result = 0;
+  base::RunLoop run_loop;
+  actual_blob->ReadSideData(base::BindOnce(
+      [](size_t* result, base::OnceClosure continuation,
+         const base::Optional<mojo_base::BigBuffer> data) {
+        *result = data ? data->size() : 0;
+        std::move(continuation).Run();
+      },
+      &result, run_loop.QuitClosure()));
+  run_loop.Run();
+  return result;
+}
+
 struct FetchResult {
   blink::ServiceWorkerStatusCode status;
   ServiceWorkerFetchDispatcher::FetchEventResult result;
@@ -305,7 +320,7 @@ std::unique_ptr<net::test_server::HttpResponse>
 VerifySaveDataNotInAccessControlRequestHeader(
     const net::test_server::HttpRequest& request) {
   if (request.method == net::test_server::METHOD_OPTIONS &&
-      network::features::ShouldEnableOutOfBlinkCors()) {
+      network::features::ShouldEnableOutOfBlinkCorsForTesting()) {
     // In OOR-CORS mode, 'Save-Data' is not added to the CORS preflight request.
     // This is the desired behavior.
     auto it = request.headers.find("Save-Data");
@@ -458,24 +473,6 @@ std::unique_ptr<net::test_server::HttpResponse> RequestHandlerForUpdateWorker(
   return http_response;
 }
 
-void StoreAllServiceWorkerRunningInfos(
-    std::vector<ServiceWorkerRunningInfo>* out_infos,
-    base::OnceClosure quit_closure,
-    ServiceWorkerContext* context,
-    std::vector<ServiceWorkerRunningInfo> infos) {
-  (*out_infos) = std::move(infos);
-  std::move(quit_closure).Run();
-}
-
-void StoreServiceWorkerRunningInfo(
-    std::vector<ServiceWorkerRunningInfo>* out_infos,
-    base::OnceClosure quit_closure,
-    ServiceWorkerContext* context,
-    const ServiceWorkerRunningInfo& info) {
-  out_infos->push_back(info);
-  std::move(quit_closure).Run();
-}
-
 const char kNavigationPreloadNetworkError[] =
     "NetworkError: The service worker navigation preload request failed with "
     "a network error.";
@@ -746,7 +743,7 @@ class ServiceWorkerVersionBrowserTest : public ServiceWorkerBrowserTest {
         33 /* dummy render process id */, true /* is_parent_frame_secure */,
         wrapper()->context()->AsWeakPtr(), &remote_endpoints_.back());
     const GURL url = embedded_test_server()->GetURL("/service_worker/host");
-    host->UpdateUrls(url, url);
+    host->UpdateUrls(url, url, url::Origin::Create(url));
     host->SetControllerRegistration(registration_,
                                     false /* notify_controllerchange */);
   }
@@ -1493,7 +1490,7 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerVersionBrowserTest, FetchEvent_Response) {
   expected_headers["content-type"] = "text/html; charset=UTF-8";
   EXPECT_EQ(expected_headers, response->headers);
 
-  blink::mojom::BlobPtr blob(std::move(response->blob->blob));
+  mojo::Remote<blink::mojom::Blob> blob(std::move(response->blob->blob));
   EXPECT_EQ("This resource is gone. Gone, gone, gone.",
             BlobToString(blob.get()));
 }
@@ -1771,7 +1768,9 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, RequestOrigin) {
         auto it = expected_request_urls.find(params->url_request.url);
         if (it != expected_request_urls.end()) {
           EXPECT_TRUE(params->url_request.originated_from_service_worker);
-          EXPECT_FALSE(params->url_request.top_frame_origin.has_value());
+          EXPECT_FALSE(params->url_request.trusted_params.has_value() &&
+                       params->url_request.trusted_params->network_isolation_key
+                           .IsFullyPopulated());
           EXPECT_TRUE(params->url_request.request_initiator.has_value());
           EXPECT_EQ(params->url_request.request_initiator->GetURL(),
                     cross_origin_server.base_url());
@@ -2992,11 +2991,11 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, ImportsBustMemcache) {
 class WorkerRunningStatusObserver : public ServiceWorkerContextObserver {
  public:
   explicit WorkerRunningStatusObserver(ServiceWorkerContext* context)
-      : context_(context) {
-    context_->AddObserver(this);
+      : scoped_context_observer_(this) {
+    scoped_context_observer_.Add(context);
   }
 
-  ~WorkerRunningStatusObserver() override { context_->RemoveObserver(this); }
+  ~WorkerRunningStatusObserver() override = default;
 
   int64_t version_id() { return version_id_; }
 
@@ -3005,26 +3004,26 @@ class WorkerRunningStatusObserver : public ServiceWorkerContextObserver {
       run_loop_.Run();
   }
 
-  void OnVersionRunningStatusChanged(content::ServiceWorkerContext* context,
-                                     int64_t version_id,
-                                     bool is_running) override {
-    if (is_running) {
-      EXPECT_EQ(context_, context);
-      version_id_ = version_id;
+  void OnVersionStartedRunning(
+      ServiceWorkerContext* context,
+      int64_t version_id,
+      const ServiceWorkerRunningInfo& running_info) override {
+    version_id_ = version_id;
 
-      if (run_loop_.running())
-        run_loop_.Quit();
-    }
+    if (run_loop_.running())
+      run_loop_.Quit();
   }
 
  private:
   base::RunLoop run_loop_;
-  ServiceWorkerContext* const context_;
+  ScopedObserver<ServiceWorkerContext, ServiceWorkerContextObserver>
+      scoped_context_observer_;
   int64_t version_id_ = blink::mojom::kInvalidServiceWorkerVersionId;
+
+  DISALLOW_COPY_AND_ASSIGN(WorkerRunningStatusObserver);
 };
 
-IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest,
-                       GetAllServiceWorkerRunningInfos) {
+IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, GetRunningServiceWorkerInfos) {
   StartServerAndNavigateToSetup();
   WorkerRunningStatusObserver observer(public_context());
   EXPECT_TRUE(NavigateToURL(shell(),
@@ -3033,40 +3032,15 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest,
   EXPECT_EQ("DONE", EvalJs(shell(), "register('fetch_event.js');"));
   observer.WaitUntilRunning();
 
-  std::vector<ServiceWorkerRunningInfo> infos;
-  base::RunLoop run_loop;
-  public_context()->GetAllServiceWorkerRunningInfos(base::BindOnce(
-      &StoreAllServiceWorkerRunningInfos, &infos, run_loop.QuitClosure()));
-  run_loop.Run();
-
+  const base::flat_map<int64_t, ServiceWorkerRunningInfo>& infos =
+      public_context()->GetRunningServiceWorkerInfos();
   ASSERT_EQ(1u, infos.size());
-  EXPECT_EQ(embedded_test_server()->GetURL("/service_worker/fetch_event.js"),
-            infos[0].script_url);
-  EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetProcess()->GetID(),
-            infos[0].process_id);
-}
-
-IN_PROC_BROWSER_TEST_F(ServiceWorkerBrowserTest, GetServiceWorkerRunningInfo) {
-  StartServerAndNavigateToSetup();
-  WorkerRunningStatusObserver observer(public_context());
-  EXPECT_TRUE(NavigateToURL(shell(),
-                            embedded_test_server()->GetURL(
-                                "/service_worker/create_service_worker.html")));
-  EXPECT_EQ("DONE", EvalJs(shell(), "register('fetch_event.js');"));
-  observer.WaitUntilRunning();
 
-  std::vector<ServiceWorkerRunningInfo> infos;
-  base::RunLoop run_loop;
-  public_context()->GetServiceWorkerRunningInfo(
-      observer.version_id(), base::BindOnce(&StoreServiceWorkerRunningInfo,
-                                            &infos, run_loop.QuitClosure()));
-  run_loop.Run();
-
-  ASSERT_EQ(1u, infos.size());
+  const ServiceWorkerRunningInfo& running_info = infos.begin()->second;
   EXPECT_EQ(embedded_test_server()->GetURL("/service_worker/fetch_event.js"),
-            infos[0].script_url);
+            running_info.script_url);
   EXPECT_EQ(shell()->web_contents()->GetMainFrame()->GetProcess()->GetID(),
-            infos[0].process_id);
+            running_info.render_process_id);
 }
 
 // An observer that waits for the version to stop.
@@ -3349,7 +3323,8 @@ class CacheStorageSideDataSizeChecker
     scoped_request->url = url_;
     CacheStorageCache* cache = cache_handle.value();
     cache->Match(
-        std::move(scoped_request), nullptr, /* trace_id = */ 0,
+        std::move(scoped_request), nullptr,
+        CacheStorageSchedulerPriority::kNormal, /* trace_id = */ 0,
         base::BindOnce(&self::OnCacheStorageCacheMatchCallback, this, result,
                        std::move(continuation), std::move(cache_handle)));
   }
@@ -3367,10 +3342,9 @@ class CacheStorageSideDataSizeChecker
     }
 
     ASSERT_EQ(CacheStorageError::kSuccess, error);
-    ASSERT_TRUE(response->blob);
-    blink::mojom::BlobPtr blob_ptr(std::move(response->blob->blob));
-    auto blob_handle =
-        base::MakeRefCounted<storage::BlobHandle>(std::move(blob_ptr));
+    ASSERT_TRUE(response->side_data_blob);
+    auto blob_handle = base::MakeRefCounted<storage::BlobHandle>(
+        std::move(response->side_data_blob->blob));
     blob_handle->get()->ReadSideData(base::BindOnce(
         [](scoped_refptr<storage::BlobHandle> blob_handle, int* result,
            base::OnceClosure continuation,
@@ -3504,180 +3478,6 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerV8CodeCacheForCacheStorageNoneTest,
   WaitUntilSideDataSizeIs(0);
 }
 
-class ServiceWorkerCodeCacheStrategyTestBase : public ServiceWorkerBrowserTest {
- public:
-  ServiceWorkerCodeCacheStrategyTestBase() = default;
-  ~ServiceWorkerCodeCacheStrategyTestBase() override = default;
-
- protected:
-  static const char kWorkerUrl[];
-  static const char kPageUrl[];
-  static const char kCachedInInstallEventUrl[];
-  static const char kCachedInInstallEventWithMimeTypeParamUrl[];
-  static const char kCachedInFetchEventUrl[];
-  static const char kCachedInMessageEventUrl[];
-
-  void RegisterAndActivateServiceWorker() {
-    auto observer = base::MakeRefCounted<WorkerActivatedObserver>(wrapper());
-    observer->Init();
-    blink::mojom::ServiceWorkerRegistrationOptions options(
-        embedded_test_server()->GetURL(kPageUrl),
-        blink::mojom::ScriptType::kClassic,
-        blink::mojom::ServiceWorkerUpdateViaCache::kImports);
-    public_context()->RegisterServiceWorker(
-        embedded_test_server()->GetURL(kWorkerUrl), options,
-        base::BindOnce(&ExpectResultAndRun, true, base::DoNothing()));
-    observer->Wait();
-  }
-
-  void NavigateToTestPage() {
-    StartServerAndNavigateToSetup();
-    RegisterAndActivateServiceWorker();
-    EXPECT_TRUE(
-        NavigateToURL(shell(), embedded_test_server()->GetURL(kPageUrl)));
-  }
-
-  void InitiateEventsToCacheScript() {
-    // Fetch a test script in the page. The service worker will put the
-    // response into CacheStorage in the fetch event handler.
-    EXPECT_EQ("DONE", EvalJs(shell(),
-                             "fetch_script('code_cache_strategy_test_script.js?"
-                             "cached_in_fetch_event');"));
-    // Post a message to the service worker to put the response of the test
-    // script into CacheStorage in the message event handler.
-    EXPECT_EQ("DONE", EvalJs(shell(),
-                             "post_message('cache_script_in_message_event');"));
-  }
-
-  CacheStorageContextImpl* GetCacheStorageContextImpl() {
-    StoragePartition* partition = BrowserContext::GetDefaultStoragePartition(
-        shell()->web_contents()->GetBrowserContext());
-    return static_cast<CacheStorageContextImpl*>(
-        partition->GetCacheStorageContext());
-  }
-
-  bool HasSideData(const std::string& path) {
-    int size = CacheStorageSideDataSizeChecker::GetSize(
-        GetCacheStorageContextImpl(), embedded_test_server()->base_url(),
-        std::string("cache_name"), embedded_test_server()->GetURL(path));
-    return size > 0;
-  }
-
-  void WaitForSideData(const std::string& path) {
-    while (true) {
-      if (HasSideData(path))
-        return;
-    }
-  }
-
-  base::test::ScopedFeatureList feature_list_;
-
-  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerCodeCacheStrategyTestBase);
-};
-
-const char ServiceWorkerCodeCacheStrategyTestBase::kPageUrl[] =
-    "/service_worker/code_cache_strategy.html";
-const char ServiceWorkerCodeCacheStrategyTestBase::kWorkerUrl[] =
-    "/service_worker/code_cache_strategy_worker.js";
-const char ServiceWorkerCodeCacheStrategyTestBase::kCachedInInstallEventUrl[] =
-    "/service_worker/"
-    "code_cache_strategy_test_script.js?cached_in_install_event";
-const char ServiceWorkerCodeCacheStrategyTestBase::
-    kCachedInInstallEventWithMimeTypeParamUrl[] =
-        "/service_worker/"
-        "code_cache_strategy_test_script.js?cached_in_install_event_with_mime_"
-        "type_param";
-const char ServiceWorkerCodeCacheStrategyTestBase::kCachedInFetchEventUrl[] =
-    "/service_worker/code_cache_strategy_test_script.js?cached_in_fetch_event";
-const char ServiceWorkerCodeCacheStrategyTestBase::kCachedInMessageEventUrl[] =
-    "/service_worker/"
-    "code_cache_strategy_test_script.js?cached_in_message_event";
-
-class ServiceWorkerCodeCacheStrategyDontGenerateTest
-    : public ServiceWorkerCodeCacheStrategyTestBase {
- public:
-  void SetUp() override {
-    feature_list_.InitAndEnableFeatureWithParameters(
-        blink::features::kServiceWorkerAggressiveCodeCache,
-        {{blink::kServiceWorkerEagerCodeCacheStrategy, "dontgenerate"}});
-    ServiceWorkerCodeCacheStrategyTestBase::SetUp();
-  }
-};
-
-IN_PROC_BROWSER_TEST_F(ServiceWorkerCodeCacheStrategyDontGenerateTest,
-                       DontGenerate) {
-  NavigateToTestPage();
-  InitiateEventsToCacheScript();
-  EXPECT_FALSE(HasSideData(kCachedInInstallEventUrl));
-  EXPECT_FALSE(HasSideData(kCachedInInstallEventWithMimeTypeParamUrl));
-  EXPECT_FALSE(HasSideData(kCachedInFetchEventUrl));
-  EXPECT_FALSE(HasSideData(kCachedInMessageEventUrl));
-}
-
-class ServiceWorkerCodeCacheStrategyInstallEventTest
-    : public ServiceWorkerCodeCacheStrategyTestBase {
- public:
-  void SetUp() override {
-    feature_list_.InitAndEnableFeatureWithParameters(
-        blink::features::kServiceWorkerAggressiveCodeCache,
-        {{blink::kServiceWorkerEagerCodeCacheStrategy, "installevent"}});
-    ServiceWorkerCodeCacheStrategyTestBase::SetUp();
-  }
-};
-
-IN_PROC_BROWSER_TEST_F(ServiceWorkerCodeCacheStrategyInstallEventTest,
-                       GenerateInInstallEvent) {
-  NavigateToTestPage();
-  InitiateEventsToCacheScript();
-  EXPECT_TRUE(HasSideData(kCachedInInstallEventUrl));
-  EXPECT_TRUE(HasSideData(kCachedInInstallEventWithMimeTypeParamUrl));
-  EXPECT_FALSE(HasSideData(kCachedInFetchEventUrl));
-  EXPECT_FALSE(HasSideData(kCachedInMessageEventUrl));
-}
-
-class ServiceWorkerCodeCacheStrategyIdleTaskTest
-    : public ServiceWorkerCodeCacheStrategyTestBase {
- public:
-  void SetUp() override {
-    feature_list_.InitAndEnableFeatureWithParameters(
-        blink::features::kServiceWorkerAggressiveCodeCache,
-        {{blink::kServiceWorkerEagerCodeCacheStrategy, "idletask"}});
-    ServiceWorkerCodeCacheStrategyTestBase::SetUp();
-  }
-};
-
-IN_PROC_BROWSER_TEST_F(ServiceWorkerCodeCacheStrategyIdleTaskTest,
-                       GenerateInIdleTask) {
-  NavigateToTestPage();
-  InitiateEventsToCacheScript();
-  EXPECT_TRUE(HasSideData(kCachedInInstallEventUrl));
-  EXPECT_TRUE(HasSideData(kCachedInInstallEventWithMimeTypeParamUrl));
-  // These should not time out.
-  WaitForSideData(kCachedInFetchEventUrl);
-  WaitForSideData(kCachedInMessageEventUrl);
-}
-
-// Test that generating and storing code cache in idle tasks doesn't corrupt
-// cache entry when Cache#put() is called twice asynchronously.
-IN_PROC_BROWSER_TEST_F(ServiceWorkerCodeCacheStrategyIdleTaskTest,
-                       CacheScriptTwice) {
-  const char kCachedTwiceUrl[] =
-      "/service_worker/code_cache_strategy_test_script.js?cached_twice";
-
-  NavigateToTestPage();
-
-  // Ask the service worker to call Cache#put() twice asynchronously.
-  // The first response is a dummy script that contains no function.
-  // The second response is an actual script that contains |test_function()|.
-  EXPECT_EQ("DONE", EvalJs(shell(), "post_message('cache_script_twice');"));
-
-  WaitForSideData(kCachedTwiceUrl);
-
-  // Ask the page to load the test script and execute |test_function()|, which
-  // will return "SUCCESS".
-  EXPECT_EQ("SUCCESS", EvalJs(shell(), "execute_cached_twice_script();"));
-}
-
 // ServiceWorkerDisableWebSecurityTests check the behavior when the web security
 // is disabled. If '--disable-web-security' flag is set, we don't check the
 // origin equality in Blink. So the Service Worker related APIs should succeed
@@ -3912,7 +3712,7 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerURLLoaderThrottleTest,
   // Ensure the service worker did not see a fetch event for the PlzRedirect
   // URL, since throttles should have redirected before interception.
   base::Value list(base::Value::Type::LIST);
-  list.GetList().emplace_back(redirect_url.spec());
+  list.Append(redirect_url.spec());
   EXPECT_EQ(list, EvalJs(shell()->web_contents()->GetMainFrame(), script));
 
   SetBrowserClientForTesting(old_content_browser_client);
@@ -3980,4 +3780,118 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerURLLoaderThrottleTest,
   SetBrowserClientForTesting(old_content_browser_client);
 }
 
+class CacheStorageEagerReadingTestBase
+    : public ServiceWorkerVersionBrowserTest {
+ public:
+  explicit CacheStorageEagerReadingTestBase(bool enabled) {
+    if (enabled)
+      feature_list.InitAndEnableFeature(features::kCacheStorageEagerReading);
+    else
+      feature_list.InitAndDisableFeature(features::kCacheStorageEagerReading);
+  }
+
+  void SetupServiceWorkerAndDoFetch(
+      std::string fetch_url,
+      blink::mojom::FetchAPIResponsePtr* response_out) {
+    StartServerAndNavigateToSetup();
+    InstallTestHelper("/service_worker/cached_fetch_event.js",
+                      blink::ServiceWorkerStatusCode::kOk);
+    ActivateTestHelper(blink::ServiceWorkerStatusCode::kOk);
+
+    ServiceWorkerFetchDispatcher::FetchEventResult result;
+    FetchOnRegisteredWorker(fetch_url, &result, response_out);
+  }
+
+  void ExpectNormalCacheResponse(blink::mojom::FetchAPIResponsePtr response) {
+    EXPECT_EQ(network::mojom::FetchResponseSource::kCacheStorage,
+              response->response_source);
+
+    // A normal cache_storage response should have a blob for the body.
+    mojo::Remote<blink::mojom::Blob> blob(std::move(response->blob->blob));
+
+    // The blob should contain the expected body content.
+    EXPECT_EQ(BlobToString(blob.get()).length(), 1075u);
+
+    // Since this js response was stored in the install event it should have
+    // code cache stored in the blob side data.
+    EXPECT_GT(BlobSideDataLength(blob.get()),
+              static_cast<size_t>(kV8CacheTimeStampDataSize));
+  }
+
+  void ExpectEagerlyReadCacheResponse(
+      blink::mojom::FetchAPIResponsePtr response) {
+    EXPECT_EQ(network::mojom::FetchResponseSource::kCacheStorage,
+              response->response_source);
+
+    // An eagerly read cache_storage response should not have a blob.  Instead
+    // the body is provided out-of-band in a mojo DataPipe.  The pipe is not
+    // surfaced here in this test.
+    EXPECT_FALSE(response->blob);
+
+    // An eagerly read response should still have a side_data_blob, though.
+    // This is provided so that js resources can still load code cache.
+    mojo::Remote<blink::mojom::Blob> side_data_blob(
+        std::move(response->side_data_blob->blob));
+
+    // Since this js response was stored in the install event it should have
+    // code cache stored in the blob side data.
+    EXPECT_GT(BlobSideDataLength(side_data_blob.get()),
+              static_cast<size_t>(kV8CacheTimeStampDataSize));
+  }
+
+  // The service worker script always matches against this URL.
+  static constexpr const char* kCacheMatchURL =
+      "/service_worker/v8_cache_test.js";
+
+  // A URL that will be different from the cache.match() executed in
+  // the service worker fetch handler.
+  static constexpr const char* kOtherURL =
+      "/service_worker/non-matching-url.js";
+
+ private:
+  base::test::ScopedFeatureList feature_list;
+};
+
+class CacheStorageEagerReadingEnabledTest
+    : public CacheStorageEagerReadingTestBase {
+ public:
+  CacheStorageEagerReadingEnabledTest()
+      : CacheStorageEagerReadingTestBase(true) {}
+};
+
+class CacheStorageEagerReadingDisabledTest
+    : public CacheStorageEagerReadingTestBase {
+ public:
+  CacheStorageEagerReadingDisabledTest()
+      : CacheStorageEagerReadingTestBase(false) {}
+};
+
+IN_PROC_BROWSER_TEST_F(CacheStorageEagerReadingDisabledTest,
+                       CacheMatchInRelatedFetchEvent) {
+  blink::mojom::FetchAPIResponsePtr response;
+  SetupServiceWorkerAndDoFetch(kCacheMatchURL, &response);
+  ExpectNormalCacheResponse(std::move(response));
+}
+
+IN_PROC_BROWSER_TEST_F(CacheStorageEagerReadingDisabledTest,
+                       CacheMatchInUnrelatedFetchEvent) {
+  blink::mojom::FetchAPIResponsePtr response;
+  SetupServiceWorkerAndDoFetch(kOtherURL, &response);
+  ExpectNormalCacheResponse(std::move(response));
+}
+
+IN_PROC_BROWSER_TEST_F(CacheStorageEagerReadingEnabledTest,
+                       CacheMatchInRelatedFetchEvent) {
+  blink::mojom::FetchAPIResponsePtr response;
+  SetupServiceWorkerAndDoFetch(kCacheMatchURL, &response);
+  ExpectEagerlyReadCacheResponse(std::move(response));
+}
+
+IN_PROC_BROWSER_TEST_F(CacheStorageEagerReadingEnabledTest,
+                       CacheMatchInUnrelatedFetchEvent) {
+  blink::mojom::FetchAPIResponsePtr response;
+  SetupServiceWorkerAndDoFetch(kOtherURL, &response);
+  ExpectNormalCacheResponse(std::move(response));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_client_utils.cc b/chromium/content/browser/service_worker/service_worker_client_utils.cc
index 7cf6ff5b75b..a9be97cf69f 100644
--- a/chromium/content/browser/service_worker/service_worker_client_utils.cc
+++ b/chromium/content/browser/service_worker/service_worker_client_utils.cc
@@ -36,6 +36,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/child_process_host.h"
+#include "content/public/common/content_client.h"
 #include "third_party/blink/public/mojom/loader/request_context_frame_type.mojom.h"
 #include "ui/base/window_open_disposition.h"
 #include "url/gurl.h"
@@ -248,15 +249,10 @@ void OpenWindowOnUI(
   // function can't be used directly since there is no render frame host yet
   // that the navigation will occur in.
 
-  GURL dest_url(url);
-  if (!GetContentClient()->browser()->ShouldAllowOpenURL(site_instance, url))
-    dest_url = GURL(url::kAboutBlankURL);
-
   OpenURLParams params(
-      dest_url,
+      url,
       Referrer::SanitizeForRequest(
-          dest_url,
-          Referrer(script_url, network::mojom::ReferrerPolicy::kDefault)),
+          url, Referrer(script_url, network::mojom::ReferrerPolicy::kDefault)),
       type == WindowType::PAYMENT_HANDLER_WINDOW
           ? WindowOpenDisposition::NEW_POPUP
           : WindowOpenDisposition::NEW_FOREGROUND_TAB,
@@ -264,10 +260,6 @@ void OpenWindowOnUI(
   params.open_app_window_if_possible = type == WindowType::NEW_TAB_WINDOW;
   params.initiator_origin = url::Origin::Create(script_url.GetOrigin());
 
-  GetContentClient()->browser()->OverrideNavigationParams(
-      site_instance, &params.transition, &params.is_renderer_initiated,
-      &params.referrer, &params.initiator_origin);
-
   // End of RequestOpenURL copy.
 
   GetContentClient()->browser()->OpenURL(
@@ -317,8 +309,7 @@ void NavigateClientOnUI(const GURL& url,
           url, Referrer(script_url, network::mojom::ReferrerPolicy::kDefault)),
       WindowOpenDisposition::CURRENT_TAB,
       false /* should_replace_current_entry */, false /* user_gesture */,
-      blink::WebTriggeringEventInfo::kUnknown,
-      std::string() /* href_translate */,
+      blink::TriggeringEventInfo::kUnknown, std::string() /* href_translate */,
       nullptr /* blob_url_loader_factory */);
   new OpenURLObserver(web_contents, frame_tree_node_id, std::move(callback));
 }
@@ -367,7 +358,6 @@ void OnGetWindowClientsOnUI(
     const std::vector<std::tuple<int, int, base::TimeTicks, std::string>>&
         clients_info,
     const GURL& script_url,
-    blink::mojom::ServiceWorkerClientLifecycleStateQuery lifecycle_state,
     ClientsCallback callback,
     std::unique_ptr<ServiceWorkerClientPtrs> out_clients) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -390,19 +380,6 @@ void OnGetWindowClientsOnUI(
     if (info->url.GetOrigin() != script_url.GetOrigin())
       continue;
 
-    // Skip frozen clients if asked to be excluded.
-    if (lifecycle_state !=
-            blink::mojom::ServiceWorkerClientLifecycleStateQuery::kAll &&
-        ((lifecycle_state ==
-              blink::mojom::ServiceWorkerClientLifecycleStateQuery::kActive &&
-          info->lifecycle_state !=
-              blink::mojom::ServiceWorkerClientLifecycleState::kActive) ||
-         (lifecycle_state ==
-              blink::mojom::ServiceWorkerClientLifecycleStateQuery::kFrozen &&
-          info->lifecycle_state !=
-              blink::mojom::ServiceWorkerClientLifecycleState::kFrozen)))
-      continue;
-
     out_clients->push_back(std::move(info));
   }
 
@@ -506,12 +483,10 @@ void GetWindowClients(const base::WeakPtr<ServiceWorkerVersion>& controller,
     return;
   }
 
-  blink::mojom::ServiceWorkerClientLifecycleStateQuery lifecycle_state =
-      options->lifecycle_state;
   RunOrPostTaskOnThread(
       FROM_HERE, BrowserThread::UI,
       base::BindOnce(&OnGetWindowClientsOnUI, clients_info,
-                     controller->script_url(), lifecycle_state,
+                     controller->script_url(),
                      base::BindOnce(&DidGetWindowClients, controller,
                                     std::move(options), std::move(callback)),
                      std::move(clients)));
diff --git a/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc b/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc
index 154d511e49f..6d1f0de5650 100644
--- a/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc
+++ b/chromium/content/browser/service_worker/service_worker_clients_api_browsertest.cc
@@ -9,6 +9,7 @@
 #include "base/callback.h"
 #include "base/callback_forward.h"
 #include "base/logging.h"
+#include "base/macros.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/optional.h"
 #include "base/strings/string16.h"
@@ -29,6 +30,8 @@
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/service_worker_test_helpers.h"
+#include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/shell/browser/shell_content_browser_client.h"
@@ -39,80 +42,6 @@
 
 namespace content {
 
-namespace {
-// Waits for a service worker to be activated.
-class ActivatedServiceWorkerObserver : public ServiceWorkerContextObserver {
- public:
-  ActivatedServiceWorkerObserver() : ServiceWorkerContextObserver() {}
-  ~ActivatedServiceWorkerObserver() override {}
-
-  void OnVersionActivated(int64_t version_id, const GURL& scope) override {
-    version_id_ = version_id;
-    if (activated_callback_)
-      std::move(activated_callback_).Run();
-  }
-
-  void WaitForActivated() {
-    if (version_id_ != -1)
-      return;
-    base::RunLoop loop;
-    activated_callback_ = loop.QuitClosure();
-    loop.Run();
-  }
-
-  int64_t version_id() const { return version_id_; }
-
- private:
-  base::OnceClosure activated_callback_;
-  int64_t version_id_ = -1;
-
-  DISALLOW_COPY_AND_ASSIGN(ActivatedServiceWorkerObserver);
-};
-
-// Mainly for testing that ShouldAllowOpenURL() is properly consulted.
-class ServiceWorkerClientsContentBrowserClient
-    : public TestContentBrowserClient {
- public:
-  ServiceWorkerClientsContentBrowserClient() : TestContentBrowserClient() {}
-  ~ServiceWorkerClientsContentBrowserClient() override {}
-
-  const GURL& opened_url() const { return opened_url_; }
-
-  void SetToAllowOpenURL(bool allow) { allow_open_url_ = allow; }
-
-  void WaitForOpenURL() {
-    if (!opened_url_.is_empty())
-      return;
-    base::RunLoop run_loop;
-    opened_url_callback_ = run_loop.QuitClosure();
-    run_loop.Run();
-  }
-
-  // ContentBrowserClient overrides:
-  bool ShouldAllowOpenURL(SiteInstance* site_instance,
-                          const GURL& url) override {
-    return allow_open_url_;
-  }
-
-  void OpenURL(SiteInstance* site_instance,
-               const OpenURLParams& params,
-               base::OnceCallback<void(WebContents*)> callback) override {
-    opened_url_ = params.url;
-    std::move(callback).Run(nullptr);
-    if (opened_url_callback_)
-      std::move(opened_url_callback_).Run();
-  }
-
- private:
-  bool allow_open_url_ = true;
-  GURL opened_url_;
-  base::OnceClosure opened_url_callback_;
-
-  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerClientsContentBrowserClient);
-};
-
-}  // namespace
-
 // Tests for the service worker Clients API.
 class ServiceWorkerClientsApiBrowserTest : public ContentBrowserTest {
  public:
@@ -124,9 +53,6 @@ class ServiceWorkerClientsApiBrowserTest : public ContentBrowserTest {
   }
 
   void SetUpOnMainThread() override {
-    old_content_browser_client_ =
-        SetBrowserClientForTesting(&content_browser_client_);
-
     embedded_test_server()->StartAcceptingConnections();
 
     StoragePartition* partition = BrowserContext::GetDefaultStoragePartition(
@@ -135,62 +61,12 @@ class ServiceWorkerClientsApiBrowserTest : public ContentBrowserTest {
         partition->GetServiceWorkerContext());
   }
 
-  void TearDownOnMainThread() override {
-    SetBrowserClientForTesting(old_content_browser_client_);
-  }
-
-  void DispatchNotificationClickEvent(int64_t version_id) {
-    base::RunLoop run_loop;
-    RunOrPostTaskOnThread(
-        FROM_HERE, ServiceWorkerContext::GetCoreThreadId(),
-        base::BindOnce(&ServiceWorkerClientsApiBrowserTest::
-                           DispatchNotificationClickEventOnCoreThread,
-                       base::Unretained(this), version_id,
-                       run_loop.QuitClosure()));
-    run_loop.Run();
-  }
-
-  void DispatchNotificationClickEventOnCoreThread(int64_t version_id,
-                                                  base::OnceClosure done) {
-    ServiceWorkerVersion* version =
-        wrapper_->context()->GetLiveVersion(version_id);
-    ASSERT_TRUE(version);
-    version->RunAfterStartWorker(
-        ServiceWorkerMetrics::EventType::NOTIFICATION_CLICK,
-        base::BindOnce(&ServiceWorkerClientsApiBrowserTest::
-                           DispatchNotificationClickAfterStartWorker,
-                       base::Unretained(this), base::WrapRefCounted(version),
-                       std::move(done)));
-  }
-
-  void DispatchNotificationClickAfterStartWorker(
-      scoped_refptr<ServiceWorkerVersion> version,
-      base::OnceClosure done,
-      blink::ServiceWorkerStatusCode status) {
-    EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status);
-    version->StartRequest(ServiceWorkerMetrics::EventType::NOTIFICATION_CLICK,
-                          base::DoNothing());
-    version->endpoint()->DispatchNotificationClickEvent(
-        "notification_id", {} /* notification_data */, -1 /* action_index */,
-        base::nullopt /* reply */,
-        base::BindOnce(
-            [](base::OnceClosure done,
-               blink::mojom::ServiceWorkerEventStatus event_status) {
-              EXPECT_EQ(blink::mojom::ServiceWorkerEventStatus::COMPLETED,
-                        event_status);
-              std::move(done).Run();
-            },
-            std::move(done)));
-  }
-
   ServiceWorkerContextWrapper* wrapper() { return wrapper_.get(); }
 
- protected:
-  ServiceWorkerClientsContentBrowserClient content_browser_client_;
-
  private:
   scoped_refptr<ServiceWorkerContextWrapper> wrapper_;
-  ContentBrowserClient* old_content_browser_client_;
+
+  DISALLOW_COPY_AND_ASSIGN(ServiceWorkerClientsApiBrowserTest);
 };
 
 // Tests a successful WindowClient.navigate() call.
@@ -224,39 +100,6 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerClientsApiBrowserTest, Navigate) {
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
 }
 
-// Tests a WindowClient.navigate() call to a disallowed URL.
-IN_PROC_BROWSER_TEST_F(ServiceWorkerClientsApiBrowserTest,
-                       NavigateDisallowedUrl) {
-  content_browser_client_.SetToAllowOpenURL(false);
-
-  // Load a page that registers a service worker.
-  EXPECT_TRUE(NavigateToURL(shell(),
-                            embedded_test_server()->GetURL(
-                                "/service_worker/create_service_worker.html")));
-  EXPECT_EQ("DONE", EvalJs(shell(), "register('client_api_worker.js');"));
-
-  // Load the page again so we are controlled.
-  EXPECT_TRUE(NavigateToURL(shell(),
-                            embedded_test_server()->GetURL(
-                                "/service_worker/create_service_worker.html")));
-  EXPECT_EQ(true, EvalJs(shell(), "!!navigator.serviceWorker.controller"));
-
-  // Have the service worker call client.navigate() on the page.
-  const std::string navigate_script = R"(
-    (async () => {
-      const registration = await navigator.serviceWorker.ready;
-      registration.active.postMessage({command: 'navigate', url: 'empty.html'});
-      return true;
-    })();
-  )";
-  EXPECT_EQ(true, EvalJs(shell(), navigate_script));
-
-  // The page should be navigated to about:blank instead of the requested URL.
-  const base::string16 title = base::ASCIIToUTF16("about:blank");
-  TitleWatcher title_watcher(shell()->web_contents(), title);
-  EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
-}
-
 // Tests a WindowClient.navigate() call during a browser-initiated navigation.
 // Regression test for https://crbug.com/930154.
 IN_PROC_BROWSER_TEST_F(ServiceWorkerClientsApiBrowserTest,
@@ -289,58 +132,34 @@ IN_PROC_BROWSER_TEST_F(ServiceWorkerClientsApiBrowserTest,
 
 // Tests a successful Clients.openWindow() call.
 IN_PROC_BROWSER_TEST_F(ServiceWorkerClientsApiBrowserTest, OpenWindow) {
-  ActivatedServiceWorkerObserver observer;
-  wrapper()->AddObserver(&observer);
-
   // Load a page that registers a service worker.
-  EXPECT_TRUE(NavigateToURL(shell(),
-                            embedded_test_server()->GetURL(
-                                "/service_worker/create_service_worker.html")));
+  GURL page_url = embedded_test_server()->GetURL(
+      "/service_worker/create_service_worker.html");
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   EXPECT_EQ("DONE", EvalJs(shell(), "register('client_api_worker.js');"));
-  observer.WaitForActivated();
 
-  // Tell the service worker to call clients.openWindow(). Do it from a
-  // notification click event so it has a user interaction token that allows
+  // Tell the service worker to call clients.openWindow(target_url). Do it from
+  // a notification click event so it has a user interaction token that allows
   // popups.
-  int64_t id = observer.version_id();
-  EXPECT_NE(-1, id);
-  DispatchNotificationClickEvent(id);
-
-  // OpenURL() should be called.
-  content_browser_client_.WaitForOpenURL();
-  EXPECT_EQ(embedded_test_server()->GetURL("/service_worker/empty.html"),
-            content_browser_client_.opened_url());
-
-  wrapper()->RemoveObserver(&observer);
-}
-
-// Tests a Clients.openWindow() call to a disallowed URL.
-IN_PROC_BROWSER_TEST_F(ServiceWorkerClientsApiBrowserTest,
-                       OpenWindowDisallowedUrl) {
-  content_browser_client_.SetToAllowOpenURL(false);
-
-  ActivatedServiceWorkerObserver observer;
-  wrapper()->AddObserver(&observer);
-
-  // Load a page that registers a service worker.
-  EXPECT_TRUE(NavigateToURL(shell(),
-                            embedded_test_server()->GetURL(
-                                "/service_worker/create_service_worker.html")));
-  EXPECT_EQ("DONE", EvalJs(shell(), "register('client_api_worker.js');"));
-  observer.WaitForActivated();
-
-  // Tell the service worker to call clients.openWindow(). Do it from a
-  // notification click event so it has a user interaction token that allows
-  // popups.
-  int64_t id = observer.version_id();
-  EXPECT_NE(-1, id);
-  DispatchNotificationClickEvent(id);
-
-  // OpenURL() should be called with about:blank instead of the requested URL.
-  content_browser_client_.WaitForOpenURL();
-  EXPECT_EQ(GURL("about:blank"), content_browser_client_.opened_url());
+  content::WebContents* new_window = nullptr;
+  GURL target_url =
+      embedded_test_server()->GetURL("/service_worker/empty.html");
+  {
+    GURL scope_url = embedded_test_server()->GetURL("/service_worker/");
+    blink::PlatformNotificationData notification_data;
+    notification_data.body = base::UTF8ToUTF16(target_url.spec());
+
+    content::WebContentsAddedObserver new_window_observer;
+    content::DispatchServiceWorkerNotificationClick(wrapper(), scope_url,
+                                                    notification_data);
+    new_window = new_window_observer.GetWebContents();
+  }
 
-  wrapper()->RemoveObserver(&observer);
+  // Verify that the new window has navigated successfully.
+  content::TestNavigationObserver nav_observer(new_window, 1);
+  nav_observer.Wait();
+  EXPECT_TRUE(nav_observer.last_navigation_succeeded());
+  EXPECT_EQ(target_url, nav_observer.last_navigation_url());
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_context_core.cc b/chromium/content/browser/service_worker/service_worker_context_core.cc
index e87204fccb4..34c11cc6573 100644
--- a/chromium/content/browser/service_worker/service_worker_context_core.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_core.cc
@@ -52,7 +52,7 @@
 
 namespace content {
 namespace {
- 
+
 void CheckFetchHandlerOfInstalledServiceWorker(
     ServiceWorkerContext::CheckHasServiceWorkerCallback callback,
     scoped_refptr<ServiceWorkerRegistration> registration) {
@@ -258,6 +258,12 @@ ServiceWorkerContextCore::ServiceWorkerContextCore(
     : wrapper_(wrapper),
       providers_(std::make_unique<ProviderByIdMap>()),
       provider_by_uuid_(std::make_unique<ProviderByClientUUIDMap>()),
+      storage_(ServiceWorkerStorage::Create(user_data_directory,
+                                            this,
+                                            std::move(database_task_runner),
+                                            quota_manager_proxy,
+                                            special_storage_policy)),
+      job_coordinator_(std::make_unique<ServiceWorkerJobCoordinator>(this)),
       loader_factory_getter_(url_loader_factory_getter),
       force_update_on_page_load_(false),
       was_service_worker_registered_(false),
@@ -268,12 +274,6 @@ ServiceWorkerContextCore::ServiceWorkerContextCore(
         base::MakeRefCounted<blink::URLLoaderFactoryBundle>(
             std::move(non_network_loader_factory_bundle_info_for_update_check));
   }
-  // These get a WeakPtr from |weak_factory_|, so must be set after
-  // |weak_factory_| is initialized.
-  storage_ = ServiceWorkerStorage::Create(
-      user_data_directory, AsWeakPtr(), std::move(database_task_runner),
-      quota_manager_proxy, special_storage_policy);
-  job_coordinator_ = std::make_unique<ServiceWorkerJobCoordinator>(AsWeakPtr());
 }
 
 ServiceWorkerContextCore::ServiceWorkerContextCore(
@@ -282,26 +282,22 @@ ServiceWorkerContextCore::ServiceWorkerContextCore(
     : wrapper_(wrapper),
       providers_(old_context->providers_.release()),
       provider_by_uuid_(old_context->provider_by_uuid_.release()),
+      storage_(ServiceWorkerStorage::Create(this, old_context->storage())),
+      job_coordinator_(std::make_unique<ServiceWorkerJobCoordinator>(this)),
       loader_factory_getter_(old_context->loader_factory_getter()),
       loader_factory_bundle_for_update_check_(
           std::move(old_context->loader_factory_bundle_for_update_check_)),
       was_service_worker_registered_(
           old_context->was_service_worker_registered_),
       observer_list_(old_context->observer_list_),
-      next_embedded_worker_id_(old_context->next_embedded_worker_id_) {
-  DCHECK(observer_list_);
-
-  // These get a WeakPtr from |weak_factory_|, so must be set after
-  // |weak_factory_| is initialized.
-  storage_ = ServiceWorkerStorage::Create(AsWeakPtr(), old_context->storage());
-  job_coordinator_ = std::make_unique<ServiceWorkerJobCoordinator>(AsWeakPtr());
-}
+      next_embedded_worker_id_(old_context->next_embedded_worker_id_) {}
 
 ServiceWorkerContextCore::~ServiceWorkerContextCore() {
   DCHECK(storage_);
   for (const auto& it : live_versions_)
     it.second->RemoveObserver(this);
-  weak_factory_.InvalidateWeakPtrs();
+
+  job_coordinator_->ClearForShutdown();
 }
 
 void ServiceWorkerContextCore::AddProviderHost(
@@ -610,15 +606,18 @@ void ServiceWorkerContextCore::AddLiveVersion(ServiceWorkerVersion* version) {
 }
 
 void ServiceWorkerContextCore::RemoveLiveVersion(int64_t id) {
-  if (live_versions_[id]->running_status() != EmbeddedWorkerStatus::STOPPED) {
+  auto it = live_versions_.find(id);
+  DCHECK(it != live_versions_.end());
+  ServiceWorkerVersion* version = it->second;
+
+  if (version->running_status() != EmbeddedWorkerStatus::STOPPED) {
     // Notify all observers that this live version is stopped, as it will
     // be removed from |live_versions_|.
-    observer_list_->Notify(
-        FROM_HERE, &ServiceWorkerContextCoreObserver::OnRunningStateChanged, id,
-        EmbeddedWorkerStatus::STOPPED);
+    observer_list_->Notify(FROM_HERE,
+                           &ServiceWorkerContextCoreObserver::OnStopped, id);
   }
 
-  live_versions_.erase(id);
+  live_versions_.erase(it);
 }
 
 std::vector<ServiceWorkerRegistrationInfo>
@@ -665,6 +664,10 @@ void ServiceWorkerContextCore::ScheduleDeleteAndStartOver() const {
 
 void ServiceWorkerContextCore::DeleteAndStartOver(StatusCallback callback) {
   job_coordinator_->AbortAll();
+
+  observer_list_->Notify(
+      FROM_HERE, &ServiceWorkerContextCoreObserver::OnDeleteAndStartOver);
+
   storage_->DeleteAndStartOver(std::move(callback));
 }
 
@@ -747,9 +750,32 @@ void ServiceWorkerContextCore::OnStorageWiped() {
 
 void ServiceWorkerContextCore::OnRunningStateChanged(
     ServiceWorkerVersion* version) {
-  observer_list_->Notify(
-      FROM_HERE, &ServiceWorkerContextCoreObserver::OnRunningStateChanged,
-      version->version_id(), version->running_status());
+  if (!version->context())
+    return;
+
+  switch (version->running_status()) {
+    case EmbeddedWorkerStatus::STOPPED:
+      observer_list_->Notify(FROM_HERE,
+                             &ServiceWorkerContextCoreObserver::OnStopped,
+                             version->version_id());
+      break;
+    case EmbeddedWorkerStatus::STARTING:
+      observer_list_->Notify(FROM_HERE,
+                             &ServiceWorkerContextCoreObserver::OnStarting,
+                             version->version_id());
+      break;
+    case EmbeddedWorkerStatus::RUNNING:
+      observer_list_->Notify(
+          FROM_HERE, &ServiceWorkerContextCoreObserver::OnStarted,
+          version->version_id(), version->scope(),
+          version->embedded_worker()->process_id(), version->script_url());
+      break;
+    case EmbeddedWorkerStatus::STOPPING:
+      observer_list_->Notify(FROM_HERE,
+                             &ServiceWorkerContextCoreObserver::OnStopping,
+                             version->version_id());
+      break;
+  }
 }
 
 void ServiceWorkerContextCore::OnVersionStateChanged(
diff --git a/chromium/content/browser/service_worker/service_worker_context_core_observer.h b/chromium/content/browser/service_worker/service_worker_context_core_observer.h
index 12d194da576..e5e8bd9b081 100644
--- a/chromium/content/browser/service_worker/service_worker_context_core_observer.h
+++ b/chromium/content/browser/service_worker/service_worker_context_core_observer.h
@@ -46,8 +46,18 @@ class ServiceWorkerContextCoreObserver {
   virtual void OnNewLiveRegistration(int64_t registration_id,
                                      const GURL& scope) {}
   virtual void OnNewLiveVersion(const ServiceWorkerVersionInfo& version_info) {}
-  virtual void OnRunningStateChanged(int64_t version_id,
-                                     EmbeddedWorkerStatus running_status) {}
+  virtual void OnStarting(int64_t version_id) {}
+  virtual void OnStarted(int64_t version_id,
+                         const GURL& scope,
+                         int process_id,
+                         const GURL& script_url) {}
+  virtual void OnStopping(int64_t version_id) {}
+  virtual void OnStopped(int64_t version_id) {}
+  // Called when the context core is about to be deleted. After this is called,
+  // method calls on this observer will be for a new context core, possibly
+  // reusing version/registration IDs previously seen. So this method gives the
+  // observer a chance to discard any state it has.
+  virtual void OnDeleteAndStartOver() {}
   virtual void OnVersionStateChanged(int64_t version_id,
                                      const GURL& scope,
                                      ServiceWorkerVersion::Status status) {}
diff --git a/chromium/content/browser/service_worker/service_worker_context_unittest.cc b/chromium/content/browser/service_worker/service_worker_context_unittest.cc
index 091f793e94d..558ee5034e4 100644
--- a/chromium/content/browser/service_worker/service_worker_context_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_unittest.cc
@@ -10,6 +10,7 @@
 #include "base/files/scoped_temp_dir.h"
 #include "base/logging.h"
 #include "base/run_loop.h"
+#include "base/scoped_observer.h"
 #include "base/time/time.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
 #include "content/browser/service_worker/fake_embedded_worker_instance_client.h"
@@ -97,7 +98,7 @@ void ExpectRegisteredWorkers(
 
 class InstallActivateWorker : public FakeServiceWorker {
  public:
-  InstallActivateWorker(EmbeddedWorkerTestHelper* helper)
+  explicit InstallActivateWorker(EmbeddedWorkerTestHelper* helper)
       : FakeServiceWorker(helper) {}
   ~InstallActivateWorker() override = default;
 
@@ -248,7 +249,8 @@ class TestServiceWorkerContextObserver : public ServiceWorkerContextObserver {
     VersionActivated,
     VersionRedundant,
     NoControllees,
-    VersionRunningStatusChanged,
+    VersionStartedRunning,
+    VersionStoppedRunning,
     Destruct
   };
   struct EventLog {
@@ -257,18 +259,14 @@ class TestServiceWorkerContextObserver : public ServiceWorkerContextObserver {
     base::Optional<int64_t> version_id;
     base::Optional<int64_t> registration_id;
     base::Optional<bool> is_running;
-    base::Optional<ServiceWorkerContext*> context;
   };
 
   explicit TestServiceWorkerContextObserver(ServiceWorkerContext* context)
-      : context_(context) {
-    context_->AddObserver(this);
+      : scoped_observer_(this) {
+    scoped_observer_.Add(context);
   }
 
-  ~TestServiceWorkerContextObserver() override {
-    if (context_)
-      context_->RemoveObserver(this);
-  }
+  ~TestServiceWorkerContextObserver() override = default;
 
   void OnRegistrationCompleted(const GURL& scope) override {
     EventLog log;
@@ -310,28 +308,37 @@ class TestServiceWorkerContextObserver : public ServiceWorkerContextObserver {
     events_.push_back(log);
   }
 
-  void OnVersionRunningStatusChanged(content::ServiceWorkerContext* context,
-                                     int64_t version_id,
-                                     bool is_running) override {
+  void OnVersionStartedRunning(
+      content::ServiceWorkerContext* context,
+      int64_t version_id,
+      const ServiceWorkerRunningInfo& running_info) override {
     EventLog log;
-    log.type = EventType::VersionRunningStatusChanged;
+    log.type = EventType::VersionStartedRunning;
+    log.version_id = version_id;
+    events_.push_back(log);
+  }
+
+  void OnVersionStoppedRunning(content::ServiceWorkerContext* context,
+                               int64_t version_id) override {
+    EventLog log;
+    log.type = EventType::VersionStoppedRunning;
     log.version_id = version_id;
-    log.is_running = is_running;
     events_.push_back(log);
   }
 
   void OnDestruct(content::ServiceWorkerContext* context) override {
+    scoped_observer_.Remove(context);
+
     EventLog log;
     log.type = EventType::Destruct;
-    log.context = context;
     events_.push_back(log);
-    context_ = nullptr;
   }
 
   const std::vector<EventLog>& events() { return events_; }
 
  private:
-  ServiceWorkerContext* context_;
+  ScopedObserver<ServiceWorkerContext, ServiceWorkerContextObserver>
+      scoped_observer_;
   std::vector<EventLog> events_;
   DISALLOW_COPY_AND_ASSIGN(TestServiceWorkerContextObserver);
 };
@@ -470,7 +477,8 @@ TEST_F(ServiceWorkerContextTest, VersionRedundantObserver) {
   EXPECT_EQ(2l, observer.events()[0].version_id);
 }
 
-// Make sure OnVersionRunningStatusChanged is called on observer.
+// Make sure OnVersionStartedRunning and OnVersionStoppedRunning are called on
+// observer.
 TEST_F(ServiceWorkerContextTest, OnVersionRunningStatusChangedObserver) {
   GURL scope("https://www.example.com/");
   GURL script_url("https://www.example.com/service_worker.js");
@@ -492,13 +500,18 @@ TEST_F(ServiceWorkerContextTest, OnVersionRunningStatusChangedObserver) {
   // Filter the events to be verified.
   for (auto event : observer.events()) {
     if (event.type == TestServiceWorkerContextObserver::EventType::
-                          VersionRunningStatusChanged)
+                          VersionStartedRunning ||
+        event.type == TestServiceWorkerContextObserver::EventType::
+                          VersionStoppedRunning) {
       events.push_back(event);
+    }
   }
 
   ASSERT_EQ(2u, events.size());
-  EXPECT_EQ(true, events[0].is_running);
-  EXPECT_EQ(false, events[1].is_running);
+  EXPECT_EQ(TestServiceWorkerContextObserver::EventType::VersionStartedRunning,
+            events[0].type);
+  EXPECT_EQ(TestServiceWorkerContextObserver::EventType::VersionStoppedRunning,
+            events[1].type);
   EXPECT_EQ(events[0].version_id, events[1].version_id);
 }
 
@@ -512,7 +525,6 @@ TEST_F(ServiceWorkerContextTest, OnDestructObserver) {
   ASSERT_EQ(1u, observer.events().size());
   EXPECT_EQ(TestServiceWorkerContextObserver::EventType::Destruct,
             observer.events()[0].type);
-  EXPECT_EQ(context, observer.events()[0].context);
 }
 
 // Make sure basic registration is working.
@@ -944,21 +956,21 @@ TEST_F(ServiceWorkerContextTest, ProviderHostIterator) {
   base::WeakPtr<ServiceWorkerProviderHost> host1 = CreateProviderHostForWindow(
       kRenderProcessId1, true /* is_parent_frame_secure */,
       context()->AsWeakPtr(), &remote_endpoints.back());
-  host1->UpdateUrls(kOrigin1, kOrigin1);
+  host1->UpdateUrls(kOrigin1, kOrigin1, url::Origin::Create(kOrigin1));
 
   // Host2 : process_id=2, origin2.
   remote_endpoints.emplace_back();
   base::WeakPtr<ServiceWorkerProviderHost> host2 = CreateProviderHostForWindow(
       kRenderProcessId2, true /* is_parent_frame_secure */,
       context()->AsWeakPtr(), &remote_endpoints.back());
-  host2->UpdateUrls(kOrigin2, kOrigin2);
+  host2->UpdateUrls(kOrigin2, kOrigin2, url::Origin::Create(kOrigin2));
 
   // Host3 : process_id=2, origin1.
   remote_endpoints.emplace_back();
   base::WeakPtr<ServiceWorkerProviderHost> host3 = CreateProviderHostForWindow(
       kRenderProcessId2, true /* is_parent_frame_secure */,
       context()->AsWeakPtr(), &remote_endpoints.back());
-  host3->UpdateUrls(kOrigin1, kOrigin1);
+  host3->UpdateUrls(kOrigin1, kOrigin1, url::Origin::Create(kOrigin1));
 
   // Host4 : process_id=2, origin2, for ServiceWorker.
   blink::mojom::ServiceWorkerRegistrationOptions registration_opt;
diff --git a/chromium/content/browser/service_worker/service_worker_context_watcher.cc b/chromium/content/browser/service_worker/service_worker_context_watcher.cc
index d6e1e924524..1c4584260f1 100644
--- a/chromium/content/browser/service_worker/service_worker_context_watcher.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_watcher.cc
@@ -34,7 +34,7 @@ ServiceWorkerContextWatcher::ServiceWorkerContextWatcher(
     WorkerRegistrationUpdatedCallback registration_callback,
     WorkerVersionUpdatedCallback version_callback,
     WorkerErrorReportedCallback error_callback)
-    : context_(context),
+    : context_(std::move(context)),
       registration_callback_(std::move(registration_callback)),
       version_callback_(std::move(version_callback)),
       error_callback_(std::move(error_callback)) {
@@ -233,20 +233,23 @@ void ServiceWorkerContextWatcher::OnNewLiveVersion(
     version_info_map_[version_id] = std::move(version);
 }
 
-void ServiceWorkerContextWatcher::OnRunningStateChanged(
-    int64_t version_id,
-    content::EmbeddedWorkerStatus running_status) {
-  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
-  auto it = version_info_map_.find(version_id);
-  if (it == version_info_map_.end())
-    return;
-  ServiceWorkerVersionInfo* version = it->second.get();
-  if (version->running_status == running_status)
-    return;
-  version->running_status = running_status;
-  SendVersionInfo(*version);
-  if (IsStoppedAndRedundant(*version))
-    version_info_map_.erase(version_id);
+void ServiceWorkerContextWatcher::OnStarting(int64_t version_id) {
+  OnRunningStateChanged(version_id, EmbeddedWorkerStatus::STARTING);
+}
+
+void ServiceWorkerContextWatcher::OnStarted(int64_t version_id,
+                                            const GURL& scope,
+                                            int process_id,
+                                            const GURL& script_url) {
+  OnRunningStateChanged(version_id, EmbeddedWorkerStatus::RUNNING);
+}
+
+void ServiceWorkerContextWatcher::OnStopping(int64_t version_id) {
+  OnRunningStateChanged(version_id, EmbeddedWorkerStatus::STOPPING);
+}
+
+void ServiceWorkerContextWatcher::OnStopped(int64_t version_id) {
+  OnRunningStateChanged(version_id, EmbeddedWorkerStatus::STOPPED);
 }
 
 void ServiceWorkerContextWatcher::OnVersionStateChanged(
@@ -375,4 +378,20 @@ void ServiceWorkerContextWatcher::OnRegistrationDeleted(int64_t registration_id,
                        ServiceWorkerRegistrationInfo::IS_DELETED);
 }
 
+void ServiceWorkerContextWatcher::OnRunningStateChanged(
+    int64_t version_id,
+    EmbeddedWorkerStatus running_status) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  auto it = version_info_map_.find(version_id);
+  if (it == version_info_map_.end())
+    return;
+  ServiceWorkerVersionInfo* version = it->second.get();
+  if (version->running_status == running_status)
+    return;
+  version->running_status = running_status;
+  SendVersionInfo(*version);
+  if (IsStoppedAndRedundant(*version))
+    version_info_map_.erase(version_id);
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_context_watcher.h b/chromium/content/browser/service_worker/service_worker_context_watcher.h
index e921b80c5b2..bb05c084962 100644
--- a/chromium/content/browser/service_worker/service_worker_context_watcher.h
+++ b/chromium/content/browser/service_worker/service_worker_context_watcher.h
@@ -84,8 +84,13 @@ class CONTENT_EXPORT ServiceWorkerContextWatcher
   void OnNewLiveRegistration(int64_t registration_id,
                              const GURL& scope) override;
   void OnNewLiveVersion(const ServiceWorkerVersionInfo& version_info) override;
-  void OnRunningStateChanged(int64_t version_id,
-                             EmbeddedWorkerStatus running_status) override;
+  void OnStarting(int64_t version_id) override;
+  void OnStarted(int64_t version_id,
+                 const GURL& scope,
+                 int process_id,
+                 const GURL& script_url) override;
+  void OnStopping(int64_t version_id) override;
+  void OnStopped(int64_t version_id) override;
   void OnVersionStateChanged(int64_t version_id,
                              const GURL& scope,
                              ServiceWorkerVersion::Status status) override;
@@ -112,6 +117,9 @@ class CONTENT_EXPORT ServiceWorkerContextWatcher
   void OnRegistrationDeleted(int64_t registration_id,
                              const GURL& scope) override;
 
+  void OnRunningStateChanged(int64_t version_id,
+                             EmbeddedWorkerStatus running_status);
+
   std::unordered_map<int64_t, std::unique_ptr<ServiceWorkerVersionInfo>>
       version_info_map_;
   scoped_refptr<ServiceWorkerContextWrapper> context_;
diff --git a/chromium/content/browser/service_worker/service_worker_context_wrapper.cc b/chromium/content/browser/service_worker/service_worker_context_wrapper.cc
index 2cfe27673ac..eda2daddff4 100644
--- a/chromium/content/browser/service_worker/service_worker_context_wrapper.cc
+++ b/chromium/content/browser/service_worker/service_worker_context_wrapper.cc
@@ -15,10 +15,10 @@
 #include "base/bind_helpers.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/guid.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
+#include "base/run_loop.h"
 #include "base/single_thread_task_runner.h"
 #include "base/task/post_task.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -37,6 +37,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/service_worker_context_observer.h"
 #include "content/public/browser/storage_usage_info.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "net/base/url_util.h"
 #include "storage/browser/quota/quota_manager_proxy.h"
@@ -44,16 +45,11 @@
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
 #include "third_party/blink/public/common/service_worker/service_worker_utils.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
-#include "url/gurl.h"
 
 namespace content {
 
 namespace {
 
-// Value used to set the timeout when starting a long running ServiceWorker. See
-// ServiceWorkerContextWrapper::StartServiceWorkerAndDispatchLongRunningMessage.
-const int kActiveWorkerTimeoutDays = 999;
-
 void WorkerStarted(ServiceWorkerContextWrapper::StatusCallback callback,
                    blink::ServiceWorkerStatusCode status) {
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
@@ -348,12 +344,16 @@ BrowserThread::ID ServiceWorkerContext::GetCoreThreadId() {
 void ServiceWorkerContextWrapper::OnRegistrationCompleted(
     int64_t registration_id,
     const GURL& scope) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   for (auto& observer : observer_list_)
     observer.OnRegistrationCompleted(scope);
 }
 
 void ServiceWorkerContextWrapper::OnRegistrationStored(int64_t registration_id,
                                                        const GURL& scope) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   for (auto& observer : observer_list_)
     observer.OnRegistrationStored(registration_id, scope);
 }
@@ -361,56 +361,64 @@ void ServiceWorkerContextWrapper::OnRegistrationStored(int64_t registration_id,
 void ServiceWorkerContextWrapper::OnReportConsoleMessage(
     int64_t version_id,
     const ConsoleMessage& message) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   for (auto& observer : observer_list_)
     observer.OnReportConsoleMessage(version_id, message);
 }
 
 void ServiceWorkerContextWrapper::OnNoControllees(int64_t version_id,
                                                   const GURL& scope) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   for (auto& observer : observer_list_)
     observer.OnNoControllees(version_id, scope);
 }
 
-void ServiceWorkerContextWrapper::OnRunningStateChanged(
-    int64_t version_id,
-    EmbeddedWorkerStatus running_status) {
-  // When |running_status| is RUNNING/STOPPING, the service
-  // worker is doing some actual tasks, so we consider the service worker is
-  // in a running status.
-  //
-  // Although the service work does have some tasks being processed in the stage
-  // of STARTING, some resources of it may have not been allocated yet,
-  // e.g. process id. If STARTING is considered as running, then the observer of
-  // ServiceWorkerContextWrapper may get the unexpected information of this
-  // service worker after being notified due to the absence of the resoureces.
-  //
-  // TODO(minggang): Create a new observer to listen to the events when the
-  // process of the service worker is allocated/released, instead of using the
-  // running status of the embedded worker.
-  if (running_status == EmbeddedWorkerStatus::RUNNING) {
-    running_service_workers_.emplace(version_id);
-    for (auto& observer : observer_list_) {
-      observer.OnVersionRunningStatusChanged(this, version_id,
-                                             true /* is_running */);
-    }
-    return;
+void ServiceWorkerContextWrapper::OnStarted(int64_t version_id,
+                                            const GURL& scope,
+                                            int process_id,
+                                            const GURL& script_url) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  auto insertion_result = running_service_workers_.insert(std::make_pair(
+      version_id, ServiceWorkerRunningInfo(script_url, scope, process_id)));
+  DCHECK(insertion_result.second);
+
+  const auto& running_info = insertion_result.first->second;
+  for (auto& observer : observer_list_) {
+    observer.OnVersionStartedRunning(this, version_id, running_info);
   }
+}
 
-  if (running_service_workers_.find(version_id) !=
-          running_service_workers_.end() &&
-      running_status == EmbeddedWorkerStatus::STOPPED) {
-    running_service_workers_.erase(version_id);
-    for (auto& observer : observer_list_) {
-      observer.OnVersionRunningStatusChanged(this, version_id,
-                                             false /* is_running */);
-    }
+void ServiceWorkerContextWrapper::OnStopped(int64_t version_id) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  auto it = running_service_workers_.find(version_id);
+  if (it != running_service_workers_.end()) {
+    running_service_workers_.erase(it);
+    for (auto& observer : observer_list_)
+      observer.OnVersionStoppedRunning(this, version_id);
+  }
+}
+
+void ServiceWorkerContextWrapper::OnDeleteAndStartOver() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
+  for (const auto& kv : running_service_workers_) {
+    int64_t version_id = kv.first;
+    for (auto& observer : observer_list_)
+      observer.OnVersionStoppedRunning(this, version_id);
   }
+  running_service_workers_.clear();
 }
 
 void ServiceWorkerContextWrapper::OnVersionStateChanged(
     int64_t version_id,
     const GURL& scope,
     ServiceWorkerVersion::Status status) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   if (status == ServiceWorkerVersion::Status::ACTIVATED) {
     for (auto& observer : observer_list_)
       observer.OnVersionActivated(version_id, scope);
@@ -422,11 +430,15 @@ void ServiceWorkerContextWrapper::OnVersionStateChanged(
 
 void ServiceWorkerContextWrapper::AddObserver(
     ServiceWorkerContextObserver* observer) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   observer_list_.AddObserver(observer);
 }
 
 void ServiceWorkerContextWrapper::RemoveObserver(
     ServiceWorkerContextObserver* observer) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   observer_list_.RemoveObserver(observer);
 }
 
@@ -475,29 +487,31 @@ void ServiceWorkerContextWrapper::UnregisterServiceWorker(
       base::BindOnce(&FinishUnregistrationOnCoreThread, std::move(callback)));
 }
 
-bool ServiceWorkerContextWrapper::StartingExternalRequest(
+ServiceWorkerExternalRequestResult
+ServiceWorkerContextWrapper::StartingExternalRequest(
     int64_t service_worker_version_id,
     const std::string& request_uuid) {
   DCHECK_CURRENTLY_ON(GetCoreThreadId());
   if (!context())
-    return false;
+    return ServiceWorkerExternalRequestResult::kNullContext;
   ServiceWorkerVersion* version =
       context()->GetLiveVersion(service_worker_version_id);
   if (!version)
-    return false;
+    return ServiceWorkerExternalRequestResult::kWorkerNotFound;
   return version->StartExternalRequest(request_uuid);
 }
 
-bool ServiceWorkerContextWrapper::FinishedExternalRequest(
+ServiceWorkerExternalRequestResult
+ServiceWorkerContextWrapper::FinishedExternalRequest(
     int64_t service_worker_version_id,
     const std::string& request_uuid) {
   DCHECK_CURRENTLY_ON(GetCoreThreadId());
   if (!context())
-    return false;
+    return ServiceWorkerExternalRequestResult::kNullContext;
   ServiceWorkerVersion* version =
       context()->GetLiveVersion(service_worker_version_id);
   if (!version)
-    return false;
+    return ServiceWorkerExternalRequestResult::kWorkerNotFound;
   return version->FinishExternalRequest(request_uuid);
 }
 
@@ -678,49 +692,7 @@ void ServiceWorkerContextWrapper::
       base::BindOnce(
           &ServiceWorkerContextWrapper::DidFindRegistrationForMessageDispatch,
           this, std::move(message), scope, std::move(result_callback),
-          std::move(callback_runner), false /* is_long_running_message */),
-      core_thread_task_runner_);
-}
-
-void ServiceWorkerContextWrapper::
-    StartServiceWorkerAndDispatchLongRunningMessage(
-        const GURL& scope,
-        blink::TransferableMessage message,
-        ResultCallback result_callback) {
-  if (!base::FeatureList::IsEnabled(
-          features::kServiceWorkerLongRunningMessage)) {
-    std::move(result_callback).Run(false);
-    return;
-  }
-
-  RunOrPostTaskOnCoreThread(
-      FROM_HERE,
-      base::BindOnce(
-          &ServiceWorkerContextWrapper::
-              StartServiceWorkerAndDispatchLongRunningMessageOnCoreThread,
-          this, scope, std::move(message), std::move(result_callback),
-          base::ThreadTaskRunnerHandle::Get()));
-}
-
-void ServiceWorkerContextWrapper::
-    StartServiceWorkerAndDispatchLongRunningMessageOnCoreThread(
-        const GURL& scope,
-        blink::TransferableMessage message,
-        ResultCallback result_callback,
-        scoped_refptr<base::TaskRunner> task_runner) {
-  DCHECK_CURRENTLY_ON(GetCoreThreadId());
-  if (!context_core_) {
-    task_runner->PostTask(FROM_HERE,
-                          base::BindOnce(std::move(result_callback), false));
-    return;
-  }
-
-  FindRegistrationForScopeOnCoreThread(
-      net::SimplifyUrlForRequest(scope), false /* include_installing_version */,
-      base::BindOnce(
-          &ServiceWorkerContextWrapper::DidFindRegistrationForMessageDispatch,
-          this, std::move(message), scope, std::move(result_callback),
-          std::move(task_runner), true /* is_long_running_message */),
+          std::move(callback_runner)),
       core_thread_task_runner_);
 }
 
@@ -729,7 +701,6 @@ void ServiceWorkerContextWrapper::DidFindRegistrationForMessageDispatch(
     const GURL& source_origin,
     ResultCallback result_callback,
     scoped_refptr<base::TaskRunner> callback_runner,
-    bool is_long_running_message,
     blink::ServiceWorkerStatusCode service_worker_status,
     scoped_refptr<ServiceWorkerRegistration> registration) {
   DCHECK_CURRENTLY_ON(GetCoreThreadId());
@@ -741,14 +712,11 @@ void ServiceWorkerContextWrapper::DidFindRegistrationForMessageDispatch(
     return;
   }
   registration->active_version()->StartWorker(
-      is_long_running_message
-          ? ServiceWorkerMetrics::EventType::LONG_RUNNING_MESSAGE
-          : ServiceWorkerMetrics::EventType::MESSAGE,
+      ServiceWorkerMetrics::EventType::MESSAGE,
       base::BindOnce(
           &ServiceWorkerContextWrapper::DidStartServiceWorkerForMessageDispatch,
           this, std::move(message), source_origin, registration,
-          std::move(result_callback), std::move(callback_runner),
-          is_long_running_message));
+          std::move(result_callback), std::move(callback_runner)));
 }
 
 void ServiceWorkerContextWrapper::DidStartServiceWorkerForMessageDispatch(
@@ -757,7 +725,6 @@ void ServiceWorkerContextWrapper::DidStartServiceWorkerForMessageDispatch(
     scoped_refptr<ServiceWorkerRegistration> registration,
     ResultCallback result_callback,
     scoped_refptr<base::TaskRunner> callback_runner,
-    bool is_long_running_message,
     blink::ServiceWorkerStatusCode status) {
   DCHECK_CURRENTLY_ON(GetCoreThreadId());
   if (status != blink::ServiceWorkerStatusCode::kOk) {
@@ -777,24 +744,12 @@ void ServiceWorkerContextWrapper::DidStartServiceWorkerForMessageDispatch(
           ->GetOrCreateServiceWorkerObjectHost(version)
           ->CreateCompleteObjectInfoToSend();
 
-  if (is_long_running_message) {
-    int request_id = version->StartRequestWithCustomTimeout(
-        ServiceWorkerMetrics::EventType::LONG_RUNNING_MESSAGE,
-        base::BindOnce(&MessageFinishedSending, std::move(result_callback),
-                       std::move(callback_runner)),
-        base::TimeDelta::FromDays(kActiveWorkerTimeoutDays),
-        ServiceWorkerVersion::CONTINUE_ON_TIMEOUT);
-    version->endpoint()->DispatchExtendableMessageEventWithCustomTimeout(
-        std::move(event), base::TimeDelta::FromDays(kActiveWorkerTimeoutDays),
-        version->CreateSimpleEventCallback(request_id));
-  } else {
-    int request_id = version->StartRequest(
-        ServiceWorkerMetrics::EventType::MESSAGE,
-        base::BindOnce(&MessageFinishedSending, std::move(result_callback),
-                       std::move(callback_runner)));
-    version->endpoint()->DispatchExtendableMessageEvent(
-        std::move(event), version->CreateSimpleEventCallback(request_id));
-  }
+  int request_id = version->StartRequest(
+      ServiceWorkerMetrics::EventType::MESSAGE,
+      base::BindOnce(&MessageFinishedSending, std::move(result_callback),
+                     std::move(callback_runner)));
+  version->endpoint()->DispatchExtendableMessageEvent(
+      std::move(event), version->CreateSimpleEventCallback(request_id));
 }
 
 void ServiceWorkerContextWrapper::StartServiceWorkerForNavigationHint(
@@ -845,26 +800,9 @@ void ServiceWorkerContextWrapper::StopAllServiceWorkers(
           std::move(callback), base::ThreadTaskRunnerHandle::Get()));
 }
 
-void ServiceWorkerContextWrapper::GetAllServiceWorkerRunningInfos(
-    GetAllServiceWorkerRunningInfosCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  RunOrPostTaskOnCoreThread(
-      FROM_HERE, base::BindOnce(&ServiceWorkerContextWrapper::
-                                    GetAllServiceWorkerRunningInfosOnCoreThread,
-                                this, std::move(callback),
-                                base::ThreadTaskRunnerHandle::Get()));
-}
-
-void ServiceWorkerContextWrapper::GetServiceWorkerRunningInfo(
-    int64_t version_id,
-    GetServiceWorkerRunningInfoCallback callback) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  RunOrPostTaskOnCoreThread(
-      FROM_HERE,
-      base::BindOnce(
-          &ServiceWorkerContextWrapper::GetServiceWorkerRunningInfoOnCoreThread,
-          this, version_id, std::move(callback),
-          base::ThreadTaskRunnerHandle::Get()));
+const base::flat_map<int64_t, ServiceWorkerRunningInfo>&
+ServiceWorkerContextWrapper::GetRunningServiceWorkerInfos() {
+  return running_service_workers_;
 }
 
 ServiceWorkerRegistration* ServiceWorkerContextWrapper::GetLiveRegistration(
@@ -1499,6 +1437,8 @@ void ServiceWorkerContextWrapper::RemoveObserver(
 }
 
 ServiceWorkerContextWrapper::~ServiceWorkerContextWrapper() {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+
   for (auto& observer : observer_list_)
     observer.OnDestruct(static_cast<ServiceWorkerContext*>(this));
 
@@ -1842,59 +1782,6 @@ ServiceWorkerContextCore* ServiceWorkerContextWrapper::context() {
   return context_core_.get();
 }
 
-void ServiceWorkerContextWrapper::GetAllServiceWorkerRunningInfosOnCoreThread(
-    GetAllServiceWorkerRunningInfosCallback callback,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_callback) {
-  DCHECK_CURRENTLY_ON(GetCoreThreadId());
-  std::vector<ServiceWorkerVersionInfo> live_versions = GetAllLiveVersionInfo();
-  std::vector<ServiceWorkerRunningInfo> live_versions_running_info;
-  for (const auto& version_info : live_versions) {
-    if (IsRunningStatus(version_info.running_status)) {
-      live_versions_running_info.emplace_back(
-          ExtractServiceWorkerRunningInfoFromVersionInfo(version_info));
-    }
-  }
-
-  task_runner_for_callback->PostTask(
-      FROM_HERE, base::BindOnce(std::move(callback),
-                                static_cast<ServiceWorkerContext*>(this),
-                                std::move(live_versions_running_info)));
-}
-
-void ServiceWorkerContextWrapper::GetServiceWorkerRunningInfoOnCoreThread(
-    int64_t version_id,
-    GetServiceWorkerRunningInfoCallback callback,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_callback) {
-  DCHECK_CURRENTLY_ON(GetCoreThreadId());
-  ServiceWorkerVersion* version = GetLiveVersion(version_id);
-  if (version && IsRunningStatus(version->running_status())) {
-    ServiceWorkerVersionInfo info = version->GetInfo();
-    task_runner_for_callback->PostTask(
-        FROM_HERE,
-        base::BindOnce(std::move(callback),
-                       static_cast<ServiceWorkerContext*>(this),
-                       ExtractServiceWorkerRunningInfoFromVersionInfo(info)));
-  } else {
-    task_runner_for_callback->PostTask(
-        FROM_HERE, base::BindOnce(std::move(callback),
-                                  static_cast<ServiceWorkerContext*>(this),
-                                  ServiceWorkerRunningInfo()));
-  }
-}
-
-ServiceWorkerRunningInfo
-ServiceWorkerContextWrapper::ExtractServiceWorkerRunningInfoFromVersionInfo(
-    const ServiceWorkerVersionInfo& version_info) {
-  return ServiceWorkerRunningInfo(version_info.script_url,
-                                  version_info.version_id,
-                                  version_info.process_id);
-}
-
-bool ServiceWorkerContextWrapper::IsRunningStatus(EmbeddedWorkerStatus status) {
-  return status == EmbeddedWorkerStatus::RUNNING ||
-         status == EmbeddedWorkerStatus::STOPPING;
-}
-
 std::unique_ptr<blink::URLLoaderFactoryBundleInfo> ServiceWorkerContextWrapper::
     CreateNonNetworkURLLoaderFactoryBundleInfoForUpdateCheck(
         BrowserContext* browser_context) {
diff --git a/chromium/content/browser/service_worker/service_worker_context_wrapper.h b/chromium/content/browser/service_worker/service_worker_context_wrapper.h
index 87ad07ff63d..c254bb39285 100644
--- a/chromium/content/browser/service_worker/service_worker_context_wrapper.h
+++ b/chromium/content/browser/service_worker/service_worker_context_wrapper.h
@@ -12,6 +12,7 @@
 #include <utility>
 #include <vector>
 
+#include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -20,6 +21,7 @@
 #include "content/browser/service_worker/service_worker_context_core.h"
 #include "content/browser/service_worker/service_worker_context_core_observer.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/browser_thread.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/service_worker_context.h"
 #include "content/public/browser/service_worker_running_info.h"
@@ -55,7 +57,8 @@ class URLLoaderFactoryGetter;
 class CONTENT_EXPORT ServiceWorkerContextWrapper
     : public ServiceWorkerContext,
       public ServiceWorkerContextCoreObserver,
-      public base::RefCountedThreadSafe<ServiceWorkerContextWrapper> {
+      public base::RefCountedThreadSafe<ServiceWorkerContextWrapper,
+                                        BrowserThread::DeleteOnUIThread> {
  public:
   using StatusCallback =
       base::OnceCallback<void(blink::ServiceWorkerStatusCode)>;
@@ -121,8 +124,12 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
   void OnReportConsoleMessage(int64_t version_id,
                               const ConsoleMessage& message) override;
   void OnNoControllees(int64_t version_id, const GURL& scope) override;
-  void OnRunningStateChanged(int64_t version_id,
-                             EmbeddedWorkerStatus running_status) override;
+  void OnStarted(int64_t version_id,
+                 const GURL& scope,
+                 int process_id,
+                 const GURL& script_url) override;
+  void OnStopped(int64_t version_id) override;
+  void OnDeleteAndStartOver() override;
   void OnVersionStateChanged(int64_t version_id,
                              const GURL& scope,
                              ServiceWorkerVersion::Status status) override;
@@ -136,10 +143,12 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
       ResultCallback callback) override;
   void UnregisterServiceWorker(const GURL& scope,
                                ResultCallback callback) override;
-  bool StartingExternalRequest(int64_t service_worker_version_id,
-                               const std::string& request_uuid) override;
-  bool FinishedExternalRequest(int64_t service_worker_version_id,
-                               const std::string& request_uuid) override;
+  ServiceWorkerExternalRequestResult StartingExternalRequest(
+      int64_t service_worker_version_id,
+      const std::string& request_uuid) override;
+  ServiceWorkerExternalRequestResult FinishedExternalRequest(
+      int64_t service_worker_version_id,
+      const std::string& request_uuid) override;
   void CountExternalRequestsForTest(
       const GURL& url,
       CountExternalRequestsCallback callback) override;
@@ -156,20 +165,13 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
       const GURL& scope,
       blink::TransferableMessage message,
       ResultCallback result_callback) override;
-  void StartServiceWorkerAndDispatchLongRunningMessage(
-      const GURL& scope,
-      blink::TransferableMessage message,
-      ResultCallback result_callback) override;
   void StartServiceWorkerForNavigationHint(
       const GURL& document_url,
       StartServiceWorkerForNavigationHintCallback callback) override;
   void StopAllServiceWorkersForOrigin(const GURL& origin) override;
   void StopAllServiceWorkers(base::OnceClosure callback) override;
-  void GetAllServiceWorkerRunningInfos(
-      GetAllServiceWorkerRunningInfosCallback callback) override;
-  void GetServiceWorkerRunningInfo(
-      int64_t version_id,
-      GetServiceWorkerRunningInfoCallback callback) override;
+  const base::flat_map<int64_t, ServiceWorkerRunningInfo>&
+  GetRunningServiceWorkerInfos() override;
 
   // These methods must only be called from the core thread.
   ServiceWorkerRegistration* GetLiveRegistration(int64_t registration_id);
@@ -327,9 +329,9 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
 
  private:
   friend class BackgroundSyncManagerTest;
-  friend class base::RefCountedThreadSafe<ServiceWorkerContextWrapper>;
-  friend class EmbeddedWorkerTestHelper;
+  friend class base::DeleteHelper<ServiceWorkerContextWrapper>;
   friend class EmbeddedWorkerBrowserTest;
+  friend class EmbeddedWorkerTestHelper;
   friend class FakeServiceWorkerContextWrapper;
   friend class ServiceWorkerClientsApiBrowserTest;
   friend class ServiceWorkerInternalsUI;
@@ -337,6 +339,7 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
   friend class ServiceWorkerProcessManager;
   friend class ServiceWorkerRequestHandler;
   friend class ServiceWorkerVersionBrowserTest;
+  friend struct BrowserThread::DeleteOnThread<BrowserThread::UI>;
 
   ~ServiceWorkerContextWrapper() override;
 
@@ -410,7 +413,6 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
       const GURL& source_origin,
       ResultCallback result_callback,
       scoped_refptr<base::TaskRunner> callback_runner,
-      bool is_long_running_message,
       blink::ServiceWorkerStatusCode service_worker_status,
       scoped_refptr<ServiceWorkerRegistration> registration);
 
@@ -420,24 +422,8 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
       scoped_refptr<ServiceWorkerRegistration> registration,
       ServiceWorkerContext::ResultCallback result_callback,
       scoped_refptr<base::TaskRunner> callback_runner,
-      bool is_long_running_message,
       blink::ServiceWorkerStatusCode service_worker_status);
 
-  void SendActiveWorkerMessage(
-      blink::TransferableMessage message,
-      const GURL& source_origin,
-      ServiceWorkerContext::ResultCallback result_callback,
-      blink::ServiceWorkerStatusCode status,
-      scoped_refptr<ServiceWorkerRegistration> registration);
-
-
-  ServiceWorkerRunningInfo ExtractServiceWorkerRunningInfoFromVersionInfo(
-      const ServiceWorkerVersionInfo& version_info);
-
-  // RUNNING and STOPPING are considered "running". See the comments in
-  // OnRunningStateChange.
-  bool IsRunningStatus(EmbeddedWorkerStatus status);
-
   // Called when ServiceWorkerImportedScriptUpdateCheck is enabled.
   std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
   CreateNonNetworkURLLoaderFactoryBundleInfoForUpdateCheck(
@@ -476,11 +462,6 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
       blink::TransferableMessage message,
       ResultCallback result_callback,
       scoped_refptr<base::TaskRunner> callback_runner);
-  void StartServiceWorkerAndDispatchLongRunningMessageOnCoreThread(
-      const GURL& scope,
-      blink::TransferableMessage message,
-      ResultCallback result_callback,
-      scoped_refptr<base::TaskRunner> callback_runner);
   void FindReadyRegistrationForIdOnCoreThread(
       int64_t registration_id,
       const GURL& origin,
@@ -547,13 +528,6 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
   void StopAllServiceWorkersOnCoreThread(
       base::OnceClosure callback,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_callback);
-  void GetAllServiceWorkerRunningInfosOnCoreThread(
-      GetAllServiceWorkerRunningInfosCallback callback,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_callback);
-  void GetServiceWorkerRunningInfoOnCoreThread(
-      int64_t version_id,
-      GetServiceWorkerRunningInfoCallback callback,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner_for_callback);
 
   // Observers of |context_core_| which live within content's implementation
   // boundary. Shared with |context_core_|.
@@ -563,7 +537,8 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
 
   // Observers which live outside content's implementation boundary. Observer
   // methods will always be dispatched on the UI thread.
-  base::ObserverList<ServiceWorkerContextObserver>::Unchecked observer_list_;
+  base::ObserverList<ServiceWorkerContextObserver, true>::Unchecked
+      observer_list_;
 
   const std::unique_ptr<ServiceWorkerProcessManager> process_manager_;
   // Cleared in ShutdownOnCoreThread():
@@ -579,9 +554,10 @@ class CONTENT_EXPORT ServiceWorkerContextWrapper
   // context.
   ResourceContext* resource_context_ = nullptr;
 
-  // The set of workers that are considered "running". For dispatching
-  // OnVersionRunningStatusChanged events.
-  base::flat_set<int64_t /* version_id */> running_service_workers_;
+  // Map that contains all service workers that are considered "running". Used
+  // to dispatch OnVersionStartedRunning()/OnVersionStoppedRunning() events.
+  base::flat_map<int64_t /* version_id */, ServiceWorkerRunningInfo>
+      running_service_workers_;
 
   // Maps the origin to a set of registration ids for that origin. Must be
   // accessed on UI thread.
diff --git a/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc b/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc
index 4407c0d8281..b53df0570e5 100644
--- a/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc
+++ b/chromium/content/browser/service_worker/service_worker_controllee_request_handler.cc
@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/bind.h"
+#include "base/optional.h"
 #include "base/trace_event/trace_event.h"
 #include "components/offline_pages/buildflags/buildflags.h"
 #include "content/browser/loader/navigation_url_loader_impl.h"
@@ -72,10 +73,18 @@ ServiceWorkerControlleeRequestHandler::ServiceWorkerControlleeRequestHandler(
       skip_service_worker_(skip_service_worker),
       force_update_started_(false) {
   DCHECK(ServiceWorkerUtils::IsMainResourceType(resource_type));
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerControlleeRequestHandler::"
+                         "ServiceWorkerControlleeRequestHandler",
+                         TRACE_ID_LOCAL(this), TRACE_EVENT_FLAG_FLOW_OUT);
 }
 
 ServiceWorkerControlleeRequestHandler::
     ~ServiceWorkerControlleeRequestHandler() {
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerControlleeRequestHandler::"
+                         "~ServiceWorkerControlleeRequestHandler",
+                         TRACE_ID_LOCAL(this), TRACE_EVENT_FLAG_FLOW_IN);
   MaybeScheduleUpdate();
 }
 
@@ -138,9 +147,14 @@ void ServiceWorkerControlleeRequestHandler::MaybeCreateLoader(
   }
 #endif  // BUILDFLAG(ENABLE_OFFLINE_PAGES)
 
-  TRACE_EVENT_ASYNC_BEGIN1(
+  // TODO(bashi): Consider using a global navigation ID instead of using |this|.
+  // Using a global ID gives us a convenient way to analyze event flows across
+  // classes.
+  TRACE_EVENT_WITH_FLOW1(
       "ServiceWorker",
-      "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this, "URL",
+      "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader",
+      TRACE_ID_LOCAL(this),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "URL",
       tentative_resource_request.url.spec());
 
   loader_callback_ = std::move(callback);
@@ -213,8 +227,12 @@ bool ServiceWorkerControlleeRequestHandler::InitializeProvider(
   provider_host_->SetControllerRegistration(nullptr,
                                             /*notify_controllerchange=*/false);
   stripped_url_ = net::SimplifyUrlForRequest(tentative_resource_request.url);
-  provider_host_->UpdateUrls(stripped_url_,
-                             tentative_resource_request.site_for_cookies);
+  provider_host_->UpdateUrls(
+      stripped_url_, tentative_resource_request.site_for_cookies,
+      tentative_resource_request.trusted_params
+          ? tentative_resource_request.trusted_params->network_isolation_key
+                .GetTopFrameOrigin()
+          : base::nullopt);
   return true;
 }
 
@@ -225,30 +243,36 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
       status, base::TimeTicks::Now() - registration_lookup_start_time_);
 
   if (status != blink::ServiceWorkerStatusCode::kOk) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Status", blink::ServiceWorkerStatusToString(status));
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Status",
+        blink::ServiceWorkerStatusToString(status));
     CompleteWithoutLoader();
     return;
   }
   DCHECK(registration);
 
   if (!provider_host_) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "No Provider");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "No Provider");
     CompleteWithoutLoader();
     return;
   }
   provider_host_->AddMatchingRegistration(registration.get());
 
   if (!context_) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "No Context");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "No Context");
     CompleteWithoutLoader();
     return;
   }
@@ -257,20 +281,24 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     allow_service_worker =
         GetContentClient()->browser()->AllowServiceWorkerOnUI(
-            registration->scope(), provider_host_->site_for_cookies(), GURL(),
+            registration->scope(), provider_host_->site_for_cookies(),
+            provider_host_->top_frame_origin(), /*script_url=*/GURL(),
             browser_context_, provider_host_->web_contents_getter());
   } else {
     allow_service_worker =
         GetContentClient()->browser()->AllowServiceWorkerOnIO(
-            registration->scope(), provider_host_->site_for_cookies(), GURL(),
+            registration->scope(), provider_host_->site_for_cookies(),
+            provider_host_->top_frame_origin(), /*script_url=*/GURL(),
             resource_context_, provider_host_->web_contents_getter());
   }
 
   if (!allow_service_worker) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "ServiceWorker is blocked");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "ServiceWorker is blocked");
     CompleteWithoutLoader();
     return;
   }
@@ -278,10 +306,12 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
   if (!provider_host_->IsContextSecureForServiceWorker()) {
     // TODO(falken): Figure out a way to surface in the page's DevTools
     // console that the service worker was blocked for security.
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "Insecure context");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "Insecure context");
     CompleteWithoutLoader();
     return;
   }
@@ -296,6 +326,12 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
         base::BindOnce(
             &ServiceWorkerControlleeRequestHandler::DidUpdateRegistration,
             weak_factory_.GetWeakPtr(), registration));
+    TRACE_EVENT_WITH_FLOW1(
+        "ServiceWorker",
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "Need to update");
     return;
   }
 
@@ -308,10 +344,12 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
   scoped_refptr<ServiceWorkerVersion> active_version =
       registration->active_version();
   if (!active_version) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "No active version, so falling back to network");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "No active version, so falling back to network");
     CompleteWithoutLoader();
     return;
   }
@@ -324,13 +362,21 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithRegistration(
     registration->active_version()->RegisterStatusChangeCallback(base::BindOnce(
         &ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion,
         weak_factory_.GetWeakPtr(), registration, active_version));
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "Wait until finished SW activation");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "Wait until finished SW activation");
     return;
   }
 
+  TRACE_EVENT_WITH_FLOW0(
+      "ServiceWorker",
+      "ServiceWorkerControlleeRequestHandler::ContinueWithRegistration",
+      TRACE_ID_LOCAL(this),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+
   ContinueWithActivatedVersion(std::move(registration),
                                std::move(active_version));
 }
@@ -339,10 +385,11 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion(
     scoped_refptr<ServiceWorkerRegistration> registration,
     scoped_refptr<ServiceWorkerVersion> active_version) {
   if (!context_ || !provider_host_) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info",
+        "ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
         "The context or provider host is gone, so falling back to network");
     CompleteWithoutLoader();
     return;
@@ -367,10 +414,11 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion(
     //      retries.
     //   3) If the provider host does not have an active version, just fail the
     //      load.
-    TRACE_EVENT_ASYNC_END2(
+    TRACE_EVENT_WITH_FLOW2(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info",
+        "ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
         "The expected active version is not ACTIVATED, so falling back to "
         "network",
         "Status",
@@ -395,10 +443,12 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion(
 
   if (active_version->fetch_handler_existence() !=
       ServiceWorkerVersion::FetchHandlerExistence::EXISTS) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "Skipped the ServiceWorker which has no fetch handler");
+        "ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "Skipped the ServiceWorker which has no fetch handler");
     CompleteWithoutLoader();
     return;
   }
@@ -410,9 +460,11 @@ void ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion(
           std::move(fallback_callback_), provider_host_,
           base::WrapRefCounted(context_->loader_factory_getter())));
 
-  TRACE_EVENT_ASYNC_END1(
+  TRACE_EVENT_WITH_FLOW1(
       "ServiceWorker",
-      "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this, "Info",
+      "ServiceWorkerControlleeRequestHandler::ContinueWithActivatedVersion",
+      TRACE_ID_LOCAL(this),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
       "Forwarded to the ServiceWorker");
   std::move(loader_callback_)
       .Run(base::BindOnce(&ServiceWorkerNavigationLoader::StartRequest,
@@ -427,10 +479,12 @@ void ServiceWorkerControlleeRequestHandler::DidUpdateRegistration(
   DCHECK(force_update_started_);
 
   if (!context_) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "The context is gone in DidUpdateRegistration");
+        "ServiceWorkerControlleeRequestHandler::DidUpdateRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "The context is gone in DidUpdateRegistration");
     CompleteWithoutLoader();
     return;
   }
@@ -443,8 +497,21 @@ void ServiceWorkerControlleeRequestHandler::DidUpdateRegistration(
         base::BindOnce(
             &ServiceWorkerControlleeRequestHandler::ContinueWithRegistration,
             weak_factory_.GetWeakPtr()));
+    TRACE_EVENT_WITH_FLOW1(
+        "ServiceWorker",
+        "ServiceWorkerControlleeRequestHandler::DidUpdateRegistration",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "Update failed, look up the registration again");
     return;
   }
+
+  TRACE_EVENT_WITH_FLOW0(
+      "ServiceWorker",
+      "ServiceWorkerControlleeRequestHandler::DidUpdateRegistration",
+      TRACE_ID_LOCAL(this),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+
   DCHECK_EQ(original_registration->id(), registration_id);
   ServiceWorkerVersion* new_version =
       original_registration->installing_version();
@@ -460,13 +527,22 @@ void ServiceWorkerControlleeRequestHandler::OnUpdatedVersionStatusChanged(
     scoped_refptr<ServiceWorkerRegistration> registration,
     scoped_refptr<ServiceWorkerVersion> version) {
   if (!context_) {
-    TRACE_EVENT_ASYNC_END1(
+    TRACE_EVENT_WITH_FLOW1(
         "ServiceWorker",
-        "ServiceWorkerControlleeRequestHandler::MaybeCreateLoader", this,
-        "Info", "The context is gone in OnUpdatedVersionStatusChanged");
+        "ServiceWorkerControlleeRequestHandler::OnUpdatedVersionStatusChanged",
+        TRACE_ID_LOCAL(this),
+        TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "Info",
+        "The context is gone in OnUpdatedVersionStatusChanged");
     CompleteWithoutLoader();
     return;
   }
+
+  TRACE_EVENT_WITH_FLOW0(
+      "ServiceWorker",
+      "ServiceWorkerControlleeRequestHandler::OnUpdatedVersionStatusChanged",
+      TRACE_ID_LOCAL(this),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+
   if (version->status() == ServiceWorkerVersion::ACTIVATED ||
       version->status() == ServiceWorkerVersion::REDUNDANT) {
     // When the status is REDUNDANT, the update failed (eg: script error), we
diff --git a/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc b/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc
index b9bcfa60420..3e0f1c89c94 100644
--- a/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_controllee_request_handler_unittest.cc
@@ -23,6 +23,7 @@
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/browser/service_worker/service_worker_test_utils.h"
 #include "content/public/browser/resource_context.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/resource_type.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/test/test_content_browser_client.h"
@@ -154,7 +155,8 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
   ServiceWorkerTestContentBrowserClient() {}
   bool AllowServiceWorkerOnIO(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       content::ResourceContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter) override {
@@ -163,7 +165,8 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
 
   bool AllowServiceWorkerOnUI(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       content::BrowserContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter) override {
diff --git a/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.cc b/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.cc
index 5d47fb535d7..8b5df1cbbd9 100644
--- a/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.cc
+++ b/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.cc
@@ -457,31 +457,31 @@ ServiceWorkerFetchDispatcher::ServiceWorkerFetchDispatcher(
       version_(std::move(version)),
       resource_type_(resource_type),
       prepare_callback_(std::move(prepare_callback)),
-      fetch_callback_(std::move(fetch_callback)),
-      did_complete_(false) {
+      fetch_callback_(std::move(fetch_callback)) {
   DCHECK(!request_->blob);
-  TRACE_EVENT_NESTABLE_ASYNC_BEGIN1(
-      "ServiceWorker", "ServiceWorkerFetchDispatcher::DispatchFetchEvent", this,
-      "event_type", ServiceWorkerMetrics::EventTypeToString(GetEventType()));
+  TRACE_EVENT_WITH_FLOW1(
+      "ServiceWorker",
+      "ServiceWorkerFetchDispatcher::ServiceWorkerFetchDispatcher",
+      TRACE_ID_LOCAL(this), TRACE_EVENT_FLAG_FLOW_OUT, "event_type",
+      ServiceWorkerMetrics::EventTypeToString(GetEventType()));
 }
 
 ServiceWorkerFetchDispatcher::~ServiceWorkerFetchDispatcher() {
-  if (!did_complete_) {
-    TRACE_EVENT_NESTABLE_ASYNC_END0(
-        "ServiceWorker", "ServiceWorkerFetchDispatcher::DispatchFetchEvent",
-        this);
-  }
+  TRACE_EVENT_WITH_FLOW0(
+      "ServiceWorker",
+      "ServiceWorkerFetchDispatcher::~ServiceWorkerFetchDispatcher",
+      TRACE_ID_LOCAL(this), TRACE_EVENT_FLAG_FLOW_IN);
 }
 
 void ServiceWorkerFetchDispatcher::Run() {
   DCHECK(version_->status() == ServiceWorkerVersion::ACTIVATING ||
          version_->status() == ServiceWorkerVersion::ACTIVATED)
       << version_->status();
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker", "ServiceWorkerFetchDispatcher::Run",
+                         TRACE_ID_LOCAL(this),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 
   if (version_->status() == ServiceWorkerVersion::ACTIVATING) {
-    TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
-        "ServiceWorker", "ServiceWorkerFetchDispatcher::WaitForActivation",
-        this);
     version_->RegisterStatusChangeCallback(
         base::BindOnce(&ServiceWorkerFetchDispatcher::DidWaitForActivation,
                        weak_factory_.GetWeakPtr()));
@@ -491,12 +491,19 @@ void ServiceWorkerFetchDispatcher::Run() {
 }
 
 void ServiceWorkerFetchDispatcher::DidWaitForActivation() {
-  TRACE_EVENT_NESTABLE_ASYNC_END0(
-      "ServiceWorker", "ServiceWorkerFetchDispatcher::WaitForActivation", this);
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerFetchDispatcher::DidWaitForActivation",
+                         TRACE_ID_LOCAL(this),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
   StartWorker();
 }
 
 void ServiceWorkerFetchDispatcher::StartWorker() {
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerFetchDispatcher::StartWorker",
+                         TRACE_ID_LOCAL(this),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+
   // We might be REDUNDANT if a new worker started activating and kicked us out
   // before we could finish activation.
   if (version_->status() != ServiceWorkerVersion::ACTIVATED) {
@@ -510,8 +517,6 @@ void ServiceWorkerFetchDispatcher::StartWorker() {
     return;
   }
 
-  TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
-      "ServiceWorker", "ServiceWorkerFetchDispatcher::StartWorker", this);
   version_->RunAfterStartWorker(
       GetEventType(),
       base::BindOnce(&ServiceWorkerFetchDispatcher::DidStartWorker,
@@ -520,9 +525,11 @@ void ServiceWorkerFetchDispatcher::StartWorker() {
 
 void ServiceWorkerFetchDispatcher::DidStartWorker(
     blink::ServiceWorkerStatusCode status) {
-  TRACE_EVENT_NESTABLE_ASYNC_END1("ServiceWorker",
-                                  "ServiceWorkerFetchDispatcher::StartWorker",
-                                  this, "status", status);
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerFetchDispatcher::DidStartWorker",
+                         TRACE_ID_LOCAL(this),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
+
   if (status != blink::ServiceWorkerStatusCode::kOk) {
     DidFail(status);
     return;
@@ -533,6 +540,10 @@ void ServiceWorkerFetchDispatcher::DidStartWorker(
 void ServiceWorkerFetchDispatcher::DispatchFetchEvent() {
   DCHECK_EQ(EmbeddedWorkerStatus::RUNNING, version_->running_status())
       << "Worker stopped too soon after it was started.";
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerFetchDispatcher::DispatchFetchEvent",
+                         TRACE_ID_LOCAL(this),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 
   // Grant the service worker's process access to files in the request body.
   if (request_->body) {
@@ -543,8 +554,6 @@ void ServiceWorkerFetchDispatcher::DispatchFetchEvent() {
   // Run callback to say that the fetch event will be dispatched.
   DCHECK(prepare_callback_);
   std::move(prepare_callback_).Run();
-  TRACE_EVENT_NESTABLE_ASYNC_BEGIN0(
-      "ServiceWorker", "ServiceWorkerFetchDispatcher::FetchEvent", this);
 
   // Set up for receiving the response.
   mojo::PendingRemote<blink::mojom::ServiceWorkerFetchResponseCallback>
@@ -591,15 +600,16 @@ void ServiceWorkerFetchDispatcher::DispatchFetchEvent() {
 void ServiceWorkerFetchDispatcher::DidFailToDispatch(
     std::unique_ptr<ResponseCallback> response_callback,
     blink::ServiceWorkerStatusCode status) {
-  TRACE_EVENT_NESTABLE_ASYNC_END1("ServiceWorker",
-                                  "ServiceWorkerFetchDispatcher::FetchEvent",
-                                  this, "status", status);
   DidFail(status);
 }
 
 void ServiceWorkerFetchDispatcher::DidFail(
     blink::ServiceWorkerStatusCode status) {
   DCHECK_NE(blink::ServiceWorkerStatusCode::kOk, status);
+  TRACE_EVENT_WITH_FLOW1(
+      "ServiceWorker", "ServiceWorkerFetchDispatcher::DidFail",
+      TRACE_ID_LOCAL(this),
+      TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "status", status);
   Complete(status, FetchEventResult::kShouldFallback,
            blink::mojom::FetchAPIResponse::New(), nullptr /* body_as_stream */,
            nullptr /* timing */);
@@ -611,8 +621,10 @@ void ServiceWorkerFetchDispatcher::DidFinish(
     blink::mojom::FetchAPIResponsePtr response,
     blink::mojom::ServiceWorkerStreamHandlePtr body_as_stream,
     blink::mojom::ServiceWorkerFetchEventTimingPtr timing) {
-  TRACE_EVENT_NESTABLE_ASYNC_END0(
-      "ServiceWorker", "ServiceWorkerFetchDispatcher::FetchEvent", this);
+  TRACE_EVENT_WITH_FLOW0("ServiceWorker",
+                         "ServiceWorkerFetchDispatcher::DidFinish",
+                         TRACE_ID_LOCAL(this),
+                         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
   Complete(blink::ServiceWorkerStatusCode::kOk, fetch_result,
            std::move(response), std::move(body_as_stream), std::move(timing));
 }
@@ -625,10 +637,6 @@ void ServiceWorkerFetchDispatcher::Complete(
     blink::mojom::ServiceWorkerFetchEventTimingPtr timing) {
   DCHECK(fetch_callback_);
 
-  did_complete_ = true;
-  TRACE_EVENT_NESTABLE_ASYNC_END1(
-      "ServiceWorker", "ServiceWorkerFetchDispatcher::DispatchFetchEvent", this,
-      "result", fetch_result);
   std::move(fetch_callback_)
       .Run(status, fetch_result, std::move(response), std::move(body_as_stream),
            std::move(timing), version_);
diff --git a/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.h b/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.h
index 5cebdd77007..551d67bf22a 100644
--- a/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.h
+++ b/chromium/content/browser/service_worker/service_worker_fetch_dispatcher.h
@@ -114,7 +114,6 @@ class CONTENT_EXPORT ServiceWorkerFetchDispatcher {
   const ResourceType resource_type_;
   base::OnceClosure prepare_callback_;
   FetchCallback fetch_callback_;
-  bool did_complete_;
 
   scoped_refptr<URLLoaderAssets> url_loader_assets_;
 
diff --git a/chromium/content/browser/service_worker/service_worker_internals_ui.cc b/chromium/content/browser/service_worker/service_worker_internals_ui.cc
index e7fb99c606a..a08b10c591b 100644
--- a/chromium/content/browser/service_worker/service_worker_internals_ui.cc
+++ b/chromium/content/browser/service_worker/service_worker_internals_ui.cc
@@ -250,12 +250,28 @@ class ServiceWorkerInternalsUI::PartitionObserver
       : partition_id_(partition_id), web_ui_(web_ui) {}
   ~PartitionObserver() override {}
   // ServiceWorkerContextCoreObserver overrides:
-  void OnRunningStateChanged(int64_t version_id,
-                             EmbeddedWorkerStatus) override {
+  void OnStarting(int64_t version_id) override {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
     web_ui_->CallJavascriptFunctionUnsafe(
-        "serviceworker.onRunningStateChanged", Value(partition_id_),
-        Value(base::NumberToString(version_id)));
+        "serviceworker.onRunningStateChanged");
+  }
+  void OnStarted(int64_t version_id,
+                 const GURL& scope,
+                 int process_id,
+                 const GURL& script_url) override {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    web_ui_->CallJavascriptFunctionUnsafe(
+        "serviceworker.onRunningStateChanged");
+  }
+  void OnStopping(int64_t version_id) override {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    web_ui_->CallJavascriptFunctionUnsafe(
+        "serviceworker.onRunningStateChanged");
+  }
+  void OnStopped(int64_t version_id) override {
+    DCHECK_CURRENTLY_ON(BrowserThread::UI);
+    web_ui_->CallJavascriptFunctionUnsafe(
+        "serviceworker.onRunningStateChanged");
   }
   void OnVersionStateChanged(int64_t version_id,
                              const GURL& scope,
diff --git a/chromium/content/browser/service_worker/service_worker_job_coordinator.cc b/chromium/content/browser/service_worker/service_worker_job_coordinator.cc
index 8270b5a47ba..09bfb6ce07e 100644
--- a/chromium/content/browser/service_worker/service_worker_job_coordinator.cc
+++ b/chromium/content/browser/service_worker/service_worker_job_coordinator.cc
@@ -59,20 +59,18 @@ void ServiceWorkerJobCoordinator::JobQueue::AbortAll() {
 }
 
 void ServiceWorkerJobCoordinator::JobQueue::ClearForShutdown() {
+  for (const auto& job : jobs_)
+    job->WillShutDown();
   jobs_.clear();
 }
 
 ServiceWorkerJobCoordinator::ServiceWorkerJobCoordinator(
-    base::WeakPtr<ServiceWorkerContextCore> context)
+    ServiceWorkerContextCore* context)
     : context_(context) {
+  DCHECK(context_);
 }
 
 ServiceWorkerJobCoordinator::~ServiceWorkerJobCoordinator() {
-  if (!context_) {
-    for (auto& job_pair : job_queues_)
-      job_pair.second.ClearForShutdown();
-    job_queues_.clear();
-  }
   DCHECK(job_queues_.empty()) << "Destroying ServiceWorkerJobCoordinator with "
                               << job_queues_.size() << " job queues";
 }
@@ -139,6 +137,12 @@ void ServiceWorkerJobCoordinator::AbortAll() {
   job_queues_.clear();
 }
 
+void ServiceWorkerJobCoordinator::ClearForShutdown() {
+  for (auto& job_pair : job_queues_)
+    job_pair.second.ClearForShutdown();
+  job_queues_.clear();
+}
+
 void ServiceWorkerJobCoordinator::FinishJob(const GURL& scope,
                                             ServiceWorkerRegisterJobBase* job) {
   auto pending_jobs = job_queues_.find(scope);
diff --git a/chromium/content/browser/service_worker/service_worker_job_coordinator.h b/chromium/content/browser/service_worker/service_worker_job_coordinator.h
index 667c82ba83b..adde9af0dc9 100644
--- a/chromium/content/browser/service_worker/service_worker_job_coordinator.h
+++ b/chromium/content/browser/service_worker/service_worker_job_coordinator.h
@@ -23,8 +23,7 @@ class ServiceWorkerRegistration;
 // This class manages all in-flight registration or unregistration jobs.
 class CONTENT_EXPORT ServiceWorkerJobCoordinator {
  public:
-  explicit ServiceWorkerJobCoordinator(
-      base::WeakPtr<ServiceWorkerContextCore> context);
+  explicit ServiceWorkerJobCoordinator(ServiceWorkerContextCore* context);
   ~ServiceWorkerJobCoordinator();
 
   void Register(const GURL& script_url,
@@ -46,6 +45,10 @@ class CONTENT_EXPORT ServiceWorkerJobCoordinator {
   void Abort(const GURL& scope);
   void AbortAll();
 
+  // Marks that the ServiceWorkerContextCore is shutting down, so jobs may be
+  // destroyed before finishing.
+  void ClearForShutdown();
+
   // Removes the job. A job that was not aborted must call FinishJob when it is
   // done.
   void FinishJob(const GURL& scope, ServiceWorkerRegisterJobBase* job);
@@ -84,9 +87,8 @@ class CONTENT_EXPORT ServiceWorkerJobCoordinator {
     DISALLOW_COPY_AND_ASSIGN(JobQueue);
   };
 
-  // The ServiceWorkerContextCore object should always outlive the
-  // job coordinator, the core owns the coordinator.
-  base::WeakPtr<ServiceWorkerContextCore> context_;
+  // The ServiceWorkerContextCore object must outlive this.
+  ServiceWorkerContextCore* const context_;
   std::map<GURL, JobQueue> job_queues_;
 
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerJobCoordinator);
diff --git a/chromium/content/browser/service_worker/service_worker_job_unittest.cc b/chromium/content/browser/service_worker/service_worker_job_unittest.cc
index 9fcdf75fd8a..5e0a8985a0d 100644
--- a/chromium/content/browser/service_worker/service_worker_job_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_job_unittest.cc
@@ -35,7 +35,8 @@
 #include "content/browser/storage_partition_impl.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
-#include "content/test/fake_network_url_loader_factory.h"
+#include "content/public/test/url_loader_interceptor.h"
+#include "content/test/fake_network.h"
 #include "ipc/ipc_test_sink.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
@@ -121,6 +122,31 @@ void RequestTermination(
   (*host)->RequestTermination(base::DoNothing());
 }
 
+class EmbeddedWorkerStatusObserver : public ServiceWorkerVersion::Observer {
+ public:
+  EmbeddedWorkerStatusObserver(base::OnceClosure quit_closure,
+                               EmbeddedWorkerStatus running_status)
+      : quit_closure_(std::move(quit_closure)),
+        expected_running_status_(running_status) {}
+
+  void OnRunningStateChanged(ServiceWorkerVersion* version) override {
+    if (!quit_closure_)
+      return;
+
+    if (version->running_status() == expected_running_status_)
+      std::move(quit_closure_).Run();
+  }
+
+ private:
+  EmbeddedWorkerStatusObserver(const EmbeddedWorkerStatusObserver&) = delete;
+  EmbeddedWorkerStatusObserver& operator=(const EmbeddedWorkerStatusObserver&) =
+      delete;
+
+  base::OnceClosure quit_closure_;
+
+  EmbeddedWorkerStatus expected_running_status_;
+};
+
 }  // namespace
 
 class ServiceWorkerJobTest : public testing::Test {
@@ -151,6 +177,8 @@ class ServiceWorkerJobTest : public testing::Test {
   void RunUnregisterJob(const GURL& scope,
                         blink::ServiceWorkerStatusCode expected_status =
                             blink::ServiceWorkerStatusCode::kOk);
+  void WaitForVersionRunningStatus(scoped_refptr<ServiceWorkerVersion> version,
+                                   EmbeddedWorkerStatus running_status);
   scoped_refptr<ServiceWorkerRegistration> FindRegistrationForScope(
       const GURL& scope,
       blink::ServiceWorkerStatusCode expected_status =
@@ -184,6 +212,19 @@ void ServiceWorkerJobTest::RunUnregisterJob(
   run_loop.Run();
 }
 
+void ServiceWorkerJobTest::WaitForVersionRunningStatus(
+    scoped_refptr<ServiceWorkerVersion> version,
+    EmbeddedWorkerStatus running_status) {
+  if (version->running_status() == running_status)
+    return;
+
+  base::RunLoop run_loop;
+  EmbeddedWorkerStatusObserver observer(run_loop.QuitClosure(), running_status);
+  version->AddObserver(&observer);
+  run_loop.Run();
+  version->RemoveObserver(&observer);
+}
+
 scoped_refptr<ServiceWorkerRegistration>
 ServiceWorkerJobTest::FindRegistrationForScope(
     const GURL& scope,
@@ -324,8 +365,11 @@ TEST_F(ServiceWorkerJobTest, Register) {
           helper_.get());
   scoped_refptr<ServiceWorkerRegistration> registration = RunRegisterJob(
       GURL("https://www.example.com/service_worker.js"), options);
-  // Wait until the worker becomes active.
-  base::RunLoop().RunUntilIdle();
+  auto runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+  registration->SetTaskRunnerForTest(runner);
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilActivated(registration->installing_version(), runner);
+  scoped_refptr<ServiceWorkerVersion> version = registration->active_version();
 
   EXPECT_TRUE(registration);
   ASSERT_EQ(2u, worker->events().size());
@@ -339,8 +383,10 @@ TEST_F(ServiceWorkerJobTest, Unregister) {
   options.scope = GURL("https://www.example.com/");
   scoped_refptr<ServiceWorkerRegistration> registration = RunRegisterJob(
       GURL("https://www.example.com/service_worker.js"), options);
-  // Wait until the worker becomes active.
-  base::RunLoop().RunUntilIdle();
+  auto runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+  registration->SetTaskRunnerForTest(runner);
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilActivated(registration->installing_version(), runner);
   scoped_refptr<ServiceWorkerVersion> version = registration->active_version();
 
   ServiceWorkerProviderHost* provider_host =
@@ -354,8 +400,8 @@ TEST_F(ServiceWorkerJobTest, Unregister) {
   EXPECT_EQ(1UL, provider_host->service_worker_object_hosts_.size());
 
   RunUnregisterJob(options.scope);
-  // Wait until the worker becomes redundant.
-  base::RunLoop().RunUntilIdle();
+
+  WaitForVersionRunningStatus(version, EmbeddedWorkerStatus::STOPPED);
 
   // The service worker registration object host and service worker object host
   // have been destroyed together with |provider_host| by the above
@@ -383,11 +429,12 @@ TEST_F(ServiceWorkerJobTest, Unregister_NothingRegistered) {
 TEST_F(ServiceWorkerJobTest, RegisterNewScript) {
   blink::mojom::ServiceWorkerRegistrationOptions options;
   options.scope = GURL("https://www.example.com/");
-
   scoped_refptr<ServiceWorkerRegistration> old_registration = RunRegisterJob(
       GURL("https://www.example.com/service_worker.js"), options);
-  // Wait until the worker becomes active.
-  base::RunLoop().RunUntilIdle();
+  auto runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+  old_registration->SetTaskRunnerForTest(runner);
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilActivated(old_registration->installing_version(), runner);
 
   scoped_refptr<ServiceWorkerRegistration> old_registration_by_scope =
       FindRegistrationForScope(options.scope);
@@ -696,13 +743,8 @@ TEST_F(ServiceWorkerJobTest, UnregisterWaitingSetsRedundant) {
   scoped_refptr<ServiceWorkerVersion> version = new ServiceWorkerVersion(
       registration.get(), script_url, blink::mojom::ScriptType::kClassic, 1L,
       helper_->context()->AsWeakPtr());
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version.get()));
 
   version->set_fetch_handler_existence(
       ServiceWorkerVersion::FetchHandlerExistence::EXISTS);
@@ -712,8 +754,7 @@ TEST_F(ServiceWorkerJobTest, UnregisterWaitingSetsRedundant) {
   EXPECT_EQ(ServiceWorkerVersion::INSTALLED, version->status());
 
   RunUnregisterJob(GURL("https://www.example.com/"));
-  // Wait until the worker becomes redundant.
-  base::RunLoop().RunUntilIdle();
+  WaitForVersionRunningStatus(version, EmbeddedWorkerStatus::STOPPED);
 
   // The version should be stopped since there is no controllee after
   // unregistration.
@@ -728,17 +769,20 @@ TEST_F(ServiceWorkerJobTest, UnregisterActiveSetsRedundant) {
   options.scope = GURL("https://www.example.com/");
   scoped_refptr<ServiceWorkerRegistration> registration = RunRegisterJob(
       GURL("https://www.example.com/service_worker.js"), options);
-  // Wait until the worker becomes active.
-  base::RunLoop().RunUntilIdle();
+  auto runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+  registration->SetTaskRunnerForTest(runner);
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilActivated(registration->installing_version(), runner);
   ASSERT_TRUE(registration.get());
 
   scoped_refptr<ServiceWorkerVersion> version = registration->active_version();
+  observer.RunUntilStatusChange(version.get(), ServiceWorkerVersion::ACTIVATED);
   EXPECT_EQ(EmbeddedWorkerStatus::RUNNING, version->running_status());
   EXPECT_EQ(ServiceWorkerVersion::ACTIVATED, version->status());
 
   RunUnregisterJob(GURL("https://www.example.com/"));
-  // Wait until the worker becomes redundant.
-  base::RunLoop().RunUntilIdle();
+
+  WaitForVersionRunningStatus(version, EmbeddedWorkerStatus::STOPPED);
 
   // The version should be stopped since there is no controllee after
   // unregistration.
@@ -754,8 +798,10 @@ TEST_F(ServiceWorkerJobTest,
   options.scope = GURL("https://www.example.com/");
   scoped_refptr<ServiceWorkerRegistration> registration = RunRegisterJob(
       GURL("https://www.example.com/service_worker.js"), options);
-  // Wait until the worker becomes active.
-  base::RunLoop().RunUntilIdle();
+  auto runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+  registration->SetTaskRunnerForTest(runner);
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilActivated(registration->installing_version(), runner);
   ASSERT_TRUE(registration.get());
 
   ServiceWorkerProviderHost* host = CreateControllee();
@@ -772,8 +818,7 @@ TEST_F(ServiceWorkerJobTest,
   EXPECT_EQ(ServiceWorkerVersion::ACTIVATED, version->status());
 
   registration->active_version()->RemoveControllee(host->client_uuid());
-  // Wait until the worker becomes redundant.
-  base::RunLoop().RunUntilIdle();
+  WaitForVersionRunningStatus(version, EmbeddedWorkerStatus::STOPPED);
 
   // The version should be stopped since there is no controllee.
   EXPECT_EQ(EmbeddedWorkerStatus::STOPPED, version->running_status());
@@ -880,8 +925,9 @@ TEST_F(ServiceWorkerJobTest, RegisterAndUnregisterWhileUninstalling) {
   EXPECT_EQ(ServiceWorkerVersion::INSTALLED, new_version->status());
 
   old_version->RemoveControllee(host->client_uuid());
-  // Wait until the worker becomes redundant.
-  base::RunLoop().RunUntilIdle();
+
+  WaitForVersionRunningStatus(old_version, EmbeddedWorkerStatus::STOPPED);
+  WaitForVersionRunningStatus(new_version, EmbeddedWorkerStatus::STOPPED);
 
   EXPECT_FALSE(registration->is_uninstalling());
   EXPECT_TRUE(registration->is_uninstalled());
@@ -1009,7 +1055,7 @@ TEST_F(ServiceWorkerJobTest, AddRegistrationToMatchingProviderHosts) {
 
   // Make an in-scope client.
   ServiceWorkerProviderHost* client = CreateControllee();
-  client->UpdateUrls(in_scope, in_scope);
+  client->UpdateUrls(in_scope, in_scope, url::Origin::Create(in_scope));
 
   // Make an in-scope reserved client.
   std::unique_ptr<ServiceWorkerProviderHostAndInfo> host_and_info =
@@ -1017,11 +1063,13 @@ TEST_F(ServiceWorkerJobTest, AddRegistrationToMatchingProviderHosts) {
                                          /*are_ancestors_secure=*/true);
   base::WeakPtr<ServiceWorkerProviderHost> reserved_client =
       std::move(host_and_info->host);
-  reserved_client->UpdateUrls(in_scope, in_scope);
+  reserved_client->UpdateUrls(in_scope, in_scope,
+                              url::Origin::Create(in_scope));
 
   // Make an out-scope client.
   ServiceWorkerProviderHost* out_scope_client = CreateControllee();
-  out_scope_client->UpdateUrls(out_scope, out_scope);
+  out_scope_client->UpdateUrls(out_scope, out_scope,
+                               url::Origin::Create(out_scope));
 
   // Make a new registration.
   GURL script("https://www.example.com/service_worker.js");
@@ -1113,10 +1161,10 @@ class UpdateJobTestHelper : public EmbeddedWorkerTestHelper,
     context_wrapper()->AddObserver(this);
     if (base::FeatureList::IsEnabled(
             blink::features::kServiceWorkerImportedScriptUpdateCheck)) {
-      loader_factory_for_update_checker_ =
-          std::make_unique<FakeNetworkURLLoaderFactory>(kHeaders, kBody, true,
-                                                        net::OK);
-      SetNetworkFactory(loader_factory_for_update_checker_.get());
+      interceptor_ = std::make_unique<URLLoaderInterceptor>(base::BindRepeating(
+          &FakeNetwork::HandleRequest, base::Unretained(&fake_network_)));
+      fake_network_.SetDefaultResponse(kHeaders, kBody,
+                                       /*network_accessed=*/true, net::OK);
     }
   }
   ~UpdateJobTestHelper() override {
@@ -1279,9 +1327,10 @@ class UpdateJobTestHelper : public EmbeddedWorkerTestHelper,
   bool registration_failed_ = false;
   bool force_start_worker_failure_ = false;
   base::Optional<bool> will_be_terminated_;
-  // This is used only when ServiceWorkerImportedScriptUpdateCheck is enabled.
-  std::unique_ptr<FakeNetworkURLLoaderFactory>
-      loader_factory_for_update_checker_;
+
+  // These are used only when ServiceWorkerImportedScriptUpdateCheck is enabled.
+  FakeNetwork fake_network_;
+  std::unique_ptr<URLLoaderInterceptor> interceptor_;
 
   base::WeakPtrFactory<UpdateJobTestHelper> weak_factory_{this};
 };
@@ -1450,7 +1499,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_BumpLastUpdateCheckTime) {
   // accessed. The check time should not be updated.
   // Set network not accessed.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         kNoChangeOrigin.Resolve(kScript), kHeaders, kBody,
         /*network_accessed=*/false, net::OK);
   }
@@ -1477,7 +1526,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_BumpLastUpdateCheckTime) {
   // accessed. The check time should be updated.
   // Set network accessed.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         kNoChangeOrigin.Resolve(kScript), kHeaders, kBody,
         /*network_accessed=*/true, net::OK);
   }
@@ -1507,7 +1556,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_BumpLastUpdateCheckTime) {
   // Run an update where the script changed. The check time should be updated.
   // Change script body.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         kNewVersionOrigin.Resolve(kScript), kHeaders, kNewBody,
         /*network_accessed=*/true, net::OK);
   }
@@ -1537,7 +1586,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_BumpLastUpdateCheckTime) {
   registration->set_last_update_check(kYesterday);
   // Change script body.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         kNewVersionOrigin.Resolve(kScript), kHeaders, kBody,
         /*network_accessed=*/true, net::OK);
   }
@@ -1569,7 +1618,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_NewVersion) {
   // Run the update job and an update is found.
   // Change script body.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         kNewVersionOrigin.Resolve(kScript), kHeaders, kNewBody,
         /*network_accessed=*/true, net::OK);
   }
@@ -1704,7 +1753,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_ScriptUrlChanged) {
           helper_.get());
   // Setup the old script response.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         old_script, kHeaders, kBody, /*network_accessed=*/true, net::OK);
   }
   scoped_refptr<ServiceWorkerRegistration> registration =
@@ -1725,7 +1774,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_ScriptUrlChanged) {
 
   if (IsImportedScriptUpdateCheckEnabled()) {
     // Setup the new script response.
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         new_script, kHeaders, kNewBody, /*network_accessed=*/true, net::OK);
 
     // Make sure the storage has the data of the current waiting version.
@@ -1778,7 +1827,7 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_EvictedIncumbent) {
   // Evict the incumbent during that time.
   // Change script body.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         kNewVersionOrigin.Resolve(kScript), kHeaders, kNewBody,
         /*network_accessed=*/true, net::OK);
   }
@@ -1804,8 +1853,10 @@ TEST_P(ServiceWorkerUpdateJobTest, Update_UninstallingRegistration) {
   options.scope = GURL("https://www.example.com/one/");
   scoped_refptr<ServiceWorkerRegistration> registration = RunRegisterJob(
       GURL("https://www.example.com/service_worker.js"), options);
-  // Wait until the worker becomes active.
-  base::RunLoop().RunUntilIdle();
+  auto runner = base::MakeRefCounted<base::TestSimpleTaskRunner>();
+  registration->SetTaskRunnerForTest(runner);
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilActivated(registration->installing_version(), runner);
 
   // Add a controllee and queue an unregister to force the uninstalling state.
   ServiceWorkerProviderHost* host = CreateControllee();
@@ -1866,9 +1917,9 @@ TEST_P(ServiceWorkerUpdateJobTest, RegisterMultipleTimesWhileUninstalling) {
   EXPECT_TRUE(registration->is_uninstalling());
 
   EXPECT_EQ(registration, RunRegisterJob(script3, options));
-  // Wait until the worker becomes redundant.
-  base::RunLoop().RunUntilIdle();
-
+  TestServiceWorkerObserver observer(helper_->context_wrapper());
+  observer.RunUntilStatusChange(second_version.get(),
+                                ServiceWorkerVersion::REDUNDANT);
   scoped_refptr<ServiceWorkerVersion> third_version =
       registration->waiting_version();
   ASSERT_TRUE(third_version);
@@ -1880,7 +1931,6 @@ TEST_P(ServiceWorkerUpdateJobTest, RegisterMultipleTimesWhileUninstalling) {
   RequestTermination(&initial_client->host());
 
   // Wait for activated.
-  TestServiceWorkerObserver observer(helper_->context_wrapper());
   observer.RunUntilActivated(third_version.get(), runner);
 
   // Verify the new version is activated.
@@ -1972,7 +2022,7 @@ TEST_P(ServiceWorkerUpdateJobTest, ActivateCancelsOnShutdown) {
   // Update. The new version should be waiting.
   // Change script body.
   if (IsImportedScriptUpdateCheckEnabled()) {
-    update_helper_->loader_factory_for_update_checker_->SetResponse(
+    update_helper_->fake_network_.SetResponse(
         script, kHeaders, kNewBody, /*network_accessed=*/true, net::OK);
   }
   registration->AddListener(update_helper_);
diff --git a/chromium/content/browser/service_worker/service_worker_metrics.cc b/chromium/content/browser/service_worker/service_worker_metrics.cc
index 3cad48ca836..fc6902dd474 100644
--- a/chromium/content/browser/service_worker/service_worker_metrics.cc
+++ b/chromium/content/browser/service_worker/service_worker_metrics.cc
@@ -122,8 +122,6 @@ const char* EventTypeToSuffix(ServiceWorkerMetrics::EventType event_type) {
       return "_ABORT_PAYMENT";
     case ServiceWorkerMetrics::EventType::COOKIE_CHANGE:
       return "_COOKIE_CHANGE";
-    case ServiceWorkerMetrics::EventType::LONG_RUNNING_MESSAGE:
-      return "_LONG_RUNNING_MESSAGE";
     case ServiceWorkerMetrics::EventType::BACKGROUND_FETCH_SUCCESS:
       return "_BACKGROUND_FETCH_SUCCESS";
     case ServiceWorkerMetrics::EventType::PERIODIC_SYNC:
@@ -191,8 +189,6 @@ const char* ServiceWorkerMetrics::EventTypeToString(EventType event_type) {
       return "Abort Payment";
     case EventType::COOKIE_CHANGE:
       return "Cookie Change";
-    case EventType::LONG_RUNNING_MESSAGE:
-      return "Long Running Message";
     case EventType::BACKGROUND_FETCH_SUCCESS:
       return "Background Fetch Success";
     case EventType::PERIODIC_SYNC:
@@ -477,10 +473,6 @@ void ServiceWorkerMetrics::RecordEventDuration(EventType event,
     case EventType::COOKIE_CHANGE:
       UMA_HISTOGRAM_MEDIUM_TIMES("ServiceWorker.CookieChangeEvent.Time", time);
       break;
-    case EventType::LONG_RUNNING_MESSAGE:
-      // Since this event is expected to last indefinitely we don't need to log
-      // how long they actually last.
-      break;
     case EventType::PERIODIC_SYNC:
       UMA_HISTOGRAM_MEDIUM_TIMES(
           "ServiceWorker.PeriodicBackgroundSyncEvent.Time", time);
diff --git a/chromium/content/browser/service_worker/service_worker_metrics.h b/chromium/content/browser/service_worker/service_worker_metrics.h
index 65088864d16..dea7547db11 100644
--- a/chromium/content/browser/service_worker/service_worker_metrics.h
+++ b/chromium/content/browser/service_worker/service_worker_metrics.h
@@ -99,7 +99,7 @@ class ServiceWorkerMetrics {
     CAN_MAKE_PAYMENT = 28,
     ABORT_PAYMENT = 29,
     COOKIE_CHANGE = 30,
-    LONG_RUNNING_MESSAGE = 31,
+    // LONG_RUNNING_MESSAGE = 31, // Obsolete
     BACKGROUND_FETCH_SUCCESS = 32,
     PERIODIC_SYNC = 33,
     CONTENT_DELETE = 34,
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader.cc
index 68fbe20f302..3d10a1e95c5 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader.cc
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader.cc
@@ -90,8 +90,8 @@ ServiceWorkerNavigationLoader::ServiceWorkerNavigationLoader(
       "ServiceWorkerNavigationLoader::ServiceWorkerNavigationLoader", this,
       TRACE_EVENT_FLAG_FLOW_OUT);
 
-  response_head_.load_timing.request_start = base::TimeTicks::Now();
-  response_head_.load_timing.request_start_time = base::Time::Now();
+  response_head_->load_timing.request_start = base::TimeTicks::Now();
+  response_head_->load_timing.request_start_time = base::Time::Now();
 }
 
 ServiceWorkerNavigationLoader::~ServiceWorkerNavigationLoader() {
@@ -180,7 +180,7 @@ void ServiceWorkerNavigationLoader::StartRequest(
 
   // Record worker start time here as |fetch_dispatcher_| will start a service
   // worker if there is no running service worker.
-  response_head_.service_worker_start_time = base::TimeTicks::Now();
+  response_head_->service_worker_start_time = base::TimeTicks::Now();
   fetch_dispatcher_->Run();
 }
 
@@ -189,10 +189,10 @@ void ServiceWorkerNavigationLoader::CommitResponseHeaders() {
   TRACE_EVENT_WITH_FLOW2(
       "ServiceWorker", "ServiceWorkerNavigationLoader::CommitResponseHeaders",
       this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT,
-      "response_code", response_head_.headers->response_code(), "status_text",
-      response_head_.headers->GetStatusText());
+      "response_code", response_head_->headers->response_code(), "status_text",
+      response_head_->headers->GetStatusText());
   TransitionToStatus(Status::kSentHeader);
-  url_loader_client_->OnReceiveResponse(response_head_);
+  url_loader_client_->OnReceiveResponse(response_head_.Clone());
 }
 
 void ServiceWorkerNavigationLoader::CommitResponseBody(
@@ -247,9 +247,9 @@ void ServiceWorkerNavigationLoader::DidPrepareFetchEvent(
   // At this point a service worker is running and the fetch event is about
   // to dispatch. Record some load timings.
   base::TimeTicks now = base::TimeTicks::Now();
-  response_head_.service_worker_ready_time = now;
-  response_head_.load_timing.send_start = now;
-  response_head_.load_timing.send_end = now;
+  response_head_->service_worker_ready_time = now;
+  response_head_->load_timing.send_start = now;
+  response_head_->load_timing.send_end = now;
 
   devtools_attached_ = version->embedded_worker()->devtools_attached();
 }
@@ -329,16 +329,16 @@ void ServiceWorkerNavigationLoader::StartResponse(
   DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
   DCHECK_EQ(status_, Status::kStarted);
 
-  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, &response_head_);
+  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, response_head_.get());
   ServiceWorkerLoaderHelpers::SaveResponseHeaders(
       response->status_code, response->status_text, response->headers,
-      &response_head_);
+      response_head_.get());
 
-  response_head_.did_service_worker_navigation_preload =
+  response_head_->did_service_worker_navigation_preload =
       did_navigation_preload_;
-  response_head_.load_timing.receive_headers_start = base::TimeTicks::Now();
-  response_head_.load_timing.receive_headers_end =
-      response_head_.load_timing.receive_headers_start;
+  response_head_->load_timing.receive_headers_start = base::TimeTicks::Now();
+  response_head_->load_timing.receive_headers_end =
+      response_head_->load_timing.receive_headers_start;
   response_source_ = response->response_source;
 
   // Make the navigated page inherit the SSLInfo from its controller service
@@ -347,21 +347,22 @@ void ServiceWorkerNavigationLoader::StartResponse(
   // TODO(horo): When we support mixed-content (HTTP) no-cors requests from a
   // ServiceWorker, we have to check the security level of the responses.
   DCHECK(version->GetMainScriptHttpResponseInfo());
-  response_head_.ssl_info = version->GetMainScriptHttpResponseInfo()->ssl_info;
+  response_head_->ssl_info = version->GetMainScriptHttpResponseInfo()->ssl_info;
 
   // Handle a redirect response. ComputeRedirectInfo returns non-null redirect
   // info if the given response is a redirect.
   base::Optional<net::RedirectInfo> redirect_info =
       ServiceWorkerLoaderHelpers::ComputeRedirectInfo(resource_request_,
-                                                      response_head_);
+                                                      *response_head_);
   if (redirect_info) {
     TRACE_EVENT_WITH_FLOW2(
         "ServiceWorker", "ServiceWorkerNavigationLoader::StartResponse", this,
         TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "result",
         "redirect", "redirect url", redirect_info->new_url.spec());
 
-    response_head_.encoded_data_length = 0;
-    url_loader_client_->OnReceiveRedirect(*redirect_info, response_head_);
+    response_head_->encoded_data_length = 0;
+    url_loader_client_->OnReceiveRedirect(*redirect_info,
+                                          response_head_.Clone());
     // Our client is the navigation loader, which will start a new URLLoader for
     // the redirect rather than calling FollowRedirect(), so we're done here.
     TransitionToStatus(Status::kCompleted);
@@ -489,22 +490,22 @@ void ServiceWorkerNavigationLoader::RecordTimingMetrics(bool handled) {
   UMA_HISTOGRAM_TIMES(
       "ServiceWorker.LoadTiming.MainFrame.MainResource."
       "StartToForwardServiceWorker",
-      response_head_.service_worker_start_time -
-          response_head_.load_timing.request_start);
+      response_head_->service_worker_start_time -
+          response_head_->load_timing.request_start);
 
   // Time spent for service worker startup.
   UMA_HISTOGRAM_MEDIUM_TIMES(
       "ServiceWorker.LoadTiming.MainFrame.MainResource."
       "ForwardServiceWorkerToWorkerReady2",
-      response_head_.service_worker_ready_time -
-          response_head_.service_worker_start_time);
+      response_head_->service_worker_ready_time -
+          response_head_->service_worker_start_time);
 
   // Browser -> Renderer IPC delay.
   UMA_HISTOGRAM_TIMES(
       "ServiceWorker.LoadTiming.MainFrame.MainResource."
       "WorkerReadyToFetchHandlerStart",
       fetch_event_timing_->dispatch_event_time -
-          response_head_.service_worker_ready_time);
+          response_head_->service_worker_ready_time);
 
   // Time spent by fetch handlers.
   UMA_HISTOGRAM_TIMES(
@@ -518,21 +519,21 @@ void ServiceWorkerNavigationLoader::RecordTimingMetrics(bool handled) {
     UMA_HISTOGRAM_TIMES(
         "ServiceWorker.LoadTiming.MainFrame.MainResource."
         "FetchHandlerEndToResponseReceived",
-        response_head_.load_timing.receive_headers_end -
+        response_head_->load_timing.receive_headers_end -
             fetch_event_timing_->respond_with_settled_time);
 
     // Time spent reading response body.
     UMA_HISTOGRAM_MEDIUM_TIMES(
         "ServiceWorker.LoadTiming.MainFrame.MainResource."
         "ResponseReceivedToCompleted2",
-        completion_time_ - response_head_.load_timing.receive_headers_end);
+        completion_time_ - response_head_->load_timing.receive_headers_end);
     // Same as above, breakdown by response source.
     base::UmaHistogramMediumTimes(
         base::StrCat({"ServiceWorker.LoadTiming.MainFrame.MainResource."
                       "ResponseReceivedToCompleted2",
                       ServiceWorkerUtils::FetchResponseSourceToSuffix(
                           response_source_)}),
-        completion_time_ - response_head_.load_timing.receive_headers_end);
+        completion_time_ - response_head_->load_timing.receive_headers_end);
   } else {
     // Renderer -> Browser IPC delay (network fallback case).
     UMA_HISTOGRAM_TIMES(
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader.h b/chromium/content/browser/service_worker/service_worker_navigation_loader.h
index 35ad602dbef..8daa07f2603 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader.h
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader.h
@@ -17,6 +17,7 @@
 #include "content/browser/service_worker/service_worker_fetch_dispatcher.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
@@ -159,10 +160,11 @@ class CONTENT_EXPORT ServiceWorkerNavigationLoader
   std::unique_ptr<ServiceWorkerFetchDispatcher> fetch_dispatcher_;
   std::unique_ptr<StreamWaiter> stream_waiter_;
   // The blob needs to be held while it's read to keep it alive.
-  blink::mojom::BlobPtr body_as_blob_;
+  mojo::Remote<blink::mojom::Blob> body_as_blob_;
 
   bool did_navigation_preload_ = false;
-  network::ResourceResponseHead response_head_;
+  network::mojom::URLResponseHeadPtr response_head_ =
+      network::mojom::URLResponseHead::New();
 
   bool devtools_attached_ = false;
   blink::mojom::ServiceWorkerFetchEventTimingPtr fetch_event_timing_;
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc
index f5f942dbae7..75d4505601b 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.cc
@@ -126,7 +126,7 @@ void MaybeCreateLoaderOnCoreThread(
           params.resource_type == ResourceType::kWorker
               ? blink::mojom::ServiceWorkerProviderType::kForDedicatedWorker
               : blink::mojom::ServiceWorkerProviderType::kForSharedWorker;
-      provider_host = ServiceWorkerProviderHost::PreCreateForWebWorker(
+      provider_host = ServiceWorkerProviderHost::CreateForWebWorker(
           context_core->AsWeakPtr(), params.process_id, provider_type,
           std::move(host_receiver), std::move(client_remote));
     }
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h
index 320d51430ae..c6d5de99725 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_interceptor.h
@@ -84,8 +84,7 @@ class ServiceWorkerNavigationLoaderInterceptor final
       network::mojom::URLLoaderClientPtr client);
 
   // For navigations, |handle_| outlives |this|. It's owned by
-  // NavigationHandleImpl which outlives NavigationURLLoaderImpl which owns
-  // |this|.
+  // NavigationRequest which outlives NavigationURLLoaderImpl which owns |this|.
   // For workers, |handle_| may be destroyed during interception. It's owned by
   // DedicatedWorkerHost or SharedWorkerHost which may be destroyed before
   // WorkerScriptLoader which owns |this|.
diff --git a/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc b/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
index 96d25063fe5..561ae54d075 100644
--- a/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_navigation_loader_unittest.cc
@@ -393,7 +393,8 @@ class ServiceWorkerNavigationLoaderTest : public testing::Test {
       provider_host_ = CreateProviderHostForWindow(
           helper_->mock_render_process_id(), /*is_parent_frame_secure=*/true,
           helper_->context()->AsWeakPtr(), &provider_endpoints_);
-      provider_host_->UpdateUrls(request->url, request->url);
+      provider_host_->UpdateUrls(request->url, request->url,
+                                 url::Origin::Create(request->url));
       provider_host_->AddMatchingRegistration(registration_.get());
       provider_host_->SetControllerRegistration(
           registration_, /*notify_controllerchange=*/false);
@@ -516,7 +517,8 @@ TEST_F(ServiceWorkerNavigationLoaderTest, NoActiveWorker) {
       helper_->mock_render_process_id(), /*is_parent_frame_secure=*/true,
       helper_->context()->AsWeakPtr(), &provider_endpoints_);
   provider_host_->UpdateUrls(GURL("https://example.com/"),
-                             GURL("https://example.com/"));
+                             GURL("https://example.com/"),
+                             url::Origin::Create(GURL("https://example.com/")));
 
   // Perform the request.
   StartRequest(CreateRequest());
@@ -566,9 +568,8 @@ TEST_F(ServiceWorkerNavigationLoaderTest, BlobResponse) {
   auto blob = blink::mojom::SerializedBlob::New();
   blob->uuid = blob_handle->uuid();
   blob->size = blob_handle->size();
-  mojo::PendingReceiver<blink::mojom::Blob> receiver =
-      mojo::MakeRequest(&blob->blob);
-  storage::BlobImpl::Create(std::move(blob_handle), std::move(receiver));
+  storage::BlobImpl::Create(std::move(blob_handle),
+                            blob->blob.InitWithNewPipeAndPassReceiver());
   service_worker_->RespondWithBlob(std::move(blob));
 
   // Perform the request.
@@ -607,9 +608,8 @@ TEST_F(ServiceWorkerNavigationLoaderTest, BrokenBlobResponse) {
                                   storage::BlobStatus::ERR_OUT_OF_MEMORY);
   auto blob = blink::mojom::SerializedBlob::New();
   blob->uuid = kBrokenUUID;
-  mojo::PendingReceiver<blink::mojom::Blob> receiver =
-      mojo::MakeRequest(&blob->blob);
-  storage::BlobImpl::Create(std::move(blob_handle), std::move(receiver));
+  storage::BlobImpl::Create(std::move(blob_handle),
+                            blob->blob.InitWithNewPipeAndPassReceiver());
   service_worker_->RespondWithBlob(std::move(blob));
 
   // Perform the request.
diff --git a/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc b/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
index 001c9ad631a..600222bbe54 100644
--- a/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_new_script_loader_unittest.cc
@@ -20,6 +20,7 @@
 #include "content/browser/service_worker/service_worker_test_utils.h"
 #include "content/browser/url_loader_factory_getter.h"
 #include "content/public/test/browser_task_environment.h"
+#include "content/public/test/url_loader_interceptor.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/base/load_flags.h"
@@ -71,22 +72,23 @@ class MockHTTPServer {
   std::map<GURL, Response> responses_;
 };
 
-// A URLLoaderFactory that returns a mocked response provided by MockHTTPServer.
-class MockNetworkURLLoaderFactory final
-    : public network::mojom::URLLoaderFactory {
+// Mocks network activity. Used by URLLoaderInterceptor.
+class MockNetwork {
  public:
-  explicit MockNetworkURLLoaderFactory(MockHTTPServer* mock_server)
+  explicit MockNetwork(MockHTTPServer* mock_server)
       : mock_server_(mock_server) {}
 
-  // network::mojom::URLLoaderFactory implementation.
-  void CreateLoaderAndStart(network::mojom::URLLoaderRequest request,
-                            int32_t routing_id,
-                            int32_t request_id,
-                            uint32_t options,
-                            const network::ResourceRequest& url_request,
-                            network::mojom::URLLoaderClientPtr client,
-                            const net::MutableNetworkTrafficAnnotationTag&
-                                traffic_annotation) override {
+  MockNetwork(const MockNetwork&) = delete;
+  MockNetwork& operator=(const MockNetwork&) = delete;
+
+  void set_to_access_network(bool access_network) {
+    access_network_ = access_network;
+  }
+
+  network::ResourceRequest last_request() const { return last_request_; }
+
+  bool InterceptNetworkRequest(URLLoaderInterceptor::RequestParams* params) {
+    const network::ResourceRequest& url_request = params->url_request;
     last_request_ = url_request;
     const MockHTTPServer::Response& response =
         mock_server_->Get(url_request.url);
@@ -103,48 +105,38 @@ class MockNetworkURLLoaderFactory final
       response_head.cert_status = net::CERT_STATUS_DATE_INVALID;
     }
 
+    network::mojom::URLLoaderClientPtr& client = params->client;
     if (response_head.headers->response_code() == 307) {
       client->OnReceiveRedirect(net::RedirectInfo(), response_head);
-      return;
+      return true;
     }
     client->OnReceiveResponse(response_head);
 
     uint32_t bytes_written = response.body.size();
     mojo::ScopedDataPipeConsumerHandle consumer;
     mojo::ScopedDataPipeProducerHandle producer;
-    ASSERT_EQ(MOJO_RESULT_OK,
-              mojo::CreateDataPipe(nullptr, &producer, &consumer));
+    CHECK_EQ(MOJO_RESULT_OK,
+             mojo::CreateDataPipe(nullptr, &producer, &consumer));
     MojoResult result = producer->WriteData(
         response.body.data(), &bytes_written, MOJO_WRITE_DATA_FLAG_ALL_OR_NONE);
-    ASSERT_EQ(MOJO_RESULT_OK, result);
+    CHECK_EQ(MOJO_RESULT_OK, result);
     client->OnStartLoadingResponseBody(std::move(consumer));
 
     network::URLLoaderCompletionStatus status;
     status.error_code = net::OK;
     client->OnComplete(status);
-  }
-
-  void set_to_access_network(bool access_network) {
-    access_network_ = access_network;
-  }
-
-  network::ResourceRequest last_request() const { return last_request_; }
-
-  void Clone(network::mojom::URLLoaderFactoryRequest factory) override {
-    NOTREACHED();
+    return true;
   }
 
  private:
   // |mock_server_| is owned by ServiceWorkerNewScriptLoaderTest.
-  MockHTTPServer* mock_server_;
+  MockHTTPServer* const mock_server_;
 
-  // The most recent request received by this factory.
+  // The most recent request received.
   network::ResourceRequest last_request_;
 
   // Controls whether a load simulates accessing network or cache.
   bool access_network_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(MockNetworkURLLoaderFactory);
 };
 
 // ServiceWorkerNewScriptLoaderTest is for testing the handling of requests for
@@ -153,7 +145,9 @@ class ServiceWorkerNewScriptLoaderTest : public testing::Test {
  public:
   ServiceWorkerNewScriptLoaderTest()
       : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP),
-        mock_server_(std::make_unique<MockHTTPServer>()) {}
+        mock_network_(&mock_server_),
+        interceptor_(base::BindRepeating(&MockNetwork::InterceptNetworkRequest,
+                                         base::Unretained(&mock_network_))) {}
   ~ServiceWorkerNewScriptLoaderTest() override = default;
 
   ServiceWorkerContextCore* context() { return helper_->context(); }
@@ -163,23 +157,18 @@ class ServiceWorkerNewScriptLoaderTest : public testing::Test {
 
     context()->storage()->LazyInitializeForTest();
 
-    mock_server_->Set(GURL(kNormalScriptURL),
-                      MockHTTPServer::Response(
-                          std::string("HTTP/1.1 200 OK\n"
-                                      "Content-Type: text/javascript\n\n"),
-                          std::string("this body came from the network")));
-    mock_server_->Set(
+    mock_server_.Set(GURL(kNormalScriptURL),
+                     MockHTTPServer::Response(
+                         std::string("HTTP/1.1 200 OK\n"
+                                     "Content-Type: text/javascript\n\n"),
+                         std::string("this body came from the network")));
+    mock_server_.Set(
         GURL(kNormalImportedScriptURL),
         MockHTTPServer::Response(
             std::string("HTTP/1.1 200 OK\n"
                         "Content-Type: text/javascript\n\n"),
             std::string(
                 "this is an import script response body from the network")));
-
-    // Initialize URLLoaderFactory.
-    mock_url_loader_factory_ =
-        std::make_unique<MockNetworkURLLoaderFactory>(mock_server_.get());
-    helper_->SetNetworkFactory(mock_url_loader_factory_.get());
   }
 
   // Sets up ServiceWorkerRegistration and ServiceWorkerVersion. This should be
@@ -252,7 +241,7 @@ class ServiceWorkerNewScriptLoaderTest : public testing::Test {
   bool VerifyStoredResponse(const GURL& url) {
     return ServiceWorkerUpdateCheckTestUtils::VerifyStoredResponse(
         LookupResourceId(url), context()->storage(),
-        mock_server_->Get(url).body);
+        mock_server_.Get(url).body);
   }
 
   int64_t LookupResourceId(const GURL& url) {
@@ -261,12 +250,15 @@ class ServiceWorkerNewScriptLoaderTest : public testing::Test {
 
  protected:
   BrowserTaskEnvironment task_environment_;
-  std::unique_ptr<MockNetworkURLLoaderFactory> mock_url_loader_factory_;
+
+  MockHTTPServer mock_server_;
+  MockNetwork mock_network_;
+  URLLoaderInterceptor interceptor_;
+
   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
 
   scoped_refptr<ServiceWorkerRegistration> registration_;
   scoped_refptr<ServiceWorkerVersion> version_;
-  std::unique_ptr<MockHTTPServer> mock_server_;
 };
 
 TEST_F(ServiceWorkerNewScriptLoaderTest, Success) {
@@ -287,7 +279,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Success) {
   std::string response;
   EXPECT_TRUE(
       mojo::BlockingCopyToString(client->response_body_release(), &response));
-  EXPECT_EQ(mock_server_->Get(kScriptURL).body, response);
+  EXPECT_EQ(mock_server_.Get(kScriptURL).body, response);
 
   // WRITE_OK should be recorded once plus one as we record a single write
   // success and the end of the body.
@@ -302,7 +294,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Success_EmptyBody) {
   const GURL kScriptURL("https://example.com/empty.js");
   std::unique_ptr<network::TestURLLoaderClient> client;
   std::unique_ptr<ServiceWorkerNewScriptLoader> loader;
-  mock_server_->Set(
+  mock_server_.Set(
       kScriptURL,
       MockHTTPServer::Response(std::string("HTTP/1.1 200 OK\n"
                                            "Content-Type: text/javascript\n\n"),
@@ -336,7 +328,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Success_LargeBody) {
   const uint32_t kBodySize =
       ServiceWorkerNewScriptLoader::kReadBufferSize * 1.6;
   const GURL kScriptURL("https://example.com/large-body.js");
-  mock_server_->Set(
+  mock_server_.Set(
       kScriptURL,
       MockHTTPServer::Response(std::string("HTTP/1.1 200 OK\n"
                                            "Content-Type: text/javascript\n\n"),
@@ -352,7 +344,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Success_LargeBody) {
   std::string response;
   EXPECT_TRUE(
       mojo::BlockingCopyToString(client->response_body_release(), &response));
-  EXPECT_EQ(mock_server_->Get(kScriptURL).body, response);
+  EXPECT_EQ(mock_server_.Get(kScriptURL).body, response);
 
   // The response should also be stored in the storage.
   EXPECT_TRUE(VerifyStoredResponse(kScriptURL));
@@ -369,9 +361,9 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Error_404) {
   std::unique_ptr<ServiceWorkerNewScriptLoader> loader;
 
   const GURL kScriptURL("https://example.com/nonexistent.js");
-  mock_server_->Set(kScriptURL, MockHTTPServer::Response(
-                                    std::string("HTTP/1.1 404 Not Found\n\n"),
-                                    std::string()));
+  mock_server_.Set(kScriptURL, MockHTTPServer::Response(
+                                   std::string("HTTP/1.1 404 Not Found\n\n"),
+                                   std::string()));
   SetUpRegistration(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
@@ -393,7 +385,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Error_Redirect) {
   std::unique_ptr<ServiceWorkerNewScriptLoader> loader;
 
   const GURL kScriptURL("https://example.com/redirect.js");
-  mock_server_->Set(
+  mock_server_.Set(
       kScriptURL,
       MockHTTPServer::Response(
           std::string("HTTP/1.1 307 Temporary Redirect\n\n"), std::string()));
@@ -422,7 +414,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Error_CertificateError) {
   MockHTTPServer::Response response(std::string("HTTP/1.1 200 OK\n\n"),
                                     std::string("body"));
   response.has_certificate_error = true;
-  mock_server_->Set(kScriptURL, response);
+  mock_server_.Set(kScriptURL, response);
   SetUpRegistration(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
@@ -445,9 +437,9 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Error_NoMimeType) {
   std::unique_ptr<ServiceWorkerNewScriptLoader> loader;
 
   const GURL kScriptURL("https://example.com/no-mime-type.js");
-  mock_server_->Set(kScriptURL, MockHTTPServer::Response(
-                                    std::string("HTTP/1.1 200 OK\n\n"),
-                                    std::string("body with no MIME type")));
+  mock_server_.Set(kScriptURL, MockHTTPServer::Response(
+                                   std::string("HTTP/1.1 200 OK\n\n"),
+                                   std::string("body with no MIME type")));
   SetUpRegistration(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
@@ -469,10 +461,10 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Error_BadMimeType) {
   std::unique_ptr<ServiceWorkerNewScriptLoader> loader;
 
   const GURL kScriptURL("https://example.com/bad-mime-type.js");
-  mock_server_->Set(kScriptURL, MockHTTPServer::Response(
-                                    std::string("HTTP/1.1 200 OK\n"
-                                                "Content-Type: text/css\n\n"),
-                                    std::string("body with bad MIME type")));
+  mock_server_.Set(kScriptURL, MockHTTPServer::Response(
+                                   std::string("HTTP/1.1 200 OK\n"
+                                               "Content-Type: text/css\n\n"),
+                                   std::string("body with bad MIME type")));
   SetUpRegistration(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
@@ -498,12 +490,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Success_PathRestriction) {
   // Service-Worker-Allowed header allows it.
   const GURL kScriptURL("https://example.com/out-of-scope/normal.js");
   const GURL kScope("https://example.com/in-scope/");
-  mock_server_->Set(kScriptURL,
-                    MockHTTPServer::Response(
-                        std::string("HTTP/1.1 200 OK\n"
-                                    "Content-Type: text/javascript\n"
-                                    "Service-Worker-Allowed: /in-scope/\n\n"),
-                        std::string("٩( ’ω’ )و I'm body!")));
+  mock_server_.Set(kScriptURL,
+                   MockHTTPServer::Response(
+                       std::string("HTTP/1.1 200 OK\n"
+                                   "Content-Type: text/javascript\n"
+                                   "Service-Worker-Allowed: /in-scope/\n\n"),
+                       std::string("٩( ’ω’ )و I'm body!")));
   blink::mojom::ServiceWorkerRegistrationOptions options;
   options.scope = kScope;
   SetUpRegistrationWithOptions(kScriptURL, options);
@@ -517,7 +509,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Success_PathRestriction) {
   std::string response;
   EXPECT_TRUE(
       mojo::BlockingCopyToString(client->response_body_release(), &response));
-  EXPECT_EQ(mock_server_->Get(kScriptURL).body, response);
+  EXPECT_EQ(mock_server_.Get(kScriptURL).body, response);
 
   // WRITE_OK should be recorded once plus one as we record a single write
   // success and the end of the body.
@@ -536,7 +528,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Error_PathRestriction) {
   // Service-Worker-Allowed header is not specified.
   const GURL kScriptURL("https://example.com/out-of-scope/normal.js");
   const GURL kScope("https://example.com/in-scope/");
-  mock_server_->Set(
+  mock_server_.Set(
       kScriptURL,
       MockHTTPServer::Response(std::string("HTTP/1.1 200 OK\n"
                                            "Content-Type: text/javascript\n\n"),
@@ -596,7 +588,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, Update) {
   ActivateVersion();
 
   // Change the script on the server.
-  mock_server_->Set(
+  mock_server_.Set(
       kScriptURL,
       MockHTTPServer::Response(std::string("HTTP/1.1 200 OK\n"
                                            "Content-Type: text/javascript\n\n"),
@@ -650,12 +642,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_All) {
   // since last update time is null.
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  network::ResourceRequest request = mock_url_loader_factory_->last_request();
+  network::ResourceRequest request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   // Promote to active and prepare to update.
@@ -667,12 +659,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_All) {
   SetUpVersion(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_FALSE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_FALSE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   // Set update check to far in the past and repeat. The requests should
@@ -683,12 +675,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_All) {
   SetUpVersion(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 }
 
@@ -710,12 +702,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_Imports) {
   // since last update time is null.
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  network::ResourceRequest request = mock_url_loader_factory_->last_request();
+  network::ResourceRequest request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   // Promote to active and prepare to update.
@@ -727,12 +719,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_Imports) {
   SetUpVersion(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_FALSE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   // Set the time to far in the past and repeat. The requests should validate
@@ -743,12 +735,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_Imports) {
   SetUpVersion(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 }
 
@@ -769,12 +761,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_None) {
   // since kNone (and the last update time is null anyway).
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  network::ResourceRequest request = mock_url_loader_factory_->last_request();
+  network::ResourceRequest request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   // Promote to active and prepare to update.
@@ -785,12 +777,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, UpdateViaCache_None) {
   SetUpVersion(kScriptURL);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 }
 
@@ -818,12 +810,12 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, ForceBypassCache) {
   // Install the main script and imported script. The cache should be validated.
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
-  network::ResourceRequest request = mock_url_loader_factory_->last_request();
+  network::ResourceRequest request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
-  request = mock_url_loader_factory_->last_request();
+  request = mock_network_.last_request();
   EXPECT_TRUE(request.load_flags & net::LOAD_VALIDATE_CACHE);
 }
 
@@ -840,7 +832,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, AccessedNetwork) {
 
   // Install the main script. The network accessed flag should be flipped on.
   version_->embedded_worker()->network_accessed_for_script_ = false;
-  mock_url_loader_factory_->set_to_access_network(true);
+  mock_network_.set_to_access_network(true);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
   EXPECT_EQ(net::OK, client->completion_status().error_code);
@@ -849,7 +841,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, AccessedNetwork) {
   // Install the imported script. The network accessed flag should be unchanged,
   // as it's only meant for main scripts.
   version_->embedded_worker()->network_accessed_for_script_ = false;
-  mock_url_loader_factory_->set_to_access_network(true);
+  mock_network_.set_to_access_network(true);
   DoRequest(kImportedScriptURL, &client, &loader);
   client->RunUntilComplete();
   EXPECT_EQ(net::OK, client->completion_status().error_code);
@@ -859,7 +851,7 @@ TEST_F(ServiceWorkerNewScriptLoaderTest, AccessedNetwork) {
   // network accessed flag should be off.
   SetUpRegistration(kScriptURL);
   version_->embedded_worker()->network_accessed_for_script_ = false;
-  mock_url_loader_factory_->set_to_access_network(false);
+  mock_network_.set_to_access_network(false);
   DoRequest(kScriptURL, &client, &loader);
   client->RunUntilComplete();
   EXPECT_EQ(net::OK, client->completion_status().error_code);
diff --git a/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc b/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc
index c114ced040c..f516a5d321c 100644
--- a/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_object_host_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/bind_helpers.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
 #include "content/browser/service_worker/fake_embedded_worker_instance_client.h"
@@ -219,7 +220,7 @@ TEST_F(ServiceWorkerObjectHostTest, OnVersionStateChanged) {
       CreateProviderHostForWindow(
           helper_->mock_render_process_id(), true /* is_parent_frame_secure */,
           helper_->context()->AsWeakPtr(), &remote_endpoint);
-  provider_host->UpdateUrls(scope, scope);
+  provider_host->UpdateUrls(scope, scope, url::Origin::Create(scope));
   blink::mojom::ServiceWorkerRegistrationObjectInfoPtr registration_info =
       GetRegistrationFromRemote(remote_endpoint.host_remote()->get(), scope);
   // |version_| is the installing version of |registration_| now.
@@ -251,54 +252,88 @@ TEST_F(ServiceWorkerObjectHostTest,
   tick_clock.SetNowTicks(base::TimeTicks::Now());
   version_->SetTickClockForTesting(&tick_clock);
 
-  // Make sure worker has a non-zero timeout.
-  bool called = false;
-  blink::ServiceWorkerStatusCode status =
-      blink::ServiceWorkerStatusCode::kErrorFailed;
-  version_->StartWorker(ServiceWorkerMetrics::EventType::UNKNOWN,
-                        base::BindOnce(&SaveStatusCallback, &called, &status));
-  base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(called);
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status);
-  version_->StartRequestWithCustomTimeout(
-      ServiceWorkerMetrics::EventType::ACTIVATE, base::DoNothing(),
-      base::TimeDelta::FromSeconds(10), ServiceWorkerVersion::KILL_ON_TIMEOUT);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
+
+  const base::TimeDelta kRequestTimeout = base::TimeDelta::FromMinutes(5);
+  const base::TimeDelta kFourSeconds = base::TimeDelta::FromSeconds(4);
 
-  // Advance clock by a couple seconds.
-  tick_clock.Advance(base::TimeDelta::FromSeconds(4));
-  base::TimeDelta remaining_time = version_->remaining_timeout();
-  EXPECT_EQ(base::TimeDelta::FromSeconds(6), remaining_time);
+  // After startup, the remaining timeout is expected to be kRequestTimeout.
+  EXPECT_EQ(kRequestTimeout, version_->remaining_timeout());
 
   // This test will simulate the worker calling postMessage() on itself.
   // Prepare |object_host|. This corresponds to the JavaScript ServiceWorker
   // object for the service worker, inside the service worker's own
   // execution context (e.g., self.registration.active inside the active
-  // worker).
+  // worker and self.serviceWorker).
   ServiceWorkerProviderHost* provider_host = version_->provider_host();
   blink::mojom::ServiceWorkerObjectInfoPtr info =
       provider_host->GetOrCreateServiceWorkerObjectHost(version_)
           ->CreateCompleteObjectInfoToSend();
   ServiceWorkerObjectHost* object_host =
       GetServiceWorkerObjectHost(provider_host, version_->version_id());
-  EXPECT_EQ(1u, GetReceiverCount(object_host));
+  EXPECT_EQ(2u, GetReceiverCount(object_host));
 
-  // Now simulate the service worker calling postMessage() to itself,
-  // by calling DispatchExtendableMessageEvent on |object_host|.
-  blink::TransferableMessage message;
-  SetUpDummyMessagePort(&message.ports);
-  called = false;
-  status = blink::ServiceWorkerStatusCode::kErrorFailed;
-  CallDispatchExtendableMessageEvent(
-      object_host, std::move(message),
-      base::BindOnce(&SaveStatusCallback, &called, &status));
-  base::RunLoop().RunUntilIdle();
-  EXPECT_TRUE(called);
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status);
+  {
+    // Advance clock by four seconds.
+    tick_clock.Advance(kFourSeconds);
+    base::TimeDelta remaining_time = version_->remaining_timeout();
+    EXPECT_EQ(kRequestTimeout - kFourSeconds, remaining_time);
+
+    // Now simulate the service worker calling postMessage() to itself,
+    // by calling DispatchExtendableMessageEvent on |object_host|.
+    // Expected status is kOk.
+    blink::TransferableMessage message;
+    SetUpDummyMessagePort(&message.ports);
+    base::RunLoop loop;
+    CallDispatchExtendableMessageEvent(
+        object_host, std::move(message),
+        base::BindLambdaForTesting([&](blink::ServiceWorkerStatusCode status) {
+          EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status);
+          loop.Quit();
+        }));
+    loop.Run();
+
+    // The dispatched ExtendableMessageEvent should be received
+    // by the worker, and the source service worker object info
+    // should be for its own version id.
+    EXPECT_EQ(3u, GetReceiverCount(object_host));
+
+    // Message event triggered by the service worker itself should not extend
+    // the timeout.
+    EXPECT_EQ(remaining_time, version_->remaining_timeout());
+  }
+
+  {
+    // Advance clock by request timeout.
+    tick_clock.Advance(kRequestTimeout);
+    base::TimeDelta remaining_time = version_->remaining_timeout();
+    EXPECT_EQ(kRequestTimeout - kFourSeconds - kRequestTimeout, remaining_time);
+
+    // Now simulate the service worker calling postMessage() to itself,
+    // by calling DispatchExtendableMessageEvent on |object_host|.
+    // Expected status is kErrorTimeout.
+    blink::TransferableMessage message;
+    SetUpDummyMessagePort(&message.ports);
+    base::RunLoop loop;
+    CallDispatchExtendableMessageEvent(
+        object_host, std::move(message),
+        base::BindLambdaForTesting([&](blink::ServiceWorkerStatusCode status) {
+          EXPECT_EQ(blink::ServiceWorkerStatusCode::kErrorTimeout, status);
+          loop.Quit();
+        }));
+    loop.Run();
+
+    // The dispatched ExtendableMessageEvent should not be received
+    // by the worker, and the source service worker object info
+    // should be for its own version id.
+    EXPECT_EQ(3u, GetReceiverCount(object_host));
+
+    // Message event triggered by the service worker itself should not extend
+    // the timeout.
+    EXPECT_EQ(remaining_time, version_->remaining_timeout());
+  }
 
-  // The dispatched ExtendableMessageEvent should be received
-  // by the worker, and the source service worker object info
-  // should be for its own version id.
-  EXPECT_EQ(2u, GetReceiverCount(object_host));
   const std::vector<blink::mojom::ExtendableMessageEventPtr>& events =
       worker->events();
   EXPECT_EQ(1u, events.size());
@@ -307,12 +342,8 @@ TEST_F(ServiceWorkerObjectHostTest,
   EXPECT_EQ(version_->version_id(),
             events[0]->source_info_for_service_worker->version_id);
 
-  // Timeout of message event should not have extended life of service worker.
-  EXPECT_EQ(remaining_time, version_->remaining_timeout());
   // Clean up.
-  base::RunLoop stop_loop;
-  version_->StopWorker(stop_loop.QuitClosure());
-  stop_loop.Run();
+  StopServiceWorker(version_.get());
 }
 
 // Tests postMessage() from a page to a service worker.
@@ -338,7 +369,7 @@ TEST_F(ServiceWorkerObjectHostTest, DispatchExtendableMessageEvent_FromClient) {
           frame_host->GetProcess()->GetID(), true /* is_parent_frame_secure */,
           helper_->context()->AsWeakPtr(), &remote_endpoint);
   SetProviderHostRenderFrameId(provider_host.get(), frame_host->GetRoutingID());
-  provider_host->UpdateUrls(scope, scope);
+  provider_host->UpdateUrls(scope, scope, url::Origin::Create(scope));
 
   // Prepare a ServiceWorkerObjectHost for the worker.
   blink::mojom::ServiceWorkerObjectInfoPtr info =
diff --git a/chromium/content/browser/service_worker/service_worker_process_browsertest.cc b/chromium/content/browser/service_worker/service_worker_process_browsertest.cc
new file mode 100644
index 00000000000..07224df0893
--- /dev/null
+++ b/chromium/content/browser/service_worker/service_worker_process_browsertest.cc
@@ -0,0 +1,227 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/command_line.h"
+#include "base/memory/scoped_refptr.h"
+#include "base/run_loop.h"
+#include "base/test/bind_test_util.h"
+#include "base/test/scoped_feature_list.h"
+#include "content/browser/frame_host/render_frame_host_impl.h"
+#include "content/browser/service_worker/service_worker_context_wrapper.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "content/test/test_content_browser_client.h"
+#include "net/dns/mock_host_resolver.h"
+
+// This file has tests involving render process selection for service workers.
+
+namespace content {
+
+class ServiceWorkerProcessBrowserTest
+    : public ContentBrowserTest,
+      public ::testing::WithParamInterface<bool> {
+ public:
+  ServiceWorkerProcessBrowserTest() {
+    feature_list_.InitAndEnableFeature(
+        features::kServiceWorkerPrefersUnusedProcess);
+  }
+  ~ServiceWorkerProcessBrowserTest() override = default;
+
+  ServiceWorkerProcessBrowserTest(const ServiceWorkerProcessBrowserTest&) =
+      delete;
+  ServiceWorkerProcessBrowserTest& operator=(
+      const ServiceWorkerProcessBrowserTest&) = delete;
+
+  void SetUpOnMainThread() override {
+    // Support multiple sites on the test server.
+    host_resolver()->AddRule("*", "127.0.0.1");
+    ASSERT_TRUE(embedded_test_server()->Start());
+
+    StoragePartition* partition = BrowserContext::GetDefaultStoragePartition(
+        shell()->web_contents()->GetBrowserContext());
+    wrapper_ = static_cast<ServiceWorkerContextWrapper*>(
+        partition->GetServiceWorkerContext());
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    if (SitePerProcess()) {
+      command_line->AppendSwitch(switches::kSitePerProcess);
+    } else {
+      command_line->RemoveSwitch(switches::kSitePerProcess);
+      command_line->AppendSwitch(switches::kDisableSiteIsolation);
+    }
+  }
+
+ protected:
+  bool SitePerProcess() const { return GetParam(); }
+
+  // Registers a service worker and then tears down the process it used, for a
+  // clean slate going forward.
+  void RegisterServiceWorker() {
+    // Load a page that registers a service worker.
+    Shell* start_shell = CreateBrowser();
+    ASSERT_TRUE(NavigateToURL(
+        start_shell, embedded_test_server()->GetURL(
+                         "/service_worker/create_service_worker.html")));
+    ASSERT_EQ("DONE",
+              EvalJs(start_shell, "register('fetch_event_pass_through.js');"));
+
+    auto* host = RenderProcessHost::FromID(GetServiceWorkerProcessId());
+    ASSERT_TRUE(host);
+    RenderProcessHostWatcher exit_watcher(
+        host, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
+
+    // Tear down the page.
+    start_shell->Close();
+
+    // Stop the service worker. The process should exit.
+    base::RunLoop loop;
+    wrapper()->StopAllServiceWorkers(loop.QuitClosure());
+    loop.Run();
+    exit_watcher.Wait();
+  }
+
+  // Returns the number of running service workers.
+  size_t GetRunningServiceWorkerCount() {
+    return wrapper()->GetRunningServiceWorkerInfos().size();
+  }
+
+  // Returns the process id of the running service worker. There must be exactly
+  // one service worker running.
+  int GetServiceWorkerProcessId() {
+    const base::flat_map<int64_t, ServiceWorkerRunningInfo>& infos =
+        wrapper()->GetRunningServiceWorkerInfos();
+    DCHECK_EQ(infos.size(), 1u);
+    const ServiceWorkerRunningInfo& info = infos.begin()->second;
+    return info.render_process_id;
+  }
+
+  ServiceWorkerContextWrapper* wrapper() { return wrapper_.get(); }
+
+  WebContentsImpl* web_contents() {
+    return static_cast<WebContentsImpl*>(shell()->web_contents());
+  }
+
+  RenderFrameHostImpl* current_frame_host() {
+    return web_contents()->GetFrameTree()->root()->current_frame_host();
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+  scoped_refptr<ServiceWorkerContextWrapper> wrapper_;
+};
+
+// Tests that a service worker started due to a navigation shares the same
+// process as the navigation.
+IN_PROC_BROWSER_TEST_P(ServiceWorkerProcessBrowserTest,
+                       ServiceWorkerAndPageShareProcess) {
+  // Register the service worker.
+  RegisterServiceWorker();
+
+  // Navigate to a page in the service worker's scope.
+  ASSERT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/service_worker/empty.html")));
+
+  // The page and service worker should be in the same process.
+  int page_process_id = current_frame_host()->GetProcess()->GetID();
+  EXPECT_NE(page_process_id, ChildProcessHost::kInvalidUniqueID);
+  ASSERT_EQ(GetRunningServiceWorkerCount(), 1u);
+  int worker_process_id = GetServiceWorkerProcessId();
+  EXPECT_EQ(page_process_id, worker_process_id);
+}
+
+namespace {
+
+// ContentBrowserClient that skips assigning a site URL for a given URL.
+class DontAssignSiteContentBrowserClient : public TestContentBrowserClient {
+ public:
+  // Any visit to |url_to_skip| will not cause the site to be assigned to the
+  // SiteInstance.
+  explicit DontAssignSiteContentBrowserClient(const GURL& url_to_skip)
+      : url_to_skip_(url_to_skip) {}
+
+  DontAssignSiteContentBrowserClient(
+      const DontAssignSiteContentBrowserClient&) = delete;
+  DontAssignSiteContentBrowserClient& operator=(
+      const DontAssignSiteContentBrowserClient&) = delete;
+
+  bool ShouldAssignSiteForURL(const GURL& url) override {
+    return url != url_to_skip_;
+  }
+
+ private:
+  GURL url_to_skip_;
+};
+
+}  // namespace
+
+// Tests that a service worker and navigation share the same process in the
+// special case where the service worker starts before the navigation starts,
+// and the navigation transitions out of a page with no site URL. This special
+// case happens in real life when doing a search from the omnibox while on the
+// Android native NTP page: the service worker starts first due to the
+// navigation hint from the omnibox, and the native page has no site URL. See
+// https://crbug.com/1012143.
+IN_PROC_BROWSER_TEST_P(
+    ServiceWorkerProcessBrowserTest,
+    ServiceWorkerAndPageShareProcess_NavigateFromUnassignedSiteInstance) {
+  // Set up a page URL that will have no site URL.
+  GURL empty_site = embedded_test_server()->GetURL("a.com", "/title1.html");
+  DontAssignSiteContentBrowserClient content_browser_client(empty_site);
+  ContentBrowserClient* old_client =
+      SetBrowserClientForTesting(&content_browser_client);
+
+  // Register the service worker.
+  RegisterServiceWorker();
+
+  // Navigate to the empty site instance page.
+  ASSERT_TRUE(NavigateToURL(shell(), empty_site));
+  EXPECT_EQ(web_contents()->GetLastCommittedURL(), empty_site);
+  scoped_refptr<SiteInstanceImpl> site_instance =
+      web_contents()->GetMainFrame()->GetSiteInstance();
+  EXPECT_EQ(GURL(), site_instance->GetSiteURL());
+  int page_process_id = current_frame_host()->GetProcess()->GetID();
+  EXPECT_NE(page_process_id, ChildProcessHost::kInvalidUniqueID);
+
+  // Start the service worker. It should start in the same process.
+  base::RunLoop loop;
+  GURL scope = embedded_test_server()->GetURL("/service_worker/");
+  int worker_process_id;
+  wrapper()->StartWorkerForScope(
+      scope,
+      base::BindLambdaForTesting(
+          [&](int64_t version_id, int process_id, int thread_id) {
+            worker_process_id = process_id;
+            loop.Quit();
+          }),
+      base::BindLambdaForTesting([&loop]() {
+        ASSERT_FALSE(true) << "start worker failed";
+        loop.Quit();
+      }));
+  loop.Run();
+
+  // The page and service worker should be in the same process.
+  EXPECT_EQ(page_process_id, worker_process_id);
+
+  // Navigate to a page in the service worker's scope. It should still be in the
+  // same process.
+  ASSERT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/service_worker/empty.html")));
+  EXPECT_EQ(page_process_id, current_frame_host()->GetProcess()->GetID());
+
+  SetBrowserClientForTesting(old_client);
+}
+
+// Toggle Site Isolation.
+INSTANTIATE_TEST_SUITE_P(, ServiceWorkerProcessBrowserTest, testing::Bool());
+
+}  // namespace content
diff --git a/chromium/content/browser/service_worker/service_worker_provider_host.cc b/chromium/content/browser/service_worker/service_worker_provider_host.cc
index af11310536b..95c8b01b794 100644
--- a/chromium/content/browser/service_worker/service_worker_provider_host.cc
+++ b/chromium/content/browser/service_worker/service_worker_provider_host.cc
@@ -31,6 +31,7 @@
 #include "content/browser/web_contents/frame_tree_node_id_registry.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
@@ -41,6 +42,8 @@
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/origin_util.h"
+#include "media/mojo/services/video_decode_perf_history.h"
+#include "mojo/public/cpp/bindings/callback_helpers.h"
 #include "mojo/public/cpp/bindings/message.h"
 #include "net/base/url_util.h"
 #include "services/network/public/cpp/resource_request_body.h"
@@ -77,8 +80,8 @@ void GetInterfaceImpl(const std::string& interface_name,
         std::move(interface_pipe));
     process->GetStoragePartition()->CreateRestrictedCookieManager(
         network::mojom::RestrictedCookieManagerRole::SCRIPT, origin,
-        true /* is_service_worker */, process_id, MSG_ROUTING_NONE,
-        std::move(receiver));
+        origin.GetURL(), origin, true /* is_service_worker */, process_id,
+        MSG_ROUTING_NONE, std::move(receiver));
     return;
   }
 
@@ -86,6 +89,66 @@ void GetInterfaceImpl(const std::string& interface_name,
                       origin);
 }
 
+void BindVideoDecodePerfHistoryImpl(
+    int process_id,
+    mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  auto* process = RenderProcessHost::FromID(process_id);
+  if (!process)
+    return;
+
+  process->GetBrowserContext()->GetVideoDecodePerfHistory()->BindReceiver(
+      std::move(receiver));
+}
+
+void CreateLockManagerImpl(
+    const url::Origin& origin,
+    int process_id,
+    mojo::PendingReceiver<blink::mojom::LockManager> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  auto* process = RenderProcessHost::FromID(process_id);
+  if (!process)
+    return;
+
+  process->CreateLockManager(MSG_ROUTING_NONE, origin, std::move(receiver));
+}
+
+void CreateIDBFactoryImpl(
+    const url::Origin& origin,
+    int process_id,
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  auto* process = RenderProcessHost::FromID(process_id);
+  if (!process)
+    return;
+
+  process->BindIndexedDB(MSG_ROUTING_NONE, origin, std::move(receiver));
+}
+
+void CreatePermissionServiceImpl(
+    const url::Origin& origin,
+    int process_id,
+    mojo::PendingReceiver<blink::mojom::PermissionService> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  auto* process = RenderProcessHost::FromID(process_id);
+  if (!process)
+    return;
+
+  process->CreatePermissionService(origin, std::move(receiver));
+}
+
+void CreatePaymentManagerImpl(
+    const url::Origin& origin,
+    int process_id,
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  auto* process = RenderProcessHost::FromID(process_id);
+  if (!process)
+    return;
+
+  process->CreatePaymentManagerForOrigin(origin, std::move(receiver));
+}
+
 ServiceWorkerMetrics::EventType PurposeToEventType(
     blink::mojom::ControllerServiceWorkerPurpose purpose) {
   switch (purpose) {
@@ -162,7 +225,7 @@ ServiceWorkerProviderHost::PreCreateNavigationHost(
 
 // static
 base::WeakPtr<ServiceWorkerProviderHost>
-ServiceWorkerProviderHost::PreCreateForController(
+ServiceWorkerProviderHost::CreateForServiceWorker(
     base::WeakPtr<ServiceWorkerContextCore> context,
     scoped_refptr<ServiceWorkerVersion> version,
     blink::mojom::ServiceWorkerProviderInfoForStartWorkerPtr*
@@ -181,7 +244,7 @@ ServiceWorkerProviderHost::PreCreateForController(
 
 // static
 base::WeakPtr<ServiceWorkerProviderHost>
-ServiceWorkerProviderHost::PreCreateForWebWorker(
+ServiceWorkerProviderHost::CreateForWebWorker(
     base::WeakPtr<ServiceWorkerContextCore> context,
     int process_id,
     blink::mojom::ServiceWorkerProviderType provider_type,
@@ -378,8 +441,10 @@ ServiceWorkerProviderHost::GetRemoteControllerServiceWorker() {
   return remote_controller;
 }
 
-void ServiceWorkerProviderHost::UpdateUrls(const GURL& url,
-                                           const GURL& site_for_cookies) {
+void ServiceWorkerProviderHost::UpdateUrls(
+    const GURL& url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
   DCHECK(IsProviderForClient());
   DCHECK(!url.has_ref());
   DCHECK(!controller());
@@ -387,6 +452,8 @@ void ServiceWorkerProviderHost::UpdateUrls(const GURL& url,
   GURL previous_url = url_;
   url_ = url;
   site_for_cookies_ = site_for_cookies;
+  top_frame_origin_ = top_frame_origin;
+
   if (previous_url != url) {
     // Revoke the token on URL change since any service worker holding the token
     // may no longer be the potential controller of this frame and shouldn't
@@ -440,6 +507,13 @@ const GURL& ServiceWorkerProviderHost::site_for_cookies() const {
   return running_hosted_version_->script_url();
 }
 
+base::Optional<url::Origin> ServiceWorkerProviderHost::top_frame_origin()
+    const {
+  if (IsProviderForClient())
+    return top_frame_origin_;
+  return url::Origin::Create(running_hosted_version_->script_url());
+}
+
 void ServiceWorkerProviderHost::UpdateController(bool notify_controllerchange) {
   ServiceWorkerVersion* version =
       controller_registration_ ? controller_registration_->active_version()
@@ -543,8 +617,8 @@ void ServiceWorkerProviderHost::RemoveMatchingRegistration(
   matching_registrations_.erase(key);
 }
 
-ServiceWorkerRegistration*
-ServiceWorkerProviderHost::MatchRegistration() const {
+ServiceWorkerRegistration* ServiceWorkerProviderHost::MatchRegistration()
+    const {
   auto it = matching_registrations_.rbegin();
   for (; it != matching_registrations_.rend(); ++it) {
     if (it->second->is_uninstalled())
@@ -574,13 +648,13 @@ bool ServiceWorkerProviderHost::AllowServiceWorker(const GURL& scope,
   DCHECK(IsContextAlive());
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     return GetContentClient()->browser()->AllowServiceWorkerOnUI(
-        scope, site_for_cookies(), script_url,
+        scope, site_for_cookies(), top_frame_origin(), script_url,
         context_->wrapper()->browser_context(),
         base::BindRepeating(&WebContentsImpl::FromRenderFrameHostID,
                             render_process_id_, frame_id()));
   } else {
     return GetContentClient()->browser()->AllowServiceWorkerOnIO(
-        scope, site_for_cookies(), script_url,
+        scope, site_for_cookies(), top_frame_origin(), script_url,
         context_->wrapper()->resource_context(),
         base::BindRepeating(&WebContentsImpl::FromRenderFrameHostID,
                             render_process_id_, frame_id()));
@@ -916,11 +990,25 @@ void ServiceWorkerProviderHost::Register(
   TRACE_EVENT_ASYNC_BEGIN2(
       "ServiceWorker", "ServiceWorkerProviderHost::Register", trace_id, "Scope",
       options->scope.spec(), "Script URL", script_url.spec());
+
+  // Wrap the callback with default invoke before passing it, since
+  // RegisterServiceWorker() can drop the callback on service worker
+  // context core shutdown (i.e., browser session shutdown or
+  // DeleteAndStartOver()) and a DCHECK would happen.
+  // TODO(crbug.com/1002776): Remove this wrapper and have the Mojo connections
+  // drop during shutdown, so the callback can be dropped without crash. Note
+  // that we currently would need to add this WrapCallback to *ALL* Mojo
+  // callbacks that go through ServiceWorkerContextCore or its members like
+  // ServiceWorkerStorage. We're only adding it to Register() now because a
+  // browser test fails without it.
+  auto wrapped_callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(
+      std::move(callback), blink::mojom::ServiceWorkerErrorType::kUnknown,
+      std::string(), nullptr);
   context_->RegisterServiceWorker(
       script_url, *options,
       base::BindOnce(&ServiceWorkerProviderHost::RegistrationComplete,
                      AsWeakPtr(), GURL(script_url), GURL(options->scope),
-                     std::move(callback), trace_id,
+                     std::move(wrapped_callback), trace_id,
                      mojo::GetBadMessageCallback()));
 }
 
@@ -1289,6 +1377,21 @@ ServiceWorkerProviderHost::CreateServiceWorkerRegistrationObjectInfo(
   return registration_object_hosts_[registration_id]->CreateObjectInfo();
 }
 
+blink::mojom::ServiceWorkerObjectInfoPtr
+ServiceWorkerProviderHost::CreateServiceWorkerObjectInfoToSend(
+    scoped_refptr<ServiceWorkerVersion> version) {
+  int64_t version_id = version->version_id();
+  auto existing_object_host = service_worker_object_hosts_.find(version_id);
+  if (existing_object_host != service_worker_object_hosts_.end()) {
+    return existing_object_host->second->CreateCompleteObjectInfoToSend();
+  }
+  service_worker_object_hosts_[version_id] =
+      std::make_unique<ServiceWorkerObjectHost>(context_, this,
+                                                std::move(version));
+  return service_worker_object_hosts_[version_id]
+      ->CreateCompleteObjectInfoToSend();
+}
+
 template <typename CallbackType, typename... Args>
 bool ServiceWorkerProviderHost::CanServeContainerHostMethods(
     CallbackType* callback,
@@ -1352,6 +1455,60 @@ bool ServiceWorkerProviderHost::is_execution_ready() const {
   return client_phase_ == ClientPhase::kExecutionReady;
 }
 
+void ServiceWorkerProviderHost::CreateLockManager(
+    mojo::PendingReceiver<blink::mojom::LockManager> receiver) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsProviderForServiceWorker());
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&CreateLockManagerImpl,
+                     running_hosted_version_->script_origin(),
+                     render_process_id_, std::move(receiver)));
+}
+
+void ServiceWorkerProviderHost::CreateIDBFactory(
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsProviderForServiceWorker());
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&CreateIDBFactoryImpl,
+                     running_hosted_version_->script_origin(),
+                     render_process_id_, std::move(receiver)));
+}
+
+void ServiceWorkerProviderHost::BindVideoDecodePerfHistory(
+    mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsProviderForServiceWorker());
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&BindVideoDecodePerfHistoryImpl, render_process_id_,
+                     std::move(receiver)));
+}
+
+void ServiceWorkerProviderHost::CreatePermissionService(
+    mojo::PendingReceiver<blink::mojom::PermissionService> receiver) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsProviderForServiceWorker());
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&CreatePermissionServiceImpl,
+                     running_hosted_version_->script_origin(),
+                     render_process_id_, std::move(receiver)));
+}
+
+void ServiceWorkerProviderHost::CreatePaymentManager(
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
+  DCHECK_CURRENTLY_ON(ServiceWorkerContext::GetCoreThreadId());
+  DCHECK(IsProviderForServiceWorker());
+  RunOrPostTaskOnThread(
+      FROM_HERE, BrowserThread::UI,
+      base::BindOnce(&CreatePaymentManagerImpl,
+                     running_hosted_version_->script_origin(),
+                     render_process_id_, std::move(receiver)));
+}
+
 void ServiceWorkerProviderHost::SetExecutionReady() {
   DCHECK(!is_execution_ready());
   TransitionToClientPhase(ClientPhase::kExecutionReady);
diff --git a/chromium/content/browser/service_worker/service_worker_provider_host.h b/chromium/content/browser/service_worker/service_worker_provider_host.h
index f229fac5e1f..9c8b5f0e3ea 100644
--- a/chromium/content/browser/service_worker/service_worker_provider_host.h
+++ b/chromium/content/browser/service_worker/service_worker_provider_host.h
@@ -25,6 +25,7 @@
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/common/content_export.h"
 #include "content/public/common/resource_type.h"
+#include "media/mojo/mojom/video_decode_perf_history.mojom.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/binding.h"
@@ -35,11 +36,16 @@
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/mojom/fetch_api.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
+#include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom-forward.h"
+#include "third_party/blink/public/mojom/locks/lock_manager.mojom-forward.h"
+#include "third_party/blink/public/mojom/payments/payment_app.mojom-forward.h"
+#include "third_party/blink/public/mojom/permissions/permission.mojom-forward.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_container.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider_type.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
+#include "url/origin.h"
 
 namespace service_worker_object_host_unittest {
 class ServiceWorkerObjectHostTest;
@@ -98,8 +104,8 @@ class WebContents;
 // pre-created by the browser process and the provider info is sent in the
 // navigation commit IPC.
 //
-// 2) For shared workers and for service workers, the provider host is
-// pre-created by the browser process and the provider info is sent in the start
+// 2) For web workers and for service workers, the provider host is
+// created by the browser process and the provider info is sent in the start
 // worker IPC message.
 class CONTENT_EXPORT ServiceWorkerProviderHost
     : public ServiceWorkerRegistration::Listener,
@@ -135,7 +141,7 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   // |out_provider_info->host_remote| stays alive).
   // CompleteStartWorkerPreparation() must be called later to get a full info to
   // send to the renderer.
-  static base::WeakPtr<ServiceWorkerProviderHost> PreCreateForController(
+  static base::WeakPtr<ServiceWorkerProviderHost> CreateForServiceWorker(
       base::WeakPtr<ServiceWorkerContextCore> context,
       scoped_refptr<ServiceWorkerVersion> version,
       blink::mojom::ServiceWorkerProviderInfoForStartWorkerPtr*
@@ -144,7 +150,7 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   // Used for starting a web worker (dedicated worker or shared worker). Returns
   // a provider host for the worker. The host stays alive as long as the
   // corresponding host for |host_receiver| stays alive.
-  static base::WeakPtr<ServiceWorkerProviderHost> PreCreateForWebWorker(
+  static base::WeakPtr<ServiceWorkerProviderHost> CreateForWebWorker(
       base::WeakPtr<ServiceWorkerContextCore> context,
       int process_id,
       blink::mojom::ServiceWorkerProviderType provider_type,
@@ -242,9 +248,12 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   mojo::Remote<blink::mojom::ControllerServiceWorker>
   GetRemoteControllerServiceWorker();
 
-  // For service worker clients. Sets |url_| and |site_for_cookies_| and updates
-  // the client uuid if it's a cross-origin transition.
-  void UpdateUrls(const GURL& url, const GURL& site_for_cookies);
+  // For service worker clients. Sets |url_|, |site_for_cookies_| and
+  // |top_frame_origin_| and updates the client uuid if it's a cross-origin
+  // transition.
+  void UpdateUrls(const GURL& url,
+                  const GURL& site_for_cookies,
+                  const base::Optional<url::Origin>& top_frame_origin);
 
   // The URL of this context. For service worker clients, this is the document
   // URL (for documents) or script URL (for workers). For service worker
@@ -259,12 +268,20 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   // is_response_committed() is true, the URL should no longer change.
   const GURL& url() const;
 
-  // The URL representing the first-party site for this context. See
-  // |network::ResourceRequest::site_for_cookies| for details.
+  // The URL representing the site_for_cookies for this context. See
+  // |URLRequest::site_for_cookies()| for details.
   // For service worker execution contexts, site_for_cookies() always
   // returns the service worker script URL.
   const GURL& site_for_cookies() const;
 
+  // The URL representing the first-party site for this context.
+  // For service worker execution contexts, top_frame_origin() always
+  // returns the origin of the service worker script URL.
+  // For shared worker it is the origin of the document that created the worker.
+  // For dedicated worker it is the top-frame origin of the document that owns
+  // the worker.
+  base::Optional<url::Origin> top_frame_origin() const;
+
   blink::mojom::ServiceWorkerProviderType provider_type() const {
     return type_;
   }
@@ -296,6 +313,14 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   CreateServiceWorkerRegistrationObjectInfo(
       scoped_refptr<ServiceWorkerRegistration> registration);
 
+  // For service worker execution contexts.
+  // Returns an object info representing |self.serviceWorker|. The object
+  // info holds a Mojo connection to the ServiceWorkerObjectHost for the
+  // |serviceWorker| to ensure the host stays alive while the object info is
+  // alive. See documentation.
+  blink::mojom::ServiceWorkerObjectInfoPtr CreateServiceWorkerObjectInfoToSend(
+      scoped_refptr<ServiceWorkerVersion> version);
+
   // Returns a ServiceWorkerObjectHost instance for |version| for this provider
   // host. A new instance is created if one does not already exist.
   // ServiceWorkerObjectHost will have an ownership of the |version|.
@@ -407,6 +432,19 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   // https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-execution-ready-flag
   bool is_execution_ready() const;
 
+  // For service worker execution contexts. Forwards |receiver| to the process
+  // host on the UI thread.
+  void CreateLockManager(
+      mojo::PendingReceiver<blink::mojom::LockManager> receiver);
+  void CreateIDBFactory(
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver);
+  void BindVideoDecodePerfHistory(
+      mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver);
+  void CreatePermissionService(
+      mojo::PendingReceiver<blink::mojom::PermissionService> receiver);
+  void CreatePaymentManager(
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
+
  private:
   // For service worker clients. The flow is kInitial -> kResponseCommitted ->
   // kExecutionReady.
@@ -625,6 +663,7 @@ class CONTENT_EXPORT ServiceWorkerProviderHost
   // For service worker clients. See comments for the getter functions.
   GURL url_;
   GURL site_for_cookies_;
+  base::Optional<url::Origin> top_frame_origin_;
 
   // Keyed by registration scope URL length.
   using ServiceWorkerRegistrationMap =
diff --git a/chromium/content/browser/service_worker/service_worker_provider_host_unittest.cc b/chromium/content/browser/service_worker/service_worker_provider_host_unittest.cc
index b80f4e1cb54..d245dd85b0e 100644
--- a/chromium/content/browser/service_worker/service_worker_provider_host_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_provider_host_unittest.cc
@@ -50,12 +50,18 @@ class ServiceWorkerTestContentClient : public TestContentClient {
 class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
  public:
   struct AllowServiceWorkerCallLog {
-    AllowServiceWorkerCallLog(const GURL& scope,
-                              const GURL& first_party,
-                              const GURL& script_url)
-        : scope(scope), first_party(first_party), script_url(script_url) {}
+    AllowServiceWorkerCallLog(
+        const GURL& scope,
+        const GURL& site_for_cookies,
+        const base::Optional<url::Origin>& top_frame_origin,
+        const GURL& script_url)
+        : scope(scope),
+          site_for_cookies(site_for_cookies),
+          top_frame_origin(top_frame_origin),
+          script_url(script_url) {}
     const GURL scope;
-    const GURL first_party;
+    const GURL site_for_cookies;
+    const base::Optional<url::Origin> top_frame_origin;
     const GURL script_url;
   };
 
@@ -63,21 +69,23 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
 
   bool AllowServiceWorkerOnIO(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       content::ResourceContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter) override {
-    logs_.emplace_back(scope, first_party, script_url);
+    logs_.emplace_back(scope, site_for_cookies, top_frame_origin, script_url);
     return false;
   }
 
   bool AllowServiceWorkerOnUI(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       content::BrowserContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter) override {
-    logs_.emplace_back(scope, first_party, script_url);
+    logs_.emplace_back(scope, site_for_cookies, top_frame_origin, script_url);
     return false;
   }
 
@@ -140,7 +148,8 @@ class ServiceWorkerProviderHostTest : public testing::Test {
       const GURL& document_url) {
     ServiceWorkerRemoteProviderEndpoint remote_endpoint;
     GURL site_for_cookies = document_url;
-    CreateProviderHostInternal(document_url, site_for_cookies,
+    url::Origin top_frame_origin = url::Origin::Create(document_url);
+    CreateProviderHostInternal(document_url, site_for_cookies, top_frame_origin,
                                &remote_endpoint);
     return remote_endpoint;
   }
@@ -148,17 +157,20 @@ class ServiceWorkerProviderHostTest : public testing::Test {
   ServiceWorkerRemoteProviderEndpoint
   PrepareServiceWorkerProviderHostWithSiteForCookies(
       const GURL& document_url,
-      const GURL& site_for_cookies) {
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin) {
     ServiceWorkerRemoteProviderEndpoint remote_endpoint;
-    CreateProviderHostInternal(document_url, site_for_cookies,
+    CreateProviderHostInternal(document_url, site_for_cookies, top_frame_origin,
                                &remote_endpoint);
     return remote_endpoint;
   }
 
   ServiceWorkerProviderHost* CreateProviderHost(const GURL& document_url) {
     GURL site_for_cookies = document_url;
+    url::Origin top_frame_origin = url::Origin::Create(document_url);
     remote_endpoints_.emplace_back();
     return CreateProviderHostInternal(document_url, site_for_cookies,
+                                      top_frame_origin,
                                       &remote_endpoints_.back());
   }
 
@@ -169,14 +181,15 @@ class ServiceWorkerProviderHostTest : public testing::Test {
         helper_->mock_render_process_id(), false /* is_parent_frame_secure */,
         helper_->context()->AsWeakPtr(), &remote_endpoints_.back());
     ServiceWorkerProviderHost* host_raw = host.get();
-    host->UpdateUrls(document_url, document_url);
+    host->UpdateUrls(document_url, document_url,
+                     url::Origin::Create(document_url));
     return host_raw;
   }
 
   void FinishNavigation(ServiceWorkerProviderHost* host) {
     // In production code, the loader/request handler does this.
     const GURL url("https://www.example.com/page");
-    host->UpdateUrls(url, url);
+    host->UpdateUrls(url, url, url::Origin::Create(url));
 
     // In production code this is called from NavigationRequest in the browser
     // process right before navigation commit.
@@ -298,11 +311,12 @@ class ServiceWorkerProviderHostTest : public testing::Test {
   ServiceWorkerProviderHost* CreateProviderHostInternal(
       const GURL& document_url,
       const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       ServiceWorkerRemoteProviderEndpoint* remote_endpoint) {
     base::WeakPtr<ServiceWorkerProviderHost> host = CreateProviderHostForWindow(
         helper_->mock_render_process_id(), true /* is_parent_frame_secure */,
         helper_->context()->AsWeakPtr(), remote_endpoint);
-    host->UpdateUrls(document_url, site_for_cookies);
+    host->UpdateUrls(document_url, site_for_cookies, top_frame_origin);
     return host.get();
   }
 
@@ -340,15 +354,19 @@ TEST_F(ServiceWorkerProviderHostTest, MatchRegistration) {
   ASSERT_EQ(nullptr, provider_host1->MatchRegistration());
 
   // SetDocumentUrl sets all of matching registrations
-  provider_host1->UpdateUrls(GURL("https://www.example.com/example1"),
-                             GURL("https://www.example.com/example1"));
+  provider_host1->UpdateUrls(
+      GURL("https://www.example.com/example1"),
+      GURL("https://www.example.com/example1"),
+      url::Origin::Create(GURL("https://www.example.com/example1")));
   ASSERT_EQ(registration2_, provider_host1->MatchRegistration());
   provider_host1->RemoveMatchingRegistration(registration2_.get());
   ASSERT_EQ(registration1_, provider_host1->MatchRegistration());
 
   // SetDocumentUrl with another origin also updates matching registrations
-  provider_host1->UpdateUrls(GURL("https://other.example.com/example"),
-                             GURL("https://other.example.com/example"));
+  provider_host1->UpdateUrls(
+      GURL("https://other.example.com/example"),
+      GURL("https://other.example.com/example"),
+      url::Origin::Create(GURL("https://other.example.com/example")));
   ASSERT_EQ(registration3_, provider_host1->MatchRegistration());
   provider_host1->RemoveMatchingRegistration(registration3_.get());
   ASSERT_EQ(nullptr, provider_host1->MatchRegistration());
@@ -362,31 +380,35 @@ TEST_F(ServiceWorkerProviderHostTest, ContextSecurity) {
           GURL("https://www.example.com/example1.html"));
 
   // Insecure document URL.
-  provider_host_secure_parent->UpdateUrls(GURL("http://host"),
-                                          GURL("http://host"));
+  provider_host_secure_parent->UpdateUrls(
+      GURL("http://host"), GURL("http://host"),
+      url::Origin::Create(GURL("http://host")));
   EXPECT_FALSE(provider_host_secure_parent->IsContextSecureForServiceWorker());
 
   // Insecure parent frame.
-  provider_host_insecure_parent->UpdateUrls(GURL("https://host"),
-                                            GURL("https://host"));
+  provider_host_insecure_parent->UpdateUrls(
+      GURL("https://host"), GURL("https://host"),
+      url::Origin::Create(GURL("https://host")));
   EXPECT_FALSE(
       provider_host_insecure_parent->IsContextSecureForServiceWorker());
 
   // Secure URL and parent frame.
-  provider_host_secure_parent->UpdateUrls(GURL("https://host"),
-                                          GURL("https://host"));
+  provider_host_secure_parent->UpdateUrls(
+      GURL("https://host"), GURL("https://host"),
+      url::Origin::Create(GURL("https://host")));
   EXPECT_TRUE(provider_host_secure_parent->IsContextSecureForServiceWorker());
 
   // Exceptional service worker scheme.
   GURL url(std::string(kServiceWorkerScheme) + "://host");
+  url::Origin origin = url::Origin::Create(url);
   EXPECT_TRUE(url.is_valid());
   EXPECT_FALSE(IsOriginSecure(url));
   EXPECT_TRUE(OriginCanAccessServiceWorkers(url));
-  provider_host_secure_parent->UpdateUrls(url, url);
+  provider_host_secure_parent->UpdateUrls(url, url, origin);
   EXPECT_TRUE(provider_host_secure_parent->IsContextSecureForServiceWorker());
 
   // Exceptional service worker scheme with insecure parent frame.
-  provider_host_insecure_parent->UpdateUrls(url, url);
+  provider_host_insecure_parent->UpdateUrls(url, url, origin);
   EXPECT_FALSE(
       provider_host_insecure_parent->IsContextSecureForServiceWorker());
 }
@@ -400,7 +422,7 @@ TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_SameOriginRedirect) {
   EXPECT_EQ(url1, host->url());
   EXPECT_EQ(url1, host->site_for_cookies());
 
-  host->UpdateUrls(url2, url2);
+  host->UpdateUrls(url2, url2, url::Origin::Create(url2));
   EXPECT_EQ(url2, host->url());
   EXPECT_EQ(url2, host->site_for_cookies());
   EXPECT_EQ(uuid1, host->client_uuid());
@@ -417,7 +439,7 @@ TEST_F(ServiceWorkerProviderHostTest, UpdateUrls_CrossOriginRedirect) {
   EXPECT_EQ(url1, host->url());
   EXPECT_EQ(url1, host->site_for_cookies());
 
-  host->UpdateUrls(url2, url2);
+  host->UpdateUrls(url2, url2, url::Origin::Create(url2));
   EXPECT_EQ(url2, host->url());
   EXPECT_EQ(url2, host->site_for_cookies());
   EXPECT_NE(uuid1, host->client_uuid());
@@ -572,7 +594,8 @@ TEST_F(ServiceWorkerProviderHostTest,
   ServiceWorkerRemoteProviderEndpoint remote_endpoint =
       PrepareServiceWorkerProviderHostWithSiteForCookies(
           GURL("https://www.example.com/foo"),
-          GURL("https://www.example.com/top"));
+          GURL("https://www.example.com/top"),
+          url::Origin::Create(GURL("https://www.example.com")));
 
   EXPECT_EQ(blink::mojom::ServiceWorkerErrorType::kDisabled,
             Register(remote_endpoint.host_remote()->get(),
@@ -582,7 +605,9 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_EQ(GURL("https://www.example.com/scope"),
             test_browser_client.logs()[0].scope);
   EXPECT_EQ(GURL("https://www.example.com/top"),
-            test_browser_client.logs()[0].first_party);
+            test_browser_client.logs()[0].site_for_cookies);
+  EXPECT_EQ(url::Origin::Create(GURL("https://www.example.com")),
+            test_browser_client.logs()[0].top_frame_origin);
   EXPECT_EQ(GURL("https://www.example.com/bar"),
             test_browser_client.logs()[0].script_url);
 
@@ -593,7 +618,9 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_EQ(GURL("https://www.example.com/foo"),
             test_browser_client.logs()[1].scope);
   EXPECT_EQ(GURL("https://www.example.com/top"),
-            test_browser_client.logs()[1].first_party);
+            test_browser_client.logs()[1].site_for_cookies);
+  EXPECT_EQ(url::Origin::Create(GURL("https://www.example.com")),
+            test_browser_client.logs()[1].top_frame_origin);
   EXPECT_EQ(GURL(), test_browser_client.logs()[1].script_url);
 
   EXPECT_EQ(blink::mojom::ServiceWorkerErrorType::kDisabled,
@@ -602,7 +629,9 @@ TEST_F(ServiceWorkerProviderHostTest,
   EXPECT_EQ(GURL("https://www.example.com/foo"),
             test_browser_client.logs()[2].scope);
   EXPECT_EQ(GURL("https://www.example.com/top"),
-            test_browser_client.logs()[2].first_party);
+            test_browser_client.logs()[2].site_for_cookies);
+  EXPECT_EQ(url::Origin::Create(GURL("https://www.example.com")),
+            *test_browser_client.logs()[2].top_frame_origin);
   EXPECT_EQ(GURL(), test_browser_client.logs()[2].script_url);
 
   SetBrowserClientForTesting(old_browser_client);
@@ -634,8 +663,9 @@ TEST_F(ServiceWorkerProviderHostTest, AllowsServiceWorker) {
   EXPECT_EQ(GURL("https://www.example.com/scope"),
             test_browser_client.logs()[0].scope);
   EXPECT_EQ(GURL("https://www.example.com/sw.js"),
-            test_browser_client.logs()[0].first_party);
-
+            test_browser_client.logs()[0].site_for_cookies);
+  EXPECT_EQ(url::Origin::Create(GURL("https://www.example.com")),
+            test_browser_client.logs()[0].top_frame_origin);
   SetBrowserClientForTesting(old_browser_client);
 }
 
@@ -917,10 +947,10 @@ void ServiceWorkerProviderHostTest::TestReservedClientsAreNotExposed(
     host_receiver =
         provider_info->host_remote.InitWithNewEndpointAndPassReceiver();
     base::WeakPtr<ServiceWorkerProviderHost> host =
-        ServiceWorkerProviderHost::PreCreateForWebWorker(
+        ServiceWorkerProviderHost::CreateForWebWorker(
             context_->AsWeakPtr(), helper_->mock_render_process_id(),
             provider_type, std::move(host_receiver), std::move(client_remote));
-    host->UpdateUrls(url, url);
+    host->UpdateUrls(url, url, url::Origin::Create(url));
     EXPECT_FALSE(CanFindClientProviderHost(host.get()));
     host->CompleteWebWorkerPreparation();
     EXPECT_TRUE(CanFindClientProviderHost(host.get()));
@@ -1000,13 +1030,13 @@ void ServiceWorkerProviderHostTest::TestClientPhaseTransition(
   host_receiver =
       provider_info->host_remote.InitWithNewEndpointAndPassReceiver();
   base::WeakPtr<ServiceWorkerProviderHost> host =
-      ServiceWorkerProviderHost::PreCreateForWebWorker(
+      ServiceWorkerProviderHost::CreateForWebWorker(
           helper_->context()->AsWeakPtr(), helper_->mock_render_process_id(),
           provider_type, std::move(host_receiver), std::move(client_remote));
   EXPECT_FALSE(host->is_response_committed());
   EXPECT_FALSE(host->is_execution_ready());
 
-  host->UpdateUrls(url, url);
+  host->UpdateUrls(url, url, url::Origin::Create(url));
   host->CompleteWebWorkerPreparation();
 
   EXPECT_TRUE(host->is_response_committed());
diff --git a/chromium/content/browser/service_worker/service_worker_register_job.cc b/chromium/content/browser/service_worker/service_worker_register_job.cc
index 7e7b87b34ac..989d323dbe9 100644
--- a/chromium/content/browser/service_worker/service_worker_register_job.cc
+++ b/chromium/content/browser/service_worker/service_worker_register_job.cc
@@ -6,6 +6,8 @@
 
 #include <stdint.h>
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/location.h"
@@ -38,7 +40,7 @@ namespace content {
 typedef ServiceWorkerRegisterJobBase::RegistrationJobType RegistrationJobType;
 
 ServiceWorkerRegisterJob::ServiceWorkerRegisterJob(
-    base::WeakPtr<ServiceWorkerContextCore> context,
+    ServiceWorkerContextCore* context,
     const GURL& script_url,
     const blink::mojom::ServiceWorkerRegistrationOptions& options)
     : context_(context),
@@ -48,14 +50,17 @@ ServiceWorkerRegisterJob::ServiceWorkerRegisterJob(
       worker_script_type_(options.type),
       update_via_cache_(options.update_via_cache),
       phase_(INITIAL),
+      is_shutting_down_(false),
       is_promise_resolved_(false),
       should_uninstall_on_failure_(false),
       force_bypass_cache_(false),
       skip_script_comparison_(false),
-      promise_resolved_status_(blink::ServiceWorkerStatusCode::kOk) {}
+      promise_resolved_status_(blink::ServiceWorkerStatusCode::kOk) {
+  DCHECK(context_);
+}
 
 ServiceWorkerRegisterJob::ServiceWorkerRegisterJob(
-    base::WeakPtr<ServiceWorkerContextCore> context,
+    ServiceWorkerContextCore* context,
     ServiceWorkerRegistration* registration,
     bool force_bypass_cache,
     bool skip_script_comparison)
@@ -64,17 +69,19 @@ ServiceWorkerRegisterJob::ServiceWorkerRegisterJob(
       scope_(registration->scope()),
       update_via_cache_(registration->update_via_cache()),
       phase_(INITIAL),
+      is_shutting_down_(false),
       is_promise_resolved_(false),
       should_uninstall_on_failure_(false),
       force_bypass_cache_(force_bypass_cache),
       skip_script_comparison_(skip_script_comparison),
       promise_resolved_status_(blink::ServiceWorkerStatusCode::kOk) {
+  DCHECK(context_);
   internal_.registration = registration;
 }
 
 ServiceWorkerRegisterJob::~ServiceWorkerRegisterJob() {
-  DCHECK(!context_ ||
-         phase_ == INITIAL || phase_ == COMPLETE || phase_ == ABORT)
+  DCHECK(is_shutting_down_ || phase_ == INITIAL || phase_ == COMPLETE ||
+         phase_ == ABORT)
       << "Jobs should only be interrupted during shutdown.";
 }
 
@@ -135,6 +142,10 @@ void ServiceWorkerRegisterJob::Abort() {
   // the jobs from the queue.
 }
 
+void ServiceWorkerRegisterJob::WillShutDown() {
+  is_shutting_down_ = true;
+}
+
 bool ServiceWorkerRegisterJob::Equals(ServiceWorkerRegisterJobBase* job) const {
   if (job->GetType() != job_type_)
     return false;
@@ -167,8 +178,7 @@ ServiceWorkerRegistration* ServiceWorkerRegisterJob::registration() const {
   return internal_.registration.get();
 }
 
-void ServiceWorkerRegisterJob::set_new_version(
-    ServiceWorkerVersion* version) {
+void ServiceWorkerRegisterJob::set_new_version(ServiceWorkerVersion* version) {
   DCHECK(phase_ == UPDATE) << phase_;
   DCHECK(!internal_.new_version.get());
   internal_.new_version = version;
@@ -340,8 +350,7 @@ void ServiceWorkerRegisterJob::TriggerUpdateCheckInBrowser(
   update_checker_ = std::make_unique<ServiceWorkerUpdateChecker>(
       std::move(resources), script_url_, script_resource_id, version_to_update,
       std::move(loader_factory), force_bypass_cache_,
-      registration()->update_via_cache(), time_since_last_check,
-      context_.get());
+      registration()->update_via_cache(), time_since_last_check, context_);
   update_checker_->Start(
       base::BindOnce(&ServiceWorkerRegisterJob::OnUpdateCheckFinished,
                      weak_factory_.GetWeakPtr()));
@@ -404,8 +413,8 @@ void ServiceWorkerRegisterJob::RegisterAndContinue() {
 
   blink::mojom::ServiceWorkerRegistrationOptions options(
       scope_, worker_script_type_, update_via_cache_);
-  set_registration(
-      new ServiceWorkerRegistration(options, registration_id, context_));
+  set_registration(new ServiceWorkerRegistration(options, registration_id,
+                                                 context_->AsWeakPtr()));
   AddRegistrationToMatchingProviderHosts(registration());
   UpdateAndContinue();
 }
@@ -473,8 +482,9 @@ void ServiceWorkerRegisterJob::StartWorkerForUpdate() {
   }
 
   // "Let worker be a new ServiceWorker object..." and start the worker.
-  set_new_version(new ServiceWorkerVersion(
-      registration(), script_url_, worker_script_type_, version_id, context_));
+  set_new_version(new ServiceWorkerVersion(registration(), script_url_,
+                                           worker_script_type_, version_id,
+                                           context_->AsWeakPtr()));
   new_version()->set_force_bypass_cache_for_scripts(force_bypass_cache_);
 
   if (need_to_pause_after_download) {
diff --git a/chromium/content/browser/service_worker/service_worker_register_job.h b/chromium/content/browser/service_worker/service_worker_register_job.h
index e7c84f87a26..c7ae1d682ee 100644
--- a/chromium/content/browser/service_worker/service_worker_register_job.h
+++ b/chromium/content/browser/service_worker/service_worker_register_job.h
@@ -5,6 +5,8 @@
 #ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_REGISTER_JOB_H_
 #define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_REGISTER_JOB_H_
 
+#include <map>
+#include <memory>
 #include <string>
 #include <vector>
 
@@ -49,13 +51,13 @@ class ServiceWorkerRegisterJob : public ServiceWorkerRegisterJobBase {
 
   // For registration jobs.
   CONTENT_EXPORT ServiceWorkerRegisterJob(
-      base::WeakPtr<ServiceWorkerContextCore> context,
+      ServiceWorkerContextCore* context,
       const GURL& script_url,
       const blink::mojom::ServiceWorkerRegistrationOptions& options);
 
   // For update jobs.
   CONTENT_EXPORT ServiceWorkerRegisterJob(
-      base::WeakPtr<ServiceWorkerContextCore> context,
+      ServiceWorkerContextCore* context,
       ServiceWorkerRegistration* registration,
       bool force_bypass_cache,
       bool skip_script_comparison);
@@ -68,6 +70,7 @@ class ServiceWorkerRegisterJob : public ServiceWorkerRegisterJobBase {
   // ServiceWorkerRegisterJobBase implementation:
   void Start() override;
   void Abort() override;
+  void WillShutDown() override;
   bool Equals(ServiceWorkerRegisterJobBase* job) const override;
   RegistrationJobType GetType() const override;
 
@@ -171,8 +174,8 @@ class ServiceWorkerRegisterJob : public ServiceWorkerRegisterJobBase {
 
   void BumpLastUpdateCheckTimeIfNeeded();
 
-  // The ServiceWorkerContextCore object should always outlive this.
-  base::WeakPtr<ServiceWorkerContextCore> context_;
+  // The ServiceWorkerContextCore object must outlive this.
+  ServiceWorkerContextCore* const context_;
 
   std::unique_ptr<ServiceWorkerUpdateChecker> update_checker_;
   std::map<GURL, ServiceWorkerUpdateChecker::ComparedScriptInfo>
@@ -188,6 +191,7 @@ class ServiceWorkerRegisterJob : public ServiceWorkerRegisterJobBase {
   const blink::mojom::ServiceWorkerUpdateViaCache update_via_cache_;
   std::vector<RegistrationCallback> callbacks_;
   Phase phase_;
+  bool is_shutting_down_;
   Internal internal_;
   bool is_promise_resolved_;
   bool should_uninstall_on_failure_;
diff --git a/chromium/content/browser/service_worker/service_worker_register_job_base.h b/chromium/content/browser/service_worker/service_worker_register_job_base.h
index 8c3f59abd57..4d5766addea 100644
--- a/chromium/content/browser/service_worker/service_worker_register_job_base.h
+++ b/chromium/content/browser/service_worker/service_worker_register_job_base.h
@@ -24,6 +24,9 @@ class ServiceWorkerRegisterJobBase {
   // It can be called regardless of whether Start() was called.
   virtual void Abort() = 0;
 
+  // Notifies the job that the context is shutting down.
+  virtual void WillShutDown() = 0;
+
   // Returns true if this job is identical to |job| for the purpose of
   // collapsing them together in a ServiceWorkerJobCoordinator queue.
   // Registration jobs are equal if they are for the same scope and script
diff --git a/chromium/content/browser/service_worker/service_worker_registration_unittest.cc b/chromium/content/browser/service_worker/service_worker_registration_unittest.cc
index 27f00be5108..053cc49c980 100644
--- a/chromium/content/browser/service_worker/service_worker_registration_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_registration_unittest.cc
@@ -14,6 +14,7 @@
 #include "base/files/scoped_temp_dir.h"
 #include "base/logging.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/scoped_feature_list.h"
@@ -35,8 +36,11 @@
 #include "content/browser/service_worker/test_service_worker_observer.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/common/service_worker/service_worker_utils.h"
+#include "content/public/common/content_client.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/public/test/test_browser_context.h"
+#include "content/public/test/url_loader_interceptor.h"
+#include "content/test/fake_network.h"
 #include "content/test/test_content_browser_client.h"
 #include "mojo/core/embedder/embedder.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
@@ -46,6 +50,7 @@
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -54,26 +59,8 @@ namespace {
 // From service_worker_registration.cc.
 constexpr base::TimeDelta kMaxLameDuckTime = base::TimeDelta::FromMinutes(5);
 
-// TODO(falken): Make this a common helper function.
-void StartWorker(ServiceWorkerVersion* version,
-                 ServiceWorkerMetrics::EventType purpose) {
-  base::RunLoop loop;
-  blink::ServiceWorkerStatusCode code;
-  version->StartWorker(
-      purpose,
-      base::BindOnce(
-          [](base::OnceClosure done, blink::ServiceWorkerStatusCode* out_code,
-             blink::ServiceWorkerStatusCode result_code) {
-            *out_code = result_code;
-            std::move(done).Run();
-          },
-          loop.QuitClosure(), &code));
-  loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, code);
-}
-
 int CreateInflightRequest(ServiceWorkerVersion* version) {
-  StartWorker(version, ServiceWorkerMetrics::EventType::PUSH);
+  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, StartServiceWorker(version));
   return version->StartRequest(ServiceWorkerMetrics::EventType::PUSH,
                                base::DoNothing());
 }
@@ -91,7 +78,8 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
  public:
   bool AllowServiceWorkerOnIO(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       content::ResourceContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter) override {
@@ -100,7 +88,8 @@ class ServiceWorkerTestContentBrowserClient : public TestContentBrowserClient {
 
   bool AllowServiceWorkerOnUI(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       content::BrowserContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter) override {
@@ -439,7 +428,7 @@ class ServiceWorkerActivationTest : public ServiceWorkerRegistrationTest,
         context()->AsWeakPtr(), &remote_endpoint_);
     DCHECK(remote_endpoint_.client_receiver()->is_valid());
     DCHECK(remote_endpoint_.host_remote()->is_bound());
-    host_->UpdateUrls(kUrl, kUrl);
+    host_->UpdateUrls(kUrl, kUrl, url::Origin::Create(kUrl));
     host_->SetControllerRegistration(registration_,
                                      false /* notify_controllerchange */);
 
@@ -480,7 +469,8 @@ class ServiceWorkerActivationTest : public ServiceWorkerRegistrationTest,
         helper_->AddNewPendingServiceWorker<FakeServiceWorker>(helper_.get());
 
     // Start the worker.
-    StartWorker(version_2.get(), ServiceWorkerMetrics::EventType::INSTALL);
+    ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+              StartServiceWorker(version_2.get()));
     version_2->SetStatus(ServiceWorkerVersion::INSTALLED);
 
     // Set it to activate when ready. The original version should still be
@@ -944,7 +934,8 @@ class ServiceWorkerRegistrationObjectHostTest
     base::WeakPtr<ServiceWorkerProviderHost> host = CreateProviderHostForWindow(
         helper_->mock_render_process_id(), true /* is_parent_frame_secure */,
         context()->AsWeakPtr(), &remote_endpoint);
-    host->UpdateUrls(document_url, document_url);
+    host->UpdateUrls(document_url, document_url,
+                     url::Origin::Create(document_url));
     if (out_host)
       *out_host = host;
     return remote_endpoint;
@@ -981,6 +972,11 @@ class ServiceWorkerRegistrationObjectHostTest
 class ServiceWorkerRegistrationObjectHostUpdateTest
     : public ServiceWorkerRegistrationObjectHostTest,
       public testing::WithParamInterface<bool> {
+ public:
+  ServiceWorkerRegistrationObjectHostUpdateTest()
+      : interceptor_(base::BindRepeating(&FakeNetwork::HandleRequest,
+                                         base::Unretained(&fake_network_))) {}
+
  protected:
   void SetUp() override {
     if (IsImportedScriptUpdateCheckEnabled()) {
@@ -996,6 +992,8 @@ class ServiceWorkerRegistrationObjectHostUpdateTest
   static bool IsImportedScriptUpdateCheckEnabled() { return GetParam(); }
 
  private:
+  FakeNetwork fake_network_;
+  URLLoaderInterceptor interceptor_;
   base::test::ScopedFeatureList feature_list_;
 };
 
@@ -1057,7 +1055,7 @@ TEST_P(ServiceWorkerRegistrationObjectHostUpdateTest,
 
   ASSERT_TRUE(bad_messages_.empty());
   GURL url("https://does.not.exist/");
-  provider_host->UpdateUrls(url, url);
+  provider_host->UpdateUrls(url, url, url::Origin::Create(url));
   CallUpdate(registration_host.get(), /*out_error_msg=*/nullptr);
   EXPECT_EQ(1u, bad_messages_.size());
 }
@@ -1165,7 +1163,7 @@ TEST_P(ServiceWorkerRegistrationObjectHostUpdateTest,
   base::WeakPtr<ServiceWorkerProviderHost> host = CreateProviderHostForWindow(
       helper_->mock_render_process_id(), true /* is_parent_frame_secure */,
       context()->AsWeakPtr(), &remote_endpoint);
-  host->UpdateUrls(kScope, kScope);
+  host->UpdateUrls(kScope, kScope, url::Origin::Create(kScope));
   version->AddControllee(host.get());
 
   // Initially set |self_update_delay| to zero.
@@ -1229,8 +1227,9 @@ TEST_F(ServiceWorkerRegistrationObjectHostTest,
   registration_host.Bind(std::move(info->host_remote));
 
   ASSERT_TRUE(bad_messages_.empty());
-  provider_host->UpdateUrls(GURL("https://does.not.exist/"),
-                            GURL("https://does.not.exist/"));
+  provider_host->UpdateUrls(
+      GURL("https://does.not.exist/"), GURL("https://does.not.exist/"),
+      url::Origin::Create(GURL("https://does.not.exist/")));
   CallUnregister(registration_host.get());
   EXPECT_EQ(1u, bad_messages_.size());
 }
diff --git a/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc b/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc
index ff766d7bb27..862a1e242f8 100644
--- a/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc
+++ b/chromium/content/browser/service_worker/service_worker_script_loader_factory.cc
@@ -149,8 +149,8 @@ void ServiceWorkerScriptLoaderFactory::CreateLoaderAndStart(
 }
 
 void ServiceWorkerScriptLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
-  bindings_.AddBinding(this, std::move(request));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
 void ServiceWorkerScriptLoaderFactory::Update(
diff --git a/chromium/content/browser/service_worker/service_worker_script_loader_factory.h b/chromium/content/browser/service_worker/service_worker_script_loader_factory.h
index 928e4b817ab..c7a5d4d1c57 100644
--- a/chromium/content/browser/service_worker/service_worker_script_loader_factory.h
+++ b/chromium/content/browser/service_worker/service_worker_script_loader_factory.h
@@ -9,7 +9,8 @@
 
 #include "base/macros.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace network {
@@ -62,7 +63,8 @@ class CONTENT_EXPORT ServiceWorkerScriptLoaderFactory
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
   void Update(scoped_refptr<network::SharedURLLoaderFactory> loader_factory);
 
@@ -99,7 +101,7 @@ class CONTENT_EXPORT ServiceWorkerScriptLoaderFactory
   scoped_refptr<network::SharedURLLoaderFactory>
       loader_factory_for_new_scripts_;
 
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   // Used to copy script started at CopyScript().
   std::unique_ptr<ServiceWorkerCacheWriter> cache_writer_;
diff --git a/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc b/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc
index cc639ff22b9..0754912346d 100644
--- a/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_script_loader_factory_unittest.cc
@@ -12,7 +12,7 @@
 #include "content/browser/service_worker/service_worker_registration.h"
 #include "content/browser/service_worker/service_worker_test_utils.h"
 #include "content/public/test/browser_task_environment.h"
-#include "content/test/fake_network_url_loader_factory.h"
+#include "content/test/fake_network.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/test/test_url_loader_client.h"
@@ -24,7 +24,9 @@ namespace content {
 class ServiceWorkerScriptLoaderFactoryTest : public testing::Test {
  public:
   ServiceWorkerScriptLoaderFactoryTest()
-      : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP) {}
+      : task_environment_(BrowserTaskEnvironment::IO_MAINLOOP),
+        interceptor_(base::BindRepeating(&FakeNetwork::HandleRequest,
+                                         base::Unretained(&fake_network_))) {}
   ~ServiceWorkerScriptLoaderFactoryTest() override = default;
 
   void SetUp() override {
@@ -47,9 +49,6 @@ class ServiceWorkerScriptLoaderFactoryTest : public testing::Test {
         helper_->mock_render_process_id(), true /* is_parent_frame_secure */,
         version_.get(), context->AsWeakPtr(), &remote_endpoint_);
 
-    network_loader_factory_ = std::make_unique<FakeNetworkURLLoaderFactory>();
-    helper_->SetNetworkFactory(network_loader_factory_.get());
-
     factory_ = std::make_unique<ServiceWorkerScriptLoaderFactory>(
         helper_->context()->AsWeakPtr(), provider_host_,
         helper_->url_loader_factory_getter()->GetNetworkFactory());
@@ -72,6 +71,9 @@ class ServiceWorkerScriptLoaderFactoryTest : public testing::Test {
   }
 
   BrowserTaskEnvironment task_environment_;
+  FakeNetwork fake_network_;
+  URLLoaderInterceptor interceptor_;
+
   std::unique_ptr<EmbeddedWorkerTestHelper> helper_;
   GURL scope_;
   GURL script_url_;
@@ -79,7 +81,6 @@ class ServiceWorkerScriptLoaderFactoryTest : public testing::Test {
   scoped_refptr<ServiceWorkerVersion> version_;
   base::WeakPtr<ServiceWorkerProviderHost> provider_host_;
   ServiceWorkerRemoteProviderEndpoint remote_endpoint_;
-  std::unique_ptr<FakeNetworkURLLoaderFactory> network_loader_factory_;
   std::unique_ptr<ServiceWorkerScriptLoaderFactory> factory_;
 };
 
diff --git a/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc b/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc
index abde435556a..da6f6d203bb 100644
--- a/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc
+++ b/chromium/content/browser/service_worker/service_worker_single_script_update_checker.cc
@@ -17,6 +17,7 @@
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/common/throttling_url_loader.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/browser/global_request_id.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/resource_type.h"
diff --git a/chromium/content/browser/service_worker/service_worker_single_script_update_checker_unittest.cc b/chromium/content/browser/service_worker/service_worker_single_script_update_checker_unittest.cc
index 6ad72f6fb09..b6e3f227202 100644
--- a/chromium/content/browser/service_worker/service_worker_single_script_update_checker_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_single_script_update_checker_unittest.cc
@@ -152,13 +152,13 @@ class ServiceWorkerSingleScriptUpdateCheckerTest : public testing::Test {
       const std::string& body,
       net::Error error) {
     auto loader_factory = std::make_unique<network::TestURLLoaderFactory>();
-    network::ResourceResponseHead head;
-    head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+    auto head = network::mojom::URLResponseHead::New();
+    head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
         net::HttpUtil::AssembleRawHeaders(header));
-    head.headers->GetMimeType(&head.mime_type);
+    head->headers->GetMimeType(&head->mime_type);
     network::URLLoaderCompletionStatus status(error);
     status.decoded_body_length = body.size();
-    loader_factory->AddResponse(url, head, body, status);
+    loader_factory->AddResponse(url, std::move(head), body, status);
     return loader_factory;
   }
 
@@ -474,11 +474,11 @@ TEST_P(ServiceWorkerSingleScriptUpdateCheckerToggleAsyncTest,
       std::move(loader_factory->GetPendingRequest(0)->client);
 
   // Simulate sending the response head.
-  network::ResourceResponseHead head;
-  head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+  auto head = network::mojom::URLResponseHead::New();
+  head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
       net::HttpUtil::AssembleRawHeaders(kSuccessHeader));
-  head.headers->GetMimeType(&head.mime_type);
-  client->OnReceiveResponse(head);
+  head->headers->GetMimeType(&head->mime_type);
+  client->OnReceiveResponse(std::move(head));
 
   // Simulate sending the response body. The buffer size for the data pipe
   // should be larger than the body to send the whole body in one chunk.
@@ -784,12 +784,11 @@ TEST_F(ServiceWorkerSingleScriptUpdateCheckerTest,
   // Simulate to send the head and the body back to the checker.
   // Note that OnComplete() is not called yet.
   {
-    network::ResourceResponseHead head =
-        network::CreateResourceResponseHead(net::HTTP_OK);
-    head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+    auto head = network::CreateURLResponseHead(net::HTTP_OK);
+    head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
         net::HttpUtil::AssembleRawHeaders(kSuccessHeader));
-    head.headers->GetMimeType(&head.mime_type);
-    request->client->OnReceiveResponse(head);
+    head->headers->GetMimeType(&head->mime_type);
+    request->client->OnReceiveResponse(std::move(head));
 
     MojoCreateDataPipeOptions options;
     options.struct_size = sizeof(MojoCreateDataPipeOptions);
diff --git a/chromium/content/browser/service_worker/service_worker_storage.cc b/chromium/content/browser/service_worker/service_worker_storage.cc
index e8926a469bc..31a16bed250 100644
--- a/chromium/content/browser/service_worker/service_worker_storage.cc
+++ b/chromium/content/browser/service_worker/service_worker_storage.cc
@@ -119,7 +119,7 @@ ServiceWorkerStorage::~ServiceWorkerStorage() {
 // static
 std::unique_ptr<ServiceWorkerStorage> ServiceWorkerStorage::Create(
     const base::FilePath& user_data_directory,
-    const base::WeakPtr<ServiceWorkerContextCore>& context,
+    ServiceWorkerContextCore* context,
     scoped_refptr<base::SequencedTaskRunner> database_task_runner,
     storage::QuotaManagerProxy* quota_manager_proxy,
     storage::SpecialStoragePolicy* special_storage_policy) {
@@ -130,7 +130,7 @@ std::unique_ptr<ServiceWorkerStorage> ServiceWorkerStorage::Create(
 
 // static
 std::unique_ptr<ServiceWorkerStorage> ServiceWorkerStorage::Create(
-    const base::WeakPtr<ServiceWorkerContextCore>& context,
+    ServiceWorkerContextCore* context,
     ServiceWorkerStorage* old_storage) {
   return base::WrapUnique(
       new ServiceWorkerStorage(old_storage->user_data_directory_, context,
@@ -1148,7 +1148,7 @@ void ServiceWorkerStorage::PurgeResources(const ResourceList& resources) {
 
 ServiceWorkerStorage::ServiceWorkerStorage(
     const base::FilePath& user_data_directory,
-    base::WeakPtr<ServiceWorkerContextCore> context,
+    ServiceWorkerContextCore* context,
     scoped_refptr<base::SequencedTaskRunner> database_task_runner,
     storage::QuotaManagerProxy* quota_manager_proxy,
     storage::SpecialStoragePolicy* special_storage_policy)
@@ -1636,8 +1636,8 @@ ServiceWorkerStorage::GetOrCreateRegistration(
 
   blink::mojom::ServiceWorkerRegistrationOptions options(
       data.scope, data.script_type, data.update_via_cache);
-  registration =
-      new ServiceWorkerRegistration(options, data.registration_id, context_);
+  registration = new ServiceWorkerRegistration(options, data.registration_id,
+                                               context_->AsWeakPtr());
   registration->set_resources_total_size_bytes(data.resources_total_size_bytes);
   registration->set_last_update_check(data.last_update_check);
   DCHECK(uninstalling_registrations_.find(data.registration_id) ==
@@ -1648,7 +1648,7 @@ ServiceWorkerStorage::GetOrCreateRegistration(
   if (!version) {
     version = base::MakeRefCounted<ServiceWorkerVersion>(
         registration.get(), data.script, data.script_type, data.version_id,
-        context_);
+        context_->AsWeakPtr());
     version->set_fetch_handler_existence(
         data.has_fetch_handler
             ? ServiceWorkerVersion::FetchHandlerExistence::EXISTS
diff --git a/chromium/content/browser/service_worker/service_worker_storage.h b/chromium/content/browser/service_worker/service_worker_storage.h
index 2712a4dff27..9d3006fdc88 100644
--- a/chromium/content/browser/service_worker/service_worker_storage.h
+++ b/chromium/content/browser/service_worker/service_worker_storage.h
@@ -94,14 +94,14 @@ class CONTENT_EXPORT ServiceWorkerStorage
 
   static std::unique_ptr<ServiceWorkerStorage> Create(
       const base::FilePath& user_data_directory,
-      const base::WeakPtr<ServiceWorkerContextCore>& context,
+      ServiceWorkerContextCore* context,
       scoped_refptr<base::SequencedTaskRunner> database_task_runner,
       storage::QuotaManagerProxy* quota_manager_proxy,
       storage::SpecialStoragePolicy* special_storage_policy);
 
   // Used for DeleteAndStartOver. Creates new storage based on |old_storage|.
   static std::unique_ptr<ServiceWorkerStorage> Create(
-      const base::WeakPtr<ServiceWorkerContextCore>& context,
+      ServiceWorkerContextCore* context,
       ServiceWorkerStorage* old_storage);
 
   // Finds registration for |document_url| or |scope| or |registration_id|.
@@ -373,7 +373,7 @@ class CONTENT_EXPORT ServiceWorkerStorage
 
   ServiceWorkerStorage(
       const base::FilePath& user_data_directory,
-      base::WeakPtr<ServiceWorkerContextCore> context,
+      ServiceWorkerContextCore* context,
       scoped_refptr<base::SequencedTaskRunner> database_task_runner,
       storage::QuotaManagerProxy* quota_manager_proxy,
       storage::SpecialStoragePolicy* special_storage_policy);
@@ -602,8 +602,8 @@ class CONTENT_EXPORT ServiceWorkerStorage
 
   base::FilePath user_data_directory_;
 
-  // The context should be valid while the storage is alive.
-  base::WeakPtr<ServiceWorkerContextCore> context_;
+  // The ServiceWorkerContextCore object must outlive this.
+  ServiceWorkerContextCore* const context_;
 
   // |database_| is only accessed using |database_task_runner_|.
   std::unique_ptr<ServiceWorkerDatabase> database_;
diff --git a/chromium/content/browser/service_worker/service_worker_test_utils.cc b/chromium/content/browser/service_worker/service_worker_test_utils.cc
index f688f988420..8ee3f683f85 100644
--- a/chromium/content/browser/service_worker/service_worker_test_utils.cc
+++ b/chromium/content/browser/service_worker/service_worker_test_utils.cc
@@ -9,6 +9,7 @@
 
 #include "base/barrier_closure.h"
 #include "base/run_loop.h"
+#include "base/test/bind_test_util.h"
 #include "base/time/time.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/service_worker/embedded_worker_test_helper.h"
@@ -26,7 +27,8 @@
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/transferrable_url_loader.mojom.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/base/io_buffer.h"
 #include "net/base/test_completion_callback.h"
 #include "net/http/http_response_info.h"
@@ -55,7 +57,8 @@ class MockSharedURLLoaderFactory final
     client->OnComplete(
         network::URLLoaderCompletionStatus(net::ERR_NOT_IMPLEMENTED));
   }
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     NOTREACHED();
   }
 
@@ -99,7 +102,7 @@ class FakeNavigationClient : public mojom::NavigationClient {
   ~FakeNavigationClient() override = default;
 
  private:
-  // mojom::NavigationClientPtr implementation:
+  // mojom::NavigationClient implementation:
   void CommitNavigation(
       mojom::CommonNavigationParamsPtr common_params,
       mojom::CommitNavigationParamsPtr commit_params,
@@ -209,7 +212,7 @@ void ServiceWorkerRemoteProviderEndpoint::BindForWindow(
   // crash.
   blink::mojom::ServiceWorkerProviderInfoForClientPtr received_info;
   base::RunLoop loop(base::RunLoop::Type::kNestableTasksAllowed);
-  mojo::MakeStrongBinding(
+  mojo::MakeSelfOwnedReceiver(
       std::make_unique<FakeNavigationClient>(base::BindOnce(
           [](base::OnceClosure quit_closure,
              blink::mojom::ServiceWorkerProviderInfoForClientPtr* out_info,
@@ -218,7 +221,7 @@ void ServiceWorkerRemoteProviderEndpoint::BindForWindow(
             std::move(quit_closure).Run();
           },
           loop.QuitClosure(), &received_info)),
-      mojo::MakeRequest(&navigation_client_));
+      navigation_client_.BindNewPipeAndPassReceiver());
   navigation_client_->CommitNavigation(
       CreateCommonNavigationParams(), CreateCommitNavigationParams(),
       network::ResourceResponseHead(), mojo::ScopedDataPipeConsumerHandle(),
@@ -295,6 +298,26 @@ ReceiveServiceWorkerStatus(base::Optional<blink::ServiceWorkerStatusCode>* out,
       std::move(quit_closure), out);
 }
 
+blink::ServiceWorkerStatusCode StartServiceWorker(
+    ServiceWorkerVersion* version) {
+  blink::ServiceWorkerStatusCode status;
+  base::RunLoop run_loop;
+  version->StartWorker(ServiceWorkerMetrics::EventType::UNKNOWN,
+                       base::BindLambdaForTesting(
+                           [&](blink::ServiceWorkerStatusCode result_status) {
+                             status = result_status;
+                             run_loop.Quit();
+                           }));
+  run_loop.Run();
+  return status;
+}
+
+void StopServiceWorker(ServiceWorkerVersion* version) {
+  base::RunLoop run_loop;
+  version->StopWorker(run_loop.QuitClosure());
+  run_loop.Run();
+}
+
 base::WeakPtr<ServiceWorkerProviderHost>
 CreateProviderHostForServiceWorkerContext(
     int process_id,
@@ -305,7 +328,7 @@ CreateProviderHostForServiceWorkerContext(
   auto provider_info =
       blink::mojom::ServiceWorkerProviderInfoForStartWorker::New();
   base::WeakPtr<ServiceWorkerProviderHost> host =
-      ServiceWorkerProviderHost::PreCreateForController(
+      ServiceWorkerProviderHost::CreateForServiceWorker(
           std::move(context), base::WrapRefCounted(hosted_version),
           &provider_info);
 
diff --git a/chromium/content/browser/service_worker/service_worker_test_utils.h b/chromium/content/browser/service_worker/service_worker_test_utils.h
index a35d1f65411..31d0e769790 100644
--- a/chromium/content/browser/service_worker/service_worker_test_utils.h
+++ b/chromium/content/browser/service_worker/service_worker_test_utils.h
@@ -23,6 +23,7 @@
 #include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
@@ -63,6 +64,11 @@ base::OnceCallback<void(blink::ServiceWorkerStatusCode)>
 ReceiveServiceWorkerStatus(base::Optional<blink::ServiceWorkerStatusCode>* out,
                            base::OnceClosure quit_closure);
 
+blink::ServiceWorkerStatusCode StartServiceWorker(
+    ServiceWorkerVersion* version);
+
+void StopServiceWorker(ServiceWorkerVersion* version);
+
 // Container for keeping the Mojo connection to the service worker provider on
 // the renderer alive.
 class ServiceWorkerRemoteProviderEndpoint {
@@ -93,7 +99,7 @@ class ServiceWorkerRemoteProviderEndpoint {
   // do the same thing by establishing a
   // blink::mojom::EmbeddedWorkerInstanceClient connection if in the future we
   // really need to make |host_remote_| and |client_receiver_| usable for it.
-  mojom::NavigationClientPtr navigation_client_;
+  mojo::Remote<mojom::NavigationClient> navigation_client_;
   // Bound with content::ServiceWorkerProviderHost. The provider host will be
   // removed asynchronously when this remote is closed.
   mojo::AssociatedRemote<blink::mojom::ServiceWorkerContainerHost> host_remote_;
diff --git a/chromium/content/browser/service_worker/service_worker_type_converters.cc b/chromium/content/browser/service_worker/service_worker_type_converters.cc
index 163959c53b5..2bf509b0fea 100644
--- a/chromium/content/browser/service_worker/service_worker_type_converters.cc
+++ b/chromium/content/browser/service_worker/service_worker_type_converters.cc
@@ -10,15 +10,14 @@ namespace mojo {
 
 // TODO(falken): TypeConverter is deprecated, and we should change
 // ServiceWorkerVersion to just use the mojom enum, but it will be a huge change
-// and not sure how to reconcile the NEW and kUnknown thing yet, so we use the
-// mojo type converter temporarily as an identifier to track.
+// so we use the mojo type converter temporarily as an identifier to track.
 blink::mojom::ServiceWorkerState
 TypeConverter<blink::mojom::ServiceWorkerState,
               content::ServiceWorkerVersion::Status>::
     Convert(content::ServiceWorkerVersion::Status status) {
   switch (status) {
     case content::ServiceWorkerVersion::NEW:
-      return blink::mojom::ServiceWorkerState::kUnknown;
+      return blink::mojom::ServiceWorkerState::kParsed;
     case content::ServiceWorkerVersion::INSTALLING:
       return blink::mojom::ServiceWorkerState::kInstalling;
     case content::ServiceWorkerVersion::INSTALLED:
@@ -31,7 +30,7 @@ TypeConverter<blink::mojom::ServiceWorkerState,
       return blink::mojom::ServiceWorkerState::kRedundant;
   }
   NOTREACHED() << status;
-  return blink::mojom::ServiceWorkerState::kUnknown;
+  return blink::mojom::ServiceWorkerState::kParsed;
 }
 
 }  // namespace mojo
diff --git a/chromium/content/browser/service_worker/service_worker_unregister_job.cc b/chromium/content/browser/service_worker/service_worker_unregister_job.cc
index 3b1894d466d..2abb284e8fb 100644
--- a/chromium/content/browser/service_worker/service_worker_unregister_job.cc
+++ b/chromium/content/browser/service_worker/service_worker_unregister_job.cc
@@ -4,6 +4,8 @@
 
 #include "content/browser/service_worker/service_worker_unregister_job.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/memory/weak_ptr.h"
 #include "content/browser/service_worker/service_worker_context_core.h"
@@ -19,9 +21,11 @@ namespace content {
 typedef ServiceWorkerRegisterJobBase::RegistrationJobType RegistrationJobType;
 
 ServiceWorkerUnregisterJob::ServiceWorkerUnregisterJob(
-    base::WeakPtr<ServiceWorkerContextCore> context,
+    ServiceWorkerContextCore* context,
     const GURL& scope)
-    : context_(context), scope_(scope), is_promise_resolved_(false) {}
+    : context_(context), scope_(scope), is_promise_resolved_(false) {
+  DCHECK(context_);
+}
 
 ServiceWorkerUnregisterJob::~ServiceWorkerUnregisterJob() {}
 
@@ -40,6 +44,8 @@ void ServiceWorkerUnregisterJob::Abort() {
                    blink::ServiceWorkerStatusCode::kErrorAbort);
 }
 
+void ServiceWorkerUnregisterJob::WillShutDown() {}
+
 bool ServiceWorkerUnregisterJob::Equals(
     ServiceWorkerRegisterJobBase* job) const {
   if (job->GetType() != GetType())
diff --git a/chromium/content/browser/service_worker/service_worker_unregister_job.h b/chromium/content/browser/service_worker/service_worker_unregister_job.h
index 96702691f37..b32db83f020 100644
--- a/chromium/content/browser/service_worker/service_worker_unregister_job.h
+++ b/chromium/content/browser/service_worker/service_worker_unregister_job.h
@@ -32,7 +32,7 @@ class ServiceWorkerUnregisterJob : public ServiceWorkerRegisterJobBase {
                                   blink::ServiceWorkerStatusCode status)>
       UnregistrationCallback;
 
-  ServiceWorkerUnregisterJob(base::WeakPtr<ServiceWorkerContextCore> context,
+  ServiceWorkerUnregisterJob(ServiceWorkerContextCore* context,
                              const GURL& scope);
   ~ServiceWorkerUnregisterJob() override;
 
@@ -43,6 +43,7 @@ class ServiceWorkerUnregisterJob : public ServiceWorkerRegisterJobBase {
   // ServiceWorkerRegisterJobBase implementation:
   void Start() override;
   void Abort() override;
+  void WillShutDown() override;
   bool Equals(ServiceWorkerRegisterJobBase* job) const override;
   RegistrationJobType GetType() const override;
 
@@ -56,7 +57,8 @@ class ServiceWorkerUnregisterJob : public ServiceWorkerRegisterJobBase {
   void ResolvePromise(int64_t registration_id,
                       blink::ServiceWorkerStatusCode status);
 
-  base::WeakPtr<ServiceWorkerContextCore> context_;
+  // The ServiceWorkerContextCore object must outlive this.
+  ServiceWorkerContextCore* const context_;
   const GURL scope_;
   std::vector<UnregistrationCallback> callbacks_;
   bool is_promise_resolved_;
diff --git a/chromium/content/browser/service_worker/service_worker_update_checker.cc b/chromium/content/browser/service_worker/service_worker_update_checker.cc
index 752297b0428..56253adb76d 100644
--- a/chromium/content/browser/service_worker/service_worker_update_checker.cc
+++ b/chromium/content/browser/service_worker/service_worker_update_checker.cc
@@ -4,6 +4,8 @@
 
 #include "content/browser/service_worker/service_worker_update_checker.h"
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/task/post_task.h"
 #include "base/trace_event/trace_event.h"
@@ -94,7 +96,9 @@ ServiceWorkerUpdateChecker::ServiceWorkerUpdateChecker(
       force_bypass_cache_(force_bypass_cache),
       update_via_cache_(update_via_cache),
       time_since_last_check_(time_since_last_check),
-      context_(context) {}
+      context_(context) {
+  DCHECK(context_);
+}
 
 ServiceWorkerUpdateChecker::~ServiceWorkerUpdateChecker() = default;
 
diff --git a/chromium/content/browser/service_worker/service_worker_update_checker.h b/chromium/content/browser/service_worker/service_worker_update_checker.h
index 0a38ba93df8..a5de84277aa 100644
--- a/chromium/content/browser/service_worker/service_worker_update_checker.h
+++ b/chromium/content/browser/service_worker/service_worker_update_checker.h
@@ -5,6 +5,10 @@
 #ifndef CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_UPDATE_CHECKER_H_
 #define CONTENT_BROWSER_SERVICE_WORKER_SERVICE_WORKER_UPDATE_CHECKER_H_
 
+#include <map>
+#include <memory>
+#include <vector>
+
 #include "base/callback.h"
 #include "content/browser/service_worker/service_worker_database.h"
 #include "content/browser/service_worker/service_worker_single_script_update_checker.h"
diff --git a/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc b/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc
index 449d74b10cb..751a4f39cb4 100644
--- a/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc
+++ b/chromium/content/browser/service_worker/service_worker_updated_script_loader.cc
@@ -24,6 +24,7 @@
 #include "content/common/throttling_url_loader.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "net/base/ip_endpoint.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
diff --git a/chromium/content/browser/service_worker/service_worker_version.cc b/chromium/content/browser/service_worker/service_worker_version.cc
index 1e8ebf4c7f0..27360a1e3cd 100644
--- a/chromium/content/browser/service_worker/service_worker_version.cc
+++ b/chromium/content/browser/service_worker/service_worker_version.cc
@@ -37,6 +37,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/page_navigator.h"
+#include "content/public/browser/service_worker_external_request_result.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/result_codes.h"
 #include "net/http/http_response_headers.h"
@@ -45,11 +46,6 @@
 #include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
 #include "third_party/blink/public/common/service_worker/service_worker_type_converters.h"
 #include "third_party/blink/public/common/service_worker/service_worker_utils.h"
-#include "third_party/blink/public/mojom/service_worker/embedded_worker.mojom.h"
-#include "third_party/blink/public/mojom/service_worker/service_worker_error_type.mojom.h"
-#include "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom.h"
-#include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
-#include "third_party/blink/public/web/web_console_message.h"
 
 namespace content {
 namespace {
@@ -347,9 +343,9 @@ void ServiceWorkerVersion::SetStatus(Status status) {
   for (auto& callback : callbacks)
     std::move(callback).Run();
 
-  if (status == INSTALLED)
+  if (status == INSTALLED) {
     embedded_worker_->OnWorkerVersionInstalled();
-  else if (status == REDUNDANT) {
+  } else if (status == REDUNDANT) {
     embedded_worker_->OnWorkerVersionDoomed();
 
     // TODO(crbug.com/951571): Remove this once we figured out the cause of
@@ -565,7 +561,6 @@ int ServiceWorkerVersion::StartRequestWithCustomTimeout(
          event_type == ServiceWorkerMetrics::EventType::ACTIVATE ||
          event_type == ServiceWorkerMetrics::EventType::MESSAGE ||
          event_type == ServiceWorkerMetrics::EventType::EXTERNAL_REQUEST ||
-         event_type == ServiceWorkerMetrics::EventType::LONG_RUNNING_MESSAGE ||
          status() == ACTIVATED)
       << "Event of type " << static_cast<int>(event_type)
       << " can only be dispatched to an active worker: " << status();
@@ -574,9 +569,6 @@ int ServiceWorkerVersion::StartRequestWithCustomTimeout(
   // request will be aborted soon, so don't bother aborting the request directly
   // here, and just skip this bookkeeping.
   if (context_) {
-    if (event_type == ServiceWorkerMetrics::EventType::LONG_RUNNING_MESSAGE)
-      embedded_worker_->AbortLifetimeTracking();
-
     if (event_type != ServiceWorkerMetrics::EventType::INSTALL &&
         event_type != ServiceWorkerMetrics::EventType::ACTIVATE &&
         event_type != ServiceWorkerMetrics::EventType::MESSAGE) {
@@ -621,25 +613,28 @@ int ServiceWorkerVersion::StartRequestWithCustomTimeout(
   return request_id;
 }
 
-bool ServiceWorkerVersion::StartExternalRequest(
+ServiceWorkerExternalRequestResult ServiceWorkerVersion::StartExternalRequest(
     const std::string& request_uuid) {
-  if (running_status() == EmbeddedWorkerStatus::STARTING)
-    return pending_external_requests_.insert(request_uuid).second;
+  if (running_status() == EmbeddedWorkerStatus::STARTING) {
+    return pending_external_requests_.insert(request_uuid).second
+               ? ServiceWorkerExternalRequestResult::kOk
+               : ServiceWorkerExternalRequestResult::kBadRequestId;
+  }
 
-  // It's possible that the renderer is lying or the version started stopping
-  // right around the time of the IPC.
-  if (running_status() != EmbeddedWorkerStatus::RUNNING)
-    return false;
+  if (running_status() == EmbeddedWorkerStatus::STOPPING ||
+      running_status() == EmbeddedWorkerStatus::STOPPED) {
+    return ServiceWorkerExternalRequestResult::kWorkerNotRunning;
+  }
 
   if (external_request_uuid_to_request_id_.count(request_uuid) > 0u)
-    return false;
+    return ServiceWorkerExternalRequestResult::kBadRequestId;
 
   int request_id =
       StartRequest(ServiceWorkerMetrics::EventType::EXTERNAL_REQUEST,
                    base::BindOnce(&ServiceWorkerVersion::CleanUpExternalRequest,
                                   this, request_uuid));
   external_request_uuid_to_request_id_[request_uuid] = request_id;
-  return true;
+  return ServiceWorkerExternalRequestResult::kOk;
 }
 
 bool ServiceWorkerVersion::FinishRequest(int request_id, bool was_handled) {
@@ -660,27 +655,34 @@ bool ServiceWorkerVersion::FinishRequest(int request_id, bool was_handled) {
   return true;
 }
 
-bool ServiceWorkerVersion::FinishExternalRequest(
+ServiceWorkerExternalRequestResult ServiceWorkerVersion::FinishExternalRequest(
     const std::string& request_uuid) {
   if (running_status() == EmbeddedWorkerStatus::STARTING)
-    return pending_external_requests_.erase(request_uuid) > 0u;
+    return pending_external_requests_.erase(request_uuid) > 0u
+               ? ServiceWorkerExternalRequestResult::kOk
+               : ServiceWorkerExternalRequestResult::kBadRequestId;
 
-  // It's possible that the renderer is lying or the version started stopping
-  // right around the time of the IPC.
-  if (running_status() != EmbeddedWorkerStatus::RUNNING)
-    return false;
+  // If it's STOPPED, there is no request to finish. We could just consider this
+  // a success, but the caller may want to know about it. (If it's STOPPING,
+  // proceed with finishing the request as normal.)
+  if (running_status() == EmbeddedWorkerStatus::STOPPED)
+    return ServiceWorkerExternalRequestResult::kWorkerNotRunning;
 
   auto iter = external_request_uuid_to_request_id_.find(request_uuid);
   if (iter != external_request_uuid_to_request_id_.end()) {
     int request_id = iter->second;
     external_request_uuid_to_request_id_.erase(iter);
-    return FinishRequest(request_id, true);
+    return FinishRequest(request_id, true)
+               ? ServiceWorkerExternalRequestResult::kOk
+               : ServiceWorkerExternalRequestResult::kBadRequestId;
   }
 
   // It is possible that the request was cancelled or timed out before and we
-  // won't find it in |external_request_uuid_to_request_id_|.
-  // Return true so we don't kill the process.
-  return true;
+  // won't find it in |external_request_uuid_to_request_id_|. Just return
+  // kOk.
+  // TODO(falken): Consider keeping track of these so we can return
+  // kBadRequestId for invalid requests ids.
+  return ServiceWorkerExternalRequestResult::kOk;
 }
 
 ServiceWorkerVersion::SimpleEventCallback
@@ -1602,12 +1604,17 @@ void ServiceWorkerVersion::StartWorkerInternal() {
   DCHECK(request_timeouts_.empty());
 
   StartTimeoutTimer();
+
+  // Set expiration time in advance so that the service worker can
+  // call postMessage() to itself immediately after it starts.
+  max_request_expiration_time_ = tick_clock_->NowTicks() + kRequestTimeout;
+
   worker_is_idle_on_renderer_ = false;
   needs_to_be_terminated_asap_ = false;
 
   auto provider_info =
       blink::mojom::ServiceWorkerProviderInfoForStartWorker::New();
-  provider_host_ = ServiceWorkerProviderHost::PreCreateForController(
+  provider_host_ = ServiceWorkerProviderHost::CreateForServiceWorker(
       context(), base::WrapRefCounted(this), &provider_info);
 
   auto params = blink::mojom::EmbeddedWorkerStartParams::New();
@@ -2053,15 +2060,15 @@ bool ServiceWorkerVersion::IsStartWorkerAllowed() const {
   // tab, pass a null callback as WebContents getter.
   if (ServiceWorkerContext::IsServiceWorkerOnUIEnabled()) {
     if (!GetContentClient()->browser()->AllowServiceWorkerOnUI(
-            scope_, scope_, script_url_, context_->wrapper()->browser_context(),
-            base::NullCallback())) {
+            scope_, scope_, url::Origin::Create(scope_), script_url_,
+            context_->wrapper()->browser_context(), base::NullCallback())) {
       return false;
     }
   } else {
     // resource_context() can return null in unit tests.
     if ((context_->wrapper()->resource_context() &&
          !GetContentClient()->browser()->AllowServiceWorkerOnIO(
-             scope_, scope_, script_url_,
+             scope_, scope_, url::Origin::Create(scope_), script_url_,
              context_->wrapper()->resource_context(), base::NullCallback()))) {
       return false;
     }
@@ -2176,10 +2183,12 @@ void ServiceWorkerVersion::InitializeGlobalScope() {
   // The registration must exist since we keep a reference to it during
   // service worker startup.
   DCHECK(registration);
+
   service_worker_remote_->InitializeGlobalScope(
       std::move(service_worker_host_),
       provider_host_->CreateServiceWorkerRegistrationObjectInfo(
           std::move(registration)),
+      provider_host_->CreateServiceWorkerObjectInfoToSend(this),
       fetch_handler_existence_);
 }
 
diff --git a/chromium/content/browser/service_worker/service_worker_version.h b/chromium/content/browser/service_worker/service_worker_version.h
index 360f98dd29c..4e75f41a510 100644
--- a/chromium/content/browser/service_worker/service_worker_version.h
+++ b/chromium/content/browser/service_worker/service_worker_version.h
@@ -311,7 +311,8 @@ class CONTENT_EXPORT ServiceWorkerVersion
   // Provides a mechanism to external clients to keep the worker running.
   // |request_uuid| is a GUID for clients to identify the request.
   // Returns true if the request was successfully scheduled to starrt.
-  bool StartExternalRequest(const std::string& request_uuid);
+  ServiceWorkerExternalRequestResult StartExternalRequest(
+      const std::string& request_uuid);
 
   // Informs ServiceWorkerVersion that an event has finished being dispatched.
   // Returns false if no inflight requests with the provided id exist, for
@@ -322,9 +323,8 @@ class CONTENT_EXPORT ServiceWorkerVersion
   bool FinishRequest(int request_id, bool was_handled);
 
   // Finishes an external request that was started by StartExternalRequest().
-  // Returns false if there was an error finishing the request: e.g. the request
-  // was not found or the worker already terminated.
-  bool FinishExternalRequest(const std::string& request_uuid);
+  ServiceWorkerExternalRequestResult FinishExternalRequest(
+      const std::string& request_uuid);
 
   // Creates a callback that is to be used for marking simple events dispatched
   // through blink::mojom::ServiceWorker as finished for the |request_id|.
diff --git a/chromium/content/browser/service_worker/service_worker_version_unittest.cc b/chromium/content/browser/service_worker/service_worker_version_unittest.cc
index 80d3715e57b..bbc5fc0332b 100644
--- a/chromium/content/browser/service_worker/service_worker_version_unittest.cc
+++ b/chromium/content/browser/service_worker/service_worker_version_unittest.cc
@@ -100,31 +100,10 @@ class TestServiceImpl : public mojom::TestService {
   TestServiceImpl() {}
 };
 
-void StartWorker(ServiceWorkerVersion* version,
-                 ServiceWorkerMetrics::EventType purpose) {
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version->StartWorker(
-      purpose, ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  EXPECT_EQ(EmbeddedWorkerStatus::STARTING, version->running_status());
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
-  EXPECT_EQ(EmbeddedWorkerStatus::RUNNING, version->running_status());
-}
-
 class ServiceWorkerVersionTest : public testing::Test {
  protected:
   using FetchHandlerExistence = blink::mojom::FetchHandlerExistence;
 
-  struct RunningStateListener : public ServiceWorkerVersion::Observer {
-    RunningStateListener() : last_status(EmbeddedWorkerStatus::STOPPED) {}
-    ~RunningStateListener() override {}
-    void OnRunningStateChanged(ServiceWorkerVersion* version) override {
-      last_status = version->running_status();
-    }
-    EmbeddedWorkerStatus last_status;
-  };
-
   struct CachedMetadataUpdateListener : public ServiceWorkerVersion::Observer {
     CachedMetadataUpdateListener() = default;
     ~CachedMetadataUpdateListener() override = default;
@@ -232,7 +211,8 @@ class ServiceWorkerVersionTest : public testing::Test {
     base::WeakPtr<ServiceWorkerProviderHost> host = CreateProviderHostForWindow(
         controllee_process_id, true /* is_parent_frame_secure */,
         helper_->context()->AsWeakPtr(), &remote_endpoint);
-    host->UpdateUrls(registration_->scope(), registration_->scope());
+    host->UpdateUrls(registration_->scope(), registration_->scope(),
+                     url::Origin::Create(registration_->scope()));
     host->SetControllerRegistration(registration_,
                                     false /* notify_controllerchange */);
     EXPECT_TRUE(version_->HasControllee());
@@ -389,7 +369,8 @@ TEST_F(ServiceWorkerVersionTest, DispatchEventToStoppedWorker) {
 
 TEST_F(ServiceWorkerVersionTest, StartUnregisteredButStillLiveWorker) {
   // Start the worker.
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
 
   // Delete the registration.
@@ -404,14 +385,8 @@ TEST_F(ServiceWorkerVersionTest, StartUnregisteredButStillLiveWorker) {
   // The live registration is marked as uninstalling, but still exists.
   ASSERT_TRUE(registration_->is_uninstalling());
 
-  {
-    // Stop the worker.
-    bool has_stopped = false;
-    base::RunLoop run_loop;
-    version_->StopWorker(VerifyCalled(&has_stopped, run_loop.QuitClosure()));
-    run_loop.Run();
-    EXPECT_TRUE(has_stopped);
-  }
+  // Stop the worker.
+  StopServiceWorker(version_.get());
 
   // Dispatch an event on the unregistered and stopped but still live worker.
   SimulateDispatchEvent(ServiceWorkerMetrics::EventType::FETCH_MAIN_FRAME);
@@ -486,7 +461,8 @@ TEST_F(ServiceWorkerVersionTest, Doom) {
   base::WeakPtr<ServiceWorkerProviderHost> host = CreateProviderHostForWindow(
       33 /* dummy render process id */, true /* is_parent_frame_secure */,
       helper_->context()->AsWeakPtr(), &remote_endpoint);
-  host->UpdateUrls(registration_->scope(), registration_->scope());
+  host->UpdateUrls(registration_->scope(), registration_->scope(),
+                   url::Origin::Create(registration_->scope()));
   host->SetControllerRegistration(registration_, false);
   EXPECT_TRUE(version_->HasControllee());
   EXPECT_TRUE(host->controller());
@@ -565,11 +541,7 @@ TEST_F(ServiceWorkerVersionTest, StaleUpdate_StartWorker) {
   EXPECT_FALSE(version_->update_timer_.IsRunning());
 
   // Update is actually scheduled after the worker stops.
-  bool has_stopped = false;
-  base::RunLoop run_loop;
-  version_->StopWorker(VerifyCalled(&has_stopped, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_TRUE(has_stopped);
+  StopServiceWorker(version_.get());
   EXPECT_TRUE(version_->stale_time_.is_null());
   EXPECT_TRUE(version_->update_timer_.IsRunning());
 }
@@ -634,7 +606,8 @@ TEST_F(ServiceWorkerVersionTest, StaleUpdate_DoNotDeferTimer) {
 }
 
 TEST_F(ServiceWorkerVersionTest, StartRequestWithNullContext) {
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
   version_->context_ = nullptr;
   version_->StartRequest(ServiceWorkerMetrics::EventType::PUSH,
@@ -684,7 +657,8 @@ TEST_F(ServiceWorkerVersionTest, UpdateCachedMetadata) {
   ASSERT_EQ(0, listener.updated_count);
   auto* service_worker =
       helper_->AddNewPendingServiceWorker<FakeServiceWorker>(helper_.get());
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   service_worker->RunUntilInitializeGlobalScope();
 
   // Simulate requesting SetCachedMetadata from the service worker global scope.
@@ -702,8 +676,8 @@ TEST_F(ServiceWorkerVersionTest, UpdateCachedMetadata) {
 }
 
 TEST_F(ServiceWorkerVersionTest, RestartWorker) {
-  StartWorker(version_.get(),
-              ServiceWorkerMetrics::EventType::FETCH_MAIN_FRAME);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
   bool has_stopped = false;
 
@@ -718,17 +692,9 @@ TEST_F(ServiceWorkerVersionTest, RestartWorker) {
   EXPECT_EQ(EmbeddedWorkerStatus::STOPPING, version_->running_status());
   run_loop.Run();
 
-  {
-    base::Optional<blink::ServiceWorkerStatusCode> status;
-    base::RunLoop run_loop;
-    version_->StartWorker(
-        ServiceWorkerMetrics::EventType::UNKNOWN,
-        ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-    run_loop.Run();
-
-    // The worker should have been successfully re-started after stopped.
-    EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
-  }
+  // Restart the worker.
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // The worker should have been stopped.
   EXPECT_TRUE(has_stopped);
@@ -786,8 +752,8 @@ TEST_F(ServiceWorkerVersionTest, RequestTimeout) {
   base::RunLoop run_loop;
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
   client->UnblockStartWorker();
-  StartWorker(version_.get(),
-              ServiceWorkerMetrics::EventType::FETCH_MAIN_FRAME);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // Create a request.
   int request_id = version_->StartRequest(
@@ -832,7 +798,8 @@ TEST_F(ServiceWorkerVersionTest, RequestNowTimeout) {
   base::Optional<blink::ServiceWorkerStatusCode> status;
   base::RunLoop run_loop;
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::SYNC);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // Create a request that should expire Now().
   int request_id = version_->StartRequestWithCustomTimeout(
@@ -856,7 +823,8 @@ TEST_F(ServiceWorkerVersionTest, RequestNowTimeoutKill) {
   base::Optional<blink::ServiceWorkerStatusCode> status;
   base::RunLoop run_loop;
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::SYNC);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // Create a request that should expire Now().
   int request_id = version_->StartRequestWithCustomTimeout(
@@ -884,7 +852,8 @@ TEST_F(ServiceWorkerVersionTest, RequestCustomizedTimeout) {
   base::RunLoop second_run_loop;
 
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::SYNC);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   base::SimpleTestTickClock tick_clock;
   SetTickClockForTesting(&tick_clock);
@@ -949,8 +918,8 @@ TEST_F(ServiceWorkerVersionTest, MixedRequestTimeouts) {
   base::RunLoop fetch_run_loop;
 
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
-  StartWorker(version_.get(),
-              ServiceWorkerMetrics::EventType::FETCH_MAIN_FRAME);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // Create a fetch request that should expire sometime later.
   int fetch_request_id = version_->StartRequest(
@@ -1054,7 +1023,8 @@ TEST_F(ServiceWorkerVersionTest, StallInStopping_DetachThenStart) {
   auto* client = helper_->AddNewPendingInstanceClient<
       DelayedFakeEmbeddedWorkerInstanceClient>(helper_.get());
   client->UnblockStartWorker();
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // Try to stop the worker.
   bool has_stopped = false;
@@ -1078,7 +1048,8 @@ TEST_F(ServiceWorkerVersionTest, StallInStopping_DetachThenStart) {
   EXPECT_EQ(EmbeddedWorkerStatus::STOPPED, version_->running_status());
 
   // Try to start the worker again. It should work.
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // The timeout interval should be reset to normal.
   EXPECT_TRUE(version_->timeout_timer_.IsRunning());
@@ -1093,7 +1064,8 @@ TEST_F(ServiceWorkerVersionTest, StallInStopping_DetachThenRestart) {
   auto* client = helper_->AddNewPendingInstanceClient<
       DelayedFakeEmbeddedWorkerInstanceClient>(helper_.get());
   client->UnblockStartWorker();
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   // Try to stop the worker.
   bool has_stopped = false;
@@ -1124,7 +1096,8 @@ TEST_F(ServiceWorkerVersionTest, RendererCrashDuringEvent) {
   auto* client =
       helper_->AddNewPendingInstanceClient<FakeEmbeddedWorkerInstanceClient>(
           helper_.get());
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::SYNC);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
 
   base::RunLoop loop;
   blink::ServiceWorkerStatusCode status = blink::ServiceWorkerStatusCode::kOk;
@@ -1179,25 +1152,15 @@ TEST_F(ServiceWorkerVersionTest, BadOrigin) {
       blink::mojom::ScriptType::kClassic,
       helper_->context()->storage()->NewVersionId(),
       helper_->context()->AsWeakPtr());
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kErrorDisallowed, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kErrorDisallowed,
+            StartServiceWorker(version.get()));
 }
 
 TEST_F(ServiceWorkerVersionTest,
        ForegroundServiceWorkerCountUpdatedByControllee) {
   // Start the worker before we have a controllee.
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(
       0,
       helper_->mock_render_process_host()->foreground_service_worker_count());
@@ -1226,13 +1189,8 @@ TEST_F(ServiceWorkerVersionTest,
 TEST_F(ServiceWorkerVersionTest,
        ForegroundServiceWorkerCountNotUpdatedBySameProcessControllee) {
   // Start the worker before we have a controllee.
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(
       0,
       helper_->mock_render_process_host()->foreground_service_worker_count());
@@ -1251,13 +1209,8 @@ TEST_F(ServiceWorkerVersionTest,
 TEST_F(ServiceWorkerVersionTest,
        ForegroundServiceWorkerCountUpdatedByControlleeProcessIdChange) {
   // Start the worker before we have a controllee.
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(
       0,
       helper_->mock_render_process_host()->foreground_service_worker_count());
@@ -1275,7 +1228,8 @@ TEST_F(ServiceWorkerVersionTest,
   base::WeakPtr<ServiceWorkerProviderHost> host =
       std::move(host_and_info->host);
   remote_endpoint.BindForWindow(std::move(host_and_info->info));
-  host->UpdateUrls(registration_->scope(), registration_->scope());
+  host->UpdateUrls(registration_->scope(), registration_->scope(),
+                   url::Origin::Create(registration_->scope()));
   host->SetControllerRegistration(registration_,
                                   false /* notify_controllerchange */);
   EXPECT_TRUE(version_->HasControllee());
@@ -1314,13 +1268,8 @@ TEST_F(ServiceWorkerVersionTest,
 
   // Starting the worker should notify the RenderProcessHost of the foreground
   // worker.
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(
       1,
       helper_->mock_render_process_host()->foreground_service_worker_count());
@@ -1345,13 +1294,8 @@ class ServiceWorkerVersionNoFetchHandlerTest : public ServiceWorkerVersionTest {
 TEST_F(ServiceWorkerVersionNoFetchHandlerTest,
        ForegroundServiceWorkerCountNotUpdated) {
   // Start the worker before we have a controllee.
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop.QuitClosure()));
-  run_loop.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(
       0,
       helper_->mock_render_process_host()->foreground_service_worker_count());
@@ -1368,62 +1312,35 @@ TEST_F(ServiceWorkerVersionNoFetchHandlerTest,
 }
 
 TEST_F(ServiceWorkerVersionTest, FailToStart_UseNewRendererProcess) {
-  base::Optional<blink::ServiceWorkerStatusCode> status;
-  base::RunLoop run_loop_1;
   ServiceWorkerContextCore* context = helper_->context();
   int64_t id = version_->version_id();
   version_->SetStatus(ServiceWorkerVersion::ACTIVATED);
 
   // Start once. It should choose the "existing process".
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop_1.QuitClosure()));
-  run_loop_1.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(helper_->mock_render_process_id(),
             version_->embedded_worker()->process_id());
-  {
-    bool has_stopped = false;
-    base::RunLoop run_loop;
-    version_->StopWorker(VerifyCalled(&has_stopped, run_loop.QuitClosure()));
-    run_loop.Run();
-    EXPECT_TRUE(has_stopped);
-  }
+
+  StopServiceWorker(version_.get());
 
   // Fail once.
-  status.reset();
   helper_->AddPendingInstanceClient(
       std::make_unique<FailStartInstanceClient>(helper_.get()));
-  base::RunLoop run_loop_2;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop_2.QuitClosure()));
-  run_loop_2.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kErrorStartWorkerFailed,
-            status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kErrorStartWorkerFailed,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(1, context->GetVersionFailureCount(id));
 
   // Fail again.
-  status.reset();
   helper_->AddPendingInstanceClient(
       std::make_unique<FailStartInstanceClient>(helper_.get()));
-  base::RunLoop run_loop_3;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop_3.QuitClosure()));
-  run_loop_3.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kErrorStartWorkerFailed,
-            status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kErrorStartWorkerFailed,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(2, context->GetVersionFailureCount(id));
 
   // Succeed. It should choose the "new process".
-  status.reset();
-  base::RunLoop run_loop_4;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop_4.QuitClosure()));
-  run_loop_4.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(helper_->new_render_process_id(),
             version_->embedded_worker()->process_id());
   EXPECT_EQ(0, context->GetVersionFailureCount(id));
@@ -1432,13 +1349,8 @@ TEST_F(ServiceWorkerVersionTest, FailToStart_UseNewRendererProcess) {
 
   // Start again. It should choose the "existing process" again as we no longer
   // force creation of a new process.
-  status.reset();
-  base::RunLoop run_loop_5;
-  version_->StartWorker(
-      ServiceWorkerMetrics::EventType::UNKNOWN,
-      ReceiveServiceWorkerStatus(&status, run_loop_5.QuitClosure()));
-  run_loop_5.Run();
-  EXPECT_EQ(blink::ServiceWorkerStatusCode::kOk, status.value());
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   EXPECT_EQ(helper_->mock_render_process_id(),
             version_->embedded_worker()->process_id());
   version_->StopWorker(base::DoNothing());
@@ -1475,7 +1387,8 @@ TEST_F(ServiceWorkerVersionTest, FailToStart_RestartStalledWorker) {
 TEST_F(ServiceWorkerVersionTest, InstalledFetchEventHandlerExists) {
   auto* service_worker =
       helper_->AddNewPendingServiceWorker<FakeServiceWorker>(helper_.get());
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   service_worker->RunUntilInitializeGlobalScope();
   EXPECT_EQ(FetchHandlerExistence::EXISTS,
             service_worker->fetch_handler_existence());
@@ -1485,7 +1398,8 @@ TEST_F(ServiceWorkerVersionNoFetchHandlerTest,
        InstalledFetchEventHandlerDoesNotExist) {
   auto* service_worker =
       helper_->AddNewPendingServiceWorker<FakeServiceWorker>(helper_.get());
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   service_worker->RunUntilInitializeGlobalScope();
   EXPECT_EQ(FetchHandlerExistence::DOES_NOT_EXIST,
             service_worker->fetch_handler_existence());
@@ -1530,7 +1444,8 @@ TEST_F(ServiceWorkerVersionTest, AddMessageToConsole) {
   // cause a crash.
   std::pair<blink::mojom::ConsoleMessageLevel, std::string> test_message =
       std::make_pair(blink::mojom::ConsoleMessageLevel::kVerbose, "");
-  StartWorker(version_.get(), ServiceWorkerMetrics::EventType::UNKNOWN);
+  ASSERT_EQ(blink::ServiceWorkerStatusCode::kOk,
+            StartServiceWorker(version_.get()));
   version_->AddMessageToConsole(test_message.first, test_message.second);
   service_worker->RunUntilInitializeGlobalScope();
   EXPECT_EQ(EmbeddedWorkerStatus::RUNNING, version_->running_status());
diff --git a/chromium/content/browser/shape_detection/shape_detection_browsertest.cc b/chromium/content/browser/shape_detection/shape_detection_browsertest.cc
index 05693956c2a..032cb46456a 100644
--- a/chromium/content/browser/shape_detection/shape_detection_browsertest.cc
+++ b/chromium/content/browser/shape_detection/shape_detection_browsertest.cc
@@ -64,7 +64,7 @@ class ShapeDetectionBrowserTest
     const GURL html_url(
         embedded_test_server()->GetURL(kShapeDetectionTestHtml));
     const GURL image_url(embedded_test_server()->GetURL(image_path));
-    NavigateToURL(shell(), html_url);
+    EXPECT_TRUE(NavigateToURL(shell(), html_url));
     const std::string js_command = "detectShapesOnImageUrl('" + detector_name +
                                    "', '" + image_url.spec() + "')";
     std::string response_string;
diff --git a/chromium/content/browser/site_instance_impl.cc b/chromium/content/browser/site_instance_impl.cc
index d0d4e89f419..47a9466685e 100644
--- a/chromium/content/browser/site_instance_impl.cc
+++ b/chromium/content/browser/site_instance_impl.cc
@@ -24,6 +24,7 @@
 #include "content/public/browser/render_process_host_factory.h"
 #include "content/public/browser/site_isolation_policy.h"
 #include "content/public/browser/web_ui_controller_factory.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
@@ -986,7 +987,7 @@ void SiteInstanceImpl::RenderProcessExited(
     RenderProcessHost* host,
     const ChildProcessTerminationInfo& info) {
   for (auto& observer : observers_)
-    observer.RenderProcessGone(this);
+    observer.RenderProcessGone(this, info);
 }
 
 void SiteInstanceImpl::LockToOriginIfNeeded() {
@@ -1046,6 +1047,12 @@ void SiteInstanceImpl::LockToOriginIfNeeded() {
                    << " in process locked to " << process_lock;
     }
   }
+
+  // Track which isolation contexts use the given process.  This lets
+  // ChildProcessSecurityPolicyImpl (e.g. CanAccessDataForOrigin) determine
+  // whether a given URL should require a lock or not (a dynamically isolated
+  // origin may require a lock in some isolation contexts but not in others).
+  policy->IncludeIsolationContext(process_->GetID(), GetIsolationContext());
 }
 
 // static
diff --git a/chromium/content/browser/site_instance_impl.h b/chromium/content/browser/site_instance_impl.h
index 1edb9fd6b0c..79fa334760e 100644
--- a/chromium/content/browser/site_instance_impl.h
+++ b/chromium/content/browser/site_instance_impl.h
@@ -32,7 +32,8 @@ class CONTENT_EXPORT SiteInstanceImpl final : public SiteInstance,
     virtual void ActiveFrameCountIsZero(SiteInstanceImpl* site_instance) {}
 
     // Called when the renderer process of this SiteInstance has exited.
-    virtual void RenderProcessGone(SiteInstanceImpl* site_instance) = 0;
+    virtual void RenderProcessGone(SiteInstanceImpl* site_instance,
+                                   const ChildProcessTerminationInfo& info) = 0;
   };
 
   static scoped_refptr<SiteInstanceImpl> Create(
diff --git a/chromium/content/browser/site_per_process_browsertest.cc b/chromium/content/browser/site_per_process_browsertest.cc
index dff84def81f..e22c515d029 100644
--- a/chromium/content/browser/site_per_process_browsertest.cc
+++ b/chromium/content/browser/site_per_process_browsertest.cc
@@ -160,7 +160,9 @@
 #include "content/browser/renderer_host/render_widget_host_view_android.h"
 #include "content/browser/web_contents/web_contents_view_android.h"
 #include "content/public/browser/android/child_process_importance.h"
+#include "content/public/common/content_client.h"
 #include "content/test/mock_overscroll_refresh_handler_android.h"
+#include "content/test/test_content_browser_client.h"
 #include "ui/android/view_android.h"
 #include "ui/android/window_android.h"
 #include "ui/events/android/event_handler_android.h"
@@ -482,60 +484,52 @@ void OpenURLBlockUntilNavigationComplete(Shell* shell, const GURL& url) {
 }
 
 // Helper function to generate a feature policy for a single feature and a list
-// of origins. (Equivalent to the declared policy "feature origin1 origin2...".)
-void SetParsedFeaturePolicyDeclaration(
-    blink::ParsedFeaturePolicyDeclaration* declaration,
+// of origins.
+// (Equivalent to the declared policy "feature origin1 origin2 ...".)
+// If the origins list is empty, it's treated as matches all origins
+// (Equivalent to the declared policy "feature *")
+blink::ParsedFeaturePolicyDeclaration CreateParsedFeaturePolicyDeclaration(
     blink::mojom::FeaturePolicyFeature feature,
     const std::vector<GURL>& origins) {
-  declaration->feature = feature;
+  blink::ParsedFeaturePolicyDeclaration declaration;
+
+  const bool matches_all = origins.empty();
+
+  declaration.feature = feature;
   blink::mojom::PolicyValueType feature_type =
       blink::FeaturePolicy::GetDefaultFeatureList().at(feature).second;
-  declaration->fallback_value =
-      blink::PolicyValue::CreateMinPolicyValue(feature_type);
-  declaration->opaque_value = declaration->fallback_value;
-  if (feature == blink::mojom::FeaturePolicyFeature::kOversizedImages) {
-    declaration->fallback_value.SetDoubleValue(2.0);
-    declaration->opaque_value.SetDoubleValue(2.0);
-  }
-  DCHECK(!origins.empty());
+  declaration.fallback_value =
+      matches_all ? blink::PolicyValue::CreateMaxPolicyValue(feature_type)
+                  : blink::PolicyValue::CreateMinPolicyValue(feature_type);
+  declaration.opaque_value = declaration.fallback_value;
+
+  if (feature == blink::mojom::FeaturePolicyFeature::kOversizedImages &&
+      !matches_all) {
+    declaration.fallback_value.SetDoubleValue(2.0);
+    declaration.opaque_value.SetDoubleValue(2.0);
+  }
+
   for (const auto origin : origins)
-    declaration->values.insert(std::pair<url::Origin, blink::PolicyValue>(
+    declaration.values.insert(std::pair<url::Origin, blink::PolicyValue>(
         url::Origin::Create(origin),
         blink::PolicyValue::CreateMaxPolicyValue(feature_type)));
+
+  return declaration;
 }
 
-blink::ParsedFeaturePolicy CreateFPHeader(
-    blink::mojom::FeaturePolicyFeature feature1,
-    blink::mojom::FeaturePolicyFeature feature2,
+blink::ParsedFeaturePolicy CreateParsedFeaturePolicy(
+    const std::vector<blink::mojom::FeaturePolicyFeature>& features,
     const std::vector<GURL>& origins) {
-  blink::ParsedFeaturePolicy result(2);
-  SetParsedFeaturePolicyDeclaration(&(result[0]), feature1, origins);
-  SetParsedFeaturePolicyDeclaration(&(result[1]), feature2, origins);
+  blink::ParsedFeaturePolicy result;
+  result.reserve(features.size());
+  for (const auto& feature : features)
+    result.push_back(CreateParsedFeaturePolicyDeclaration(feature, origins));
   return result;
 }
 
-// Helper function to generate a feature policy for a single feature which
-// matches every origin. (Equivalent to the declared policy "feature1 *;
-// feature2 *".)
-blink::ParsedFeaturePolicy CreateFPHeaderMatchesAll(
-    blink::mojom::FeaturePolicyFeature feature1,
-    blink::mojom::FeaturePolicyFeature feature2) {
-  blink::ParsedFeaturePolicy result(2);
-  blink::mojom::PolicyValueType feature_type1 =
-      blink::FeaturePolicy::GetDefaultFeatureList().at(feature1).second;
-  blink::mojom::PolicyValueType feature_type2 =
-      blink::FeaturePolicy::GetDefaultFeatureList().at(feature2).second;
-  blink::PolicyValue max_value1 =
-      blink::PolicyValue::CreateMaxPolicyValue(feature_type1);
-  blink::PolicyValue max_value2 =
-      blink::PolicyValue::CreateMaxPolicyValue(feature_type2);
-  result[0].feature = feature1;
-  result[0].fallback_value = max_value1;
-  result[0].opaque_value = max_value1;
-  result[1].feature = feature2;
-  result[1].fallback_value = max_value2;
-  result[1].opaque_value = max_value2;
-  return result;
+blink::ParsedFeaturePolicy CreateParsedFeaturePolicyMatchesAll(
+    const std::vector<blink::mojom::FeaturePolicyFeature>& features) {
+  return CreateParsedFeaturePolicy(features, {});
 }
 
 // Check frame depth on node, widget, and process all match expected depth.
@@ -677,7 +671,13 @@ class UpdateViewportIntersectionMessageFilter
 // SitePerProcessBrowserTest
 //
 
-SitePerProcessBrowserTest::SitePerProcessBrowserTest() {}
+SitePerProcessBrowserTest::SitePerProcessBrowserTest() {
+#if !defined(OS_ANDROID)
+  // TODO(bokan): Needed for scrollability check in
+  // FrameOwnerPropertiesPropagationScrolling. crbug.com/662196.
+  feature_list_.InitAndDisableFeature(features::kOverlayScrollbar);
+#endif
+}
 
 std::string SitePerProcessBrowserTest::DepictFrameTree(FrameTreeNode* node) {
   return visualizer_.DepictFrameTree(node);
@@ -689,13 +689,6 @@ void SitePerProcessBrowserTest::SetUpCommandLine(
   IsolateAllSitesForTesting(command_line);
 
   command_line->AppendSwitch(switches::kValidateInputEventStream);
-  command_line->AppendSwitch(switches::kAllowPreCommitInput);
-
-#if !defined(OS_ANDROID)
-  // TODO(bokan): Needed for scrollability check in
-  // FrameOwnerPropertiesPropagationScrolling. crbug.com/662196.
-  feature_list_.InitAndDisableFeature(features::kOverlayScrollbar);
-#endif
 }
 
 void SitePerProcessBrowserTest::SetUpOnMainThread() {
@@ -954,6 +947,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessHighDPIBrowserTest,
   EXPECT_EQ(expected_dip_scale, GetFrameDeviceScaleFactor(web_contents()));
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  EXPECT_EQ(expected_dip_scale, GetFrameDeviceScaleFactor(root));
   ASSERT_EQ(1U, root->child_count());
 
   FrameTreeNode* child = root->child_at(0);
@@ -1677,13 +1671,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollBubblingFromOOPIFTest) {
       blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.SetPositionInWidget(1, 1);
+  // Use precise pixels to keep these events off the animated scroll pathways,
+  // which currently break this test.
+  // https://bugs.chromium.org/p/chromium/issues/detail?id=710513
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = -5.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  // Set has_precise_scroll_deltas to keep these events off the animated scroll
-  // pathways, which currently break this test.
-  // https://bugs.chromium.org/p/chromium/issues/detail?id=710513
-  scroll_event.has_precise_scrolling_deltas = true;
   rwhv_parent->ProcessMouseWheelEvent(scroll_event, ui::LatencyInfo());
 
   // The event router sends wheel events of a single scroll sequence to the
@@ -1856,6 +1851,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   RenderWidgetHostViewBase* rwhv_child = static_cast<RenderWidgetHostViewBase*>(
       iframe_node->current_frame_host()->GetRenderWidgetHost()->GetView());
 
+  // This test does not involve hit testing, but input events could be dropped
+  // by the renderer before the first compositor commit, so we wait here anyway
+  // to avoid that.
+  WaitForHitTestData(iframe_node->current_frame_host());
+
   double initial_y = 0.0;
   ASSERT_TRUE(content::ExecuteScriptAndExtractDouble(
       root,
@@ -1964,10 +1964,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, TouchpadGestureFlingStart) {
   blink::WebMouseWheelEvent scroll_event(
       blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = 5.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
   child_rwh->ForwardWheelEvent(scroll_event);
   gesture_scroll_begin_ack_observer.Wait();
 
@@ -2091,10 +2092,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        scale_factor),
       gfx::ToCeiledInt((bounds.y() - root_view->GetViewBounds().y() + 10) *
                        scale_factor));
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = 5.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
   rwhv_nested->ProcessMouseWheelEvent(scroll_event, ui::LatencyInfo());
   ack_observer.Wait();
 
@@ -2150,10 +2152,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
                        scale_factor),
       gfx::ToCeiledInt((bounds.y() - root_view->GetViewBounds().y() + 10) *
                        scale_factor));
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = -5.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
   child_view->ProcessMouseWheelEvent(scroll_event, ui::LatencyInfo());
 
   // Send a wheel end event to complete the scrolling sequence.
@@ -2227,10 +2230,11 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, ScrollLocalSubframeInOOPIF) {
       blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.SetPositionInWidget(90, 110);
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = -50.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
   rwhv_child->ProcessMouseWheelEvent(scroll_event, ui::LatencyInfo());
   ack_observer.Wait();
 }
@@ -2919,7 +2923,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, RemoveFocusFromKilledFrame) {
   GURL main_url(embedded_test_server()->GetURL(
       "foo.com", "/cross_site_iframe_factory.html?foo.com(bar.com)"));
-  NavigateToURL(shell(), main_url);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // It is safe to obtain the root frame tree node here, as it doesn't change.
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
@@ -4097,6 +4101,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessEmbedderCSPEnforcementBrowserTest,
     NavigateFrameToURL(child, urls[i]);
     EXPECT_EQ(csp_values[i], child->frame_owner_properties().required_csp);
     // TODO(amalika): add checks that the CSP replication takes effect
+
+    const url::Origin child_origin =
+        child->current_frame_host()->GetLastCommittedOrigin();
+    // TODO(https://crbug.com/1000804): Enable check once bug is fixed.
+    // EXPECT_TRUE(child_origin.opaque());
+    EXPECT_EQ(url::Origin::Create(urls[i].GetOrigin())
+                  .GetTupleOrPrecursorTupleIfOpaque(),
+              child_origin.GetTupleOrPrecursorTupleIfOpaque());
   }
 }
 
@@ -4155,8 +4167,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, OriginReplication) {
 
 // Test that HasReceivedUserGesture and HasReceivedUserGestureBeforeNavigation
 // are propagated correctly across origins.
+// Flaky. https://crbug.com/1014175
 IN_PROC_BROWSER_TEST_F(SitePerProcessAutoplayBrowserTest,
-                       PropagateUserGestureFlag) {
+                       DISABLED_PropagateUserGestureFlag) {
   GURL main_url(embedded_test_server()->GetURL(
       "example.com", "/media/autoplay/autoplay-enabled.html"));
   GURL foo_url(embedded_test_server()->GetURL(
@@ -6213,8 +6226,6 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
     params->parent_routing_id =
         shell()->web_contents()->GetMainFrame()->GetRoutingID();
     params->previous_sibling_routing_id = IPC::mojom::kRoutingIdNone;
-    params->widget_params = mojom::CreateFrameWidgetParams::New();
-    params->widget_params->routing_id = IPC::mojom::kRoutingIdNone;
     params->replication_state.name = "name";
     params->replication_state.unique_name = "name";
     params->devtools_frame_token = base::UnguessableToken::Create();
@@ -7136,7 +7147,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
     load_observer.Wait();
 
     // The blocked frame's origin should become unique.
-    EXPECT_EQ("null", root->child_at(0)->current_origin().Serialize());
+    const url::Origin child_origin =
+        root->child_at(0)->current_frame_host()->GetLastCommittedOrigin();
+    EXPECT_TRUE(child_origin.opaque());
+    EXPECT_EQ(url::Origin::Create(blocked_url.GetOrigin())
+                  .GetTupleOrPrecursorTupleIfOpaque(),
+              child_origin.GetTupleOrPrecursorTupleIfOpaque());
 
     // X-Frame-Options and CSP frame-ancestors behave differently. XFO commits
     // an error page, while CSP commits a "data:," URL.
@@ -7968,7 +7984,7 @@ class ShowCreatedWindowInterceptor
           test_callback)
       : render_frame_host_(render_frame_host),
         test_callback_(std::move(test_callback)) {
-    render_frame_host_->frame_host_binding_for_testing().SwapImplForTesting(
+    render_frame_host_->frame_host_receiver_for_testing().SwapImplForTesting(
         this);
   }
 
@@ -8737,17 +8753,18 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  EXPECT_EQ(CreateFPHeader(blink::mojom::FeaturePolicyFeature::kGeolocation,
-                           blink::mojom::FeaturePolicyFeature::kOversizedImages,
-                           {start_url.GetOrigin()}),
+  EXPECT_EQ(CreateParsedFeaturePolicy(
+                {blink::mojom::FeaturePolicyFeature::kGeolocation,
+                 blink::mojom::FeaturePolicyFeature::kOversizedImages},
+                {start_url.GetOrigin()}),
             root->current_replication_state().feature_policy_header);
 
   // When the main frame navigates to a page with a new policy, it should
   // overwrite the old one.
   EXPECT_TRUE(NavigateToURL(shell(), first_nav_url));
-  EXPECT_EQ(CreateFPHeaderMatchesAll(
-                blink::mojom::FeaturePolicyFeature::kGeolocation,
-                blink::mojom::FeaturePolicyFeature::kOversizedImages),
+  EXPECT_EQ(CreateParsedFeaturePolicyMatchesAll(
+                {blink::mojom::FeaturePolicyFeature::kGeolocation,
+                 blink::mojom::FeaturePolicyFeature::kOversizedImages}),
             root->current_replication_state().feature_policy_header);
 
   // When the main frame navigates to a page without a policy, the replicated
@@ -8767,17 +8784,18 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), start_url));
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  EXPECT_EQ(CreateFPHeader(blink::mojom::FeaturePolicyFeature::kGeolocation,
-                           blink::mojom::FeaturePolicyFeature::kOversizedImages,
-                           {start_url.GetOrigin()}),
+  EXPECT_EQ(CreateParsedFeaturePolicy(
+                {blink::mojom::FeaturePolicyFeature::kGeolocation,
+                 blink::mojom::FeaturePolicyFeature::kOversizedImages},
+                {start_url.GetOrigin()}),
             root->current_replication_state().feature_policy_header);
 
   // When the main frame navigates to a page with a new policy, it should
   // overwrite the old one.
   EXPECT_TRUE(NavigateToURL(shell(), first_nav_url));
-  EXPECT_EQ(CreateFPHeaderMatchesAll(
-                blink::mojom::FeaturePolicyFeature::kGeolocation,
-                blink::mojom::FeaturePolicyFeature::kOversizedImages),
+  EXPECT_EQ(CreateParsedFeaturePolicyMatchesAll(
+                {blink::mojom::FeaturePolicyFeature::kGeolocation,
+                 blink::mojom::FeaturePolicyFeature::kOversizedImages}),
             root->current_replication_state().feature_policy_header);
 
   // When the main frame navigates to a page without a policy, the replicated
@@ -8799,23 +8817,25 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicyBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   FrameTreeNode* root = web_contents()->GetFrameTree()->root();
-  EXPECT_EQ(CreateFPHeader(blink::mojom::FeaturePolicyFeature::kGeolocation,
-                           blink::mojom::FeaturePolicyFeature::kOversizedImages,
-                           {main_url.GetOrigin(), GURL("http://example.com/")}),
+  EXPECT_EQ(CreateParsedFeaturePolicy(
+                {blink::mojom::FeaturePolicyFeature::kGeolocation,
+                 blink::mojom::FeaturePolicyFeature::kOversizedImages},
+                {main_url.GetOrigin(), GURL("http://example.com/")}),
             root->current_replication_state().feature_policy_header);
   EXPECT_EQ(1UL, root->child_count());
   EXPECT_EQ(
-      CreateFPHeader(blink::mojom::FeaturePolicyFeature::kGeolocation,
-                     blink::mojom::FeaturePolicyFeature::kOversizedImages,
-                     {main_url.GetOrigin()}),
+      CreateParsedFeaturePolicy(
+          {blink::mojom::FeaturePolicyFeature::kGeolocation,
+           blink::mojom::FeaturePolicyFeature::kOversizedImages},
+          {main_url.GetOrigin()}),
       root->child_at(0)->current_replication_state().feature_policy_header);
 
   // Navigate the iframe cross-site.
   NavigateFrameToURL(root->child_at(0), first_nav_url);
   EXPECT_EQ(
-      CreateFPHeaderMatchesAll(
-          blink::mojom::FeaturePolicyFeature::kGeolocation,
-          blink::mojom::FeaturePolicyFeature::kOversizedImages),
+      CreateParsedFeaturePolicyMatchesAll(
+          {blink::mojom::FeaturePolicyFeature::kGeolocation,
+           blink::mojom::FeaturePolicyFeature::kOversizedImages}),
       root->child_at(0)->current_replication_state().feature_policy_header);
 
   // Navigate the iframe to another location, this one with no policy header
@@ -8827,9 +8847,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicyBrowserTest,
   // Navigate the iframe back to a page with a policy
   NavigateFrameToURL(root->child_at(0), first_nav_url);
   EXPECT_EQ(
-      CreateFPHeaderMatchesAll(
-          blink::mojom::FeaturePolicyFeature::kGeolocation,
-          blink::mojom::FeaturePolicyFeature::kOversizedImages),
+      CreateParsedFeaturePolicyMatchesAll(
+          {blink::mojom::FeaturePolicyFeature::kGeolocation,
+           blink::mojom::FeaturePolicyFeature::kOversizedImages}),
       root->child_at(0)->current_replication_state().feature_policy_header);
 }
 
@@ -8858,9 +8878,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessFeaturePolicyJavaScriptBrowserTest,
   // exists.)
   NavigateFrameToURL(root->child_at(1), first_nav_url);
   EXPECT_EQ(
-      CreateFPHeaderMatchesAll(
-          blink::mojom::FeaturePolicyFeature::kGeolocation,
-          blink::mojom::FeaturePolicyFeature::kOversizedImages),
+      CreateParsedFeaturePolicyMatchesAll(
+          {blink::mojom::FeaturePolicyFeature::kGeolocation,
+           blink::mojom::FeaturePolicyFeature::kOversizedImages}),
       root->child_at(1)->current_replication_state().feature_policy_header);
 
   EXPECT_EQ(1UL, root->child_at(1)->child_count());
@@ -11929,7 +11949,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 // Create an out-of-process iframe that causes itself to be detached during
 // its layout/animate phase. See https://crbug.com/802932.
 // Disabled on Android due to flakiness, https://crbug.com/809580.
-#if defined(OS_ANDROID)
+// Disabled on Mac due to flakiness, https://crbug.com/1006122.
+#if defined(OS_ANDROID) || defined(OS_MACOSX)
 #define MAYBE_OOPIFDetachDuringAnimation DISABLED_OOPIFDetachDuringAnimation
 #else
 #define MAYBE_OOPIFDetachDuringAnimation OOPIFDetachDuringAnimation
@@ -12761,6 +12782,12 @@ class SitePerProcessBrowserTouchActionTest : public SitePerProcessBrowserTest {
       : compositor_touch_action_enabled_(
             base::FeatureList::IsEnabled(features::kCompositorTouchAction)) {}
 
+  bool GetTouchActionForceEnableZoom(RenderWidgetHost* rwh) {
+    InputRouterImpl* input_router = static_cast<InputRouterImpl*>(
+        static_cast<RenderWidgetHostImpl*>(rwh)->input_router());
+    return input_router->touch_action_filter_.force_enable_zoom_;
+  }
+
   // Computes the effective and white-listed touch action for |rwhv_child| by
   // dispatching a touch to it through |rwhv_root|. |rwhv_root| is the root
   // frame containing |rwhv_child|. |rwhv_child| is the child (or indirect
@@ -12862,6 +12889,76 @@ class SitePerProcessBrowserTouchActionTest : public SitePerProcessBrowserTest {
   const bool compositor_touch_action_enabled_;
 };
 
+#if defined(OS_ANDROID)
+// Class to set |force_enable_zoom| to true in WebkitPrefs.
+class EnableForceZoomContentClient : public TestContentBrowserClient {
+ public:
+  EnableForceZoomContentClient() = default;
+
+  void OverrideWebkitPrefs(RenderViewHost* render_view_host,
+                           WebPreferences* prefs) override {
+    DCHECK(old_client_);
+    old_client_->OverrideWebkitPrefs(render_view_host, prefs);
+    prefs->force_enable_zoom = true;
+  }
+
+  void set_old_client(ContentBrowserClient* old_client) {
+    old_client_ = old_client;
+  }
+
+ private:
+  ContentBrowserClient* old_client_ = nullptr;
+
+  DISALLOW_COPY_AND_ASSIGN(EnableForceZoomContentClient);
+};
+
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
+                       ForceEnableZoomPropagatesToChild) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b)"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+  FrameTreeNode* root = web_contents()->GetFrameTree()->root();
+  ASSERT_EQ(1U, root->child_count());
+  GURL b_url(embedded_test_server()->GetURL("b.com", "/title1.html"));
+  FrameTreeNode* child = root->child_at(0);
+  NavigateFrameToURL(child, b_url);
+  WaitForHitTestData(child->current_frame_host());
+
+  // Get access to child's TouchActionFilter.
+  RenderWidgetHost* child_rwh =
+      child->current_frame_host()->GetRenderWidgetHost();
+  EXPECT_FALSE(GetTouchActionForceEnableZoom(child_rwh));
+
+  EnableForceZoomContentClient new_client;
+  ContentBrowserClient* old_client = SetBrowserClientForTesting(&new_client);
+  new_client.set_old_client(old_client);
+
+  web_contents()->GetRenderViewHost()->OnWebkitPreferencesChanged();
+
+  EXPECT_TRUE(GetTouchActionForceEnableZoom(child_rwh));
+
+  // Add a new oopif child frame, and make sure it initializes with the correct
+  // value of ForceEnableZoom.
+  GURL c_url = embedded_test_server()->GetURL("c.com", "/title1.html");
+  std::string create_frame_script = base::StringPrintf(
+      "var new_iframe = document.createElement('iframe');"
+      "new_iframe.src = '%s';"
+      "document.body.appendChild(new_iframe);",
+      c_url.spec().c_str());
+  EXPECT_TRUE(ExecuteScript(root, create_frame_script));
+  EXPECT_TRUE(WaitForLoadStop(web_contents()));
+  ASSERT_EQ(2U, root->child_count());
+
+  FrameTreeNode* new_child = root->child_at(1);
+  EXPECT_NE(root->current_frame_host()->GetRenderWidgetHost(),
+            new_child->current_frame_host()->GetRenderWidgetHost());
+  EXPECT_TRUE(GetTouchActionForceEnableZoom(
+      new_child->current_frame_host()->GetRenderWidgetHost()));
+
+  SetBrowserClientForTesting(old_client);
+}
+#endif  // defined(OS_ANDROID)
+
 // Flaky on every platform, failing most of the time on Android.
 // See https://crbug.com/945734
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTouchActionTest,
@@ -13347,14 +13444,22 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       1);
 }
 
-IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
-                       ChildFrameCrashMetrics_ScrolledIntoViewAfterTabIsShown) {
-  // Disable the feature to mark hidden tabs with sad frames for reload, since
-  // it makes the scenario for which this test collects metrics impossible.
+class SitePerProcessBrowserTestWithoutSadFrameTabReload
+    : public SitePerProcessBrowserTest {
+ public:
+  SitePerProcessBrowserTestWithoutSadFrameTabReload() {
+    // Disable the feature to mark hidden tabs with sad frames for reload, since
+    // it makes the scenario for which this test collects metrics impossible.
+    feature_list_.InitAndDisableFeature(
+        features::kReloadHiddenTabsWithCrashedSubframes);
+  }
+
+ private:
   base::test::ScopedFeatureList feature_list_;
-  feature_list_.InitAndDisableFeature(
-      features::kReloadHiddenTabsWithCrashedSubframes);
+};
 
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTestWithoutSadFrameTabReload,
+                       ChildFrameCrashMetrics_ScrolledIntoViewAfterTabIsShown) {
   // Start on a page that has a single iframe, which is positioned out of
   // view, and navigate that iframe cross-site.
   GURL main_url(
@@ -13425,15 +13530,33 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
       1);
 }
 
+class SitePerProcessBrowserTestWithSadFrameTabReload
+    : public SitePerProcessBrowserTest {
+ public:
+  SitePerProcessBrowserTestWithSadFrameTabReload() {
+    // Disable the feature to mark hidden tabs with sad frames for reload, since
+    // it makes the scenario for which this test collects metrics impossible.
+    feature_list_.InitAndEnableFeature(
+        features::kReloadHiddenTabsWithCrashedSubframes);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
 // Verify the feature where hidden tabs with crashed subframes are marked for
 // reload.  This avoids showing crashed subframes if a hidden tab is eventually
 // shown.  See https://crbug.com/841572.
-IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
-                       ReloadHiddenTabWithCrashedSubframe) {
-  base::test::ScopedFeatureList feature_list_;
-  feature_list_.InitAndEnableFeature(
-      features::kReloadHiddenTabsWithCrashedSubframes);
-
+// crbug.com/1010119, fails on win.
+#if defined(OS_WIN)
+#define MAYBE_ReloadHiddenTabWithCrashedSubframe \
+  DISABLED_ReloadHiddenTabWithCrashedSubframe
+#else
+#define MAYBE_ReloadHiddenTabWithCrashedSubframe \
+  ReloadHiddenTabWithCrashedSubframe
+#endif
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTestWithSadFrameTabReload,
+                       MAYBE_ReloadHiddenTabWithCrashedSubframe) {
   auto crash_process = [](FrameTreeNode* ftn) {
     RenderProcessHost* process = ftn->current_frame_host()->GetProcess();
     RenderProcessHostWatcher crash_observer(
@@ -13457,6 +13580,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   // Kill the b.com subframe's process.  This should mark the hidden
   // WebContents for reload.
   {
+    SCOPED_TRACE("In-viewport sad frame on a hidden tab");
     base::HistogramTester histograms;
     crash_process(root->child_at(0));
     histograms.ExpectUniqueSample(
@@ -13482,10 +13606,12 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   GURL out_of_view_url(
       embedded_test_server()->GetURL("a.com", "/iframe_out_of_view.html"));
   EXPECT_TRUE(NavigateToURL(shell(), out_of_view_url));
+  EXPECT_EQ("LOADED", EvalJsWithManualReply(shell(), "notifyWhenLoaded();"));
   NavigateIframeToURL(web_contents(), "test_iframe",
                       embedded_test_server()->GetURL("b.com", "/title1.html"));
   web_contents()->UpdateWebContentsVisibility(Visibility::HIDDEN);
   {
+    SCOPED_TRACE("Out-of-viewport sad frame on a hidden tab");
     base::HistogramTester histograms;
     crash_process(root->child_at(0));
     histograms.ExpectUniqueSample(
@@ -13516,6 +13642,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 
   web_contents()->UpdateWebContentsVisibility(Visibility::HIDDEN);
   {
+    SCOPED_TRACE("display:none sad frame on a hidden tab");
     base::HistogramTester histograms;
     crash_process(root->child_at(0));
     histograms.ExpectUniqueSample(
@@ -13531,6 +13658,7 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
   EXPECT_EQ(Visibility::VISIBLE, web_contents()->GetVisibility());
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
   {
+    SCOPED_TRACE("Visible sad frame on a visible tab");
     base::HistogramTester histograms;
     crash_process(root->child_at(0));
     histograms.ExpectUniqueSample(
@@ -14235,7 +14363,8 @@ class ScrollingIntegrationTest : public SitePerProcessBrowserTest {
     params.gesture_source_type = source;
     params.anchor = gfx::PointF(point);
     params.distances.push_back(-distance);
-    params.precise_scrolling_deltas = true;
+    params.granularity =
+        ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
 
     auto gesture = std::make_unique<SyntheticSmoothScrollGesture>(params);
 
diff --git a/chromium/content/browser/site_per_process_hit_test_browsertest.cc b/chromium/content/browser/site_per_process_hit_test_browsertest.cc
index 1b42c32fcbb..11f68ea226f 100644
--- a/chromium/content/browser/site_per_process_hit_test_browsertest.cc
+++ b/chromium/content/browser/site_per_process_hit_test_browsertest.cc
@@ -717,7 +717,6 @@ class SitePerProcessHitTestBrowserTest
  protected:
   void SetUpCommandLine(base::CommandLine* command_line) override {
     SitePerProcessBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
     ui::PlatformEventSource::SetIgnoreNativePlatformEvents(true);
     if (std::get<0>(GetParam()) == HitTestType::kDrawQuad) {
       // Default enabled.
@@ -1148,10 +1147,11 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
       gfx::ToCeiledInt((bounds.y() - root_view->GetViewBounds().y() + 5) *
                        scale_factor));
   SetWebEventPositions(&scroll_event, position_in_widget, root_view);
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = 5.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
   router->RouteMouseWheelEvent(root_view, &scroll_event, ui::LatencyInfo());
   scroll_begin_observer.Wait();
 
@@ -1674,10 +1674,11 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
       blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   SetWebEventPositions(&scroll_event, position_in_root, root_rwhv);
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = 5.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
 
   router->RouteMouseWheelEvent(root_rwhv, &scroll_event, ui::LatencyInfo());
 
@@ -2553,15 +2554,17 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHighDPIHitTestBrowserTest,
   SurfaceHitTestTestHelper(shell(), embedded_test_server());
 }
 
+// TODO(crbug/1014602): NestedSurfaceHitTestTest is flaky.
+
 // Test that mouse events are being routed to the correct RenderWidgetHostView
 // when there are nested out-of-process iframes.
 IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
-                       NestedSurfaceHitTestTest) {
+                       DISABLED_NestedSurfaceHitTestTest) {
   NestedSurfaceHitTestTestHelper(shell(), embedded_test_server());
 }
 
 IN_PROC_BROWSER_TEST_P(SitePerProcessHighDPIHitTestBrowserTest,
-                       NestedSurfaceHitTestTest) {
+                       DISABLED_NestedSurfaceHitTestTest) {
   NestedSurfaceHitTestTestHelper(shell(), embedded_test_server());
 }
 
@@ -2718,9 +2721,8 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
 
 // This test tests that browser process hittesting ignores frames with
 // pointer-events: none.
-// crbug.com/968970: the test is flaky.
 IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
-                       DISABLED_SurfaceHitTestPointerEventsNoneChanged) {
+                       SurfaceHitTestPointerEventsNoneChanged) {
   GURL main_url(embedded_test_server()->GetURL(
       "/frame_tree/page_with_positioned_frame_pointer-events_none.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ -2731,6 +2733,7 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
 
   FrameTreeNode* child_node1 = root->child_at(0);
   FrameTreeNode* child_node2 = root->child_at(1);
+
   GURL site_url(embedded_test_server()->GetURL("bar.com", "/title1.html"));
   EXPECT_EQ(site_url, child_node2->current_url());
   EXPECT_NE(shell()->web_contents()->GetSiteInstance(),
@@ -2748,6 +2751,9 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
   RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
       root->current_frame_host()->GetRenderWidgetHost()->GetView());
 
+  // This is to make sure that the hit_test_data is clean before running the
+  // hit_test_data_change_observer below.
+  WaitForHitTestData(child_node1->current_frame_host());
   WaitForHitTestData(child_node2->current_frame_host());
 
   // Target input event to child1 frame.
@@ -2806,6 +2812,140 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
               kHitTestTolerance);
 }
 
+IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
+                       PointerEventsNoneWithNestedSameOriginIFrame) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "/frame_tree/page_with_same_origin_nested_frames.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  ASSERT_EQ(1U, root->child_count());
+  RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
+      root->current_frame_host()->GetRenderWidgetHost()->GetView());
+
+  EXPECT_EQ(
+      " Site A ------------ proxies for B\n"
+      "   +--Site A ------- proxies for B\n"
+      "        +--Site B -- proxies for A\n"
+      "Where A = http://127.0.0.1/\n"
+      "      B = http://baz.com/",
+      DepictFrameTree(root));
+
+  FrameTreeNode* child_node = root->child_at(0);
+  FrameTreeNode* grandchild_node = child_node->child_at(0);
+
+  // This is to make sure that the hit_test_data is clean before running the
+  // hit_test_data_change_observer.
+  WaitForHitTestData(child_node->current_frame_host());
+  WaitForHitTestData(grandchild_node->current_frame_host());
+
+  HitTestRegionObserver hit_test_data_change_observer(
+      root_view->GetRootFrameSinkId());
+  hit_test_data_change_observer.WaitForHitTestData();
+
+  EXPECT_TRUE(ExecuteScript(web_contents(),
+                            "document.getElementById('wrapper').style."
+                            "pointerEvents = 'none';"));
+
+  hit_test_data_change_observer.WaitForHitTestDataChange();
+
+  MainThreadFrameObserver observer(
+      root->current_frame_host()->GetRenderWidgetHost());
+  observer.Wait();
+
+  // ------------------------
+  // root    50px
+  //     ---------------------
+  //     |child  50px        |
+  // 50px|    -------------- |
+  //     |50px| grand_child ||
+  //     |    |             ||
+  //     |    |-------------||
+  //     ---------------------
+
+  // DispatchMouseEventAndWaitUntilDispatch will make sure the mouse event goes
+  // to the right frame. Create a listener for the grandchild to verify that it
+  // does not receive the event. No need to create one for the child because
+  // root and child are on the same process.
+  RenderWidgetHostMouseEventMonitor grandchild_frame_monitor(
+      grandchild_node->current_frame_host()->GetRenderWidgetHost());
+
+  // Since child has pointer-events: none, (125, 125) should be claimed by root.
+  DispatchMouseEventAndWaitUntilDispatch(web_contents(), root_view,
+                                         gfx::PointF(125, 125), root_view,
+                                         gfx::PointF(125, 125));
+  EXPECT_FALSE(grandchild_frame_monitor.EventWasReceived());
+}
+
+IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
+                       PointerEventsNoneWithNestedOOPIF) {
+  GURL main_url(embedded_test_server()->GetURL(
+      "/frame_tree/page_with_positioned_nested_frames.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  ASSERT_EQ(1U, root->child_count());
+  RenderWidgetHostViewBase* root_view = static_cast<RenderWidgetHostViewBase*>(
+      root->current_frame_host()->GetRenderWidgetHost()->GetView());
+
+  EXPECT_EQ(
+      " Site A ------------ proxies for B C\n"
+      "   +--Site B ------- proxies for A C\n"
+      "        +--Site C -- proxies for A B\n"
+      "Where A = http://127.0.0.1/\n"
+      "      B = http://a.com/\n"
+      "      C = http://baz.com/",
+      DepictFrameTree(root));
+
+  FrameTreeNode* child_node = root->child_at(0);
+  FrameTreeNode* grandchild_node = child_node->child_at(0);
+
+  // This is to make sure that the hit_test_data is clean before running the
+  // hit_test_data_change_observer.
+  WaitForHitTestData(child_node->current_frame_host());
+  WaitForHitTestData(grandchild_node->current_frame_host());
+
+  HitTestRegionObserver hit_test_data_change_observer(
+      root_view->GetRootFrameSinkId());
+  hit_test_data_change_observer.WaitForHitTestData();
+
+  EXPECT_TRUE(ExecuteScript(web_contents(),
+                            "document.getElementsByTagName('iframe')[0].style."
+                            "pointerEvents = 'none';"));
+
+  hit_test_data_change_observer.WaitForHitTestDataChange();
+
+  MainThreadFrameObserver observer(
+      root->current_frame_host()->GetRenderWidgetHost());
+  observer.Wait();
+
+  // ------------------------
+  // root    50px
+  //     ---------------------
+  //     |child  50px        |
+  // 50px|    -------------- |
+  //     |50px| grand_child ||
+  //     |    |             ||
+  //     |    |-------------||
+  //     ---------------------
+
+  // DispatchMouseEventAndWaitUntilDispatch will make sure the mouse event goes
+  // to the right frame. Create a listener for the child to verify that it does
+  // not receive the event.
+  RenderWidgetHostMouseEventMonitor child_frame_monitor(
+      child_node->current_frame_host()->GetRenderWidgetHost());
+
+  // Since child has pointer-events: none, (125, 125) should be claimed by root.
+  DispatchMouseEventAndWaitUntilDispatch(web_contents(), root_view,
+                                         gfx::PointF(125, 125), root_view,
+                                         gfx::PointF(125, 125));
+  EXPECT_FALSE(child_frame_monitor.EventWasReceived());
+}
+
 // This test tests that browser process can successfully hit test on nested
 // OOPIFs that are partially occluded by main frame elements.
 IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
@@ -3201,8 +3341,9 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
 
 // This test verifies that MouseEnter and MouseLeave events fire correctly
 // when the mouse cursor moves between processes.
+// Flaky (timeout): https://crbug.com/1006635.
 IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
-                       CrossProcessMouseEnterAndLeaveTest) {
+                       DISABLED_CrossProcessMouseEnterAndLeaveTest) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b,c(d))"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ -4359,10 +4500,11 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessMouseWheelHitTestBrowserTest,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   gfx::Point child_point_in_root(90, 90);
   SetWebEventPositions(&scroll_event, child_point_in_root, rwhv_root);
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
   scroll_event.delta_y = -20.0f;
   scroll_event.phase = blink::WebMouseWheelEvent::kPhaseBegan;
-  scroll_event.has_precise_scrolling_deltas = true;
 
   {
     InputEventAckWaiter await_begin_in_child(
@@ -5596,6 +5738,8 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
   scoped_refptr<ShowWidgetMessageFilter> filter = new ShowWidgetMessageFilter();
   c_node->current_frame_host()->GetProcess()->AddFilter(filter.get());
 
+  WaitForHitTestData(c_node->current_frame_host());
+
   // Target left-click event to child frame.
   blink::WebMouseEvent click_event(
       blink::WebInputEvent::kMouseDown, blink::WebInputEvent::kNoModifiers,
@@ -6137,7 +6281,7 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessNonIntegerScaleFactorHitTestBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_P(SitePerProcessNonIntegerScaleFactorHitTestBrowserTest,
-                       NestedSurfaceHitTestTest) {
+                       DISABLED_NestedSurfaceHitTestTest) {
   NestedSurfaceHitTestTestHelper(shell(), embedded_test_server());
 }
 
@@ -6408,6 +6552,18 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
   }
 }
 
+class SitePerProcessHitTestBrowserTestWithBrowserVerifiedUserActivation
+    : public SitePerProcessHitTestBrowserTest {
+ public:
+  SitePerProcessHitTestBrowserTestWithBrowserVerifiedUserActivation() {
+    feature_list_.InitAndEnableFeature(
+        features::kBrowserVerifiedUserActivation);
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+};
+
 #if defined(OS_LINUX)
 // Test is flaky. See https://crbug.com/995285
 #define MAYBE_RenderWidgetUserActivationStateTest \
@@ -6416,12 +6572,9 @@ IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
 #define MAYBE_RenderWidgetUserActivationStateTest \
   RenderWidgetUserActivationStateTest
 #endif
-IN_PROC_BROWSER_TEST_P(SitePerProcessHitTestBrowserTest,
-                       MAYBE_RenderWidgetUserActivationStateTest) {
-  base::test::ScopedFeatureList scoped_feature_list_;
-  scoped_feature_list_.InitAndEnableFeature(
-      features::kBrowserVerifiedUserActivation);
-
+IN_PROC_BROWSER_TEST_P(
+    SitePerProcessHitTestBrowserTestWithBrowserVerifiedUserActivation,
+    MAYBE_RenderWidgetUserActivationStateTest) {
   GURL main_url(embedded_test_server()->GetURL(
       "foo.com", "/frame_tree/page_with_positioned_frame.html"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
diff --git a/chromium/content/browser/site_per_process_mac_browsertest.mm b/chromium/content/browser/site_per_process_mac_browsertest.mm
index 908580526f5..ee078ea53bb 100644
--- a/chromium/content/browser/site_per_process_mac_browsertest.mm
+++ b/chromium/content/browser/site_per_process_mac_browsertest.mm
@@ -173,7 +173,8 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessMacBrowserTest,
       blink::WebInputEvent::kMouseWheel, blink::WebInputEvent::kNoModifiers,
       blink::WebInputEvent::GetStaticTimeStampForTests());
   scroll_event.SetPositionInWidget(1, 1);
-  scroll_event.has_precise_scrolling_deltas = true;
+  scroll_event.delta_units =
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
   scroll_event.delta_x = 0.0f;
 
   // Have the RWHVCF process a sequence of touchpad scroll events that contain
diff --git a/chromium/content/browser/site_per_process_unload_browsertest.cc b/chromium/content/browser/site_per_process_unload_browsertest.cc
index dfe8ce2aba4..566c4a57212 100644
--- a/chromium/content/browser/site_per_process_unload_browsertest.cc
+++ b/chromium/content/browser/site_per_process_unload_browsertest.cc
@@ -21,6 +21,7 @@
 #include "base/test/test_timeouts.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "base/time/time.h"
+#include "build/build_config.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/navigation_controller_impl.h"
@@ -29,6 +30,7 @@
 #include "content/browser/renderer_host/render_widget_host_view_child_frame.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/common/frame_messages.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/navigation_handle.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
@@ -377,7 +379,14 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
 // B2  A2
 //     |
 //     C3
-IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, UnloadHandlerSubframes) {
+// TODO(crbug.com/1012185): Flaky timeouts on Linux and Mac.
+#if defined(OS_LINUX) || defined(OS_MACOSX)
+#define MAYBE_UnloadHandlerSubframes DISABLED_UnloadHandlerSubframes
+#else
+#define MAYBE_UnloadHandlerSubframes UnloadHandlerSubframes
+#endif
+IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest,
+                       MAYBE_UnloadHandlerSubframes) {
   GURL main_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(c(b),c(a(c))),d)"));
   EXPECT_TRUE(NavigateToURL(shell(), main_url));
@@ -473,6 +482,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, SlowUnloadHandlerInIframe) {
 // Navigate from A(B(A(B)) to C. Check the unload handler are executed, executed
 // in the right order and the processes for A and B are removed.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, Unload_ABAB) {
+  web_contents()->GetController().GetBackForwardCache().DisableForTesting(
+      content::BackForwardCache::TEST_USES_UNLOAD_EVENT);
+
   GURL initial_url(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(a(b)))"));
   GURL next_url(embedded_test_server()->GetURL("c.com", "/title1.html"));
@@ -608,6 +620,9 @@ IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, UnloadNestedPendingDeletion) {
 // If B1 receives FrameHostMsg_OnDetach before A2, it should not destroy itself
 // and its children, but rather wait for A2.
 IN_PROC_BROWSER_TEST_F(SitePerProcessBrowserTest, PartialUnloadHandler) {
+  web_contents()->GetController().GetBackForwardCache().DisableForTesting(
+      content::BackForwardCache::TEST_USES_UNLOAD_EVENT);
+
   GURL url_aba(embedded_test_server()->GetURL(
       "a.com", "/cross_site_iframe_factory.html?a(b(a))"));
   GURL url_c(embedded_test_server()->GetURL("c.com", "/title1.html"));
diff --git a/chromium/content/browser/sms/sms_browsertest.cc b/chromium/content/browser/sms/sms_browsertest.cc
index cffc46ba570..a99c5b1b2a1 100644
--- a/chromium/content/browser/sms/sms_browsertest.cc
+++ b/chromium/content/browser/sms/sms_browsertest.cc
@@ -97,7 +97,7 @@ class SmsBrowserTest : public ContentBrowserTest {
 
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Receive) {
   GURL url = GetTestUrl(nullptr, "simple_page.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   shell()->web_contents()->SetDelegate(&delegate_);
 
@@ -139,7 +139,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Receive) {
 
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, AtMostOnePendingSmsRequest) {
   GURL url = GetTestUrl(nullptr, "simple_page.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   shell()->web_contents()->SetDelegate(&delegate_);
 
@@ -194,7 +194,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, AtMostOnePendingSmsRequest) {
 
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Reload) {
   GURL url = GetTestUrl(nullptr, "simple_page.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   auto* provider = new NiceMock<MockSmsProvider>();
   BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(
@@ -227,7 +227,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Reload) {
                                         ukm_loop.QuitClosure());
 
   // Reload the page.
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   ukm_loop.Run();
 
@@ -238,7 +238,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Reload) {
 
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Close) {
   GURL url = GetTestUrl(nullptr, "simple_page.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   auto* provider = new NiceMock<MockSmsProvider>();
   BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(
@@ -278,8 +278,8 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, TwoTabsSameOrigin) {
 
   GURL url = GetTestUrl(nullptr, "simple_page.html");
 
-  NavigateToURL(tab1, url);
-  NavigateToURL(tab2, url);
+  EXPECT_TRUE(NavigateToURL(tab1, url));
+  EXPECT_TRUE(NavigateToURL(tab2, url));
 
   std::string script = R"(
     navigator.sms.receive().then(({content}) => {
@@ -394,8 +394,8 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, TwoTabsDifferentOrigin) {
   GURL url1 = https_server.GetURL("a.com", "/simple_page.html");
   GURL url2 = https_server.GetURL("b.com", "/simple_page.html");
 
-  NavigateToURL(tab1, url1);
-  NavigateToURL(tab2, url2);
+  EXPECT_TRUE(NavigateToURL(tab1, url1));
+  EXPECT_TRUE(NavigateToURL(tab2, url2));
 
   std::string script = R"(
     navigator.sms.receive().then(({content}) => {
@@ -471,7 +471,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, TwoTabsDifferentOrigin) {
 
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, SmsReceivedAfterTabIsClosed) {
   GURL url = GetTestUrl(nullptr, "simple_page.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   auto* provider = new NiceMock<MockSmsProvider>();
   BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(
@@ -502,7 +502,7 @@ IN_PROC_BROWSER_TEST_F(SmsBrowserTest, SmsReceivedAfterTabIsClosed) {
 
 IN_PROC_BROWSER_TEST_F(SmsBrowserTest, Cancels) {
   GURL url = GetTestUrl(nullptr, "simple_page.html");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   auto* provider = new NiceMock<MockSmsProvider>();
   BrowserMainLoop::GetInstance()->SetSmsProviderForTesting(
diff --git a/chromium/content/browser/snapshot_browsertest.cc b/chromium/content/browser/snapshot_browsertest.cc
index 1ed8faf153c..d4288b23602 100644
--- a/chromium/content/browser/snapshot_browsertest.cc
+++ b/chromium/content/browser/snapshot_browsertest.cc
@@ -24,6 +24,7 @@
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/shell/common/shell_switches.h"
+#include "gpu/command_buffer/service/gpu_switches.h"
 #include "net/test/embedded_test_server/http_request.h"
 #include "net/test/embedded_test_server/http_response.h"
 #include "third_party/skia/include/core/SkBitmap.h"
@@ -89,8 +90,8 @@ class SnapshotBrowserTest : public ContentBrowserTest {
         &SnapshotBrowserTest::HandleRequest, base::Unretained(this)));
     ASSERT_TRUE(embedded_test_server()->Start());
 
-    ASSERT_NO_FATAL_FAILURE(content::NavigateToURL(
-        shell(), embedded_test_server()->GetURL("/test")));
+    ASSERT_TRUE(
+        NavigateToURL(shell(), embedded_test_server()->GetURL("/test")));
   }
 
   std::unique_ptr<net::test_server::HttpResponse> HandleRequest(
diff --git a/chromium/content/browser/speech/mock_tts_controller.cc b/chromium/content/browser/speech/mock_tts_controller.cc
index 7d8d632d069..50e3b57e3fa 100644
--- a/chromium/content/browser/speech/mock_tts_controller.cc
+++ b/chromium/content/browser/speech/mock_tts_controller.cc
@@ -26,7 +26,7 @@ class MockTtsController : public TtsController {
 
   bool IsSpeaking() override { return false; }
 
-  void SpeakOrEnqueue(TtsUtterance* utterance) override {}
+  void SpeakOrEnqueue(std::unique_ptr<TtsUtterance> utterance) override {}
 
   void Stop() override {}
 
diff --git a/chromium/content/browser/speech/speech_recognition_dispatcher_host.cc b/chromium/content/browser/speech/speech_recognition_dispatcher_host.cc
index fea528fab13..1cc1a1aec15 100644
--- a/chromium/content/browser/speech/speech_recognition_dispatcher_host.cc
+++ b/chromium/content/browser/speech/speech_recognition_dispatcher_host.cc
@@ -190,8 +190,8 @@ void SpeechRecognitionDispatcherHost::StartSessionOnIO(
       SpeechRecognitionManager::GetInstance()->CreateSession(config);
   DCHECK_NE(session_id, SpeechRecognitionManager::kSessionIDInvalid);
   session->SetSessionId(session_id);
-  mojo::MakeStrongBinding(std::move(session),
-                          std::move(params->session_request));
+  mojo::MakeSelfOwnedReceiver(std::move(session),
+                              std::move(params->session_receiver));
 
   SpeechRecognitionManager::GetInstance()->StartSession(session_id);
 }
@@ -199,11 +199,11 @@ void SpeechRecognitionDispatcherHost::StartSessionOnIO(
 // ---------------------- SpeechRecognizerSession -----------------------------
 
 SpeechRecognitionSession::SpeechRecognitionSession(
-    blink::mojom::SpeechRecognitionSessionClientPtrInfo client_ptr_info)
+    mojo::PendingRemote<blink::mojom::SpeechRecognitionSessionClient> client)
     : session_id_(SpeechRecognitionManager::kSessionIDInvalid),
-      client_(std::move(client_ptr_info)),
+      client_(std::move(client)),
       stopped_(false) {
-  client_.set_connection_error_handler(
+  client_.set_disconnect_handler(
       base::BindOnce(&SpeechRecognitionSession::ConnectionErrorHandler,
                      base::Unretained(this)));
 }
diff --git a/chromium/content/browser/speech/speech_recognition_dispatcher_host.h b/chromium/content/browser/speech/speech_recognition_dispatcher_host.h
index e373c23109a..46213409fed 100644
--- a/chromium/content/browser/speech/speech_recognition_dispatcher_host.h
+++ b/chromium/content/browser/speech/speech_recognition_dispatcher_host.h
@@ -15,6 +15,8 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/speech_recognition_event_listener.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/speech/speech_recognizer.mojom.h"
 
 namespace network {
@@ -74,13 +76,14 @@ class CONTENT_EXPORT SpeechRecognitionDispatcherHost
 // SpeechRecognitionSession implements the
 // blink::mojom::SpeechRecognitionSession interface for a particular session. It
 // also acts as a proxy for events sent from SpeechRecognitionManager, and
-// forwards the events to the renderer using a SpeechRecognitionSessionClientPtr
-// (that is passed from the render process).
+// forwards the events to the renderer using a
+// mojo::Remote<SpeechRecognitionSessionClient> (that is passed from the render
+// process).
 class SpeechRecognitionSession : public blink::mojom::SpeechRecognitionSession,
                                  public SpeechRecognitionEventListener {
  public:
   explicit SpeechRecognitionSession(
-      blink::mojom::SpeechRecognitionSessionClientPtrInfo client_ptr_info);
+      mojo::PendingRemote<blink::mojom::SpeechRecognitionSessionClient> client);
   ~SpeechRecognitionSession() override;
   base::WeakPtr<SpeechRecognitionSession> AsWeakPtr();
 
@@ -113,7 +116,7 @@ class SpeechRecognitionSession : public blink::mojom::SpeechRecognitionSession,
   void ConnectionErrorHandler();
 
   int session_id_;
-  blink::mojom::SpeechRecognitionSessionClientPtr client_;
+  mojo::Remote<blink::mojom::SpeechRecognitionSessionClient> client_;
   bool stopped_;
 
   base::WeakPtrFactory<SpeechRecognitionSession> weak_factory_{this};
diff --git a/chromium/content/browser/speech/speech_recognition_engine.cc b/chromium/content/browser/speech/speech_recognition_engine.cc
index 8cf67c6dbec..e55a430e581 100644
--- a/chromium/content/browser/speech/speech_recognition_engine.cc
+++ b/chromium/content/browser/speech/speech_recognition_engine.cc
@@ -18,7 +18,7 @@
 #include "content/browser/speech/proto/google_streaming_api.pb.h"
 #include "google_apis/google_api_keys.h"
 #include "mojo/public/c/system/types.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "net/base/escape.h"
 #include "net/base/load_flags.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
@@ -91,10 +91,11 @@ class SpeechRecognitionEngine::UpstreamLoader
                  SpeechRecognitionEngine* speech_recognition_engine)
       : speech_recognition_engine_(speech_recognition_engine) {
     // Attach a chunked upload body.
-    network::mojom::ChunkedDataPipeGetterPtr data_pipe;
-    binding_set_.AddBinding(this, mojo::MakeRequest(&data_pipe));
+    mojo::PendingRemote<network::mojom::ChunkedDataPipeGetter> data_remote;
+    receiver_set_.Add(this, data_remote.InitWithNewPipeAndPassReceiver());
     resource_request->request_body = new network::ResourceRequestBody();
-    resource_request->request_body->SetToChunkedDataPipe(std::move(data_pipe));
+    resource_request->request_body->SetToChunkedDataPipe(
+        std::move(data_remote));
     simple_url_loader_ = network::SimpleURLLoader::Create(
         std::move(resource_request), upstream_traffic_annotation);
     simple_url_loader_->DownloadToStringOfUnboundedSizeUntilCrashAndDie(
@@ -219,7 +220,7 @@ class SpeechRecognitionEngine::UpstreamLoader
 
   SpeechRecognitionEngine* const speech_recognition_engine_;
   std::unique_ptr<network::SimpleURLLoader> simple_url_loader_;
-  mojo::BindingSet<network::mojom::ChunkedDataPipeGetter> binding_set_;
+  mojo::ReceiverSet<network::mojom::ChunkedDataPipeGetter> receiver_set_;
 
   DISALLOW_COPY_AND_ASSIGN(UpstreamLoader);
 };
diff --git a/chromium/content/browser/speech/speech_recognition_engine_unittest.cc b/chromium/content/browser/speech/speech_recognition_engine_unittest.cc
index 8465c9bc176..889760af80b 100644
--- a/chromium/content/browser/speech/speech_recognition_engine_unittest.cc
+++ b/chromium/content/browser/speech/speech_recognition_engine_unittest.cc
@@ -18,6 +18,7 @@
 #include "base/test/task_environment.h"
 #include "content/browser/speech/audio_buffer.h"
 #include "content/browser/speech/proto/google_streaming_api.pb.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_util.h"
@@ -104,7 +105,7 @@ class SpeechRecognitionEngineTest
 
   network::TestURLLoaderFactory url_loader_factory_;
   mojo::ScopedDataPipeProducerHandle downstream_data_pipe_;
-  network::mojom::ChunkedDataPipeGetterPtr chunked_data_pipe_getter_;
+  mojo::Remote<network::mojom::ChunkedDataPipeGetter> chunked_data_pipe_getter_;
   mojo::ScopedDataPipeConsumerHandle upstream_data_pipe_;
 
   std::unique_ptr<SpeechRecognitionEngine> engine_under_test_;
diff --git a/chromium/content/browser/speech/speech_recognition_manager_impl.cc b/chromium/content/browser/speech/speech_recognition_manager_impl.cc
index ef6371fed6f..9a55a7c6e80 100644
--- a/chromium/content/browser/speech/speech_recognition_manager_impl.cc
+++ b/chromium/content/browser/speech/speech_recognition_manager_impl.cc
@@ -35,6 +35,7 @@
 #include "content/public/browser/speech_recognition_session_context.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_client.h"
 #include "media/audio/audio_device_description.h"
 #include "third_party/blink/public/mojom/speech/speech_recognition_error.mojom.h"
 #include "third_party/blink/public/mojom/speech/speech_recognition_result.mojom.h"
diff --git a/chromium/content/browser/speech/speech_recognizer_impl.cc b/chromium/content/browser/speech/speech_recognizer_impl.cc
index ac501d619c1..94aa4bff631 100644
--- a/chromium/content/browser/speech/speech_recognizer_impl.cc
+++ b/chromium/content/browser/speech/speech_recognizer_impl.cc
@@ -10,6 +10,7 @@
 
 #include "base/bind.h"
 #include "base/macros.h"
+#include "base/numerics/ranges.h"
 #include "base/task/post_task.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
@@ -231,7 +232,8 @@ void SpeechRecognizerImpl::StartRecognition(const std::string& device_id) {
 
 void SpeechRecognizerImpl::AbortRecognition() {
   base::PostTask(FROM_HERE, {BrowserThread::IO},
-                 base::BindOnce(&SpeechRecognizerImpl::DispatchEvent, this,
+                 base::BindOnce(&SpeechRecognizerImpl::DispatchEvent,
+                                weak_ptr_factory_.GetWeakPtr(),
                                 FSMEventArgs(EVENT_ABORT)));
 }
 
@@ -847,15 +849,15 @@ void SpeechRecognizerImpl::UpdateSignalAndNoiseLevels(const float& rms,
   // Perhaps it might be quite expensive on mobile.
   float level = (rms - kAudioMeterMinDb) /
       (kAudioMeterDbRange / kAudioMeterRangeMaxUnclipped);
-  level = std::min(std::max(0.0f, level), kAudioMeterRangeMaxUnclipped);
+  level = base::ClampToRange(level, 0.0f, kAudioMeterRangeMaxUnclipped);
   const float smoothing_factor = (level > audio_level_) ? kUpSmoothingFactor :
                                                           kDownSmoothingFactor;
   audio_level_ += (level - audio_level_) * smoothing_factor;
 
   float noise_level = (endpointer_.NoiseLevelDb() - kAudioMeterMinDb) /
       (kAudioMeterDbRange / kAudioMeterRangeMaxUnclipped);
-  noise_level = std::min(std::max(0.0f, noise_level),
-                         kAudioMeterRangeMaxUnclipped);
+  noise_level =
+      base::ClampToRange(noise_level, 0.0f, kAudioMeterRangeMaxUnclipped);
 
   listener()->OnAudioLevelsChange(
       session_id(), clip_detected ? 1.0f : audio_level_, noise_level);
diff --git a/chromium/content/browser/speech/speech_recognizer_impl_unittest.cc b/chromium/content/browser/speech/speech_recognizer_impl_unittest.cc
index 8bceb16c955..45e8eb7166a 100644
--- a/chromium/content/browser/speech/speech_recognizer_impl_unittest.cc
+++ b/chromium/content/browser/speech/speech_recognizer_impl_unittest.cc
@@ -30,6 +30,7 @@
 #include "media/audio/test_audio_thread.h"
 #include "media/base/audio_bus.h"
 #include "media/base/test_helpers.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/base/net_errors.h"
@@ -411,7 +412,7 @@ TEST_F(SpeechRecognizerImplTest, StopWithData) {
   // that we are streaming out encoded data as chunks without waiting for the
   // full recording to complete.
   const size_t kNumChunks = 5;
-  network::mojom::ChunkedDataPipeGetterPtr chunked_data_pipe_getter;
+  mojo::Remote<network::mojom::ChunkedDataPipeGetter> chunked_data_pipe_getter;
   mojo::DataPipe data_pipe;
   for (size_t i = 0; i < kNumChunks; ++i) {
     Capture(audio_bus_.get());
diff --git a/chromium/content/browser/speech/speech_synthesis_impl.cc b/chromium/content/browser/speech/speech_synthesis_impl.cc
index 412b8bde26f..1ab5ad01656 100644
--- a/chromium/content/browser/speech/speech_synthesis_impl.cc
+++ b/chromium/content/browser/speech/speech_synthesis_impl.cc
@@ -132,7 +132,7 @@ void SpeechSynthesisImpl::Speak(
   // See comments on EventThunk about how lifetime of this instance is managed.
   tts_utterance->SetEventDelegate(new EventThunk(std::move(client)));
 
-  TtsController::GetInstance()->SpeakOrEnqueue(tts_utterance.release());
+  TtsController::GetInstance()->SpeakOrEnqueue(std::move(tts_utterance));
 }
 
 void SpeechSynthesisImpl::Pause() {
diff --git a/chromium/content/browser/speech/tts_controller_impl.cc b/chromium/content/browser/speech/tts_controller_impl.cc
index e64ffbd6ac3..7ba7e7e5e6e 100644
--- a/chromium/content/browser/speech/tts_controller_impl.cc
+++ b/chromium/content/browser/speech/tts_controller_impl.cc
@@ -18,6 +18,7 @@
 #include "build/build_config.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/system_connector.h"
+#include "content/public/common/content_client.h"
 #include "services/data_decoder/public/cpp/safe_xml_parser.h"
 #include "services/data_decoder/public/mojom/constants.mojom.h"
 #include "services/data_decoder/public/mojom/xml_parser.mojom.h"
@@ -88,28 +89,29 @@ TtsControllerImpl::TtsControllerImpl()
 TtsControllerImpl::~TtsControllerImpl() {
   if (current_utterance_) {
     current_utterance_->Finish();
-    delete current_utterance_;
+    current_utterance_.reset();
   }
 
   // Clear any queued utterances too.
   ClearUtteranceQueue(false);  // Don't sent events.
 }
 
-void TtsControllerImpl::SpeakOrEnqueue(TtsUtterance* utterance) {
+void TtsControllerImpl::SpeakOrEnqueue(
+    std::unique_ptr<TtsUtterance> utterance) {
   // If we're paused and we get an utterance that can't be queued,
   // flush the queue but stay in the paused state.
   if (paused_ && !utterance->GetCanEnqueue()) {
-    utterance_queue_.push(utterance);
+    utterance_queue_.emplace(std::move(utterance));
     Stop();
     paused_ = true;
     return;
   }
 
   if (paused_ || (IsSpeaking() && utterance->GetCanEnqueue())) {
-    utterance_queue_.push(utterance);
+    utterance_queue_.emplace(std::move(utterance));
   } else {
     Stop();
-    SpeakNow(utterance);
+    SpeakNow(std::move(utterance));
   }
 }
 
@@ -129,7 +131,7 @@ void TtsControllerImpl::Stop(const GURL& source_url) {
   if (current_utterance_ && !current_utterance_->GetEngineId().empty()) {
     if (GetTtsControllerDelegate()->GetTtsEngineDelegate())
       GetTtsControllerDelegate()->GetTtsEngineDelegate()->Stop(
-          current_utterance_);
+          current_utterance_.get());
   } else {
     GetTtsPlatform()->ClearError();
     GetTtsPlatform()->StopSpeaking();
@@ -149,7 +151,7 @@ void TtsControllerImpl::Pause() {
   if (current_utterance_ && !current_utterance_->GetEngineId().empty()) {
     if (GetTtsControllerDelegate()->GetTtsEngineDelegate())
       GetTtsControllerDelegate()->GetTtsEngineDelegate()->Pause(
-          current_utterance_);
+          current_utterance_.get());
   } else if (current_utterance_) {
     GetTtsPlatform()->ClearError();
     GetTtsPlatform()->Pause();
@@ -163,7 +165,7 @@ void TtsControllerImpl::Resume() {
   if (current_utterance_ && !current_utterance_->GetEngineId().empty()) {
     if (GetTtsControllerDelegate()->GetTtsEngineDelegate())
       GetTtsControllerDelegate()->GetTtsEngineDelegate()->Resume(
-          current_utterance_);
+          current_utterance_.get());
   } else if (current_utterance_) {
     GetTtsPlatform()->ClearError();
     GetTtsPlatform()->Resume();
@@ -273,15 +275,13 @@ void TtsControllerImpl::RemoveVoicesChangedDelegate(
 void TtsControllerImpl::RemoveUtteranceEventDelegate(
     UtteranceEventDelegate* delegate) {
   // First clear any pending utterances with this delegate.
-  base::queue<TtsUtterance*> old_queue = utterance_queue_;
-  utterance_queue_ = base::queue<TtsUtterance*>();
+  base::queue<std::unique_ptr<TtsUtterance>> old_queue;
+  utterance_queue_.swap(old_queue);
   while (!old_queue.empty()) {
-    TtsUtterance* utterance = old_queue.front();
+    std::unique_ptr<TtsUtterance> utterance = std::move(old_queue.front());
     old_queue.pop();
     if (utterance->GetEventDelegate() != delegate)
-      utterance_queue_.push(utterance);
-    else
-      delete utterance;
+      utterance_queue_.emplace(std::move(utterance));
   }
 
   if (current_utterance_ &&
@@ -290,7 +290,7 @@ void TtsControllerImpl::RemoveUtteranceEventDelegate(
     if (!current_utterance_->GetEngineId().empty()) {
       if (GetTtsControllerDelegate()->GetTtsEngineDelegate())
         GetTtsControllerDelegate()->GetTtsEngineDelegate()->Stop(
-            current_utterance_);
+            current_utterance_.get());
     } else {
       GetTtsPlatform()->ClearError();
       GetTtsPlatform()->StopSpeaking();
@@ -330,9 +330,14 @@ TtsPlatform* TtsControllerImpl::GetTtsPlatform() {
   return tts_platform_;
 }
 
-void TtsControllerImpl::SpeakNow(TtsUtterance* utterance) {
-  if (!GetTtsControllerDelegate())
+void TtsControllerImpl::SpeakNow(std::unique_ptr<TtsUtterance> utterance) {
+  // TODO(crbug/1003410): Change to always have a valid TtsControllerDelegate.
+  // This may involve modifying tests to register a mock implementation.
+  if (!GetTtsControllerDelegate()) {
+    utterance->OnTtsEvent(TTS_EVENT_CANCELLED, kInvalidCharIndex,
+                          kInvalidLength, std::string());
     return;
+  }
 
   // Get all available voices and try to find a matching voice.
   std::vector<VoiceData> voices;
@@ -342,16 +347,17 @@ void TtsControllerImpl::SpeakNow(TtsUtterance* utterance) {
   // to true because that might trigger deferred loading of native voices.
   // TODO(katie): Move most of the GetMatchingVoice logic into content/ and
   // use the TTS controller delegate to get chrome-specific info as needed.
-  int index = GetTtsControllerDelegate()->GetMatchingVoice(utterance, voices);
+  int index =
+      GetTtsControllerDelegate()->GetMatchingVoice(utterance.get(), voices);
   VoiceData voice;
   if (index >= 0)
     voice = voices[index];
   else
     voice.native = true;
 
-  UpdateUtteranceDefaults(utterance);
+  UpdateUtteranceDefaults(utterance.get());
 
-  GetTtsPlatform()->WillSpeakUtteranceWithVoice(utterance, voice);
+  GetTtsPlatform()->WillSpeakUtteranceWithVoice(utterance.get(), voice);
 
   base::RecordAction(base::UserMetricsAction("TextToSpeech.Speak"));
   UMA_HISTOGRAM_COUNTS_100000("TextToSpeech.Utterance.TextLength",
@@ -373,63 +379,66 @@ void TtsControllerImpl::SpeakNow(TtsUtterance* utterance) {
   if (!voice.native) {
 #if !defined(OS_ANDROID)
     DCHECK(!voice.engine_id.empty());
-    current_utterance_ = utterance;
-    utterance->SetEngineId(voice.engine_id);
+    current_utterance_ = std::move(utterance);
+    current_utterance_->SetEngineId(voice.engine_id);
     if (GetTtsControllerDelegate()->GetTtsEngineDelegate())
-      GetTtsControllerDelegate()->GetTtsEngineDelegate()->Speak(utterance,
-                                                                voice);
+      GetTtsControllerDelegate()->GetTtsEngineDelegate()->Speak(
+          current_utterance_.get(), voice);
     bool sends_end_event =
         voice.events.find(TTS_EVENT_END) != voice.events.end();
     if (!sends_end_event) {
-      utterance->Finish();
-      delete utterance;
-      current_utterance_ = nullptr;
+      current_utterance_->Finish();
+      current_utterance_.reset();
       SpeakNextUtterance();
     }
 #endif
   } else {
     // It's possible for certain platforms to send start events immediately
     // during |speak|.
-    current_utterance_ = utterance;
+    current_utterance_ = std::move(utterance);
     GetTtsPlatform()->ClearError();
-    GetTtsPlatform()->Speak(utterance->GetId(), utterance->GetText(),
-                            utterance->GetLang(), voice,
-                            utterance->GetContinuousParameters(),
-                            base::BindOnce(&TtsControllerImpl::OnSpeakFinished,
-                                           base::Unretained(this), utterance));
+    GetTtsPlatform()->Speak(
+        current_utterance_->GetId(), current_utterance_->GetText(),
+        current_utterance_->GetLang(), voice,
+        current_utterance_->GetContinuousParameters(),
+        base::BindOnce(&TtsControllerImpl::OnSpeakFinished,
+                       base::Unretained(this), current_utterance_->GetId()));
   }
 }
 
-void TtsControllerImpl::OnSpeakFinished(TtsUtterance* utterance, bool success) {
-  if (!success)
-    current_utterance_ = nullptr;
+void TtsControllerImpl::OnSpeakFinished(int utterance_id, bool success) {
+  if (success)
+    return;
+
+  // Since OnSpeakFinished could run asynchronously, it is possible that the
+  // current utterance has changed. Ignore any such spurious callbacks.
+  if (!current_utterance_ || current_utterance_->GetId() != utterance_id)
+    return;
 
   // If the native voice wasn't able to process this speech, see if
   // the browser has built-in TTS that isn't loaded yet.
-  if (!success &&
-      GetTtsPlatform()->LoadBuiltInTtsEngine(utterance->GetBrowserContext())) {
-    utterance_queue_.push(utterance);
+  if (GetTtsPlatform()->LoadBuiltInTtsEngine(
+          current_utterance_->GetBrowserContext())) {
+    utterance_queue_.emplace(std::move(current_utterance_));
     return;
   }
 
-  if (!success) {
-    utterance->OnTtsEvent(TTS_EVENT_ERROR, kInvalidCharIndex, kInvalidLength,
-                          GetTtsPlatform()->GetError());
-    delete utterance;
-    return;
-  }
+  current_utterance_->OnTtsEvent(TTS_EVENT_ERROR, kInvalidCharIndex,
+                                 kInvalidLength, GetTtsPlatform()->GetError());
+  current_utterance_.reset();
 }
 
 void TtsControllerImpl::ClearUtteranceQueue(bool send_events) {
   while (!utterance_queue_.empty()) {
-    TtsUtterance* utterance = utterance_queue_.front();
+    std::unique_ptr<TtsUtterance> utterance =
+        std::move(utterance_queue_.front());
     utterance_queue_.pop();
-    if (send_events)
+    if (send_events) {
       utterance->OnTtsEvent(TTS_EVENT_CANCELLED, kInvalidCharIndex,
                             kInvalidLength, std::string());
-    else
+    } else {
       utterance->Finish();
-    delete utterance;
+    }
   }
 }
 
@@ -438,8 +447,7 @@ void TtsControllerImpl::FinishCurrentUtterance() {
     if (!current_utterance_->IsFinished())
       current_utterance_->OnTtsEvent(TTS_EVENT_INTERRUPTED, kInvalidCharIndex,
                                      kInvalidLength, std::string());
-    delete current_utterance_;
-    current_utterance_ = nullptr;
+    current_utterance_.reset();
   }
 }
 
@@ -450,9 +458,10 @@ void TtsControllerImpl::SpeakNextUtterance() {
   // Start speaking the next utterance in the queue.  Keep trying in case
   // one fails but there are still more in the queue to try.
   while (!utterance_queue_.empty() && !current_utterance_) {
-    TtsUtterance* utterance = utterance_queue_.front();
+    std::unique_ptr<TtsUtterance> utterance =
+        std::move(utterance_queue_.front());
     utterance_queue_.pop();
-    SpeakNow(utterance);
+    SpeakNow(std::move(utterance));
   }
 }
 
diff --git a/chromium/content/browser/speech/tts_controller_impl.h b/chromium/content/browser/speech/tts_controller_impl.h
index 921beb6877a..c593948ff12 100644
--- a/chromium/content/browser/speech/tts_controller_impl.h
+++ b/chromium/content/browser/speech/tts_controller_impl.h
@@ -39,7 +39,7 @@ class CONTENT_EXPORT TtsControllerImpl : public TtsController {
 
   // TtsController methods
   bool IsSpeaking() override;
-  void SpeakOrEnqueue(TtsUtterance* utterance) override;
+  void SpeakOrEnqueue(std::unique_ptr<TtsUtterance> utterance) override;
   void Stop() override;
   void Stop(const GURL& source_url) override;
   void Pause() override;
@@ -84,7 +84,7 @@ class CONTENT_EXPORT TtsControllerImpl : public TtsController {
 
   // Start speaking the given utterance. Will either take ownership of
   // |utterance| or delete it if there's an error. Returns true on success.
-  void SpeakNow(TtsUtterance* utterance);
+  void SpeakNow(std::unique_ptr<TtsUtterance> utterance);
 
   // Clear the utterance queue. If send_events is true, will send
   // TTS_EVENT_CANCELLED events on each one.
@@ -102,7 +102,7 @@ class CONTENT_EXPORT TtsControllerImpl : public TtsController {
   void UpdateUtteranceDefaults(TtsUtterance* utterance);
 
   // Passed to Speak() as a callback.
-  void OnSpeakFinished(TtsUtterance* utterance, bool success);
+  void OnSpeakFinished(int utterance_id, bool success);
 
   // Static helper methods for StripSSML.
   static void StripSSMLHelper(
@@ -121,7 +121,7 @@ class CONTENT_EXPORT TtsControllerImpl : public TtsController {
   base::ObserverList<VoicesChangedDelegate> voices_changed_delegates_;
 
   // The current utterance being spoken.
-  TtsUtterance* current_utterance_;
+  std::unique_ptr<TtsUtterance> current_utterance_;
 
   // Whether the queue is paused or not.
   bool paused_;
@@ -131,7 +131,7 @@ class CONTENT_EXPORT TtsControllerImpl : public TtsController {
   TtsPlatform* tts_platform_;
 
   // A queue of utterances to speak after the current one finishes.
-  base::queue<TtsUtterance*> utterance_queue_;
+  base::queue<std::unique_ptr<TtsUtterance>> utterance_queue_;
 
   DISALLOW_COPY_AND_ASSIGN(TtsControllerImpl);
 };
diff --git a/chromium/content/browser/speech/tts_controller_unittest.cc b/chromium/content/browser/speech/tts_controller_unittest.cc
index 4210e6f9a3e..7ef09febda1 100644
--- a/chromium/content/browser/speech/tts_controller_unittest.cc
+++ b/chromium/content/browser/speech/tts_controller_unittest.cc
@@ -83,15 +83,15 @@ TEST_F(TtsControllerTest, TestTtsControllerShutdown) {
 
   controller->SetTtsPlatform(&platform_impl);
 
-  TtsUtterance* utterance1 = TtsUtterance::Create(nullptr);
+  std::unique_ptr<TtsUtterance> utterance1 = TtsUtterance::Create(nullptr);
   utterance1->SetCanEnqueue(true);
   utterance1->SetSrcId(1);
-  controller->SpeakOrEnqueue(utterance1);
+  controller->SpeakOrEnqueue(std::move(utterance1));
 
-  TtsUtterance* utterance2 = TtsUtterance::Create(nullptr);
+  std::unique_ptr<TtsUtterance> utterance2 = TtsUtterance::Create(nullptr);
   utterance2->SetCanEnqueue(true);
   utterance2->SetSrcId(2);
-  controller->SpeakOrEnqueue(utterance2);
+  controller->SpeakOrEnqueue(std::move(utterance2));
 
   // Make sure that deleting the controller when there are pending
   // utterances doesn't cause a crash.
@@ -107,7 +107,7 @@ TEST_F(TtsControllerTest, TestTtsControllerUtteranceDefaults) {
       std::make_unique<TtsControllerForTesting>();
 
   std::unique_ptr<TtsUtterance> utterance1 =
-      base::WrapUnique(content::TtsUtterance::Create(nullptr));
+      content::TtsUtterance::Create(nullptr);
   // Initialized to default (unset constant) values.
   EXPECT_EQ(blink::mojom::kSpeechSynthesisDoublePrefNotSet,
             utterance1->GetContinuousParameters().rate);
diff --git a/chromium/content/browser/speech/tts_platform_impl.cc b/chromium/content/browser/speech/tts_platform_impl.cc
index 8d39aad8240..7ce56ecb51b 100644
--- a/chromium/content/browser/speech/tts_platform_impl.cc
+++ b/chromium/content/browser/speech/tts_platform_impl.cc
@@ -8,6 +8,7 @@
 
 #if defined(OS_CHROMEOS)
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #endif
 
 #include <string>
diff --git a/chromium/content/browser/speech/tts_ssml_browsertest.cc b/chromium/content/browser/speech/tts_ssml_browsertest.cc
index fcfff94f154..08981b648f3 100644
--- a/chromium/content/browser/speech/tts_ssml_browsertest.cc
+++ b/chromium/content/browser/speech/tts_ssml_browsertest.cc
@@ -32,7 +32,7 @@ class TtsSsmlBrowserTest : public ContentBrowserTest {
   void RunSSMLStripTest(std::string input, std::string expected_string) {
     MockTtsControllerImpl* controller = new MockTtsControllerImpl();
 
-    TtsUtterance* utterance = TtsUtterance::Create(nullptr);
+    std::unique_ptr<TtsUtterance> utterance = TtsUtterance::Create(nullptr);
     utterance->SetText(input);
 
     base::RunLoop run_loop;
diff --git a/chromium/content/browser/speech/tts_utterance_impl.cc b/chromium/content/browser/speech/tts_utterance_impl.cc
index 64f4112c1e7..95a2592d04e 100644
--- a/chromium/content/browser/speech/tts_utterance_impl.cc
+++ b/chromium/content/browser/speech/tts_utterance_impl.cc
@@ -35,8 +35,9 @@ UtteranceContinuousParameters::UtteranceContinuousParameters()
 // static
 int TtsUtteranceImpl::next_utterance_id_ = 0;
 
-TtsUtterance* TtsUtterance::Create(BrowserContext* browser_context) {
-  return new TtsUtteranceImpl(browser_context);
+std::unique_ptr<TtsUtterance> TtsUtterance::Create(
+    BrowserContext* browser_context) {
+  return std::make_unique<TtsUtteranceImpl>(browser_context);
 }
 
 TtsUtteranceImpl::TtsUtteranceImpl(BrowserContext* browser_context)
diff --git a/chromium/content/browser/ssl/ssl_client_auth_handler.cc b/chromium/content/browser/ssl/ssl_client_auth_handler.cc
index 8d063daddcf..3fd2d0009d0 100644
--- a/chromium/content/browser/ssl/ssl_client_auth_handler.cc
+++ b/chromium/content/browser/ssl/ssl_client_auth_handler.cc
@@ -14,6 +14,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/client_certificate_delegate.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "net/ssl/client_cert_store.h"
 #include "net/ssl/ssl_private_key.h"
 #include "net/url_request/url_request.h"
diff --git a/chromium/content/browser/ssl/ssl_manager.cc b/chromium/content/browser/ssl/ssl_manager.cc
index dfd84da4715..93cda186d5b 100644
--- a/chromium/content/browser/ssl/ssl_manager.cc
+++ b/chromium/content/browser/ssl/ssl_manager.cc
@@ -26,6 +26,7 @@
 #include "content/public/browser/devtools_agent_host.h"
 #include "content/public/browser/navigation_details.h"
 #include "content/public/browser/ssl_host_state_delegate.h"
+#include "content/public/common/content_client.h"
 #include "net/url_request/url_request.h"
 #include "services/metrics/public/cpp/ukm_builders.h"
 #include "services/metrics/public/cpp/ukm_recorder.h"
diff --git a/chromium/content/browser/startup_task_runner.cc b/chromium/content/browser/startup_task_runner.cc
index 51c98506b14..62deb231b80 100644
--- a/chromium/content/browser/startup_task_runner.cc
+++ b/chromium/content/browser/startup_task_runner.cc
@@ -18,7 +18,7 @@ StartupTaskRunner::StartupTaskRunner(
 StartupTaskRunner::~StartupTaskRunner() {}
 
 void StartupTaskRunner::AddTask(StartupTask callback) {
-  task_list_.push_back(callback);
+  task_list_.push_back(std::move(callback));
 }
 
 void StartupTaskRunner::StartRunningTasksAsync() {
@@ -29,16 +29,16 @@ void StartupTaskRunner::StartRunningTasksAsync() {
       std::move(startup_complete_callback_).Run(result);
     }
   } else {
-    const base::Closure next_task =
-        base::Bind(&StartupTaskRunner::WrappedTask, base::Unretained(this));
-    proxy_->PostNonNestableTask(FROM_HERE, next_task);
+    base::OnceClosure next_task =
+        base::BindOnce(&StartupTaskRunner::WrappedTask, base::Unretained(this));
+    proxy_->PostNonNestableTask(FROM_HERE, std::move(next_task));
   }
 }
 
 void StartupTaskRunner::RunAllTasksNow() {
   int result = 0;
   for (auto it = task_list_.begin(); it != task_list_.end(); it++) {
-    result = it->Run();
+    result = std::move(*it).Run();
     if (result > 0) break;
   }
   task_list_.clear();
@@ -54,7 +54,7 @@ void StartupTaskRunner::WrappedTask() {
     // so there is nothing to do
     return;
   }
-  int result = task_list_.front().Run();
+  int result = std::move(task_list_.front()).Run();
   task_list_.pop_front();
   if (result > 0) {
     // Stop now and throw away the remaining tasks
@@ -65,9 +65,9 @@ void StartupTaskRunner::WrappedTask() {
       std::move(startup_complete_callback_).Run(result);
     }
   } else {
-    const base::Closure next_task =
-        base::Bind(&StartupTaskRunner::WrappedTask, base::Unretained(this));
-    proxy_->PostNonNestableTask(FROM_HERE, next_task);
+    base::OnceClosure next_task =
+        base::BindOnce(&StartupTaskRunner::WrappedTask, base::Unretained(this));
+    proxy_->PostNonNestableTask(FROM_HERE, std::move(next_task));
   }
 }
 
diff --git a/chromium/content/browser/startup_task_runner.h b/chromium/content/browser/startup_task_runner.h
index a38776d147e..012cb0c8999 100644
--- a/chromium/content/browser/startup_task_runner.h
+++ b/chromium/content/browser/startup_task_runner.h
@@ -20,7 +20,7 @@ namespace content {
 // A startup task is a void function returning the status on completion.
 // a status of > 0 indicates a failure, and that no further startup tasks should
 // be run.
-typedef base::Callback<int(void)> StartupTask;
+typedef base::OnceCallback<int(void)> StartupTask;
 
 // This class runs startup tasks. The tasks are either run immediately inline,
 // or are queued one at a time on the UI thread's message loop. If the events
diff --git a/chromium/content/browser/storage_partition_impl.cc b/chromium/content/browser/storage_partition_impl.cc
index 48f6bd6bedd..a9318c8de61 100644
--- a/chromium/content/browser/storage_partition_impl.cc
+++ b/chromium/content/browser/storage_partition_impl.cc
@@ -18,6 +18,7 @@
 #include "base/command_line.h"
 #include "base/location.h"
 #include "base/optional.h"
+#include "base/run_loop.h"
 #include "base/sequenced_task_runner.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/utf_string_conversions.h"
@@ -68,8 +69,7 @@
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/callback_helpers.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/base/net_errors.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_util.h"
@@ -170,7 +170,17 @@ void ClearShaderCacheOnIOThread(const base::FilePath& path,
                                 const base::Time end,
                                 base::OnceClosure callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  GetShaderCacheFactorySingleton()->ClearByPath(
+  gpu::ShaderCacheFactory* shader_cache_factory =
+      GetShaderCacheFactorySingleton();
+
+  // May be null in tests where it is difficult to plumb through a test storage
+  // partition.
+  if (!shader_cache_factory) {
+    std::move(callback).Run();
+    return;
+  }
+
+  shader_cache_factory->ClearByPath(
       path, begin, end,
       base::BindOnce(&ClearedShaderCache, std::move(callback)));
 }
@@ -545,15 +555,10 @@ class LoginHandlerDelegate {
     auth_challenge_responder_.set_disconnect_handler(base::BindOnce(
         &LoginHandlerDelegate::OnRequestCancelled, base::Unretained(this)));
 
-    auto continue_after_inteceptor_io =
-        base::BindOnce(&LoginHandlerDelegate::ContinueAfterInterceptorIO,
-                       weak_factory_.GetWeakPtr());
-    base::PostTask(
-        FROM_HERE, {BrowserThread::IO},
-        base::BindOnce(&DevToolsURLLoaderInterceptor::HandleAuthRequest,
-                       request_id_.child_id, routing_id_,
-                       request_id_.request_id, auth_info_,
-                       std::move(continue_after_inteceptor_io)));
+    DevToolsURLLoaderInterceptor::HandleAuthRequest(
+        request_id_.child_id, routing_id_, request_id_.request_id, auth_info_,
+        base::BindOnce(&LoginHandlerDelegate::ContinueAfterInterceptor,
+                       weak_factory_.GetWeakPtr()));
   }
 
  private:
@@ -564,18 +569,7 @@ class LoginHandlerDelegate {
     delete this;
   }
 
-  static void ContinueAfterInterceptorIO(
-      base::WeakPtr<LoginHandlerDelegate> self_weak,
-      bool use_fallback,
-      const base::Optional<net::AuthCredentials>& auth_credentials) {
-    DCHECK_CURRENTLY_ON(BrowserThread::IO);
-    base::PostTask(
-        FROM_HERE, {BrowserThread::UI},
-        base::BindOnce(&LoginHandlerDelegate::ContinueAfterInterceptorUI,
-                       std::move(self_weak), use_fallback, auth_credentials));
-  }
-
-  void ContinueAfterInterceptorUI(
+  void ContinueAfterInterceptor(
       bool use_fallback,
       const base::Optional<net::AuthCredentials>& auth_credentials) {
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -769,10 +763,11 @@ class SSLClientAuthDelegate : public SSLClientAuthHandler::Delegate {
     DCHECK((cert && private_key) || (!cert && !private_key));
 
     if (cert && private_key) {
-      network::mojom::SSLPrivateKeyPtr ssl_private_key;
+      mojo::PendingRemote<network::mojom::SSLPrivateKey> ssl_private_key;
 
-      mojo::MakeStrongBinding(std::make_unique<SSLPrivateKeyImpl>(private_key),
-                              mojo::MakeRequest(&ssl_private_key));
+      mojo::MakeSelfOwnedReceiver(
+          std::make_unique<SSLPrivateKeyImpl>(private_key),
+          ssl_private_key.InitWithNewPipeAndPassReceiver());
 
       client_cert_responder_->ContinueWithCertificate(
           cert, private_key->GetProviderName(),
@@ -897,12 +892,13 @@ class StoragePartitionImpl::URLLoaderFactoryForBrowserProcess
                                traffic_annotation);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     if (!storage_partition_)
       return;
     storage_partition_
         ->GetURLLoaderFactoryForBrowserProcessInternal(corb_enabled_)
-        ->Clone(std::move(request));
+        ->Clone(std::move(receiver));
   }
 
   // SharedURLLoaderFactory implementation:
@@ -1224,7 +1220,6 @@ void StoragePartitionImpl::Initialize() {
       browser_context_->GetSpecialStoragePolicy(), quota_manager_proxy.get());
 
   dom_storage_context_ = DOMStorageContextWrapper::Create(
-      BrowserContext::GetConnectorFor(browser_context_),
       is_in_memory_ ? base::FilePath() : browser_context_->GetPath(),
       relative_partition_path_, browser_context_->GetSpecialStoragePolicy());
 
@@ -1393,17 +1388,19 @@ StoragePartitionImpl::GetCookieManagerForBrowserProcess() {
 void StoragePartitionImpl::CreateRestrictedCookieManager(
     network::mojom::RestrictedCookieManagerRole role,
     const url::Origin& origin,
+    const GURL& site_for_cookies,
+    const url::Origin& top_frame_origin,
     bool is_service_worker,
     int process_id,
     int routing_id,
     mojo::PendingReceiver<network::mojom::RestrictedCookieManager> receiver) {
   DCHECK(initialized_);
   if (!GetContentClient()->browser()->WillCreateRestrictedCookieManager(
-          role, browser_context_, origin, is_service_worker, process_id,
-          routing_id, &receiver)) {
-    GetNetworkContext()->GetRestrictedCookieManager(std::move(receiver), role,
-                                                    origin, is_service_worker,
-                                                    process_id, routing_id);
+          role, browser_context_, origin, site_for_cookies, top_frame_origin,
+          is_service_worker, process_id, routing_id, &receiver)) {
+    GetNetworkContext()->GetRestrictedCookieManager(
+        std::move(receiver), role, origin, site_for_cookies, top_frame_origin,
+        is_service_worker, process_id, routing_id);
   }
 }
 
@@ -2069,7 +2066,8 @@ void StoragePartitionImpl::DataDeletionHelper::ClearDataOnUIThread(
         base::WrapRefCounted(dom_storage_context),
         base::WrapRefCounted(special_storage_policy), origin_matcher,
         storage_origin, perform_storage_cleanup, begin, end,
-        CreateTaskCompletionClosure(TracingDataType::kLocalStorage));
+        mojo::WrapCallbackWithDefaultInvokeIfNotRun(
+            CreateTaskCompletionClosure(TracingDataType::kLocalStorage)));
 
     // ClearDataImpl cannot clear session storage data when a particular origin
     // is specified. Therefore we ignore clearing session storage in this case.
@@ -2287,7 +2285,7 @@ void StoragePartitionImpl::InitNetworkContext() {
   network_context_client_receiver_.reset();
   network_context_->SetClient(
       network_context_client_receiver_.BindNewPipeAndPassRemote());
-  network_context_.set_connection_error_handler(base::BindOnce(
+  network_context_.set_disconnect_handler(base::BindOnce(
       &StoragePartitionImpl::InitNetworkContext, weak_factory_.GetWeakPtr()));
 }
 
@@ -2340,24 +2338,26 @@ network::mojom::OriginPolicyManager*
 StoragePartitionImpl::GetOriginPolicyManagerForBrowserProcess() {
   DCHECK(initialized_);
   if (!origin_policy_manager_for_browser_process_ ||
-      origin_policy_manager_for_browser_process_.encountered_error()) {
+      !origin_policy_manager_for_browser_process_.is_connected()) {
     GetNetworkContext()->GetOriginPolicyManager(
-        mojo::MakeRequest(&origin_policy_manager_for_browser_process_));
+        origin_policy_manager_for_browser_process_
+            .BindNewPipeAndPassReceiver());
   }
   return origin_policy_manager_for_browser_process_.get();
 }
 
 void StoragePartitionImpl::SetOriginPolicyManagerForBrowserProcessForTesting(
-    network::mojom::OriginPolicyManagerPtr test_origin_policy_manager) {
+    mojo::PendingRemote<network::mojom::OriginPolicyManager>
+        test_origin_policy_manager) {
   DCHECK(initialized_);
-  origin_policy_manager_for_browser_process_ =
-      std::move(test_origin_policy_manager);
+  origin_policy_manager_for_browser_process_.Bind(
+      std::move(test_origin_policy_manager));
 }
 
 void StoragePartitionImpl::
     ResetOriginPolicyManagerForBrowserProcessForTesting() {
   DCHECK(initialized_);
-  origin_policy_manager_for_browser_process_ = nullptr;
+  origin_policy_manager_for_browser_process_.reset();
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/storage_partition_impl.h b/chromium/content/browser/storage_partition_impl.h
index 1ca85b4bdb9..1a40b74ac67 100644
--- a/chromium/content/browser/storage_partition_impl.h
+++ b/chromium/content/browser/storage_partition_impl.h
@@ -40,6 +40,7 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/mojom/cookie_manager.mojom.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "services/network/public/mojom/network_service.mojom.h"
@@ -112,6 +113,8 @@ class CONTENT_EXPORT StoragePartitionImpl
   void CreateRestrictedCookieManager(
       network::mojom::RestrictedCookieManagerRole role,
       const url::Origin& origin,
+      const GURL& site_for_cookies,
+      const url::Origin& top_frame_origin,
       bool is_service_worker,
       int process_id,
       int routing_id,
@@ -297,7 +300,8 @@ class CONTENT_EXPORT StoragePartitionImpl
 
   // Override the origin policy manager for testing use only.
   void SetOriginPolicyManagerForBrowserProcessForTesting(
-      network::mojom::OriginPolicyManagerPtr test_origin_policy_manager);
+      mojo::PendingRemote<network::mojom::OriginPolicyManager>
+          test_origin_policy_manager);
   void ResetOriginPolicyManagerForBrowserProcessForTesting();
 
  private:
@@ -463,7 +467,7 @@ class CONTENT_EXPORT StoragePartitionImpl
   // service. When it's disabled, the underlying NetworkContext may either be
   // provided by the embedder, or is created by the StoragePartition and owned
   // by |network_context_owner_|.
-  network::mojom::NetworkContextPtr network_context_;
+  mojo::Remote<network::mojom::NetworkContext> network_context_;
 
   mojo::Receiver<network::mojom::NetworkContextClient>
       network_context_client_receiver_{this};
@@ -484,7 +488,7 @@ class CONTENT_EXPORT StoragePartitionImpl
   bool is_test_url_loader_factory_for_browser_process_with_corb_ = false;
   mojo::Remote<network::mojom::CookieManager>
       cookie_manager_for_browser_process_;
-  network::mojom::OriginPolicyManagerPtr
+  mojo::Remote<network::mojom::OriginPolicyManager>
       origin_policy_manager_for_browser_process_;
 
   // See comments for site_for_service_worker().
diff --git a/chromium/content/browser/storage_partition_impl_browsertest.cc b/chromium/content/browser/storage_partition_impl_browsertest.cc
index ac2940444ae..69cd7efd619 100644
--- a/chromium/content/browser/storage_partition_impl_browsertest.cc
+++ b/chromium/content/browser/storage_partition_impl_browsertest.cc
@@ -21,11 +21,11 @@
 #include "net/http/http_status_code.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
-#include "services/network/public/cpp/resource_response_info.h"
 #include "services/network/public/cpp/simple_url_loader.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "services/network/test/test_url_loader_client.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -111,11 +111,11 @@ IN_PROC_BROWSER_TEST_F(StoragePartititionImplBrowsertest, NetworkContext) {
   // Just wait until headers are received - if the right headers are received,
   // no need to read the body.
   client.RunUntilResponseBodyArrived();
-  ASSERT_TRUE(client.response_head().headers);
-  EXPECT_EQ(200, client.response_head().headers->response_code());
+  ASSERT_TRUE(client.response_head()->headers);
+  EXPECT_EQ(200, client.response_head()->headers->response_code());
 
   std::string foo_header_value;
-  ASSERT_TRUE(client.response_head().headers->GetNormalizedHeader(
+  ASSERT_TRUE(client.response_head()->headers->GetNormalizedHeader(
       "foo", &foo_header_value));
   EXPECT_EQ("bar", foo_header_value);
 }
diff --git a/chromium/content/browser/storage_partition_impl_map.cc b/chromium/content/browser/storage_partition_impl_map.cc
index a9e30499108..bca090b797f 100644
--- a/chromium/content/browser/storage_partition_impl_map.cc
+++ b/chromium/content/browser/storage_partition_impl_map.cc
@@ -39,6 +39,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
diff --git a/chromium/content/browser/storage_partition_impl_unittest.cc b/chromium/content/browser/storage_partition_impl_unittest.cc
index f4545670738..de9c8f5e4b1 100644
--- a/chromium/content/browser/storage_partition_impl_unittest.cc
+++ b/chromium/content/browser/storage_partition_impl_unittest.cc
@@ -12,12 +12,15 @@
 #include "base/single_thread_task_runner.h"
 #include "base/stl_util.h"
 #include "base/task/post_task.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/scoped_feature_list.h"
 #include "base/threading/thread.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "components/services/leveldb/public/cpp/util.h"
+#include "components/services/storage/dom_storage/dom_storage_database.h"
 #include "content/browser/code_cache/generated_code_cache.h"
 #include "content/browser/code_cache/generated_code_cache_context.h"
+#include "content/browser/dom_storage/local_storage_context_mojo.h"
 #include "content/browser/dom_storage/local_storage_database.pb.h"
 #include "content/browser/gpu/shader_cache_factory.h"
 #include "content/browser/storage_partition_impl.h"
@@ -30,8 +33,6 @@
 #include "content/public/test/test_browser_context.h"
 #include "content/public/test/test_browser_thread.h"
 #include "content/public/test/test_utils.h"
-#include "content/test/fake_leveldb_database.h"
-#include "mojo/public/cpp/bindings/associated_receiver.h"
 #include "net/base/test_completion_callback.h"
 #include "net/cookies/canonical_cookie.h"
 #include "net/cookies/cookie_store.h"
@@ -191,13 +192,21 @@ class RemoveCookieTester {
 
 class RemoveLocalStorageTester {
  public:
-  explicit RemoveLocalStorageTester(TestBrowserContext* profile)
-      : dom_storage_context_(nullptr),
-        mock_db_(&mock_data_),
-        db_receiver_(&mock_db_) {
+  RemoveLocalStorageTester(content::BrowserTaskEnvironment* task_environment,
+                           TestBrowserContext* profile)
+      : task_environment_(task_environment), dom_storage_context_(nullptr) {
     dom_storage_context_ =
-        content::BrowserContext::GetDefaultStoragePartition(profile)->
-            GetDOMStorageContext();
+        content::BrowserContext::GetDefaultStoragePartition(profile)
+            ->GetDOMStorageContext();
+  }
+
+  ~RemoveLocalStorageTester() {
+    // Tests which bring up a real Local Storage context need to shut it down
+    // and wait for the database to be closed before terminating; otherwise the
+    // TestBrowserContext may fail to delete its temp dir, and it will not be
+    // happy about that.
+    static_cast<DOMStorageContextWrapper*>(dom_storage_context_)->Shutdown();
+    task_environment_->RunUntilIdle();
   }
 
   // Returns true, if the given origin URL exists.
@@ -215,37 +224,46 @@ class RemoveLocalStorageTester {
     // Note: This test depends on details of how the dom_storage library
     // stores data in the database.
 
-    mojo::AssociatedRemote<leveldb::mojom::LevelDBDatabase> database_remote;
-    auto receiver =
-        database_remote.BindNewEndpointAndPassDedicatedReceiverForTesting();
     static_cast<DOMStorageContextWrapper*>(dom_storage_context_)
-        ->SetLocalStorageDatabaseForTesting(database_remote.Unbind());
-    db_receiver_.Bind(std::move(receiver));
+        ->SetLocalStorageDatabaseOpenCallbackForTesting(
+            base::BindLambdaForTesting([&](LocalStorageContextMojo* context) {
+              context->GetDatabaseForTesting().PostTaskWithThisObject(
+                  FROM_HERE, base::BindOnce(&PopulateDatabase));
+            }));
+  }
 
+  static void PopulateDatabase(const storage::DomStorageDatabase& db) {
     LocalStorageOriginMetaData data;
+    std::map<std::vector<uint8_t>, std::vector<uint8_t>> entries;
 
     base::Time now = base::Time::Now();
     data.set_last_modified(now.ToInternalValue());
     data.set_size_bytes(16);
-    mock_data_[CreateMetaDataKey(kOrigin1)] =
-        leveldb::StdStringToUint8Vector(data.SerializeAsString());
-    mock_data_[CreateDataKey(kOrigin1)] = {};
+    ASSERT_TRUE(
+        db.Put(CreateMetaDataKey(kOrigin1),
+               leveldb::StdStringToUint8Vector(data.SerializeAsString()))
+            .ok());
+    ASSERT_TRUE(db.Put(CreateDataKey(kOrigin1), {}).ok());
 
     base::Time one_day_ago = now - base::TimeDelta::FromDays(1);
     data.set_last_modified(one_day_ago.ToInternalValue());
-    mock_data_[CreateMetaDataKey(kOrigin2)] =
-        leveldb::StdStringToUint8Vector(data.SerializeAsString());
-    mock_data_[CreateDataKey(kOrigin2)] = {};
+    ASSERT_TRUE(
+        db.Put(CreateMetaDataKey(kOrigin2),
+               leveldb::StdStringToUint8Vector(data.SerializeAsString()))
+            .ok());
+    ASSERT_TRUE(db.Put(CreateDataKey(kOrigin2), {}).ok());
 
     base::Time sixty_days_ago = now - base::TimeDelta::FromDays(60);
     data.set_last_modified(sixty_days_ago.ToInternalValue());
-    mock_data_[CreateMetaDataKey(kOrigin3)] =
-        leveldb::StdStringToUint8Vector(data.SerializeAsString());
-    mock_data_[CreateDataKey(kOrigin3)] = {};
+    ASSERT_TRUE(
+        db.Put(CreateMetaDataKey(kOrigin3),
+               leveldb::StdStringToUint8Vector(data.SerializeAsString()))
+            .ok());
+    ASSERT_TRUE(db.Put(CreateDataKey(kOrigin3), {}).ok());
   }
 
  private:
-  std::vector<uint8_t> CreateDataKey(const url::Origin& origin) {
+  static std::vector<uint8_t> CreateDataKey(const url::Origin& origin) {
     auto serialized_origin =
         leveldb::StdStringToUint8Vector(origin.Serialize());
     std::vector<uint8_t> key = {'_'};
@@ -255,7 +273,7 @@ class RemoveLocalStorageTester {
     return key;
   }
 
-  std::vector<uint8_t> CreateMetaDataKey(const url::Origin& origin) {
+  static std::vector<uint8_t> CreateMetaDataKey(const url::Origin& origin) {
     const uint8_t kMetaPrefix[] = {'M', 'E', 'T', 'A', ':'};
     auto serialized_origin =
         leveldb::StdStringToUint8Vector(origin.Serialize());
@@ -279,12 +297,9 @@ class RemoveLocalStorageTester {
   }
 
   // We don't own these pointers.
+  content::BrowserTaskEnvironment* const task_environment_;
   content::DOMStorageContext* dom_storage_context_;
 
-  std::map<std::vector<uint8_t>, std::vector<uint8_t>> mock_data_;
-  FakeLevelDBDatabase mock_db_;
-  mojo::AssociatedReceiver<leveldb::mojom::LevelDBDatabase> db_receiver_;
-
   std::vector<content::StorageUsageInfo> infos_;
 
   AwaitCompletionHelper await_completion_;
@@ -313,8 +328,8 @@ class RemoveCodeCacheTester {
                 GURL origin_lock,
                 const std::string& data) {
     std::vector<uint8_t> data_vector(data.begin(), data.end());
-    GetCache(cache)->WriteData(url, origin_lock, base::Time::Now(),
-                               data_vector);
+    GetCache(cache)->WriteEntry(url, origin_lock, base::Time::Now(),
+                                data_vector);
     base::RunLoop().RunUntilIdle();
   }
 
@@ -591,21 +606,19 @@ void ClearQuotaDataWithOriginMatcher(
                        base::Time::Max(), loop_to_quit->QuitClosure());
 }
 
-void ClearQuotaDataForOrigin(
-    content::StoragePartition* partition,
-    const GURL& remove_origin,
-    const base::Time delete_begin,
-    base::RunLoop* loop_to_quit) {
+void ClearQuotaDataForOrigin(content::StoragePartition* partition,
+                             const GURL& remove_origin,
+                             const base::Time delete_begin,
+                             base::RunLoop* loop_to_quit) {
   partition->ClearData(kAllQuotaRemoveMask,
                        StoragePartition::QUOTA_MANAGED_STORAGE_MASK_ALL,
                        remove_origin, delete_begin, base::Time::Max(),
                        loop_to_quit->QuitClosure());
 }
 
-void ClearQuotaDataForNonPersistent(
-    content::StoragePartition* partition,
-    const base::Time delete_begin,
-    base::RunLoop* loop_to_quit) {
+void ClearQuotaDataForNonPersistent(content::StoragePartition* partition,
+                                    const base::Time delete_begin,
+                                    base::RunLoop* loop_to_quit) {
   partition->ClearData(kAllQuotaRemoveMask,
                        ~StoragePartition::QUOTA_MANAGED_STORAGE_MASK_PERSISTENT,
                        GURL(), delete_begin, base::Time::Max(),
@@ -649,8 +662,7 @@ void ClearStuff(uint32_t remove_mask,
                        run_loop->QuitClosure());
 }
 
-void ClearData(content::StoragePartition* partition,
-               base::RunLoop* run_loop) {
+void ClearData(content::StoragePartition* partition, base::RunLoop* run_loop) {
   base::Time time;
   partition->ClearData(StoragePartition::REMOVE_DATA_MASK_SHADER_CACHE,
                        StoragePartition::QUOTA_MANAGED_STORAGE_MASK_ALL, GURL(),
@@ -708,8 +720,10 @@ class StoragePartitionImplTest : public testing::Test {
     return quota_manager_.get();
   }
 
-  TestBrowserContext* browser_context() {
-    return browser_context_.get();
+  TestBrowserContext* browser_context() { return browser_context_.get(); }
+
+  content::BrowserTaskEnvironment* task_environment() {
+    return &task_environment_;
   }
 
  private:
@@ -754,9 +768,7 @@ class StoragePartitionShaderClearTest : public testing::Test {
 
   size_t Size() { return cache_->Size(); }
 
-  TestBrowserContext* browser_context() {
-    return browser_context_.get();
-  }
+  TestBrowserContext* browser_context() { return browser_context_.get(); }
 
  private:
   content::BrowserTaskEnvironment task_environment_;
@@ -840,8 +852,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverBoth) {
 
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
 
   base::RunLoop run_loop;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -867,8 +878,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverOnlyTemporary) {
 
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
 
   base::RunLoop run_loop;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -894,8 +904,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverOnlyPersistent) {
 
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
 
   base::RunLoop run_loop;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -919,8 +928,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverOnlyPersistent) {
 TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverNeither) {
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
 
   base::RunLoop run_loop;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -946,8 +954,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForeverSpecificOrigin) {
 
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
 
   base::RunLoop run_loop;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -974,8 +981,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForLastHour) {
 
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
 
   base::RunLoop run_loop;
   base::ThreadTaskRunnerHandle::Get()->PostTask(
@@ -1005,8 +1011,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedDataForLastWeek) {
   base::RunLoop run_loop;
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::BindOnce(&ClearQuotaDataForNonPersistent, partition,
@@ -1038,8 +1043,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedUnprotectedOrigins) {
 
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
   partition->OverrideSpecialStoragePolicyForTesting(mock_policy.get());
 
   base::RunLoop run_loop;
@@ -1076,8 +1080,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedProtectedOrigins) {
   base::RunLoop run_loop;
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
   partition->OverrideSpecialStoragePolicyForTesting(mock_policy.get());
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
@@ -1107,8 +1110,7 @@ TEST_F(StoragePartitionImplTest, RemoveQuotaManagedIgnoreDevTools) {
   base::RunLoop run_loop;
   StoragePartitionImpl* partition = static_cast<StoragePartitionImpl*>(
       BrowserContext::GetDefaultStoragePartition(browser_context()));
-  partition->OverrideQuotaManagerForTesting(
-      GetMockManager());
+  partition->OverrideQuotaManagerForTesting(GetMockManager());
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::BindOnce(&ClearQuotaDataWithOriginMatcher, partition,
@@ -1181,7 +1183,7 @@ TEST_F(StoragePartitionImplTest, RemoveUnprotectedLocalStorageForever) {
       new MockSpecialStoragePolicy;
   mock_policy->AddProtected(kOrigin1.GetURL());
 
-  RemoveLocalStorageTester tester(browser_context());
+  RemoveLocalStorageTester tester(task_environment(), browser_context());
 
   tester.AddDOMStorageTestData();
   EXPECT_TRUE(tester.DOMStorageExistsForOrigin(kOrigin1));
@@ -1216,7 +1218,7 @@ TEST_F(StoragePartitionImplTest, RemoveProtectedLocalStorageForever) {
       new MockSpecialStoragePolicy;
   mock_policy->AddProtected(kOrigin1.GetURL());
 
-  RemoveLocalStorageTester tester(browser_context());
+  RemoveLocalStorageTester tester(task_environment(), browser_context());
 
   tester.AddDOMStorageTestData();
   EXPECT_TRUE(tester.DOMStorageExistsForOrigin(kOrigin1));
@@ -1250,7 +1252,7 @@ TEST_F(StoragePartitionImplTest, RemoveProtectedLocalStorageForever) {
 }
 
 TEST_F(StoragePartitionImplTest, RemoveLocalStorageForLastWeek) {
-  RemoveLocalStorageTester tester(browser_context());
+  RemoveLocalStorageTester tester(task_environment(), browser_context());
 
   tester.AddDOMStorageTestData();
   EXPECT_TRUE(tester.DOMStorageExistsForOrigin(kOrigin1));
diff --git a/chromium/content/browser/theme_helper.h b/chromium/content/browser/theme_helper.h
index 06fa6ccd3a0..7a4cd53163c 100644
--- a/chromium/content/browser/theme_helper.h
+++ b/chromium/content/browser/theme_helper.h
@@ -37,4 +37,4 @@ class ThemeHelper : public ui::NativeThemeObserver {
 
 }  // namespace content
 
-#endif  // CONTENT_BROWSER_THEME_HELPER_H_
\ No newline at end of file
+#endif  // CONTENT_BROWSER_THEME_HELPER_H_
diff --git a/chromium/content/browser/tracing/background_memory_tracing_observer.cc b/chromium/content/browser/tracing/background_memory_tracing_observer.cc
index cf1f294d09a..29c79966335 100644
--- a/chromium/content/browser/tracing/background_memory_tracing_observer.cc
+++ b/chromium/content/browser/tracing/background_memory_tracing_observer.cc
@@ -34,6 +34,7 @@ void BackgroundMemoryTracingObserver::OnTracingEnabled(
       ->RequestGlobalDumpAndAppendToTrace(
           base::trace_event::MemoryDumpType::EXPLICITLY_TRIGGERED,
           base::trace_event::MemoryDumpLevelOfDetail::BACKGROUND,
+          base::trace_event::MemoryDumpDeterminism::NONE,
           memory_instrumentation::MemoryInstrumentation::
               RequestGlobalMemoryDumpAndAppendToTraceCallback());
 }
diff --git a/chromium/content/browser/tracing/background_startup_tracing_observer.cc b/chromium/content/browser/tracing/background_startup_tracing_observer.cc
index 1590187c3d1..72c32bb600b 100644
--- a/chromium/content/browser/tracing/background_startup_tracing_observer.cc
+++ b/chromium/content/browser/tracing/background_startup_tracing_observer.cc
@@ -66,10 +66,6 @@ void BackgroundStartupTracingObserver::OnScenarioActivated(
     return;
   const BackgroundTracingRule* startup_rule = FindStartupRuleInConfig(*config);
   DCHECK(startup_rule);
-  // TODO(ssid): Investigate when/how this can happen.
-  if (!startup_rule) {
-    return;
-  }
 
   // Post task to avoid reentrancy.
   base::PostTask(
@@ -115,6 +111,7 @@ BackgroundStartupTracingObserver::IncludeStartupConfigIfNeeded(
   // immediately finalize tracing, rather than starting it.
   if (config &&
       (config->tracing_mode() == BackgroundTracingConfigImpl::PREEMPTIVE)) {
+    enabled_in_current_session_ = false;
     return config;
   }
 
diff --git a/chromium/content/browser/tracing/background_tracing_active_scenario.cc b/chromium/content/browser/tracing/background_tracing_active_scenario.cc
index fb390bef879..b79c56f51a6 100644
--- a/chromium/content/browser/tracing/background_tracing_active_scenario.cc
+++ b/chromium/content/browser/tracing/background_tracing_active_scenario.cc
@@ -81,8 +81,7 @@ class PerfettoTracingSession
 #if !defined(OS_ANDROID)
     // TODO(crbug.com/941318): Re-enable startup tracing for Android once all
     // Perfetto-related deadlocks are resolved.
-    if (!TracingControllerImpl::GetInstance()->IsTracing() &&
-        tracing::TracingUsesPerfettoBackend()) {
+    if (!TracingControllerImpl::GetInstance()->IsTracing()) {
       tracing::TraceEventDataSource::GetInstance()->SetupStartupTracing(
           /*privacy_filtering_enabled=*/true);
     }
@@ -96,8 +95,9 @@ class PerfettoTracingSession
     perfetto_config.mutable_incremental_state_config()->set_clear_period_ms(
         interning_reset_interval_ms);
 
-    tracing::mojom::TracingSessionClientPtr tracing_session_client;
-    binding_.Bind(mojo::MakeRequest(&tracing_session_client));
+    mojo::PendingRemote<tracing::mojom::TracingSessionClient>
+        tracing_session_client;
+    binding_.Bind(tracing_session_client.InitWithNewPipeAndPassReceiver());
     binding_.set_connection_error_handler(
         base::BindOnce(&PerfettoTracingSession::OnTracingSessionEnded,
                        base::Unretained(this)));
@@ -196,8 +196,7 @@ class LegacyTracingSession
 #if !defined(OS_ANDROID)
     // TODO(crbug.com/941318): Re-enable startup tracing for Android once all
     // Perfetto-related deadlocks are resolved.
-    if (!TracingControllerImpl::GetInstance()->IsTracing() &&
-        tracing::TracingUsesPerfettoBackend()) {
+    if (!TracingControllerImpl::GetInstance()->IsTracing()) {
       tracing::TraceEventDataSource::GetInstance()->SetupStartupTracing(
           /*privacy_filtering_enabled=*/false);
     }
@@ -226,8 +225,7 @@ class LegacyTracingSession
       TracingControllerImpl::GetInstance()->StopTracing(
           TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
               [](const base::RepeatingClosure& on_failure,
-                 std::unique_ptr<const base::DictionaryValue>,
-                 base::RefCountedString*) { on_failure.Run(); },
+                 std::unique_ptr<std::string>) { on_failure.Run(); },
               std::move(on_failure))));
       return;
     }
@@ -237,18 +235,18 @@ class LegacyTracingSession
             TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
                 [](base::WeakPtr<BackgroundTracingActiveScenario> weak_this,
                    const base::RepeatingClosure& on_success,
-                   std::unique_ptr<const base::DictionaryValue> metadata,
-                   base::RefCountedString* file_contents) {
+                   std::unique_ptr<std::string> file_contents) {
                   on_success.Run();
                   if (weak_this) {
-                    weak_this->OnJSONDataComplete(std::move(metadata),
-                                                  file_contents);
+                    weak_this->OnJSONDataComplete(std::move(file_contents));
                   }
                 },
                 parent_scenario_->GetWeakPtr(), std::move(on_success))),
             true /* compress_with_background_priority */);
 
-    TracingControllerImpl::GetInstance()->StopTracing(trace_data_endpoint);
+    TracingControllerImpl::GetInstance()->StopTracing(
+        trace_data_endpoint, "",
+        parent_scenario_->GetConfig()->requires_anonymized_data());
   }
 
   void AbortScenario(const base::RepeatingClosure& on_abort_callback) override {
@@ -256,8 +254,7 @@ class LegacyTracingSession
       TracingControllerImpl::GetInstance()->StopTracing(
           TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
               [](const base::RepeatingClosure& on_abort_callback,
-                 std::unique_ptr<const base::DictionaryValue>,
-                 base::RefCountedString*) { on_abort_callback.Run(); },
+                 std::unique_ptr<std::string>) { on_abort_callback.Run(); },
               std::move(on_abort_callback))));
     } else {
       on_abort_callback.Run();
@@ -356,7 +353,20 @@ bool BackgroundTracingActiveScenario::StartTracing() {
   uint8_t modes = base::trace_event::TraceLog::RECORDING_MODE;
   if (!chrome_config.event_filters().empty())
     modes |= base::trace_event::TraceLog::FILTERING_MODE;
-  base::trace_event::TraceLog::GetInstance()->SetEnabled(chrome_config, modes);
+
+// TODO(crbug.com/941318): Re-enable startup tracing for Perfetto backend on
+// Android once all Perfetto-related deadlocks are resolved.
+#if !defined(OS_ANDROID)
+  TraceConfig chrome_config_for_trace_log(chrome_config);
+  // Perfetto backend configures buffer sizes when tracing is started in the
+  // service (see perfetto_config.cc). Zero them out here for TraceLog to avoid
+  // DCHECKs in TraceConfig::Merge.
+  chrome_config_for_trace_log.SetTraceBufferSizeInKb(0);
+  chrome_config_for_trace_log.SetTraceBufferSizeInEvents(0);
+
+  base::trace_event::TraceLog::GetInstance()->SetEnabled(
+      chrome_config_for_trace_log, modes);
+#endif  // !defined(OS_ANDROID)
 
   DCHECK(!tracing_session_);
   if (base::FeatureList::IsEnabled(features::kBackgroundTracingProtoOutput)) {
@@ -418,8 +428,7 @@ void BackgroundTracingActiveScenario::BeginFinalizing(
 }
 
 void BackgroundTracingActiveScenario::OnJSONDataComplete(
-    std::unique_ptr<const base::DictionaryValue> metadata,
-    base::RefCountedString* file_contents) {
+    std::unique_ptr<std::string> file_contents) {
   BackgroundTracingManagerImpl::RecordMetric(Metrics::FINALIZATION_STARTED);
   UMA_HISTOGRAM_MEMORY_KB("Tracing.Background.FinalizingTraceSizeInKB",
                           file_contents->size() / 1024);
@@ -428,7 +437,7 @@ void BackgroundTracingActiveScenario::OnJSONDataComplete(
   // callback.
   if (!receive_callback_.is_null()) {
     receive_callback_.Run(
-        file_contents, std::move(metadata),
+        std::move(file_contents),
         base::BindOnce(&BackgroundTracingActiveScenario::OnFinalizeComplete,
                        weak_ptr_factory_.GetWeakPtr()));
   }
diff --git a/chromium/content/browser/tracing/background_tracing_active_scenario.h b/chromium/content/browser/tracing/background_tracing_active_scenario.h
index 4288d2eb104..4282bae6571 100644
--- a/chromium/content/browser/tracing/background_tracing_active_scenario.h
+++ b/chromium/content/browser/tracing/background_tracing_active_scenario.h
@@ -16,10 +16,6 @@
 #include "services/tracing/public/cpp/perfetto/trace_event_data_source.h"
 #include "services/tracing/public/mojom/perfetto_service.mojom.h"
 
-namespace base {
-class RefCountedString;
-}  // namespace base
-
 namespace content {
 
 class BackgroundTracingConfigImpl;
@@ -54,8 +50,7 @@ class BackgroundTracingActiveScenario {
       BackgroundTracingManager::StartedFinalizingCallback callback);
 
   // Called by LegacyTracingSession when the final trace data is ready.
-  void OnJSONDataComplete(std::unique_ptr<const base::DictionaryValue> metadata,
-                          base::RefCountedString*);
+  void OnJSONDataComplete(std::unique_ptr<std::string>);
   // Called by the PerfettoTracingSession when the proto trace is ready.
   void OnProtoDataComplete(std::unique_ptr<std::string> proto_trace);
 
diff --git a/chromium/content/browser/tracing/background_tracing_config_impl.cc b/chromium/content/browser/tracing/background_tracing_config_impl.cc
index 158aa3874e2..ee41a4f9e06 100644
--- a/chromium/content/browser/tracing/background_tracing_config_impl.cc
+++ b/chromium/content/browser/tracing/background_tracing_config_impl.cc
@@ -276,10 +276,6 @@ TraceConfig BackgroundTracingConfigImpl::GetTraceConfig() const {
     chrome_config.SetProcessFilterConfig(process_config);
   }
 
-  if (requires_anonymized_data_) {
-    chrome_config.EnableArgumentFilter();
-  }
-
   chrome_config.SetTraceBufferSizeInKb(GetMaximumTraceBufferSizeKb());
 
 #if defined(OS_ANDROID)
@@ -523,13 +519,14 @@ TraceConfig BackgroundTracingConfigImpl::GetConfigForCategoryPreset(
       return TraceConfig(
           "benchmark,toplevel,ipc,base,ServiceWorker,CacheStorage,Blob,"
           "IndexedDB,loading,mojom,navigation,renderer,blink,blink_gc,blink."
-          "user_timing,blink.worker,fonts,disabled-by-default-cpu_profiler,"
-          "disabled-by-default-network",
+          "user_timing,blink.worker,fonts,startup,disabled-by-default-cpu_"
+          "profiler,disabled-by-default-network",
           record_mode);
     case BackgroundTracingConfigImpl::CategoryPreset::BENCHMARK_POWER:
       return TraceConfig(
           "benchmark,toplevel,ipc,base,audio,compositor,gpu,media,memory,midi,"
-          "native,omnibox,renderer,skia,task_scheduler,ui,v8,views,webaudio",
+          "native,omnibox,renderer,skia,task_scheduler,ui,v8,views,webaudio,"
+          "disabled-by-default-cpu_profiler",
           record_mode);
     case BackgroundTracingConfigImpl::CategoryPreset::BLINK_STYLE:
       return TraceConfig("blink_style", record_mode);
diff --git a/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc b/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc
index 5b718712467..b76c766ccae 100644
--- a/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc
+++ b/chromium/content/browser/tracing/background_tracing_manager_browsertest.cc
@@ -254,32 +254,29 @@ class TestTraceReceiverHelper {
 
   void WaitForTraceReceived() { wait_for_trace_received_.Run(); }
   bool trace_received() const { return trace_received_; }
-
-  const base::Value& get_metadata() const { return *metadata_; }
+  const std::string& file_contents() const { return file_contents_; }
 
   bool TraceHasMatchingString(const char* text) const {
     return file_contents_.find(text) != std::string::npos;
   }
 
   void Upload(
-      const scoped_refptr<base::RefCountedString>& file_contents,
-      std::unique_ptr<const base::DictionaryValue> metadata,
+      std::unique_ptr<std::string> file_contents,
       BackgroundTracingManager::FinishedProcessingCallback done_callback) {
-    metadata_ = std::move(metadata);
-
     EXPECT_TRUE(file_contents);
     EXPECT_FALSE(trace_received_);
     trace_received_ = true;
 
     // Uncompress the trace content.
-    size_t compressed_length = file_contents->data().length();
+    size_t compressed_length = file_contents->length();
     const size_t kOutputBufferLength = 10 * 1024 * 1024;
     std::vector<char> output_str(kOutputBufferLength);
 
     z_stream stream = {nullptr};
     stream.avail_in = compressed_length;
     stream.avail_out = kOutputBufferLength;
-    stream.next_in = reinterpret_cast<Bytef*>(&file_contents->data()[0]);
+    stream.next_in =
+        reinterpret_cast<Bytef*>(const_cast<char*>(file_contents->data()));
     stream.next_out = reinterpret_cast<Bytef*>(output_str.data());
 
     // 16 + MAX_WBITS means only decoding gzip encoded streams, and using
@@ -303,7 +300,6 @@ class TestTraceReceiverHelper {
   }
 
  private:
-  std::unique_ptr<const base::DictionaryValue> metadata_;
   base::RunLoop wait_for_trace_received_;
   bool trace_received_ = false;
   std::string file_contents_;
@@ -326,11 +322,10 @@ class TestMultipleTraceReceiverHelper {
   }
 
   void Upload(
-      const scoped_refptr<base::RefCountedString>& file_contents,
-      std::unique_ptr<const base::DictionaryValue> metadata,
+      std::unique_ptr<std::string> file_contents,
       BackgroundTracingManager::FinishedProcessingCallback done_callback) {
-    trace_receivers_[current_receiver_offset_].Upload(
-        file_contents, std::move(metadata), std::move(done_callback));
+    trace_receivers_[current_receiver_offset_].Upload(std::move(file_contents),
+                                                      std::move(done_callback));
     current_receiver_offset_++;
   }
 
@@ -671,7 +666,7 @@ IN_PROC_BROWSER_TEST_F(BackgroundTracingManagerBrowserTest,
 
   background_tracing_helper.WaitForScenarioActivated();
 
-  NavigateToURL(shell(), GetTestUrl("", "about:blank"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl("", "about:blank")));
 
   TestTriggerHelper trigger_helper;
   BackgroundTracingManager::GetInstance()->TriggerNamedEvent(
@@ -1014,8 +1009,15 @@ IN_PROC_BROWSER_TEST_F(BackgroundTracingManagerBrowserTest,
 
   EXPECT_TRUE(trace_receiver_helper.trace_received());
 
+  base::Optional<base::Value> trace_json =
+      base::JSONReader::Read(trace_receiver_helper.file_contents());
+  ASSERT_TRUE(trace_json);
+  auto* metadata_json = static_cast<base::DictionaryValue*>(
+      trace_json->FindKeyOfType("metadata", base::Value::Type::DICTIONARY));
+  ASSERT_TRUE(metadata_json);
+
   const std::string* trace_config =
-      trace_receiver_helper.get_metadata().FindStringKey("trace-config");
+      metadata_json->FindStringKey("trace-config");
   ASSERT_TRUE(trace_config);
   EXPECT_NE(trace_config->find("record-continuously"), trace_config->npos)
       << *trace_config;
@@ -1071,8 +1073,15 @@ IN_PROC_BROWSER_TEST_F(BackgroundTracingManagerBrowserTest, CustomConfig) {
 
   EXPECT_TRUE(trace_receiver_helper.trace_received());
 
+  base::Optional<base::Value> trace_json =
+      base::JSONReader::Read(trace_receiver_helper.file_contents());
+  ASSERT_TRUE(trace_json);
+  auto* metadata_json = static_cast<base::DictionaryValue*>(
+      trace_json->FindKeyOfType("metadata", base::Value::Type::DICTIONARY));
+  ASSERT_TRUE(metadata_json);
+
   const std::string* trace_config =
-      trace_receiver_helper.get_metadata().FindStringKey("trace-config");
+      metadata_json->FindStringKey("trace-config");
   ASSERT_TRUE(trace_config);
   EXPECT_NE(trace_config->find("record-until-full"), trace_config->npos)
       << *trace_config;
@@ -1580,7 +1589,7 @@ IN_PROC_BROWSER_TEST_F(BackgroundTracingManagerBrowserTest, RunStartupTracing) {
 
   EXPECT_TRUE(BackgroundTracingManager::GetInstance()->SetActiveScenario(
       std::move(config), trace_receiver_helper.get_receive_callback(),
-      BackgroundTracingManager::NO_DATA_FILTERING));
+      BackgroundTracingManager::ANONYMIZE_DATA));
 
   tracelog_helper.WaitForStartTracing();
   background_tracing_helper.WaitForTracingEnabled();
@@ -1589,9 +1598,6 @@ IN_PROC_BROWSER_TEST_F(BackgroundTracingManagerBrowserTest, RunStartupTracing) {
                   ->GetActiveScenarioForTesting()
                   ->GetConfig()
                   ->requires_anonymized_data());
-  EXPECT_TRUE(base::trace_event::TraceLog::GetInstance()
-                  ->GetCurrentTraceConfig()
-                  .IsArgumentFilterEnabled());
 
   // Since we specified a delay in the scenario, we should still be tracing
   // at this point.
@@ -1616,8 +1622,7 @@ class ProtoBackgroundTracingTest : public DevToolsProtocolTest {
  public:
   ProtoBackgroundTracingTest() {
     scoped_feature_list_.InitWithFeatures(
-        /*enabled_features=*/{features::kTracingPerfettoBackend,
-                              features::kBackgroundTracingProtoOutput},
+        /*enabled_features=*/{features::kBackgroundTracingProtoOutput},
         /*disabled_features=*/{});
   }
 
@@ -1661,10 +1666,12 @@ IN_PROC_BROWSER_TEST_F(ProtoBackgroundTracingTest, ProtoTraceReceived) {
 
   EXPECT_TRUE(BackgroundTracingManager::GetInstance()->SetActiveScenario(
       std::move(config), base::DoNothing(),
-      BackgroundTracingManager::NO_DATA_FILTERING));
+      BackgroundTracingManager::ANONYMIZE_DATA));
 
   background_tracing_helper.WaitForTracingEnabled();
 
+  NavigateToURLBlockUntilNavigationsComplete(shell(), GURL("about:blank"), 1);
+
   TestTriggerHelper trigger_helper;
   BackgroundTracingManager::GetInstance()->TriggerNamedEvent(
       handle, trigger_helper.receive_closure(true));
@@ -1684,7 +1691,7 @@ IN_PROC_BROWSER_TEST_F(ProtoBackgroundTracingTest, ProtoTraceReceived) {
   tracing::PrivacyFilteringCheck checker;
   checker.CheckProtoForUnexpectedFields(trace_data);
   EXPECT_GT(checker.stats().track_event, 0u);
-  EXPECT_EQ(checker.stats().process_desc, 0u);
+  EXPECT_GT(checker.stats().process_desc, 0u);
   EXPECT_GT(checker.stats().thread_desc, 0u);
   EXPECT_TRUE(checker.stats().has_interned_names);
   EXPECT_TRUE(checker.stats().has_interned_categories);
diff --git a/chromium/content/browser/tracing/background_tracing_rule.cc b/chromium/content/browser/tracing/background_tracing_rule.cc
index 2588f0bf093..b9c5ca271ca 100644
--- a/chromium/content/browser/tracing/background_tracing_rule.cc
+++ b/chromium/content/browser/tracing/background_tracing_rule.cc
@@ -15,6 +15,7 @@
 #include "base/strings/strcat.h"
 #include "base/task/post_task.h"
 #include "base/timer/timer.h"
+#include "base/trace_event/trace_event.h"
 #include "base/values.h"
 #include "components/tracing/common/background_tracing_agent.mojom.h"
 #include "content/browser/tracing/background_tracing_manager_impl.h"
diff --git a/chromium/content/browser/tracing/cast_tracing_agent.cc b/chromium/content/browser/tracing/cast_tracing_agent.cc
index dcf5107630e..3a61612d88a 100644
--- a/chromium/content/browser/tracing/cast_tracing_agent.cc
+++ b/chromium/content/browser/tracing/cast_tracing_agent.cc
@@ -11,6 +11,7 @@
 #include "base/logging.h"
 #include "base/no_destructor.h"
 #include "base/sequence_checker.h"
+#include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "base/trace_event/trace_config.h"
 #include "chromecast/tracing/system_tracing_common.h"
@@ -285,12 +286,13 @@ void CastTracingAgent::StartTracing(const std::string& config,
                              base::Unretained(this), std::move(callback)));
 }
 
-void CastTracingAgent::StopAndFlush(tracing::mojom::RecorderPtr recorder) {
+void CastTracingAgent::StopAndFlush(
+    mojo::PendingRemote<tracing::mojom::Recorder> recorder) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // This may be called even if we are not tracing.
   if (!session_)
     return;
-  recorder_ = std::move(recorder);
+  recorder_.Bind(std::move(recorder));
   session_->StopTracing(base::BindRepeating(&CastTracingAgent::HandleTraceData,
                                             base::Unretained(this)));
 }
diff --git a/chromium/content/browser/tracing/cast_tracing_agent.h b/chromium/content/browser/tracing/cast_tracing_agent.h
index 7b90f2abedc..cb6ea1ad717 100644
--- a/chromium/content/browser/tracing/cast_tracing_agent.h
+++ b/chromium/content/browser/tracing/cast_tracing_agent.h
@@ -9,6 +9,7 @@
 #include <string>
 
 #include "chromecast/tracing/system_tracer.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/tracing/public/cpp/base_agent.h"
 #include "services/tracing/public/mojom/tracing.mojom.h"
 
@@ -35,14 +36,15 @@ class CastTracingAgent : public tracing::BaseAgent {
   void StartTracing(const std::string& config,
                     base::TimeTicks coordinator_time,
                     Agent::StartTracingCallback callback) override;
-  void StopAndFlush(tracing::mojom::RecorderPtr recorder) override;
+  void StopAndFlush(
+      mojo::PendingRemote<tracing::mojom::Recorder> recorder) override;
 
   void StartTracingCallbackProxy(Agent::StartTracingCallback callback,
                                  bool success);
   void HandleTraceData(chromecast::SystemTracer::Status status,
                        std::string trace_data);
 
-  tracing::mojom::RecorderPtr recorder_;
+  mojo::Remote<tracing::mojom::Recorder> recorder_;
 
   // Task runner for collecting traces in a worker thread.
   scoped_refptr<base::SequencedTaskRunner> worker_task_runner_;
diff --git a/chromium/content/browser/tracing/cros_tracing_agent.cc b/chromium/content/browser/tracing/cros_tracing_agent.cc
index b8c22b8303b..74559612d6b 100644
--- a/chromium/content/browser/tracing/cros_tracing_agent.cc
+++ b/chromium/content/browser/tracing/cros_tracing_agent.cc
@@ -16,7 +16,7 @@
 #include "base/task/post_task.h"
 #include "base/trace_event/trace_config.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
-#include "chromeos/dbus/debug_daemon_client.h"
+#include "chromeos/dbus/debug_daemon/debug_daemon_client.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "services/service_manager/public/cpp/connector.h"
 #include "services/tracing/public/cpp/perfetto/perfetto_traced_process.h"
@@ -244,11 +244,12 @@ void CrOSTracingAgent::StartTracing(const std::string& config,
                              base::Unretained(this), std::move(callback)));
 }
 
-void CrOSTracingAgent::StopAndFlush(tracing::mojom::RecorderPtr recorder) {
+void CrOSTracingAgent::StopAndFlush(
+    mojo::PendingRemote<tracing::mojom::Recorder> recorder) {
   // This may be called even if we are not tracing.
   if (!session_)
     return;
-  recorder_ = std::move(recorder);
+  recorder_.Bind(std::move(recorder));
   session_->StopTracing(
       base::BindOnce(&CrOSTracingAgent::RecorderProxy, base::Unretained(this)));
 }
diff --git a/chromium/content/browser/tracing/cros_tracing_agent.h b/chromium/content/browser/tracing/cros_tracing_agent.h
index 289db7cc385..edb0c963fc4 100644
--- a/chromium/content/browser/tracing/cros_tracing_agent.h
+++ b/chromium/content/browser/tracing/cros_tracing_agent.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include <string>
 
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/tracing/public/cpp/base_agent.h"
 #include "services/tracing/public/mojom/tracing.mojom.h"
 
@@ -34,14 +35,15 @@ class CrOSTracingAgent : public tracing::BaseAgent {
   void StartTracing(const std::string& config,
                     base::TimeTicks coordinator_time,
                     Agent::StartTracingCallback callback) override;
-  void StopAndFlush(tracing::mojom::RecorderPtr recorder) override;
+  void StopAndFlush(
+      mojo::PendingRemote<tracing::mojom::Recorder> recorder) override;
 
   void StartTracingCallbackProxy(Agent::StartTracingCallback callback,
                                  bool success);
   void RecorderProxy(const scoped_refptr<base::RefCountedString>& events);
 
   std::unique_ptr<CrOSSystemTracingSession> session_;
-  tracing::mojom::RecorderPtr recorder_;
+  mojo::Remote<tracing::mojom::Recorder> recorder_;
 
   DISALLOW_COPY_AND_ASSIGN(CrOSTracingAgent);
 };
diff --git a/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc b/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc
index 0afeead6355..0283f6f4761 100644
--- a/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc
+++ b/chromium/content/browser/tracing/memory_instrumentation_browsertest.cc
@@ -79,9 +79,8 @@ std::unique_ptr<GlobalMemoryDump> DoGlobalDump() {
 
 // *SAN fake some sys calls we need meaning we never get dumps for the
 // processes.
-// Flakes on Android. crbug.com/970058
 #if defined(MEMORY_SANITIZER) || defined(ADDRESS_SANITIZER) || \
-    defined(THREAD_SANITIZER) || defined(OS_ANDROID)
+    defined(THREAD_SANITIZER)
 #define MAYBE_PrivateFootprintComputation DISABLED_PrivateFootprintComputation
 #else
 #define MAYBE_PrivateFootprintComputation PrivateFootprintComputation
diff --git a/chromium/content/browser/tracing/memory_instrumentation_util.cc b/chromium/content/browser/tracing/memory_instrumentation_util.cc
new file mode 100644
index 00000000000..10b01d41d09
--- /dev/null
+++ b/chromium/content/browser/tracing/memory_instrumentation_util.cc
@@ -0,0 +1,26 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/tracing/memory_instrumentation_util.h"
+
+#include "content/public/browser/resource_coordinator_service.h"
+#include "services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h"
+#include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
+
+namespace content {
+
+void InitializeBrowserMemoryInstrumentationClient() {
+  mojo::PendingRemote<memory_instrumentation::mojom::Coordinator> coordinator;
+  mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess> process;
+  auto process_receiver = process.InitWithNewPipeAndPassReceiver();
+  GetMemoryInstrumentationCoordinatorController()->RegisterClientProcess(
+      coordinator.InitWithNewPipeAndPassReceiver(), std::move(process),
+      memory_instrumentation::mojom::ProcessType::BROWSER,
+      base::GetCurrentProcId(), /*service_name=*/base::nullopt);
+  memory_instrumentation::ClientProcessImpl::CreateInstance(
+      std::move(process_receiver), std::move(coordinator),
+      /*is_browser_process=*/true);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/tracing/memory_instrumentation_util.h b/chromium/content/browser/tracing/memory_instrumentation_util.h
new file mode 100644
index 00000000000..95fc27ec78f
--- /dev/null
+++ b/chromium/content/browser/tracing/memory_instrumentation_util.h
@@ -0,0 +1,18 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_TRACING_MEMORY_INSTRUMENTATION_UTIL_H_
+#define CONTENT_BROWSER_TRACING_MEMORY_INSTRUMENTATION_UTIL_H_
+
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Registers the browser process as a memory-instrumentation client, so that
+// data for the browser process will be available in memory dumps.
+void CONTENT_EXPORT InitializeBrowserMemoryInstrumentationClient();
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_TRACING_MEMORY_INSTRUMENTATION_UTIL_H_
diff --git a/chromium/content/browser/tracing/memory_tracing_browsertest.cc b/chromium/content/browser/tracing/memory_tracing_browsertest.cc
index a5041492d11..2f47e544084 100644
--- a/chromium/content/browser/tracing/memory_tracing_browsertest.cc
+++ b/chromium/content/browser/tracing/memory_tracing_browsertest.cc
@@ -27,6 +27,7 @@
 #include "testing/gmock/include/gmock/gmock.h"
 
 using base::trace_event::MemoryDumpArgs;
+using base::trace_event::MemoryDumpDeterminism;
 using base::trace_event::MemoryDumpLevelOfDetail;
 using base::trace_event::MemoryDumpManager;
 using base::trace_event::MemoryDumpType;
@@ -85,10 +86,12 @@ class MemoryTracingTest : public ContentBrowserTest {
               RequestGlobalDumpAndAppendToTrace,
           base::Unretained(
               memory_instrumentation::MemoryInstrumentation::GetInstance()),
-          dump_type, level_of_detail, std::move(callback)));
+          dump_type, level_of_detail, MemoryDumpDeterminism::NONE,
+          std::move(callback)));
     } else {
       memory_instrumentation::MemoryInstrumentation::GetInstance()
           ->RequestGlobalDumpAndAppendToTrace(dump_type, level_of_detail,
+                                              MemoryDumpDeterminism::NONE,
                                               std::move(callback));
     }
   }
@@ -134,10 +137,9 @@ class MemoryTracingTest : public ContentBrowserTest {
   void DisableTracing() {
     base::RunLoop run_loop;
     bool success = TracingController::GetInstance()->StopTracing(
-        TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
-            [](base::Closure quit_closure,
-               std::unique_ptr<const base::DictionaryValue> metadata,
-               base::RefCountedString* trace_str) {
+        TracingControllerImpl::CreateCallbackEndpoint(base::BindOnce(
+            [](base::OnceClosure quit_closure,
+               std::unique_ptr<std::string> trace_str) {
               std::move(quit_closure).Run();
             },
             run_loop.QuitClosure())));
@@ -163,7 +165,7 @@ class MemoryTracingTest : public ContentBrowserTest {
   }
 
   void Navigate(Shell* shell) {
-    NavigateToURL(shell, GetTestUrl("", "title1.html"));
+    EXPECT_TRUE(NavigateToURL(shell, GetTestUrl("", "title1.html")));
   }
 
   MOCK_METHOD2(OnMemoryDumpDone, void(uint32_t request_index, bool successful));
@@ -178,10 +180,9 @@ class MemoryTracingTest : public ContentBrowserTest {
 // intended to give coverage to Android WebView.
 #if defined(OS_ANDROID)
 
-// Flaky on Android. crbug.com/970058
-class DISABLED_SingleProcessMemoryTracingTest : public MemoryTracingTest {
+class SingleProcessMemoryTracingTest : public MemoryTracingTest {
  public:
-  DISABLED_SingleProcessMemoryTracingTest() {}
+  SingleProcessMemoryTracingTest() {}
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     command_line->AppendSwitch(switches::kSingleProcess);
@@ -189,15 +190,15 @@ class DISABLED_SingleProcessMemoryTracingTest : public MemoryTracingTest {
 };
 
 // https://crbug.com/788788
-#if defined(ADDRESS_SANITIZER)
+#if defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
 #define MAYBE_BrowserInitiatedSingleDump DISABLED_BrowserInitiatedSingleDump
 #else
 #define MAYBE_BrowserInitiatedSingleDump BrowserInitiatedSingleDump
-#endif  // defined(ADDRESS_SANITIZER)
+#endif  // defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
 
 // Checks that a memory dump initiated from a the main browser thread ends up in
 // a single dump even in single process mode.
-IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
+IN_PROC_BROWSER_TEST_F(SingleProcessMemoryTracingTest,
                        MAYBE_BrowserInitiatedSingleDump) {
   Navigate(shell());
 
@@ -212,16 +213,16 @@ IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
 }
 
 // https://crbug.com/788788
-#if defined(ADDRESS_SANITIZER)
+#if defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
 #define MAYBE_RendererInitiatedSingleDump DISABLED_RendererInitiatedSingleDump
 #else
 #define MAYBE_RendererInitiatedSingleDump RendererInitiatedSingleDump
-#endif  // defined(ADDRESS_SANITIZER)
+#endif  // defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
 
 // Checks that a memory dump initiated from a renderer thread ends up in a
 // single dump even in single process mode.
-IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
-                       DISABLED_RendererInitiatedSingleDump) {
+IN_PROC_BROWSER_TEST_F(SingleProcessMemoryTracingTest,
+                       MAYBE_RendererInitiatedSingleDump) {
   Navigate(shell());
 
   EXPECT_CALL(*mock_dump_provider_, OnMemoryDump(_,_)).WillOnce(Return(true));
@@ -235,12 +236,12 @@ IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
 }
 
 // https://crbug.com/788788
-#if defined(ADDRESS_SANITIZER)
+#if defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
 #define MAYBE_ManyInterleavedDumps DISABLED_ManyInterleavedDumps
 #else
 #define MAYBE_ManyInterleavedDumps ManyInterleavedDumps
-#endif  // defined(ADDRESS_SANITIZER)
-IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
+#endif  // defined(OS_ANDROID) && defined(ADDRESS_SANITIZER)
+IN_PROC_BROWSER_TEST_F(SingleProcessMemoryTracingTest,
                        MAYBE_ManyInterleavedDumps) {
   Navigate(shell());
 
@@ -270,8 +271,7 @@ IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
 // that periodic dump requests fail in case there is already a request in the
 // queue with the same level of detail.
 // Flaky failures on all platforms. https://crbug.com/752613
-IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
-                       DISABLED_QueuedDumps) {
+IN_PROC_BROWSER_TEST_F(SingleProcessMemoryTracingTest, DISABLED_QueuedDumps) {
   Navigate(shell());
 
   EnableMemoryTracing();
@@ -337,7 +337,7 @@ IN_PROC_BROWSER_TEST_F(DISABLED_SingleProcessMemoryTracingTest,
 #endif  // defined(OS_ANDROID)
 
 // Flaky on Mac. crbug.com/809809
-#if defined(OS_MACOSX) || defined(OS_ANDROID)
+#if defined(OS_MACOSX)
 #define MAYBE_BrowserInitiatedDump DISABLED_BrowserInitiatedDump
 #else
 #define MAYBE_BrowserInitiatedDump BrowserInitiatedDump
diff --git a/chromium/content/browser/tracing/perfetto_file_tracer.cc b/chromium/content/browser/tracing/perfetto_file_tracer.cc
index 997c3e2d94e..50e4dedf30b 100644
--- a/chromium/content/browser/tracing/perfetto_file_tracer.cc
+++ b/chromium/content/browser/tracing/perfetto_file_tracer.cc
@@ -12,6 +12,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/task/post_task.h"
 #include "base/threading/scoped_blocking_call.h"
+#include "build/build_config.h"
 #include "components/tracing/common/trace_startup_config.h"
 #include "components/tracing/common/tracing_switches.h"
 #include "content/public/browser/system_connector.h"
@@ -22,6 +23,10 @@
 #include "third_party/perfetto/include/perfetto/tracing/core/trace_config.h"
 #include "third_party/perfetto/protos/perfetto/config/trace_config.pb.h"
 
+#if defined(OS_ANDROID)
+#include "content/browser/android/tracing_controller_android.h"
+#endif
+
 namespace content {
 
 namespace {
@@ -35,6 +40,14 @@ class BackgroundDrainer : public mojo::DataPipeDrainer::Client {
     base::FilePath output_file =
         base::CommandLine::ForCurrentProcess()->GetSwitchValuePath(
             switches::kPerfettoOutputFile);
+
+#if defined(OS_ANDROID)
+    if (output_file.empty()) {
+      TracingControllerAndroid::GenerateTracingFilePath(&output_file);
+      VLOG(0) << "Writing to output file: " << output_file.value();
+    }
+#endif
+
     file_.Initialize(output_file,
                      base::File::FLAG_CREATE_ALWAYS | base::File::FLAG_WRITE);
     if (!file_.IsValid()) {
@@ -105,8 +118,9 @@ PerfettoFileTracer::PerfettoFileTracer()
   // We just need a single global trace buffer, for our data.
   trace_config.mutable_buffers()->front().set_size_kb(32 * 1024);
 
-  tracing::mojom::TracingSessionClientPtr tracing_session_client;
-  binding_.Bind(mojo::MakeRequest(&tracing_session_client));
+  mojo::PendingRemote<tracing::mojom::TracingSessionClient>
+      tracing_session_client;
+  binding_.Bind(tracing_session_client.InitWithNewPipeAndPassReceiver());
   binding_.set_connection_error_handler(base::BindOnce(
       &PerfettoFileTracer::OnTracingSessionEnded, base::Unretained(this)));
 
diff --git a/chromium/content/browser/tracing/startup_tracing_browsertest.cc b/chromium/content/browser/tracing/startup_tracing_browsertest.cc
index a99af71bdf4..a064e17480f 100644
--- a/chromium/content/browser/tracing/startup_tracing_browsertest.cc
+++ b/chromium/content/browser/tracing/startup_tracing_browsertest.cc
@@ -69,7 +69,7 @@ class CommandlineStartupTracingTest : public ContentBrowserTest {
 };
 
 IN_PROC_BROWSER_TEST_F(CommandlineStartupTracingTest, TestStartupTracing) {
-  NavigateToURL(shell(), GetTestUrl("", "title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl("", "title1.html")));
   WaitForCondition(base::BindRepeating([]() {
                      return !TracingController::GetInstance()->IsTracing();
                    }),
@@ -94,8 +94,7 @@ class StartupTracingInProcessTest : public ContentBrowserTest {
  public:
   StartupTracingInProcessTest() {
     scoped_feature_list_.InitWithFeatures(
-        /*enabled_features=*/{features::kTracingPerfettoBackend,
-                              features::kTracingServiceInProcess},
+        /*enabled_features=*/{features::kTracingServiceInProcess},
         /*disabled_features=*/{});
   }
 
@@ -128,6 +127,8 @@ IN_PROC_BROWSER_TEST_F(StartupTracingInProcessTest, TestFilledStartupBuffer) {
 
   auto config = tracing::TraceStartupConfig::GetInstance()
                     ->GetDefaultBrowserStartupConfig();
+  config.SetTraceBufferSizeInEvents(0);
+  config.SetTraceBufferSizeInKb(0);
   uint8_t modes = base::trace_event::TraceLog::RECORDING_MODE;
   base::trace_event::TraceLog::GetInstance()->SetEnabled(config, modes);
 
@@ -143,14 +144,15 @@ IN_PROC_BROWSER_TEST_F(StartupTracingInProcessTest, TestFilledStartupBuffer) {
       config, wait_for_tracing.QuitClosure());
   wait_for_tracing.Run();
 
-  NavigateToURL(shell(), GetTestUrl("", "title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl("", "title1.html")));
 
   base::RunLoop wait_for_stop;
   TracingControllerImpl::GetInstance()->StopTracing(
-      TracingController::CreateStringEndpoint(base::BindRepeating(
-          [](base::RepeatingClosure quit_callback,
-             std::unique_ptr<const base::DictionaryValue> metadata,
-             base::RefCountedString* data) { quit_callback.Run(); },
+      TracingController::CreateStringEndpoint(base::BindOnce(
+          [](base::OnceClosure quit_callback,
+             std::unique_ptr<std::string> data) {
+            std::move(quit_callback).Run();
+          },
           wait_for_stop.QuitClosure())));
   wait_for_stop.Run();
 }
@@ -183,7 +185,7 @@ class BackgroundStartupTracingTest : public ContentBrowserTest {
 #define MAYBE_TestStartupTracing TestStartupTracing
 #endif
 IN_PROC_BROWSER_TEST_F(BackgroundStartupTracingTest, MAYBE_TestStartupTracing) {
-  NavigateToURL(shell(), GetTestUrl("", "title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl("", "title1.html")));
 
   EXPECT_FALSE(tracing::TraceStartupConfig::GetInstance()->IsEnabled());
   EXPECT_FALSE(TracingController::GetInstance()->IsTracing());
@@ -200,7 +202,7 @@ IN_PROC_BROWSER_TEST_F(BackgroundStartupTracingTest, MAYBE_TestStartupTracing) {
   tracing::PrivacyFilteringCheck checker;
   checker.CheckProtoForUnexpectedFields(trace);
   EXPECT_GT(checker.stats().track_event, 0u);
-  EXPECT_EQ(checker.stats().process_desc, 0u);
+  EXPECT_GT(checker.stats().process_desc, 0u);
   EXPECT_GT(checker.stats().thread_desc, 0u);
   EXPECT_TRUE(checker.stats().has_interned_names);
   EXPECT_TRUE(checker.stats().has_interned_categories);
diff --git a/chromium/content/browser/tracing/tracing_controller_browsertest.cc b/chromium/content/browser/tracing/tracing_controller_browsertest.cc
index 9ed33ec6490..fb5caa20d07 100644
--- a/chromium/content/browser/tracing/tracing_controller_browsertest.cc
+++ b/chromium/content/browser/tracing/tracing_controller_browsertest.cc
@@ -69,32 +69,26 @@ class TracingControllerTestEndpoint
     : public TracingController::TraceDataEndpoint {
  public:
   TracingControllerTestEndpoint(
-      base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                          base::RefCountedString*)> done_callback)
-      : done_callback_(done_callback) {}
+      TracingController::CompletionCallback done_callback)
+      : done_callback_(std::move(done_callback)) {}
 
   void ReceiveTraceChunk(std::unique_ptr<std::string> chunk) override {
     EXPECT_FALSE(chunk->empty());
     trace_ += *chunk;
   }
 
-  void ReceiveTraceFinalContents(
-      std::unique_ptr<const base::DictionaryValue> metadata) override {
-    scoped_refptr<base::RefCountedString> chunk_ptr =
-        base::RefCountedString::TakeString(&trace_);
-
-    base::PostTask(FROM_HERE, {BrowserThread::UI},
-                   base::BindOnce(done_callback_, std::move(metadata),
-                                  base::RetainedRef(chunk_ptr)));
+  void ReceivedTraceFinalContents() override {
+    base::PostTask(
+        FROM_HERE, {BrowserThread::UI},
+        base::BindOnce(std::move(done_callback_),
+                       std::make_unique<std::string>(std::move(trace_))));
   }
 
  protected:
-  ~TracingControllerTestEndpoint() override {}
+  ~TracingControllerTestEndpoint() override = default;
 
   std::string trace_;
-  base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                      base::RefCountedString*)>
-      done_callback_;
+  TracingController::CompletionCallback done_callback_;
 };
 
 class TestTracingDelegate : public TracingDelegate {
@@ -144,19 +138,16 @@ class TracingControllerTest : public ContentBrowserTest {
     std::move(quit_callback).Run();
   }
 
-  void StopTracingStringDoneCallbackTest(
-      base::Closure quit_callback,
-      std::unique_ptr<const base::DictionaryValue> metadata,
-      base::RefCountedString* data) {
+  void StopTracingStringDoneCallbackTest(base::OnceClosure quit_callback,
+                                         std::unique_ptr<std::string> data) {
     disable_recording_done_callback_count_++;
-    last_metadata_ = std::move(metadata);
-    last_data_ = data->data();
-    EXPECT_FALSE(data->data().empty());
+    last_data_ = std::move(data);
+    EXPECT_FALSE(last_data_->empty());
     std::move(quit_callback).Run();
   }
 
   void StopTracingFileDoneCallbackTest(base::Closure quit_callback,
-                                            const base::FilePath& file_path) {
+                                       const base::FilePath& file_path) {
     disable_recording_done_callback_count_++;
     {
       base::ScopedAllowBlockingForTesting allow_blocking;
@@ -185,13 +176,7 @@ class TracingControllerTest : public ContentBrowserTest {
     return last_actual_recording_file_path_;
   }
 
-  const base::DictionaryValue* last_metadata() const {
-    return last_metadata_.get();
-  }
-
-  const std::string& last_data() const {
-    return last_data_;
-  }
+  const std::string& last_data() const { return *last_data_; }
 
   void TestStartAndStopTracingString(bool enable_systrace = false) {
     Navigate(shell());
@@ -214,11 +199,9 @@ class TracingControllerTest : public ContentBrowserTest {
 
     {
       base::RunLoop run_loop;
-      base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                          base::RefCountedString*)>
-          callback = base::Bind(
-              &TracingControllerTest::StopTracingStringDoneCallbackTest,
-              base::Unretained(this), run_loop.QuitClosure());
+      TracingController::CompletionCallback callback = base::BindRepeating(
+          &TracingControllerTest::StopTracingStringDoneCallbackTest,
+          base::Unretained(this), run_loop.QuitClosure());
       bool result = controller->StopTracing(
           TracingController::CreateStringEndpoint(std::move(callback)));
       ASSERT_TRUE(result);
@@ -234,9 +217,6 @@ class TracingControllerTest : public ContentBrowserTest {
     Navigate(shell());
 
     TracingControllerImpl* controller = TracingControllerImpl::GetInstance();
-    tracing::TraceEventAgent::GetInstance()->AddMetadataGeneratorFunction(
-        base::Bind(&TracingControllerTest::GenerateMetadataDict,
-                   base::Unretained(this)));
 
     {
       base::RunLoop run_loop;
@@ -244,10 +224,8 @@ class TracingControllerTest : public ContentBrowserTest {
           base::BindOnce(&TracingControllerTest::StartTracingDoneCallbackTest,
                          base::Unretained(this), run_loop.QuitClosure());
 
-      TraceConfig config = TraceConfig();
-      config.EnableArgumentFilter();
-
-      bool result = controller->StartTracing(config, std::move(callback));
+      bool result =
+          controller->StartTracing(TraceConfig(), std::move(callback));
       ASSERT_TRUE(result);
       run_loop.Run();
       EXPECT_EQ(enable_recording_done_callback_count(), 1);
@@ -255,19 +233,22 @@ class TracingControllerTest : public ContentBrowserTest {
 
     {
       base::RunLoop run_loop;
-      base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                          base::RefCountedString*)>
-          callback = base::Bind(
-              &TracingControllerTest::StopTracingStringDoneCallbackTest,
-              base::Unretained(this), run_loop.QuitClosure());
+      TracingController::CompletionCallback callback = base::BindRepeating(
+          &TracingControllerTest::StopTracingStringDoneCallbackTest,
+          base::Unretained(this), run_loop.QuitClosure());
 
       scoped_refptr<TracingController::TraceDataEndpoint> trace_data_endpoint =
           TracingController::CreateStringEndpoint(std::move(callback));
 
       metadata_ = std::make_unique<base::DictionaryValue>();
       metadata_->SetString("not-whitelisted", "this_not_found");
+      tracing::TraceEventAgent::GetInstance()->AddMetadataGeneratorFunction(
+          base::Bind(&TracingControllerTest::GenerateMetadataDict,
+                     base::Unretained(this)));
 
-      bool result = controller->StopTracing(trace_data_endpoint);
+      bool result =
+          controller->StopTracing(trace_data_endpoint, /*agent_label=*/"",
+                                  /*privacy_filtering_enabled=*/true);
       ASSERT_TRUE(result);
       run_loop.Run();
       EXPECT_EQ(disable_recording_done_callback_count(), 1);
@@ -295,11 +276,9 @@ class TracingControllerTest : public ContentBrowserTest {
 
     {
       base::RunLoop run_loop;
-      base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                          base::RefCountedString*)>
-          callback = base::Bind(
-              &TracingControllerTest::StopTracingStringDoneCallbackTest,
-              base::Unretained(this), run_loop.QuitClosure());
+      TracingController::CompletionCallback callback = base::BindOnce(
+          &TracingControllerTest::StopTracingStringDoneCallbackTest,
+          base::Unretained(this), run_loop.QuitClosure());
       bool result = controller->StopTracing(
           TracingControllerImpl::CreateCompressedStringEndpoint(
               new TracingControllerTestEndpoint(std::move(callback)),
@@ -330,11 +309,9 @@ class TracingControllerTest : public ContentBrowserTest {
 
     {
       base::RunLoop run_loop;
-      base::Closure callback = base::Bind(
+      base::RepeatingClosure callback = base::BindRepeating(
           &TracingControllerTest::StopTracingFileDoneCallbackTest,
-          base::Unretained(this),
-          run_loop.QuitClosure(),
-          result_file_path);
+          base::Unretained(this), run_loop.QuitClosure(), result_file_path);
       bool result =
           controller->StopTracing(TracingController::CreateFileEndpoint(
               result_file_path, std::move(callback)));
@@ -355,8 +332,7 @@ class TracingControllerTest : public ContentBrowserTest {
   int disable_recording_done_callback_count_;
   base::FilePath last_actual_recording_file_path_;
   std::unique_ptr<base::DictionaryValue> metadata_;
-  std::unique_ptr<const base::DictionaryValue> last_metadata_;
-  std::string last_data_;
+  std::unique_ptr<std::string> last_data_;
 };
 
 IN_PROC_BROWSER_TEST_F(TracingControllerTest, GetCategories) {
@@ -382,25 +358,30 @@ IN_PROC_BROWSER_TEST_F(TracingControllerTest,
   TestStartAndStopTracingString();
   // Check that a number of important keys exist in the metadata dictionary. The
   // values are not checked to ensure the test is robust.
-  ASSERT_NE(last_metadata(), nullptr);
+  base::Optional<base::Value> trace_json = base::JSONReader::Read(last_data());
+  ASSERT_TRUE(trace_json);
+  auto* metadata_json = static_cast<base::DictionaryValue*>(
+      trace_json->FindKeyOfType("metadata", base::Value::Type::DICTIONARY));
+  ASSERT_TRUE(metadata_json);
+
   std::string network_type;
-  last_metadata()->GetString("network-type", &network_type);
+  metadata_json->GetString("network-type", &network_type);
   EXPECT_FALSE(network_type.empty());
   std::string user_agent;
-  last_metadata()->GetString("user-agent", &user_agent);
+  metadata_json->GetString("user-agent", &user_agent);
   EXPECT_FALSE(user_agent.empty());
   std::string os_name;
-  last_metadata()->GetString("os-name", &os_name);
+  metadata_json->GetString("os-name", &os_name);
   EXPECT_FALSE(os_name.empty());
   std::string command_line;
-  last_metadata()->GetString("command_line", &command_line);
+  metadata_json->GetString("command_line", &command_line);
   EXPECT_FALSE(command_line.empty());
   std::string trace_config;
-  last_metadata()->GetString("trace-config", &trace_config);
+  metadata_json->GetString("trace-config", &trace_config);
   EXPECT_EQ(TraceConfig().ToString(), trace_config);
 #if defined(OS_CHROMEOS)
   std::string hardware_class;
-  last_metadata()->GetString("hardware-class", &hardware_class);
+  metadata_json->GetString("hardware-class", &hardware_class);
   EXPECT_EQ(hardware_class, "test-hardware-class");
 #endif
 }
@@ -408,34 +389,7 @@ IN_PROC_BROWSER_TEST_F(TracingControllerTest,
 IN_PROC_BROWSER_TEST_F(TracingControllerTest, NotWhitelistedMetadataStripped) {
   TestStartAndStopTracingStringWithFilter();
   // Check that a number of important keys exist in the metadata dictionary.
-  ASSERT_NE(last_metadata(), nullptr);
-  std::string network_type;
-  last_metadata()->GetString("network-type", &network_type);
-  EXPECT_FALSE(network_type.empty());
-  EXPECT_TRUE(network_type != "__stripped__");
-  std::string os_name;
-  last_metadata()->GetString("os-name", &os_name);
-  EXPECT_FALSE(os_name.empty());
-  EXPECT_TRUE(os_name != "__stripped__");
-  std::string user_agent;
-  last_metadata()->GetString("user-agent", &user_agent);
-  EXPECT_FALSE(user_agent.empty());
-  EXPECT_TRUE(user_agent != "__stripped__");
-#if defined(OS_CHROMEOS)
-  std::string hardware_class;
-  last_metadata()->GetString("hardware-class", &hardware_class);
-  EXPECT_EQ(hardware_class, "test-hardware-class");
-#endif
-
-  // Check that the not whitelisted metadata is stripped.
-  std::string not_whitelisted;
-  last_metadata()->GetString("not-whitelisted", &not_whitelisted);
-  EXPECT_FALSE(not_whitelisted.empty());
-  EXPECT_TRUE(not_whitelisted == "__stripped__");
-
-  // Also check the trace content.
-  std::unique_ptr<base::Value> trace_json =
-      base::JSONReader::ReadDeprecated(last_data());
+  base::Optional<base::Value> trace_json = base::JSONReader::Read(last_data());
   ASSERT_TRUE(trace_json);
   const base::Value* metadata_json =
       trace_json->FindKeyOfType("metadata", base::Value::Type::DICTIONARY);
@@ -451,11 +405,6 @@ IN_PROC_BROWSER_TEST_F(TracingControllerTest, NotWhitelistedMetadataStripped) {
 
   // The following field is not whitelisted and is supposed to be stripped.
   EXPECT_TRUE(KeyEquals(metadata_json, "v8-version", "__stripped__"));
-
-  // TODO(770017): This test is currently broken since metadata filtering is
-  // only done in |TracingControllerImpl::GenerateMetadataDict()|. Metadata
-  // set by other providers are not filtered correctly.
-  // EXPECT_TRUE(KeyEquals(metadata_json, "not-whitelisted", "__stripped__"));
 }
 
 IN_PROC_BROWSER_TEST_F(TracingControllerTest,
@@ -485,9 +434,8 @@ IN_PROC_BROWSER_TEST_F(TracingControllerTest,
       TracingController::StartTracingDoneCallback()));
   EXPECT_TRUE(controller->StopTracing(
       TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
-          [](base::Closure quit_closure,
-             std::unique_ptr<const base::DictionaryValue> metadata,
-             base::RefCountedString* trace_str) {
+          [](base::OnceClosure quit_closure,
+             std::unique_ptr<std::string> trace_str) {
             std::move(quit_closure).Run();
           },
           run_loop.QuitClosure()))));
@@ -502,10 +450,9 @@ IN_PROC_BROWSER_TEST_F(TracingControllerTest, DoubleStopTracing) {
   EXPECT_TRUE(controller->StartTracing(
       TraceConfig(), TracingController::StartTracingDoneCallback()));
   EXPECT_TRUE(controller->StopTracing(
-      TracingControllerImpl::CreateCallbackEndpoint(base::BindRepeating(
-          [](base::Closure quit_closure,
-             std::unique_ptr<const base::DictionaryValue> metadata,
-             base::RefCountedString* trace_str) {
+      TracingControllerImpl::CreateCallbackEndpoint(base::BindOnce(
+          [](base::OnceClosure quit_closure,
+             std::unique_ptr<std::string> trace_str) {
             std::move(quit_closure).Run();
           },
           run_loop.QuitClosure()))));
diff --git a/chromium/content/browser/tracing/tracing_controller_impl.cc b/chromium/content/browser/tracing/tracing_controller_impl.cc
index a02265417fa..50af9cb3e20 100644
--- a/chromium/content/browser/tracing/tracing_controller_impl.cc
+++ b/chromium/content/browser/tracing/tracing_controller_impl.cc
@@ -4,6 +4,7 @@
 
 #include "content/browser/tracing/tracing_controller_impl.h"
 
+#include <inttypes.h>
 #include <memory>
 #include <utility>
 #include <vector>
@@ -14,6 +15,7 @@
 #include "base/cpu.h"
 #include "base/files/file_tracing.h"
 #include "base/logging.h"
+#include "base/run_loop.h"
 #include "base/strings/string_split.h"
 #include "base/strings/stringprintf.h"
 #include "base/system/sys_info.h"
@@ -38,6 +40,7 @@
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/network_change_notifier.h"
 #include "services/service_manager/public/cpp/connector.h"
+#include "services/tracing/public/cpp/perfetto/perfetto_config.h"
 #include "services/tracing/public/cpp/trace_event_agent.h"
 #include "services/tracing/public/cpp/traced_process_impl.h"
 #include "services/tracing/public/cpp/tracing_features.h"
@@ -46,7 +49,7 @@
 
 #if defined(OS_CHROMEOS)
 #include "chromeos/dbus/dbus_thread_manager.h"
-#include "chromeos/dbus/debug_daemon_client.h"
+#include "chromeos/dbus/debug_daemon/debug_daemon_client.h"
 #include "chromeos/system/statistics_provider.h"
 #include "content/browser/tracing/cros_tracing_agent.h"
 #endif
@@ -65,6 +68,7 @@
 #include <sys/time.h>
 #include "base/debug/elf_reader.h"
 #include "content/browser/android/tracing_controller_android.h"
+#include "services/tracing/public/cpp/perfetto/java_heap_profiler/java_heap_profiler_android.h"
 
 // Symbol with virtual address of the start of ELF header of the current binary.
 extern char __ehdr_start;
@@ -209,40 +213,30 @@ void TracingControllerImpl::AddAgents() {
         base::BindRepeating(&TracingDelegate::GenerateMetadataDict,
                             base::Unretained(delegate_.get())));
   }
+#if defined(OS_ANDROID)
+  tracing::PerfettoTracedProcess::Get()->AddDataSource(
+      tracing::JavaHeapProfiler::GetInstance());
+#endif
 }
 
 void TracingControllerImpl::ConnectToServiceIfNeeded() {
-  if (!coordinator_) {
+  if (!consumer_host_) {
     GetSystemConnector()->BindInterface(tracing::mojom::kServiceName,
-                                        &coordinator_);
-    coordinator_.set_connection_error_handler(base::BindOnce(
+                                        &consumer_host_);
+    consumer_host_.set_connection_error_handler(base::BindOnce(
         [](TracingControllerImpl* controller) {
-          controller->coordinator_.reset();
+          controller->consumer_host_.reset();
         },
         base::Unretained(this)));
   }
 }
 
-void TracingControllerImpl::DisconnectFromService() {
-  coordinator_ = nullptr;
-}
-
 // Can be called on any thread.
 std::unique_ptr<base::DictionaryValue>
 TracingControllerImpl::GenerateMetadataDict() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   auto metadata_dict = std::make_unique<base::DictionaryValue>();
 
-  // trace_config_ can be null if the tracing controller finishes flushing
-  // traces before the Chrome tracing agent finishes flushing traces. Normally,
-  // this does not happen; however, if the service manager is teared down during
-  // tracing, e.g. at Chrome shutdown, tracing controller may finish flushing
-  // traces without waiting for tracing agents.
-  if (trace_config_ && !tracing::TracingUsesPerfettoBackend()) {
-    DCHECK(IsTracing());
-    metadata_dict->SetString("trace-config", trace_config_->ToString());
-  }
-
   metadata_dict->SetString("network-type", GetNetworkTypeString());
   metadata_dict->SetString("product-version",
                            GetContentClient()->browser()->GetProduct());
@@ -399,15 +393,27 @@ bool TracingControllerImpl::StartTracing(
   trace_config_ =
       std::make_unique<base::trace_event::TraceConfig>(trace_config);
 
+  DCHECK(!tracing_session_host_);
   ConnectToServiceIfNeeded();
-  coordinator_->StartTracing(
-      trace_config.ToString(),
-      base::BindOnce(
-          [](StartTracingDoneCallback callback, bool success) {
-            if (!callback.is_null())
-              std::move(callback).Run();
-          },
-          std::move(callback)));
+
+  perfetto::TraceConfig perfetto_config = tracing::GetDefaultPerfettoConfig(
+      trace_config, /*requires_anonymized_data=*/false);
+
+  mojo::PendingRemote<tracing::mojom::TracingSessionClient>
+      tracing_session_client;
+  binding_.Bind(tracing_session_client.InitWithNewPipeAndPassReceiver());
+  binding_.set_connection_error_handler(base::BindOnce(
+      &TracingControllerImpl::OnTracingFailed, base::Unretained(this)));
+
+  consumer_host_->EnableTracing(
+      mojo::MakeRequest(&tracing_session_host_),
+      std::move(tracing_session_client), std::move(perfetto_config),
+      tracing::mojom::TracingClientPriority::kUserInitiated);
+  tracing_session_host_.set_connection_error_handler(base::BindOnce(
+      &TracingControllerImpl::OnTracingFailed, base::Unretained(this)));
+
+  start_tracing_callback_ = std::move(callback);
+
   // TODO(chiniforooshan): The actual success value should be sent by the
   // callback asynchronously.
   return true;
@@ -517,8 +523,9 @@ bool TracingControllerImpl::StopTracing(
 
 bool TracingControllerImpl::StopTracing(
     const scoped_refptr<TraceDataEndpoint>& trace_data_endpoint,
-    const std::string& agent_label) {
-  if (!IsTracing() || drainer_ || !coordinator_)
+    const std::string& agent_label,
+    bool privacy_filtering_enabled) {
+  if (!IsTracing() || drainer_ || !tracing_session_host_)
     return false;
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
@@ -526,26 +533,36 @@ bool TracingControllerImpl::StopTracing(
   base::trace_event::TraceLog::GetInstance()->AddClockSyncMetadataEvent();
 #endif
 
+  // Setting the argument filter is no longer supported just in the TraceConfig;
+  // clients of the TracingController that need filtering need to pass that
+  // option to StopTracing directly as an argument. This is due to Perfetto-
+  // based tracing requiring this filtering to be done during serialization
+  // time and not during tracing time.
+  // TODO(oysteine): Remove the config option once the legacy IPC layer is
+  // removed.
+  CHECK(privacy_filtering_enabled || !trace_config_->IsArgumentFilterEnabled());
+
   tracing::TraceStartupConfig::GetInstance()->SetDisabled();
   trace_data_endpoint_ = std::move(trace_data_endpoint);
   is_data_complete_ = false;
-  is_metadata_available_ = false;
-  mojo::DataPipe data_pipe;
-  drainer_.reset(
-      new mojo::DataPipeDrainer(this, std::move(data_pipe.consumer_handle)));
-  if (agent_label.empty()) {
-    // Stop and flush all agents.
-    coordinator_->StopAndFlush(
-        std::move(data_pipe.producer_handle),
-        base::BindRepeating(&TracingControllerImpl::OnMetadataAvailable,
-                            base::Unretained(this)));
-  } else {
-    // Stop all and flush a particular agent.
-    coordinator_->StopAndFlushAgent(
-        std::move(data_pipe.producer_handle), agent_label,
-        base::BindRepeating(&TracingControllerImpl::OnMetadataAvailable,
-                            base::Unretained(this)));
+  read_buffers_complete_ = false;
+
+  mojo::ScopedDataPipeProducerHandle producer_handle;
+  mojo::ScopedDataPipeConsumerHandle consumer_handle;
+  MojoResult result =
+      mojo::CreateDataPipe(nullptr, &producer_handle, &consumer_handle);
+  if (result != MOJO_RESULT_OK) {
+    CompleteFlush();
+    return true;
   }
+
+  drainer_.reset(new mojo::DataPipeDrainer(this, std::move(consumer_handle)));
+
+  tracing_session_host_->DisableTracingAndEmitJson(
+      agent_label, std::move(producer_handle), privacy_filtering_enabled,
+      base::BindOnce(&TracingControllerImpl::OnReadBuffersComplete,
+                     base::Unretained(this)));
+
   // TODO(chiniforooshan): Is the return value used anywhere?
   return true;
 }
@@ -554,12 +571,14 @@ bool TracingControllerImpl::GetTraceBufferUsage(
     GetTraceBufferUsageCallback callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  ConnectToServiceIfNeeded();
-  coordinator_->RequestBufferUsage(base::BindOnce(
+  if (!tracing_session_host_) {
+    std::move(callback).Run(0.0, 0);
+    return true;
+  }
+
+  tracing_session_host_->RequestBufferUsage(base::BindOnce(
       [](GetTraceBufferUsageCallback callback, bool success, float percent_full,
-         uint32_t approximate_count) {
-        std::move(callback).Run(percent_full, approximate_count);
-      },
+         bool data_loss) { std::move(callback).Run(percent_full, 0); },
       std::move(callback)));
   // TODO(chiniforooshan): The actual success value should be sent by the
   // callback asynchronously.
@@ -570,15 +589,15 @@ bool TracingControllerImpl::IsTracing() {
   return trace_config_ != nullptr;
 }
 
-void TracingControllerImpl::RegisterTracingUI(TracingUI* tracing_ui) {
-  DCHECK(tracing_uis_.find(tracing_ui) == tracing_uis_.end());
-  tracing_uis_.insert(tracing_ui);
+void TracingControllerImpl::OnTracingEnabled() {
+  if (start_tracing_callback_)
+    std::move(start_tracing_callback_).Run();
 }
 
-void TracingControllerImpl::UnregisterTracingUI(TracingUI* tracing_ui) {
-  auto it = tracing_uis_.find(tracing_ui);
-  DCHECK(it != tracing_uis_.end());
-  tracing_uis_.erase(it);
+void TracingControllerImpl::OnTracingDisabled() {}
+
+void TracingControllerImpl::OnTracingFailed() {
+  CompleteFlush();
 }
 
 void TracingControllerImpl::OnDataAvailable(const void* data,
@@ -591,43 +610,24 @@ void TracingControllerImpl::OnDataAvailable(const void* data,
 }
 
 void TracingControllerImpl::CompleteFlush() {
-  if (trace_data_endpoint_) {
-    trace_data_endpoint_->ReceiveTraceFinalContents(
-        std::move(filtered_metadata_));
-  }
-  filtered_metadata_.reset(nullptr);
+  if (trace_data_endpoint_)
+    trace_data_endpoint_->ReceivedTraceFinalContents();
+
   trace_data_endpoint_ = nullptr;
   trace_config_ = nullptr;
   drainer_ = nullptr;
+  tracing_session_host_.reset();
+  binding_.Close();
 }
 
 void TracingControllerImpl::OnDataComplete() {
   is_data_complete_ = true;
-  if (is_metadata_available_)
+  if (read_buffers_complete_)
     CompleteFlush();
 }
 
-void TracingControllerImpl::OnMetadataAvailable(base::Value metadata) {
-  DCHECK(!filtered_metadata_);
-  is_metadata_available_ = true;
-  base::trace_event::MetadataFilterPredicate metadata_filter;
-  if (trace_config_->IsArgumentFilterEnabled()) {
-    metadata_filter = base::trace_event::TraceLog::GetInstance()
-                          ->GetMetadataFilterPredicate();
-  }
-  if (metadata_filter.is_null()) {
-    filtered_metadata_ = base::DictionaryValue::From(
-        base::Value::ToUniquePtrValue(std::move(metadata)));
-  } else {
-    filtered_metadata_ = std::make_unique<base::DictionaryValue>();
-    for (auto it : metadata.DictItems()) {
-      if (metadata_filter.Run(it.first)) {
-        filtered_metadata_->SetKey(it.first, std::move(it.second));
-      } else {
-        filtered_metadata_->SetKey(it.first, base::Value("__stripped__"));
-      }
-    }
-  }
+void TracingControllerImpl::OnReadBuffersComplete() {
+  read_buffers_complete_ = true;
   if (is_data_complete_)
     CompleteFlush();
 }
diff --git a/chromium/content/browser/tracing/tracing_controller_impl.h b/chromium/content/browser/tracing/tracing_controller_impl.h
index ea92ca00a0e..9c00a9b43d6 100644
--- a/chromium/content/browser/tracing/tracing_controller_impl.h
+++ b/chromium/content/browser/tracing/tracing_controller_impl.h
@@ -15,8 +15,9 @@
 #include "base/timer/timer.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/tracing_controller.h"
+#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/system/data_pipe_drainer.h"
-#include "services/tracing/public/mojom/tracing.mojom.h"
+#include "services/tracing/public/mojom/perfetto_service.mojom.h"
 
 namespace base {
 
@@ -25,7 +26,6 @@ class TraceConfig;
 }  // namespace trace_event
 
 class DictionaryValue;
-class RefCountedString;
 }  // namespace base
 
 namespace tracing {
@@ -36,15 +36,14 @@ namespace content {
 
 class PerfettoFileTracer;
 class TracingDelegate;
-class TracingUI;
 
 class TracingControllerImpl : public TracingController,
-                              public mojo::DataPipeDrainer::Client {
+                              public mojo::DataPipeDrainer::Client,
+                              public tracing::mojom::TracingSessionClient {
  public:
   // Create an endpoint for dumping the trace data to a callback.
   CONTENT_EXPORT static scoped_refptr<TraceDataEndpoint> CreateCallbackEndpoint(
-      const base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                                base::RefCountedString*)>& callback);
+      CompletionCallback callback);
 
   CONTENT_EXPORT static scoped_refptr<TraceDataEndpoint>
   CreateCompressedStringEndpoint(scoped_refptr<TraceDataEndpoint> endpoint,
@@ -61,12 +60,16 @@ class TracingControllerImpl : public TracingController,
                     StartTracingDoneCallback callback) override;
   bool StopTracing(const scoped_refptr<TraceDataEndpoint>& endpoint) override;
   bool StopTracing(const scoped_refptr<TraceDataEndpoint>& endpoint,
-                   const std::string& agent_label) override;
+                   const std::string& agent_label,
+                   bool privacy_filtering_enabled = false) override;
   bool GetTraceBufferUsage(GetTraceBufferUsageCallback callback) override;
   bool IsTracing() override;
 
-  void RegisterTracingUI(TracingUI* tracing_ui);
-  void UnregisterTracingUI(TracingUI* tracing_ui);
+  // tracing::mojom::TracingSessionClient implementation:
+  void OnTracingEnabled() override;
+  void OnTracingDisabled() override;
+
+  void OnTracingFailed();
 
   // For unittests.
   CONTENT_EXPORT void SetTracingDelegateForTesting(
@@ -94,14 +97,13 @@ class TracingControllerImpl : public TracingController,
   ~TracingControllerImpl() override;
   void AddAgents();
   void ConnectToServiceIfNeeded();
-  void DisconnectFromService();
   std::unique_ptr<base::DictionaryValue> GenerateMetadataDict();
 
   // mojo::DataPipeDrainer::Client
   void OnDataAvailable(const void* data, size_t num_bytes) override;
   void OnDataComplete() override;
 
-  void OnMetadataAvailable(base::Value metadata);
+  void OnReadBuffersComplete();
 
   void CompleteFlush();
 
@@ -113,16 +115,18 @@ class TracingControllerImpl : public TracingController,
   base::FilePath GetStartupTraceFileName() const;
 
   std::unique_ptr<PerfettoFileTracer> perfetto_file_tracer_;
-  tracing::mojom::CoordinatorPtr coordinator_;
+  tracing::mojom::ConsumerHostPtr consumer_host_;
+  tracing::mojom::TracingSessionHostPtr tracing_session_host_;
+  mojo::Binding<tracing::mojom::TracingSessionClient> binding_{this};
+  StartTracingDoneCallback start_tracing_callback_;
+
   std::vector<std::unique_ptr<tracing::BaseAgent>> agents_;
   std::unique_ptr<TracingDelegate> delegate_;
   std::unique_ptr<base::trace_event::TraceConfig> trace_config_;
   std::unique_ptr<mojo::DataPipeDrainer> drainer_;
   scoped_refptr<TraceDataEndpoint> trace_data_endpoint_;
-  std::unique_ptr<base::DictionaryValue> filtered_metadata_;
-  std::set<TracingUI*> tracing_uis_;
   bool is_data_complete_ = false;
-  bool is_metadata_available_ = false;
+  bool read_buffers_complete_ = false;
 
   base::FilePath startup_trace_file_;
   // This timer initiates trace file saving.
diff --git a/chromium/content/browser/tracing/tracing_controller_impl_data_endpoint.cc b/chromium/content/browser/tracing/tracing_controller_impl_data_endpoint.cc
index 3270233f5ad..27a735246a6 100644
--- a/chromium/content/browser/tracing/tracing_controller_impl_data_endpoint.cc
+++ b/chromium/content/browser/tracing/tracing_controller_impl_data_endpoint.cc
@@ -24,24 +24,18 @@ namespace {
 
 class StringTraceDataEndpoint : public TracingController::TraceDataEndpoint {
  public:
-  typedef base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                              base::RefCountedString*)>
-      CompletionCallback;
+  explicit StringTraceDataEndpoint(
+      TracingController::CompletionCallback callback)
+      : completion_callback_(std::move(callback)) {}
 
-  explicit StringTraceDataEndpoint(CompletionCallback callback)
-      : completion_callback_(callback) {}
-
-  void ReceiveTraceFinalContents(
-      std::unique_ptr<const base::DictionaryValue> metadata) override {
-    std::string tmp = trace_.str();
+  void ReceivedTraceFinalContents() override {
+    auto str = std::make_unique<std::string>(trace_.str());
     trace_.str("");
     trace_.clear();
-    scoped_refptr<base::RefCountedString> str =
-        base::RefCountedString::TakeString(&tmp);
 
-    base::PostTask(FROM_HERE, {BrowserThread::UI},
-                   base::BindOnce(completion_callback_, std::move(metadata),
-                                  base::RetainedRef(str)));
+    base::PostTask(
+        FROM_HERE, {BrowserThread::UI},
+        base::BindOnce(std::move(completion_callback_), std::move(str)));
   }
 
   void ReceiveTraceChunk(std::unique_ptr<std::string> chunk) override {
@@ -51,7 +45,7 @@ class StringTraceDataEndpoint : public TracingController::TraceDataEndpoint {
  private:
   ~StringTraceDataEndpoint() override {}
 
-  CompletionCallback completion_callback_;
+  TracingController::CompletionCallback completion_callback_;
   std::ostringstream trace_;
 
   DISALLOW_COPY_AND_ASSIGN(StringTraceDataEndpoint);
@@ -60,10 +54,10 @@ class StringTraceDataEndpoint : public TracingController::TraceDataEndpoint {
 class FileTraceDataEndpoint : public TracingController::TraceDataEndpoint {
  public:
   explicit FileTraceDataEndpoint(const base::FilePath& trace_file_path,
-                                 const base::Closure& callback,
+                                 base::OnceClosure callback,
                                  base::TaskPriority write_priority)
       : file_path_(trace_file_path),
-        completion_callback_(callback),
+        completion_callback_(std::move(callback)),
         may_block_task_runner_(base::CreateSequencedTaskRunner(
             {base::ThreadPool(), base::MayBlock(), write_priority})) {}
 
@@ -75,8 +69,7 @@ class FileTraceDataEndpoint : public TracingController::TraceDataEndpoint {
             std::move(chunk)));
   }
 
-  void ReceiveTraceFinalContents(
-      std::unique_ptr<const base::DictionaryValue>) override {
+  void ReceivedTraceFinalContents() override {
     may_block_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce(&FileTraceDataEndpoint::CloseOnBlockingThread, this));
@@ -115,10 +108,10 @@ class FileTraceDataEndpoint : public TracingController::TraceDataEndpoint {
         base::BindOnce(&FileTraceDataEndpoint::FinalizeOnUIThread, this));
   }
 
-  void FinalizeOnUIThread() { completion_callback_.Run(); }
+  void FinalizeOnUIThread() { std::move(completion_callback_).Run(); }
 
   base::FilePath file_path_;
-  base::Closure completion_callback_;
+  base::OnceClosure completion_callback_;
   FILE* file_ = nullptr;
   const scoped_refptr<base::SequencedTaskRunner> may_block_task_runner_;
 
@@ -144,16 +137,15 @@ class CompressedTraceDataEndpoint
                        this, std::move(chunk)));
   }
 
-  void ReceiveTraceFinalContents(
-      std::unique_ptr<const base::DictionaryValue> metadata) override {
+  void ReceivedTraceFinalContents() override {
     background_task_runner_->PostTask(
         FROM_HERE,
         base::BindOnce(&CompressedTraceDataEndpoint::CloseOnBackgroundThread,
-                       this, std::move(metadata)));
+                       this));
   }
 
  private:
-  ~CompressedTraceDataEndpoint() override {}
+  ~CompressedTraceDataEndpoint() override = default;
 
   bool OpenZStreamOnBackgroundThread() {
     if (stream_)
@@ -208,8 +200,7 @@ class CompressedTraceDataEndpoint
     } while (stream_->avail_out == 0);
   }
 
-  void CloseOnBackgroundThread(
-      std::unique_ptr<const base::DictionaryValue> metadata) {
+  void CloseOnBackgroundThread() {
     if (!OpenZStreamOnBackgroundThread())
       return;
 
@@ -217,7 +208,7 @@ class CompressedTraceDataEndpoint
     deflateEnd(stream_.get());
     stream_.reset();
 
-    endpoint_->ReceiveTraceFinalContents(std::move(metadata));
+    endpoint_->ReceivedTraceFinalContents();
   }
 
   scoped_refptr<TraceDataEndpoint> endpoint_;
@@ -231,17 +222,16 @@ class CompressedTraceDataEndpoint
 }  // namespace
 
 scoped_refptr<TracingController::TraceDataEndpoint>
-TracingController::CreateStringEndpoint(
-    const base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                              base::RefCountedString*)>& callback) {
-  return new StringTraceDataEndpoint(callback);
+TracingController::CreateStringEndpoint(CompletionCallback callback) {
+  return new StringTraceDataEndpoint(std::move(callback));
 }
 
 scoped_refptr<TracingController::TraceDataEndpoint>
 TracingController::CreateFileEndpoint(const base::FilePath& file_path,
-                                      const base::Closure& callback,
+                                      base::OnceClosure callback,
                                       base::TaskPriority write_priority) {
-  return new FileTraceDataEndpoint(file_path, callback, write_priority);
+  return new FileTraceDataEndpoint(file_path, std::move(callback),
+                                   write_priority);
 }
 
 scoped_refptr<TracingController::TraceDataEndpoint>
@@ -253,10 +243,8 @@ TracingControllerImpl::CreateCompressedStringEndpoint(
 }
 
 scoped_refptr<TracingController::TraceDataEndpoint>
-TracingControllerImpl::CreateCallbackEndpoint(
-    const base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                              base::RefCountedString*)>& callback) {
-  return new StringTraceDataEndpoint(callback);
+TracingControllerImpl::CreateCallbackEndpoint(CompletionCallback callback) {
+  return new StringTraceDataEndpoint(std::move(callback));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/tracing/tracing_ui.cc b/chromium/content/browser/tracing/tracing_ui.cc
index 7b26dd06351..39806147437 100644
--- a/chromium/content/browser/tracing/tracing_ui.cc
+++ b/chromium/content/browser/tracing/tracing_ui.cc
@@ -9,6 +9,7 @@
 #include <memory>
 #include <set>
 #include <string>
+#include <utility>
 #include <vector>
 
 #include "base/base64.h"
@@ -31,7 +32,6 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/storage_partition.h"
-#include "content/public/browser/trace_uploader.h"
 #include "content/public/browser/tracing_controller.h"
 #include "content/public/browser/tracing_delegate.h"
 #include "content/public/browser/web_contents.h"
@@ -96,10 +96,9 @@ void OnTraceBufferStatusResult(const WebUIDataSource::GotDataCallback& callback,
 
 void TracingCallbackWrapperBase64(
     const WebUIDataSource::GotDataCallback& callback,
-    std::unique_ptr<const base::DictionaryValue> metadata,
-    base::RefCountedString* data) {
+    std::unique_ptr<std::string> data) {
   base::RefCountedString* data_base64 = new base::RefCountedString();
-  base::Base64Encode(data->data(), &data_base64->data());
+  base::Base64Encode(*data, &data_base64->data());
   callback.Run(data_base64);
 }
 
@@ -164,13 +163,6 @@ void OnTracingRequest(const std::string& path,
 TracingUI::TracingUI(WebUI* web_ui)
     : WebUIController(web_ui),
       delegate_(GetContentClient()->browser()->GetTracingDelegate()) {
-  web_ui->RegisterMessageCallback(
-      "doUpload",
-      base::BindRepeating(&TracingUI::DoUpload, base::Unretained(this)));
-  web_ui->RegisterMessageCallback(
-      "doUploadBase64", base::BindRepeating(&TracingUI::DoUploadBase64Encoded,
-                                            base::Unretained(this)));
-
   // Set up the chrome://tracing/ source.
   BrowserContext* browser_context =
       web_ui->GetWebContents()->GetBrowserContext();
@@ -182,70 +174,9 @@ TracingUI::TracingUI(WebUI* web_ui)
   source->SetRequestFilter(base::BindRepeating(OnShouldHandleRequest),
                            base::BindRepeating(OnTracingRequest));
   WebUIDataSource::Add(browser_context, source);
-  TracingControllerImpl::GetInstance()->RegisterTracingUI(this);
-}
-
-TracingUI::~TracingUI() {
-  TracingControllerImpl::GetInstance()->UnregisterTracingUI(this);
-}
-
-void TracingUI::DoUploadBase64Encoded(const base::ListValue* args) {
-  std::string file_contents_base64;
-  if (!args || args->empty() || !args->GetString(0, &file_contents_base64)) {
-    web_ui()->CallJavascriptFunctionUnsafe("onUploadError",
-                                           base::Value("Missing data"));
-    return;
-  }
-
-  std::string file_contents;
-  base::Base64Decode(file_contents_base64, &file_contents);
-
-  // doUploadBase64 is used to upload binary data which is assumed to already
-  // be compressed.
-  DoUploadInternal(file_contents, TraceUploader::UNCOMPRESSED_UPLOAD);
-}
-
-void TracingUI::DoUpload(const base::ListValue* args) {
-  std::string file_contents;
-  if (!args || args->empty() || !args->GetString(0, &file_contents)) {
-    web_ui()->CallJavascriptFunctionUnsafe("onUploadError",
-                                           base::Value("Missing data"));
-    return;
-  }
-
-  DoUploadInternal(file_contents, TraceUploader::COMPRESSED_UPLOAD);
 }
 
-void TracingUI::DoUploadInternal(const std::string& file_contents,
-                                 TraceUploader::UploadMode upload_mode) {
-  if (!delegate_) {
-    web_ui()->CallJavascriptFunctionUnsafe("onUploadError",
-                                           base::Value("Not implemented"));
-    return;
-  }
-
-  if (trace_uploader_) {
-    web_ui()->CallJavascriptFunctionUnsafe("onUploadError",
-                                           base::Value("Upload in progress"));
-    return;
-  }
-
-  TraceUploader::UploadProgressCallback progress_callback =
-      base::Bind(&TracingUI::OnTraceUploadProgress,
-      weak_factory_.GetWeakPtr());
-  TraceUploader::UploadDoneCallback done_callback = base::BindOnce(
-      &TracingUI::OnTraceUploadComplete, weak_factory_.GetWeakPtr());
-
-  trace_uploader_ = delegate_->GetTraceUploader(
-      BrowserContext::GetDefaultStoragePartition(
-          web_ui()->GetWebContents()->GetBrowserContext())
-          ->GetURLLoaderFactoryForBrowserProcess());
-  DCHECK(trace_uploader_);
-  trace_uploader_->DoUpload(file_contents, upload_mode, nullptr,
-                            std::move(progress_callback),
-                            std::move(done_callback));
-  // TODO(mmandlis): Add support for stopping the upload in progress.
-}
+TracingUI::~TracingUI() = default;
 
 // static
 bool TracingUI::GetTracingOptions(
@@ -302,25 +233,4 @@ bool TracingUI::GetTracingOptions(
   return true;
 }
 
-void TracingUI::OnTraceUploadProgress(int64_t current, int64_t total) {
-  DCHECK(current <= total);
-  int percent = (current / total) * 100;
-  web_ui()->CallJavascriptFunctionUnsafe(
-      "onUploadProgress", base::Value(percent),
-      base::Value(base::StringPrintf("%" PRId64, current)),
-      base::Value(base::StringPrintf("%" PRId64, total)));
-}
-
-void TracingUI::OnTraceUploadComplete(bool success,
-                                      const std::string& feedback) {
-  if (success) {
-    web_ui()->CallJavascriptFunctionUnsafe("onUploadComplete",
-                                           base::Value(feedback));
-  } else {
-    web_ui()->CallJavascriptFunctionUnsafe("onUploadError",
-                                           base::Value(feedback));
-  }
-  trace_uploader_.reset();
-}
-
 }  // namespace content
diff --git a/chromium/content/browser/tracing/tracing_ui.h b/chromium/content/browser/tracing/tracing_ui.h
index 6f0d9c8f4ff..2bb89e71269 100644
--- a/chromium/content/browser/tracing/tracing_ui.h
+++ b/chromium/content/browser/tracing/tracing_ui.h
@@ -12,7 +12,6 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "content/public/browser/trace_uploader.h"
 #include "content/public/browser/web_ui_controller.h"
 
 namespace base {
@@ -35,17 +34,9 @@ class CONTENT_EXPORT TracingUI : public WebUIController {
   static bool GetTracingOptions(const std::string& data64,
                                 base::trace_event::TraceConfig* trace_config);
 
-  void OnTraceUploadProgress(int64_t current, int64_t total);
-  void OnTraceUploadComplete(bool success, const std::string& feedback);
 
  private:
-  void DoUploadInternal(const std::string& file_contents,
-                        TraceUploader::UploadMode upload_mode);
-  void DoUpload(const base::ListValue* args);
-  void DoUploadBase64Encoded(const base::ListValue* args);
-
   std::unique_ptr<TracingDelegate> delegate_;
-  std::unique_ptr<TraceUploader> trace_uploader_;
   base::WeakPtrFactory<TracingUI> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(TracingUI);
diff --git a/chromium/content/browser/url_loader_factory_getter.cc b/chromium/content/browser/url_loader_factory_getter.cc
index 377ac680b60..0d8f01f0868 100644
--- a/chromium/content/browser/url_loader_factory_getter.cc
+++ b/chromium/content/browser/url_loader_factory_getter.cc
@@ -12,6 +12,7 @@
 #include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/lazy_instance.h"
+#include "base/run_loop.h"
 #include "base/task/post_task.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/common/service_worker/service_worker_utils.h"
@@ -87,11 +88,12 @@ class URLLoaderFactoryGetter::URLLoaderFactoryForIOThread
                                traffic_annotation);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     if (!factory_getter_)
       return;
     factory_getter_->GetURLLoaderFactory(is_corb_enabled_)
-        ->Clone(std::move(request));
+        ->Clone(std::move(receiver));
   }
 
   // SharedURLLoaderFactory implementation:
@@ -133,11 +135,11 @@ void URLLoaderFactoryGetter::Initialize(StoragePartitionImpl* partition) {
   // TODO(mmenke):  Is one less thread hop on startup worth the extra complexity
   // of two different pipe creation paths?
   network::mojom::URLLoaderFactoryPtr network_factory;
-  network::mojom::URLLoaderFactoryRequest pending_network_factory_request =
-      MakeRequest(&network_factory);
+  mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+      pending_network_factory_receiver = MakeRequest(&network_factory);
 
   HandleNetworkFactoryRequestOnUIThread(
-      std::move(pending_network_factory_request), false);
+      std::move(pending_network_factory_receiver), false);
 
   base::PostTask(FROM_HERE, {BrowserThread::IO},
                  base::BindOnce(&URLLoaderFactoryGetter::InitializeOnIOThread,
@@ -202,9 +204,10 @@ network::mojom::URLLoaderFactory* URLLoaderFactoryGetter::GetURLLoaderFactory(
 }
 
 void URLLoaderFactoryGetter::CloneNetworkFactory(
-    network::mojom::URLLoaderFactoryRequest network_factory_request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+        network_factory_receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::IO);
-  GetURLLoaderFactory(false)->Clone(std::move(network_factory_request));
+  GetURLLoaderFactory(false)->Clone(std::move(network_factory_receiver));
 }
 
 void URLLoaderFactoryGetter::SetNetworkFactoryForTesting(
@@ -276,7 +279,8 @@ void URLLoaderFactoryGetter::ReinitializeOnIOThread(
 }
 
 void URLLoaderFactoryGetter::HandleNetworkFactoryRequestOnUIThread(
-    network::mojom::URLLoaderFactoryRequest network_factory_request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+        network_factory_receiver,
     bool is_corb_enabled) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   // |StoragePartitionImpl| may have went away while |URLLoaderFactoryGetter| is
@@ -293,7 +297,7 @@ void URLLoaderFactoryGetter::HandleNetworkFactoryRequestOnUIThread(
       base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kDisableWebSecurity);
   partition_->GetNetworkContext()->CreateURLLoaderFactory(
-      std::move(network_factory_request), std::move(params));
+      std::move(network_factory_receiver), std::move(params));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/url_loader_factory_getter.h b/chromium/content/browser/url_loader_factory_getter.h
index 95758133e54..fcf2e707559 100644
--- a/chromium/content/browser/url_loader_factory_getter.h
+++ b/chromium/content/browser/url_loader_factory_getter.h
@@ -12,6 +12,7 @@
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace network {
@@ -75,7 +76,8 @@ class URLLoaderFactoryGetter
   // When NetworkService is disabled, this clones the non-NetworkService direct
   // network factory.
   CONTENT_EXPORT void CloneNetworkFactory(
-      network::mojom::URLLoaderFactoryRequest network_factory_request);
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+          network_factory_receiver);
 
   // Overrides the network URLLoaderFactory for subsequent requests. Passing a
   // null pointer will restore the default behavior.
@@ -98,7 +100,7 @@ class URLLoaderFactoryGetter
   // called either on the IO thread or before threads start. This callback is
   // run on the IO thread.
   using GetNetworkFactoryCallback = base::RepeatingCallback<void(
-      URLLoaderFactoryGetter* url_loader_factory_getter)>;
+      scoped_refptr<URLLoaderFactoryGetter> url_loader_factory_getter)>;
   CONTENT_EXPORT static void SetGetNetworkFactoryCallbackForTesting(
       const GetNetworkFactoryCallback& get_network_factory_callback);
 
@@ -125,7 +127,8 @@ class URLLoaderFactoryGetter
 
   // Send |network_factory_request| to cached |StoragePartitionImpl|.
   void HandleNetworkFactoryRequestOnUIThread(
-      network::mojom::URLLoaderFactoryRequest network_factory_request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+          network_factory_receiver,
       bool is_corb_enabled);
 
   // Called on the IO thread to get the URLLoaderFactory to the network service.
diff --git a/chromium/content/browser/utility_process_host.cc b/chromium/content/browser/utility_process_host.cc
index c5fc2e543af..7d2af8aa57f 100644
--- a/chromium/content/browser/utility_process_host.cc
+++ b/chromium/content/browser/utility_process_host.cc
@@ -26,6 +26,7 @@
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
@@ -392,9 +393,9 @@ bool UtilityProcessHost::StartProcess() {
       network::switches::kIgnoreUrlFetcherCertRequests,
       network::switches::kLogNetLog,
       network::switches::kNetLogCaptureMode,
-      network::switches::kNoReferrers,
       network::switches::kExplicitlyAllowedPorts,
       service_manager::switches::kNoSandbox,
+      service_manager::switches::kEnableAudioServiceSandbox,
 #if defined(OS_MACOSX)
       service_manager::switches::kEnableSandboxLogging,
       os_crypt::switches::kUseMockKeychain,
@@ -427,6 +428,7 @@ bool UtilityProcessHost::StartProcess() {
       switches::kAudioServiceQuitTimeoutMs,
       switches::kDisableAudioOutput,
       switches::kFailAudioStreamCreation,
+      switches::kForceDisableWebRtcApmInAudioService,
       switches::kMuteAudio,
       switches::kUseFileForFakeAudioCapture,
       switches::kAgcStartupMinVolume,
@@ -513,6 +515,12 @@ void UtilityProcessHost::OnProcessCrashed(int exit_code) {
   client->OnProcessCrashed();
 }
 
+base::Optional<std::string> UtilityProcessHost::GetServiceName() {
+  if (!service_identity_)
+    return metrics_name_;
+  return service_identity_->name();
+}
+
 void UtilityProcessHost::BindHostReceiver(
     mojo::GenericPendingReceiver receiver) {
 #if defined(OS_LINUX)
diff --git a/chromium/content/browser/utility_process_host.h b/chromium/content/browser/utility_process_host.h
index 5136379af6f..7ce622a2666 100644
--- a/chromium/content/browser/utility_process_host.h
+++ b/chromium/content/browser/utility_process_host.h
@@ -135,6 +135,7 @@ class CONTENT_EXPORT UtilityProcessHost
   void OnProcessLaunched() override;
   void OnProcessLaunchFailed(int error_code) override;
   void OnProcessCrashed(int exit_code) override;
+  base::Optional<std::string> GetServiceName() override;
   void BindHostReceiver(mojo::GenericPendingReceiver receiver) override;
 
   // Launch the child process with switches that will setup this sandbox type.
diff --git a/chromium/content/browser/utility_process_host_browsertest.cc b/chromium/content/browser/utility_process_host_browsertest.cc
index dd5c86716b1..cc80c53d946 100644
--- a/chromium/content/browser/utility_process_host_browsertest.cc
+++ b/chromium/content/browser/utility_process_host_browsertest.cc
@@ -17,6 +17,7 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_service.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 #if defined(OS_MACOSX) || defined(OS_LINUX)
 #include <sys/wait.h>
@@ -73,7 +74,7 @@ class UtilityProcessHostBrowserTest : public BrowserChildProcessObserver,
 #endif
     EXPECT_TRUE(host->Start());
 
-    BindInterface(host, &service_);
+    BindInterface(host, service_.BindNewPipeAndPassReceiver());
     if (crash) {
       service_->DoCrashImmediately(
           base::BindOnce(&UtilityProcessHostBrowserTest::OnSomethingOnIOThread,
@@ -98,7 +99,7 @@ class UtilityProcessHostBrowserTest : public BrowserChildProcessObserver,
     base::PostTask(FROM_HERE, {BrowserThread::UI}, std::move(done_closure_));
   }
 
-  mojom::TestServicePtr service_;
+  mojo::Remote<mojom::TestService> service_;
   base::OnceClosure done_closure_;
 
   // Access on UI thread.
diff --git a/chromium/content/browser/vibration_browsertest.cc b/chromium/content/browser/vibration_browsertest.cc
index df3bba70ad4..4fc38b94ded 100644
--- a/chromium/content/browser/vibration_browsertest.cc
+++ b/chromium/content/browser/vibration_browsertest.cc
@@ -14,7 +14,7 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/shell/browser/shell.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/device/public/mojom/constants.mojom.h"
 #include "services/device/public/mojom/vibration_manager.mojom.h"
 #include "services/service_manager/public/cpp/service_binding.h"
@@ -26,7 +26,7 @@ namespace {
 class VibrationTest : public ContentBrowserTest,
                       public device::mojom::VibrationManager {
  public:
-  VibrationTest() : binding_(this) {
+  VibrationTest() {
     // Because Device Service also runs in this process(browser process), here
     // we can directly set our binder to intercept interface requests against
     // it.
@@ -41,8 +41,9 @@ class VibrationTest : public ContentBrowserTest,
         device::mojom::VibrationManager>(device::mojom::kServiceName);
   }
 
-  void BindVibrationManager(device::mojom::VibrationManagerRequest request) {
-    binding_.Bind(std::move(request));
+  void BindVibrationManager(
+      mojo::PendingReceiver<device::mojom::VibrationManager> receiver) {
+    receiver_.Bind(std::move(receiver));
   }
 
  protected:
@@ -70,7 +71,7 @@ class VibrationTest : public ContentBrowserTest,
 
   int64_t vibrate_milliseconds_ = -1;
   base::Closure vibrate_done_;
-  mojo::Binding<device::mojom::VibrationManager> binding_;
+  mojo::Receiver<device::mojom::VibrationManager> receiver_{this};
 
   DISALLOW_COPY_AND_ASSIGN(VibrationTest);
 };
diff --git a/chromium/content/browser/web_contents/javascript_dialog_navigation_deferrer.cc b/chromium/content/browser/web_contents/javascript_dialog_navigation_deferrer.cc
index edfb2c7e0b4..f7abf8a4c17 100644
--- a/chromium/content/browser/web_contents/javascript_dialog_navigation_deferrer.cc
+++ b/chromium/content/browser/web_contents/javascript_dialog_navigation_deferrer.cc
@@ -4,7 +4,6 @@
 
 #include "content/browser/web_contents/javascript_dialog_navigation_deferrer.h"
 
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 
 namespace content {
diff --git a/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc b/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc
index 9ef6e2ba389..80b5e49e676 100644
--- a/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc
+++ b/chromium/content/browser/web_contents/opened_by_dom_browsertest.cc
@@ -92,8 +92,8 @@ IN_PROC_BROWSER_TEST_F(OpenedByDOMTest, NormalWindow) {
   // list has only one element. Navigate a bit so the second condition is false.
   GURL url1 = embedded_test_server()->GetURL("/site_isolation/blank.html?1");
   GURL url2 = embedded_test_server()->GetURL("/site_isolation/blank.html?2");
-  NavigateToURL(shell(), url1);
-  NavigateToURL(shell(), url2);
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+  EXPECT_TRUE(NavigateToURL(shell(), url2));
 
   // This window was not opened by DOM, so close does not reach the browser
   // process.
@@ -108,10 +108,10 @@ IN_PROC_BROWSER_TEST_F(OpenedByDOMTest, Popup) {
   GURL url1 = embedded_test_server()->GetURL("/site_isolation/blank.html?1");
   GURL url2 = embedded_test_server()->GetURL("/site_isolation/blank.html?2");
   GURL url3 = embedded_test_server()->GetURL("/site_isolation/blank.html?3");
-  NavigateToURL(shell(), url1);
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
 
   Shell* popup = OpenWindowFromJavaScript(shell(), url2);
-  NavigateToURL(popup, url3);
+  EXPECT_TRUE(NavigateToURL(popup, url3));
   EXPECT_TRUE(AttemptCloseFromJavaScript(popup->web_contents()));
 }
 
@@ -130,10 +130,10 @@ IN_PROC_BROWSER_TEST_F(OpenedByDOMTest, CrossProcessPopup) {
   GURL url3 = embedded_test_server()->GetURL("/site_isolation/blank.html?3");
   url3 = url3.ReplaceComponents(replace_host);
 
-  NavigateToURL(shell(), url1);
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
 
   Shell* popup = OpenWindowFromJavaScript(shell(), url2);
-  NavigateToURL(popup, url3);
+  EXPECT_TRUE(NavigateToURL(popup, url3));
   EXPECT_TRUE(AttemptCloseFromJavaScript(popup->web_contents()));
 }
 
diff --git a/chromium/content/browser/web_contents/web_contents_android.cc b/chromium/content/browser/web_contents/web_contents_android.cc
index 391902a1001..00bd3ee07c2 100644
--- a/chromium/content/browser/web_contents/web_contents_android.cc
+++ b/chromium/content/browser/web_contents/web_contents_android.cc
@@ -654,11 +654,6 @@ void WebContentsAndroid::SetSpatialNavigationDisabled(
   web_contents_->SetSpatialNavigationDisabled(disabled);
 }
 
-void WebContentsAndroid::ReloadLoFiImages(JNIEnv* env,
-                                          const JavaParamRef<jobject>& obj) {
-  static_cast<WebContentsImpl*>(web_contents_)->ReloadLoFiImages();
-}
-
 int WebContentsAndroid::DownloadImage(
     JNIEnv* env,
     const base::android::JavaParamRef<jobject>& obj,
diff --git a/chromium/content/browser/web_contents/web_contents_android.h b/chromium/content/browser/web_contents/web_contents_android.h
index 2ba2d6b4a02..161cff0e5e4 100644
--- a/chromium/content/browser/web_contents/web_contents_android.h
+++ b/chromium/content/browser/web_contents/web_contents_android.h
@@ -185,9 +185,6 @@ class CONTENT_EXPORT WebContentsAndroid {
       const base::android::JavaParamRef<jobject>& obj,
       bool disabled);
 
-  void ReloadLoFiImages(JNIEnv* env,
-                        const base::android::JavaParamRef<jobject>& obj);
-
   int DownloadImage(JNIEnv* env,
                     const base::android::JavaParamRef<jobject>& obj,
                     const base::android::JavaParamRef<jstring>& url,
diff --git a/chromium/content/browser/web_contents/web_contents_impl.cc b/chromium/content/browser/web_contents/web_contents_impl.cc
index fbc1dc34838..aa2aeccdf7b 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl.cc
@@ -15,7 +15,6 @@
 #include "base/debug/dump_without_crashing.h"
 #include "base/feature_list.h"
 #include "base/files/file_path.h"
-#include "base/i18n/character_encoding.h"
 #include "base/lazy_instance.h"
 #include "base/location.h"
 #include "base/logging.h"
@@ -60,7 +59,6 @@
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/frame_host/navigation_entry_impl.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator_impl.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
@@ -99,6 +97,7 @@
 #include "content/common/render_message_filter.mojom.h"
 #include "content/common/view_messages.h"
 #include "content/common/widget_messages.h"
+#include "content/public/browser/accessibility_tree_formatter.h"
 #include "content/public/browser/ax_event_notification_details.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_plugin_guest_manager.h"
@@ -128,14 +127,15 @@
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/child_process_host.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/page_state.h"
-#include "content/public/common/page_zoom.h"
 #include "content/public/common/referrer_type_converters.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/url_utils.h"
+#include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/common/web_preferences.h"
 #include "media/base/user_input_monitor.h"
 #include "net/base/url_util.h"
@@ -153,9 +153,11 @@
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
+#include "third_party/blink/public/common/page/page_zoom.h"
+#include "third_party/blink/public/common/security/security_style.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom-shared.h"
-#include "third_party/blink/public/platform/web_security_style.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/accessibility/ax_tree_combiner.h"
 #include "ui/base/layout.h"
@@ -176,7 +178,6 @@
 #include "services/device/public/mojom/nfc.mojom.h"
 #else  // !OS_ANDROID
 #include "content/browser/host_zoom_map_impl.h"
-#include "content/browser/host_zoom_map_observer.h"
 #endif  // OS_ANDROID
 
 #if BUILDFLAG(ENABLE_PLUGINS)
@@ -301,11 +302,21 @@ bool AreValidRegisterProtocolHandlerArguments(const std::string& protocol,
   return true;
 }
 
+void RecordMaxFrameCountUMA(size_t max_frame_count) {
+  UMA_HISTOGRAM_COUNTS_10000("Navigation.MainFrame.MaxFrameCount",
+                             max_frame_count);
+}
+
 }  // namespace
 
 std::unique_ptr<WebContents> WebContents::Create(
     const WebContents::CreateParams& params) {
-  return WebContentsImpl::CreateWithOpener(params, FindOpenerRFH(params));
+  return WebContentsImpl::Create(params);
+}
+
+std::unique_ptr<WebContentsImpl> WebContentsImpl::Create(
+    const CreateParams& params) {
+  return CreateWithOpener(params, FindOpenerRFH(params));
 }
 
 std::unique_ptr<WebContents> WebContents::CreateWithSessionStorage(
@@ -568,8 +579,10 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
       is_showing_before_unload_dialog_(false),
       last_active_time_(base::TimeTicks::Now()),
       closed_by_user_gesture_(false),
-      minimum_zoom_percent_(static_cast<int>(kMinimumZoomFactor * 100)),
-      maximum_zoom_percent_(static_cast<int>(kMaximumZoomFactor * 100)),
+      minimum_zoom_percent_(
+          static_cast<int>(blink::kMinimumPageZoomFactor * 100)),
+      maximum_zoom_percent_(
+          static_cast<int>(blink::kMaximumPageZoomFactor * 100)),
       zoom_scroll_remainder_(0),
       fullscreen_widget_process_id_(ChildProcessHost::kInvalidUniqueID),
       fullscreen_widget_routing_id_(MSG_ROUTING_NONE),
@@ -582,8 +595,6 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
       audio_stream_monitor_(this),
       media_web_contents_observer_(
           std::make_unique<MediaWebContentsObserver>(this)),
-      media_device_group_id_salt_base_(
-          BrowserContext::CreateRandomMediaDeviceIDSalt()),
 #if !defined(OS_ANDROID)
       page_scale_factor_is_one_(true),
 #endif  // !defined(OS_ANDROID)
@@ -599,10 +610,6 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
   pepper_playback_observer_.reset(new PepperPlaybackObserver(this));
 #endif
 
-#if !defined(OS_ANDROID)
-  host_zoom_map_observer_.reset(new HostZoomMapObserver(this));
-#endif  // !defined(OS_ANDROID)
-
 #if defined(OS_ANDROID)
   display_cutout_host_impl_ = std::make_unique<DisplayCutoutHostImpl>(this);
 #endif
@@ -612,7 +619,6 @@ WebContentsImpl::WebContentsImpl(BrowserContext* browser_context)
 
   ui::NativeTheme* native_theme = ui::NativeTheme::GetInstanceForWeb();
   native_theme_observer_.Add(native_theme);
-  in_high_contrast_ = native_theme->UsesHighContrastColors();
   using_dark_colors_ = native_theme->ShouldUseDarkColors();
   preferred_color_scheme_ = native_theme->GetPreferredColorScheme();
 }
@@ -683,7 +689,7 @@ WebContentsImpl::~WebContentsImpl() {
   // destroyed.
   RenderFrameHostManager* root = GetRenderManager();
 
-  GetController().back_forward_cache().Flush();
+  GetController().GetBackForwardCache().Flush();
   root->current_frame_host()->SetRenderFrameCreated(false);
   root->current_frame_host()->ResetNavigationRequests();
 
@@ -865,7 +871,6 @@ bool WebContentsImpl::OnMessageReceived(RenderViewHostImpl* render_view_host,
 
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(WebContentsImpl, message, render_view_host)
-    IPC_MESSAGE_HANDLER(ViewHostMsg_UpdateZoomLimits, OnUpdateZoomLimits)
     IPC_MESSAGE_HANDLER(ViewHostMsg_PageScaleFactorChanged,
                         OnPageScaleFactorChanged)
     IPC_MESSAGE_HANDLER(
@@ -898,10 +903,6 @@ bool WebContentsImpl::OnMessageReceived(RenderFrameHostImpl* render_frame_host,
   IPC_BEGIN_MESSAGE_MAP_WITH_PARAM(WebContentsImpl, message, render_frame_host)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DomOperationResponse,
                         OnDomOperationResponse)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DidChangeThemeColor,
-                        OnThemeColorChanged)
-    IPC_MESSAGE_HANDLER(FrameHostMsg_DidFinishDocumentLoad,
-                        OnDocumentLoadedInFrame)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidFinishLoad, OnDidFinishLoad)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DidLoadResourceFromMemoryCache,
                         OnDidLoadResourceFromMemoryCache)
@@ -1283,10 +1284,8 @@ void WebContentsImpl::SetUserAgentOverride(const std::string& override,
 
   renderer_preferences_.user_agent_override = override;
 
-  // Send the new override string to the renderer.
-  RenderViewHost* host = GetRenderViewHost();
-  if (host)
-    host->SyncRendererPrefs();
+  // Send the new override string to all renderers in the current page.
+  SyncRendererPrefs();
 
   // Reload the page if a load is currently in progress to avoid having
   // different parts of the page loaded using different user agents.
@@ -1336,10 +1335,6 @@ const PageImportanceSignals& WebContentsImpl::GetPageImportanceSignals() {
   return page_importance_signals_;
 }
 
-const std::string& WebContentsImpl::GetMediaDeviceGroupIDSaltBase() const {
-  return media_device_group_id_salt_base_;
-}
-
 #if defined(OS_ANDROID)
 
 void WebContentsImpl::SetDisplayCutoutSafeArea(gfx::Insets insets) {
@@ -1445,7 +1440,7 @@ uint64_t WebContentsImpl::GetUploadPosition() {
 }
 
 const std::string& WebContentsImpl::GetEncoding() {
-  return canonical_encoding_;
+  return GetMainFrame()->GetEncoding();
 }
 
 bool WebContentsImpl::WasDiscarded() {
@@ -1552,7 +1547,7 @@ void WebContentsImpl::SetAudioMuted(bool mute) {
     observer.DidUpdateAudioMutingState(mute);
 
   // Notification for UI updates in response to the changed muting state.
-  NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+  NotifyNavigationStateChanged(INVALIDATE_TYPE_AUDIO);
 }
 
 bool WebContentsImpl::IsCurrentlyAudible() {
@@ -1615,6 +1610,9 @@ bool WebContentsImpl::IsCrashed() {
 #if defined(OS_ANDROID)
     case base::TERMINATION_STATUS_OOM_PROTECTED:
 #endif
+#if defined(OS_WIN)
+    case base::TERMINATION_STATUS_INTEGRITY_FAILURE:
+#endif
       return true;
     case base::TERMINATION_STATUS_NORMAL_TERMINATION:
     case base::TERMINATION_STATUS_STILL_RUNNING:
@@ -1653,7 +1651,7 @@ bool WebContentsImpl::IsBeingDestroyed() {
 void WebContentsImpl::NotifyNavigationStateChanged(
     InvalidateTypes changed_flags) {
   // Notify the media observer of potential audibility changes.
-  if (changed_flags & INVALIDATE_TYPE_TAB) {
+  if (changed_flags & INVALIDATE_TYPE_AUDIO) {
     media_web_contents_observer_->MaybeUpdateAudibleState();
   }
 
@@ -1666,8 +1664,25 @@ void WebContentsImpl::NotifyNavigationStateChanged(
 
 void WebContentsImpl::NotifyVisibleViewportSizeChanged(
     const gfx::Size& visible_viewport_size) {
+  // This viewport size is in screen coordinates, but will be handed to blink
+  // which expects coordinates including the device scale factor when
+  // UseZoomForDSF is enabled.
+  // TODO(danakj): This scaling should be done in the renderer where emulation
+  // may override the device scale factor.
+  gfx::Size visible_viewport_size_for_blink = visible_viewport_size;
+  if (IsUseZoomForDSFEnabled()) {
+    ScreenInfo info;
+    GetMainFrame()->GetRenderWidgetHost()->GetScreenInfo(&info);
+
+    visible_viewport_size_for_blink =
+        gfx::ScaleToCeiledSize(visible_viewport_size, info.device_scale_factor);
+  }
+
+  // TODO(danakj): This should be part of VisualProperties and walk down the
+  // RenderWidget tree like other VisualProperties do, in order to set the
+  // value in each WebView holds a part of the local frame tree.
   SendPageMessage(new PageMsg_UpdatePageVisualProperties(
-      MSG_ROUTING_NONE, visible_viewport_size));
+      MSG_ROUTING_NONE, visible_viewport_size_for_blink));
 }
 
 RenderFrameHostImpl* WebContentsImpl::GetFocusedFrameFromFocusedDelegate() {
@@ -1695,7 +1710,7 @@ void WebContentsImpl::OnAudioStateChanged() {
       new PageMsg_AudioStateChanged(MSG_ROUTING_NONE, is_currently_audible_));
 
   // Notification for UI updates in response to the changed audio state.
-  NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+  NotifyNavigationStateChanged(INVALIDATE_TYPE_AUDIO);
 
   // Ensure that audio state changes propagate from innermost to outermost
   // WebContents.
@@ -1842,18 +1857,22 @@ bool WebContentsImpl::NeedToFireBeforeUnload() {
   if (GetRenderViewHost()->SuddenTerminationAllowed())
     return false;
 
-  // Check whether the main frame needs to run beforeunload or unload handlers.
-  if (GetMainFrame()->GetSuddenTerminationDisablerState(
-          blink::kBeforeUnloadHandler | blink::kUnloadHandler)) {
-    return true;
+  // Check whether any frame in the frame tree needs to run beforeunload or
+  // unload handlers.
+  for (FrameTreeNode* node : frame_tree_.Nodes()) {
+    RenderFrameHostImpl* rfh = node->current_frame_host();
+
+    // No need to run beforeunload/unload if the RenderFrame isn't live.
+    if (!rfh->IsRenderFrameLive())
+      continue;
+
+    if (rfh->GetSuddenTerminationDisablerState(blink::kBeforeUnloadHandler |
+                                               blink::kUnloadHandler)) {
+      return true;
+    }
   }
 
-  // Check whether any subframes need to run beforeunload handlers.
-  //
-  // TODO(alexmos): Also check whether subframes need to run unload handlers in
-  // addition to beforeunload.
-  return GetMainFrame()->ShouldDispatchBeforeUnload(
-      true /* check_subframes_only */);
+  return false;
 }
 
 void WebContentsImpl::DispatchBeforeUnload(bool auto_cancel) {
@@ -1945,7 +1964,7 @@ std::unique_ptr<WebContents> WebContentsImpl::DetachFromOuterWebContents() {
   view_.reset(CreateWebContentsView(
       this, GetContentClient()->browser()->GetWebContentsViewDelegate(this),
       &render_view_host_delegate_view_));
-  view_->CreateView(GetPreferredSize(), nullptr);
+  view_->CreateView(nullptr);
   std::unique_ptr<WebContents> web_contents =
       node_.DisconnectFromOuterWebContents();
   DCHECK_EQ(web_contents.get(), this);
@@ -2002,6 +2021,14 @@ void WebContentsImpl::NotifyPreferencesChanged() {
     render_view_host->OnWebkitPreferencesChanged();
 }
 
+void WebContentsImpl::SyncRendererPrefs() {
+  blink::mojom::RendererPreferences renderer_preferences =
+      GetRendererPrefs(GetBrowserContext());
+  RenderViewHostImpl::GetPlatformSpecificPrefs(&renderer_preferences);
+  SendPageMessage(
+      new PageMsg_SetRendererPrefs(MSG_ROUTING_NONE, renderer_preferences));
+}
+
 void WebContentsImpl::OnCookiesRead(const GURL& url,
                                     const GURL& first_party_url,
                                     const net::CookieList& cookie_list,
@@ -2040,7 +2067,6 @@ std::unique_ptr<WebContents> WebContentsImpl::Clone() {
   // We pass our own opener so that the cloned page can access it if it was set
   // before.
   CreateParams create_params(GetBrowserContext(), GetSiteInstance());
-  create_params.initial_size = GetContainerBounds().size();
   FrameTreeNode* opener = frame_tree_.root()->opener();
   RenderFrameHostImpl* opener_rfh = nullptr;
   if (opener)
@@ -2155,8 +2181,7 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
   CHECK(render_view_host_delegate_view_);
   CHECK(view_.get());
 
-  gfx::Size initial_size = params.initial_size;
-  view_->CreateView(initial_size, params.context);
+  view_->CreateView(params.context);
 
 #if BUILDFLAG(ENABLE_PLUGINS)
   plugin_content_origin_whitelist_.reset(
@@ -2206,6 +2231,14 @@ void WebContentsImpl::Init(const WebContents::CreateParams& params) {
   // happens after RenderFrameHostManager::Init.
   NotifySwappedFromRenderManager(
       nullptr, GetRenderManager()->current_frame_host(), true);
+
+  // For WebContents that are never shown, do critical initialization here which
+  // would normally only happen when the WebContents is shown.
+  if (params.is_never_visible) {
+    // This has just been created so there can only be one frame. Thus it is
+    // safe to initialize the root.
+    GetMainFrame()->Init();
+  }
 }
 
 void WebContentsImpl::OnWebContentsDestroyed(WebContentsImpl* web_contents) {
@@ -2354,24 +2387,53 @@ void WebContentsImpl::RenderWidgetLostFocus(
 
 void WebContentsImpl::RenderWidgetWasResized(
     RenderWidgetHostImpl* render_widget_host,
-    const ScreenInfo& screen_info,
     bool width_changed) {
   RenderFrameHostImpl* rfh = GetMainFrame();
   if (!rfh || render_widget_host != rfh->GetRenderWidgetHost())
     return;
 
-  SendPageMessage(new PageMsg_UpdateScreenInfo(MSG_ROUTING_NONE, screen_info));
-
   for (auto& observer : observers_)
     observer.MainFrameWasResized(width_changed);
 }
 
 KeyboardEventProcessingResult WebContentsImpl::PreHandleKeyboardEvent(
     const NativeWebKeyboardEvent& event) {
+  auto* outermost_contents = GetOutermostWebContents();
+  // TODO(wjmaclean): Generalize this to forward all key events to the outermost
+  // delegate's handler.
+  if (outermost_contents != this && IsFullscreenForCurrentTab() &&
+      event.windows_key_code == ui::VKEY_ESCAPE) {
+    // When an inner WebContents has focus and is fullscreen, redirect <esc>
+    // key events to the outermost WebContents so it can be handled by that
+    // WebContents' delegate.
+    if (outermost_contents->PreHandleKeyboardEvent(event) ==
+        KeyboardEventProcessingResult::HANDLED) {
+      return KeyboardEventProcessingResult::HANDLED;
+    }
+  }
   return delegate_ ? delegate_->PreHandleKeyboardEvent(this, event)
                    : KeyboardEventProcessingResult::NOT_HANDLED;
 }
 
+bool WebContentsImpl::HandleMouseEvent(const blink::WebMouseEvent& event) {
+  // Handle mouse button back/forward in the browser process after the render
+  // process is done with the event. This ensures all renderer-initiated history
+  // navigations can be treated consistently.
+  if (event.GetType() == blink::WebInputEvent::Type::kMouseUp) {
+    WebContentsImpl* outermost = GetOutermostWebContents();
+    if (event.button == blink::WebPointerProperties::Button::kBack &&
+        outermost->controller_.CanGoBack()) {
+      outermost->controller_.GoBack();
+      return true;
+    } else if (event.button == blink::WebPointerProperties::Button::kForward &&
+               outermost->controller_.CanGoForward()) {
+      outermost->controller_.GoForward();
+      return true;
+    }
+  }
+  return false;
+}
+
 bool WebContentsImpl::HandleKeyboardEvent(const NativeWebKeyboardEvent& event) {
   if (browser_plugin_embedder_ &&
       browser_plugin_embedder_->HandleKeyboardEvent(event)) {
@@ -2491,7 +2553,7 @@ RenderWidgetHostImpl* WebContentsImpl::GetRenderWidgetHostWithPageFocus() {
 
 void WebContentsImpl::EnterFullscreenMode(
     const GURL& origin,
-    const blink::WebFullscreenOptions& options) {
+    const blink::mojom::FullscreenOptions& options) {
   // This method is being called to enter renderer-initiated fullscreen mode.
   // Make sure any existing fullscreen widget is shut down first.
   RenderWidgetHostView* const widget_view = GetFullscreenRenderWidgetHostView();
@@ -2620,13 +2682,13 @@ bool WebContentsImpl::IsFullscreen() {
   return IsFullscreenForCurrentTab();
 }
 
-blink::WebDisplayMode WebContentsImpl::GetDisplayMode(
+blink::mojom::DisplayMode WebContentsImpl::GetDisplayMode(
     RenderWidgetHostImpl* render_widget_host) const {
   if (!RenderViewHostImpl::From(render_widget_host))
-    return blink::kWebDisplayModeBrowser;
+    return blink::mojom::DisplayMode::kBrowser;
 
   return delegate_ ? delegate_->GetDisplayMode(this)
-                   : blink::kWebDisplayModeBrowser;
+                   : blink::mojom::DisplayMode::kBrowser;
 }
 
 void WebContentsImpl::RequestToLockMouse(
@@ -2761,27 +2823,17 @@ void WebContentsImpl::OnRenderFrameProxyVisibilityChanged(
   }
 }
 
-void WebContentsImpl::CreateNewWindow(
+RenderFrameHostDelegate* WebContentsImpl::CreateNewWindow(
     RenderFrameHost* opener,
-    int32_t render_view_route_id,
-    int32_t main_frame_route_id,
-    int32_t main_frame_widget_route_id,
     const mojom::CreateNewWindowParams& params,
+    bool is_new_browsing_instance,
     bool has_user_gesture,
     SessionStorageNamespace* session_storage_namespace) {
-  // We should have zero valid routing ids, or three valid routing IDs.
-  DCHECK_EQ((render_view_route_id == MSG_ROUTING_NONE),
-            (main_frame_route_id == MSG_ROUTING_NONE));
-  DCHECK_EQ((render_view_route_id == MSG_ROUTING_NONE),
-            (main_frame_widget_route_id == MSG_ROUTING_NONE));
   DCHECK(opener);
 
   int render_process_id = opener->GetProcess()->GetID();
-  SiteInstance* source_site_instance = opener->GetSiteInstance();
 
-  // The route IDs passed into this function can be trusted not to already
-  // be in use; they were allocated by the RenderWidgetHelper by the caller.
-  DCHECK(!RenderFrameHostImpl::FromID(render_process_id, main_frame_route_id));
+  SiteInstance* source_site_instance = opener->GetSiteInstance();
 
   // We usually create the new window in the same BrowsingInstance (group of
   // script-related windows), by passing in the current SiteInstance.  However,
@@ -2789,11 +2841,6 @@ void WebContentsImpl::CreateNewWindow(
   // SiteInstance in its own BrowsingInstance.
   bool is_guest = BrowserPluginGuest::IsGuest(this);
 
-  // If the opener is to be suppressed, the new window can be in any process.
-  // Since routing ids are process specific, we must not have one passed in
-  // as argument here.
-  DCHECK(!params.opener_suppressed || render_view_route_id == MSG_ROUTING_NONE);
-
   scoped_refptr<SiteInstance> site_instance =
       params.opener_suppressed && !is_guest
           ? SiteInstance::CreateForURL(GetBrowserContext(), params.target_url)
@@ -2814,25 +2861,14 @@ void WebContentsImpl::CreateNewWindow(
       static_cast<SessionStorageNamespaceImpl*>(session_storage_namespace);
   CHECK(session_storage_namespace_impl->IsFromContext(dom_storage_context));
 
-  if (delegate_ &&
-      !delegate_->ShouldCreateWebContents(
-          this, opener, source_site_instance, render_view_route_id,
-          main_frame_route_id, main_frame_widget_route_id,
-          params.window_container_type, opener->GetLastCommittedURL(),
-          params.frame_name, params.target_url, partition_id,
-          session_storage_namespace)) {
-    // Note: even though we're not creating a WebContents here, it could have
-    // been created by the embedder so ensure that the RenderFrameHost is
-    // properly initialized.
-    // It's safe to only target the frame because the render process will not
-    // have a chance to create more frames at this point.
-    RenderFrameHostImpl* rfh =
-        RenderFrameHostImpl::FromID(render_process_id, main_frame_route_id);
-    if (rfh) {
-      DCHECK(rfh->IsRenderFrameLive());
-      rfh->Init();
-    }
-    return;
+  if (delegate_ && delegate_->IsWebContentsCreationOverridden(
+                       source_site_instance, params.window_container_type,
+                       opener->GetLastCommittedURL(), params.frame_name,
+                       params.target_url)) {
+    return static_cast<WebContentsImpl*>(delegate_->CreateCustomWebContents(
+        opener, source_site_instance, is_new_browsing_instance,
+        opener->GetLastCommittedURL(), params.frame_name, params.target_url,
+        partition_id, session_storage_namespace));
   }
 
   bool renderer_started_hidden =
@@ -2841,29 +2877,45 @@ void WebContentsImpl::CreateNewWindow(
   // Create the new web contents. This will automatically create the new
   // WebContentsView. In the future, we may want to create the view separately.
   CreateParams create_params(GetBrowserContext(), site_instance.get());
-  create_params.routing_id = render_view_route_id;
-  create_params.main_frame_routing_id = main_frame_route_id;
-  create_params.main_frame_widget_routing_id = main_frame_widget_route_id;
   create_params.main_frame_name = params.frame_name;
   create_params.opener_render_process_id = render_process_id;
   create_params.opener_render_frame_id = opener->GetRoutingID();
   create_params.opener_suppressed = params.opener_suppressed;
   create_params.initially_hidden = renderer_started_hidden;
-  create_params.renderer_initiated_creation =
-      main_frame_route_id != MSG_ROUTING_NONE;
 
-  std::unique_ptr<WebContents> new_contents;
+  // Even though all codepaths leading here are in response to a renderer
+  // tryng to open a new window, if the new window ends up in a different
+  // browsing instance, then the RenderViewHost, RenderWidgetHost,
+  // RenderFrameHost constellation is effectively browser initiated
+  // the opener's process will not given the routing IDs for the new
+  // objects.
+  create_params.renderer_initiated_creation = !is_new_browsing_instance;
+
+  // If |is_new_browsing_instance| is true, defer routing_id allocation
+  // to the WebContentsImpl::Create() call. This is required because with
+  // a new browsing instance, WebContentsImpl::Create() may elect a different
+  // SiteInstance from |site_instance| (which happens if |site_instance| is
+  // nullptr for example).
+  //
+  // TODO(ajwong): This routing id allocation should be pushed down further
+  // into WebContentsImpl::Create().
+  if (!is_new_browsing_instance) {
+    create_params.routing_id = opener->GetProcess()->GetNextRoutingID();
+    create_params.main_frame_routing_id =
+        opener->GetProcess()->GetNextRoutingID();
+    create_params.main_frame_widget_routing_id =
+        opener->GetProcess()->GetNextRoutingID();
+  }
+
+  std::unique_ptr<WebContentsImpl> new_contents;
   if (!is_guest) {
     create_params.context = view_->GetNativeView();
-    create_params.initial_size = GetContainerBounds().size();
-    new_contents = WebContents::Create(create_params);
-  }  else {
-    new_contents = base::WrapUnique(
-        GetBrowserPluginGuest()->CreateNewGuestWindow(create_params));
+    new_contents = WebContentsImpl::Create(create_params);
+  } else {
+    new_contents = base::WrapUnique(static_cast<WebContentsImpl*>(
+        GetBrowserPluginGuest()->CreateNewGuestWindow(create_params)));
   }
-  auto owning_contents_impl =
-      base::WrapUnique(static_cast<WebContentsImpl*>(new_contents.release()));
-  auto* new_contents_impl = owning_contents_impl.get();
+  auto* new_contents_impl = new_contents.get();
 
   new_contents_impl->GetController().SetSessionStorageNamespace(
       partition_id, session_storage_namespace);
@@ -2897,9 +2949,10 @@ void WebContentsImpl::CreateNewWindow(
     // TODO(ajwong): This should be keyed off the RenderFrame routing id or the
     // FrameTreeNode id instead of the routing id of the Widget for the main
     // frame.  https://crbug.com/545684
-    DCHECK_NE(MSG_ROUTING_NONE, main_frame_widget_route_id);
-    GlobalRoutingID id(render_process_id, main_frame_widget_route_id);
-    pending_contents_[id] = std::move(owning_contents_impl);
+    DCHECK_NE(MSG_ROUTING_NONE, create_params.main_frame_routing_id);
+    GlobalRoutingID id(render_process_id,
+                       create_params.main_frame_widget_routing_id);
+    pending_contents_[id] = std::move(new_contents);
     AddDestructionObserver(new_contents_impl);
   }
 
@@ -2931,12 +2984,12 @@ void WebContentsImpl::CreateNewWindow(
           new_contents_impl->weak_factory_.GetWeakPtr();
 
       gfx::Rect initial_rect;  // Report an empty initial rect.
-      delegate_->AddNewContents(this, std::move(owning_contents_impl),
+      delegate_->AddNewContents(this, std::move(new_contents),
                                 params.disposition, initial_rect,
                                 has_user_gesture, &was_blocked);
       // The delegate may delete |new_contents_impl| during AddNewContents().
       if (!weak_new_contents)
-        return;
+        return nullptr;
     }
 
     if (!was_blocked) {
@@ -2961,26 +3014,31 @@ void WebContentsImpl::CreateNewWindow(
       }
     }
   }
+  return new_contents_impl;
 }
 
 void WebContentsImpl::CreateNewWidget(int32_t render_process_id,
                                       int32_t widget_route_id,
-                                      mojom::WidgetPtr widget) {
+                                      mojo::PendingRemote<mojom::Widget> widget,
+                                      RenderViewHostImpl* render_view_host) {
   CreateNewWidget(render_process_id, widget_route_id, /*is_fullscreen=*/false,
-                  std::move(widget));
+                  std::move(widget), render_view_host);
 }
 
-void WebContentsImpl::CreateNewFullscreenWidget(int32_t render_process_id,
-                                                int32_t widget_route_id,
-                                                mojom::WidgetPtr widget) {
+void WebContentsImpl::CreateNewFullscreenWidget(
+    int32_t render_process_id,
+    int32_t widget_route_id,
+    mojo::PendingRemote<mojom::Widget> widget,
+    RenderViewHostImpl* render_view_host) {
   CreateNewWidget(render_process_id, widget_route_id, /*is_fullscreen=*/true,
-                  std::move(widget));
+                  std::move(widget), render_view_host);
 }
 
 void WebContentsImpl::CreateNewWidget(int32_t render_process_id,
                                       int32_t route_id,
                                       bool is_fullscreen,
-                                      mojom::WidgetPtr widget) {
+                                      mojo::PendingRemote<mojom::Widget> widget,
+                                      RenderViewHostImpl* render_view_host) {
   RenderProcessHost* process = RenderProcessHost::FromID(render_process_id);
   // A message to create a new widget can only come from an active process for
   // this WebContentsImpl instance. If any other process sends the request,
@@ -2992,7 +3050,6 @@ void WebContentsImpl::CreateNewWidget(int32_t render_process_id,
 
   RenderWidgetHostImpl* widget_host = new RenderWidgetHostImpl(
       this, process, route_id, std::move(widget), IsHidden());
-
   RenderWidgetHostViewBase* widget_view =
       static_cast<RenderWidgetHostViewBase*>(
           view_->CreateViewForChildWidget(widget_host));
@@ -3076,12 +3133,22 @@ void WebContentsImpl::ShowCreatedWidget(int process_id,
     return;
 
   // GetOutermostWebContents() returns |this| if there are no outer WebContents.
+  auto* outer_web_contents = GetOuterWebContents();
+  auto* outermost_web_contents = GetOutermostWebContents();
   RenderWidgetHostView* view =
-      GetOutermostWebContents()->GetRenderWidgetHostView();
+      outermost_web_contents->GetRenderWidgetHostView();
+  // It's not entirely obvious why we need the transform only in the case where
+  // the outer webcontents is not the same as the outermost webcontents. It may
+  // be due to the fact that oopifs that are children of the mainframe get
+  // correct values for their screenrects, but deeper cross-process frames do
+  // not. Hopefully this can be resolved with https://crbug.com/928825.
+  // Handling these cases separately is needed for http://crbug.com/1015298.
+  bool needs_transform = this != outermost_web_contents &&
+                         outermost_web_contents != outer_web_contents;
 
   gfx::Rect transformed_rect(initial_rect);
   RenderWidgetHostView* this_view = GetRenderWidgetHostView();
-  if (this_view != view) {
+  if (needs_transform) {
     // We need to transform the coordinates of initial_rect.
     gfx::Point origin =
         this_view->TransformPointToRootCoordSpace(initial_rect.origin());
@@ -3102,7 +3169,7 @@ void WebContentsImpl::ShowCreatedWidget(int process_id,
     if (delegate_ && delegate_->EmbedsFullscreenWidget()) {
       widget_host_view->InitAsChild(GetRenderWidgetHostView()->GetNativeView());
       delegate_->EnterFullscreenModeForTab(this, GURL(),
-                                           blink::WebFullscreenOptions());
+                                           blink::mojom::FullscreenOptions());
     } else {
       widget_host_view->InitAsFullscreen(view);
     }
@@ -3255,11 +3322,13 @@ void WebContentsImpl::AccessibilityLocationChangesReceived(
     observer.AccessibilityLocationChangesReceived(details);
 }
 
-base::string16 WebContentsImpl::DumpAccessibilityTree(bool internal) {
+base::string16 WebContentsImpl::DumpAccessibilityTree(
+    bool internal,
+    std::vector<AccessibilityTreeFormatter::PropertyFilter> property_filters) {
   auto* ax_mgr = GetOrCreateRootBrowserAccessibilityManager();
   DCHECK(ax_mgr);
-  return AccessibilityTreeFormatter::DumpAccessibilityTreeFromManager(ax_mgr,
-                                                                      internal);
+  return AccessibilityTreeFormatter::DumpAccessibilityTreeFromManager(
+      ax_mgr, internal, property_filters);
 }
 
 RenderFrameHost* WebContentsImpl::GetGuestByInstanceID(
@@ -3282,10 +3351,10 @@ device::mojom::GeolocationContext* WebContentsImpl::GetGeolocationContext() {
   if (geolocation_context_)
     return geolocation_context_.get();
 
-  auto request = mojo::MakeRequest(&geolocation_context_);
   service_manager::Connector* connector = GetSystemConnector();
+  auto receiver = geolocation_context_.BindNewPipeAndPassReceiver();
   if (connector)
-    connector->BindInterface(device::mojom::kServiceName, std::move(request));
+    connector->Connect(device::mojom::kServiceName, std::move(receiver));
   return geolocation_context_.get();
 }
 
@@ -3296,9 +3365,10 @@ device::mojom::WakeLockContext* WebContentsImpl::GetWakeLockContext() {
 }
 
 #if defined(OS_ANDROID)
-void WebContentsImpl::GetNFC(device::mojom::NFCRequest request) {
+void WebContentsImpl::GetNFC(
+    mojo::PendingReceiver<device::mojom::NFC> receiver) {
   NFCHost nfc_host(this);
-  nfc_host.GetNFC(std::move(request));
+  nfc_host.GetNFC(std::move(receiver));
 }
 #endif
 
@@ -3644,19 +3714,12 @@ void WebContentsImpl::SetHistoryOffsetAndLengthForView(
       render_view_host->GetRoutingID(), history_offset, history_length));
 }
 
-void WebContentsImpl::ReloadFocusedFrame(bool bypass_cache) {
+void WebContentsImpl::ReloadFocusedFrame() {
   RenderFrameHost* focused_frame = GetFocusedFrame();
   if (!focused_frame)
     return;
 
-  focused_frame->Send(new FrameMsg_Reload(
-      focused_frame->GetRoutingID(), bypass_cache));
-}
-
-void WebContentsImpl::ReloadLoFiImages() {
-  SendToAllFrames(new FrameMsg_ReloadLoFiImages(MSG_ROUTING_NONE));
-  for (auto& observer : observers_)
-    observer.DidReloadLoFiImages();
+  focused_frame->Reload();
 }
 
 std::vector<mojo::Remote<blink::mojom::PauseSubresourceLoadingHandle>>
@@ -4355,10 +4418,9 @@ void WebContentsImpl::DidRedirectNavigation(
   // Notify accessibility if this is a reload. This has to called on the
   // BrowserAccessibilityManager associated with the old RFHI.
   if (navigation_handle->GetReloadType() != ReloadType::NONE) {
-    NavigationHandleImpl* nhi =
-        static_cast<NavigationHandleImpl*>(navigation_handle);
+    NavigationRequest* request = NavigationRequest::From(navigation_handle);
     BrowserAccessibilityManager* manager =
-        nhi->frame_tree_node()
+        request->frame_tree_node()
             ->current_frame_host()
             ->browser_accessibility_manager();
     if (manager)
@@ -4370,6 +4432,13 @@ void WebContentsImpl::ReadyToCommitNavigation(
     NavigationHandle* navigation_handle) {
   TRACE_EVENT1("navigation", "WebContentsImpl::ReadyToCommitNavigation",
                "navigation_handle", navigation_handle);
+
+  if (!navigation_handle->GetParentFrame() &&
+      record_max_frame_count_when_leaving_current_page_) {
+    RecordMaxFrameCountUMA(max_frame_count_);
+    record_max_frame_count_when_leaving_current_page_ = false;
+  }
+
   for (auto& observer : observers_)
     observer.ReadyToCommitNavigation(navigation_handle);
 
@@ -4457,6 +4526,17 @@ void WebContentsImpl::DidFinishNavigation(NavigationHandle* navigation_handle) {
       navigation_handle->GetURL() != url::kAboutBlankURL) {
     should_focus_location_bar_by_default_ = false;
   }
+
+  // If navigation has successfully finished in the main page, set
+  // |record_max_frame_count_when_leaving_current_page_| to true so that when
+  // the main frame navigates away from this page we know to record this page's
+  // max frame count.
+  if (navigation_handle->IsInMainFrame() && !navigation_handle->IsErrorPage()) {
+    record_max_frame_count_when_leaving_current_page_ = true;
+
+    // Navigation has completed in main frame. Reset |max_frame_count_| to 1.
+    max_frame_count_ = 1;
+  }
 }
 
 void WebContentsImpl::DidFailLoadWithError(
@@ -4576,8 +4656,9 @@ bool WebContentsImpl::CanOverscrollContent() const {
   return false;
 }
 
-void WebContentsImpl::OnThemeColorChanged(RenderFrameHostImpl* source,
-                                          base::Optional<SkColor> theme_color) {
+void WebContentsImpl::OnThemeColorChanged(
+    RenderFrameHostImpl* source,
+    const base::Optional<SkColor>& theme_color) {
   if (source != GetMainFrame()) {
     // Only the main frame may control the theme.
     return;
@@ -4712,6 +4793,10 @@ void WebContentsImpl::ViewSource(RenderFrameHostImpl* frame) {
                                        std::string(":") +
                                        frame_entry->url().spec()));
 
+  navigation_entry->set_network_isolation_key(
+      net::NetworkIsolationKey(GetMainFrame()->GetLastCommittedOrigin(),
+                               frame->GetLastCommittedOrigin()));
+
   // Do not restore scroller position.
   // TODO(creis, lukasza, arthursonzogni): Do not reuse the original PageState,
   // but start from a new one and only copy the needed data.
@@ -4807,9 +4892,9 @@ void WebContentsImpl::OnDidRunContentWithCertificateErrors(
       entry->GetURL().GetOrigin());
 }
 
-void WebContentsImpl::OnDocumentLoadedInFrame(RenderFrameHostImpl* source) {
+void WebContentsImpl::DOMContentLoaded(RenderFrameHost* render_frame_host) {
   for (auto& observer : observers_)
-    observer.DocumentLoadedInFrame(source);
+    observer.DOMContentLoaded(render_frame_host);
 }
 
 void WebContentsImpl::OnDidFinishLoad(RenderFrameHostImpl* source,
@@ -4828,8 +4913,7 @@ void WebContentsImpl::OnDidFinishLoad(RenderFrameHostImpl* source,
 
 void WebContentsImpl::OnGoToEntryAtOffset(RenderFrameHostImpl* source,
                                           int offset,
-                                          bool has_user_gesture,
-                                          bool from_script) {
+                                          bool has_user_gesture) {
   // Non-user initiated navigations coming from the renderer should be ignored
   // if there is an ongoing browser-initiated navigation.
   // See https://crbug.com/879965.
@@ -4847,11 +4931,7 @@ void WebContentsImpl::OnGoToEntryAtOffset(RenderFrameHostImpl* source,
 
   // All frames are allowed to navigate the global history.
   if (!delegate_ || delegate_->OnGoToEntryOffset(offset)) {
-    // We only check sandboxed navigation permissions on navigations originating
-    // from scripts, and not mouse back buttons (from_script == false), which
-    // also use this path.
-    if (from_script &&
-        source->IsSandboxed(blink::WebSandboxFlags::kTopNavigation)) {
+    if (source->IsSandboxed(blink::WebSandboxFlags::kTopNavigation)) {
       // Keep track of whether this is a session history from a sandboxed iframe
       // with top level navigation disallowed.
       controller_.GoToOffsetInSandboxedFrame(offset,
@@ -4862,13 +4942,6 @@ void WebContentsImpl::OnGoToEntryAtOffset(RenderFrameHostImpl* source,
   }
 }
 
-void WebContentsImpl::OnUpdateZoomLimits(RenderViewHostImpl* source,
-                                         int minimum_percent,
-                                         int maximum_percent) {
-  minimum_zoom_percent_ = minimum_percent;
-  maximum_zoom_percent_ = maximum_percent;
-}
-
 void WebContentsImpl::OnPageScaleFactorChanged(RenderViewHostImpl* source,
                                                float page_scale_factor) {
 #if !defined(OS_ANDROID)
@@ -5127,12 +5200,6 @@ void WebContentsImpl::DidFirstVisuallyNonEmptyPaint(
   }
 }
 
-void WebContentsImpl::DidCommitAndDrawCompositorFrame(
-    RenderViewHostImpl* source) {
-  for (auto& observer : observers_)
-    observer.DidCommitAndDrawCompositorFrame();
-}
-
 bool WebContentsImpl::IsPortal() const {
   return portal();
 }
@@ -5279,6 +5346,12 @@ void WebContentsImpl::NotifyViewSwapped(RenderViewHost* old_host,
 void WebContentsImpl::NotifyFrameSwapped(RenderFrameHost* old_host,
                                          RenderFrameHost* new_host,
                                          bool is_main_frame) {
+  if (!old_host) {
+    frame_count_++;
+    if (max_frame_count_ < frame_count_)
+      max_frame_count_ = frame_count_;
+  }
+
 #if defined(OS_ANDROID)
   // Copy importance from |old_host| if |new_host| is a main frame.
   if (old_host && !new_host->GetParent()) {
@@ -5383,6 +5456,20 @@ void WebContentsImpl::RenderFrameCreated(RenderFrameHost* render_frame_host) {
 }
 
 void WebContentsImpl::RenderFrameDeleted(RenderFrameHost* render_frame_host) {
+  if (!render_frame_host->GetParent() && IsBeingDestroyed() &&
+      record_max_frame_count_when_leaving_current_page_ &&
+      !static_cast<RenderFrameHostImpl*>(render_frame_host)
+           ->is_in_back_forward_cache()) {
+    // Main frame has been deleted because WebContents is being destroyed.
+    // Note that we aren't recording this here when the main frame is in the
+    // back-forward cache because that means we've actually already navigated
+    // away from it (and we got to this point because the WebContents is
+    // deleted), which means |max_frame_count_| is already overwritten.
+    // The |max_frame_count_| value will instead be recorded from within
+    // |WebContentsImpl::ReadyToCommitNavigation()|.
+    RecordMaxFrameCountUMA(max_frame_count_);
+  }
+
   is_notifying_observers_ = true;
   for (auto& observer : observers_)
     observer.RenderFrameDeleted(render_frame_host);
@@ -5631,7 +5718,7 @@ bool WebContentsImpl::IsSpatialNavigationDisabled() const {
   return is_spatial_navigation_disabled_;
 }
 
-RenderFrameHost* WebContentsImpl::GetPendingMainFrame() {
+RenderFrameHostImpl* WebContentsImpl::GetPendingMainFrame() {
   return GetRenderManager()->speculative_frame_host();
 }
 
@@ -6146,11 +6233,6 @@ void WebContentsImpl::UpdateTitle(RenderFrameHost* render_frame_host,
   UpdateTitleForEntry(entry, title);
 }
 
-void WebContentsImpl::UpdateEncoding(RenderFrameHost* render_frame_host,
-                                     const std::string& encoding) {
-  SetEncoding(encoding);
-}
-
 void WebContentsImpl::DocumentAvailableInMainFrame(
     RenderViewHost* render_view_host) {
   for (auto& observer : observers_)
@@ -6548,10 +6630,7 @@ void WebContentsImpl::CreateRenderWidgetHostViewForRenderManager(
     RenderViewHost* render_view_host) {
   RenderWidgetHostViewBase* rwh_view =
       view_->CreateViewForWidget(render_view_host->GetWidget(), false);
-
-  // Now that the RenderView has been created, we need to tell it its size.
-  if (rwh_view)
-    rwh_view->SetSize(GetSizeForNewRenderView(true));
+  rwh_view->SetSize(GetSizeForNewRenderView(true));
 }
 
 bool WebContentsImpl::CreateRenderViewForRenderManager(
@@ -6731,14 +6810,6 @@ void WebContentsImpl::OnDialogClosed(int render_process_id,
   is_showing_before_unload_dialog_ = false;
 }
 
-void WebContentsImpl::SetEncoding(const std::string& encoding) {
-  if (encoding == last_reported_encoding_)
-    return;
-  last_reported_encoding_ = encoding;
-
-  canonical_encoding_ = base::GetCanonicalEncodingNameByAliasName(encoding);
-}
-
 bool WebContentsImpl::IsHidden() {
   return !IsBeingCaptured() && visibility_ != Visibility::VISIBLE;
 }
@@ -6800,6 +6871,8 @@ gfx::Size WebContentsImpl::GetSizeForNewRenderView(bool is_main_frame) {
 }
 
 void WebContentsImpl::OnFrameRemoved(RenderFrameHost* render_frame_host) {
+  frame_count_--;
+
   for (auto& observer : observers_)
     observer.FrameDeleted(render_frame_host);
 }
@@ -7340,7 +7413,6 @@ void WebContentsImpl::OnNativeThemeUpdated(ui::NativeTheme* observed_theme) {
   DCHECK(native_theme_observer_.IsObserving(observed_theme));
 
   bool using_dark_colors = observed_theme->ShouldUseDarkColors();
-  bool in_high_contrast = observed_theme->UsesHighContrastColors();
   ui::NativeTheme::PreferredColorScheme preferred_color_scheme =
       observed_theme->GetPreferredColorScheme();
   bool preferences_changed = false;
@@ -7349,10 +7421,6 @@ void WebContentsImpl::OnNativeThemeUpdated(ui::NativeTheme* observed_theme) {
     using_dark_colors_ = using_dark_colors;
     preferences_changed = true;
   }
-  if (in_high_contrast_ != in_high_contrast) {
-    in_high_contrast_ = in_high_contrast;
-    preferences_changed = true;
-  }
   if (preferred_color_scheme_ != preferred_color_scheme) {
     preferred_color_scheme_ = preferred_color_scheme;
     preferences_changed = true;
diff --git a/chromium/content/browser/web_contents/web_contents_impl.h b/chromium/content/browser/web_contents/web_contents_impl.h
index dfb543d031d..71299edb9e3 100644
--- a/chromium/content/browser/web_contents/web_contents_impl.h
+++ b/chromium/content/browser/web_contents/web_contents_impl.h
@@ -42,6 +42,7 @@
 #include "content/browser/renderer_host/render_widget_host_delegate.h"
 #include "content/browser/wake_lock/wake_lock_context_host.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/accessibility_tree_formatter.h"
 #include "content/public/browser/color_chooser.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/media_stream_request.h"
@@ -54,6 +55,8 @@
 #include "content/public/common/page_importance_signals.h"
 #include "content/public/common/resource_type.h"
 #include "content/public/common/three_d_api_types.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/load_states.h"
 #include "net/cookies/canonical_cookie.h"
@@ -129,9 +132,7 @@ class CreateNewWindowParams;
 
 #if defined(OS_ANDROID)
 class WebContentsAndroid;
-#else  // !defined(OS_ANDROID)
-class HostZoomMapObserver;
-#endif  // defined(OS_ANDROID)
+#endif
 
 #if BUILDFLAG(ENABLE_PLUGINS)
 class PepperPlaybackObserver;
@@ -382,6 +383,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   std::vector<WebContents*> GetInnerWebContents() override;
   void DidChangeVisibleSecurityState() override;
   void NotifyPreferencesChanged() override;
+  void SyncRendererPrefs() override;
   void OnCookiesRead(const GURL& url,
                      const GURL& first_party_url,
                      const net::CookieList& cookie_list,
@@ -394,7 +396,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void Stop() override;
   void SetPageFrozen(bool frozen) override;
   std::unique_ptr<WebContents> Clone() override;
-  void ReloadFocusedFrame(bool bypass_cache) override;
+  void ReloadFocusedFrame() override;
   void Undo() override;
   void Redo() override;
   void Cut() override;
@@ -409,7 +411,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void ReplaceMisspelling(const base::string16& word) override;
   void NotifyContextMenuClosed(
       const CustomContextMenuContext& context) override;
-  void ReloadLoFiImages() override;
   std::vector<mojo::Remote<blink::mojom::PauseSubresourceLoadingHandle>>
   PauseSubresourceLoading() override;
   void ExecuteCustomContextMenuCommand(
@@ -545,14 +546,13 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                              bool is_display_none) override;
   void FrameSizeChanged(RenderFrameHost* render_frame_host,
                         const gfx::Size& frame_size) override;
+  void DOMContentLoaded(RenderFrameHost* render_frame_host) override;
   void DocumentOnLoadCompleted(RenderFrameHost* render_frame_host) override;
   void UpdateStateForFrame(RenderFrameHost* render_frame_host,
                            const PageState& page_state) override;
   void UpdateTitle(RenderFrameHost* render_frame_host,
                    const base::string16& title,
                    base::i18n::TextDirection title_direction) override;
-  void UpdateEncoding(RenderFrameHost* render_frame_host,
-                      const std::string& encoding) override;
   WebContents* GetAsWebContents() override;
   bool IsNeverVisible() override;
   ui::AXMode GetAccessibilityMode() override;
@@ -562,17 +562,21 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       const AXEventNotificationDetails& details) override;
   void AccessibilityLocationChangesReceived(
       const std::vector<AXLocationChangeNotificationDetails>& details) override;
-  base::string16 DumpAccessibilityTree(bool internal) override;
+  base::string16 DumpAccessibilityTree(
+      bool internal,
+      std::vector<content::AccessibilityTreeFormatter::PropertyFilter>
+          property_filters) override;
   RenderFrameHost* GetGuestByInstanceID(
       RenderFrameHost* render_frame_host,
       int browser_plugin_instance_id) override;
   device::mojom::GeolocationContext* GetGeolocationContext() override;
   device::mojom::WakeLockContext* GetWakeLockContext() override;
 #if defined(OS_ANDROID)
-  void GetNFC(device::mojom::NFCRequest request) override;
+  void GetNFC(mojo::PendingReceiver<device::mojom::NFC> receiver) override;
 #endif
-  void EnterFullscreenMode(const GURL& origin,
-                           const blink::WebFullscreenOptions& options) override;
+  void EnterFullscreenMode(
+      const GURL& origin,
+      const blink::mojom::FullscreenOptions& options) override;
   void ExitFullscreenMode(bool will_cause_resize) override;
   void FullscreenStateChanged(RenderFrameHost* rfh,
                               bool is_fullscreen) override;
@@ -592,12 +596,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       RenderFrameHostImpl* frame,
       const gfx::Rect& bounds_in_root_view) override;
   void OnAdvanceFocus(RenderFrameHostImpl* source_rfh) override;
-  void CreateNewWindow(
+  RenderFrameHostDelegate* CreateNewWindow(
       RenderFrameHost* opener,
-      int32_t render_view_route_id,
-      int32_t main_frame_route_id,
-      int32_t main_frame_widget_route_id,
       const mojom::CreateNewWindowParams& params,
+      bool is_new_browsing_instance,
       bool has_user_gesture,
       SessionStorageNamespace* session_storage_namespace) override;
   void ShowCreatedWindow(int process_id,
@@ -636,6 +638,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                                    int context_id) override;
   RenderFrameHostImpl* GetMainFrameForInnerDelegate(
       FrameTreeNode* frame_tree_node) override;
+  void OnThemeColorChanged(RenderFrameHostImpl* source,
+                           const base::Optional<SkColor>& theme_color) override;
 
   // RenderViewHostDelegate ----------------------------------------------------
   RenderViewHostDelegateView* GetDelegateView() override;
@@ -670,10 +674,12 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void UpdatePreferredSize(const gfx::Size& pref_size) override;
   void CreateNewWidget(int32_t render_process_id,
                        int32_t route_id,
-                       mojom::WidgetPtr widget) override;
+                       mojo::PendingRemote<mojom::Widget> widget,
+                       RenderViewHostImpl* render_view_host) override;
   void CreateNewFullscreenWidget(int32_t render_process_id,
                                  int32_t widget_route_id,
-                                 mojom::WidgetPtr widget) override;
+                                 mojo::PendingRemote<mojom::Widget> widget,
+                                 RenderViewHostImpl* render_view_host) override;
   void ShowCreatedWidget(int process_id,
                          int widget_route_id,
                          const gfx::Rect& initial_rect) override;
@@ -696,9 +702,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   bool HideDownloadUI() const override;
   bool HasPersistentVideo() const override;
   bool IsSpatialNavigationDisabled() const override;
-  RenderFrameHost* GetPendingMainFrame() override;
+  RenderFrameHostImpl* GetPendingMainFrame() override;
   void DidFirstVisuallyNonEmptyPaint(RenderViewHostImpl* source) override;
-  void DidCommitAndDrawCompositorFrame(RenderViewHostImpl* source) override;
   bool IsPortal() const override;
 
   // NavigatorDelegate ---------------------------------------------------------
@@ -726,7 +731,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void DidStartNavigationToPendingEntry(const GURL& url,
                                         ReloadType reload_type) override;
   bool ShouldTransferNavigation(bool is_main_frame_navigation) override;
-  bool ShouldPreserveAbortedURLs() override;
   void DidStartLoading(FrameTreeNode* frame_tree_node,
                        bool to_different_document) override;
   void DidStopLoading() override;
@@ -747,7 +751,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void RenderWidgetGotFocus(RenderWidgetHostImpl* render_widget_host) override;
   void RenderWidgetLostFocus(RenderWidgetHostImpl* render_widget_host) override;
   void RenderWidgetWasResized(RenderWidgetHostImpl* render_widget_host,
-                              const ScreenInfo& screen_info,
                               bool width_changed) override;
   void ResizeDueToAutoResize(RenderWidgetHostImpl* render_widget_host,
                              const gfx::Size& new_size) override;
@@ -764,6 +767,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
 
   KeyboardEventProcessingResult PreHandleKeyboardEvent(
       const NativeWebKeyboardEvent& event) override;
+  bool HandleMouseEvent(const blink::WebMouseEvent& event) override;
   bool HandleKeyboardEvent(const NativeWebKeyboardEvent& event) override;
   bool HandleWheelEvent(const blink::WebMouseWheelEvent& event) override;
   bool PreHandleGestureEvent(const blink::WebGestureEvent& event) override;
@@ -805,7 +809,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   RenderWidgetHostImpl* GetKeyboardLockWidget() override;
   // The following function is already listed under WebContents overrides:
   // bool IsFullscreenForCurrentTab() const override;
-  blink::WebDisplayMode GetDisplayMode(
+  blink::mojom::DisplayMode GetDisplayMode(
       RenderWidgetHostImpl* render_widget_host) const override;
   void LostCapture(RenderWidgetHostImpl* render_widget_host) override;
   void LostMouseLock(RenderWidgetHostImpl* render_widget_host) override;
@@ -885,6 +889,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
       const EntryChangedDetails& change_details) override;
   void NotifyNavigationListPruned(const PrunedDetails& pruned_details) override;
   void NotifyNavigationEntriesDeleted() override;
+  bool ShouldPreserveAbortedURLs() override;
 
   // Invoked before a form repost warning is shown.
   void NotifyBeforeFormRepostWarningShow() override;
@@ -1045,10 +1050,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                                  const gfx::RectF& active_rect);
 #endif
 
-  // Returns a base salt used to generate group IDs for media-device
-  // enumerations.
-  const std::string& GetMediaDeviceGroupIDSaltBase() const;
-
 #if defined(OS_ANDROID)
   // Called by WebContentsAndroid to send the Display Cutout safe area to
   // DisplayCutoutHostImpl.
@@ -1119,6 +1120,12 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                            NotifyFullscreenAcquired_SameOrigin);
   FRIEND_TEST_ALL_PREFIXES(WebContentsImplBrowserTest,
                            FullscreenAfterFrameSwap);
+  FRIEND_TEST_ALL_PREFIXES(WebContentsImplBrowserTest,
+                           MaxFrameCountForCrossProcessNavigation);
+  FRIEND_TEST_ALL_PREFIXES(WebContentsImplBrowserTest,
+                           MaxFrameCountRemovedIframes);
+  FRIEND_TEST_ALL_PREFIXES(WebContentsImplBrowserTest,
+                           MaxFrameCountInjectedIframes);
   FRIEND_TEST_ALL_PREFIXES(FormStructureBrowserTest, HTMLFiles);
   FRIEND_TEST_ALL_PREFIXES(NavigationControllerTest, HistoryNavigate);
   FRIEND_TEST_ALL_PREFIXES(RenderFrameHostManagerTest, PageDoesBackAndReload);
@@ -1231,6 +1238,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // See WebContents::Create for a description of these parameters.
   explicit WebContentsImpl(BrowserContext* browser_context);
 
+  // Covariant return type alternative for WebContents::Create(). Avoids
+  // need for casting of objects inside the content layer.
+  static std::unique_ptr<WebContentsImpl> Create(const CreateParams& params);
+
   // Add and remove observers for page navigation notifications. The order in
   // which notifications are sent to observers is undefined. Clients must be
   // sure to remove the observer before they go away.
@@ -1271,8 +1282,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                       const base::string16& user_input);
 
   // IPC message handlers.
-  void OnThemeColorChanged(RenderFrameHostImpl* source,
-                           base::Optional<SkColor> theme_color);
   void OnDidLoadResourceFromMemoryCache(
       RenderFrameHostImpl* source,
       const GURL& url,
@@ -1286,12 +1295,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                                const GURL& target_url);
   void OnDidDisplayContentWithCertificateErrors(RenderFrameHostImpl* source);
   void OnDidRunContentWithCertificateErrors(RenderFrameHostImpl* source);
-  void OnDocumentLoadedInFrame(RenderFrameHostImpl* source);
   void OnDidFinishLoad(RenderFrameHostImpl* source, const GURL& url);
   void OnGoToEntryAtOffset(RenderFrameHostImpl* source,
                            int offset,
-                           bool has_user_gesture,
-                           bool from_script);
+                           bool has_user_gesture);
   void OnUpdateZoomLimits(RenderViewHostImpl* source,
                           int minimum_percent,
                           int maximum_percent);
@@ -1398,7 +1405,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   void CreateNewWidget(int32_t render_process_id,
                        int32_t route_id,
                        bool is_fullscreen,
-                       mojom::WidgetPtr widget);
+                       mojo::PendingRemote<mojom::Widget> widget,
+                       RenderViewHostImpl* render_view_host);
 
   // Helper for ShowCreatedWidget/ShowCreatedFullscreenWidget.
   void ShowCreatedWidget(int process_id,
@@ -1454,8 +1462,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
                           bool is_main_frame);
   void NotifyDisconnected();
 
-  void SetEncoding(const std::string& encoding);
-
   // TODO(creis): This should take in a FrameTreeNode to know which node's
   // render manager to return.  For now, we just return the root's.
   RenderFrameHostManager* GetRenderManager() const;
@@ -1625,12 +1631,6 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // used to check whether we can do something for some special contents.
   std::string contents_mime_type_;
 
-  // The last reported character encoding, not canonicalized.
-  std::string last_reported_encoding_;
-
-  // The canonicalized character encoding.
-  std::string canonical_encoding_;
-
   // Whether the initial empty page has been accessed by another page, making it
   // unsafe to show the pending URL. Usually false unless another window tries
   // to modify the blank page.  Always false after the first commit.
@@ -1708,8 +1708,8 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   bool closed_by_user_gesture_;
 
   // Minimum/maximum zoom percent.
-  int minimum_zoom_percent_;
-  int maximum_zoom_percent_;
+  const int minimum_zoom_percent_;
+  const int maximum_zoom_percent_;
 
   // Used to correctly handle integer zooming through a smooth scroll device.
   float zoom_scroll_remainder_;
@@ -1789,7 +1789,7 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // Whether the last JavaScript dialog shown was suppressed. Used for testing.
   bool last_dialog_suppressed_;
 
-  device::mojom::GeolocationContextPtr geolocation_context_;
+  mojo::Remote<device::mojom::GeolocationContext> geolocation_context_;
 
   std::unique_ptr<WakeLockContextHost> wake_lock_context_host_;
 
@@ -1832,16 +1832,10 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   std::unique_ptr<PepperPlaybackObserver> pepper_playback_observer_;
 #endif  // BUILDFLAG(ENABLE_PLUGINS)
 
-#if !defined(OS_ANDROID)
-  std::unique_ptr<HostZoomMapObserver> host_zoom_map_observer_;
-#endif  // !defined(OS_ANDROID)
-
   std::unique_ptr<RenderWidgetHostInputEventRouter> rwh_input_event_router_;
 
   PageImportanceSignals page_importance_signals_;
 
-  std::string media_device_group_id_salt_base_;
-
 #if !defined(OS_ANDROID)
   bool page_scale_factor_is_one_;
 #endif  // !defined(OS_ANDROID)
@@ -1916,13 +1910,11 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   // with OOPIF renderers.
   blink::WebTextAutosizerPageInfo text_autosizer_page_info_;
 
-  // Observe native theme for changes to dark mode, high contrast and preferred
-  // color scheme. Used to notify the renderer of preferred color scheme and
-  // forced colors changes.
+  // Observe native theme for changes to dark mode, and preferred color scheme.
+  // Used to notify the renderer of preferred color scheme changes.
   ScopedObserver<ui::NativeTheme, ui::NativeThemeObserver>
       native_theme_observer_;
 
-  bool in_high_contrast_ = false;
   bool using_dark_colors_ = false;
   ui::NativeTheme::PreferredColorScheme preferred_color_scheme_ =
       ui::NativeTheme::PreferredColorScheme::kNoPreference;
@@ -1937,6 +1929,20 @@ class CONTENT_EXPORT WebContentsImpl : public WebContents,
   std::unique_ptr<JavaScriptDialogNavigationDeferrer>
       javascript_dialog_navigation_deferrer_;
 
+  // The number of frames currently in this WebContents.
+  size_t frame_count_ = 0;
+
+  // The max number of frames seen in the current page hosted by this
+  // WebContents.
+  size_t max_frame_count_ = 0;
+
+  // This boolean value is used to keep track of whether we should record
+  // |max_frame_count_| when the main frame navigation is ready to commit.
+  // |max_frame_count_| should not be recorded for initial navigation for
+  // example. This is because |max_frame_count_| refers to the page that is
+  // being navigated away from.
+  bool record_max_frame_count_when_leaving_current_page_ = false;
+
   base::WeakPtrFactory<WebContentsImpl> loading_weak_factory_{this};
   base::WeakPtrFactory<WebContentsImpl> weak_factory_{this};
 
diff --git a/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc b/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
index 7ba29e59461..1c1d68c0c31 100644
--- a/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl_browsertest.cc
@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <algorithm>
 #include <array>
 #include <utility>
 #include <vector>
@@ -17,6 +18,7 @@
 #include "base/strings/pattern.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/test/scoped_feature_list.h"
+#include "base/test/test_timeouts.h"
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
 #include "base/values.h"
@@ -29,7 +31,9 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/web_contents/web_contents_view.h"
 #include "content/common/frame_messages.h"
+#include "content/common/page_messages.h"
 #include "content/common/unfreezable_frame_messages.h"
+#include "content/public/browser/back_forward_cache.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/file_select_listener.h"
 #include "content/public/browser/invalidate_type.h"
@@ -68,6 +72,7 @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "third_party/blink/public/common/features.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -90,7 +95,7 @@ void ResizeWebContentsView(Shell* shell, const gfx::Size& size,
   // If |set_start_page| is true, start with blank page to make sure resize
   // takes effect.
   if (set_start_page)
-    NavigateToURL(shell, GURL("about://blank"));
+    EXPECT_TRUE(NavigateToURL(shell, GURL(url::kAboutBlankURL)));
 #else
   static_cast<WebContentsImpl*>(shell->web_contents())->GetView()->
       SizeContents(size);
@@ -139,9 +144,28 @@ class WebContentsImplBrowserTest : public ContentBrowserTest {
     return web_contents->current_fullscreen_frame_;
   }
 
-  void SetUpCommandLine(base::CommandLine* command_line) override {
-    ContentBrowserTest::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
+ protected:
+  // Gets script to create subframe.
+  std::string GetSubframeScript(const GURL& sub_frame) {
+    const char kLoadIframeScript[] = R"(
+        let iframe = document.createElement('iframe');
+        iframe.src = $1;
+        document.body.appendChild(iframe);
+      )";
+    return JsReplace(kLoadIframeScript, sub_frame);
+  }
+
+  // Creates and loads subframe, waits for load to stop, and then returns
+  // subframe from the web contents frame tree.
+  RenderFrameHost* CreateSubframe(const GURL& sub_frame) {
+    EXPECT_TRUE(ExecuteScript(shell(), GetSubframeScript(sub_frame)));
+    EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
+
+    return static_cast<WebContentsImpl*>(shell()->web_contents())
+        ->GetFrameTree()
+        ->root()
+        ->child_at(0)
+        ->current_frame_host();
   }
 
  private:
@@ -280,7 +304,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, DidStopLoadingDetails) {
 
   LoadStopNotificationObserver load_observer(
       &shell()->web_contents()->GetController());
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
   load_observer.Wait();
 
   EXPECT_EQ("/title1.html", load_observer.url_.path());
@@ -306,7 +331,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   // We will hear a DidStopLoading from the first load as the new load
   // is started.
   NavigateOnCommitObserver commit_observer(shell(), url2);
-  NavigateToURL(shell(), url1);
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
   load_observer.Wait();
 
   EXPECT_EQ(url1, load_observer.url_);
@@ -317,6 +342,9 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
 namespace {
 
+const char kFrameCountUMA[] = "Navigation.MainFrame.FrameCount";
+const char kMaxFrameCountUMA[] = "Navigation.MainFrame.MaxFrameCount";
+
 // Class that waits for a particular load to finish in any frame.  This happens
 // after the commit event.
 class LoadFinishedWaiter : public WebContentsObserver {
@@ -410,7 +438,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
                        ClearNonVisiblePendingOnFail) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
 
   // Navigate to an invalid URL and make sure it doesn't leave a pending entry.
   LoadStopNotificationObserver load_observer1(
@@ -452,7 +481,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   // When no size is set, RenderWidgetHostView adopts the size of
   // WebContentsView.
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title2.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title2.html")));
   EXPECT_EQ(shell()->web_contents()->GetContainerBounds().size(),
             shell()->web_contents()->GetRenderWidgetHostView()->GetViewBounds().
                 size());
@@ -463,7 +493,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   gfx::Size size_insets(10, 15);
   ResizeWebContentsView(shell(), size, true);
   delegate->set_size_insets(size_insets);
-  NavigateToURL(shell(), https_server.GetURL("/"));
+  EXPECT_TRUE(NavigateToURL(shell(), https_server.GetURL("/")));
   size.Enlarge(size_insets.width(), size_insets.height());
   EXPECT_EQ(size,
             shell()->web_contents()->GetRenderWidgetHostView()->GetViewBounds().
@@ -488,7 +518,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ResizeWebContentsView(shell(), init_size, true);
   delegate->set_size_insets(size_insets);
   RenderViewSizeObserver observer(shell(), new_size);
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
   // RenderWidgetHostView is created at specified size.
   init_size.Enlarge(size_insets.width(), size_insets.height());
   EXPECT_EQ(init_size, observer.rwhv_create_size());
@@ -511,7 +542,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, SetTitleOnUnload) {
       "data:text/html,"
       "<title>A</title>"
       "<body onunload=\"document.title = 'B'\"></body>");
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   ASSERT_EQ(1, shell()->web_contents()->GetController().GetEntryCount());
   NavigationEntryImpl* entry1 = NavigationEntryImpl::FromNavigationEntry(
       shell()->web_contents()->GetController().GetLastCommittedEntry());
@@ -521,7 +552,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, SetTitleOnUnload) {
   // Force a process switch by going to a privileged page.
   GURL web_ui_page(std::string(kChromeUIScheme) + "://" +
                    std::string(kChromeUIGpuHost));
-  NavigateToURL(shell(), web_ui_page);
+  EXPECT_TRUE(NavigateToURL(shell(), web_ui_page));
   NavigationEntryImpl* entry2 = NavigationEntryImpl::FromNavigationEntry(
       shell()->web_contents()->GetController().GetLastCommittedEntry());
   SiteInstance* site_instance2 = entry2->site_instance();
@@ -534,8 +565,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, SetTitleOnUnload) {
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, OpenURLSubframe) {
   // Navigate to a page with frames and grab a subframe's FrameTreeNode ID.
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/frame_tree/top.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/frame_tree/top.html")));
   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell()->web_contents());
   FrameTreeNode* root = wc->GetFrameTree()->root();
   ASSERT_EQ(3UL, root->child_count());
@@ -560,11 +591,11 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, OpenURLSubframe) {
 
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
                        AppendingFrameInWebUIDoesNotCrash) {
-  const GURL kWebUIUrl(GetWebUIURL("tracing"));
+  const GURL kWebUIUrl(GetWebUIURL("gpu"));
   const char kJSCodeForAppendingFrame[] =
       "document.body.appendChild(document.createElement('iframe'));";
 
-  NavigateToURL(shell(), kWebUIUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kWebUIUrl));
 
   EXPECT_TRUE(content::ExecuteScript(shell(), kJSCodeForAppendingFrame));
 }
@@ -610,12 +641,12 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   // Navigate to the initial URL and capture the RenderFrameHost for later
   // comparison.
-  NavigateToURL(shell(), initial_url);
+  EXPECT_TRUE(NavigateToURL(shell(), initial_url));
   RenderFrameHost* orig_rfh = shell()->web_contents()->GetMainFrame();
 
   // Install the observer and navigate cross-site.
   RenderFrameCreatedObserver observer(shell());
-  NavigateToURL(shell(), cross_site_url);
+  EXPECT_TRUE(NavigateToURL(shell(), cross_site_url));
 
   // The observer should've seen a RenderFrameCreated call for the new frame
   // and not the old one.
@@ -634,7 +665,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       &shell()->web_contents()->GetController());
   TitleWatcher title_watcher(shell()->web_contents(),
                              base::ASCIIToUTF16("pushState"));
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/push_state.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/push_state.html")));
   load_observer.Wait();
   base::string16 title = title_watcher.WaitAndGetTitle();
   ASSERT_EQ(title, base::ASCIIToUTF16("pushState"));
@@ -654,8 +686,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
                        RenderViewCreatedForChildWindow) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
 
   WebContentsAddedObserver new_web_contents_observer;
   ASSERT_TRUE(ExecuteScript(shell(),
@@ -817,7 +849,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ResourceLoadComplete) {
   // Load a page with an image and an image.
   GURL page_url(embedded_test_server()->GetURL("/page_with_iframe.html"));
   base::TimeTicks before = base::TimeTicks::Now();
-  NavigateToURL(shell(), page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   base::TimeTicks after = base::TimeTicks::Now();
   ASSERT_EQ(3U, observer.resource_load_infos().size());
   SCOPE_TRACED(observer.CheckResourceLoaded(
@@ -845,7 +877,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   GURL page_url(
       embedded_test_server()->GetURL("/page_with_cached_subresource.html"));
   base::TimeTicks before = base::TimeTicks::Now();
-  NavigateToURL(shell(), page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   base::TimeTicks after = base::TimeTicks::Now();
 
   GURL resource_url = embedded_test_server()->GetURL("/cachetime");
@@ -868,7 +900,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   // Loading again should serve the request out of the in-memory cache.
   before = base::TimeTicks::Now();
-  NavigateToURL(shell(), page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   after = base::TimeTicks::Now();
   ASSERT_EQ(1U, observer.resource_load_infos().size());
   SCOPE_TRACED(observer.CheckResourceLoaded(
@@ -882,11 +914,11 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   // Kill the renderer process so when the navigate again, it will be a fresh
   // renderer with an empty in-memory cache.
   ScopedAllowRendererCrashes scoped_allow_renderer_crashes(shell());
-  NavigateToURL(shell(), GetWebUIURL("crash"));
+  EXPECT_FALSE(NavigateToURL(shell(), GetWebUIURL("crash")));
 
   // Reload that URL, the subresource should be served from the network cache.
   before = base::TimeTicks::Now();
-  NavigateToURL(shell(), page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   after = base::TimeTicks::Now();
   ASSERT_EQ(2U, observer.resource_load_infos().size());
   SCOPE_TRACED(observer.CheckResourceLoaded(
@@ -1023,11 +1055,13 @@ class WebContentsSplitCacheBrowserTest : public WebContentsImplBrowserTest {
                               const GURL& worker) {
     DCHECK(url.is_valid());
 
-    // Do a cross-process navigation to clear the in-memory cache.
-    // We assume that we don't start this call from "chrome://gpu", as
-    // otherwise it won't be a cross-process navigation. We are relying
-    // on this navigation to discard the old process.
-    EXPECT_TRUE(NavigateToURL(shell(), GetWebUIURL("gpu")));
+    // Clear the in-memory cache held by the current process:
+    // 1) Prevent the old page from entering the back-forward cache. Otherwise
+    //    the old process will be kept alive, because it is still being used.
+    // 2) Navigate to a WebUI URL, which uses a new process.
+    BackForwardCache::DisableForRenderFrameHost(
+        shell()->web_contents()->GetMainFrame(), "test");
+    EXPECT_TRUE(NavigateToURL(shell(), GetWebUIURL(kChromeUIGpuHost)));
 
     // Observe network requests.
     ResourceLoadObserver observer(shell());
@@ -1097,6 +1131,16 @@ class WebContentsSplitCacheBrowserTest : public WebContentsImplBrowserTest {
   bool NavigationResourceCached(const GURL& url,
                                 const GURL& sub_frame,
                                 bool subframe_navigation_resource_cached) {
+    return NavigationResourceCached(url, url, sub_frame,
+                                    subframe_navigation_resource_cached);
+  }
+
+  // Same as above, but allows explicitly specifying the expected commit URL
+  // for the navigation to |url|, in case it differs.
+  bool NavigationResourceCached(const GURL& url,
+                                const GURL& expected_commit_url,
+                                const GURL& sub_frame,
+                                bool subframe_navigation_resource_cached) {
     // Do a cross-process navigation to clear the in-memory cache.
     // We assume that we don't start this call from "chrome://gpu", as
     // otherwise it won't be a cross-process navigation. We are relying
@@ -1106,7 +1150,7 @@ class WebContentsSplitCacheBrowserTest : public WebContentsImplBrowserTest {
     // Observe network requests.
     ResourceLoadObserver observer(shell());
 
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
 
     RenderFrameHostImpl* main_frame = static_cast<RenderFrameHostImpl*>(
         shell()->web_contents()->GetMainFrame());
@@ -1162,16 +1206,6 @@ class WebContentsSplitCacheBrowserTest : public WebContentsImplBrowserTest {
     return (*observer.FindResource(worker))->was_cached;
   }
 
-  // Gets script to create subframe.
-  std::string GetSubframeScript(const GURL& sub_frame) {
-    const char kLoadIframeScript[] = R"(
-        let iframe = document.createElement('iframe');
-        iframe.src = $1;
-        document.body.appendChild(iframe);
-      )";
-    return JsReplace(kLoadIframeScript, sub_frame);
-  }
-
   // Gets script to create worker.
   std::string GetWorkerScript(const GURL& worker) {
     const char kLoadWorkerScript[] = "let w = new Worker($1);";
@@ -1188,19 +1222,6 @@ class WebContentsSplitCacheBrowserTest : public WebContentsImplBrowserTest {
     return JsReplace(kLoadResourceScript, resource);
   }
 
-  // Creates and loads subframe, waits for load to stop, and then returns
-  // subframe from the web contents frame tree.
-  RenderFrameHost* CreateSubframe(const GURL& sub_frame) {
-    EXPECT_TRUE(ExecuteScript(shell(), GetSubframeScript(sub_frame)));
-    EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
-
-    return static_cast<WebContentsImpl*>(shell()->web_contents())
-        ->GetFrameTree()
-        ->root()
-        ->child_at(0)
-        ->current_frame_host();
-  }
-
   GURL GenURL(const std::string& host, const std::string& path) {
     return embedded_test_server()->GetURL(host, path);
   }
@@ -1400,8 +1421,14 @@ IN_PROC_BROWSER_TEST_F(WebContentsSplitCacheBrowserTestDisabled,
                                GenURL("c.com", "/title1.html")));
 }
 
+// TODO(http://crbug.com/997808): Flaky on Linux ASAN.
+#if defined(OS_LINUX) && (defined(ADDRESS_SANITIZER) || defined(LEAK_SANITIZER))
+#define MAYBE_SplitCacheDedicatedWorkers DISABLED_SplitCacheDedicatedWorkers
+#else
+#define MAYBE_SplitCacheDedicatedWorkers SplitCacheDedicatedWorkers
+#endif
 IN_PROC_BROWSER_TEST_F(WebContentsSplitCacheWithFrameOriginBrowserTest,
-                       SplitCacheDedicatedWorkers) {
+                       MAYBE_SplitCacheDedicatedWorkers) {
   // Load 3p.com/script from a.com's worker. The first time it's loaded from the
   // network and the second it's cached.
   EXPECT_FALSE(TestResourceLoadFromDedicatedWorker(
@@ -1446,7 +1473,8 @@ IN_PROC_BROWSER_TEST_P(WebContentsSplitCacheBrowserTestEnabled,
 
   // Navigate to a.com/redirect_to_d which redirects to d.com/title1.html.
   EXPECT_FALSE(NavigationResourceCached(GenURL("a.com", "/redirect_to_d"),
-                                        GURL(), false));
+                                        GenURL("d.com", "/title1.html"), GURL(),
+                                        false));
 
   // Navigate to d.com directly. The main resource should be cached due to the
   // earlier redirected navigation.
@@ -1498,12 +1526,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsSplitCacheWithFrameOriginBrowserTest,
       GenURL("d.com", "/title1.html"), true);
 }
 
-// TODO(http://crbug.com/997808): Flaky on Linux ASAN.
-#if defined(OS_LINUX) && defined(ADDRESS_SANITIZER)
-#define MAYBE_SplitCacheDedicatedWorkers DISABLED_SplitCacheDedicatedWorkers
-#else
-#define MAYBE_SplitCacheDedicatedWorkers SplitCacheDedicatedWorkers
-#endif
 IN_PROC_BROWSER_TEST_P(WebContentsSplitCacheBrowserTestEnabled,
                        MAYBE_SplitCacheDedicatedWorkers) {
   // Load 3p.com/script from a.com's worker. The first time it's loaded from the
@@ -1635,8 +1657,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
                        ResourceLoadCompleteFromLocalResource) {
   ResourceLoadObserver observer(shell());
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(),
-                GURL(embedded_test_server()->GetURL("/page_with_image.html")));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GURL(embedded_test_server()->GetURL("/page_with_image.html"))));
   ASSERT_EQ(2U, observer.resource_load_infos().size());
   EXPECT_TRUE(
       observer.resource_load_infos()[0]->network_info->network_accessed);
@@ -1644,7 +1666,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       observer.resource_load_infos()[1]->network_info->network_accessed);
   observer.Reset();
 
-  NavigateToURL(shell(), GetWebUIURL("gpu"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetWebUIURL("gpu")));
   ASSERT_LE(1U, observer.resource_load_infos().size());
   for (const mojom::ResourceLoadInfoPtr& resource_load_info :
        observer.resource_load_infos()) {
@@ -1661,7 +1683,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       embedded_test_server()->GetURL("/page_with_image_redirect.html"));
   GURL page_original_url(embedded_test_server()->GetURL(
       "/server-redirect?" + page_destination_url.spec()));
-  NavigateToURL(shell(), page_original_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_original_url,
+                            page_destination_url /* expected_commit_url */));
 
   ASSERT_EQ(2U, observer.resource_load_infos().size());
   const mojom::ResourceLoadInfoPtr& page_load_info =
@@ -1687,7 +1710,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   GURL image_url(embedded_test_server()->GetURL("/blank.jpg"));
 
   // Load the page without errors.
-  NavigateToURL(shell(), page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   ASSERT_EQ(2U, observer.resource_load_infos().size());
   EXPECT_EQ(net::OK, observer.resource_load_infos()[0]->net_error);
   EXPECT_EQ(net::OK, observer.resource_load_infos()[1]->net_error);
@@ -1705,7 +1728,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
         return true;
       },
       image_url));
-  NavigateToURL(shell(), page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), page_url));
   ASSERT_EQ(2U, observer.resource_load_infos().size());
   EXPECT_EQ(net::OK, observer.resource_load_infos()[0]->net_error);
   EXPECT_EQ(net::ERR_ADDRESS_UNREACHABLE,
@@ -1718,7 +1741,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
 
   GURL cacheable_url(embedded_test_server()->GetURL("/set-header"));
-  NavigateToURL(shell(), cacheable_url);
+  EXPECT_TRUE(NavigateToURL(shell(), cacheable_url));
   ASSERT_EQ(1U, observer.resource_load_infos().size());
   EXPECT_FALSE(
       observer.resource_load_infos()[0]->network_info->always_access_network);
@@ -1728,7 +1751,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       "cache-control: no-cache", "cache-control: no-store", "pragma: no-cache"};
   for (const std::string& header : headers) {
     GURL no_cache_url(embedded_test_server()->GetURL("/set-header?" + header));
-    NavigateToURL(shell(), no_cache_url);
+    EXPECT_TRUE(NavigateToURL(shell(), no_cache_url));
     ASSERT_EQ(1U, observer.resource_load_infos().size());
     EXPECT_TRUE(
         observer.resource_load_infos()[0]->network_info->always_access_network);
@@ -1747,7 +1770,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   GURL start_url(embedded_test_server()->GetURL("/server-redirect?" +
                                                 intermediate_url.spec()));
 
-  NavigateToURL(shell(), start_url);
+  EXPECT_TRUE(
+      NavigateToURL(shell(), start_url, target_url /* expected_commit_url */));
 
   ASSERT_EQ(1U, observer.resource_load_infos().size());
   EXPECT_EQ(target_url, observer.resource_load_infos()[0]->url);
@@ -1777,7 +1801,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
 
   GURL url(embedded_test_server()->GetURL("/page_with_image.html"));
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
   ASSERT_EQ(2U, observer.resource_load_infos().size());
   EXPECT_EQ(url, observer.resource_load_infos()[0]->url);
   EXPECT_TRUE(observer.resource_is_associated_with_main_frame()[0]);
@@ -1786,7 +1810,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   // Load that same page inside an iframe.
   GURL data_url("data:text/html,<iframe src='" + url.spec() + "'></iframe>");
-  NavigateToURL(shell(), data_url);
+  EXPECT_TRUE(NavigateToURL(shell(), data_url));
   ASSERT_EQ(3U, observer.resource_load_infos().size());
   EXPECT_EQ(data_url, observer.resource_load_infos()[0]->url);
   EXPECT_EQ(url, observer.resource_load_infos()[1]->url);
@@ -1836,7 +1860,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, LoadProgress) {
   std::unique_ptr<LoadProgressDelegateAndObserver> delegate(
       new LoadProgressDelegateAndObserver(shell()));
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
 
   const std::vector<double>& progresses = delegate->progresses;
   // All updates should be in order ...
@@ -1858,8 +1883,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, LoadProgressWithFrames) {
   std::unique_ptr<LoadProgressDelegateAndObserver> delegate(
       new LoadProgressDelegateAndObserver(shell()));
 
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("/frame_tree/top.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/frame_tree/top.html")));
 
   const std::vector<double>& progresses = delegate->progresses;
   // All updates should be in order ...
@@ -1883,7 +1908,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
 
   // Start at a real page.
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
 
   // Simulate a navigation that has not completed.
   const GURL kURL2 = embedded_test_server()->GetURL("/title2.html");
@@ -1950,7 +1976,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   std::unique_ptr<FirstVisuallyNonEmptyPaintObserver> observer(
       new FirstVisuallyNonEmptyPaintObserver(shell()));
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
 
   observer->WaitForDidFirstVisuallyNonEmptyPaint();
   ASSERT_TRUE(observer->did_fist_visually_non_empty_paint_);
@@ -1960,15 +1987,17 @@ namespace {
 
 class WebDisplayModeDelegate : public WebContentsDelegate {
  public:
-  explicit WebDisplayModeDelegate(blink::WebDisplayMode mode) : mode_(mode) { }
+  explicit WebDisplayModeDelegate(blink::mojom::DisplayMode mode)
+      : mode_(mode) {}
   ~WebDisplayModeDelegate() override { }
 
-  blink::WebDisplayMode GetDisplayMode(const WebContents* source) override {
+  blink::mojom::DisplayMode GetDisplayMode(const WebContents* source) override {
     return mode_;
   }
-  void set_mode(blink::WebDisplayMode mode) { mode_ = mode; }
+  void set_mode(blink::mojom::DisplayMode mode) { mode_ = mode; }
+
  private:
-  blink::WebDisplayMode mode_;
+  blink::mojom::DisplayMode mode_;
 
   DISALLOW_COPY_AND_ASSIGN(WebDisplayModeDelegate);
 };
@@ -1977,10 +2006,10 @@ class WebDisplayModeDelegate : public WebContentsDelegate {
 
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ChangeDisplayMode) {
   ASSERT_TRUE(embedded_test_server()->Start());
-  WebDisplayModeDelegate delegate(blink::kWebDisplayModeMinimalUi);
+  WebDisplayModeDelegate delegate(blink::mojom::DisplayMode::kMinimalUi);
   shell()->web_contents()->SetDelegate(&delegate);
 
-  NavigateToURL(shell(), GURL("about://blank"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
 
   ASSERT_TRUE(ExecuteScript(shell(),
                             "document.title = "
@@ -1988,7 +2017,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ChangeDisplayMode) {
                             " minimal-ui)').matches"));
   EXPECT_EQ(base::ASCIIToUTF16("true"), shell()->web_contents()->GetTitle());
 
-  delegate.set_mode(blink::kWebDisplayModeFullscreen);
+  delegate.set_mode(blink::mojom::DisplayMode::kFullscreen);
   // Simulate widget is entering fullscreen (changing size is enough).
   shell()
       ->web_contents()
@@ -2042,7 +2071,8 @@ class MockPageScaleObserver : public WebContentsObserver {
 // a notification to the browser so that WebContentsObservers are notified.
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ChangePageScale) {
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/title1.html")));
 
   MockPageScaleObserver observer(shell());
   ::testing::InSequence expect_call_sequence;
@@ -2062,7 +2092,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ViewSourceDirectNavigation) {
   ASSERT_TRUE(embedded_test_server()->Start());
   const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));
   const GURL kViewSourceURL(kViewSourceScheme + std::string(":") + kUrl.spec());
-  NavigateToURL(shell(), kViewSourceURL);
+  EXPECT_TRUE(NavigateToURL(shell(), kViewSourceURL));
   // Displayed view-source URLs don't include the scheme of the effective URL if
   // the effective URL is HTTP. (e.g. view-source:example.com is displayed
   // instead of view-source:http://example.com).
@@ -2082,7 +2112,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
   const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));
   const GURL kViewSourceURL(kViewSourceScheme + std::string(":") + kUrl.spec());
-  NavigateToURL(shell(), kUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kUrl));
 
   auto console_delegate = std::make_unique<ConsoleObserverDelegate>(
       shell()->web_contents(),
@@ -2102,7 +2132,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
   const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));
   const GURL kViewSourceURL(kViewSourceScheme + std::string(":") + kUrl.spec());
-  NavigateToURL(shell(), kUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kUrl));
 
   std::unique_ptr<ConsoleObserverDelegate> console_delegate(
       new ConsoleObserverDelegate(
@@ -2126,8 +2156,10 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 // Test that view source mode for a webui page can be opened.
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ViewSourceWebUI) {
   const std::string kUrl = "view-source:" + GetWebUIURLString(kChromeUIGpuHost);
-  const GURL kGURL(kUrl);
-  NavigateToURL(shell(), kGURL);
+  // To ensure that NavigateToURL succeeds, append a slash to the view-source:
+  // URL, since the slash would be appended anyway as part of the navigation.
+  const GURL kGURL(kUrl + "/");
+  EXPECT_TRUE(NavigateToURL(shell(), kGURL));
   EXPECT_EQ(base::ASCIIToUTF16(kUrl), shell()->web_contents()->GetTitle());
   EXPECT_TRUE(shell()
                   ->web_contents()
@@ -2254,7 +2286,7 @@ void NavigateToDataURLAndCheckForTerminationDisabler(
     const std::string& html,
     bool expect_onunload,
     bool expect_onbeforeunload) {
-  NavigateToURL(shell, GURL("data:text/html," + html));
+  EXPECT_TRUE(NavigateToURL(shell, GURL("data:text/html," + html)));
   RenderFrameHostImpl* rfh =
       static_cast<RenderFrameHostImpl*>(shell->web_contents()->GetMainFrame());
   EXPECT_EQ(expect_onunload || expect_onbeforeunload,
@@ -2353,7 +2385,7 @@ class TestWCDelegateForDialogsAndFullscreen : public JavaScriptDialogManager,
   void EnterFullscreenModeForTab(
       WebContents* web_contents,
       const GURL& origin,
-      const blink::WebFullscreenOptions& options) override {
+      const blink::mojom::FullscreenOptions& options) override {
     is_fullscreen_ = true;
   }
 
@@ -2461,8 +2493,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   ASSERT_TRUE(embedded_test_server()->Start());
 
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
   EXPECT_TRUE(WaitForLoadStop(wc));
 
   FrameTreeNode* root = wc->GetFrameTree()->root();
@@ -2519,8 +2551,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
             GURL(test_delegate.last_message()).ReplaceComponents(clear_port));
 
   // Navigate the top frame cross-site; ensure that dialogs work.
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("c.com", "/title3.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("c.com", "/title3.html")));
   EXPECT_TRUE(WaitForLoadStop(wc));
   test_delegate.WillWaitForDialog();
   EXPECT_TRUE(
@@ -2566,8 +2598,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       base_web_contents->GetBrowserContext());
   create_params.desired_renderer_state =
       WebContents::CreateParams::kInitializeAndWarmupRendererProcess;
-  create_params.initial_size =
-      base_web_contents->GetContainerBounds().size();
   std::unique_ptr<WebContents> web_contents(WebContents::Create(create_params));
   ASSERT_TRUE(web_contents);
 
@@ -2618,7 +2648,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
         base_web_contents->GetBrowserContext());
     create_params.desired_renderer_state =
         WebContents::CreateParams::kNoRendererProcess;
-    create_params.initial_size = base_web_contents->GetContainerBounds().size();
     std::unique_ptr<WebContents> web_contents(
         WebContents::Create(create_params));
     ASSERT_TRUE(web_contents);
@@ -2677,8 +2706,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       base_web_contents->GetBrowserContext());
   create_params.desired_renderer_state =
       WebContents::CreateParams::kInitializeAndWarmupRendererProcess;
-  create_params.initial_size =
-      base_web_contents->GetContainerBounds().size();
   std::unique_ptr<WebContents> web_contents(WebContents::Create(create_params));
   ASSERT_TRUE(web_contents);
 
@@ -2834,8 +2861,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   shell()->web_contents()->SetDelegate(delegate.get());
   ASSERT_TRUE(shell()->web_contents()->GetDelegate() == delegate.get());
 
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("a.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("a.com", "/title1.html")));
 
   // Try to request pointer lock. WebContentsDelegate should get a notification.
   ASSERT_TRUE(ExecuteScript(shell(),
@@ -2862,8 +2889,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_FALSE(delegate.get()->request_to_lock_mouse_called_);
 
   // Force a cross-process navigation so that the RenderWidgetHost is deleted.
-  NavigateToURL(shell(),
-                embedded_test_server()->GetURL("b.com", "/title1.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("b.com", "/title1.html")));
 
   // Make sure the WebContents cleaned up the previous pending request. A new
   // request should be forwarded to the WebContentsDelegate.
@@ -2882,7 +2909,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, UserAgentOverride) {
   const GURL kUrl(embedded_test_server()->GetURL(kHeaderPath));
   const std::string kUserAgentOverride = "foo";
 
-  NavigateToURL(shell(), kUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kUrl));
   std::string header_value;
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       shell()->web_contents(),
@@ -2891,7 +2918,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, UserAgentOverride) {
   EXPECT_NE(kUserAgentOverride, header_value);
 
   shell()->web_contents()->SetUserAgentOverride("foo", false);
-  NavigateToURL(shell(), kUrl);
+  EXPECT_TRUE(NavigateToURL(shell(), kUrl));
   EXPECT_TRUE(ExecuteScriptAndExtractString(
       shell()->web_contents(),
       "window.domAutomationController.send(document.body.textContent);",
@@ -2922,7 +2949,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // alert
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
   std::string script = "alert('hi')";
   test_delegate.WillWaitForDialog();
@@ -2931,7 +2958,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_FALSE(wc->IsFullscreenForCurrentTab());
 
   // confirm
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
   script = "confirm('hi')";
   test_delegate.WillWaitForDialog();
@@ -2940,7 +2967,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_FALSE(wc->IsFullscreenForCurrentTab());
 
   // prompt
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
   script = "prompt('hi')";
   test_delegate.WillWaitForDialog();
@@ -2949,7 +2976,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_FALSE(wc->IsFullscreenForCurrentTab());
 
   // beforeunload
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
   // Disable the hang monitor (otherwise there will be a race between the
   // beforeunload dialog and the beforeunload hang timer) and give the page a
@@ -2993,7 +3020,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   // A dialog from the inner WebContents should make the outer contents lose
   // fullscreen.
-  top_contents->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  top_contents->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(top_contents->IsFullscreenForCurrentTab());
   script = "alert('hi')";
   inner_test_delegate.WillWaitForDialog();
@@ -3009,7 +3036,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, FileChooserEndsFullscreen) {
   GURL url("about:blank");
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
   wc->RunFileChooser(wc->GetMainFrame(),
                      std::make_unique<MockFileSelectListener>(),
@@ -3026,7 +3053,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // popup
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
   std::string script = "window.open('', '', 'width=200,height=100')";
   test_delegate.WillWaitForNewContents();
@@ -3054,7 +3081,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
       static_cast<WebContentsImpl*>(test_delegate.last_popup());
 
   // Put the original page into fullscreen.
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
 
   // Have the popup open a popup.
@@ -3084,7 +3111,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   test_delegate.Wait();
 
   // Put the main contents into fullscreen ...
-  wc->EnterFullscreenMode(url, blink::WebFullscreenOptions());
+  wc->EnterFullscreenMode(url, blink::mojom::FullscreenOptions());
   EXPECT_TRUE(wc->IsFullscreenForCurrentTab());
 
   // ... and ensure that a call to window.focus() from it causes loss of
@@ -3331,11 +3358,120 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, NotifyPreferencesChanged) {
   SetBrowserClientForTesting(old_client);
 }
 
+namespace {
+
+class OutgoingSetRendererPrefsIPCWatcher {
+ public:
+  OutgoingSetRendererPrefsIPCWatcher(RenderProcessHostImpl* rph)
+      : rph_(rph), outgoing_message_seen_(false) {
+    rph_->SetIpcSendWatcherForTesting(
+        base::BindRepeating(&OutgoingSetRendererPrefsIPCWatcher::OnMessage,
+                            base::Unretained(this)));
+  }
+  ~OutgoingSetRendererPrefsIPCWatcher() {
+    rph_->SetIpcSendWatcherForTesting(
+        base::RepeatingCallback<void(const IPC::Message& msg)>());
+  }
+
+  void WaitForIPC() {
+    if (outgoing_message_seen_)
+      return;
+    run_loop_ = std::make_unique<base::RunLoop>();
+    run_loop_->Run();
+    run_loop_.reset();
+  }
+
+  const blink::mojom::RendererPreferences& renderer_preferences() const {
+    return renderer_preferences_;
+  }
+
+ private:
+  void OnMessage(const IPC::Message& message) {
+    IPC_BEGIN_MESSAGE_MAP(OutgoingSetRendererPrefsIPCWatcher, message)
+      IPC_MESSAGE_HANDLER(PageMsg_SetRendererPrefs, OnSetRendererPrefs)
+    IPC_END_MESSAGE_MAP()
+  }
+
+  void OnSetRendererPrefs(
+      const blink::mojom::RendererPreferences& renderer_prefs) {
+    outgoing_message_seen_ = true;
+    renderer_preferences_ = renderer_prefs;
+    if (run_loop_)
+      run_loop_->Quit();
+  }
+
+  RenderProcessHostImpl* rph_;
+  bool outgoing_message_seen_;
+  std::unique_ptr<base::RunLoop> run_loop_;
+  blink::mojom::RendererPreferences renderer_preferences_;
+};
+}  // namespace
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, SyncRendererPrefs) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  // Navigate to a site with two iframes in different origins.
+  GURL url = embedded_test_server()->GetURL(
+      "a.com", "/cross_site_iframe_factory.html?a(b,c)");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  // Retrieve an arbitrary renderer preference.
+  blink::mojom::RendererPreferences* renderer_preferences =
+      web_contents->GetMutableRendererPrefs();
+  const bool use_custom_colors_old = renderer_preferences->use_custom_colors;
+
+  // Retrieve all unique render process hosts.
+  std::vector<RenderProcessHostImpl*> render_process_hosts;
+  for (FrameTreeNode* frame_tree_node : web_contents->GetFrameTree()->Nodes()) {
+    RenderProcessHostImpl* render_process_host =
+        static_cast<RenderProcessHostImpl*>(
+            frame_tree_node->current_frame_host()->GetProcess());
+    ASSERT_NE(nullptr, render_process_host);
+    DLOG(INFO) << "render_process_host=" << render_process_host;
+
+    // It's possible (Android e.g.) for frame hosts to share a
+    // RenderProcessHost.
+    if (std::find(render_process_hosts.begin(), render_process_hosts.end(),
+                  render_process_host) == render_process_hosts.end()) {
+      render_process_hosts.push_back(render_process_host);
+    }
+  }
+
+  // Set up watchers for PageMsg_SetRendererPrefs message being sent from unique
+  // render process hosts.
+  std::vector<std::unique_ptr<OutgoingSetRendererPrefsIPCWatcher>> ipc_watchers;
+  for (auto* render_process_host : render_process_hosts) {
+    ipc_watchers.push_back(std::make_unique<OutgoingSetRendererPrefsIPCWatcher>(
+        render_process_host));
+
+    // Make sure the IPC watchers have the same default value for the arbitrary
+    // preference.
+    EXPECT_EQ(use_custom_colors_old,
+              ipc_watchers.back()->renderer_preferences().use_custom_colors);
+  }
+
+  // Change the arbitrary renderer preference.
+  const bool use_custom_colors_new = !use_custom_colors_old;
+  renderer_preferences->use_custom_colors = use_custom_colors_new;
+  web_contents->SyncRendererPrefs();
+
+  // Ensure IPC is sent to each frame.
+  for (auto& ipc_watcher : ipc_watchers) {
+    ipc_watcher->WaitForIPC();
+    EXPECT_EQ(use_custom_colors_new,
+              ipc_watcher->renderer_preferences().use_custom_colors);
+  }
+
+  renderer_preferences->use_custom_colors = use_custom_colors_old;
+}
+
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, SetPageFrozen) {
   EXPECT_TRUE(embedded_test_server()->Start());
 
   GURL test_url = embedded_test_server()->GetURL("/pause_schedule_task.html");
-  NavigateToURL(shell(), test_url);
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
   EXPECT_TRUE(WaitForLoadStop(shell()->web_contents()));
 
   int text_length;
@@ -3438,15 +3574,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, FrozenAndUnfrozenIPC) {
   EXPECT_TRUE(delete_rfh_c.deleted());
 }
 
-// http://crbug.com/990854
-#if defined(OS_ANDROID)
-#define MAYBE_PopupWindowBrowserNavResumeLoad \
-  DISABLED_PopupWindowBrowserNavResumeLoad
-#else
-#define MAYBE_PopupWindowBrowserNavResumeLoad PopupWindowBrowserNavResumeLoad
-#endif
 IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
-                       MAYBE_PopupWindowBrowserNavResumeLoad) {
+                       PopupWindowBrowserNavResumeLoad) {
   // This test verifies a pop up that requires navigation from browser side
   // works with a delegate that delays navigations of pop ups.
   // Create a file: scheme pop up from a file: scheme page, which requires
@@ -3468,8 +3597,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
     ShellAddedObserver new_shell_observer;
     bool success = false;
     EXPECT_TRUE(ExecuteScriptAndExtractBool(
-        shell(),
-        "window.domAutomationController.send(clickDeadFileNewWindowLink());",
+        shell(), "window.domAutomationController.send(clickLinkToSelf());",
         &success));
     new_shell = new_shell_observer.GetShell();
     new_contents = new_shell->web_contents();
@@ -3480,10 +3608,8 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_FALSE(new_contents->GetDelegate());
   new_contents->SetDelegate(new_shell);
   new_contents->ResumeLoadingCreatedWebContents();
-  // Dead file link may or may not load depending on OS. The result is not
-  // relevant for this test, so not checking the the result.
   WaitForLoadStop(new_contents);
-  EXPECT_TRUE(new_contents->GetLastCommittedURL().SchemeIs("file"));
+  EXPECT_EQ(url, new_contents->GetLastCommittedURL());
 }
 
 namespace {
@@ -3746,7 +3872,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, CtrlClickSubframeLink) {
   // Load a page with a subframe link.
   GURL main_url(
       embedded_test_server()->GetURL("/ctrl-click-subframe-link.html"));
-  NavigateToURL(shell(), main_url);
+  EXPECT_TRUE(NavigateToURL(shell(), main_url));
 
   // Start intercepting the DidOpenRequestedURL callback.
   MockDidOpenRequestedURLObserver mock_observer(shell());
@@ -3787,7 +3913,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, SetVisibilityBeforeLoad) {
   // the WebContents is fully controlled by the app.
   WebContents::CreateParams create_params(
       attached_web_contents->GetBrowserContext(), nullptr /* site_instance */);
-  create_params.initial_size = gfx::Size(100, 100);
   std::unique_ptr<WebContents> web_contents =
       WebContents::Create(create_params);
   EXPECT_EQ(Visibility::VISIBLE, web_contents->GetVisibility());
@@ -3862,7 +3987,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
 
   WebContents::CreateParams create_params(
       attached_web_contents->GetBrowserContext(), /*site_instance=*/nullptr);
-  create_params.initial_size = gfx::Size(100, 100);
   std::unique_ptr<WebContents> public_web_contents =
       WebContents::Create(create_params);
   auto* web_contents = static_cast<WebContentsImpl*>(public_web_contents.get());
@@ -3906,4 +4030,425 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
   EXPECT_THAT(deleted_routing_ids, testing::Contains(frame_routing_id));
 }
 
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, MouseButtonsNavigate) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  GURL url_a = embedded_test_server()->GetURL("a.com", "/title1.html");
+  GURL url_b = embedded_test_server()->GetURL("b.com", "/title1.html");
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  {
+    TestNavigationObserver back_observer(web_contents);
+    web_contents->GetRenderWidgetHostWithPageFocus()->ForwardMouseEvent(
+        blink::WebMouseEvent(
+            blink::WebInputEvent::kMouseUp, blink::WebFloatPoint(51, 50),
+            blink::WebFloatPoint(51, 50),
+            blink::WebPointerProperties::Button::kBack, 0,
+            blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
+    back_observer.Wait();
+    ASSERT_EQ(url_a, web_contents->GetLastCommittedURL());
+  }
+
+  {
+    TestNavigationObserver forward_observer(web_contents);
+    web_contents->GetRenderWidgetHostWithPageFocus()->ForwardMouseEvent(
+        blink::WebMouseEvent(
+            blink::WebInputEvent::kMouseUp, blink::WebFloatPoint(51, 50),
+            blink::WebFloatPoint(51, 50),
+            blink::WebPointerProperties::Button::kForward, 0,
+            blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
+    forward_observer.Wait();
+    ASSERT_EQ(url_b, web_contents->GetLastCommittedURL());
+  }
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, MouseButtonsDontNavigate) {
+  // This test injects mouse event listeners in javascript that will
+  // preventDefault the action causing the default navigation action not to be
+  // taken.
+
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  GURL url_a = embedded_test_server()->GetURL("a.com", "/title1.html");
+  GURL url_b = embedded_test_server()->GetURL("b.com", "/title1.html");
+
+  EXPECT_TRUE(NavigateToURL(shell(), url_a));
+  EXPECT_TRUE(NavigateToURL(shell(), url_b));
+
+  // Prevent default the action.
+  EXPECT_TRUE(content::ExecuteScript(shell(),
+                                     "document.addEventListener('mouseup', "
+                                     "event => event.preventDefault());"));
+
+  RenderWidgetHostImpl* render_widget_host =
+      web_contents->GetRenderWidgetHostWithPageFocus();
+  render_widget_host->ForwardMouseEvent(blink::WebMouseEvent(
+      blink::WebInputEvent::kMouseUp, blink::WebFloatPoint(51, 50),
+      blink::WebFloatPoint(51, 50), blink::WebPointerProperties::Button::kBack,
+      0, blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
+  RunUntilInputProcessed(render_widget_host);
+
+  // Wait an action timeout and assert the URL is correct.
+  {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(), TestTimeouts::action_timeout());
+    run_loop.Run();
+  }
+  ASSERT_EQ(url_b, web_contents->GetLastCommittedURL());
+
+  // Move back so we have a forward entry in the history stack so we
+  // can test forward getting canceled.
+  {
+    TestNavigationObserver back_observer(web_contents);
+    web_contents->GetController().GoBack();
+    back_observer.Wait();
+    ASSERT_EQ(url_a, web_contents->GetLastCommittedURL());
+  }
+
+  // Now test the forward button by going back, and injecting the prevention
+  // script.
+  // Prevent default the action.
+  EXPECT_TRUE(content::ExecuteScript(shell(),
+                                     "document.addEventListener('mouseup', "
+                                     "event => event.preventDefault());"));
+
+  render_widget_host = web_contents->GetRenderWidgetHostWithPageFocus();
+  render_widget_host->ForwardMouseEvent(blink::WebMouseEvent(
+      blink::WebInputEvent::kMouseUp, blink::WebFloatPoint(51, 50),
+      blink::WebFloatPoint(51, 50),
+      blink::WebPointerProperties::Button::kForward, 0,
+      blink::WebInputEvent::kNoModifiers, base::TimeTicks::Now()));
+  RunUntilInputProcessed(render_widget_host);
+  // Wait an action timeout and assert the URL is correct.
+  {
+    base::RunLoop run_loop;
+    base::ThreadTaskRunnerHandle::Get()->PostDelayedTask(
+        FROM_HERE, run_loop.QuitClosure(), TestTimeouts::action_timeout());
+    run_loop.Run();
+  }
+  ASSERT_EQ(url_a, web_contents->GetLastCommittedURL());
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, FrameCount) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  base::HistogramTester histogram_tester;
+
+  GURL url_with_iframes =
+      embedded_test_server()->GetURL("a.com", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url_with_iframes));
+  shell()->Close();
+
+  // Number of samples should be only one.
+  histogram_tester.ExpectTotalCount(kFrameCountUMA, 1);
+  histogram_tester.ExpectTotalCount(kMaxFrameCountUMA, 1);
+
+  histogram_tester.ExpectBucketCount(kFrameCountUMA, /* bucket */ 2,
+                                     /* count */ 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, 2, 1);
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       MaxFrameCountForCrossProcessNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  base::HistogramTester histogram_tester;
+
+  auto* web_contents = static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  GURL url = embedded_test_server()->GetURL("a.com", "/title1.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  EXPECT_EQ(web_contents->max_frame_count_, 1u);
+
+  GURL url_with_iframes_out_of_process =
+      embedded_test_server()->GetURL("b.com", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url_with_iframes_out_of_process));
+  EXPECT_EQ(web_contents->max_frame_count_, 2u);
+
+  // There should be two samples for kFrameCountUMA.
+  histogram_tester.ExpectTotalCount(kFrameCountUMA, 2);
+  histogram_tester.ExpectBucketCount(kFrameCountUMA, /* bucket */ 2,
+                                     /* count */ 1);
+  histogram_tester.ExpectBucketCount(kFrameCountUMA, /* bucket */ 1,
+                                     /* count */ 1);
+
+  // There should be only one record for KMaxFrameCountUMA as it is recorded
+  // either when a frame is destroyed or when a new page is loaded.
+  histogram_tester.ExpectTotalCount(kMaxFrameCountUMA, 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, /* bucket */ 1,
+                                     /* count */ 1);
+
+  // Same site navigation with multiple cross process iframes.
+  GURL url_with_multiple_iframes = embedded_test_server()->GetURL(
+      "b.com", "/cross_site_iframe_factory.html?b(a,c(b),d,b)");
+  EXPECT_TRUE(NavigateToURL(shell(), url_with_multiple_iframes));
+  EXPECT_EQ(web_contents->max_frame_count_, 6u);
+
+  histogram_tester.ExpectTotalCount(kMaxFrameCountUMA, 2);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, 1, 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, 2, 1);
+
+  // Simulate tab close to check that |kMaxFrameCountUMA| gets recorded.
+  shell()->Close();
+
+  // When the shell closes, the web contents is destroyed, as a result the main
+  // frame will be destroyed. When the main frame is destroyed, the
+  // kMaxFrameCountUMA gets recorded.
+  histogram_tester.ExpectTotalCount(kMaxFrameCountUMA, 3);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, 1, 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, 2, 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, 6, 1);
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       MaxFrameCountInjectedIframes) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  base::HistogramTester histogram_tester;
+  auto* web_contents = static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  GURL url_with_iframes =
+      embedded_test_server()->GetURL("a.com", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url_with_iframes));
+  EXPECT_EQ(web_contents->max_frame_count_, 2u);
+
+  // |url_with_iframes| contains another iframe inside it. This means that we
+  // have 4 iframes inside.
+  auto* rfh =
+      static_cast<RenderFrameHostImpl*>(CreateSubframe(url_with_iframes));
+
+  EXPECT_EQ(web_contents->max_frame_count_, 4u);
+  EXPECT_EQ(web_contents->frame_count_, 4u);
+
+  ASSERT_NE(rfh, nullptr);
+
+  shell()->Close();
+
+  // There should be one sample for kFrameCountUMA.
+  histogram_tester.ExpectTotalCount(kFrameCountUMA, 1);
+  histogram_tester.ExpectBucketCount(kFrameCountUMA, /* bucket */ 2,
+                                     /* count */ 1);
+
+  // There should be one sample for kMaxFrameCountUMA.
+  histogram_tester.ExpectTotalCount(kMaxFrameCountUMA, 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, /* bucket */ 4u,
+                                     /* count */ 1);
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       MaxFrameCountRemovedIframes) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  base::HistogramTester histogram_tester;
+  auto* web_contents = static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  GURL url_with_iframes =
+      embedded_test_server()->GetURL("a.com", "/page_with_iframe.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url_with_iframes));
+  EXPECT_EQ(web_contents->max_frame_count_, 2u);
+
+  GURL url = embedded_test_server()->GetURL("a.com", "/title1.html");
+  auto* rfh = static_cast<RenderFrameHostImpl*>(CreateSubframe(url));
+  ASSERT_NE(rfh, nullptr);
+  EXPECT_EQ(web_contents->max_frame_count_, 3u);
+  EXPECT_EQ(web_contents->frame_count_, 3u);
+
+  // Let's remove the first child.
+  auto* main_frame = web_contents->GetMainFrame();
+  auto* node_to_remove = main_frame->child_at(0);
+  FrameDeletedObserver observer(node_to_remove->current_frame_host());
+  EXPECT_TRUE(ExecuteScript(main_frame,
+                            "document.body.removeChild(document.querySelector('"
+                            "iframe').parentNode);"));
+  observer.Wait();
+
+  EXPECT_EQ(web_contents->max_frame_count_, 3u);
+  EXPECT_EQ(web_contents->frame_count_, 2u);
+
+  // Let's remove the second child.
+  node_to_remove = main_frame->child_at(0);
+  FrameDeletedObserver observer_second(node_to_remove->current_frame_host());
+  EXPECT_TRUE(ExecuteScript(
+      main_frame,
+      "document.body.removeChild(document.querySelector('iframe'));"));
+  observer_second.Wait();
+
+  EXPECT_EQ(web_contents->max_frame_count_, 3u);
+  EXPECT_EQ(web_contents->frame_count_, 1u);
+
+  shell()->Close();
+
+  // There should be one sample for kFrameCountUMA.
+  histogram_tester.ExpectTotalCount(kFrameCountUMA, 1);
+  histogram_tester.ExpectBucketCount(kFrameCountUMA, /* bucket */ 2,
+                                     /* count */ 1);
+
+  // There should be one sample for kMaxFrameCountUMA
+  histogram_tester.ExpectTotalCount(kMaxFrameCountUMA, 1);
+  histogram_tester.ExpectBucketCount(kMaxFrameCountUMA, /* bucket */ 3,
+                                     /* count */ 1);
+}
+
+namespace {
+
+class LoadingObserver : public WebContentsObserver {
+ public:
+  explicit LoadingObserver(WebContents* web_contents)
+      : WebContentsObserver(web_contents) {}
+
+  std::vector<std::string>& GetEvents() { return events_; }
+
+  void DidStartNavigation(NavigationHandle* navigation_handle) override {
+    events_.push_back("DidStartNavigation");
+  }
+
+  void DidFinishNavigation(NavigationHandle* navigation_handle) override {
+    events_.push_back("DidFinishNavigation");
+  }
+
+  void DidStartLoading() override { events_.push_back("DidStartLoading"); }
+
+  void DidStopLoading() override {
+    events_.push_back("DidStopLoading");
+    run_loop_.Quit();
+  }
+
+  void DocumentAvailableInMainFrame() override {
+    events_.push_back("DocumentAvailableInMainFrame");
+  }
+
+  void DocumentOnLoadCompletedInMainFrame() override {
+    events_.push_back("DocumentOnLoadCompletedInMainFrame");
+  }
+
+  void DOMContentLoaded(RenderFrameHost* render_frame_host) override {
+    events_.push_back("DOMContentLoaded");
+  }
+
+  void DidFinishLoad(RenderFrameHost* render_frame_host,
+                     const GURL& url) override {
+    events_.push_back("DidFinishLoad");
+  }
+
+  void DidFailLoad(RenderFrameHost* render_frame_host,
+                   const GURL& url,
+                   int error_code,
+                   const base::string16& error_description) override {
+    events_.push_back("DidFailLoad");
+  }
+
+  void Wait() { run_loop_.Run(); }
+
+ private:
+  std::vector<std::string> events_;
+  base::RepeatingClosure completion_callback_;
+  base::RunLoop run_loop_;
+};
+
+}  // namespace
+
+// These tests provide a reference points for simulating the navigation events
+// for unittests.
+//
+// Keep in sync with TestRenderFrameHostTest.LoadingCallbacksOrder_*.
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       LoadingCallbacksOrder_CrossDocumentNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  LoadingObserver loading_observer(web_contents);
+
+  GURL url = embedded_test_server()->GetURL("a.com", "/title1.html");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  loading_observer.Wait();
+
+  EXPECT_THAT(loading_observer.GetEvents(),
+              testing::ElementsAre(
+                  "DidStartLoading", "DidStartNavigation",
+                  "DidFinishNavigation", "DocumentAvailableInMainFrame",
+                  "DOMContentLoaded", "DocumentOnLoadCompletedInMainFrame",
+                  "DidFinishLoad", "DidStopLoading"));
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       LoadingCallbacksOrder_SameDocumentNavigation) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  GURL url1 = embedded_test_server()->GetURL("a.com", "/title1.html");
+  GURL url2 = embedded_test_server()->GetURL("a.com", "/title1.html#foo");
+
+  LoadingObserver loading_observer1(web_contents);
+  EXPECT_TRUE(NavigateToURL(shell(), url1));
+  loading_observer1.Wait();
+
+  LoadingObserver loading_observer2(web_contents);
+  EXPECT_TRUE(NavigateToURL(shell(), url2));
+  loading_observer2.Wait();
+
+  EXPECT_THAT(loading_observer2.GetEvents(),
+              testing::ElementsAre("DidStartLoading", "DidStartNavigation",
+                                   "DidFinishNavigation", "DidStopLoading"));
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       LoadingCallbacksOrder_AbortedNavigation) {
+  const char kPageURL[] = "/controlled_page_load.html";
+  net::test_server::ControllableHttpResponse response(embedded_test_server(),
+                                                      kPageURL);
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url = embedded_test_server()->GetURL("a.com", kPageURL);
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  LoadingObserver loading_observer(web_contents);
+  shell()->LoadURL(url);
+  response.WaitForRequest();
+  response.Send(net::HttpStatusCode::HTTP_NO_CONTENT);
+  response.Done();
+
+  loading_observer.Wait();
+
+  EXPECT_THAT(loading_observer.GetEvents(),
+              testing::ElementsAre("DidStartLoading", "DidStartNavigation",
+                                   "DidFinishNavigation", "DidStopLoading"));
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
+                       LoadingCallbacksOrder_ErrorPage) {
+  const char kPageURL[] = "/controlled_page_load.html";
+  net::test_server::ControllableHttpResponse response(embedded_test_server(),
+                                                      kPageURL);
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  GURL url = embedded_test_server()->GetURL("a.com", kPageURL);
+  WebContentsImpl* web_contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+
+  LoadingObserver loading_observer(web_contents);
+  shell()->LoadURL(url);
+  response.WaitForRequest();
+  response.Send(net::HttpStatusCode::HTTP_REQUEST_TIMEOUT);
+  response.Done();
+
+  loading_observer.Wait();
+
+  EXPECT_THAT(loading_observer.GetEvents(),
+              testing::ElementsAre(
+                  "DidStartLoading", "DidStartNavigation",
+                  "DidFinishNavigation", "DocumentAvailableInMainFrame",
+                  "DOMContentLoaded", "DidFinishLoad", "DidStartNavigation",
+                  "DidFinishNavigation", "DocumentAvailableInMainFrame",
+                  "DOMContentLoaded", "DocumentOnLoadCompletedInMainFrame",
+                  "DidFinishLoad", "DidStopLoading"));
+}
+
 }  // namespace content
diff --git a/chromium/content/browser/web_contents/web_contents_impl_unittest.cc b/chromium/content/browser/web_contents/web_contents_impl_unittest.cc
index 1c7835ab19e..0c77f019dce 100644
--- a/chromium/content/browser/web_contents/web_contents_impl_unittest.cc
+++ b/chromium/content/browser/web_contents/web_contents_impl_unittest.cc
@@ -63,6 +63,7 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/common/frame/sandbox_flags.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "url/url_constants.h"
 
@@ -348,7 +349,7 @@ class FakeFullscreenDelegate : public WebContentsDelegate {
   void EnterFullscreenModeForTab(
       WebContents* web_contents,
       const GURL& origin,
-      const blink::WebFullscreenOptions& options) override {
+      const blink::mojom::FullscreenOptions& options) override {
     fullscreened_contents_ = web_contents;
   }
 
@@ -1407,8 +1408,7 @@ TEST_F(WebContentsImplTest, NavigationExitsFullscreen) {
   // Toggle fullscreen mode on (as if initiated via IPC from renderer).
   EXPECT_FALSE(contents()->IsFullscreenForCurrentTab());
   EXPECT_FALSE(fake_delegate.IsFullscreenForTabOrPending(contents()));
-  orig_rfh->OnMessageReceived(FrameHostMsg_EnterFullscreen(
-      orig_rfh->GetRoutingID(), blink::WebFullscreenOptions()));
+  orig_rfh->EnterFullscreen(blink::mojom::FullscreenOptions::New());
   EXPECT_TRUE(contents()->IsFullscreenForCurrentTab());
   EXPECT_TRUE(fake_delegate.IsFullscreenForTabOrPending(contents()));
 
@@ -1446,8 +1446,7 @@ TEST_F(WebContentsImplTest, HistoryNavigationExitsFullscreen) {
 
   for (int i = 0; i < 2; ++i) {
     // Toggle fullscreen mode on (as if initiated via IPC from renderer).
-    orig_rfh->OnMessageReceived(FrameHostMsg_EnterFullscreen(
-        orig_rfh->GetRoutingID(), blink::WebFullscreenOptions()));
+    orig_rfh->EnterFullscreen(blink::mojom::FullscreenOptions::New());
     EXPECT_TRUE(contents()->IsFullscreenForCurrentTab());
     EXPECT_TRUE(fake_delegate.IsFullscreenForTabOrPending(contents()));
 
@@ -1478,8 +1477,7 @@ TEST_F(WebContentsImplTest, CrashExitsFullscreen) {
   // Toggle fullscreen mode on (as if initiated via IPC from renderer).
   EXPECT_FALSE(contents()->IsFullscreenForCurrentTab());
   EXPECT_FALSE(fake_delegate.IsFullscreenForTabOrPending(contents()));
-  main_test_rfh()->OnMessageReceived(FrameHostMsg_EnterFullscreen(
-      main_test_rfh()->GetRoutingID(), blink::WebFullscreenOptions()));
+  main_test_rfh()->EnterFullscreen(blink::mojom::FullscreenOptions::New());
   EXPECT_TRUE(contents()->IsFullscreenForCurrentTab());
   EXPECT_TRUE(fake_delegate.IsFullscreenForTabOrPending(contents()));
 
@@ -2792,8 +2790,9 @@ TEST_F(WebContentsImplTest, HandleWheelEvent) {
 
   int modifiers = 0;
   // Verify that normal mouse wheel events do nothing to change the zoom level.
-  blink::WebMouseWheelEvent event =
-      SyntheticWebMouseWheelEventBuilder::Build(0, 0, 0, 1, modifiers, false);
+  blink::WebMouseWheelEvent event = SyntheticWebMouseWheelEventBuilder::Build(
+      0, 0, 0, 1, modifiers,
+      ui::input_types::ScrollGranularity::kScrollByPixel);
   EXPECT_FALSE(contents()->HandleWheelEvent(event));
   EXPECT_EQ(0, delegate->GetAndResetContentsZoomChangedCallCount());
 
@@ -2801,8 +2800,9 @@ TEST_F(WebContentsImplTest, HandleWheelEvent) {
   // decreased. Except on MacOS where we never want to adjust zoom
   // with mousewheel.
   modifiers = WebInputEvent::kControlKey;
-  event =
-      SyntheticWebMouseWheelEventBuilder::Build(0, 0, 0, 1, modifiers, false);
+  event = SyntheticWebMouseWheelEventBuilder::Build(
+      0, 0, 0, 1, modifiers,
+      ui::input_types::ScrollGranularity::kScrollByPixel);
   bool handled = contents()->HandleWheelEvent(event);
 #if defined(USE_AURA)
   EXPECT_TRUE(handled);
@@ -2815,8 +2815,9 @@ TEST_F(WebContentsImplTest, HandleWheelEvent) {
 
   modifiers = WebInputEvent::kControlKey | WebInputEvent::kShiftKey |
               WebInputEvent::kAltKey;
-  event =
-      SyntheticWebMouseWheelEventBuilder::Build(0, 0, 2, -5, modifiers, false);
+  event = SyntheticWebMouseWheelEventBuilder::Build(
+      0, 0, 2, -5, modifiers,
+      ui::input_types::ScrollGranularity::kScrollByPixel);
   handled = contents()->HandleWheelEvent(event);
 #if defined(USE_AURA)
   EXPECT_TRUE(handled);
@@ -2828,8 +2829,9 @@ TEST_F(WebContentsImplTest, HandleWheelEvent) {
 #endif
 
   // Unless there is no vertical movement.
-  event =
-      SyntheticWebMouseWheelEventBuilder::Build(0, 0, 2, 0, modifiers, false);
+  event = SyntheticWebMouseWheelEventBuilder::Build(
+      0, 0, 2, 0, modifiers,
+      ui::input_types::ScrollGranularity::kScrollByPixel);
   EXPECT_FALSE(contents()->HandleWheelEvent(event));
   EXPECT_EQ(0, delegate->GetAndResetContentsZoomChangedCallCount());
 
@@ -2837,8 +2839,9 @@ TEST_F(WebContentsImplTest, HandleWheelEvent) {
   // zoom being adjusted, to avoid accidental adjustments caused by
   // two-finger-scrolling on a touchpad.
   modifiers = WebInputEvent::kControlKey;
-  event =
-      SyntheticWebMouseWheelEventBuilder::Build(0, 0, 0, 5, modifiers, true);
+  event = SyntheticWebMouseWheelEventBuilder::Build(
+      0, 0, 0, 5, modifiers,
+      ui::input_types::ScrollGranularity::kScrollByPrecisePixel);
   EXPECT_FALSE(contents()->HandleWheelEvent(event));
   EXPECT_EQ(0, delegate->GetAndResetContentsZoomChangedCallCount());
 
@@ -3230,13 +3233,13 @@ TEST_F(WebContentsImplTest, MediaWakeLock) {
   // Send a fake audio stream monitor notification.  The audio wake lock
   // should be created.
   monitor->set_was_recently_audible_for_testing(true);
-  contents()->NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+  contents()->NotifyNavigationStateChanged(INVALIDATE_TYPE_AUDIO);
   EXPECT_TRUE(has_audio_wake_lock());
 
   // Send another fake notification, this time when WasRecentlyAudible() will
   // be false.  The wake lock should be released.
   monitor->set_was_recently_audible_for_testing(false);
-  contents()->NotifyNavigationStateChanged(INVALIDATE_TYPE_TAB);
+  contents()->NotifyNavigationStateChanged(INVALIDATE_TYPE_AUDIO);
   EXPECT_FALSE(has_audio_wake_lock());
 
   main_test_rfh()->GetProcess()->SimulateCrash();
@@ -3255,8 +3258,7 @@ TEST_F(WebContentsImplTest, ThemeColorChangeDependingOnFirstVisiblePaint) {
 
   // Theme color changes should not propagate past the WebContentsImpl before
   // the first visually non-empty paint has occurred.
-  rfh->OnMessageReceived(
-      FrameHostMsg_DidChangeThemeColor(rfh->GetRoutingID(), SK_ColorRED));
+  rfh->DidChangeThemeColor(SK_ColorRED);
 
   EXPECT_EQ(SK_ColorRED, contents()->GetThemeColor());
   EXPECT_EQ(base::nullopt, observer.last_theme_color());
@@ -3269,8 +3271,7 @@ TEST_F(WebContentsImplTest, ThemeColorChangeDependingOnFirstVisiblePaint) {
   EXPECT_EQ(SK_ColorRED, observer.last_theme_color());
 
   // Additional changes made by the web contents should propagate as well.
-  rfh->OnMessageReceived(
-      FrameHostMsg_DidChangeThemeColor(rfh->GetRoutingID(), SK_ColorGREEN));
+  rfh->DidChangeThemeColor(SK_ColorGREEN);
 
   EXPECT_EQ(SK_ColorGREEN, contents()->GetThemeColor());
   EXPECT_EQ(SK_ColorGREEN, observer.last_theme_color());
diff --git a/chromium/content/browser/web_contents/web_contents_view.h b/chromium/content/browser/web_contents/web_contents_view.h
index bfb918a2cba..bff5b42b166 100644
--- a/chromium/content/browser/web_contents/web_contents_view.h
+++ b/chromium/content/browser/web_contents/web_contents_view.h
@@ -78,8 +78,7 @@ class WebContentsView {
   // Get the bounds of the View, relative to the parent.
   virtual gfx::Rect GetViewBounds() const = 0;
 
-  virtual void CreateView(
-      const gfx::Size& initial_size, gfx::NativeView context) = 0;
+  virtual void CreateView(gfx::NativeView context) = 0;
 
   // Sets up the View that holds the rendered web page, receives messages for
   // it and contains page plugins. The host view should be sized to the current
diff --git a/chromium/content/browser/web_contents/web_contents_view_android.cc b/chromium/content/browser/web_contents/web_contents_view_android.cc
index 10086ffc8ac..af081e77379 100644
--- a/chromium/content/browser/web_contents/web_contents_view_android.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_android.cc
@@ -25,6 +25,7 @@
 #include "content/public/browser/android/synchronous_compositor.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/web_contents_delegate.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/drop_data.h"
 #include "ui/android/overscroll_refresh_handler.h"
@@ -229,9 +230,7 @@ gfx::Rect WebContentsViewAndroid::GetViewBounds() const {
   return gfx::Rect(view_.GetSize());
 }
 
-void WebContentsViewAndroid::CreateView(
-    const gfx::Size& initial_size, gfx::NativeView context) {
-}
+void WebContentsViewAndroid::CreateView(gfx::NativeView context) {}
 
 RenderWidgetHostViewBase* WebContentsViewAndroid::CreateViewForWidget(
     RenderWidgetHost* render_widget_host, bool is_guest_view_hack) {
diff --git a/chromium/content/browser/web_contents/web_contents_view_android.h b/chromium/content/browser/web_contents/web_contents_view_android.h
index 37358129a48..59579dc6438 100644
--- a/chromium/content/browser/web_contents/web_contents_view_android.h
+++ b/chromium/content/browser/web_contents/web_contents_view_android.h
@@ -68,8 +68,7 @@ class WebContentsViewAndroid : public WebContentsView,
   void FocusThroughTabTraversal(bool reverse) override;
   DropData* GetDropData() const override;
   gfx::Rect GetViewBounds() const override;
-  void CreateView(const gfx::Size& initial_size,
-                  gfx::NativeView context) override;
+  void CreateView(gfx::NativeView context) override;
   RenderWidgetHostViewBase* CreateViewForWidget(
       RenderWidgetHost* render_widget_host,
       bool is_guest_view_hack) override;
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura.cc b/chromium/content/browser/web_contents/web_contents_view_aura.cc
index 15e5f49d6f4..fbefaf20752 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_aura.cc
@@ -13,6 +13,7 @@
 #include "base/command_line.h"
 #include "base/containers/flat_set.h"
 #include "base/feature_list.h"
+#include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/macros.h"
 #include "base/message_loop/message_loop_current.h"
@@ -52,7 +53,6 @@
 #include "content/public/common/child_process_host.h"
 #include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
-#include "content/public/common/drop_data.h"
 #include "net/base/filename_util.h"
 #include "third_party/blink/public/platform/web_input_event.h"
 #include "ui/aura/client/aura_constants.h"
@@ -399,6 +399,25 @@ aura::Window* GetHostWindow(aura::Window* window) {
 
 }  // namespace
 
+WebContentsViewAura::OnPerformDropContext::OnPerformDropContext(
+    RenderWidgetHostImpl* target_rwh,
+    const ui::DropTargetEvent& event,
+    std::unique_ptr<ui::OSExchangeData> data,
+    base::ScopedClosureRunner end_drag_runner,
+    base::Optional<gfx::PointF> transformed_pt,
+    gfx::PointF screen_pt)
+    : target_rwh(target_rwh->GetWeakPtr()),
+      event(event),
+      data(std::move(data)),
+      end_drag_runner(std::move(end_drag_runner)),
+      transformed_pt(std::move(transformed_pt)),
+      screen_pt(screen_pt) {}
+
+WebContentsViewAura::OnPerformDropContext::OnPerformDropContext(
+    OnPerformDropContext&&) = default;
+
+WebContentsViewAura::OnPerformDropContext::~OnPerformDropContext() = default;
+
 #if defined(OS_WIN)
 // A web contents observer that watches for navigations while an async drop
 // operation is in progress during virtual file data retrieval and temp file
@@ -936,12 +955,7 @@ Visibility WebContentsViewAura::GetVisibility() const {
 ////////////////////////////////////////////////////////////////////////////////
 // WebContentsViewAura, WebContentsView implementation:
 
-void WebContentsViewAura::CreateView(const gfx::Size& initial_size,
-                                     gfx::NativeView context) {
-  // NOTE: we ignore |initial_size| since in some cases it's wrong (such as
-  // if the bookmark bar is not shown and you create a new tab). The right
-  // value is set shortly after this, so its safe to ignore.
-
+void WebContentsViewAura::CreateView(gfx::NativeView context) {
   CreateAuraWindow(context);
 
   // delegate_->GetDragDestDelegate() creates a new delegate on every call.
@@ -1429,10 +1443,44 @@ void WebContentsViewAura::PerformDropCallback(
   if (!current_drop_data_)
     return;
 
-  const int key_modifiers = ui::EventFlagsToWebEventModifiers(event.flags());
+  OnPerformDropContext context(target_rwh, event, std::move(data),
+                               std::move(end_drag_runner), transformed_pt,
+                               screen_pt);
+  // |delegate_| may be null in unit tests.
+  if (delegate_) {
+    delegate_->OnPerformDrop(
+        *current_drop_data_,
+        base::BindOnce(&WebContentsViewAura::FinishOnPerformDropCallback,
+                       weak_ptr_factory_.GetWeakPtr(), std::move(context)));
+  } else {
+    FinishOnPerformDropCallback(
+        std::move(context),
+        WebContentsViewDelegate::DropCompletionResult::kContinue);
+  }
+}
+
+void WebContentsViewAura::FinishOnPerformDropCallback(
+    OnPerformDropContext context,
+    WebContentsViewDelegate::DropCompletionResult result) {
+  const int key_modifiers =
+      ui::EventFlagsToWebEventModifiers(context.event.flags());
+  // This is possibly an async callback.  Make sure the RWH is still valid.
+  if (!context.target_rwh || !IsValidDragTarget(context.target_rwh.get()))
+    return;
+
+  if (result != WebContentsViewDelegate::DropCompletionResult::kContinue) {
+    if (!drop_callback_for_testing_.is_null()) {
+      std::move(drop_callback_for_testing_)
+          .Run(context.target_rwh.get(), *current_drop_data_,
+               context.transformed_pt.value(), context.screen_pt, key_modifiers,
+               /*drop_allowed=*/false);
+    }
+    return;
+  }
+
 #if defined(OS_WIN)
   if (ShouldIncludeVirtualFiles(*current_drop_data_) &&
-      data->HasVirtualFilenames()) {
+      context.data->HasVirtualFilenames()) {
     // Asynchronously retrieve the actual content of any virtual files now (this
     // step is not needed for "real" files already on the file system, e.g.
     // those dropped on Chromium from the desktop). When all content has been
@@ -1446,22 +1494,23 @@ void WebContentsViewAura::PerformDropCallback(
     // GetVirtualFilesAsTempFiles will immediately return false if there are no
     // virtual files to retrieve (all items are folders e.g.) and no callback
     // will be received.
-    if (data->GetVirtualFilesAsTempFiles(std::move(callback))) {
+    if (context.data->GetVirtualFilesAsTempFiles(std::move(callback))) {
       // Cache the parameters as they were at the time of the drop. This is
       // needed for checking that the drop target is still valid when the async
       // operation completes.
       async_drop_navigation_observer_ =
           std::make_unique<AsyncDropNavigationObserver>(
               web_contents_, std::move(current_drop_data_),
-              std::move(end_drag_runner), target_rwh, transformed_pt.value(),
-              screen_pt, key_modifiers);
+              std::move(context.end_drag_runner), context.target_rwh.get(),
+              context.transformed_pt.value(), context.screen_pt, key_modifiers);
       return;
     }
   }
 
 #endif
-  CompleteDrop(target_rwh, *current_drop_data_, transformed_pt.value(),
-               screen_pt, key_modifiers);
+  CompleteDrop(context.target_rwh.get(), *current_drop_data_,
+               context.transformed_pt.value(), context.screen_pt,
+               key_modifiers);
   current_drop_data_.reset();
 }
 
@@ -1490,7 +1539,7 @@ void WebContentsViewAura::CompleteDrop(RenderWidgetHostImpl* target_rwh,
   if (!drop_callback_for_testing_.is_null()) {
     std::move(drop_callback_for_testing_)
         .Run(target_rwh, drop_data, client_pt, screen_pt, key_modifiers,
-             /*drop_allowed*/ true);
+             /*drop_allowed=*/true);
   }
 }
 
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura.h b/chromium/content/browser/web_contents/web_contents_view_aura.h
index 428c5afe4cd..180f4fa00e4 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura.h
+++ b/chromium/content/browser/web_contents/web_contents_view_aura.h
@@ -14,6 +14,7 @@
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/weak_ptr.h"
+#include "base/optional.h"
 #include "build/build_config.h"
 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
 #include "content/browser/web_contents/web_contents_view.h"
@@ -21,9 +22,12 @@
 #include "content/common/content_export.h"
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/visibility.h"
+#include "content/public/browser/web_contents_view_delegate.h"
+#include "content/public/common/drop_data.h"
 #include "ui/aura/client/drag_drop_delegate.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_delegate.h"
+#include "ui/base/dragdrop/drop_target_event.h"
 
 namespace ui {
 class DropTargetEvent;
@@ -35,7 +39,6 @@ class GestureNavSimple;
 class RenderWidgetHostImpl;
 class RenderWidgetHostViewAura;
 class TouchSelectionControllerClientAura;
-class WebContentsViewDelegate;
 class WebContentsImpl;
 class WebDragDestDelegate;
 
@@ -65,6 +68,27 @@ class CONTENT_EXPORT WebContentsViewAura
       RenderWidgetHostViewCreateFunction create_render_widget_host_view);
 
  private:
+  // A structure used to keep drop context for asynchronously finishing a
+  // drop operation.  This is required because some drop event data gets
+  // cleared out once PerformDropCallback() returns.
+  struct CONTENT_EXPORT OnPerformDropContext {
+    OnPerformDropContext(RenderWidgetHostImpl* target_rwh,
+                         const ui::DropTargetEvent& event,
+                         std::unique_ptr<ui::OSExchangeData> data,
+                         base::ScopedClosureRunner end_drag_runner,
+                         base::Optional<gfx::PointF> transformed_pt,
+                         gfx::PointF screen_pt);
+    OnPerformDropContext(OnPerformDropContext&& other);
+    ~OnPerformDropContext();
+
+    base::WeakPtr<RenderWidgetHostImpl> target_rwh;
+    ui::DropTargetEvent event;
+    std::unique_ptr<ui::OSExchangeData> data;
+    base::ScopedClosureRunner end_drag_runner;
+    base::Optional<gfx::PointF> transformed_pt;
+    gfx::PointF screen_pt;
+  };
+
   friend class WebContentsViewAuraTest;
   FRIEND_TEST_ALL_PREFIXES(WebContentsViewAuraTest, EnableDisableOverscroll);
   FRIEND_TEST_ALL_PREFIXES(WebContentsViewAuraTest, DragDropFiles);
@@ -75,6 +99,8 @@ class CONTENT_EXPORT WebContentsViewAura
                            DragDropVirtualFilesOriginateFromRenderer);
   FRIEND_TEST_ALL_PREFIXES(WebContentsViewAuraTest, DragDropUrlData);
   FRIEND_TEST_ALL_PREFIXES(WebContentsViewAuraTest, DragDropOnOopif);
+  FRIEND_TEST_ALL_PREFIXES(WebContentsViewAuraTest, OnPerformDrop_DeepScanOK);
+  FRIEND_TEST_ALL_PREFIXES(WebContentsViewAuraTest, OnPerformDrop_DeepScanBad);
 
   class WindowObserver;
 
@@ -119,8 +145,7 @@ class CONTENT_EXPORT WebContentsViewAura
   void FocusThroughTabTraversal(bool reverse) override;
   DropData* GetDropData() const override;
   gfx::Rect GetViewBounds() const override;
-  void CreateView(const gfx::Size& initial_size,
-                  gfx::NativeView context) override;
+  void CreateView(gfx::NativeView context) override;
   RenderWidgetHostViewBase* CreateViewForWidget(
       RenderWidgetHost* render_widget_host,
       bool is_guest_view_hack) override;
@@ -208,6 +233,11 @@ class CONTENT_EXPORT WebContentsViewAura
                            base::WeakPtr<RenderWidgetHostViewBase> target,
                            base::Optional<gfx::PointF> transformed_pt);
 
+  // Called from PerformDropCallback() to finish processing the drop.
+  void FinishOnPerformDropCallback(
+      OnPerformDropContext context,
+      WebContentsViewDelegate::DropCompletionResult result);
+
   // Completes a drop operation by communicating the drop data to the renderer
   // process.
   void CompleteDrop(RenderWidgetHostImpl* target_rwh,
@@ -298,7 +328,7 @@ class CONTENT_EXPORT WebContentsViewAura
 
   bool init_rwhv_with_null_parent_for_testing_;
 
-  // Used to ensure the drag and drop callbacks bound to this
+  // Used to ensure that the drag and drop callbacks bound to this
   // object are canceled when this object is destroyed.
   base::WeakPtrFactory<WebContentsViewAura> weak_ptr_factory_{this};
 
diff --git a/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc b/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc
index 3e0aa3596a6..781c0f49e76 100644
--- a/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_aura_browsertest.cc
@@ -34,6 +34,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/browser/web_contents_view_delegate.h"
 #include "content/public/browser/web_drag_dest_delegate.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
@@ -54,6 +55,8 @@
 #include "ui/events/event_utils.h"
 #include "ui/events/test/event_generator.h"
 
+namespace content {
+
 namespace {
 
 // TODO(tdresser): Find a way to avoid sleeping like this. See crbug.com/405282
@@ -66,10 +69,22 @@ void GiveItSomeTime() {
   run_loop.Run();
 }
 
-}  //namespace
+// A test delegate used in drag and drop tests to simulate either good or bad
+// deep scans of data.
+class TestWebContentsViewDelegate : public WebContentsViewDelegate {
+ public:
+  TestWebContentsViewDelegate(DropCompletionResult result) : result_(result) {}
 
+  void OnPerformDrop(const DropData& drop_data,
+                     DropCompletionCallback callback) override {
+    std::move(callback).Run(result_);
+  }
 
-namespace content {
+ private:
+  DropCompletionResult result_;
+};
+
+}  // namespace
 
 class WebContentsViewAuraTest : public ContentBrowserTest {
  public:
@@ -85,7 +100,7 @@ class WebContentsViewAuraTest : public ContentBrowserTest {
       test_url = GURL(url);
     else
       test_url = GURL(embedded_test_server()->GetURL(url));
-    NavigateToURL(shell(), test_url);
+    EXPECT_TRUE(NavigateToURL(shell(), test_url));
 
     frame_observer_ = std::make_unique<RenderFrameSubmissionObserver>(
         shell()->web_contents());
@@ -252,15 +267,19 @@ class WebContentsViewAuraTest : public ContentBrowserTest {
     }
     void OnDragOver() override {}
     void OnDragEnter() override {}
-    void OnDrop() override {}
-    void OnDragLeave() override {}
+    void OnDrop() override { on_drop_called_ = true; }
+    void OnDragLeave() override { on_drag_leave_called_ = true; }
     void OnReceiveDragData(const ui::OSExchangeData& data) override {}
 
     void Reset() { drag_initialize_called_ = false; }
     bool GetDragInitializeCalled() { return drag_initialize_called_; }
+    bool GetOnDropCalled() { return on_drop_called_; }
+    bool GetOnDragLeaveCalled() { return on_drag_leave_called_; }
 
    private:
     bool drag_initialize_called_ = false;
+    bool on_drop_called_ = false;
+    bool on_drag_leave_called_ = false;
   };
 
   // ContentBrowserTest:
@@ -606,6 +625,72 @@ IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest, DragDropOnOopif) {
   }
 }
 
+IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest, OnPerformDrop_DeepScanOK) {
+  StartTestWithPage("/simple_page.html");
+  WebContentsImpl* contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  WebContentsViewAura* view =
+      static_cast<WebContentsViewAura*>(contents->GetView());
+
+  drag_dest_delegate_.Reset();
+  view->SetDragDestDelegateForTesting(&drag_dest_delegate_);
+
+  // The view takes ownership of the delegate.  The delegate simulates that
+  // the scans passed.
+  view->SetDelegateForTesting(new TestWebContentsViewDelegate(
+      WebContentsViewDelegate::DropCompletionResult::kContinue));
+
+  std::unique_ptr<ui::OSExchangeData> data =
+      std::make_unique<ui::OSExchangeData>();
+  view->RegisterDropCallbackForTesting(base::BindOnce(
+      &WebContentsViewAuraTest::OnDropComplete, base::Unretained(this)));
+  base::RunLoop run_loop;
+  async_drop_closure_ = run_loop.QuitClosure();
+
+  gfx::PointF point = {10, 10};
+  ui::DropTargetEvent event(*data.get(), point, point,
+                            ui::DragDropTypes::DRAG_COPY);
+  view->OnDragEntered(event);
+  EXPECT_TRUE(drag_dest_delegate_.GetDragInitializeCalled());
+  view->OnPerformDrop(event, std::move(data));
+  run_loop.Run();
+
+  EXPECT_TRUE(drag_dest_delegate_.GetOnDropCalled());
+}
+
+IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest, OnPerformDrop_DeepScanBad) {
+  StartTestWithPage("/simple_page.html");
+  WebContentsImpl* contents =
+      static_cast<WebContentsImpl*>(shell()->web_contents());
+  WebContentsViewAura* view =
+      static_cast<WebContentsViewAura*>(contents->GetView());
+
+  drag_dest_delegate_.Reset();
+  view->SetDragDestDelegateForTesting(&drag_dest_delegate_);
+
+  // The view takes ownership of the delegate.  The delegate simulates that
+  // the scans failed.
+  view->SetDelegateForTesting(new TestWebContentsViewDelegate(
+      WebContentsViewDelegate::DropCompletionResult::kAbort));
+
+  std::unique_ptr<ui::OSExchangeData> data =
+      std::make_unique<ui::OSExchangeData>();
+  view->RegisterDropCallbackForTesting(base::BindOnce(
+      &WebContentsViewAuraTest::OnDropComplete, base::Unretained(this)));
+  base::RunLoop run_loop;
+  async_drop_closure_ = run_loop.QuitClosure();
+
+  gfx::PointF point = {10, 10};
+  ui::DropTargetEvent event(*data.get(), point, point,
+                            ui::DragDropTypes::DRAG_COPY);
+  view->OnDragEntered(event);
+  EXPECT_TRUE(drag_dest_delegate_.GetDragInitializeCalled());
+  view->OnPerformDrop(event, std::move(data));
+  run_loop.Run();
+
+  EXPECT_FALSE(drag_dest_delegate_.GetOnDropCalled());
+}
+
 IN_PROC_BROWSER_TEST_F(WebContentsViewAuraTest, ContentWindowClose) {
   ASSERT_NO_FATAL_FAILURE(StartTestWithPage("/overscroll_navigation.html"));
 
diff --git a/chromium/content/browser/web_contents/web_contents_view_child_frame.cc b/chromium/content/browser/web_contents/web_contents_view_child_frame.cc
index 1a68298648a..a766385cf58 100644
--- a/chromium/content/browser/web_contents/web_contents_view_child_frame.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_child_frame.cc
@@ -77,8 +77,7 @@ gfx::Rect WebContentsViewChildFrame::GetViewBounds() const {
   return gfx::Rect();
 }
 
-void WebContentsViewChildFrame::CreateView(const gfx::Size& initial_size,
-                                           gfx::NativeView context) {
+void WebContentsViewChildFrame::CreateView(gfx::NativeView context) {
   // The WebContentsViewChildFrame does not have a native view.
 }
 
diff --git a/chromium/content/browser/web_contents/web_contents_view_child_frame.h b/chromium/content/browser/web_contents/web_contents_view_child_frame.h
index 8aaa80183dd..412bb35e4b6 100644
--- a/chromium/content/browser/web_contents/web_contents_view_child_frame.h
+++ b/chromium/content/browser/web_contents/web_contents_view_child_frame.h
@@ -36,8 +36,7 @@ class WebContentsViewChildFrame : public WebContentsView,
   void FocusThroughTabTraversal(bool reverse) override;
   DropData* GetDropData() const override;
   gfx::Rect GetViewBounds() const override;
-  void CreateView(const gfx::Size& initial_size,
-                  gfx::NativeView context) override;
+  void CreateView(gfx::NativeView context) override;
   RenderWidgetHostViewBase* CreateViewForWidget(
       RenderWidgetHost* render_widget_host,
       bool is_guest_view_hack) override;
diff --git a/chromium/content/browser/web_contents/web_contents_view_guest.cc b/chromium/content/browser/web_contents/web_contents_view_guest.cc
index ecaf30bcb7b..c45581fd22b 100644
--- a/chromium/content/browser/web_contents/web_contents_view_guest.cc
+++ b/chromium/content/browser/web_contents/web_contents_view_guest.cc
@@ -113,10 +113,8 @@ gfx::Rect WebContentsViewGuest::GetViewBounds() const {
   return gfx::Rect(size_);
 }
 
-void WebContentsViewGuest::CreateView(const gfx::Size& initial_size,
-                                      gfx::NativeView context) {
-  platform_view_->CreateView(initial_size, context);
-  size_ = initial_size;
+void WebContentsViewGuest::CreateView(gfx::NativeView context) {
+  platform_view_->CreateView(context);
 }
 
 RenderWidgetHostViewBase* WebContentsViewGuest::CreateViewForWidget(
diff --git a/chromium/content/browser/web_contents/web_contents_view_guest.h b/chromium/content/browser/web_contents/web_contents_view_guest.h
index 913fbc4bb00..12aa7cd4799 100644
--- a/chromium/content/browser/web_contents/web_contents_view_guest.h
+++ b/chromium/content/browser/web_contents/web_contents_view_guest.h
@@ -54,8 +54,7 @@ class WebContentsViewGuest : public WebContentsView,
   void FocusThroughTabTraversal(bool reverse) override;
   DropData* GetDropData() const override;
   gfx::Rect GetViewBounds() const override;
-  void CreateView(const gfx::Size& initial_size,
-                  gfx::NativeView context) override;
+  void CreateView(gfx::NativeView context) override;
   RenderWidgetHostViewBase* CreateViewForWidget(
       RenderWidgetHost* render_widget_host,
       bool is_guest_view_hack) override;
diff --git a/chromium/content/browser/web_contents/web_contents_view_mac.h b/chromium/content/browser/web_contents/web_contents_view_mac.h
index 35da7e53b6a..6fdec8c0a5e 100644
--- a/chromium/content/browser/web_contents/web_contents_view_mac.h
+++ b/chromium/content/browser/web_contents/web_contents_view_mac.h
@@ -73,8 +73,7 @@ class WebContentsViewMac : public WebContentsView,
   void FocusThroughTabTraversal(bool reverse) override;
   DropData* GetDropData() const override;
   gfx::Rect GetViewBounds() const override;
-  void CreateView(const gfx::Size& initial_size,
-                  gfx::NativeView context) override;
+  void CreateView(gfx::NativeView context) override;
   RenderWidgetHostViewBase* CreateViewForWidget(
       RenderWidgetHost* render_widget_host,
       bool is_guest_view_hack) override;
diff --git a/chromium/content/browser/web_contents/web_contents_view_mac.mm b/chromium/content/browser/web_contents/web_contents_view_mac.mm
index b35b9b48b53..4721a9b3f51 100644
--- a/chromium/content/browser/web_contents/web_contents_view_mac.mm
+++ b/chromium/content/browser/web_contents/web_contents_view_mac.mm
@@ -315,8 +315,7 @@ gfx::Rect WebContentsViewMac::GetViewBounds() const {
   return gfx::ScreenRectFromNSRect(window_bounds);
 }
 
-void WebContentsViewMac::CreateView(
-    const gfx::Size& initial_size, gfx::NativeView context) {
+void WebContentsViewMac::CreateView(gfx::NativeView context) {
   in_process_ns_view_bridge_ =
       std::make_unique<remote_cocoa::WebContentsNSViewBridge>(ns_view_id_,
                                                               this);
diff --git a/chromium/content/browser/web_contents_binding_set_browsertest.cc b/chromium/content/browser/web_contents_binding_set_browsertest.cc
index c375f877460..20872b5f526 100644
--- a/chromium/content/browser/web_contents_binding_set_browsertest.cc
+++ b/chromium/content/browser/web_contents_binding_set_browsertest.cc
@@ -66,7 +66,7 @@ class TestFrameInterfaceBinder : public mojom::WebContentsFrameBindingSetTest {
 }  // namespace
 
 IN_PROC_BROWSER_TEST_F(WebContentsBindingSetBrowserTest, OverrideForTesting) {
-  NavigateToURL(shell(), GURL("data:text/html,ho hum"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("data:text/html,ho hum")));
 
   // Ensure that we can add a WebContentsFrameBindingSet and then override its
   // request handler.
diff --git a/chromium/content/browser/web_package/bundled_exchanges_browsertest.cc b/chromium/content/browser/web_package/bundled_exchanges_browsertest.cc
index c4d6bd797cd..c123472718a 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_browsertest.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_browsertest.cc
@@ -3,25 +3,112 @@
 // found in the LICENSE file.
 
 #include "base/files/file_path.h"
+#include "base/files/file_util.h"
 #include "base/optional.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/system/sys_info.h"
+#include "base/test/scoped_feature_list.h"
+#include "base/threading/thread_restrictions.h"
 #include "build/build_config.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/navigation_handle.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/shell/browser/shell.h"
 #include "net/base/filename_util.h"
 
+#if defined(OS_ANDROID)
+#include "base/android/content_uri_utils.h"
+#endif  // OS_ANDROID
+
 namespace content {
 namespace {
 
+// "%2F" is treated as an invalid character for file URLs.
+constexpr char kInvalidFileUrl[] = "file:///tmp/test%2F/a.wbn";
+
+constexpr char kTestPageUrl[] = "https://test.example.org/";
+constexpr char kTestPage1Url[] = "https://test.example.org/page1.html";
+constexpr char kTestPage2Url[] = "https://test.example.org/page2.html";
+constexpr char kTestPageForHashUrl[] =
+    "https://test.example.org/hash.html#hello";
+
+base::FilePath GetTestDataPath(base::StringPiece file) {
+  base::FilePath test_data_dir;
+  CHECK(base::PathService::Get(base::DIR_SOURCE_ROOT, &test_data_dir));
+  return test_data_dir
+      .Append(base::FilePath(
+          FILE_PATH_LITERAL("content/test/data/bundled_exchanges")))
+      .AppendASCII(file);
+}
+
+#if defined(OS_ANDROID)
+GURL CopyFileAndGetContentUri(const base::FilePath& file) {
+  base::ScopedAllowBlockingForTesting allow_blocking;
+  base::FilePath tmp_dir;
+  CHECK(base::GetTempDir(&tmp_dir));
+  // The directory name "bundled_exchanges" must be kept in sync with
+  // content/shell/android/browsertests_apk/res/xml/file_paths.xml
+  base::FilePath tmp_wbn_dir = tmp_dir.AppendASCII("bundled_exchanges");
+  CHECK(base::CreateDirectoryAndGetError(tmp_wbn_dir, nullptr));
+  base::FilePath tmp_dir_in_tmp_wbn_dir;
+  CHECK(
+      base::CreateTemporaryDirInDir(tmp_wbn_dir, "", &tmp_dir_in_tmp_wbn_dir));
+  base::FilePath temp_file = tmp_dir_in_tmp_wbn_dir.Append(file.BaseName());
+  CHECK(base::CopyFile(file, temp_file));
+  return GURL(base::GetContentUriFromFilePath(temp_file).value());
+}
+#endif  // OS_ANDROID
+
+class BundledExchangesBrowserTestBase : public ContentBrowserTest {
+ protected:
+  BundledExchangesBrowserTestBase() = default;
+  ~BundledExchangesBrowserTestBase() override = default;
+
+  void NavigateToBundleAndWaitForReady(const GURL& test_data_url,
+                                       const GURL& expected_commit_url) {
+    base::string16 expected_title = base::ASCIIToUTF16("Ready");
+    TitleWatcher title_watcher(shell()->web_contents(), expected_title);
+    EXPECT_TRUE(NavigateToURL(shell()->web_contents(), test_data_url,
+                              expected_commit_url));
+    EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
+  }
+
+  void RunTestScript(const std::string& script) {
+    EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
+                              "loadScript('" + script + "');"));
+    base::string16 ok = base::ASCIIToUTF16("OK");
+    TitleWatcher title_watcher(shell()->web_contents(), ok);
+    title_watcher.AlsoWaitForTitle(base::ASCIIToUTF16("FAIL"));
+    EXPECT_EQ(ok, title_watcher.WaitAndGetTitle());
+  }
+
+  void ExecuteScriptAndWaitForTitle(const std::string& script,
+                                    const std::string& title) {
+    base::string16 title16 = base::ASCIIToUTF16(title);
+    TitleWatcher title_watcher(shell()->web_contents(), title16);
+    EXPECT_TRUE(ExecuteScript(shell()->web_contents(), script));
+    EXPECT_EQ(title16, title_watcher.WaitAndGetTitle());
+  }
+
+  void NavigateToURLAndWaitForTitle(const GURL& url, const std::string& title) {
+    ExecuteScriptAndWaitForTitle(
+        base::StringPrintf("location.href = '%s';", url.spec().c_str()), title);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(BundledExchangesBrowserTestBase);
+};
+
 class TestBrowserClient : public ContentBrowserClient {
  public:
   TestBrowserClient() = default;
@@ -52,91 +139,221 @@ class FinishNavigationObserver : public WebContentsObserver {
   DISALLOW_COPY_AND_ASSIGN(FinishNavigationObserver);
 };
 
+ContentBrowserClient* MaybeSetBrowserClientForTesting(
+    ContentBrowserClient* browser_client) {
+#if defined(OS_ANDROID)
+  // TODO(crbug.com/864403): It seems that we call unsupported Android APIs on
+  // KitKat when we set a ContentBrowserClient. Don't call such APIs and make
+  // this test available on KitKat.
+  int32_t major_version = 0, minor_version = 0, bugfix_version = 0;
+  base::SysInfo::OperatingSystemVersionNumbers(&major_version, &minor_version,
+                                               &bugfix_version);
+  if (major_version < 5)
+    return nullptr;
+#endif  // defined(OS_ANDROID)
+  return SetBrowserClientForTesting(browser_client);
+}
+
 }  // namespace
 
-class BundledExchangesTrustableFileBrowserTest : public ContentBrowserTest {
+class InvalidTrustableBundledExchangesFileUrlBrowserTest
+    : public ContentBrowserTest {
  protected:
-  BundledExchangesTrustableFileBrowserTest() {}
-  ~BundledExchangesTrustableFileBrowserTest() override = default;
+  InvalidTrustableBundledExchangesFileUrlBrowserTest() = default;
+  ~InvalidTrustableBundledExchangesFileUrlBrowserTest() override = default;
 
-  void SetUp() override {
-    test_data_path_ = GetTestDataPath();
-    ContentBrowserTest::SetUp();
+  void SetUpOnMainThread() override {
+    ContentBrowserTest::SetUpOnMainThread();
+    original_client_ = MaybeSetBrowserClientForTesting(&browser_client_);
   }
 
+  void TearDownOnMainThread() override {
+    ContentBrowserTest::TearDownOnMainThread();
+    if (original_client_)
+      SetBrowserClientForTesting(original_client_);
+  }
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitchASCII(switches::kTrustableBundledExchangesFileUrl,
+                                    kInvalidFileUrl);
+  }
+
+  ContentBrowserClient* original_client_ = nullptr;
+
+ private:
+  TestBrowserClient browser_client_;
+
+  DISALLOW_COPY_AND_ASSIGN(InvalidTrustableBundledExchangesFileUrlBrowserTest);
+};
+
+IN_PROC_BROWSER_TEST_F(InvalidTrustableBundledExchangesFileUrlBrowserTest,
+                       NoCrashOnNavigation) {
+  // Don't run the test if we couldn't override BrowserClient. It happens only
+  // on Android Kitkat or older systems.
+  if (!original_client_)
+    return;
+  base::RunLoop run_loop;
+  FinishNavigationObserver finish_navigation_observer(shell()->web_contents(),
+                                                      run_loop.QuitClosure());
+  EXPECT_FALSE(NavigateToURL(shell()->web_contents(), GURL(kInvalidFileUrl)));
+  run_loop.Run();
+  ASSERT_TRUE(finish_navigation_observer.error_code());
+  EXPECT_EQ(net::ERR_INVALID_URL, *finish_navigation_observer.error_code());
+}
+
+class BundledExchangesTrustableFileBrowserTestBase
+    : public BundledExchangesBrowserTestBase {
+ protected:
+  BundledExchangesTrustableFileBrowserTestBase() = default;
+  ~BundledExchangesTrustableFileBrowserTestBase() override = default;
+
+  void SetUp() override { BundledExchangesBrowserTestBase::SetUp(); }
+
   void SetUpOnMainThread() override {
-    ContentBrowserTest::SetUpOnMainThread();
-#if defined(OS_ANDROID)
-    // TODO(crbug.com/864403): It seems that we call unsupported Android APIs on
-    // KitKat when we set a ContentBrowserClient. Don't call such APIs and make
-    // this test available on KitKat.
-    int32_t major_version = 0, minor_version = 0, bugfix_version = 0;
-    base::SysInfo::OperatingSystemVersionNumbers(&major_version, &minor_version,
-                                                 &bugfix_version);
-    if (major_version < 5)
-      return;
-#endif
-    original_client_ = SetBrowserClientForTesting(&browser_client_);
+    BundledExchangesBrowserTestBase::SetUpOnMainThread();
+    original_client_ = MaybeSetBrowserClientForTesting(&browser_client_);
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
-    command_line->AppendSwitchPath(switches::kTrustableBundledExchangesFile,
-                                   test_data_path());
+    command_line->AppendSwitchASCII(switches::kTrustableBundledExchangesFileUrl,
+                                    test_data_url().spec());
   }
 
   void TearDownOnMainThread() override {
-    ContentBrowserTest::TearDownOnMainThread();
+    BundledExchangesBrowserTestBase::TearDownOnMainThread();
     if (original_client_)
       SetBrowserClientForTesting(original_client_);
   }
 
-  virtual base::FilePath GetTestDataPath() const {
-    base::FilePath test_data_dir;
-    CHECK(base::PathService::Get(base::DIR_SOURCE_ROOT, &test_data_dir));
-    return test_data_dir.AppendASCII("services")
-        .AppendASCII("test")
-        .AppendASCII("data")
-        .AppendASCII("bundled_exchanges")
-        .AppendASCII("hello.wbn");
-  }
-
-  const base::FilePath& test_data_path() const { return test_data_path_; }
+  const GURL& test_data_url() const { return test_data_url_; }
 
   ContentBrowserClient* original_client_ = nullptr;
+  GURL test_data_url_;
 
  private:
   TestBrowserClient browser_client_;
-  base::FilePath test_data_path_;
 
+  DISALLOW_COPY_AND_ASSIGN(BundledExchangesTrustableFileBrowserTestBase);
+};
+
+enum class TestFilePathMode {
+  kNormalFilePath,
+#if defined(OS_ANDROID)
+  kContentURI,
+#endif  // OS_ANDROID
+};
+
+class BundledExchangesTrustableFileBrowserTest
+    : public testing::WithParamInterface<TestFilePathMode>,
+      public BundledExchangesTrustableFileBrowserTestBase {
+ protected:
+  BundledExchangesTrustableFileBrowserTest() {
+    if (GetParam() == TestFilePathMode::kNormalFilePath) {
+      test_data_url_ = net::FilePathToFileURL(
+          GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+      return;
+    }
+#if defined(OS_ANDROID)
+    DCHECK_EQ(TestFilePathMode::kContentURI, GetParam());
+    test_data_url_ = CopyFileAndGetContentUri(
+        GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+#endif  // OS_ANDROID
+  }
+  ~BundledExchangesTrustableFileBrowserTest() override = default;
+
+ private:
   DISALLOW_COPY_AND_ASSIGN(BundledExchangesTrustableFileBrowserTest);
 };
 
-IN_PROC_BROWSER_TEST_F(BundledExchangesTrustableFileBrowserTest,
+IN_PROC_BROWSER_TEST_P(BundledExchangesTrustableFileBrowserTest,
                        TrustableBundledExchangesFile) {
   // Don't run the test if we couldn't override BrowserClient. It happens only
   // on Android Kitkat or older systems.
   if (!original_client_)
     return;
+  NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
+}
 
-  base::string16 expected_title = base::ASCIIToUTF16("Done");
-  TitleWatcher title_watcher(shell()->web_contents(), expected_title);
-  EXPECT_TRUE(NavigateToURL(shell()->web_contents(),
-                            net::FilePathToFileURL(test_data_path()),
-                            GURL("https://test.example.org/")));
-  EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
+IN_PROC_BROWSER_TEST_P(BundledExchangesTrustableFileBrowserTest, RangeRequest) {
+  // Don't run the test if we couldn't override BrowserClient. It happens only
+  // on Android Kitkat or older systems.
+  if (!original_client_)
+    return;
+
+  NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
+  RunTestScript("test-range-request.js");
+}
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesTrustableFileBrowserTest, Navigations) {
+  // Don't run the test if we couldn't override BrowserClient. It happens only
+  // on Android Kitkat or older systems.
+  if (!original_client_)
+    return;
+
+  NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
+  // Move to page 1.
+  NavigateToURLAndWaitForTitle(GURL(kTestPage1Url), "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            GURL(kTestPage1Url));
+  // Move to page 2.
+  NavigateToURLAndWaitForTitle(GURL(kTestPage2Url), "Page 2");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            GURL(kTestPage2Url));
+  // Back to page 1.
+  ExecuteScriptAndWaitForTitle("history.back();", "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            GURL(kTestPage1Url));
+
+  // Back to the initial page.
+  ExecuteScriptAndWaitForTitle("history.back();", "Ready");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(), GURL(kTestPageUrl));
+
+  // Move to page 1.
+  ExecuteScriptAndWaitForTitle("history.forward();", "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            GURL(kTestPage1Url));
+
+  // Reload.
+  ExecuteScriptAndWaitForTitle("document.title = 'reset';", "reset");
+  ExecuteScriptAndWaitForTitle("location.reload();", "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            GURL(kTestPage1Url));
+
+  // Move to page 2.
+  ExecuteScriptAndWaitForTitle("history.forward();", "Page 2");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            GURL(kTestPage2Url));
 }
 
+IN_PROC_BROWSER_TEST_P(BundledExchangesTrustableFileBrowserTest,
+                       NavigationWithHash) {
+  // Don't run the test if we couldn't override BrowserClient. It happens only
+  // on Android Kitkat or older systems.
+  if (!original_client_)
+    return;
+  NavigateToBundleAndWaitForReady(test_data_url(), GURL(kTestPageUrl));
+  NavigateToURLAndWaitForTitle(GURL(kTestPageForHashUrl), "#hello");
+}
+
+INSTANTIATE_TEST_SUITE_P(BundledExchangesTrustableFileBrowserTests,
+                         BundledExchangesTrustableFileBrowserTest,
+                         testing::Values(TestFilePathMode::kNormalFilePath
+#if defined(OS_ANDROID)
+                                         ,
+                                         TestFilePathMode::kContentURI
+#endif  // OS_ANDROID
+                                         ));
+
 class BundledExchangesTrustableFileNotFoundBrowserTest
-    : public BundledExchangesTrustableFileBrowserTest {
+    : public BundledExchangesTrustableFileBrowserTestBase {
  protected:
-  BundledExchangesTrustableFileNotFoundBrowserTest() = default;
-  ~BundledExchangesTrustableFileNotFoundBrowserTest() override = default;
-
-  base::FilePath GetTestDataPath() const override {
+  BundledExchangesTrustableFileNotFoundBrowserTest() {
     base::FilePath test_data_dir;
     CHECK(base::PathService::Get(base::DIR_SOURCE_ROOT, &test_data_dir));
-    return test_data_dir.AppendASCII("not_found");
+    test_data_url_ =
+        net::FilePathToFileURL(test_data_dir.AppendASCII("not_found"));
   }
+  ~BundledExchangesTrustableFileNotFoundBrowserTest() override = default;
 };
 
 IN_PROC_BROWSER_TEST_F(BundledExchangesTrustableFileNotFoundBrowserTest,
@@ -146,16 +363,241 @@ IN_PROC_BROWSER_TEST_F(BundledExchangesTrustableFileNotFoundBrowserTest,
   if (!original_client_)
     return;
 
+  WebContents* web_contents = shell()->web_contents();
+  ConsoleObserverDelegate console_delegate(web_contents, "*");
+  web_contents->SetDelegate(&console_delegate);
   base::RunLoop run_loop;
-  FinishNavigationObserver finish_navigation_observer(shell()->web_contents(),
+  FinishNavigationObserver finish_navigation_observer(web_contents,
+                                                      run_loop.QuitClosure());
+  EXPECT_FALSE(NavigateToURL(web_contents, test_data_url()));
+  run_loop.Run();
+  ASSERT_TRUE(finish_navigation_observer.error_code());
+  EXPECT_EQ(net::ERR_INVALID_BUNDLED_EXCHANGES,
+            *finish_navigation_observer.error_code());
+  if (console_delegate.messages().empty())
+    console_delegate.Wait();
+
+  EXPECT_FALSE(console_delegate.messages().empty());
+  EXPECT_EQ("Failed to read metadata of Web Bundle file: FILE_ERROR_FAILED",
+            console_delegate.message());
+}
+
+class BundledExchangesFileBrowserTest
+    : public testing::WithParamInterface<TestFilePathMode>,
+      public BundledExchangesBrowserTestBase {
+ protected:
+  BundledExchangesFileBrowserTest() = default;
+  ~BundledExchangesFileBrowserTest() override = default;
+
+  void SetUp() override {
+    feature_list_.InitWithFeatures({features::kWebBundles}, {});
+    BundledExchangesBrowserTestBase::SetUp();
+  }
+
+  GURL GetTestUrlForFile(base::FilePath file_path) const {
+    switch (GetParam()) {
+      case TestFilePathMode::kNormalFilePath:
+        return net::FilePathToFileURL(file_path);
+#if defined(OS_ANDROID)
+      case TestFilePathMode::kContentURI:
+        return CopyFileAndGetContentUri(file_path);
+#endif  // OS_ANDROID
+    }
+  }
+
+ private:
+  base::test::ScopedFeatureList feature_list_;
+
+  DISALLOW_COPY_AND_ASSIGN(BundledExchangesFileBrowserTest);
+};
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest, BasicNavigation) {
+  const GURL test_data_url =
+      GetTestUrlForFile(GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+  NavigateToBundleAndWaitForReady(
+      test_data_url,
+      bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+          test_data_url, GURL(kTestPageUrl)));
+}
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest, Navigations) {
+  const GURL test_data_url =
+      GetTestUrlForFile(GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+  NavigateToBundleAndWaitForReady(
+      test_data_url,
+      bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+          test_data_url, GURL(kTestPageUrl)));
+  // Move to page 1.
+  NavigateToURLAndWaitForTitle(GURL(kTestPage1Url), "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPage1Url)));
+  // Move to page 2.
+  NavigateToURLAndWaitForTitle(GURL(kTestPage2Url), "Page 2");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPage2Url)));
+
+  // Back to page 1.
+  ExecuteScriptAndWaitForTitle("history.back();", "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPage1Url)));
+  // Back to the initial page.
+  ExecuteScriptAndWaitForTitle("history.back();", "Ready");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPageUrl)));
+
+  // Move to page 1.
+  ExecuteScriptAndWaitForTitle("history.forward();", "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPage1Url)));
+
+  // Reload.
+  ExecuteScriptAndWaitForTitle("document.title = 'reset';", "reset");
+  ExecuteScriptAndWaitForTitle("location.reload();", "Page 1");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPage1Url)));
+
+  // Move to page 2.
+  ExecuteScriptAndWaitForTitle("history.forward();", "Page 2");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPage2Url)));
+}
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest, NavigationWithHash) {
+  const GURL test_data_url =
+      GetTestUrlForFile(GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+  NavigateToBundleAndWaitForReady(
+      test_data_url,
+      bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+          test_data_url, GURL(kTestPageUrl)));
+  NavigateToURLAndWaitForTitle(GURL(kTestPageForHashUrl), "#hello");
+  EXPECT_EQ(shell()->web_contents()->GetLastCommittedURL(),
+            bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                test_data_url, GURL(kTestPageForHashUrl)));
+}
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest,
+                       InvalidBundledExchangeFile) {
+  const GURL test_data_url =
+      GetTestUrlForFile(GetTestDataPath("invalid_bundled_exchanges.wbn"));
+
+  WebContents* web_contents = shell()->web_contents();
+  ConsoleObserverDelegate console_delegate(web_contents, "*");
+  web_contents->SetDelegate(&console_delegate);
+
+  base::RunLoop run_loop;
+  FinishNavigationObserver finish_navigation_observer(web_contents,
                                                       run_loop.QuitClosure());
-  EXPECT_FALSE(NavigateToURL(shell()->web_contents(),
-                             net::FilePathToFileURL(test_data_path()),
-                             GURL("https://test.example.org/")));
+  EXPECT_FALSE(NavigateToURL(web_contents, test_data_url));
   run_loop.Run();
   ASSERT_TRUE(finish_navigation_observer.error_code());
   EXPECT_EQ(net::ERR_INVALID_BUNDLED_EXCHANGES,
             *finish_navigation_observer.error_code());
+
+  if (console_delegate.messages().empty())
+    console_delegate.Wait();
+
+  EXPECT_FALSE(console_delegate.messages().empty());
+  EXPECT_EQ("Failed to read metadata of Web Bundle file: Wrong magic bytes.",
+            console_delegate.message());
 }
 
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest,
+                       ResponseParseErrorInMainResource) {
+  const GURL test_data_url = GetTestUrlForFile(
+      GetTestDataPath("broken_bundle_broken_first_entry.wbn"));
+
+  WebContents* web_contents = shell()->web_contents();
+  ConsoleObserverDelegate console_delegate(web_contents, "*");
+  web_contents->SetDelegate(&console_delegate);
+
+  base::RunLoop run_loop;
+  FinishNavigationObserver finish_navigation_observer(web_contents,
+                                                      run_loop.QuitClosure());
+  EXPECT_FALSE(NavigateToURL(web_contents, test_data_url));
+  run_loop.Run();
+  ASSERT_TRUE(finish_navigation_observer.error_code());
+  EXPECT_EQ(net::ERR_INVALID_BUNDLED_EXCHANGES,
+            *finish_navigation_observer.error_code());
+
+  if (console_delegate.messages().empty())
+    console_delegate.Wait();
+
+  EXPECT_FALSE(console_delegate.messages().empty());
+  EXPECT_EQ(
+      "Failed to read response header of Web Bundle file: Response headers map "
+      "must have exactly one pseudo-header, :status.",
+      console_delegate.message());
+}
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest,
+                       ResponseParseErrorInSubresource) {
+  const GURL test_data_url = GetTestUrlForFile(
+      GetTestDataPath("broken_bundle_broken_script_entry.wbn"));
+  NavigateToBundleAndWaitForReady(
+      test_data_url,
+      bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+          test_data_url, GURL(kTestPageUrl)));
+
+  WebContents* web_contents = shell()->web_contents();
+  ConsoleObserverDelegate console_delegate(web_contents, "*");
+  web_contents->SetDelegate(&console_delegate);
+
+  ExecuteScriptAndWaitForTitle(R"(
+    const script = document.createElement("script");
+    script.onerror = () => { document.title = "load failed";};
+    script.src = "script.js";
+    document.body.appendChild(script);)",
+                               "load failed");
+
+  if (console_delegate.messages().empty())
+    console_delegate.Wait();
+
+  EXPECT_FALSE(console_delegate.messages().empty());
+  EXPECT_EQ(
+      "Failed to read response header of Web Bundle file: Response headers map "
+      "must have exactly one pseudo-header, :status.",
+      console_delegate.message());
+}
+
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest, NoLocalFileScheme) {
+  const GURL test_data_url =
+      GetTestUrlForFile(GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+  NavigateToBundleAndWaitForReady(
+      test_data_url,
+      bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+          test_data_url, GURL(kTestPageUrl)));
+
+  auto expected_title = base::ASCIIToUTF16("load failed");
+  TitleWatcher title_watcher(shell()->web_contents(), expected_title);
+  title_watcher.AlsoWaitForTitle(base::ASCIIToUTF16("Local Script"));
+
+  const GURL script_file_url =
+      net::FilePathToFileURL(GetTestDataPath("local_script.js"));
+  const std::string script = base::StringPrintf(R"(
+    const script = document.createElement("script");
+    script.onerror = () => { document.title = "load failed";};
+    script.src = "%s";
+    document.body.appendChild(script);)",
+                                                script_file_url.spec().c_str());
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(), script));
+
+  EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
+}
+
+INSTANTIATE_TEST_SUITE_P(BundledExchangesFileBrowserTest,
+                         BundledExchangesFileBrowserTest,
+                         testing::Values(TestFilePathMode::kNormalFilePath
+#if defined(OS_ANDROID)
+                                         ,
+                                         TestFilePathMode::kContentURI
+#endif  // OS_ANDROID
+                                         ));
+
 }  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_handle.cc b/chromium/content/browser/web_package/bundled_exchanges_handle.cc
index 59ea62c107b..b810d8e73b7 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_handle.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_handle.cc
@@ -5,14 +5,21 @@
 #include "content/browser/web_package/bundled_exchanges_handle.h"
 
 #include "base/bind.h"
+#include "base/memory/ptr_util.h"
 #include "base/sequence_checker.h"
 #include "base/strings/stringprintf.h"
 #include "base/task/post_task.h"
 #include "content/browser/loader/navigation_loader_interceptor.h"
+#include "content/browser/web_package/bundled_exchanges_handle_tracker.h"
+#include "content/browser/web_package/bundled_exchanges_navigation_info.h"
 #include "content/browser/web_package/bundled_exchanges_reader.h"
+#include "content/browser/web_package/bundled_exchanges_source.h"
 #include "content/browser/web_package/bundled_exchanges_url_loader_factory.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
 #include "content/public/browser/browser_task_traits.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
@@ -20,12 +27,17 @@
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "net/http/http_util.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
+#include "services/data_decoder/public/mojom/bundled_exchanges_parser.mojom.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 
 namespace content {
 
 namespace {
 
+using DoneCallback = base::OnceCallback<void(
+    const GURL& target_inner_url,
+    std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory)>;
+
 const net::NetworkTrafficAnnotationTag kTrafficAnnotation =
     net::DefineNetworkTrafficAnnotation("bundled_exchanges_start_url_loader",
                                         R"(
@@ -54,18 +66,223 @@ const net::NetworkTrafficAnnotationTag kTrafficAnnotation =
     "by Blink, but based on a user initiated navigation."
   )");
 
+void AddMetadataParseErrorMessageToConsole(
+    int frame_tree_node_id,
+    const data_decoder::mojom::BundleMetadataParseErrorPtr& metadata_error) {
+  WebContents* web_contents =
+      WebContents::FromFrameTreeNodeId(frame_tree_node_id);
+  if (!web_contents)
+    return;
+  web_contents->GetMainFrame()->AddMessageToConsole(
+      blink::mojom::ConsoleMessageLevel::kError,
+      std::string("Failed to read metadata of Web Bundle file: ") +
+          metadata_error->message);
+}
+
+// A class to provide a network::mojom::URLLoader interface to redirect a
+// request to the BundledExchanges to the main resource url.
+class PrimaryURLRedirectLoader final : public network::mojom::URLLoader {
+ public:
+  PrimaryURLRedirectLoader(
+      mojo::PendingRemote<network::mojom::URLLoaderClient> client)
+      : client_(std::move(client)) {}
+
+  void OnReadyToRedirect(const network::ResourceRequest& resource_request,
+                         const GURL& url) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    DCHECK(client_.is_connected());
+    network::ResourceResponseHead response_head;
+    response_head.encoded_data_length = 0;
+    response_head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+        net::HttpUtil::AssembleRawHeaders(
+            base::StringPrintf("HTTP/1.1 %d %s\r\n", 303, "See Other")));
+
+    net::RedirectInfo redirect_info = net::RedirectInfo::ComputeRedirectInfo(
+        "GET", resource_request.url, resource_request.site_for_cookies,
+        resource_request.update_first_party_url_on_redirect
+            ? net::URLRequest::FirstPartyURLPolicy::
+                  UPDATE_FIRST_PARTY_URL_ON_REDIRECT
+            : net::URLRequest::FirstPartyURLPolicy::
+                  NEVER_CHANGE_FIRST_PARTY_URL,
+        resource_request.referrer_policy, resource_request.referrer.spec(), 303,
+        url, /*referrer_policy_header=*/base::nullopt,
+        /*insecure_scheme_was_upgraded=*/false, /*copy_fragment=*/true,
+        /*is_signed_exchange_fallback_redirect=*/false);
+    client_->OnReceiveRedirect(redirect_info, response_head);
+  }
+
+ private:
+  // mojom::URLLoader overrides:
+  void FollowRedirect(const std::vector<std::string>& removed_headers,
+                      const net::HttpRequestHeaders& modified_headers,
+                      const base::Optional<GURL>& new_url) override {}
+  void SetPriority(net::RequestPriority priority,
+                   int intra_priority_value) override {}
+  void PauseReadingBodyFromNet() override {}
+  void ResumeReadingBodyFromNet() override {}
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  mojo::Remote<network::mojom::URLLoaderClient> client_;
+
+  DISALLOW_COPY_AND_ASSIGN(PrimaryURLRedirectLoader);
+};
+
+// A class to inherit NavigationLoaderInterceptor for the navigation to a
+// untrustable BundledExchanges file (eg: "file:///tmp/a.wbn").
+// The overridden methods of NavigationLoaderInterceptor are called in the
+// following sequence:
+// [1] MaybeCreateLoader() is called for all navigation requests. It calls the
+//     |callback| with the a null RequestHandler.
+// [2] MaybeCreateLoaderForResponse() is called for all navigation responses.
+//     If the response mime type is not "application/webbundle", returns false.
+//     Otherwise starts reading the metadata and returns true. Once the metadata
+//     is read, OnMetadataReady() is called, and a redirect loader is
+//     created to redirect the navigation request to the Bundle's synthesized
+//     primary URL ("file:///tmp/a.wbn?https://example.com/a.html").
+// [3] MaybeCreateLoader() is called again for the redirect. It continues on
+//     StartResponse() to create the loader for the main resource.
+class InterceptorForFile final : public NavigationLoaderInterceptor {
+ public:
+  explicit InterceptorForFile(DoneCallback done_callback,
+                              int frame_tree_node_id)
+      : done_callback_(std::move(done_callback)),
+        frame_tree_node_id_(frame_tree_node_id) {}
+  ~InterceptorForFile() override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  }
+
+ private:
+  // NavigationLoaderInterceptor implementation
+  void MaybeCreateLoader(
+      const network::ResourceRequest& tentative_resource_request,
+      BrowserContext* browser_context,
+      LoaderCallback callback,
+      FallbackCallback fallback_callback) override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    // InterceptorForFile::MaybeCreateLoader() creates a loader only after
+    // recognising that the response is a bundled exchange file at
+    // MaybeCreateLoaderForResponse() and successfully created
+    // |url_loader_factory_|.
+    if (!url_loader_factory_) {
+      std::move(callback).Run({});
+      return;
+    }
+    std::move(callback).Run(base::BindOnce(&InterceptorForFile::StartResponse,
+                                           weak_factory_.GetWeakPtr()));
+  }
+
+  bool MaybeCreateLoaderForResponse(
+      const network::ResourceRequest& request,
+      const network::ResourceResponseHead& response_head,
+      mojo::ScopedDataPipeConsumerHandle* response_body,
+      network::mojom::URLLoaderPtr* loader,
+      network::mojom::URLLoaderClientRequest* client_request,
+      ThrottlingURLLoader* url_loader,
+      bool* skip_other_interceptors,
+      bool* will_return_unsafe_redirect) override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    DCHECK(bundled_exchanges_utils::IsSupprtedFileScheme(request.url));
+    if (response_head.mime_type !=
+        bundled_exchanges_utils::
+            kBundledExchangesFileMimeTypeWithoutParameters) {
+      return false;
+    }
+    std::unique_ptr<BundledExchangesSource> source =
+        BundledExchangesSource::MaybeCreateFromFileUrl(request.url);
+    if (!source)
+      return false;
+    reader_ = base::MakeRefCounted<BundledExchangesReader>(std::move(source));
+    reader_->ReadMetadata(base::BindOnce(&InterceptorForFile::OnMetadataReady,
+                                         weak_factory_.GetWeakPtr(), request));
+    *client_request = forwarding_client_.BindNewPipeAndPassReceiver();
+    *will_return_unsafe_redirect = true;
+    return true;
+  }
+
+  void OnMetadataReady(
+      network::ResourceRequest request,
+      data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    if (metadata_error) {
+      AddMetadataParseErrorMessageToConsole(frame_tree_node_id_,
+                                            metadata_error);
+      forwarding_client_->OnComplete(network::URLLoaderCompletionStatus(
+          net::ERR_INVALID_BUNDLED_EXCHANGES));
+      forwarding_client_.reset();
+      return;
+    }
+    DCHECK(reader_);
+    primary_url_ = reader_->GetPrimaryURL();
+    url_loader_factory_ = std::make_unique<BundledExchangesURLLoaderFactory>(
+        std::move(reader_), frame_tree_node_id_);
+
+    const GURL new_url =
+        bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+            request.url, primary_url_);
+    auto redirect_loader =
+        std::make_unique<PrimaryURLRedirectLoader>(forwarding_client_.Unbind());
+    redirect_loader->OnReadyToRedirect(request, new_url);
+  }
+
+  void StartResponse(const network::ResourceRequest& resource_request,
+                     network::mojom::URLLoaderRequest request,
+                     network::mojom::URLLoaderClientPtr client) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    network::ResourceRequest new_resource_request = resource_request;
+    new_resource_request.url = primary_url_;
+    url_loader_factory_->CreateLoaderAndStart(
+        std::move(request), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+        new_resource_request, std::move(client),
+        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
+    std::move(done_callback_).Run(primary_url_, std::move(url_loader_factory_));
+  }
+
+  DoneCallback done_callback_;
+  const int frame_tree_node_id_;
+  scoped_refptr<BundledExchangesReader> reader_;
+  GURL primary_url_;
+  std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory_;
+
+  mojo::Remote<network::mojom::URLLoaderClient> forwarding_client_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<InterceptorForFile> weak_factory_{this};
+
+  DISALLOW_COPY_AND_ASSIGN(InterceptorForFile);
+};
+
 // A class to inherit NavigationLoaderInterceptor for the navigation to a
-// BundledExchanges.
-class Interceptor final : public NavigationLoaderInterceptor {
+// trustable BundledExchanges file (eg: "file:///tmp/a.wbn").
+// The overridden methods of NavigationLoaderInterceptor are called in the
+// following sequence:
+// [1] MaybeCreateLoader() is called for the navigation request to the trustable
+//     BundledExchanges file. It continues on CreateURLLoader() to create the
+//     loader for the main resource.
+//     - If OnMetadataReady() has not been called yet:
+//         Wait for OnMetadataReady() to be called.
+//     - If OnMetadataReady() was called with an error:
+//         Completes the request with ERR_INVALID_BUNDLED_EXCHANGES.
+//     - If OnMetadataReady() was called whthout errors:
+//         A redirect loader is created to redirect the navigation request to
+//         the Bundle's primary URL ("https://example.com/a.html").
+// [2] MaybeCreateLoader() is called again for the redirect. It continues on
+//     CreateURLLoader() to create the loader for the main resource.
+class InterceptorForTrustableFile final : public NavigationLoaderInterceptor {
  public:
-  using RepeatingRequestHandler = base::RepeatingCallback<void(
-      const network::ResourceRequest& resource_request,
-      network::mojom::URLLoaderRequest,
-      network::mojom::URLLoaderClientPtr)>;
-
-  explicit Interceptor(RepeatingRequestHandler request_handler)
-      : request_handler_(request_handler) {}
-  ~Interceptor() override {
+  InterceptorForTrustableFile(std::unique_ptr<BundledExchangesSource> source,
+                              DoneCallback done_callback,
+                              int frame_tree_node_id)
+      : source_(std::move(source)),
+        reader_(base::MakeRefCounted<BundledExchangesReader>(source_->Clone())),
+        done_callback_(std::move(done_callback)),
+        frame_tree_node_id_(frame_tree_node_id) {
+    reader_->ReadMetadata(
+        base::BindOnce(&InterceptorForTrustableFile::OnMetadataReady,
+                       weak_factory_.GetWeakPtr()));
+  }
+  ~InterceptorForTrustableFile() override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   }
 
@@ -76,109 +293,423 @@ class Interceptor final : public NavigationLoaderInterceptor {
                          LoaderCallback callback,
                          FallbackCallback fallback_callback) override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    std::move(callback).Run(
+        base::BindOnce(&InterceptorForTrustableFile::CreateURLLoader,
+                       weak_factory_.GetWeakPtr()));
+  }
+
+  void CreateURLLoader(const network::ResourceRequest& resource_request,
+                       network::mojom::URLLoaderRequest request,
+                       network::mojom::URLLoaderClientPtr client) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    if (metadata_error_) {
+      client->OnComplete(network::URLLoaderCompletionStatus(
+          net::ERR_INVALID_BUNDLED_EXCHANGES));
+      return;
+    }
+
+    if (!url_loader_factory_) {
+      // This must be the first request to the bundled exchange file.
+      DCHECK_EQ(source_->url(), resource_request.url);
+      pending_resource_request_ = resource_request;
+      pending_request_ = std::move(request);
+      pending_client_ = std::move(client);
+      return;
+    }
+
+    // Currently |source_| must be a local file. And the bundle's primary URL
+    // can't be a local file URL. So while handling redirected request to the
+    // primary URL, |resource_request.url| must not be same as the |source_|'s
+    // URL.
+    if (source_->url() != resource_request.url) {
+      url_loader_factory_->CreateLoaderAndStart(
+          std::move(request), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+          resource_request, std::move(client),
+          net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
+      std::move(done_callback_)
+          .Run(resource_request.url, std::move(url_loader_factory_));
+      return;
+    }
+
+    auto redirect_loader =
+        std::make_unique<PrimaryURLRedirectLoader>(client.PassInterface());
+    redirect_loader->OnReadyToRedirect(resource_request, primary_url_);
+    mojo::MakeSelfOwnedReceiver(
+        std::move(redirect_loader),
+        mojo::PendingReceiver<network::mojom::URLLoader>(std::move(request)));
+  }
 
-    std::move(callback).Run(request_handler_);
+  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    DCHECK(!url_loader_factory_);
+
+    if (error) {
+      AddMetadataParseErrorMessageToConsole(frame_tree_node_id_, error);
+      metadata_error_ = std::move(error);
+    } else {
+      primary_url_ = reader_->GetPrimaryURL();
+      url_loader_factory_ = std::make_unique<BundledExchangesURLLoaderFactory>(
+          std::move(reader_), frame_tree_node_id_);
+    }
+
+    if (pending_request_) {
+      DCHECK(pending_client_);
+      CreateURLLoader(pending_resource_request_, std::move(pending_request_),
+                      std::move(pending_client_));
+    }
   }
 
-  RepeatingRequestHandler request_handler_;
+  std::unique_ptr<BundledExchangesSource> source_;
+  scoped_refptr<BundledExchangesReader> reader_;
+  DoneCallback done_callback_;
+  const int frame_tree_node_id_;
+
+  network::ResourceRequest pending_resource_request_;
+  network::mojom::URLLoaderRequest pending_request_;
+  network::mojom::URLLoaderClientPtr pending_client_;
+
+  std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory_;
+
+  GURL primary_url_;
+  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
 
   SEQUENCE_CHECKER(sequence_checker_);
 
-  DISALLOW_COPY_AND_ASSIGN(Interceptor);
+  base::WeakPtrFactory<InterceptorForTrustableFile> weak_factory_{this};
+
+  DISALLOW_COPY_AND_ASSIGN(InterceptorForTrustableFile);
 };
 
-}  // namespace
+// A class to inherit NavigationLoaderInterceptor for the navigation within a
+// trustable BundledExchanges file.
+// For example:
+//   A user opened "file:///tmp/a.wbn", and InterceptorForTrustableFile
+//   redirected to "https://example.com/a.html" and "a.html" in "a.wbn" was
+//   loaded. And the user clicked a link to "https://example.com/b.html" from
+//   "a.html".
+// In this case, this interceptor intecepts the navigation request to "b.html",
+// and creates a URLLoader using the BundledExchangesURLLoaderFactory to load
+// the response of "b.html" in "a.wbn".
+class InterceptorForTrackedNavigationFromTrustableFile final
+    : public NavigationLoaderInterceptor {
+ public:
+  InterceptorForTrackedNavigationFromTrustableFile(
+      scoped_refptr<BundledExchangesReader> reader,
+      DoneCallback done_callback,
+      int frame_tree_node_id)
+      : url_loader_factory_(std::make_unique<BundledExchangesURLLoaderFactory>(
+            std::move(reader),
+            frame_tree_node_id)),
+        done_callback_(std::move(done_callback)) {}
+  ~InterceptorForTrackedNavigationFromTrustableFile() override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  }
 
-// A class to provide a network::mojom::URLLoader interface to redirect a
-// request to the BundledExchanges to the main resource url.
-class BundledExchangesHandle::PrimaryURLRedirectLoader final
-    : public network::mojom::URLLoader {
+ private:
+  // NavigationLoaderInterceptor implementation
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    DCHECK(url_loader_factory_->reader()->HasEntry(resource_request.url));
+    std::move(callback).Run(base::BindOnce(
+        &InterceptorForTrackedNavigationFromTrustableFile::CreateURLLoader,
+        weak_factory_.GetWeakPtr()));
+  }
+
+  void CreateURLLoader(const network::ResourceRequest& resource_request,
+                       network::mojom::URLLoaderRequest request,
+                       network::mojom::URLLoaderClientPtr client) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    url_loader_factory_->CreateLoaderAndStart(
+        std::move(request), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+        resource_request, std::move(client),
+        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
+    std::move(done_callback_)
+        .Run(resource_request.url, std::move(url_loader_factory_));
+  }
+
+  std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory_;
+  DoneCallback done_callback_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<InterceptorForTrackedNavigationFromTrustableFile>
+      weak_factory_{this};
+
+  DISALLOW_COPY_AND_ASSIGN(InterceptorForTrackedNavigationFromTrustableFile);
+};
+
+// A class to inherit NavigationLoaderInterceptor for the navigation within a
+// BundledExchanges file.
+// For example:
+//   A user opened "file:///tmp/a.wbn", and InterceptorForFile redirected to
+//   "file:///tmp/a.wbn?https://example.com/a.html" and "a.html" in "a.wbn" was
+//   loaded. And the user clicked a link to "https://example.com/b.html" from
+//   "a.html".
+// In this case, this interceptor intecepts the navigation request to "b.html",
+// and redirect the navigation request to
+// "file:///tmp/a.wbn?https://example.com/b.html" and creates a URLLoader using
+// the BundledExchangesURLLoaderFactory to load the response of "b.html" in
+// "a.wbn".
+class InterceptorForTrackedNavigationFromFile final
+    : public NavigationLoaderInterceptor {
  public:
-  PrimaryURLRedirectLoader(
-      const network::ResourceRequest& resource_request,
-      mojo::PendingRemote<network::mojom::URLLoaderClient> client)
-      : client_(std::move(client)) {
-    redirect_info_ = net::RedirectInfo::ComputeRedirectInfo(
-        "GET", resource_request.url, resource_request.site_for_cookies,
-        resource_request.top_frame_origin,
-        resource_request.update_first_party_url_on_redirect
-            ? net::URLRequest::FirstPartyURLPolicy::
-                  UPDATE_FIRST_PARTY_URL_ON_REDIRECT
-            : net::URLRequest::FirstPartyURLPolicy::
-                  NEVER_CHANGE_FIRST_PARTY_URL,
-        resource_request.referrer_policy, resource_request.referrer.spec(), 303,
-        GURL(), /*referrer_policy_header=*/base::nullopt,
-        /*insecure_scheme_was_upgraded=*/false, /*copy_fragment=*/true,
-        /*is_signed_exchange_fallback_redirect=*/false);
+  InterceptorForTrackedNavigationFromFile(
+      scoped_refptr<BundledExchangesReader> reader,
+      DoneCallback done_callback,
+      int frame_tree_node_id)
+      : url_loader_factory_(std::make_unique<BundledExchangesURLLoaderFactory>(
+            std::move(reader),
+            frame_tree_node_id)),
+        done_callback_(std::move(done_callback)) {}
+  ~InterceptorForTrackedNavigationFromFile() override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   }
 
-  void OnReadyToRedirect(
-      const GURL& url,
-      data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+ private:
+  // NavigationLoaderInterceptor implementation
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override {
     DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-    DCHECK(client_.is_connected());
+    std::move(callback).Run(base::BindOnce(
+        &InterceptorForTrackedNavigationFromFile::CreateURLLoader,
+        weak_factory_.GetWeakPtr()));
+  }
 
-    // TODO(crbug.com/966753): Handle |error|.
+  bool ShouldBypassRedirectChecks() override { return true; }
 
-    network::ResourceResponseHead response_head;
-    response_head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
-        net::HttpUtil::AssembleRawHeaders(
-            base::StringPrintf("HTTP/1.1 %d %s\r\n", 303, "See Other")));
-    redirect_info_.new_url = url;
-    client_->OnReceiveRedirect(redirect_info_, response_head);
+  void CreateURLLoader(const network::ResourceRequest& resource_request,
+                       network::mojom::URLLoaderRequest request,
+                       network::mojom::URLLoaderClientPtr client) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    if (!is_redirected_) {
+      DCHECK(url_loader_factory_->reader()->HasEntry(resource_request.url));
+      is_redirected_ = true;
+      original_request_url_ = resource_request.url;
+
+      GURL bundled_exchanges_url =
+          url_loader_factory_->reader()->source().url();
+      const GURL new_url =
+          bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+              bundled_exchanges_url, original_request_url_);
+      auto redirect_loader =
+          std::make_unique<PrimaryURLRedirectLoader>(client.PassInterface());
+      redirect_loader->OnReadyToRedirect(resource_request, new_url);
+      mojo::MakeSelfOwnedReceiver(
+          std::move(redirect_loader),
+          mojo::PendingReceiver<network::mojom::URLLoader>(std::move(request)));
+      return;
+    }
+    network::ResourceRequest new_resource_request = resource_request;
+    new_resource_request.url = original_request_url_;
+    url_loader_factory_->CreateLoaderAndStart(
+        std::move(request), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+        new_resource_request, std::move(client),
+        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
+    std::move(done_callback_)
+        .Run(original_request_url_, std::move(url_loader_factory_));
   }
 
-  base::WeakPtr<PrimaryURLRedirectLoader> GetWeakPtr() {
-    return weak_factory_.GetWeakPtr();
+  std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory_;
+  DoneCallback done_callback_;
+
+  bool is_redirected_ = false;
+  GURL original_request_url_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<InterceptorForTrackedNavigationFromFile> weak_factory_{
+      this};
+
+  DISALLOW_COPY_AND_ASSIGN(InterceptorForTrackedNavigationFromFile);
+};
+
+// A class to inherit NavigationLoaderInterceptor for the history navigation to
+// a BundledExchanges file.
+// - MaybeCreateLoader() is called for the history navigation request. It
+//   continues on CreateURLLoader() to create the loader for the main resource.
+//   - If OnMetadataReady() has not been called yet:
+//       Wait for OnMetadataReady() to be called.
+//   - If OnMetadataReady() was called with an error:
+//       Completes the request with ERR_INVALID_BUNDLED_EXCHANGES.
+//   - If OnMetadataReady() was called whthout errors:
+//       Creates the loader for the main resource.
+class InterceptorForNavigationInfo final : public NavigationLoaderInterceptor {
+ public:
+  InterceptorForNavigationInfo(
+      std::unique_ptr<BundledExchangesNavigationInfo> navigation_info,
+      DoneCallback done_callback,
+      int frame_tree_node_id)
+      : reader_(base::MakeRefCounted<BundledExchangesReader>(
+            navigation_info->source().Clone())),
+        target_inner_url_(navigation_info->target_inner_url()),
+        done_callback_(std::move(done_callback)),
+        frame_tree_node_id_(frame_tree_node_id) {
+    reader_->ReadMetadata(
+        base::BindOnce(&InterceptorForNavigationInfo::OnMetadataReady,
+                       weak_factory_.GetWeakPtr()));
+  }
+  ~InterceptorForNavigationInfo() override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   }
 
  private:
-  // mojom::URLLoader overrides:
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override {}
-  void SetPriority(net::RequestPriority priority,
-                   int intra_priority_value) override {}
-  void PauseReadingBodyFromNet() override {}
-  void ResumeReadingBodyFromNet() override {}
+  // NavigationLoaderInterceptor implementation
+  void MaybeCreateLoader(const network::ResourceRequest& resource_request,
+                         BrowserContext* browser_context,
+                         LoaderCallback callback,
+                         FallbackCallback fallback_callback) override {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    std::move(callback).Run(
+        base::BindOnce(&InterceptorForNavigationInfo::CreateURLLoader,
+                       weak_factory_.GetWeakPtr()));
+  }
 
-  SEQUENCE_CHECKER(sequence_checker_);
+  void CreateURLLoader(const network::ResourceRequest& resource_request,
+                       network::mojom::URLLoaderRequest request,
+                       network::mojom::URLLoaderClientPtr client) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    if (metadata_error_) {
+      client->OnComplete(network::URLLoaderCompletionStatus(
+          net::ERR_INVALID_BUNDLED_EXCHANGES));
+      return;
+    }
+
+    if (!url_loader_factory_) {
+      pending_resource_request_ = resource_request;
+      pending_request_ = std::move(request);
+      pending_client_ = std::move(client);
+      return;
+    }
+
+    network::ResourceRequest new_resource_request = resource_request;
+    new_resource_request.url = target_inner_url_;
+    url_loader_factory_->CreateLoaderAndStart(
+        std::move(request), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
+        new_resource_request, std::move(client),
+        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
+    std::move(done_callback_)
+        .Run(target_inner_url_, std::move(url_loader_factory_));
+  }
 
-  mojo::Remote<network::mojom::URLLoaderClient> client_;
-  net::RedirectInfo redirect_info_;
+  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error) {
+    DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+    DCHECK(!url_loader_factory_);
+
+    if (error) {
+      AddMetadataParseErrorMessageToConsole(frame_tree_node_id_, error);
+      metadata_error_ = std::move(error);
+    } else {
+      url_loader_factory_ = std::make_unique<BundledExchangesURLLoaderFactory>(
+          std::move(reader_), frame_tree_node_id_);
+    }
+
+    if (pending_request_) {
+      DCHECK(pending_client_);
+      CreateURLLoader(pending_resource_request_, std::move(pending_request_),
+                      std::move(pending_client_));
+    }
+  }
 
-  base::WeakPtrFactory<PrimaryURLRedirectLoader> weak_factory_{this};
+  scoped_refptr<BundledExchangesReader> reader_;
+  const GURL target_inner_url_;
+  DoneCallback done_callback_;
+  const int frame_tree_node_id_;
 
-  DISALLOW_COPY_AND_ASSIGN(PrimaryURLRedirectLoader);
+  network::ResourceRequest pending_resource_request_;
+  network::mojom::URLLoaderRequest pending_request_;
+  network::mojom::URLLoaderClientPtr pending_client_;
+
+  std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory_;
+  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
+
+  SEQUENCE_CHECKER(sequence_checker_);
+
+  base::WeakPtrFactory<InterceptorForNavigationInfo> weak_factory_{this};
+
+  DISALLOW_COPY_AND_ASSIGN(InterceptorForNavigationInfo);
 };
 
-BundledExchangesHandle::BundledExchangesHandle()
-    : BundledExchangesHandle(BundledExchangesSource()) {}
+}  // namespace
 
-BundledExchangesHandle::BundledExchangesHandle(
-    const BundledExchangesSource& bundled_exchanges_source)
-    : source_(bundled_exchanges_source) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  if (bundled_exchanges_source.IsValid()) {
-    reader_ =
-        std::make_unique<BundledExchangesReader>(bundled_exchanges_source);
-    reader_->ReadMetadata(base::BindOnce(
-        &BundledExchangesHandle::OnMetadataReady, weak_factory_.GetWeakPtr()));
+// static
+std::unique_ptr<BundledExchangesHandle> BundledExchangesHandle::CreateForFile(
+    int frame_tree_node_id) {
+  auto handle = base::WrapUnique(new BundledExchangesHandle());
+  handle->SetInterceptor(std::make_unique<InterceptorForFile>(
+      base::BindOnce(&BundledExchangesHandle::OnBundledExchangesFileLoaded,
+                     handle->weak_factory_.GetWeakPtr()),
+      frame_tree_node_id));
+  return handle;
+}
+
+// static
+std::unique_ptr<BundledExchangesHandle>
+BundledExchangesHandle::CreateForTrustableFile(
+    std::unique_ptr<BundledExchangesSource> source,
+    int frame_tree_node_id) {
+  DCHECK(source->is_trusted());
+  auto handle = base::WrapUnique(new BundledExchangesHandle());
+  handle->SetInterceptor(std::make_unique<InterceptorForTrustableFile>(
+      std::move(source),
+      base::BindOnce(&BundledExchangesHandle::OnBundledExchangesFileLoaded,
+                     handle->weak_factory_.GetWeakPtr()),
+      frame_tree_node_id));
+  return handle;
+}
+
+// static
+std::unique_ptr<BundledExchangesHandle>
+BundledExchangesHandle::CreateForTrackedNavigation(
+    scoped_refptr<BundledExchangesReader> reader,
+    int frame_tree_node_id) {
+  auto handle = base::WrapUnique(new BundledExchangesHandle());
+  if (reader->source().is_trusted()) {
+    handle->SetInterceptor(
+        std::make_unique<InterceptorForTrackedNavigationFromTrustableFile>(
+            std::move(reader),
+            base::BindOnce(
+                &BundledExchangesHandle::OnBundledExchangesFileLoaded,
+                handle->weak_factory_.GetWeakPtr()),
+            frame_tree_node_id));
+  } else {
+    handle->SetInterceptor(
+        std::make_unique<InterceptorForTrackedNavigationFromFile>(
+            std::move(reader),
+            base::BindOnce(
+                &BundledExchangesHandle::OnBundledExchangesFileLoaded,
+                handle->weak_factory_.GetWeakPtr()),
+            frame_tree_node_id));
   }
+  return handle;
 }
 
-BundledExchangesHandle::~BundledExchangesHandle() {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+// static
+std::unique_ptr<BundledExchangesHandle>
+BundledExchangesHandle::CreateForNavigationInfo(
+    std::unique_ptr<BundledExchangesNavigationInfo> navigation_info,
+    int frame_tree_node_id) {
+  auto handle = base::WrapUnique(new BundledExchangesHandle());
+  handle->SetInterceptor(std::make_unique<InterceptorForNavigationInfo>(
+      std::move(navigation_info),
+      base::BindOnce(&BundledExchangesHandle::OnBundledExchangesFileLoaded,
+                     handle->weak_factory_.GetWeakPtr()),
+      frame_tree_node_id));
+  return handle;
 }
 
+BundledExchangesHandle::BundledExchangesHandle() = default;
+
+BundledExchangesHandle::~BundledExchangesHandle() = default;
+
 std::unique_ptr<NavigationLoaderInterceptor>
-BundledExchangesHandle::CreateInterceptor() {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  return std::make_unique<Interceptor>(
-      source_.IsValid()
-          ? base::BindRepeating(&BundledExchangesHandle::CreateURLLoader,
-                                weak_factory_.GetWeakPtr())
-          : base::NullCallback());
+BundledExchangesHandle::TakeInterceptor() {
+  DCHECK(interceptor_);
+  return std::move(interceptor_);
 }
 
 void BundledExchangesHandle::CreateURLLoaderFactory(
@@ -191,70 +722,32 @@ void BundledExchangesHandle::CreateURLLoaderFactory(
   url_loader_factory_->Clone(std::move(receiver));
 }
 
+std::unique_ptr<BundledExchangesHandleTracker>
+BundledExchangesHandle::MaybeCreateTracker() {
+  if (!url_loader_factory_)
+    return nullptr;
+  return std::make_unique<BundledExchangesHandleTracker>(
+      url_loader_factory_->reader(), navigation_info_->target_inner_url());
+}
+
 bool BundledExchangesHandle::IsReadyForLoading() {
   return !!url_loader_factory_;
 }
 
-void BundledExchangesHandle::CreateURLLoader(
-    const network::ResourceRequest& resource_request,
-    network::mojom::URLLoaderRequest request,
-    network::mojom::URLLoaderClientPtr client) {
-  DCHECK(source_.is_trusted);
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-
-  if (metadata_error_) {
-    client->OnComplete(
-        network::URLLoaderCompletionStatus(net::ERR_INVALID_BUNDLED_EXCHANGES));
-    return;
-  }
-
-  if (!url_loader_factory_) {
-    // This must be the first request to the bundled exchange file.
-    DCHECK(source_.Match(resource_request.url));
-    pending_create_url_loader_task_ = base::Bind(
-        &BundledExchangesHandle::CreateURLLoader, base::Unretained(this),
-        resource_request, base::Passed(&request), base::Passed(&client));
-    return;
-  }
-
-  // Currently |source_| must be a local file. And the bundle's primary URL
-  // can't be a local file URL. So while handling redirected request to the
-  // primary URL, |resource_request.url| must not be same as the |source|'s URL.
-  if (!source_.Match(resource_request.url)) {
-    url_loader_factory_->CreateLoaderAndStart(
-        std::move(request), /*routing_id=*/0, /*request_id=*/0, /*options=*/0,
-        resource_request, std::move(client),
-        net::MutableNetworkTrafficAnnotationTag(kTrafficAnnotation));
-    return;
-  }
-
-  auto redirect_loader =
-      std::make_unique<BundledExchangesHandle::PrimaryURLRedirectLoader>(
-          resource_request, client.PassInterface());
-  redirect_loader->OnReadyToRedirect(std::move(primary_url_),
-                                     std::move(metadata_error_));
-  std::unique_ptr<network::mojom::URLLoader> url_loader(
-      std::move(redirect_loader));
-  mojo::MakeSelfOwnedReceiver(
-      std::move(url_loader),
-      mojo::PendingReceiver<network::mojom::URLLoader>(std::move(request)));
+void BundledExchangesHandle::SetInterceptor(
+    std::unique_ptr<NavigationLoaderInterceptor> interceptor) {
+  interceptor_ = std::move(interceptor);
 }
 
-void BundledExchangesHandle::OnMetadataReady(
-    data_decoder::mojom::BundleMetadataParseErrorPtr error) {
-  DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  DCHECK(!url_loader_factory_);
-
-  if (error) {
-    metadata_error_ = std::move(error);
-  } else {
-    primary_url_ = reader_->GetPrimaryURL();
-    url_loader_factory_ =
-        std::make_unique<BundledExchangesURLLoaderFactory>(std::move(reader_));
-  }
-
-  if (pending_create_url_loader_task_)
-    std::move(pending_create_url_loader_task_).Run();
+void BundledExchangesHandle::OnBundledExchangesFileLoaded(
+    const GURL& target_inner_url,
+    std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory) {
+  auto source = url_loader_factory->reader()->source().Clone();
+  if (!source->is_trusted())
+    base_url_override_ = target_inner_url;
+  navigation_info_ = std::make_unique<BundledExchangesNavigationInfo>(
+      std::move(source), target_inner_url);
+  url_loader_factory_ = std::move(url_loader_factory);
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_handle.h b/chromium/content/browser/web_package/bundled_exchanges_handle.h
index 1b72c6f42f5..632ed251ad4 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_handle.h
+++ b/chromium/content/browser/web_package/bundled_exchanges_handle.h
@@ -6,62 +6,85 @@
 #define CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_HANDLE_H_
 
 #include <memory>
-#include <string>
 
-#include "base/callback_forward.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
-#include "base/optional.h"
-#include "content/browser/web_package/bundled_exchanges_source.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
-#include "services/data_decoder/public/mojom/bundled_exchanges_parser.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "url/gurl.h"
 
 namespace content {
 
-class BundledExchangesReader;
+class BundledExchangesSource;
 class BundledExchangesURLLoaderFactory;
+class BundledExchangesHandleTracker;
+class BundledExchangesNavigationInfo;
+class BundledExchangesReader;
 class NavigationLoaderInterceptor;
 
 // A class to provide interfaces to communicate with a BundledExchanges for
 // loading. Running on the UI thread.
-class BundledExchangesHandle final {
+class BundledExchangesHandle {
  public:
-  BundledExchangesHandle();
-  explicit BundledExchangesHandle(const BundledExchangesSource& source);
+  static std::unique_ptr<BundledExchangesHandle> CreateForFile(
+      int frame_tree_node_id);
+  static std::unique_ptr<BundledExchangesHandle> CreateForTrustableFile(
+      std::unique_ptr<BundledExchangesSource> source,
+      int frame_tree_node_id);
+  static std::unique_ptr<BundledExchangesHandle> CreateForTrackedNavigation(
+      scoped_refptr<BundledExchangesReader> reader,
+      int frame_tree_node_id);
+  static std::unique_ptr<BundledExchangesHandle> CreateForNavigationInfo(
+      std::unique_ptr<BundledExchangesNavigationInfo> navigation_info,
+      int frame_tree_node_id);
+
   ~BundledExchangesHandle();
 
-  // Creates a NavigationLoaderInterceptor instance to handle the request for
+  // Takes a NavigationLoaderInterceptor instance to handle the request for
   // a BundledExchanges, to redirect to the entry URL of the BundledExchanges,
   // and to load the main exchange from the BundledExchanges.
-  std::unique_ptr<NavigationLoaderInterceptor> CreateInterceptor();
+  std::unique_ptr<NavigationLoaderInterceptor> TakeInterceptor();
 
   // Creates a URLLoaderFactory to load resources from the BundledExchanges.
   void CreateURLLoaderFactory(
       mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       mojo::Remote<network::mojom::URLLoaderFactory> fallback_factory);
 
+  // Creates a BundledExchangesHandleTracker to track navigations within the
+  // bundled exchanges file. Returns null if not yet succeeded to load the
+  // exchanges file.
+  std::unique_ptr<BundledExchangesHandleTracker> MaybeCreateTracker();
+
   // Checks if a valid BundledExchanges is attached, opened, and ready for use.
   bool IsReadyForLoading();
 
+  // The base URL which will be set for the document to support relative path
+  // subresource loading in unsigned bundled exchanges file.
+  const GURL& base_url_override() const { return base_url_override_; }
+
+  const BundledExchangesNavigationInfo* navigation_info() const {
+    return navigation_info_.get();
+  }
+
  private:
-  class PrimaryURLRedirectLoader;
+  BundledExchangesHandle();
+
+  void SetInterceptor(std::unique_ptr<NavigationLoaderInterceptor> interceptor);
 
-  void CreateURLLoader(const network::ResourceRequest& resource_request,
-                       network::mojom::URLLoaderRequest request,
-                       network::mojom::URLLoaderClientPtr client);
-  void OnMetadataReady(data_decoder::mojom::BundleMetadataParseErrorPtr error);
+  // Called when succeeded to load the bundled exchanges file.
+  // |target_inner_url| is the URL of the resource in the bundled exchanges
+  // file, which are used for the navigation.
+  void OnBundledExchangesFileLoaded(
+      const GURL& target_inner_url,
+      std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory);
 
-  const BundledExchangesSource source_;
+  std::unique_ptr<NavigationLoaderInterceptor> interceptor_;
 
-  base::OnceClosure pending_create_url_loader_task_;
+  GURL base_url_override_;
+  std::unique_ptr<BundledExchangesNavigationInfo> navigation_info_;
 
-  std::unique_ptr<BundledExchangesReader> reader_;
   std::unique_ptr<BundledExchangesURLLoaderFactory> url_loader_factory_;
-  GURL primary_url_;
-  data_decoder::mojom::BundleMetadataParseErrorPtr metadata_error_;
 
   base::WeakPtrFactory<BundledExchangesHandle> weak_factory_{this};
 
diff --git a/chromium/content/browser/web_package/bundled_exchanges_handle_tracker.cc b/chromium/content/browser/web_package/bundled_exchanges_handle_tracker.cc
new file mode 100644
index 00000000000..bf54b979101
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_handle_tracker.cc
@@ -0,0 +1,45 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/bundled_exchanges_handle_tracker.h"
+
+#include "content/browser/web_package/bundled_exchanges_handle.h"
+#include "content/browser/web_package/bundled_exchanges_navigation_info.h"
+#include "content/browser/web_package/bundled_exchanges_reader.h"
+#include "content/browser/web_package/bundled_exchanges_source.h"
+#include "content/browser/web_package/bundled_exchanges_utils.h"
+
+namespace content {
+
+BundledExchangesHandleTracker::BundledExchangesHandleTracker(
+    scoped_refptr<BundledExchangesReader> reader,
+    const GURL& target_inner_url)
+    : reader_(std::move(reader)), target_inner_url_(target_inner_url) {
+  DCHECK(reader_);
+}
+
+BundledExchangesHandleTracker::~BundledExchangesHandleTracker() = default;
+
+std::unique_ptr<BundledExchangesHandle>
+BundledExchangesHandleTracker::MaybeCreateBundledExchangesHandle(
+    const GURL& url,
+    int frame_tree_node_id) {
+  if (reader_->HasEntry(url)) {
+    return BundledExchangesHandle::CreateForTrackedNavigation(
+        reader_, frame_tree_node_id);
+  }
+  if (!reader_->source().is_trusted() &&
+      url == bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+                 reader_->source().url(), target_inner_url_)) {
+    // This happens when the page in an untrustable bundled exchanges file is
+    // reloaded.
+    return BundledExchangesHandle::CreateForNavigationInfo(
+        std::make_unique<BundledExchangesNavigationInfo>(
+            reader_->source().Clone(), target_inner_url_),
+        frame_tree_node_id);
+  }
+  return nullptr;
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_handle_tracker.h b/chromium/content/browser/web_package/bundled_exchanges_handle_tracker.h
new file mode 100644
index 00000000000..353af53b7bd
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_handle_tracker.h
@@ -0,0 +1,40 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_HANDLE_TRACKER_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_HANDLE_TRACKER_H_
+
+#include "base/memory/scoped_refptr.h"
+#include "content/browser/web_package/bundled_exchanges_reader.h"
+#include "url/gurl.h"
+
+namespace content {
+
+class BundledExchangesHandle;
+class BundledExchangesReader;
+
+// This class is used to track navigations within the bundled exchanges file.
+class BundledExchangesHandleTracker {
+ public:
+  BundledExchangesHandleTracker(scoped_refptr<BundledExchangesReader> reader,
+                                const GURL& target_inner_url);
+  ~BundledExchangesHandleTracker();
+
+  // Returns a BundledExchangesHandle to handle the navigation request to |url|
+  // if the bundled exchanges file contains the matching response. Otherwise
+  // returns null.
+  std::unique_ptr<BundledExchangesHandle> MaybeCreateBundledExchangesHandle(
+      const GURL& url,
+      int frame_tree_node_id);
+
+ private:
+  scoped_refptr<BundledExchangesReader> reader_;
+  const GURL target_inner_url_;
+
+  DISALLOW_COPY_AND_ASSIGN(BundledExchangesHandleTracker);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_HANDLE_TRACKER_H_
diff --git a/chromium/content/browser/web_package/bundled_exchanges_navigation_info.cc b/chromium/content/browser/web_package/bundled_exchanges_navigation_info.cc
new file mode 100644
index 00000000000..122aa84bfcb
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_navigation_info.cc
@@ -0,0 +1,32 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/bundled_exchanges_navigation_info.h"
+
+#include "content/browser/web_package/bundled_exchanges_source.h"
+
+namespace content {
+
+BundledExchangesNavigationInfo::BundledExchangesNavigationInfo(
+    std::unique_ptr<BundledExchangesSource> source,
+    const GURL& target_inner_url)
+    : source_(std::move(source)), target_inner_url_(target_inner_url) {}
+
+BundledExchangesNavigationInfo::~BundledExchangesNavigationInfo() = default;
+
+const BundledExchangesSource& BundledExchangesNavigationInfo::source() const {
+  return *source_.get();
+}
+
+const GURL& BundledExchangesNavigationInfo::target_inner_url() const {
+  return target_inner_url_;
+}
+
+std::unique_ptr<BundledExchangesNavigationInfo>
+BundledExchangesNavigationInfo::Clone() const {
+  return std::make_unique<BundledExchangesNavigationInfo>(source_->Clone(),
+                                                          target_inner_url_);
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_navigation_info.h b/chromium/content/browser/web_package/bundled_exchanges_navigation_info.h
new file mode 100644
index 00000000000..8338eeed460
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_navigation_info.h
@@ -0,0 +1,38 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_NAVIGATION_INFO_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_NAVIGATION_INFO_H_
+
+#include <memory>
+
+#include "url/gurl.h"
+
+namespace content {
+
+class BundledExchangesSource;
+
+// A class that holds necessary information for navigation in a
+// BundledExchanges.
+class BundledExchangesNavigationInfo {
+ public:
+  BundledExchangesNavigationInfo(std::unique_ptr<BundledExchangesSource> source,
+                                 const GURL& target_inner_url);
+  ~BundledExchangesNavigationInfo();
+
+  const BundledExchangesSource& source() const;
+  const GURL& target_inner_url() const;
+
+  std::unique_ptr<BundledExchangesNavigationInfo> Clone() const;
+
+ private:
+  std::unique_ptr<BundledExchangesSource> source_;
+  const GURL target_inner_url_;
+
+  DISALLOW_COPY_AND_ASSIGN(BundledExchangesNavigationInfo);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_NAVIGATION_INFO_H_
diff --git a/chromium/content/browser/web_package/bundled_exchanges_reader.cc b/chromium/content/browser/web_package/bundled_exchanges_reader.cc
index 141d379346d..babc558ca12 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_reader.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_reader.cc
@@ -23,16 +23,14 @@
 
 namespace content {
 
-BundledExchangesReader::SharedFile::SharedFile(const base::FilePath& file_path)
-    : file_path_(file_path) {
+BundledExchangesReader::SharedFile::SharedFile(
+    std::unique_ptr<BundledExchangesSource> source) {
   base::PostTaskAndReplyWithResult(
       FROM_HERE, {base::ThreadPool(), base::MayBlock()},
       base::BindOnce(
-          [](const base::FilePath& file_path) -> std::unique_ptr<base::File> {
-            return std::make_unique<base::File>(
-                file_path, base::File::FLAG_OPEN | base::File::FLAG_READ);
-          },
-          file_path_),
+          [](std::unique_ptr<BundledExchangesSource> source)
+              -> std::unique_ptr<base::File> { return source->OpenFile(); },
+          std::move(source)),
       base::BindOnce(&SharedFile::SetFile, base::RetainedRef(this)));
 }
 
@@ -138,11 +136,12 @@ class BundledExchangesReader::SharedFileDataSource final
 };
 
 BundledExchangesReader::BundledExchangesReader(
-    const BundledExchangesSource& source)
-    : parser_(ServiceManagerConnection::GetForProcess()
+    std::unique_ptr<BundledExchangesSource> source)
+    : source_(std::move(source)),
+      parser_(ServiceManagerConnection::GetForProcess()
                   ? ServiceManagerConnection::GetForProcess()->GetConnector()
                   : nullptr),
-      file_(base::MakeRefCounted<SharedFile>(source.file_path)) {}
+      file_(base::MakeRefCounted<SharedFile>(source_->Clone())) {}
 
 BundledExchangesReader::~BundledExchangesReader() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -153,8 +152,8 @@ void BundledExchangesReader::ReadMetadata(MetadataCallback callback) {
   DCHECK(!metadata_ready_);
 
   file_->DuplicateFile(
-      base::BindOnce(&BundledExchangesReader::ReadMetadataInternal,
-                     weak_factory_.GetWeakPtr(), std::move(callback)));
+      base::BindOnce(&BundledExchangesReader::ReadMetadataInternal, this,
+                     std::move(callback)));
 }
 
 void BundledExchangesReader::ReadResponse(const GURL& url,
@@ -164,7 +163,13 @@ void BundledExchangesReader::ReadResponse(const GURL& url,
 
   auto it = entries_.find(net::SimplifyUrlForRequest(url));
   if (it == entries_.end() || it->second->response_locations.empty()) {
-    PostTask(FROM_HERE, base::BindOnce(std::move(callback), nullptr));
+    PostTask(
+        FROM_HERE,
+        base::BindOnce(
+            std::move(callback), nullptr,
+            data_decoder::mojom::BundleResponseParseError::New(
+                data_decoder::mojom::BundleParseErrorType::kParserInternalError,
+                "Not found in Web Bundle file.")));
     return;
   }
 
@@ -212,6 +217,11 @@ const GURL& BundledExchangesReader::GetPrimaryURL() const {
   return primary_url_;
 }
 
+const BundledExchangesSource& BundledExchangesReader::source() const {
+  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
+  return *source_;
+}
+
 void BundledExchangesReader::SetBundledExchangesParserFactoryForTesting(
     mojo::Remote<data_decoder::mojom::BundledExchangesParserFactory> factory) {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
@@ -223,7 +233,7 @@ void BundledExchangesReader::ReadMetadataInternal(MetadataCallback callback,
                                                   base::File file) {
   base::File::Error error = parser_.OpenFile(std::move(file));
   if (base::File::FILE_OK != error) {
-    base::PostTaskWithTraits(
+    base::PostTask(
         FROM_HERE, {BrowserThread::UI},
         base::BindOnce(
             std::move(callback),
@@ -260,8 +270,7 @@ void BundledExchangesReader::OnResponseParsed(
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   DCHECK(metadata_ready_);
 
-  // TODO(crbug.com/966753): Handle |error|.
-  std::move(callback).Run(std::move(response));
+  std::move(callback).Run(std::move(response), std::move(error));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_reader.h b/chromium/content/browser/web_package/bundled_exchanges_reader.h
index 8f1960521c4..3a755296184 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_reader.h
+++ b/chromium/content/browser/web_package/bundled_exchanges_reader.h
@@ -25,16 +25,19 @@
 
 namespace content {
 
-struct BundledExchangesSource;
+class BundledExchangesSource;
 
 // A class to handle a BundledExchanges that is specified by |source|.
 // It asks the utility process to parse metadata and response structures, and
 // provides body data based on parsed information.
+// This class is typically owned by BundledExchangesURLLoaderFactory, and also
+// could be co-owned by BundledExchangesHandleTracker during navigations.
 // Running on the UI thread.
-class CONTENT_EXPORT BundledExchangesReader final {
+class CONTENT_EXPORT BundledExchangesReader final
+    : public base::RefCounted<BundledExchangesReader> {
  public:
-  explicit BundledExchangesReader(const BundledExchangesSource& source);
-  ~BundledExchangesReader();
+  explicit BundledExchangesReader(
+      std::unique_ptr<BundledExchangesSource> source);
 
   // Starts parsing, and runs |callback| when meta data gets to be available.
   // |error| is set only on failures.
@@ -46,8 +49,9 @@ class CONTENT_EXPORT BundledExchangesReader final {
   // Gets data_decoder::mojom::BundleResponsePtr for the given |url| that
   // contains response headers and range information for its body.
   // Should be called after ReadMetadata finishes.
-  using ResponseCallback =
-      base::OnceCallback<void(data_decoder::mojom::BundleResponsePtr)>;
+  using ResponseCallback = base::OnceCallback<void(
+      data_decoder::mojom::BundleResponsePtr,
+      data_decoder::mojom::BundleResponseParseErrorPtr)>;
   void ReadResponse(const GURL& url, ResponseCallback callback);
 
   // Starts loading response body. |response| should be obtained by
@@ -67,15 +71,20 @@ class CONTENT_EXPORT BundledExchangesReader final {
   // Should be called after ReadMetadata finishes.
   const GURL& GetPrimaryURL() const;
 
+  // Returns the BundledExchangesSource.
+  const BundledExchangesSource& source() const;
+
   void SetBundledExchangesParserFactoryForTesting(
       mojo::Remote<data_decoder::mojom::BundledExchangesParserFactory> factory);
 
  private:
+  friend class base::RefCounted<BundledExchangesReader>;
+
   // A simple wrapper class to share a single base::File instance among multiple
   // SharedFileDataSource instances.
   class SharedFile final : public base::RefCountedThreadSafe<SharedFile> {
    public:
-    explicit SharedFile(const base::FilePath& file_path);
+    explicit SharedFile(std::unique_ptr<BundledExchangesSource> source);
     void DuplicateFile(base::OnceCallback<void(base::File)> callback);
     base::File* operator->();
 
@@ -93,6 +102,8 @@ class CONTENT_EXPORT BundledExchangesReader final {
   };
   class SharedFileDataSource;
 
+  ~BundledExchangesReader();
+
   void ReadMetadataInternal(MetadataCallback callback, base::File file);
 
   void OnMetadataParsed(MetadataCallback callback,
@@ -104,14 +115,14 @@ class CONTENT_EXPORT BundledExchangesReader final {
 
   SEQUENCE_CHECKER(sequence_checker_);
 
+  const std::unique_ptr<BundledExchangesSource> source_;
+
   data_decoder::SafeBundledExchangesParser parser_;
   scoped_refptr<SharedFile> file_;
   GURL primary_url_;
   base::flat_map<GURL, data_decoder::mojom::BundleIndexValuePtr> entries_;
   bool metadata_ready_ = false;
 
-  base::WeakPtrFactory<BundledExchangesReader> weak_factory_{this};
-
   DISALLOW_COPY_AND_ASSIGN(BundledExchangesReader);
 };
 
diff --git a/chromium/content/browser/web_package/bundled_exchanges_reader_unittest.cc b/chromium/content/browser/web_package/bundled_exchanges_reader_unittest.cc
index 71f13445cc1..70bc0abe5a9 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_reader_unittest.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_reader_unittest.cc
@@ -61,7 +61,7 @@ class BundledExchangesReaderTest : public testing::Test {
  private:
   base::test::TaskEnvironment task_environment_;
   std::unique_ptr<MockBundledExchangesReaderFactory> reader_factory_;
-  std::unique_ptr<BundledExchangesReader> reader_;
+  scoped_refptr<BundledExchangesReader> reader_;
   const GURL primary_url_ = GURL("https://test.example.org/");
   const std::string body_ = std::string("hello new open world.");
 };
@@ -88,14 +88,17 @@ TEST_F(BundledExchangesReaderTest, ReadResponse) {
 
   GetMockFactory()->ReadAndFullfillResponse(
       GetReader(), GetPrimaryURL(), std::move(response),
-      base::BindOnce([](data_decoder::mojom::BundleResponsePtr response) {
-        EXPECT_TRUE(response);
-        if (response) {
-          EXPECT_EQ(200, response->response_code);
-          EXPECT_EQ(0xdeadu, response->payload_offset);
-          EXPECT_EQ(0xbeafu, response->payload_length);
-        }
-      }));
+      base::BindOnce(
+          [](data_decoder::mojom::BundleResponsePtr response,
+             data_decoder::mojom::BundleResponseParseErrorPtr error) {
+            EXPECT_TRUE(response);
+            EXPECT_FALSE(error);
+            if (response) {
+              EXPECT_EQ(200, response->response_code);
+              EXPECT_EQ(0xdeadu, response->payload_offset);
+              EXPECT_EQ(0xbeafu, response->payload_length);
+            }
+          }));
 }
 
 TEST_F(BundledExchangesReaderTest, ReadResponseForURLContainingUserAndPass) {
@@ -112,14 +115,17 @@ TEST_F(BundledExchangesReaderTest, ReadResponseForURLContainingUserAndPass) {
 
   GetMockFactory()->ReadAndFullfillResponse(
       GetReader(), url, std::move(response),
-      base::BindOnce([](data_decoder::mojom::BundleResponsePtr response) {
-        EXPECT_TRUE(response);
-        if (response) {
-          EXPECT_EQ(200, response->response_code);
-          EXPECT_EQ(0xdeadu, response->payload_offset);
-          EXPECT_EQ(0xbeafu, response->payload_length);
-        }
-      }));
+      base::BindOnce(
+          [](data_decoder::mojom::BundleResponsePtr response,
+             data_decoder::mojom::BundleResponseParseErrorPtr error) {
+            EXPECT_TRUE(response);
+            EXPECT_FALSE(error);
+            if (response) {
+              EXPECT_EQ(200, response->response_code);
+              EXPECT_EQ(0xdeadu, response->payload_offset);
+              EXPECT_EQ(0xbeafu, response->payload_length);
+            }
+          }));
 }
 
 TEST_F(BundledExchangesReaderTest, ReadResponseForURLContainingFragment) {
@@ -136,14 +142,17 @@ TEST_F(BundledExchangesReaderTest, ReadResponseForURLContainingFragment) {
 
   GetMockFactory()->ReadAndFullfillResponse(
       GetReader(), url, std::move(response),
-      base::BindOnce([](data_decoder::mojom::BundleResponsePtr response) {
-        EXPECT_TRUE(response);
-        if (response) {
-          EXPECT_EQ(200, response->response_code);
-          EXPECT_EQ(0xdeadu, response->payload_offset);
-          EXPECT_EQ(0xbeafu, response->payload_length);
-        }
-      }));
+      base::BindOnce(
+          [](data_decoder::mojom::BundleResponsePtr response,
+             data_decoder::mojom::BundleResponseParseErrorPtr error) {
+            EXPECT_TRUE(response);
+            EXPECT_FALSE(error);
+            if (response) {
+              EXPECT_EQ(200, response->response_code);
+              EXPECT_EQ(0xdeadu, response->payload_offset);
+              EXPECT_EQ(0xbeafu, response->payload_length);
+            }
+          }));
 }
 
 TEST_F(BundledExchangesReaderTest, ReadResponseBody) {
diff --git a/chromium/content/browser/web_package/bundled_exchanges_source.cc b/chromium/content/browser/web_package/bundled_exchanges_source.cc
index a8478730a1a..c978f842ad5 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_source.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_source.cc
@@ -3,49 +3,75 @@
 // found in the LICENSE file.
 
 #include "content/browser/web_package/bundled_exchanges_source.h"
+
+#include "base/files/file.h"
+#include "base/memory/ptr_util.h"
+#include "build/build_config.h"
 #include "net/base/filename_util.h"
-#include "net/base/url_util.h"
 #include "url/gurl.h"
 
-namespace content {
+#if defined(OS_ANDROID)
+#include "base/android/content_uri_utils.h"
+#endif
 
-namespace {
+namespace content {
 
-bool MatchByFilePath(const GURL& url, const base::FilePath file_path) {
-  if (!url.SchemeIsFile())
-    return false;
-  base::FilePath url_file_path;
-  return net::FileURLToFilePath(url, &url_file_path) &&
-         file_path == url_file_path;
+// static
+std::unique_ptr<BundledExchangesSource>
+BundledExchangesSource::MaybeCreateFromTrustedFileUrl(const GURL& url) {
+#if defined(OS_ANDROID)
+  if (url.SchemeIs(url::kContentScheme)) {
+    const base::FilePath file_path = base::FilePath(url.spec());
+    return base::WrapUnique(
+        new BundledExchangesSource(/*is_trusted=*/true, file_path, url));
+  }
+#endif
+  DCHECK(url.SchemeIsFile());
+  base::FilePath file_path;
+  if (!net::FileURLToFilePath(url, &file_path))
+    return nullptr;
+  return base::WrapUnique(
+      new BundledExchangesSource(/*is_trusted=*/true, file_path, url));
 }
 
-}  // namespace
-
-BundledExchangesSource::BundledExchangesSource() {}
-
-BundledExchangesSource::BundledExchangesSource(const base::FilePath& path)
-    : file_path(path) {
-  DCHECK(!file_path.empty());
+// static
+std::unique_ptr<BundledExchangesSource>
+BundledExchangesSource::MaybeCreateFromFileUrl(const GURL& url) {
+  base::FilePath file_path;
+  if (url.SchemeIsFile()) {
+    if (net::FileURLToFilePath(url, &file_path)) {
+      return base::WrapUnique(
+          new BundledExchangesSource(/*is_trusted=*/false, file_path, url));
+    }
+  }
+#if defined(OS_ANDROID)
+  if (url.SchemeIs(url::kContentScheme)) {
+    return base::WrapUnique(new BundledExchangesSource(
+        /*is_trusted=*/false, base::FilePath(url.spec()), url));
+  }
+#endif
+  return nullptr;
 }
 
-BundledExchangesSource::BundledExchangesSource(
-    const BundledExchangesSource& src) = default;
-
-bool BundledExchangesSource::Match(const GURL& url) const {
-  if (!IsValid())
-    return false;
-
-  GURL request_url = net::SimplifyUrlForRequest(url);
-
-  if (!file_path.empty())
-    return MatchByFilePath(request_url, file_path);
-
-  NOTREACHED();
-  return false;
+std::unique_ptr<BundledExchangesSource> BundledExchangesSource::Clone() const {
+  return base::WrapUnique(
+      new BundledExchangesSource(is_trusted_, file_path_, url_));
 }
 
-bool BundledExchangesSource::IsValid() const {
-  return !file_path.empty();
+std::unique_ptr<base::File> BundledExchangesSource::OpenFile() const {
+#if defined(OS_ANDROID)
+  if (file_path_.IsContentUri()) {
+    return std::make_unique<base::File>(
+        base::OpenContentUriForRead(file_path_));
+  }
+#endif
+  return std::make_unique<base::File>(
+      file_path_, base::File::FLAG_OPEN | base::File::FLAG_READ);
 }
 
+BundledExchangesSource::BundledExchangesSource(bool is_trusted,
+                                               const base::FilePath& file_path,
+                                               const GURL& url)
+    : is_trusted_(is_trusted), file_path_(file_path), url_(url) {}
+
 }  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_source.h b/chromium/content/browser/web_package/bundled_exchanges_source.h
index effe41ef7df..1ad7ee49b98 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_source.h
+++ b/chromium/content/browser/web_package/bundled_exchanges_source.h
@@ -5,40 +5,57 @@
 #ifndef CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_SOURCE_H_
 #define CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_SOURCE_H_
 
+#include <memory>
+
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "content/common/content_export.h"
+#include "url/gurl.h"
 
-class GURL;
+namespace base {
+class File;
+}  // namespace base
 
 namespace content {
 
-// A struct to abstract required information to access a BundledExchanges.
-struct CONTENT_EXPORT BundledExchangesSource {
-  // Constructs an invalid instance that does not match any.
-  BundledExchangesSource();
-
-  // Constructs a valid instance that match file URL for the given |file_path|.
-  explicit BundledExchangesSource(const base::FilePath& file_path);
+// A class to abstract required information to access a BundledExchanges.
+class CONTENT_EXPORT BundledExchangesSource {
+ public:
+  // Used only for testing navigation to a trustable BundledExchanges source
+  // with --trustable-bundled-exchanges-file-url flag. Returns null when failed
+  // to get the filename from the |url|.
+  static std::unique_ptr<BundledExchangesSource> MaybeCreateFromTrustedFileUrl(
+      const GURL& url);
+  // Returns a new BundledExchangesSource for the |url| if the scheme of |url|
+  // is file: (or content: on Android). Otherwise returns null.
+  static std::unique_ptr<BundledExchangesSource> MaybeCreateFromFileUrl(
+      const GURL& url);
 
-  // Copy constructor.
-  explicit BundledExchangesSource(const BundledExchangesSource& src);
+  ~BundledExchangesSource() = default;
 
-  // Checks if this instance is valid and can match a URL.
-  bool IsValid() const;
+  std::unique_ptr<BundledExchangesSource> Clone() const;
 
-  // Checks if the given |url| is for the BundledExchanges itself that this
-  // instance represents. Note that this does not mean the |url| is for an
-  // exchange provided by the BundledExchanges.
-  bool Match(const GURL& url) const;
+  std::unique_ptr<base::File> OpenFile() const;
 
   // A flag to represent if this source can be trusted, i.e. using the URL in
   // the BundledExchanges as the origin for the content. Otherwise, we will use
   // the origin that serves the BundledExchanges itself. For instance, if the
   // BundledExchanges is in a local file system, file:// should be the origin.
-  bool is_trusted = false;
+  bool is_trusted() const { return is_trusted_; }
+
+  const base::FilePath& file_path() const { return file_path_; }
+  const GURL& url() const { return url_; }
+
+ private:
+  BundledExchangesSource(bool is_trusted,
+                         const base::FilePath& file_path,
+                         const GURL& url);
+
+  const bool is_trusted_;
+  const base::FilePath file_path_;
+  const GURL url_;
 
-  const base::FilePath file_path;
+  DISALLOW_COPY_AND_ASSIGN(BundledExchangesSource);
 };
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.cc b/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.cc
index 11751322753..c77f567b882 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.cc
@@ -12,6 +12,8 @@
 #include "base/strings/string_util.h"
 #include "base/task/post_task.h"
 #include "content/browser/web_package/bundled_exchanges_reader.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/web_contents.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
@@ -58,6 +60,19 @@ network::ResourceResponseHead CreateResourceResponse(
   return response_head;
 }
 
+void AddResponseParseErrorMessageToConsole(
+    int frame_tree_node_id,
+    const data_decoder::mojom::BundleResponseParseErrorPtr& error) {
+  WebContents* web_contents =
+      WebContents::FromFrameTreeNodeId(frame_tree_node_id);
+  if (!web_contents)
+    return;
+  web_contents->GetMainFrame()->AddMessageToConsole(
+      blink::mojom::ConsoleMessageLevel::kError,
+      std::string("Failed to read response header of Web Bundle file: ") +
+          error->message);
+}
+
 }  // namespace
 
 // TODO(crbug.com/966753): Consider security models, i.e. plausible CORS
@@ -67,12 +82,29 @@ class BundledExchangesURLLoaderFactory::EntryLoader final
  public:
   EntryLoader(base::WeakPtr<BundledExchangesURLLoaderFactory> factory,
               mojo::PendingRemote<network::mojom::URLLoaderClient> client,
-              const GURL& url)
-      : factory_(std::move(factory)), loader_client_(std::move(client)) {
+              const network::ResourceRequest& resource_request,
+              int frame_tree_node_id)
+      : factory_(std::move(factory)),
+        loader_client_(std::move(client)),
+        frame_tree_node_id_(frame_tree_node_id) {
     DCHECK(factory_);
-    factory_->GetReader()->ReadResponse(
-        url, base::BindOnce(&EntryLoader::OnResponseReady,
-                            weak_factory_.GetWeakPtr()));
+
+    // Parse the Range header if any.
+    // Whether range request should be supported or not is discussed here:
+    // https://github.com/WICG/webpackage/issues/478
+    std::string range_header;
+    if (resource_request.headers.GetHeader(net::HttpRequestHeaders::kRange,
+                                           &range_header)) {
+      std::vector<net::HttpByteRange> ranges;
+      if (net::HttpUtil::ParseRangeHeader(range_header, &ranges) &&
+          ranges.size() == 1) {  // We don't support multi-range requests.
+        byte_range_ = ranges[0];
+      }
+    }
+
+    factory_->reader()->ReadResponse(
+        resource_request.url, base::BindOnce(&EntryLoader::OnResponseReady,
+                                             weak_factory_.GetWeakPtr()));
   }
   ~EntryLoader() override = default;
 
@@ -86,19 +118,41 @@ class BundledExchangesURLLoaderFactory::EntryLoader final
   void PauseReadingBodyFromNet() override {}
   void ResumeReadingBodyFromNet() override {}
 
-  void OnResponseReady(data_decoder::mojom::BundleResponsePtr response) {
+  void OnResponseReady(data_decoder::mojom::BundleResponsePtr response,
+                       data_decoder::mojom::BundleResponseParseErrorPtr error) {
     if (!factory_ || !loader_client_.is_connected())
       return;
 
     // TODO(crbug.com/990733): For the initial implementation, we allow only
     // net::HTTP_OK, but we should clarify acceptable status code in the spec.
     if (!response || response->response_code != net::HTTP_OK) {
+      if (error)
+        AddResponseParseErrorMessageToConsole(frame_tree_node_id_, error);
       loader_client_->OnComplete(network::URLLoaderCompletionStatus(
           net::ERR_INVALID_BUNDLED_EXCHANGES));
       return;
     }
 
-    loader_client_->OnReceiveResponse(CreateResourceResponse(response));
+    network::ResourceResponseHead response_head =
+        CreateResourceResponse(response);
+    if (byte_range_) {
+      if (byte_range_->ComputeBounds(response->payload_length)) {
+        response_head.headers->UpdateWithNewRange(*byte_range_,
+                                                  response->payload_length,
+                                                  true /*replace_status_line*/);
+        // Adjust the offset and length to read.
+        // Note: This wouldn't work when the exchange is signed and its payload
+        // is mi-sha256 encoded. see crbug.com/1001366
+        response->payload_offset += byte_range_->first_byte_position();
+        response->payload_length = byte_range_->last_byte_position() -
+                                   byte_range_->first_byte_position() + 1;
+      } else {
+        loader_client_->OnComplete(network::URLLoaderCompletionStatus(
+            net::ERR_REQUEST_RANGE_NOT_SATISFIABLE));
+        return;
+      }
+    }
+    loader_client_->OnReceiveResponse(std::move(response_head));
 
     mojo::ScopedDataPipeProducerHandle producer_handle;
     mojo::ScopedDataPipeConsumerHandle consumer_handle;
@@ -119,7 +173,7 @@ class BundledExchangesURLLoaderFactory::EntryLoader final
       return;
     }
 
-    factory_->GetReader()->ReadResponseBody(
+    factory_->reader()->ReadResponseBody(
         std::move(response), std::move(producer_handle),
         base::BindOnce(&EntryLoader::FinishReadingBody,
                        weak_factory_.GetWeakPtr()));
@@ -137,6 +191,8 @@ class BundledExchangesURLLoaderFactory::EntryLoader final
 
   base::WeakPtr<BundledExchangesURLLoaderFactory> factory_;
   mojo::Remote<network::mojom::URLLoaderClient> loader_client_;
+  const int frame_tree_node_id_;
+  base::Optional<net::HttpByteRange> byte_range_;
 
   base::WeakPtrFactory<EntryLoader> weak_factory_{this};
 
@@ -144,8 +200,9 @@ class BundledExchangesURLLoaderFactory::EntryLoader final
 };
 
 BundledExchangesURLLoaderFactory::BundledExchangesURLLoaderFactory(
-    std::unique_ptr<BundledExchangesReader> reader)
-    : reader_(std::move(reader)) {}
+    scoped_refptr<BundledExchangesReader> reader,
+    int frame_tree_node_id)
+    : reader_(std::move(reader)), frame_tree_node_id_(frame_tree_node_id) {}
 
 BundledExchangesURLLoaderFactory::~BundledExchangesURLLoaderFactory() = default;
 
@@ -165,9 +222,9 @@ void BundledExchangesURLLoaderFactory::CreateLoaderAndStart(
   if (base::EqualsCaseInsensitiveASCII(resource_request.method,
                                        net::HttpRequestHeaders::kGetMethod) &&
       reader_->HasEntry(resource_request.url)) {
-    auto loader = std::make_unique<EntryLoader>(weak_factory_.GetWeakPtr(),
-                                                loader_client.PassInterface(),
-                                                resource_request.url);
+    auto loader = std::make_unique<EntryLoader>(
+        weak_factory_.GetWeakPtr(), loader_client.PassInterface(),
+        resource_request, frame_tree_node_id_);
     std::unique_ptr<network::mojom::URLLoader> url_loader = std::move(loader);
     mojo::MakeSelfOwnedReceiver(
         std::move(url_loader), mojo::PendingReceiver<network::mojom::URLLoader>(
@@ -183,8 +240,8 @@ void BundledExchangesURLLoaderFactory::CreateLoaderAndStart(
 }
 
 void BundledExchangesURLLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
-  bindings_.AddBinding(this, std::move(request));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.h b/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.h
index b194b0d97ae..5d148fbc119 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.h
+++ b/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory.h
@@ -8,8 +8,9 @@
 #include "base/callback.h"
 #include "base/memory/weak_ptr.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
@@ -23,7 +24,8 @@ class CONTENT_EXPORT BundledExchangesURLLoaderFactory final
     : public network::mojom::URLLoaderFactory {
  public:
   explicit BundledExchangesURLLoaderFactory(
-      std::unique_ptr<BundledExchangesReader> reader);
+      scoped_refptr<BundledExchangesReader> reader,
+      int frame_tree_node_id);
   ~BundledExchangesURLLoaderFactory() override;
 
   // Set a |network::mojom::URLLoaderFactory| remote interface used for requests
@@ -41,16 +43,20 @@ class CONTENT_EXPORT BundledExchangesURLLoaderFactory final
                             network::mojom::URLLoaderClientPtr loader_client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
+
+  const scoped_refptr<BundledExchangesReader>& reader() const {
+    return reader_;
+  }
 
  private:
   class EntryLoader;
   friend class EntryLoader;
 
-  BundledExchangesReader* GetReader() { return reader_.get(); }
-
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
-  std::unique_ptr<BundledExchangesReader> reader_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
+  scoped_refptr<BundledExchangesReader> reader_;
+  const int frame_tree_node_id_;
   mojo::Remote<network::mojom::URLLoaderFactory> fallback_factory_;
 
   base::WeakPtrFactory<BundledExchangesURLLoaderFactory> weak_factory_{this};
diff --git a/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory_unittest.cc b/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory_unittest.cc
index afe968f59d1..c73b6d12fde 100644
--- a/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory_unittest.cc
+++ b/chromium/content/browser/web_package/bundled_exchanges_url_loader_factory_unittest.cc
@@ -9,6 +9,7 @@
 #include "base/optional.h"
 #include "base/run_loop.h"
 #include "base/test/task_environment.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/web_package/bundled_exchanges_reader.h"
 #include "content/browser/web_package/mock_bundled_exchanges_reader_factory.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -34,8 +35,8 @@ class BundledExchangesURLLoaderFactoryTest : public testing::Test {
     mock_factory_ = MockBundledExchangesReaderFactory::Create();
     auto reader = mock_factory_->CreateReader(body_);
     reader_ = reader.get();
-    loader_factory_ =
-        std::make_unique<BundledExchangesURLLoaderFactory>(std::move(reader));
+    loader_factory_ = std::make_unique<BundledExchangesURLLoaderFactory>(
+        std::move(reader), FrameTreeNode::kFrameTreeNodeInvalidId);
 
     base::flat_map<GURL, data_decoder::mojom::BundleIndexValuePtr> items;
     data_decoder::mojom::BundleIndexValuePtr item =
@@ -59,27 +60,27 @@ class BundledExchangesURLLoaderFactoryTest : public testing::Test {
             },
             run_loop.QuitClosure()));
     run_loop.Run();
+
+    // Set some useful default values for |resource_request_|.
+    resource_request_.url = primary_url_;
+    resource_request_.method = net::HttpRequestHeaders::kGetMethod;
   }
 
-  // This function creates a URLLoader, and simulates a response for
-  // BundledExchangesReader::ReadResponse with |response| if it is given.
-  // |response| can contains nullptr to simulate the case ReadResponse fails.
+  // This function creates a URLLoader with |resource_request_|, and simulates
+  // a response for BundledExchangesReader::ReadResponse with |response| if it
+  // is given. |response| can contain nullptr to simulate the case ReadResponse
+  // fails.
   mojo::Remote<network::mojom::URLLoader> CreateLoaderAndStart(
-      const GURL& url,
-      const std::string& method,
       base::Optional<data_decoder::mojom::BundleResponsePtr> response,
       bool clone = false) {
     mojo::Remote<network::mojom::URLLoader> loader;
-    network::ResourceRequest resource_request;
-    resource_request.url = url;
-    resource_request.method = method;
 
     if (clone) {
       mojo::Remote<network::mojom::URLLoaderFactory> loader_factory;
       loader_factory_->Clone(loader_factory.BindNewPipeAndPassReceiver());
       loader_factory->CreateLoaderAndStart(
           loader.BindNewPipeAndPassReceiver(),
-          /*routing_id=*/0, /*request_id=*/0, /*options=*/0, resource_request,
+          /*routing_id=*/0, /*request_id=*/0, /*options=*/0, resource_request_,
           test_client_.CreateInterfacePtr(),
           net::MutableNetworkTrafficAnnotationTag(
               TRAFFIC_ANNOTATION_FOR_TESTS));
@@ -87,7 +88,7 @@ class BundledExchangesURLLoaderFactoryTest : public testing::Test {
     } else {
       loader_factory_->CreateLoaderAndStart(
           loader.BindNewPipeAndPassReceiver(),
-          /*routing_id=*/0, /*request_id=*/0, /*options=*/0, resource_request,
+          /*routing_id=*/0, /*request_id=*/0, /*options=*/0, resource_request_,
           test_client_.CreateInterfacePtr(),
           net::MutableNetworkTrafficAnnotationTag(
               TRAFFIC_ANNOTATION_FOR_TESTS));
@@ -101,7 +102,8 @@ class BundledExchangesURLLoaderFactoryTest : public testing::Test {
   const GURL& GetPrimaryURL() const { return primary_url_; }
   const std::string& GetBody() const { return body_; }
 
-  void RunAndCheck(const std::string expected_body) {
+  void RunAndCheck(int expected_response_code,
+                   const std::string expected_body) {
     test_client_.RunUntilResponseBodyArrived();
 
     EXPECT_TRUE(test_client_.has_received_response());
@@ -109,10 +111,11 @@ class BundledExchangesURLLoaderFactoryTest : public testing::Test {
     EXPECT_FALSE(test_client_.has_received_upload_progress());
     EXPECT_FALSE(test_client_.has_received_cached_metadata());
 
-    ASSERT_TRUE(test_client_.response_head().headers);
+    ASSERT_TRUE(test_client_.response_head()->headers);
     ASSERT_TRUE(test_client_.response_body());
 
-    EXPECT_EQ(200, test_client_.response_head().headers->response_code());
+    EXPECT_EQ(expected_response_code,
+              test_client_.response_head()->headers->response_code());
 
     if (!expected_body.empty()) {
       std::vector<char> buffer(expected_body.size() * 2);
@@ -146,6 +149,13 @@ class BundledExchangesURLLoaderFactoryTest : public testing::Test {
     loader_factory_->SetFallbackFactory(std::move(fallback_factory));
   }
 
+  const network::TestURLLoaderClient& GetTestClient() const {
+    return test_client_;
+  }
+
+ protected:
+  network::ResourceRequest resource_request_;
+
  private:
   base::test::TaskEnvironment task_environment_;
   std::unique_ptr<MockBundledExchangesReaderFactory> mock_factory_;
@@ -165,11 +175,29 @@ TEST_F(BundledExchangesURLLoaderFactoryTest, CreateEntryLoader) {
   response->payload_offset = 0;
   response->payload_length = GetBody().size();
 
-  auto loader =
-      CreateLoaderAndStart(GetPrimaryURL(), net::HttpRequestHeaders::kGetMethod,
-                           std::move(response));
+  auto loader = CreateLoaderAndStart(std::move(response));
+
+  RunAndCheck(200, GetBody());
+}
+
+TEST_F(BundledExchangesURLLoaderFactoryTest, RangeRequest) {
+  data_decoder::mojom::BundleResponsePtr response =
+      data_decoder::mojom::BundleResponse::New();
+  response->response_code = 200;
+  response->payload_offset = 0;
+  response->payload_length = GetBody().size();
+
+  resource_request_.headers.SetHeader(net::HttpRequestHeaders::kRange,
+                                      "bytes=10-19");
+
+  auto loader = CreateLoaderAndStart(std::move(response));
 
-  RunAndCheck(GetBody());
+  RunAndCheck(206, GetBody().substr(10, 10));
+  EXPECT_EQ(10, GetTestClient().response_head()->headers->GetContentLength());
+  std::string content_range;
+  EXPECT_TRUE(GetTestClient().response_head()->headers->EnumerateHeader(
+      nullptr, net::HttpResponseHeaders::kContentRange, &content_range));
+  EXPECT_EQ("bytes 10-19/25", content_range);
 }
 
 TEST_F(BundledExchangesURLLoaderFactoryTest,
@@ -180,11 +208,11 @@ TEST_F(BundledExchangesURLLoaderFactoryTest,
   response->payload_offset = 0;
   response->payload_length = GetBody().size();
 
-  auto loader = CreateLoaderAndStart(
-      GURL("https://user:pass@test.example.org/"),
-      net::HttpRequestHeaders::kGetMethod, std::move(response));
+  resource_request_.url = GURL("https://user:pass@test.example.org/");
 
-  RunAndCheck(GetBody());
+  auto loader = CreateLoaderAndStart(std::move(response));
+
+  RunAndCheck(200, GetBody());
 }
 
 TEST_F(BundledExchangesURLLoaderFactoryTest,
@@ -195,36 +223,31 @@ TEST_F(BundledExchangesURLLoaderFactoryTest,
   response->payload_offset = 0;
   response->payload_length = GetBody().size();
 
-  auto loader = CreateLoaderAndStart(GURL("https://test.example.org/#test"),
-                                     net::HttpRequestHeaders::kGetMethod,
-                                     std::move(response));
+  resource_request_.url = GURL("https://test.example.org/#test");
+
+  auto loader = CreateLoaderAndStart(std::move(response));
 
-  RunAndCheck(GetBody());
+  RunAndCheck(200, GetBody());
 }
 
 TEST_F(BundledExchangesURLLoaderFactoryTest,
        CreateEntryLoaderAndFailToReadResponse) {
-  auto loader =
-      CreateLoaderAndStart(GetPrimaryURL(), net::HttpRequestHeaders::kGetMethod,
-                           /*response=*/nullptr);
+  auto loader = CreateLoaderAndStart(/*response=*/nullptr);
 
   RunAndCheckFailure(net::ERR_INVALID_BUNDLED_EXCHANGES);
 }
 
 TEST_F(BundledExchangesURLLoaderFactoryTest, CreateLoaderForPost) {
   // URL should match, but POST method should not be handled by the EntryLoader.
-  auto loader =
-      CreateLoaderAndStart(GetPrimaryURL(), "POST", /*response=*/base::nullopt);
+  resource_request_.method = "POST";
+  auto loader = CreateLoaderAndStart(/*response=*/base::nullopt);
 
   RunAndCheckFailure(net::ERR_FAILED);
 }
 
 TEST_F(BundledExchangesURLLoaderFactoryTest, CreateLoaderForNotSupportedURL) {
-  data_decoder::mojom::BundleResponsePtr response =
-      data_decoder::mojom::BundleResponse::New();
-  auto loader = CreateLoaderAndStart(GURL("https://test.example.org/nowhere"),
-                                     net::HttpRequestHeaders::kGetMethod,
-                                     /*response=*/base::nullopt);
+  resource_request_.url = GURL("https://test.example.org/nowhere");
+  auto loader = CreateLoaderAndStart(/*response=*/base::nullopt);
 
   RunAndCheckFailure(net::ERR_FAILED);
 }
@@ -241,15 +264,15 @@ TEST_F(BundledExchangesURLLoaderFactoryTest, CreateFallbackLoader) {
   // Access to the 404 address for the BundledExchanges, so to be handled by
   // the fallback factory set above.
   const std::string url_string = "https://test.example.org/somewhere";
-  auto loader = CreateLoaderAndStart(
-      GURL(url_string), net::HttpRequestHeaders::kGetMethod, base::nullopt);
+  resource_request_.url = GURL(url_string);
+  auto loader = CreateLoaderAndStart(base::nullopt);
   ASSERT_EQ(1, test_factory->NumPending());
 
   // Reply with a mock response.
   test_factory->SimulateResponseForPendingRequest(url_string, GetBody(),
                                                   net::HTTP_OK);
 
-  RunAndCheck(GetBody());
+  RunAndCheck(200, GetBody());
 }
 
 TEST_F(BundledExchangesURLLoaderFactoryTest, CreateByClonedFactory) {
@@ -259,11 +282,9 @@ TEST_F(BundledExchangesURLLoaderFactoryTest, CreateByClonedFactory) {
   response->payload_offset = 0;
   response->payload_length = GetBody().size();
 
-  auto loader =
-      CreateLoaderAndStart(GetPrimaryURL(), net::HttpRequestHeaders::kGetMethod,
-                           std::move(response), /*clone=*/true);
+  auto loader = CreateLoaderAndStart(std::move(response), /*clone=*/true);
 
-  RunAndCheck(GetBody());
+  RunAndCheck(200, GetBody());
 }
 
 }  // namespace
diff --git a/chromium/content/browser/web_package/bundled_exchanges_utils.cc b/chromium/content/browser/web_package/bundled_exchanges_utils.cc
new file mode 100644
index 00000000000..b494791a4ca
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_utils.cc
@@ -0,0 +1,101 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/bundled_exchanges_utils.h"
+
+#include "base/command_line.h"
+#include "base/feature_list.h"
+#include "build/build_config.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/content_features.h"
+#include "content/public/common/content_switches.h"
+#include "url/gurl.h"
+
+#if defined(OS_ANDROID)
+#include "url/url_constants.h"
+#endif  // defined(OS_ANDROID)
+
+namespace content {
+namespace bundled_exchanges_utils {
+namespace {
+
+const base::FilePath::CharType kBundledExchangesFileExtension[] =
+    FILE_PATH_LITERAL(".wbn");
+
+}  // namespace
+
+bool IsSupprtedFileScheme(const GURL& url) {
+  if (url.SchemeIsFile())
+    return true;
+#if defined(OS_ANDROID)
+  if (url.SchemeIs(url::kContentScheme))
+    return true;
+#endif  // defined(OS_ANDROID)
+  return false;
+}
+
+bool CanLoadAsTrustableBundledExchangesFile(const GURL& url) {
+  if (!GetContentClient()->browser()->CanAcceptUntrustedExchangesIfNeeded())
+    return false;
+  if (!IsSupprtedFileScheme(url))
+    return false;
+  if (!base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kTrustableBundledExchangesFileUrl)) {
+    return false;
+  }
+  return base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
+             switches::kTrustableBundledExchangesFileUrl) == url.spec();
+}
+
+bool CanLoadAsBundledExchangesFile(const GURL& url) {
+  if (!base::FeatureList::IsEnabled(features::kWebBundles))
+    return false;
+  return IsSupprtedFileScheme(url);
+}
+
+bool CanLoadAsBundledExchanges(const GURL& url, const std::string& mime_type) {
+  if (!base::FeatureList::IsEnabled(features::kWebBundles))
+    return false;
+  // Currently loading bundled exchanges file from server response is not
+  // implemented yet.
+  if (!IsSupprtedFileScheme(url))
+    return false;
+  return mime_type == kBundledExchangesFileMimeTypeWithoutParameters;
+}
+
+bool GetBundledExchangesFileMimeTypeFromFile(const base::FilePath& path,
+                                             std::string* mime_type) {
+  DCHECK(mime_type);
+  if (!base::FeatureList::IsEnabled(features::kWebBundles))
+    return false;
+  if (path.Extension() != kBundledExchangesFileExtension)
+    return false;
+  *mime_type = kBundledExchangesFileMimeTypeWithoutParameters;
+  return true;
+}
+
+GURL GetSynthesizedUrlForBundledExchanges(
+    const GURL& bundled_exchanges_file_url,
+    const GURL& url_in_bundles) {
+  url::Replacements<char> replacements;
+
+  url::Replacements<char> clear_ref;
+  clear_ref.ClearRef();
+  std::string query_string = url_in_bundles.ReplaceComponents(clear_ref).spec();
+  url::Component new_query(0, query_string.size());
+  replacements.SetQuery(query_string.c_str(), new_query);
+
+  if (!url_in_bundles.has_ref()) {
+    replacements.ClearRef();
+    return bundled_exchanges_file_url.ReplaceComponents(replacements);
+  }
+  url::Component new_ref(0, url_in_bundles.ref().size());
+  std::string ref_string = url_in_bundles.ref();
+  replacements.SetRef(ref_string.c_str(), new_ref);
+  return bundled_exchanges_file_url.ReplaceComponents(replacements);
+}
+
+}  // namespace bundled_exchanges_utils
+}  // namespace content
diff --git a/chromium/content/browser/web_package/bundled_exchanges_utils.h b/chromium/content/browser/web_package/bundled_exchanges_utils.h
new file mode 100644
index 00000000000..590dfb3b8ad
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_utils.h
@@ -0,0 +1,72 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_UTILS_H_
+#define CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_UTILS_H_
+
+#include "base/files/file_path.h"
+#include "content/common/content_export.h"
+
+class GURL;
+
+namespace content {
+namespace bundled_exchanges_utils {
+
+// The "application/webbundle" MIME type must have a "v" parameter whose value
+// is a format version [1]. But we use the "application/webbundle" MIME type
+// without "v" parameter while loading bundled exchanges files in local storage.
+// This is because Android's intent-filter is not designed to support such
+// parameters.
+// IntentResolver.queryIntent() [2] is called when a filer application calls
+// PackageManager.queryIntentActivities() to open files. But this queryIntent()
+// doesn't support Media Type's parameters matching. For example, if we add a
+// <intent-filter> with <data android:mimeType="application/webbundle;v=b1" />
+// in AndroidManifest.xml, the data with "application/webbundle; v=b1" which has
+// a space after ";" doesn't match the filter.
+// [1]
+// https://wicg.github.io/webpackage/draft-yasskin-wpack-bundled-exchanges.html#internet-media-type-registration
+// [2]
+// https://android.googlesource.com/platform/frameworks/base/+/4ab9511/services/core/java/com/android/server/IntentResolver.java#398
+constexpr char kBundledExchangesFileMimeTypeWithoutParameters[] =
+    "application/webbundle";
+
+// On Android, returns true if the url scheme is file or content. On other
+// platforms, returns true if the url scheme is file.
+bool IsSupprtedFileScheme(const GURL& url);
+
+// Returns true if |url| is the file URL which is specified with
+// --trustable-bundled-exchanges-file-url flag. Always returns false when
+// ContentBrowserClient::CanAcceptUntrustedExchangesIfNeeded() is false.
+bool CanLoadAsTrustableBundledExchangesFile(const GURL& url);
+
+// Returns whether bundled exchanges file can be loaded from the |url|. Always
+// returns false when BundledHTTPExchanges feature is not enabled.
+bool CanLoadAsBundledExchangesFile(const GURL& url);
+
+// Returns whether bundled exchanges file can be loaded from the |url| with
+// the |mime_type|. Always returns false when BundledHTTPExchanges feature is
+// not enabled.
+bool CanLoadAsBundledExchanges(const GURL& url, const std::string& mime_type);
+
+// Sets |mime_type| to "application/webbundle" and returns true, when
+// BundledHTTPExchanges feature is enabled, and the extension of the |path| is
+// ".wbn". Otherwise returns false.
+bool GetBundledExchangesFileMimeTypeFromFile(const base::FilePath& path,
+                                             std::string* mime_type);
+
+// Generate a synthesized URL which can indicate the url in bundled exchanges
+// file.
+// Example:
+//   bundled_exchanges_file_url: file:///dir/x.wbn?query1#ref1
+//   url_in_bundles: https://example.com/a.html?query2#ref2
+//      => synthesized URL:
+//           file:///dir/x.wbn?https://example.com/a.html?query2#ref2
+CONTENT_EXPORT GURL
+GetSynthesizedUrlForBundledExchanges(const GURL& bundled_exchanges_file_url,
+                                     const GURL& url_in_bundles);
+
+}  // namespace bundled_exchanges_utils
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_WEB_PACKAGE_BUNDLED_EXCHANGES_UTILS_H_
diff --git a/chromium/content/browser/web_package/bundled_exchanges_utils_unittest.cc b/chromium/content/browser/web_package/bundled_exchanges_utils_unittest.cc
new file mode 100644
index 00000000000..44b04953630
--- /dev/null
+++ b/chromium/content/browser/web_package/bundled_exchanges_utils_unittest.cc
@@ -0,0 +1,45 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/web_package/bundled_exchanges_utils.h"
+
+#include "testing/gtest/include/gtest/gtest.h"
+#include "url/gurl.h"
+
+namespace content {
+namespace bundled_exchanges_utils {
+
+TEST(BundledExchangesUtilsTest, GetSynthesizedUrlForBundledExchanges) {
+  EXPECT_EQ(GURL("file:///dir/x.wbn?https://example.com/a.html"),
+            GetSynthesizedUrlForBundledExchanges(
+                GURL("file:///dir/x.wbn"), GURL("https://example.com/a.html")));
+
+  EXPECT_EQ(
+      GURL("file:///dir/x.wbn?https://example.com/a.html?query"),
+      GetSynthesizedUrlForBundledExchanges(
+          GURL("file:///dir/x.wbn"), GURL("https://example.com/a.html?query")));
+
+  EXPECT_EQ(GURL("file:///dir/x.wbn?https://example.com/a.html?query2"),
+            GetSynthesizedUrlForBundledExchanges(
+                GURL("file:///dir/x.wbn?query1"),
+                GURL("https://example.com/a.html?query2")));
+
+  EXPECT_EQ(
+      GURL("file:///dir/x.wbn?https://example.com/a.html"),
+      GetSynthesizedUrlForBundledExchanges(GURL("file:///dir/x.wbn#ref"),
+                                           GURL("https://example.com/a.html")));
+
+  EXPECT_EQ(GURL("file:///dir/x.wbn?https://example.com/a.html#ref2"),
+            GetSynthesizedUrlForBundledExchanges(
+                GURL("file:///dir/x.wbn#ref1"),
+                GURL("https://example.com/a.html#ref2")));
+
+  EXPECT_EQ(GURL("file:///dir/x.wbn?https://example.com/a.html?query2#ref2"),
+            GetSynthesizedUrlForBundledExchanges(
+                GURL("file:///dir/x.wbn?query1#ref1"),
+                GURL("https://example.com/a.html?query2#ref2")));
+}
+
+}  // namespace bundled_exchanges_utils
+}  // namespace content
diff --git a/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.cc b/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.cc
index ac38fb3ec57..a1b05272faf 100644
--- a/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.cc
+++ b/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.cc
@@ -19,6 +19,7 @@
 #include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
+#include "net/base/filename_util.h"
 #include "services/data_decoder/public/mojom/bundled_exchanges_parser.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -148,7 +149,7 @@ class MockBundledExchangesReaderFactoryImpl final
       : MockBundledExchangesReaderFactory() {}
   ~MockBundledExchangesReaderFactoryImpl() override = default;
 
-  std::unique_ptr<BundledExchangesReader> CreateReader(
+  scoped_refptr<BundledExchangesReader> CreateReader(
       const std::string& test_file_data) override {
     if (!temp_dir_.CreateUniqueTempDir() ||
         !CreateTemporaryFileInDir(temp_dir_.GetPath(), &temp_file_path_) ||
@@ -158,8 +159,9 @@ class MockBundledExchangesReaderFactoryImpl final
       return nullptr;
     }
 
-    BundledExchangesSource source(temp_file_path_);
-    auto reader = std::make_unique<BundledExchangesReader>(source);
+    auto reader = base::MakeRefCounted<BundledExchangesReader>(
+        BundledExchangesSource::MaybeCreateFromTrustedFileUrl(
+            net::FilePathToFileURL(temp_file_path_)));
 
     std::unique_ptr<MockParserFactory> factory =
         std::make_unique<MockParserFactory>();
@@ -205,8 +207,10 @@ class MockBundledExchangesReaderFactoryImpl final
         url, base::BindOnce(
                  [](base::Closure quit_closure,
                     BundledExchangesReader::ResponseCallback callback,
-                    data_decoder::mojom::BundleResponsePtr response) {
-                   std::move(callback).Run(std::move(response));
+                    data_decoder::mojom::BundleResponsePtr response,
+                    data_decoder::mojom::BundleResponseParseErrorPtr error) {
+                   std::move(callback).Run(std::move(response),
+                                           std::move(error));
                    std::move(quit_closure).Run();
                  },
                  run_loop.QuitClosure(), std::move(callback)));
diff --git a/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.h b/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.h
index ee82a1779b9..1497d699670 100644
--- a/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.h
+++ b/chromium/content/browser/web_package/mock_bundled_exchanges_reader_factory.h
@@ -25,7 +25,7 @@ class MockBundledExchangesReaderFactory {
   // Creates BundledExchangesReader instance. A temporary file is created and
   // |test_file_data| is stored. This temporary file is used when
   // BundledExchangesReader::ReadResponseBody() is called.
-  virtual std::unique_ptr<BundledExchangesReader> CreateReader(
+  virtual scoped_refptr<BundledExchangesReader> CreateReader(
       const std::string& test_file_data) = 0;
 
   // Calls ReadMetadata with |callback| for |reader|, and simulates the call as
diff --git a/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc b/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc
index 50162f66158..1bf7de47356 100644
--- a/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc
+++ b/chromium/content/browser/web_package/prefetched_signed_exchange_cache.cc
@@ -18,8 +18,9 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/navigation_policy.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/http/http_cache.h"
 #include "net/http/http_util.h"
@@ -330,14 +331,14 @@ class SubresourceSignedExchangeURLLoaderFactory
     : public network::mojom::URLLoaderFactory {
  public:
   SubresourceSignedExchangeURLLoaderFactory(
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       std::unique_ptr<const PrefetchedSignedExchangeCache::Entry> entry,
       const url::Origin& request_initiator_site_lock)
       : entry_(std::move(entry)),
         request_initiator_site_lock_(request_initiator_site_lock) {
-    bindings_.AddBinding(this, std::move(request));
-    bindings_.set_connection_error_handler(base::BindRepeating(
-        &SubresourceSignedExchangeURLLoaderFactory::OnConnectionError,
+    receivers_.Add(this, std::move(receiver));
+    receivers_.set_disconnect_handler(base::BindRepeating(
+        &SubresourceSignedExchangeURLLoaderFactory::OnMojoDisconnect,
         base::Unretained(this)));
   }
   ~SubresourceSignedExchangeURLLoaderFactory() override {}
@@ -361,20 +362,21 @@ class SubresourceSignedExchangeURLLoaderFactory
             false /* is_navigation_request */),
         std::move(loader));
   }
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
-    bindings_.AddBinding(this, std::move(request));
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
+    receivers_.Add(this, std::move(receiver));
   }
 
  private:
-  void OnConnectionError() {
-    if (!bindings_.empty())
+  void OnMojoDisconnect() {
+    if (!receivers_.empty())
       return;
     delete this;
   }
 
   std::unique_ptr<const PrefetchedSignedExchangeCache::Entry> entry_;
   const url::Origin request_initiator_site_lock_;
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   DISALLOW_COPY_AND_ASSIGN(SubresourceSignedExchangeURLLoaderFactory);
 };
diff --git a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc
index 99ffb319be1..d3ea5638d31 100644
--- a/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_cert_fetcher_unittest.cc
@@ -14,6 +14,7 @@
 #include "components/cbor/writer.h"
 #include "content/public/common/resource_type.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/base/load_flags.h"
 #include "net/cert/x509_util.h"
@@ -119,7 +120,8 @@ class URLLoaderFactoryForMockLoader final
     client_ptr_ = std::move(client);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest factory) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> factory)
+      override {
     NOTREACHED();
   }
 
diff --git a/chromium/content/browser/web_package/signed_exchange_certificate_chain.cc b/chromium/content/browser/web_package/signed_exchange_certificate_chain.cc
index 947af81b3b4..d9151fdff48 100644
--- a/chromium/content/browser/web_package/signed_exchange_certificate_chain.cc
+++ b/chromium/content/browser/web_package/signed_exchange_certificate_chain.cc
@@ -15,6 +15,7 @@
 #include "content/browser/web_package/signed_exchange_consts.h"
 #include "content/browser/web_package/signed_exchange_utils.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "crypto/sha2.h"
 #include "net/cert/asn1_util.h"
 #include "net/cert/x509_certificate.h"
diff --git a/chromium/content/browser/web_package/signed_exchange_consts.h b/chromium/content/browser/web_package/signed_exchange_consts.h
index ad674a2d246..3b7b7615495 100644
--- a/chromium/content/browser/web_package/signed_exchange_consts.h
+++ b/chromium/content/browser/web_package/signed_exchange_consts.h
@@ -8,7 +8,7 @@
 namespace content {
 
 constexpr char kAcceptHeaderSignedExchangeSuffix[] =
-    ",application/signed-exchange;v=b3";
+    ",application/signed-exchange;v=b3;q=0.9";
 
 enum class SignedExchangeVersion { kUnknown, kB3 };
 
diff --git a/chromium/content/browser/web_package/signed_exchange_devtools_proxy.cc b/chromium/content/browser/web_package/signed_exchange_devtools_proxy.cc
index cb29a54a157..416c4536c50 100644
--- a/chromium/content/browser/web_package/signed_exchange_devtools_proxy.cc
+++ b/chromium/content/browser/web_package/signed_exchange_devtools_proxy.cc
@@ -22,12 +22,12 @@ namespace content {
 SignedExchangeDevToolsProxy::SignedExchangeDevToolsProxy(
     const GURL& outer_request_url,
     const network::ResourceResponseHead& outer_response,
-    base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+    int frame_tree_node_id,
     base::Optional<const base::UnguessableToken> devtools_navigation_token,
     bool report_raw_headers)
     : outer_request_url_(outer_request_url),
       outer_response_(outer_response),
-      frame_tree_node_id_getter_(frame_tree_node_id_getter),
+      frame_tree_node_id_(frame_tree_node_id),
       devtools_navigation_token_(devtools_navigation_token),
       devtools_enabled_(report_raw_headers) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -43,7 +43,7 @@ void SignedExchangeDevToolsProxy::ReportError(
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   errors_.push_back(SignedExchangeError(message, std::move(error_field)));
   WebContents* web_contents =
-      WebContents::FromFrameTreeNodeId(frame_tree_node_id_getter_.Run());
+      WebContents::FromFrameTreeNodeId(frame_tree_node_id_);
   if (!web_contents)
     return;
   web_contents->GetMainFrame()->AddMessageToConsole(
@@ -57,7 +57,7 @@ void SignedExchangeDevToolsProxy::CertificateRequestSent(
     return;
 
   FrameTreeNode* frame_tree_node =
-      FrameTreeNode::GloballyFindByID(frame_tree_node_id_getter_.Run());
+      FrameTreeNode::GloballyFindByID(frame_tree_node_id_);
   if (!frame_tree_node)
     return;
 
@@ -75,7 +75,7 @@ void SignedExchangeDevToolsProxy::CertificateResponseReceived(
     return;
 
   FrameTreeNode* frame_tree_node =
-      FrameTreeNode::GloballyFindByID(frame_tree_node_id_getter_.Run());
+      FrameTreeNode::GloballyFindByID(frame_tree_node_id_);
   if (!frame_tree_node)
     return;
 
@@ -92,7 +92,7 @@ void SignedExchangeDevToolsProxy::CertificateRequestCompleted(
     return;
 
   FrameTreeNode* frame_tree_node =
-      FrameTreeNode::GloballyFindByID(frame_tree_node_id_getter_.Run());
+      FrameTreeNode::GloballyFindByID(frame_tree_node_id_);
   if (!frame_tree_node)
     return;
 
@@ -112,7 +112,7 @@ void SignedExchangeDevToolsProxy::OnSignedExchangeReceived(
     ssl_info_opt = *ssl_info;
 
   FrameTreeNode* frame_tree_node =
-      FrameTreeNode::GloballyFindByID(frame_tree_node_id_getter_.Run());
+      FrameTreeNode::GloballyFindByID(frame_tree_node_id_);
   if (!frame_tree_node)
     return;
 
diff --git a/chromium/content/browser/web_package/signed_exchange_devtools_proxy.h b/chromium/content/browser/web_package/signed_exchange_devtools_proxy.h
index 2ba6b9917c9..b530f47d95b 100644
--- a/chromium/content/browser/web_package/signed_exchange_devtools_proxy.h
+++ b/chromium/content/browser/web_package/signed_exchange_devtools_proxy.h
@@ -40,10 +40,6 @@ class SignedExchangeEnvelope;
 // DevTools via the UI thread to show signed exchange related information.
 class CONTENT_EXPORT SignedExchangeDevToolsProxy {
  public:
-  // |frame_tree_node_id_getter| callback will be called on the UI thread to get
-  // the frame tree node ID. Note: We are using callback beause when Network
-  // Service is not enabled the ID is not available while handling prefetch
-  // requests on the IO thread.
   // When the signed exchange request is a navigation request,
   // |devtools_navigation_token| can be used to find the matching request in
   // DevTools. But when the signed exchange request is a prefetch request, the
@@ -53,7 +49,7 @@ class CONTENT_EXPORT SignedExchangeDevToolsProxy {
   SignedExchangeDevToolsProxy(
       const GURL& outer_request_url,
       const network::ResourceResponseHead& outer_response_head,
-      base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+      int frame_tree_node_id,
       base::Optional<const base::UnguessableToken> devtools_navigation_token,
       bool report_raw_headers);
   ~SignedExchangeDevToolsProxy();
@@ -79,7 +75,7 @@ class CONTENT_EXPORT SignedExchangeDevToolsProxy {
  private:
   const GURL outer_request_url_;
   const network::ResourceResponseHead outer_response_;
-  const base::RepeatingCallback<int(void)> frame_tree_node_id_getter_;
+  const int frame_tree_node_id_;
   const base::Optional<const base::UnguessableToken> devtools_navigation_token_;
   const bool devtools_enabled_;
   std::vector<SignedExchangeError> errors_;
diff --git a/chromium/content/browser/web_package/signed_exchange_handler.cc b/chromium/content/browser/web_package/signed_exchange_handler.cc
index b62ebe4218b..82838fc6d68 100644
--- a/chromium/content/browser/web_package/signed_exchange_handler.cc
+++ b/chromium/content/browser/web_package/signed_exchange_handler.cc
@@ -88,7 +88,7 @@ void VerifyCert(const scoped_refptr<net::X509Certificate>& certificate,
                 const GURL& url,
                 const std::string& ocsp_result,
                 const std::string& sct_list,
-                base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+                int frame_tree_node_id,
                 VerifyCallback callback) {
   VerifyCallback wrapped_callback = mojo::WrapCallbackWithDefaultInvokeIfNotRun(
       std::move(callback), net::ERR_FAILED, net::CertVerifyResult(),
@@ -97,8 +97,7 @@ void VerifyCert(const scoped_refptr<net::X509Certificate>& certificate,
   network::mojom::NetworkContext* network_context =
       g_network_context_for_testing;
   if (!network_context) {
-    auto* frame =
-        FrameTreeNode::GloballyFindByID(frame_tree_node_id_getter.Run());
+    auto* frame = FrameTreeNode::GloballyFindByID(frame_tree_node_id);
     if (!frame)
       return;
 
@@ -176,7 +175,7 @@ SignedExchangeHandler::SignedExchangeHandler(
     std::unique_ptr<blink::SignedExchangeRequestMatcher> request_matcher,
     std::unique_ptr<SignedExchangeDevToolsProxy> devtools_proxy,
     SignedExchangeReporter* reporter,
-    base::RepeatingCallback<int(void)> frame_tree_node_id_getter)
+    int frame_tree_node_id)
     : is_secure_transport_(is_secure_transport),
       has_nosniff_(has_nosniff),
       headers_callback_(std::move(headers_callback)),
@@ -186,7 +185,7 @@ SignedExchangeHandler::SignedExchangeHandler(
       request_matcher_(std::move(request_matcher)),
       devtools_proxy_(std::move(devtools_proxy)),
       reporter_(reporter),
-      frame_tree_node_id_getter_(frame_tree_node_id_getter) {
+      frame_tree_node_id_(frame_tree_node_id) {
   TRACE_EVENT0(TRACE_DISABLED_BY_DEFAULT("loading"),
                "SignedExchangeHandler::SignedExchangeHandler");
 
@@ -237,7 +236,8 @@ SignedExchangeHandler::~SignedExchangeHandler() = default;
 SignedExchangeHandler::SignedExchangeHandler()
     : is_secure_transport_(true),
       has_nosniff_(true),
-      load_flags_(net::LOAD_NORMAL) {}
+      load_flags_(net::LOAD_NORMAL),
+      frame_tree_node_id_(FrameTreeNode::kFrameTreeNodeInvalidId) {}
 
 const GURL& SignedExchangeHandler::GetFallbackUrl() const {
   return prologue_fallback_url_and_after_.fallback_url().url;
@@ -521,7 +521,7 @@ void SignedExchangeHandler::OnCertReceived(
   base::PostTask(
       FROM_HERE, {BrowserThread::UI},
       base::BindOnce(&VerifyCert, certificate, url, stapled_ocsp_response,
-                     sct_list_from_cert_cbor, frame_tree_node_id_getter_,
+                     sct_list_from_cert_cbor, frame_tree_node_id_,
                      base::BindOnce(&SignedExchangeHandler::OnVerifyCert,
                                     weak_factory_.GetWeakPtr())));
 }
diff --git a/chromium/content/browser/web_package/signed_exchange_handler.h b/chromium/content/browser/web_package/signed_exchange_handler.h
index ef3c4547889..55d3a120bf0 100644
--- a/chromium/content/browser/web_package/signed_exchange_handler.h
+++ b/chromium/content/browser/web_package/signed_exchange_handler.h
@@ -97,7 +97,7 @@ class CONTENT_EXPORT SignedExchangeHandler {
       std::unique_ptr<blink::SignedExchangeRequestMatcher> request_matcher,
       std::unique_ptr<SignedExchangeDevToolsProxy> devtools_proxy,
       SignedExchangeReporter* reporter,
-      base::RepeatingCallback<int(void)> frame_tree_node_id_getter);
+      int frame_tree_node_id);
   virtual ~SignedExchangeHandler();
 
   int64_t GetExchangeHeaderLength() const { return exchange_header_length_; }
@@ -177,7 +177,7 @@ class CONTENT_EXPORT SignedExchangeHandler {
   // This is owned by SignedExchangeLoader which is the owner of |this|.
   SignedExchangeReporter* reporter_;
 
-  base::RepeatingCallback<int(void)> frame_tree_node_id_getter_;
+  const int frame_tree_node_id_;
 
   base::TimeTicks cert_fetch_start_time_;
 
diff --git a/chromium/content/browser/web_package/signed_exchange_handler_unittest.cc b/chromium/content/browser/web_package/signed_exchange_handler_unittest.cc
index 13b39bdad94..d058fe7c30d 100644
--- a/chromium/content/browser/web_package/signed_exchange_handler_unittest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_handler_unittest.cc
@@ -13,15 +13,18 @@
 #include "base/path_service.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "base/test/scoped_feature_list.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/web_package/signed_exchange_cert_fetcher_factory.h"
 #include "content/browser/web_package/signed_exchange_devtools_proxy.h"
 #include "content/browser/web_package/signed_exchange_signature_verifier.h"
 #include "content/browser/web_package/signed_exchange_test_utils.h"
 #include "content/browser/web_package/signed_exchange_utils.h"
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/test/browser_task_environment.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/io_buffer.h"
 #include "net/base/load_flags.h"
 #include "net/base/test_completion_callback.h"
@@ -321,7 +324,7 @@ class SignedExchangeHandlerTest
       std::unique_ptr<net::TestURLRequestContext> context) {
     url_request_context_ = std::move(context);
     network_context_ = std::make_unique<network::NetworkContext>(
-        nullptr, mojo::MakeRequest(&network_context_ptr_),
+        nullptr, network_context_remote_.BindNewPipeAndPassReceiver(),
         url_request_context_.get(),
         /*cors_exempt_header_list=*/std::vector<std::string>());
     SignedExchangeHandler::SetNetworkContextForTesting(network_context_.get());
@@ -335,7 +338,7 @@ class SignedExchangeHandlerTest
         std::make_unique<blink::SignedExchangeRequestMatcher>(
             net::HttpRequestHeaders(), std::string() /* accept_langs */),
         nullptr /* devtools_proxy */, nullptr /* reporter */,
-        base::RepeatingCallback<int(void)>());
+        FrameTreeNode::kFrameTreeNodeInvalidId);
   }
 
   void WaitForHeader() {
@@ -406,7 +409,7 @@ class SignedExchangeHandlerTest
   ContentBrowserClient* original_client_;
   std::unique_ptr<net::TestURLRequestContext> url_request_context_;
   std::unique_ptr<network::NetworkContext> network_context_;
-  network::mojom::NetworkContextPtr network_context_ptr_;
+  mojo::Remote<network::mojom::NetworkContext> network_context_remote_;
   const url::Origin request_initiator_;
   std::unique_ptr<SignedExchangeCertificateChain::IgnoreErrorsSPKIList>
       original_ignore_errors_spki_list_;
diff --git a/chromium/content/browser/web_package/signed_exchange_loader.cc b/chromium/content/browser/web_package/signed_exchange_loader.cc
index 9fa3f458ab0..ae6ae3222c4 100644
--- a/chromium/content/browser/web_package/signed_exchange_loader.cc
+++ b/chromium/content/browser/web_package/signed_exchange_loader.cc
@@ -11,8 +11,6 @@
 #include "base/feature_list.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/stringprintf.h"
-#include "content/browser/loader/data_pipe_to_source_stream.h"
-#include "content/browser/loader/source_stream_to_data_pipe.h"
 #include "content/browser/web_package/signed_exchange_cert_fetcher_factory.h"
 #include "content/browser/web_package/signed_exchange_devtools_proxy.h"
 #include "content/browser/web_package/signed_exchange_handler.h"
@@ -28,8 +26,10 @@
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
 #include "services/network/public/cpp/constants.h"
+#include "services/network/public/cpp/data_pipe_to_source_stream.h"
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/cpp/source_stream_to_data_pipe.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
@@ -68,7 +68,7 @@ SignedExchangeLoader::SignedExchangeLoader(
     std::unique_ptr<SignedExchangeReporter> reporter,
     scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
     URLLoaderThrottlesGetter url_loader_throttles_getter,
-    base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+    int frame_tree_node_id,
     scoped_refptr<SignedExchangePrefetchMetricRecorder> metric_recorder,
     const std::string& accept_langs)
     : outer_request_(outer_request),
@@ -81,7 +81,7 @@ SignedExchangeLoader::SignedExchangeLoader(
       reporter_(std::move(reporter)),
       url_loader_factory_(std::move(url_loader_factory)),
       url_loader_throttles_getter_(std::move(url_loader_throttles_getter)),
-      frame_tree_node_id_getter_(frame_tree_node_id_getter),
+      frame_tree_node_id_(frame_tree_node_id),
       metric_recorder_(std::move(metric_recorder)),
       accept_langs_(accept_langs) {
   DCHECK(outer_request_.url.is_valid());
@@ -154,7 +154,8 @@ void SignedExchangeLoader::OnStartLoadingResponseBody(
   if (g_signed_exchange_factory_for_testing_) {
     signed_exchange_handler_ = g_signed_exchange_factory_for_testing_->Create(
         outer_request_.url,
-        std::make_unique<DataPipeToSourceStream>(std::move(response_body)),
+        std::make_unique<network::DataPipeToSourceStream>(
+            std::move(response_body)),
         base::BindOnce(&SignedExchangeLoader::OnHTTPExchangeFound,
                        weak_factory_.GetWeakPtr()),
         std::move(cert_fetcher_factory));
@@ -164,13 +165,14 @@ void SignedExchangeLoader::OnStartLoadingResponseBody(
   signed_exchange_handler_ = std::make_unique<SignedExchangeHandler>(
       IsOriginSecure(outer_request_.url),
       HasNoSniffHeader(outer_response_head_), content_type_,
-      std::make_unique<DataPipeToSourceStream>(std::move(response_body)),
+      std::make_unique<network::DataPipeToSourceStream>(
+          std::move(response_body)),
       base::BindOnce(&SignedExchangeLoader::OnHTTPExchangeFound,
                      weak_factory_.GetWeakPtr()),
       std::move(cert_fetcher_factory), outer_request_.load_flags,
       std::make_unique<blink::SignedExchangeRequestMatcher>(
           outer_request_.headers, accept_langs_),
-      std::move(devtools_proxy_), reporter_.get(), frame_tree_node_id_getter_);
+      std::move(devtools_proxy_), reporter_.get(), frame_tree_node_id_);
 }
 
 void SignedExchangeLoader::OnComplete(
@@ -299,10 +301,8 @@ void SignedExchangeLoader::OnHTTPExchangeFound(
     return;
   }
   pending_body_consumer_ = std::move(consumer_handle);
-  body_data_pipe_adapter_ = std::make_unique<SourceStreamToDataPipe>(
-      std::move(payload_stream), std::move(producer_handle),
-      base::BindOnce(&SignedExchangeLoader::FinishReadingBody,
-                     base::Unretained(this)));
+  body_data_pipe_adapter_ = std::make_unique<network::SourceStreamToDataPipe>(
+      std::move(payload_stream), std::move(producer_handle));
 
   StartReadingBody();
 }
@@ -337,7 +337,8 @@ void SignedExchangeLoader::StartReadingBody() {
 
   // Start reading.
   client_->OnStartLoadingResponseBody(std::move(pending_body_consumer_));
-  body_data_pipe_adapter_->Start();
+  body_data_pipe_adapter_->Start(base::BindOnce(
+      &SignedExchangeLoader::FinishReadingBody, base::Unretained(this)));
 }
 
 void SignedExchangeLoader::FinishReadingBody(int result) {
diff --git a/chromium/content/browser/web_package/signed_exchange_loader.h b/chromium/content/browser/web_package/signed_exchange_loader.h
index 376eb77dfb6..e5aea596451 100644
--- a/chromium/content/browser/web_package/signed_exchange_loader.h
+++ b/chromium/content/browser/web_package/signed_exchange_loader.h
@@ -34,6 +34,7 @@ class SourceStream;
 
 namespace network {
 class SharedURLLoaderFactory;
+class SourceStreamToDataPipe;
 }  // namespace network
 
 namespace content {
@@ -44,7 +45,6 @@ class SignedExchangeHandlerFactory;
 class SignedExchangePrefetchMetricRecorder;
 class SignedExchangeReporter;
 class SignedExchangeValidityPinger;
-class SourceStreamToDataPipe;
 
 // SignedExchangeLoader handles an origin-signed HTTP exchange response. It is
 // created when a SignedExchangeRequestHandler recieves an origin-signed HTTP
@@ -72,7 +72,7 @@ class CONTENT_EXPORT SignedExchangeLoader final
       std::unique_ptr<SignedExchangeReporter> reporter,
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
       URLLoaderThrottlesGetter url_loader_throttles_getter,
-      base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+      int frame_tree_node_id,
       scoped_refptr<SignedExchangePrefetchMetricRecorder> metric_recorder,
       const std::string& accept_langs);
   ~SignedExchangeLoader() override;
@@ -161,7 +161,7 @@ class CONTENT_EXPORT SignedExchangeLoader final
   network::mojom::URLLoaderClientRequest pending_client_request_;
 
   std::unique_ptr<SignedExchangeHandler> signed_exchange_handler_;
-  std::unique_ptr<SourceStreamToDataPipe> body_data_pipe_adapter_;
+  std::unique_ptr<network::SourceStreamToDataPipe> body_data_pipe_adapter_;
 
   // Kept around until ProceedWithResponse is called.
   mojo::ScopedDataPipeConsumerHandle pending_body_consumer_;
@@ -172,7 +172,7 @@ class CONTENT_EXPORT SignedExchangeLoader final
   std::unique_ptr<SignedExchangeReporter> reporter_;
   scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
   URLLoaderThrottlesGetter url_loader_throttles_getter_;
-  base::RepeatingCallback<int(void)> frame_tree_node_id_getter_;
+  const int frame_tree_node_id_;
   scoped_refptr<SignedExchangePrefetchMetricRecorder> metric_recorder_;
 
   base::Optional<net::SSLInfo> ssl_info_;
diff --git a/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc b/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc
index 233c35d9b23..5bb11d4daa3 100644
--- a/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_loader_unittest.cc
@@ -12,12 +12,14 @@
 #include "base/test/scoped_feature_list.h"
 #include "base/test/task_environment.h"
 #include "build/build_config.h"
+#include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/web_package/mock_signed_exchange_handler.h"
 #include "content/browser/web_package/signed_exchange_devtools_proxy.h"
 #include "content/browser/web_package/signed_exchange_prefetch_metric_recorder.h"
 #include "content/browser/web_package/signed_exchange_reporter.h"
 #include "content/public/common/content_features.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/data_pipe_producer.h"
 #include "mojo/public/cpp/system/string_data_source.h"
 #include "net/http/http_status_code.h"
@@ -117,7 +119,8 @@ class SignedExchangeLoaderTest : public testing::TestWithParam<bool> {
       ping_loader_ = std::make_unique<MockURLLoader>(std::move(request));
       ping_loader_client_ = std::move(client);
     }
-    void Clone(network::mojom::URLLoaderFactoryRequest request) override {}
+    void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+        override {}
 
     std::unique_ptr<MockURLLoader> ping_loader_;
     network::mojom::URLLoaderClientPtr ping_loader_client_;
@@ -179,7 +182,7 @@ TEST_P(SignedExchangeLoaderTest, Simple) {
           false /* should_redirect_to_fallback */, nullptr /* devtools_proxy */,
           nullptr /* reporter */, CreateMockPingLoaderFactory(),
           base::BindRepeating(&SignedExchangeLoaderTest::ThrottlesGetter),
-          base::RepeatingCallback<int(void)>(), nullptr /* metric_recorder */,
+          FrameTreeNode::kFrameTreeNodeInvalidId, nullptr /* metric_recorder */,
           std::string() /* accept_langs */);
 
   EXPECT_CALL(mock_loader, PauseReadingBodyFromNet());
diff --git a/chromium/content/browser/web_package/signed_exchange_prefetch_handler.cc b/chromium/content/browser/web_package/signed_exchange_prefetch_handler.cc
index 6c0116fcb5c..820cfe3862b 100644
--- a/chromium/content/browser/web_package/signed_exchange_prefetch_handler.cc
+++ b/chromium/content/browser/web_package/signed_exchange_prefetch_handler.cc
@@ -19,7 +19,7 @@
 namespace content {
 
 SignedExchangePrefetchHandler::SignedExchangePrefetchHandler(
-    base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+    int frame_tree_node_id,
     const network::ResourceRequest& resource_request,
     const network::ResourceResponseHead& response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
@@ -51,14 +51,14 @@ SignedExchangePrefetchHandler::SignedExchangePrefetchHandler(
       std::move(client), std::move(endpoints), url_loader_options,
       false /* should_redirect_to_fallback */,
       std::make_unique<SignedExchangeDevToolsProxy>(
-          resource_request.url, response_head, frame_tree_node_id_getter,
+          resource_request.url, response_head, frame_tree_node_id,
           base::nullopt /* devtools_navigation_token */,
           resource_request.report_raw_headers),
-      SignedExchangeReporter::MaybeCreate(
-          resource_request.url, resource_request.referrer.spec(), response_head,
-          frame_tree_node_id_getter),
+      SignedExchangeReporter::MaybeCreate(resource_request.url,
+                                          resource_request.referrer.spec(),
+                                          response_head, frame_tree_node_id),
       std::move(url_loader_factory), loader_throttles_getter,
-      frame_tree_node_id_getter, std::move(metric_recorder), accept_langs);
+      frame_tree_node_id, std::move(metric_recorder), accept_langs);
 }
 
 SignedExchangePrefetchHandler::~SignedExchangePrefetchHandler() = default;
diff --git a/chromium/content/browser/web_package/signed_exchange_prefetch_handler.h b/chromium/content/browser/web_package/signed_exchange_prefetch_handler.h
index 1e3764be7c5..3ad5742f3d6 100644
--- a/chromium/content/browser/web_package/signed_exchange_prefetch_handler.h
+++ b/chromium/content/browser/web_package/signed_exchange_prefetch_handler.h
@@ -45,7 +45,7 @@ class SignedExchangePrefetchHandler final
   // |forwarding_client| is a pointer to the downstream client (typically who
   // creates this handler).
   SignedExchangePrefetchHandler(
-      base::RepeatingCallback<int(void)> frame_tree_node_id_getter,
+      int frame_tree_node_id,
       const network::ResourceRequest& resource_request,
       const network::ResourceResponseHead& response,
       mojo::ScopedDataPipeConsumerHandle response_body,
diff --git a/chromium/content/browser/web_package/signed_exchange_reporter.cc b/chromium/content/browser/web_package/signed_exchange_reporter.cc
index 0b5927ef0ba..50e4710c3f0 100644
--- a/chromium/content/browser/web_package/signed_exchange_reporter.cc
+++ b/chromium/content/browser/web_package/signed_exchange_reporter.cc
@@ -118,9 +118,8 @@ bool ShouldDowngradeReport(const char* result_string,
   return false;
 }
 
-void ReportResultOnUI(base::OnceCallback<int(void)> frame_tree_node_id_getter,
+void ReportResultOnUI(int frame_tree_node_id,
                       network::mojom::SignedExchangeReportPtr report) {
-  int frame_tree_node_id = std::move(frame_tree_node_id_getter).Run();
   FrameTreeNode* frame_tree_node =
       FrameTreeNode::GloballyFindByID(frame_tree_node_id);
   if (!frame_tree_node)
@@ -146,23 +145,23 @@ std::unique_ptr<SignedExchangeReporter> SignedExchangeReporter::MaybeCreate(
     const GURL& outer_url,
     const std::string& referrer,
     const network::ResourceResponseHead& response,
-    base::OnceCallback<int(void)> frame_tree_node_id_getter) {
+    int frame_tree_node_id) {
   if (!signed_exchange_utils::
           IsSignedExchangeReportingForDistributorsEnabled()) {
     return nullptr;
   }
   return base::WrapUnique(new SignedExchangeReporter(
-      outer_url, referrer, response, std::move(frame_tree_node_id_getter)));
+      outer_url, referrer, response, frame_tree_node_id));
 }
 
 SignedExchangeReporter::SignedExchangeReporter(
     const GURL& outer_url,
     const std::string& referrer,
     const network::ResourceResponseHead& response,
-    base::OnceCallback<int(void)> frame_tree_node_id_getter)
+    int frame_tree_node_id)
     : report_(network::mojom::SignedExchangeReport::New()),
       request_start_(response.load_timing.request_start),
-      frame_tree_node_id_getter_(std::move(frame_tree_node_id_getter)) {
+      frame_tree_node_id_(frame_tree_node_id) {
   report_->outer_url = outer_url;
   report_->referrer = referrer;
   report_->server_ip_address = response.remote_endpoint.address();
@@ -196,7 +195,6 @@ void SignedExchangeReporter::set_cert_url(const GURL& cert_url) {
 void SignedExchangeReporter::ReportResultAndFinish(
     SignedExchangeLoadResult result) {
   DCHECK(report_);
-  DCHECK(frame_tree_node_id_getter_);
 
   const char* result_string = GetResultTypeString(result);
   report_->success = result == SignedExchangeLoadResult::kSuccess;
@@ -214,10 +212,9 @@ void SignedExchangeReporter::ReportResultAndFinish(
     report_->elapsed_time = base::TimeTicks::Now() - request_start_;
   }
 
-  base::PostTask(
-      FROM_HERE, {BrowserThread::UI},
-      base::BindOnce(&ReportResultOnUI, std::move(frame_tree_node_id_getter_),
-                     std::move(report_)));
+  base::PostTask(FROM_HERE, {BrowserThread::UI},
+                 base::BindOnce(&ReportResultOnUI, frame_tree_node_id_,
+                                std::move(report_)));
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/web_package/signed_exchange_reporter.h b/chromium/content/browser/web_package/signed_exchange_reporter.h
index d7abf43f96e..bbd3a0981c2 100644
--- a/chromium/content/browser/web_package/signed_exchange_reporter.h
+++ b/chromium/content/browser/web_package/signed_exchange_reporter.h
@@ -8,7 +8,6 @@
 #include <memory>
 #include <string>
 
-#include "base/callback.h"
 #include "base/macros.h"
 #include "content/browser/web_package/signed_exchange_error.h"
 #include "content/common/content_export.h"
@@ -31,7 +30,7 @@ class CONTENT_EXPORT SignedExchangeReporter {
       const GURL& outer_url,
       const std::string& referrer,
       const network::ResourceResponseHead& response,
-      base::OnceCallback<int(void)> frame_tree_node_id_getter);
+      int frame_tree_node_id);
 
   ~SignedExchangeReporter();
 
@@ -44,15 +43,14 @@ class CONTENT_EXPORT SignedExchangeReporter {
   void ReportResultAndFinish(SignedExchangeLoadResult result);
 
  private:
-  SignedExchangeReporter(
-      const GURL& outer_url,
-      const std::string& referrer,
-      const network::ResourceResponseHead& response,
-      base::OnceCallback<int(void)> frame_tree_node_id_getter);
+  SignedExchangeReporter(const GURL& outer_url,
+                         const std::string& referrer,
+                         const network::ResourceResponseHead& response,
+                         int frame_tree_node_id);
 
   network::mojom::SignedExchangeReportPtr report_;
   const base::TimeTicks request_start_;
-  base::OnceCallback<int(void)> frame_tree_node_id_getter_;
+  const int frame_tree_node_id_;
   net::IPAddress cert_server_ip_address_;
 
   DISALLOW_COPY_AND_ASSIGN(SignedExchangeReporter);
diff --git a/chromium/content/browser/web_package/signed_exchange_request_handler.cc b/chromium/content/browser/web_package/signed_exchange_request_handler.cc
index 11a52c20557..567b77dda9e 100644
--- a/chromium/content/browser/web_package/signed_exchange_request_handler.cc
+++ b/chromium/content/browser/web_package/signed_exchange_request_handler.cc
@@ -81,7 +81,8 @@ bool SignedExchangeRequestHandler::MaybeCreateLoaderForResponse(
     network::mojom::URLLoaderPtr* loader,
     network::mojom::URLLoaderClientRequest* client_request,
     ThrottlingURLLoader* url_loader,
-    bool* skip_other_interceptors) {
+    bool* skip_other_interceptors,
+    bool* will_return_unsafe_redirect) {
   DCHECK(!signed_exchange_loader_);
   if (!signed_exchange_utils::ShouldHandleAsSignedHTTPExchange(request.url,
                                                                response_head)) {
@@ -91,9 +92,6 @@ bool SignedExchangeRequestHandler::MaybeCreateLoaderForResponse(
   network::mojom::URLLoaderClientPtr client;
   *client_request = mojo::MakeRequest(&client);
 
-  base::RepeatingCallback<int(void)> frame_tree_node_id_getter =
-      base::BindRepeating([](int id) { return id; }, frame_tree_node_id_);
-
   // This lets the SignedExchangeLoader directly returns an artificial redirect
   // to the downstream client without going through ThrottlingURLLoader, which
   // means some checks like SafeBrowsing may not see the redirect. Given that
@@ -104,13 +102,12 @@ bool SignedExchangeRequestHandler::MaybeCreateLoaderForResponse(
       url_loader->Unbind(), url_loader_options_,
       true /* should_redirect_to_fallback */,
       std::make_unique<SignedExchangeDevToolsProxy>(
-          request.url, response_head, frame_tree_node_id_getter,
+          request.url, response_head, frame_tree_node_id_,
           devtools_navigation_token_, request.report_raw_headers),
       SignedExchangeReporter::MaybeCreate(request.url, request.referrer.spec(),
-                                          response_head,
-                                          frame_tree_node_id_getter),
-      url_loader_factory_, url_loader_throttles_getter_,
-      frame_tree_node_id_getter, metric_recorder_, accept_langs_);
+                                          response_head, frame_tree_node_id_),
+      url_loader_factory_, url_loader_throttles_getter_, frame_tree_node_id_,
+      metric_recorder_, accept_langs_);
 
   *skip_other_interceptors = true;
   return true;
diff --git a/chromium/content/browser/web_package/signed_exchange_request_handler.h b/chromium/content/browser/web_package/signed_exchange_request_handler.h
index 079714aa84e..09731c3d41e 100644
--- a/chromium/content/browser/web_package/signed_exchange_request_handler.h
+++ b/chromium/content/browser/web_package/signed_exchange_request_handler.h
@@ -57,7 +57,8 @@ class SignedExchangeRequestHandler final : public NavigationLoaderInterceptor {
       network::mojom::URLLoaderPtr* loader,
       network::mojom::URLLoaderClientRequest* client_request,
       ThrottlingURLLoader* url_loader,
-      bool* skip_other_interceptors) override;
+      bool* skip_other_interceptors,
+      bool* will_return_unsafe_redirect) override;
 
  private:
   void StartResponse(const network::ResourceRequest& resource_request,
diff --git a/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc b/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc
index 70f53712196..26aa8880e3a 100644
--- a/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_request_handler_browsertest.cc
@@ -16,7 +16,7 @@
 #include "base/threading/thread_restrictions.h"
 #include "base/time/time.h"
 #include "build/build_config.h"
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/loader/prefetch_url_loader_service.h"
 #include "content/browser/storage_partition_impl.h"
@@ -34,6 +34,7 @@
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_paths.h"
 #include "content/public/common/page_type.h"
@@ -99,7 +100,7 @@ class AssertNavigationHandleFlagObserver : public WebContentsObserver {
   ~AssertNavigationHandleFlagObserver() override = default;
 
   void DidFinishNavigation(NavigationHandle* handle) override {
-    EXPECT_TRUE(static_cast<NavigationHandleImpl*>(handle)->IsSignedExchangeInnerResponse());
+    EXPECT_TRUE(handle->IsSignedExchangeInnerResponse());
   }
 
  private:
@@ -228,7 +229,7 @@ class SignedExchangeRequestHandlerBrowserTest
     base::string16 expected_title =
         base::ASCIIToUTF16(expect_success ? "OK" : "FAIL");
     TitleWatcher title_watcher(shell()->web_contents(), expected_title);
-    NavigateToURL(shell(), prefetch_html_url);
+    EXPECT_TRUE(NavigateToURL(shell(), prefetch_html_url));
     EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
 
     if (SXGPrefetchCacheIsEnabled() && expect_success)
@@ -292,7 +293,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, Simple) {
   if (!UsePrefetch()) {
     // Need to be in a page to execute JavaScript to trigger renderer initiated
     // navigation.
-    NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html"));
+    EXPECT_TRUE(
+        NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html")));
   }
 
   base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
@@ -370,7 +372,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, VariantMatch) {
   if (!UsePrefetch()) {
     // Need to be in a page to execute JavaScript to trigger renderer initiated
     // navigation.
-    NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html"));
+    EXPECT_TRUE(
+        NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html")));
   }
 
   base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
@@ -409,7 +412,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
 
   base::string16 title = base::ASCIIToUTF16("Fallback URL response");
   TitleWatcher title_watcher(shell()->web_contents(), title);
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   histogram_tester_.ExpectUniqueSample(
       kLoadResultHistogram, SignedExchangeLoadResult::kVariantMismatch,
@@ -431,7 +435,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   base::string16 title = base::ASCIIToUTF16("Fallback URL response");
   TitleWatcher title_watcher(shell()->web_contents(), title);
   RedirectObserver redirect_observer(shell()->web_contents());
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   EXPECT_EQ(303, redirect_observer.response_code());
   histogram_tester_.ExpectUniqueSample(
@@ -455,7 +460,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   base::string16 title = base::ASCIIToUTF16("Fallback URL response");
   TitleWatcher title_watcher(shell()->web_contents(), title);
   RedirectObserver redirect_observer(shell()->web_contents());
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   EXPECT_EQ(303, redirect_observer.response_code());
   histogram_tester_.ExpectUniqueSample(
@@ -481,7 +487,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, Expired) {
   base::string16 title = base::ASCIIToUTF16("Fallback URL response");
   TitleWatcher title_watcher(shell()->web_contents(), title);
   RedirectObserver redirect_observer(shell()->web_contents());
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   EXPECT_EQ(303, redirect_observer.response_code());
   histogram_tester_.ExpectUniqueSample(
@@ -515,7 +522,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
 
     base::string16 title = base::ASCIIToUTF16("Fallback URL response");
     TitleWatcher title_watcher(shell()->web_contents(), title);
-    NavigateToURL(shell(), url);
+    GURL expected_commit_url = GURL("https://test.example.org/test/");
+    EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
     EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   }
   histogram_tester_.ExpectTotalCount(kLoadResultHistogram,
@@ -550,7 +558,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, MAYBE_BadMICE) {
   const base::string16 title_bad = base::ASCIIToUTF16("Reached End: true");
   TitleWatcher title_watcher(shell()->web_contents(), title_good);
   title_watcher.AlsoWaitForTitle(title_bad);
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title_good, title_watcher.WaitAndGetTitle());
 
   histogram_tester_.ExpectTotalCount(kLoadResultHistogram,
@@ -578,7 +587,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, BadMICESmall) {
 
   // Note: TitleWatcher is not needed. NavigateToURL waits until navigation
   // complete.
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
 
   histogram_tester_.ExpectTotalCount(kLoadResultHistogram,
                                      UsePrefetch() ? 2 : 1);
@@ -605,7 +615,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest, CertNotFound) {
 
   base::string16 title = base::ASCIIToUTF16("Fallback URL response");
   TitleWatcher title_watcher(shell()->web_contents(), title);
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   histogram_tester_.ExpectUniqueSample(
       kLoadResultHistogram, SignedExchangeLoadResult::kCertFetchError,
@@ -679,7 +690,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeRequestHandlerDownloadBrowserTest,
 
   embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html")));
 
   const std::string load_sxg =
       "const iframe = document.createElement('iframe');"
@@ -703,7 +715,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeRequestHandlerDownloadBrowserTest,
 
   embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
   ASSERT_TRUE(embedded_test_server()->Start());
-  NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL("/empty.html")));
 
   const std::string load_sxg = base::StringPrintf(
       "const iframe = document.createElement('iframe');"
@@ -758,7 +771,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeRequestHandlerRealCertVerifierBrowserTest,
   // verification time.
   base::string16 title = base::ASCIIToUTF16("Fallback URL response");
   TitleWatcher title_watcher(shell()->web_contents(), title);
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   // Verify that it failed at the OCSP check step.
   histogram_tester_.ExpectUniqueSample(kLoadResultHistogram,
@@ -784,7 +798,7 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   {
     base::string16 title = base::ASCIIToUTF16("Done");
     TitleWatcher title_watcher(shell()->web_contents(), title);
-    NavigateToURL(shell(), install_sw_url);
+    EXPECT_TRUE(NavigateToURL(shell(), install_sw_url));
     EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   }
   embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
@@ -795,7 +809,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
   TitleWatcher title_watcher(shell()->web_contents(), title);
   title_watcher.AlsoWaitForTitle(base::ASCIIToUTF16("Generated"));
-  NavigateToURL(shell(), url);
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
+  EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
   // The page content shoud be served from the signed exchange.
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
 }
@@ -816,14 +831,15 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   {
     base::string16 title = base::ASCIIToUTF16("Done");
     TitleWatcher title_watcher(shell()->web_contents(), title);
-    NavigateToURL(shell(), install_sw_url);
+    EXPECT_TRUE(NavigateToURL(shell(), install_sw_url));
     EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   }
 
   base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
   TitleWatcher title_watcher(shell()->web_contents(), title);
-  NavigateToURL(shell(), embedded_test_server()->GetURL(
-                             "/sxg/test.example.org_test.sxg"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), embedded_test_server()->GetURL("/sxg/test.example.org_test.sxg"),
+      GURL("https://test.example.org/test/") /* expected_commit_url */));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
 
   // The page must not be controlled by the service worker of the physical URL.
@@ -854,13 +870,15 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   {
     base::string16 title = base::ASCIIToUTF16("Done");
     TitleWatcher title_watcher(shell()->web_contents(), title);
-    NavigateToURL(shell(), install_sw_url);
+    EXPECT_TRUE(NavigateToURL(shell(), install_sw_url));
     EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   }
 
   base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
   TitleWatcher title_watcher(shell()->web_contents(), title);
-  NavigateToURL(shell(), GURL("https://test.example.org/scope/test.sxg"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GURL("https://test.example.org/scope/test.sxg"),
+      GURL("https://test.example.org/test/") /* expected_commit_url */));
   EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
 
   // The page must not be controlled by the service worker of the physical URL.
@@ -882,11 +900,12 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeRequestHandlerBrowserTest,
   ASSERT_TRUE(embedded_test_server()->Start());
 
   GURL url = embedded_test_server()->GetURL("/sxg/test.example.org_test.sxg");
+  GURL expected_commit_url = GURL("https://test.example.org/test/");
 
   {
     base::string16 title = base::ASCIIToUTF16("https://test.example.org/test/");
     TitleWatcher title_watcher(shell()->web_contents(), title);
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
     EXPECT_EQ(title, title_watcher.WaitAndGetTitle());
   }
 
@@ -940,7 +959,16 @@ class SignedExchangeAcceptHeaderBrowserTest
   void NavigateAndWaitForTitle(const GURL& url, const std::string title) {
     base::string16 expected_title = base::ASCIIToUTF16(title);
     TitleWatcher title_watcher(shell()->web_contents(), expected_title);
-    NavigateToURL(shell(), url);
+    EXPECT_TRUE(NavigateToURL(shell(), url));
+    EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
+  }
+
+  void NavigateWithRedirectAndWaitForTitle(const GURL& url,
+                                           const GURL& expected_commit_url,
+                                           const std::string& title) {
+    base::string16 expected_title = base::ASCIIToUTF16(title);
+    TitleWatcher title_watcher(shell()->web_contents(), expected_title);
+    EXPECT_TRUE(NavigateToURL(shell(), url, expected_commit_url));
     EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
   }
 
@@ -1073,7 +1101,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeAcceptHeaderBrowserTest, Redirect) {
   const GURL redirect_url = https_server_.GetURL("/r?" + test_url.spec());
   const GURL redirect_redirect_url =
       https_server_.GetURL("/r?" + redirect_url.spec());
-  NavigateAndWaitForTitle(redirect_redirect_url, test_url.spec());
+  NavigateWithRedirectAndWaitForTitle(redirect_redirect_url, test_url,
+                                      test_url.spec());
 
   CheckNavigationAcceptHeader({redirect_redirect_url, redirect_url, test_url});
 }
@@ -1086,7 +1115,8 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeAcceptHeaderBrowserTest,
   const GURL fallback_url = https_server_.GetURL("/sxg/test.html");
   const GURL test_url =
       https_server_.GetURL("/fallback_sxg?" + fallback_url.spec());
-  NavigateAndWaitForTitle(test_url, fallback_url.spec());
+  NavigateWithRedirectAndWaitForTitle(test_url, fallback_url,
+                                      fallback_url.spec());
 
   CheckNavigationAcceptHeader({test_url});
   CheckFallbackAcceptHeader({fallback_url});
@@ -1152,13 +1182,15 @@ IN_PROC_BROWSER_TEST_P(SignedExchangeAcceptHeaderBrowserTest, ServiceWorker) {
               GetInterceptedAcceptHeader(target_url));
     ClearInterceptedAcceptHeaders();
 
-    NavigateAndWaitForTitle(redirect_target_url, expected_title);
+    NavigateWithRedirectAndWaitForTitle(redirect_target_url, target_url,
+                                        expected_title);
     CheckNavigationAcceptHeader({redirect_target_url});
     EXPECT_EQ(expected_target_accept_header,
               GetInterceptedAcceptHeader(target_url));
     ClearInterceptedAcceptHeaders();
 
-    NavigateAndWaitForTitle(redirect_redirect_target_url, expected_title);
+    NavigateWithRedirectAndWaitForTitle(redirect_redirect_target_url,
+                                        target_url, expected_title);
     CheckNavigationAcceptHeader(
         {redirect_redirect_target_url, redirect_target_url});
     EXPECT_EQ(expected_target_accept_header,
diff --git a/chromium/content/browser/web_package/signed_exchange_signature_header_field.cc b/chromium/content/browser/web_package/signed_exchange_signature_header_field.cc
index 6d2464d8729..c91184e656c 100644
--- a/chromium/content/browser/web_package/signed_exchange_signature_header_field.cc
+++ b/chromium/content/browser/web_package/signed_exchange_signature_header_field.cc
@@ -11,7 +11,7 @@
 #include "content/browser/web_package/signed_exchange_consts.h"
 #include "content/browser/web_package/signed_exchange_utils.h"
 #include "crypto/sha2.h"
-#include "third_party/blink/public/common/web_package/http_structured_header.h"
+#include "third_party/blink/public/common/http/structured_header.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/web_package/signed_exchange_signature_verifier_unittest.cc b/chromium/content/browser/web_package/signed_exchange_signature_verifier_unittest.cc
index 1cabed2948f..eb81cd3b998 100644
--- a/chromium/content/browser/web_package/signed_exchange_signature_verifier_unittest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_signature_verifier_unittest.cc
@@ -24,7 +24,7 @@ const uint64_t kSignatureHeaderExpires = 1517895941;
 
 // See content/test/data/sxg/README on how to generate these data.
 // clang-format off
-constexpr char kSignatureHeaderECDSAP256[] = R"(label;cert-sha256=*FliHUDteraIzN1Q2AZLxPtQrQdJUiFCe/gwwSNxdfVU=*;cert-url="https://example.com/cert.msg";date=1517892341;expires=1517895941;integrity="digest/mi-sha256-03";sig=*MEUCIBcqXwHFKHJx/zC6tPvraxfCfjnZymD8ezx1gOCMMB7tAiEApmDS7Kr13YHhau8NGxffYBMFBUwM3qblxDj5ne9tCDg=*;validity-url="https://test.example.org/resource.validity.msg")";
+constexpr char kSignatureHeaderECDSAP256[] = R"(label;cert-sha256=*4gNFIZRsc0QyiaUY/ekUZU6h3q/1mtQafd53/yaF5Ms=*;cert-url="https://example.com/cert.msg";date=1517892341;expires=1517895941;integrity="digest/mi-sha256-03";sig=*MEYCIQDLap5Ns9tI0JmCr1nc58GTHqzyfWJmTiZ+AIPt0OBE6gIhAJ8uHk3RyxX0/pnMmmKKdr63T0XHqyz00aaxuECJ4Ez/*;validity-url="https://test.example.org/resource.validity.msg")";
 constexpr uint8_t kCborHeadersECDSAP256[] = {
   0xa4, 0x46, 0x64, 0x69, 0x67, 0x65, 0x73, 0x74, 0x58, 0x39, 0x6d, 0x69,
   0x2d, 0x73, 0x68, 0x61, 0x32, 0x35, 0x36, 0x2d, 0x30, 0x33, 0x3d, 0x77,
@@ -40,7 +40,7 @@ constexpr uint8_t kCborHeadersECDSAP256[] = {
   0x69, 0x6e, 0x67, 0x4c, 0x6d, 0x69, 0x2d, 0x73, 0x68, 0x61, 0x32, 0x35,
   0x36, 0x2d, 0x30, 0x33
 };
-constexpr char kSignatureHeaderECDSAP384[] = R"(label;cert-sha256=*GqecTbre59ZUPEUJrS+k5PR7sfvpQtXAVrBsU7tl9gk=*;cert-url="https://example.com/cert.msg";date=1517892341;expires=1517895941;integrity="digest/mi-sha256-03";sig=*MGUCMQC/lMDu8L9Vb46S3wl5CFy8S82BefM+1SDZ4ZGGc8Kbc4dYPQcfXpT/xbzBQe1kpiYCMAMk/64O++b+9D7ceeokaGLkabmk9l9fWretOeW9cOMaLGEylxt95HSIlOdNSDfdjg==*;validity-url="https://test.example.org/resource.validity.msg")";
+constexpr char kSignatureHeaderECDSAP384[] = R"(label;cert-sha256=*KrfLZg1xcHbdKYZ1nb8cnUjp/6iaEo6LeQrRSV6StKw=*;cert-url="https://example.com/cert.msg";date=1517892341;expires=1517895941;integrity="digest/mi-sha256-03";sig=*MGUCMBTSH0TpKGv5JSspWU+7hYeSDwaoRzYDzxxQaDQ2kV/IQS+3bQd4SFm0dPvsPzJH7AIxAPT1MXZoEiDhu45Ssr+ubU8n68QZZ92eI7TvtsEF1LEAXtx2YYC2UARu6ok9UxtrZQ==*;validity-url="https://test.example.org/resource.validity.msg")";
 // clang-format on
 
 // |expires| (1518497142) is more than 7 days (604800 seconds) after |date|
diff --git a/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc b/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
index 726d092cdbf..55e272e6d5b 100644
--- a/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
+++ b/chromium/content/browser/web_package/signed_exchange_subresource_prefetch_browsertest.cc
@@ -286,6 +286,17 @@ class SignedExchangePrefetchBrowserTest
       // Shutdown the server.
       EXPECT_TRUE(embedded_test_server()->ShutdownAndWaitUntilComplete());
 
+      // The HTTP Cache does not currently support cross-origin prefetching if
+      // the split cache is enabled, so skip the rest of the tests.
+      // TODO(crbug.com/939317): Remove this early return when cross-origin
+      // prefetching with split cache works.
+      if (base::FeatureList::IsEnabled(
+              net::features::kSplitCacheByNetworkIsolationKey) &&
+          !url::Origin::Create(sxg_url).IsSameOriginWith(
+              url::Origin::Create(inner_url))) {
+        return;
+      }
+
       // Need to setup MockSignedExchangeHandlerFactory because the SXG is
       // loaded from HTTPCache.
       MockSignedExchangeHandlerFactory factory({MockSignedExchangeHandlerParams(
@@ -381,7 +392,7 @@ class SignedExchangePrefetchBrowserTest
 
     EXPECT_EQ(0, sxg_request_counter->GetRequestCount());
 
-    NavigateToURL(shell(), prefetch_page_url);
+    EXPECT_TRUE(NavigateToURL(shell(), prefetch_page_url));
 
     WaitUntilLoaded(sxg_url);
 
@@ -804,7 +815,7 @@ IN_PROC_BROWSER_TEST_P(SignedExchangePrefetchBrowserTest,
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
   EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
-  NavigateToURL(shell(), prefetch_page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), prefetch_page_url));
 
   WaitUntilLoaded(sxg_page_url);
   if (base::FeatureList::IsEnabled(
@@ -1095,7 +1106,7 @@ class SignedExchangeSubresourcePrefetchBrowserTest
     ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
     EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
-    NavigateToURL(shell(), prefetch_page_url);
+    EXPECT_TRUE(NavigateToURL(shell(), prefetch_page_url));
 
     WaitUntilLoaded(sxg_page_url);
     WaitUntilLoaded(sxg_script_url);
@@ -1230,7 +1241,8 @@ class SignedExchangeSubresourcePrefetchBrowserTest
              script_header_integrity)});
     ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-    NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+    EXPECT_TRUE(
+        NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
 
     WaitUntilLoaded(target_sxg_url);
     WaitUntilLoaded(script_sxg_url);
@@ -1541,7 +1553,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
            image2_url, "image/png", {}, image2_header_integrity)});
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
   WaitUntilLoaded(target_sxg_url);
   WaitUntilLoaded(image1_sxg_url);
 
@@ -1651,7 +1664,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   });
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
 
   WaitUntilLoaded(target_sxg_url);
   WaitUntilLoaded(script1_sxg_url);
@@ -1754,7 +1768,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
            script_url, "text/javascript", {}, script_header_integrity)});
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
 
   WaitUntilLoaded(target_sxg_url);
   WaitUntilLoaded(script_sxg_url);
@@ -1854,7 +1869,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   });
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
 
   WaitUntilLoaded(target_sxg_url);
   WaitUntilLoaded(script1_sxg_url);
@@ -2071,7 +2087,8 @@ let results = [];
 
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
 
   // Wait until all (main- and sub-resource) SXGs are prefetched.
   while (GetCachedExchanges(shell()).size() < base::size(kTestCases) + 1) {
@@ -2186,7 +2203,7 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
   EXPECT_EQ(0, GetPrefetchURLLoaderCallCount());
-  NavigateToURL(shell(), prefetch_page_url);
+  EXPECT_TRUE(NavigateToURL(shell(), prefetch_page_url));
 
   WaitUntilLoaded(sxg_page_url);
   WaitUntilLoaded(sxg_script_url);
@@ -2268,7 +2285,8 @@ IN_PROC_BROWSER_TEST_F(SignedExchangeSubresourcePrefetchBrowserTest,
            script_url, "text/javascript", {}, script_header_integrity)});
   ScopedSignedExchangeHandlerFactory scoped_factory(&factory);
 
-  NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), embedded_test_server()->GetURL(prefetch_path)));
 
   WaitUntilLoaded(target_sxg_url);
   WaitUntilLoaded(script_sxg_url);
diff --git a/chromium/content/browser/web_package/signed_exchange_test_utils.h b/chromium/content/browser/web_package/signed_exchange_test_utils.h
index e9c3123012d..b25fdfebe69 100644
--- a/chromium/content/browser/web_package/signed_exchange_test_utils.h
+++ b/chromium/content/browser/web_package/signed_exchange_test_utils.h
@@ -8,9 +8,9 @@
 namespace content {
 
 constexpr char kPEMECDSAP256SPKIHash[] =
-    "gyt+9XZNn/phgPx5H8+75u0Kcr1UxLnfz1+5ccndF3A=";
+    "Roij6gF5orGtG9K8u8PkTe1LiRbVklxLM+EVABTK8I0=";
 constexpr char kPEMECDSAP384SPKIHash[] =
-    "ymo7jA8HxN67FG5u4dp9kxzM6LGvqEWLv8kCkKRguA4=";
+    "wfk/4dogHdX/MbLIvpjbKQ7fhO+ovkX2wjzDPSrIsMY=";
 
 }  // namespace content
 
diff --git a/chromium/content/browser/web_package/signed_exchange_utils.cc b/chromium/content/browser/web_package/signed_exchange_utils.cc
index eee8906e202..d01b3ea345b 100644
--- a/chromium/content/browser/web_package/signed_exchange_utils.cc
+++ b/chromium/content/browser/web_package/signed_exchange_utils.cc
@@ -9,6 +9,7 @@
 #include "base/no_destructor.h"
 #include "base/strings/string_piece.h"
 #include "base/strings/string_util.h"
+#include "base/strings/stringprintf.h"
 #include "base/time/time.h"
 #include "base/trace_event/trace_event.h"
 #include "content/browser/loader/download_utils_impl.h"
@@ -208,7 +209,6 @@ net::RedirectInfo CreateRedirectInfo(
   // Step 3. Set actualResponse's status to 303. [spec text]
   return net::RedirectInfo::ComputeRedirectInfo(
       "GET", outer_request.url, outer_request.site_for_cookies,
-      outer_request.top_frame_origin,
       outer_request.update_first_party_url_on_redirect
           ? net::URLRequest::FirstPartyURLPolicy::
                 UPDATE_FIRST_PARTY_URL_ON_REDIRECT
diff --git a/chromium/content/browser/webauth/authenticator_common.cc b/chromium/content/browser/webauth/authenticator_common.cc
index a84cda590ea..b90edc0c129 100644
--- a/chromium/content/browser/webauth/authenticator_common.cc
+++ b/chromium/content/browser/webauth/authenticator_common.cc
@@ -548,34 +548,46 @@ AuthenticatorCommon::CreateRequestDelegate(std::string relying_party_id) {
       render_frame_host_, relying_party_id_);
 }
 
-void AuthenticatorCommon::StartMakeCredentialRequest() {
-  device::FidoDiscoveryFactory* discovery_factory =
+void AuthenticatorCommon::StartMakeCredentialRequest(
+    bool allow_skipping_pin_touch) {
+  discovery_factory_ =
       AuthenticatorEnvironmentImpl::GetInstance()->GetDiscoveryFactoryOverride(
           static_cast<RenderFrameHostImpl*>(render_frame_host_)
               ->frame_tree_node());
-  if (!discovery_factory)
-    discovery_factory = request_delegate_->GetDiscoveryFactory();
+  if (!discovery_factory_) {
+    discovery_factory_ = request_delegate_->GetDiscoveryFactory();
+  }
 
   if (base::FeatureList::IsEnabled(device::kWebAuthPhoneSupport)) {
+    std::vector<device::CableDiscoveryData> cable_pairings =
+        request_delegate_->GetCablePairings();
+    const bool have_paired_phones = !cable_pairings.empty();
+
     device::QRGeneratorKey qr_generator_key(
         device::CableDiscoveryData::NewQRKey());
     if (request_delegate_->SetCableTransportInfo(
-            /*cable_extension_provided=*/false, qr_generator_key)) {
-      discovery_factory->set_cable_data({}, std::move(qr_generator_key));
+            /*cable_extension_provided=*/false, have_paired_phones,
+            qr_generator_key)) {
+      discovery_factory_->set_cable_data(cable_pairings,
+                                         std::move(qr_generator_key));
     }
   }
 
   request_ = std::make_unique<device::MakeCredentialRequestHandler>(
-      connector_, discovery_factory, GetTransports(caller_origin_, transports_),
+      connector_, discovery_factory_,
+      GetTransports(caller_origin_, transports_),
       *ctap_make_credential_request_, *authenticator_selection_criteria_,
+      allow_skipping_pin_touch,
       base::BindOnce(&AuthenticatorCommon::OnRegisterResponse,
                      weak_factory_.GetWeakPtr()));
 
   request_delegate_->RegisterActionCallbacks(
       base::BindOnce(&AuthenticatorCommon::OnCancelFromUI,
                      weak_factory_.GetWeakPtr()) /* cancel_callback */,
-      base::BindRepeating(&AuthenticatorCommon::StartMakeCredentialRequest,
-                          weak_factory_.GetWeakPtr()) /* start_over_callback */,
+      base::BindRepeating(
+          &AuthenticatorCommon::StartMakeCredentialRequest,
+          weak_factory_.GetWeakPtr(),
+          /*allow_skipping_pin_touch=*/false) /* start_over_callback */,
       base::BindRepeating(
           &device::FidoRequestHandlerBase::StartAuthenticatorRequest,
           request_->GetWeakPtr()) /* request_callback */,
@@ -591,43 +603,56 @@ void AuthenticatorCommon::StartMakeCredentialRequest() {
   request_->set_observer(request_delegate_.get());
 }
 
-void AuthenticatorCommon::StartGetAssertionRequest() {
-  device::FidoDiscoveryFactory* discovery_factory =
+void AuthenticatorCommon::StartGetAssertionRequest(
+    bool allow_skipping_pin_touch) {
+  discovery_factory_ =
       AuthenticatorEnvironmentImpl::GetInstance()->GetDiscoveryFactoryOverride(
           static_cast<RenderFrameHostImpl*>(render_frame_host_)
               ->frame_tree_node());
-  if (!discovery_factory)
-    discovery_factory = request_delegate_->GetDiscoveryFactory();
+  if (!discovery_factory_) {
+    discovery_factory_ = request_delegate_->GetDiscoveryFactory();
+  }
 
-  std::vector<device::CableDiscoveryData> cable_extension;
+  std::vector<device::CableDiscoveryData> cable_pairings;
+  bool have_cable_extension = false;
   if (ctap_get_assertion_request_->cable_extension &&
-      request_delegate_->ShouldPermitCableExtension(caller_origin_)) {
-    cable_extension = *ctap_get_assertion_request_->cable_extension;
+      request_delegate_->ShouldPermitCableExtension(caller_origin_) &&
+      IsFocused()) {
+    cable_pairings = *ctap_get_assertion_request_->cable_extension;
+    have_cable_extension = !cable_pairings.empty();
   }
 
   base::Optional<device::QRGeneratorKey> qr_generator_key;
+  bool have_paired_phones = false;
   if (base::FeatureList::IsEnabled(device::kWebAuthPhoneSupport)) {
     qr_generator_key.emplace(device::CableDiscoveryData::NewQRKey());
+    auto paired_phones = request_delegate_->GetCablePairings();
+    have_paired_phones = !paired_phones.empty();
+    cable_pairings.insert(cable_pairings.end(), paired_phones.begin(),
+                          paired_phones.end());
   }
 
-  if ((!cable_extension.empty() || qr_generator_key.has_value()) &&
-      request_delegate_->SetCableTransportInfo(!cable_extension.empty(),
-                                               qr_generator_key)) {
-    discovery_factory->set_cable_data(std::move(cable_extension),
-                                      std::move(qr_generator_key));
+  if ((!cable_pairings.empty() || qr_generator_key.has_value()) &&
+      request_delegate_->SetCableTransportInfo(
+          have_cable_extension, have_paired_phones, qr_generator_key)) {
+    discovery_factory_->set_cable_data(std::move(cable_pairings),
+                                       std::move(qr_generator_key));
   }
 
   request_ = std::make_unique<device::GetAssertionRequestHandler>(
-      connector_, discovery_factory, GetTransports(caller_origin_, transports_),
-      *ctap_get_assertion_request_,
+      connector_, discovery_factory_,
+      GetTransports(caller_origin_, transports_), *ctap_get_assertion_request_,
+      allow_skipping_pin_touch,
       base::BindOnce(&AuthenticatorCommon::OnSignResponse,
                      weak_factory_.GetWeakPtr()));
 
   request_delegate_->RegisterActionCallbacks(
       base::BindOnce(&AuthenticatorCommon::OnCancelFromUI,
                      weak_factory_.GetWeakPtr()) /* cancel_callback */,
-      base::BindRepeating(&AuthenticatorCommon::StartGetAssertionRequest,
-                          weak_factory_.GetWeakPtr()) /* start_over_callback */,
+      base::BindRepeating(
+          &AuthenticatorCommon::StartGetAssertionRequest,
+          weak_factory_.GetWeakPtr(),
+          /*allow_skipping_pin_touch=*/false) /* start_over_callback */,
       base::BindRepeating(
           &device::FidoRequestHandlerBase::StartAuthenticatorRequest,
           request_->GetWeakPtr()) /* request_callback */,
@@ -763,9 +788,7 @@ void AuthenticatorCommon::MakeCredential(
 
   bool resident_key = options->authenticator_selection &&
                       options->authenticator_selection->require_resident_key();
-  if (resident_key &&
-      (!base::FeatureList::IsEnabled(device::kWebAuthResidentKeys) ||
-       !request_delegate_->SupportsResidentKeys())) {
+  if (resident_key && !request_delegate_->SupportsResidentKeys()) {
     // Disallow the creation of resident credentials.
     InvokeCallbackAndCleanup(
         std::move(callback),
@@ -880,7 +903,7 @@ void AuthenticatorCommon::MakeCredential(
       break;
   }
 
-  StartMakeCredentialRequest();
+  StartMakeCredentialRequest(/*allow_skipping_pin_touch=*/true);
 }
 
 // mojom:Authenticator
@@ -955,8 +978,7 @@ void AuthenticatorCommon::GetAssertion(
   }
 
   if (options->allow_credentials.empty()) {
-    if (!base::FeatureList::IsEnabled(device::kWebAuthResidentKeys) ||
-        !request_delegate_->SupportsResidentKeys()) {
+    if (!request_delegate_->SupportsResidentKeys()) {
       InvokeCallbackAndCleanup(
           std::move(callback),
           blink::mojom::AuthenticatorStatus::RESIDENT_CREDENTIALS_UNSUPPORTED);
@@ -994,7 +1016,7 @@ void AuthenticatorCommon::GetAssertion(
   ctap_get_assertion_request_->is_u2f_only =
       OriginIsCryptoTokenExtension(caller_origin_);
 
-  StartGetAssertionRequest();
+  StartGetAssertionRequest(/*allow_skipping_pin_touch=*/true);
 }
 
 void AuthenticatorCommon::IsUserVerifyingPlatformAuthenticatorAvailable(
@@ -1445,6 +1467,15 @@ void AuthenticatorCommon::Cleanup() {
 
   timer_->Stop();
   request_.reset();
+  if (discovery_factory_) {
+    // The FidoDiscoveryFactory instance may have been obtained via
+    // AuthenticatorEnvironmentImpl::GetDiscoveryFactoryOverride() (in unit
+    // tests or when WebDriver injected a virtual authenticator), in which case
+    // it may be long-lived and handle more than one request. Hence, we need to
+    // reset all per-request state before deleting its pointer.
+    discovery_factory_->ResetRequestState();
+    discovery_factory_ = nullptr;
+  }
   request_delegate_.reset();
   make_credential_response_callback_.Reset();
   get_assertion_response_callback_.Reset();
diff --git a/chromium/content/browser/webauth/authenticator_common.h b/chromium/content/browser/webauth/authenticator_common.h
index e7facc48d3b..a8ec5af7839 100644
--- a/chromium/content/browser/webauth/authenticator_common.h
+++ b/chromium/content/browser/webauth/authenticator_common.h
@@ -117,11 +117,11 @@ class CONTENT_EXPORT AuthenticatorCommon {
 
   // Replaces the current |request_| with a |MakeCredentialRequestHandler|,
   // effectively restarting the request.
-  void StartMakeCredentialRequest();
+  void StartMakeCredentialRequest(bool allow_skipping_pin_touch);
 
   // Replaces the current |request_| with a |GetAssertionRequestHandler|,
   // effectively restarting the request.
-  void StartGetAssertionRequest();
+  void StartGetAssertionRequest(bool allow_skipping_pin_touch);
 
   bool IsFocused() const;
 
@@ -174,7 +174,7 @@ class CONTENT_EXPORT AuthenticatorCommon {
   // The request delegate decides whether to present the user with a visual
   // error before the request is finally resolved with |status|.
   void SignalFailureToRequestDelegate(
-      const ::device::FidoAuthenticator* authenticator,
+      const device::FidoAuthenticator* authenticator,
       AuthenticatorRequestClientDelegate::InterestingFailureReason reason,
       blink::mojom::AuthenticatorStatus status);
 
@@ -193,7 +193,7 @@ class CONTENT_EXPORT AuthenticatorCommon {
   RenderFrameHost* const render_frame_host_;
   service_manager::Connector* connector_ = nullptr;
   base::flat_set<device::FidoTransportProtocol> transports_;
-
+  device::FidoDiscoveryFactory* discovery_factory_ = nullptr;
   std::unique_ptr<device::FidoRequestHandlerBase> request_;
   blink::mojom::Authenticator::MakeCredentialCallback
       make_credential_response_callback_;
diff --git a/chromium/content/browser/webauth/authenticator_impl_unittest.cc b/chromium/content/browser/webauth/authenticator_impl_unittest.cc
index 9325f793cfb..ecc3b4cbf69 100644
--- a/chromium/content/browser/webauth/authenticator_impl_unittest.cc
+++ b/chromium/content/browser/webauth/authenticator_impl_unittest.cc
@@ -35,6 +35,7 @@
 #include "content/browser/webauth/authenticator_environment_impl.h"
 #include "content/public/browser/authenticator_request_client_delegate.h"
 #include "content/public/browser/render_frame_host.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_service_manager_context.h"
@@ -58,6 +59,7 @@
 #include "services/service_manager/public/cpp/connector.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "url/url_util.h"
 
 #if defined(OS_MACOSX)
 #include "device/fido/mac/authenticator_config.h"
@@ -327,10 +329,11 @@ GetTestPublicKeyCredentialRequestOptions() {
 
 std::vector<device::CableDiscoveryData> GetTestCableExtension() {
   device::CableDiscoveryData cable;
-  cable.version = 1;
-  cable.client_eid.fill(0x01);
-  cable.authenticator_eid.fill(0x02);
-  cable.session_pre_key.fill(0x03);
+  cable.version = device::CableDiscoveryData::Version::V1;
+  cable.v1.emplace();
+  cable.v1->client_eid.fill(0x01);
+  cable.v1->authenticator_eid.fill(0x02);
+  cable.v1->session_pre_key.fill(0x03);
 
   std::vector<device::CableDiscoveryData> ret;
   ret.emplace_back(std::move(cable));
@@ -341,9 +344,14 @@ std::vector<device::CableDiscoveryData> GetTestCableExtension() {
 
 class AuthenticatorTestBase : public content::RenderViewHostTestHarness {
  protected:
-  AuthenticatorTestBase() { ResetVirtualDevice(); }
+  AuthenticatorTestBase() = default;
   ~AuthenticatorTestBase() override {}
 
+  void SetUp() override {
+    content::RenderViewHostTestHarness::SetUp();
+    ResetVirtualDevice();
+  }
+
   void ResetVirtualDevice() {
     auto virtual_device_factory =
         std::make_unique<device::test::VirtualFidoDeviceFactory>();
@@ -354,11 +362,6 @@ class AuthenticatorTestBase : public content::RenderViewHostTestHarness {
   }
 
   device::test::VirtualFidoDeviceFactory* virtual_device_factory_;
-
-#if defined(OS_WIN)
-  device::ScopedFakeWinWebAuthnApi win_webauthn_api_ =
-      device::ScopedFakeWinWebAuthnApi::MakeUnavailable();
-#endif  // defined(OS_WIN)
 };
 
 class AuthenticatorImplTest : public AuthenticatorTestBase {
@@ -409,7 +412,7 @@ class AuthenticatorImplTest : public AuthenticatorTestBase {
     connector_->OverrideBinderForTesting(
         service_manager::ServiceFilter::ByName(device::mojom::kServiceName),
         device::mojom::HidManager::Name_,
-        base::Bind(&device::FakeFidoHidManager::AddBinding,
+        base::Bind(&device::FakeFidoHidManager::AddReceiver,
                    base::Unretained(fake_hid_manager_.get())));
 
     // Set up a timer for testing.
@@ -2571,7 +2574,7 @@ class AuthenticatorImplRequestDelegateTest : public AuthenticatorImplTest {
     connector_->OverrideBinderForTesting(
         service_manager::ServiceFilter::ByName(device::mojom::kServiceName),
         device::mojom::HidManager::Name_,
-        base::Bind(&device::FakeFidoHidManager::AddBinding,
+        base::Bind(&device::FakeFidoHidManager::AddReceiver,
                    base::Unretained(fake_hid_manager_.get())));
 
     // Set up a timer for testing.
@@ -2900,6 +2903,40 @@ TEST_F(AuthenticatorImplTest, GetAssertionWithLargeAllowList) {
   }
 }
 
+TEST_F(AuthenticatorImplTest, NoUnexpectedAuthenticatorExtensions) {
+  TestServiceManagerContext smc;
+  NavigateAndCommit(GURL(kTestOrigin1));
+
+  device::VirtualCtap2Device::Config config;
+  config.add_extra_extension = true;
+  virtual_device_factory_->SetCtap2Config(config);
+
+  mojo::Remote<blink::mojom::Authenticator> authenticator =
+      ConnectToAuthenticator();
+
+  // Check that extra authenticator extensions are rejected when creating a
+  // credential.
+  TestMakeCredentialCallback create_callback;
+  authenticator->MakeCredential(GetTestPublicKeyCredentialCreationOptions(),
+                                create_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  create_callback.WaitForCallback();
+  EXPECT_EQ(create_callback.status(), AuthenticatorStatus::NOT_ALLOWED_ERROR);
+
+  // Extensions should also be rejected when getting an assertion.
+  PublicKeyCredentialRequestOptionsPtr assertion_options =
+      GetTestPublicKeyCredentialRequestOptions();
+  ASSERT_TRUE(virtual_device_factory_->mutable_state()->InjectRegistration(
+      assertion_options->allow_credentials.back().id(), kTestRelyingPartyId));
+  TestGetAssertionCallback assertion_callback;
+  authenticator->GetAssertion(std::move(assertion_options),
+                              assertion_callback.callback());
+  base::RunLoop().RunUntilIdle();
+  assertion_callback.WaitForCallback();
+  EXPECT_EQ(assertion_callback.status(),
+            AuthenticatorStatus::NOT_ALLOWED_ERROR);
+}
+
 class UVAuthenticatorImplTest : public AuthenticatorImplTest {
  public:
   UVAuthenticatorImplTest() = default;
@@ -3651,8 +3688,6 @@ class ResidentKeyAuthenticatorImplTest : public UVAuthenticatorImplTest {
   ResidentKeyAuthenticatorImplTest() = default;
 
   void SetUp() override {
-    scoped_feature_list_.InitWithFeatures({device::kWebAuthResidentKeys}, {});
-
     UVAuthenticatorImplTest::SetUp();
     old_client_ = SetBrowserClientForTesting(&test_client_);
     device::VirtualCtap2Device::Config config;
@@ -3689,7 +3724,6 @@ class ResidentKeyAuthenticatorImplTest : public UVAuthenticatorImplTest {
 
  private:
   ContentBrowserClient* old_client_ = nullptr;
-  base::test::ScopedFeatureList scoped_feature_list_;
 
   DISALLOW_COPY_AND_ASSIGN(ResidentKeyAuthenticatorImplTest);
 };
@@ -4077,15 +4111,14 @@ TEST_F(ResidentKeyAuthenticatorImplTest, WinCredProtectApiVersion) {
   // The canned response returned by the Windows API fake is for acme.com.
   NavigateAndCommit(GURL("https://acme.com"));
   TestServiceManagerContext smc;
-  // AuthenticatorTestBase default-disables |win_webauthn_api_|.
-  win_webauthn_api_.set_available(true);
   for (const bool supports_cred_protect : {false, true}) {
     SCOPED_TRACE(testing::Message()
                  << "supports_cred_protect: " << supports_cred_protect);
 
-    win_webauthn_api_.set_version(supports_cred_protect
-                                      ? WEBAUTHN_API_VERSION_2
-                                      : WEBAUTHN_API_VERSION_1);
+    ::device::FakeWinWebAuthnApi api;
+    virtual_device_factory_->set_win_webauthn_api(&api);
+    api.set_version(supports_cred_protect ? WEBAUTHN_API_VERSION_2
+                                          : WEBAUTHN_API_VERSION_1);
 
     PublicKeyCredentialCreationOptionsPtr options = make_credential_options();
     options->relying_party = device::PublicKeyCredentialRpEntity();
@@ -4161,7 +4194,7 @@ class InternalAuthenticatorImplTest : public AuthenticatorTestBase {
     connector_->OverrideBinderForTesting(
         service_manager::ServiceFilter::ByName(device::mojom::kServiceName),
         device::mojom::HidManager::Name_,
-        base::BindRepeating(&device::FakeFidoHidManager::AddBinding,
+        base::BindRepeating(&device::FakeFidoHidManager::AddReceiver,
                             base::Unretained(fake_hid_manager_.get())));
 
     // Set up a timer for testing.
diff --git a/chromium/content/browser/webauth/authenticator_mojom_traits.cc b/chromium/content/browser/webauth/authenticator_mojom_traits.cc
index 34d3eb2b3c8..2478eb0d8fc 100644
--- a/chromium/content/browser/webauth/authenticator_mojom_traits.cc
+++ b/chromium/content/browser/webauth/authenticator_mojom_traits.cc
@@ -236,10 +236,14 @@ bool StructTraits<blink::mojom::CableAuthenticationDataView,
                   device::CableDiscoveryData>::
     Read(blink::mojom::CableAuthenticationDataView data,
          device::CableDiscoveryData* out) {
-  out->version = data.version();
-  if (!data.ReadClientEid(&out->client_eid) ||
-      !data.ReadAuthenticatorEid(&out->authenticator_eid) ||
-      !data.ReadSessionPreKey(&out->session_pre_key)) {
+  if (data.version() != 1) {
+    return false;
+  }
+  out->version = device::CableDiscoveryData::Version::V1;
+  out->v1.emplace();
+  if (!data.ReadClientEid(&out->v1->client_eid) ||
+      !data.ReadAuthenticatorEid(&out->v1->authenticator_eid) ||
+      !data.ReadSessionPreKey(&out->v1->session_pre_key)) {
     return false;
   }
   return true;
diff --git a/chromium/content/browser/webauth/authenticator_mojom_traits.h b/chromium/content/browser/webauth/authenticator_mojom_traits.h
index 659a7d22b45..836793fc09f 100644
--- a/chromium/content/browser/webauth/authenticator_mojom_traits.h
+++ b/chromium/content/browser/webauth/authenticator_mojom_traits.h
@@ -186,22 +186,26 @@ struct BLINK_COMMON_EXPORT
     StructTraits<blink::mojom::CableAuthenticationDataView,
                  device::CableDiscoveryData> {
   static uint8_t version(const device::CableDiscoveryData& in) {
-    return in.version;
+    CHECK_EQ(device::CableDiscoveryData::Version::V1, in.version);
+    return 1;
   }
 
   static const device::CableEidArray& client_eid(
       const device::CableDiscoveryData& in) {
-    return in.client_eid;
+    CHECK_EQ(device::CableDiscoveryData::Version::V1, in.version);
+    return in.v1->client_eid;
   }
 
   static const device::CableEidArray& authenticator_eid(
       const device::CableDiscoveryData& in) {
-    return in.authenticator_eid;
+    CHECK_EQ(device::CableDiscoveryData::Version::V1, in.version);
+    return in.v1->authenticator_eid;
   }
 
   static const device::CableSessionPreKeyArray& session_pre_key(
       const device::CableDiscoveryData& in) {
-    return in.session_pre_key;
+    CHECK_EQ(device::CableDiscoveryData::Version::V1, in.version);
+    return in.v1->session_pre_key;
   }
 
   static bool Read(blink::mojom::CableAuthenticationDataView data,
diff --git a/chromium/content/browser/webauth/authenticator_mojom_traits_unittest.cc b/chromium/content/browser/webauth/authenticator_mojom_traits_unittest.cc
index 5e1fd973fd6..53ffaf0d635 100644
--- a/chromium/content/browser/webauth/authenticator_mojom_traits_unittest.cc
+++ b/chromium/content/browser/webauth/authenticator_mojom_traits_unittest.cc
@@ -159,7 +159,8 @@ TEST(AuthenticatorMojomTraitsTest, SerializePublicKeyCredentialUserEntity) {
 // Verify serialization and deserialization of CableDiscoveryData.
 TEST(AuthenticatorMojomTraitsTest, SerializeCableDiscoveryData) {
   std::vector<CableDiscoveryData> success_cases = {
-      CableDiscoveryData(0, kClientEid, kAuthenticatorEid, kSessionPreKey)};
+      CableDiscoveryData(CableDiscoveryData::Version::V1, kClientEid,
+                         kAuthenticatorEid, kSessionPreKey)};
 
   AssertSerializeAndDeserializeSucceeds<blink::mojom::CableAuthentication,
                                         CableDiscoveryData>(success_cases);
diff --git a/chromium/content/browser/webauth/webauth_browsertest.cc b/chromium/content/browser/webauth/webauth_browsertest.cc
index db63dfb71f9..3f471d8651b 100644
--- a/chromium/content/browser/webauth/webauth_browsertest.cc
+++ b/chromium/content/browser/webauth/webauth_browsertest.cc
@@ -25,6 +25,7 @@
 #include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/service_manager_connection.h"
@@ -392,7 +393,8 @@ class WebAuthBrowserTestBase : public content::ContentBrowserTest {
         new WebAuthBrowserTestContentBrowserClient(&test_state_));
     old_client_ = SetBrowserClientForTesting(test_client_.get());
 
-    NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html"));
+    EXPECT_TRUE(
+        NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html")));
   }
 
   void TearDown() override {
@@ -459,12 +461,11 @@ class WebAuthLocalClientBrowserTest : public WebAuthBrowserTestBase {
   }
 
   void ConnectToAuthenticator() {
-    auto* broker = static_cast<blink::mojom::DocumentInterfaceBroker*>(
-        static_cast<RenderFrameHostImpl*>(
-            shell()->web_contents()->GetMainFrame()));
+    auto* render_frame_host_impl = static_cast<RenderFrameHostImpl*>(
+        shell()->web_contents()->GetMainFrame());
     if (authenticator_remote_.is_bound())
       authenticator_remote_.reset();
-    broker->GetAuthenticator(
+    render_frame_host_impl->GetAuthenticator(
         authenticator_remote_.BindNewPipeAndPassReceiver());
   }
 
@@ -551,7 +552,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthLocalClientBrowserTest,
                                   create_callback_receiver.callback());
 
   fake_hid_discovery->WaitForCallToStartAndSimulateSuccess();
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html")));
   WaitForConnectionError();
 
   // The next active document should be able to successfully call
@@ -573,7 +575,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthLocalClientBrowserTest,
                                 get_callback_receiver.callback());
 
   fake_hid_discovery->WaitForCallToStartAndSimulateSuccess();
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html")));
   WaitForConnectionError();
 
   // The next active document should be able to successfully call
@@ -629,7 +632,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthLocalClientBrowserTest,
           if (behavior == AttestationCallbackBehavior::BEFORE_NAVIGATION) {
             std::move(callback).Run(false);
           }
-          NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html"));
+          EXPECT_TRUE(NavigateToURL(
+              shell(), GetHttpsURL("www.acme.com", "/title2.html")));
           if (behavior == AttestationCallbackBehavior::AFTER_NAVIGATION) {
             std::move(callback).Run(false);
           }
@@ -648,7 +652,9 @@ IN_PROC_BROWSER_TEST_F(WebAuthLocalClientBrowserTest,
   ScopedNavigationCancellingThrottleInstaller navigation_canceller(
       shell()->web_contents());
 
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html"));
+  // This navigation should be canceled and hence should not succeed.
+  EXPECT_FALSE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html")));
 
   auto* fake_hid_discovery = discovery_factory_->ForgeNextHidDiscovery();
   TestCreateCallbackReceiver create_callback_receiver;
@@ -672,7 +678,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthLocalClientBrowserTest,
       }));
 
   auto* fake_hid_discovery = discovery_factory_->ForgeNextHidDiscovery();
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title2.html")));
   WaitForConnectionError();
 
   // Normally, when the request is serviced, the implementation retrieves the
@@ -1117,7 +1124,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
                        RequestsFromIFrames) {
   static constexpr char kOuterHost[] = "acme.com";
   static constexpr char kInnerHost[] = "notacme.com";
-  NavigateToURL(shell(), GetHttpsURL(kOuterHost, "/page_with_iframe.html"));
+  EXPECT_TRUE(NavigateToURL(shell(),
+                            GetHttpsURL(kOuterHost, "/page_with_iframe.html")));
 
   auto* virtual_device_factory = InjectVirtualFidoDeviceFactory();
   static constexpr uint8_t kOuterCredentialID = 1;
@@ -1193,7 +1201,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
         return true;
       });
 
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/page_with_iframe.html"));
+  EXPECT_TRUE(NavigateToURL(
+      shell(), GetHttpsURL("www.acme.com", "/page_with_iframe.html")));
 
   // The plain ExecuteScriptAndExtractString cannot be used because
   // NavigateIframeToURL uses it internally and they get confused about which
@@ -1247,8 +1256,8 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
         },
         shell()->web_contents(), &prompt_callback_was_invoked, behavior);
 
-    NavigateToURL(shell(),
-                  GetHttpsURL("www.acme.com", "/page_with_iframe.html"));
+    EXPECT_TRUE(NavigateToURL(
+        shell(), GetHttpsURL("www.acme.com", "/page_with_iframe.html")));
 
     CreateParameters parameters;
     parameters.attestation = "direct";
@@ -1264,13 +1273,52 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
   }
 }
 
+IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
+                       BadCableExtensionVersions) {
+  // The caBLE extension should only contain v1 data. Test that nothing crashes
+  // if a site tries to set other versions.
+
+  InjectVirtualFidoDeviceFactory();
+  GetParameters parameters;
+  parameters.allow_credentials =
+      "allowCredentials: [{ type: 'public-key',"
+      "  id: new TextEncoder().encode('allowedCredential'),"
+      "  transports: ['cable']}],"
+      "extensions: {"
+      "  cableAuthentication: [{"
+      "    version: 1,"
+      "    clientEid: new Uint8Array(Array(16).fill(1)),"
+      "    authenticatorEid: new Uint8Array(Array(16).fill(2)),"
+      "    sessionPreKey: new Uint8Array(Array(32).fill(3)),"
+      "  },{"
+      "    version: 2,"
+      "    clientEid: new Uint8Array(Array(16).fill(1)),"
+      "    authenticatorEid: new Uint8Array(Array(16).fill(2)),"
+      "    sessionPreKey: new Uint8Array(Array(32).fill(3)),"
+      "  },{"
+      "    version: 3,"
+      "    clientEid: new Uint8Array(Array(16).fill(1)),"
+      "    authenticatorEid: new Uint8Array(Array(16).fill(2)),"
+      "    sessionPreKey: new Uint8Array(Array(32).fill(3)),"
+      "  }]"
+      "}";
+  std::string result;
+  ASSERT_TRUE(content::ExecuteScriptAndExtractString(
+      shell()->web_contents()->GetMainFrame(),
+      BuildGetCallWithParameters(parameters), &result));
+  ASSERT_EQ(kNotAllowedErrorMessage, result);
+}
+
 #if defined(OS_WIN)
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest, WinMakeCredential) {
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html")));
 
-  device::ScopedFakeWinWebAuthnApi fake_api;
+  device::FakeWinWebAuthnApi fake_api;
   fake_api.set_is_uvpaa(true);
   fake_api.set_hresult(S_OK);
+  auto* virtual_device_factory = InjectVirtualFidoDeviceFactory();
+  virtual_device_factory->set_win_webauthn_api(&fake_api);
 
   base::Optional<std::string> result = ExecuteScriptAndExtractPrefixedString(
       shell()->web_contents(),
@@ -1281,8 +1329,11 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest, WinMakeCredential) {
 
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
                        WinMakeCredentialReturnCodeFailure) {
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html"));
-  device::ScopedFakeWinWebAuthnApi fake_api;
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html")));
+  device::FakeWinWebAuthnApi fake_api;
+  auto* virtual_device_factory = InjectVirtualFidoDeviceFactory();
+  virtual_device_factory->set_win_webauthn_api(&fake_api);
 
   // Errors documented for WebAuthNGetErrorName() in <webauthn.h>.
   const std::map<HRESULT, std::string> errors{
@@ -1315,10 +1366,13 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest, WinGetAssertion) {
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html"));
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html")));
 
-  device::ScopedFakeWinWebAuthnApi fake_api;
+  device::FakeWinWebAuthnApi fake_api;
   fake_api.set_hresult(S_OK);
+  auto* virtual_device_factory = InjectVirtualFidoDeviceFactory();
+  virtual_device_factory->set_win_webauthn_api(&fake_api);
 
   base::Optional<std::string> result = ExecuteScriptAndExtractPrefixedString(
       shell()->web_contents(), BuildGetCallWithParameters(GetParameters()),
@@ -1337,8 +1391,11 @@ IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest, WinGetAssertion) {
 
 IN_PROC_BROWSER_TEST_F(WebAuthJavascriptClientBrowserTest,
                        WinGetAssertionReturnCodeFailure) {
-  NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html"));
-  device::ScopedFakeWinWebAuthnApi fake_api;
+  EXPECT_TRUE(
+      NavigateToURL(shell(), GetHttpsURL("www.acme.com", "/title1.html")));
+  device::FakeWinWebAuthnApi fake_api;
+  auto* virtual_device_factory = InjectVirtualFidoDeviceFactory();
+  virtual_device_factory->set_win_webauthn_api(&fake_api);
 
   // Errors documented for WebAuthNGetErrorName() in <webauthn.h>.
   const std::set<HRESULT> errors{
diff --git a/chromium/content/browser/webkit_browsertest.cc b/chromium/content/browser/webkit_browsertest.cc
index eacc310b317..510c48e1442 100644
--- a/chromium/content/browser/webkit_browsertest.cc
+++ b/chromium/content/browser/webkit_browsertest.cc
@@ -64,7 +64,7 @@ IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, AbortOnEnd) {
   URLLoaderInterceptor interceptor(base::BindRepeating(&AbortOnEndInterceptor));
   GURL url = embedded_test_server()->GetURL(kAsyncScriptThatAbortsOnEndPage);
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   // If you are seeing this test fail, please strongly investigate the
   // possibility that http://crbug.com/75604 and
@@ -86,7 +86,7 @@ IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, XsltBadImport) {
   URLLoaderInterceptor interceptor(base::BindRepeating(&AbortOnEndInterceptor));
   GURL url = embedded_test_server()->GetURL(kXsltBadImportPage);
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   EXPECT_FALSE(shell()->web_contents()->IsCrashed());
 }
@@ -106,7 +106,7 @@ IN_PROC_BROWSER_TEST_F(WebKitBrowserTest, PrerenderNoCrash) {
   ASSERT_TRUE(embedded_test_server()->Start());
   GURL url = embedded_test_server()->GetURL(kPrerenderNoCrashPage);
 
-  NavigateToURL(shell(), url);
+  EXPECT_TRUE(NavigateToURL(shell(), url));
 
   EXPECT_FALSE(shell()->web_contents()->IsCrashed());
 }
diff --git a/chromium/content/browser/webrtc/OWNERS b/chromium/content/browser/webrtc/OWNERS
index 99868f95e87..0bec65a036e 100644
--- a/chromium/content/browser/webrtc/OWNERS
+++ b/chromium/content/browser/webrtc/OWNERS
@@ -1,10 +1,10 @@
-chfremer@chromium.org
 guidou@chromium.org
 tommi@chromium.org
 
 per-file *test*=phoglund@chromium.org
 
-# Original (legacy) owner.
+# Original (legacy) owners.
+chfremer@chromium.org
 emircan@chromium.org
 mcasas@chromium.org
 
diff --git a/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc b/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc
index fa35bbeb6fc..043ad5a37d2 100644
--- a/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_audio_browsertest.cc
@@ -11,7 +11,6 @@
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/webrtc_ip_handling_policy.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
@@ -19,6 +18,7 @@
 #include "media/webrtc/webrtc_switches.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gtest/include/gtest/gtest-param-test.h"
+#include "third_party/blink/public/common/peerconnection/webrtc_ip_handling_policy.h"
 
 const char kAudioConstraints[] = "audio: {echoCancellation: {exact: false}}";
 const char kVideoConstraints[] = "video:true";
@@ -46,7 +46,6 @@ class WebRtcAudioBrowserTest : public WebRtcContentBrowserTestBase,
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     WebRtcContentBrowserTestBase::SetUpCommandLine(command_line);
-    command_line->AppendSwitch(switches::kAllowPreCommitInput);
     // Automatically grant device permission.
     AppendUseFakeUIForMediaStreamFlag();
   }
diff --git a/chromium/content/browser/webrtc/webrtc_browsertest.cc b/chromium/content/browser/webrtc/webrtc_browsertest.cc
index 0343c2b8280..0ddd8118f71 100644
--- a/chromium/content/browser/webrtc/webrtc_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_browsertest.cc
@@ -10,7 +10,6 @@
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/network_service_util.h"
-#include "content/public/common/webrtc_ip_handling_policy.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
@@ -19,6 +18,7 @@
 #include "media/media_buildflags.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "services/network/public/cpp/features.h"
+#include "third_party/blink/public/common/peerconnection/webrtc_ip_handling_policy.h"
 
 namespace content {
 
diff --git a/chromium/content/browser/webrtc/webrtc_data_browsertest.cc b/chromium/content/browser/webrtc/webrtc_data_browsertest.cc
index 73fc5f9d7d3..82aa3776edb 100644
--- a/chromium/content/browser/webrtc/webrtc_data_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_data_browsertest.cc
@@ -9,13 +9,13 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/webrtc_ip_handling_policy.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "media/audio/audio_manager.h"
 #include "media/base/media_switches.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "third_party/blink/public/common/peerconnection/webrtc_ip_handling_policy.h"
 
 namespace content {
 
@@ -72,11 +72,17 @@ IN_PROC_BROWSER_TEST_F(MAYBE_WebRtcDataBrowserTest,
 // This test will make a PeerConnection-based call and test an unreliable text
 // dataChannel and audio and video tracks.
 // TODO(mallinath) - Remove this test after rtp based data channel is disabled.
-IN_PROC_BROWSER_TEST_F(MAYBE_WebRtcDataBrowserTest, CallWithDataAndMedia) {
+// Flaky. crbug.com/986872
+#if defined(OS_LINUX) || defined(OS_WIN)
+#define MAYBE_CallWithDataAndMedia DISABLED_CallWithDataAndMedia
+#else
+#define MAYBE_CallWithDataAndMedia CallWithDataAndMedia
+#endif
+IN_PROC_BROWSER_TEST_F(MAYBE_WebRtcDataBrowserTest,
+                       MAYBE_CallWithDataAndMedia) {
   MakeTypicalPeerConnectionCall("callWithDataAndMedia();");
 }
 
-
 #if defined(MEMORY_SANITIZER)
 // Fails under MemorySanitizer: http://crbug.com/405951
 #define MAYBE_CallWithSctpDataAndMedia DISABLED_CallWithSctpDataAndMedia
diff --git a/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc b/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
index d5203fcb5cf..ad5116a676d 100644
--- a/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_getusermedia_browsertest.cc
@@ -304,13 +304,13 @@ IN_PROC_BROWSER_TEST_P(WebRtcGetUserMediaBrowserTest,
                        MAYBE_GetUserMediaWithMandatorySourceID) {
   ASSERT_TRUE(embedded_test_server()->Start());
 
+  GURL url(embedded_test_server()->GetURL("/media/getusermedia.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
   std::vector<std::string> audio_ids;
   std::vector<std::string> video_ids;
   GetInputDevices(&audio_ids, &video_ids);
 
-  GURL url(embedded_test_server()->GetURL("/media/getusermedia.html"));
-  EXPECT_TRUE(NavigateToURL(shell(), url));
-
   // Test all combinations of mandatory sourceID;
   for (std::vector<std::string>::const_iterator video_it = video_ids.begin();
        video_it != video_ids.end(); ++video_it) {
@@ -794,6 +794,15 @@ IN_PROC_BROWSER_TEST_P(WebRtcGetUserMediaBrowserTest,
 }
 
 IN_PROC_BROWSER_TEST_P(WebRtcGetUserMediaBrowserTest,
+                       GetUserMediaEchoCancellationOnAndOffAndVideo) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+  GURL url(embedded_test_server()->GetURL("/media/getusermedia.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+  ExecuteJavascriptAndWaitForOk(
+      "getUserMediaEchoCancellationOnAndOffAndVideo()");
+}
+
+IN_PROC_BROWSER_TEST_P(WebRtcGetUserMediaBrowserTest,
                        GetAudioStreamAndCheckMutingInitiallyUnmuted) {
   // Muting tests do not work with the out-of-process audio service.
   // https://crbug.com/843490.
@@ -866,9 +875,10 @@ IN_PROC_BROWSER_TEST_P(WebRtcGetUserMediaBrowserTest,
   ExecuteJavascriptAndWaitForOk("setUpForAudioServiceCrash()");
 
   // Crash the audio service process.
-  audio::mojom::TestingApiPtr service_testing_api;
-  GetSystemConnector()->BindInterface(audio::mojom::kServiceName,
-                                      mojo::MakeRequest(&service_testing_api));
+  mojo::Remote<audio::mojom::TestingApi> service_testing_api;
+  GetSystemConnector()->Connect(
+      audio::mojom::kServiceName,
+      service_testing_api.BindNewPipeAndPassReceiver());
   service_testing_api->Crash();
 
   ExecuteJavascriptAndWaitForOk("verifyAfterAudioServiceCrash()");
diff --git a/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc b/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc
index 091f3f30b56..a58febd49cf 100644
--- a/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_image_capture_browsertest.cc
@@ -34,10 +34,16 @@ namespace content {
 // the bug is understood and fixed.
 #define MAYBE_ManipulatePan DISABLED_ManipulatePan
 #define MAYBE_ManipulateZoom DISABLED_ManipulateZoom
-#define MAYBE_ManipulateExposureTime DISABLED_ManipulateExposureTime
 #else
 #define MAYBE_ManipulatePan ManipulatePan
 #define MAYBE_ManipulateZoom ManipulateZoom
+#endif
+
+// TODO(crbug.com/793859, crbug.com/986602): This test is broken on Android
+// (see above) and flaky on Linux.
+#if defined(OS_ANDROID) || defined(OS_LINUX)
+#define MAYBE_ManipulateExposureTime DISABLED_ManipulateExposureTime
+#else
 #define MAYBE_ManipulateExposureTime ManipulateExposureTime
 #endif
 
@@ -213,8 +219,14 @@ IN_PROC_BROWSER_TEST_P(WebRtcImageCaptureSucceedsBrowserTest, GrabFrame) {
   ASSERT_TRUE(RunImageCaptureTestCase("testCreateAndGrabFrameSucceeds()"));
 }
 
+// Flaky. crbug.com/998116
+#if defined(OS_LINUX)
+#define MAYBE_GetTrackCapabilities DISABLED_GetTrackCapabilities
+#else
+#define MAYBE_GetTrackCapabilities GetTrackCapabilities
+#endif
 IN_PROC_BROWSER_TEST_P(WebRtcImageCaptureSucceedsBrowserTest,
-                       GetTrackCapabilities) {
+                       MAYBE_GetTrackCapabilities) {
   embedded_test_server()->StartAcceptingConnections();
   ASSERT_TRUE(RunImageCaptureTestCase("testCreateAndGetTrackCapabilities()"));
 }
diff --git a/chromium/content/browser/webrtc/webrtc_internals.cc b/chromium/content/browser/webrtc/webrtc_internals.cc
index aec3c7b9212..a910ed5c04b 100644
--- a/chromium/content/browser/webrtc/webrtc_internals.cc
+++ b/chromium/content/browser/webrtc/webrtc_internals.cc
@@ -24,6 +24,7 @@
 #include "content/public/browser/system_connector.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/webrtc_event_logger.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_switches.h"
 #include "ipc/ipc_platform_file.h"
 #include "media/audio/audio_debug_recording_session.h"
diff --git a/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc b/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc
index c029b9ef223..6def6d8447c 100644
--- a/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_ip_permissions_browsertest.cc
@@ -9,13 +9,13 @@
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/browser/webrtc/webrtc_content_browsertest_base.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/webrtc_ip_handling_policy.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "content/public/test/test_utils.h"
 #include "media/audio/audio_manager.h"
 #include "media/base/media_switches.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "third_party/blink/public/common/peerconnection/webrtc_ip_handling_policy.h"
 
 namespace content {
 
@@ -56,7 +56,7 @@ class MAYBE_WebRtcIPPermissionGrantedTest
     WebRtcContentBrowserTestBase::SetUpCommandLine(command_line);
     AppendUseFakeUIForMediaStreamFlag();
     command_line->AppendSwitchASCII(switches::kForceWebRtcIPHandlingPolicy,
-                                    kWebRTCIPHandlingDefault);
+                                    blink::kWebRTCIPHandlingDefault);
   }
 };
 
@@ -77,7 +77,7 @@ class MAYBE_WebRtcIPPermissionDeniedTest : public WebRtcContentBrowserTestBase {
   void SetUpCommandLine(base::CommandLine* command_line) override {
     WebRtcContentBrowserTestBase::SetUpCommandLine(command_line);
     command_line->AppendSwitchASCII(switches::kForceWebRtcIPHandlingPolicy,
-                                    kWebRTCIPHandlingDefault);
+                                    blink::kWebRTCIPHandlingDefault);
   }
 };
 
@@ -101,7 +101,7 @@ class MAYBE_WebRtcIPPolicyPublicAndPrivateInterfacesTest
     AppendUseFakeUIForMediaStreamFlag();
     command_line->AppendSwitchASCII(
         switches::kForceWebRtcIPHandlingPolicy,
-        kWebRTCIPHandlingDefaultPublicAndPrivateInterfaces);
+        blink::kWebRTCIPHandlingDefaultPublicAndPrivateInterfaces);
   }
 };
 
@@ -124,7 +124,7 @@ class MAYBE_WebRtcIPPolicyPublicInterfaceOnlyTest
     AppendUseFakeUIForMediaStreamFlag();
     command_line->AppendSwitchASCII(
         switches::kForceWebRtcIPHandlingPolicy,
-        kWebRTCIPHandlingDefaultPublicInterfaceOnly);
+        blink::kWebRTCIPHandlingDefaultPublicInterfaceOnly);
   }
 };
 
@@ -144,8 +144,9 @@ class MAYBE_WebRtcIPPolicyDisableUdpTest : public WebRtcContentBrowserTestBase {
   void SetUpCommandLine(base::CommandLine* command_line) override {
     WebRtcContentBrowserTestBase::SetUpCommandLine(command_line);
     AppendUseFakeUIForMediaStreamFlag();
-    command_line->AppendSwitchASCII(switches::kForceWebRtcIPHandlingPolicy,
-                                    kWebRTCIPHandlingDisableNonProxiedUdp);
+    command_line->AppendSwitchASCII(
+        switches::kForceWebRtcIPHandlingPolicy,
+        blink::kWebRTCIPHandlingDisableNonProxiedUdp);
   }
 };
 
diff --git a/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc b/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc
index 53155d63c3c..266e53d67f5 100644
--- a/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc
+++ b/chromium/content/browser/webrtc/webrtc_video_capture_shared_device_browsertest.cc
@@ -13,6 +13,7 @@
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
 #include "media/base/media_switches.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/video_capture/public/cpp/mock_receiver.h"
 #include "services/video_capture/public/mojom/device.mojom.h"
 #include "services/video_capture/public/mojom/device_factory.mojom.h"
@@ -124,7 +125,7 @@ class WebRtcVideoCaptureSharedDeviceBrowserTest
     DCHECK(content::BrowserThread::CurrentlyOn(content::BrowserThread::UI));
     main_task_runner_ = base::ThreadTaskRunnerHandle::Get();
     mock_receiver_ = std::make_unique<video_capture::MockReceiver>(
-        mojo::MakeRequest(&receiver_proxy_));
+        subscriber_.InitWithNewPipeAndPassReceiver());
   }
 
   scoped_refptr<base::TaskRunner> main_task_runner_;
@@ -155,7 +156,7 @@ class WebRtcVideoCaptureSharedDeviceBrowserTest
     requestable_settings.requested_format.frame_size = kVideoSize;
     requestable_settings.buffer_type = buffer_type_to_request;
 
-    device_->Start(requestable_settings, std::move(receiver_proxy_));
+    device_->Start(requestable_settings, std::move(subscriber_));
   }
 
   void OnSourceInfosReceived(
@@ -173,7 +174,7 @@ class WebRtcVideoCaptureSharedDeviceBrowserTest
 
     video_capture::mojom::PushVideoStreamSubscriptionPtr subscription;
     video_source_->CreatePushSubscription(
-        std::move(receiver_proxy_), requestable_settings,
+        std::move(subscriber_), requestable_settings,
         false /*force_reopen_with_new_settings*/,
         mojo::MakeRequest(&subscription_),
         base::BindOnce(&WebRtcVideoCaptureSharedDeviceBrowserTest::
@@ -200,7 +201,7 @@ class WebRtcVideoCaptureSharedDeviceBrowserTest
   video_capture::mojom::VideoSourcePtr video_source_;
   video_capture::mojom::PushVideoStreamSubscriptionPtr subscription_;
 
-  video_capture::mojom::ReceiverPtr receiver_proxy_;
+  mojo::PendingRemote<video_capture::mojom::Receiver> subscriber_;
   base::WeakPtrFactory<WebRtcVideoCaptureSharedDeviceBrowserTest> weak_factory_{
       this};
 
diff --git a/chromium/content/browser/websockets/websocket_connector_impl.cc b/chromium/content/browser/websockets/websocket_connector_impl.cc
index aad76cf9fe6..c1e45c4594d 100644
--- a/chromium/content/browser/websockets/websocket_connector_impl.cc
+++ b/chromium/content/browser/websockets/websocket_connector_impl.cc
@@ -8,6 +8,7 @@
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
+#include "content/public/common/content_client.h"
 #include "services/network/public/cpp/features.h"
 #include "url/gurl.h"
 
diff --git a/chromium/content/browser/webui/shared_resources_data_source.cc b/chromium/content/browser/webui/shared_resources_data_source.cc
index 35db9c82c39..07d11d876c1 100644
--- a/chromium/content/browser/webui/shared_resources_data_source.cc
+++ b/chromium/content/browser/webui/shared_resources_data_source.cc
@@ -64,17 +64,20 @@ const std::map<std::string, std::string> CreatePathPrefixAliasesMap() {
   // TODO(rkc): Once we have a separate source for apps, remove '*/apps/'
   // aliases.
   std::map<std::string, std::string> aliases = {
-      {"../../../third_party/polymer/v1_0/components-chromium/",
-       "polymer/v1_0/"},
-      {"../../../third_party/polymer/v3_0/components-chromium/",
-       "polymer/v3_0/"},
-      {"../../../third_party/web-animations-js/sources/",
-       "polymer/v1_0/web-animations-js/"},
-      {"../../views/resources/default_100_percent/common/", "images/apps/"},
-      {"../../views/resources/default_200_percent/common/", "images/2x/apps/"},
-      {"../../webui/resources/cr_components/", "cr_components/"},
-      {"../../webui/resources/cr_elements/", "cr_elements/"},
-      {"@out_folder@/gen/ui/webui/resources/", ""},
+    {"../../../third_party/polymer/v1_0/components-chromium/", "polymer/v1_0/"},
+    {"../../../third_party/polymer/v3_0/components-chromium/", "polymer/v3_0/"},
+    {"../../../third_party/web-animations-js/sources/",
+     "polymer/v1_0/web-animations-js/"},
+    {"../../views/resources/default_100_percent/common/", "images/apps/"},
+    {"../../views/resources/default_200_percent/common/", "images/2x/apps/"},
+    {"../../webui/resources/cr_components/", "cr_components/"},
+    {"../../webui/resources/cr_elements/", "cr_elements/"},
+    {"@out_folder@/gen/ui/webui/resources/", ""},
+#if defined(OS_ANDROID)
+    // This is a temporary fix for `target_cpu = "arm64"`. See the bug for
+    // more context: crbug.com/1020284.
+    {"@out_folder@/android_clang_arm/gen/ui/webui/resources/", ""},
+#endif  // defined(OS_ANDROID)
   };
 
 #if defined(OS_CHROMEOS)
diff --git a/chromium/content/browser/webui/url_data_manager_backend.cc b/chromium/content/browser/webui/url_data_manager_backend.cc
index 72d651ce906..a9f0765b3e0 100644
--- a/chromium/content/browser/webui/url_data_manager_backend.cc
+++ b/chromium/content/browser/webui/url_data_manager_backend.cc
@@ -31,6 +31,7 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
diff --git a/chromium/content/browser/webui/web_ui_controller_factory_registry.cc b/chromium/content/browser/webui/web_ui_controller_factory_registry.cc
index 2737c433cba..c0f339f6c43 100644
--- a/chromium/content/browser/webui/web_ui_controller_factory_registry.cc
+++ b/chromium/content/browser/webui/web_ui_controller_factory_registry.cc
@@ -10,6 +10,7 @@
 #include "content/browser/frame_host/debug_urls.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/web_ui_controller.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "url/gurl.h"
diff --git a/chromium/content/browser/webui/web_ui_mojo_browsertest.cc b/chromium/content/browser/webui/web_ui_mojo_browsertest.cc
index fb06c33193b..7f6e404413e 100644
--- a/chromium/content/browser/webui/web_ui_mojo_browsertest.cc
+++ b/chromium/content/browser/webui/web_ui_mojo_browsertest.cc
@@ -37,8 +37,8 @@
 #include "content/public/test/test_utils.h"
 #include "content/shell/browser/shell.h"
 #include "content/test/data/web_ui_test_mojo_bindings.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 
 namespace content {
@@ -83,8 +83,8 @@ void GetResource(const std::string& id,
 class BrowserTargetImpl : public mojom::BrowserTarget {
  public:
   BrowserTargetImpl(base::RunLoop* run_loop,
-                    mojo::InterfaceRequest<mojom::BrowserTarget> request)
-      : run_loop_(run_loop), binding_(this, std::move(request)) {}
+                    mojo::PendingReceiver<mojom::BrowserTarget> receiver)
+      : run_loop_(run_loop), receiver_(this, std::move(receiver)) {}
 
   ~BrowserTargetImpl() override {}
 
@@ -99,7 +99,7 @@ class BrowserTargetImpl : public mojom::BrowserTarget {
   base::RunLoop* const run_loop_;
 
  private:
-  mojo::Binding<mojom::BrowserTarget> binding_;
+  mojo::Receiver<mojom::BrowserTarget> receiver_;
   DISALLOW_COPY_AND_ASSIGN(BrowserTargetImpl);
 };
 
@@ -309,7 +309,7 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, EndToEndPing) {
     g_got_message = false;
     base::RunLoop run_loop;
     factory()->set_run_loop(&run_loop);
-    NavigateToURL(shell(), test_url);
+    EXPECT_TRUE(NavigateToURL(shell(), test_url));
     // RunLoop is quit when message received from page.
     run_loop.Run();
     EXPECT_TRUE(g_got_message);
@@ -321,7 +321,7 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, EndToEndPing) {
     g_got_message = false;
     base::RunLoop other_run_loop;
     factory()->set_run_loop(&other_run_loop);
-    NavigateToURL(other_shell, test_url);
+    EXPECT_TRUE(NavigateToURL(other_shell, test_url));
     // RunLoop is quit when message received from page.
     other_run_loop.Run();
     EXPECT_TRUE(g_got_message);
@@ -349,7 +349,7 @@ IN_PROC_BROWSER_TEST_F(WebUIMojoTest, EndToEndPing) {
     g_got_message = false;
     base::RunLoop other_run_loop;
     factory()->set_run_loop(&other_run_loop);
-    NavigateToURL(other_shell, test_url);
+    EXPECT_TRUE(NavigateToURL(other_shell, test_url));
     // RunLoop is quit when message received from page.
     other_run_loop.Run();
     EXPECT_TRUE(g_got_message);
diff --git a/chromium/content/browser/webui/web_ui_security_browsertest.cc b/chromium/content/browser/webui/web_ui_security_browsertest.cc
new file mode 100644
index 00000000000..65448acefb3
--- /dev/null
+++ b/chromium/content/browser/webui/web_ui_security_browsertest.cc
@@ -0,0 +1,224 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/files/file_path.h"
+#include "base/files/file_util.h"
+#include "base/hash/hash.h"
+#include "base/memory/ref_counted_memory.h"
+#include "base/path_service.h"
+#include "base/strings/string_number_conversions.h"
+#include "base/threading/thread_restrictions.h"
+#include "content/browser/child_process_security_policy_impl.h"
+#include "content/browser/frame_host/frame_tree_node.h"
+#include "content/browser/web_contents/web_contents_impl.h"
+#include "content/browser/webui/web_ui_controller_factory_registry.h"
+#include "content/public/browser/web_ui.h"
+#include "content/public/browser/web_ui_controller.h"
+#include "content/public/browser/web_ui_data_source.h"
+#include "content/public/common/bindings_policy.h"
+#include "content/public/common/content_paths.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+#include "content/public/test/test_frame_navigation_observer.h"
+#include "content/public/test/test_utils.h"
+#include "content/shell/browser/shell.h"
+#include "content/test/content_browser_test_utils_internal.h"
+#include "net/base/url_util.h"
+#include "url/gurl.h"
+
+namespace content {
+
+namespace {
+
+void GetResource(const std::string& id,
+                 const WebUIDataSource::GotDataCallback& callback) {
+  base::ScopedAllowBlockingForTesting allow_blocking;
+
+  std::string contents;
+  base::FilePath path;
+  CHECK(base::PathService::Get(content::DIR_TEST_DATA, &path));
+  path = path.AppendASCII(id.substr(0, id.find("?")));
+  CHECK(base::ReadFileToString(path, &contents)) << path.value();
+
+  base::RefCountedString* ref_contents = new base::RefCountedString;
+  ref_contents->data() = contents;
+  callback.Run(ref_contents);
+}
+
+struct WebUIControllerConfig {
+  int bindings = BINDINGS_POLICY_MOJO_WEB_UI;
+  std::string child_src = "child-src 'self' chrome://web-ui-subframe/;";
+  bool disable_xfo = false;
+};
+
+class TestWebUIController : public WebUIController {
+ public:
+  TestWebUIController(WebUI* web_ui,
+                      const GURL& base_url,
+                      const WebUIControllerConfig& config)
+      : WebUIController(web_ui) {
+    web_ui->SetBindings(config.bindings);
+
+    WebUIDataSource* data_source = WebUIDataSource::Create(base_url.host());
+    data_source->SetRequestFilter(
+        base::BindRepeating([](const std::string& path) { return true; }),
+        base::BindRepeating(&GetResource));
+
+    if (!config.child_src.empty())
+      data_source->OverrideContentSecurityPolicyChildSrc(config.child_src);
+
+    if (config.disable_xfo)
+      data_source->DisableDenyXFrameOptions();
+
+    WebUIDataSource::Add(web_ui->GetWebContents()->GetBrowserContext(),
+                         data_source);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TestWebUIController);
+};
+
+class TestWebUIControllerFactory : public WebUIControllerFactory {
+ public:
+  TestWebUIControllerFactory() {}
+
+  std::unique_ptr<WebUIController> CreateWebUIControllerForURL(
+      WebUI* web_ui,
+      const GURL& url) override {
+    if (!url.SchemeIs(kChromeUIScheme))
+      return nullptr;
+
+    WebUIControllerConfig config;
+    if (url.has_query()) {
+      std::string value;
+      bool has_value = net::GetValueForKeyInQuery(url, "bindings", &value);
+      if (has_value)
+        EXPECT_TRUE(base::StringToInt(value, &(config.bindings)));
+
+      has_value = net::GetValueForKeyInQuery(url, "noxfo", &value);
+      if (has_value && value == "true")
+        config.disable_xfo = true;
+    }
+
+    return std::make_unique<TestWebUIController>(web_ui, url, config);
+  }
+
+  WebUI::TypeID GetWebUIType(BrowserContext* browser_context,
+                             const GURL& url) override {
+    if (!url.SchemeIs(kChromeUIScheme))
+      return WebUI::kNoWebUI;
+
+    return reinterpret_cast<WebUI::TypeID>(base::Hash(url.host()));
+  }
+
+  bool UseWebUIForURL(BrowserContext* browser_context,
+                      const GURL& url) override {
+    return GetWebUIType(browser_context, url) != WebUI::kNoWebUI;
+  }
+  bool UseWebUIBindingsForURL(BrowserContext* browser_context,
+                              const GURL& url) override {
+    return GetWebUIType(browser_context, url) != WebUI::kNoWebUI;
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(TestWebUIControllerFactory);
+};
+
+}  // namespace
+
+class WebUISecurityTest : public ContentBrowserTest {
+ public:
+  WebUISecurityTest() { WebUIControllerFactory::RegisterFactory(&factory_); }
+
+  ~WebUISecurityTest() override {
+    WebUIControllerFactory::UnregisterFactoryForTesting(&factory_);
+  }
+
+  TestWebUIControllerFactory* factory() { return &factory_; }
+
+ private:
+  TestWebUIControllerFactory factory_;
+
+  DISALLOW_COPY_AND_ASSIGN(WebUISecurityTest);
+};
+
+// Loads a WebUI which does not have any bindings.
+IN_PROC_BROWSER_TEST_F(WebUISecurityTest, NoBindings) {
+  GURL test_url(GetWebUIURL("web-ui/title1.html?bindings=0"));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+
+  EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetMainFrame()->GetProcess()->GetID()));
+}
+
+// Loads a WebUI which has WebUI bindings.
+IN_PROC_BROWSER_TEST_F(WebUISecurityTest, WebUIBindings) {
+  GURL test_url(GetWebUIURL("web-ui/title1.html?bindings=" +
+                            base::NumberToString(BINDINGS_POLICY_WEB_UI)));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+
+  EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetMainFrame()->GetProcess()->GetID()));
+}
+
+// Loads a WebUI which has Mojo bindings.
+IN_PROC_BROWSER_TEST_F(WebUISecurityTest, MojoBindings) {
+  GURL test_url(GetWebUIURL("web-ui/title1.html?bindings=" +
+                            base::NumberToString(BINDINGS_POLICY_MOJO_WEB_UI)));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+
+  EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetMainFrame()->GetProcess()->GetID()));
+}
+
+// Loads a WebUI which has both WebUI and Mojo bindings.
+IN_PROC_BROWSER_TEST_F(WebUISecurityTest, WebUIAndMojoBindings) {
+  GURL test_url(GetWebUIURL("web-ui/title1.html?bindings=" +
+                            base::NumberToString(BINDINGS_POLICY_WEB_UI |
+                                                 BINDINGS_POLICY_MOJO_WEB_UI)));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+
+  EXPECT_TRUE(ChildProcessSecurityPolicyImpl::GetInstance()->HasWebUIBindings(
+      shell()->web_contents()->GetMainFrame()->GetProcess()->GetID()));
+}
+
+// Verify that a WebUI can add a subframe for its own WebUI.
+// Note: This works by accident, since the main frame WebUI will respond to
+// the navigation request for the subframe. See https://crbug.com/713313.
+IN_PROC_BROWSER_TEST_F(WebUISecurityTest, WebUISameSiteSubframe) {
+  // TODO(nasko): Remove the noxfo=true parameter when https://crbug.com/713313
+  // is fixed. It is required for now, since currently WebUIs are not created
+  // for subframes, so the main frame WebUI object will respond to the
+  // navigation request for the subframe, which means we need to disable
+  // X-Frame-Options on it.
+  GURL test_url(GetWebUIURL("web-ui/page_with_blank_iframe.html?noxfo=true"));
+  EXPECT_TRUE(NavigateToURL(shell(), test_url));
+
+  FrameTreeNode* root = static_cast<WebContentsImpl*>(shell()->web_contents())
+                            ->GetFrameTree()
+                            ->root();
+  EXPECT_EQ(1U, root->child_count());
+
+  TestFrameNavigationObserver observer(root->child_at(0));
+  GURL subframe_url(GetWebUIURL("web-ui/title1.html?noxfo=true"));
+  NavigateFrameToURL(root->child_at(0), subframe_url);
+
+  EXPECT_TRUE(observer.last_navigation_succeeded());
+  EXPECT_EQ(subframe_url, observer.last_committed_url());
+  EXPECT_EQ(root->current_frame_host()->GetSiteInstance(),
+            root->child_at(0)->current_frame_host()->GetSiteInstance());
+  EXPECT_EQ(
+      GetWebUIURL("web-ui"),
+      root->child_at(0)->current_frame_host()->GetSiteInstance()->GetSiteURL());
+
+  // TODO(nasko): The subframe should have its own WebUI object, so the
+  // following expectation should be inverted once https://crbug.com/713313 is
+  // fixed.
+  EXPECT_EQ(nullptr, root->child_at(0)->current_frame_host()->web_ui());
+  EXPECT_NE(root->current_frame_host()->web_ui(),
+            root->child_at(0)->current_frame_host()->web_ui());
+}
+
+}  // namespace content
diff --git a/chromium/content/browser/webui/web_ui_url_loader_factory.cc b/chromium/content/browser/webui/web_ui_url_loader_factory.cc
index 39edc87ce5c..5c152c58bdb 100644
--- a/chromium/content/browser/webui/web_ui_url_loader_factory.cc
+++ b/chromium/content/browser/webui/web_ui_url_loader_factory.cc
@@ -30,7 +30,8 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/url_constants.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "services/network/public/mojom/network_service.mojom.h"
 #include "ui/base/template_expressions.h"
 
@@ -81,17 +82,26 @@ void ReadData(scoped_refptr<network::ResourceResponse> headers,
 
   uint32_t output_size = bytes->size();
 
-  mojo::DataPipe data_pipe(output_size);
+  MojoCreateDataPipeOptions options;
+  options.struct_size = sizeof(MojoCreateDataPipeOptions);
+  options.flags = MOJO_CREATE_DATA_PIPE_FLAG_NONE;
+  options.element_num_bytes = 1;
+  options.capacity_num_bytes = output_size;
+  mojo::ScopedDataPipeProducerHandle pipe_producer_handle;
+  mojo::ScopedDataPipeConsumerHandle pipe_consumer_handle;
+  MojoResult create_result = mojo::CreateDataPipe(
+      &options, &pipe_producer_handle, &pipe_consumer_handle);
+  CHECK_EQ(create_result, MOJO_RESULT_OK);
 
   void* buffer = nullptr;
   uint32_t num_bytes = output_size;
-  MojoResult result = data_pipe.producer_handle->BeginWriteData(
+  MojoResult result = pipe_producer_handle->BeginWriteData(
       &buffer, &num_bytes, MOJO_WRITE_DATA_FLAG_NONE);
   CHECK_EQ(result, MOJO_RESULT_OK);
   CHECK_GE(num_bytes, output_size);
 
   memcpy(buffer, bytes->front(), output_size);
-  result = data_pipe.producer_handle->EndWriteData(output_size);
+  result = pipe_producer_handle->EndWriteData(output_size);
   CHECK_EQ(result, MOJO_RESULT_OK);
 
   // For media content, |content_length| must be known upfront for data that is
@@ -104,7 +114,7 @@ void ReadData(scoped_refptr<network::ResourceResponse> headers,
   client.Bind(std::move(client_info));
   client->OnReceiveResponse(headers->head);
 
-  client->OnStartLoadingResponseBody(std::move(data_pipe.consumer_handle));
+  client->OnStartLoadingResponseBody(std::move(pipe_consumer_handle));
   network::URLLoaderCompletionStatus status(net::OK);
   status.encoded_data_length = output_size;
   status.encoded_body_length = output_size;
@@ -224,9 +234,9 @@ class WebUIURLLoaderFactory : public network::mojom::URLLoaderFactory,
 
   ~WebUIURLLoaderFactory() override {}
 
-  void AddBinding(mojo::PendingReceiver<network::mojom::URLLoaderFactory>
-                      factory_receiver) {
-    loader_factory_bindings_.AddBinding(this, std::move(factory_receiver));
+  void AddReceiver(mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+                       factory_receiver) {
+    loader_factory_receivers_.Add(this, std::move(factory_receiver));
   }
 
   // network::mojom::URLLoaderFactory implementation:
@@ -291,8 +301,9 @@ class WebUIURLLoaderFactory : public network::mojom::URLLoaderFactory,
             GetStoragePartition()->browser_context()->GetResourceContext()));
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
-    loader_factory_bindings_.AddBinding(this, std::move(request));
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
+    loader_factory_receivers_.Add(this, std::move(receiver));
   }
 
   // WebContentsObserver implementation:
@@ -315,7 +326,7 @@ class WebUIURLLoaderFactory : public network::mojom::URLLoaderFactory,
   RenderFrameHost* render_frame_host_;
   std::string scheme_;
   const base::flat_set<std::string> allowed_hosts_;  // if empty all allowed.
-  mojo::BindingSet<network::mojom::URLLoaderFactory> loader_factory_bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> loader_factory_receivers_;
 
   DISALLOW_COPY_AND_ASSIGN(WebUIURLLoaderFactory);
 };
@@ -343,7 +354,7 @@ void CreateWebUIURLLoaderBinding(
         std::make_unique<WebUIURLLoaderFactory>(render_frame_host, scheme,
                                                 base::flat_set<std::string>());
   }
-  g_web_ui_url_loader_factories.Get()[routing_id]->AddBinding(
+  g_web_ui_url_loader_factories.Get()[routing_id]->AddReceiver(
       std::move(factory_receiver));
 }
 
diff --git a/chromium/content/browser/worker_host/dedicated_worker_host.cc b/chromium/content/browser/worker_host/dedicated_worker_host.cc
index c4287066bca..f9b7e5c601f 100644
--- a/chromium/content/browser/worker_host/dedicated_worker_host.cc
+++ b/chromium/content/browser/worker_host/dedicated_worker_host.cc
@@ -22,6 +22,8 @@
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/service_worker_context.h"
+#include "content/public/common/content_client.h"
+#include "content/public/common/network_service_util.h"
 #include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
@@ -200,6 +202,14 @@ void DedicatedWorkerHost::StartScriptLoad(
         appcache_handle->appcache_host_id());
   }
 
+  // Set if the subresource loader factories support file URLs so that we can
+  // recreate the factories after Network Service crashes.
+  // TODO(nhiroki): Currently this flag is calculated based on the request
+  // initiator origin to keep consistency with WorkerScriptFetchInitiator, but
+  // probably this should be calculated based on the worker origin as the
+  // factories be used for subresource loading on the worker.
+  file_url_support_ = request_initiator_origin.scheme() == url::kFileScheme;
+
   service_worker_handle_ = std::make_unique<ServiceWorkerNavigationHandle>(
       storage_partition_impl->GetServiceWorkerContext());
 
@@ -261,6 +271,12 @@ void DedicatedWorkerHost::DidStartScriptLoad(
     return;
   }
 
+  // Start observing Network Service crash when it's running out-of-process.
+  if (IsOutOfProcessNetworkService()) {
+    ObserveNetworkServiceCrash(static_cast<StoragePartitionImpl*>(
+        worker_process_host->GetStoragePartition()));
+  }
+
   // Set up the default network loader factory.
   bool bypass_redirect_checks = false;
   subresource_loader_factories->pending_default_factory() =
@@ -282,10 +298,12 @@ void DedicatedWorkerHost::DidStartScriptLoad(
     service_worker_state = controller->object_info->state;
   }
 
-  client_->OnScriptLoadStarted(service_worker_handle_->TakeProviderInfo(),
-                               std::move(main_script_load_params),
-                               std::move(subresource_loader_factories),
-                               std::move(controller));
+  client_->OnScriptLoadStarted(
+      service_worker_handle_->TakeProviderInfo(),
+      std::move(main_script_load_params),
+      std::move(subresource_loader_factories),
+      subresource_loader_updater_.BindNewPipeAndPassReceiver(),
+      std::move(controller));
 
   // |service_worker_remote_object| is an associated remote, so calls can't be
   // made on it until its receiver is sent. Now that the receiver was sent, it
@@ -343,13 +361,12 @@ void DedicatedWorkerHost::CreateWebUsbService(
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
   RenderFrameHostImpl* ancestor_render_frame_host =
       GetAncestorRenderFrameHost();
-  if (!ancestor_render_frame_host) {
-    // The ancestor frame may have already been closed. In that case, the worker
-    // will soon be terminated too, so abort the connection.
+  // The ancestor frame may have already been closed. In that case, the worker
+  // will soon be terminated too, so abort the connection.
+  if (!ancestor_render_frame_host)
     return;
-  }
-  GetContentClient()->browser()->CreateWebUsbService(ancestor_render_frame_host,
-                                                     std::move(receiver));
+
+  ancestor_render_frame_host->CreateWebUsbService(std::move(receiver));
 }
 
 void DedicatedWorkerHost::CreateWebSocketConnector(
@@ -388,6 +405,15 @@ void DedicatedWorkerHost::BindFileSystemManager(
   worker_process_host->BindFileSystemManager(GetOrigin(), std::move(receiver));
 }
 
+void DedicatedWorkerHost::BindVideoDecodePerfHistory(
+    mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* worker_process_host = GetProcessHost();
+  if (!worker_process_host)
+    return;
+  worker_process_host->BindVideoDecodePerfHistory(std::move(receiver));
+}
+
 void DedicatedWorkerHost::CreateIdleManager(
     mojo::PendingReceiver<blink::mojom::IdleManager> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -409,6 +435,117 @@ void DedicatedWorkerHost::CreateIdleManager(
       ->CreateService(std::move(receiver));
 }
 
+void DedicatedWorkerHost::CreatePaymentManager(
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* worker_process_host = GetProcessHost();
+  if (!worker_process_host)
+    return;
+  worker_process_host->CreatePaymentManagerForOrigin(GetOrigin(),
+                                                     std::move(receiver));
+}
+
+void DedicatedWorkerHost::CreateIDBFactory(
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* worker_process_host = GetProcessHost();
+  if (!worker_process_host)
+    return;
+  worker_process_host->BindIndexedDB(MSG_ROUTING_NONE, GetOrigin(),
+                                     std::move(receiver));
+}
+
+void DedicatedWorkerHost::BindSmsReceiverReceiver(
+    mojo::PendingReceiver<blink::mojom::SmsReceiver> receiver) {
+  RenderFrameHostImpl* ancestor_render_frame_host =
+      GetAncestorRenderFrameHost();
+  if (!ancestor_render_frame_host) {
+    // The ancestor frame may have already been closed. In that case, the worker
+    // will soon be terminated too, so abort the connection.
+    return;
+  }
+
+  ancestor_render_frame_host->BindSmsReceiverReceiver(std::move(receiver));
+}
+
+#if !defined(OS_ANDROID)
+void DedicatedWorkerHost::BindSerialService(
+    mojo::PendingReceiver<blink::mojom::SerialService> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderFrameHostImpl* ancestor_render_frame_host =
+      GetAncestorRenderFrameHost();
+  if (!ancestor_render_frame_host) {
+    // The ancestor frame may have already been closed. In that case, the worker
+    // will soon be terminated too, so abort the connection.
+    return;
+  }
+
+  ancestor_render_frame_host->BindSerialService(std::move(receiver));
+}
+#endif
+
+void DedicatedWorkerHost::ObserveNetworkServiceCrash(
+    StoragePartitionImpl* storage_partition_impl) {
+  auto params = network::mojom::URLLoaderFactoryParams::New();
+  params->process_id = worker_process_id_;
+  storage_partition_impl->GetNetworkContext()->CreateURLLoaderFactory(
+      mojo::MakeRequest(&network_service_connection_error_handler_holder_),
+      std::move(params));
+  network_service_connection_error_handler_holder_.set_connection_error_handler(
+      base::BindOnce(&DedicatedWorkerHost::UpdateSubresourceLoaderFactories,
+                     weak_factory_.GetWeakPtr()));
+}
+
+void DedicatedWorkerHost::UpdateSubresourceLoaderFactories() {
+  DCHECK(IsOutOfProcessNetworkService());
+  DCHECK(subresource_loader_updater_.is_bound());
+  DCHECK(network_service_connection_error_handler_holder_);
+  DCHECK(network_service_connection_error_handler_holder_.encountered_error());
+
+  // Get a storage partition.
+  auto* worker_process_host = RenderProcessHost::FromID(worker_process_id_);
+  if (!worker_process_host)
+    return;
+  auto* storage_partition_impl = static_cast<StoragePartitionImpl*>(
+      worker_process_host->GetStoragePartition());
+
+  // Get a storage domain.
+  if (!GetAncestorRenderFrameHost() ||
+      !GetAncestorRenderFrameHost()->GetSiteInstance())
+    return;
+  std::string storage_domain;
+  std::string partition_name;
+  bool in_memory;
+  GetContentClient()->browser()->GetStoragePartitionConfigForSite(
+      storage_partition_impl->browser_context(),
+      GetAncestorRenderFrameHost()->GetSiteInstance()->GetSiteURL(),
+      /*can_be_default=*/true, &storage_domain, &partition_name, &in_memory);
+
+  // Start observing Network Service crash again.
+  ObserveNetworkServiceCrash(storage_partition_impl);
+
+  // Recreate the default URLLoaderFactory. This doesn't support
+  // AppCache-specific factory.
+  std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
+      subresource_loader_factories =
+          WorkerScriptFetchInitiator::CreateFactoryBundle(
+              WorkerScriptFetchInitiator::LoaderType::kSubResource,
+              worker_process_id_, storage_partition_impl, storage_domain,
+              file_url_support_, /*filesystem_url_support=*/true);
+
+  bool bypass_redirect_checks = false;
+  subresource_loader_factories->pending_default_factory() =
+      CreateNetworkFactoryForSubresources(worker_process_host,
+                                          GetAncestorRenderFrameHost(),
+                                          &bypass_redirect_checks);
+  subresource_loader_factories->set_bypass_redirect_checks(
+      bypass_redirect_checks);
+
+  subresource_loader_updater_->UpdateSubresourceLoaderFactories(
+      std::move(subresource_loader_factories));
+}
+
+// May return a nullptr.
 RenderFrameHostImpl* DedicatedWorkerHost::GetAncestorRenderFrameHost() {
   // Use |worker_process_id_| as the ancestor render frame's process ID as the
   // frame surely lives in the same process for dedicated workers.
diff --git a/chromium/content/browser/worker_host/dedicated_worker_host.h b/chromium/content/browser/worker_host/dedicated_worker_host.h
index 4e56abf3ad7..d35c23e2ecd 100644
--- a/chromium/content/browser/worker_host/dedicated_worker_host.h
+++ b/chromium/content/browser/worker_host/dedicated_worker_host.h
@@ -5,8 +5,10 @@
 #ifndef CONTENT_BROWSER_WORKER_HOST_DEDICATED_WORKER_HOST_H_
 #define CONTENT_BROWSER_WORKER_HOST_DEDICATED_WORKER_HOST_H_
 
+#include "build/build_config.h"
 #include "content/browser/browser_interface_broker_impl.h"
 #include "content/public/browser/render_process_host.h"
+#include "media/mojo/mojom/video_decode_perf_history.mojom.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver.h"
@@ -15,10 +17,17 @@
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "third_party/blink/public/mojom/filesystem/file_system.mojom-forward.h"
 #include "third_party/blink/public/mojom/idle/idle_manager.mojom-forward.h"
+#include "third_party/blink/public/mojom/payments/payment_app.mojom-forward.h"
+#include "third_party/blink/public/mojom/sms/sms_receiver.mojom-forward.h"
 #include "third_party/blink/public/mojom/usb/web_usb_service.mojom-forward.h"
 #include "third_party/blink/public/mojom/websockets/websocket_connector.mojom-forward.h"
 #include "third_party/blink/public/mojom/worker/dedicated_worker_host.mojom.h"
 #include "third_party/blink/public/mojom/worker/dedicated_worker_host_factory.mojom.h"
+#include "third_party/blink/public/mojom/worker/subresource_loader_updater.mojom.h"
+
+#if !defined(OS_ANDROID)
+#include "third_party/blink/public/mojom/serial/serial.mojom-forward.h"
+#endif
 
 namespace url {
 class Origin;
@@ -28,6 +37,7 @@ namespace content {
 
 class ServiceWorkerNavigationHandle;
 class ServiceWorkerObjectHost;
+class StoragePartitionImpl;
 
 // Creates a host factory for a dedicated worker. This must be called on the UI
 // thread.
@@ -64,8 +74,23 @@ class DedicatedWorkerHost final
 
   void BindFileSystemManager(
       mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver);
+  void BindVideoDecodePerfHistory(
+      mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver);
   void CreateIdleManager(
       mojo::PendingReceiver<blink::mojom::IdleManager> receiver);
+  void CreatePaymentManager(
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
+  void CreateIDBFactory(
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver);
+  void BindSmsReceiverReceiver(
+      mojo::PendingReceiver<blink::mojom::SmsReceiver> receiver);
+  void CreateWebUsbService(
+      mojo::PendingReceiver<blink::mojom::WebUsbService> receiver);
+
+#if !defined(OS_ANDROID)
+  void BindSerialService(
+      mojo::PendingReceiver<blink::mojom::SerialService> receiver);
+#endif
 
   // service_manager::mojom::InterfaceProvider:
   void GetInterface(const std::string& interface_name,
@@ -115,6 +140,9 @@ class DedicatedWorkerHost final
           controller_service_worker_object_host,
       bool success);
 
+  // Sets up the observer of network service crash.
+  void ObserveNetworkServiceCrash(StoragePartitionImpl* storage_partition_impl);
+
   // Creates a network factory for subresource requests from this worker. The
   // network factory is meant to be passed to the renderer.
   mojo::PendingRemote<network::mojom::URLLoaderFactory>
@@ -122,15 +150,16 @@ class DedicatedWorkerHost final
                                       RenderFrameHostImpl* render_frame_host,
                                       bool* bypass_redirect_checks);
 
-  void CreateWebUsbService(
-      mojo::PendingReceiver<blink::mojom::WebUsbService> receiver);
-
   void CreateWebSocketConnector(
       mojo::PendingReceiver<blink::mojom::WebSocketConnector> receiver);
 
   void CreateNestedDedicatedWorker(
       mojo::PendingReceiver<blink::mojom::DedicatedWorkerHostFactory> receiver);
 
+  // Updates subresource loader factories. This is supposed to be called when
+  // out-of-process Network Service crashes.
+  void UpdateSubresourceLoaderFactories();
+
   // May return a nullptr.
   RenderFrameHostImpl* GetAncestorRenderFrameHost();
 
@@ -167,9 +196,18 @@ class DedicatedWorkerHost final
       &broker_};
   mojo::Receiver<blink::mojom::DedicatedWorkerHost> host_receiver_;
 
+  // Indicates if subresource loaders of this worker support file URLs.
+  bool file_url_support_ = false;
+
   // The liveness state of the dedicated worker in the renderer.
   bool is_frozen_ = false;
 
+  // For observing Network Service connection errors only.
+  network::mojom::URLLoaderFactoryPtr
+      network_service_connection_error_handler_holder_;
+  mojo::Remote<blink::mojom::SubresourceLoaderUpdater>
+      subresource_loader_updater_;
+
   base::WeakPtrFactory<DedicatedWorkerHost> weak_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(DedicatedWorkerHost);
diff --git a/chromium/content/browser/worker_host/shared_worker_host.cc b/chromium/content/browser/worker_host/shared_worker_host.cc
index ee1860efa30..c33f126debd 100644
--- a/chromium/content/browser/worker_host/shared_worker_host.cc
+++ b/chromium/content/browser/worker_host/shared_worker_host.cc
@@ -333,6 +333,15 @@ void SharedWorkerHost::AllowCacheStorage(
           GetRenderFrameIDsForWorker()));
 }
 
+void SharedWorkerHost::BindVideoDecodePerfHistory(
+    mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* worker_process_host = GetProcessHost();
+  if (!worker_process_host)
+    return;
+  worker_process_host->BindVideoDecodePerfHistory(std::move(receiver));
+}
+
 void SharedWorkerHost::CreateAppCacheBackend(
     mojo::PendingReceiver<blink::mojom::AppCacheBackend> receiver) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
@@ -347,6 +356,27 @@ void SharedWorkerHost::CreateAppCacheBackend(
       worker_process_host->GetID(), MSG_ROUTING_NONE, std::move(receiver));
 }
 
+void SharedWorkerHost::CreatePaymentManager(
+    mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* worker_process_host = GetProcessHost();
+  if (!worker_process_host)
+    return;
+  worker_process_host->CreatePaymentManagerForOrigin(
+      url::Origin::Create(instance().url()), std::move(receiver));
+}
+
+void SharedWorkerHost::CreateIDBFactory(
+    mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) {
+  DCHECK_CURRENTLY_ON(BrowserThread::UI);
+  RenderProcessHost* worker_process_host = GetProcessHost();
+  if (!worker_process_host)
+    return;
+  worker_process_host->BindIndexedDB(MSG_ROUTING_NONE,
+                                     url::Origin::Create(instance().url()),
+                                     std::move(receiver));
+}
+
 void SharedWorkerHost::Destruct() {
   // Ask the service to destroy |this| which will terminate the worker.
   service_->DestroyHost(this);
@@ -462,6 +492,10 @@ void SharedWorkerHost::SetServiceWorkerHandle(
   service_worker_handle_ = std::move(service_worker_handle);
 }
 
+bool SharedWorkerHost::HasClients() const {
+  return !clients_.empty();
+}
+
 mojo::Remote<blink::mojom::SharedWorker>
 SharedWorkerHost::TerminateRemoteWorkerForTesting() {
   mojo::Remote<blink::mojom::SharedWorker> worker = std::move(worker_);
diff --git a/chromium/content/browser/worker_host/shared_worker_host.h b/chromium/content/browser/worker_host/shared_worker_host.h
index 1cb5ccfd2c7..33c73934c22 100644
--- a/chromium/content/browser/worker_host/shared_worker_host.h
+++ b/chromium/content/browser/worker_host/shared_worker_host.h
@@ -20,6 +20,7 @@
 #include "content/public/browser/global_routing_id.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/shared_worker_instance.h"
+#include "media/mojo/mojom/video_decode_perf_history.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
@@ -28,6 +29,7 @@
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "third_party/blink/public/mojom/devtools/devtools_agent.mojom.h"
+#include "third_party/blink/public/mojom/payments/payment_app.mojom-forward.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
 #include "third_party/blink/public/mojom/worker/shared_worker.mojom.h"
 #include "third_party/blink/public/mojom/worker/shared_worker_client.mojom.h"
@@ -73,7 +75,7 @@ class CONTENT_EXPORT SharedWorkerHost
   // This method must be called either on the UI thread or before threads start.
   // This callback is run on the UI thread.
   using CreateNetworkFactoryCallback = base::RepeatingCallback<void(
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       int worker_process_id,
       network::mojom::URLLoaderFactoryPtrInfo original_factory)>;
   static void SetNetworkFactoryForSubresourcesForTesting(
@@ -107,8 +109,14 @@ class CONTENT_EXPORT SharedWorkerHost
   void AllowCacheStorage(const GURL& url,
                          base::OnceCallback<void(bool)> callback);
 
+  void BindVideoDecodePerfHistory(
+      mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver);
   void CreateAppCacheBackend(
       mojo::PendingReceiver<blink::mojom::AppCacheBackend> receiver);
+  void CreatePaymentManager(
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver);
+  void CreateIDBFactory(
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver);
 
   // Causes this instance to be deleted, which will terminate the worker. May
   // be done based on a UI action.
@@ -124,6 +132,9 @@ class CONTENT_EXPORT SharedWorkerHost
   void SetServiceWorkerHandle(
       std::unique_ptr<ServiceWorkerNavigationHandle> service_worker_handle);
 
+  // Returns true if this worker is connected to at least one client.
+  bool HasClients() const;
+
   const SharedWorkerInstance& instance() const { return instance_; }
   int worker_process_id() const { return worker_process_id_; }
 
diff --git a/chromium/content/browser/worker_host/shared_worker_host_unittest.cc b/chromium/content/browser/worker_host/shared_worker_host_unittest.cc
index 97a0f1e83cb..c168a85a693 100644
--- a/chromium/content/browser/worker_host/shared_worker_host_unittest.cc
+++ b/chromium/content/browser/worker_host/shared_worker_host_unittest.cc
@@ -112,7 +112,7 @@ class SharedWorkerHostTest : public testing::Test {
     host_receiver =
         provider_info->host_remote.InitWithNewEndpointAndPassReceiver();
     base::WeakPtr<ServiceWorkerProviderHost> service_worker_host =
-        ServiceWorkerProviderHost::PreCreateForWebWorker(
+        ServiceWorkerProviderHost::CreateForWebWorker(
             helper_->context()->AsWeakPtr(), mock_render_process_host_.GetID(),
             blink::mojom::ServiceWorkerProviderType::kForSharedWorker,
             std::move(host_receiver), std::move(client_remote));
diff --git a/chromium/content/browser/worker_host/shared_worker_service_impl.cc b/chromium/content/browser/worker_host/shared_worker_service_impl.cc
index 1c2a28ba62a..fe428808896 100644
--- a/chromium/content/browser/worker_host/shared_worker_service_impl.cc
+++ b/chromium/content/browser/worker_host/shared_worker_service_impl.cc
@@ -17,7 +17,7 @@
 #include "base/macros.h"
 #include "base/task/post_task.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
-#include "content/browser/file_url_loader_factory.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 #include "content/browser/service_worker/service_worker_navigation_handle.h"
 #include "content/browser/storage_partition_impl.h"
 #include "content/browser/url_loader_factory_getter.h"
@@ -32,6 +32,7 @@
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/shared_worker_instance.h"
 #include "content/public/common/bind_interface_helpers.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/content_switches.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -71,7 +72,7 @@ void SharedWorkerServiceImpl::AddObserver(Observer* observer) {
   observers_.AddObserver(observer);
 }
 
-void SharedWorkerServiceImpl::RemoveObserver(const Observer* observer) {
+void SharedWorkerServiceImpl::RemoveObserver(Observer* observer) {
   observers_.RemoveObserver(observer);
 }
 
@@ -117,11 +118,23 @@ void SharedWorkerServiceImpl::ConnectToWorker(
     return;
   }
 
+  // Enforce same-origin policy.
+  // data: URLs are not considered a different origin.
+  url::Origin constructor_origin = render_frame_host->GetLastCommittedOrigin();
+  bool is_cross_origin = !info->url.SchemeIs(url::kDataScheme) &&
+                         url::Origin::Create(info->url) != constructor_origin;
+  if (is_cross_origin &&
+      !GetContentClient()->browser()->DoesSchemeAllowCrossOriginSharedWorker(
+          constructor_origin.scheme())) {
+    ScriptLoadFailed(std::move(client));
+    return;
+  }
+
   RenderFrameHost* main_frame =
       render_frame_host->frame_tree_node()->frame_tree()->GetMainFrame();
   if (!GetContentClient()->browser()->AllowSharedWorker(
-          info->url, main_frame->GetLastCommittedURL(), info->name,
-          render_frame_host->GetLastCommittedOrigin(),
+          info->url, render_frame_host->ComputeSiteForCookies(),
+          main_frame->GetLastCommittedOrigin(), info->name, constructor_origin,
           WebContentsImpl::FromRenderFrameHostID(client_process_id, frame_id)
               ->GetBrowserContext(),
           client_process_id, frame_id)) {
@@ -130,9 +143,9 @@ void SharedWorkerServiceImpl::ConnectToWorker(
   }
 
   SharedWorkerInstance instance(
-      info->url, info->name, render_frame_host->GetLastCommittedOrigin(),
-      info->content_security_policy, info->content_security_policy_type,
-      info->creation_address_space, creation_context_type);
+      info->url, info->name, constructor_origin, info->content_security_policy,
+      info->content_security_policy_type, info->creation_address_space,
+      creation_context_type);
 
   SharedWorkerHost* host = FindMatchingSharedWorkerHost(
       instance.url(), instance.name(), instance.constructor_origin());
@@ -334,6 +347,18 @@ void SharedWorkerServiceImpl::StartWorker(
     return;
   }
 
+  // Also drop this request if |client|'s render frame host no longer exists and
+  // the worker has no other clients. This is possible if the frame was deleted
+  // between the CreateWorker() and DidCreateScriptLoader() calls. This avoids
+  // starting a shared worker and immediately stopping it because its sole
+  // client is already being torn down and avoids sending a OnClientAdded()
+  // notification for a frame that is already destroyed.
+  if (!RenderFrameHost::FromID(client_process_id, frame_id) &&
+      !host->HasClients()) {
+    DestroyHost(host.get());
+    return;
+  }
+
   // Get the factory used to instantiate the new shared worker instance in
   // the target process.
   mojo::PendingRemote<blink::mojom::SharedWorkerFactory> factory;
diff --git a/chromium/content/browser/worker_host/shared_worker_service_impl.h b/chromium/content/browser/worker_host/shared_worker_service_impl.h
index d1f0234cd6e..9234ccc5728 100644
--- a/chromium/content/browser/worker_host/shared_worker_service_impl.h
+++ b/chromium/content/browser/worker_host/shared_worker_service_impl.h
@@ -50,7 +50,7 @@ class CONTENT_EXPORT SharedWorkerServiceImpl : public SharedWorkerService {
 
   // SharedWorkerService implementation.
   void AddObserver(Observer* observer) override;
-  void RemoveObserver(const Observer* observer) override;
+  void RemoveObserver(Observer* observer) override;
   bool TerminateWorker(const GURL& url,
                        const std::string& name,
                        const url::Origin& constructor_origin) override;
diff --git a/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc b/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc
index 43083a7f0d6..05a5fbb1569 100644
--- a/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc
+++ b/chromium/content/browser/worker_host/shared_worker_service_impl_unittest.cc
@@ -289,6 +289,38 @@ TEST_F(SharedWorkerServiceImplTest, BasicTest) {
   base::RunLoop().RunUntilIdle();
 }
 
+// Tests that the shared worker will not be started if the hosting web contents
+// is destroyed while the script is being fetched.
+TEST_F(SharedWorkerServiceImplTest, WebContentsDestroyed) {
+  std::unique_ptr<TestWebContents> web_contents =
+      CreateWebContents(GURL("http://example.com/"));
+  TestRenderFrameHost* render_frame_host = web_contents->GetMainFrame();
+  MockRenderProcessHost* renderer_host = render_frame_host->GetProcess();
+  const int process_id = renderer_host->GetID();
+  renderer_host->OverrideBinderForTesting(
+      blink::mojom::SharedWorkerFactory::Name_,
+      base::BindRepeating(&SharedWorkerServiceImplTest::BindSharedWorkerFactory,
+                          base::Unretained(this), process_id));
+
+  MockSharedWorkerClient client;
+  MessagePortChannel local_port;
+  const GURL kUrl("http://example.com/w.js");
+  ConnectToSharedWorker(MakeSharedWorkerConnector(
+                            renderer_host, render_frame_host->GetRoutingID()),
+                        kUrl, "name", &client, &local_port);
+
+  // Now asynchronously destroy |web_contents| so that the startup sequence at
+  // least reaches SharedWorkerServiceImpl::DidCreateScriptLoader().
+  // reaches at least the DidCreateScriptLoader()
+  base::SequencedTaskRunnerHandle::Get()->DeleteSoon(FROM_HERE,
+                                                     std::move(web_contents));
+
+  base::RunLoop().RunUntilIdle();
+
+  // The shared worker creation request was dropped.
+  EXPECT_TRUE(!client.CheckReceivedOnCreated());
+}
+
 TEST_F(SharedWorkerServiceImplTest, TwoRendererTest) {
   // The first renderer host.
   std::unique_ptr<TestWebContents> web_contents0 =
diff --git a/chromium/content/browser/worker_host/test_shared_worker_service_impl.cc b/chromium/content/browser/worker_host/test_shared_worker_service_impl.cc
index a4a9b9613e3..441d22b7bf8 100644
--- a/chromium/content/browser/worker_host/test_shared_worker_service_impl.cc
+++ b/chromium/content/browser/worker_host/test_shared_worker_service_impl.cc
@@ -82,8 +82,10 @@ void TestSharedWorkerServiceImpl::OnRemoteSharedWorkerConnectionLost(
     mojo::RemoteSetElementId id) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  if (worker_hosts_.empty() && workers_awaiting_disconnection_.empty())
+  if (worker_hosts_.empty() && workers_awaiting_disconnection_.empty() &&
+      terminate_all_workers_callback_) {
     std::move(terminate_all_workers_callback_).Run();
+  }
 }
 
 }  // namespace content
diff --git a/chromium/content/browser/worker_host/worker_browsertest.cc b/chromium/content/browser/worker_host/worker_browsertest.cc
index 1a0abd518b4..68ab191e4f0 100644
--- a/chromium/content/browser/worker_host/worker_browsertest.cc
+++ b/chromium/content/browser/worker_host/worker_browsertest.cc
@@ -88,7 +88,7 @@ class WorkerTest : public ContentBrowserTest {
     const base::string16 fail_title = base::ASCIIToUTF16("FAIL");
     TitleWatcher title_watcher(window->web_contents(), ok_title);
     title_watcher.AlsoWaitForTitle(fail_title);
-    NavigateToURL(window, url);
+    EXPECT_TRUE(NavigateToURL(window, url));
     base::string16 final_title = title_watcher.WaitAndGetTitle();
     EXPECT_EQ(expect_failure ? fail_title : ok_title, final_title);
   }
@@ -252,7 +252,7 @@ IN_PROC_BROWSER_TEST_F(WorkerTest, WebSocketSharedWorker) {
   Shell* window = shell();
   const base::string16 expected_title = base::ASCIIToUTF16("OK");
   TitleWatcher title_watcher(window->web_contents(), expected_title);
-  NavigateToURL(window, url);
+  EXPECT_TRUE(NavigateToURL(window, url));
   base::string16 final_title = title_watcher.WaitAndGetTitle();
   EXPECT_EQ(expected_title, final_title);
 }
@@ -308,7 +308,6 @@ IN_PROC_BROWSER_TEST_F(WorkerTest, VerifyInitiatorSharedWorker) {
       [&](URLLoaderInterceptor::RequestParams* params) {
         auto it = expected_request_urls.find(params->url_request.url);
         if (it != expected_request_urls.end()) {
-          EXPECT_FALSE(params->url_request.top_frame_origin.has_value());
           EXPECT_TRUE(params->url_request.request_initiator.has_value());
           EXPECT_EQ(expected_origin,
                     params->url_request.request_initiator.value());
diff --git a/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc b/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc
index 0fc6a17962c..c43f7ebf36d 100644
--- a/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc
+++ b/chromium/content/browser/worker_host/worker_script_fetch_initiator.cc
@@ -16,9 +16,9 @@
 #include "base/task/post_task.h"
 #include "content/browser/appcache/appcache_navigation_handle.h"
 #include "content/browser/data_url_loader_factory.h"
-#include "content/browser/file_url_loader_factory.h"
 #include "content/browser/fileapi/file_system_url_loader_factory.h"
 #include "content/browser/loader/browser_initiated_resource_request.h"
+#include "content/browser/loader/file_url_loader_factory.h"
 #include "content/browser/navigation_subresource_loader_params.h"
 #include "content/browser/service_worker/service_worker_context_wrapper.h"
 #include "content/browser/service_worker/service_worker_navigation_handle.h"
@@ -37,6 +37,7 @@
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/resource_context.h"
 #include "content/public/browser/shared_cors_origin_access_list.h"
+#include "content/public/common/content_client.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/referrer.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
@@ -98,12 +99,12 @@ void WorkerScriptFetchInitiator::Start(
   // subresource loading.
   std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
       factory_bundle_for_browser = CreateFactoryBundle(
-          worker_process_id, storage_partition, storage_domain,
-          constructor_uses_file_url, filesystem_url_support);
+          LoaderType::kMainResource, worker_process_id, storage_partition,
+          storage_domain, constructor_uses_file_url, filesystem_url_support);
   std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
       subresource_loader_factories = CreateFactoryBundle(
-          worker_process_id, storage_partition, storage_domain,
-          constructor_uses_file_url, filesystem_url_support);
+          LoaderType::kSubResource, worker_process_id, storage_partition,
+          storage_domain, constructor_uses_file_url, filesystem_url_support);
 
   // Create a resource request for initiating worker script fetch from the
   // browser process.
@@ -177,6 +178,7 @@ void WorkerScriptFetchInitiator::Start(
 
 std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
 WorkerScriptFetchInitiator::CreateFactoryBundle(
+    LoaderType loader_type,
     int worker_process_id,
     StoragePartitionImpl* storage_partition,
     const std::string& storage_domain,
@@ -196,10 +198,21 @@ WorkerScriptFetchInitiator::CreateFactoryBundle(
             worker_process_id, RenderFrameHost::kNoFrameTreeNodeId,
             storage_partition->GetFileSystemContext(), storage_domain);
   }
-  GetContentClient()
-      ->browser()
-      ->RegisterNonNetworkSubresourceURLLoaderFactories(
-          worker_process_id, MSG_ROUTING_NONE, &non_network_factories);
+
+  switch (loader_type) {
+    case LoaderType::kMainResource:
+      GetContentClient()
+          ->browser()
+          ->RegisterNonNetworkWorkerMainResourceURLLoaderFactories(
+              storage_partition->browser_context(), &non_network_factories);
+      break;
+    case LoaderType::kSubResource:
+      GetContentClient()
+          ->browser()
+          ->RegisterNonNetworkSubresourceURLLoaderFactories(
+              worker_process_id, MSG_ROUTING_NONE, &non_network_factories);
+      break;
+  }
 
   auto factory_bundle = std::make_unique<blink::URLLoaderFactoryBundleInfo>();
   for (auto& pair : non_network_factories) {
@@ -310,7 +323,6 @@ void WorkerScriptFetchInitiator::CreateScriptLoader(
     // network service after a crash, but it's OK since it's used only for a
     // single request to fetch the worker's main script during startup. If the
     // network service crashes, worker startup should simply fail.
-    network::mojom::URLLoaderFactoryPtr network_factory_ptr;
     auto network_factory =
         storage_partition->GetURLLoaderFactoryForBrowserProcess();
     network_factory->Clone(std::move(default_factory_receiver));
diff --git a/chromium/content/browser/worker_host/worker_script_fetch_initiator.h b/chromium/content/browser/worker_host/worker_script_fetch_initiator.h
index 1d9ff922202..62ab7842f74 100644
--- a/chromium/content/browser/worker_host/worker_script_fetch_initiator.h
+++ b/chromium/content/browser/worker_host/worker_script_fetch_initiator.h
@@ -77,15 +77,19 @@ class WorkerScriptFetchInitiator {
       const std::string& storage_domain,
       CompletionCallback callback);
 
- private:
+  // Used for specifying how URLLoaderFactoryBundle is used.
+  enum class LoaderType { kMainResource, kSubResource };
+
   // Creates a loader factory bundle. Must be called on the UI thread.
   static std::unique_ptr<blink::URLLoaderFactoryBundleInfo> CreateFactoryBundle(
+      LoaderType loader_type,
       int worker_process_id,
       StoragePartitionImpl* storage_partition,
       const std::string& storage_domain,
       bool file_support,
       bool filesystem_url_support);
 
+ private:
   // Adds additional request headers to |resource_request|. Must be called on
   // the UI thread.
   static void AddAdditionalRequestHeaders(
diff --git a/chromium/content/browser/worker_host/worker_script_fetcher.cc b/chromium/content/browser/worker_host/worker_script_fetcher.cc
index b9fd295f65e..18f74402eec 100644
--- a/chromium/content/browser/worker_host/worker_script_fetcher.cc
+++ b/chromium/content/browser/worker_host/worker_script_fetcher.cc
@@ -11,6 +11,7 @@
 #include "content/browser/worker_host/worker_script_loader_factory.h"
 #include "content/common/throttling_url_loader.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/global_request_id.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
diff --git a/chromium/content/browser/worker_host/worker_script_loader.cc b/chromium/content/browser/worker_host/worker_script_loader.cc
index 604c7a86222..db2395f8b45 100644
--- a/chromium/content/browser/worker_host/worker_script_loader.cc
+++ b/chromium/content/browser/worker_host/worker_script_loader.cc
@@ -295,13 +295,15 @@ bool WorkerScriptLoader::MaybeCreateLoaderForResponse(
   DCHECK(default_loader_used_);
   for (auto& interceptor : interceptors_) {
     bool skip_other_interceptors = false;
+    bool will_return_unsafe_redirect = false;
     if (interceptor->MaybeCreateLoaderForResponse(
             resource_request_, response_head, response_body,
             response_url_loader, response_client_request, url_loader,
-            &skip_other_interceptors)) {
+            &skip_other_interceptors, &will_return_unsafe_redirect)) {
       // Both ServiceWorkerRequestHandler and AppCacheRequestHandler don't set
-      // skip_other_interceptors.
+      // skip_other_interceptors nor will_return_unsafe_redirect.
       DCHECK(!skip_other_interceptors);
+      DCHECK(!will_return_unsafe_redirect);
       subresource_loader_params_ =
           interceptor->MaybeCreateSubresourceLoaderParams();
       return true;
diff --git a/chromium/content/browser/worker_host/worker_script_loader_factory.cc b/chromium/content/browser/worker_host/worker_script_loader_factory.cc
index cd7b4d8bdac..56cd2bafb32 100644
--- a/chromium/content/browser/worker_host/worker_script_loader_factory.cc
+++ b/chromium/content/browser/worker_host/worker_script_loader_factory.cc
@@ -68,7 +68,7 @@ void WorkerScriptLoaderFactory::CreateLoaderAndStart(
 }
 
 void WorkerScriptLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
   // This method is required to support synchronous requests, which shared
   // worker script requests are not.
   NOTREACHED();
diff --git a/chromium/content/browser/worker_host/worker_script_loader_factory.h b/chromium/content/browser/worker_host/worker_script_loader_factory.h
index 94a652f7bea..3862b653bd1 100644
--- a/chromium/content/browser/worker_host/worker_script_loader_factory.h
+++ b/chromium/content/browser/worker_host/worker_script_loader_factory.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "content/browser/navigation_subresource_loader_params.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 
 namespace network {
@@ -61,7 +62,8 @@ class CONTENT_EXPORT WorkerScriptLoaderFactory
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
   base::WeakPtr<WorkerScriptLoader> GetScriptLoader() { return script_loader_; }
 
diff --git a/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc b/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc
index f90a93e8644..63e033318a3 100644
--- a/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc
+++ b/chromium/content/browser/worker_host/worker_script_loader_factory_unittest.cc
@@ -13,6 +13,7 @@
 #include "content/browser/service_worker/service_worker_navigation_handle_core.h"
 #include "content/public/test/browser_task_environment.h"
 #include "content/test/fake_network_url_loader_factory.h"
+#include "net/base/network_isolation_key.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
 #include "services/network/test/test_url_loader_client.h"
@@ -65,6 +66,10 @@ class WorkerScriptLoaderFactoryTest : public testing::Test {
     network::mojom::URLLoaderPtr loader;
     network::ResourceRequest resource_request;
     resource_request.url = url;
+    resource_request.trusted_params = network::ResourceRequest::TrustedParams();
+    resource_request.trusted_params->network_isolation_key =
+        net::NetworkIsolationKey(url::Origin::Create(url),
+                                 url::Origin::Create(url));
     resource_request.resource_type =
         static_cast<int>(ResourceType::kSharedWorker);
     factory->CreateLoaderAndStart(
diff --git a/chromium/content/browser/zoom_browsertest.cc b/chromium/content/browser/zoom_browsertest.cc
index 7d776641853..7983ca39df4 100644
--- a/chromium/content/browser/zoom_browsertest.cc
+++ b/chromium/content/browser/zoom_browsertest.cc
@@ -12,7 +12,6 @@
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
-#include "content/public/common/page_zoom.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/content_browser_test.h"
 #include "content/public/test/content_browser_test_utils.h"
@@ -21,6 +20,7 @@
 #include "content/test/content_browser_test_utils_internal.h"
 #include "net/dns/mock_host_resolver.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/common/page/page_zoom.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -244,7 +244,7 @@ IN_PROC_BROWSER_TEST_F(ZoomBrowserTest, ZoomPreservedOnReload) {
     ResizeObserver observer(root->current_frame_host());
 
     const double new_zoom_level =
-        default_zoom_level + ZoomFactorToZoomLevel(new_zoom_factor);
+        default_zoom_level + blink::PageZoomFactorToZoomLevel(new_zoom_factor);
     host_zoom_map->SetZoomLevelForHost(top_level_host, new_zoom_level);
 
     WaitForResize(msg_queue, observer);
@@ -311,7 +311,7 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SubframesZoomProperly) {
                                  scale_one_grandchild_width, kTolerance);
 
     const double new_zoom_level =
-        default_zoom_level + ZoomFactorToZoomLevel(new_zoom_factor);
+        default_zoom_level + blink::PageZoomFactorToZoomLevel(new_zoom_factor);
     host_zoom_map->SetZoomLevelForHost(top_level_host, new_zoom_level);
 
     WaitAndCheckFrameZoom(msg_queue, frame_observers);
@@ -356,7 +356,7 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SubframesDontZoomIndependently) {
 
   const double new_zoom_factor = 2.0;
   const double new_zoom_level =
-      default_zoom_level + ZoomFactorToZoomLevel(new_zoom_factor);
+      default_zoom_level + blink::PageZoomFactorToZoomLevel(new_zoom_factor);
 
   // This should not cause the nested iframe to change its zoom.
   host_zoom_map->SetZoomLevelForHost("b.com", new_zoom_level);
@@ -366,10 +366,6 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SubframesDontZoomIndependently) {
   EXPECT_EQ(scale_one_child_width, GetSubframeWidth(child));
   EXPECT_EQ(scale_one_grandchild_width, GetSubframeWidth(grandchild));
 
-  // We exclude the remainder of this test on Android since Android does not
-  // set page zoom levels for loading pages.
-  // See RenderFrameImpl::SetHostZoomLevel().
-#if !defined(OS_ANDROID)
   // When we navigate so that b.com is the top-level site, then it has the
   // expected zoom.
   GURL new_url = embedded_test_server()->GetURL("b.com", "/title1.html");
@@ -377,7 +373,6 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SubframesDontZoomIndependently) {
   EXPECT_DOUBLE_EQ(
       new_zoom_factor,
       GetMainFrameZoomFactor(web_contents(), main_frame_window_border));
-#endif
 }
 
 IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, AllFramesGetDefaultZoom) {
@@ -420,7 +415,8 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, AllFramesGetDefaultZoom) {
                                  scale_one_grandchild_width, kTolerance);
 
     const double new_default_zoom_level =
-        default_zoom_level + ZoomFactorToZoomLevel(new_default_zoom_factor);
+        default_zoom_level +
+        blink::PageZoomFactorToZoomLevel(new_default_zoom_factor);
 
     host_zoom_map->SetZoomLevelForHost("b.com", new_default_zoom_level + 1.0);
     host_zoom_map->SetDefaultZoomLevel(new_default_zoom_level);
@@ -475,7 +471,7 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SiblingFramesZoom) {
                                  scale_one_child2_width, kTolerance);
 
     const double new_zoom_level =
-        default_zoom_level + ZoomFactorToZoomLevel(new_zoom_factor);
+        default_zoom_level + blink::PageZoomFactorToZoomLevel(new_zoom_factor);
     host_zoom_map->SetZoomLevelForHost(top_level_host, new_zoom_level);
 
     WaitAndCheckFrameZoom(msg_queue, frame_observers);
@@ -524,7 +520,7 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SubframeRetainsZoomOnNavigation) {
                                  scale_one_child_width, kTolerance);
 
     const double new_zoom_level =
-        default_zoom_level + ZoomFactorToZoomLevel(new_zoom_factor);
+        default_zoom_level + blink::PageZoomFactorToZoomLevel(new_zoom_factor);
     host_zoom_map->SetZoomLevelForHost(top_level_host, new_zoom_level);
 
     WaitAndCheckFrameZoom(msg_queue, frame_observers);
@@ -553,7 +549,6 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest, SubframeRetainsZoomOnNavigation) {
 }
 
 // http://crbug.com/609213
-#if !defined(OS_ANDROID)
 IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest,
                        RedirectToPageWithSubframeZoomsCorrectly) {
   std::string initial_host("a.com");
@@ -568,7 +563,8 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest,
   const double kZoomFactorForRedirectedHost = 1.5;
   HostZoomMap* host_zoom_map = HostZoomMap::GetForWebContents(web_contents());
   host_zoom_map->SetZoomLevelForHost(
-      redirected_host, ZoomFactorToZoomLevel(kZoomFactorForRedirectedHost));
+      redirected_host,
+      blink::PageZoomFactorToZoomLevel(kZoomFactorForRedirectedHost));
 
   // Navigation to a.com doesn't change the zoom level, but when it redirects
   // to b.com, and then a subframe loads, the zoom should change.
@@ -585,15 +581,10 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest,
               GetMainFrameZoomFactor(web_contents(), main_frame_window_border),
               0.01);
 }
-#endif
 
 // Tests that on cross-site navigation from a page that has a subframe, the
 // appropriate zoom is applied to the new page.
 // crbug.com/673065
-// Note: We exclude the this test on Android since Android does not set page
-// zoom levels for loading pages.
-// See RenderFrameImpl::SetHostZoomLevel().
-#if !defined(OS_ANDROID)
 IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest,
                        SubframesDontBreakConnectionToRenderer) {
   std::string top_level_host("a.com");
@@ -618,7 +609,7 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest,
   // Set a zoom for a host that will be navigated to below.
   const double new_zoom_factor = 2.0;
   const double new_zoom_level =
-      default_zoom_level + ZoomFactorToZoomLevel(new_zoom_factor);
+      default_zoom_level + blink::PageZoomFactorToZoomLevel(new_zoom_factor);
   host_zoom_map->SetZoomLevelForHost("foo.com", new_zoom_level);
 
   // Navigate forward in the same RFH to a site with that host via a
@@ -652,6 +643,5 @@ IN_PROC_BROWSER_TEST_F(IFrameZoomBrowserTest,
       GetMainFrameZoomFactor(web_contents(), main_frame_window_border),
       .1);
 }
-#endif
 
 }  // namespace content
diff --git a/chromium/content/child/BUILD.gn b/chromium/content/child/BUILD.gn
index b9b101ce383..04e20553e44 100644
--- a/chromium/content/child/BUILD.gn
+++ b/chromium/content/child/BUILD.gn
@@ -72,8 +72,11 @@ target(link_target_type, "child") {
     "thread_safe_sender.h",
     "webthemeengine_impl_android.cc",
     "webthemeengine_impl_android.h",
+    "webthemeengine_impl_conversions.cc",
+    "webthemeengine_impl_conversions.h",
     "webthemeengine_impl_default.cc",
     "webthemeengine_impl_default.h",
+    "webthemeengine_impl_mac.cc",
     "webthemeengine_impl_mac.h",
   ]
 
@@ -96,7 +99,6 @@ target(link_target_type, "child") {
     "//components/variations",
     "//components/webcrypto",
     "//content/app/resources",
-    "//content/app/strings",
     "//content/common",
     "//content/public/common:common_sources",
     "//crypto:platform",
@@ -119,6 +121,7 @@ target(link_target_type, "child") {
     "//third_party/blink/public:resources",
     "//third_party/blink/public:scaled_resources",
     "//third_party/blink/public/common",
+    "//third_party/blink/public/strings",
     "//third_party/ced",
     "//third_party/zlib/google:compression_utils",
     "//ui/base",
@@ -134,9 +137,6 @@ target(link_target_type, "child") {
 
   if (is_android) {
     deps += [ "//third_party/android_ndk:cpu_features" ]
-    if (notouch_build) {
-      configs += [ ":notouch_config" ]
-    }
     sources -= [
       "webthemeengine_impl_default.cc",
       "webthemeengine_impl_default.h",
@@ -173,10 +173,6 @@ target(link_target_type, "child") {
   ]
 }
 
-config("notouch_config") {
-  defines = [ "ENABLE_TOUCHLESS_UASTYLE_THEME" ]
-}
-
 # See comment at the top of //content/BUILD.gn for how this works.
 group("for_content_tests") {
   visibility = [ "//content/test/*" ]
diff --git a/chromium/content/child/blink_platform_impl.cc b/chromium/content/child/blink_platform_impl.cc
index a82b3db6e37..a1b85791ddb 100644
--- a/chromium/content/child/blink_platform_impl.cc
+++ b/chromium/content/child/blink_platform_impl.cc
@@ -31,7 +31,6 @@
 #include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "content/app/resources/grit/content_resources.h"
-#include "content/app/strings/grit/content_strings.h"
 #include "content/child/child_thread_impl.h"
 #include "content/common/appcache_interfaces.h"
 #include "content/common/child_process.mojom.h"
@@ -50,6 +49,7 @@
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/resources/grit/blink_image_resources.h"
 #include "third_party/blink/public/resources/grit/blink_resources.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "third_party/zlib/google/compression_utils.h"
 #include "ui/base/layout.h"
 #include "ui/base/ui_base_features.h"
@@ -66,7 +66,6 @@
 #endif
 
 using blink::WebData;
-using blink::WebLocalizedString;
 using blink::WebString;
 using blink::WebThemeEngine;
 using blink::WebURL;
@@ -88,270 +87,6 @@ std::unique_ptr<blink::WebThemeEngine> GetWebThemeEngine() {
 #endif
 }
 
-int ToMessageID(int resource_id) {
-  switch (resource_id) {
-    case WebLocalizedString::kAXAMPMFieldText:
-      return IDS_AX_AM_PM_FIELD_TEXT;
-    case WebLocalizedString::kAXCalendarShowDatePicker:
-      return IDS_AX_CALENDAR_SHOW_DATE_PICKER;
-    case WebLocalizedString::kAXCalendarShowMonthSelector:
-      return IDS_AX_CALENDAR_SHOW_MONTH_SELECTOR;
-    case WebLocalizedString::kAXCalendarShowNextMonth:
-      return IDS_AX_CALENDAR_SHOW_NEXT_MONTH;
-    case WebLocalizedString::kAXCalendarShowPreviousMonth:
-      return IDS_AX_CALENDAR_SHOW_PREVIOUS_MONTH;
-    case WebLocalizedString::kAXCalendarWeekDescription:
-      return IDS_AX_CALENDAR_WEEK_DESCRIPTION;
-    case WebLocalizedString::kAXDayOfMonthFieldText:
-      return IDS_AX_DAY_OF_MONTH_FIELD_TEXT;
-    case WebLocalizedString::kAXHourFieldText:
-      return IDS_AX_HOUR_FIELD_TEXT;
-    case WebLocalizedString::kAXMediaDefault:
-      return IDS_AX_MEDIA_DEFAULT;
-    case WebLocalizedString::kAXMediaAudioElement:
-      return IDS_AX_MEDIA_AUDIO_ELEMENT;
-    case WebLocalizedString::kAXMediaVideoElement:
-      return IDS_AX_MEDIA_VIDEO_ELEMENT;
-    case WebLocalizedString::kAXMediaMuteButton:
-      return IDS_AX_MEDIA_MUTE_BUTTON;
-    case WebLocalizedString::kAXMediaUnMuteButton:
-      return IDS_AX_MEDIA_UNMUTE_BUTTON;
-    case WebLocalizedString::kAXMediaPlayButton:
-      return IDS_AX_MEDIA_PLAY_BUTTON;
-    case WebLocalizedString::kAXMediaPauseButton:
-      return IDS_AX_MEDIA_PAUSE_BUTTON;
-    case WebLocalizedString::kAXMediaCurrentTimeDisplay:
-      return IDS_AX_MEDIA_CURRENT_TIME_DISPLAY;
-    case WebLocalizedString::kAXMediaTimeRemainingDisplay:
-      return IDS_AX_MEDIA_TIME_REMAINING_DISPLAY;
-    case WebLocalizedString::kAXMediaEnterFullscreenButton:
-      return IDS_AX_MEDIA_ENTER_FULL_SCREEN_BUTTON;
-    case WebLocalizedString::kAXMediaExitFullscreenButton:
-      return IDS_AX_MEDIA_EXIT_FULL_SCREEN_BUTTON;
-    case WebLocalizedString::kAXMediaDisplayCutoutFullscreenButton:
-      return IDS_AX_MEDIA_DISPLAY_CUT_OUT_FULL_SCREEN_BUTTON;
-    case WebLocalizedString::kAXMediaEnterPictureInPictureButton:
-      return IDS_AX_MEDIA_ENTER_PICTURE_IN_PICTURE_BUTTON;
-    case WebLocalizedString::kAXMediaExitPictureInPictureButton:
-      return IDS_AX_MEDIA_EXIT_PICTURE_IN_PICTURE_BUTTON;
-    case WebLocalizedString::kAXMediaShowClosedCaptionsMenuButton:
-      return IDS_AX_MEDIA_SHOW_CLOSED_CAPTIONS_MENU_BUTTON;
-    case WebLocalizedString::kAXMediaHideClosedCaptionsMenuButton:
-      return IDS_AX_MEDIA_HIDE_CLOSED_CAPTIONS_MENU_BUTTON;
-    case WebLocalizedString::kAXMediaLoadingPanel:
-      return IDS_AX_MEDIA_LOADING_PANEL;
-    case WebLocalizedString::kAXMediaCastOffButton:
-      return IDS_AX_MEDIA_CAST_OFF_BUTTON;
-    case WebLocalizedString::kAXMediaCastOnButton:
-      return IDS_AX_MEDIA_CAST_ON_BUTTON;
-    case WebLocalizedString::kAXMediaDownloadButton:
-      return IDS_AX_MEDIA_DOWNLOAD_BUTTON;
-    case WebLocalizedString::kAXMediaOverflowButton:
-      return IDS_AX_MEDIA_OVERFLOW_BUTTON;
-    case WebLocalizedString::kAXMediaAudioElementHelp:
-      return IDS_AX_MEDIA_AUDIO_ELEMENT_HELP;
-    case WebLocalizedString::kAXMediaVideoElementHelp:
-      return IDS_AX_MEDIA_VIDEO_ELEMENT_HELP;
-    case WebLocalizedString::kAXMediaAudioSliderHelp:
-      return IDS_AX_MEDIA_AUDIO_SLIDER_HELP;
-    case WebLocalizedString::kAXMediaVideoSliderHelp:
-      return IDS_AX_MEDIA_VIDEO_SLIDER_HELP;
-    case WebLocalizedString::kAXMediaVolumeSliderHelp:
-      return IDS_AX_MEDIA_VOLUME_SLIDER_HELP;
-    case WebLocalizedString::kAXMediaCurrentTimeDisplayHelp:
-      return IDS_AX_MEDIA_CURRENT_TIME_DISPLAY_HELP;
-    case WebLocalizedString::kAXMediaTimeRemainingDisplayHelp:
-      return IDS_AX_MEDIA_TIME_REMAINING_DISPLAY_HELP;
-    case WebLocalizedString::kAXMediaOverflowButtonHelp:
-      return IDS_AX_MEDIA_OVERFLOW_BUTTON_HELP;
-    case WebLocalizedString::kAXMediaTouchLessPlayPauseAction:
-      return IDS_AX_MEDIA_TOUCHLESS_PLAY_PAUSE_ACTION;
-    case WebLocalizedString::kAXMediaTouchLessSeekAction:
-      return IDS_AX_MEDIA_TOUCHLESS_SEEK_ACTION;
-    case WebLocalizedString::kAXMediaTouchLessVolumeAction:
-      return IDS_AX_MEDIA_TOUCHLESS_VOLUME_ACTION;
-    case WebLocalizedString::kAXMillisecondFieldText:
-      return IDS_AX_MILLISECOND_FIELD_TEXT;
-    case WebLocalizedString::kAXMinuteFieldText:
-      return IDS_AX_MINUTE_FIELD_TEXT;
-    case WebLocalizedString::kAXMonthFieldText:
-      return IDS_AX_MONTH_FIELD_TEXT;
-    case WebLocalizedString::kAXSecondFieldText:
-      return IDS_AX_SECOND_FIELD_TEXT;
-    case WebLocalizedString::kAXWeekOfYearFieldText:
-      return IDS_AX_WEEK_OF_YEAR_FIELD_TEXT;
-    case WebLocalizedString::kAXYearFieldText:
-      return IDS_AX_YEAR_FIELD_TEXT;
-    case WebLocalizedString::kCalendarClear:
-      return IDS_FORM_CALENDAR_CLEAR;
-    case WebLocalizedString::kCalendarToday:
-      return IDS_FORM_CALENDAR_TODAY;
-    case WebLocalizedString::kDetailsLabel:
-      return IDS_DETAILS_WITHOUT_SUMMARY_LABEL;
-    case WebLocalizedString::kFileButtonChooseFileLabel:
-      return IDS_FORM_FILE_BUTTON_LABEL;
-    case WebLocalizedString::kFileButtonChooseMultipleFilesLabel:
-      return IDS_FORM_MULTIPLE_FILES_BUTTON_LABEL;
-    case WebLocalizedString::kFileButtonNoFileSelectedLabel:
-      return IDS_FORM_FILE_NO_FILE_LABEL;
-    case WebLocalizedString::kInputElementAltText:
-      return IDS_FORM_INPUT_ALT;
-    case WebLocalizedString::kMissingPluginText:
-      return IDS_PLUGIN_INITIALIZATION_ERROR;
-    case WebLocalizedString::kAXMediaPlaybackError:
-      return IDS_MEDIA_PLAYBACK_ERROR;
-    case WebLocalizedString::kMediaRemotingCastText:
-      return IDS_MEDIA_REMOTING_CAST_TEXT;
-    case WebLocalizedString::kMediaRemotingCastToUnknownDeviceText:
-      return IDS_MEDIA_REMOTING_CAST_TO_UNKNOWN_DEVICE_TEXT;
-    case WebLocalizedString::kMediaRemotingStopByErrorText:
-      return IDS_MEDIA_REMOTING_STOP_BY_ERROR_TEXT;
-    case WebLocalizedString::kMediaRemotingStopByPlaybackQualityText:
-      return IDS_MEDIA_REMOTING_STOP_BY_PLAYBACK_QUALITY_TEXT;
-    case WebLocalizedString::kMediaRemotingStopNoText:
-      return -1;  // This string name is used only to indicate an empty string.
-    case WebLocalizedString::kMediaRemotingStopText:
-      return IDS_MEDIA_REMOTING_STOP_TEXT;
-    case WebLocalizedString::kMediaScrubbingMessageText:
-      return IDS_MEDIA_SCRUBBING_MESSAGE_TEXT;
-    case WebLocalizedString::kMultipleFileUploadText:
-      return IDS_FORM_FILE_MULTIPLE_UPLOAD;
-    case WebLocalizedString::kOtherColorLabel:
-      return IDS_FORM_OTHER_COLOR_LABEL;
-    case WebLocalizedString::kOtherDateLabel:
-      return IDS_FORM_OTHER_DATE_LABEL;
-    case WebLocalizedString::kOtherMonthLabel:
-      return IDS_FORM_OTHER_MONTH_LABEL;
-    case WebLocalizedString::kOtherWeekLabel:
-      return IDS_FORM_OTHER_WEEK_LABEL;
-    case WebLocalizedString::kOverflowMenuCaptions:
-      return IDS_MEDIA_OVERFLOW_MENU_CLOSED_CAPTIONS;
-    case WebLocalizedString::kOverflowMenuCaptionsSubmenuTitle:
-      return IDS_MEDIA_OVERFLOW_MENU_CLOSED_CAPTIONS_SUBMENU_TITLE;
-    case WebLocalizedString::kOverflowMenuCast:
-      return IDS_MEDIA_OVERFLOW_MENU_CAST;
-    case WebLocalizedString::kOverflowMenuEnterFullscreen:
-      return IDS_MEDIA_OVERFLOW_MENU_ENTER_FULLSCREEN;
-    case WebLocalizedString::kOverflowMenuExitFullscreen:
-      return IDS_MEDIA_OVERFLOW_MENU_EXIT_FULLSCREEN;
-    case WebLocalizedString::kOverflowMenuMute:
-      return IDS_MEDIA_OVERFLOW_MENU_MUTE;
-    case WebLocalizedString::kOverflowMenuUnmute:
-      return IDS_MEDIA_OVERFLOW_MENU_UNMUTE;
-    case WebLocalizedString::kOverflowMenuPlay:
-      return IDS_MEDIA_OVERFLOW_MENU_PLAY;
-    case WebLocalizedString::kOverflowMenuPause:
-      return IDS_MEDIA_OVERFLOW_MENU_PAUSE;
-    case WebLocalizedString::kOverflowMenuDownload:
-      return IDS_MEDIA_OVERFLOW_MENU_DOWNLOAD;
-    case WebLocalizedString::kOverflowMenuEnterPictureInPicture:
-      return IDS_MEDIA_OVERFLOW_MENU_ENTER_PICTURE_IN_PICTURE;
-    case WebLocalizedString::kOverflowMenuExitPictureInPicture:
-      return IDS_MEDIA_OVERFLOW_MENU_EXIT_PICTURE_IN_PICTURE;
-    case WebLocalizedString::kPictureInPictureInterstitialText:
-      return IDS_MEDIA_PICTURE_IN_PICTURE_INTERSTITIAL_TEXT;
-    case WebLocalizedString::kPlaceholderForDayOfMonthField:
-      return IDS_FORM_PLACEHOLDER_FOR_DAY_OF_MONTH_FIELD;
-    case WebLocalizedString::kPlaceholderForMonthField:
-      return IDS_FORM_PLACEHOLDER_FOR_MONTH_FIELD;
-    case WebLocalizedString::kPlaceholderForYearField:
-      return IDS_FORM_PLACEHOLDER_FOR_YEAR_FIELD;
-    case WebLocalizedString::kResetButtonDefaultLabel:
-      return IDS_FORM_RESET_LABEL;
-    case WebLocalizedString::kSelectMenuListText:
-      return IDS_FORM_SELECT_MENU_LIST_TEXT;
-    case WebLocalizedString::kSubmitButtonDefaultLabel:
-      return IDS_FORM_SUBMIT_LABEL;
-    case WebLocalizedString::kThisMonthButtonLabel:
-      return IDS_FORM_THIS_MONTH_LABEL;
-    case WebLocalizedString::kThisWeekButtonLabel:
-      return IDS_FORM_THIS_WEEK_LABEL;
-    case WebLocalizedString::kValidationBadInputForDateTime:
-      return IDS_FORM_VALIDATION_BAD_INPUT_DATETIME;
-    case WebLocalizedString::kValidationBadInputForNumber:
-      return IDS_FORM_VALIDATION_BAD_INPUT_NUMBER;
-    case WebLocalizedString::kValidationPatternMismatch:
-      return IDS_FORM_VALIDATION_PATTERN_MISMATCH;
-    case WebLocalizedString::kValidationRangeOverflow:
-      return IDS_FORM_VALIDATION_RANGE_OVERFLOW;
-    case WebLocalizedString::kValidationRangeOverflowDateTime:
-      return IDS_FORM_VALIDATION_RANGE_OVERFLOW_DATETIME;
-    case WebLocalizedString::kValidationRangeUnderflow:
-      return IDS_FORM_VALIDATION_RANGE_UNDERFLOW;
-    case WebLocalizedString::kValidationRangeUnderflowDateTime:
-      return IDS_FORM_VALIDATION_RANGE_UNDERFLOW_DATETIME;
-    case WebLocalizedString::kValidationStepMismatch:
-      return IDS_FORM_VALIDATION_STEP_MISMATCH;
-    case WebLocalizedString::kValidationStepMismatchCloseToLimit:
-      return IDS_FORM_VALIDATION_STEP_MISMATCH_CLOSE_TO_LIMIT;
-    case WebLocalizedString::kValidationTooLong:
-      return IDS_FORM_VALIDATION_TOO_LONG;
-    case WebLocalizedString::kValidationTooShort:
-      return IDS_FORM_VALIDATION_TOO_SHORT;
-    case WebLocalizedString::kValidationTooShortPlural:
-      return IDS_FORM_VALIDATION_TOO_SHORT_PLURAL;
-    case WebLocalizedString::kValidationTypeMismatch:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH;
-    case WebLocalizedString::kValidationTypeMismatchForEmail:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL;
-    case WebLocalizedString::kValidationTypeMismatchForEmailEmpty:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_EMPTY;
-    case WebLocalizedString::kValidationTypeMismatchForEmailEmptyDomain:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_EMPTY_DOMAIN;
-    case WebLocalizedString::kValidationTypeMismatchForEmailEmptyLocal:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_EMPTY_LOCAL;
-    case WebLocalizedString::kValidationTypeMismatchForEmailInvalidDomain:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_INVALID_DOMAIN;
-    case WebLocalizedString::kValidationTypeMismatchForEmailInvalidDots:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_INVALID_DOTS;
-    case WebLocalizedString::kValidationTypeMismatchForEmailInvalidLocal:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_INVALID_LOCAL;
-    case WebLocalizedString::kValidationTypeMismatchForEmailNoAtSign:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_EMAIL_NO_AT_SIGN;
-    case WebLocalizedString::kValidationTypeMismatchForMultipleEmail:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_MULTIPLE_EMAIL;
-    case WebLocalizedString::kValidationTypeMismatchForURL:
-      return IDS_FORM_VALIDATION_TYPE_MISMATCH_URL;
-    case WebLocalizedString::kValidationValueMissing:
-      return IDS_FORM_VALIDATION_VALUE_MISSING;
-    case WebLocalizedString::kValidationValueMissingForCheckbox:
-      return IDS_FORM_VALIDATION_VALUE_MISSING_CHECKBOX;
-    case WebLocalizedString::kValidationValueMissingForFile:
-      return IDS_FORM_VALIDATION_VALUE_MISSING_FILE;
-    case WebLocalizedString::kValidationValueMissingForMultipleFile:
-      return IDS_FORM_VALIDATION_VALUE_MISSING_MULTIPLE_FILE;
-    case WebLocalizedString::kValidationValueMissingForRadio:
-      return IDS_FORM_VALIDATION_VALUE_MISSING_RADIO;
-    case WebLocalizedString::kValidationValueMissingForSelect:
-      return IDS_FORM_VALIDATION_VALUE_MISSING_SELECT;
-    case WebLocalizedString::kWeekFormatTemplate:
-      return IDS_FORM_INPUT_WEEK_TEMPLATE;
-    case WebLocalizedString::kWeekNumberLabel:
-      return IDS_FORM_WEEK_NUMBER_LABEL;
-    case WebLocalizedString::kTextTracksNoLabel:
-      return IDS_MEDIA_TRACKS_NO_LABEL;
-    case WebLocalizedString::kTextTracksOff:
-      return IDS_MEDIA_TRACKS_OFF;
-    case WebLocalizedString::kUnitsKibibytes:
-      return IDS_UNITS_KIBIBYTES;
-    case WebLocalizedString::kUnitsMebibytes:
-      return IDS_UNITS_MEBIBYTES;
-    case WebLocalizedString::kUnitsGibibytes:
-      return IDS_UNITS_GIBIBYTES;
-    case WebLocalizedString::kUnitsTebibytes:
-      return IDS_UNITS_TEBIBYTES;
-    case WebLocalizedString::kUnitsPebibytes:
-      return IDS_UNITS_PEBIBYTES;
-    // This "default:" line exists to avoid compile warnings about enum
-    // coverage when we add a new symbol to WebLocalizedString.h in WebKit.
-    // After a planned WebKit patch is landed, we need to add a case statement
-    // for the added symbol here.
-    default:
-      break;
-  }
-  return -1;
-}
-
 // This must match third_party/WebKit/public/blink_resources.grd.
 // In particular, |is_gzipped| corresponds to compress="gzip".
 struct DataResource {
@@ -463,28 +198,26 @@ WebData BlinkPlatformImpl::UncompressDataResource(int resource_id) {
 }
 
 WebString BlinkPlatformImpl::QueryLocalizedString(int resource_id) {
-  int message_id = ToMessageID(resource_id);
-  if (message_id < 0)
+  if (resource_id < 0)
     return WebString();
   return WebString::FromUTF16(
-      GetContentClient()->GetLocalizedString(message_id));
+      GetContentClient()->GetLocalizedString(resource_id));
 }
 
 WebString BlinkPlatformImpl::QueryLocalizedString(int resource_id,
                                                   const WebString& value) {
-  int message_id = ToMessageID(resource_id);
-  if (message_id < 0)
+  if (resource_id < 0)
     return WebString();
 
   base::string16 format_string =
-      GetContentClient()->GetLocalizedString(message_id);
+      GetContentClient()->GetLocalizedString(resource_id);
 
   // If the ContentClient returned an empty string, e.g. because it's using the
   // default implementation of ContentClient::GetLocalizedString, return an
   // empty string instead of crashing with a failed DCHECK in
   // base::ReplaceStringPlaceholders below. This is useful for tests that don't
   // specialize a full ContentClient, since this way they can behave as though
-  // there isn't a defined |message_id| for the |name| instead of crashing
+  // there isn't a defined |resource_id| for the |name| instead of crashing
   // outright.
   if (format_string.empty())
     return WebString();
@@ -496,15 +229,14 @@ WebString BlinkPlatformImpl::QueryLocalizedString(int resource_id,
 WebString BlinkPlatformImpl::QueryLocalizedString(int resource_id,
                                                   const WebString& value1,
                                                   const WebString& value2) {
-  int message_id = ToMessageID(resource_id);
-  if (message_id < 0)
+  if (resource_id < 0)
     return WebString();
   std::vector<base::string16> values;
   values.reserve(2);
   values.push_back(value1.Utf16());
   values.push_back(value2.Utf16());
   return WebString::FromUTF16(base::ReplaceStringPlaceholders(
-      GetContentClient()->GetLocalizedString(message_id), values, nullptr));
+      GetContentClient()->GetLocalizedString(resource_id), values, nullptr));
 }
 
 bool BlinkPlatformImpl::AllowScriptExtensionForServiceWorker(
diff --git a/chromium/content/child/child_histogram_fetcher_impl.cc b/chromium/content/child/child_histogram_fetcher_impl.cc
index f881a6a66e4..feff7fb3b8a 100644
--- a/chromium/content/child/child_histogram_fetcher_impl.cc
+++ b/chromium/content/child/child_histogram_fetcher_impl.cc
@@ -14,7 +14,7 @@
 #include "base/single_thread_task_runner.h"
 #include "content/child/child_process.h"
 #include "ipc/ipc_sender.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 
 namespace content {
@@ -24,14 +24,16 @@ ChildHistogramFetcherFactoryImpl::ChildHistogramFetcherFactoryImpl() {}
 ChildHistogramFetcherFactoryImpl::~ChildHistogramFetcherFactoryImpl() {}
 
 void ChildHistogramFetcherFactoryImpl::Create(
-    content::mojom::ChildHistogramFetcherFactoryRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<ChildHistogramFetcherFactoryImpl>(),
-                          std::move(request));
+    mojo::PendingReceiver<content::mojom::ChildHistogramFetcherFactory>
+        receiver) {
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<ChildHistogramFetcherFactoryImpl>(),
+      std::move(receiver));
 }
 
 void ChildHistogramFetcherFactoryImpl::CreateFetcher(
     base::WritableSharedMemoryRegion shared_memory,
-    content::mojom::ChildHistogramFetcherRequest request) {
+    mojo::PendingReceiver<content::mojom::ChildHistogramFetcher> receiver) {
   if (shared_memory.IsValid()) {
     // This message must be received only once. Multiple calls to create a
     // global allocator will cause a CHECK() failure.
@@ -43,9 +45,8 @@ void ChildHistogramFetcherFactoryImpl::CreateFetcher(
   if (global_allocator)
     global_allocator->CreateTrackingHistograms(global_allocator->Name());
 
-  content::mojom::ChildHistogramFetcherPtr child_histogram_interface;
-  mojo::MakeStrongBinding(std::make_unique<ChildHistogramFetcherImpl>(),
-                          std::move(request));
+  mojo::MakeSelfOwnedReceiver(std::make_unique<ChildHistogramFetcherImpl>(),
+                              std::move(receiver));
 }
 
 ChildHistogramFetcherImpl::ChildHistogramFetcherImpl() {}
diff --git a/chromium/content/child/child_histogram_fetcher_impl.h b/chromium/content/child/child_histogram_fetcher_impl.h
index 68860d943fd..2327b9e21bc 100644
--- a/chromium/content/child/child_histogram_fetcher_impl.h
+++ b/chromium/content/child/child_histogram_fetcher_impl.h
@@ -13,6 +13,7 @@
 #include "base/memory/writable_shared_memory_region.h"
 #include "content/common/histogram_fetcher.mojom.h"
 #include "ipc/message_filter.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace base {
 class HistogramDeltaSerialization;
@@ -26,11 +27,13 @@ class ChildHistogramFetcherFactoryImpl
   ChildHistogramFetcherFactoryImpl();
   ~ChildHistogramFetcherFactoryImpl() override;
 
-  static void Create(content::mojom::ChildHistogramFetcherFactoryRequest);
+  static void Create(
+      mojo::PendingReceiver<content::mojom::ChildHistogramFetcherFactory>);
 
  private:
-  void CreateFetcher(base::WritableSharedMemoryRegion,
-                     content::mojom::ChildHistogramFetcherRequest) override;
+  void CreateFetcher(
+      base::WritableSharedMemoryRegion,
+      mojo::PendingReceiver<content::mojom::ChildHistogramFetcher>) override;
 };
 
 class ChildHistogramFetcherImpl : public content::mojom::ChildHistogramFetcher {
diff --git a/chromium/content/child/child_process_sandbox_support_impl_linux.cc b/chromium/content/child/child_process_sandbox_support_impl_linux.cc
index 0a57543eb51..712e4287bf5 100644
--- a/chromium/content/child/child_process_sandbox_support_impl_linux.cc
+++ b/chromium/content/child/child_process_sandbox_support_impl_linux.cc
@@ -47,10 +47,8 @@ void WebSandboxSupportLinux::GetFallbackFontForCharacter(
   std::string family_name;
   if (!font_loader_->FallbackFontForCharacter(character, preferred_locale,
                                               &font_identity, &family_name,
-                                              &is_bold, &is_italic)) {
-    LOG(ERROR) << "FontService fallback request does not receive a response.";
+                                              &is_bold, &is_italic))
     return;
-  }
 
   // TODO(drott): Perhaps take OutOfProcessFont out of the picture here and pass
   // mojo FontIdentityPtr directly?
diff --git a/chromium/content/child/child_process_sandbox_support_impl_mac.cc b/chromium/content/child/child_process_sandbox_support_impl_mac.cc
index bb5559dea58..c2d3a526ca0 100644
--- a/chromium/content/child/child_process_sandbox_support_impl_mac.cc
+++ b/chromium/content/child/child_process_sandbox_support_impl_mac.cc
@@ -19,12 +19,12 @@
 
 namespace content {
 
-WebSandboxSupportMac::WebSandboxSupportMac(
-    service_manager::Connector* connector) {
-  connector->BindInterface(content::mojom::kSystemServiceName,
-                           mojo::MakeRequest(&sandbox_support_));
-  sandbox_support_->GetSystemColors(base::BindOnce(
-      &WebSandboxSupportMac::OnGotSystemColors, base::Unretained(this)));
+WebSandboxSupportMac::WebSandboxSupportMac() {
+  if (auto* thread = ChildThread::Get()) {
+    thread->BindHostReceiver(sandbox_support_.BindNewPipeAndPassReceiver());
+    sandbox_support_->GetSystemColors(base::BindOnce(
+        &WebSandboxSupportMac::OnGotSystemColors, base::Unretained(this)));
+  }
 }
 
 WebSandboxSupportMac::~WebSandboxSupportMac() = default;
@@ -32,6 +32,8 @@ WebSandboxSupportMac::~WebSandboxSupportMac() = default;
 bool WebSandboxSupportMac::LoadFont(CTFontRef font,
                                     CGFontRef* out,
                                     uint32_t* font_id) {
+  if (!sandbox_support_)
+    return false;
   base::ScopedCFTypeRef<CFStringRef> name_ref(CTFontCopyPostScriptName(font));
   base::string16 font_name = SysCFStringRefToUTF16(name_ref);
   float font_point_size = CTFontGetSize(font);
diff --git a/chromium/content/child/child_process_sandbox_support_impl_mac.h b/chromium/content/child/child_process_sandbox_support_impl_mac.h
index b6f8e5b0070..2cfb0a4c8c1 100644
--- a/chromium/content/child/child_process_sandbox_support_impl_mac.h
+++ b/chromium/content/child/child_process_sandbox_support_impl_mac.h
@@ -10,12 +10,9 @@
 #include "base/memory/read_only_shared_memory_region.h"
 #include "base/memory/shared_memory_mapping.h"
 #include "content/common/sandbox_support_mac.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/platform/mac/web_sandbox_support.h"
 
-namespace service_manager {
-class Connector;
-}
-
 namespace content {
 
 // Implementation of the interface used by Blink to upcall to the privileged
@@ -23,7 +20,7 @@ namespace content {
 // the sandbox.
 class WebSandboxSupportMac : public blink::WebSandboxSupport {
  public:
-  explicit WebSandboxSupportMac(service_manager::Connector* connector);
+  WebSandboxSupportMac();
   ~WebSandboxSupportMac() override;
 
   // blink::WebSandboxSupport:
@@ -33,7 +30,7 @@ class WebSandboxSupportMac : public blink::WebSandboxSupport {
  private:
   void OnGotSystemColors(base::ReadOnlySharedMemoryRegion region);
 
-  mojom::SandboxSupportMacPtr sandbox_support_;
+  mojo::Remote<mojom::SandboxSupportMac> sandbox_support_;
   base::ReadOnlySharedMemoryMapping color_map_;
 
   DISALLOW_COPY_AND_ASSIGN(WebSandboxSupportMac);
diff --git a/chromium/content/child/child_thread_impl.cc b/chromium/content/child/child_thread_impl.cc
index be70e3414a1..979ccf1194f 100644
--- a/chromium/content/child/child_thread_impl.cc
+++ b/chromium/content/child/child_thread_impl.cc
@@ -62,6 +62,9 @@
 #include "ipc/ipc_sync_channel.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "mojo/core/embedder/scoped_ipc_support.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/platform/named_platform_channel.h"
 #include "mojo/public/cpp/platform/platform_channel.h"
@@ -73,9 +76,7 @@
 #include "services/device/public/cpp/power_monitor/power_monitor_broadcast_source.h"
 #include "services/resource_coordinator/public/cpp/memory_instrumentation/client_process_impl.h"
 #include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
-#include "services/resource_coordinator/public/mojom/service_constants.mojom.h"
 #include "services/service_manager/embedder/switches.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 
@@ -90,7 +91,9 @@
 
 #if BUILDFLAG(CLANG_COVERAGE)
 #include <stdio.h>
-#include <unistd.h>
+#if defined(OS_WIN)
+#include <io.h>
+#endif
 // Function provided by libclang_rt.profile-*.a, declared and documented at:
 // https://github.com/llvm/llvm-project/blob/master/compiler-rt/lib/profile/InstrProfiling.h
 extern "C" void __llvm_profile_set_file_object(FILE* File, int EnableMerge);
@@ -229,12 +232,14 @@ mojo::IncomingInvitation InitializeMojoIPCChannel() {
           service_manager::kMojoIPCChannel))));
 #endif
 
-  return mojo::IncomingInvitation::Accept(std::move(endpoint));
+  return mojo::IncomingInvitation::Accept(
+      std::move(endpoint), MOJO_ACCEPT_INVITATION_FLAG_LEAK_TRANSPORT_ENDPOINT);
 }
 
 class ChannelBootstrapFilter : public ConnectionFilter {
  public:
-  explicit ChannelBootstrapFilter(IPC::mojom::ChannelBootstrapPtrInfo bootstrap)
+  explicit ChannelBootstrapFilter(
+      mojo::PendingRemote<IPC::mojom::ChannelBootstrap> bootstrap)
       : bootstrap_(std::move(bootstrap)) {}
 
  private:
@@ -250,13 +255,13 @@ class ChannelBootstrapFilter : public ConnectionFilter {
 
     if (interface_name == IPC::mojom::ChannelBootstrap::Name_) {
       DCHECK(bootstrap_.is_valid());
-      mojo::FuseInterface(
-          IPC::mojom::ChannelBootstrapRequest(std::move(*interface_pipe)),
-          std::move(bootstrap_));
+      mojo::FusePipes(mojo::PendingReceiver<IPC::mojom::ChannelBootstrap>(
+                          std::move(*interface_pipe)),
+                      std::move(bootstrap_));
     }
   }
 
-  IPC::mojom::ChannelBootstrapPtrInfo bootstrap_;
+  mojo::PendingRemote<IPC::mojom::ChannelBootstrap> bootstrap_;
 
   DISALLOW_COPY_AND_ASSIGN(ChannelBootstrapFilter);
 };
@@ -395,6 +400,11 @@ class ChildProcessImpl : public mojom::ChildProcess {
     int fd = file.TakePlatformFile();
     FILE* f = fdopen(fd, "r+b");
     __llvm_profile_set_file_object(f, 1);
+#elif defined(OS_WIN)
+    HANDLE handle = file.TakePlatformFile();
+    int fd = _open_osfhandle((intptr_t)handle, 0);
+    FILE* f = _fdopen(fd, "r+b");
+    __llvm_profile_set_file_object(f, 1);
 #endif
   }
 #endif
@@ -415,13 +425,13 @@ void BindChildProcessImpl(
     base::RepeatingClosure quit_closure,
     ChildThreadImpl::Options::ServiceBinder service_binder,
     mojo::PendingReceiver<mojom::ChildProcessHost> host_receiver,
-    mojom::ChildProcessRequest request) {
+    mojo::PendingReceiver<mojom::ChildProcess> receiver) {
   mojo::MakeSelfOwnedReceiver<mojom::ChildProcess>(
       std::make_unique<ChildProcessImpl>(
           std::move(main_thread_task_runner), std::move(weak_main_thread),
           std::move(quit_closure), std::move(service_binder),
           std::move(host_receiver)),
-      std::move(request));
+      std::move(receiver));
 }
 
 }  // namespace
@@ -539,18 +549,18 @@ void ChildThreadImpl::SetFieldTrialGroup(const std::string& trial_name,
 void ChildThreadImpl::OnFieldTrialGroupFinalized(
     const std::string& trial_name,
     const std::string& group_name) {
-  mojom::FieldTrialRecorderPtr field_trial_recorder;
-  BindHostReceiver(mojo::MakeRequest(&field_trial_recorder));
+  mojo::Remote<mojom::FieldTrialRecorder> field_trial_recorder;
+  BindHostReceiver(field_trial_recorder.BindNewPipeAndPassReceiver());
   field_trial_recorder->FieldTrialActivated(trial_name);
 }
 
 void ChildThreadImpl::ConnectChannel() {
   DCHECK(service_manager_connection_);
-  IPC::mojom::ChannelBootstrapPtr bootstrap;
+  mojo::PendingRemote<IPC::mojom::ChannelBootstrap> bootstrap;
   mojo::ScopedMessagePipeHandle handle =
-      mojo::MakeRequest(&bootstrap).PassMessagePipe();
+      bootstrap.InitWithNewPipeAndPassReceiver().PassPipe();
   service_manager_connection_->AddConnectionFilter(
-      std::make_unique<ChannelBootstrapFilter>(bootstrap.PassInterface()));
+      std::make_unique<ChannelBootstrapFilter>(std::move(bootstrap)));
 
   channel_->Init(
       IPC::ChannelMojo::CreateClientFactory(
@@ -632,31 +642,19 @@ void ChildThreadImpl::Init(const Options& options) {
   // In single process mode, browser-side tracing and memory will cover the
   // whole process including renderers.
   if (!IsInBrowserProcess()) {
-    if (service_manager_connection_) {
-      std::string process_type_str =
-          base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
-              switches::kProcessType);
-      auto process_type = memory_instrumentation::mojom::ProcessType::OTHER;
-      if (process_type_str == switches::kRendererProcess)
-        process_type = memory_instrumentation::mojom::ProcessType::RENDERER;
-      else if (process_type_str == switches::kGpuProcess)
-        process_type = memory_instrumentation::mojom::ProcessType::GPU;
-      else if (process_type_str == switches::kUtilityProcess)
-        process_type = memory_instrumentation::mojom::ProcessType::UTILITY;
-      else if (process_type_str == switches::kPpapiPluginProcess)
-        process_type = memory_instrumentation::mojom::ProcessType::PLUGIN;
-
-      memory_instrumentation::ClientProcessImpl::Config config(
-          GetConnector(), resource_coordinator::mojom::kServiceName,
-          process_type);
-      memory_instrumentation::ClientProcessImpl::CreateInstance(config);
-    }
+    mojo::PendingRemote<memory_instrumentation::mojom::Coordinator> coordinator;
+    mojo::PendingRemote<memory_instrumentation::mojom::ClientProcess> process;
+    auto process_receiver = process.InitWithNewPipeAndPassReceiver();
+    mojo::Remote<memory_instrumentation::mojom::CoordinatorConnector> connector;
+    BindHostReceiver(connector.BindNewPipeAndPassReceiver());
+    connector->RegisterCoordinatorClient(
+        coordinator.InitWithNewPipeAndPassReceiver(), std::move(process));
+    memory_instrumentation::ClientProcessImpl::CreateInstance(
+        std::move(process_receiver), std::move(coordinator));
   }
 
   // In single process mode we may already have initialized the power monitor,
-  // also for some edge cases where there is no ServiceManagerConnection, we do
-  // not create the power monitor.
-  if (!base::PowerMonitor::IsInitialized() && service_manager_connection_) {
+  if (!base::PowerMonitor::IsInitialized()) {
     auto power_monitor_source =
         std::make_unique<device::PowerMonitorBroadcastSource>(
             GetIOTaskRunner());
@@ -666,7 +664,9 @@ void ChildThreadImpl::Init(const Options& options) {
     // PowerMonitor is set before the power monitor source receives incoming
     // communication from the browser process (see https://crbug.com/821790 for
     // details)
-    source_ptr->Init(GetConnector());
+    mojo::PendingRemote<device::mojom::PowerMonitor> remote_power_monitor;
+    BindHostReceiver(remote_power_monitor.InitWithNewPipeAndPassReceiver());
+    source_ptr->Init(std::move(remote_power_monitor));
   }
 
 #if defined(OS_POSIX)
@@ -773,10 +773,8 @@ void ChildThreadImpl::ReleaseCachedFonts() {
 }
 
 mojom::FontCacheWin* ChildThreadImpl::GetFontCacheWin() {
-  if (!font_cache_win_ptr_) {
-    GetConnector()->BindInterface(mojom::kSystemServiceName,
-                                  &font_cache_win_ptr_);
-  }
+  if (!font_cache_win_ptr_)
+    BindHostReceiver(mojo::MakeRequest(&font_cache_win_ptr_));
   return font_cache_win_ptr_.get();
 }
 #endif
@@ -793,10 +791,6 @@ ServiceManagerConnection* ChildThreadImpl::GetServiceManagerConnection() {
   return service_manager_connection_.get();
 }
 
-service_manager::Connector* ChildThreadImpl::GetConnector() {
-  return service_manager_connection_->GetConnector();
-}
-
 void ChildThreadImpl::BindHostReceiver(mojo::GenericPendingReceiver receiver) {
   child_process_host_->BindHostReceiver(std::move(receiver));
 }
@@ -912,19 +906,21 @@ void ChildThreadImpl::EnsureConnected() {
 
 void ChildThreadImpl::GetRoute(
     int32_t routing_id,
-    blink::mojom::AssociatedInterfaceProviderAssociatedRequest request) {
-  associated_interface_provider_bindings_.AddBinding(
-      this, std::move(request), routing_id);
+    mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>
+        receiver) {
+  associated_interface_provider_receivers_.Add(this, std::move(receiver),
+                                               routing_id);
 }
 
 void ChildThreadImpl::GetAssociatedInterface(
     const std::string& name,
-    blink::mojom::AssociatedInterfaceAssociatedRequest request) {
+    mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterface>
+        receiver) {
   int32_t routing_id =
-      associated_interface_provider_bindings_.dispatch_context();
+      associated_interface_provider_receivers_.current_context();
   Listener* route = router_.GetRoute(routing_id);
   if (route)
-    route->OnAssociatedInterfaceRequest(name, request.PassHandle());
+    route->OnAssociatedInterfaceRequest(name, receiver.PassHandle());
 }
 
 bool ChildThreadImpl::IsInBrowserProcess() const {
diff --git a/chromium/content/child/child_thread_impl.h b/chromium/content/child/child_thread_impl.h
index 96fa9d2dcff..0fa490a03c9 100644
--- a/chromium/content/child/child_thread_impl.h
+++ b/chromium/content/child/child_thread_impl.h
@@ -28,10 +28,11 @@
 #include "ipc/ipc_buildflags.h"  // For BUILDFLAG(IPC_MESSAGE_LOG_ENABLED).
 #include "ipc/ipc_platform_file.h"
 #include "ipc/message_router.h"
-#include "mojo/public/cpp/bindings/associated_binding_set.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/associated_receiver_set.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 #include "mojo/public/cpp/bindings/shared_remote.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
 #include "third_party/blink/public/mojom/associated_interfaces/associated_interfaces.mojom.h"
@@ -97,7 +98,6 @@ class CONTENT_EXPORT ChildThreadImpl
   void RecordAction(const base::UserMetricsAction& action) override;
   void RecordComputedAction(const std::string& action) override;
   ServiceManagerConnection* GetServiceManagerConnection() override;
-  service_manager::Connector* GetConnector() override;
   void BindHostReceiver(mojo::GenericPendingReceiver receiver) override;
   scoped_refptr<base::SingleThreadTaskRunner> GetIOTaskRunner() override;
   void SetFieldTrialGroup(const std::string& trial_name,
@@ -204,14 +204,16 @@ class CONTENT_EXPORT ChildThreadImpl
   void EnsureConnected();
 
   // mojom::RouteProvider:
-  void GetRoute(int32_t routing_id,
-                blink::mojom::AssociatedInterfaceProviderAssociatedRequest
-                    request) override;
+  void GetRoute(
+      int32_t routing_id,
+      mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterfaceProvider>
+          receiver) override;
 
   // blink::mojom::AssociatedInterfaceProvider:
   void GetAssociatedInterface(
       const std::string& name,
-      blink::mojom::AssociatedInterfaceAssociatedRequest request) override;
+      mojo::PendingAssociatedReceiver<blink::mojom::AssociatedInterface>
+          receiver) override;
 
 #if defined(OS_WIN)
   mojom::FontCacheWin* GetFontCacheWin();
@@ -221,8 +223,9 @@ class CONTENT_EXPORT ChildThreadImpl
   std::unique_ptr<ServiceManagerConnection> service_manager_connection_;
 
   mojo::AssociatedReceiver<mojom::RouteProvider> route_provider_receiver_{this};
-  mojo::AssociatedBindingSet<blink::mojom::AssociatedInterfaceProvider, int32_t>
-      associated_interface_provider_bindings_;
+  mojo::AssociatedReceiverSet<blink::mojom::AssociatedInterfaceProvider,
+                              int32_t>
+      associated_interface_provider_receivers_;
   mojo::AssociatedRemote<mojom::RouteProvider> remote_route_provider_;
 #if defined(OS_WIN)
   mojom::FontCacheWinPtr font_cache_win_ptr_;
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.cc b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.cc
index f9166904638..7d717652d05 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.cc
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.cc
@@ -6,6 +6,8 @@
 
 #include <dwrite.h>
 
+#include <utility>
+
 #include "base/bind.h"
 #include "base/callback.h"
 #include "base/debug/alias.h"
@@ -15,6 +17,7 @@
 #include "content/child/dwrite_font_proxy/dwrite_font_proxy_win.h"
 #include "content/child/dwrite_font_proxy/font_fallback_win.h"
 #include "content/child/font_warmup_win.h"
+#include "content/public/child/child_thread.h"
 #include "content/public/common/service_names.mojom.h"
 #include "skia/ext/fontmgr_default.h"
 #include "third_party/blink/public/web/win/web_font_rendering.h"
@@ -31,8 +34,8 @@ namespace {
 DWriteFontCollectionProxy* g_font_collection = nullptr;
 FontFallback* g_font_fallback = nullptr;
 
-base::RepeatingCallback<blink::mojom::DWriteFontProxyPtrInfo(void)>*
-    g_connection_callback_override = nullptr;
+base::RepeatingCallback<mojo::PendingRemote<blink::mojom::DWriteFontProxy>(
+    void)>* g_connection_callback_override = nullptr;
 
 // Windows-only DirectWrite support. These warm up the DirectWrite paths
 // before sandbox lock down to allow Skia access to the Font Manager service.
@@ -48,22 +51,20 @@ void CreateDirectWriteFactory(IDWriteFactory** factory) {
 
 }  // namespace
 
-void InitializeDWriteFontProxy(service_manager::Connector* connector) {
+void InitializeDWriteFontProxy() {
   TRACE_EVENT0("dwrite,fonts", "InitializeDWriteFontProxy");
   mswr::ComPtr<IDWriteFactory> factory;
 
   CreateDirectWriteFactory(&factory);
 
   if (!g_font_collection) {
-    blink::mojom::DWriteFontProxyPtrInfo dwrite_font_proxy;
+    mojo::PendingRemote<blink::mojom::DWriteFontProxy> dwrite_font_proxy;
     if (g_connection_callback_override) {
       dwrite_font_proxy = g_connection_callback_override->Run();
-    } else if (connector) {
-      connector->BindInterface(mojom::kSystemServiceName,
-                               mojo::MakeRequest(&dwrite_font_proxy));
+    } else if (auto* thread = ChildThread::Get()) {
+      thread->BindHostReceiver(
+          dwrite_font_proxy.InitWithNewPipeAndPassReceiver());
     }
-    // If |connector| is not provided, the connection to the browser will be
-    // created on demand.
     DWriteFontCollectionProxy::Create(&g_font_collection, factory.Get(),
                                       std::move(dwrite_font_proxy));
   }
@@ -101,12 +102,12 @@ void UninitializeDWriteFontProxy() {
 }
 
 void SetDWriteFontProxySenderForTesting(
-    base::RepeatingCallback<blink::mojom::DWriteFontProxyPtrInfo(void)>
-        sender) {
+    base::RepeatingCallback<
+        mojo::PendingRemote<blink::mojom::DWriteFontProxy>(void)> sender) {
   DCHECK(!g_connection_callback_override);
-  g_connection_callback_override =
-      new base::RepeatingCallback<blink::mojom::DWriteFontProxyPtrInfo(void)>(
-          std::move(sender));
+  g_connection_callback_override = new base::RepeatingCallback<
+      mojo::PendingRemote<blink::mojom::DWriteFontProxy>(void)>(
+      std::move(sender));
 }
 
 void ClearDWriteFontProxySenderForTesting() {
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.h b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.h
index 42b8d18f163..43edcae6921 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.h
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_init_impl_win.h
@@ -8,6 +8,7 @@
 #include "base/callback.h"
 #include "content/common/content_export.h"
 #include "content/public/child/dwrite_font_proxy_init_win.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/dwrite_font_proxy/dwrite_font_proxy.mojom.h"
 
 namespace content {
@@ -16,7 +17,8 @@ namespace content {
 // useful in tests which use a fake render thread which is unable to process
 // font IPC messages. This should only be called when running as a test.
 CONTENT_EXPORT void SetDWriteFontProxySenderForTesting(
-    base::RepeatingCallback<blink::mojom::DWriteFontProxyPtrInfo(void)> sender);
+    base::RepeatingCallback<
+        mojo::PendingRemote<blink::mojom::DWriteFontProxy>(void)> sender);
 
 // Cleans up the fake dwrite font proxy connection factory.
 CONTENT_EXPORT void ClearDWriteFontProxySenderForTesting();
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc
index 2b18674376d..65654effb8b 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.cc
@@ -17,10 +17,10 @@
 #include "base/no_destructor.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/task/post_task.h"
+#include "base/trace_event/trace_event.h"
 #include "content/child/dwrite_font_proxy/dwrite_localized_strings_win.h"
 #include "content/public/child/child_thread.h"
 #include "content/public/common/service_names.mojom.h"
-#include "services/service_manager/public/cpp/connector.h"
 
 namespace mswr = Microsoft::WRL;
 
@@ -77,7 +77,7 @@ void LogFontProxyError(FontProxyError error) {
 HRESULT DWriteFontCollectionProxy::Create(
     DWriteFontCollectionProxy** proxy_out,
     IDWriteFactory* dwrite_factory,
-    blink::mojom::DWriteFontProxyPtrInfo proxy) {
+    mojo::PendingRemote<blink::mojom::DWriteFontProxy> proxy) {
   return Microsoft::WRL::MakeAndInitialize<DWriteFontCollectionProxy>(
       proxy_out, dwrite_factory, std::move(proxy));
 }
@@ -263,7 +263,7 @@ HRESULT DWriteFontCollectionProxy::CreateStreamFromKey(
 
 HRESULT DWriteFontCollectionProxy::RuntimeClassInitialize(
     IDWriteFactory* factory,
-    blink::mojom::DWriteFontProxyPtrInfo proxy) {
+    mojo::PendingRemote<blink::mojom::DWriteFontProxy> proxy) {
   DCHECK(factory);
 
   factory_ = factory;
@@ -358,7 +358,7 @@ bool DWriteFontCollectionProxy::CreateFamily(UINT32 family_index) {
 }
 
 void DWriteFontCollectionProxy::SetProxy(
-    blink::mojom::DWriteFontProxyPtrInfo proxy) {
+    mojo::PendingRemote<blink::mojom::DWriteFontProxy> proxy) {
   font_proxy_ = blink::mojom::ThreadSafeDWriteFontProxyPtr::Create(
       std::move(proxy),
       base::CreateSequencedTaskRunner(
@@ -367,18 +367,19 @@ void DWriteFontCollectionProxy::SetProxy(
 
 blink::mojom::DWriteFontProxy& DWriteFontCollectionProxy::GetFontProxy() {
   if (!font_proxy_) {
-    blink::mojom::DWriteFontProxyPtrInfo dwrite_font_proxy;
+    mojo::PendingRemote<blink::mojom::DWriteFontProxy> dwrite_font_proxy;
     if (main_task_runner_->RunsTasksInCurrentSequence()) {
-      ChildThread::Get()->GetConnector()->BindInterface(
-          mojom::kSystemServiceName, mojo::MakeRequest(&dwrite_font_proxy));
+      ChildThread::Get()->BindHostReceiver(
+          dwrite_font_proxy.InitWithNewPipeAndPassReceiver());
     } else {
       main_task_runner_->PostTask(
-          FROM_HERE, base::BindOnce(
-                         [](blink::mojom::DWriteFontProxyRequest request) {
-                           ChildThread::Get()->GetConnector()->BindInterface(
-                               mojom::kSystemServiceName, std::move(request));
-                         },
-                         mojo::MakeRequest(&dwrite_font_proxy)));
+          FROM_HERE,
+          base::BindOnce(
+              [](mojo::PendingReceiver<blink::mojom::DWriteFontProxy>
+                     receiver) {
+                ChildThread::Get()->BindHostReceiver(std::move(receiver));
+              },
+              dwrite_font_proxy.InitWithNewPipeAndPassReceiver()));
     }
     SetProxy(std::move(dwrite_font_proxy));
   }
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.h b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.h
index 40c92d3315a..576fa767650 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.h
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win.h
@@ -16,6 +16,7 @@
 #include "base/macros.h"
 #include "base/strings/string16.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/dwrite_font_proxy/dwrite_font_proxy.mojom.h"
 
 namespace content {
@@ -38,7 +39,7 @@ class DWriteFontCollectionProxy
   static CONTENT_EXPORT HRESULT
   Create(DWriteFontCollectionProxy** proxy_out,
          IDWriteFactory* dwrite_factory,
-         blink::mojom::DWriteFontProxyPtrInfo proxy);
+         mojo::PendingRemote<blink::mojom::DWriteFontProxy> proxy);
 
   // Use Create() to construct these objects. Direct calls to the constructor
   // are an error - it is only public because a WRL helper function creates the
@@ -69,9 +70,9 @@ class DWriteFontCollectionProxy
                       UINT32 font_file_reference_key_size,
                       IDWriteFontFileStream** font_file_stream) override;
 
-  CONTENT_EXPORT HRESULT STDMETHODCALLTYPE
-  RuntimeClassInitialize(IDWriteFactory* factory,
-                         blink::mojom::DWriteFontProxyPtrInfo proxy);
+  CONTENT_EXPORT HRESULT STDMETHODCALLTYPE RuntimeClassInitialize(
+      IDWriteFactory* factory,
+      mojo::PendingRemote<blink::mojom::DWriteFontProxy> proxy);
 
   CONTENT_EXPORT void Unregister();
 
@@ -91,7 +92,7 @@ class DWriteFontCollectionProxy
   blink::mojom::DWriteFontProxy& GetFontProxy();
 
  private:
-  void SetProxy(blink::mojom::DWriteFontProxyPtrInfo);
+  void SetProxy(mojo::PendingRemote<blink::mojom::DWriteFontProxy> proxy);
 
   Microsoft::WRL::ComPtr<IDWriteFactory> factory_;
   std::vector<Microsoft::WRL::ComPtr<DWriteFontFamilyProxy>> families_;
diff --git a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win_unittest.cc b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win_unittest.cc
index d0c7628bb9b..a51415f45c1 100644
--- a/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win_unittest.cc
+++ b/chromium/content/child/dwrite_font_proxy/dwrite_font_proxy_win_unittest.cc
@@ -9,6 +9,7 @@
 #include <wrl.h>
 
 #include <memory>
+#include <utility>
 
 #include "base/memory/ref_counted.h"
 #include "base/test/task_environment.h"
@@ -27,7 +28,7 @@ class DWriteFontProxyUnitTest : public testing::Test {
     fake_collection_ = std::make_unique<FakeFontCollection>();
     SetupFonts(fake_collection_.get());
     DWriteFontCollectionProxy::Create(&collection_, factory.Get(),
-                                      fake_collection_->CreatePtr());
+                                      fake_collection_->CreateRemote());
     EXPECT_TRUE(collection_.Get());
   }
 
@@ -343,7 +344,7 @@ TEST_F(DWriteFontProxyUnitTest, TestCustomFontFiles) {
   }
   mswr::ComPtr<DWriteFontCollectionProxy> collection;
   DWriteFontCollectionProxy::Create(&collection, factory.Get(),
-                                    fonts.CreatePtr());
+                                    fonts.CreateRemote());
 
   // Check that we can get the font family and match a font.
   UINT32 index = UINT_MAX;
diff --git a/chromium/content/child/dwrite_font_proxy/font_fallback_win.cc b/chromium/content/child/dwrite_font_proxy/font_fallback_win.cc
index 9bcb5e54949..8afb1131927 100644
--- a/chromium/content/child/dwrite_font_proxy/font_fallback_win.cc
+++ b/chromium/content/child/dwrite_font_proxy/font_fallback_win.cc
@@ -11,6 +11,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversion_utils.h"
+#include "base/trace_event/trace_event.h"
 #include "content/child/dwrite_font_proxy/dwrite_font_proxy_win.h"
 
 namespace mswr = Microsoft::WRL;
diff --git a/chromium/content/child/dwrite_font_proxy/font_fallback_win_unittest.cc b/chromium/content/child/dwrite_font_proxy/font_fallback_win_unittest.cc
index a0772b1b81b..6a50dc5266d 100644
--- a/chromium/content/child/dwrite_font_proxy/font_fallback_win_unittest.cc
+++ b/chromium/content/child/dwrite_font_proxy/font_fallback_win_unittest.cc
@@ -8,6 +8,7 @@
 #include <shlobj.h>
 #include <wrl.h>
 
+#include <memory>
 #include <vector>
 
 #include "base/memory/ref_counted.h"
@@ -46,7 +47,7 @@ class FontFallbackUnitTest : public testing::Test {
         .AddFilePath(segoe_path);
 
     DWriteFontCollectionProxy::Create(&collection_, factory_.Get(),
-                                      fake_collection_->CreatePtr());
+                                      fake_collection_->CreateRemote());
   }
 
   base::test::TaskEnvironment task_environment;
diff --git a/chromium/content/child/font_warmup_win_unittest.cc b/chromium/content/child/font_warmup_win_unittest.cc
index 36f68fdb5e0..48a47b805d8 100644
--- a/chromium/content/child/font_warmup_win_unittest.cc
+++ b/chromium/content/child/font_warmup_win_unittest.cc
@@ -10,6 +10,7 @@
 #include <stdint.h>
 #include <wrl.h>
 
+#include <algorithm>
 #include <memory>
 #include <vector>
 
@@ -43,7 +44,7 @@ class GDIFontEmulationTest : public testing::Test {
     fake_collection_ = std::make_unique<FakeFontCollection>();
     SetupFonts(fake_collection_.get());
     DWriteFontCollectionProxy::Create(&collection_, factory.Get(),
-                                      fake_collection_->CreatePtr());
+                                      fake_collection_->CreateRemote());
     EXPECT_TRUE(collection_.Get());
 
     content::SetPreSandboxWarmupFontMgrForTesting(
diff --git a/chromium/content/child/runtime_features.cc b/chromium/content/child/runtime_features.cc
index fba63fb7f47..eefb49ff56e 100644
--- a/chromium/content/child/runtime_features.cc
+++ b/chromium/content/child/runtime_features.cc
@@ -21,8 +21,10 @@
 #include "net/base/features.h"
 #include "services/device/public/cpp/device_features.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/network_switches.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/platform/web_runtime_features.h"
+#include "ui/accessibility/accessibility_features.h"
 #include "ui/base/ui_base_features.h"
 #include "ui/events/blink/blink_features.h"
 #include "ui/gfx/switches.h"
@@ -41,75 +43,22 @@ using blink::WebRuntimeFeatures;
 
 namespace {
 
-void SetRuntimeFeatureDefaultsForPlatform() {
+// Sets blink runtime features for specific platforms.
+// This should be a last resort vs runtime_enabled_features.json5.
+void SetRuntimeFeatureDefaultsForPlatform(
+    const base::CommandLine& command_line) {
   // Please consider setting up feature defaults for different platforms
   // in runtime_enabled_features.json5 instead of here
-
+  // TODO(rodneyding): Move the more common cases here
+  // to baseFeature/switch functions below and move more complex
+  // ones to special case functions.
 #if defined(USE_AURA)
   WebRuntimeFeatures::EnableCompositedSelectionUpdate(true);
 #endif
-
 #if defined(OS_WIN)
   if (base::win::GetVersion() >= base::win::Version::WIN10)
     WebRuntimeFeatures::EnableWebBluetooth(true);
 #endif
-}
-
-void SetIndividualRuntimeFeatures(
-    const base::CommandLine& command_line,
-    bool enable_experimental_web_platform_features) {
-
-  if (!base::FeatureList::IsEnabled(features::kWebUsb))
-    WebRuntimeFeatures::EnableWebUsb(false);
-
-  if (base::FeatureList::IsEnabled(
-          blink::features::kBlockingFocusWithoutUserActivation)) {
-    WebRuntimeFeatures::EnableBlockingFocusWithoutUserActivation(true);
-  }
-
-  if (command_line.HasSwitch(switches::kDisableDatabases))
-    WebRuntimeFeatures::EnableDatabase(false);
-
-  if (command_line.HasSwitch(switches::kDisableNotifications)) {
-    WebRuntimeFeatures::EnableNotifications(false);
-
-    // Chrome's Push Messaging implementation relies on Web Notifications.
-    WebRuntimeFeatures::EnablePushMessaging(false);
-  }
-
-  if (!base::FeatureList::IsEnabled(features::kNotificationContentImage))
-    WebRuntimeFeatures::EnableNotificationContentImage(false);
-
-  WebRuntimeFeatures::EnableSharedArrayBuffer(
-      base::FeatureList::IsEnabled(features::kSharedArrayBuffer) ||
-      base::FeatureList::IsEnabled(features::kWebAssemblyThreads));
-
-  if (command_line.HasSwitch(switches::kDisableSharedWorkers))
-    WebRuntimeFeatures::EnableSharedWorker(false);
-
-  if (command_line.HasSwitch(switches::kDisableSpeechAPI)) {
-    WebRuntimeFeatures::EnableScriptedSpeechRecognition(false);
-    WebRuntimeFeatures::EnableScriptedSpeechSynthesis(false);
-  }
-
-  if (command_line.HasSwitch(switches::kDisableSpeechSynthesisAPI)) {
-    WebRuntimeFeatures::EnableScriptedSpeechSynthesis(false);
-  }
-
-  if (command_line.HasSwitch(switches::kDisableFileSystem))
-    WebRuntimeFeatures::EnableFileSystem(false);
-
-  if (!command_line.HasSwitch(switches::kDisableYUVImageDecoding) &&
-      base::FeatureList::IsEnabled(
-          blink::features::kDecodeJpeg420ImagesToYUV)) {
-    WebRuntimeFeatures::EnableDecodeJpeg420ImagesToYUV(true);
-  }
-
-  if (!command_line.HasSwitch(switches::kDisableYUVImageDecoding) &&
-      base::FeatureList::IsEnabled(
-          blink::features::kDecodeLossyWebPImagesToYUV)) {
-    WebRuntimeFeatures::EnableDecodeLossyWebPImagesToYUV(true);
-  }
 
 #if defined(SUPPORT_WEBGL2_COMPUTE_CONTEXT)
   if (command_line.HasSwitch(switches::kEnableWebGL2ComputeContext)) {
@@ -117,17 +66,6 @@ void SetIndividualRuntimeFeatures(
   }
 #endif
 
-  if (command_line.HasSwitch(switches::kEnableWebGLDraftExtensions))
-    WebRuntimeFeatures::EnableWebGLDraftExtensions(true);
-
-  if (command_line.HasSwitch(switches::kEnableAutomation) ||
-      command_line.HasSwitch(switches::kHeadless)) {
-    WebRuntimeFeatures::EnableAutomationControlled(true);
-  }
-
-  if (command_line.HasSwitch(switches::kEnableWebBluetoothScanning))
-    WebRuntimeFeatures::EnableWebBluetoothScanning(true);
-
 #if defined(OS_MACOSX)
   const bool enable_canvas_2d_image_chromium =
       command_line.HasSwitch(
@@ -154,176 +92,11 @@ void SetIndividualRuntimeFeatures(
 #endif
   WebRuntimeFeatures::EnableWebGLImageChromium(enable_web_gl_image_chromium);
 
-  if (command_line.HasSwitch(switches::kForceOverlayFullscreenVideo))
-    WebRuntimeFeatures::ForceOverlayFullscreenVideo(true);
-
-  if (ui::IsOverlayScrollbarEnabled())
-    WebRuntimeFeatures::EnableOverlayScrollbars(true);
-
-  if (command_line.HasSwitch(switches::kEnablePreciseMemoryInfo))
-    WebRuntimeFeatures::EnablePreciseMemoryInfo(true);
-
-  if (command_line.HasSwitch(switches::kEnablePrintBrowser))
-    WebRuntimeFeatures::EnablePrintBrowser(true);
-
-  // TODO(yashard): Remove |enable_experimental_web_platform_features| flag
-  // since the feature should have been enabled when it is set to experimental
-  if (command_line.HasSwitch(switches::kEnableNetworkInformationDownlinkMax) ||
-      enable_experimental_web_platform_features) {
-    WebRuntimeFeatures::EnableNetInfoDownlinkMax(true);
-  }
-
-  WebRuntimeFeatures::EnableReducedReferrerGranularity(
-      base::FeatureList::IsEnabled(features::kReducedReferrerGranularity));
-
-  if (base::FeatureList::IsEnabled(features::kPeriodicBackgroundSync))
-    WebRuntimeFeatures::EnablePeriodicBackgroundSync(true);
-
-  if (command_line.HasSwitch(switches::kDisablePermissionsAPI))
-    WebRuntimeFeatures::EnablePermissionsAPI(false);
-
-  if (command_line.HasSwitch(switches::kDisableV8IdleTasks))
-    WebRuntimeFeatures::EnableV8IdleTasks(false);
-  else
-    WebRuntimeFeatures::EnableV8IdleTasks(true);
-
-  if (command_line.HasSwitch(switches::kEnableUnsafeWebGPU))
-    WebRuntimeFeatures::EnableWebGPU(true);
-
-  if (command_line.HasSwitch(switches::kEnableCanvas2dSwapChain))
-    WebRuntimeFeatures::EnableCanvas2dSwapChain(true);
-
-  if (command_line.HasSwitch(switches::kEnableWebGLSwapChain))
-    WebRuntimeFeatures::EnableWebGLSwapChain(true);
-
-  if (command_line.HasSwitch(switches::kEnableWebVR))
-    WebRuntimeFeatures::EnableWebVR(true);
-
-  if (base::FeatureList::IsEnabled(features::kWebXr))
-    WebRuntimeFeatures::EnableWebXR(true);
-
-  if (base::FeatureList::IsEnabled(features::kWebXrArModule))
-    WebRuntimeFeatures::EnableWebXRARModule(true);
-
-  if (base::FeatureList::IsEnabled(features::kWebXrHitTest))
-    WebRuntimeFeatures::EnableWebXRHitTest(true);
-
-  if (base::FeatureList::IsEnabled(features::kWebXrAnchors))
-    WebRuntimeFeatures::EnableWebXRAnchors(true);
-
-  if (base::FeatureList::IsEnabled(features::kWebXrPlaneDetection))
-    WebRuntimeFeatures::EnableWebXRPlaneDetection(true);
-
-  if (command_line.HasSwitch(switches::kDisablePresentationAPI))
-    WebRuntimeFeatures::EnablePresentationAPI(false);
-
-  if (command_line.HasSwitch(switches::kDisableRemotePlaybackAPI))
-    WebRuntimeFeatures::EnableRemotePlaybackAPI(false);
-
-  // TODO(yashard): Remove |enable_experimental_web_platform_features| flag
-  // since the feature should have been enabled when it is set to experimental
-  WebRuntimeFeatures::EnableFetchMetadata(
-      base::FeatureList::IsEnabled(network::features::kFetchMetadata) ||
-      enable_experimental_web_platform_features);
-  WebRuntimeFeatures::EnableFetchMetadataDestination(
-      base::FeatureList::IsEnabled(
-          network::features::kFetchMetadataDestination) ||
-      enable_experimental_web_platform_features);
-
-  WebRuntimeFeatures::EnableUserActivationPostMessageTransfer(
-      base::FeatureList::IsEnabled(
-          features::kUserActivationPostMessageTransfer));
-
-  WebRuntimeFeatures::EnableUserActivationSameOriginVisibility(
-      base::FeatureList::IsEnabled(
-          features::kUserActivationSameOriginVisibility));
-
-  WebRuntimeFeatures::EnableUserActivationV2(
-      base::FeatureList::IsEnabled(features::kUserActivationV2));
-
-  if (base::FeatureList::IsEnabled(features::kScrollAnchorSerialization))
-    WebRuntimeFeatures::EnableScrollAnchorSerialization(true);
-
-  WebRuntimeFeatures::EnableFeatureFromString(
-      "CSSBackdropFilter",
-      base::FeatureList::IsEnabled(blink::features::kCSSBackdropFilter) ||
-          enable_experimental_web_platform_features);
-
-  WebRuntimeFeatures::EnableFeatureFromString(
-      "FastBorderRadius",
-      base::FeatureList::IsEnabled(blink::features::kFastBorderRadius) ||
-          enable_experimental_web_platform_features);
-
-  WebRuntimeFeatures::EnablePassiveDocumentEventListeners(
-      base::FeatureList::IsEnabled(features::kPassiveDocumentEventListeners));
-
-  WebRuntimeFeatures::EnablePassiveDocumentWheelEventListeners(
-      base::FeatureList::IsEnabled(
-          features::kPassiveDocumentWheelEventListeners));
-
-  WebRuntimeFeatures::EnableFeatureFromString(
-      "FontSrcLocalMatching",
-      base::FeatureList::IsEnabled(features::kFontSrcLocalMatching));
-
-  WebRuntimeFeatures::EnableFeatureFromString(
-      "LegacyWindowsDWriteFontFallback",
-      base::FeatureList::IsEnabled(features::kLegacyWindowsDWriteFontFallback));
-
-  if (command_line.HasSwitch(switches::kDisableBackgroundTimerThrottling))
-    WebRuntimeFeatures::EnableTimerThrottlingForBackgroundTabs(false);
-
-  WebRuntimeFeatures::EnableExpensiveBackgroundTimerThrottling(
-      base::FeatureList::IsEnabled(
-          features::kExpensiveBackgroundTimerThrottling));
-
-  WebRuntimeFeatures::EnableTimerThrottlingForHiddenFrames(
-      base::FeatureList::IsEnabled(features::kTimerThrottlingForHiddenFrames));
-
-  if (base::FeatureList::IsEnabled(
-          features::kSendBeaconThrowForBlobWithNonSimpleType))
-    WebRuntimeFeatures::EnableSendBeaconThrowForBlobWithNonSimpleType(true);
-
 #if defined(OS_ANDROID)
   if (command_line.HasSwitch(switches::kDisableMediaSessionAPI))
     WebRuntimeFeatures::EnableMediaSession(false);
 #endif
 
-  WebRuntimeFeatures::EnablePaymentRequest(
-      base::FeatureList::IsEnabled(features::kWebPayments));
-
-  if (base::FeatureList::IsEnabled(features::kServiceWorkerPaymentApps))
-    WebRuntimeFeatures::EnablePaymentApp(true);
-
-  if (base::FeatureList::IsEnabled(features::kCompositorTouchAction))
-    WebRuntimeFeatures::EnableCompositorTouchAction(true);
-
-  if (base::FeatureList::IsEnabled(features::kGenericSensorExtraClasses))
-    WebRuntimeFeatures::EnableGenericSensorExtraClasses(true);
-
-  if (network::features::ShouldEnableOutOfBlinkCors())
-    WebRuntimeFeatures::EnableOutOfBlinkCors(true);
-
-  if (base::FeatureList::IsEnabled(
-          network::features::kBlockNonSecureExternalRequests)) {
-    WebRuntimeFeatures::EnableFeatureFromString("AddressSpace", true);
-  }
-
-  WebRuntimeFeatures::EnableMediaCastOverlayButton(
-      base::FeatureList::IsEnabled(media::kMediaCastOverlayButton));
-
-  if (!base::FeatureList::IsEnabled(features::kBlockCredentialedSubresources)) {
-    WebRuntimeFeatures::EnableFeatureFromString("BlockCredentialedSubresources",
-                                                false);
-  }
-
-  if (base::FeatureList::IsEnabled(features::kRasterInducingScroll))
-    WebRuntimeFeatures::EnableRasterInducingScroll(true);
-
-  WebRuntimeFeatures::EnableFeatureFromString(
-      "AllowContentInitiatedDataUrlNavigations",
-      base::FeatureList::IsEnabled(
-          features::kAllowContentInitiatedDataUrlNavigations));
-
 #if defined(OS_ANDROID)
   WebRuntimeFeatures::EnableWebNfc(
       base::FeatureList::IsEnabled(features::kWebNfc));
@@ -340,57 +113,349 @@ void SetIndividualRuntimeFeatures(
       base::FeatureList::IsEnabled(features::kWebAuth));
 #endif
 
-  WebRuntimeFeatures::EnableClientPlaceholdersForServerLoFi(
-      base::GetFieldTrialParamValue("PreviewsClientLoFi",
-                                    "replace_server_placeholders") != "false");
-
-  WebRuntimeFeatures::EnableResourceLoadScheduler(
-      base::FeatureList::IsEnabled(features::kResourceLoadScheduler));
-
-  if (base::FeatureList::IsEnabled(features::kBuiltInModuleAll))
-    WebRuntimeFeatures::EnableBuiltInModuleAll(true);
-
-  if (base::FeatureList::IsEnabled(features::kBuiltInModuleInfra))
-    WebRuntimeFeatures::EnableBuiltInModuleInfra(true);
-
-  if (base::FeatureList::IsEnabled(features::kBuiltInModuleKvStorage))
-    WebRuntimeFeatures::EnableBuiltInModuleKvStorage(true);
-
-  WebRuntimeFeatures::EnableFeatureFromString(
-      "LayoutNG", base::FeatureList::IsEnabled(blink::features::kLayoutNG));
-
-  WebRuntimeFeatures::EnableLazyInitializeMediaControls(
-      base::FeatureList::IsEnabled(features::kLazyInitializeMediaControls));
-
-  WebRuntimeFeatures::EnableMediaEngagementBypassAutoplayPolicies(
-      base::FeatureList::IsEnabled(
-          media::kMediaEngagementBypassAutoplayPolicies));
+#if defined(OS_ANDROID)
+  WebRuntimeFeatures::EnablePictureInPictureAPI(
+      base::FeatureList::IsEnabled(media::kPictureInPictureAPI));
+#endif
 
-  WebRuntimeFeatures::EnableOverflowIconsForMediaControls(
-      base::FeatureList::IsEnabled(media::kOverflowIconsForMediaControls));
+#if defined(OS_ANDROID)
+  if (base::android::BuildInfo::GetInstance()->sdk_int() >=
+      base::android::SDK_VERSION_P) {
+    // Display Cutout is limited to Android P+.
+    WebRuntimeFeatures::EnableDisplayCutoutAPI(true);
+  }
+#endif
 
-  WebRuntimeFeatures::EnableAllowActivationDelegationAttr(
-      base::FeatureList::IsEnabled(features::kAllowActivationDelegationAttr));
+#if defined(OS_ANDROID)
+  WebRuntimeFeatures::EnableMediaControlsExpandGesture(
+      base::FeatureList::IsEnabled(media::kMediaControlsExpandGesture));
+#endif
+}
 
-  WebRuntimeFeatures::EnableScriptStreamingOnPreload(
-      base::FeatureList::IsEnabled(features::kScriptStreamingOnPreload));
+enum RuntimeFeatureEnableOptions {
+  // Always set the Blink feature to the enabled state of the base::Feature.
+  // Example: A run time feature that is completely controlled
+  // by base::Feature.
+  kUseFeatureState,
+  // Enables the Blink feature when the base::Feature is enabled,
+  // otherwise no change.
+  kEnableOnly,
+  // Disables the Blink feature when the base::Feature is *disabled*,
+  // otherwise no change.
+  kDisableOnly,
+};
+
+template <typename T>
+// Helper class that describes the desired actions for the runtime feature
+// depending on a check for chromium base::Feature.
+struct RuntimeFeatureToChromiumFeatureMap {
+  // This can be either an enabler function defined in web_runtime_features.cc
+  // or the string name of the feature in runtime_enabled_features.json5.
+  T feature_enabler;
+  // The chromium base::Feature to check.
+  const base::Feature& chromium_feature;
+  const RuntimeFeatureEnableOptions option;
+};
+
+// Sets blink runtime features that are either directly
+// controlled by Chromium base::Feature or are overridden
+// by base::Feature states.
+void SetRuntimeFeaturesFromChromiumFeatures() {
+  using wf = WebRuntimeFeatures;
+  // To add a runtime feature control, add a new
+  // RuntimeFeatureToChromiumFeatureMap entry here if there is a custom
+  // enabler function defined. Otherwise add the entry with string name
+  // in the next list.
+  const RuntimeFeatureToChromiumFeatureMap<void (*)(bool)>
+      blinkFeatureToBaseFeatureMapping[] = {
+          // TODO(rodneyding): Sort features in alphabetical order
+          {wf::EnableWebUsb, features::kWebUsb, kDisableOnly},
+          {wf::EnableBlockingFocusWithoutUserActivation,
+           blink::features::kBlockingFocusWithoutUserActivation, kEnableOnly},
+          {wf::EnableNotificationContentImage,
+           features::kNotificationContentImage, kDisableOnly},
+          {wf::EnableReducedReferrerGranularity,
+           features::kReducedReferrerGranularity, kUseFeatureState},
+          {wf::EnablePeriodicBackgroundSync, features::kPeriodicBackgroundSync,
+           kEnableOnly},
+          {wf::EnableWebXR, features::kWebXr, kUseFeatureState},
+          {wf::EnableWebXRARDOMOverlay, features::kWebXrArDOMOverlay,
+           kEnableOnly},
+          {wf::EnableWebXRARModule, features::kWebXrArModule, kEnableOnly},
+          {wf::EnableWebXRHitTest, features::kWebXrHitTest, kEnableOnly},
+          {wf::EnableWebXRAnchors, features::kWebXrAnchors, kEnableOnly},
+          {wf::EnableWebXRPlaneDetection, features::kWebXrPlaneDetection,
+           kEnableOnly},
+          {wf::EnableWebXrGamepadModule, features::kWebXrGamepadModule,
+           kUseFeatureState},
+          {wf::EnableFetchMetadata, network::features::kFetchMetadata,
+           kUseFeatureState},
+          {wf::EnableFetchMetadataDestination,
+           network::features::kFetchMetadataDestination, kUseFeatureState},
+          {wf::EnableUserActivationPostMessageTransfer,
+           features::kUserActivationPostMessageTransfer, kUseFeatureState},
+          {wf::EnableUserActivationSameOriginVisibility,
+           features::kUserActivationSameOriginVisibility, kUseFeatureState},
+          {wf::EnableUserActivationV2, features::kUserActivationV2,
+           kUseFeatureState},
+          {wf::EnablePassiveDocumentEventListeners,
+           features::kPassiveDocumentEventListeners, kUseFeatureState},
+          {wf::EnablePassiveDocumentWheelEventListeners,
+           features::kPassiveDocumentWheelEventListeners, kUseFeatureState},
+          {wf::EnableExpensiveBackgroundTimerThrottling,
+           features::kExpensiveBackgroundTimerThrottling, kUseFeatureState},
+          {wf::EnableTimerThrottlingForHiddenFrames,
+           features::kTimerThrottlingForHiddenFrames, kUseFeatureState},
+          {wf::EnableSendBeaconThrowForBlobWithNonSimpleType,
+           features::kSendBeaconThrowForBlobWithNonSimpleType, kEnableOnly},
+          {wf::EnablePaymentRequest, features::kWebPayments, kUseFeatureState},
+          {wf::EnablePaymentApp, features::kServiceWorkerPaymentApps,
+           kEnableOnly},
+          {wf::EnableCompositorTouchAction, features::kCompositorTouchAction,
+           kEnableOnly},
+          {wf::EnableGenericSensorExtraClasses,
+           features::kGenericSensorExtraClasses, kEnableOnly},
+          {wf::EnableMediaCastOverlayButton, media::kMediaCastOverlayButton,
+           kUseFeatureState},
+          {wf::EnableBuiltInModuleAll, features::kBuiltInModuleAll,
+           kEnableOnly},
+          {wf::EnableBuiltInModuleInfra, features::kBuiltInModuleInfra,
+           kEnableOnly},
+          {wf::EnableBuiltInModuleKvStorage, features::kBuiltInModuleKvStorage,
+           kEnableOnly},
+          {wf::EnableLazyInitializeMediaControls,
+           features::kLazyInitializeMediaControls, kUseFeatureState},
+          {wf::EnableMediaEngagementBypassAutoplayPolicies,
+           media::kMediaEngagementBypassAutoplayPolicies, kUseFeatureState},
+          {wf::EnableOverflowIconsForMediaControls,
+           media::kOverflowIconsForMediaControls, kUseFeatureState},
+          {wf::EnableAllowActivationDelegationAttr,
+           features::kAllowActivationDelegationAttr, kUseFeatureState},
+          {wf::EnableScriptStreamingOnPreload,
+           features::kScriptStreamingOnPreload, kUseFeatureState},
+          {wf::EnableMergeBlockingNonBlockingPools,
+           base::kMergeBlockingNonBlockingPools, kUseFeatureState},
+          {wf::EnableLazyFrameLoading, features::kLazyFrameLoading,
+           kUseFeatureState},
+          {wf::EnableLazyFrameVisibleLoadTimeMetrics,
+           features::kLazyFrameVisibleLoadTimeMetrics, kUseFeatureState},
+          {wf::EnableLazyImageLoading, features::kLazyImageLoading,
+           kUseFeatureState},
+          {wf::EnableLazyImageVisibleLoadTimeMetrics,
+           features::kLazyImageVisibleLoadTimeMetrics, kUseFeatureState},
+          {wf::EnablePictureInPicture, media::kPictureInPicture,
+           kUseFeatureState},
+          {wf::EnableCacheInlineScriptCode, features::kCacheInlineScriptCode,
+           kUseFeatureState},
+          {wf::EnableWasmCodeCache, blink::features::kWasmCodeCache,
+           kUseFeatureState},
+          {wf::EnableExperimentalProductivityFeatures,
+           features::kExperimentalProductivityFeatures, kEnableOnly},
+          {wf::EnableFeaturePolicyForSandbox,
+           features::kFeaturePolicyForSandbox, kEnableOnly},
+          {wf::EnableAccessibilityExposeARIAAnnotations,
+           features::kEnableAccessibilityExposeARIAAnnotations,
+           kUseFeatureState},
+          {wf::EnableAccessibilityExposeDisplayNone,
+           features::kEnableAccessibilityExposeDisplayNone, kUseFeatureState},
+          {wf::EnableAllowSyncXHRInPageDismissal,
+           blink::features::kAllowSyncXHRInPageDismissal, kEnableOnly},
+          {wf::EnableAutoplayIgnoresWebAudio, media::kAutoplayIgnoreWebAudio,
+           kUseFeatureState},
+          {wf::EnablePortals, blink::features::kPortals, kUseFeatureState},
+          {wf::EnableImplicitRootScroller,
+           blink::features::kImplicitRootScroller, kUseFeatureState},
+          {wf::EnableCSSOMViewScrollCoordinates,
+           blink::features::kCSSOMViewScrollCoordinates, kEnableOnly},
+          {wf::EnableTextFragmentAnchor, blink::features::kTextFragmentAnchor,
+           kUseFeatureState},
+          {wf::EnableBackgroundFetch, features::kBackgroundFetch, kDisableOnly},
+          {wf::EnableUpdateHoverAtBeginFrame,
+           features::kUpdateHoverAtBeginFrame, kUseFeatureState},
+          {wf::EnableForcedColors, features::kForcedColors, kUseFeatureState},
+          {wf::EnableFractionalScrollOffsets,
+           features::kFractionalScrollOffsets, kUseFeatureState},
+          {wf::EnableGetDisplayMedia, blink::features::kRTCGetDisplayMedia,
+           kUseFeatureState},
+          {wf::EnableMimeHandlerViewInCrossProcessFrame,
+           features::kMimeHandlerViewInCrossProcessFrame, kUseFeatureState},
+          {wf::EnableFallbackCursorMode, features::kFallbackCursorMode,
+           kUseFeatureState},
+          {wf::EnableSignedExchangePrefetchCacheForNavigations,
+           features::kSignedExchangePrefetchCacheForNavigations,
+           kUseFeatureState},
+          {wf::EnableSignedExchangeSubresourcePrefetch,
+           features::kSignedExchangeSubresourcePrefetch, kUseFeatureState},
+          {wf::EnableIdleDetection, features::kIdleDetection, kDisableOnly},
+          {wf::EnableSkipTouchEventFilter, features::kSkipTouchEventFilter,
+           kUseFeatureState},
+          {wf::EnableSmsReceiver, features::kSmsReceiver, kDisableOnly},
+          {wf::EnableDisplayLocking, blink::features::kDisplayLocking,
+           kUseFeatureState},
+          {wf::EnableConsolidatedMovementXY, features::kConsolidatedMovementXY,
+           kUseFeatureState},
+          {wf::EnableCooperativeScheduling, features::kCooperativeScheduling,
+           kUseFeatureState},
+          {wf::EnableMouseSubframeNoImplicitCapture,
+           features::kMouseSubframeNoImplicitCapture, kUseFeatureState},
+          {wf::EnableBackForwardCache, features::kBackForwardCache,
+           kUseFeatureState},
+          {wf::EnableCookieDeprecationMessages,
+           features::kCookieDeprecationMessages, kEnableOnly},
+          {wf::EnableSameSiteByDefaultCookies,
+           net::features::kSameSiteByDefaultCookies, kEnableOnly},
+          {wf::EnableCookiesWithoutSameSiteMustBeSecure,
+           net::features::kCookiesWithoutSameSiteMustBeSecure, kEnableOnly},
+          {wf::EnablePointerLockOptions, features::kPointerLockOptions,
+           kEnableOnly},
+          {wf::EnableDocumentPolicy, features::kDocumentPolicy,
+           kUseFeatureState},
+      };
+  for (const auto& mapping : blinkFeatureToBaseFeatureMapping) {
+    const bool featureEnabled =
+        base::FeatureList::IsEnabled(mapping.chromium_feature);
+    switch (mapping.option) {
+      case kEnableOnly:
+        if (featureEnabled)
+          mapping.feature_enabler(true);
+        break;
+      case kDisableOnly:
+        if (!featureEnabled)
+          mapping.feature_enabler(false);
+        break;
+      case kUseFeatureState:
+        mapping.feature_enabler(featureEnabled);
+    }
+  }
 
-  WebRuntimeFeatures::EnableMergeBlockingNonBlockingPools(
-      base::FeatureList::IsEnabled(base::kMergeBlockingNonBlockingPools));
+  // TODO(crbug/832393): Cleanup the inconsistency between custom WRF enabler
+  // function and using feature string name with EnableFeatureFromString.
+  const RuntimeFeatureToChromiumFeatureMap<const char*>
+      runtimeFeatureNameToChromiumFeatureMapping[] = {
+          {"CSSBackdropFilter", blink::features::kCSSBackdropFilter,
+           kUseFeatureState},
+          {"FastBorderRadius", blink::features::kFastBorderRadius,
+           kUseFeatureState},
+          {"FontSrcLocalMatching", features::kFontSrcLocalMatching,
+           kUseFeatureState},
+          {"LegacyWindowsDWriteFontFallback",
+           features::kLegacyWindowsDWriteFontFallback, kUseFeatureState},
+          {"AddressSpace", network::features::kBlockNonSecureExternalRequests,
+           kEnableOnly},
+          {"BlockCredentialedSubresources",
+           features::kBlockCredentialedSubresources, kDisableOnly},
+          {"AllowContentInitiatedDataUrlNavigations",
+           features::kAllowContentInitiatedDataUrlNavigations,
+           kUseFeatureState},
+          {"LayoutNG", blink::features::kLayoutNG, kUseFeatureState},
+          {"UserAgentClientHint", features::kUserAgentClientHint, kEnableOnly},
+          {"AudioWorkletRealtimeThread",
+           blink::features::kAudioWorkletRealtimeThread, kEnableOnly},
+          {"TrustedDOMTypes", features::kTrustedDOMTypes, kEnableOnly},
+          {"IgnoreCrossOriginWindowWhenNamedAccessOnWindow",
+           blink::features::kIgnoreCrossOriginWindowWhenNamedAccessOnWindow,
+           kEnableOnly},
+          {"StorageAccessAPI", blink::features::kStorageAccessAPI, kEnableOnly},
+      };
+  for (const auto& mapping : runtimeFeatureNameToChromiumFeatureMapping) {
+    const bool featureEnabled =
+        base::FeatureList::IsEnabled(mapping.chromium_feature);
+    switch (mapping.option) {
+      case kEnableOnly:
+        if (featureEnabled)
+          wf::EnableFeatureFromString(mapping.feature_enabler, true);
+        break;
+      case kDisableOnly:
+        if (!featureEnabled)
+          wf::EnableFeatureFromString(mapping.feature_enabler, false);
+        break;
+      case kUseFeatureState:
+        wf::EnableFeatureFromString(mapping.feature_enabler, featureEnabled);
+    }
+  }
+}
 
-  WebRuntimeFeatures::EnableLazyFrameLoading(
-      base::FeatureList::IsEnabled(features::kLazyFrameLoading));
-  WebRuntimeFeatures::EnableLazyFrameVisibleLoadTimeMetrics(
-      base::FeatureList::IsEnabled(features::kLazyFrameVisibleLoadTimeMetrics));
-  WebRuntimeFeatures::EnableLazyImageLoading(
-      base::FeatureList::IsEnabled(features::kLazyImageLoading));
-  WebRuntimeFeatures::EnableLazyImageVisibleLoadTimeMetrics(
-      base::FeatureList::IsEnabled(features::kLazyImageVisibleLoadTimeMetrics));
+// Helper class that describes the desired enable/disable action
+// for a runtime feature when a command line switch exists.
+struct SwitchToFeatureMap {
+  // The enabler function defined in web_runtime_features.cc.
+  void (*feature_enabler)(bool);
+  // The switch to check for on command line.
+  const char* switch_name;
+  // This is the desired state for the runtime feature if the
+  // switch exists on command line.
+  bool target_enabled_state;
+};
+
+// Sets blink runtime features controlled by command line switches.
+void SetRuntimeFeaturesFromCommandLine(const base::CommandLine& command_line) {
+  // To add a new switch-controlled runtime feature, add a new
+  // SwitchToFeatureMap entry to the initializer list below.
+  // Note: command line switches are now discouraged, please consider
+  // using base::Feature instead.
+  // https://chromium.googlesource.com/chromium/src/+/refs/heads/master/docs/configuration.md#switches
+  using wrf = WebRuntimeFeatures;
+  const SwitchToFeatureMap switchToFeatureMapping[] = {
+      // Stable Features
+      {wrf::EnablePermissionsAPI, switches::kDisablePermissionsAPI, false},
+      {wrf::EnablePresentationAPI, switches::kDisablePresentationAPI, false},
+      {wrf::EnableRemotePlaybackAPI, switches::kDisableRemotePlaybackAPI,
+       false},
+      {wrf::EnableTimerThrottlingForBackgroundTabs,
+       switches::kDisableBackgroundTimerThrottling, false},
+      // End of Stable Features
+      {wrf::EnableDatabase, switches::kDisableDatabases, false},
+      {wrf::EnableNotifications, switches::kDisableNotifications, false},
+      // Chrome's Push Messaging implementation relies on Web Notifications.
+      {wrf::EnablePushMessaging, switches::kDisableNotifications, false},
+      {wrf::EnableSharedWorker, switches::kDisableSharedWorkers, false},
+      {wrf::EnableScriptedSpeechRecognition, switches::kDisableSpeechAPI,
+       false},
+      {wrf::EnableScriptedSpeechSynthesis, switches::kDisableSpeechAPI, false},
+      {wrf::EnableScriptedSpeechSynthesis, switches::kDisableSpeechSynthesisAPI,
+       false},
+      {wrf::EnableFileSystem, switches::kDisableFileSystem, false},
+      {wrf::EnableWebGLDraftExtensions, switches::kEnableWebGLDraftExtensions,
+       true},
+      {wrf::EnableAutomationControlled, switches::kEnableAutomation, true},
+      {wrf::EnableAutomationControlled, switches::kHeadless, true},
+      {wrf::EnableAutomationControlled, switches::kRemoteDebuggingPipe, true},
+      {wrf::EnableAutomationControlled, switches::kRemoteDebuggingPort, true},
+      {wrf::ForceOverlayFullscreenVideo, switches::kForceOverlayFullscreenVideo,
+       true},
+      {wrf::EnablePreciseMemoryInfo, switches::kEnablePreciseMemoryInfo, true},
+      {wrf::EnablePrintBrowser, switches::kEnablePrintBrowser, true},
+      {wrf::EnableNetInfoDownlinkMax,
+       switches::kEnableNetworkInformationDownlinkMax, true},
+      {wrf::EnablePermissionsAPI, switches::kDisablePermissionsAPI, false},
+      {wrf::EnableWebGPU, switches::kEnableUnsafeWebGPU, true},
+      {wrf::EnableWebVR, switches::kEnableWebVR, true},
+      {wrf::EnablePresentationAPI, switches::kDisablePresentationAPI, false},
+      {wrf::EnableRemotePlaybackAPI, switches::kDisableRemotePlaybackAPI,
+       false},
+      {wrf::EnableTimerThrottlingForBackgroundTabs,
+       switches::kDisableBackgroundTimerThrottling, false},
+      {wrf::EnableAccessibilityObjectModel,
+       switches::kEnableAccessibilityObjectModel, true},
+      {wrf::EnableAllowSyncXHRInPageDismissal,
+       switches::kAllowSyncXHRInPageDismissal, true},
+  };
+  for (const auto& mapping : switchToFeatureMapping) {
+    if (command_line.HasSwitch(mapping.switch_name))
+      mapping.feature_enabler(mapping.target_enabled_state);
+  }
+}
 
+// Sets blink runtime features controlled by FieldTrial parameter values.
+void SetRuntimeFeaturesFromFieldTrialParams() {
+  // Automatic lazy frame loading by default is enabled and restricted to users
+  // with Lite Mode (aka Data Saver) turned on. Note that in practice, this also
+  // restricts automatic lazy loading by default to Android, since Lite Mode is
+  // only accessible through UI on Android.
   WebRuntimeFeatures::EnableAutomaticLazyFrameLoading(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyFrameLoading, "automatic-lazy-load-frames-enabled",
-          false));
+          true));
   WebRuntimeFeatures::EnableRestrictAutomaticLazyFrameLoadingToDataSaver(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyFrameLoading,
@@ -399,10 +464,14 @@ void SetIndividualRuntimeFeatures(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyFrameLoading, "enable-lazy-load-on-reload", false));
 
+  // Automatic lazy image loading by default is enabled and restricted to users
+  // with Lite Mode (aka Data Saver) turned on. Note that in practice, this also
+  // restricts automatic lazy loading by default to Android, since Lite Mode is
+  // only accessible through UI on Android.
   WebRuntimeFeatures::EnableAutomaticLazyImageLoading(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyImageLoading, "automatic-lazy-load-images-enabled",
-          false));
+          true));
   WebRuntimeFeatures::EnableRestrictAutomaticLazyImageLoadingToDataSaver(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyImageLoading,
@@ -411,39 +480,41 @@ void SetIndividualRuntimeFeatures(
       base::GetFieldTrialParamByFeatureAsBool(
           features::kLazyImageLoading, "enable-lazy-load-images-metadata-fetch",
           false));
+}
 
-  WebRuntimeFeatures::EnablePictureInPicture(
-      base::FeatureList::IsEnabled(media::kPictureInPicture));
-
-#if defined(OS_ANDROID)
-  WebRuntimeFeatures::EnablePictureInPictureAPI(
-      base::FeatureList::IsEnabled(media::kPictureInPictureAPI));
-#endif
-
-  WebRuntimeFeatures::EnableCacheInlineScriptCode(
-      base::FeatureList::IsEnabled(features::kCacheInlineScriptCode));
-
-  WebRuntimeFeatures::EnableWasmCodeCache(
-      base::FeatureList::IsEnabled(blink::features::kWasmCodeCache));
+// Sets blink runtime features that depend on a combination
+// of args rather than a single check of base::Feature or switch.
+// This can be a combination of both or custom checking logic
+// not covered by other functions. In short, this should be used
+// as a last resort.
+void SetCustomizedRuntimeFeaturesFromCombinedArgs(
+    const base::CommandLine& command_line,
+    bool enable_experimental_web_platform_features) {
+  // CAUTION: Only add custom enabling logic here if it cannot
+  // be covered by the other functions.
 
-  if (base::FeatureList::IsEnabled(
-          features::kExperimentalProductivityFeatures)) {
-    WebRuntimeFeatures::EnableExperimentalProductivityFeatures(true);
+  if (!command_line.HasSwitch(switches::kDisableYUVImageDecoding) &&
+      base::FeatureList::IsEnabled(
+          blink::features::kDecodeJpeg420ImagesToYUV)) {
+    WebRuntimeFeatures::EnableDecodeJpeg420ImagesToYUV(true);
+  }
+  if (!command_line.HasSwitch(switches::kDisableYUVImageDecoding) &&
+      base::FeatureList::IsEnabled(
+          blink::features::kDecodeLossyWebPImagesToYUV)) {
+    WebRuntimeFeatures::EnableDecodeLossyWebPImagesToYUV(true);
   }
 
-  if (base::FeatureList::IsEnabled(features::kFeaturePolicyForSandbox))
-    WebRuntimeFeatures::EnableFeaturePolicyForSandbox(true);
+  WebRuntimeFeatures::EnableSharedArrayBuffer(
+      base::FeatureList::IsEnabled(features::kSharedArrayBuffer) ||
+      base::FeatureList::IsEnabled(features::kWebAssemblyThreads));
 
-#if defined(OS_ANDROID)
-  if (base::android::BuildInfo::GetInstance()->sdk_int() >=
-      base::android::SDK_VERSION_P) {
-    // Display Cutout is limited to Android P+.
-    WebRuntimeFeatures::EnableDisplayCutoutAPI(true);
-  }
-#endif
+  // These checks are custom wrappers around base::FeatureList::IsEnabled
+  // They're moved here to distinguish them from actual base checks
+  if (ui::IsOverlayScrollbarEnabled())
+    WebRuntimeFeatures::EnableOverlayScrollbars(true);
 
-  if (command_line.HasSwitch(switches::kEnableAccessibilityObjectModel))
-    WebRuntimeFeatures::EnableAccessibilityObjectModel(true);
+  WebRuntimeFeatures::EnableFormControlsRefresh(
+      features::IsFormControlsRefreshEnabled());
 
   if (base::FeatureList::GetInstance()->IsFeatureOverriddenFromCommandLine(
           blink::features::kNativeFileSystemAPI.name,
@@ -455,137 +526,26 @@ void SetIndividualRuntimeFeatures(
     WebRuntimeFeatures::EnableFeatureFromString("FileHandling", true);
   }
 
-  if (base::FeatureList::IsEnabled(
-          blink::features::kAllowSyncXHRInPageDismissal) ||
-      command_line.HasSwitch(switches::kAllowSyncXHRInPageDismissal)) {
-    WebRuntimeFeatures::EnableAllowSyncXHRInPageDismissal(true);
-  }
-
-  WebRuntimeFeatures::EnableAutoplayIgnoresWebAudio(
-      base::FeatureList::IsEnabled(media::kAutoplayIgnoreWebAudio));
-
-#if defined(OS_ANDROID)
-  WebRuntimeFeatures::EnableMediaControlsExpandGesture(
-      base::FeatureList::IsEnabled(media::kMediaControlsExpandGesture));
-#endif
-
-  WebRuntimeFeatures::EnablePortals(
-      base::FeatureList::IsEnabled(blink::features::kPortals));
-
-  WebRuntimeFeatures::EnableImplicitRootScroller(
-      base::FeatureList::IsEnabled(blink::features::kImplicitRootScroller));
-
-  WebRuntimeFeatures::EnableTextFragmentAnchor(
-      base::FeatureList::IsEnabled(blink::features::kTextFragmentAnchor));
-
-  if (!base::FeatureList::IsEnabled(features::kBackgroundFetch))
-    WebRuntimeFeatures::EnableBackgroundFetch(false);
-
-  WebRuntimeFeatures::EnableUpdateHoverAtBeginFrame(
-      base::FeatureList::IsEnabled(features::kUpdateHoverAtBeginFrame));
-
-  WebRuntimeFeatures::EnableFractionalScrollOffsets(
-      base::FeatureList::IsEnabled(features::kFractionalScrollOffsets));
-
-  WebRuntimeFeatures::EnableFirstContentfulPaintPlusPlus(
-      base::FeatureList::IsEnabled(
-          blink::features::kFirstContentfulPaintPlusPlus));
-
-  WebRuntimeFeatures::EnableGetDisplayMedia(
-      base::FeatureList::IsEnabled(blink::features::kRTCGetDisplayMedia));
-
-  WebRuntimeFeatures::EnableMimeHandlerViewInCrossProcessFrame(
-      base::FeatureList::IsEnabled(
-          features::kMimeHandlerViewInCrossProcessFrame));
-
-  WebRuntimeFeatures::EnableFallbackCursorMode(
-      base::FeatureList::IsEnabled(features::kFallbackCursorMode));
-
-  if (base::FeatureList::IsEnabled(features::kUserAgentClientHint))
-    WebRuntimeFeatures::EnableFeatureFromString("UserAgentClientHint", true);
-
-  WebRuntimeFeatures::EnableSignedExchangePrefetchCacheForNavigations(
-      base::FeatureList::IsEnabled(
-          features::kSignedExchangePrefetchCacheForNavigations));
-  WebRuntimeFeatures::EnableSignedExchangeSubresourcePrefetch(
-      base::FeatureList::IsEnabled(
-          features::kSignedExchangeSubresourcePrefetch));
-
-  if (!base::FeatureList::IsEnabled(features::kIdleDetection))
-    WebRuntimeFeatures::EnableIdleDetection(false);
-
-  WebRuntimeFeatures::EnableSkipTouchEventFilter(
-      base::FeatureList::IsEnabled(features::kSkipTouchEventFilter));
-
-  WebRuntimeFeatures::EnableStaleWhileRevalidate(
-      base::FeatureList::IsEnabled(features::kStaleWhileRevalidate));
-
-  if (!base::FeatureList::IsEnabled(features::kSmsReceiver))
-    WebRuntimeFeatures::EnableSmsReceiver(false);
-
-  WebRuntimeFeatures::EnableDisplayLocking(
-      base::FeatureList::IsEnabled(blink::features::kDisplayLocking) ||
-      enable_experimental_web_platform_features);
-
-  WebRuntimeFeatures::EnableFormControlsRefresh(
-      features::IsFormControlsRefreshEnabled());
-
-  if (base::FeatureList::IsEnabled(
-          blink::features::kAudioWorkletRealtimeThread)) {
-    WebRuntimeFeatures::EnableFeatureFromString("AudioWorkletRealtimeThread",
-                                                true);
-  }
-
-  if (!base::FeatureList::IsEnabled(
-          features::kPauseExecutionContextOnBackgroundFreeze)) {
-    WebRuntimeFeatures::EnablePauseExecutionContextOnBackgroundFreeze(false);
-  }
-
-  WebRuntimeFeatures::EnableConsolidatedMovementXY(
-      base::FeatureList::IsEnabled(features::kConsolidatedMovementXY));
-
-  WebRuntimeFeatures::EnableCooperativeScheduling(
-      base::FeatureList::IsEnabled(features::kCooperativeScheduling));
-
-  WebRuntimeFeatures::EnableStreamsNative(
-      base::FeatureList::IsEnabled(blink::features::kStreamsNative));
-
-  WebRuntimeFeatures::EnableMouseSubframeNoImplicitCapture(
-      base::FeatureList::IsEnabled(features::kMouseSubframeNoImplicitCapture));
-
-  if (base::FeatureList::IsEnabled(features::kTrustedDOMTypes))
-    WebRuntimeFeatures::EnableFeatureFromString("TrustedDOMTypes", true);
-
-  WebRuntimeFeatures::EnableBackForwardCache(
-      base::FeatureList::IsEnabled(features::kBackForwardCache));
-
-  if (base::FeatureList::IsEnabled(features::kCookieDeprecationMessages))
-    WebRuntimeFeatures::EnableCookieDeprecationMessages(true);
-
-  if (base::FeatureList::IsEnabled(net::features::kSameSiteByDefaultCookies))
-    WebRuntimeFeatures::EnableSameSiteByDefaultCookies(true);
-
-  if (base::FeatureList::IsEnabled(
-          net::features::kCookiesWithoutSameSiteMustBeSecure)) {
-    WebRuntimeFeatures::EnableCookiesWithoutSameSiteMustBeSecure(true);
-  }
-
-  if (base::FeatureList::IsEnabled(
-          blink::features::kIgnoreCrossOriginWindowWhenNamedAccessOnWindow)) {
-    WebRuntimeFeatures::EnableFeatureFromString(
-        "IgnoreCrossOriginWindowWhenNamedAccessOnWindow", true);
-  }
-
-  if (base::FeatureList::IsEnabled(blink::features::kStorageAccessAPI)) {
-    WebRuntimeFeatures::EnableFeatureFromString("StorageAccessAPI", true);
-  }
+  // TODO(rodneyding): This is a rare case for a stable feature
+  // Need to investigate more to determine whether to refactor it.
+  if (command_line.HasSwitch(switches::kDisableV8IdleTasks))
+    WebRuntimeFeatures::EnableV8IdleTasks(false);
+  else
+    WebRuntimeFeatures::EnableV8IdleTasks(true);
 
-  if (base::FeatureList::IsEnabled(features::kPointerLockOptions)) {
-    WebRuntimeFeatures::EnablePointerLockOptions(true);
+  // This is a hack to get the tests passing as they require
+  // these blink features to be enabled while they are disabled
+  // by base::Feature controls earlier in code.
+  // TODO(rodneyding): Investigate more on proper treatments of
+  // these features.
+  if (enable_experimental_web_platform_features) {
+    WebRuntimeFeatures::EnableNetInfoDownlinkMax(true);
+    WebRuntimeFeatures::EnableFetchMetadata(true);
+    WebRuntimeFeatures::EnableFetchMetadataDestination(true);
+    WebRuntimeFeatures::EnableFeatureFromString("CSSBackdropFilter", true);
+    WebRuntimeFeatures::EnableFeatureFromString("FastBorderRadius", true);
+    WebRuntimeFeatures::EnableDisplayLocking(true);
   }
-
-  WebRuntimeFeatures::EnableDocumentPolicy(
-      base::FeatureList::IsEnabled(features::kDocumentPolicy));
 }
 
 }  // namespace
@@ -594,24 +554,37 @@ namespace content {
 
 void SetRuntimeFeaturesDefaultsAndUpdateFromArgs(
     const base::CommandLine& command_line) {
-  // Set experimental features
+  // Sets experimental features.
   bool enable_experimental_web_platform_features =
       command_line.HasSwitch(switches::kEnableExperimentalWebPlatformFeatures);
   if (enable_experimental_web_platform_features)
     WebRuntimeFeatures::EnableExperimentalFeatures(true);
 
-  SetRuntimeFeatureDefaultsForPlatform();
+  SetRuntimeFeatureDefaultsForPlatform(command_line);
 
-  // Set origin trial features
+  // Sets origin trial features.
   if (command_line.HasSwitch(
           switches::kDisableOriginTrialControlledBlinkFeatures)) {
     WebRuntimeFeatures::EnableOriginTrialControlledFeatures(false);
   }
 
-  // TODO(yashard): Remove |enable_experimental_web_platform_features|
-  // flag since no individual feature should need it
-  SetIndividualRuntimeFeatures(command_line,
-                               enable_experimental_web_platform_features);
+  if (!command_line.HasSwitch(
+          network::switches::kForceToDisableOutOfBlinkCors) &&
+      base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors)) {
+    WebRuntimeFeatures::EnableOutOfBlinkCors(true);
+  }
+
+  // TODO(rodneyding): add doc explaining ways to add new runtime features
+  // controls in the following functions.
+
+  SetRuntimeFeaturesFromChromiumFeatures();
+
+  SetRuntimeFeaturesFromCommandLine(command_line);
+
+  SetRuntimeFeaturesFromFieldTrialParams();
+
+  SetCustomizedRuntimeFeaturesFromCombinedArgs(
+      command_line, enable_experimental_web_platform_features);
 
   // Enable explicitly enabled features, and then disable explicitly disabled
   // ones.
diff --git a/chromium/content/child/webthemeengine_impl_android.cc b/chromium/content/child/webthemeengine_impl_android.cc
index e818c14ad82..2e703d631d4 100644
--- a/chromium/content/child/webthemeengine_impl_android.cc
+++ b/chromium/content/child/webthemeengine_impl_android.cc
@@ -227,4 +227,13 @@ void WebThemeEngineAndroid::Paint(
       canvas, NativeThemePart(part), NativeThemeState(state), gfx::Rect(rect),
       native_theme_extra_params, NativeColorScheme(color_scheme));
 }
+
+blink::ForcedColors WebThemeEngineAndroid::ForcedColors() const {
+  return forced_colors_;
+}
+
+void WebThemeEngineAndroid::SetForcedColors(
+    const blink::ForcedColors forced_colors) {
+  forced_colors_ = forced_colors;
+}
 }  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_android.h b/chromium/content/child/webthemeengine_impl_android.h
index df0a40b78ba..7387bce1ab5 100644
--- a/chromium/content/child/webthemeengine_impl_android.h
+++ b/chromium/content/child/webthemeengine_impl_android.h
@@ -22,6 +22,11 @@ class WebThemeEngineAndroid : public blink::WebThemeEngine {
              const blink::WebRect& rect,
              const blink::WebThemeEngine::ExtraParams* extra_params,
              blink::WebColorScheme color_scheme) override;
+  blink::ForcedColors ForcedColors() const override;
+  void SetForcedColors(const blink::ForcedColors forced_colors) override;
+
+ private:
+  blink::ForcedColors forced_colors_ = blink::ForcedColors::kNone;
 };
 
 }  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_conversions.cc b/chromium/content/child/webthemeengine_impl_conversions.cc
new file mode 100644
index 00000000000..db004c1da0c
--- /dev/null
+++ b/chromium/content/child/webthemeengine_impl_conversions.cc
@@ -0,0 +1,120 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/webthemeengine_impl_conversions.h"
+
+namespace content {
+
+// TODO(https://crbug.com/988434): The mapping functions below are duplicated
+// inside Blink and in the Android implementation of WebThemeEngine. They should
+// be implemented in one place where dependencies between Blink and
+// ui::NativeTheme make sense.
+ui::NativeTheme::Part NativeThemePart(blink::WebThemeEngine::Part part) {
+  switch (part) {
+    case blink::WebThemeEngine::kPartScrollbarDownArrow:
+      return ui::NativeTheme::kScrollbarDownArrow;
+    case blink::WebThemeEngine::kPartScrollbarLeftArrow:
+      return ui::NativeTheme::kScrollbarLeftArrow;
+    case blink::WebThemeEngine::kPartScrollbarRightArrow:
+      return ui::NativeTheme::kScrollbarRightArrow;
+    case blink::WebThemeEngine::kPartScrollbarUpArrow:
+      return ui::NativeTheme::kScrollbarUpArrow;
+    case blink::WebThemeEngine::kPartScrollbarHorizontalThumb:
+      return ui::NativeTheme::kScrollbarHorizontalThumb;
+    case blink::WebThemeEngine::kPartScrollbarVerticalThumb:
+      return ui::NativeTheme::kScrollbarVerticalThumb;
+    case blink::WebThemeEngine::kPartScrollbarHorizontalTrack:
+      return ui::NativeTheme::kScrollbarHorizontalTrack;
+    case blink::WebThemeEngine::kPartScrollbarVerticalTrack:
+      return ui::NativeTheme::kScrollbarVerticalTrack;
+    case blink::WebThemeEngine::kPartScrollbarCorner:
+      return ui::NativeTheme::kScrollbarCorner;
+    case blink::WebThemeEngine::kPartCheckbox:
+      return ui::NativeTheme::kCheckbox;
+    case blink::WebThemeEngine::kPartRadio:
+      return ui::NativeTheme::kRadio;
+    case blink::WebThemeEngine::kPartButton:
+      return ui::NativeTheme::kPushButton;
+    case blink::WebThemeEngine::kPartTextField:
+      return ui::NativeTheme::kTextField;
+    case blink::WebThemeEngine::kPartMenuList:
+      return ui::NativeTheme::kMenuList;
+    case blink::WebThemeEngine::kPartSliderTrack:
+      return ui::NativeTheme::kSliderTrack;
+    case blink::WebThemeEngine::kPartSliderThumb:
+      return ui::NativeTheme::kSliderThumb;
+    case blink::WebThemeEngine::kPartInnerSpinButton:
+      return ui::NativeTheme::kInnerSpinButton;
+    case blink::WebThemeEngine::kPartProgressBar:
+      return ui::NativeTheme::kProgressBar;
+    default:
+      return ui::NativeTheme::kScrollbarDownArrow;
+  }
+}
+
+ui::NativeTheme::ScrollbarOverlayColorTheme
+NativeThemeScrollbarOverlayColorTheme(
+    blink::WebScrollbarOverlayColorTheme theme) {
+  switch (theme) {
+    case blink::WebScrollbarOverlayColorTheme::
+        kWebScrollbarOverlayColorThemeLight:
+      return ui::NativeTheme::ScrollbarOverlayColorThemeLight;
+    case blink::WebScrollbarOverlayColorTheme::
+        kWebScrollbarOverlayColorThemeDark:
+      return ui::NativeTheme::ScrollbarOverlayColorThemeDark;
+    default:
+      return ui::NativeTheme::ScrollbarOverlayColorThemeDark;
+  }
+}
+
+ui::NativeTheme::State NativeThemeState(blink::WebThemeEngine::State state) {
+  switch (state) {
+    case blink::WebThemeEngine::kStateDisabled:
+      return ui::NativeTheme::kDisabled;
+    case blink::WebThemeEngine::kStateHover:
+      return ui::NativeTheme::kHovered;
+    case blink::WebThemeEngine::kStateNormal:
+      return ui::NativeTheme::kNormal;
+    case blink::WebThemeEngine::kStatePressed:
+      return ui::NativeTheme::kPressed;
+    default:
+      return ui::NativeTheme::kDisabled;
+  }
+}
+
+ui::NativeTheme::ColorScheme NativeColorScheme(
+    blink::WebColorScheme color_scheme) {
+  switch (color_scheme) {
+    case blink::WebColorScheme::kLight:
+      return ui::NativeTheme::ColorScheme::kLight;
+    case blink::WebColorScheme::kDark:
+      return ui::NativeTheme::ColorScheme::kDark;
+  }
+}
+
+ui::NativeTheme::SystemThemeColor NativeSystemThemeColor(
+    blink::WebThemeEngine::SystemThemeColor theme_color) {
+  switch (theme_color) {
+    case blink::WebThemeEngine::SystemThemeColor::kButtonFace:
+      return ui::NativeTheme::SystemThemeColor::kButtonFace;
+    case blink::WebThemeEngine::SystemThemeColor::kButtonText:
+      return ui::NativeTheme::SystemThemeColor::kButtonText;
+    case blink::WebThemeEngine::SystemThemeColor::kGrayText:
+      return ui::NativeTheme::SystemThemeColor::kGrayText;
+    case blink::WebThemeEngine::SystemThemeColor::kHighlight:
+      return ui::NativeTheme::SystemThemeColor::kHighlight;
+    case blink::WebThemeEngine::SystemThemeColor::kHighlightText:
+      return ui::NativeTheme::SystemThemeColor::kHighlightText;
+    case blink::WebThemeEngine::SystemThemeColor::kHotlight:
+      return ui::NativeTheme::SystemThemeColor::kHotlight;
+    case blink::WebThemeEngine::SystemThemeColor::kWindow:
+      return ui::NativeTheme::SystemThemeColor::kWindow;
+    case blink::WebThemeEngine::SystemThemeColor::kWindowText:
+      return ui::NativeTheme::SystemThemeColor::kWindowText;
+    default:
+      return ui::NativeTheme::SystemThemeColor::kNotSupported;
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_conversions.h b/chromium/content/child/webthemeengine_impl_conversions.h
new file mode 100644
index 00000000000..fdd2e5691cc
--- /dev/null
+++ b/chromium/content/child/webthemeengine_impl_conversions.h
@@ -0,0 +1,32 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_CHILD_WEBTHEMEENGINE_IMPL_CONVERSIONS_H_
+#define CONTENT_CHILD_WEBTHEMEENGINE_IMPL_CONVERSIONS_H_
+
+#include "content/child/webthemeengine_impl_default.h"
+#include "content/common/content_export.h"
+#include "ui/native_theme/native_theme.h"
+
+namespace content {
+
+CONTENT_EXPORT ui::NativeTheme::Part NativeThemePart(
+    blink::WebThemeEngine::Part part);
+
+CONTENT_EXPORT ui::NativeTheme::ScrollbarOverlayColorTheme
+NativeThemeScrollbarOverlayColorTheme(
+    blink::WebScrollbarOverlayColorTheme theme);
+
+CONTENT_EXPORT ui::NativeTheme::State NativeThemeState(
+    blink::WebThemeEngine::State state);
+
+CONTENT_EXPORT ui::NativeTheme::ColorScheme NativeColorScheme(
+    blink::WebColorScheme color_scheme);
+
+CONTENT_EXPORT ui::NativeTheme::SystemThemeColor NativeSystemThemeColor(
+    blink::WebThemeEngine::SystemThemeColor theme_color);
+
+}  // namespace content
+
+#endif  // CONTENT_CHILD_WEBTHEMEENGINE_IMPL_CONVERSIONS_H_
diff --git a/chromium/content/child/webthemeengine_impl_default.cc b/chromium/content/child/webthemeengine_impl_default.cc
index 35bb7549116..bf8bd544d8f 100644
--- a/chromium/content/child/webthemeengine_impl_default.cc
+++ b/chromium/content/child/webthemeengine_impl_default.cc
@@ -5,6 +5,7 @@
 #include "content/child/webthemeengine_impl_default.h"
 
 #include "build/build_config.h"
+#include "content/child/webthemeengine_impl_conversions.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_size.h"
@@ -35,92 +36,6 @@ int32_t g_horizontal_arrow_bitmap_width;
 
 }  // namespace
 
-// TODO(https://crbug.com/988434): The mapping functions below are duplicated
-// inside Blink and in the Android implementation of WebThemeEngine. They should
-// be implemented in one place where dependencies between Blink and
-// ui::NativeTheme make sense.
-static ui::NativeTheme::Part NativeThemePart(
-    WebThemeEngine::Part part) {
-  switch (part) {
-    case WebThemeEngine::kPartScrollbarDownArrow:
-      return ui::NativeTheme::kScrollbarDownArrow;
-    case WebThemeEngine::kPartScrollbarLeftArrow:
-      return ui::NativeTheme::kScrollbarLeftArrow;
-    case WebThemeEngine::kPartScrollbarRightArrow:
-      return ui::NativeTheme::kScrollbarRightArrow;
-    case WebThemeEngine::kPartScrollbarUpArrow:
-      return ui::NativeTheme::kScrollbarUpArrow;
-    case WebThemeEngine::kPartScrollbarHorizontalThumb:
-      return ui::NativeTheme::kScrollbarHorizontalThumb;
-    case WebThemeEngine::kPartScrollbarVerticalThumb:
-      return ui::NativeTheme::kScrollbarVerticalThumb;
-    case WebThemeEngine::kPartScrollbarHorizontalTrack:
-      return ui::NativeTheme::kScrollbarHorizontalTrack;
-    case WebThemeEngine::kPartScrollbarVerticalTrack:
-      return ui::NativeTheme::kScrollbarVerticalTrack;
-    case WebThemeEngine::kPartScrollbarCorner:
-      return ui::NativeTheme::kScrollbarCorner;
-    case WebThemeEngine::kPartCheckbox:
-      return ui::NativeTheme::kCheckbox;
-    case WebThemeEngine::kPartRadio:
-      return ui::NativeTheme::kRadio;
-    case WebThemeEngine::kPartButton:
-      return ui::NativeTheme::kPushButton;
-    case WebThemeEngine::kPartTextField:
-      return ui::NativeTheme::kTextField;
-    case WebThemeEngine::kPartMenuList:
-      return ui::NativeTheme::kMenuList;
-    case WebThemeEngine::kPartSliderTrack:
-      return ui::NativeTheme::kSliderTrack;
-    case WebThemeEngine::kPartSliderThumb:
-      return ui::NativeTheme::kSliderThumb;
-    case WebThemeEngine::kPartInnerSpinButton:
-      return ui::NativeTheme::kInnerSpinButton;
-    case WebThemeEngine::kPartProgressBar:
-      return ui::NativeTheme::kProgressBar;
-    default:
-      return ui::NativeTheme::kScrollbarDownArrow;
-  }
-}
-
-static ui::NativeTheme::ScrollbarOverlayColorTheme
-NativeThemeScrollbarOverlayColorTheme(WebScrollbarOverlayColorTheme theme) {
-  switch (theme) {
-    case WebScrollbarOverlayColorTheme::kWebScrollbarOverlayColorThemeLight:
-      return ui::NativeTheme::ScrollbarOverlayColorThemeLight;
-    case WebScrollbarOverlayColorTheme::kWebScrollbarOverlayColorThemeDark:
-      return ui::NativeTheme::ScrollbarOverlayColorThemeDark;
-    default:
-      return ui::NativeTheme::ScrollbarOverlayColorThemeDark;
-  }
-}
-
-static ui::NativeTheme::State NativeThemeState(
-    WebThemeEngine::State state) {
-  switch (state) {
-    case WebThemeEngine::kStateDisabled:
-      return ui::NativeTheme::kDisabled;
-    case WebThemeEngine::kStateHover:
-      return ui::NativeTheme::kHovered;
-    case WebThemeEngine::kStateNormal:
-      return ui::NativeTheme::kNormal;
-    case WebThemeEngine::kStatePressed:
-      return ui::NativeTheme::kPressed;
-    default:
-      return ui::NativeTheme::kDisabled;
-  }
-}
-
-static ui::NativeTheme::ColorScheme NativeColorScheme(
-    WebColorScheme color_scheme) {
-  switch (color_scheme) {
-    case WebColorScheme::kLight:
-      return ui::NativeTheme::ColorScheme::kLight;
-    case WebColorScheme::kDark:
-      return ui::NativeTheme::ColorScheme::kDark;
-  }
-}
-
 static void GetNativeThemeExtraParams(
     WebThemeEngine::Part part,
     WebThemeEngine::State state,
@@ -132,6 +47,8 @@ static void GetNativeThemeExtraParams(
   switch (part) {
     case WebThemeEngine::kPartScrollbarHorizontalTrack:
     case WebThemeEngine::kPartScrollbarVerticalTrack:
+      native_theme_extra_params->scrollbar_track.is_upper =
+          extra_params->scrollbar_track.is_back;
       native_theme_extra_params->scrollbar_track.track_x =
           extra_params->scrollbar_track.track_x;
       native_theme_extra_params->scrollbar_track.track_y =
@@ -295,6 +212,12 @@ blink::WebRect WebThemeEngineDefault::NinePatchAperture(Part part) const {
       NativeThemePart(part));
 }
 
+base::Optional<SkColor> WebThemeEngineDefault::GetSystemColor(
+    blink::WebThemeEngine::SystemThemeColor system_theme_color) const {
+  return ui::NativeTheme::GetInstanceForWeb()->GetSystemColorFromMap(
+      NativeSystemThemeColor(system_theme_color));
+}
+
 #if defined(OS_WIN)
 // static
 void WebThemeEngineDefault::cacheScrollBarMetrics(
@@ -309,4 +232,16 @@ void WebThemeEngineDefault::cacheScrollBarMetrics(
 }
 #endif
 
+blink::ForcedColors WebThemeEngineDefault::ForcedColors() const {
+  return ui::NativeTheme::GetInstanceForWeb()->UsesHighContrastColors()
+             ? blink::ForcedColors::kActive
+             : blink::ForcedColors::kNone;
+}
+
+void WebThemeEngineDefault::SetForcedColors(
+    const blink::ForcedColors forced_colors) {
+  ui::NativeTheme::GetInstanceForWeb()->set_high_contrast(
+      forced_colors == blink::ForcedColors::kActive);
+}
+
 }  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_default.h b/chromium/content/child/webthemeengine_impl_default.h
index 180f15c6a94..181223b8856 100644
--- a/chromium/content/child/webthemeengine_impl_default.h
+++ b/chromium/content/child/webthemeengine_impl_default.h
@@ -28,6 +28,8 @@ class WebThemeEngineDefault : public blink::WebThemeEngine {
   bool SupportsNinePatch(Part part) const override;
   blink::WebSize NinePatchCanvasSize(Part part) const override;
   blink::WebRect NinePatchAperture(Part part) const override;
+  base::Optional<SkColor> GetSystemColor(blink::WebThemeEngine::SystemThemeColor
+                                             system_theme_color) const override;
 #if defined(OS_WIN)
   // Caches the scrollbar metrics. These are retrieved in the browser and passed
   // to the renderer in blink::mojom::RendererPreferences because the required
@@ -37,6 +39,8 @@ class WebThemeEngineDefault : public blink::WebThemeEngine {
                                     int32_t vertical_arrow_bitmap_height,
                                     int32_t horizontal_arrow_bitmap_width);
 #endif
+  blink::ForcedColors ForcedColors() const override;
+  void SetForcedColors(const blink::ForcedColors forced_colors) override;
 };
 
 }  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_default_browsertest.cc b/chromium/content/child/webthemeengine_impl_default_browsertest.cc
new file mode 100644
index 00000000000..0430bbc0af8
--- /dev/null
+++ b/chromium/content/child/webthemeengine_impl_default_browsertest.cc
@@ -0,0 +1,142 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "build/build_config.h"
+#include "content/public/test/content_browser_test.h"
+#include "content/public/test/content_browser_test_utils.h"
+
+#if defined(OS_WIN)
+#include "base/win/windows_version.h"
+#endif  // defined (OS_WIN)
+
+namespace content {
+
+class WebThemeEngineImplDefaultBrowserTest : public ContentBrowserTest {
+ public:
+  WebThemeEngineImplDefaultBrowserTest() {}
+};
+
+#if defined(OS_WIN)
+IN_PROC_BROWSER_TEST_F(WebThemeEngineImplDefaultBrowserTest, GetSystemColor) {
+  // The test non-deterministically fails on Windows-2008ServerR2 builders due
+  // to a difference in the default theme. As a result, only run the test on
+  // non-server versions.
+  if (base::win::OSInfo::GetInstance()->version_type() ==
+      base::win::VersionType::SUITE_SERVER) {
+    return;
+  }
+  GURL url(
+      "data:text/html,"
+      "<!doctype html><html>"
+      "<body>"
+      "<div id='activeBorder' style='color: ActiveBorder'>ActiveBorder</div>"
+      "<div id='activeCaption' style='color: ActiveCaption'>ActiveCaption</div>"
+      "<div id='appWorkspace' style='color: AppWorkspace'>AppWorkspace</div>"
+      "<div id='background' style='color: Background'>Background</div>"
+      "<div id='buttonFace' style='color: ButtonFace'>ButtonFace</div>"
+      "<div id='buttonHighlight' style='color: "
+      "ButtonHighlight'>ButtonHighlight</div>"
+      "<div id='buttonShadow' style='color: ButtonShadow'>ButtonShadow</div>"
+      "<div id='buttonText' style='color: ButtonText'>ButtonText</div>"
+      "<div id='captionText' style='color: CaptionText'>CaptionText</div>"
+      "<div id='grayText' style='color: GrayText'>GrayText</div>"
+      "<div id='highlight' style='color: Highlight'>Highlight</div>"
+      "<div id='highlightText' style='color: HighlightText'>HighlightText</div>"
+      "<div id='inactiveBorder' style='color: "
+      "InactiveBorder'>InactiveBorder</div>"
+      "<div id='inactiveCaption' style='color: "
+      "InactiveCaption'>InactiveCaption</div>"
+      "<div id='inactiveCaptionText' style='color: "
+      "InactiveCaptionText'>InactiveCaptionText</div>"
+      "<div id='infoBackground' style='color: "
+      "InfoBackground'>InfoBackground</div>"
+      "<div id='infoText' style='color: InfoText'>InfoText</div>"
+      "<div id='linkText' style='color: LinkText'>LinkText</div>"
+      "<div id='menu' style='color: Menu'>Menu</div>"
+      "<div id='menuText' style='color: MenuText'>MenuText</div>"
+      "<div id='scrollbar' style='color: Scrollbar'>Scrollbar</div>"
+      "<div id='threeDDarkShadow' style='color: "
+      "ThreeDDarkShadow'>ThreeDDarkShadow</div>"
+      "<div id='threeDFace' style='color: ThreeDFace'>ThreeDFace</div>"
+      "<div id='threeDHighlight' style='color: "
+      "ThreeDHighlight'>ThreeDHighlight</div>"
+      "<div id='threeDLightShadow' style='color: "
+      "ThreeDLightShadow'>ThreeDLightShadow</div>"
+      "<div id='threeDShadow' style='color: ThreeDShadow'>ThreeDShadow</div>"
+      "<div id='visitedText' style='color: VisitedText'>VisitedText</div>"
+      "<div id='window' style='color: Window'>Window</div>"
+      "<div id='windowFrame' style='color: WindowFrame'>WindowFrame</div>"
+      "<div id='windowText' style='color: WindowText'>WindowText</div>"
+      "</body></html>");
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  std::vector<std::string> ids = {"activeBorder",
+                                  "activeCaption",
+                                  "appWorkspace",
+                                  "background",
+                                  "buttonFace",
+                                  "buttonHighlight",
+                                  "buttonShadow",
+                                  "buttonText",
+                                  "captionText",
+                                  "grayText",
+                                  "highlight",
+                                  "highlightText",
+                                  "inactiveBorder",
+                                  "inactiveCaption",
+                                  "inactiveCaptionText",
+                                  "infoBackground",
+                                  "infoText",
+                                  "linkText",
+                                  "menu",
+                                  "menuText",
+                                  "scrollbar",
+                                  "threeDDarkShadow",
+                                  "threeDFace",
+                                  "threeDHighlight",
+                                  "threeDLightShadow",
+                                  "threeDShadow",
+                                  "visitedText",
+                                  "window",
+                                  "windowFrame",
+                                  "windowText"};
+  std::vector<std::string> expected_colors;
+  if (base::win::GetVersion() <= base::win::Version::WIN8_1) {
+    expected_colors = {
+        "rgb(255, 255, 255)", "rgb(204, 204, 204)", "rgb(255, 255, 255)",
+        "rgb(99, 99, 206)",   "rgb(240, 240, 240)", "rgb(221, 221, 221)",
+        "rgb(136, 136, 136)", "rgb(0, 0, 0)",       "rgb(0, 0, 0)",
+        "rgb(109, 109, 109)", "rgb(51, 153, 255)",  "rgb(255, 255, 255)",
+        "rgb(255, 255, 255)", "rgb(255, 255, 255)", "rgb(127, 127, 127)",
+        "rgb(251, 252, 197)", "rgb(0, 0, 0)",       "rgb(0, 102, 204)",
+        "rgb(247, 247, 247)", "rgb(0, 0, 0)",       "rgb(255, 255, 255)",
+        "rgb(102, 102, 102)", "rgb(192, 192, 192)", "rgb(221, 221, 221)",
+        "rgb(192, 192, 192)", "rgb(136, 136, 136)", "rgb(0, 102, 204)",
+        "rgb(255, 255, 255)", "rgb(204, 204, 204)", "rgb(0, 0, 0)"};
+  } else {
+    expected_colors = {
+        "rgb(255, 255, 255)", "rgb(204, 204, 204)", "rgb(255, 255, 255)",
+        "rgb(99, 99, 206)",   "rgb(240, 240, 240)", "rgb(221, 221, 221)",
+        "rgb(136, 136, 136)", "rgb(0, 0, 0)",       "rgb(0, 0, 0)",
+        "rgb(109, 109, 109)", "rgb(0, 120, 215)",   "rgb(255, 255, 255)",
+        "rgb(255, 255, 255)", "rgb(255, 255, 255)", "rgb(127, 127, 127)",
+        "rgb(251, 252, 197)", "rgb(0, 0, 0)",       "rgb(0, 102, 204)",
+        "rgb(247, 247, 247)", "rgb(0, 0, 0)",       "rgb(255, 255, 255)",
+        "rgb(102, 102, 102)", "rgb(192, 192, 192)", "rgb(221, 221, 221)",
+        "rgb(192, 192, 192)", "rgb(136, 136, 136)", "rgb(0, 102, 204)",
+        "rgb(255, 255, 255)", "rgb(204, 204, 204)", "rgb(0, 0, 0)"};
+  }
+
+  ASSERT_EQ(ids.size(), expected_colors.size());
+
+  for (size_t i = 0; i < ids.size(); i++) {
+    EXPECT_EQ(expected_colors[i],
+              EvalJs(shell(),
+                     "window.getComputedStyle(document.getElementById('" +
+                         ids[i] + "')).getPropertyValue('color').toString()"));
+  }
+}
+#endif  // defined(OS_WIN)
+
+}  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_mac.cc b/chromium/content/child/webthemeengine_impl_mac.cc
new file mode 100644
index 00000000000..9cb279efffd
--- /dev/null
+++ b/chromium/content/child/webthemeengine_impl_mac.cc
@@ -0,0 +1,17 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/webthemeengine_impl_mac.h"
+
+namespace content {
+
+blink::ForcedColors WebThemeEngineMac::ForcedColors() const {
+  return forced_colors_;
+}
+
+void WebThemeEngineMac::SetForcedColors(
+    const blink::ForcedColors forced_colors) {
+  forced_colors_ = forced_colors;
+}
+}  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_mac.h b/chromium/content/child/webthemeengine_impl_mac.h
index 29e31609233..d4c4075f059 100644
--- a/chromium/content/child/webthemeengine_impl_mac.h
+++ b/chromium/content/child/webthemeengine_impl_mac.h
@@ -12,6 +12,12 @@ namespace content {
 class WebThemeEngineMac : public blink::WebThemeEngine {
  public:
   ~WebThemeEngineMac() override {}
+
+  blink::ForcedColors ForcedColors() const override;
+  void SetForcedColors(const blink::ForcedColors forced_colors) override;
+
+ private:
+  blink::ForcedColors forced_colors_ = blink::ForcedColors::kNone;
 };
 
 }  // namespace content
diff --git a/chromium/content/child/webthemeengine_impl_unittest.cc b/chromium/content/child/webthemeengine_impl_unittest.cc
new file mode 100644
index 00000000000..755ac9f5aab
--- /dev/null
+++ b/chromium/content/child/webthemeengine_impl_unittest.cc
@@ -0,0 +1,126 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/child/webthemeengine_impl_conversions.h"
+
+#include <vector>
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/platform/web_theme_engine.h"
+
+namespace content {
+
+TEST(WebThemeEngineTest, NativeSystemThemeColor) {
+  std::vector<blink::WebThemeEngine::SystemThemeColor> blink_inputs = {
+      blink::WebThemeEngine::SystemThemeColor::kButtonFace,
+      blink::WebThemeEngine::SystemThemeColor::kButtonText,
+      blink::WebThemeEngine::SystemThemeColor::kGrayText,
+      blink::WebThemeEngine::SystemThemeColor::kHighlight,
+      blink::WebThemeEngine::SystemThemeColor::kHighlightText,
+      blink::WebThemeEngine::SystemThemeColor::kHotlight,
+      blink::WebThemeEngine::SystemThemeColor::kWindow,
+      blink::WebThemeEngine::SystemThemeColor::kWindowText};
+
+  std::vector<ui::NativeTheme::SystemThemeColor> native_theme_outputs = {
+      ui::NativeTheme::SystemThemeColor::kButtonFace,
+      ui::NativeTheme::SystemThemeColor::kButtonText,
+      ui::NativeTheme::SystemThemeColor::kGrayText,
+      ui::NativeTheme::SystemThemeColor::kHighlight,
+      ui::NativeTheme::SystemThemeColor::kHighlightText,
+      ui::NativeTheme::SystemThemeColor::kHotlight,
+      ui::NativeTheme::SystemThemeColor::kWindow,
+      ui::NativeTheme::SystemThemeColor::kWindowText};
+
+  for (size_t i = 0; i < blink_inputs.size(); ++i)
+    EXPECT_EQ(NativeSystemThemeColor(blink_inputs[i]), native_theme_outputs[i]);
+}
+
+TEST(WebThemeEngineTest, NativeSystemThemePart) {
+  std::vector<blink::WebThemeEngine::Part> blink_inputs = {
+      blink::WebThemeEngine::kPartScrollbarDownArrow,
+      blink::WebThemeEngine::kPartScrollbarLeftArrow,
+      blink::WebThemeEngine::kPartScrollbarRightArrow,
+      blink::WebThemeEngine::kPartScrollbarUpArrow,
+      blink::WebThemeEngine::kPartScrollbarHorizontalThumb,
+      blink::WebThemeEngine::kPartScrollbarVerticalThumb,
+      blink::WebThemeEngine::kPartScrollbarHorizontalTrack,
+      blink::WebThemeEngine::kPartScrollbarVerticalTrack,
+      blink::WebThemeEngine::kPartScrollbarCorner,
+      blink::WebThemeEngine::kPartCheckbox,
+      blink::WebThemeEngine::kPartRadio,
+      blink::WebThemeEngine::kPartButton,
+      blink::WebThemeEngine::kPartTextField,
+      blink::WebThemeEngine::kPartMenuList,
+      blink::WebThemeEngine::kPartSliderTrack,
+      blink::WebThemeEngine::kPartSliderThumb,
+      blink::WebThemeEngine::kPartInnerSpinButton,
+      blink::WebThemeEngine::kPartProgressBar};
+
+  std::vector<ui::NativeTheme::Part> native_theme_outputs = {
+      ui::NativeTheme::kScrollbarDownArrow,
+      ui::NativeTheme::kScrollbarLeftArrow,
+      ui::NativeTheme::kScrollbarRightArrow,
+      ui::NativeTheme::kScrollbarUpArrow,
+      ui::NativeTheme::kScrollbarHorizontalThumb,
+      ui::NativeTheme::kScrollbarVerticalThumb,
+      ui::NativeTheme::kScrollbarHorizontalTrack,
+      ui::NativeTheme::kScrollbarVerticalTrack,
+      ui::NativeTheme::kScrollbarCorner,
+      ui::NativeTheme::kCheckbox,
+      ui::NativeTheme::kRadio,
+      ui::NativeTheme::kPushButton,
+      ui::NativeTheme::kTextField,
+      ui::NativeTheme::kMenuList,
+      ui::NativeTheme::kSliderTrack,
+      ui::NativeTheme::kSliderThumb,
+      ui::NativeTheme::kInnerSpinButton,
+      ui::NativeTheme::kProgressBar};
+
+  for (size_t i = 0; i < blink_inputs.size(); ++i)
+    EXPECT_EQ(NativeThemePart(blink_inputs[i]), native_theme_outputs[i]);
+}
+
+TEST(WebThemeEngineTest, NativeSystemThemeState) {
+  std::vector<blink::WebThemeEngine::State> blink_inputs = {
+      blink::WebThemeEngine::kStateDisabled,
+      blink::WebThemeEngine::kStateHover,
+      blink::WebThemeEngine::kStateNormal,
+      blink::WebThemeEngine::kStatePressed,
+  };
+
+  std::vector<ui::NativeTheme::State> native_theme_outputs = {
+      ui::NativeTheme::kDisabled, ui::NativeTheme::kHovered,
+      ui::NativeTheme::kNormal, ui::NativeTheme::kPressed};
+
+  for (size_t i = 0; i < blink_inputs.size(); ++i)
+    EXPECT_EQ(NativeThemeState(blink_inputs[i]), native_theme_outputs[i]);
+}
+
+TEST(WebThemeEngineTest, NativeColorScheme) {
+  std::vector<blink::WebColorScheme> blink_inputs = {
+      blink::WebColorScheme::kLight, blink::WebColorScheme::kDark};
+
+  std::vector<ui::NativeTheme::ColorScheme> native_theme_outputs = {
+      ui::NativeTheme::ColorScheme::kLight,
+      ui::NativeTheme::ColorScheme::kDark};
+
+  for (size_t i = 0; i < blink_inputs.size(); ++i)
+    EXPECT_EQ(NativeColorScheme(blink_inputs[i]), native_theme_outputs[i]);
+}
+
+TEST(WebThemeEngineTest, NativeThemeScrollbarOverlayColorTheme) {
+  std::vector<blink::WebScrollbarOverlayColorTheme> blink_inputs = {
+      blink::WebScrollbarOverlayColorTheme::kWebScrollbarOverlayColorThemeLight,
+      blink::WebScrollbarOverlayColorTheme::kWebScrollbarOverlayColorThemeDark};
+
+  std::vector<ui::NativeTheme::ScrollbarOverlayColorTheme>
+      native_theme_outputs = {ui::NativeTheme::ScrollbarOverlayColorThemeLight,
+                              ui::NativeTheme::ScrollbarOverlayColorThemeDark};
+
+  for (size_t i = 0; i < blink_inputs.size(); ++i) {
+    EXPECT_EQ(NativeThemeScrollbarOverlayColorTheme(blink_inputs[i]),
+              native_theme_outputs[i]);
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/common/BUILD.gn b/chromium/content/common/BUILD.gn
index fa7f26603b8..7070753ef72 100644
--- a/chromium/content/common/BUILD.gn
+++ b/chromium/content/common/BUILD.gn
@@ -24,6 +24,7 @@ buildflag_header("buildflags") {
   flags = [
     "USE_EXTERNAL_POPUP_MENU=$use_external_popup_menu",
     "ALLOW_CRITICAL_MEMORY_PRESSURE_HANDLING_IN_FOREGROUND=$allow_critical_memory_pressure_handling_in_foreground",
+    "ENABLE_SCREEN_CAPTURE=$enable_screen_capture",
   ]
 }
 
@@ -59,6 +60,9 @@ source_set("common") {
     "browser_plugin/browser_plugin_messages.h",
     "child_process_host_impl.cc",
     "child_process_host_impl.h",
+    "common_param_traits.cc",
+    "common_param_traits.h",
+    "common_param_traits_macros.h",
     "common_sandbox_support_linux.cc",
     "content_constants_internal.cc",
     "content_constants_internal.h",
@@ -177,10 +181,6 @@ source_set("common") {
     "media/cdm_info.cc",
     "media/media_player_delegate_messages.h",
     "media/peer_connection_tracker_messages.h",
-    "mime_sniffing_throttle.cc",
-    "mime_sniffing_throttle.h",
-    "mime_sniffing_url_loader.cc",
-    "mime_sniffing_url_loader.h",
     "navigation_gesture.h",
     "navigation_params.cc",
     "navigation_params.h",
@@ -192,7 +192,6 @@ source_set("common") {
     "page_messages.h",
     "page_state_serialization.cc",
     "page_state_serialization.h",
-    "page_zoom.cc",
     "pepper_file_util.cc",
     "pepper_file_util.h",
     "pepper_plugin_list.cc",
@@ -473,7 +472,6 @@ mojom("mojo_bindings") {
     "frame_proxy.mojom",
     "frame_sink_provider.mojom",
     "histogram_fetcher.mojom",
-    "host_zoom.mojom",
     "input/input_handler.mojom",
     "input/input_injector.mojom",
     "input/synchronous_compositor.mojom",
diff --git a/chromium/content/common/DEPS b/chromium/content/common/DEPS
index 6a18ca55af0..571d23646cb 100644
--- a/chromium/content/common/DEPS
+++ b/chromium/content/common/DEPS
@@ -47,7 +47,6 @@ include_rules = [
   "+third_party/blink/public/platform/web_scroll_into_view_params.h",
   "+third_party/blink/public/platform/web_scroll_types.h",
   "+third_party/blink/public/platform/web_storage_area.h",
-  "+third_party/blink/public/platform/web_sudden_termination_disabler_type.h",
   "+third_party/blink/public/platform/web_text_autosizer_page_info.h",
   "+third_party/blink/public/platform/web_touch_event.h",
   "+third_party/blink/public/platform/linux/web_fallback_font.h",
@@ -63,15 +62,12 @@ include_rules = [
   "+third_party/blink/public/web/web_device_emulation_params.h",
   "+third_party/blink/public/web/web_drag_status.h",
   "+third_party/blink/public/web/web_frame_owner_properties.h",
-  "+third_party/blink/public/web/web_fullscreen_options.h",
   "+third_party/blink/public/web/web_ime_text_span.h",
   "+third_party/blink/public/web/web_media_player_action.h",
-  "+third_party/blink/public/web/web_plugin_action.h",
   "+third_party/blink/public/web/WebSharedWorkerCreationContextType.h",
   "+third_party/blink/public/web/WebSharedWorkerCreationErrors.h",
   "+third_party/blink/public/web/web_text_direction.h",
   "+third_party/blink/public/web/web_tree_scope_type.h",
-  "+third_party/blink/public/web/web_triggering_event_info.h",
   "+third_party/blink/public/web/win/web_font_rendering.h",
 ]
 specific_include_rules = {
diff --git a/chromium/content/common/associated_interfaces.mojom b/chromium/content/common/associated_interfaces.mojom
index cc8bdcb3f3c..a890215ac40 100644
--- a/chromium/content/common/associated_interfaces.mojom
+++ b/chromium/content/common/associated_interfaces.mojom
@@ -10,5 +10,5 @@ import "third_party/blink/public/mojom/associated_interfaces/associated_interfac
 // ID to an AssociatedInterfaceProvider.
 interface RouteProvider {
   GetRoute(int32 routing_id,
-           associated blink.mojom.AssociatedInterfaceProvider& request);
+           pending_associated_receiver<blink.mojom.AssociatedInterfaceProvider> receiver);
 };
diff --git a/chromium/content/common/background_fetch/background_fetch_types.cc b/chromium/content/common/background_fetch/background_fetch_types.cc
index f5726e16a5b..3521948217c 100644
--- a/chromium/content/common/background_fetch/background_fetch_types.cc
+++ b/chromium/content/common/background_fetch/background_fetch_types.cc
@@ -4,16 +4,18 @@
 
 #include "content/common/background_fetch/background_fetch_types.h"
 
+#include "mojo/public/cpp/bindings/remote.h"
+
 namespace {
 
 blink::mojom::SerializedBlobPtr CloneSerializedBlob(
     const blink::mojom::SerializedBlobPtr& blob) {
   if (blob.is_null())
     return nullptr;
-  blink::mojom::BlobPtr blob_ptr(std::move(blob->blob));
-  blob_ptr->Clone(mojo::MakeRequest(&blob->blob));
-  return blink::mojom::SerializedBlob::New(
-      blob->uuid, blob->content_type, blob->size, blob_ptr.PassInterface());
+  mojo::Remote<blink::mojom::Blob> blob_remote(std::move(blob->blob));
+  blob_remote->Clone(blob->blob.InitWithNewPipeAndPassReceiver());
+  return blink::mojom::SerializedBlob::New(blob->uuid, blob->content_type,
+                                           blob->size, blob_remote.Unbind());
 }
 
 }  // namespace
@@ -33,7 +35,9 @@ blink::mojom::FetchAPIResponsePtr BackgroundFetchSettledFetch::CloneResponse(
       CloneSerializedBlob(response->blob), response->error,
       response->response_time, response->cache_storage_cache_name,
       response->cors_exposed_header_names,
-      CloneSerializedBlob(response->side_data_blob));
+      CloneSerializedBlob(response->side_data_blob),
+      CloneSerializedBlob(response->side_data_blob_for_cache_put),
+      response->content_security_policy.Clone());
 }
 
 // static
diff --git a/chromium/content/common/common_param_traits.cc b/chromium/content/common/common_param_traits.cc
new file mode 100644
index 00000000000..a2125ec45cd
--- /dev/null
+++ b/chromium/content/common/common_param_traits.cc
@@ -0,0 +1,27 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Get basic type definitions.
+#include "content/common/common_param_traits.h"
+
+// Generate param traits write methods.
+#include "ipc/param_traits_write_macros.h"
+namespace IPC {
+#undef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#include "content/common/common_param_traits_macros.h"
+}  // namespace IPC
+
+// Generate param traits read methods.
+#include "ipc/param_traits_read_macros.h"
+namespace IPC {
+#undef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#include "content/common/common_param_traits_macros.h"
+}  // namespace IPC
+
+// Generate param traits log methods.
+#include "ipc/param_traits_log_macros.h"
+namespace IPC {
+#undef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#include "content/common/common_param_traits_macros.h"
+}  // namespace IPC
diff --git a/chromium/content/common/common_param_traits.h b/chromium/content/common/common_param_traits.h
new file mode 100644
index 00000000000..d375a2a137a
--- /dev/null
+++ b/chromium/content/common/common_param_traits.h
@@ -0,0 +1,13 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_COMMON_COMMON_PARAM_TRAITS_H_
+#define CONTENT_COMMON_COMMON_PARAM_TRAITS_H_
+
+// This file provides declarations of IPC serialization macros that are used
+// in more than one IPC message file.
+
+#include "content/common/common_param_traits_macros.h"
+
+#endif  // CONTENT_COMMON_COMMON_PARAM_TRAITS_H_
diff --git a/chromium/content/common/common_param_traits_macros.h b/chromium/content/common/common_param_traits_macros.h
new file mode 100644
index 00000000000..7b3fc10afd6
--- /dev/null
+++ b/chromium/content/common/common_param_traits_macros.h
@@ -0,0 +1,54 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Singly or Multiply-included shared traits file depending on circumstances.
+// This allows the use of IPC serialization macros in more than one IPC message
+// file.
+#ifndef CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+#define CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
+
+#include "content/common/frame_messages.h"
+#include "content/common/visual_properties.h"
+#include "ipc/ipc_message_macros.h"
+#include "third_party/blink/public/web/web_device_emulation_params.h"
+
+#undef IPC_MESSAGE_EXPORT
+#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
+
+// Traits for VisualProperties.
+IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDeviceEmulationParams::ScreenPosition,
+                          blink::WebDeviceEmulationParams::kScreenPositionLast)
+
+IPC_ENUM_TRAITS_MAX_VALUE(content::ScreenOrientationValues,
+                          content::SCREEN_ORIENTATION_VALUES_LAST)
+
+IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationType,
+                              blink::kWebScreenOrientationUndefined,
+                              blink::WebScreenOrientationTypeLast)
+
+IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::DisplayMode,
+                          blink::mojom::DisplayMode::kMaxValue)
+
+IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
+  IPC_STRUCT_TRAITS_MEMBER(screen_info)
+  IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
+  IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
+  IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
+  IPC_STRUCT_TRAITS_MEMBER(new_size)
+  IPC_STRUCT_TRAITS_MEMBER(compositor_viewport_pixel_rect)
+  IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
+  IPC_STRUCT_TRAITS_MEMBER(scroll_focused_node_into_view)
+  IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
+  IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
+  IPC_STRUCT_TRAITS_MEMBER(local_surface_id_allocation)
+  IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
+  IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
+  IPC_STRUCT_TRAITS_MEMBER(display_mode)
+  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
+  IPC_STRUCT_TRAITS_MEMBER(zoom_level)
+  IPC_STRUCT_TRAITS_MEMBER(page_scale_factor)
+  IPC_STRUCT_TRAITS_MEMBER(is_pinch_gesture_active)
+IPC_STRUCT_TRAITS_END()
+
+#endif  // CONTENT_COMMON_COMMON_PARAM_TRAITS_MACROS_H_
diff --git a/chromium/content/common/content_param_traits.cc b/chromium/content/common/content_param_traits.cc
index 7a5c824a3c0..7487aa02656 100644
--- a/chromium/content/common/content_param_traits.cc
+++ b/chromium/content/common/content_param_traits.cc
@@ -17,10 +17,12 @@
 #include "content/common/tab_switch_time_recorder.h"
 #include "ipc/ipc_mojo_message_helper.h"
 #include "ipc/ipc_mojo_param_traits.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/ip_endpoint.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
+#include "third_party/blink/public/mojom/feature_policy/policy_value.mojom.h"
 #include "third_party/blink/public/mojom/messaging/transferable_message.mojom.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/events/blink/web_input_event_traits.h"
@@ -223,7 +225,7 @@ struct ParamTraits<blink::mojom::SerializedBlobPtr> {
     WriteParam(m, p->uuid);
     WriteParam(m, p->content_type);
     WriteParam(m, p->size);
-    WriteParam(m, p->blob.PassHandle().release());
+    WriteParam(m, p->blob.PassPipe().release());
   }
 
   static bool Read(const base::Pickle* m,
@@ -236,7 +238,7 @@ struct ParamTraits<blink::mojom::SerializedBlobPtr> {
         !ReadParam(m, iter, &(*r)->size) || !ReadParam(m, iter, &handle)) {
       return false;
     }
-    (*r)->blob = blink::mojom::BlobPtrInfo(
+    (*r)->blob = mojo::PendingRemote<blink::mojom::Blob>(
         mojo::ScopedMessagePipeHandle(handle), blink::mojom::Blob::Version_);
     return true;
   }
@@ -250,6 +252,7 @@ void ParamTraits<scoped_refptr<base::RefCountedData<
   WriteParam(m, p->data.stack_trace_id);
   WriteParam(m, p->data.stack_trace_debugger_id_first);
   WriteParam(m, p->data.stack_trace_debugger_id_second);
+  WriteParam(m, p->data.stack_trace_should_pause);
   WriteParam(m, p->data.ports);
   WriteParam(m, p->data.stream_channels);
   WriteParam(m, !!p->data.user_activation);
@@ -282,6 +285,7 @@ bool ParamTraits<
       !ReadParam(m, iter, &(*r)->data.stack_trace_id) ||
       !ReadParam(m, iter, &(*r)->data.stack_trace_debugger_id_first) ||
       !ReadParam(m, iter, &(*r)->data.stack_trace_debugger_id_second) ||
+      !ReadParam(m, iter, &(*r)->data.stack_trace_should_pause) ||
       !ReadParam(m, iter, &(*r)->data.ports) ||
       !ReadParam(m, iter, &(*r)->data.stream_channels) ||
       !ReadParam(m, iter, &has_activation) ||
diff --git a/chromium/content/common/content_security_policy/csp_source.cc b/chromium/content/common/content_security_policy/csp_source.cc
index f941a24d864..56166305223 100644
--- a/chromium/content/common/content_security_policy/csp_source.cc
+++ b/chromium/content/common/content_security_policy/csp_source.cc
@@ -9,6 +9,7 @@
 #include "base/strings/string_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/common/content_security_policy/csp_context.h"
+#include "services/network/public/mojom/content_security_policy.mojom.h"
 #include "url/url_canon.h"
 #include "url/url_util.h"
 
@@ -172,6 +173,14 @@ CSPSource::CSPSource(const std::string& scheme,
   DCHECK(!is_port_wildcard || port == url::PORT_UNSPECIFIED);
 }
 
+CSPSource::CSPSource(const network::mojom::CSPSource& csp_source)
+    : CSPSource(csp_source.scheme,
+                csp_source.host,
+                csp_source.is_host_wildcard,
+                csp_source.port,
+                csp_source.is_port_wildcard,
+                csp_source.path) {}
+
 CSPSource::CSPSource(const CSPSource& source) = default;
 CSPSource::~CSPSource() = default;
 
diff --git a/chromium/content/common/content_security_policy/csp_source.h b/chromium/content/common/content_security_policy/csp_source.h
index de2c051945c..9dfd5bf61b5 100644
--- a/chromium/content/common/content_security_policy/csp_source.h
+++ b/chromium/content/common/content_security_policy/csp_source.h
@@ -8,6 +8,7 @@
 #include <string>
 
 #include "content/common/content_export.h"
+#include "services/network/public/mojom/content_security_policy.mojom-forward.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -31,6 +32,7 @@ struct CONTENT_EXPORT CSPSource {
             int port,
             bool is_port_wildcard,
             const std::string& path);
+  explicit CSPSource(const network::mojom::CSPSource& csp_source);
   CSPSource(const CSPSource& source);
   ~CSPSource();
 
diff --git a/chromium/content/common/content_security_policy/csp_source_list.cc b/chromium/content/common/content_security_policy/csp_source_list.cc
index 3adb1e4e60d..664c2b64160 100644
--- a/chromium/content/common/content_security_policy/csp_source_list.cc
+++ b/chromium/content/common/content_security_policy/csp_source_list.cc
@@ -36,6 +36,29 @@ CSPSourceList::CSPSourceList(bool allow_self,
       allow_response_redirects(allow_response_redirects),
       sources(sources) {}
 
+CSPSourceList::CSPSourceList(
+    const network::mojom::CSPSourceList& csp_source_list)
+    : allow_self(false), allow_star(false), allow_response_redirects(false) {
+  for (auto& source : csp_source_list.sources) {
+    // The mojo representation of the source list has 'self' as a source entry,
+    // mark this source list as accepting 'self'.
+    if (source->allow_self) {
+      allow_self = true;
+      continue;
+    }
+    // The mojo representation has a '*' (wildcard) representation as empty
+    // scheme, host and port with is_host_wildcard set to true. Mark the source
+    // list as accepting star.
+    if (source->scheme == "" && source->is_host_wildcard &&
+        source->host == "" && source->port == url::PORT_UNSPECIFIED) {
+      allow_star = true;
+      continue;
+    }
+
+    sources.push_back(CSPSource(*source));
+  }
+}
+
 CSPSourceList::CSPSourceList(const CSPSourceList&) = default;
 CSPSourceList::~CSPSourceList() = default;
 
diff --git a/chromium/content/common/content_security_policy/csp_source_list.h b/chromium/content/common/content_security_policy/csp_source_list.h
index a1ce31f83c0..1bb5e5046db 100644
--- a/chromium/content/common/content_security_policy/csp_source_list.h
+++ b/chromium/content/common/content_security_policy/csp_source_list.h
@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "content/common/content_security_policy/csp_source.h"
+#include "services/network/public/mojom/content_security_policy.mojom-forward.h"
 #include "url/gurl.h"
 
 namespace content {
@@ -20,6 +21,7 @@ struct CONTENT_EXPORT CSPSourceList {
                 bool allow_star,
                 bool allow_response_redirects,
                 std::vector<CSPSource> source_list);
+  explicit CSPSourceList(const network::mojom::CSPSourceList& csp_source_list);
   CSPSourceList(const CSPSourceList&);
   ~CSPSourceList();
 
diff --git a/chromium/content/common/coverage_utils.cc b/chromium/content/common/coverage_utils.cc
index 00794b2253d..609f5039309 100644
--- a/chromium/content/common/coverage_utils.cc
+++ b/chromium/content/common/coverage_utils.cc
@@ -15,8 +15,11 @@
 #include "base/path_service.h"
 #include "base/rand_util.h"
 #include "base/strings/strcat.h"
+#include "base/strings/string16.h"
 #include "base/strings/string_number_conversions.h"
+#include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_restrictions.h"
+#include "build/build_config.h"
 
 namespace content {
 
@@ -26,7 +29,11 @@ base::File OpenCoverageFile() {
   std::string prof_template;
   base::FilePath path;
   if (env->GetVar("LLVM_PROFILE_FILE", &prof_template)) {
+#if defined(OS_WIN)
+    path = base::FilePath(base::UTF8ToUTF16(prof_template)).DirName();
+#else
     path = base::FilePath(prof_template).DirName();
+#endif
     base::CreateDirectory(path);
   } else {
     base::PathService::Get(base::DIR_CURRENT, &path);
@@ -37,7 +44,11 @@ base::File OpenCoverageFile() {
   int pool_index = base::RandInt(0, 3);
   std::string filename = base::StrCat(
       {"child_pool-", base::NumberToString(pool_index), ".profraw"});
+#if defined(OS_WIN)
+  path = path.Append(base::UTF8ToUTF16(filename));
+#else
   path = path.Append(filename);
+#endif
   uint32_t flags = base::File::FLAG_OPEN_ALWAYS | base::File::FLAG_READ |
                    base::File::FLAG_WRITE;
 
diff --git a/chromium/content/common/features.gni b/chromium/content/common/features.gni
index b1bcb83306b..13874c33dde 100644
--- a/chromium/content/common/features.gni
+++ b/chromium/content/common/features.gni
@@ -12,3 +12,5 @@ declare_args() {
   # false, critical memory pressure is treated like moderate pressure in foreground).
   allow_critical_memory_pressure_handling_in_foreground = is_chromecast
 }
+
+enable_screen_capture = is_linux || is_mac || is_win || is_android
diff --git a/chromium/content/common/fetch/fetch_api_request_proto.cc b/chromium/content/common/fetch/fetch_api_request_proto.cc
index 1a478f2b0c8..52e33c17e3c 100644
--- a/chromium/content/common/fetch/fetch_api_request_proto.cc
+++ b/chromium/content/common/fetch/fetch_api_request_proto.cc
@@ -5,6 +5,7 @@
 #include "content/common/fetch/fetch_api_request_proto.h"
 
 #include "content/common/fetch/fetch_api_request.pb.h"
+#include "content/public/common/referrer.h"
 
 namespace content {
 
@@ -54,10 +55,10 @@ blink::mojom::FetchAPIRequestPtr DeserializeFetchRequestFromString(
   request_ptr->method = request_proto.method();
   request_ptr->headers = {request_proto.headers().begin(),
                           request_proto.headers().end()};
-  request_ptr->referrer =
-      blink::mojom::Referrer::New(GURL(request_proto.referrer().url()),
-                                  static_cast<network::mojom::ReferrerPolicy>(
-                                      request_proto.referrer().policy()));
+  request_ptr->referrer = blink::mojom::Referrer::New(
+      GURL(request_proto.referrer().url()),
+
+      Referrer::ConvertToPolicy(request_proto.referrer().policy()));
   request_ptr->is_reload = request_proto.is_reload();
   request_ptr->credentials_mode = static_cast<network::mojom::CredentialsMode>(
       request_proto.credentials_mode());
diff --git a/chromium/content/common/font_cache_dispatcher_win.cc b/chromium/content/common/font_cache_dispatcher_win.cc
index d4cb522a813..bb8fd56bcd6 100644
--- a/chromium/content/common/font_cache_dispatcher_win.cc
+++ b/chromium/content/common/font_cache_dispatcher_win.cc
@@ -15,7 +15,6 @@
 #include "base/strings/string16.h"
 #include "base/thread_annotations.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
-#include "services/service_manager/public/cpp/bind_source_info.h"
 
 namespace content {
 namespace {
@@ -138,9 +137,7 @@ FontCacheDispatcher::~FontCacheDispatcher() {
 }
 
 // static
-void FontCacheDispatcher::Create(
-    mojom::FontCacheWinRequest request,
-    const service_manager::BindSourceInfo& source_info) {
+void FontCacheDispatcher::Create(mojom::FontCacheWinRequest request) {
   mojo::MakeStrongBinding(std::make_unique<FontCacheDispatcher>(),
                           std::move(request));
 }
diff --git a/chromium/content/common/font_list_mac.mm b/chromium/content/common/font_list_mac.mm
index 64d2210bcb4..6b605e97fd6 100644
--- a/chromium/content/common/font_list_mac.mm
+++ b/chromium/content/common/font_list_mac.mm
@@ -8,38 +8,38 @@
 
 #include <utility>
 
-#include "base/mac/scoped_nsautorelease_pool.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/values.h"
 
 namespace content {
 
 std::unique_ptr<base::ListValue> GetFontList_SlowBlocking() {
-  base::mac::ScopedNSAutoreleasePool autorelease_pool;
-  std::unique_ptr<base::ListValue> font_list(new base::ListValue);
-  NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
-  NSMutableDictionary* fonts_dict = [NSMutableDictionary dictionary];
-  NSArray* fonts = [fontManager availableFontFamilies];
-
-  for (NSString* family_name in fonts) {
-    NSString* localized_family_name =
-        [fontManager localizedNameForFamily:family_name face:nil];
-    fonts_dict[family_name] = localized_family_name;
+  @autoreleasepool {
+    std::unique_ptr<base::ListValue> font_list(new base::ListValue);
+    NSFontManager* fontManager = [[[NSFontManager alloc] init] autorelease];
+    NSMutableDictionary* fonts_dict = [NSMutableDictionary dictionary];
+    NSArray* fonts = [fontManager availableFontFamilies];
+
+    for (NSString* family_name in fonts) {
+      NSString* localized_family_name =
+          [fontManager localizedNameForFamily:family_name face:nil];
+      fonts_dict[family_name] = localized_family_name;
+    }
+
+    // Sort family names based on localized names.
+    NSArray* sortedFonts = [fonts_dict
+        keysSortedByValueUsingSelector:@selector(localizedStandardCompare:)];
+
+    for (NSString* family_name in sortedFonts) {
+      NSString* localized_family_name = fonts_dict[family_name];
+      auto font_item = std::make_unique<base::ListValue>();
+      font_item->AppendString(base::SysNSStringToUTF16(family_name));
+      font_item->AppendString(base::SysNSStringToUTF16(localized_family_name));
+      font_list->Append(std::move(font_item));
+    }
+
+    return font_list;
   }
-
-  // Sort family names based on localized names.
-  NSArray* sortedFonts = [fonts_dict
-      keysSortedByValueUsingSelector:@selector(localizedStandardCompare:)];
-
-  for (NSString* family_name in sortedFonts) {
-    NSString* localized_family_name = fonts_dict[family_name];
-    auto font_item = std::make_unique<base::ListValue>();
-    font_item->AppendString(base::SysNSStringToUTF16(family_name));
-    font_item->AppendString(base::SysNSStringToUTF16(localized_family_name));
-    font_list->Append(std::move(font_item));
-  }
-
-  return font_list;
 }
 
 }  // namespace content
diff --git a/chromium/content/common/frame.mojom b/chromium/content/common/frame.mojom
index 79660bebe2f..b7ef3588dcf 100644
--- a/chromium/content/common/frame.mojom
+++ b/chromium/content/common/frame.mojom
@@ -9,6 +9,7 @@ import "content/common/frame_messages.mojom";
 import "content/common/native_types.mojom";
 import "content/common/navigation_client.mojom";
 import "content/common/navigation_params.mojom";
+import "content/public/common/browser_controls_state.mojom";
 import "content/public/common/resource_type.mojom";
 import "content/public/common/resource_load_info.mojom";
 import "content/public/common/transferrable_url_loader.mojom";
@@ -21,6 +22,7 @@ import "services/network/public/mojom/url_loader.mojom";
 import "services/network/public/mojom/url_loader_factory.mojom";
 import "services/service_manager/public/mojom/interface_provider.mojom";
 import "services/viz/public/mojom/compositing/surface_id.mojom";
+import "skia/public/mojom/skcolor.mojom";
 import "third_party/blink/public/mojom/blob/blob_url_store.mojom";
 import "third_party/blink/public/mojom/commit_result/commit_result.mojom";
 import "third_party/blink/public/mojom/devtools/console_message.mojom";
@@ -71,6 +73,13 @@ interface Frame {
   ExtractSmartClipData(gfx.mojom.Rect rect)
       => (mojo_base.mojom.String16 text, mojo_base.mojom.String16 html,
               gfx.mojom.Rect clip_rect);
+
+  // Notifies the renderer whether hiding/showing the browser controls is
+  // enabled, what the current state should be, and whether or not to
+  // animate to the proper state.
+  UpdateBrowserControlsState(BrowserControlsState constraints,
+                             BrowserControlsState current,
+                             bool animate);
 };
 
 // Implemented by the frame provider and currently must be associated with the
@@ -252,12 +261,18 @@ interface FrameBindingsControl {
   // that allow JS content extended privileges. See BindingsPolicy for valid
   // flag values.
   AllowBindings(int32 enabled_bindings_flags);
+
+  // Used to tell the RenderFrame to enable Mojo JS bindings, which allows
+  // JS code running in the renderer process to connect to Mojo interfaces
+  // and make method calls on them.
+  // This is used for WebUI only at this time.
+  EnableMojoJsBindings();
 };
 
 // Implemented by a service that provides implementations of the Frame
 // interface. (e.g. renderer processes).
 interface FrameFactory {
-  CreateFrame(int32 frame_routing_id, Frame& frame);
+  CreateFrame(int32 frame_routing_id, pending_receiver<Frame> frame);
 };
 
 struct CreateNewWindowParams {
@@ -323,6 +338,9 @@ struct CreateNewWindowReply {
   // The ID of the widget for the main frame.
   int32 main_frame_widget_route_id;
 
+  // Initial properties for the main frame RenderWidget.
+  VisualProperties visual_properties;
+
   DocumentScopedInterfaceBundle main_frame_interface_bundle;
 
   // Duplicated from CreateNewWindowParams because legacy code.
@@ -371,7 +389,7 @@ interface FrameHost {
           mojo_base.mojom.UnguessableToken devtools_frame_token);
 
   // Creates and returns a KeepAliveHandle.
-  IssueKeepAliveHandle(KeepAliveHandle& keep_alive_handle);
+  IssueKeepAliveHandle(pending_receiver<KeepAliveHandle> keep_alive_handle);
 
   // Sent by the renderer when a navigation commits in the frame.
 
@@ -416,7 +434,7 @@ interface FrameHost {
       CommonNavigationParams common_params,
       BeginNavigationParams begin_params,
       pending_remote<blink.mojom.BlobURLToken>? blob_url_token,
-      associated NavigationClient? navigation_client,
+      pending_associated_remote<NavigationClient>? navigation_client,
       pending_remote<blink.mojom.NavigationInitiator>? navigation_initiator);
 
   // Sent when a subresource response has started.
@@ -466,10 +484,6 @@ interface FrameHost {
   // navigation.
   FrameSizeChanged(gfx.mojom.Size size);
 
-  // Notifies the browser that the current frame has either become or is no
-  // longer fullscreen.
-  FullscreenStateChanged(bool is_fullscreen);
-
   // Notifies the browser that the current frame has changed its visibility
   // status.
   VisibilityChanged(blink.mojom.FrameVisibility visibility);
@@ -549,4 +563,7 @@ interface FrameHost {
   // Evicts the page from the back/forward cache due to e.g., JavaScript
   // execution.
   EvictFromBackForwardCache();
+
+  // Notifies the browser that the current frame has changed theme color.
+  DidChangeThemeColor(skia.mojom.SkColor? theme_color);
 };
diff --git a/chromium/content/common/frame_messages.h b/chromium/content/common/frame_messages.h
index c67d0cc0156..24decdbf52a 100644
--- a/chromium/content/common/frame_messages.h
+++ b/chromium/content/common/frame_messages.h
@@ -59,8 +59,11 @@
 #include "third_party/blink/public/common/frame/user_activation_update_type.h"
 #include "third_party/blink/public/common/messaging/message_port_channel.h"
 #include "third_party/blink/public/common/messaging/transferable_message.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
+#include "third_party/blink/public/common/sudden_termination_disabler_type.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
+#include "third_party/blink/public/mojom/feature_policy/feature_policy.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/mojom/frame/lifecycle.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
@@ -69,12 +72,9 @@
 #include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
 #include "third_party/blink/public/platform/web_scroll_into_view_params.h"
 #include "third_party/blink/public/platform/web_scroll_types.h"
-#include "third_party/blink/public/platform/web_sudden_termination_disabler_type.h"
 #include "third_party/blink/public/web/web_frame_owner_properties.h"
-#include "third_party/blink/public/web/web_fullscreen_options.h"
 #include "third_party/blink/public/web/web_media_player_action.h"
 #include "third_party/blink/public/web/web_tree_scope_type.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "ui/events/types/scroll_types.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -138,8 +138,8 @@ IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::FeaturePolicyFeature,
                           blink::mojom::FeaturePolicyFeature::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(content::CSPDisposition,
                           content::CSPDisposition::LAST)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebTriggeringEventInfo,
-                          blink::WebTriggeringEventInfo::kMaxValue)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::TriggeringEventInfo,
+                          blink::TriggeringEventInfo::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::UserActivationUpdateType,
                           blink::UserActivationUpdateType::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebMediaPlayerAction::Type,
@@ -180,10 +180,6 @@ IPC_STRUCT_TRAITS_BEGIN(blink::WebIntrinsicSizingInfo)
   IPC_STRUCT_TRAITS_MEMBER(has_height)
 IPC_STRUCT_TRAITS_END()
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebFullscreenOptions)
-  IPC_STRUCT_TRAITS_MEMBER(prefers_navigation_bar)
-IPC_STRUCT_TRAITS_END()
-
 IPC_STRUCT_TRAITS_BEGIN(blink::WebScrollIntoViewParams::Alignment)
   IPC_STRUCT_TRAITS_MEMBER(rect_visible)
   IPC_STRUCT_TRAITS_MEMBER(rect_hidden)
@@ -506,20 +502,18 @@ IPC_STRUCT_BEGIN(FrameHostMsg_OpenURL_Params)
   IPC_STRUCT_MEMBER(WindowOpenDisposition, disposition)
   IPC_STRUCT_MEMBER(bool, should_replace_current_entry)
   IPC_STRUCT_MEMBER(bool, user_gesture)
-  IPC_STRUCT_MEMBER(blink::WebTriggeringEventInfo, triggering_event_info)
+  IPC_STRUCT_MEMBER(blink::TriggeringEventInfo, triggering_event_info)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
   IPC_STRUCT_MEMBER(std::string, href_translate)
   IPC_STRUCT_MEMBER(content::NavigationDownloadPolicy, download_policy)
 IPC_STRUCT_END()
 
 IPC_STRUCT_BEGIN(FrameHostMsg_DownloadUrl_Params)
-  IPC_STRUCT_MEMBER(int, render_view_id)
-  IPC_STRUCT_MEMBER(int, render_frame_id)
   IPC_STRUCT_MEMBER(GURL, url)
   IPC_STRUCT_MEMBER(content::Referrer, referrer)
   IPC_STRUCT_MEMBER(url::Origin, initiator_origin)
   IPC_STRUCT_MEMBER(base::string16, suggested_name)
-  IPC_STRUCT_MEMBER(bool, follow_cross_origin_redirects)
+  IPC_STRUCT_MEMBER(network::mojom::RedirectMode, cross_origin_redirects)
   IPC_STRUCT_MEMBER(mojo::MessagePipeHandle, blob_url_token)
 IPC_STRUCT_END()
 
@@ -692,10 +686,6 @@ IPC_MESSAGE_ROUTED0(FrameMsg_ChildFrameProcessGone)
 IPC_MESSAGE_ROUTED1(FrameMsg_ContextMenuClosed,
                     content::CustomContextMenuContext /* custom_context */)
 
-// Reloads all the Lo-Fi images in the RenderFrame. Ignores the cache and
-// reloads from the network.
-IPC_MESSAGE_ROUTED0(FrameMsg_ReloadLoFiImages)
-
 // Executes custom context menu action that was provided from Blink.
 IPC_MESSAGE_ROUTED2(FrameMsg_CustomContextMenuAction,
                     content::CustomContextMenuContext /* custom_context */,
@@ -751,10 +741,9 @@ IPC_MESSAGE_ROUTED3(FrameMsg_AddMessageToConsole,
                     std::string /* message */,
                     bool /* discard_duplicates */)
 
-// Tells the renderer to reload the frame, optionally bypassing the cache while
-// doing so.
-IPC_MESSAGE_ROUTED1(FrameMsg_Reload,
-                    bool /* bypass_cache */)
+// TODO(https://crbug.com/995428): Deprecated.
+// Tells the renderer to reload the frame.
+IPC_MESSAGE_ROUTED0(FrameMsg_Reload)
 
 // Change the accessibility mode in the renderer process.
 IPC_MESSAGE_ROUTED1(FrameMsg_SetAccessibilityMode, ui::AXMode)
@@ -1039,15 +1028,13 @@ IPC_MESSAGE_ROUTED1(FrameHostMsg_DidFinishLoad,
                     GURL /* validated_url */)
 
 // Initiates a download based on user actions like 'ALT+click'.
-IPC_MESSAGE_CONTROL(FrameHostMsg_DownloadUrl, FrameHostMsg_DownloadUrl_Params)
+IPC_MESSAGE_ROUTED1(FrameHostMsg_DownloadUrl, FrameHostMsg_DownloadUrl_Params)
 
 // Asks the browser to save a image (for <canvas> or <img>) from a data URL.
 // Note: |data_url| is the contents of a data:URL, and that it's represented as
 // a string only to work around size limitations for GURLs in IPC messages.
-IPC_MESSAGE_CONTROL3(FrameHostMsg_SaveImageFromDataURL,
-                     int /* render_view_id */,
-                     int /* render_frame_id */,
-                     std::string /* data_url */)
+IPC_MESSAGE_ROUTED1(FrameHostMsg_SaveImageFromDataURL,
+                    std::string /* data_url */)
 
 // Notifies that the initial empty document of a view has been accessed.
 // After this, it is no longer safe to show a pending navigation's URL without
@@ -1336,10 +1323,6 @@ IPC_SYNC_MESSAGE_ROUTED1_2(FrameHostMsg_RunBeforeUnloadConfirm,
                            bool /* out - success */,
                            base::string16 /* out - This is ignored.*/)
 
-// Notify browser the theme color has been changed.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_DidChangeThemeColor,
-                    base::Optional<SkColor> /* theme_color */)
-
 // Register a new handler for URL requests with the given scheme.
 IPC_MESSAGE_ROUTED4(FrameHostMsg_RegisterProtocolHandler,
                     std::string /* scheme */,
@@ -1378,19 +1361,11 @@ IPC_MESSAGE_ROUTED0(FrameHostMsg_AbortNavigation)
 // The message is delivered using RenderWidget::QueueMessage.
 IPC_MESSAGE_ROUTED1(FrameHostMsg_VisualStateResponse, uint64_t /* id */)
 
-// Puts the browser into "tab fullscreen" mode for the sending renderer.
-// See the comment in chrome/browser/ui/browser.h for more details.
-IPC_MESSAGE_ROUTED1(FrameHostMsg_EnterFullscreen, blink::WebFullscreenOptions)
-
-// Exits the browser from "tab fullscreen" mode for the sending renderer.
-// See the comment in chrome/browser/ui/browser.h for more details.
-IPC_MESSAGE_ROUTED0(FrameHostMsg_ExitFullscreen)
-
 // Sent when a new sudden termination disabler condition is either introduced or
 // removed.
 IPC_MESSAGE_ROUTED2(FrameHostMsg_SuddenTerminationDisablerChanged,
                     bool /* present */,
-                    blink::WebSuddenTerminationDisablerType /* disabler_type */)
+                    blink::SuddenTerminationDisablerType /* disabler_type */)
 
 // Requests that the resource timing info be added to the performance entries of
 // a remote parent frame.
@@ -1504,10 +1479,9 @@ IPC_MESSAGE_ROUTED0(FrameHostMsg_RenderFallbackContentInParentProcess)
 // Used to go to the session history entry at the given offset (ie, -1 will
 // return the "back" item). This message affects a view and not just a frame,
 // but is sent on the frame channel for attribution purposes.
-IPC_MESSAGE_ROUTED3(FrameHostMsg_GoToEntryAtOffset,
+IPC_MESSAGE_ROUTED2(FrameHostMsg_GoToEntryAtOffset,
                     int /* offset (from current) of history item to get */,
-                    bool /* has_user_gesture */,
-                    bool /* from_script */)
+                    bool /* has_user_gesture */)
 
 #if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
 
diff --git a/chromium/content/common/frame_sink_provider.mojom b/chromium/content/common/frame_sink_provider.mojom
index f02c4825426..2df0b197d5b 100644
--- a/chromium/content/common/frame_sink_provider.mojom
+++ b/chromium/content/common/frame_sink_provider.mojom
@@ -14,12 +14,15 @@ import "services/viz/public/mojom/compositing/compositor_frame_sink.mojom";
 interface FrameSinkProvider {
   CreateForWidget(
       int32 widget_id,
-      viz.mojom.CompositorFrameSink& compositor_frame_sink_request,
-      viz.mojom.CompositorFrameSinkClient compositor_frame_sink_client);
+      pending_receiver<viz.mojom.CompositorFrameSink>
+          compositor_frame_sink_receiver,
+      pending_remote<viz.mojom.CompositorFrameSinkClient>
+          compositor_frame_sink_client);
 
    RegisterRenderFrameMetadataObserver(
       int32  widget_id,
-      RenderFrameMetadataObserverClient&
-        render_frame_metadata_observer_client_request,
-      RenderFrameMetadataObserver render_frame_metadata_observer);
+      pending_receiver<RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_client_receiver,
+      pending_remote<RenderFrameMetadataObserver>
+        render_frame_metadata_observer);
 };
diff --git a/chromium/content/common/histogram_fetcher.mojom b/chromium/content/common/histogram_fetcher.mojom
index 76c0d258b40..5ffecb492bc 100644
--- a/chromium/content/common/histogram_fetcher.mojom
+++ b/chromium/content/common/histogram_fetcher.mojom
@@ -10,7 +10,7 @@ interface ChildHistogramFetcherFactory {
   // Creates a ChildHistogram interface that uses shared memory buffer to
   // store histograms that are to be reported by the browser process to UMA.
   CreateFetcher(mojo_base.mojom.WritableSharedMemoryRegion? shared_memory,
-                       ChildHistogramFetcher& child_histogram_fetcher);
+                pending_receiver<ChildHistogramFetcher> child_histogram_fetcher);
 };
 
 interface ChildHistogramFetcher{
diff --git a/chromium/content/common/host_zoom.mojom b/chromium/content/common/host_zoom.mojom
deleted file mode 100644
index 2204340da70..00000000000
--- a/chromium/content/common/host_zoom.mojom
+++ /dev/null
@@ -1,12 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-module content.mojom;
-
-import "url/mojom/url.mojom";
-
-interface HostZoom {
-  // Sets the host zoom level for the given url, called just before commit.
-  SetHostZoomLevel(url.mojom.Url url, double zoom_level);
-};
diff --git a/chromium/content/common/input/event_with_latency_info_unittest.cc b/chromium/content/common/input/event_with_latency_info_unittest.cc
index 1d5fec27ea2..53c46856a46 100644
--- a/chromium/content/common/input/event_with_latency_info_unittest.cc
+++ b/chromium/content/common/input/event_with_latency_info_unittest.cc
@@ -325,13 +325,10 @@ TEST_F(EventWithLatencyInfoTest, WebMouseWheelEventCoalescing) {
   EXPECT_TRUE(CanCoalesce(mouse_wheel_0, mouse_wheel_1));
   EXPECT_EQ(mouse_wheel_0.event.GetModifiers(),
             mouse_wheel_1.event.GetModifiers());
-  EXPECT_EQ(mouse_wheel_0.event.scroll_by_page,
-            mouse_wheel_1.event.scroll_by_page);
+  EXPECT_EQ(mouse_wheel_0.event.delta_units, mouse_wheel_1.event.delta_units);
   EXPECT_EQ(mouse_wheel_0.event.phase, mouse_wheel_1.event.phase);
   EXPECT_EQ(mouse_wheel_0.event.momentum_phase,
             mouse_wheel_1.event.momentum_phase);
-  EXPECT_EQ(mouse_wheel_0.event.has_precise_scrolling_deltas,
-            mouse_wheel_1.event.has_precise_scrolling_deltas);
   Coalesce(mouse_wheel_0, &mouse_wheel_1);
 
   // Coalesced event has the position of the most recent event.
diff --git a/chromium/content/common/input/input_event_mojom_traits.cc b/chromium/content/common/input/input_event_mojom_traits.cc
index 2a14695627b..ff9f5aa6735 100644
--- a/chromium/content/common/input/input_event_mojom_traits.cc
+++ b/chromium/content/common/input/input_event_mojom_traits.cc
@@ -340,13 +340,13 @@ bool StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::Read(
         wheel_event->momentum_phase =
             static_cast<blink::WebMouseWheelEvent::Phase>(
                 wheel_data->momentum_phase);
-        wheel_event->scroll_by_page = wheel_data->scroll_by_page;
-        wheel_event->has_precise_scrolling_deltas =
-            wheel_data->has_precise_scrolling_deltas;
         wheel_event->dispatch_type = wheel_data->cancelable;
         wheel_event->event_action =
             static_cast<blink::WebMouseWheelEvent::EventAction>(
                 wheel_data->event_action);
+        wheel_event->delta_units =
+            static_cast<ui::input_types::ScrollGranularity>(
+                wheel_data->delta_units);
       }
     }
 
@@ -397,9 +397,9 @@ StructTraits<content::mojom::EventDataView, InputEventUniquePtr>::pointer_data(
         wheel_event->wheel_ticks_y, wheel_event->acceleration_ratio_x,
         wheel_event->acceleration_ratio_y, wheel_event->resending_plugin_id,
         wheel_event->phase, wheel_event->momentum_phase,
-        wheel_event->scroll_by_page, wheel_event->has_precise_scrolling_deltas,
         wheel_event->dispatch_type,
-        static_cast<uint8_t>(wheel_event->event_action));
+        static_cast<uint8_t>(wheel_event->event_action),
+        static_cast<uint8_t>(wheel_event->delta_units));
   }
 
   return PointerDataFromPointerProperties(
diff --git a/chromium/content/common/input/input_handler.mojom b/chromium/content/common/input/input_handler.mojom
index caf15e51a3a..623f1b6c110 100644
--- a/chromium/content/common/input/input_handler.mojom
+++ b/chromium/content/common/input/input_handler.mojom
@@ -63,10 +63,9 @@ struct WheelData {
   int32 resending_plugin_id;
   uint8 phase;
   uint8 momentum_phase;
-  bool scroll_by_page;
-  bool has_precise_scrolling_deltas;
   Cancelability cancelable;
   uint8 event_action;
+  uint8 delta_units;
 };
 
 struct MouseData {
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
index ee9ec1e1933..018d4955460 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.cc
@@ -18,8 +18,7 @@ SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams()
       speed_in_pixels_s(kDefaultSpeedInPixelsS),
       fling_velocity_x(0),
       fling_velocity_y(0),
-      precise_scrolling_deltas(false),
-      scroll_by_page(false) {}
+      granularity(ui::input_types::ScrollGranularity::kScrollByPixel) {}
 
 SyntheticSmoothScrollGestureParams::SyntheticSmoothScrollGestureParams(
     const SyntheticSmoothScrollGestureParams& other) = default;
diff --git a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
index d590892d409..ccc6dce65a9 100644
--- a/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
+++ b/chromium/content/common/input/synthetic_smooth_scroll_gesture_params.h
@@ -9,6 +9,7 @@
 
 #include "content/common/content_export.h"
 #include "content/common/input/synthetic_gesture_params.h"
+#include "ui/events/types/scroll_types.h"
 #include "ui/gfx/geometry/point_f.h"
 #include "ui/gfx/geometry/vector2d.h"
 
@@ -30,8 +31,7 @@ struct CONTENT_EXPORT SyntheticSmoothScrollGestureParams
   float speed_in_pixels_s;
   float fling_velocity_x;
   float fling_velocity_y;
-  bool precise_scrolling_deltas;
-  bool scroll_by_page;
+  ui::input_types::ScrollGranularity granularity;
 
   static const SyntheticSmoothScrollGestureParams* Cast(
       const SyntheticGestureParams* gesture_params);
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.cc b/chromium/content/common/input/synthetic_web_input_event_builders.cc
index 425c65ea5c7..54f11ee619a 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.cc
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.cc
@@ -58,9 +58,8 @@ WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     float dx,
     float dy,
     int modifiers,
-    bool precise,
-    bool scroll_by_page) {
-  return Build(x, y, 0, 0, dx, dy, modifiers, precise, scroll_by_page);
+    ui::input_types::ScrollGranularity delta_units) {
+  return Build(x, y, 0, 0, dx, dy, modifiers, delta_units);
 }
 
 WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
@@ -71,20 +70,19 @@ WebMouseWheelEvent SyntheticWebMouseWheelEventBuilder::Build(
     float dx,
     float dy,
     int modifiers,
-    bool precise,
-    bool scroll_by_page) {
+    ui::input_types::ScrollGranularity delta_units) {
   WebMouseWheelEvent result(WebInputEvent::kMouseWheel, modifiers,
                             ui::EventTimeForNow());
   result.SetPositionInScreen(global_x, global_y);
   result.SetPositionInWidget(x, y);
+  result.delta_units = delta_units;
   result.delta_x = dx;
   result.delta_y = dy;
   if (dx)
     result.wheel_ticks_x = dx > 0.0f ? 1.0f : -1.0f;
   if (dy)
     result.wheel_ticks_y = dy > 0.0f ? 1.0f : -1.0f;
-  result.has_precise_scrolling_deltas = precise;
-  result.scroll_by_page = scroll_by_page;
+
   result.event_action = WebMouseWheelEventTraits::GetEventAction(result);
   return result;
 }
diff --git a/chromium/content/common/input/synthetic_web_input_event_builders.h b/chromium/content/common/input/synthetic_web_input_event_builders.h
index 9c29e98bdd0..608123f4266 100644
--- a/chromium/content/common/input/synthetic_web_input_event_builders.h
+++ b/chromium/content/common/input/synthetic_web_input_event_builders.h
@@ -12,6 +12,7 @@
 #include "third_party/blink/public/platform/web_keyboard_event.h"
 #include "third_party/blink/public/platform/web_mouse_wheel_event.h"
 #include "third_party/blink/public/platform/web_touch_event.h"
+#include "ui/events/types/scroll_types.h"
 
 // Provides sensible creation of default WebInputEvents for testing purposes.
 
@@ -33,22 +34,22 @@ class CONTENT_EXPORT SyntheticWebMouseWheelEventBuilder {
  public:
   static blink::WebMouseWheelEvent Build(
       blink::WebMouseWheelEvent::Phase phase);
-  static blink::WebMouseWheelEvent Build(float x,
-                                         float y,
-                                         float dx,
-                                         float dy,
-                                         int modifiers,
-                                         bool precise,
-                                         bool scroll_by_page = false);
-  static blink::WebMouseWheelEvent Build(float x,
-                                         float y,
-                                         float global_x,
-                                         float global_y,
-                                         float dx,
-                                         float dy,
-                                         int modifiers,
-                                         bool precise,
-                                         bool scroll_by_page = false);
+  static blink::WebMouseWheelEvent Build(
+      float x,
+      float y,
+      float dx,
+      float dy,
+      int modifiers,
+      ui::input_types::ScrollGranularity delta_units);
+  static blink::WebMouseWheelEvent Build(
+      float x,
+      float y,
+      float global_x,
+      float global_y,
+      float dx,
+      float dy,
+      int modifiers,
+      ui::input_types::ScrollGranularity delta_units);
 };
 
 class CONTENT_EXPORT SyntheticWebKeyboardEventBuilder {
diff --git a/chromium/content/common/input/web_mouse_wheel_event_traits.cc b/chromium/content/common/input/web_mouse_wheel_event_traits.cc
index 372ae755785..0ff0bde4f9a 100644
--- a/chromium/content/common/input/web_mouse_wheel_event_traits.cc
+++ b/chromium/content/common/input/web_mouse_wheel_event_traits.cc
@@ -16,7 +16,8 @@ blink::WebMouseWheelEvent::EventAction WebMouseWheelEventTraits::GetEventAction(
 #if defined(USE_AURA)
   // Scroll events generated from the mouse wheel when the control key is held
   // don't trigger scrolling. Instead, they may cause zooming.
-  if (!event.has_precise_scrolling_deltas &&
+  if (event.delta_units !=
+          ui::input_types::ScrollGranularity::kScrollByPrecisePixel &&
       (event.GetModifiers() & WebInputEvent::kControlKey)) {
     return blink::WebMouseWheelEvent::EventAction::kPageZoom;
   }
diff --git a/chromium/content/common/input_messages.h b/chromium/content/common/input_messages.h
index d27d9123927..316d8dd0b41 100644
--- a/chromium/content/common/input_messages.h
+++ b/chromium/content/common/input_messages.h
@@ -119,8 +119,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::SyntheticSmoothScrollGestureParams)
   IPC_STRUCT_TRAITS_MEMBER(speed_in_pixels_s)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_x)
   IPC_STRUCT_TRAITS_MEMBER(fling_velocity_y)
-  IPC_STRUCT_TRAITS_MEMBER(precise_scrolling_deltas)
-  IPC_STRUCT_TRAITS_MEMBER(scroll_by_page)
+  IPC_STRUCT_TRAITS_MEMBER(granularity)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(content::SyntheticPinchGestureParams)
diff --git a/chromium/content/common/media/peer_connection_tracker.mojom b/chromium/content/common/media/peer_connection_tracker.mojom
index 12fe034fb5c..020e836504a 100644
--- a/chromium/content/common/media/peer_connection_tracker.mojom
+++ b/chromium/content/common/media/peer_connection_tracker.mojom
@@ -4,6 +4,21 @@
 
 module content.mojom;
 
+struct PeerConnectionInfo {
+  // ID of the peer connection. Unique only within the renderer process.
+  int32 lid;
+
+  // Serialized version of RTCConfiguration.
+  string rtc_configuration;
+
+  // Serialized version of blink::WebMediaConstraints.
+  string constraints;
+
+  // The URL of the blink::WebLocalFrame within which this peer connection
+  // lives. Used for debugging purposes (displayed by WebRTC-Internals).
+  string url;
+};
+
 // This interface allows forwarding PeerConnection events to WebRTCInternals in
 // the browser process.
 interface PeerConnectionTrackerHost {
@@ -11,6 +26,10 @@ interface PeerConnectionTrackerHost {
   // TODO(vm.arjun): Migrate rest of the messages,
   // https://bugs.chromium.org/p/chromium/issues/detail?id=792801
 
+  // Notifies WebRTCInternals about the addition of the peer connection
+  // whose data is specified in |info|.
+  AddPeerConnection(PeerConnectionInfo info);
+
   // Notifies WebRTCInternals about the removal of the peer connection
   // identified with local id |lid|.
   RemovePeerConnection(int32 lid);
diff --git a/chromium/content/common/media/peer_connection_tracker_messages.h b/chromium/content/common/media/peer_connection_tracker_messages.h
index 231725edaec..0c721cb54c6 100644
--- a/chromium/content/common/media/peer_connection_tracker_messages.h
+++ b/chromium/content/common/media/peer_connection_tracker_messages.h
@@ -14,21 +14,7 @@
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 #define IPC_MESSAGE_START PeerConnectionTrackerMsgStart
 
-IPC_STRUCT_BEGIN(PeerConnectionInfo)
-  // ID of the peer connection. Unique only within the renderer process.
-  IPC_STRUCT_MEMBER(int, lid)
-  // Serialized version of RTCConfiguration.
-  IPC_STRUCT_MEMBER(std::string, rtc_configuration)
-  // Serialized version of blink::WebMediaConstraints.
-  IPC_STRUCT_MEMBER(std::string, constraints)
-  // The URL of the blink::WebLocalFrame within which this peer connection
-  // lives. Used for debugging purposes (displayed by WebRTC-Internals).
-  IPC_STRUCT_MEMBER(std::string, url)
-IPC_STRUCT_END()
-
 // Messages sent from PeerConnectionTracker to PeerConnectionTrackerHost.
-IPC_MESSAGE_CONTROL1(PeerConnectionTrackerHost_AddPeerConnection,
-                     PeerConnectionInfo /* info */)
 IPC_MESSAGE_CONTROL2(PeerConnectionTrackerHost_AddStandardStats,
                      int /* lid */,
                      base::ListValue /* value */)
diff --git a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
index 5d43f4f7120..a6120daa6f0 100644
--- a/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
+++ b/chromium/content/common/media/renderer_audio_input_stream_factory.mojom
@@ -17,7 +17,7 @@ import "services/audio/public/mojom/audio_processing.mojom";
 // by the lifetime of the client.
 interface RendererAudioInputStreamFactory {
   CreateStream(
-      RendererAudioInputStreamFactoryClient client,
+      pending_remote<RendererAudioInputStreamFactoryClient> client,
       mojo_base.mojom.UnguessableToken session_id,
       media.mojom.AudioParameters params,
       bool automatic_gain_control,
diff --git a/chromium/content/common/media/renderer_audio_output_stream_factory.mojom b/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
index c26c8cce401..c151fec4513 100644
--- a/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
+++ b/chromium/content/common/media/renderer_audio_output_stream_factory.mojom
@@ -10,18 +10,18 @@ import "media/mojo/mojom/media_types.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 
 // This interface is used to create output streams. The client supplies a
-// request for a stream provider, and then supplies the desired audio
+// mojo receiver for a stream provider, and then supplies the desired audio
 // parameters to that to create the stream.
 interface RendererAudioOutputStreamFactory {
-  // Used to request a device. The AudioOutputStreamProviderRequest will be
-  // bound to an AudioOutputStreamProvider implementation or closed
-  // (in case of an error).
-  // If |session_id| is provided, it will be taken into account together with
-  // |device_id| in the selection of the audio output device to request.
-  // If not provided, only |device_id| will be taken into account in the
-  // selection of the audio output device.
+  // Used to request a device. If successful, |stream_provider_receiver| will be
+  // bound to an AudioOutputStreamProvider implementation, otherwise it will
+  // simply be discarded (won't be bound). If |session_id| is provided, it will
+  // be taken into account together with |device_id| in the selection of the
+  // audio output device to request. If not provided, only |device_id| will be
+  // taken into account in the selection of the audio output device.
   RequestDeviceAuthorization(
-      media.mojom.AudioOutputStreamProvider& stream_provider_request,
+      pending_receiver<media.mojom.AudioOutputStreamProvider>
+          stream_provider_receiver,
       mojo_base.mojom.UnguessableToken? session_id,
       string device_id) =>
       (media.mojom.OutputDeviceStatus state,
diff --git a/chromium/content/common/mime_sniffing_throttle.cc b/chromium/content/common/mime_sniffing_throttle.cc
deleted file mode 100644
index 62d72feefc7..00000000000
--- a/chromium/content/common/mime_sniffing_throttle.cc
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mime_sniffing_throttle.h"
-
-#include "content/common/mime_sniffing_url_loader.h"
-#include "net/base/mime_sniffer.h"
-
-namespace content {
-
-MimeSniffingThrottle::MimeSniffingThrottle(
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : task_runner_(std::move(task_runner)) {}
-
-MimeSniffingThrottle::~MimeSniffingThrottle() = default;
-
-void MimeSniffingThrottle::WillProcessResponse(
-    const GURL& response_url,
-    network::ResourceResponseHead* response_head,
-    bool* defer) {
-  // No need to do mime sniffing again.
-  if (response_head->did_mime_sniff)
-    return;
-
-  bool blocked_sniffing_mime = false;
-  std::string content_type_options;
-  if (response_head->headers &&
-      response_head->headers->GetNormalizedHeader("x-content-type-options",
-                                                  &content_type_options)) {
-    blocked_sniffing_mime =
-        base::LowerCaseEqualsASCII(content_type_options, "nosniff");
-  }
-
-  if (!blocked_sniffing_mime &&
-      net::ShouldSniffMimeType(response_url, response_head->mime_type)) {
-    // Pause the response until the mime type becomes ready.
-    *defer = true;
-
-    network::mojom::URLLoaderPtr new_loader;
-    network::mojom::URLLoaderClientRequest new_loader_request;
-    network::mojom::URLLoaderPtr source_loader;
-    network::mojom::URLLoaderClientRequest source_client_request;
-    MimeSniffingURLLoader* mime_sniffing_loader;
-    std::tie(new_loader, new_loader_request, mime_sniffing_loader) =
-        MimeSniffingURLLoader::CreateLoader(weak_factory_.GetWeakPtr(),
-                                            response_url, *response_head,
-                                            task_runner_);
-    delegate_->InterceptResponse(std::move(new_loader),
-                                 std::move(new_loader_request), &source_loader,
-                                 &source_client_request);
-    mime_sniffing_loader->Start(std::move(source_loader),
-                                std::move(source_client_request));
-  }
-}
-
-void MimeSniffingThrottle::ResumeWithNewResponseHead(
-    const network::ResourceResponseHead& new_response_head) {
-  delegate_->UpdateDeferredResponseHead(new_response_head);
-  delegate_->Resume();
-}
-
-}  // namespace content
diff --git a/chromium/content/common/mime_sniffing_throttle.h b/chromium/content/common/mime_sniffing_throttle.h
deleted file mode 100644
index 135b3d14d36..00000000000
--- a/chromium/content/common/mime_sniffing_throttle.h
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MIME_SNIFFING_THROTTLE_H_
-#define CONTENT_COMMON_MIME_SNIFFING_THROTTLE_H_
-
-#include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/common/loader/url_loader_throttle.h"
-
-namespace content {
-
-// Throttle for mime type sniffing. This may intercept the request and
-// modify the response's mime type in the response head.
-class CONTENT_EXPORT MimeSniffingThrottle : public blink::URLLoaderThrottle {
- public:
-  // |task_runner| is used to bind the right task runner for handling incoming
-  // IPC in MimeSniffingLoader. |task_runner| is supposed to be bound to the
-  // current sequence.
-  explicit MimeSniffingThrottle(
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-  ~MimeSniffingThrottle() override;
-
-  // Implements blink::URLLoaderThrottle.
-  void WillProcessResponse(const GURL& response_url,
-                           network::ResourceResponseHead* response_head,
-                           bool* defer) override;
-
-  // Called from MimeSniffingURLLoader once mime type is ready.
-  void ResumeWithNewResponseHead(
-      const network::ResourceResponseHead& new_response_head);
-
- private:
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-  base::WeakPtrFactory<MimeSniffingThrottle> weak_factory_{this};
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_MIME_SNIFFING_THROTTLE_H_
diff --git a/chromium/content/common/mime_sniffing_throttle_unittest.cc b/chromium/content/common/mime_sniffing_throttle_unittest.cc
deleted file mode 100644
index d216febf8b1..00000000000
--- a/chromium/content/common/mime_sniffing_throttle_unittest.cc
+++ /dev/null
@@ -1,508 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mime_sniffing_throttle.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/run_loop.h"
-#include "base/test/task_environment.h"
-#include "content/common/mime_sniffing_url_loader.h"
-#include "mojo/public/cpp/system/data_pipe_utils.h"
-#include "services/network/test/test_url_loader_client.h"
-#include "services/network/test/test_url_loader_factory.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/common/loader/url_loader_throttle.h"
-#include "url/gurl.h"
-
-namespace content {
-
-namespace {
-
-class MojoDataPipeSender {
- public:
-  MojoDataPipeSender(mojo::ScopedDataPipeProducerHandle handle)
-      : handle_(std::move(handle)),
-        watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC) {}
-
-  void Start(std::string data, base::OnceClosure done_callback) {
-    data_ = std::move(data);
-    done_callback_ = std::move(done_callback);
-    watcher_.Watch(handle_.get(),
-                   MOJO_HANDLE_SIGNAL_WRITABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-                   base::BindRepeating(&MojoDataPipeSender::OnWritable,
-                                       base::Unretained(this)));
-  }
-
-  void OnWritable(MojoResult) {
-    uint32_t sending_bytes = data_.size() - sent_bytes_;
-    MojoResult result = handle_->WriteData(
-        data_.c_str() + sent_bytes_, &sending_bytes, MOJO_WRITE_DATA_FLAG_NONE);
-    switch (result) {
-      case MOJO_RESULT_OK:
-        break;
-      case MOJO_RESULT_FAILED_PRECONDITION:
-        // Finished unexpectedly.
-        std::move(done_callback_).Run();
-        return;
-      case MOJO_RESULT_SHOULD_WAIT:
-        // Just wait until OnWritable() is called by the watcher.
-        return;
-      default:
-        NOTREACHED();
-        return;
-    }
-    sent_bytes_ += sending_bytes;
-    if (data_.size() == sent_bytes_)
-      std::move(done_callback_).Run();
-  }
-
-  mojo::ScopedDataPipeProducerHandle ReleaseHandle() {
-    return std::move(handle_);
-  }
-
-  bool has_succeeded() const { return data_.size() == sent_bytes_; }
-
- private:
-  mojo::ScopedDataPipeProducerHandle handle_;
-  mojo::SimpleWatcher watcher_;
-  base::OnceClosure done_callback_;
-  std::string data_;
-  uint32_t sent_bytes_ = 0;
-};
-
-class MockDelegate : public blink::URLLoaderThrottle::Delegate {
- public:
-  // Implements blink::URLLoaderThrottle::Delegate.
-  void CancelWithError(int error_code,
-                       base::StringPiece custom_reason) override {
-    NOTIMPLEMENTED();
-  }
-  void Resume() override {
-    is_resumed_ = true;
-    // Resume from OnReceiveResponse() with a customized response header.
-    destination_loader_client()->OnReceiveResponse(
-        updated_response_head().value());
-  }
-
-  void SetPriority(net::RequestPriority priority) override { NOTIMPLEMENTED(); }
-  void UpdateDeferredResponseHead(
-      const network::ResourceResponseHead& new_response_head) override {
-    updated_response_head_ = new_response_head;
-  }
-  void PauseReadingBodyFromNet() override { NOTIMPLEMENTED(); }
-  void ResumeReadingBodyFromNet() override { NOTIMPLEMENTED(); }
-  void InterceptResponse(
-      network::mojom::URLLoaderPtr new_loader,
-      network::mojom::URLLoaderClientRequest new_client_request,
-      network::mojom::URLLoaderPtr* original_loader,
-      network::mojom::URLLoaderClientRequest* original_client_request)
-      override {
-    is_intercepted_ = true;
-
-    destination_loader_ptr_ = std::move(new_loader);
-    ASSERT_TRUE(mojo::FuseInterface(
-        std::move(new_client_request),
-        destination_loader_client_.CreateInterfacePtr().PassInterface()));
-    source_loader_request_ = mojo::MakeRequest(original_loader);
-    *original_client_request = mojo::MakeRequest(&source_loader_client_ptr_);
-  }
-
-  void LoadResponseBody(const std::string& body) {
-    if (!source_body_handle_.is_valid()) {
-      // Send OnStartLoadingResponseBody() if it's the first call.
-      mojo::ScopedDataPipeConsumerHandle consumer;
-      EXPECT_EQ(MOJO_RESULT_OK,
-                mojo::CreateDataPipe(nullptr, &source_body_handle_, &consumer));
-      source_loader_client()->OnStartLoadingResponseBody(std::move(consumer));
-    }
-
-    MojoDataPipeSender sender(std::move(source_body_handle_));
-    base::RunLoop loop;
-    sender.Start(body, loop.QuitClosure());
-    loop.Run();
-
-    EXPECT_TRUE(sender.has_succeeded());
-    source_body_handle_ = sender.ReleaseHandle();
-  }
-
-  void CompleteResponse() {
-    source_loader_client()->OnComplete(network::URLLoaderCompletionStatus());
-    source_body_handle_.reset();
-  }
-
-  uint32_t ReadResponseBody(uint32_t size) {
-    std::vector<uint8_t> buffer(size);
-    MojoResult result = destination_loader_client_.response_body().ReadData(
-        buffer.data(), &size, MOJO_READ_DATA_FLAG_NONE);
-    switch (result) {
-      case MOJO_RESULT_OK:
-        return size;
-      case MOJO_RESULT_FAILED_PRECONDITION:
-        return 0;
-      case MOJO_RESULT_SHOULD_WAIT:
-        return 0;
-      default:
-        NOTREACHED();
-    }
-    return 0;
-  }
-
-  bool is_intercepted() const { return is_intercepted_; }
-  bool is_resumed() const { return is_resumed_; }
-
-  const base::Optional<network::ResourceResponseHead>& updated_response_head()
-      const {
-    return updated_response_head_;
-  }
-
-  network::TestURLLoaderClient* destination_loader_client() {
-    return &destination_loader_client_;
-  }
-
-  network::mojom::URLLoaderClient* source_loader_client() {
-    return source_loader_client_ptr_.get();
-  }
-
- private:
-  bool is_intercepted_ = false;
-  bool is_resumed_ = false;
-  base::Optional<network::ResourceResponseHead> updated_response_head_;
-
-  // A pair of a loader and a loader client for destination of the response.
-  network::mojom::URLLoaderPtr destination_loader_ptr_;
-  network::TestURLLoaderClient destination_loader_client_;
-
-  // A pair of a loader and a loader client for source of the response.
-  network::mojom::URLLoaderClientPtr source_loader_client_ptr_;
-  network::mojom::URLLoaderRequest source_loader_request_;
-
-  mojo::ScopedDataPipeProducerHandle source_body_handle_;
-};
-
-}  // namespace
-
-class MimeSniffingThrottleTest : public testing::Test {
- protected:
-  // Be the first member so it is destroyed last.
-  base::test::TaskEnvironment task_environment_;
-};
-
-TEST_F(MimeSniffingThrottleTest, NoMimeTypeWithSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, SniffableMimeTypeWithSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/plain";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NotSniffableMimeTypeWithSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/javascript";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NoMimeTypeWithNotSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("wss://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, SniffableMimeTypeWithNotSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/plain";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("wss://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NotSniffableMimeTypeWithNotSniffableScheme) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/javascript";
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("wss://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, SniffableButAlreadySniffed) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  network::ResourceResponseHead response_head;
-  response_head.mime_type = "text/plain";
-  response_head.did_mime_sniff = true;
-  bool defer = false;
-  throttle->WillProcessResponse(GURL("https://example.com"), &response_head,
-                                &defer);
-  EXPECT_FALSE(defer);
-  EXPECT_FALSE(delegate->is_intercepted());
-}
-
-TEST_F(MimeSniffingThrottleTest, NoBody) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Call OnComplete() without sending body.
-  delegate->source_loader_client()->OnComplete(
-      network::URLLoaderCompletionStatus(net::ERR_FAILED));
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated to the default mime type ("text/plain").
-  EXPECT_TRUE(delegate->destination_loader_client()->has_received_response());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, EmptyBody) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  mojo::DataPipe pipe;
-  delegate->source_loader_client()->OnStartLoadingResponseBody(
-      std::move(pipe.consumer_handle));
-  pipe.producer_handle.reset();  // The pipe is empty.
-
-  delegate->source_loader_client()->OnComplete(
-      network::URLLoaderCompletionStatus());
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated to the default mime type ("text/plain").
-  EXPECT_TRUE(delegate->destination_loader_client()->has_received_response());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_PlainText) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body and complete the response.
-  delegate->LoadResponseBody("This is a text.");
-  delegate->CompleteResponse();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_Docx) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com/hogehoge.docx");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body and complete the response.
-  delegate->LoadResponseBody("\xD0\xCF\x11\xE0\xA1\xB1\x1A\xE1");
-  delegate->CompleteResponse();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("application/msword",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_PNG) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com/hogehoge.docx");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body and complete the response.
-  delegate->LoadResponseBody("\x89PNG\x0D\x0A\x1A\x0A");
-  delegate->CompleteResponse();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("image/png",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Body_LongPlainText) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // 64KiB is coming from the default value used in
-  // mojo::core::Core::CreateDataPipe().
-  const uint32_t kDefaultDataPipeBufferSize = 64 * 1024;
-  std::string long_body(kDefaultDataPipeBufferSize * 2, 'x');
-
-  // Send the data to the MimeSniffingURLLoader.
-  // |delegate|'s MojoDataPipeSender sends the first
-  // |kDefaultDataPipeBufferSize| bytes to MimeSniffingURLLoader and
-  // MimeSniffingURLLoader will read the first |kDefaultDataPipeBufferSize|
-  // bytes of the body, so the MojoDataPipeSender can push the rest of
-  // |kDefaultDataPipeBufferSize| of the body soon and finishes sending the
-  // body. After this, MimeSniffingURLLoader is waiting to push the body to the
-  // destination data pipe since the pipe should be full until it's read.
-  delegate->LoadResponseBody(long_body);
-  task_environment_.RunUntilIdle();
-
-  // Send OnComplete() to the MimeSniffingURLLoader.
-  delegate->CompleteResponse();
-  task_environment_.RunUntilIdle();
-  // MimeSniffingURLLoader should not send OnComplete() to the destination
-  // client until it finished writing all the data.
-  EXPECT_FALSE(
-      delegate->destination_loader_client()->has_received_completion());
-
-  // Read the half of the body. This unblocks MimeSniffingURLLoader to push the
-  // rest of the body to the data pipe.
-  uint32_t read_bytes = delegate->ReadResponseBody(long_body.size() / 2);
-  task_environment_.RunUntilIdle();
-
-  // Read the rest of the body.
-  read_bytes += delegate->ReadResponseBody(long_body.size() / 2);
-  task_environment_.RunUntilIdle();
-  delegate->destination_loader_client()->RunUntilComplete();
-
-  // Check if all data has been read.
-  EXPECT_EQ(long_body.size(), read_bytes);
-
-  // The mime type should be updated.
-  EXPECT_TRUE(delegate->is_resumed());
-  EXPECT_EQ("text/plain",
-            delegate->destination_loader_client()->response_head().mime_type);
-}
-
-TEST_F(MimeSniffingThrottleTest, Abort_NoBodyPipe) {
-  auto throttle = std::make_unique<MimeSniffingThrottle>(
-      task_environment_.GetMainThreadTaskRunner());
-  auto delegate = std::make_unique<MockDelegate>();
-  throttle->set_delegate(delegate.get());
-
-  GURL response_url("https://example.com");
-  network::ResourceResponseHead response_head;
-  bool defer = false;
-  throttle->WillProcessResponse(response_url, &response_head, &defer);
-  EXPECT_TRUE(defer);
-  EXPECT_TRUE(delegate->is_intercepted());
-
-  // Send the body
-  std::string body = "This should be long enough to complete sniffing.";
-  body.resize(1024, 'a');
-  delegate->LoadResponseBody(body);
-  task_environment_.RunUntilIdle();
-
-  // Release a pipe for the body on the receiver side.
-  delegate->destination_loader_client()->response_body_release();
-  task_environment_.RunUntilIdle();
-
-  // Send the body after the pipe is closed. The the loader aborts.
-  delegate->LoadResponseBody("This is a text.");
-
-  // Calling OnComplete should not crash.
-  delegate->CompleteResponse();
-  task_environment_.RunUntilIdle();
-}
-
-}  // namespace content
diff --git a/chromium/content/common/mime_sniffing_url_loader.cc b/chromium/content/common/mime_sniffing_url_loader.cc
deleted file mode 100644
index 7d9c71633f7..00000000000
--- a/chromium/content/common/mime_sniffing_url_loader.cc
+++ /dev/null
@@ -1,368 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/common/mime_sniffing_url_loader.h"
-
-#include "base/bind.h"
-#include "content/common/mime_sniffing_throttle.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
-#include "net/base/mime_sniffer.h"
-
-namespace content {
-
-// static
-const char MimeSniffingURLLoader::kDefaultMimeType[] = "text/plain";
-
-// static
-std::tuple<network::mojom::URLLoaderPtr,
-           network::mojom::URLLoaderClientRequest,
-           MimeSniffingURLLoader*>
-MimeSniffingURLLoader::CreateLoader(
-    base::WeakPtr<MimeSniffingThrottle> throttle,
-    const GURL& response_url,
-    const network::ResourceResponseHead& response_head,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  network::mojom::URLLoaderPtr url_loader;
-  network::mojom::URLLoaderClientPtr url_loader_client;
-  network::mojom::URLLoaderClientRequest url_loader_client_request =
-      mojo::MakeRequest(&url_loader_client);
-  auto loader = base::WrapUnique(new MimeSniffingURLLoader(
-      std::move(throttle), response_url, response_head,
-      std::move(url_loader_client), std::move(task_runner)));
-  MimeSniffingURLLoader* loader_rawptr = loader.get();
-  mojo::MakeStrongBinding(std::move(loader), mojo::MakeRequest(&url_loader));
-  return std::make_tuple(std::move(url_loader),
-                         std::move(url_loader_client_request), loader_rawptr);
-}
-
-MimeSniffingURLLoader::MimeSniffingURLLoader(
-    base::WeakPtr<MimeSniffingThrottle> throttle,
-    const GURL& response_url,
-    const network::ResourceResponseHead& response_head,
-    network::mojom::URLLoaderClientPtr destination_url_loader_client,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : throttle_(throttle),
-      source_url_client_binding_(this),
-      destination_url_loader_client_(std::move(destination_url_loader_client)),
-      response_url_(response_url),
-      response_head_(response_head),
-      task_runner_(task_runner),
-      body_consumer_watcher_(FROM_HERE,
-                             mojo::SimpleWatcher::ArmingPolicy::MANUAL,
-                             task_runner),
-      body_producer_watcher_(FROM_HERE,
-                             mojo::SimpleWatcher::ArmingPolicy::MANUAL,
-                             std::move(task_runner)) {}
-
-MimeSniffingURLLoader::~MimeSniffingURLLoader() = default;
-
-void MimeSniffingURLLoader::Start(
-    network::mojom::URLLoaderPtr source_url_loader,
-    network::mojom::URLLoaderClientRequest source_url_loader_client_request) {
-  source_url_loader_ = std::move(source_url_loader);
-  source_url_client_binding_.Bind(std::move(source_url_loader_client_request),
-                                  task_runner_);
-}
-
-void MimeSniffingURLLoader::OnReceiveResponse(
-    network::mojom::URLResponseHeadPtr response_head) {
-  // OnReceiveResponse() shouldn't be called because MimeSniffingURLLoader is
-  // created by MimeSniffingThrottle::WillProcessResponse(), which is equivalent
-  // to OnReceiveResponse().
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::OnReceiveRedirect(
-    const net::RedirectInfo& redirect_info,
-    network::mojom::URLResponseHeadPtr response_head) {
-  // OnReceiveRedirect() shouldn't be called because MimeSniffingURLLoader is
-  // created by MimeSniffingThrottle::WillProcessResponse(), which is equivalent
-  // to OnReceiveResponse().
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::OnUploadProgress(
-    int64_t current_position,
-    int64_t total_size,
-    OnUploadProgressCallback ack_callback) {
-  destination_url_loader_client_->OnUploadProgress(current_position, total_size,
-                                                   std::move(ack_callback));
-}
-
-void MimeSniffingURLLoader::OnReceiveCachedMetadata(mojo_base::BigBuffer data) {
-  destination_url_loader_client_->OnReceiveCachedMetadata(std::move(data));
-}
-
-void MimeSniffingURLLoader::OnTransferSizeUpdated(int32_t transfer_size_diff) {
-  destination_url_loader_client_->OnTransferSizeUpdated(transfer_size_diff);
-}
-
-void MimeSniffingURLLoader::OnStartLoadingResponseBody(
-    mojo::ScopedDataPipeConsumerHandle body) {
-  state_ = State::kSniffing;
-  body_consumer_handle_ = std::move(body);
-  body_consumer_watcher_.Watch(
-      body_consumer_handle_.get(),
-      MOJO_HANDLE_SIGNAL_READABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-      base::BindRepeating(&MimeSniffingURLLoader::OnBodyReadable,
-                          base::Unretained(this)));
-  body_consumer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::OnComplete(
-    const network::URLLoaderCompletionStatus& status) {
-  DCHECK(!complete_status_.has_value());
-  switch (state_) {
-    case State::kWaitForBody:
-      // An error occured before receiving any data.
-      DCHECK_NE(net::OK, status.error_code);
-      state_ = State::kCompleted;
-      response_head_.mime_type = kDefaultMimeType;
-      if (!throttle_) {
-        Abort();
-        return;
-      }
-      throttle_->ResumeWithNewResponseHead(response_head_);
-      destination_url_loader_client_->OnComplete(status);
-      return;
-    case State::kSniffing:
-    case State::kSending:
-      // Defer calling OnComplete() until mime sniffing has finished and all
-      // data is sent.
-      complete_status_ = status;
-      return;
-    case State::kCompleted:
-      destination_url_loader_client_->OnComplete(status);
-      return;
-    case State::kAborted:
-      NOTREACHED();
-      return;
-  }
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::FollowRedirect(
-    const std::vector<std::string>& removed_headers,
-    const net::HttpRequestHeaders& modified_headers,
-    const base::Optional<GURL>& new_url) {
-  // MimeSniffingURLLoader starts handling the request after
-  // OnReceivedResponse(). A redirect response is not expected.
-  NOTREACHED();
-}
-
-void MimeSniffingURLLoader::SetPriority(net::RequestPriority priority,
-                                        int32_t intra_priority_value) {
-  if (state_ == State::kAborted)
-    return;
-  source_url_loader_->SetPriority(priority, intra_priority_value);
-}
-
-void MimeSniffingURLLoader::PauseReadingBodyFromNet() {
-  if (state_ == State::kAborted)
-    return;
-  source_url_loader_->PauseReadingBodyFromNet();
-}
-
-void MimeSniffingURLLoader::ResumeReadingBodyFromNet() {
-  if (state_ == State::kAborted)
-    return;
-  source_url_loader_->ResumeReadingBodyFromNet();
-}
-
-void MimeSniffingURLLoader::OnBodyReadable(MojoResult) {
-  if (state_ == State::kSending) {
-    // The pipe becoming readable when kSending means all buffered body has
-    // already been sent.
-    ForwardBodyToClient();
-    return;
-  }
-  DCHECK_EQ(State::kSniffing, state_);
-
-  size_t start_size = buffered_body_.size();
-  uint32_t read_bytes = net::kMaxBytesToSniff;
-  buffered_body_.resize(start_size + read_bytes);
-  MojoResult result =
-      body_consumer_handle_->ReadData(buffered_body_.data() + start_size,
-                                      &read_bytes, MOJO_READ_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // Finished the body before mime type is completely decided.
-      buffered_body_.resize(start_size);
-      CompleteSniffing();
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_consumer_watcher_.ArmOrNotify();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-
-  DCHECK_EQ(MOJO_RESULT_OK, result);
-  buffered_body_.resize(start_size + read_bytes);
-  std::string new_type;
-  bool made_final_decision =
-      net::SniffMimeType(buffered_body_.data(), buffered_body_.size(),
-                         response_url_, response_head_.mime_type,
-                         net::ForceSniffFileUrlsForHtml::kDisabled, &new_type);
-  response_head_.mime_type = new_type;
-  response_head_.did_mime_sniff = true;
-  if (made_final_decision) {
-    CompleteSniffing();
-    return;
-  }
-  body_consumer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::OnBodyWritable(MojoResult) {
-  DCHECK_EQ(State::kSending, state_);
-  if (bytes_remaining_in_buffer_ > 0) {
-    SendReceivedBodyToClient();
-  } else {
-    ForwardBodyToClient();
-  }
-}
-
-void MimeSniffingURLLoader::CompleteSniffing() {
-  DCHECK_EQ(State::kSniffing, state_);
-  if (buffered_body_.empty()) {
-    // The URLLoader ended before sending any data. There is not enough
-    // information to determine the MIME type.
-    response_head_.mime_type = kDefaultMimeType;
-  }
-
-  state_ = State::kSending;
-  bytes_remaining_in_buffer_ = buffered_body_.size();
-  if (!throttle_) {
-    Abort();
-    return;
-  }
-  throttle_->ResumeWithNewResponseHead(response_head_);
-  mojo::ScopedDataPipeConsumerHandle body_to_send;
-  MojoResult result =
-      mojo::CreateDataPipe(nullptr, &body_producer_handle_, &body_to_send);
-  if (result != MOJO_RESULT_OK) {
-    Abort();
-    return;
-  }
-  // Set up the watcher for the producer handle.
-  body_producer_watcher_.Watch(
-      body_producer_handle_.get(),
-      MOJO_HANDLE_SIGNAL_WRITABLE | MOJO_HANDLE_SIGNAL_PEER_CLOSED,
-      base::BindRepeating(&MimeSniffingURLLoader::OnBodyWritable,
-                          base::Unretained(this)));
-
-  // Send deferred message.
-  destination_url_loader_client_->OnStartLoadingResponseBody(
-      std::move(body_to_send));
-
-  if (bytes_remaining_in_buffer_) {
-    SendReceivedBodyToClient();
-    return;
-  }
-
-  CompleteSending();
-}
-
-void MimeSniffingURLLoader::CompleteSending() {
-  DCHECK_EQ(State::kSending, state_);
-  state_ = State::kCompleted;
-  // Call client's OnComplete() if |this|'s OnComplete() has already been
-  // called.
-  if (complete_status_.has_value())
-    destination_url_loader_client_->OnComplete(complete_status_.value());
-
-  body_consumer_watcher_.Cancel();
-  body_producer_watcher_.Cancel();
-  body_consumer_handle_.reset();
-  body_producer_handle_.reset();
-}
-
-void MimeSniffingURLLoader::SendReceivedBodyToClient() {
-  DCHECK_EQ(State::kSending, state_);
-  // Send the buffered data first.
-  DCHECK_GT(bytes_remaining_in_buffer_, 0u);
-  size_t start_position = buffered_body_.size() - bytes_remaining_in_buffer_;
-  uint32_t bytes_sent = bytes_remaining_in_buffer_;
-  MojoResult result =
-      body_producer_handle_->WriteData(buffered_body_.data() + start_position,
-                                       &bytes_sent, MOJO_WRITE_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // The pipe is closed unexpectedly. |this| should be deleted once
-      // URLLoaderPtr on the destination is released.
-      Abort();
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_producer_watcher_.ArmOrNotify();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-  bytes_remaining_in_buffer_ -= bytes_sent;
-  body_producer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::ForwardBodyToClient() {
-  DCHECK_EQ(0u, bytes_remaining_in_buffer_);
-  // Send the body from the consumer to the producer.
-  const void* buffer;
-  uint32_t buffer_size = 0;
-  MojoResult result = body_consumer_handle_->BeginReadData(
-      &buffer, &buffer_size, MOJO_BEGIN_READ_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_consumer_watcher_.ArmOrNotify();
-      return;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // All data has been sent.
-      CompleteSending();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-
-  result = body_producer_handle_->WriteData(buffer, &buffer_size,
-                                            MOJO_WRITE_DATA_FLAG_NONE);
-  switch (result) {
-    case MOJO_RESULT_OK:
-      break;
-    case MOJO_RESULT_FAILED_PRECONDITION:
-      // The pipe is closed unexpectedly. |this| should be deleted once
-      // URLLoaderPtr on the destination is released.
-      Abort();
-      return;
-    case MOJO_RESULT_SHOULD_WAIT:
-      body_consumer_handle_->EndReadData(0);
-      body_producer_watcher_.ArmOrNotify();
-      return;
-    default:
-      NOTREACHED();
-      return;
-  }
-
-  body_consumer_handle_->EndReadData(buffer_size);
-  body_consumer_watcher_.ArmOrNotify();
-}
-
-void MimeSniffingURLLoader::Abort() {
-  state_ = State::kAborted;
-  body_consumer_watcher_.Cancel();
-  body_producer_watcher_.Cancel();
-  source_url_loader_.reset();
-  source_url_client_binding_.Close();
-  destination_url_loader_client_.reset();
-  // |this| should be removed since the owner will destroy |this| or the owner
-  // has already been destroyed by some reason.
-}
-
-}  // namespace content
diff --git a/chromium/content/common/mime_sniffing_url_loader.h b/chromium/content/common/mime_sniffing_url_loader.h
deleted file mode 100644
index 5480191583a..00000000000
--- a/chromium/content/common/mime_sniffing_url_loader.h
+++ /dev/null
@@ -1,151 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_COMMON_MIME_SNIFFING_URL_LOADER_H_
-#define CONTENT_COMMON_MIME_SNIFFING_URL_LOADER_H_
-
-#include <tuple>
-
-#include "base/callback.h"
-#include "base/memory/ref_counted.h"
-#include "base/memory/weak_ptr.h"
-#include "base/strings/string_piece.h"
-#include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/system/data_pipe.h"
-#include "mojo/public/cpp/system/simple_watcher.h"
-#include "services/network/public/cpp/resource_response.h"
-#include "services/network/public/cpp/shared_url_loader_factory.h"
-#include "services/network/public/mojom/url_loader.mojom.h"
-#include "services/network/public/mojom/url_loader_factory.mojom.h"
-#include "third_party/blink/public/common/loader/url_loader_throttle.h"
-
-namespace content {
-
-class MimeSniffingThrottle;
-
-// Reads the response body and determines its mime type. This url loader buffers
-// the response body until the mime type is decided. MimeSniffingURLLoader
-// is expected to be created just after receiving OnReceiveResponse(), so this
-// handles only OnStartLoadingResponseBody() and OnComplete() as a
-// network::mojom::URLLoaderClient.
-//
-// This loader has five states:
-// kWaitForBody: The initial state until the body is received (=
-//               OnStartLoadingResponseBody() is called) or the response is
-//               finished (= OnComplete() is called). When body is provided, the
-//               state is changed to kSniffing. Otherwise the state goes to
-//               kCompleted.
-// kSniffing: Receives the body from the source loader and estimate the mime
-//            type. The received body is kept in this loader until the mime type
-//            is decided. When the mime type is decided or all body has been
-//            received, this loader will dispatch queued messages like
-//            OnStartLoadingResponseBody() to the destination
-//            loader client, and then the state is changed to kSending.
-// kSending: Receives the body and sends it to the destination loader client.
-//           The state changes to kCompleted after all data is sent.
-// kCompleted: All data has been sent to the destination loader.
-// kAborted: Unexpected behavior happens. Watchers, pipes and the binding from
-//           the source loader to |this| are stopped. All incoming messages from
-//           the destination (through network::mojom::URLLoader) are ignored in
-//           this state.
-class CONTENT_EXPORT MimeSniffingURLLoader
-    : public network::mojom::URLLoaderClient,
-      public network::mojom::URLLoader {
- public:
-  ~MimeSniffingURLLoader() override;
-
-  // Start waiting for the body.
-  void Start(
-      network::mojom::URLLoaderPtr source_url_loader,
-      network::mojom::URLLoaderClientRequest source_url_loader_client_request);
-
-  // network::mojom::URLLoaderPtr controls the lifetime of the loader.
-  static std::tuple<network::mojom::URLLoaderPtr,
-                    network::mojom::URLLoaderClientRequest,
-                    MimeSniffingURLLoader*>
-  CreateLoader(base::WeakPtr<MimeSniffingThrottle> throttle,
-               const GURL& response_url,
-               const network::ResourceResponseHead& response_head,
-               scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
- private:
-  MimeSniffingURLLoader(
-      base::WeakPtr<MimeSniffingThrottle> throttle,
-      const GURL& response_url,
-      const network::ResourceResponseHead& response_head,
-      network::mojom::URLLoaderClientPtr destination_url_loader_client,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
-  // network::mojom::URLLoaderClient implementation (called from the source of
-  // the response):
-  void OnReceiveResponse(
-      network::mojom::URLResponseHeadPtr response_head) override;
-  void OnReceiveRedirect(
-      const net::RedirectInfo& redirect_info,
-      network::mojom::URLResponseHeadPtr response_head) override;
-  void OnUploadProgress(int64_t current_position,
-                        int64_t total_size,
-                        OnUploadProgressCallback ack_callback) override;
-  void OnReceiveCachedMetadata(mojo_base::BigBuffer data) override;
-  void OnTransferSizeUpdated(int32_t transfer_size_diff) override;
-  void OnStartLoadingResponseBody(
-      mojo::ScopedDataPipeConsumerHandle body) override;
-  void OnComplete(const network::URLLoaderCompletionStatus& status) override;
-
-  // network::mojom::URLLoader implementation (called from the destination of
-  // the response):
-  void FollowRedirect(const std::vector<std::string>& removed_headers,
-                      const net::HttpRequestHeaders& modified_headers,
-                      const base::Optional<GURL>& new_url) override;
-  void SetPriority(net::RequestPriority priority,
-                   int32_t intra_priority_value) override;
-  void PauseReadingBodyFromNet() override;
-  void ResumeReadingBodyFromNet() override;
-
-  void OnBodyReadable(MojoResult);
-  void OnBodyWritable(MojoResult);
-  void CompleteSniffing();
-  void CompleteSending();
-  void SendReceivedBodyToClient();
-  void ForwardBodyToClient();
-
-  void Abort();
-
-  static const char kDefaultMimeType[];
-
-  base::WeakPtr<MimeSniffingThrottle> throttle_;
-
-  mojo::Binding<network::mojom::URLLoaderClient> source_url_client_binding_;
-  network::mojom::URLLoaderPtr source_url_loader_;
-  network::mojom::URLLoaderClientPtr destination_url_loader_client_;
-
-  GURL response_url_;
-
-  // Capture the response head to defer to send it to the destination until the
-  // mime type is decided.
-  network::ResourceResponseHead response_head_;
-
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-
-  enum class State { kWaitForBody, kSniffing, kSending, kCompleted, kAborted };
-  State state_ = State::kWaitForBody;
-
-  // Set if OnComplete() is called during sniffing.
-  base::Optional<network::URLLoaderCompletionStatus> complete_status_;
-
-  std::vector<char> buffered_body_;
-  size_t bytes_remaining_in_buffer_;
-
-  mojo::ScopedDataPipeConsumerHandle body_consumer_handle_;
-  mojo::ScopedDataPipeProducerHandle body_producer_handle_;
-  mojo::SimpleWatcher body_consumer_watcher_;
-  mojo::SimpleWatcher body_producer_watcher_;
-
-  DISALLOW_COPY_AND_ASSIGN(MimeSniffingURLLoader);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_COMMON_MIME_SNIFFING_URL_LOADER_H_
diff --git a/chromium/content/common/navigation_params.mojom b/chromium/content/common/navigation_params.mojom
index c0bbef7c50d..e2761bd24c2 100644
--- a/chromium/content/common/navigation_params.mojom
+++ b/chromium/content/common/navigation_params.mojom
@@ -344,4 +344,8 @@ struct CommitNavigationParams {
   // https://wicg.github.io/cors-rfc1918/#address-space
   network.mojom.IPAddressSpace ip_address_space =
       network.mojom.IPAddressSpace.kUnknown;
+
+  // The base URL which will be set for the document to support relative path
+  // subresource loading in unsigned bundled exchanges file.
+  url.mojom.Url base_url_override_for_bundled_exchanges;
 };
diff --git a/chromium/content/common/page_messages.h b/chromium/content/common/page_messages.h
index 36718e326d5..21fd5d1e05b 100644
--- a/chromium/content/common/page_messages.h
+++ b/chromium/content/common/page_messages.h
@@ -36,10 +36,6 @@ IPC_MESSAGE_ROUTED2(PageMsg_SetHistoryOffsetAndLength,
 
 IPC_MESSAGE_ROUTED1(PageMsg_AudioStateChanged, bool /* is_audio_playing */)
 
-// Sent to OOPIF renderers when the main frame's ScreenInfo changes.
-IPC_MESSAGE_ROUTED1(PageMsg_UpdateScreenInfo,
-                    content::ScreenInfo /* screen_info */)
-
 // Sent to renderers with remote main frames when page-related visual properties
 // change.
 IPC_MESSAGE_ROUTED1(PageMsg_UpdatePageVisualProperties,
@@ -62,6 +58,9 @@ IPC_MESSAGE_ROUTED0(PageMsg_RestorePageFromBackForwardCache)
 IPC_MESSAGE_ROUTED1(PageMsg_UpdateTextAutosizerPageInfoForRemoteMainFrames,
                     blink::WebTextAutosizerPageInfo /* page_info */)
 
+// Sends updated preferences to the renderer.
+IPC_MESSAGE_ROUTED1(PageMsg_SetRendererPrefs, blink::mojom::RendererPreferences)
+
 // -----------------------------------------------------------------------------
 // Messages sent from the renderer to the browser.
 
diff --git a/chromium/content/common/page_state.mojom b/chromium/content/common/page_state.mojom
index 771c9ad7d99..e4f2abcd424 100644
--- a/chromium/content/common/page_state.mojom
+++ b/chromium/content/common/page_state.mojom
@@ -4,6 +4,7 @@
 
 module content.history.mojom;
 
+// WARNING: Please read the comments below, before including other Mojo types.
 import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/time.mojom";
 import "services/network/public/mojom/referrer_policy.mojom";
@@ -13,23 +14,31 @@ import "ui/gfx/geometry/mojom/geometry.mojom";
 // This file contains the mojo IDL definitions for PageState and its constituent
 // parts. The resultant generated code is used to serialize and deserialize
 // PageState for the purpose of history restore.
-// When adding fields, assign your new field an explicity ordinal(@n) and
-// prefer to add fields to the end of the struct to simplify finding the
-// latest ordinal.
-// For backwards compatibility purposes, new fields must be tagged with a
-// [MinVersion=x] attribute; x is specified at the bottom of this comment
-// block.
-// You'll also need to read/write the new field's value when decoding and
-// encoding PageState, update PageStateSerializationTest to check that
-// your new field is preserved across serialization, and add a BackwardsCompat
-// test with associated serialized_vxx.dat file. Look for
-// DumpExpectedPageStateForBackwardsCompat in page_state_serialization_unittest
-// for how to do this.
+//
+// When adding fields:
+// - Assign your new field an explicit ordinal(@n) and prefer to add fields to
+//   the end of the struct to simplify finding the latest ordinal.
+// - For backwards compatibility purposes:
+//     - New fields must be tagged with a [MinVersion=x] attribute; x is
+//       specified at the bottom of this comment block.
+//     - Only types with frozen/unchanging Mojo serialization may be used;
+//       for example, |string| is okay, but |url.mojom.Origin| is not.
+//       (note that if serialization of any of the types used in PageState
+//       changes in a backwards-incompatible way then it should be caught by
+//       one of PageStateSerializationTest, BackwardsCompat_vXX tests).
+// - You'll also need to read/write the new field's value when decoding and
+//   encoding PageState, update PageStateSerializationTest to check that your
+//   new field is preserved across serialization, and add a BackwardsCompat
+//   test with associated serialized_vxx.dat file. Look for
+//   DumpExpectedPageStateForBackwardsCompat in
+//   page_state_serialization_unittest for how to do this.
+//
 // Don't remove, or change the type of fields; this will break
 // compatibility. If re-ordering fields, make sure to retain the original
 // ordinal value.
+//
 // Update the below value if your change introduces fields using it.
-// Next MinVersion: 2
+// Next MinVersion: 3
 
 // Next Ordinal: 4
 // FileSystemFile is no longer supported.
@@ -90,6 +99,7 @@ struct ViewState {
   [MinVersion=1] uint64 scroll_anchor_simhash@5 = 0;
 };
 
+// Next Ordinal: 13
 struct FrameState {
   mojo_base.mojom.String16? url_string@0;
   mojo_base.mojom.String16? referrer@1;
@@ -103,6 +113,7 @@ struct FrameState {
   network.mojom.ReferrerPolicy referrer_policy@9;
   HttpBody http_body@10;
   array<FrameState> children@11;
+  [MinVersion=2] string? initiator_origin@12;
 };
 
 // Next Ordinal: 2
diff --git a/chromium/content/common/page_state_serialization.cc b/chromium/content/common/page_state_serialization.cc
index bf884e3d3d3..1d92376abf3 100644
--- a/chromium/content/common/page_state_serialization.cc
+++ b/chromium/content/common/page_state_serialization.cc
@@ -6,6 +6,7 @@
 
 #include <algorithm>
 #include <limits>
+#include <utility>
 
 #include "base/pickle.h"
 #include "base/strings/string_number_conversions.h"
@@ -14,6 +15,7 @@
 #include "build/build_config.h"
 #include "content/common/page_state.mojom.h"
 #include "content/common/unique_name_helper.h"
+#include "content/public/common/referrer.h"
 #include "ipc/ipc_message_utils.h"
 #include "mojo/public/cpp/base/string16_mojom_traits.h"
 #include "mojo/public/cpp/base/time_mojom_traits.h"
@@ -205,6 +207,7 @@ struct SerializeObject {
 // 25: Limit the length of unique names: https://crbug.com/626202
 // 26: Switch to mojo-based serialization.
 // 27: Add serialized scroll anchor to FrameState.
+// 28: Add initiator origin to FrameState.
 // NOTE: If the version is -1, then the pickle contains only a URL string.
 // See ReadPageState.
 //
@@ -212,7 +215,7 @@ const int kMinVersion = 11;
 // NOTE: When changing the version, please add a backwards compatibility test.
 // See PageStateSerializationTest.DumpExpectedPageStateForBackwardsCompat for
 // instructions on how to generate the new test case.
-const int kCurrentVersion = 27;
+const int kCurrentVersion = 28;
 
 // A bunch of convenience functions to write to/read from SerializeObjects.  The
 // de-serializers assume the input data will be in the correct format and fall
@@ -464,7 +467,7 @@ void ReadResourceRequestBody(
         std::string blob_uuid = ReadStdString(obj);
         AppendBlobToRequestBody(request_body, blob_uuid);
       } else {
-        ReadGURL(obj); // Skip the obsolete blob url value.
+        ReadGURL(obj);  // Skip the obsolete blob url value.
       }
     }
   }
@@ -544,14 +547,13 @@ void ReadFrameState(
   state->item_sequence_number = ReadInteger64(obj);
   state->document_sequence_number = ReadInteger64(obj);
   if (obj->version >= 21 && obj->version < 23)
-    ReadInteger64(obj); // Skip obsolete frame sequence number.
+    ReadInteger64(obj);  // Skip obsolete frame sequence number.
 
   if (obj->version >= 17 && obj->version < 19)
-    ReadInteger64(obj); // Skip obsolete target frame id number.
+    ReadInteger64(obj);  // Skip obsolete target frame id number.
 
   if (obj->version >= 18) {
-    state->referrer_policy =
-        static_cast<network::mojom::ReferrerPolicy>(ReadInteger(obj));
+    state->referrer_policy = Referrer::ConvertToPolicy(ReadInteger(obj));
   }
 
   if (obj->version >= 20 && state->did_save_scroll_or_scale_state) {
@@ -773,6 +775,8 @@ void WriteFrameState(const ExplodedFrameState& state,
                      history::mojom::FrameState* frame) {
   frame->url_string = state.url_string;
   frame->referrer = state.referrer;
+  if (state.initiator_origin.has_value())
+    frame->initiator_origin = state.initiator_origin.value().Serialize();
   frame->target = state.target;
   frame->state_object = state.state_object;
 
@@ -823,6 +827,11 @@ void ReadFrameState(history::mojom::FrameState* frame,
                     ExplodedFrameState* state) {
   state->url_string = frame->url_string;
   state->referrer = frame->referrer;
+  if (frame->initiator_origin.has_value()) {
+    state->initiator_origin =
+        url::Origin::Create(GURL(frame->initiator_origin.value()));
+  }
+
   state->target = frame->target;
   state->state_object = frame->state_object;
 
@@ -1023,6 +1032,7 @@ void EncodePageState(const ExplodedPageState& exploded, std::string* encoded) {
   obj.version = kCurrentVersion;
   WriteMojoPageState(exploded, &obj);
   *encoded = obj.GetAsString();
+  DCHECK(!encoded->empty());
 }
 
 void LegacyEncodePageStateForTesting(const ExplodedPageState& exploded,
diff --git a/chromium/content/common/page_state_serialization.h b/chromium/content/common/page_state_serialization.h
index bed9ba7399c..c61a6c3eb56 100644
--- a/chromium/content/common/page_state_serialization.h
+++ b/chromium/content/common/page_state_serialization.h
@@ -21,6 +21,7 @@
 #include "ui/gfx/geometry/point.h"
 #include "ui/gfx/geometry/point_f.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 namespace content {
 
@@ -38,6 +39,7 @@ struct CONTENT_EXPORT ExplodedHttpBody {
 struct CONTENT_EXPORT ExplodedFrameState {
   base::Optional<base::string16> url_string;
   base::Optional<base::string16> referrer;
+  base::Optional<url::Origin> initiator_origin;
   base::Optional<base::string16> target;
   base::Optional<base::string16> state_object;
   std::vector<base::Optional<base::string16>> document_state;
diff --git a/chromium/content/common/page_state_serialization_unittest.cc b/chromium/content/common/page_state_serialization_unittest.cc
index 80cd7d6d615..251ef06ece6 100644
--- a/chromium/content/common/page_state_serialization_unittest.cc
+++ b/chromium/content/common/page_state_serialization_unittest.cc
@@ -75,6 +75,7 @@ void ExpectEquality(const ExplodedFrameState& expected,
   EXPECT_EQ(expected.url_string, actual.url_string);
   EXPECT_EQ(expected.referrer, actual.referrer);
   EXPECT_EQ(expected.referrer_policy, actual.referrer_policy);
+  EXPECT_EQ(expected.initiator_origin, actual.initiator_origin);
   EXPECT_EQ(expected.target, actual.target);
   EXPECT_EQ(expected.state_object, actual.state_object);
   ExpectEquality(expected.document_state, actual.document_state);
@@ -145,9 +146,30 @@ class PageStateSerializationTest : public testing::Test {
     referenced_files->emplace_back(path.AsUTF16Unsafe());
   }
 
-  void PopulateFrameStateForBackwardsCompatTest(
-      ExplodedFrameState* frame_state,
-      bool is_child) {
+  void PopulateFrameStateForBackwardsCompatTest(ExplodedFrameState* frame_state,
+                                                bool is_child,
+                                                int version) {
+    if (version < 28) {
+      // Older versions didn't cover |initiator_origin| -  we expect that
+      // deserialization will set it to the default, null value.
+      frame_state->initiator_origin = base::nullopt;
+    } else {
+      frame_state->initiator_origin =
+          url::Origin::Create(GURL("https://initiator.example.com"));
+    }
+
+    // Some of the test values below are the same as the default value that
+    // would be deserialized when reading old versions.  This is undesirable,
+    // because it means that the tests do not fully test that a non-default
+    // value is correctly deserialized.  Unfortunately this is tricky to change,
+    // because these default/old test values are baked into serialized_XX.dat
+    // test files (which we should be wary of modifying, since they are supposed
+    // to represent set-in-stone old serialization format).
+    //
+    // When introducing new fields, please test a non-default value, starting
+    // with the |version| where the new field is being introduced (set the
+    // |version|-dependent test value above - next to and similarly to how
+    // |initiator_origin| is handled).
     frame_state->url_string = base::UTF8ToUTF16("http://chromium.org/");
     frame_state->referrer = base::UTF8ToUTF16("http://google.com/");
     frame_state->referrer_policy = network::mojom::ReferrerPolicy::kDefault;
@@ -189,14 +211,15 @@ class PageStateSerializationTest : public testing::Test {
                                                        test_body2.size());
 
       ExplodedFrameState child_state;
-      PopulateFrameStateForBackwardsCompatTest(&child_state, true);
+      PopulateFrameStateForBackwardsCompatTest(&child_state, true, version);
       frame_state->children.push_back(child_state);
     }
   }
 
-  void PopulatePageStateForBackwardsCompatTest(ExplodedPageState* page_state) {
+  void PopulatePageStateForBackwardsCompatTest(ExplodedPageState* page_state,
+                                               int version) {
     page_state->referenced_files.push_back(base::UTF8ToUTF16("file.txt"));
-    PopulateFrameStateForBackwardsCompatTest(&page_state->top, false);
+    PopulateFrameStateForBackwardsCompatTest(&page_state->top, false, version);
   }
 
   void ReadBackwardsCompatPageState(const std::string& suffix,
@@ -251,7 +274,7 @@ class PageStateSerializationTest : public testing::Test {
 
     ExplodedPageState decoded_state;
     ExplodedPageState expected_state;
-    PopulatePageStateForBackwardsCompatTest(&expected_state);
+    PopulatePageStateForBackwardsCompatTest(&expected_state, version);
     ReadBackwardsCompatPageState(suffix, version, &decoded_state);
 
     ExpectEquality(expected_state, decoded_state);
@@ -390,7 +413,7 @@ TEST_F(PageStateSerializationTest, BadMessagesTest2) {
 // test compatibility and migration.
 TEST_F(PageStateSerializationTest, LegacyEncodePageStateFrozen) {
   ExplodedPageState actual_state;
-  PopulatePageStateForBackwardsCompatTest(&actual_state);
+  PopulatePageStateForBackwardsCompatTest(&actual_state, 25);
 
   std::string actual_encoded_state;
   LegacyEncodePageStateForTesting(actual_state, 25, &actual_encoded_state);
@@ -449,8 +472,11 @@ TEST_F(PageStateSerializationTest, ScrollAnchorSelectorLengthLimited) {
 // revision where page_state_serialization.cc:kCurrentVersion == 23.
 #if 0
 TEST_F(PageStateSerializationTest, DumpExpectedPageStateForBackwardsCompat) {
+  // Populate |state| with test data suitable for testing the current (i.e. the
+  // latest) version of serialization.  This is accomplished by asking for test
+  // data for version 9999 - a future, hypothetical version number.
   ExplodedPageState state;
-  PopulatePageStateForBackwardsCompatTest(&state);
+  PopulatePageStateForBackwardsCompatTest(&state, 9999);
 
   std::string encoded;
   EncodePageState(state, &encoded);
@@ -541,6 +567,10 @@ TEST_F(PageStateSerializationTest, BackwardsCompat_v27) {
   TestBackwardsCompat(27);
 }
 
+TEST_F(PageStateSerializationTest, BackwardsCompat_v28) {
+  TestBackwardsCompat(28);
+}
+
 // Add your new backwards compat test for future versions *above* this
 // comment block; field-specific tests go *below* this comment block.
 // Any field additions require a new version and backcompat test; only fields
diff --git a/chromium/content/common/page_zoom.cc b/chromium/content/common/page_zoom.cc
deleted file mode 100644
index af448aa421e..00000000000
--- a/chromium/content/common/page_zoom.cc
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <cmath>
-
-#include "content/public/common/page_zoom.h"
-
-namespace content {
-
-const double kMinimumZoomFactor = 0.25;
-const double kMaximumZoomFactor = 5.0;
-const double kEpsilon = 0.001;
-const double kTextSizeMultiplierRatio = 1.2;
-
-bool ZoomValuesEqual(double value_a, double value_b) {
-  return (std::fabs(value_a - value_b) <= kEpsilon);
-}
-
-double ZoomLevelToZoomFactor(double zoom_level) {
-  return std::pow(kTextSizeMultiplierRatio, zoom_level);
-}
-
-double ZoomFactorToZoomLevel(double factor) {
-  return std::log(factor) / std::log(kTextSizeMultiplierRatio);
-}
-
-}  // namespace content
diff --git a/chromium/content/common/page_zoom_unittest.cc b/chromium/content/common/page_zoom_unittest.cc
deleted file mode 100644
index 67dd5d567da..00000000000
--- a/chromium/content/common/page_zoom_unittest.cc
+++ /dev/null
@@ -1,19 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/common/page_zoom.h"
-
-#include "testing/gtest/include/gtest/gtest.h"
-
-TEST(PageZoomTest, ZoomValuesEqual) {
-  // Test two identical values.
-  EXPECT_TRUE(content::ZoomValuesEqual(1.5, 1.5));
-
-  // Test two values that are close enough to be considered equal.
-  EXPECT_TRUE(content::ZoomValuesEqual(1.5, 1.49999999));
-
-  // Test two values that are close, but should not be considered equal.
-  EXPECT_FALSE(content::ZoomValuesEqual(1.5, 1.4));
-}
-
diff --git a/chromium/content/common/render_message_filter.mojom b/chromium/content/common/render_message_filter.mojom
index bc461da3cfc..96e22365ac2 100644
--- a/chromium/content/common/render_message_filter.mojom
+++ b/chromium/content/common/render_message_filter.mojom
@@ -17,11 +17,11 @@ interface RenderMessageFilter {
 
   // Similar to CreateWindow, except used for sub-widgets, like <select>
   // dropdowns.
-  [Sync] CreateNewWidget(int32 opener_id, Widget widget)
+  [Sync] CreateNewWidget(int32 opener_id, pending_remote<Widget> widget)
       => (int32 route_id);
 
   // Similar to CreateWidget except the widget is a full screen window.
-  [Sync] CreateFullscreenWidget(int32 opener_id, Widget widget)
+  [Sync] CreateFullscreenWidget(int32 opener_id, pending_remote<Widget> widget)
       => (int32 route_id);
 
   // A renderer sends this when it wants to know whether a gpu process exists.
diff --git a/chromium/content/common/renderer.mojom b/chromium/content/common/renderer.mojom
index 9cd918745e4..4e4c1615c98 100644
--- a/chromium/content/common/renderer.mojom
+++ b/chromium/content/common/renderer.mojom
@@ -11,8 +11,8 @@ import "mojo/public/mojom/base/generic_pending_receiver.mojom";
 import "mojo/public/mojom/base/time.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "services/network/public/mojom/network_types.mojom";
+import "third_party/blink/public/mojom/manifest/manifest.mojom";
 import "third_party/blink/public/mojom/renderer_preferences.mojom";
-import "third_party/blink/public/mojom/service_worker/embedded_worker.mojom";
 import "third_party/blink/public/mojom/user_agent/user_agent_metadata.mojom";
 import "ui/gfx/geometry/mojom/geometry.mojom";
 
@@ -75,7 +75,9 @@ struct CreateViewParams {
   // Whether or not the frame has previously committed a real load.
   bool has_committed_real_load;
 
-  // The initial renderer size.
+  // Initial state for the main frame RenderWidget.
+  // TODO(danakj): This should be optional and not included when there is no
+  // main_frame_widget_routing_id.
   VisualProperties visual_properties;
 
   // Whether lookup of frames in the created RenderView (e.g. lookup via
@@ -89,9 +91,11 @@ struct CreateViewParams {
 
 struct CreateFrameWidgetParams {
   // Gives the routing ID for the RenderWidget that will be attached to the
-  // new RenderFrame. If the RenderFrame does not need a RenderWidget, this
-  // is MSG_ROUTING_NONE and the other parameters are not read.
+  // new RenderFrame.
   int32 routing_id;
+
+  // The initial visual properties of the widget.
+  VisualProperties visual_properties;
 };
 
 struct CreateFrameParams {
@@ -141,7 +145,7 @@ struct CreateFrameParams {
 
   // Specifies properties for a new RenderWidget that will be attached to the
   // new RenderFrame (if one is needed).
-  CreateFrameWidgetParams widget_params;
+  CreateFrameWidgetParams? widget_params;
 
   // Whether or not the frame has previously committed a real load.
   bool has_committed_real_load;
@@ -210,14 +214,6 @@ interface Renderer {
                    FrameReplicationState replication_state,
                    mojo_base.mojom.UnguessableToken devtools_frame_token);
 
-  // Tells the renderer to create an EmbeddedWorkerInstanceClient, which is what
-  // manages service worker startup and shutdown.
-  // TODO(shimazu): Send all params for starting service worker to reduce the
-  // number of IPCs.
-  SetUpEmbeddedWorkerChannelForServiceWorker(
-      pending_receiver<blink.mojom.EmbeddedWorkerInstanceClient>
-          client_receiver);
-
   // Tells the renderer that the network type has changed so that
   // navigator.onLine and navigator.connection can be updated.
   OnNetworkConnectionChanged(NetworkConnectionType connection_type,
diff --git a/chromium/content/common/resource_messages.h b/chromium/content/common/resource_messages.h
index c31444de9a6..0d31d88e8d4 100644
--- a/chromium/content/common/resource_messages.h
+++ b/chromium/content/common/resource_messages.h
@@ -29,10 +29,6 @@
 
 #endif  // INTERNAL_CONTENT_COMMON_RESOURCE_MESSAGES_H_
 
-#define IPC_MESSAGE_START ResourceMsgStart
-#undef IPC_MESSAGE_EXPORT
-#define IPC_MESSAGE_EXPORT CONTENT_EXPORT
-
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebMixedContentContextType,
                           blink::WebMixedContentContextType::kLast)
 
diff --git a/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc b/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
index 0de95f888f0..44a23dd1163 100644
--- a/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
+++ b/chromium/content/common/service_manager/service_manager_connection_impl_unittest.cc
@@ -23,7 +23,7 @@ constexpr char kTestServiceName[] = "test service";
 }  // namespace
 
 TEST(ServiceManagerConnectionImplTest, ServiceLaunchThreading) {
-  base::test::TaskEnvironment task_environment;
+  base::test::SingleThreadTaskEnvironment task_environment;
   base::Thread io_thread("ServiceManagerConnectionImplTest IO Thread");
   io_thread.Start();
   service_manager::mojom::ServicePtr service;
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.cc b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
index 392867932a5..1f573ee5b22 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.cc
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.cc
@@ -17,9 +17,10 @@
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
 #include "services/network/loader_util.h"
+#include "services/network/public/cpp/content_security_policy.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_request_body.h"
-#include "services/network/public/cpp/resource_response.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
 #include "ui/base/page_transition_types.h"
 
@@ -52,7 +53,7 @@ void ServiceWorkerLoaderHelpers::SaveResponseHeaders(
     const int status_code,
     const std::string& status_text,
     const base::flat_map<std::string, std::string>& headers,
-    network::ResourceResponseHead* out_head) {
+    network::mojom::URLResponseHead* out_head) {
   // Build a string instead of using HttpResponseHeaders::AddHeader on
   // each header, since AddHeader has O(n^2) performance.
   std::string buf(base::StringPrintf("HTTP/1.1 %d %s\r\n", status_code,
@@ -93,7 +94,7 @@ void ServiceWorkerLoaderHelpers::SaveResponseHeaders(
 // static
 void ServiceWorkerLoaderHelpers::SaveResponseInfo(
     const blink::mojom::FetchAPIResponse& response,
-    network::ResourceResponseHead* out_head) {
+    network::mojom::URLResponseHead* out_head) {
   out_head->was_fetched_via_service_worker = true;
   out_head->was_fallback_required_by_service_worker = false;
   out_head->url_list_via_service_worker = response.url_list;
@@ -108,13 +109,15 @@ void ServiceWorkerLoaderHelpers::SaveResponseInfo(
     out_head->cache_storage_cache_name.clear();
   out_head->cors_exposed_header_names = response.cors_exposed_header_names;
   out_head->did_service_worker_navigation_preload = false;
+  out_head->content_security_policy =
+      network::ContentSecurityPolicy(response.content_security_policy.Clone());
 }
 
 // static
 base::Optional<net::RedirectInfo>
 ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
     const network::ResourceRequest& original_request,
-    const network::ResourceResponseHead& response_head) {
+    const network::mojom::URLResponseHead& response_head) {
   std::string new_location;
   if (!response_head.headers->IsRedirect(&new_location))
     return base::nullopt;
@@ -128,9 +131,9 @@ ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
           : net::URLRequest::NEVER_CHANGE_FIRST_PARTY_URL;
   return net::RedirectInfo::ComputeRedirectInfo(
       original_request.method, original_request.url,
-      original_request.site_for_cookies, original_request.top_frame_origin,
-      first_party_url_policy, original_request.referrer_policy,
-      network::ComputeReferrer(original_request.referrer),
+      original_request.site_for_cookies, first_party_url_policy,
+      original_request.referrer_policy,
+      original_request.referrer.GetAsReferrer().spec(),
       response_head.headers->response_code(),
       original_request.url.Resolve(new_location),
       net::RedirectUtil::GetReferrerPolicyHeader(response_head.headers.get()),
@@ -138,7 +141,7 @@ ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
 }
 
 int ServiceWorkerLoaderHelpers::ReadBlobResponseBody(
-    blink::mojom::BlobPtr* blob,
+    mojo::Remote<blink::mojom::Blob>* blob,
     uint64_t blob_size,
     base::OnceCallback<void(int)> on_blob_read_complete,
     mojo::ScopedDataPipeConsumerHandle* handle_out) {
diff --git a/chromium/content/common/service_worker/service_worker_loader_helpers.h b/chromium/content/common/service_worker/service_worker_loader_helpers.h
index 5b037576294..c90564e3b3a 100644
--- a/chromium/content/common/service_worker/service_worker_loader_helpers.h
+++ b/chromium/content/common/service_worker/service_worker_loader_helpers.h
@@ -7,14 +7,15 @@
 
 #include "base/containers/flat_map.h"
 #include "base/optional.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/http/http_request_headers.h"
 #include "net/url_request/redirect_info.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_response.mojom.h"
 
 namespace network {
 struct ResourceRequest;
-struct ResourceResponseHead;
 }
 
 namespace content {
@@ -29,23 +30,23 @@ class ServiceWorkerLoaderHelpers {
       const int status_code,
       const std::string& status_text,
       const base::flat_map<std::string, std::string>& headers,
-      network::ResourceResponseHead* out_head);
+      network::mojom::URLResponseHead* out_head);
   // Populates |out_head| (except for headers) with given |response|.
   static void SaveResponseInfo(const blink::mojom::FetchAPIResponse& response,
-                               network::ResourceResponseHead* out_head);
+                               network::mojom::URLResponseHead* out_head);
 
   // Returns a redirect info if |response_head| is an redirect response.
   // Otherwise returns base::nullopt.
   static base::Optional<net::RedirectInfo> ComputeRedirectInfo(
       const network::ResourceRequest& original_request,
-      const network::ResourceResponseHead& response_head);
+      const network::mojom::URLResponseHead& response_head);
 
   // Reads |blob| into |handle_out|. Calls |on_blob_read_complete| when done or
   // if an error occurred. Currently this always returns net::OK but
   // the plan is to return an error if reading couldn't start, in
   // which case |on_blob_read_complete| isn't called.
   static int ReadBlobResponseBody(
-      blink::mojom::BlobPtr* blob,
+      mojo::Remote<blink::mojom::Blob>* blob,
       uint64_t blob_size,
       base::OnceCallback<void(int net_error)> on_blob_read_complete,
       mojo::ScopedDataPipeConsumerHandle* handle_out);
diff --git a/chromium/content/common/throttling_url_loader.cc b/chromium/content/common/throttling_url_loader.cc
index 4c4046499ce..ee5e64a114f 100644
--- a/chromium/content/common/throttling_url_loader.cc
+++ b/chromium/content/common/throttling_url_loader.cc
@@ -12,6 +12,8 @@
 #include "net/http/http_util.h"
 #include "net/url_request/redirect_util.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/resource_response.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 
 namespace content {
 
@@ -74,11 +76,11 @@ class ThrottlingURLLoader::ForwardingThrottleDelegate
   }
 
   void UpdateDeferredResponseHead(
-      const network::ResourceResponseHead& new_response_head) override {
+      network::mojom::URLResponseHeadPtr new_response_head) override {
     if (!loader_)
       return;
     ScopedDelegateCall scoped_delegate_call(this);
-    loader_->UpdateDeferredResponseHead(new_response_head);
+    loader_->UpdateDeferredResponseHead(std::move(new_response_head));
   }
 
   void PauseReadingBodyFromNet() override {
@@ -179,15 +181,16 @@ ThrottlingURLLoader::StartInfo::StartInfo(
 ThrottlingURLLoader::StartInfo::~StartInfo() = default;
 
 ThrottlingURLLoader::ResponseInfo::ResponseInfo(
-    const network::ResourceResponseHead& in_response_head)
-    : response_head(in_response_head) {}
+    network::mojom::URLResponseHeadPtr in_response_head)
+    : response_head(std::move(in_response_head)) {}
 
 ThrottlingURLLoader::ResponseInfo::~ResponseInfo() = default;
 
 ThrottlingURLLoader::RedirectInfo::RedirectInfo(
     const net::RedirectInfo& in_redirect_info,
-    const network::ResourceResponseHead& in_response_head)
-    : redirect_info(in_redirect_info), response_head(in_response_head) {}
+    network::mojom::URLResponseHeadPtr in_response_head)
+    : redirect_info(in_redirect_info),
+      response_head(std::move(in_response_head)) {}
 
 ThrottlingURLLoader::RedirectInfo::~RedirectInfo() = default;
 
@@ -392,8 +395,7 @@ void ThrottlingURLLoader::StartNow() {
 
     net::RedirectInfo redirect_info = net::RedirectInfo::ComputeRedirectInfo(
         start_info_->url_request.method, start_info_->url_request.url,
-        start_info_->url_request.site_for_cookies,
-        start_info_->url_request.top_frame_origin, first_party_url_policy,
+        start_info_->url_request.site_for_cookies, first_party_url_policy,
         start_info_->url_request.referrer_policy,
         start_info_->url_request.referrer.spec(),
         // Use status code 307 to preserve the method, so POST requests work.
@@ -413,7 +415,7 @@ void ThrottlingURLLoader::StartNow() {
     // that's requested.
     start_info_->url_request.url = throttle_will_start_redirect_url_;
 
-    network::ResourceResponseHead response_head;
+    auto response_head = network::mojom::URLResponseHead::New();
     std::string header_string = base::StringPrintf(
         "HTTP/1.1 %i Internal Redirect\n"
         "Location: %s",
@@ -421,26 +423,26 @@ void ThrottlingURLLoader::StartNow() {
         throttle_will_start_redirect_url_.spec().c_str());
 
     // This is only needed when CORS is running in the renderer.
-    if (!network::features::ShouldEnableOutOfBlinkCors()) {
-      std::string http_origin;
-      if (start_info_->url_request.headers.GetHeader("Origin", &http_origin)) {
-        // If this redirect is used in a cross-origin request, add CORS headers
-        // to make sure that the redirect gets through. Note that the
-        // destination URL is still subject to the usual CORS policy, i.e. the
-        // resource will only be available to web pages if the server serves the
-        // response with the required CORS response headers.
-        header_string += base::StringPrintf(
-            "\n"
-            "Access-Control-Allow-Origin: %s\n"
-            "Access-Control-Allow-Credentials: true",
-            http_origin.c_str());
-      }
+    // TODO(crbug.com/1001450): Remove following code once OOR-CORS is fully
+    // enabled.
+    std::string http_origin;
+    if (start_info_->url_request.headers.GetHeader("Origin", &http_origin)) {
+      // If this redirect is used in a cross-origin request, add CORS headers
+      // to make sure that the redirect gets through. Note that the
+      // destination URL is still subject to the usual CORS policy, i.e. the
+      // resource will only be available to web pages if the server serves the
+      // response with the required CORS response headers.
+      header_string += base::StringPrintf(
+          "\n"
+          "Access-Control-Allow-Origin: %s\n"
+          "Access-Control-Allow-Credentials: true",
+          http_origin.c_str());
     }
 
-    response_head.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+    response_head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
         net::HttpUtil::AssembleRawHeaders(header_string));
-    response_head.encoded_data_length = header_string.size();
-    OnReceiveRedirect(redirect_info, response_head);
+    response_head->encoded_data_length = header_string.size();
+    OnReceiveRedirect(redirect_info, std::move(response_head));
     return;
   }
 
@@ -611,8 +613,8 @@ void ThrottlingURLLoader::OnReceiveRedirect(
 
     if (deferred) {
       deferred_stage_ = DEFERRED_REDIRECT;
-      redirect_info_ =
-          std::make_unique<RedirectInfo>(redirect_info, response_head);
+      redirect_info_ = std::make_unique<RedirectInfo>(redirect_info,
+                                                      std::move(response_head));
       // |client_binding_| can be unbound if the redirect came from a throttle.
       if (client_binding_.is_bound())
         client_binding_.PauseIncomingMethodCallProcessing();
@@ -626,7 +628,6 @@ void ThrottlingURLLoader::OnReceiveRedirect(
   request.url = redirect_info.new_url;
   request.method = redirect_info.new_method;
   request.site_for_cookies = redirect_info.new_site_for_cookies;
-  request.top_frame_origin = redirect_info.new_top_frame_origin;
   request.referrer = GURL(redirect_info.new_referrer);
   request.referrer_policy = redirect_info.new_referrer_policy;
 
@@ -747,8 +748,9 @@ void ThrottlingURLLoader::Resume() {
       // the redirect or if it will be cancelled. FollowRedirect would be a more
       // suitable place to set this URL but there we do not have the data.
       response_url_ = redirect_info_->redirect_info.new_url;
-      forwarding_client_->OnReceiveRedirect(redirect_info_->redirect_info,
-                                            redirect_info_->response_head);
+      forwarding_client_->OnReceiveRedirect(
+          redirect_info_->redirect_info,
+          std::move(redirect_info_->response_head));
       // Note: |this| may be deleted here.
       break;
     }
@@ -765,7 +767,8 @@ void ThrottlingURLLoader::Resume() {
     }
     case DEFERRED_RESPONSE: {
       client_binding_.ResumeIncomingMethodCallProcessing();
-      forwarding_client_->OnReceiveResponse(response_info_->response_head);
+      forwarding_client_->OnReceiveResponse(
+          std::move(response_info_->response_head));
       // Note: |this| may be deleted here.
       break;
     }
@@ -810,10 +813,10 @@ void ThrottlingURLLoader::UpdateDeferredRequestHeaders(
 }
 
 void ThrottlingURLLoader::UpdateDeferredResponseHead(
-    const network::ResourceResponseHead& new_response_head) {
+    network::mojom::URLResponseHeadPtr new_response_head) {
   DCHECK(response_info_);
   DCHECK_EQ(DEFERRED_RESPONSE, deferred_stage_);
-  response_info_->response_head = new_response_head;
+  response_info_->response_head = std::move(new_response_head);
 }
 
 void ThrottlingURLLoader::PauseReadingBodyFromNet(
diff --git a/chromium/content/common/throttling_url_loader.h b/chromium/content/common/throttling_url_loader.h
index f723990d006..e5e64fbe267 100644
--- a/chromium/content/common/throttling_url_loader.h
+++ b/chromium/content/common/throttling_url_loader.h
@@ -14,10 +14,10 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/binding.h"
-#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 
 namespace base {
@@ -144,7 +144,7 @@ class CONTENT_EXPORT ThrottlingURLLoader
       const net::HttpRequestHeaders& modified_request_headers,
       const net::HttpRequestHeaders& modified_cors_exempt_request_headers);
   void UpdateDeferredResponseHead(
-      const network::ResourceResponseHead& new_response_head);
+      network::mojom::URLResponseHeadPtr new_response_head);
   void PauseReadingBodyFromNet(blink::URLLoaderThrottle* throttle);
   void ResumeReadingBodyFromNet(blink::URLLoaderThrottle* throttle);
   void InterceptResponse(
@@ -220,22 +220,21 @@ class CONTENT_EXPORT ThrottlingURLLoader
   std::unique_ptr<StartInfo> start_info_;
 
   struct ResponseInfo {
-    explicit ResponseInfo(
-        const network::ResourceResponseHead& in_response_head);
+    explicit ResponseInfo(network::mojom::URLResponseHeadPtr in_response_head);
     ~ResponseInfo();
 
-    network::ResourceResponseHead response_head;
+    network::mojom::URLResponseHeadPtr response_head;
   };
   // Set if response is deferred.
   std::unique_ptr<ResponseInfo> response_info_;
 
   struct RedirectInfo {
     RedirectInfo(const net::RedirectInfo& in_redirect_info,
-                 const network::ResourceResponseHead& in_response_head);
+                 network::mojom::URLResponseHeadPtr in_response_head);
     ~RedirectInfo();
 
     net::RedirectInfo redirect_info;
-    network::ResourceResponseHead response_head;
+    network::mojom::URLResponseHeadPtr response_head;
   };
   // Set if redirect is deferred.
   std::unique_ptr<RedirectInfo> redirect_info_;
diff --git a/chromium/content/common/throttling_url_loader_unittest.cc b/chromium/content/common/throttling_url_loader_unittest.cc
index 963b47b4812..145bd2f6932 100644
--- a/chromium/content/common/throttling_url_loader_unittest.cc
+++ b/chromium/content/common/throttling_url_loader_unittest.cc
@@ -10,6 +10,7 @@
 #include "base/run_loop.h"
 #include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
@@ -66,13 +67,14 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
   }
 
   void NotifyClientOnReceiveResponse() {
-    client_ptr_->OnReceiveResponse(network::ResourceResponseHead());
+    client_ptr_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   }
 
   void NotifyClientOnReceiveRedirect() {
     net::RedirectInfo info;
     info.new_url = redirect_url;
-    client_ptr_->OnReceiveRedirect(info, network::ResourceResponseHead());
+    client_ptr_->OnReceiveRedirect(info,
+                                   network::mojom::URLResponseHead::New());
   }
 
   void NotifyClientOnComplete(int error_code) {
@@ -112,7 +114,8 @@ class TestURLLoaderFactory : public network::mojom::URLLoaderFactory,
       on_create_loader_and_start_callback_.Run(url_request);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     NOTREACHED();
   }
 
diff --git a/chromium/content/common/user_agent.cc b/chromium/content/common/user_agent.cc
index 65083a09551..37e72394997 100644
--- a/chromium/content/common/user_agent.cc
+++ b/chromium/content/common/user_agent.cc
@@ -30,7 +30,7 @@ const base::Feature kAndroidUserAgentStringContainsBuildId{
 #endif  // defined(OS_ANDROID)
 
 std::string GetUserAgentPlatform() {
-#if defined(OS_WIN) || defined(OS_FUCHSIA)
+#if defined(OS_WIN)
   return "";
 #elif defined(OS_MACOSX)
   return "Macintosh; ";
@@ -38,6 +38,10 @@ std::string GetUserAgentPlatform() {
   return "X11; ";  // strange, but that's what Firefox uses
 #elif defined(OS_ANDROID)
   return "Linux; ";
+#elif defined(OS_FUCHSIA)
+  // TODO(https://crbug.com/1010256): Sites get confused into serving mobile
+  // content if we report only "Fuchsia".
+  return "X11; ";
 #elif defined(OS_POSIX)
   return "Unknown; ";
 #endif
diff --git a/chromium/content/common/view_messages.h b/chromium/content/common/view_messages.h
index 632b7b8159a..ac32a53c5cd 100644
--- a/chromium/content/common/view_messages.h
+++ b/chromium/content/common/view_messages.h
@@ -23,6 +23,7 @@
 #include "components/viz/common/frame_sinks/begin_frame_args.h"
 #include "components/viz/common/quads/compositor_frame.h"
 #include "components/viz/common/resources/shared_bitmap.h"
+#include "content/common/common_param_traits_macros.h"
 #include "content/common/content_export.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/frame_replication_state.h"
@@ -40,10 +41,10 @@
 #include "media/base/ipc/media_param_traits.h"
 #include "net/base/network_change_notifier.h"
 #include "ppapi/buildflags/buildflags.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/common/plugin/plugin_action.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "third_party/blink/public/platform/web_text_autosizer_page_info.h"
-#include "third_party/blink/public/web/web_plugin_action.h"
 #include "third_party/blink/public/web/web_text_direction.h"
 #include "ui/base/ime/text_input_type.h"
 #include "ui/gfx/color_space.h"
@@ -67,8 +68,8 @@
 
 #define IPC_MESSAGE_START ViewMsgStart
 
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebPluginAction::Type,
-                          blink::WebPluginAction::Type::kTypeLast)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::PluginAction::Type,
+                          blink::PluginAction::Type::kTypeLast)
 IPC_ENUM_TRAITS_MAX_VALUE(content::MenuItem::Type, content::MenuItem::TYPE_LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(content::NavigationGesture,
                           content::NavigationGestureLast)
@@ -92,7 +93,7 @@ IPC_ENUM_TRAITS_MAX_VALUE(ui::NativeTheme::PreferredColorScheme,
 IPC_ENUM_TRAITS_MAX_VALUE(ui::NativeTheme::SystemThemeColor,
                           ui::NativeTheme::SystemThemeColor::kMaxValue)
 
-IPC_STRUCT_TRAITS_BEGIN(blink::WebPluginAction)
+IPC_STRUCT_TRAITS_BEGIN(blink::PluginAction)
   IPC_STRUCT_TRAITS_MEMBER(type)
   IPC_STRUCT_TRAITS_MEMBER(enable)
 IPC_STRUCT_TRAITS_END()
@@ -114,9 +115,6 @@ IPC_STRUCT_TRAITS_END()
 // Make the RenderWidget background transparent or opaque.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetBackgroundOpaque, bool /* opaque */)
 
-// Sends updated preferences to the renderer.
-IPC_MESSAGE_ROUTED1(ViewMsg_SetRendererPrefs, blink::mojom::RendererPreferences)
-
 // This passes a set of webkit preferences down to the renderer.
 IPC_MESSAGE_ROUTED1(ViewMsg_UpdateWebPreferences,
                     content::WebPreferences)
@@ -130,7 +128,7 @@ IPC_MESSAGE_ROUTED1(ViewMsg_SetInitialFocus,
 // the given point.
 IPC_MESSAGE_ROUTED2(ViewMsg_PluginActionAt,
                     gfx::Point, /* location */
-                    blink::WebPluginAction)
+                    blink::PluginAction)
 
 // Sets the page scale for the current main frame to the given page scale.
 IPC_MESSAGE_ROUTED1(ViewMsg_SetPageScale, float /* page_scale_factor */)
@@ -284,14 +282,6 @@ IPC_MESSAGE_ROUTED1(
     ViewHostMsg_NotifyTextAutosizerPageInfoChangedInLocalMainFrame,
     blink::WebTextAutosizerPageInfo /* page_info */)
 
-// Updates the minimum/maximum allowed zoom percent for this tab from the
-// default values.  If |remember| is true, then the zoom setting is applied to
-// other pages in the site and is saved, otherwise it only applies to this
-// tab.
-IPC_MESSAGE_ROUTED2(ViewHostMsg_UpdateZoomLimits,
-                    int /* minimum_percent */,
-                    int /* maximum_percent */)
-
 // Send back a string to be recorded by UserMetrics.
 IPC_MESSAGE_CONTROL1(ViewHostMsg_UserMetricsRecordAction,
                      std::string /* action */)
diff --git a/chromium/content/common/visual_properties.h b/chromium/content/common/visual_properties.h
index 198422384e8..5f64c144537 100644
--- a/chromium/content/common/visual_properties.h
+++ b/chromium/content/common/visual_properties.h
@@ -10,11 +10,45 @@
 #include "components/viz/common/surfaces/local_surface_id_allocation.h"
 #include "content/common/content_export.h"
 #include "content/public/common/screen_info.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "ui/gfx/geometry/size.h"
 
 namespace content {
 
+// Visual properties contain context required to render a frame tree.
+// For legacy reasons, both Page visual properties [shared by all Renderers] and
+// Widget visual properties [unique to local frame roots] are passed along the
+// same data structure. Separating these is tricky because they both affect
+// rendering, and if updates are received asynchronously, this can cause
+// incorrect behavior.
+// Visual properties are also used for Pepper fullscreen and popups, which are
+// also based on Widgets.
+//
+// The data flow for VisualProperties is tricky. For legacy reasons, visual
+// properties are currently always sent from RenderWidgetHosts to RenderWidgets.
+// However, RenderWidgets can also send visual properties to out-of-process
+// subframes [by bouncing through CrossProcessFrameConnector]. This causes a
+// cascading series of VisualProperty messages. This is necessary due to the
+// current implementation to make sure that cross-process surfaces get
+// simultaneously synchronized. For more details, see:
+// https://docs.google.com/document/d/1VKOLBYlujcn862w9LAyUbv6oW9RZgD65oDCI_G5AEVQ/edit#heading=h.wno2seszsyen
+// https://docs.google.com/document/d/1J7BTRsylGApm6KHaaTu-m6LLvSWJgf1B9CM-USKIp1k/edit#heading=h.ichmoicfam1y
+//
+// Known problems:
+// + It's not clear which properties are page-specific and which are
+// widget-specific. We should document them.
+// + It's not clear which properties are only set by the browser, which are only
+// set by the renderer, and which are set by both.
+// + Given the frame tree A(B(A')) where A and A' are same-origin, same process
+// and B is separate origin separate process:
+//   (1) RenderWidget A gets SynchronizeVisualProperties, passes it to proxy for
+//   B, sets values on RenderView/Page.
+//   (2) RenderWidget B gets SynchronizeVisualProperties, passes it to proxy for
+//   A'
+//   (3) RenderWidget A' gets SynchronizeVisualProperties.
+// In between (1) and (3), frames associated with RenderWidget A' will see
+// updated page properties from (1) but are still seeing old widget properties.
+
 struct CONTENT_EXPORT VisualProperties {
   VisualProperties();
   VisualProperties(const VisualProperties& other);
@@ -69,7 +103,8 @@ struct CONTENT_EXPORT VisualProperties {
   bool is_fullscreen_granted = false;
 
   // The display mode.
-  blink::WebDisplayMode display_mode = blink::kWebDisplayModeUndefined;
+  blink::mojom::DisplayMode display_mode =
+      blink::mojom::DisplayMode::kUndefined;
 
   // This represents the latest capture sequence number requested. When this is
   // incremented, that means the caller wants to synchronize surfaces which
diff --git a/chromium/content/common/widget_messages.h b/chromium/content/common/widget_messages.h
index b7263693670..1fbd8f1fccb 100644
--- a/chromium/content/common/widget_messages.h
+++ b/chromium/content/common/widget_messages.h
@@ -10,6 +10,7 @@
 #include "base/optional.h"
 #include "base/time/time.h"
 #include "cc/input/touch_action.h"
+#include "content/common/common_param_traits_macros.h"
 #include "content/common/content_param_traits.h"
 #include "content/common/cursors/webcursor.h"
 #include "content/common/tab_switch_time_recorder.h"
@@ -22,7 +23,6 @@
 #include "third_party/blink/public/platform/web_float_point.h"
 #include "third_party/blink/public/platform/web_float_rect.h"
 #include "third_party/blink/public/platform/web_intrinsic_sizing_info.h"
-#include "third_party/blink/public/web/web_device_emulation_params.h"
 #include "third_party/blink/public/web/web_text_direction.h"
 #include "ui/base/ime/text_input_action.h"
 #include "ui/base/ime/text_input_mode.h"
@@ -35,41 +35,6 @@
 
 #define IPC_MESSAGE_START WidgetMsgStart
 
-// Traits for VisualProperties.
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDeviceEmulationParams::ScreenPosition,
-                          blink::WebDeviceEmulationParams::kScreenPositionLast)
-
-IPC_ENUM_TRAITS_MAX_VALUE(content::ScreenOrientationValues,
-                          content::SCREEN_ORIENTATION_VALUES_LAST)
-
-IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::WebScreenOrientationType,
-                              blink::kWebScreenOrientationUndefined,
-                              blink::WebScreenOrientationTypeLast)
-
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebDisplayMode,
-                          blink::WebDisplayMode::kWebDisplayModeLast)
-
-IPC_STRUCT_TRAITS_BEGIN(content::VisualProperties)
-  IPC_STRUCT_TRAITS_MEMBER(screen_info)
-  IPC_STRUCT_TRAITS_MEMBER(auto_resize_enabled)
-  IPC_STRUCT_TRAITS_MEMBER(min_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(max_size_for_auto_resize)
-  IPC_STRUCT_TRAITS_MEMBER(new_size)
-  IPC_STRUCT_TRAITS_MEMBER(compositor_viewport_pixel_rect)
-  IPC_STRUCT_TRAITS_MEMBER(browser_controls_shrink_blink_size)
-  IPC_STRUCT_TRAITS_MEMBER(scroll_focused_node_into_view)
-  IPC_STRUCT_TRAITS_MEMBER(top_controls_height)
-  IPC_STRUCT_TRAITS_MEMBER(bottom_controls_height)
-  IPC_STRUCT_TRAITS_MEMBER(local_surface_id_allocation)
-  IPC_STRUCT_TRAITS_MEMBER(visible_viewport_size)
-  IPC_STRUCT_TRAITS_MEMBER(is_fullscreen_granted)
-  IPC_STRUCT_TRAITS_MEMBER(display_mode)
-  IPC_STRUCT_TRAITS_MEMBER(capture_sequence_number)
-  IPC_STRUCT_TRAITS_MEMBER(zoom_level)
-  IPC_STRUCT_TRAITS_MEMBER(page_scale_factor)
-  IPC_STRUCT_TRAITS_MEMBER(is_pinch_gesture_active)
-IPC_STRUCT_TRAITS_END()
-
 // Traits for WebDeviceEmulationParams.
 IPC_STRUCT_TRAITS_BEGIN(blink::WebFloatPoint)
   IPC_STRUCT_TRAITS_MEMBER(x)
@@ -146,12 +111,6 @@ IPC_MESSAGE_ROUTED2(WidgetMsg_ShowContextMenu,
 // Expects a Close_ACK message when finished.
 IPC_MESSAGE_ROUTED0(WidgetMsg_Close)
 
-// Tells the renderer to update visual properties. The resulting
-// CompositorFrame will produce a RenderFrameMetadata containing a new
-// LocalSurfaceId. This acts as a form of ACK for this message.
-IPC_MESSAGE_ROUTED1(WidgetMsg_SynchronizeVisualProperties,
-                    content::VisualProperties /* params */)
-
 // Enables device emulation. See WebDeviceEmulationParams for description.
 IPC_MESSAGE_ROUTED1(WidgetMsg_EnableDeviceEmulation,
                     blink::WebDeviceEmulationParams /* params */)
@@ -188,8 +147,14 @@ IPC_MESSAGE_ROUTED1(WidgetMsg_SetTextDirection,
 // are in progress.
 IPC_MESSAGE_ROUTED0(WidgetMsg_SetBounds_ACK)
 
+// Updates a RenderWidget's visual properties. This should include all
+// geometries and compositing inputs so that they are updated atomically.
+IPC_MESSAGE_ROUTED1(WidgetMsg_UpdateVisualProperties,
+                    content::VisualProperties /* visual_properties */)
+
 // Informs the RenderWidget of its position on the user's screen, as well as
 // the position of the native window holding the RenderWidget.
+// TODO(danakj): These should be part of UpdateVisualProperties.
 IPC_MESSAGE_ROUTED2(WidgetMsg_UpdateScreenRects,
                     gfx::Rect /* widget_screen_rect */,
                     gfx::Rect /* window_screen_rect */)
@@ -333,9 +298,6 @@ IPC_MESSAGE_ROUTED0(WidgetHostMsg_WaitForNextFrameForTests_ACK)
 // after the frame widget has painted something.
 IPC_MESSAGE_ROUTED0(WidgetHostMsg_DidFirstVisuallyNonEmptyPaint)
 
-// Sent once the RenderWidgetCompositor issues a draw command.
-IPC_MESSAGE_ROUTED0(WidgetHostMsg_DidCommitAndDrawCompositorFrame)
-
 // Notifies whether there are JavaScript touch event handlers or not.
 IPC_MESSAGE_ROUTED1(WidgetHostMsg_HasTouchEventHandlers,
                     bool /* has_handlers */)
diff --git a/chromium/content/content_resources.grd b/chromium/content/content_resources.grd
index 979eb9af407..d067b9644a4 100644
--- a/chromium/content/content_resources.grd
+++ b/chromium/content/content_resources.grd
@@ -30,9 +30,10 @@
       <include name="IDR_INDEXED_DB_INTERNALS_CSS" file="browser/resources/indexed_db/indexeddb_internals.css" flattenhtml="true" compress="gzip" type="BINDATA" />
       <include name="IDR_MEDIA_INTERNALS_HTML" file="browser/resources/media/media_internals.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
       <include name="IDR_MEDIA_INTERNALS_JS" file="browser/resources/media/media_internals.js" flattenhtml="true" compress="gzip" type="BINDATA" />
+      <include name="IDR_MEDIA_INTERNALS_JS_DISABLED" file="browser/resources/media/media_internals_disabled.js" flattenhtml="true" compress="gzip" type="BINDATA" />
       <include name="IDR_NETWORK_ERROR_LISTING_HTML" file="browser/resources/net/network_errors_listing.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
-      <include name="IDR_NETWORK_ERROR_LISTING_JS" file="browser/resources/net/network_errors_listing.js" flattenhtml="true" type="BINDATA" />
-      <include name="IDR_NETWORK_ERROR_LISTING_CSS" file="browser/resources/net/network_errors_listing.css" flattenhtml="true" type="BINDATA" />
+      <include name="IDR_NETWORK_ERROR_LISTING_JS" file="browser/resources/net/network_errors_listing.js" flattenhtml="true" type="BINDATA" compress="gzip" />
+      <include name="IDR_NETWORK_ERROR_LISTING_CSS" file="browser/resources/net/network_errors_listing.css" flattenhtml="true" type="BINDATA" compress="gzip" />
       <include name="IDR_ORIGIN_MOJO_HTML" file="${root_gen_dir}/url/mojom/origin.mojom.html" use_base_dir="false" type="BINDATA" compress="gzip" />
       <include name="IDR_ORIGIN_MOJO_JS" file="${root_gen_dir}/url/mojom/origin.mojom-lite.js" use_base_dir="false" type="BINDATA" compress="gzip" />
       <include name="IDR_PROCESS_INTERNALS_HTML" file="browser/resources/process/process_internals.html" flattenhtml="true" allowexternalscript="true" compress="gzip" type="BINDATA" />
diff --git a/chromium/content/gpu/BUILD.gn b/chromium/content/gpu/BUILD.gn
index 0939d25ccd7..fde557cc303 100644
--- a/chromium/content/gpu/BUILD.gn
+++ b/chromium/content/gpu/BUILD.gn
@@ -37,6 +37,7 @@ target(link_target_type, "gpu_sources") {
   sources = [
     "gpu_child_thread.cc",
     "gpu_child_thread.h",
+    "gpu_child_thread_receiver_bindings.cc",
     "gpu_main.cc",
     "gpu_process.cc",
     "gpu_process.h",
diff --git a/chromium/content/gpu/DEPS b/chromium/content/gpu/DEPS
index ae42cef0592..1ddb55d9660 100644
--- a/chromium/content/gpu/DEPS
+++ b/chromium/content/gpu/DEPS
@@ -5,6 +5,7 @@ include_rules = [
   "+content/public/gpu",
   "+libEGL",
   "+libGLESv2",
+  "+services/metrics/public",
   "+services/service_manager",
   "+services/shape_detection",
   "+services/tracing/public/cpp",
diff --git a/chromium/content/gpu/OWNERS b/chromium/content/gpu/OWNERS
index ae61c99483f..c3b653afd1d 100644
--- a/chromium/content/gpu/OWNERS
+++ b/chromium/content/gpu/OWNERS
@@ -1,4 +1,8 @@
 kbr@chromium.org
 zmo@chromium.org
 
+# For security review.
+per-file gpu_child_thread_receiver_bindings.cc=set noparent
+per-file gpu_child_thread_receiver_bindings.cc=file://ipc/SECURITY_OWNERS
+
 # COMPONENT: Internals>GPU>Internals
diff --git a/chromium/content/gpu/gpu_child_thread.cc b/chromium/content/gpu/gpu_child_thread.cc
index 882c679c216..9ee49d360e2 100644
--- a/chromium/content/gpu/gpu_child_thread.cc
+++ b/chromium/content/gpu/gpu_child_thread.cc
@@ -13,7 +13,6 @@
 #include "base/callback_helpers.h"
 #include "base/command_line.h"
 #include "base/memory/weak_ptr.h"
-#include "base/no_destructor.h"
 #include "base/run_loop.h"
 #include "base/sequenced_task_runner.h"
 #include "base/threading/thread_checker.h"
@@ -33,10 +32,11 @@
 #include "gpu/ipc/service/gpu_watchdog_thread.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "media/gpu/ipc/service/media_gpu_channel_manager.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "services/metrics/public/cpp/mojo_ukm_recorder.h"
+#include "services/metrics/public/mojom/ukm_interface.mojom.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
-#include "services/service_manager/public/cpp/connector.h"
-#include "services/shape_detection/public/mojom/shape_detection_service.mojom.h"
-#include "services/shape_detection/shape_detection_service.h"
 #include "services/viz/privileged/mojom/gl/gpu_service.mojom.h"
 #include "third_party/skia/include/core/SkGraphics.h"
 
@@ -165,8 +165,7 @@ class QueueingConnectionFilter : public ConnectionFilter {
   DISALLOW_COPY_AND_ASSIGN(QueueingConnectionFilter);
 };
 
-viz::VizMainImpl::ExternalDependencies CreateVizMainDependencies(
-    service_manager::Connector* connector) {
+viz::VizMainImpl::ExternalDependencies CreateVizMainDependencies() {
   viz::VizMainImpl::ExternalDependencies deps;
   deps.create_display_compositor = features::IsVizDisplayCompositorEnabled();
   if (GetContentClient()->gpu()) {
@@ -179,7 +178,12 @@ viz::VizMainImpl::ExternalDependencies CreateVizMainDependencies(
   auto* process = ChildProcess::current();
   deps.shutdown_event = process->GetShutDownEvent();
   deps.io_thread_task_runner = process->io_task_runner();
-  deps.connector = connector;
+
+  mojo::PendingRemote<ukm::mojom::UkmRecorderInterface> ukm_recorder;
+  ChildThread::Get()->BindHostReceiver(
+      ukm_recorder.InitWithNewPipeAndPassReceiver());
+  deps.ukm_recorder =
+      std::make_unique<ukm::MojoUkmRecorder>(std::move(ukm_recorder));
   return deps;
 }
 
@@ -208,9 +212,7 @@ GpuChildThread::GpuChildThread(base::RepeatingClosure quit_closure,
                                const ChildThreadImpl::Options& options,
                                std::unique_ptr<gpu::GpuInit> gpu_init)
     : ChildThreadImpl(MakeQuitSafelyClosure(), options),
-      viz_main_(this,
-                CreateVizMainDependencies(GetConnector()),
-                std::move(gpu_init)),
+      viz_main_(this, CreateVizMainDependencies(), std::move(gpu_init)),
       quit_closure_(std::move(quit_closure)) {
   if (in_process_gpu()) {
     DCHECK(base::CommandLine::ForCurrentProcess()->HasSwitch(
@@ -291,16 +293,6 @@ void GpuChildThread::RunService(
   service_factory_->RunService(service_name, std::move(receiver));
 }
 
-void GpuChildThread::BindServiceInterface(
-    mojo::GenericPendingReceiver receiver) {
-  if (auto shape_detection_receiver =
-          receiver.As<shape_detection::mojom::ShapeDetectionService>()) {
-    static base::NoDestructor<shape_detection::ShapeDetectionService> service{
-        std::move(shape_detection_receiver)};
-    return;
-  }
-}
-
 void GpuChildThread::OnAssociatedInterfaceRequest(
     const std::string& name,
     mojo::ScopedInterfaceEndpointHandle handle) {
@@ -328,7 +320,7 @@ void GpuChildThread::OnGpuServiceConnection(viz::GpuServiceImpl* gpu_service) {
       gpu_service->gpu_channel_manager()->gpu_driver_bug_workarounds(),
       gpu_service->gpu_feature_info(),
       gpu_service->media_gpu_channel_manager()->AsWeakPtr(),
-      std::move(overlay_factory_cb)));
+      gpu_service->gpu_memory_buffer_factory(), std::move(overlay_factory_cb)));
 
   if (GetContentClient()->gpu()) {  // NULL in tests.
     GetContentClient()->gpu()->GpuServiceInitialized(
@@ -393,23 +385,19 @@ std::unique_ptr<media::AndroidOverlay> GpuChildThread::CreateAndroidOverlay(
     scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
     const base::UnguessableToken& routing_token,
     media::AndroidOverlayConfig config) {
-  media::mojom::AndroidOverlayProviderPtr overlay_provider;
+  mojo::PendingRemote<media::mojom::AndroidOverlayProvider> overlay_provider;
   if (main_task_runner->RunsTasksInCurrentSequence()) {
-    ChildThread::Get()->GetConnector()->BindInterface(
-        content::mojom::kSystemServiceName, &overlay_provider);
+    ChildThread::Get()->BindHostReceiver(
+        overlay_provider.InitWithNewPipeAndPassReceiver());
   } else {
-    // Create a connector on this sequence and bind it on the main thread.
-    service_manager::mojom::ConnectorRequest request;
-    auto connector = service_manager::Connector::Create(&request);
-    connector->BindInterface(content::mojom::kSystemServiceName,
-                             &overlay_provider);
-    auto bind_connector_request =
-        [](service_manager::mojom::ConnectorRequest request) {
-          ChildThread::Get()->GetConnector()->BindConnectorRequest(
-              std::move(request));
-        };
     main_task_runner->PostTask(
-        FROM_HERE, base::BindOnce(bind_connector_request, std::move(request)));
+        FROM_HERE,
+        base::BindOnce(
+            [](mojo::PendingReceiver<media::mojom::AndroidOverlayProvider>
+                   receiver) {
+              ChildThread::Get()->BindHostReceiver(std::move(receiver));
+            },
+            overlay_provider.InitWithNewPipeAndPassReceiver()));
   }
 
   return std::make_unique<media::MojoAndroidOverlay>(
diff --git a/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc b/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc
new file mode 100644
index 00000000000..ff7a472f32c
--- /dev/null
+++ b/chromium/content/gpu/gpu_child_thread_receiver_bindings.cc
@@ -0,0 +1,25 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// This file exposes services from the GPU process to the browser.
+
+#include "content/gpu/gpu_child_thread.h"
+
+#include "base/no_destructor.h"
+#include "services/shape_detection/public/mojom/shape_detection_service.mojom.h"
+#include "services/shape_detection/shape_detection_service.h"
+
+namespace content {
+
+void GpuChildThread::BindServiceInterface(
+    mojo::GenericPendingReceiver receiver) {
+  if (auto shape_detection_receiver =
+          receiver.As<shape_detection::mojom::ShapeDetectionService>()) {
+    static base::NoDestructor<shape_detection::ShapeDetectionService> service{
+        std::move(shape_detection_receiver)};
+    return;
+  }
+}
+
+}  // namespace content
diff --git a/chromium/content/gpu/gpu_main.cc b/chromium/content/gpu/gpu_main.cc
index d257830f594..0de66bc85b1 100644
--- a/chromium/content/gpu/gpu_main.cc
+++ b/chromium/content/gpu/gpu_main.cc
@@ -99,14 +99,6 @@
 #include "media/gpu/vaapi/vaapi_wrapper.h"
 #endif
 
-#if defined(OS_MACOSX)
-extern "C" {
-void _LSSetApplicationLaunchServicesServerConnectionStatus(
-    uint64_t flags,
-    bool (^connection_allowed)(CFDictionaryRef));
-}
-#endif  // defined(OS_MACOSX)
-
 namespace content {
 
 namespace {
@@ -285,9 +277,6 @@ int GpuMain(const MainFunctionParams& parameters) {
     main_thread_task_executor =
         std::make_unique<base::SingleThreadTaskExecutor>(
             base::MessagePumpType::NS_RUNLOOP);
-
-    // Tell LaunchServices to continue without a connection to the daemon.
-    _LSSetApplicationLaunchServicesServerConnectionStatus(0, nullptr);
 #else
     main_thread_task_executor =
         std::make_unique<base::SingleThreadTaskExecutor>(
diff --git a/chromium/content/gpu/gpu_service_factory.cc b/chromium/content/gpu/gpu_service_factory.cc
index 4b8a936be0b..cc4ac255838 100644
--- a/chromium/content/gpu/gpu_service_factory.cc
+++ b/chromium/content/gpu/gpu_service_factory.cc
@@ -26,6 +26,7 @@ GpuServiceFactory::GpuServiceFactory(
     const gpu::GpuDriverBugWorkarounds& gpu_workarounds,
     const gpu::GpuFeatureInfo& gpu_feature_info,
     base::WeakPtr<media::MediaGpuChannelManager> media_gpu_channel_manager,
+    gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
     media::AndroidOverlayMojoFactoryCB android_overlay_factory_cb) {
 #if BUILDFLAG(ENABLE_MOJO_MEDIA_IN_GPU_PROCESS)
   gpu_preferences_ = gpu_preferences;
@@ -33,6 +34,7 @@ GpuServiceFactory::GpuServiceFactory(
   gpu_feature_info_ = gpu_feature_info;
   task_runner_ = base::ThreadTaskRunnerHandle::Get();
   media_gpu_channel_manager_ = std::move(media_gpu_channel_manager);
+  gpu_memory_buffer_factory_ = gpu_memory_buffer_factory;
   android_overlay_factory_cb_ = std::move(android_overlay_factory_cb);
 #endif
 }
@@ -70,8 +72,8 @@ void GpuServiceFactory::RunService(
     FactoryCallback factory = base::BindOnce(
         &media::CreateGpuMediaService, std::move(request), gpu_preferences_,
         gpu_workarounds_, gpu_feature_info_, task_runner_,
-        media_gpu_channel_manager_, android_overlay_factory_cb_,
-        std::move(cdm_proxy_factory_cb));
+        media_gpu_channel_manager_, gpu_memory_buffer_factory_,
+        android_overlay_factory_cb_, std::move(cdm_proxy_factory_cb));
     task_runner->PostTask(
         FROM_HERE, base::BindOnce(
                        [](FactoryCallback factory) {
diff --git a/chromium/content/gpu/gpu_service_factory.h b/chromium/content/gpu/gpu_service_factory.h
index cb4314bca70..1c15091d8fd 100644
--- a/chromium/content/gpu/gpu_service_factory.h
+++ b/chromium/content/gpu/gpu_service_factory.h
@@ -16,6 +16,10 @@
 #include "media/mojo/buildflags.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
 
+namespace gpu {
+class GpuMemoryBufferFactory;
+}
+
 namespace media {
 class MediaGpuChannelManager;
 }
@@ -30,6 +34,7 @@ class GpuServiceFactory {
       const gpu::GpuDriverBugWorkarounds& gpu_workarounds,
       const gpu::GpuFeatureInfo& gpu_feature_info,
       base::WeakPtr<media::MediaGpuChannelManager> media_gpu_channel_manager,
+      gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory,
       media::AndroidOverlayMojoFactoryCB android_overlay_factory_cb);
   ~GpuServiceFactory();
 
@@ -46,6 +51,8 @@ class GpuServiceFactory {
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
   base::WeakPtr<media::MediaGpuChannelManager> media_gpu_channel_manager_;
   media::AndroidOverlayMojoFactoryCB android_overlay_factory_cb_;
+  // Indirectly owned by GpuChildThread.
+  gpu::GpuMemoryBufferFactory* gpu_memory_buffer_factory_;
   gpu::GpuPreferences gpu_preferences_;
   gpu::GpuDriverBugWorkarounds gpu_workarounds_;
   gpu::GpuFeatureInfo gpu_feature_info_;
diff --git a/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc b/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc
index 9159ceb8e53..b20e399beac 100644
--- a/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc
+++ b/chromium/content/ppapi_plugin/ppapi_blink_platform_impl.cc
@@ -42,8 +42,7 @@ PpapiBlinkPlatformImpl::PpapiBlinkPlatformImpl() {
   SkFontConfigInterface::SetGlobal(font_loader_);
   sandbox_support_.reset(new WebSandboxSupportLinux(font_loader_));
 #elif defined(OS_MACOSX)
-  sandbox_support_.reset(
-      new WebSandboxSupportMac(ChildThread::Get()->GetConnector()));
+  sandbox_support_ = std::make_unique<WebSandboxSupportMac>();
 #endif
 }
 
diff --git a/chromium/content/ppapi_plugin/ppapi_plugin_main.cc b/chromium/content/ppapi_plugin/ppapi_plugin_main.cc
index 9b5204b9c57..b7eedca3624 100644
--- a/chromium/content/ppapi_plugin/ppapi_plugin_main.cc
+++ b/chromium/content/ppapi_plugin/ppapi_plugin_main.cc
@@ -24,7 +24,6 @@
 #include "ipc/ipc_sender.h"
 #include "ppapi/proxy/plugin_globals.h"
 #include "ppapi/proxy/proxy_module.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "ui/base/ui_base_switches.h"
 
 #if defined(OS_WIN)
@@ -137,7 +136,7 @@ int PpapiPluginMain(const MainFunctionParams& parameters) {
 #if defined(OS_WIN)
   if (!base::win::IsUser32AndGdi32Available())
     gfx::win::InitializeDirectWrite();
-  InitializeDWriteFontProxy(ChildThread::Get()->GetConnector());
+  InitializeDWriteFontProxy();
 
   int antialiasing_enabled = 1;
   base::StringToInt(
diff --git a/chromium/content/ppapi_plugin/ppapi_thread.cc b/chromium/content/ppapi_plugin/ppapi_thread.cc
index 258e8b31ac4..6e05498f25c 100644
--- a/chromium/content/ppapi_plugin/ppapi_thread.cc
+++ b/chromium/content/ppapi_plugin/ppapi_thread.cc
@@ -42,6 +42,7 @@
 #include "ipc/ipc_sync_channel.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "media/media_buildflags.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "ppapi/c/dev/ppp_network_state_dev.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/c/ppp.h"
@@ -50,7 +51,6 @@
 #include "ppapi/proxy/plugin_message_filter.h"
 #include "ppapi/proxy/ppapi_messages.h"
 #include "ppapi/proxy/resource_reply_thread_registrar.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "third_party/blink/public/web/blink.h"
 #include "ui/base/buildflags.h"
 #include "ui/base/ui_base_features.h"
@@ -120,12 +120,14 @@ PpapiThread::PpapiThread(base::RepeatingClosure quit_closure,
   // In single process, browser main loop set up the discardable memory
   // allocator.
   if (!command_line.HasSwitch(switches::kSingleProcess)) {
-    discardable_memory::mojom::DiscardableSharedMemoryManagerPtr manager_ptr;
-    ChildThread::Get()->GetConnector()->BindInterface(
-        mojom::kSystemServiceName, mojo::MakeRequest(&manager_ptr));
+    mojo::PendingRemote<
+        discardable_memory::mojom::DiscardableSharedMemoryManager>
+        manager_remote;
+    ChildThread::Get()->BindHostReceiver(
+        manager_remote.InitWithNewPipeAndPassReceiver());
     discardable_shared_memory_manager_ = std::make_unique<
         discardable_memory::ClientDiscardableSharedMemoryManager>(
-        std::move(manager_ptr), GetIOTaskRunner());
+        std::move(manager_remote), GetIOTaskRunner());
     base::DiscardableMemoryAllocator::SetInstance(
         discardable_shared_memory_manager_.get());
   }
diff --git a/chromium/content/public/README b/chromium/content/public/README
deleted file mode 100644
index 05e3c47eb22..00000000000
--- a/chromium/content/public/README
+++ /dev/null
@@ -1,3 +0,0 @@
-Content API design:
-https://www.chromium.org/developers/content-module/content-api
-
diff --git a/chromium/content/public/README.md b/chromium/content/public/README.md
new file mode 100644
index 00000000000..59e6ce33d0f
--- /dev/null
+++ b/chromium/content/public/README.md
@@ -0,0 +1,74 @@
+# Content API
+
+`//content/public` is the API exposed to embedders of the [content
+module](/content/README.md).
+
+## Motivation
+- isolate developers working on Chrome from inner workings of content
+- make the boundary between content and chrome clear to developers and other
+  embedders
+
+## Design
+In general, we follow the design of the [Blink Public
+API](/third_party/blink/public/README.md). This makes it easier for people
+who're already familiar with it, and also keeps things consistent.
+
+- `//content/public` should contain only interfaces, enums, structs and (rarely)
+  static functions.
+  - An exception is `//content/public/test`. We allow concrete classes that
+    chrome test classes derive from or use in here.
+- While we don't allow old-style Chrome IPC `_messages.h` files in
+  `//content/public`, we do allow `.mojom` files (see
+  [discussion](https://groups.google.com/a/chromium.org/forum/#!searchin/chromium-mojo/cross-module/chromium-mojo/ZR2YlRV7Uxs/Ce-h_AaWCgAJ)).
+  If a mojom is only used inside content, it should be in
+  `//content/common`. If it's an interface that is implemented or called by
+  content's embedder, then it belongs in `//content/public/common`.
+- In general, if there is a struct or enum which is only used by an interface,
+  they are put in the same file, but when the struct/enum is used in other
+  places or if it's pretty big, then it should be in its own file.
+- All code under `//content` should be in the `"content"` namespace.
+- Interfaces that content implements usually should be pure abstract, because
+  usually there's only one implementation. These should not be implemented
+  outside of content.  (i.e., content will freely assume that it can cast to
+  its implementation(s)).
+- Interfaces that embedders implement, especially ones which are used in tests
+  or are observer-style and have many implementations, should have default
+  (empty) implementations.
+- Prefer enum classes over enum types. For enum types, the value should start
+  with the name of the type, i.e.,  `PAGE_TRANSITION_LINK` in the
+  `content::PageTransition` enum.
+- content implementation code should use other implementations directly and
+  not go through the interface (i.e., code in `//content/renderer` should use
+  `RenderViewImpl` instead of `content::RenderView`).
+- It's acceptable to put implementation files that hold constructors/destructors
+  of interfaces/structs which might have member variables. For structs, this
+  covers initializing member variables. For interfaces (i.e.
+  `RenderViewObserver`) this might cover things like automatic
+  registration/unregistration. Normally we would put this small code in headers,
+  but because of the clang checks against putting code in headers, we're forced
+  to put it in .cc files (we don't want to make a clang exception for the
+  `content/public` directory since that would lead to confusion).
+- When code in chrome implements an interface from content, usually the
+  convention is to prefix the implementation with "Chrome" (i.e.
+  `ChromeContentBrowserClient` derives from `content::ContentBrowserClient`).
+- Only expose methods in the public API that embedders need. If a method is only
+  used by other code in content, it belongs in `foo_impl.h` and not `foo.h`.
+- Methods in the API should be there because either content is calling out to
+  its embedder, or the embedder is calling to content. There shouldn't be any
+  methods which are used to call from the embedder to the embedder.
+- All classes/structs/enums in the public API must be used by embedders and
+  content. i.e. if the chrome layer uses a struct but content doesn't know about
+  it, it doesn't belong in `//content/public` but instead some module that's
+  higher level.
+- We avoid single-method delegate interfaces, and in those case we use
+  callbacks.
+- Don't add the `const` identifier to interfaces. For interfaces implemented by
+  the embedder, we can't make assumptions about what the embedder needs to
+  implement it. For interfaces implemented by content, the implementation
+  details doesn't have to be exposed.
+- Observer interfaces (i.e. `WebContentsObserver`, `RenderFrameObserver`,
+  `RenderViewObserver`) should only have void methods. This is because otherwise
+  the order that observers are registered would matter, and we don't want that.
+  The only exception is `OnMessageReceived()`, which is fine since only one
+  observer class handles each particular IPC, so ordering doesn't make a
+  difference.
diff --git a/chromium/content/public/android/BUILD.gn b/chromium/content/public/android/BUILD.gn
index 76b274ac56c..197094e2a72 100644
--- a/chromium/content/public/android/BUILD.gn
+++ b/chromium/content/public/android/BUILD.gn
@@ -80,8 +80,8 @@ android_library("content_java") {
     "//services/shape_detection:shape_detection_java",
     "//services/shape_detection/public/mojom:mojom_java",
     "//skia/public/mojom:mojom_java",
+    "//third_party/android_deps:androidx_annotation_annotation_java",
     "//third_party/android_deps:com_android_support_collections_java",
-    "//third_party/android_deps:com_android_support_support_annotations_java",
     "//third_party/android_deps:com_android_support_support_compat_java",
     "//third_party/blink/public:blink_headers_java",
     "//third_party/blink/public/mojom:android_mojo_bindings_java",
@@ -90,6 +90,7 @@ android_library("content_java") {
     "//third_party/jsr-305:jsr_305_javalib",
     "//ui/android:ui_java",
     "//ui/gfx/geometry/mojom:mojom_java",
+    "//url:origin_java",
   ]
 
   srcjar_deps = [
@@ -295,6 +296,7 @@ android_library("content_java") {
     "java/src/org/chromium/content_public/common/ScreenOrientationConstants.java",
     "java/src/org/chromium/content_public/common/ServiceManagerConnection.java",
     "java/src/org/chromium/content_public/common/UseZoomForDSFPolicy.java",
+    "java/src/org/chromium/content_public/app/ChildProcessServiceFactory.java",
   ]
   annotation_processor_deps = [ "//base/android/jni_generator:jni_processor" ]
 }
@@ -481,8 +483,8 @@ android_library("content_javatests") {
     "//services/device/public/java:geolocation_java_test_support",
     "//services/service_manager/public/java:service_manager_java",
     "//services/test/echo/public/mojom:mojom_java",
+    "//third_party/android_deps:androidx_annotation_annotation_java",
     "//third_party/android_deps:com_android_support_collections_java",
-    "//third_party/android_deps:com_android_support_support_annotations_java",
     "//third_party/android_support_test_runner:rules_java",
     "//third_party/android_support_test_runner:runner_java",
     "//third_party/blink/public:blink_headers_java",
@@ -596,4 +598,8 @@ junit_binary("content_junit_tests") {
     "//ui/android:ui_java",
     "//ui/gfx/geometry/mojom:mojom_java",
   ]
+
+  data_deps = [
+    "//testing/buildbot/filters:content_junit_tests_filters",
+  ]
 }
diff --git a/chromium/content/public/android/generate_child_service.py b/chromium/content/public/android/generate_child_service.py
index f29047b6ef1..ebe07f2d8f1 100755
--- a/chromium/content/public/android/generate_child_service.py
+++ b/chromium/content/public/android/generate_child_service.py
@@ -20,10 +20,13 @@ def GenerateService(i):
 
 package org.chromium.content.app;
 
+import org.chromium.base.annotations.MainDex;
+
 /**
  * This is needed to register multiple SandboxedProcess services so that we
  * can have more than one sandboxed process.
  */
+@MainDex
 public class SandboxedProcessService{0} extends SandboxedProcessService {{
 }}"""
   return template.format(str(i))
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionFactoryTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionFactoryTest.java
index 9ff53201de4..26a399e3524 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionFactoryTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionFactoryTest.java
@@ -117,7 +117,7 @@ public class ThreadedInputConnectionFactoryTest {
     private boolean mHasWindowFocus;
 
     @Before
-    public void setUp() throws Exception {
+    public void setUp() {
         // ThreadedInputConnectionFactory#initializeAndGet() logic is activated under N, so pretend
         // that we're in L. Note that this is to workaround crbug.com/944476 that
         // @Config(..., sdk = Build.VERSION_CODES.LOLLIPOP) doesn't work.
@@ -152,7 +152,7 @@ public class ThreadedInputConnectionFactoryTest {
         when(mProxyView.getHandler()).thenReturn(mImeHandler);
         final Callable<InputConnection> callable = new Callable<InputConnection>() {
             @Override
-            public InputConnection call() throws Exception {
+            public InputConnection call() {
                 return mFactory.initializeAndGet(
                         mContainerView, mImeAdapter, 1, 0, 0, 0, 0, 0, mEditorInfo);
             }
@@ -170,7 +170,7 @@ public class ThreadedInputConnectionFactoryTest {
             private int mCount;
 
             @Override
-            public Boolean answer(InvocationOnMock invocation) throws Throwable {
+            public Boolean answer(InvocationOnMock invocation) {
                 mCount++;
                 // To simplify IMM's behavior, let's say that it succeeds input method activation
                 // only when the view has a window focus.
@@ -184,7 +184,7 @@ public class ThreadedInputConnectionFactoryTest {
         });
         when(mInputMethodManager.isActive(mProxyView)).thenAnswer(new Answer<Boolean>() {
             @Override
-            public Boolean answer(InvocationOnMock invocation) throws Throwable {
+            public Boolean answer(InvocationOnMock invocation) {
                 return mInputConnection != null;
             }
         });
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionTest.java
index 27437bd1431..5c3ea586518 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/input/ThreadedInputConnectionTest.java
@@ -59,7 +59,7 @@ public class ThreadedInputConnectionTest {
     boolean mRunningOnUiThread;
 
     @Before
-    public void setUp() throws Exception {
+    public void setUp() {
         MockitoAnnotations.initMocks(this);
 
         mImeAdapter = Mockito.mock(ImeAdapterImpl.class);
@@ -234,7 +234,7 @@ public class ThreadedInputConnectionTest {
 
     @Test
     @Feature("TextInput")
-    public void testUpdateSelectionBehaviorWhenUpdatesRequested() throws InterruptedException {
+    public void testUpdateSelectionBehaviorWhenUpdatesRequested() {
         // Arrange.
         final ExtractedTextRequest request = new ExtractedTextRequest();
 
@@ -267,7 +267,7 @@ public class ThreadedInputConnectionTest {
 
     @Test
     @Feature("TextInput")
-    public void testUpdateSelectionBehaviorWhenUpdatesNotRequested() throws InterruptedException {
+    public void testUpdateSelectionBehaviorWhenUpdatesNotRequested() {
         // Arrange.
         final ExtractedTextRequest request = new ExtractedTextRequest();
 
@@ -316,7 +316,7 @@ public class ThreadedInputConnectionTest {
 
     @Test
     @Feature("TextInput")
-    public void testExtractedTextNotSentAfterInputConnectionReset() throws InterruptedException {
+    public void testExtractedTextNotSentAfterInputConnectionReset() {
         // Arrange.
         final ExtractedTextRequest request = new ExtractedTextRequest();
 
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/remoteobjects/RemoteObjectImplTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/remoteobjects/RemoteObjectImplTest.java
index 1fbec4dd7f1..6b6906b8426 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/remoteobjects/RemoteObjectImplTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/remoteobjects/RemoteObjectImplTest.java
@@ -67,7 +67,7 @@ public final class RemoteObjectImplTest {
     private RemoteObjectImpl.ObjectIdAllocator mIdAllocator;
 
     @Before
-    public void setUp() throws Exception {
+    public void setUp() {
         MockitoAnnotations.initMocks(this);
     }
 
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/MagnifierAnimatorTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/MagnifierAnimatorTest.java
index d69b693b84e..3a59a40d15f 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/MagnifierAnimatorTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/MagnifierAnimatorTest.java
@@ -33,7 +33,7 @@ public class MagnifierAnimatorTest {
     private MagnifierAnimator mAnimator;
 
     @Before
-    public void setUp() throws Exception {
+    public void setUp() {
         MockitoAnnotations.initMocks(this);
         ShadowLog.stream = System.out;
 
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java
index eb303573cc2..7df3b6f7860 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SelectionPopupControllerTest.java
@@ -132,7 +132,7 @@ public class SelectionPopupControllerTest {
     }
 
     @Before
-    public void setUp() throws Exception {
+    public void setUp() {
         MockitoAnnotations.initMocks(this);
         ShadowLog.stream = System.out;
 
@@ -177,7 +177,7 @@ public class SelectionPopupControllerTest {
     }
 
     @After
-    public void tearDown() throws Exception {
+    public void tearDown() {
         ContentClassFactory.set(mOriginalContentClassFactory);
     }
 
diff --git a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java
index 60108346dbf..9dc3930f3cb 100644
--- a/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java
+++ b/chromium/content/public/android/junit/src/org/chromium/content/browser/selection/SmartSelectionMetricsLoggerTest.java
@@ -64,7 +64,7 @@ public class SmartSelectionMetricsLoggerTest {
     }
 
     @Before
-    public void setUp() throws Exception {
+    public void setUp() {
         MockitoAnnotations.initMocks(this);
         ShadowLog.stream = System.out;
     }
diff --git a/chromium/content/public/app/BUILD.gn b/chromium/content/public/app/BUILD.gn
index b31fcd54019..2eff52c3dec 100644
--- a/chromium/content/public/app/BUILD.gn
+++ b/chromium/content/public/app/BUILD.gn
@@ -186,7 +186,6 @@ source_set("content_browser_manifest") {
     "//base",
     "//content/public/common:service_names",
     "//services/content/public/cpp:manifest",
-    "//services/file/public/cpp:manifest",
   ]
 
   public_deps = [
diff --git a/chromium/content/public/app/DEPS b/chromium/content/public/app/DEPS
index 3f7937e357d..3660cb01330 100644
--- a/chromium/content/public/app/DEPS
+++ b/chromium/content/public/app/DEPS
@@ -12,6 +12,5 @@ include_rules = [
 specific_include_rules = {
   "content_browser_manifest\.cc": [
     "+services/content/public/cpp/manifest.h",
-    "+services/file/public/cpp/manifest.h",
   ],
 }
diff --git a/chromium/content/public/app/content_browser_manifest.cc b/chromium/content/public/app/content_browser_manifest.cc
index 9002c33a299..d13e5f9eb71 100644
--- a/chromium/content/public/app/content_browser_manifest.cc
+++ b/chromium/content/public/app/content_browser_manifest.cc
@@ -7,7 +7,6 @@
 #include "base/no_destructor.h"
 #include "content/public/common/service_names.mojom.h"
 #include "services/content/public/cpp/manifest.h"
-#include "services/file/public/cpp/manifest.h"
 #include "services/service_manager/public/cpp/manifest_builder.h"
 
 namespace content {
@@ -93,7 +92,7 @@ const service_manager::Manifest& GetContentBrowserManifest() {
                   "network.mojom.P2PSocketManager",
                   "network.mojom.MdnsResponder",
                   "network.mojom.URLLoaderFactory",
-                  "resource_coordinator.mojom.ProcessCoordinationUnit",
+                  "performance_manager.mojom.ProcessCoordinationUnit",
                   "viz.mojom.CompositingModeReporter",
                   "viz.mojom.Gpu",
               })
@@ -124,6 +123,7 @@ const service_manager::Manifest& GetContentBrowserManifest() {
           .RequireCapability("network", "test")
           .RequireCapability(mojom::kRendererServiceName, "browser")
           .RequireCapability("media", "media:media")
+          .RequireCapability("media_renderer", "media:media")
           .RequireCapability("*", "app")
           .RequireCapability("content", "navigation")
           .RequireCapability("resource_coordinator", "service_callbacks")
@@ -167,126 +167,67 @@ const service_manager::Manifest& GetContentBrowserManifest() {
           .ExposeInterfaceFilterCapability_Deprecated(
               "navigation:shared_worker", "renderer",
               std::set<const char*>{
-                  "blink.mojom.CacheStorage", "blink.mojom.IDBFactory",
-                  "blink.mojom.LockManager",
+                  "blink.mojom.CacheStorage",
                   "blink.mojom.NativeFileSystemManager",
                   "blink.mojom.NotificationService",
-                  "blink.mojom.PermissionService",
                   "blink.mojom.QuotaDispatcherHost",
-                  "blink.mojom.WebSocketConnector",
-                  "media.mojom.VideoDecodePerfHistory",
-                  "payments.mojom.PaymentManager",
-                  "shape_detection.mojom.BarcodeDetectionProvider",
-                  "shape_detection.mojom.FaceDetectionProvider",
-                  "shape_detection.mojom.TextDetection"})
+                  "blink.mojom.WebSocketConnector"})
           .ExposeInterfaceFilterCapability_Deprecated(
               "navigation:dedicated_worker", "renderer",
               std::set<const char*>{
                   "blink.mojom.CacheStorage",
                   "blink.mojom.DedicatedWorkerHostFactory",
-                  "blink.mojom.IDBFactory",
-                  "blink.mojom.LockManager",
                   "blink.mojom.NativeFileSystemManager",
                   "blink.mojom.NotificationService",
-                  "blink.mojom.PermissionService",
                   "blink.mojom.QuotaDispatcherHost",
-                  "blink.mojom.SerialService",
-                  "blink.mojom.WebUsbService", "blink.mojom.SmsReceiver",
-                  "blink.mojom.WebSocketConnector",
-                  "media.mojom.VideoDecodePerfHistory",
-                  "payments.mojom.PaymentManager",
-                  "shape_detection.mojom.BarcodeDetectionProvider",
-                  "shape_detection.mojom.FaceDetectionProvider",
-                  "shape_detection.mojom.TextDetection"})
+                  "blink.mojom.WebSocketConnector"})
           .ExposeInterfaceFilterCapability_Deprecated(
               "navigation:service_worker", "renderer",
               std::set<const char*>{
-                  "blink.mojom.CacheStorage", "blink.mojom.CookieStore",
-                  "blink.mojom.ContentIndexService", "blink.mojom.IDBFactory",
-                  "blink.mojom.LockManager",
+                  "blink.mojom.CacheStorage",
                   "blink.mojom.NativeFileSystemManager",
                   "blink.mojom.NotificationService",
-                  "blink.mojom.PermissionService",
                   "blink.mojom.QuotaDispatcherHost",
-                  "media.mojom.VideoDecodePerfHistory",
                   "network.mojom.RestrictedCookieManager",
-                  "blink.mojom.WebSocketConnector",
-                  "payments.mojom.PaymentManager",
-                  "shape_detection.mojom.BarcodeDetectionProvider",
-                  "shape_detection.mojom.FaceDetectionProvider",
-                  "shape_detection.mojom.TextDetection"})
+                  "blink.mojom.WebSocketConnector"})
           .ExposeInterfaceFilterCapability_Deprecated(
               "navigation:frame", "renderer",
               std::set<const char*>{
                   "autofill.mojom.AutofillDriver",
                   "autofill.mojom.PasswordManagerDriver",
-                  "blink.mojom.AnchorElementMetricsHost",
                   "blink.mojom.CacheStorage",
                   "blink.mojom.ColorChooserFactory",
-                  "blink.mojom.ContactsManager",
-                  "blink.mojom.ContentIndexService",
                   "blink.mojom.DateTimeChooser",
                   "blink.mojom.DisplayCutoutHost",
                   "blink.mojom.DedicatedWorkerHostFactory",
-                  "blink.mojom.FileChooser",
                   "blink.mojom.GeolocationService",
-                  "blink.mojom.HidService",
-                  "blink.mojom.IDBFactory",
-                  "blink.mojom.InsecureInputService",
-                  "blink.mojom.KeyboardLockService",
-                  "blink.mojom.LockManager",
-                  "blink.mojom.MediaDevicesDispatcherHost",
-                  "blink.mojom.MediaStreamDispatcherHost",
-                  "blink.mojom.MediaSessionService",
                   "blink.mojom.NativeFileSystemManager",
                   "blink.mojom.NotificationService",
-                  "blink.mojom.PermissionService",
-                  "blink.mojom.PictureInPictureService",
                   "blink.mojom.Portal",
                   "blink.mojom.PrefetchURLLoaderService",
-                  "blink.mojom.PresentationService",
                   "blink.mojom.QuotaDispatcherHost",
-                  "blink.mojom.SerialService",
                   "blink.mojom.SharedWorkerConnector",
-                  "blink.mojom.SmsReceiver",
-                  "blink.mojom.SpeechRecognizer",
                   "blink.mojom.TextSuggestionHost",
                   "blink.mojom.UnhandledTapNotifier",
-                  "blink.mojom.WakeLockService",
-                  "blink.mojom.WebBluetoothService",
-                  "blink.mojom.WebUsbService",
                   "content.mojom.BrowserTarget",
                   "content.mojom.InputInjector",
                   "content.mojom.RendererAudioInputStreamFactory",
                   "content.mojom.RendererAudioOutputStreamFactory",
-                  "device.mojom.GamepadMonitor",
                   "device.mojom.Geolocation",
-                  "device.mojom.NFC",
-                  "device.mojom.SensorProvider",
-                  "device.mojom.VibrationManager",
-                  "device.mojom.VRService",
                   "discardable_memory.mojom.DiscardableSharedMemoryManager",
                   "media.mojom.FuchsiaCdmProvider",
-                  "media.mojom.ImageCapture",
                   "media.mojom.InterfaceFactory",
                   "media.mojom.MediaMetricsProvider",
                   "media.mojom.RemoterFactory",
                   "media.mojom.Renderer",
-                  "media.mojom.VideoDecodePerfHistory",
                   "mojom.ProcessInternalsHandler",
                   "network.mojom.RestrictedCookieManager",
                   "blink.mojom.WebSocketConnector",
-                  "payments.mojom.PaymentManager",
-                  "payments.mojom.PaymentRequest",
-                  "resource_coordinator.mojom.DocumentCoordinationUnit",
-                  "shape_detection.mojom.BarcodeDetectionProvider",
-                  "shape_detection.mojom.FaceDetectionProvider",
-                  "shape_detection.mojom.TextDetection",
+                  "performance_manager.mojom.DocumentCoordinationUnit",
                   "viz.mojom.Gpu"})
           .RequireInterfaceFilterCapability_Deprecated(
               mojom::kRendererServiceName, "navigation:frame", "browser")
           .PackageService(content::GetManifest())
-          .PackageService(file::GetManifest())
           .Build()};
   return *manifest;
   // clang-format on
diff --git a/chromium/content/public/app/content_renderer_manifest.cc b/chromium/content/public/app/content_renderer_manifest.cc
index 30b6f1f03c5..625e51f42a1 100644
--- a/chromium/content/public/app/content_renderer_manifest.cc
+++ b/chromium/content/public/app/content_renderer_manifest.cc
@@ -21,6 +21,7 @@ const service_manager::Manifest& GetContentRendererManifest() {
               std::set<const char*>{
                   "blink.mojom.CodeCacheHost",
                   "blink.mojom.CrashMemoryMetricsReporter",
+                  "blink.mojom.EmbeddedWorkerInstanceClient",
                   "blink.mojom.LeakDetector",
                   "blink.mojom.OomIntervention",
                   "blink.mojom.SharedWorkerFactory",
diff --git a/chromium/content/public/app/v8_snapshot_overlay_manifest.cc b/chromium/content/public/app/v8_snapshot_overlay_manifest.cc
index b07152e38a6..46977557ffd 100644
--- a/chromium/content/public/app/v8_snapshot_overlay_manifest.cc
+++ b/chromium/content/public/app/v8_snapshot_overlay_manifest.cc
@@ -31,25 +31,19 @@ const service_manager::Manifest& GetV8SnapshotOverlayManifest() {
             kV8NativesDataDescriptor,
             base::FilePath(FILE_PATH_LITERAL("assets/natives_blob.bin")))
 #if defined(USE_V8_CONTEXT_SNAPSHOT)
-#if defined(ARCH_CPU_64_BITS)
-        .PreloadFile(kV8Snapshot64DataDescriptor,
-                     base::FilePath(FILE_PATH_LITERAL(
-                         "assets/v8_context_snapshot_64.bin")))
-#else
         .PreloadFile(kV8Snapshot32DataDescriptor,
                      base::FilePath(FILE_PATH_LITERAL(
                          "assets/v8_context_snapshot_32.bin")))
-#endif
-#else
-#if defined(ARCH_CPU_64_BITS)
-        .PreloadFile(
-            kV8Snapshot64DataDescriptor,
-            base::FilePath(FILE_PATH_LITERAL("assets/snapshot_blob_64.bin")))
+        .PreloadFile(kV8Snapshot64DataDescriptor,
+                     base::FilePath(FILE_PATH_LITERAL(
+                         "assets/v8_context_snapshot_64.bin")))
 #else
         .PreloadFile(
             kV8Snapshot32DataDescriptor,
             base::FilePath(FILE_PATH_LITERAL("assets/snapshot_blob_32.bin")))
-#endif
+        .PreloadFile(
+            kV8Snapshot64DataDescriptor,
+            base::FilePath(FILE_PATH_LITERAL("assets/snapshot_blob_64.bin")))
 #endif  // defined(USE_V8_CONTEXT_SNAPSHOT)
 #endif
         .Build()
diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn
index 36cf6041076..0cca034d000 100644
--- a/chromium/content/public/browser/BUILD.gn
+++ b/chromium/content/public/browser/BUILD.gn
@@ -53,6 +53,7 @@ jumbo_source_set("browser_sources") {
     "authenticator_request_client_delegate.h",
     "ax_event_notification_details.cc",
     "ax_event_notification_details.h",
+    "back_forward_cache.h",
     "background_fetch_delegate.cc",
     "background_fetch_delegate.h",
     "background_fetch_description.cc",
@@ -76,6 +77,7 @@ jumbo_source_set("browser_sources") {
     "browser_accessibility_state.h",
     "browser_associated_interface.h",
     "browser_child_process_host.h",
+    "browser_child_process_host_delegate.cc",
     "browser_child_process_host_delegate.h",
     "browser_child_process_host_iterator.cc",
     "browser_child_process_host_iterator.h",
@@ -189,6 +191,7 @@ jumbo_source_set("browser_sources") {
     "javascript_dialog_manager.h",
     "keyboard_event_processing_result.h",
     "load_notification_details.h",
+    "lock_observer.h",
     "login_delegate.h",
     "manifest_icon_downloader.h",
     "media_capture_devices.h",
@@ -248,6 +251,7 @@ jumbo_source_set("browser_sources") {
     "page_navigator.h",
     "page_visibility_state.h",
     "payment_app_provider.h",
+    "peak_gpu_memory_tracker.h",
     "pepper_flash_settings_helper.h",
     "pepper_vpn_provider_resource_host_proxy.h",
     "permission_controller.h",
@@ -272,6 +276,7 @@ jumbo_source_set("browser_sources") {
     "render_frame_host.h",
     "render_frame_metadata_provider.h",
     "render_process_host.h",
+    "render_process_host_creation_observer.h",
     "render_process_host_factory.h",
     "render_process_host_observer.h",
     "render_view_host.h",
@@ -283,6 +288,7 @@ jumbo_source_set("browser_sources") {
     "renderer_preferences_util.h",
     "replaced_navigation_entry_data.h",
     "resource_context.h",
+    "resource_coordinator_service.h",
     "restore_type.h",
     "same_site_data_remover.h",
     "sandbox_type.h",
@@ -302,6 +308,8 @@ jumbo_source_set("browser_sources") {
     "service_process_info.h",
     "service_worker_context.h",
     "service_worker_context_observer.h",
+    "service_worker_external_request_result.h",
+    "service_worker_running_info.cc",
     "service_worker_running_info.h",
     "session_storage_namespace.h",
     "session_storage_usage_info.h",
@@ -325,10 +333,13 @@ jumbo_source_set("browser_sources") {
     "ssl_status.cc",
     "ssl_status.h",
     "startup_data.h",
+    "storage_notification_service.h",
     "storage_partition.h",
     "storage_usage_info.h",
     "stored_payment_app.cc",
     "stored_payment_app.h",
+    "supported_delegations.cc",
+    "supported_delegations.h",
     "swap_metrics_driver.h",
     "system_connector.h",
     "touch_selection_controller_client_manager.h",
diff --git a/chromium/content/public/browser/DEPS b/chromium/content/public/browser/DEPS
index 9373ad4a4a5..57a51260a63 100644
--- a/chromium/content/public/browser/DEPS
+++ b/chromium/content/public/browser/DEPS
@@ -9,6 +9,7 @@ include_rules = [
   "+services/media_session/public",
   "+services/metrics/public/cpp",
   "+services/network/public/cpp",
+  "+services/resource_coordinator/public",
   "+services/service_manager/sandbox",
   "+services/video_capture/public/mojom",
   "+services/viz/public/mojom",
diff --git a/chromium/content/public/browser/accessibility_tree_formatter.h b/chromium/content/public/browser/accessibility_tree_formatter.h
index ad2aa7a2c71..56a90d02faf 100644
--- a/chromium/content/public/browser/accessibility_tree_formatter.h
+++ b/chromium/content/public/browser/accessibility_tree_formatter.h
@@ -158,7 +158,8 @@ class CONTENT_EXPORT AccessibilityTreeFormatter
 
   static base::string16 DumpAccessibilityTreeFromManager(
       BrowserAccessibilityManager* ax_mgr,
-      bool internal);
+      bool internal,
+      std::vector<PropertyFilter> property_filters);
 
   // Set regular expression filters that apply to each property of every node
   // before it's output.
diff --git a/chromium/content/public/browser/android/compositor.h b/chromium/content/public/browser/android/compositor.h
index c8fd681da7b..18a2da222b6 100644
--- a/chromium/content/public/browser/android/compositor.h
+++ b/chromium/content/public/browser/android/compositor.h
@@ -83,6 +83,9 @@ class CONTENT_EXPORT Compositor {
   // Composite *without* having modified the layer tree.
   virtual void SetNeedsComposite() = 0;
 
+  // Request a draw and swap even if there is no change to the layer tree.
+  virtual void SetNeedsRedraw() = 0;
+
   // Returns the UI resource provider associated with the compositor.
   virtual ui::UIResourceProvider& GetUIResourceProvider() = 0;
 
diff --git a/chromium/content/public/browser/android/synchronous_compositor_client.h b/chromium/content/public/browser/android/synchronous_compositor_client.h
index 1ab4556e55d..748432ee869 100644
--- a/chromium/content/public/browser/android/synchronous_compositor_client.h
+++ b/chromium/content/public/browser/android/synchronous_compositor_client.h
@@ -33,14 +33,14 @@ class SynchronousCompositorClient {
   // compositor thread, and open for business. |process_id| and |routing_id|
   // belong to the RVH that owns the compositor.
   virtual void DidInitializeCompositor(SynchronousCompositor* compositor,
-                                       const viz::FrameSinkId& id);
+                                       const viz::FrameSinkId& id) = 0;
 
   // Indication to the client that |compositor| is going out of scope, and
   // must not be accessed within or after this call.
   // NOTE if the client goes away before the compositor it must call
   // SynchronousCompositor::SetClient(nullptr) to release the back pointer.
   virtual void DidDestroyCompositor(SynchronousCompositor* compositor,
-                                    const viz::FrameSinkId& id);
+                                    const viz::FrameSinkId& id) = 0;
 
   virtual void UpdateRootLayerState(SynchronousCompositor* compositor,
                                     const gfx::Vector2dF& total_scroll_offset,
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.cc b/chromium/content/public/browser/authenticator_request_client_delegate.cc
index cf916c26668..6d7028f5825 100644
--- a/chromium/content/public/browser/authenticator_request_client_delegate.cc
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.cc
@@ -9,8 +9,13 @@
 #include "base/callback.h"
 #include "base/strings/string_piece.h"
 #include "build/build_config.h"
+#include "device/fido/features.h"
 #include "device/fido/fido_discovery_factory.h"
 
+#if defined(OS_WIN)
+#include "device/fido/win/webauthn_api.h"
+#endif  // defined(OS_WIN)
+
 namespace content {
 
 AuthenticatorRequestClientDelegate::AuthenticatorRequestClientDelegate() =
@@ -56,10 +61,16 @@ bool AuthenticatorRequestClientDelegate::ShouldPermitCableExtension(
 
 bool AuthenticatorRequestClientDelegate::SetCableTransportInfo(
     bool cable_extension_provided,
+    bool have_paired_phones,
     base::Optional<device::QRGeneratorKey> qr_generator_key) {
   return false;
 }
 
+std::vector<device::CableDiscoveryData>
+AuthenticatorRequestClientDelegate::GetCablePairings() {
+  return {};
+}
+
 void AuthenticatorRequestClientDelegate::SelectAccount(
     std::vector<device::AuthenticatorGetAssertionResponse> responses,
     base::OnceCallback<void(device::AuthenticatorGetAssertionResponse)>
@@ -96,6 +107,15 @@ AuthenticatorRequestClientDelegate::GetDiscoveryFactory() {
 #if defined(OS_MACOSX)
     discovery_factory_->set_mac_touch_id_info(GetTouchIdAuthenticatorConfig());
 #endif  // defined(OS_MACOSX)
+
+#if defined(OS_WIN)
+    if (base::FeatureList::IsEnabled(device::kWebAuthUseNativeWinApi)) {
+      discovery_factory_->set_win_webauthn_api(
+          device::WinWebAuthnApi::GetDefault());
+    }
+#endif  // defined(OS_WIN)
+
+    CustomizeDiscoveryFactory(discovery_factory_.get());
   }
   return discovery_factory_.get();
 #endif
@@ -150,4 +170,7 @@ void AuthenticatorRequestClientDelegate::FinishCollectPIN() {
   NOTREACHED();
 }
 
+void AuthenticatorRequestClientDelegate::CustomizeDiscoveryFactory(
+    device::FidoDiscoveryFactory* discovery_factory) {}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/authenticator_request_client_delegate.h b/chromium/content/public/browser/authenticator_request_client_delegate.h
index e33793d6745..188201574b5 100644
--- a/chromium/content/public/browser/authenticator_request_client_delegate.h
+++ b/chromium/content/public/browser/authenticator_request_client_delegate.h
@@ -125,6 +125,9 @@ class CONTENT_EXPORT AuthenticatorRequestClientDelegate
   // to advance to directly to guiding the user to check their phone as the site
   // is strongly indicating that it will work.
   //
+  // have_paired_phones is true if a previous call to |GetCablePairings|
+  // returned one or more caBLE pairings.
+  //
   // |qr_generator_key| is a random AES-256 key that can be used to
   // encrypt a coarse timestamp with |CableDiscoveryData::DeriveQRKeyMaterial|.
   // The UI may display a QR code with the resulting secret which, if
@@ -137,8 +140,16 @@ class CONTENT_EXPORT AuthenticatorRequestClientDelegate
   // handshakes is irrelevant if the UI is not displaying the QR codes.
   virtual bool SetCableTransportInfo(
       bool cable_extension_provided,
+      bool have_paired_phones,
       base::Optional<device::QRGeneratorKey> qr_generator_key);
 
+  // GetCablePairings returns any known caBLE pairing data. For example, the
+  // embedder may know of pairings because it configured the
+  // |FidoDiscoveryFactory| (using |CustomizeDiscoveryFactory|) to make a
+  // callback when a phone offered long-term pairing data. Additionally, it may
+  // know of pairings via some cloud-based service or sync feature.
+  virtual std::vector<device::CableDiscoveryData> GetCablePairings();
+
   // SelectAccount is called to allow the embedder to select between one or more
   // accounts. This is triggered when the web page requests an unspecified
   // credential (by passing an empty allow-list). In this case, any accounts
@@ -219,6 +230,12 @@ class CONTENT_EXPORT AuthenticatorRequestClientDelegate
       base::OnceCallback<void(std::string)> provide_pin_cb) override;
   void FinishCollectPIN() override;
 
+ protected:
+  // CustomizeDiscoveryFactory may be overridden in order to configure
+  // |discovery_factory|.
+  virtual void CustomizeDiscoveryFactory(
+      device::FidoDiscoveryFactory* discovery_factory);
+
  private:
 #if !defined(OS_ANDROID)
   std::unique_ptr<device::FidoDiscoveryFactory> discovery_factory_;
diff --git a/chromium/content/public/browser/back_forward_cache.h b/chromium/content/public/browser/back_forward_cache.h
new file mode 100644
index 00000000000..379d79f1871
--- /dev/null
+++ b/chromium/content/public/browser/back_forward_cache.h
@@ -0,0 +1,113 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_BACK_FORWARD_CACHE_H_
+#define CONTENT_PUBLIC_BROWSER_BACK_FORWARD_CACHE_H_
+
+#include "base/strings/string_piece.h"
+#include "content/common/content_export.h"
+#include "content/public/browser/global_routing_id.h"
+
+namespace content {
+
+class RenderFrameHost;
+
+// Public API for the BackForwardCache.
+//
+// After the user navigates away from a document, the old one might go into the
+// frozen state and will be kept in the cache. It can potentially be reused
+// at a later time if the user navigates back.
+//
+// Not all documents can or will be cached. You should not assume a document
+// will be cached.
+//
+// WARNING: This code is still experimental and might completely go away.
+// Please get in touch with bfcache-dev@chromium.org if you intend to use it.
+//
+// All methods of this class should be called from the UI thread.
+class CONTENT_EXPORT BackForwardCache {
+ public:
+  // Prevents the |render_frame_host| from entering the BackForwardCache. A
+  // RenderFrameHost can only enter the BackForwardCache if the main one and all
+  // its children can. This action can not be undone. Any document that is
+  // assigned to this same RenderFrameHost in the future will not be cached
+  // either. In practice this is not a big deal as only navigations that use a
+  // new frame can be cached.
+  //
+  // This might be needed for example by components that listen to events via a
+  // WebContentsObserver and keep some sort of per frame state, as this state
+  // might be lost and not be recreated when navigating back.
+  //
+  // If the page is already in the cache an eviction is triggered.
+  //
+  // |render_frame_host|: non-null.
+  // |reason|: Free form string to be used in logging and metrics.
+  static void DisableForRenderFrameHost(RenderFrameHost* render_frame_host,
+                                        base::StringPiece reason);
+
+  // Helper function to be used when it is not always possible to guarantee the
+  // |render_frame_host| to be still alive when this is called. In this case,
+  // its |id| can be used.
+  static void DisableForRenderFrameHost(GlobalFrameRoutingId id,
+                                        base::StringPiece reason);
+
+  // List of reasons the BackForwardCache was disabled for a specific test. If a
+  // test needs to be disabled for a reason not covered below, please add to
+  // this enum.
+  enum DisableForTestingReason {
+    // The test has expectations that won't make sense if caching is enabled.
+    //
+    // One alternative to disabling BackForwardCache is to make the test's logic
+    // conditional, based on whether or not BackForwardCache is enabled.
+    //
+    // You should also consider whether it would make sense to instead split
+    // into two tests, one using a cacheable page, and one using an uncacheable
+    // page.
+    //
+    // Once BackForwardCache is enabled everywhere, any tests still disabled for
+    // this reason should change their expectations to permanently match the
+    // BackForwardCache enabled behavior.
+    TEST_ASSUMES_NO_CACHING,
+
+    // Unload events never fire for documents that are put into the
+    // BackForwardCache. This is by design, as there is never an appropriate
+    // moment to fire unload if the document is cached.
+    // In short, this is because:
+    //
+    // * We can't fire unload when going into the cache, because it may be
+    // destructive, and put the document into an unknown/bad state. Pages can
+    // also be cached and restored multiple times, and we don't want to invoke
+    // unload more than once.
+    //
+    // * We can't fire unload when the document is evicted from the cache,
+    // because at that point we don't want to run javascript for privacy and
+    // security reasons.
+    //
+    // An alternative to disabling the BackForwardCache, is to have the test
+    // load a page that is ineligible for caching (e.g. due to an unsupported
+    // feature).
+    TEST_USES_UNLOAD_EVENT,
+  };
+
+  // Disables the BackForwardCache so that no documents will be stored/served.
+  // This allows tests to "force" not using the BackForwardCache, this can be
+  // useful when:
+  // * Tests rely on a new document being loaded.
+  // * Tests want to test this case specifically.
+  // Callers should pass an accurate |reason| to make future triaging of
+  // disabled tests easier.
+  //
+  // Note: It's preferable to make tests BackForwardCache compatible
+  // when feasible, rather than using this method. Also please consider whether
+  // you actually should have 2 tests, one with the document cached
+  // (BackForwardCache enabled), and one without.
+  virtual void DisableForTesting(DisableForTestingReason reason) = 0;
+
+ protected:
+  BackForwardCache() = default;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_BACK_FORWARD_CACHE_H_
diff --git a/chromium/content/public/browser/background_sync_parameters.cc b/chromium/content/public/browser/background_sync_parameters.cc
index 9450f965dcd..67a8a19f751 100644
--- a/chromium/content/public/browser/background_sync_parameters.cc
+++ b/chromium/content/public/browser/background_sync_parameters.cc
@@ -20,17 +20,31 @@ constexpr base::TimeDelta kMinPeriodicSyncEventsInterval =
 
 BackgroundSyncParameters::BackgroundSyncParameters()
     : disable(false),
+#if defined(OS_ANDROID)
+      rely_on_android_network_detection(false),
+#endif
+      keep_browser_awake_till_events_complete(false),
       max_sync_attempts(kMaxSyncAttempts),
       max_sync_attempts_with_notification_permission(kMaxSyncAttempts),
       initial_retry_delay(kInitialRetryDelay),
       retry_delay_factor(kRetryDelayFactor),
       min_sync_recovery_time(kMinSyncRecoveryTime),
       max_sync_event_duration(kMaxSyncEventDuration),
-      min_periodic_sync_events_interval(kMinPeriodicSyncEventsInterval) {}
+      min_periodic_sync_events_interval(kMinPeriodicSyncEventsInterval) {
+}
+
+BackgroundSyncParameters::BackgroundSyncParameters(
+    const BackgroundSyncParameters& other) = default;
 
 bool BackgroundSyncParameters::operator==(
     const BackgroundSyncParameters& other) const {
   return disable == other.disable &&
+#if defined(OS_ANDROID)
+         rely_on_android_network_detection ==
+             other.rely_on_android_network_detection &&
+#endif
+         keep_browser_awake_till_events_complete ==
+             other.keep_browser_awake_till_events_complete &&
          max_sync_attempts == other.max_sync_attempts &&
          max_sync_attempts_with_notification_permission ==
              other.max_sync_attempts_with_notification_permission &&
diff --git a/chromium/content/public/browser/background_sync_parameters.h b/chromium/content/public/browser/background_sync_parameters.h
index 9c60470509d..31a80fc89f1 100644
--- a/chromium/content/public/browser/background_sync_parameters.h
+++ b/chromium/content/public/browser/background_sync_parameters.h
@@ -8,18 +8,30 @@
 #include <stdint.h>
 
 #include "base/time/time.h"
+#include "build/build_config.h"
 #include "content/common/content_export.h"
 
 namespace content {
 
 struct CONTENT_EXPORT BackgroundSyncParameters {
   BackgroundSyncParameters();
+  BackgroundSyncParameters(const BackgroundSyncParameters& other);
   bool operator==(const BackgroundSyncParameters& other) const;
 
   // True if the manager should be disabled and registration attempts should
   // fail.
   bool disable;
 
+#if defined(OS_ANDROID)
+  // True if we should rely on Android's network detection where possible.
+  bool rely_on_android_network_detection;
+#endif
+
+  // If true, we keep the browser awake till all (periodic)sync events fired
+  // have completed. If false, we only keep the browser awake till all ready
+  // (periodic)sync events have been fired.
+  bool keep_browser_awake_till_events_complete;
+
   // The number of attempts the BackgroundSyncManager will make to fire an
   // event before giving up.
   int max_sync_attempts;
diff --git a/chromium/content/public/browser/background_tracing_manager.h b/chromium/content/public/browser/background_tracing_manager.h
index e4d064b23f7..bf952c0bc1a 100644
--- a/chromium/content/public/browser/background_tracing_manager.h
+++ b/chromium/content/public/browser/background_tracing_manager.h
@@ -43,8 +43,7 @@ class BackgroundTracingManager {
   //
   using FinishedProcessingCallback = base::OnceCallback<void(bool success)>;
   using ReceiveCallback =
-      base::RepeatingCallback<void(const scoped_refptr<base::RefCountedString>&,
-                                   std::unique_ptr<const base::DictionaryValue>,
+      base::RepeatingCallback<void(std::unique_ptr<std::string>,
                                    FinishedProcessingCallback)>;
 
   // Set the triggering rules for when to start recording.
diff --git a/chromium/content/public/browser/blob_handle.h b/chromium/content/public/browser/blob_handle.h
index eb106fc035c..41c09508bcb 100644
--- a/chromium/content/public/browser/blob_handle.h
+++ b/chromium/content/public/browser/blob_handle.h
@@ -6,6 +6,8 @@
 #define CONTENT_PUBLIC_BROWSER_BLOB_HANDLE_H_
 
 #include <string>
+
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
 
 namespace content {
@@ -16,7 +18,7 @@ class BlobHandle {
  public:
   virtual ~BlobHandle() {}
   virtual std::string GetUUID() = 0;
-  virtual blink::mojom::BlobPtr PassBlob() = 0;
+  virtual mojo::PendingRemote<blink::mojom::Blob> PassBlob() = 0;
 
  protected:
   BlobHandle() {}
diff --git a/chromium/content/public/browser/bluetooth_chooser.h b/chromium/content/public/browser/bluetooth_chooser.h
index c7fa6e1216d..652fad3752e 100644
--- a/chromium/content/public/browser/bluetooth_chooser.h
+++ b/chromium/content/public/browser/bluetooth_chooser.h
@@ -47,7 +47,7 @@ class CONTENT_EXPORT BluetoothChooser {
   // After the EventHandler is called with Event::CANCELLED, Event::SELECTED,
   // Event::DENIED_PERMISSION or Event::SHOW_*, it won't be called again, and
   // users must not call any more BluetoothChooser methods.
-  typedef base::Callback<void(Event, const std::string& opt_device_id)>
+  typedef base::RepeatingCallback<void(Event, const std::string& opt_device_id)>
       EventHandler;
 
   BluetoothChooser() {}
diff --git a/chromium/content/public/browser/browser_child_process_host.h b/chromium/content/public/browser/browser_child_process_host.h
index 2a556cf2253..adab7ee5636 100644
--- a/chromium/content/public/browser/browser_child_process_host.h
+++ b/chromium/content/public/browser/browser_child_process_host.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
 #define CONTENT_PUBLIC_BROWSER_BROWSER_CHILD_PROCESS_HOST_H_
 
+#include "base/callback.h"
 #include "base/environment.h"
 #include "base/memory/shared_memory.h"
 #include "base/process/kill.h"
@@ -15,6 +16,7 @@
 #include "content/public/browser/child_process_termination_info.h"
 #include "content/public/common/process_type.h"
 #include "ipc/ipc_sender.h"
+#include "mojo/public/cpp/bindings/generic_pending_receiver.h"
 #include "services/service_manager/public/mojom/service.mojom.h"
 
 #if defined(OS_MACOSX)
@@ -103,6 +105,16 @@ class CONTENT_EXPORT BrowserChildProcessHost : public IPC::Sender {
   // Returns a PortProvider used to get the task port for child processes.
   static base::PortProvider* GetPortProvider();
 #endif
+
+  // Allows tests to override host interface binding behavior. Any interface
+  // binding request which would normally pass through
+  // BrowserChildProcessHostImpl::BindHostReceiver() will pass through
+  // |callback| first if non-null. |callback| is only called from the IO thread.
+  using BindHostReceiverInterceptor =
+      base::RepeatingCallback<void(BrowserChildProcessHost* process_host,
+                                   mojo::GenericPendingReceiver* receiver)>;
+  static void InterceptBindHostReceiverForTesting(
+      BindHostReceiverInterceptor callback);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_child_process_host_delegate.cc b/chromium/content/public/browser/browser_child_process_host_delegate.cc
new file mode 100644
index 00000000000..b77023bd453
--- /dev/null
+++ b/chromium/content/public/browser/browser_child_process_host_delegate.cc
@@ -0,0 +1,13 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/browser_child_process_host_delegate.h"
+
+namespace content {
+
+base::Optional<std::string> BrowserChildProcessHostDelegate::GetServiceName() {
+  return base::nullopt;
+}
+
+}  // namespace content
diff --git a/chromium/content/public/browser/browser_child_process_host_delegate.h b/chromium/content/public/browser/browser_child_process_host_delegate.h
index 33319d0bd02..6f1f0fd0353 100644
--- a/chromium/content/public/browser/browser_child_process_host_delegate.h
+++ b/chromium/content/public/browser/browser_child_process_host_delegate.h
@@ -5,6 +5,9 @@
 #ifndef CONTENT_PUBLIC_BROWSER_BROWSER_CHILD_PROCESS_HOST_DELEGATE_H_
 #define CONTENT_PUBLIC_BROWSER_BROWSER_CHILD_PROCESS_HOST_DELEGATE_H_
 
+#include <string>
+
+#include "base/optional.h"
 #include "content/common/content_export.h"
 #include "ipc/ipc_listener.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
@@ -28,6 +31,10 @@ class CONTENT_EXPORT BrowserChildProcessHostDelegate : public IPC::Listener {
   // returned from GetExitCodeProcess()).
   virtual void OnProcessCrashed(int exit_code) {}
 
+  // Returns a string identifying the primary service running in the child
+  // process, if any.
+  virtual base::Optional<std::string> GetServiceName();
+
   // Binds an interface receiver in the host process, as requested by the child
   // process.
   virtual void BindHostReceiver(mojo::GenericPendingReceiver receiver) {}
diff --git a/chromium/content/public/browser/browser_context.h b/chromium/content/public/browser/browser_context.h
index 2eaf3facff2..67ba58e9141 100644
--- a/chromium/content/public/browser/browser_context.h
+++ b/chromium/content/public/browser/browser_context.h
@@ -19,6 +19,7 @@
 #include "base/optional.h"
 #include "base/supports_user_data.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/url_request/url_request_interceptor.h"
 #include "net/url_request/url_request_job_factory.h"
 #include "services/network/public/mojom/cors_origin_pattern.mojom-forward.h"
@@ -90,6 +91,7 @@ class ResourceContext;
 class ServiceManagerConnection;
 class SharedCorsOriginAccessList;
 class SiteInstance;
+class StorageNotificationService;
 class StoragePartition;
 class SSLHostStateDelegate;
 
@@ -133,7 +135,8 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
       BrowserContext* browser_context,
       const GURL& site,
       bool can_create = true);
-  using StoragePartitionCallback = base::Callback<void(StoragePartition*)>;
+  using StoragePartitionCallback =
+      base::RepeatingCallback<void(StoragePartition*)>;
   static void ForEachStoragePartition(
       BrowserContext* browser_context,
       const StoragePartitionCallback& callback);
@@ -169,13 +172,16 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   static BlobContextGetter GetBlobStorageContext(
       BrowserContext* browser_context);
 
-  // Returns a mojom::BlobPtr for a specific blob. If no blob exists with the
-  // given UUID, the BlobPtr pipe will close.
-  // This method should be called on the UI thread.
+  // Returns a mojom::mojo::PendingRemote<blink::mojom::Blob> for a specific
+  // blob. If no blob exists with the given UUID, the
+  // mojo::PendingRemote<blink::mojom::Blob> pipe will close. This method should
+  // be called on the UI thread.
   // TODO(mek): Blob UUIDs should be entirely internal to the blob system, so
-  // eliminate this method in favor of just passing around the BlobPtr directly.
-  static blink::mojom::BlobPtr GetBlobPtr(BrowserContext* browser_context,
-                                          const std::string& uuid);
+  // eliminate this method in favor of just passing around the
+  // mojo::PendingRemote<blink::mojom::Blob> directly.
+  static mojo::PendingRemote<blink::mojom::Blob> GetBlobRemote(
+      BrowserContext* browser_context,
+      const std::string& uuid);
 
   // Delivers a push message with |data| to the Service Worker identified by
   // |origin| and |service_worker_registration_id|.
@@ -277,6 +283,12 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // return nullptr.
   virtual PushMessagingService* GetPushMessagingService() = 0;
 
+  // Returns a storage notification service associated with that context,
+  // nullptr otherwise. In the case that nullptr is returned, QuotaManager
+  // and the rest of the storage layer will have no connection to the Chrome
+  // layer for UI purposes.
+  virtual StorageNotificationService* GetStorageNotificationService() = 0;
+
   // Returns the SSL host state decisions for this context. The context may
   // return nullptr, implementing the default exception storage strategy.
   virtual SSLHostStateDelegate* GetSSLHostStateDelegate() = 0;
@@ -314,6 +326,9 @@ class CONTENT_EXPORT BrowserContext : public base::SupportsUserData {
   // Returns a SharedCorsOriginAccessList instance.
   virtual SharedCorsOriginAccessList* GetSharedCorsOriginAccessList();
 
+  // Returns true if OOR-CORS should be enabled.
+  virtual bool ShouldEnableOutOfBlinkCors();
+
   // Handles a service request for a service expected to run an instance per
   // BrowserContext.
   virtual std::unique_ptr<service_manager::Service> HandleServiceRequest(
diff --git a/chromium/content/public/browser/browser_task_traits.h b/chromium/content/public/browser/browser_task_traits.h
index fb283f779e6..96954966672 100644
--- a/chromium/content/public/browser/browser_task_traits.h
+++ b/chromium/content/public/browser/browser_task_traits.h
@@ -80,11 +80,21 @@ class CONTENT_EXPORT BrowserTaskTraitsExtension {
           base::trait_helpers::AreValidTraits<ValidTrait, ArgTypes...>::value>>
   constexpr BrowserTaskTraitsExtension(ArgTypes... args)
       : browser_thread_(
-            base::trait_helpers::GetEnum<BrowserThread::ID>(args...)),
+            base::trait_helpers::GetEnum<BrowserThread::ID, BrowserThread::UI>(
+                args...)),
         task_type_(
             base::trait_helpers::GetEnum<BrowserTaskType,
                                          BrowserTaskType::kDefault>(args...)),
-        nestable_(!base::trait_helpers::HasTrait<NonNestable, ArgTypes...>()) {}
+        nestable_(!base::trait_helpers::HasTrait<NonNestable, ArgTypes...>()) {
+    constexpr bool has_current_thread =
+        base::trait_helpers::HasTrait<base::CurrentThread, ArgTypes...>();
+    constexpr bool has_browser_thread =
+        base::trait_helpers::HasTrait<BrowserThread::ID, ArgTypes...>();
+    static_assert(
+        has_current_thread != has_browser_thread,
+        "Either content::BrowserThread::ID or base::CurrentThread must be set, "
+        "but not both");
+  }
 
   // Keep in sync with UiThreadTaskTraits.java
   constexpr base::TaskTraitsExtensionStorage Serialize() const {
@@ -105,7 +115,9 @@ class CONTENT_EXPORT BrowserTaskTraitsExtension {
         static_cast<bool>(extension.data[2]));
   }
 
+  // This must be ignored if base::CurrentThread is specified.
   constexpr BrowserThread::ID browser_thread() const { return browser_thread_; }
+
   constexpr BrowserTaskType task_type() const { return task_type_; }
 
   // Returns true if tasks with these traits may run in a nested RunLoop.
diff --git a/chromium/content/public/browser/browser_task_traits_unittest.nc b/chromium/content/public/browser/browser_task_traits_unittest.nc
index 8738feb08d6..7f2aa055155 100644
--- a/chromium/content/public/browser/browser_task_traits_unittest.nc
+++ b/chromium/content/public/browser/browser_task_traits_unittest.nc
@@ -7,14 +7,17 @@
 
 #include "base/task/task_traits.h"
 #include "content/public/browser/browser_task_traits.h"
+#include "content/public/browser/browser_thread.h"
 
 namespace content {
 
-#if defined(NCTEST_BROWSER_TASK_TRAITS_NO_THREAD)  // [r"The traits bag is missing a required trait."]
-constexpr base::TaskTraits traits = {NonNestable()};
+#if defined(NCTEST_BROWSER_TASK_TRAITS_NO_THREAD)  // [r"Either content::BrowserThread::ID or base::CurrentThread must be set, but not both"]
+constexpr base::TaskTraits traits = {BrowserTaskType::kNavigation};
 #elif defined(NCTEST_BROWSER_TASK_TRAITS_MULTIPLE_THREADS)  // [r"The traits bag contains multiple traits of the same type."]
 constexpr base::TaskTraits traits = {BrowserThread::UI,
                                      BrowserThread::IO};
+#elif defined(NCTEST_BROWSER_TASK_TRAITS_BROWSER_THREAD_AND_CURRENT_THREAD)  // [r"Either content::BrowserThread::ID or base::CurrentThread must be set, but not both"]
+constexpr base::TaskTraits traits = {BrowserThread::UI, base::CurrentThread()};
 #endif
 
 }  // namespace content
diff --git a/chromium/content/public/browser/browser_thread.h b/chromium/content/public/browser/browser_thread.h
index b1d1f6c9f0c..dcec2a09ef6 100644
--- a/chromium/content/public/browser/browser_thread.h
+++ b/chromium/content/public/browser/browser_thread.h
@@ -69,8 +69,13 @@ class CONTENT_EXPORT BrowserThread {
   // NOTE: Task posting APIs have moved to post_task.h. See
   // browser_task_traits.h.
 
-  // TODO(crbug.com/878356): Consider replacing callsites of this with
-  // base::CreateTaskRunner({id})->DeleteSoon(..).
+  // Delete/ReleaseSoon() helpers allow future deletion of an owned object on
+  // its associated thread. If you already have a task runner bound to a
+  // BrowserThread you should use its SequencedTaskRunner::DeleteSoon() member
+  // method. If you don't, the helpers below avoid having to do
+  // base::CreateSingleThreadTaskRunner({BrowserThread::ID})->DeleteSoon(...)
+  // which is equivalent.
+
   template <class T>
   static bool DeleteSoon(ID identifier,
                          const base::Location& from_here,
diff --git a/chromium/content/public/browser/browsing_data_filter_builder.h b/chromium/content/public/browser/browsing_data_filter_builder.h
index b1f05a4ec38..f1080fc2704 100644
--- a/chromium/content/public/browser/browsing_data_filter_builder.h
+++ b/chromium/content/public/browser/browsing_data_filter_builder.h
@@ -82,7 +82,7 @@ class CONTENT_EXPORT BrowsingDataFilterBuilder {
 
   // A convenience method to produce an empty blacklist, a filter that matches
   // everything.
-  static base::Callback<bool(const GURL&)> BuildNoopFilter();
+  static base::RepeatingCallback<bool(const GURL&)> BuildNoopFilter();
 
   // The mode of the filter.
   virtual Mode GetMode() = 0;
diff --git a/chromium/content/public/browser/browsing_data_remover.h b/chromium/content/public/browser/browsing_data_remover.h
index c9f4f3acb8f..cacc4ce2135 100644
--- a/chromium/content/public/browser/browsing_data_remover.h
+++ b/chromium/content/public/browser/browsing_data_remover.h
@@ -199,8 +199,8 @@ class BrowsingDataRemover {
   // |continue_to_completion| to finish the task. Used in tests to artificially
   // prolong execution.
   virtual void SetWouldCompleteCallbackForTesting(
-      const base::Callback<void(const base::Closure& continue_to_completion)>&
-          callback) = 0;
+      const base::RepeatingCallback<
+          void(base::OnceClosure continue_to_completion)>& callback) = 0;
 
   // Parameters of the last call are exposed to be used by tests. Removal and
   // origin type masks equal to -1 mean that no removal has ever been executed.
diff --git a/chromium/content/public/browser/chromeos/delegate_to_browser_gpu_service_accelerator_factory.h b/chromium/content/public/browser/chromeos/delegate_to_browser_gpu_service_accelerator_factory.h
index 2f1f3a43933..7433cc9d5fe 100644
--- a/chromium/content/public/browser/chromeos/delegate_to_browser_gpu_service_accelerator_factory.h
+++ b/chromium/content/public/browser/chromeos/delegate_to_browser_gpu_service_accelerator_factory.h
@@ -6,6 +6,7 @@
 #define CONTENT_PUBLIC_BROWSER_CHROMEOS_DELEGATE_TO_BROWSER_GPU_SERVICE_ACCELERATOR_FACTORY_H_
 
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "services/video_capture/public/mojom/video_capture_service.mojom.h"
 
 namespace content {
@@ -17,8 +18,8 @@ class CONTENT_EXPORT DelegateToBrowserGpuServiceAcceleratorFactory
     : public video_capture::mojom::AcceleratorFactory {
  public:
   void CreateJpegDecodeAccelerator(
-      chromeos_camera::mojom::MjpegDecodeAcceleratorRequest jda_request)
-      override;
+      mojo::PendingReceiver<chromeos_camera::mojom::MjpegDecodeAccelerator>
+          jda_receiver) override;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.cc b/chromium/content/public/browser/content_browser_client.cc
index 3e5ebb5c71b..f2b23659d02 100644
--- a/chromium/content/public/browser/content_browser_client.cc
+++ b/chromium/content/public/browser/content_browser_client.cc
@@ -17,11 +17,15 @@
 #include "content/public/browser/browser_main_parts.h"
 #include "content/public/browser/client_certificate_delegate.h"
 #include "content/public/browser/login_delegate.h"
+#include "content/public/browser/navigation_throttle.h"
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/browser/network_service_instance.h"
+#include "content/public/browser/overlay_window.h"
 #include "content/public/browser/page_navigator.h"
+#include "content/public/browser/quota_permission_context.h"
 #include "content/public/browser/url_loader_request_interceptor.h"
 #include "content/public/browser/vpn_service_proxy.h"
+#include "content/public/browser/web_contents.h"
 #include "content/public/common/url_utils.h"
 #include "media/audio/audio_manager.h"
 #include "media/media_buildflags.h"
@@ -32,6 +36,7 @@
 #include "services/device/public/cpp/geolocation/location_provider.h"
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/mojom/network_service.mojom.h"
+#include "services/service_manager/public/cpp/manifest.h"
 #include "services/service_manager/sandbox/sandbox_type.h"
 #include "storage/browser/quota/quota_manager.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
@@ -91,6 +96,10 @@ bool ContentBrowserClient::ShouldCompareEffectiveURLsForSiteInstanceSelection(
   return true;
 }
 
+bool ContentBrowserClient::IsExplicitNavigation(ui::PageTransition transition) {
+  return transition & ui::PAGE_TRANSITION_FROM_ADDRESS_BAR;
+}
+
 bool ContentBrowserClient::ShouldUseMobileFlingCurve() {
   return false;
 }
@@ -136,7 +145,8 @@ ContentBrowserClient::CreateURLLoaderFactoryForNetworkRequests(
     network::mojom::NetworkContext* network_context,
     mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>*
         header_client,
-    const url::Origin& request_initiator) {
+    const url::Origin& request_initiator,
+    const base::Optional<net::NetworkIsolationKey>& network_isolation_key) {
   return network::mojom::URLLoaderFactoryPtrInfo();
 }
 
@@ -163,11 +173,6 @@ bool ContentBrowserClient::CanCommitURL(RenderProcessHost* process_host,
   return true;
 }
 
-bool ContentBrowserClient::ShouldAllowOpenURL(SiteInstance* site_instance,
-                                              const GURL& url) {
-  return true;
-}
-
 bool ContentBrowserClient::IsURLAcceptableForWebUI(
     BrowserContext* browser_context,
     const GURL& url) {
@@ -294,7 +299,8 @@ bool ContentBrowserClient::AllowAppCache(const GURL& manifest_url,
 
 bool ContentBrowserClient::AllowServiceWorkerOnIO(
     const GURL& scope,
-    const GURL& first_party,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin,
     const GURL& script_url,
     ResourceContext* context,
     base::RepeatingCallback<WebContents*()> wc_getter) {
@@ -303,7 +309,8 @@ bool ContentBrowserClient::AllowServiceWorkerOnIO(
 
 bool ContentBrowserClient::AllowServiceWorkerOnUI(
     const GURL& scope,
-    const GURL& first_party,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin,
     const GURL& script_url,
     BrowserContext* context,
     base::RepeatingCallback<WebContents*()> wc_getter) {
@@ -312,7 +319,8 @@ bool ContentBrowserClient::AllowServiceWorkerOnUI(
 
 bool ContentBrowserClient::AllowSharedWorker(
     const GURL& worker_url,
-    const GURL& main_frame_url,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin,
     const std::string& name,
     const url::Origin& constructor_origin,
     BrowserContext* context,
@@ -322,6 +330,11 @@ bool ContentBrowserClient::AllowSharedWorker(
   return true;
 }
 
+bool ContentBrowserClient::DoesSchemeAllowCrossOriginSharedWorker(
+    const std::string& scheme) {
+  return false;
+}
+
 bool ContentBrowserClient::AllowSignedExchange(BrowserContext* context) {
   return true;
 }
@@ -472,6 +485,10 @@ MediaObserver* ContentBrowserClient::GetMediaObserver() {
   return nullptr;
 }
 
+LockObserver* ContentBrowserClient::GetLockObserver() {
+  return nullptr;
+}
+
 PlatformNotificationService*
 ContentBrowserClient::GetPlatformNotificationService(
     BrowserContext* browser_context) {
@@ -596,7 +613,7 @@ bool ContentBrowserClient::IsPluginAllowedToUseDevChannelAPIs(
   return false;
 }
 
-bool ContentBrowserClient::BindAssociatedInterfaceRequestFromFrame(
+bool ContentBrowserClient::BindAssociatedReceiverFromFrame(
     RenderFrameHost* render_frame_host,
     const std::string& interface_name,
     mojo::ScopedInterfaceEndpointHandle* handle) {
@@ -702,6 +719,11 @@ void ContentBrowserClient::RegisterNonNetworkNavigationURLLoaderFactories(
     NonNetworkURLLoaderFactoryMap* factories) {}
 
 void ContentBrowserClient::
+    RegisterNonNetworkWorkerMainResourceURLLoaderFactories(
+        BrowserContext* browser_context,
+        NonNetworkURLLoaderFactoryMap* factories) {}
+
+void ContentBrowserClient::
     RegisterNonNetworkServiceWorkerUpdateURLLoaderFactories(
         BrowserContext* browser_context,
         NonNetworkURLLoaderFactoryMap* factories) {}
@@ -755,6 +777,8 @@ bool ContentBrowserClient::WillCreateRestrictedCookieManager(
     network::mojom::RestrictedCookieManagerRole role,
     BrowserContext* browser_context,
     const url::Origin& origin,
+    const GURL& site_for_cookies,
+    const url::Origin& top_frame_origin,
     bool is_service_worker,
     int process_id,
     int frame_id,
@@ -774,18 +798,19 @@ ContentBrowserClient::WillCreateURLLoaderRequestInterceptors(
 void ContentBrowserClient::OnNetworkServiceCreated(
     network::mojom::NetworkService* network_service) {}
 
-network::mojom::NetworkContextPtr ContentBrowserClient::CreateNetworkContext(
+mojo::Remote<network::mojom::NetworkContext>
+ContentBrowserClient::CreateNetworkContext(
     BrowserContext* context,
     bool in_memory,
     const base::FilePath& relative_partition_path) {
   DCHECK(context);
-  network::mojom::NetworkContextPtr network_context;
+  mojo::Remote<network::mojom::NetworkContext> network_context;
   network::mojom::NetworkContextParamsPtr context_params =
       network::mojom::NetworkContextParams::New();
   context_params->user_agent = GetUserAgent();
   context_params->accept_language = "en-us,en";
-  GetNetworkService()->CreateNetworkContext(MakeRequest(&network_context),
-                                            std::move(context_params));
+  GetNetworkService()->CreateNetworkContext(
+      network_context.BindNewPipeAndPassReceiver(), std::move(context_params));
   return network_context;
 }
 
@@ -878,6 +903,7 @@ bool ContentBrowserClient::HandleExternalProtocol(
     bool is_main_frame,
     ui::PageTransition page_transition,
     bool has_user_gesture,
+    const base::Optional<url::Origin>& initiating_origin,
     network::mojom::URLLoaderFactoryPtr* out_factory) {
   return true;
 }
@@ -888,11 +914,6 @@ ContentBrowserClient::CreateWindowForPictureInPicture(
   return nullptr;
 }
 
-bool ContentBrowserClient::IsSafeRedirectTarget(const GURL& url,
-                                                BrowserContext* context) {
-  return true;
-}
-
 void ContentBrowserClient::RegisterRendererPreferenceWatcher(
     BrowserContext* browser_context,
     mojo::PendingRemote<blink::mojom::RendererPreferenceWatcher> watcher) {
@@ -991,4 +1012,16 @@ void ContentBrowserClient::BlockBluetoothScanning(
     const url::Origin& requesting_origin,
     const url::Origin& embedding_origin) {}
 
+bool ContentBrowserClient::ShouldLoadExtraIcuDataFile() {
+  return false;
+}
+
+bool ContentBrowserClient::ArePersistentMediaDeviceIDsAllowed(
+    content::BrowserContext* browser_context,
+    const GURL& scope,
+    const GURL& site_for_cookies,
+    const base::Optional<url::Origin>& top_frame_origin) {
+  return false;
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/content_browser_client.h b/chromium/content/public/browser/content_browser_client.h
index dcb77c78114..7a02c260cc9 100644
--- a/chromium/content/public/browser/content_browser_client.h
+++ b/chromium/content/public/browser/content_browser_client.h
@@ -11,62 +11,41 @@
 #include <memory>
 #include <set>
 #include <string>
-#include <utility>
 #include <vector>
 
 #include "base/callback.h"
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
+#include "base/files/file_path.h"
+#include "base/memory/scoped_refptr.h"
 #include "base/optional.h"
-#include "base/task/thread_pool/thread_pool_instance.h"
+#include "base/strings/string_piece.h"
 #include "base/time/time.h"
-#include "base/values.h"
-#include "build/build_config.h"
-#include "content/public/browser/browser_or_resource_context.h"
+#include "content/common/content_export.h"
 #include "content/public/browser/certificate_request_result_type.h"
 #include "content/public/browser/generated_code_cache_settings.h"
-#include "content/public/browser/global_request_id.h"
-#include "content/public/browser/global_routing_id.h"
-#include "content/public/browser/navigation_throttle.h"
-#include "content/public/browser/overlay_window.h"
 #include "content/public/browser/page_visibility_state.h"
-#include "content/public/browser/quota_permission_context.h"
-#include "content/public/browser/web_contents.h"
-#include "content/public/common/content_client.h"
-#include "content/public/common/navigation_policy.h"
 #include "content/public/common/previews_state.h"
-#include "content/public/common/resource_type.h"
-#include "content/public/common/socket_permission_request.h"
 #include "content/public/common/window_container_type.mojom-forward.h"
 #include "media/base/video_codecs.h"
 #include "media/cdm/cdm_proxy.h"
-#include "media/media_buildflags.h"
 #include "media/mojo/mojom/remoting.mojom.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "net/base/mime_util.h"
-#include "net/url_request/url_request_context_getter.h"
-#include "services/network/public/mojom/network_context.mojom.h"
+#include "mojo/public/cpp/bindings/remote.h"
+#include "services/network/public/mojom/restricted_cookie_manager.mojom-forward.h"
+#include "services/network/public/mojom/url_loader_factory.mojom-forward.h"
 #include "services/network/public/mojom/websocket.mojom-forward.h"
-#include "services/service_manager/public/cpp/binder_map.h"
-#include "services/service_manager/public/cpp/binder_registry.h"
-#include "services/service_manager/public/cpp/identity.h"
-#include "services/service_manager/public/cpp/manifest.h"
-#include "services/service_manager/public/mojom/service.mojom-forward.h"
-#include "services/service_manager/sandbox/sandbox_type.h"
 #include "storage/browser/fileapi/file_system_context.h"
-#include "storage/browser/quota/quota_manager.h"
-#include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
-#include "third_party/blink/public/common/mediastream/media_stream_request.h"
 #include "third_party/blink/public/common/user_agent/user_agent_metadata.h"
 #include "third_party/blink/public/mojom/credentialmanager/credential_manager.mojom-forward.h"
-#include "third_party/blink/public/mojom/renderer_preference_watcher.mojom-forward.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom-forward.h"
-#include "third_party/blink/public/mojom/window_features/window_features.mojom-forward.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/image/image_skia.h"
+#include "url/gurl.h"
+#include "url/origin.h"
 
 #if (defined(OS_POSIX) && !defined(OS_MACOSX)) || defined(OS_FUCHSIA)
 #include "base/posix/global_descriptors.h"
@@ -76,6 +55,10 @@
 #include "content/public/browser/posix_file_descriptor_info.h"
 #endif
 
+namespace net {
+class AuthCredentials;
+}  // namespace net
+
 class GURL;
 using LoginAuthRequiredCallback =
     base::OnceCallback<void(const base::Optional<net::AuthCredentials>&)>;
@@ -83,46 +66,61 @@ using LoginAuthRequiredCallback =
 namespace base {
 class CommandLine;
 class FilePath;
-}
+}  // namespace base
 
 namespace blink {
 namespace mojom {
 class RendererPreferences;
+class RendererPreferenceWatcher;
 class WebUsbService;
-}
+class WindowFeatures;
+}  // namespace mojom
+class AssociatedInterfaceRegistry;
 class URLLoaderThrottle;
 }  // namespace blink
 
 namespace device {
 class LocationProvider;
-}
+}  // namespace device
 
 namespace media {
 class AudioLogFactory;
 class AudioManager;
 enum class EncryptionMode;
-}
-
-namespace mojo {
-class ScopedInterfaceEndpointHandle;
-}
+}  // namespace media
 
 namespace network {
+enum class OriginPolicyState;
 class SharedURLLoaderFactory;
-}
+namespace mojom {
+class TrustedHeaderClient;
+}  // namespace mojom
+}  // namespace network
 
 namespace service_manager {
 class Identity;
+struct Manifest;
 class Service;
-struct BindSourceInfo;
-}
+
+template <typename...>
+class BinderRegistryWithArgs;
+using BinderRegistry = BinderRegistryWithArgs<>;
+
+template <typename>
+class BinderMapWithContext;
+
+namespace mojom {
+class Service;
+}  // namespace mojom
+}  // namespace service_manager
 
 namespace net {
 class AuthChallengeInfo;
-class AuthCredentials;
 class ClientCertIdentity;
 using ClientCertIdentityList = std::vector<std::unique_ptr<ClientCertIdentity>>;
 class ClientCertStore;
+class HttpResponseHeaders;
+class NetworkIsolationKey;
 class SSLCertRequestInfo;
 class SSLInfo;
 class URLRequest;
@@ -130,30 +128,33 @@ class URLRequest;
 
 namespace network {
 namespace mojom {
+class NetworkContext;
 class NetworkService;
-}
+class TrustedURLLoaderHeaderClient;
+}  // namespace mojom
 struct ResourceRequest;
 }  // namespace network
 
 namespace rappor {
 class RapporService;
-}
+}  // namespace rappor
 
 namespace sandbox {
 class TargetPolicy;
-}
+}  // namespace sandbox
 
 namespace ui {
 class SelectFilePolicy;
-}
+}  // namespace ui
 
 namespace url {
 class Origin;
-}
+}  // namespace url
 
 namespace storage {
 class FileSystemBackend;
-}
+struct QuotaSettings;
+}  // namespace storage
 
 namespace content {
 enum class PermissionType;
@@ -167,10 +168,14 @@ class ClientCertificateDelegate;
 class ControllerPresentationServiceDelegate;
 class DevToolsManagerDelegate;
 class HidDelegate;
+class LockObserver;
 class LoginDelegate;
 class MediaObserver;
 class NavigationHandle;
+class NavigationThrottle;
 class NavigationUIData;
+class OverlayWindow;
+class PictureInPictureWindowController;
 class PlatformNotificationService;
 class QuotaPermissionContext;
 class ReceiverPresentationServiceDelegate;
@@ -189,9 +194,13 @@ class URLLoaderRequestInterceptor;
 class VpnServiceProxy;
 class WebContents;
 class WebContentsViewDelegate;
+struct GlobalFrameRoutingId;
+struct GlobalRequestID;
 struct MainFunctionParams;
+struct NavigationDownloadPolicy;
 struct OpenURLParams;
 struct Referrer;
+struct SocketPermissionRequest;
 struct WebPreferences;
 
 // Embedder API (or SPI) for participating in browser logic, to be implemented
@@ -273,6 +282,13 @@ class CONTENT_EXPORT ContentBrowserClient {
       const GURL& candidate_url,
       const GURL& destination_url);
 
+  // Returns true if the user intentionally initiated the navigation. This is
+  // used to determine whether we should process debug URLs like chrome://crash.
+  // The default implementation checks whether the transition was initiated via
+  // the address bar (rather than whether it was typed) to permit the pasting of
+  // debug URLs.
+  virtual bool IsExplicitNavigation(ui::PageTransition transition);
+
   // Returns whether gesture fling events should use the mobile-behavior gesture
   // curve for scrolling.
   virtual bool ShouldUseMobileFlingCurve();
@@ -332,9 +348,10 @@ class CONTENT_EXPORT ContentBrowserClient {
   // - The default factory to be used by a frame.  In this case
   //   |request_initiator| is the origin being committed in the frame (or the
   //   last origin committed in the frame).
-  // - The initiator-specific factory to be used by a frame.  This happens for
-  //   origins covered via
-  //   RenderFrameHost::MarkInitiatorAsRequiringSeparateURLLoaderFactory.
+  // - An isolated-world-specific factory to be used by a frame.  This happens
+  //   for origins covered via
+  //   RenderFrameHost::MarkIsolatedWorldAsRequiringSeparateURLLoaderFactory.
+  //   In this case |request_initiator| is the origin of the isolated world.
   //
   // This method allows the //content embedder to provide a URLLoaderFactory
   // with |request_initiator|-specific properties (e.g. with relaxed
@@ -349,7 +366,8 @@ class CONTENT_EXPORT ContentBrowserClient {
       network::mojom::NetworkContext* network_context,
       mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>*
           header_client,
-      const url::Origin& request_initiator);
+      const url::Origin& request_initiator,
+      const base::Optional<net::NetworkIsolationKey>& network_isolation_key);
 
   // Returns a list additional WebUI schemes, if any.  These additional schemes
   // act as aliases to the chrome: scheme.  The additional schemes may or may
@@ -386,11 +404,6 @@ class CONTENT_EXPORT ContentBrowserClient {
   // This is called on the UI thread.
   virtual bool CanCommitURL(RenderProcessHost* process_host, const GURL& url);
 
-  // Returns whether |url| should be allowed to open from the context indicated
-  // by |site_instance|.
-  // This also applies in cases where the new URL will open in another process.
-  virtual bool ShouldAllowOpenURL(SiteInstance* site_instance, const GURL& url);
-
   // Returns whether a URL can be displayed within a WebUI for a given
   // BrowserContext. Temporary workaround while crbug.com/768526 is resolved.
   // Note: This is used by an internal Cast implementation of this class.
@@ -487,6 +500,12 @@ class CONTENT_EXPORT ContentBrowserClient {
 
   // Indicates whether a file path should be accessible via file URL given a
   // request from a browser context which lives within |profile_path|.
+  //
+  // On POSIX platforms, |absolute_path| is the path after resolving all
+  // symboling links. On Windows, if the file URL is a shortcut,
+  // IsFileAccessAllowed will be called twice: Once for the shortcut, which is
+  // treated like a redirect, and once for the destination path after following
+  // the shortcut, assuming access to the shortcut path was allowed.
   virtual bool IsFileAccessAllowed(const base::FilePath& path,
                                    const base::FilePath& absolute_path,
                                    const base::FilePath& profile_path);
@@ -534,9 +553,14 @@ class CONTENT_EXPORT ContentBrowserClient {
                              BrowserContext* context);
 
   // Allows the embedder to control if a service worker is allowed at the given
-  // |scope| and can be accessed from |first_party|. This function is called
-  // whenever an attempt is made to create or access the persistent state of the
-  // registration, or to start the service worker.
+  // |scope| and can be accessed from |site_for_cookies| and |top_frame_origin|.
+  // |site_for_cookies| is used to determine whether the request is done in a
+  // third-party context. |top_frame_origin| is used to check if any
+  // content_setting affects this request. Only calls that are made within the
+  // context of a tab can provide a proper |top_frame_origin|, otherwise the
+  // scope of the service worker is used.
+  // This function is called whenever an attempt is made to create or access the
+  // persistent state of the registration, or to start the service worker.
   //
   // If non-empty, |script_url| is the script of the service worker that is
   // attempted to be registered or started. If it's empty, an attempt is being
@@ -548,14 +572,16 @@ class CONTENT_EXPORT ContentBrowserClient {
   // This is called on the IO thread.
   virtual bool AllowServiceWorkerOnIO(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       ResourceContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter);
   // Same but for the UI thread.
   virtual bool AllowServiceWorkerOnUI(
       const GURL& scope,
-      const GURL& first_party,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
       const GURL& script_url,
       BrowserContext* context,
       base::RepeatingCallback<WebContents*()> wc_getter);
@@ -563,13 +589,20 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Allow the embedder to control if a Shared Worker can be connected from a
   // given tab.
   // This is called on the UI thread.
-  virtual bool AllowSharedWorker(const GURL& worker_url,
-                                 const GURL& main_frame_url,
-                                 const std::string& name,
-                                 const url::Origin& constructor_origin,
-                                 BrowserContext* context,
-                                 int render_process_id,
-                                 int render_frame_id);
+  virtual bool AllowSharedWorker(
+      const GURL& worker_url,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin,
+      const std::string& name,
+      const url::Origin& constructor_origin,
+      BrowserContext* context,
+      int render_process_id,
+      int render_frame_id);
+
+  // Allow the embedder to control if a page/worker with |scheme| URL can create
+  // a cross-origin shared workers.
+  virtual bool DoesSchemeAllowCrossOriginSharedWorker(
+      const std::string& scheme);
 
   // Allows the embedder to control whether Signed HTTP Exchanges (SXG) can be
   // loaded. This is called on the UI thread.
@@ -711,7 +744,8 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void GetQuotaSettings(
       content::BrowserContext* context,
       content::StoragePartition* partition,
-      storage::OptionalQuotaSettingsCallback callback);
+      base::OnceCallback<void(base::Optional<storage::QuotaSettings>)>
+          callback);
 
   // Allows the embedder to provide settings that determine if generated code
   // can be cached and the amount of disk space used for caching generated code.
@@ -749,6 +783,13 @@ class CONTENT_EXPORT ContentBrowserClient {
   // return nullptr if they're not interested.
   virtual MediaObserver* GetMediaObserver();
 
+  // Returns a class to observe usage of locks. The embedder can return nullptr
+  // if they're not interested. The returned LockObserver may be used on any
+  // sequence until threads are destroyed. The impl should therefore be
+  // thread-safe and remain alive until at least
+  // BrowserMainParts::PostDestroyThreads().
+  virtual LockObserver* GetLockObserver();
+
   // Returns the platform notification service, capable of displaying Web
   // Notifications to the user. The embedder can return a nullptr if they don't
   // support this functionality. Must be called on the UI thread.
@@ -942,10 +983,10 @@ class CONTENT_EXPORT ContentBrowserClient {
       RenderFrameHost* render_frame_host,
       mojo::PendingReceiver<blink::mojom::CredentialManager> receiver) {}
 
-  // Content was unable to bind a request for this associated interface, so the
+  // Content was unable to bind a receiver for this associated interface, so the
   // embedder should try. Returns true if the |handle| was actually taken and
   // bound; false otherwise.
-  virtual bool BindAssociatedInterfaceRequestFromFrame(
+  virtual bool BindAssociatedReceiverFromFrame(
       RenderFrameHost* render_frame_host,
       const std::string& interface_name,
       mojo::ScopedInterfaceEndpointHandle* handle);
@@ -959,14 +1000,9 @@ class CONTENT_EXPORT ContentBrowserClient {
       const std::string& interface_name,
       mojo::ScopedMessagePipeHandle interface_pipe) {}
 
-  // (Currently called only from GPUProcessHost, move somewhere more central).
-  // Called when a request to bind |interface_name| on |interface_pipe| is
-  // received from |source_info.identity|. If the request is bound,
-  // |interface_pipe| will become invalid (taken by the client).
-  virtual void BindInterfaceRequest(
-      const service_manager::BindSourceInfo& source_info,
-      const std::string& interface_name,
-      mojo::ScopedMessagePipeHandle* interface_pipe) {}
+  // Handles an unhandled incoming interface binding request from the GPU
+  // process. Called on the IO thread.
+  virtual void BindGpuHostReceiver(mojo::GenericPendingReceiver receiver) {}
 
   // Called on the main thread to handle an unhandled interface receiver binding
   // request from a render process. See |RenderThread::BindHostReceiver()|.
@@ -1164,9 +1200,18 @@ class CONTENT_EXPORT ContentBrowserClient {
       NonNetworkURLLoaderFactoryMap* factories);
 
   // Allows the embedder to register per-scheme URLLoaderFactory
-  // implementations to handle service worker script requests initiated by the
-  // browser process for schemes not handled by the Network Service.
-  // Only called for service worker update check when
+  // implementations to handle dedicated/shared worker main script requests
+  // initiated by the browser process for schemes not handled by the Network
+  // Service. The resulting |factories| must be used only by the browser
+  // process. The caller must not send any of |factories| to any other process.
+  virtual void RegisterNonNetworkWorkerMainResourceURLLoaderFactories(
+      BrowserContext* browser_context,
+      NonNetworkURLLoaderFactoryMap* factories);
+
+  // Allows the embedder to register per-scheme URLLoaderFactory
+  // implementations to handle service worker main/imported script requests
+  // initiated by the browser process for schemes not handled by the Network
+  // Service. Only called for service worker update check when
   // ServiceWorkerImportedScriptUpdateCheck is enabled.
   // The resulting |factories| must be used only by the browser process. The
   // caller must not send any of |factories| to any other process.
@@ -1303,7 +1348,12 @@ class CONTENT_EXPORT ContentBrowserClient {
   // preference-following access to cookies. This is primarily used for objects
   // vended to renderer processes for limited, origin-locked (to |origin|),
   // access to script-accessible cookies from JavaScript, so returned objects
-  // should treat their inputs as untrusted.
+  // should treat their inputs as untrusted.  |site_for_cookies| represents
+  // which domains the cookie manager should consider to be first-party, for
+  // purposes of SameSite cookies and any third-party cookie blocking the
+  // embedder may implement (if |site_for_cookies| is empty, no domains are
+  // first-party). |top_frame_origin| represents the domain for top-level frame,
+  // and can be used to look up preferences that are dependent on that.
   //
   // |*receiver| is always valid upon entry.
   //
@@ -1326,6 +1376,8 @@ class CONTENT_EXPORT ContentBrowserClient {
       network::mojom::RestrictedCookieManagerRole role,
       BrowserContext* browser_context,
       const url::Origin& origin,
+      const GURL& site_for_cookies,
+      const url::Origin& top_frame_origin,
       bool is_service_worker,
       int process_id,
       int routing_id,
@@ -1370,7 +1422,7 @@ class CONTENT_EXPORT ContentBrowserClient {
   // For NetworkContexts returned from the Network Service, some requirements:
   //   -enable data URL support (or else data URLs will fail)
   //   -disable file URL support (for security)
-  virtual network::mojom::NetworkContextPtr CreateNetworkContext(
+  virtual mojo::Remote<network::mojom::NetworkContext> CreateNetworkContext(
       BrowserContext* context,
       bool in_memory,
       const base::FilePath& relative_partition_path);
@@ -1502,14 +1554,20 @@ class CONTENT_EXPORT ContentBrowserClient {
   // ChildProcessHost::kInvalidUniqueID and |navigation_ui_data| will valid.
   // Otherwise child_id will be the process id and |navigation_ui_data| will be
   // nullptr.
+  //
+  // |initiating_origin| is the origin that initiated the navigation to the
+  // external protocol, and may be null, e.g. in the case of browser-initiated
+  // navigations. The initiating origin is intended to help users make security
+  // decisions about whether to allow an external application to launch.
   virtual bool HandleExternalProtocol(
       const GURL& url,
-      WebContents::Getter web_contents_getter,
+      base::Callback<WebContents*(void)> web_contents_getter,
       int child_id,
       NavigationUIData* navigation_data,
       bool is_main_frame,
       ui::PageTransition page_transition,
       bool has_user_gesture,
+      const base::Optional<url::Origin>& initiating_origin,
       network::mojom::URLLoaderFactoryPtr* out_factory);
 
   // Creates an OverlayWindow to be used for Picture-in-Picture. This window
@@ -1520,10 +1578,6 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual std::unique_ptr<OverlayWindow> CreateWindowForPictureInPicture(
       PictureInPictureWindowController* controller);
 
-  // Returns true if it is safe to redirect to |url|, otherwise returns false.
-  // This is called on the UI thread.
-  virtual bool IsSafeRedirectTarget(const GURL& url, BrowserContext* context);
-
   // Registers the watcher to observe updates in RendererPreferences.
   virtual void RegisterRendererPreferenceWatcher(
       BrowserContext* browser_context,
@@ -1638,6 +1692,17 @@ class CONTENT_EXPORT ContentBrowserClient {
   virtual void BlockBluetoothScanning(content::BrowserContext* browser_context,
                                       const url::Origin& requesting_origin,
                                       const url::Origin& embedding_origin);
+
+  // Returns true if the extra ICU data file is available and should be used to
+  // initialize ICU.
+  virtual bool ShouldLoadExtraIcuDataFile();
+
+  // Returns true if the site is allowed to use persistent media device IDs.
+  virtual bool ArePersistentMediaDeviceIDsAllowed(
+      content::BrowserContext* browser_context,
+      const GURL& scope,
+      const GURL& site_for_cookies,
+      const base::Optional<url::Origin>& top_frame_origin);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/desktop_streams_registry.h b/chromium/content/public/browser/desktop_streams_registry.h
index ed9eb6a76d4..600009c69e5 100644
--- a/chromium/content/public/browser/desktop_streams_registry.h
+++ b/chromium/content/public/browser/desktop_streams_registry.h
@@ -7,7 +7,9 @@
 
 #include "content/common/content_export.h"
 
-class GURL;
+namespace url {
+class Origin;
+}
 
 namespace content {
 
@@ -34,7 +36,7 @@ class CONTENT_EXPORT DesktopStreamsRegistry {
   // |render_frame_id| refers to the RenderFrame requesting the stream.
   virtual std::string RegisterStream(int render_process_id,
                                      int render_frame_id,
-                                     const GURL& origin,
+                                     const url::Origin& origin,
                                      const DesktopMediaID& source,
                                      const std::string& extension_name,
                                      const DesktopStreamRegistryType type) = 0;
@@ -48,7 +50,7 @@ class CONTENT_EXPORT DesktopStreamsRegistry {
       const std::string& id,
       int render_process_id,
       int render_frame_id,
-      const GURL& origin,
+      const url::Origin& origin,
       std::string* extension_name,
       const DesktopStreamRegistryType type) = 0;
 };
diff --git a/chromium/content/public/browser/devtools_agent_host.h b/chromium/content/public/browser/devtools_agent_host.h
index 096b6c21050..3bc7d2fe579 100644
--- a/chromium/content/public/browser/devtools_agent_host.h
+++ b/chromium/content/public/browser/devtools_agent_host.h
@@ -74,7 +74,7 @@ class CONTENT_EXPORT DevToolsAgentHost
       std::unique_ptr<DevToolsExternalAgentProxyDelegate> delegate);
 
   using CreateServerSocketCallback =
-      base::Callback<std::unique_ptr<net::ServerSocket>(std::string*)>;
+      base::RepeatingCallback<std::unique_ptr<net::ServerSocket>(std::string*)>;
 
   // Creates DevToolsAgentHost for the browser, which works with browser-wide
   // debugging protocol.
diff --git a/chromium/content/public/browser/download_manager.h b/chromium/content/public/browser/download_manager.h
index d7355b85557..0964a78a0ba 100644
--- a/chromium/content/public/browser/download_manager.h
+++ b/chromium/content/public/browser/download_manager.h
@@ -29,6 +29,7 @@
 
 #include <stdint.h>
 
+#include <memory>
 #include <string>
 #include <vector>
 
@@ -46,7 +47,6 @@
 #include "content/common/content_export.h"
 #include "net/base/net_errors.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
-#include "storage/browser/blob/blob_data_handle.h"
 #include "url/origin.h"
 
 class GURL;
@@ -119,15 +119,12 @@ class CONTENT_EXPORT DownloadManager : public base::SupportsUserData::Data,
       base::Time remove_end) = 0;
 
   using SimpleDownloadManager::DownloadUrl;
-  // For downloads of blob URLs, the caller can pass a BlobDataHandle object so
-  // that the blob will remain valid until the download starts. The
-  // BlobDataHandle will be attached to the associated URLRequest.
-  // If |blob_data_handle| is unspecified, and the blob URL cannot be mapped to
-  // a blob by the time the download request starts, then the download will
-  // fail.
+  // For downloads of blob URLs, the caller can pass a URLLoaderFactory to
+  // use to load the Blob URL. If none is specified and the blob URL cannot be
+  // mapped to a blob by the time the download request starts, then the download
+  // will fail.
   virtual void DownloadUrl(
       std::unique_ptr<download::DownloadUrlParameters> parameters,
-      std::unique_ptr<storage::BlobDataHandle> blob_data_handle,
       scoped_refptr<network::SharedURLLoaderFactory>
           blob_url_loader_factory) = 0;
 
diff --git a/chromium/content/public/browser/download_manager_delegate.cc b/chromium/content/public/browser/download_manager_delegate.cc
index 6969224dd43..7205bd34979 100644
--- a/chromium/content/public/browser/download_manager_delegate.cc
+++ b/chromium/content/public/browser/download_manager_delegate.cc
@@ -27,7 +27,7 @@ bool DownloadManagerDelegate::ShouldOpenFileBasedOnExtension(
 
 bool DownloadManagerDelegate::ShouldCompleteDownload(
     download::DownloadItem* item,
-    const base::Closure& callback) {
+    base::OnceClosure callback) {
   return true;
 }
 
diff --git a/chromium/content/public/browser/download_manager_delegate.h b/chromium/content/public/browser/download_manager_delegate.h
index ff0f7d0f2d9..3276f38ccb2 100644
--- a/chromium/content/public/browser/download_manager_delegate.h
+++ b/chromium/content/public/browser/download_manager_delegate.h
@@ -114,7 +114,7 @@ class CONTENT_EXPORT DownloadManagerDelegate {
   // has been called or the function has returned true for a particular
   // download it should continue to return true for that download.
   virtual bool ShouldCompleteDownload(download::DownloadItem* item,
-                                      const base::Closure& complete_callback);
+                                      base::OnceClosure complete_callback);
 
   // Allows the delegate to override opening the download. If this function
   // returns false, the delegate needs to call callback when it's done
@@ -138,8 +138,7 @@ class CONTENT_EXPORT DownloadManagerDelegate {
   // Retrieve the directories to save html pages and downloads to.
   virtual void GetSaveDir(BrowserContext* browser_context,
                           base::FilePath* website_save_dir,
-                          base::FilePath* download_save_dir,
-                          bool* skip_dir_check) {}
+                          base::FilePath* download_save_dir) {}
 
   // Asks the user for the path to save a page. The delegate calls the callback
   // to give the answer.
diff --git a/chromium/content/public/browser/favicon_status.cc b/chromium/content/public/browser/favicon_status.cc
index 0a10179edd5..91ed848cbd2 100644
--- a/chromium/content/public/browser/favicon_status.cc
+++ b/chromium/content/public/browser/favicon_status.cc
@@ -5,6 +5,7 @@
 #include "content/public/browser/favicon_status.h"
 
 #include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 #include "ui/gfx/image/image_skia.h"
 
 namespace content {
diff --git a/chromium/content/public/browser/gpu_data_manager.h b/chromium/content/public/browser/gpu_data_manager.h
index 76a2d18be23..d3ee1382f9e 100644
--- a/chromium/content/public/browser/gpu_data_manager.h
+++ b/chromium/content/public/browser/gpu_data_manager.h
@@ -28,6 +28,12 @@ enum GpuProcessKind {
   GPU_PROCESS_KIND_COUNT
 };
 
+enum GpuInfoRequest {
+  kGpuInfoRequestDxDiag = 1 << 0,
+  kGpuInfoRequestDx12Vulkan = 1 << 1,
+  kGpuInfoRequestAll = kGpuInfoRequestDxDiag | kGpuInfoRequestDx12Vulkan,
+};
+
 class GpuDataManagerObserver;
 
 // This class is fully thread-safe.
@@ -54,7 +60,8 @@ class GpuDataManager {
   virtual bool GpuAccessAllowed(std::string* reason) = 0;
 
   // Requests complete GPU info if it has not already been requested
-  virtual void RequestCompleteGpuInfoIfNeeded() = 0;
+  virtual void RequestDxdiagDx12VulkanGpuInfoIfNeeded(GpuInfoRequest request,
+                                                      bool delayed) = 0;
 
   // Check if basic and context GPU info have been collected.
   virtual bool IsEssentialGpuInfoAvailable() = 0;
diff --git a/chromium/content/public/browser/gpu_service_registry.h b/chromium/content/public/browser/gpu_service_registry.h
index 487acf50108..37ca37f6d0a 100644
--- a/chromium/content/public/browser/gpu_service_registry.h
+++ b/chromium/content/public/browser/gpu_service_registry.h
@@ -2,13 +2,14 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifndef CONTENT_PUBLIC_BROWSER_GPU_INTERFACE_REGISTRY_H_
-#define CONTENT_PUBLIC_BROWSER_GPU_INTERFACE_REGISTRY_H_
+#ifndef CONTENT_PUBLIC_BROWSER_GPU_SERVICE_REGISTRY_H_
+#define CONTENT_PUBLIC_BROWSER_GPU_SERVICE_REGISTRY_H_
 
 #include <string>
+#include <utility>
 
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 
 namespace content {
@@ -19,11 +20,10 @@ CONTENT_EXPORT void BindInterfaceInGpuProcess(
 
 // Bind to an interface exposed by the GPU process.
 template <typename Interface>
-void BindInterfaceInGpuProcess(mojo::InterfaceRequest<Interface> request) {
-  BindInterfaceInGpuProcess(Interface::Name_,
-                            std::move(request.PassMessagePipe()));
+void BindInterfaceInGpuProcess(mojo::PendingReceiver<Interface> receiver) {
+  BindInterfaceInGpuProcess(Interface::Name_, receiver.PassPipe());
 }
 
 }  // namespace content
 
-#endif  // CONTENT_PUBLIC_BROWSER_GPU_INTERFACE_REGISTRY_H_
+#endif  // CONTENT_PUBLIC_BROWSER_GPU_SERVICE_REGISTRY_H_
diff --git a/chromium/content/public/browser/gpu_utils.cc b/chromium/content/public/browser/gpu_utils.cc
index c2ddc4f9233..d4ae6eb24a4 100644
--- a/chromium/content/public/browser/gpu_utils.cc
+++ b/chromium/content/public/browser/gpu_utils.cc
@@ -91,19 +91,6 @@ const gpu::GpuPreferences GetGpuPreferencesFromCommandLine() {
 
   gpu_preferences.enable_oop_rasterization_ddl =
       command_line->HasSwitch(switches::kEnableOopRasterizationDDL);
-  if (command_line->HasSwitch(switches::kUseVulkan)) {
-    auto value = command_line->GetSwitchValueASCII(switches::kUseVulkan);
-    if (value.empty() || value == switches::kVulkanImplementationNameNative) {
-      gpu_preferences.use_vulkan = gpu::VulkanImplementationName::kNative;
-    } else if (value == switches::kVulkanImplementationNameSwiftshader) {
-      gpu_preferences.use_vulkan = gpu::VulkanImplementationName::kSwiftshader;
-    } else {
-      gpu_preferences.use_vulkan = gpu::VulkanImplementationName::kNone;
-    }
-  } else {
-    gpu_preferences.use_vulkan = gpu::VulkanImplementationName::kNone;
-  }
-
   gpu_preferences.enforce_vulkan_protected_memory =
       command_line->HasSwitch(switches::kEnforceVulkanProtectedMemory);
   gpu_preferences.disable_vulkan_fallback_to_gl_for_testing =
diff --git a/chromium/content/public/browser/invalidate_type.h b/chromium/content/public/browser/invalidate_type.h
index f85ec3da0af..b3afba06655 100644
--- a/chromium/content/public/browser/invalidate_type.h
+++ b/chromium/content/public/browser/invalidate_type.h
@@ -20,8 +20,12 @@ enum InvalidateTypes {
                                            // state changed.
   INVALIDATE_TYPE_LOAD          = 1 << 2,  // The loading state has changed.
   INVALIDATE_TYPE_TITLE         = 1 << 3,  // The title changed.
+  INVALIDATE_TYPE_AUDIO         = 1 << 4,  // The tab became audible or
+                                           // inaudible.
+                                           // TODO(crbug.com/846374):
+                                           // remove this.
 
-  INVALIDATE_TYPE_ALL           = (1 << 4) - 1,
+  INVALIDATE_TYPE_ALL           = (1 << 5) - 1,
 };
 
 }
diff --git a/chromium/content/public/browser/lock_observer.h b/chromium/content/public/browser/lock_observer.h
new file mode 100644
index 00000000000..bb46c8e058b
--- /dev/null
+++ b/chromium/content/public/browser/lock_observer.h
@@ -0,0 +1,44 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_LOCK_OBSERVER_H_
+#define CONTENT_PUBLIC_BROWSER_LOCK_OBSERVER_H_
+
+#include "base/macros.h"
+
+namespace content {
+
+// Observer interface to be notified when frames hold resources.
+//
+// Methods may be called from any sequence and must therefore be thread-safe.
+class LockObserver {
+ public:
+  LockObserver() = default;
+  virtual ~LockObserver() = default;
+
+  // Invoked when the number of Web Locks held by a frame switches between zero
+  // and non-zero. There is no guarantee that the frame identified by
+  // |render_process_id| and |render_frame_id| still exists when this is called.
+  virtual void OnFrameStartsHoldingWebLocks(int render_process_id,
+                                            int render_frame_id) = 0;
+  virtual void OnFrameStopsHoldingWebLocks(int render_process_id,
+                                           int render_frame_id) = 0;
+
+  // Invoked when the number of IndexedDB connections (pending or active) in a
+  // frame switches between zero and non-zero. There is no guarantee that the
+  // frame identified by |render_process_id| and |render_frame_id| still exists
+  // when this is called.
+  virtual void OnFrameStartsHoldingIndexedDBConnections(
+      int render_process_id,
+      int render_frame_id) = 0;
+  virtual void OnFrameStopsHoldingIndexedDBConnections(int render_process_id,
+                                                       int render_frame_id) = 0;
+
+  LockObserver(const LockObserver&) = delete;
+  LockObserver& operator=(const LockObserver&) = delete;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_LOCK_OBSERVER_H_
diff --git a/chromium/content/public/browser/native_file_system_entry_factory.h b/chromium/content/public/browser/native_file_system_entry_factory.h
index 3666fc7703c..d7c42af8122 100644
--- a/chromium/content/public/browser/native_file_system_entry_factory.h
+++ b/chromium/content/public/browser/native_file_system_entry_factory.h
@@ -16,10 +16,11 @@
 
 namespace content {
 
-// Exposes methods for creating NativeFileSystemEntries.
+// Exposes methods for creating NativeFileSystemEntries. All these methods need
+// to be called on the UI thread.
 class CONTENT_EXPORT NativeFileSystemEntryFactory
     : public base::RefCountedThreadSafe<NativeFileSystemEntryFactory,
-                                        BrowserThread::DeleteOnIOThread> {
+                                        BrowserThread::DeleteOnUIThread> {
  public:
   // Context from which a created handle is going to be used. This is used for
   // security and permission checks. Pass in MSG_ROUTING_NONE as frame_id if
@@ -56,7 +57,7 @@ class CONTENT_EXPORT NativeFileSystemEntryFactory
       const base::FilePath& directory_path) = 0;
 
  protected:
-  friend struct BrowserThread::DeleteOnThread<BrowserThread::IO>;
+  friend struct BrowserThread::DeleteOnThread<BrowserThread::UI>;
   friend class base::DeleteHelper<NativeFileSystemEntryFactory>;
   virtual ~NativeFileSystemEntryFactory() {}
 };
diff --git a/chromium/content/public/browser/native_file_system_permission_context.h b/chromium/content/public/browser/native_file_system_permission_context.h
index 418f4a36a95..1e763f101ed 100644
--- a/chromium/content/public/browser/native_file_system_permission_context.h
+++ b/chromium/content/public/browser/native_file_system_permission_context.h
@@ -14,7 +14,7 @@ namespace content {
 
 // Entry point to an embedder implemented permission context for the Native File
 // System API. Instances of this class can be retrieved via a BrowserContext.
-// All these methods should always be called on the same sequence.
+// All these methods must always be called on the UI thread.
 class NativeFileSystemPermissionContext {
  public:
   // The type of action a user took that resulted in needing a permission grant
@@ -94,14 +94,14 @@ class NativeFileSystemPermissionContext {
       int frame_id,
       base::OnceCallback<void(SensitiveDirectoryResult)> callback) = 0;
 
-  enum class SafeBrowsingResult { kAllow, kBlock };
-  // Runs a recently finished write operation through Safe Browsing code to
-  // determine if the write should be allowed or blocked.
-  virtual void PerformSafeBrowsingChecks(
+  enum class AfterWriteCheckResult { kAllow, kBlock };
+  // Runs a recently finished write operation through checks such as malware
+  // or other security checks to determine if the write should be allowed.
+  virtual void PerformAfterWriteChecks(
       std::unique_ptr<NativeFileSystemWriteItem> item,
       int process_id,
       int frame_id,
-      base::OnceCallback<void(SafeBrowsingResult)> callback) = 0;
+      base::OnceCallback<void(AfterWriteCheckResult)> callback) = 0;
 
   // Returns whether the given |origin| is allowed to ask for write access.
   // This is used to block save file dialogs from being shown
diff --git a/chromium/content/public/browser/native_file_system_permission_grant.h b/chromium/content/public/browser/native_file_system_permission_grant.h
index 9ecadecc116..14336416c6d 100644
--- a/chromium/content/public/browser/native_file_system_permission_grant.h
+++ b/chromium/content/public/browser/native_file_system_permission_grant.h
@@ -25,7 +25,7 @@ namespace content {
 //
 // NativeFileSystemPermissionGrant instances are not thread safe, and should
 // only be used (and referenced) on the same sequence as the PermssionContext
-// that created them.
+// that created them, i.e. the UI thread.
 class CONTENT_EXPORT NativeFileSystemPermissionGrant
     : public base::RefCounted<NativeFileSystemPermissionGrant> {
  public:
diff --git a/chromium/content/public/browser/navigation_controller.cc b/chromium/content/public/browser/navigation_controller.cc
index e152cc8284a..a1c4d032d1a 100644
--- a/chromium/content/public/browser/navigation_controller.cc
+++ b/chromium/content/public/browser/navigation_controller.cc
@@ -6,28 +6,68 @@
 
 #include "base/memory/ref_counted_memory.h"
 #include "build/build_config.h"
+#include "content/public/browser/page_navigator.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/common/was_activated_option.mojom.h"
 
 namespace content {
 
 NavigationController::LoadURLParams::LoadURLParams(const GURL& url)
-    : url(url),
-      load_type(LOAD_TYPE_DEFAULT),
-      transition_type(ui::PAGE_TRANSITION_LINK),
-      frame_tree_node_id(RenderFrameHost::kNoFrameTreeNodeId),
-      is_renderer_initiated(false),
-      override_user_agent(UA_OVERRIDE_INHERIT),
-      post_data(nullptr),
-      can_load_local_resources(false),
-      should_replace_current_entry(false),
-      has_user_gesture(false),
-      should_clear_history_list(false),
-      started_from_context_menu(false),
-      navigation_ui_data(nullptr),
-      from_download_cross_origin_redirect(false),
-      was_activated(mojom::WasActivatedOption::kUnknown),
-      reload_type(ReloadType::NONE) {}
+    : url(url), is_renderer_initiated(false) {}
+
+NavigationController::LoadURLParams::LoadURLParams(const OpenURLParams& input)
+    : url(input.url),
+      initiator_origin(input.initiator_origin),
+      source_site_instance(input.source_site_instance),
+      load_type(input.uses_post ? LOAD_TYPE_HTTP_POST : LOAD_TYPE_DEFAULT),
+      transition_type(input.transition),
+      frame_tree_node_id(input.frame_tree_node_id),
+      referrer(input.referrer),
+      redirect_chain(input.redirect_chain),
+      extra_headers(input.extra_headers),
+      is_renderer_initiated(input.is_renderer_initiated),
+      post_data(input.post_data),
+      should_replace_current_entry(input.should_replace_current_entry),
+      has_user_gesture(input.user_gesture),
+      started_from_context_menu(input.started_from_context_menu),
+      blob_url_loader_factory(input.blob_url_loader_factory),
+      href_translate(input.href_translate),
+      reload_type(input.reload_type) {
+  // |post_data| should be present iff |uses_post| is true.
+  //
+  // TODO(lukasza): Consider removing |uses_post| (redundant with |post_data|).
+  DCHECK_EQ(input.uses_post, !!input.post_data);
+
+  // A non-null |source_site_instance| is important for picking the right
+  // renderer process for hosting about:blank and/or data: URLs (their origin's
+  // precursor is based on |initiator_origin|).
+  if (url.IsAboutBlank() || url.SchemeIs(url::kDataScheme)) {
+    DCHECK_EQ(initiator_origin.has_value(),
+              static_cast<bool>(source_site_instance));
+  }
+
+  // Implementation notes:
+  //   The following LoadURLParams don't have an equivalent in OpenURLParams:
+  //     base_url_for_data_url
+  //     virtual_url_for_data_url
+  //     data_url_as_string
+  //
+  //     can_load_local_resources
+  //     frame_name
+  //     from_download_cross_origin_redirect
+  //     input_start
+  //     navigation_ui_data
+  //     override_user_agent
+  //     should_clear_history_list
+  //     was_activated
+  //
+  //   The following OpenURLParams don't have an equivalent in LoadURLParams:
+  //     disposition
+  //     open_app_window_if_possible
+  //     source_render_frame_id
+  //     source_render_process_id
+  //     triggering_event_info
+}
 
 NavigationController::LoadURLParams::~LoadURLParams() {
 }
diff --git a/chromium/content/public/browser/navigation_controller.h b/chromium/content/public/browser/navigation_controller.h
index c7c067a6d3a..7fa0063f52a 100644
--- a/chromium/content/public/browser/navigation_controller.h
+++ b/chromium/content/public/browser/navigation_controller.h
@@ -20,6 +20,7 @@
 #include "content/public/browser/global_request_id.h"
 #include "content/public/browser/navigation_ui_data.h"
 #include "content/public/browser/reload_type.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/restore_type.h"
 #include "content/public/browser/session_storage_namespace.h"
 #include "content/public/browser/site_instance.h"
@@ -39,10 +40,12 @@ class RefCountedString;
 
 namespace content {
 
+class BackForwardCache;
 class BrowserContext;
 class NavigationEntry;
 class RenderFrameHost;
 class WebContents;
+struct OpenURLParams;
 
 // A NavigationController maintains the back-forward list for a WebContents and
 // manages all navigation within that list.
@@ -102,8 +105,8 @@ class NavigationController {
   // Extra headers are separated by \n.
   CONTENT_EXPORT static std::unique_ptr<NavigationEntry> CreateNavigationEntry(
       const GURL& url,
-      const Referrer& referrer,
-      const base::Optional<url::Origin>& initiator_origin,
+      Referrer referrer,
+      base::Optional<url::Origin> initiator_origin,
       ui::PageTransition transition,
       bool is_renderer_initiated,
       const std::string& extra_headers,
@@ -131,15 +134,15 @@ class NavigationController {
     scoped_refptr<SiteInstance> source_site_instance;
 
     // See LoadURLType comments above.
-    LoadURLType load_type;
+    LoadURLType load_type = LOAD_TYPE_DEFAULT;
 
     // PageTransition for this load. See PageTransition for details.
     // Note the default value in constructor below.
-    ui::PageTransition transition_type;
+    ui::PageTransition transition_type = ui::PAGE_TRANSITION_LINK;
 
     // The browser-global FrameTreeNode ID for the frame to navigate, or
     // RenderFrameHost::kNoFrameTreeNodeId for the main frame.
-    int frame_tree_node_id;
+    int frame_tree_node_id = RenderFrameHost::kNoFrameTreeNodeId;
 
     // Referrer for this load. Empty if none.
     Referrer referrer;
@@ -157,7 +160,7 @@ class NavigationController {
 
     // User agent override for this load. See comments in
     // UserAgentOverrideOption definition.
-    UserAgentOverrideOption override_user_agent;
+    UserAgentOverrideOption override_user_agent = UA_OVERRIDE_INHERIT;
 
     // Used in LOAD_TYPE_DATA loads only. Used for specifying a base URL
     // for pages loaded via data URLs.
@@ -181,18 +184,18 @@ class NavigationController {
     scoped_refptr<network::ResourceRequestBody> post_data;
 
     // True if this URL should be able to access local resources.
-    bool can_load_local_resources;
+    bool can_load_local_resources = false;
 
     // Indicates whether this navigation should replace the current
     // navigation entry.
-    bool should_replace_current_entry;
+    bool should_replace_current_entry = false;
 
     // Used to specify which frame to navigate. If empty, the main frame is
     // navigated. This is currently only used in tests.
     std::string frame_name;
 
     // Indicates that the navigation was triggered by a user gesture.
-    bool has_user_gesture;
+    bool has_user_gesture = false;
 
     // Indicates that during this navigation, the session history should be
     // cleared such that the resulting page is the first and only entry of the
@@ -200,10 +203,10 @@ class NavigationController {
     //
     // The clearing is done asynchronously, and completes when this navigation
     // commits.
-    bool should_clear_history_list;
+    bool should_clear_history_list = false;
 
     // Indicates whether or not this navigation was initiated via context menu.
-    bool started_from_context_menu;
+    bool started_from_context_menu = false;
 
     // Optional URLLoaderFactory to facilitate navigation to a blob URL.
     scoped_refptr<network::SharedURLLoaderFactory> blob_url_loader_factory;
@@ -215,7 +218,7 @@ class NavigationController {
 
     // Whether this navigation was triggered by a x-origin redirect following a
     // prior (most likely <a download>) download attempt.
-    bool from_download_cross_origin_redirect;
+    bool from_download_cross_origin_redirect = false;
 
     // Time at which the input leading to this navigation occurred. This field
     // is set for links clicked by the user; the embedder is recommended to set
@@ -224,7 +227,8 @@ class NavigationController {
 
     // Set to |kYes| if the navigation should propagate user activation. This
     // is used by embedders where the activation has occurred outside the page.
-    mojom::WasActivatedOption was_activated;
+    mojom::WasActivatedOption was_activated =
+        mojom::WasActivatedOption::kUnknown;
 
     // If this navigation was initiated from a link that specified the
     // hrefTranslate attribute, this contains the attribute's value (a BCP47
@@ -235,6 +239,12 @@ class NavigationController {
     ReloadType reload_type = ReloadType::NONE;
 
     explicit LoadURLParams(const GURL& url);
+
+    // Copies |open_url_params| into LoadURLParams, attempting to copy all
+    // fields that are present in both structs (some properties are ignored
+    // because they are unique to LoadURLParams or OpenURLParams).
+    explicit LoadURLParams(const OpenURLParams& open_url_params);
+
     ~LoadURLParams();
 
     DISALLOW_COPY_AND_ASSIGN(LoadURLParams);
@@ -373,13 +383,17 @@ class NavigationController {
   // explicitly requested using SetNeedsReload().
   virtual void LoadIfNecessary() = 0;
 
-  // Navigates directly to an error page, with |error_page_html| as the
-  // contents, and |url| as the url. |error| is the code that will be used
-  // when triggering the error page.
-  virtual void LoadErrorPage(RenderFrameHost* render_frame_host,
-                             const GURL& url,
-                             const std::string& error_page_html,
-                             net::Error error) = 0;
+  // Navigates directly to an error page in response to an event on the last
+  // committed page (e.g., triggered by a subresource), with |error_page_html|
+  // as the contents and |url| as the URL.
+
+  // The error page will create a NavigationEntry that temporarily replaces the
+  // original page's entry. The original entry will be put back into the entry
+  // list after any other navigation.
+  virtual void LoadPostCommitErrorPage(RenderFrameHost* render_frame_host,
+                                       const GURL& url,
+                                       const std::string& error_page_html,
+                                       net::Error error) = 0;
 
   // Renavigation --------------------------------------------------------------
 
@@ -413,6 +427,10 @@ class NavigationController {
   // Otherwise this call discards any transient or pending entries.
   virtual bool RemoveEntryAtIndex(int index) = 0;
 
+  // Discards any transient or pending entries, then discards all entries after
+  // the current entry index.
+  virtual void PruneForwardEntries() = 0;
+
   // Random --------------------------------------------------------------------
 
   // Session storage depends on dom_storage that depends on blink::WebString.
@@ -513,6 +531,9 @@ class NavigationController {
   // page they interacted with.
   virtual bool IsEntryMarkedToBeSkipped(int index) = 0;
 
+  // Gets the BackForwardCache for this NavigationController.
+  virtual BackForwardCache& GetBackForwardCache() = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class NavigationControllerImpl;
diff --git a/chromium/content/public/browser/navigation_handle.cc b/chromium/content/public/browser/navigation_handle.cc
index a26285c11d1..b58f57d66f9 100644
--- a/chromium/content/public/browser/navigation_handle.cc
+++ b/chromium/content/public/browser/navigation_handle.cc
@@ -6,7 +6,7 @@
 
 #include <utility>
 
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
@@ -14,11 +14,10 @@
 namespace content {
 
 WebContents* NavigationHandle::GetWebContents() {
-  // The NavigationHandleImpl cannot access the WebContentsImpl as it would be
-  // a layering violation, hence the cast here.
-  return static_cast<WebContentsImpl*>(static_cast<NavigationHandleImpl*>(this)
-                                           ->navigation_request()
-                                           ->GetDelegate());
+  // The NavigationRequest cannot access the WebContentsImpl as it would be a
+  // layering violation, hence the cast here.
+  return static_cast<WebContentsImpl*>(
+      NavigationRequest::From(this)->GetDelegate());
 }
 
 }  // namespace content
diff --git a/chromium/content/public/browser/navigation_handle.h b/chromium/content/public/browser/navigation_handle.h
index c55df1c60c1..e2bbb0565a8 100644
--- a/chromium/content/public/browser/navigation_handle.h
+++ b/chromium/content/public/browser/navigation_handle.h
@@ -30,6 +30,7 @@ class ProxyServer;
 }  // namespace net
 
 namespace content {
+struct GlobalFrameRoutingId;
 struct GlobalRequestID;
 class NavigationThrottle;
 class NavigationUIData;
@@ -65,11 +66,16 @@ class CONTENT_EXPORT NavigationHandle {
   // e.g. URLs might be rewritten by the renderer before being committed.
   virtual const GURL& GetURL() = 0;
 
-  // Returns the SiteInstance that started the request.
-  // If a frame in SiteInstance A navigates a frame in SiteInstance B to a URL
-  // in SiteInstance C, then this returns B.
+  // Returns the SiteInstance where the frame being navigated was at the start
+  // of the navigation.  If a frame in SiteInstance A navigates a frame in
+  // SiteInstance B to a URL in SiteInstance C, then this returns B.
   virtual SiteInstance* GetStartingSiteInstance() = 0;
 
+  // Returns the SiteInstance of the initiator of the navigation.  If a frame in
+  // SiteInstance A navigates a frame in SiteInstance B to a URL in SiteInstance
+  // C, then this returns A.
+  virtual SiteInstance* GetSourceSiteInstance() = 0;
+
   // Whether the navigation is taking place in the main frame or in a subframe.
   // This remains constant over the navigation lifetime.
   virtual bool IsInMainFrame() = 0;
@@ -144,12 +150,6 @@ class CONTENT_EXPORT NavigationHandle {
   // |bool IsPost()| as opposed to |const std::string& GetMethod()| method.
   virtual bool IsPost() = 0;
 
-  // Returns the POST body associated with this navigation. This will be null
-  // for GET and/or other non-POST requests (or if a response to a POST request
-  // was a redirect that changed the method to GET - for example 302).
-  virtual const scoped_refptr<network::ResourceRequestBody>&
-  GetResourceRequestBody() = 0;
-
   // Returns a sanitized version of the referrer for this request.
   virtual const blink::mojom::Referrer& GetReferrer() = 0;
 
@@ -168,6 +168,9 @@ class CONTENT_EXPORT NavigationHandle {
   // handlers.
   virtual bool IsExternalProtocol() = 0;
 
+  // Whether the navigation is restoring a page from back-forward cache.
+  virtual bool IsServedFromBackForwardCache() = 0;
+
   // Navigation control flow --------------------------------------------------
 
   // The net error code if an error happened prior to commit. Otherwise it will
@@ -182,6 +185,14 @@ class CONTENT_EXPORT NavigationHandle {
   // with an error page.
   virtual RenderFrameHost* GetRenderFrameHost() = 0;
 
+  // Returns the id of the RenderFrameHost this navigation is committing from.
+  // In case a navigation happens within the same RenderFrameHost,
+  // GetRenderFrameHost() and GetPreviousRenderFrameHostId() will refer to the
+  // same RenderFrameHost.
+  // Note: This is not guaranteed to refer to a RenderFrameHost that still
+  // exists.
+  virtual GlobalFrameRoutingId GetPreviousRenderFrameHostId() = 0;
+
   // Whether the navigation happened without changing document. Examples of
   // same document navigations are:
   // * reference fragment navigations
diff --git a/chromium/content/public/browser/navigation_throttle.cc b/chromium/content/public/browser/navigation_throttle.cc
index 552b1af65a8..0b0ac3fec5a 100644
--- a/chromium/content/public/browser/navigation_throttle.cc
+++ b/chromium/content/public/browser/navigation_throttle.cc
@@ -4,7 +4,7 @@
 
 #include "content/public/browser/navigation_throttle.h"
 
-#include "content/browser/frame_host/navigation_handle_impl.h"
+#include "content/browser/frame_host/navigation_request.h"
 
 namespace content {
 
@@ -85,9 +85,7 @@ void NavigationThrottle::Resume() {
     resume_callback_.Run();
     return;
   }
-  static_cast<NavigationHandleImpl*>(navigation_handle_)
-      ->navigation_request()
-      ->Resume(this);
+  NavigationRequest::From(navigation_handle_)->Resume(this);
 }
 
 void NavigationThrottle::CancelDeferredNavigation(
@@ -96,8 +94,7 @@ void NavigationThrottle::CancelDeferredNavigation(
     cancel_deferred_navigation_callback_.Run(result);
     return;
   }
-  static_cast<NavigationHandleImpl*>(navigation_handle_)
-      ->navigation_request()
+  NavigationRequest::From(navigation_handle_)
       ->CancelDeferredNavigation(this, result);
 }
 
diff --git a/chromium/content/public/browser/network_service_instance.h b/chromium/content/public/browser/network_service_instance.h
index 43bf749d312..5fd44bf33f6 100644
--- a/chromium/content/public/browser/network_service_instance.h
+++ b/chromium/content/public/browser/network_service_instance.h
@@ -44,8 +44,8 @@ CONTENT_EXPORT network::mojom::NetworkService* GetNetworkService();
 CONTENT_EXPORT net::NetworkChangeNotifier* GetNetworkChangeNotifier();
 #endif
 
-// Call |FlushForTesting()| on cached |NetworkServicePtr|. For testing only.
-// Must only be called on the UI thread.
+// Call |FlushForTesting()| on cached |mojo::Remote<NetworkService>|. For
+// testing only. Must only be called on the UI thread.
 CONTENT_EXPORT void FlushNetworkServiceInstanceForTesting();
 
 // Returns a NetworkConnectionTracker that can be used to subscribe for
diff --git a/chromium/content/public/browser/page_navigator.cc b/chromium/content/public/browser/page_navigator.cc
index ad8ddc6a733..974ec7f13e3 100644
--- a/chromium/content/public/browser/page_navigator.cc
+++ b/chromium/content/public/browser/page_navigator.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "content/public/browser/page_navigator.h"
+#include "content/browser/frame_host/navigation_request.h"
 
 namespace content {
 
@@ -66,4 +67,34 @@ OpenURLParams::OpenURLParams(const OpenURLParams& other) = default;
 
 OpenURLParams::~OpenURLParams() = default;
 
+// static
+OpenURLParams OpenURLParams::FromNavigationHandle(NavigationHandle* handle) {
+  OpenURLParams params(
+      handle->GetURL(), Referrer(handle->GetReferrer()),
+      handle->GetFrameTreeNodeId(), WindowOpenDisposition::CURRENT_TAB,
+      handle->GetPageTransition(), handle->IsRendererInitiated());
+
+  params.initiator_origin = handle->GetInitiatorOrigin();
+  params.source_site_instance = handle->GetSourceSiteInstance();
+  params.redirect_chain = handle->GetRedirectChain();
+  params.user_gesture = handle->HasUserGesture();
+  params.started_from_context_menu = handle->WasStartedFromContextMenu();
+  params.href_translate = handle->GetHrefTranslate();
+  params.reload_type = handle->GetReloadType();
+
+  // A non-null |source_site_instance| is important for picking the right
+  // renderer process for hosting about:blank and/or data: URLs (their origin's
+  // precursor is based on |initiator_origin|).
+  if (params.url.IsAboutBlank() || params.url.SchemeIs(url::kDataScheme)) {
+    DCHECK_EQ(params.initiator_origin.has_value(),
+              static_cast<bool>(params.source_site_instance));
+  }
+
+  // TODO(lukasza): Consider also covering |post_data| (and |uses_post|) and
+  // |extra_headers| (this is difficult, because we can't cast |handle| to
+  // NavigationRequest*, because it may be MockNavigationHandle in unit tests).
+
+  return params;
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/page_navigator.h b/chromium/content/public/browser/page_navigator.h
index da36d45cdf2..0694536c22f 100644
--- a/chromium/content/public/browser/page_navigator.h
+++ b/chromium/content/public/browser/page_navigator.h
@@ -23,13 +23,14 @@
 #include "ipc/ipc_message.h"
 #include "services/network/public/cpp/resource_request_body.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
 #include "url/gurl.h"
 
 namespace content {
 
+class NavigationHandle;
 class WebContents;
 
 struct CONTENT_EXPORT OpenURLParams {
@@ -53,6 +54,11 @@ struct CONTENT_EXPORT OpenURLParams {
   OpenURLParams(const OpenURLParams& other);
   ~OpenURLParams();
 
+  // Creates OpenURLParams that 1) preserve all applicable |handle| properties
+  // (URL, referrer, initiator, etc.) with OpenURLParams equivalents and 2) fill
+  // in reasonable defaults for other properties (like WindowOpenDisposition).
+  static OpenURLParams FromNavigationHandle(NavigationHandle* handle);
+
   // The URL/referrer to be opened.
   GURL url;
   Referrer referrer;
@@ -107,8 +113,8 @@ struct CONTENT_EXPORT OpenURLParams {
 
   // Whether the call to OpenURL was triggered by an Event, and what the
   // isTrusted flag of the event was.
-  blink::WebTriggeringEventInfo triggering_event_info =
-      blink::WebTriggeringEventInfo::kUnknown;
+  blink::TriggeringEventInfo triggering_event_info =
+      blink::TriggeringEventInfo::kUnknown;
 
   // Indicates whether this navigation was started via context menu.
   bool started_from_context_menu;
diff --git a/chromium/content/public/browser/payment_app_provider.h b/chromium/content/public/browser/payment_app_provider.h
index 10de9611bdf..256a2680896 100644
--- a/chromium/content/public/browser/payment_app_provider.h
+++ b/chromium/content/public/browser/payment_app_provider.h
@@ -65,6 +65,7 @@ class CONTENT_EXPORT PaymentAppProvider {
       const std::string& sw_scope,
       bool sw_use_cache,
       const std::string& method,
+      const SupportedDelegations& supported_delegations,
       RegistrationIdCallback registration_id_callback,
       InvokePaymentAppCallback callback) = 0;
   virtual void CanMakePayment(
diff --git a/chromium/content/public/browser/peak_gpu_memory_tracker.h b/chromium/content/public/browser/peak_gpu_memory_tracker.h
new file mode 100644
index 00000000000..8d9e78e335f
--- /dev/null
+++ b/chromium/content/public/browser/peak_gpu_memory_tracker.h
@@ -0,0 +1,50 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_PEAK_GPU_MEMORY_TRACKER_H_
+#define CONTENT_PUBLIC_BROWSER_PEAK_GPU_MEMORY_TRACKER_H_
+
+#include <stdint.h>
+#include <memory>
+
+#include "base/callback.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+// Tracks the peak memory of the GPU service for its lifetime. Upon its
+// destruction a report will be requested from the GPU service. The peak will be
+// reported to the provided PeakMemoryCallback. This will occur on the thread
+// that this was created on.
+//
+// If the GPU is lost during this objects lifetime, upon destruction the
+// PeakMemoryCallback will be ran with "0" as the reported peak usage. The same
+// for if there is never a successful GPU connection.
+//
+// See PeakGpuMemoryTracker::Create.
+class CONTENT_EXPORT PeakGpuMemoryTracker {
+ public:
+  // The callback will be provided with the peak memory usage in Bytes. Or 0 if
+  // getting a report from the GPU service was not possible.
+  using PeakMemoryCallback = base::OnceCallback<void(uint64_t)>;
+
+  // Creates the PeakGpuMemoryTracker, which performs the registration with the
+  // GPU service. Destroy the PeakGpuMemoryTracker to request a report from the
+  // GPU service. The report will be delivered to |callback| on the thread which
+  // calls Create.
+  static std::unique_ptr<PeakGpuMemoryTracker> Create(
+      PeakMemoryCallback callback);
+
+  virtual ~PeakGpuMemoryTracker() = default;
+
+  PeakGpuMemoryTracker(const PeakGpuMemoryTracker*) = delete;
+  PeakGpuMemoryTracker& operator=(const PeakGpuMemoryTracker&) = delete;
+
+ protected:
+  PeakGpuMemoryTracker() = default;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_PEAK_GPU_MEMORY_TRACKER_H_
diff --git a/chromium/content/public/browser/render_frame_host.h b/chromium/content/public/browser/render_frame_host.h
index 6811d5c7133..f0ce24cbb44 100644
--- a/chromium/content/public/browser/render_frame_host.h
+++ b/chromium/content/public/browser/render_frame_host.h
@@ -15,18 +15,21 @@
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/page_visibility_state.h"
+#include "content/public/common/browser_controls_state.h"
 #include "content/public/common/isolated_world_ids.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/network/public/mojom/url_loader_factory.mojom-forward.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
 #include "third_party/blink/public/common/frame/sandbox_flags.h"
 #include "third_party/blink/public/common/scheduler/web_scheduler_tracked_feature.h"
+#include "third_party/blink/public/common/sudden_termination_disabler_type.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
+#include "third_party/blink/public/mojom/frame/frame.mojom.h"
 #include "third_party/blink/public/mojom/loader/pause_subresource_loading_handle.mojom-forward.h"
-#include "third_party/blink/public/platform/web_sudden_termination_disabler_type.h"
 #include "ui/accessibility/ax_tree_id.h"
 #include "ui/gfx/geometry/rect.h"
 #include "ui/gfx/native_widget_types.h"
@@ -76,12 +79,10 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Returns nullptr if the IDs do not correspond to a live RenderFrameHost.
   static RenderFrameHost* FromID(int render_process_id, int render_frame_id);
 
-#if defined(OS_ANDROID) || defined(OS_FUCHSIA) || defined(IS_CHROMECAST)
   // Globally allows for injecting JavaScript into the main world. This feature
-  // is present only to support Android WebView, Fuchsia web.Contexts, and
-  // CastOS content shell. It must not be used in other configurations.
+  // is present only to support Android WebView, WebLayer, Fuchsia web.Contexts,
+  // and CastOS content shell. It must not be used in other configurations.
   static void AllowInjectingJavaScript();
-#endif
 
   // Returns a RenderFrameHost given its accessibility tree ID.
   static RenderFrameHost* FromAXTreeID(ui::AXTreeID ax_tree_id);
@@ -124,6 +125,13 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // current RenderFrameHost.
   virtual RenderFrameHost* GetParent() = 0;
 
+  // Returns a vector of all RenderFrameHosts in the subtree rooted at |this|.
+  // The results may be in different processes.
+  // TODO(https://crbug.com/1013740): Consider exposing a way for the browser
+  // process to run a function across a subtree in all renderers rather than
+  // exposing the RenderFrameHosts of the frames here.
+  virtual std::vector<RenderFrameHost*> GetFramesInSubtree() = 0;
+
   // Returns whether or not this RenderFrameHost is a descendant of |ancestor|.
   // This is equivalent to check that |ancestor| is reached by iterating on
   // GetParent().
@@ -238,9 +246,10 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   virtual void CopyImageAt(int x, int y) = 0;
 
   // Requests to save the image at the location in viewport coordinates (not
-  // frame coordinates). If there is an image at the location, the renderer
-  // will post back the appropriate download message to trigger the save UI.
-  // If there is no image at that location, does nothing.
+  // frame coordinates). If there is a data-URL-based image at the location, the
+  // renderer will post back the appropriate download message to trigger the
+  // save UI.  Nothing gets done if there is no image at that location (or if
+  // the image has a non-data URL).
   virtual void SaveImageAt(int x, int y) = 0;
 
   // RenderViewHost for this frame.
@@ -286,14 +295,14 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   virtual bool HasSelection() = 0;
 
   // Text surrounding selection.
-  typedef base::OnceCallback<void(const base::string16& content,
-                                  uint32_t start_offset,
-                                  uint32_t end_offset)>
-      TextSurroundingSelectionCallback;
   virtual void RequestTextSurroundingSelection(
-      TextSurroundingSelectionCallback callback,
+      blink::mojom::Frame::GetTextSurroundingSelectionCallback callback,
       int max_length) = 0;
 
+  // Generates an intervention report in this frame.
+  virtual void SendInterventionReport(const std::string& id,
+                                      const std::string& message) = 0;
+
   // Tell the render frame to enable a set of javascript bindings. The argument
   // should be a combination of values from BindingsPolicy.
   virtual void AllowBindings(int binding_flags) = 0;
@@ -319,7 +328,7 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // Check whether the specific Blink feature is currently preventing fast
   // shutdown of the frame.
   virtual bool GetSuddenTerminationDisablerState(
-      blink::WebSuddenTerminationDisablerType disabler_type) = 0;
+      blink::SuddenTerminationDisablerType disabler_type) = 0;
 
   // Returns true if the given |threshold_value| is below the threshold value
   // specified in the policy for |feature| for this RenderFrameHost. See
@@ -352,15 +361,16 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // If this returns true, any redirect safety checks should be bypassed in
   // downstream loaders.
   virtual bool CreateNetworkServiceDefaultFactory(
-      network::mojom::URLLoaderFactoryRequest default_factory_request) = 0;
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory>
+          default_factory_receiver) = 0;
 
   // Requests that future URLLoaderFactoryBundle(s) sent to the renderer should
-  // use a separate URLLoaderFactory for requests initiated by any of the
-  // origins listed in |request_initiators|.  The URLLoaderFactory(s) for each
+  // use a separate URLLoaderFactory for requests initiated by isolated worlds
+  // listed in |isolated_world_origins|.  The URLLoaderFactory(s) for each
   // origin will be created via
   // ContentBrowserClient::CreateURLLoaderFactoryForNetworkRequests method.
-  virtual void MarkInitiatorsAsRequiringSeparateURLLoaderFactory(
-      base::flat_set<url::Origin> request_initiators,
+  virtual void MarkIsolatedWorldsAsRequiringSeparateURLLoaderFactory(
+      base::flat_set<url::Origin> isolated_world_origins,
       bool push_to_renderer_now) = 0;
 
   // Returns true if the given sandbox flag |flags| is in effect on this frame.
@@ -416,6 +426,17 @@ class CONTENT_EXPORT RenderFrameHost : public IPC::Listener,
   // FrameTreeNode associated with this RenderFrameHost.
   virtual bool HasTransientUserActivation() = 0;
 
+  // Notifies the renderer whether hiding/showing the browser controls is
+  // enabled, what the current state should be, and whether or not to animate to
+  // the proper state.
+  virtual void UpdateBrowserControlsState(BrowserControlsState constraints,
+                                          BrowserControlsState current,
+                                          bool animate) = 0;
+
+  // Reloads the frame if it is live. It initiates a reload but doesn't wait for
+  // it to finish.
+  virtual void Reload() = 0;
+
  private:
   // This interface should only be implemented inside content.
   friend class RenderFrameHostImpl;
diff --git a/chromium/content/public/browser/render_process_host.h b/chromium/content/public/browser/render_process_host.h
index 36c85a221e1..1e5650ac381 100644
--- a/chromium/content/public/browser/render_process_host.h
+++ b/chromium/content/public/browser/render_process_host.h
@@ -24,6 +24,7 @@
 #include "ipc/ipc_channel_proxy.h"
 #include "ipc/ipc_sender.h"
 #include "media/media_buildflags.h"
+#include "media/mojo/mojom/video_decode_perf_history.mojom-forward.h"
 #include "mojo/public/cpp/bindings/generic_pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
@@ -34,6 +35,9 @@
 #include "third_party/blink/public/mojom/cache_storage/cache_storage.mojom-forward.h"
 #include "third_party/blink/public/mojom/filesystem/file_system.mojom-forward.h"
 #include "third_party/blink/public/mojom/indexeddb/indexeddb.mojom-forward.h"
+#include "third_party/blink/public/mojom/locks/lock_manager.mojom-forward.h"
+#include "third_party/blink/public/mojom/payments/payment_app.mojom-forward.h"
+#include "third_party/blink/public/mojom/permissions/permission.mojom-forward.h"
 #include "ui/gfx/native_widget_types.h"
 
 #if defined(OS_ANDROID)
@@ -411,11 +415,11 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
   // Create an URLLoaderFactory that can be used by |origin| being hosted in
   // |this| process.
   //
-  // When NetworkService is enabled, |request| will be bound with a new
+  // When NetworkService is enabled, |receiver| will be bound with a new
   // URLLoaderFactory created from the storage partition's Network Context. Note
   // that the URLLoaderFactory returned by this method does NOT support
   // auto-reconnect after a crash of Network Service.
-  // When NetworkService is not enabled, |request| will be bound with a
+  // When NetworkService is not enabled, |receiver| will be bound with a
   // URLLoaderFactory which routes requests to ResourceDispatcherHost.
   //
   // |preferences| is an optional argument that might be used to control some
@@ -438,11 +442,10 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
       const net::NetworkIsolationKey& network_isolation_key,
       mojo::PendingRemote<network::mojom::TrustedURLLoaderHeaderClient>
           header_client,
-      network::mojom::URLLoaderFactoryRequest request) = 0;
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) = 0;
 
   // Whether this process is locked out from ever being reused for sites other
   // than the ones it currently has.
-  virtual void SetIsNeverSuitableForReuse() = 0;
   virtual bool MayReuseHost() = 0;
 
   // Indicates whether this RenderProcessHost is "unused".  This starts out as
@@ -489,11 +492,44 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
       const url::Origin& origin,
       mojo::PendingReceiver<blink::mojom::FileSystemManager> receiver) = 0;
 
-  // Binds |request| to the IndexedDBDispatcherHost instance. The binding is
+  // Binds |receiver| to the IndexedDBDispatcherHost instance. The receiver is
   // sent to the IO thread. This is for internal use only, and is only exposed
   // here to support MockRenderProcessHost usage in tests.
-  virtual void BindIndexedDB(blink::mojom::IDBFactoryRequest request,
-                             const url::Origin& origin) = 0;
+  //
+  // |render_frame_id| is the frame associated with |receiver|, or
+  // MSG_ROUTING_NONE if |receiver| is associated with a worker.
+  virtual void BindIndexedDB(
+      int render_frame_id,
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::IDBFactory> receiver) = 0;
+
+  // Binds |receiver| to the VideoDecodePerfHistory instance.  This is for
+  // internal use only, and is only exposed here to support
+  // MockRenderProcessHost usage in tests.
+  virtual void BindVideoDecodePerfHistory(
+      mojo::PendingReceiver<media::mojom::VideoDecodePerfHistory> receiver) = 0;
+
+  // Binds |receiver| to an instance of LockManager. This is for internal use
+  // only, and is only exposed here to support MockRenderProcessHost usage in
+  // tests.
+  virtual void CreateLockManager(
+      int render_frame_id,
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::LockManager> receiver) = 0;
+
+  // Binds |receiver| to an instance of PermissionService. This is for internal
+  // use only, and is only exposed here to support MockRenderProcessHost usage
+  // in tests.
+  virtual void CreatePermissionService(
+      const url::Origin& origin,
+      mojo::PendingReceiver<blink::mojom::PermissionService> receiver) = 0;
+
+  // Binds |receiver| to an instance of PaymentManager. This is for internal
+  // use only, and is only exposed here to support MockRenderProcessHost usage
+  // in tests.
+  virtual void CreatePaymentManagerForOrigin(
+      const url::Origin& origin,
+      mojo::PendingReceiver<payments::mojom::PaymentManager> receiver) = 0;
 
   // Returns the current number of active views in this process.  Excludes
   // any RenderViewHosts that are swapped out.
@@ -595,6 +631,16 @@ class CONTENT_EXPORT RenderProcessHost : public IPC::Sender,
 
   // Counts current RenderProcessHost(s), ignoring the spare process.
   static int GetCurrentRenderProcessCountForTesting();
+
+  // Allows tests to override host interface binding behavior. Any interface
+  // binding request which would normally pass through the RPH's internal
+  // IOThreadHostImpl::BindHostReceiver() will pass through |callback| first if
+  // non-null. |callback| is only called from the IO thread.
+  using BindHostReceiverInterceptor =
+      base::RepeatingCallback<void(int render_process_id,
+                                   mojo::GenericPendingReceiver* receiver)>;
+  static void InterceptBindHostReceiverForTesting(
+      BindHostReceiverInterceptor callback);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/render_process_host_creation_observer.h b/chromium/content/public/browser/render_process_host_creation_observer.h
new file mode 100644
index 00000000000..c684670060e
--- /dev/null
+++ b/chromium/content/public/browser/render_process_host_creation_observer.h
@@ -0,0 +1,34 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_CREATION_OBSERVER_H_
+#define CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_CREATION_OBSERVER_H_
+
+#include "base/macros.h"
+#include "content/common/content_export.h"
+
+namespace content {
+
+class RenderProcessHost;
+
+// An observer that gets notified any time a new RenderProcessHost is created.
+// This can only be used on the UI thread.
+class CONTENT_EXPORT RenderProcessHostCreationObserver {
+ public:
+  virtual ~RenderProcessHostCreationObserver();
+
+  // This method is invoked when the process was successfully launched. Note
+  // that the channel may or may not have been connected when this is invoked.
+  virtual void OnRenderProcessHostCreated(RenderProcessHost* process_host) = 0;
+
+ protected:
+  RenderProcessHostCreationObserver();
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(RenderProcessHostCreationObserver);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_RENDER_PROCESS_HOST_CREATION_OBSERVER_H_
diff --git a/chromium/content/public/browser/render_process_host_observer.h b/chromium/content/public/browser/render_process_host_observer.h
index 60e3668f4ed..17e9ef25ae0 100644
--- a/chromium/content/public/browser/render_process_host_observer.h
+++ b/chromium/content/public/browser/render_process_host_observer.h
@@ -15,7 +15,9 @@ class RenderProcessHost;
 struct ChildProcessTerminationInfo;
 
 // An observer API implemented by classes which are interested
-// in RenderProcessHost lifecycle events.
+// in RenderProcessHost lifecycle events. Note that this does not allow
+// observing the creation of a RenderProcessHost. There is a separate observer
+// for that: RenderProcessHostCreationObserver.
 class CONTENT_EXPORT RenderProcessHostObserver {
  public:
   // This method is invoked when the process was launched and the channel was
diff --git a/chromium/content/public/browser/render_view_host.h b/chromium/content/public/browser/render_view_host.h
index 832d14711c5..a0c210b5df5 100644
--- a/chromium/content/public/browser/render_view_host.h
+++ b/chromium/content/public/browser/render_view_host.h
@@ -15,7 +15,7 @@
 #include "third_party/blink/public/platform/web_drag_operation.h"
 
 namespace blink {
-struct WebPluginAction;
+struct PluginAction;
 }
 
 namespace gfx {
@@ -85,7 +85,8 @@ class CONTENT_EXPORT RenderViewHost : public IPC::Sender {
   // Tells the renderer to perform the given action on the plugin located at
   // the given point.
   virtual void ExecutePluginActionAtLocation(
-      const gfx::Point& location, const blink::WebPluginAction& action) = 0;
+      const gfx::Point& location,
+      const blink::PluginAction& action) = 0;
 
   virtual RenderViewHostDelegate* GetDelegate() = 0;
 
@@ -103,10 +104,6 @@ class CONTENT_EXPORT RenderViewHost : public IPC::Sender {
   virtual void SetWebUIProperty(const std::string& name,
                                 const std::string& value) = 0;
 
-  // Sends the renderer process the current preferences supplied by the
-  // RenderViewHostDelegate.
-  virtual void SyncRendererPrefs() = 0;
-
   // TODO(mustaq): Replace "Webkit" from the following three method names.
   //
   // Returns the current WebKit preferences. Note: WebPreferences is cached, so
diff --git a/chromium/content/public/browser/render_widget_host.h b/chromium/content/public/browser/render_widget_host.h
index 9799de8d934..69df05953e7 100644
--- a/chromium/content/public/browser/render_widget_host.h
+++ b/chromium/content/public/browser/render_widget_host.h
@@ -11,6 +11,7 @@
 #include <vector>
 
 #include "base/callback.h"
+#include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/native_web_keyboard_event.h"
 #include "content/public/common/drop_data.h"
@@ -240,12 +241,25 @@ class CONTENT_EXPORT RenderWidgetHost : public IPC::Sender {
     virtual void OnInputEventAck(InputEventAckSource source,
                                  InputEventAckState state,
                                  const blink::WebInputEvent&) {}
+    // Key events are not triggered through InputEvent on Android.
+    // This function is triggered by IME commitText.
+#if defined(OS_ANDROID)
+    virtual void OnImeTextCommittedEvent(const base::string16& text_str) {}
+#endif
   };
 
   // Add/remove an input event observer.
   virtual void AddInputEventObserver(InputEventObserver* observer) = 0;
   virtual void RemoveInputEventObserver(InputEventObserver* observer) = 0;
 
+#if defined(OS_ANDROID)
+  // Add/remove an Ime text committed event observer.
+  virtual void AddImeTextCommittedEventObserver(
+      RenderWidgetHost::InputEventObserver* observer) = 0;
+  virtual void RemoveImeTextCommittedEventObserver(
+      InputEventObserver* observer) = 0;
+#endif
+
   // Add and remove observers for widget host events. The order in which
   // notifications are sent to observers is undefined. Observers must be sure to
   // remove the observer before they go away.
diff --git a/chromium/content/public/browser/resource_coordinator_service.h b/chromium/content/public/browser/resource_coordinator_service.h
new file mode 100644
index 00000000000..9a59cf7db30
--- /dev/null
+++ b/chromium/content/public/browser/resource_coordinator_service.h
@@ -0,0 +1,25 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_RESOURCE_COORDINATOR_SERVICE_H_
+#define CONTENT_PUBLIC_BROWSER_RESOURCE_COORDINATOR_SERVICE_H_
+
+#include "content/common/content_export.h"
+#include "services/resource_coordinator/public/mojom/memory_instrumentation/memory_instrumentation.mojom.h"
+#include "services/resource_coordinator/public/mojom/resource_coordinator_service.mojom.h"
+
+namespace content {
+
+// Gets the browser's connection to the in-process Resource Coordinator service.
+CONTENT_EXPORT resource_coordinator::mojom::ResourceCoordinatorService*
+GetResourceCoordinatorService();
+
+// Gets the browser's connection to the Resource Coordinator's
+// memory instrumentation CoordinatorController.
+CONTENT_EXPORT memory_instrumentation::mojom::CoordinatorController*
+GetMemoryInstrumentationCoordinatorController();
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_RESOURCE_COORDINATOR_SERVICE_H_
diff --git a/chromium/content/public/browser/security_style_explanations.h b/chromium/content/public/browser/security_style_explanations.h
index 5dd0047737c..a0df34f21fd 100644
--- a/chromium/content/public/browser/security_style_explanations.h
+++ b/chromium/content/public/browser/security_style_explanations.h
@@ -10,7 +10,7 @@
 
 #include "content/common/content_export.h"
 #include "content/public/browser/security_style_explanation.h"
-#include "third_party/blink/public/platform/web_security_style.h"
+#include "third_party/blink/public/common/security/security_style.h"
 
 namespace content {
 
diff --git a/chromium/content/public/browser/service_worker_context.h b/chromium/content/public/browser/service_worker_context.h
index ce257c05bd3..5674e076cdd 100644
--- a/chromium/content/public/browser/service_worker_context.h
+++ b/chromium/content/public/browser/service_worker_context.h
@@ -12,6 +12,7 @@
 #include "base/callback_forward.h"
 #include "content/common/content_export.h"
 #include "content/public/browser/browser_thread.h"
+#include "content/public/browser/service_worker_external_request_result.h"
 #include "content/public/browser/service_worker_running_info.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom-forward.h"
 #include "url/gurl.h"
@@ -74,12 +75,6 @@ class CONTENT_EXPORT ServiceWorkerContext {
 
   using StartWorkerCallback = base::OnceCallback<
       void(int64_t version_id, int process_id, int thread_id)>;
-  using GetAllServiceWorkerRunningInfosCallback =
-      base::OnceCallback<void(ServiceWorkerContext*,
-                              const std::vector<ServiceWorkerRunningInfo>)>;
-  using GetServiceWorkerRunningInfoCallback =
-      base::OnceCallback<void(ServiceWorkerContext*,
-                              const ServiceWorkerRunningInfo&)>;
 
   // Temporary for crbug.com/824858. The thread the context core lives on.
   static bool IsServiceWorkerOnUIEnabled();
@@ -131,18 +126,21 @@ class CONTENT_EXPORT ServiceWorkerContext {
 
   // Mechanism for embedder to increment/decrement ref count of a service
   // worker.
+  //
   // Embedders can call StartingExternalRequest() while it is performing some
   // work with the worker. The worker is considered to be working until embedder
   // calls FinishedExternalRequest(). This ensures that content/ does not
   // shut the worker down while embedder is expecting the worker to be kept
   // alive.
   //
-  // Must be called from the core thread. Returns whether or not changing the
-  // ref count succeeded.
-  virtual bool StartingExternalRequest(int64_t service_worker_version_id,
-                                       const std::string& request_uuid) = 0;
-  virtual bool FinishedExternalRequest(int64_t service_worker_version_id,
-                                       const std::string& request_uuid) = 0;
+  // Must be called from the core thread.
+  virtual ServiceWorkerExternalRequestResult StartingExternalRequest(
+      int64_t service_worker_version_id,
+      const std::string& request_uuid) = 0;
+  virtual ServiceWorkerExternalRequestResult FinishedExternalRequest(
+      int64_t service_worker_version_id,
+      const std::string& request_uuid) = 0;
+
   // Returns the pending external request count for the worker with the
   // specified |origin| via |callback|. Must be called from the UI thread. The
   // callback is called on the UI thread.
@@ -204,23 +202,6 @@ class CONTENT_EXPORT ServiceWorkerContext {
       blink::TransferableMessage message,
       ResultCallback result_callback) = 0;
 
-  // Deprecated: DO NOT USE
-  // This is a temporary addition only to be used for the Android Messages
-  // integration with ChromeOS (http://crbug.com/823256).  The removal is
-  // tracked at http://crbug.com/869714.  Please ask Service Worker OWNERS
-  // (content/browser/service_worker/OWNERS) if you have questions.
-  //
-  // Starts the active worker of the registration for the given |scope|, sets
-  // its timeout to 999 days, and passes in the given |message|.  The
-  // |result_callback| will be executed upon success or failure and pass back
-  // the boolean result.
-  //
-  // May be called on any thread, and the callback is called on that thread.
-  virtual void StartServiceWorkerAndDispatchLongRunningMessage(
-      const GURL& scope,
-      blink::TransferableMessage message,
-      ResultCallback result_callback) = 0;
-
   // Starts the service worker for |document_url|. Called when a navigation to
   // that URL is predicted to occur soon. Must be called from the UI thread. The
   // |callback| will always be called on the UI thread.
@@ -242,16 +223,9 @@ class CONTENT_EXPORT ServiceWorkerContext {
   // Gets info about all running workers.
   //
   // Must be called on the UI thread. The callback is called on the UI thread.
-  virtual void GetAllServiceWorkerRunningInfos(
-      GetAllServiceWorkerRunningInfosCallback callback) = 0;
-
-  // Gets info of the running worker whose version id is
-  // |service_worker_version_id|.
-  //
-  // Must be called on the UI thread. The callback is called on the UI thread.
-  virtual void GetServiceWorkerRunningInfo(
-      int64_t service_worker_version_id,
-      GetServiceWorkerRunningInfoCallback callback) = 0;
+  virtual const base::flat_map<int64_t /* version_id */,
+                               ServiceWorkerRunningInfo>&
+  GetRunningServiceWorkerInfos() = 0;
 
  protected:
   ServiceWorkerContext() {}
diff --git a/chromium/content/public/browser/service_worker_context_observer.h b/chromium/content/public/browser/service_worker_context_observer.h
index ea0f8d35376..91345986f8a 100644
--- a/chromium/content/public/browser/service_worker_context_observer.h
+++ b/chromium/content/public/browser/service_worker_context_observer.h
@@ -8,8 +8,9 @@
 #include "url/gurl.h"
 
 namespace content {
-struct ConsoleMessage;
 class ServiceWorkerContext;
+struct ConsoleMessage;
+struct ServiceWorkerRunningInfo;
 
 class ServiceWorkerContextObserver {
  public:
@@ -38,15 +39,20 @@ class ServiceWorkerContextObserver {
   // Called when the service worker with id |version_id| starts or stops
   // running.
   //
-  // This function is currently only called after a worker finishes
+  // These functions are currently only called after a worker finishes
   // starting/stopping or the version is destroyed before finishing
   // stopping. That is, a worker in the process of starting is not yet
-  // considered running, even if it's executing JavaScript. See TODO in
-  // ServiceWorkerContextWrapper::OnRunningStateChanged.
-  virtual void OnVersionRunningStatusChanged(
-      content::ServiceWorkerContext* context,
+  // considered running, even if it's executing JavaScript.
+  //
+  // TODO(minggang): Create a new observer to listen to the events when the
+  // process of the service worker is allocated/released, instead of using the
+  // running status of the embedded worker.
+  virtual void OnVersionStartedRunning(
+      ServiceWorkerContext* context,
       int64_t version_id,
-      bool is_running) {}
+      const ServiceWorkerRunningInfo& running_info) {}
+  virtual void OnVersionStoppedRunning(ServiceWorkerContext* context,
+                                       int64_t version_id) {}
 
   // Called when there are no more controllees for the service worker with id
   // |version_id|.
@@ -58,7 +64,7 @@ class ServiceWorkerContextObserver {
                                       const ConsoleMessage& message) {}
 
   // Called when |context| is destroyed. Observers must no longer use |context|.
-  virtual void OnDestruct(content::ServiceWorkerContext* context) {}
+  virtual void OnDestruct(ServiceWorkerContext* context) {}
 
  protected:
   virtual ~ServiceWorkerContextObserver() {}
diff --git a/chromium/content/public/browser/service_worker_external_request_result.h b/chromium/content/public/browser/service_worker_external_request_result.h
new file mode 100644
index 00000000000..fe5af7017cb
--- /dev/null
+++ b/chromium/content/public/browser/service_worker_external_request_result.h
@@ -0,0 +1,34 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_EXTERNAL_REQUEST_RESULT_H_
+#define CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_EXTERNAL_REQUEST_RESULT_H_
+
+namespace content {
+
+// The result of adjusting the ref count of a service worker by an embedder,
+// which keeps the service worker running.
+enum class ServiceWorkerExternalRequestResult {
+  // The ref count was adjusted successfully.
+  kOk,
+
+  // Error cases (the ref count did not change):
+  // There is already an outstanding request with the given id (if
+  // incrementing), or there was not an outstanding request with that id (if
+  // decrementing).
+  kBadRequestId,
+  // The worker is already stopping or stopped (if incrementing), or
+  // is already stopped (if decrementing).
+  kWorkerNotRunning,
+  // The worker with the given version id doesn't exist or is not live.
+  kWorkerNotFound,
+  // The core context inside ServiceWorkerContext has been destroyed.
+  // This can happen during init or shutdown or a fatal storage error
+  // occurred and the context is being reinitialized.
+  kNullContext,
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_SERVICE_WORKER_EXTERNAL_REQUEST_RESULT_H_
diff --git a/chromium/content/public/browser/service_worker_running_info.cc b/chromium/content/public/browser/service_worker_running_info.cc
new file mode 100644
index 00000000000..34932638b0a
--- /dev/null
+++ b/chromium/content/public/browser/service_worker_running_info.cc
@@ -0,0 +1,23 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/service_worker_running_info.h"
+
+namespace content {
+
+ServiceWorkerRunningInfo::ServiceWorkerRunningInfo(const GURL& script_url,
+                                                   const GURL& scope,
+                                                   int64_t render_process_id)
+    : script_url(script_url),
+      scope(scope),
+      render_process_id(render_process_id) {}
+
+ServiceWorkerRunningInfo::ServiceWorkerRunningInfo(
+    ServiceWorkerRunningInfo&& other) noexcept = default;
+ServiceWorkerRunningInfo& ServiceWorkerRunningInfo::operator=(
+    ServiceWorkerRunningInfo&& other) noexcept = default;
+
+ServiceWorkerRunningInfo::~ServiceWorkerRunningInfo() = default;
+
+}  // namespace content
diff --git a/chromium/content/public/browser/service_worker_running_info.h b/chromium/content/public/browser/service_worker_running_info.h
index 83e2b100949..b012501278d 100644
--- a/chromium/content/public/browser/service_worker_running_info.h
+++ b/chromium/content/public/browser/service_worker_running_info.h
@@ -15,20 +15,21 @@ namespace content {
 // A struct containing information about a running service worker.
 struct CONTENT_EXPORT ServiceWorkerRunningInfo {
   ServiceWorkerRunningInfo(const GURL& script_url,
-                           int64_t id,
-                           int64_t process_id)
-      : script_url(script_url), version_id(id), process_id(process_id) {}
-
-  ServiceWorkerRunningInfo() = default;
+                           const GURL& scope,
+                           int64_t render_process_id);
+  ServiceWorkerRunningInfo(ServiceWorkerRunningInfo&& other) noexcept;
+  ServiceWorkerRunningInfo& operator=(
+      ServiceWorkerRunningInfo&& other) noexcept;
+  ~ServiceWorkerRunningInfo();
 
   // The service worker script URL.
-  const GURL script_url;
+  GURL script_url;
 
-  // The unique identifier for this service worker within the same
-  // ServiceWorkerContext.
-  const int64_t version_id = blink::mojom::kInvalidServiceWorkerVersionId;
+  // The scope that this service worker handles.
+  GURL scope;
 
-  const int process_id = content::ChildProcessHost::kInvalidUniqueID;
+  // The ID of the render process on which this service worker lives.
+  int render_process_id = content::ChildProcessHost::kInvalidUniqueID;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/shared_worker_instance.cc b/chromium/content/public/browser/shared_worker_instance.cc
index 2d20614fe34..2837b51fcc8 100644
--- a/chromium/content/public/browser/shared_worker_instance.cc
+++ b/chromium/content/public/browser/shared_worker_instance.cc
@@ -7,6 +7,8 @@
 #include <tuple>
 
 #include "base/logging.h"
+#include "content/public/browser/content_browser_client.h"
+#include "content/public/common/content_client.h"
 
 namespace content {
 
@@ -24,7 +26,13 @@ SharedWorkerInstance::SharedWorkerInstance(
       content_security_policy_(content_security_policy),
       content_security_policy_type_(security_policy_type),
       creation_address_space_(creation_address_space),
-      creation_context_type_(creation_context_type) {}
+      creation_context_type_(creation_context_type) {
+  // Ensure the same-origin policy is enforced correctly.
+  DCHECK(url.SchemeIs(url::kDataScheme) ||
+         GetContentClient()->browser()->DoesSchemeAllowCrossOriginSharedWorker(
+             constructor_origin.scheme()) ||
+         url::Origin::Create(url).IsSameOriginWith(constructor_origin));
+}
 
 SharedWorkerInstance::SharedWorkerInstance(const SharedWorkerInstance& other) =
     default;
@@ -44,11 +52,6 @@ bool SharedWorkerInstance::Matches(
     const GURL& url,
     const std::string& name,
     const url::Origin& constructor_origin) const {
-  // |url| and |constructor_origin| should be in the same origin, or |url|
-  // should be a data: URL.
-  DCHECK(url::Origin::Create(url).IsSameOriginWith(constructor_origin) ||
-         url.SchemeIs(url::kDataScheme));
-
   // Step 11.2: "If there exists a SharedWorkerGlobalScope object whose closing
   // flag is false, constructor origin is same origin with outside settings's
   // origin, constructor url equals urlRecord, and name equals the value of
diff --git a/chromium/content/public/browser/shared_worker_service.h b/chromium/content/public/browser/shared_worker_service.h
index 62bc467ffc1..b7e064312f3 100644
--- a/chromium/content/public/browser/shared_worker_service.h
+++ b/chromium/content/public/browser/shared_worker_service.h
@@ -12,9 +12,13 @@
 
 class GURL;
 
+namespace base {
+class UnguessableToken;
+}
+
 namespace url {
 class Origin;
-}  // namespace url
+}
 
 namespace content {
 
@@ -52,7 +56,7 @@ class CONTENT_EXPORT SharedWorkerService {
 
   // Adds/removes an observer.
   virtual void AddObserver(Observer* observer) = 0;
-  virtual void RemoveObserver(const Observer* observer) = 0;
+  virtual void RemoveObserver(Observer* observer) = 0;
 
   // Terminates the given shared worker identified by its name, the URL of
   // its main script resource, and the constructor origin. Returns true on
diff --git a/chromium/content/public/browser/site_isolation_policy.cc b/chromium/content/public/browser/site_isolation_policy.cc
index f88598cc81a..3723f330b46 100644
--- a/chromium/content/public/browser/site_isolation_policy.cc
+++ b/chromium/content/public/browser/site_isolation_policy.cc
@@ -45,6 +45,8 @@ bool IsSiteIsolationDisabled() {
   }
 #endif
 
+  // Check with the embedder.  In particular, chrome/ uses this to disable site
+  // isolation when below a memory threshold.
   return GetContentClient() &&
          GetContentClient()->browser()->ShouldDisableSiteIsolation();
 }
@@ -90,6 +92,16 @@ bool SiteIsolationPolicy::AreIsolatedOriginsEnabled() {
 
 // static
 bool SiteIsolationPolicy::IsStrictOriginIsolationEnabled() {
+  // If the feature is explicitly enabled by the user (e.g., from
+  // chrome://flags), honor this regardless of checks to disable site isolation
+  // below.  This means this takes precedence over memory thresholds or
+  // switches to disable site isolation.
+  if (base::FeatureList::GetInstance()->IsFeatureOverriddenFromCommandLine(
+          features::kStrictOriginIsolation.name,
+          base::FeatureList::OVERRIDE_ENABLE_FEATURE)) {
+    return true;
+  }
+
   // TODO(wjmaclean): Figure out what should happen when this feature is
   // combined with --isolate-origins.
   if (IsSiteIsolationDisabled())
diff --git a/chromium/content/public/browser/storage_notification_service.h b/chromium/content/public/browser/storage_notification_service.h
new file mode 100644
index 00000000000..2be44456d36
--- /dev/null
+++ b/chromium/content/public/browser/storage_notification_service.h
@@ -0,0 +1,34 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_STORAGE_NOTIFICATION_SERVICE_H_
+#define CONTENT_PUBLIC_BROWSER_STORAGE_NOTIFICATION_SERVICE_H_
+
+#include "base/bind.h"
+
+namespace content {
+
+// This interface is used to create a connection between the storage layer and
+// the embedder layer, where calls to UI code can be made. Embedders should
+// implement this interface as well as a GetStorageNotificationService()
+// function in it's implementation of BrowserContext.
+class StorageNotificationService {
+ public:
+  StorageNotificationService() = default;
+  ~StorageNotificationService() = default;
+
+  // This pure virtual function should be implemented in the embedder layer
+  // where calls to UI and notification code can be implemented. This closure
+  // is passed to QuotaManager in StoragePartitionImpl, where it is called
+  // when QuotaManager determines appropriate to alert the user that the device
+  // is in a state of storage pressure.
+  virtual base::RepeatingClosure GetStoragePressureNotificationClosure() = 0;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(StorageNotificationService);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_STORAGE_NOTIFICATION_SERVICE_H_
diff --git a/chromium/content/public/browser/storage_partition.h b/chromium/content/public/browser/storage_partition.h
index 2a7a7669610..066bc65f22e 100644
--- a/chromium/content/public/browser/storage_partition.h
+++ b/chromium/content/public/browser/storage_partition.h
@@ -110,6 +110,8 @@ class CONTENT_EXPORT StoragePartition {
   virtual void CreateRestrictedCookieManager(
       network::mojom::RestrictedCookieManagerRole role,
       const url::Origin& origin,
+      const GURL& site_for_cookies,
+      const url::Origin& top_frame_origin,
       bool is_service_worker,
       int process_id,
       int routing_id,
diff --git a/chromium/content/public/browser/stored_payment_app.h b/chromium/content/public/browser/stored_payment_app.h
index 55ccba8765d..0c9d06e4d29 100644
--- a/chromium/content/public/browser/stored_payment_app.h
+++ b/chromium/content/public/browser/stored_payment_app.h
@@ -10,6 +10,7 @@
 #include <vector>
 
 #include "content/common/content_export.h"
+#include "content/public/browser/supported_delegations.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "url/gurl.h"
 
@@ -76,6 +77,9 @@ struct CONTENT_EXPORT StoredPaymentApp {
 
   // User hint for this payment app.
   std::string user_hint;
+
+  // List of supported delegations for this payment app.
+  SupportedDelegations supported_delegations;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/supported_delegations.cc b/chromium/content/public/browser/supported_delegations.cc
new file mode 100644
index 00000000000..d90663457a6
--- /dev/null
+++ b/chromium/content/public/browser/supported_delegations.cc
@@ -0,0 +1,13 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/browser/supported_delegations.h"
+
+namespace content {
+
+SupportedDelegations::SupportedDelegations() = default;
+
+SupportedDelegations::~SupportedDelegations() = default;
+
+}  // namespace content
\ No newline at end of file
diff --git a/chromium/content/public/browser/supported_delegations.h b/chromium/content/public/browser/supported_delegations.h
new file mode 100644
index 00000000000..817e5155fad
--- /dev/null
+++ b/chromium/content/public/browser/supported_delegations.h
@@ -0,0 +1,25 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_BROWSER_SUPPORTED_DELEGATIONS_H_
+#define CONTENT_PUBLIC_BROWSER_SUPPORTED_DELEGATIONS_H_
+
+#include "content/common/content_export.h"
+
+namespace content {
+
+// This class represents the supported delegations of the StoredPaymentApp.
+struct CONTENT_EXPORT SupportedDelegations {
+  SupportedDelegations();
+  ~SupportedDelegations();
+
+  bool shipping_address = false;
+  bool payer_name = false;
+  bool payer_phone = false;
+  bool payer_email = false;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_BROWSER_SUPPORTED_DELEGATIONS_H_
diff --git a/chromium/content/public/browser/tracing_controller.h b/chromium/content/public/browser/tracing_controller.h
index 8c3459a78ce..3927389d123 100644
--- a/chromium/content/public/browser/tracing_controller.h
+++ b/chromium/content/public/browser/tracing_controller.h
@@ -7,6 +7,7 @@
 
 #include <stddef.h>
 
+#include <memory>
 #include <set>
 #include <string>
 
@@ -28,7 +29,6 @@ class TracingController;
 // the UI thread.
 class TracingController {
  public:
-
   CONTENT_EXPORT static TracingController* GetInstance();
 
   // An interface for trace data consumer. An implementation of this interface
@@ -41,8 +41,7 @@ class TracingController {
       : public base::RefCountedThreadSafe<TraceDataEndpoint> {
    public:
     virtual void ReceiveTraceChunk(std::unique_ptr<std::string> chunk) = 0;
-    virtual void ReceiveTraceFinalContents(
-        std::unique_ptr<const base::DictionaryValue> metadata) = 0;
+    virtual void ReceivedTraceFinalContents() = 0;
 
    protected:
     friend class base::RefCountedThreadSafe<TraceDataEndpoint>;
@@ -51,15 +50,16 @@ class TracingController {
 
   // Create a trace endpoint that may be supplied to StopTracing
   // to capture the trace data as a string.
+  using CompletionCallback =
+      base::OnceCallback<void(std::unique_ptr<std::string>)>;
   CONTENT_EXPORT static scoped_refptr<TraceDataEndpoint> CreateStringEndpoint(
-      const base::Callback<void(std::unique_ptr<const base::DictionaryValue>,
-                                base::RefCountedString*)>& callback);
+      CompletionCallback callback);
 
   // Create a trace endpoint that may be supplied to StopTracing
   // to dump the trace data to a file.
   CONTENT_EXPORT static scoped_refptr<TraceDataEndpoint> CreateFileEndpoint(
       const base::FilePath& file_path,
-      const base::Closure& callback,
+      base::OnceClosure callback,
       base::TaskPriority write_priority = base::TaskPriority::BEST_EFFORT);
 
   // Get a set of category groups. The category groups can change as
@@ -114,7 +114,8 @@ class TracingController {
       const scoped_refptr<TraceDataEndpoint>& trace_data_endpoint) = 0;
   virtual bool StopTracing(
       const scoped_refptr<TraceDataEndpoint>& trace_data_endpoint,
-      const std::string& agent_label) = 0;
+      const std::string& agent_label,
+      bool privacy_filtering_enabled = false) = 0;
 
   // Get the maximum across processes of trace buffer percent full state.
   // When the TraceBufferUsage value is determined, the callback is
diff --git a/chromium/content/public/browser/tts_controller.h b/chromium/content/public/browser/tts_controller.h
index b52834495b0..ced4805ea76 100644
--- a/chromium/content/public/browser/tts_controller.h
+++ b/chromium/content/public/browser/tts_controller.h
@@ -91,7 +91,7 @@ class CONTENT_EXPORT TtsController {
   // and another utterance is in progress, adds it to the end of the queue.
   // Otherwise, interrupts any current utterance and speaks this one
   // immediately.
-  virtual void SpeakOrEnqueue(TtsUtterance* utterance) = 0;
+  virtual void SpeakOrEnqueue(std::unique_ptr<TtsUtterance> utterance) = 0;
 
   // Stop all utterances and flush the queue. Implies leaving pause mode
   // as well.
diff --git a/chromium/content/public/browser/tts_utterance.h b/chromium/content/public/browser/tts_utterance.h
index 68ef1b9430a..ec03129b584 100644
--- a/chromium/content/public/browser/tts_utterance.h
+++ b/chromium/content/public/browser/tts_utterance.h
@@ -5,6 +5,7 @@
 #ifndef CONTENT_PUBLIC_BROWSER_TTS_UTTERANCE_H_
 #define CONTENT_PUBLIC_BROWSER_TTS_UTTERANCE_H_
 
+#include <memory>
 #include <set>
 
 #include "content/common/content_export.h"
@@ -61,7 +62,7 @@ class CONTENT_EXPORT TtsUtterance {
   // Construct an utterance given a profile and a completion task to call
   // when the utterance is done speaking. Before speaking this utterance,
   // its other parameters like text, rate, pitch, etc. should all be set.
-  static TtsUtterance* Create(BrowserContext* browser_context);
+  static std::unique_ptr<TtsUtterance> Create(BrowserContext* browser_context);
   virtual ~TtsUtterance() = default;
 
   // Sends an event to the delegate. If the event type is TTS_EVENT_END
diff --git a/chromium/content/public/browser/web_contents.cc b/chromium/content/public/browser/web_contents.cc
index df508da0aef..2e133afb8da 100644
--- a/chromium/content/public/browser/web_contents.cc
+++ b/chromium/content/public/browser/web_contents.cc
@@ -30,7 +30,8 @@ WebContents::CreateParams::CreateParams(BrowserContext* context,
       context(nullptr),
       renderer_initiated_creation(false),
       desired_renderer_state(kOkayToHaveRendererProcess),
-      starting_sandbox_flags(blink::WebSandboxFlags::kNone) {}
+      starting_sandbox_flags(blink::WebSandboxFlags::kNone),
+      is_never_visible(false) {}
 
 WebContents::CreateParams::CreateParams(const CreateParams& other) = default;
 
diff --git a/chromium/content/public/browser/web_contents.h b/chromium/content/public/browser/web_contents.h
index b5ff1cc5d6f..075dd254543 100644
--- a/chromium/content/public/browser/web_contents.h
+++ b/chromium/content/public/browser/web_contents.h
@@ -20,6 +20,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
+#include "content/public/browser/accessibility_tree_formatter.h"
 #include "content/public/browser/invalidate_type.h"
 #include "content/public/browser/mhtml_generation_result.h"
 #include "content/public/browser/navigation_controller.h"
@@ -152,9 +153,6 @@ class WebContents : public PageNavigator,
     // window.open('', 'bar')).
     std::string main_frame_name;
 
-    // Initial size of the new WebContent's view. Can be (0, 0) if not needed.
-    gfx::Size initial_size;
-
     // True if the contents should be initially hidden.
     bool initially_hidden;
 
@@ -224,6 +222,12 @@ class WebContents : public PageNavigator,
     // default initialized then the value is not passed on to the WebContents
     // and GetLastActiveTime() will return the WebContents' creation time.
     base::TimeTicks last_active_time;
+
+    // Normal WebContents initialization is split between construction and the
+    // first time it is shown. Some WebContents are never shown though.
+    // Setting this to true will invoke the WebContents delayed initialization
+    // that doesn't require visibility.
+    bool is_never_visible;
   };
 
   // Creates a new WebContents.
@@ -402,7 +406,10 @@ class WebContents : public PageNavigator,
 
   virtual void SetAccessibilityMode(ui::AXMode mode) = 0;
 
-  virtual base::string16 DumpAccessibilityTree(bool internal) = 0;
+  virtual base::string16 DumpAccessibilityTree(
+      bool internal,
+      std::vector<content::AccessibilityTreeFormatter::PropertyFilter>
+          property_filters) = 0;
 
   virtual const PageImportanceSignals& GetPageImportanceSignals() = 0;
 
@@ -594,6 +601,10 @@ class WebContents : public PageNavigator,
   // an IPC to all the renderer processes associated with this WebContents.
   virtual void NotifyPreferencesChanged() = 0;
 
+  // Sends the current preferences to all renderer processes for the current
+  // page.
+  virtual void SyncRendererPrefs() = 0;
+
   // Notifies WebContents that an attempt has been made to read the cookies in
   // |cookie_list|.
   virtual void OnCookiesRead(const GURL& url,
@@ -622,11 +633,7 @@ class WebContents : public PageNavigator,
   virtual std::unique_ptr<WebContents> Clone() = 0;
 
   // Reloads the focused frame.
-  virtual void ReloadFocusedFrame(bool bypass_cache) = 0;
-
-  // Reloads all the Lo-Fi images in this WebContents. Ignores the cache and
-  // reloads from the network.
-  virtual void ReloadLoFiImages() = 0;
+  virtual void ReloadFocusedFrame() = 0;
 
   // Attains PauseSubresourceLoadingHandles for each frame in the web contents.
   // As long as these handles are not deleted, subresources will continue to be
diff --git a/chromium/content/public/browser/web_contents_delegate.cc b/chromium/content/public/browser/web_contents_delegate.cc
index e6881a1c391..9dcdf2d12bb 100644
--- a/chromium/content/public/browser/web_contents_delegate.cc
+++ b/chromium/content/public/browser/web_contents_delegate.cc
@@ -119,20 +119,25 @@ bool WebContentsDelegate::OnGoToEntryOffset(int offset) {
   return true;
 }
 
-bool WebContentsDelegate::ShouldCreateWebContents(
-    WebContents* web_contents,
-    RenderFrameHost* opener,
+bool WebContentsDelegate::IsWebContentsCreationOverridden(
     SiteInstance* source_site_instance,
-    int32_t route_id,
-    int32_t main_frame_route_id,
-    int32_t main_frame_widget_route_id,
     content::mojom::WindowContainerType window_container_type,
     const GURL& opener_url,
     const std::string& frame_name,
+    const GURL& target_url) {
+  return false;
+}
+
+WebContents* WebContentsDelegate::CreateCustomWebContents(
+    RenderFrameHost* opener,
+    SiteInstance* source_site_instance,
+    bool is_new_browsing_instance,
+    const GURL& opener_url,
+    const std::string& frame_name,
     const GURL& target_url,
     const std::string& partition_id,
     SessionStorageNamespace* session_storage_namespace) {
-  return true;
+  return nullptr;
 }
 
 JavaScriptDialogManager* WebContentsDelegate::GetJavaScriptDialogManager(
@@ -169,9 +174,9 @@ bool WebContentsDelegate::IsFullscreenForTabOrPending(
   return false;
 }
 
-blink::WebDisplayMode WebContentsDelegate::GetDisplayMode(
+blink::mojom::DisplayMode WebContentsDelegate::GetDisplayMode(
     const WebContents* web_contents) {
-  return blink::kWebDisplayModeBrowser;
+  return blink::mojom::DisplayMode::kBrowser;
 }
 
 ColorChooser* WebContentsDelegate::OpenColorChooser(
@@ -270,10 +275,10 @@ bool WebContentsDelegate::SaveFrame(const GURL& url, const Referrer& referrer) {
   return false;
 }
 
-blink::WebSecurityStyle WebContentsDelegate::GetSecurityStyle(
+blink::SecurityStyle WebContentsDelegate::GetSecurityStyle(
     WebContents* web_contents,
     SecurityStyleExplanations* security_style_explanations) {
-  return blink::kWebSecurityStyleUnknown;
+  return blink::SecurityStyle::kUnknown;
 }
 
 bool WebContentsDelegate::ShouldAllowRunningInsecureContent(
diff --git a/chromium/content/public/browser/web_contents_delegate.h b/chromium/content/public/browser/web_contents_delegate.h
index 70afb535763..dedaf25af5b 100644
--- a/chromium/content/public/browser/web_contents_delegate.h
+++ b/chromium/content/public/browser/web_contents_delegate.h
@@ -25,12 +25,12 @@
 #include "content/public/common/previews_state.h"
 #include "content/public/common/window_container_type.mojom-forward.h"
 #include "third_party/blink/public/common/frame/blocked_navigation_types.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
 #include "third_party/blink/public/common/mediastream/media_stream_request.h"
+#include "third_party/blink/public/common/security/security_style.h"
 #include "third_party/blink/public/mojom/choosers/color_chooser.mojom-forward.h"
+#include "third_party/blink/public/mojom/frame/fullscreen.mojom-forward.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/platform/web_drag_operation.h"
-#include "third_party/blink/public/platform/web_security_style.h"
-#include "third_party/blink/public/web/web_fullscreen_options.h"
 #include "third_party/skia/include/core/SkColor.h"
 #include "ui/base/window_open_disposition.h"
 #include "ui/gfx/geometry/rect_f.h"
@@ -57,7 +57,6 @@ class ColorChooser;
 class FileSelectListener;
 class JavaScriptDialogManager;
 class RenderFrameHost;
-class RenderProcessHost;
 class RenderWidgetHost;
 class SessionStorageNamespace;
 class SiteInstance;
@@ -298,35 +297,30 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual bool OnGoToEntryOffset(int offset);
 
   // Allows delegate to control whether a new WebContents can be created by
-  // |web_contents|.
+  // the WebContents itself.
   //
-  // The route ID parameters passed to this method are associated with the
-  // |source_site_instance|'s RenderProcessHost. They may also be
-  // MSG_ROUTING_NONE. If they are valid, they correspond to a trio of
-  // RenderView, RenderFrame, and RenderWidget objects that have been created in
-  // the renderer, but not yet assigned a WebContents, RenderViewHost,
-  // RenderFrameHost, or RenderWidgetHost.
-  //
-  // The return value is interpreted as follows:
+  // If an delegate returns true, it can optionally also override
+  // CreateCustomWebContents() below to provide their own WebContents.
+  virtual bool IsWebContentsCreationOverridden(
+      SiteInstance* source_site_instance,
+      content::mojom::WindowContainerType window_container_type,
+      const GURL& opener_url,
+      const std::string& frame_name,
+      const GURL& target_url);
+
+  // Allow delegate to creates a custom WebContents when
+  // WebContents::CreateNewWindow() is called. This function is only called
+  // when IsWebContentsCreationOverridden() returns true.
   //
-  //   Return true: |web_contents| should create a WebContents.
-  //   Return false: |web_contents| should not create a WebContents. The
-  //       provisionally-created RenderView (if it exists) in the renderer
-  //       process will be destroyed, UNLESS the delegate, during this method,
-  //       itself creates a WebContents using |source_site_instance|,
-  //       |route_id|, |main_frame_route_id|, and |main_frame_widget_route_id|
-  //       as creation parameters. If this happens, the delegate assumes
-  //       ownership of the corresponding RenderView, etc. |web_contents| will
-  //       detect that this has happened by looking for the existence of a
-  //       RenderViewHost in |source_site_instance| with |route_id|.
-  virtual bool ShouldCreateWebContents(
-      WebContents* web_contents,
+  // In general, a delegate should return a pointer to a created WebContents
+  // so that the opener can be given a references to it as appropriate.
+  // Returning nullptr also makes sense if the delegate wishes to suppress
+  // all window creation, or if the delegate wants to ensure the opener
+  // cannot get a reference effectively creating a new browsing instance.
+  virtual WebContents* CreateCustomWebContents(
       RenderFrameHost* opener,
       SiteInstance* source_site_instance,
-      int32_t route_id,
-      int32_t main_frame_route_id,
-      int32_t main_frame_widget_route_id,
-      content::mojom::WindowContainerType window_container_type,
+      bool is_new_browsing_instance,
       const GURL& opener_url,
       const std::string& frame_name,
       const GURL& target_url,
@@ -434,7 +428,7 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual void EnterFullscreenModeForTab(
       WebContents* web_contents,
       const GURL& origin,
-      const blink::WebFullscreenOptions& options) {}
+      const blink::mojom::FullscreenOptions& options) {}
 
   // Called when the renderer puts a tab out of fullscreen mode.
   virtual void ExitFullscreenModeForTab(WebContents*) {}
@@ -442,11 +436,12 @@ class CONTENT_EXPORT WebContentsDelegate {
   virtual bool IsFullscreenForTabOrPending(const WebContents* web_contents);
 
   // Returns the actual display mode of the top-level browsing context.
-  // For example, it should return 'blink::WebDisplayModeFullscreen' whenever
-  // the browser window is put to fullscreen mode (either by the end user,
-  // or HTML API or from a web manifest setting).
-  // See http://w3c.github.io/manifest/#dfn-display-mode
-  virtual blink::WebDisplayMode GetDisplayMode(const WebContents* web_contents);
+  // For example, it should return 'blink::mojom::DisplayModeFullscreen'
+  // whenever the browser window is put to fullscreen mode (either by the end
+  // user, or HTML API or from a web manifest setting). See
+  // http://w3c.github.io/manifest/#dfn-display-mode
+  virtual blink::mojom::DisplayMode GetDisplayMode(
+      const WebContents* web_contents);
 
   // Register a new handler for URL requests with the given scheme.
   // |user_gesture| is true if the registration is made in the context of a user
@@ -574,8 +569,8 @@ class CONTENT_EXPORT WebContentsDelegate {
   // Can be overridden by a delegate to return the security style of the
   // given |web_contents|, populating |security_style_explanations| to
   // explain why the SecurityStyle was downgraded. Returns
-  // WebSecurityStyleUnknown if not overriden.
-  virtual blink::WebSecurityStyle GetSecurityStyle(
+  // SecurityStyleUnknown if not overriden.
+  virtual blink::SecurityStyle GetSecurityStyle(
       WebContents* web_contents,
       SecurityStyleExplanations* security_style_explanations);
 
diff --git a/chromium/content/public/browser/web_contents_observer.h b/chromium/content/public/browser/web_contents_observer.h
index e97e4616cb5..e6562beb5c4 100644
--- a/chromium/content/public/browser/web_contents_observer.h
+++ b/chromium/content/public/browser/web_contents_observer.h
@@ -171,8 +171,12 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // Called when a navigation encountered a server redirect.
   virtual void DidRedirectNavigation(NavigationHandle* navigation_handle) {}
 
-  // Called when the navigation is ready to be committed in a renderer. Most
-  // observers should use DidFinishNavigation instead, which happens right
+  // Called when the navigation is ready to be committed in a renderer. This
+  // occurs when the response code isn't 204/205 (which tell the browser that
+  // the request is successful but there's no content that follows) or a
+  // download (either from a response header or based on mime sniffing the
+  // response). The browser then is ready to switch rendering the new document.
+  // Most observers should use DidFinishNavigation instead, which happens right
   // after the navigation commits. This method is for observers that want to
   // initialize renderer-side state just before the RenderFrame commits the
   // navigation.
@@ -234,7 +238,7 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // This method is invoked when the document in the given frame finished
   // loading. At this point, scripts marked as defer were executed, and
   // content scripts marked "document_end" get injected into the frame.
-  virtual void DocumentLoadedInFrame(RenderFrameHost* render_frame_host) {}
+  virtual void DOMContentLoaded(RenderFrameHost* render_frame_host) {}
 
   // This method is invoked when the load is done, i.e. the spinner of the tab
   // will stop spinning, and the onload event was dispatched.
@@ -339,12 +343,6 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
   // failure methods will also be invoked.
   virtual void NavigationStopped() {}
 
-  // This method is invoked when the WebContents reloads all the LoFi images in
-  // the frame. LoFi is a type of Preview where Chrome shows gray boxes in place
-  // of the images on a webpage in order to conserve data for data-sensitive
-  // users. See http://bit.ly/LoFiPublicDoc.
-  virtual void DidReloadLoFiImages() {}
-
   // Called when there has been direct user interaction with the WebContents.
   // The type argument specifies the kind of interaction. Direct user input
   // signalled through this callback includes:
@@ -568,11 +566,6 @@ class CONTENT_EXPORT WebContentsObserver : public IPC::Listener {
       const std::string& interface_name,
       mojo::ScopedMessagePipeHandle* interface_pipe) {}
 
-  // Notifies that the RenderWidgetCompositor has issued a draw command. An
-  // observer can use this method to detect when Chrome visually updated a
-  // tab.
-  virtual void DidCommitAndDrawCompositorFrame() {}
-
   // Called when "audible" playback starts or stops on a WebAudio AudioContext.
   using AudioContextId = std::pair<RenderFrameHost*, int>;
   virtual void AudioContextPlaybackStarted(
diff --git a/chromium/content/public/browser/web_contents_view_delegate.cc b/chromium/content/public/browser/web_contents_view_delegate.cc
index 4938997f620..880f48251df 100644
--- a/chromium/content/public/browser/web_contents_view_delegate.cc
+++ b/chromium/content/public/browser/web_contents_view_delegate.cc
@@ -5,6 +5,10 @@
 #include "content/public/browser/web_contents_view_delegate.h"
 
 #include <stddef.h>
+#include <utility>
+
+#include "base/callback.h"
+#include "content/public/common/drop_data.h"
 
 namespace content {
 
@@ -47,4 +51,9 @@ void* WebContentsViewDelegate::CreateRenderWidgetHostViewDelegate(
   return nullptr;
 }
 
+void WebContentsViewDelegate::OnPerformDrop(const DropData& drop_data,
+                                            DropCompletionCallback callback) {
+  return std::move(callback).Run(DropCompletionResult::kContinue);
+}
+
 }  // namespace content
diff --git a/chromium/content/public/browser/web_contents_view_delegate.h b/chromium/content/public/browser/web_contents_view_delegate.h
index e8ad82fab5a..73f65070c52 100644
--- a/chromium/content/public/browser/web_contents_view_delegate.h
+++ b/chromium/content/public/browser/web_contents_view_delegate.h
@@ -22,11 +22,25 @@ class RenderFrameHost;
 class RenderWidgetHost;
 class WebDragDestDelegate;
 struct ContextMenuParams;
+struct DropData;
 
 // This interface allows a client to extend the functionality of the
 // WebContentsView implementation.
 class CONTENT_EXPORT WebContentsViewDelegate {
  public:
+  enum class DropCompletionResult {
+    // The drag and drop operation can continue normally.
+    kContinue,
+
+    // The drag and drop should be aborted.  For example, the data in the
+    // drop does not comply with enterprise policies.
+    kAbort,
+  };
+
+  // Callback used with OnPerformDrop() method that is called once
+  // OnPerformDrop() completes.
+  using DropCompletionCallback = base::OnceCallback<void(DropCompletionResult)>;
+
   virtual ~WebContentsViewDelegate();
 
   // Returns the native window containing the WebContents, or nullptr if the
@@ -67,6 +81,11 @@ class CONTENT_EXPORT WebContentsViewDelegate {
       RenderWidgetHost* render_widget_host,
       bool is_popup);
 #endif
+
+  // Performs the actions needed for a drop and then calls the completion
+  // callback once done.
+  virtual void OnPerformDrop(const DropData& drop_data,
+                             DropCompletionCallback callback);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/browser/webvr_service_provider.cc b/chromium/content/public/browser/webvr_service_provider.cc
index 709718b2d37..e10aa124eeb 100644
--- a/chromium/content/public/browser/webvr_service_provider.cc
+++ b/chromium/content/public/browser/webvr_service_provider.cc
@@ -13,11 +13,11 @@ base::LazyInstance<WebvrServiceProvider::BindWebvrServiceCallback>::Leaky
 
 void WebvrServiceProvider::BindWebvrService(
     RenderFrameHost* render_frame_host,
-    mojo::InterfaceRequest<device::mojom::VRService> request) {
-  // Ignore the interface request if the callback is unset.
+    mojo::PendingReceiver<device::mojom::VRService> receiver) {
+  // Ignore the pending receiver if the callback is unset.
   if (g_callback.Get().is_null())
     return;
-  g_callback.Get().Run(render_frame_host, std::move(request));
+  g_callback.Get().Run(render_frame_host, std::move(receiver));
 }
 
 void WebvrServiceProvider::SetWebvrServiceCallback(
diff --git a/chromium/content/public/browser/webvr_service_provider.h b/chromium/content/public/browser/webvr_service_provider.h
index 92b333d3b87..d0a966f732f 100644
--- a/chromium/content/public/browser/webvr_service_provider.h
+++ b/chromium/content/public/browser/webvr_service_provider.h
@@ -7,7 +7,7 @@
 
 #include "base/callback.h"
 #include "content/common/content_export.h"
-#include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace device {
 namespace mojom {
@@ -25,11 +25,11 @@ class WebvrServiceProvider {
  public:
   static void BindWebvrService(
       RenderFrameHost* render_frame_host,
-      mojo::InterfaceRequest<device::mojom::VRService> request);
+      mojo::PendingReceiver<device::mojom::VRService> receiver);
 
   using BindWebvrServiceCallback =
       base::Callback<void(RenderFrameHost*,
-                          mojo::InterfaceRequest<device::mojom::VRService>)>;
+                          mojo::PendingReceiver<device::mojom::VRService>)>;
 
   CONTENT_EXPORT static void SetWebvrServiceCallback(
       BindWebvrServiceCallback callback);
diff --git a/chromium/content/public/child/child_thread.h b/chromium/content/public/child/child_thread.h
index e1dc569b31d..8498e3e6aae 100644
--- a/chromium/content/public/child/child_thread.h
+++ b/chromium/content/public/child/child_thread.h
@@ -22,10 +22,6 @@ class SingleThreadTaskRunner;
 struct UserMetricsAction;
 }
 
-namespace service_manager {
-class Connector;
-}
-
 namespace content {
 
 class ServiceManagerConnection;
@@ -63,14 +59,6 @@ class CONTENT_EXPORT ChildThread : public IPC::Sender {
   // service_manager::Connector can be obtained).
   virtual ServiceManagerConnection* GetServiceManagerConnection() = 0;
 
-  // Returns a connector that can be used to bind interfaces exposed by other
-  // services.
-  //
-  // DEPRECATED: Do not introduce new calls to |GetConnector()|. To bind
-  // browser process receivers scoped to this child process, use
-  // |BindHostReceiver()| below.
-  virtual service_manager::Connector* GetConnector() = 0;
-
   // Asks the browser-side process host object to bind |receiver|. Whether or
   // not the interface type encapsulated by |receiver| is supported depends on
   // the process type and potentially on the Content embedder.
diff --git a/chromium/content/public/child/dwrite_font_proxy_init_win.h b/chromium/content/public/child/dwrite_font_proxy_init_win.h
index a94e4817360..7983f61ee6c 100644
--- a/chromium/content/public/child/dwrite_font_proxy_init_win.h
+++ b/chromium/content/public/child/dwrite_font_proxy_init_win.h
@@ -6,16 +6,11 @@
 #define CONTENT_PUBLIC_CHILD_DWRITE_FONT_PROXY_INIT_WIN_H_
 
 #include "content/common/content_export.h"
-#include "services/service_manager/public/cpp/connector.h"
 
 namespace content {
 
-// Initializes the dwrite font proxy. If |connector| is non-null, it will be
-// used to create the underlying mojo connection to the browser during
-// initialization. Otherwise, the connection will be created on demand using a
-// connector obtained from the current ChildThread.
-CONTENT_EXPORT void InitializeDWriteFontProxy(
-    service_manager::Connector* connector = nullptr);
+// Initializes the dwrite font proxy.
+CONTENT_EXPORT void InitializeDWriteFontProxy();
 
 // Uninitialize the dwrite font proxy. This is safe to call even if the proxy
 // has not been initialized. After this, calls to load fonts may fail.
diff --git a/chromium/content/public/common/BUILD.gn b/chromium/content/public/common/BUILD.gn
index 7f789e11549..6223c89df02 100644
--- a/chromium/content/public/common/BUILD.gn
+++ b/chromium/content/public/common/BUILD.gn
@@ -176,6 +176,7 @@ jumbo_source_set("common_sources") {
     "pepper_plugin_info.cc",
     "pepper_plugin_info.h",
     "persistent_notification_status.h",
+    "previews_state.cc",
     "previews_state.h",
     "process_type.h",
     "profiling.cc",
@@ -216,8 +217,6 @@ jumbo_source_set("common_sources") {
     "webplugininfo.cc",
     "webplugininfo.h",
     "webplugininfo_param_traits.h",
-    "webrtc_ip_handling_policy.cc",
-    "webrtc_ip_handling_policy.h",
     "widget_type.h",
   ]
 
@@ -344,6 +343,7 @@ mojom("interfaces") {
   ]
 
   sources = [
+    "browser_controls_state.mojom",
     "drop_data.mojom",
     "fullscreen_video_element.mojom",
     "resource_load_info.mojom",
diff --git a/chromium/content/public/common/browser_controls_state.mojom b/chromium/content/public/common/browser_controls_state.mojom
new file mode 100644
index 00000000000..3ec41b840e1
--- /dev/null
+++ b/chromium/content/public/common/browser_controls_state.mojom
@@ -0,0 +1,8 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module content.mojom;
+
+[Native]
+enum BrowserControlsState;
diff --git a/chromium/content/public/common/browser_controls_state.typemap b/chromium/content/public/common/browser_controls_state.typemap
new file mode 100644
index 00000000000..7f185e74c4e
--- /dev/null
+++ b/chromium/content/public/common/browser_controls_state.typemap
@@ -0,0 +1,9 @@
+# Copyright 2019 The Chromium Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+mojom = "//content/public/common/browser_controls_state.mojom"
+public_headers = [ "//content/public/common/browser_controls_state.h" ]
+traits_headers = [ "//content/public/common/common_param_traits_macros.h" ]
+type_mappings =
+    [ "content.mojom.BrowserControlsState=::content::BrowserControlsState" ]
diff --git a/chromium/content/public/common/common_param_traits_macros.h b/chromium/content/public/common/common_param_traits_macros.h
index 30e6e9de1c8..5411d32dbfd 100644
--- a/chromium/content/public/common/common_param_traits_macros.h
+++ b/chromium/content/public/common/common_param_traits_macros.h
@@ -10,6 +10,7 @@
 
 #include "build/build_config.h"
 #include "cc/input/touch_action.h"
+#include "content/public/common/browser_controls_state.h"
 #include "content/public/common/drop_data.h"
 #include "content/public/common/referrer.h"
 #include "content/public/common/web_preferences.h"
@@ -17,6 +18,7 @@
 #include "ipc/ipc_message_macros.h"
 #include "services/network/public/cpp/network_ipc_param_traits.h"
 #include "services/network/public/mojom/referrer_policy.mojom.h"
+#include "third_party/blink/public/common/security/security_style.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/permissions/permission_status.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
@@ -25,8 +27,8 @@
 #include "third_party/blink/public/platform/web_history_scroll_restoration_type.h"
 #include "third_party/blink/public/platform/web_point.h"
 #include "third_party/blink/public/platform/web_rect.h"
-#include "third_party/blink/public/platform/web_security_style.h"
 #include "third_party/blink/public/platform/web_url_request.h"
+#include "ui/accessibility/ax_enums.mojom.h"
 #include "ui/accessibility/ax_event.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/accessibility/ax_relative_bounds.h"
@@ -42,6 +44,9 @@
 #undef IPC_MESSAGE_EXPORT
 #define IPC_MESSAGE_EXPORT CONTENT_EXPORT
 
+IPC_ENUM_TRAITS_MAX_VALUE(content::BrowserControlsState,
+                          content::BROWSER_CONTROLS_STATE_LAST)
+
 IPC_ENUM_TRAITS_VALIDATE(ui::PageTransition,
                          ((value &
                            ui::PageTransition::PAGE_TRANSITION_CORE_MASK) <=
@@ -52,7 +57,7 @@ IPC_ENUM_TRAITS_MAX_VALUE(network::mojom::ReferrerPolicy,
                           network::mojom::ReferrerPolicy::kMaxValue)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::WebHistoryScrollRestorationType,
                           blink::kWebHistoryScrollRestorationManual)
-IPC_ENUM_TRAITS_MAX_VALUE(blink::WebSecurityStyle, blink::kWebSecurityStyleLast)
+IPC_ENUM_TRAITS_MAX_VALUE(blink::SecurityStyle, blink::SecurityStyle::kLast)
 IPC_ENUM_TRAITS_MAX_VALUE(blink::mojom::PermissionStatus,
                           blink::mojom::PermissionStatus::LAST)
 IPC_ENUM_TRAITS_MAX_VALUE(cc::TouchAction, cc::kTouchActionMax)
@@ -81,9 +86,6 @@ IPC_ENUM_TRAITS_MIN_MAX_VALUE(
 IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::PreferredColorScheme,
                               blink::PreferredColorScheme::kNoPreference,
                               blink::PreferredColorScheme::kLight)
-IPC_ENUM_TRAITS_MIN_MAX_VALUE(blink::ForcedColors,
-                              blink::ForcedColors::kNone,
-                              blink::ForcedColors::kMaxValue)
 
 IPC_STRUCT_TRAITS_BEGIN(blink::WebPoint)
   IPC_STRUCT_TRAITS_MEMBER(x)
@@ -249,7 +251,6 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(do_not_update_selection_on_mutating_selection_range)
   IPC_STRUCT_TRAITS_MEMBER(autoplay_policy)
   IPC_STRUCT_TRAITS_MEMBER(preferred_color_scheme)
-  IPC_STRUCT_TRAITS_MEMBER(forced_colors)
   IPC_STRUCT_TRAITS_MEMBER(low_priority_iframes_threshold)
   IPC_STRUCT_TRAITS_MEMBER(picture_in_picture_enabled)
   IPC_STRUCT_TRAITS_MEMBER(translate_service_available)
@@ -257,6 +258,7 @@ IPC_STRUCT_TRAITS_BEGIN(content::WebPreferences)
   IPC_STRUCT_TRAITS_MEMBER(lazy_load_enabled)
   IPC_STRUCT_TRAITS_MEMBER(lazy_frame_loading_distance_thresholds_px)
   IPC_STRUCT_TRAITS_MEMBER(lazy_image_loading_distance_thresholds_px)
+  IPC_STRUCT_TRAITS_MEMBER(lazy_image_first_k_fully_load)
 IPC_STRUCT_TRAITS_END()
 
 IPC_STRUCT_TRAITS_BEGIN(blink::mojom::WindowFeatures)
diff --git a/chromium/content/public/common/content_descriptors.h b/chromium/content/public/common/content_descriptors.h
index bccbe890411..459d5c6886a 100644
--- a/chromium/content/public/common/content_descriptors.h
+++ b/chromium/content/public/common/content_descriptors.h
@@ -15,6 +15,7 @@ enum {
 #if defined(OS_ANDROID)
   kAndroidPropertyDescriptor = service_manager::kFirstEmbedderDescriptor,
   kAndroidICUDataDescriptor,
+  kAndroidICUExtraDataDescriptor,
 #endif
 
   // Reserves 100 to 199 for dynamically generated IDs.
diff --git a/chromium/content/public/common/content_features.cc b/chromium/content/public/common/content_features.cc
index 3971b3baae1..aea2cd028fa 100644
--- a/chromium/content/public/common/content_features.cc
+++ b/chromium/content/public/common/content_features.cc
@@ -27,6 +27,12 @@ const base::Feature kAllowContentInitiatedDataUrlNavigations{
     "AllowContentInitiatedDataUrlNavigations",
     base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Allows popups during page unloading.
+// TODO(https://crbug.com/1010509): Set to DISABLED_BY_DEFAULT in Chrome 80.
+// TODO(https://crbug.com/937569): Remove this entirely in Chrome 82.
+const base::Feature kAllowPopupsDuringPageUnload{
+    "AllowPopupsDuringPageUnload", base::FEATURE_ENABLED_BY_DEFAULT};
+
 // Accepts Origin-Signed HTTP Exchanges to be signed with certificates
 // that do not have CanSignHttpExchangesDraft extension.
 // TODO(https://crbug.com/862003): Remove when certificates with
@@ -82,11 +88,6 @@ const base::Feature kBlockCredentialedSubresources{
 const base::Feature kBrowserVerifiedUserActivation{
     "BrowserVerifiedUserActivation", base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Controls whether Bundled HTTP Exchanges is enabled.
-// https://wicg.github.io/webpackage/draft-yasskin-wpack-bundled-exchanges.html
-const base::Feature kBundledHTTPExchanges{"BundledHTTPExchanges",
-                                          base::FEATURE_DISABLED_BY_DEFAULT};
-
 // Enables code caching for inline scripts.
 const base::Feature kCacheInlineScriptCode{"CacheInlineScriptCode",
                                            base::FEATURE_ENABLED_BY_DEFAULT};
@@ -94,7 +95,18 @@ const base::Feature kCacheInlineScriptCode{"CacheInlineScriptCode",
 // Enables support for parallel cache_storage operations via the
 // "max_shared_ops" fieldtrial parameter.
 const base::Feature kCacheStorageParallelOps{"CacheStorageParallelOps",
-                                             base::FEATURE_DISABLED_BY_DEFAULT};
+                                             base::FEATURE_ENABLED_BY_DEFAULT};
+
+// Enables eagerly reading the response body in cache.match() when the
+// operation was started from a FetchEvent handler with a matching request
+// URL.
+const base::Feature kCacheStorageEagerReading{
+    "CacheStorageEagerReading", base::FEATURE_DISABLED_BY_DEFAULT};
+
+// Enables scheduling the operation at high priority when a cache.match() is
+// initiated from a FetchEvent handler with a matching request URL.
+const base::Feature kCacheStorageHighPriorityMatch{
+    "CacheStorageHighPriorityMatch", base::FEATURE_DISABLED_BY_DEFAULT};
 
 // If Canvas2D Image Chromium is allowed, this feature controls whether it is
 // enabled.
@@ -114,7 +126,7 @@ const base::Feature kConsolidatedMovementXY{"ConsolidatedMovementXY",
 // Show messages in the DevTools console about upcoming deprecations
 // that would affect sent/received cookies.
 const base::Feature kCookieDeprecationMessages{
-    "CookieDeprecationMessages", base::FEATURE_DISABLED_BY_DEFAULT};
+    "CookieDeprecationMessages", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Enables Blink cooperative scheduling.
 const base::Feature kCooperativeScheduling{"CooperativeScheduling",
@@ -161,15 +173,12 @@ const base::Feature kFeaturePolicyForSandbox{"FeaturePolicyForSandbox",
 // Enables fixes for matching src: local() for web fonts correctly against full
 // font name or postscript name. Rolling out behind a flag, as enabling this
 // enables a font indexer on Android which we need to test in the field first.
-// TODO(https://crbug.com/996027): Re-enable this on Windows once Windows 7
-// DWRiteFontLookupTableBuilder stability is fixed.
-#if !defined(OS_WIN)
 const base::Feature kFontSrcLocalMatching{"FontSrcLocalMatching",
                                           base::FEATURE_ENABLED_BY_DEFAULT};
-#else
-const base::Feature kFontSrcLocalMatching{"FontSrcLocalMatching",
-                                          base::FEATURE_DISABLED_BY_DEFAULT};
-#endif
+
+// Enables forced colors mode for web content.
+const base::Feature kForcedColors{"ForcedColors",
+                                  base::FEATURE_DISABLED_BY_DEFAULT};
 
 // Enables scrollers inside Blink to store scroll offsets in fractional
 // floating-point numbers rather than truncating to integers.
@@ -258,7 +267,7 @@ const base::Feature kLazyInitializeMediaControls{
 // API font fallback calls to retrieve a fallback font family name as opposed to
 // using a hard-coded font lookup table.
 const base::Feature kLegacyWindowsDWriteFontFallback{
-    "LegacyWindowsDWriteFontFallback", base::FEATURE_DISABLED_BY_DEFAULT};
+    "LegacyWindowsDWriteFontFallback", base::FEATURE_ENABLED_BY_DEFAULT};
 
 const base::Feature kLogJsConsoleMessages{"LogJsConsoleMessages",
                                           base::FEATURE_DISABLED_BY_DEFAULT};
@@ -350,11 +359,6 @@ const base::Feature kPassiveDocumentWheelEventListeners{
 const base::Feature kPassiveEventListenersDueToFling{
     "PassiveEventListenersDueToFling", base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Whether ExecutionContext is paused (and workers) on background freeze.
-const base::Feature kPauseExecutionContextOnBackgroundFreeze = {
-    "PauseExecutionContextOnBackgroundFreeze",
-    base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Whether web apps can run periodic tasks upon network connectivity.
 const base::Feature kPeriodicBackgroundSync{"PeriodicBackgroundSync",
                                             base::FEATURE_DISABLED_BY_DEFAULT};
@@ -408,10 +412,6 @@ const base::Feature kPrioritizeBootstrapTasks = {
 const base::Feature kProactivelySwapBrowsingInstance{
     "ProactivelySwapBrowsingInstance", base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Enable raster-inducing scroll.
-const base::Feature kRasterInducingScroll{"RasterInducingScroll",
-                                          base::FEATURE_DISABLED_BY_DEFAULT};
-
 // Reduce the amount of information in the default 'referer' header for
 // cross-origin requests.
 const base::Feature kReducedReferrerGranularity{
@@ -452,20 +452,12 @@ const base::Feature kRequestUnbufferedDispatch{
 const base::Feature kResamplingInputEvents{"ResamplingInputEvents",
                                            base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Loading Dispatcher v0 support with ResourceLoadScheduler (crbug.com/729954).
-const base::Feature kResourceLoadScheduler{"ResourceLoadScheduler",
-                                           base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Run video capture service in the Browser process as opposed to a dedicated
 // utility process
 const base::Feature kRunVideoCaptureServiceInBrowserProcess{
     "RunVideoCaptureServiceInBrowserProcess",
     base::FEATURE_DISABLED_BY_DEFAULT};
 
-// Save the scroll anchor and use it to restore scroll position.
-const base::Feature kScrollAnchorSerialization{
-    "ScrollAnchorSerialization", base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Make sendBeacon throw for a Blob with a non simple type.
 const base::Feature kSendBeaconThrowForBlobWithNonSimpleType{
     "SendBeaconThrowForBlobWithNonSimpleType",
@@ -489,6 +481,13 @@ const base::Feature kServiceWorkerOnUI{"ServiceWorkerOnUI",
 const base::Feature kServiceWorkerPaymentApps{"ServiceWorkerPaymentApps",
                                               base::FEATURE_ENABLED_BY_DEFAULT};
 
+// If enabled, prefer to start service workers in an unused renderer process if
+// available. This helps let navigations and service workers use the same
+// process when a process was already created for a navigation but not yet
+// claimed by it (as is common for navigations from the Android New Tab Page).
+const base::Feature kServiceWorkerPrefersUnusedProcess{
+    "ServiceWorkerPrefersUnusedProcess", base::FEATURE_DISABLED_BY_DEFAULT};
+
 // http://tc39.github.io/ecmascript_sharedmem/shmem.html
 const base::Feature kSharedArrayBuffer {
   "SharedArrayBuffer",
@@ -536,11 +535,6 @@ const base::Feature kSmsReceiver{"SmsReceiver",
 const base::Feature kSpareRendererForSitePerProcess{
     "SpareRendererForSitePerProcess", base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Enables StaleWhileRevalidate support.
-// https://www.chromestatus.com/features/5050913014153216
-const base::Feature kStaleWhileRevalidate{"StaleWhileRevalidate",
-                                          base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Enables Storage Pressure notifications and settings pages.
 const base::Feature kStoragePressureUI{"StoragePressureUI",
                                        base::FEATURE_DISABLED_BY_DEFAULT};
@@ -676,6 +670,11 @@ const base::Feature kWebAuthCable {
 #endif
 };
 
+// Controls whether Web Bundles (Bundled HTTP Exchanges) is enabled.
+// https://wicg.github.io/webpackage/draft-yasskin-wpack-bundled-exchanges.html
+const base::Feature kWebBundles{"WebBundles",
+                                base::FEATURE_DISABLED_BY_DEFAULT};
+
 // If WebGL Image Chromium is allowed, this feature controls whether it is
 // enabled.
 const base::Feature kWebGLImageChromium{"WebGLImageChromium",
@@ -695,26 +694,16 @@ const base::Feature kWebPayments{"WebPayments",
 const base::Feature kWebRtcEcdsaDefault{"WebRTC-EnableWebRtcEcdsa",
                                         base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Enables negotiation of experimental multiplex codec in SDP.
-const base::Feature kWebRtcMultiplexCodec{"WebRTC-MultiplexCodec",
-                                          base::FEATURE_DISABLED_BY_DEFAULT};
-
 // Use GpuMemoryBuffer backed VideoFrames in media streams.
 const base::Feature kWebRtcUseGpuMemoryBufferVideoFrames{
     "WebRTC-UseGpuMemoryBufferVideoFrames", base::FEATURE_ENABLED_BY_DEFAULT};
 
-// Causes WebRTC to replace host ICE candidate IP addresses with generated
-// names ending in ".local" and resolve them using mDNS.
-// http://crbug.com/878465
-const base::Feature kWebRtcHideLocalIpsWithMdns{
-    "WebRtcHideLocalIpsWithMdns", base::FEATURE_ENABLED_BY_DEFAULT};
-
 // Controls whether the WebUSB API is enabled:
 // https://wicg.github.io/webusb
 const base::Feature kWebUsb{"WebUSB", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Controls whether the WebXR Device API is enabled.
-const base::Feature kWebXr{"WebXR", base::FEATURE_DISABLED_BY_DEFAULT};
+const base::Feature kWebXr{"WebXR", base::FEATURE_ENABLED_BY_DEFAULT};
 
 // Enables access to AR features via the WebXR API.
 const base::Feature kWebXrArModule{"WebXRARModule",
@@ -724,6 +713,10 @@ const base::Feature kWebXrArModule{"WebXRARModule",
 const base::Feature kWebXrAnchors{"WebXRAnchors",
                                   base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Enables access to the WebXR Device API gamepad module.
+const base::Feature kWebXrGamepadModule{"WebXrGamepadModule",
+                                        base::FEATURE_ENABLED_BY_DEFAULT};
+
 // Enables access to raycasting against estimated XR scene geometry.
 const base::Feature kWebXrHitTest{"WebXRHitTest",
                                   base::FEATURE_DISABLED_BY_DEFAULT};
@@ -732,6 +725,10 @@ const base::Feature kWebXrHitTest{"WebXRHitTest",
 const base::Feature kWebXrPlaneDetection{"WebXRPlaneDetection",
                                          base::FEATURE_DISABLED_BY_DEFAULT};
 
+// Enables access to planes detected in the user's environment.
+const base::Feature kWebXrArDOMOverlay{"WebXRARDOMOverlay",
+                                       base::FEATURE_DISABLED_BY_DEFAULT};
+
 // Start streaming scripts on script preload.
 const base::Feature kScriptStreamingOnPreload{"ScriptStreamingOnPreload",
                                               base::FEATURE_ENABLED_BY_DEFAULT};
@@ -784,6 +781,13 @@ const base::Feature kWebUIPolymer2Exceptions{"WebUIPolymer2Exceptions",
                                              base::FEATURE_ENABLED_BY_DEFAULT};
 #endif  // defined(OS_CHROMEOS)
 
+#if defined(OS_WIN)
+// Enables the use of a touch fling curve that is based on the behavior of
+// native apps on Windows.
+const base::Feature kExperimentalFlingAnimation{
+    "ExperimentalFlingAnimation", base::FEATURE_DISABLED_BY_DEFAULT};
+#endif  // defined(OS_WIN)
+
 #if defined(OS_MACOSX)
 // Enables caching of media devices for the purpose of enumerating them.
 const base::Feature kDeviceMonitorMac{"DeviceMonitorMac",
diff --git a/chromium/content/public/common/content_features.h b/chromium/content/public/common/content_features.h
index 4ff0d373175..f9ab24077d4 100644
--- a/chromium/content/public/common/content_features.h
+++ b/chromium/content/public/common/content_features.h
@@ -19,6 +19,7 @@ namespace features {
 CONTENT_EXPORT extern const base::Feature kAllowActivationDelegationAttr;
 CONTENT_EXPORT extern const base::Feature
     kAllowContentInitiatedDataUrlNavigations;
+CONTENT_EXPORT extern const base::Feature kAllowPopupsDuringPageUnload;
 CONTENT_EXPORT extern const base::Feature
     kAllowSignedHTTPExchangeCertsWithoutExtension;
 CONTENT_EXPORT extern const base::Feature kAudioServiceAudioStreams;
@@ -28,9 +29,10 @@ CONTENT_EXPORT extern const base::Feature kBackgroundFetch;
 CONTENT_EXPORT extern const base::Feature kBackForwardCache;
 CONTENT_EXPORT extern const base::Feature kBlockCredentialedSubresources;
 CONTENT_EXPORT extern const base::Feature kBrowserVerifiedUserActivation;
-CONTENT_EXPORT extern const base::Feature kBundledHTTPExchanges;
 CONTENT_EXPORT extern const base::Feature kCacheInlineScriptCode;
 CONTENT_EXPORT extern const base::Feature kCacheStorageParallelOps;
+CONTENT_EXPORT extern const base::Feature kCacheStorageEagerReading;
+CONTENT_EXPORT extern const base::Feature kCacheStorageHighPriorityMatch;
 CONTENT_EXPORT extern const base::Feature kCanvas2DImageChromium;
 CONTENT_EXPORT extern const base::Feature kConsolidatedMovementXY;
 CONTENT_EXPORT extern const base::Feature kCookieDeprecationMessages;
@@ -46,6 +48,7 @@ CONTENT_EXPORT extern const base::Feature
     kExtraSafelistedRequestHeadersForOutOfBlinkCors;
 CONTENT_EXPORT extern const base::Feature kFeaturePolicyForSandbox;
 CONTENT_EXPORT extern const base::Feature kFontSrcLocalMatching;
+CONTENT_EXPORT extern const base::Feature kForcedColors;
 CONTENT_EXPORT extern const base::Feature kFractionalScrollOffsets;
 CONTENT_EXPORT extern const base::Feature kGuestViewCrossProcessFrames;
 CONTENT_EXPORT extern const base::Feature kHistoryManipulationIntervention;
@@ -80,8 +83,6 @@ CONTENT_EXPORT extern const base::Feature kOverscrollHistoryNavigation;
 CONTENT_EXPORT extern const base::Feature kPassiveDocumentEventListeners;
 CONTENT_EXPORT extern const base::Feature kPassiveDocumentWheelEventListeners;
 CONTENT_EXPORT extern const base::Feature kPassiveEventListenersDueToFling;
-CONTENT_EXPORT extern const base::Feature
-    kPauseExecutionContextOnBackgroundFreeze;
 CONTENT_EXPORT extern const base::Feature kPeriodicBackgroundSync;
 CONTENT_EXPORT extern const base::Feature kPerNavigationMojoInterface;
 CONTENT_EXPORT extern const base::Feature kPepper3DImageChromium;
@@ -92,22 +93,20 @@ CONTENT_EXPORT extern const base::Feature
     kProcessSharingWithDefaultSiteInstances;
 CONTENT_EXPORT extern const base::Feature
     kProcessSharingWithStrictSiteInstances;
-CONTENT_EXPORT extern const base::Feature kRasterInducingScroll;
 CONTENT_EXPORT extern const base::Feature kReducedReferrerGranularity;
 CONTENT_EXPORT extern const base::Feature kReloadHiddenTabsWithCrashedSubframes;
 CONTENT_EXPORT extern const base::Feature kRenderDocumentForMainFrame;
 CONTENT_EXPORT extern const base::Feature kRenderDocumentForSubframe;
 CONTENT_EXPORT extern const base::Feature kRequestUnbufferedDispatch;
 CONTENT_EXPORT extern const base::Feature kResamplingInputEvents;
-CONTENT_EXPORT extern const base::Feature kResourceLoadScheduler;
 CONTENT_EXPORT extern const base::Feature
     kRunVideoCaptureServiceInBrowserProcess;
-CONTENT_EXPORT extern const base::Feature kScrollAnchorSerialization;
 CONTENT_EXPORT extern const base::Feature
     kSendBeaconThrowForBlobWithNonSimpleType;
 CONTENT_EXPORT extern const base::Feature kServiceWorkerLongRunningMessage;
 CONTENT_EXPORT extern const base::Feature kServiceWorkerOnUI;
 CONTENT_EXPORT extern const base::Feature kServiceWorkerPaymentApps;
+CONTENT_EXPORT extern const base::Feature kServiceWorkerPrefersUnusedProcess;
 CONTENT_EXPORT extern const base::Feature kSharedArrayBuffer;
 CONTENT_EXPORT extern const base::Feature
     kSignedExchangePrefetchCacheForNavigations;
@@ -118,7 +117,6 @@ CONTENT_EXPORT extern const base::Feature kSignedHTTPExchange;
 CONTENT_EXPORT extern const base::Feature kSignedHTTPExchangePingValidity;
 CONTENT_EXPORT extern const base::Feature kSmsReceiver;
 CONTENT_EXPORT extern const base::Feature kSpareRendererForSitePerProcess;
-CONTENT_EXPORT extern const base::Feature kStaleWhileRevalidate;
 CONTENT_EXPORT extern const base::Feature kStoragePressureUI;
 CONTENT_EXPORT extern const base::Feature kStrictOriginIsolation;
 CONTENT_EXPORT extern const base::Feature kSyntheticPointerActions;
@@ -140,17 +138,18 @@ CONTENT_EXPORT extern const base::Feature kWebAssemblyTrapHandler;
 CONTENT_EXPORT extern const base::Feature kWebAuth;
 CONTENT_EXPORT extern const base::Feature kWebAuthBle;
 CONTENT_EXPORT extern const base::Feature kWebAuthCable;
+CONTENT_EXPORT extern const base::Feature kWebBundles;
 CONTENT_EXPORT extern const base::Feature kWebContentsOcclusion;
 CONTENT_EXPORT extern const base::Feature kWebGLImageChromium;
 CONTENT_EXPORT extern const base::Feature kWebPayments;
 CONTENT_EXPORT extern const base::Feature kWebRtcEcdsaDefault;
-CONTENT_EXPORT extern const base::Feature kWebRtcMultiplexCodec;
 CONTENT_EXPORT extern const base::Feature kWebRtcUseGpuMemoryBufferVideoFrames;
-CONTENT_EXPORT extern const base::Feature kWebRtcHideLocalIpsWithMdns;
 CONTENT_EXPORT extern const base::Feature kWebUsb;
 CONTENT_EXPORT extern const base::Feature kWebXr;
 CONTENT_EXPORT extern const base::Feature kWebXrArModule;
 CONTENT_EXPORT extern const base::Feature kWebXrAnchors;
+CONTENT_EXPORT extern const base::Feature kWebXrArDOMOverlay;
+CONTENT_EXPORT extern const base::Feature kWebXrGamepadModule;
 CONTENT_EXPORT extern const base::Feature kWebXrHitTest;
 CONTENT_EXPORT extern const base::Feature kWebXrPlaneDetection;
 CONTENT_EXPORT extern const base::Feature kScriptStreamingOnPreload;
@@ -170,6 +169,10 @@ CONTENT_EXPORT extern const base::Feature kWebNfc;
 CONTENT_EXPORT extern const base::Feature kWebUIPolymer2Exceptions;
 #endif
 
+#if defined(OS_WIN)
+CONTENT_EXPORT extern const base::Feature kExperimentalFlingAnimation;
+#endif  // defined(OS_WIN)
+
 #if defined(OS_MACOSX)
 CONTENT_EXPORT extern const base::Feature kDeviceMonitorMac;
 CONTENT_EXPORT extern const base::Feature kIOSurfaceCapturer;
diff --git a/chromium/content/public/common/content_switches.cc b/chromium/content/public/common/content_switches.cc
index a192260c1f0..d0e2b583f48 100644
--- a/chromium/content/public/common/content_switches.cc
+++ b/chromium/content/public/common/content_switches.cc
@@ -14,7 +14,8 @@ namespace switches {
 const char kAcceleratedCanvas2dMSAASampleCount[] = "canvas-msaa-sample-count";
 
 // Allows processing of input before a frame has been committed.
-// TODO(schenney): Remove when crbug.com/987626 is fixed.
+// TODO(schenney): crbug.com/987626. Used by headless. Look for a way not
+// involving a command line switch.
 const char kAllowPreCommitInput[] = "allow-pre-commit-input";
 
 // By default, file:// URIs cannot read other file:// URIs. This is an
@@ -108,11 +109,6 @@ const char kDisableBackgroundTimerThrottling[] =
 // features.
 const char kDisableBlinkFeatures[]          = "disable-blink-features";
 
-// Enable Web Bluetooth Scanning
-// This switch enables Web Bluetooth Scanning without any
-// permission prompt for testing.
-const char kEnableWebBluetoothScanning[] = "enable-web-bluetooth-scanning";
-
 // Disables HTML5 DB support.
 const char kDisableDatabases[]              = "disable-databases";
 
@@ -342,9 +338,6 @@ const char kEnablePreferCompositingToLCDText[] =
 // features.
 const char kEnableBlinkFeatures[]           = "enable-blink-features";
 
-// Enables Canvas 2D overlays for Windows.
-const char kEnableCanvas2dSwapChain[] = "enable-canvas2d-swap-chain";
-
 // Enable native caret browsing, in which a moveable cursor is placed on a web
 // page, allowing a user to select and navigate through non-editable text using
 // just a keyboard. See https://crbug.com/977390 for links to i2i.
@@ -411,7 +404,7 @@ const char kV8CacheOptions[] = "v8-cache-options";
 // is only useful for tests.
 const char kEnableServiceBinaryLauncher[] = "enable-service-binary-launcher";
 
-// Enables the Skia benchmarking extension
+// Enables the Skia benchmarking extension.
 const char kEnableSkiaBenchmarking[]        = "enable-skia-benchmarking";
 
 // On platforms that support it, enables smooth scroll animation.
@@ -503,9 +496,6 @@ const char kEnableOopRasterization[] = "enable-oop-rasterization";
 // Turns on skia deferred display list for out of process raster.
 const char kEnableOopRasterizationDDL[] = "enable-oop-rasterization-ddl";
 
-// Enables WebGL overlays for Windows.
-const char kEnableWebGLSwapChain[] = "enable-webgl-swap-chain";
-
 // The number of multisample antialiasing samples for GPU rasterization.
 // Requires MSAA support on GPU to have an effect. 0 disables MSAA.
 const char kGpuRasterizationMSAASampleCount[] =
@@ -568,9 +558,12 @@ const char kDisableJavaScriptHarmonyShipping[] =
 // Enables experimental Harmony (ECMAScript 6) features.
 const char kJavaScriptHarmony[]             = "javascript-harmony";
 
-// Specifies the flags passed to JS engine
+// Specifies the flags passed to JS engine.
 const char kJavaScriptFlags[]               = "js-flags";
 
+// Flag to launch tests in the browser process.
+const char kLaunchAsBrowser[] = "as-browser";
+
 // Overrides the Lite Page Subresource host.
 const char kLitePagesServerSubresourceHost[] =
     "litepage-server-subresource-host";
@@ -825,10 +818,10 @@ const char kTouchEventFeatureDetectionDisabled[] = "disabled";
 // the platform default is used.
 const char kTouchTextSelectionStrategy[]    = "touch-selection-strategy";
 
-// Accepts specified file as a trustable BundledExchanges file. This flag should
-// be used only for testing purpose.
-const char kTrustableBundledExchangesFile[] =
-    "trustable-bundled-exchanges-file";
+// Accepts specified file URL of a trustable BundledExchanges file. This flag
+// should be used only for testing purpose.
+const char kTrustableBundledExchangesFileUrl[] =
+    "trustable-bundled-exchanges-file-url";
 
 // Replaces the existing codecs supported in peer connection with a single fake
 // codec entry that create a fake video encoder and decoder.
@@ -867,6 +860,9 @@ const char kValidateInputEventStream[] = "validate-input-event-stream";
 // kWaitForDebugger flag passed on or not.
 const char kWaitForDebuggerChildren[]       = "wait-for-debugger-children";
 
+// Flag used by WebUI test runners to wait for debugger to be attached.
+const char kWaitForDebuggerWebUI[] = "wait-for-debugger-webui";
+
 // Set the antialiasing method used for webgl. (none, explicit, implicit, or
 // screenspace)
 const char kWebglAntialiasingMode[] = "webgl-antialiasing-mode";
@@ -987,14 +983,6 @@ const char kEnableAutomation[] = "enable-automation";
 const char kEnableSpeechDispatcher[] = "enable-speech-dispatcher";
 #endif
 
-#if defined(OS_CHROMEOS)
-// A time_t. Passed by session_manager into the Chrome user session, indicating
-// that if Chrome crashes before the indicated time, session_manager will
-// consider this to be a crash-loop situation and log the user out. Chrome
-// mostly just passes this to crash_reporter if it crashes.
-const char kCrashLoopBefore[] = "crash-loop-before";
-#endif
-
 #if defined(OS_WIN)
 // /prefetch:# arguments to use when launching various process types. It has
 // been observed that when file reads are consistent for 3 process launches with
diff --git a/chromium/content/public/common/content_switches.h b/chromium/content/public/common/content_switches.h
index ab6225134b3..20acdce1032 100644
--- a/chromium/content/public/common/content_switches.h
+++ b/chromium/content/public/common/content_switches.h
@@ -110,7 +110,6 @@ CONTENT_EXPORT extern const char kEnableAggressiveDOMStorageFlushing[];
 CONTENT_EXPORT extern const char kEnableAutomation[];
 CONTENT_EXPORT extern const char kEnablePreferCompositingToLCDText[];
 CONTENT_EXPORT extern const char kEnableBlinkFeatures[];
-CONTENT_EXPORT extern const char kEnableCanvas2dSwapChain[];
 CONTENT_EXPORT extern const char kEnableCaretBrowsing[];
 CONTENT_EXPORT extern const char kEnableDisplayList2dCanvas[];
 CONTENT_EXPORT extern const char kEnableExperimentalWebAssemblyFeatures[];
@@ -142,7 +141,6 @@ CONTENT_EXPORT extern const char kEnableUseZoomForDSF[];
 CONTENT_EXPORT extern const char kEnableViewport[];
 CONTENT_EXPORT extern const char kEnableVtune[];
 CONTENT_EXPORT extern const char kEnableWebAuthTestingAPI[];
-CONTENT_EXPORT extern const char kEnableWebBluetoothScanning[];
 CONTENT_EXPORT extern const char kEnableWebGL2ComputeContext[];
 CONTENT_EXPORT extern const char kEnableWebGLDraftExtensions[];
 CONTENT_EXPORT extern const char kEnableWebGLImageChromium[];
@@ -155,7 +153,6 @@ CONTENT_EXPORT extern const char kForceGpuRasterization[];
 CONTENT_EXPORT extern const char kDisableOopRasterization[];
 CONTENT_EXPORT extern const char kEnableOopRasterization[];
 CONTENT_EXPORT extern const char kEnableOopRasterizationDDL[];
-CONTENT_EXPORT extern const char kEnableWebGLSwapChain[];
 CONTENT_EXPORT extern const char kForceOverlayFullscreenVideo[];
 CONTENT_EXPORT extern const char kForcePresentationReceiverForTesting[];
 CONTENT_EXPORT extern const char kForceRendererAccessibility[];
@@ -170,6 +167,7 @@ CONTENT_EXPORT extern const char kIPCConnectionTimeout[];
 CONTENT_EXPORT extern const char kIsolateOrigins[];
 CONTENT_EXPORT extern const char kJavaScriptFlags[];
 CONTENT_EXPORT extern const char kJavaScriptHarmony[];
+CONTENT_EXPORT extern const char kLaunchAsBrowser[];
 CONTENT_EXPORT extern const char kLitePagesServerSubresourceHost[];
 CONTENT_EXPORT extern const char kLogGpuControlListDecisions[];
 CONTENT_EXPORT extern const char kLoggingLevel[];
@@ -228,7 +226,7 @@ CONTENT_EXPORT extern const char kTouchEventFeatureDetectionAuto[];
 CONTENT_EXPORT extern const char kTouchEventFeatureDetectionEnabled[];
 CONTENT_EXPORT extern const char kTouchEventFeatureDetectionDisabled[];
 CONTENT_EXPORT extern const char kTouchTextSelectionStrategy[];
-CONTENT_EXPORT extern const char kTrustableBundledExchangesFile[];
+CONTENT_EXPORT extern const char kTrustableBundledExchangesFileUrl[];
 CONTENT_EXPORT extern const char kUseFakeCodecForPeerConnection[];
 CONTENT_EXPORT extern const char kUseFakeUIForMediaStream[];
 CONTENT_EXPORT extern const char kVideoImageTextureTarget[];
@@ -251,6 +249,7 @@ CONTENT_EXPORT extern const char kEnableWebRtcSrtpEncryptedHeaders[];
 CONTENT_EXPORT extern const char kEnableWebRtcStunOrigin[];
 CONTENT_EXPORT extern const char kEnforceWebRtcIPPermissionCheck[];
 CONTENT_EXPORT extern const char kForceWebRtcIPHandlingPolicy[];
+CONTENT_EXPORT extern const char kWaitForDebuggerWebUI[];
 extern const char kWebRtcMaxCaptureFramerate[];
 extern const char kWebRtcMaxCpuConsumptionPercentage[];
 CONTENT_EXPORT extern const char kWebRtcStunProbeTrialParameter[];
@@ -274,10 +273,6 @@ CONTENT_EXPORT extern const char kRendererWaitForJavaDebugger[];
 CONTENT_EXPORT extern const char kEnableSpeechDispatcher[];
 #endif
 
-#if defined(OS_CHROMEOS)
-CONTENT_EXPORT extern const char kCrashLoopBefore[];
-#endif
-
 #if defined(OS_WIN)
 CONTENT_EXPORT extern const char kPrefetchArgumentRenderer[];
 CONTENT_EXPORT extern const char kPrefetchArgumentGpu[];
diff --git a/chromium/content/public/common/font_cache_dispatcher_win.h b/chromium/content/public/common/font_cache_dispatcher_win.h
index c046fda9757..7699429be1d 100644
--- a/chromium/content/public/common/font_cache_dispatcher_win.h
+++ b/chromium/content/public/common/font_cache_dispatcher_win.h
@@ -12,10 +12,6 @@
 #include "content/common/content_export.h"
 #include "content/public/common/font_cache_win.mojom.h"
 
-namespace service_manager {
-struct BindSourceInfo;
-}
-
 namespace content {
 
 // Dispatches messages used for font caching on Windows. This is needed because
@@ -26,8 +22,7 @@ class CONTENT_EXPORT FontCacheDispatcher : public mojom::FontCacheWin {
   FontCacheDispatcher();
   ~FontCacheDispatcher() override;
 
-  static void Create(mojom::FontCacheWinRequest request,
-                     const service_manager::BindSourceInfo& source_info);
+  static void Create(mojom::FontCacheWinRequest request);
 
  private:
   // mojom::FontCacheWin:
diff --git a/chromium/content/public/common/page_zoom.h b/chromium/content/public/common/page_zoom.h
index aa5e56a9071..49e08106b6e 100644
--- a/chromium/content/public/common/page_zoom.h
+++ b/chromium/content/public/common/page_zoom.h
@@ -5,8 +5,6 @@
 #ifndef CONTENT_PUBLIC_COMMON_PAGE_ZOOM_H_
 #define CONTENT_PUBLIC_COMMON_PAGE_ZOOM_H_
 
-#include "content/common/content_export.h"
-
 namespace content {
 
 // This enum is the parameter to various text/page zoom commands so we know
@@ -17,28 +15,6 @@ enum PageZoom {
   PAGE_ZOOM_IN    = 1,
 };
 
-// The minimum zoom factor permitted for a page. This is an alternative to
-// WebView::minTextSizeMultiplier.
-CONTENT_EXPORT extern const double kMinimumZoomFactor;
-
-// The maximum zoom factor permitted for a page. This is an alternative to
-// WebView::maxTextSizeMultiplier.
-CONTENT_EXPORT extern const double kMaximumZoomFactor;
-
-// Epsilon value for comparing two floating-point zoom values. We don't use
-// std::numeric_limits<> because it is too precise for zoom values. Zoom
-// values lose precision due to factor/level conversions. A value of 0.001
-// is precise enough for zoom value comparisons.
-CONTENT_EXPORT extern const double kEpsilon;
-
-// Test if two zoom values (either zoom factors or zoom levels) should be
-// considered equal.
-CONTENT_EXPORT bool ZoomValuesEqual(double value_a, double value_b);
-
-// Converts between zoom factors and levels.
-CONTENT_EXPORT double ZoomLevelToZoomFactor(double zoom_level);
-CONTENT_EXPORT double ZoomFactorToZoomLevel(double factor);
-
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_PAGE_ZOOM_H_
diff --git a/chromium/content/public/common/previews_state.cc b/chromium/content/public/common/previews_state.cc
new file mode 100644
index 00000000000..34f598a144c
--- /dev/null
+++ b/chromium/content/public/common/previews_state.cc
@@ -0,0 +1,40 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/public/common/previews_state.h"
+
+#include "third_party/blink/public/platform/web_url_request.h"
+
+#define STATIC_ASSERT_PREVIEWS_ENUM(a, b)                   \
+  static_assert(static_cast<int>(a) == static_cast<int>(b), \
+                "mismatching enums: " #a)
+
+namespace content {
+
+// Ensure that content::PreviewsState and blink::WebURLRequest::PreviewsState
+// are kept in sync.
+STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_UNSPECIFIED,
+                            blink::WebURLRequest::kPreviewsUnspecified);
+STATIC_ASSERT_PREVIEWS_ENUM(CLIENT_LOFI_AUTO_RELOAD,
+                            blink::WebURLRequest::kClientLoFiAutoReload);
+STATIC_ASSERT_PREVIEWS_ENUM(SERVER_LITE_PAGE_ON,
+                            blink::WebURLRequest::kServerLitePageOn);
+STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_NO_TRANSFORM,
+                            blink::WebURLRequest::kPreviewsNoTransform);
+STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_OFF, blink::WebURLRequest::kPreviewsOff);
+STATIC_ASSERT_PREVIEWS_ENUM(NOSCRIPT_ON, blink::WebURLRequest::kNoScriptOn);
+STATIC_ASSERT_PREVIEWS_ENUM(RESOURCE_LOADING_HINTS_ON,
+                            blink::WebURLRequest::kResourceLoadingHintsOn);
+STATIC_ASSERT_PREVIEWS_ENUM(OFFLINE_PAGE_ON,
+                            blink::WebURLRequest::kOfflinePageOn);
+STATIC_ASSERT_PREVIEWS_ENUM(LITE_PAGE_REDIRECT_ON,
+                            blink::WebURLRequest::kLitePageRedirectOn);
+STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_LOAD_DEFERRED,
+                            blink::WebURLRequest::kLazyImageLoadDeferred);
+STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_AUTO_RELOAD,
+                            blink::WebURLRequest::kLazyImageAutoReload);
+STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_STATE_LAST,
+                            blink::WebURLRequest::kPreviewsStateLast);
+
+}  // namespace content
diff --git a/chromium/content/public/common/previews_state.h b/chromium/content/public/common/previews_state.h
index c8cad444206..11e6bbbea16 100644
--- a/chromium/content/public/common/previews_state.h
+++ b/chromium/content/public/common/previews_state.h
@@ -5,13 +5,6 @@
 #ifndef CONTENT_PUBLIC_COMMON_PREVIEWS_STATE_H_
 #define CONTENT_PUBLIC_COMMON_PREVIEWS_STATE_H_
 
-#include "content/common/content_export.h"
-#include "third_party/blink/public/platform/web_url_request.h"
-
-#define STATIC_ASSERT_PREVIEWS_ENUM(a, b)                   \
-  static_assert(static_cast<int>(a) == static_cast<int>(b), \
-                "mismatching enums: " #a)
-
 namespace content {
 
 typedef int PreviewsState;
@@ -65,31 +58,6 @@ const PreviewsState ALL_SUPPORTED_PREVIEWS =
     SERVER_LITE_PAGE_ON | NOSCRIPT_ON | RESOURCE_LOADING_HINTS_ON |
     OFFLINE_PAGE_ON | LITE_PAGE_REDIRECT_ON;
 
-// Ensure that content::PreviewsState and blink::WebURLRequest::PreviewsState
-// are kept in sync.
-STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_UNSPECIFIED,
-                            blink::WebURLRequest::kPreviewsUnspecified);
-STATIC_ASSERT_PREVIEWS_ENUM(CLIENT_LOFI_AUTO_RELOAD,
-                            blink::WebURLRequest::kClientLoFiAutoReload);
-STATIC_ASSERT_PREVIEWS_ENUM(SERVER_LITE_PAGE_ON,
-                            blink::WebURLRequest::kServerLitePageOn);
-STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_NO_TRANSFORM,
-                            blink::WebURLRequest::kPreviewsNoTransform);
-STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_OFF, blink::WebURLRequest::kPreviewsOff);
-STATIC_ASSERT_PREVIEWS_ENUM(NOSCRIPT_ON, blink::WebURLRequest::kNoScriptOn);
-STATIC_ASSERT_PREVIEWS_ENUM(RESOURCE_LOADING_HINTS_ON,
-                            blink::WebURLRequest::kResourceLoadingHintsOn);
-STATIC_ASSERT_PREVIEWS_ENUM(OFFLINE_PAGE_ON,
-                            blink::WebURLRequest::kOfflinePageOn);
-STATIC_ASSERT_PREVIEWS_ENUM(LITE_PAGE_REDIRECT_ON,
-                            blink::WebURLRequest::kLitePageRedirectOn);
-STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_LOAD_DEFERRED,
-                            blink::WebURLRequest::kLazyImageLoadDeferred);
-STATIC_ASSERT_PREVIEWS_ENUM(LAZY_IMAGE_AUTO_RELOAD,
-                            blink::WebURLRequest::kLazyImageAutoReload);
-STATIC_ASSERT_PREVIEWS_ENUM(PREVIEWS_STATE_LAST,
-                            blink::WebURLRequest::kPreviewsStateLast);
-
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_COMMON_PREVIEWS_STATE_H_
diff --git a/chromium/content/public/common/referrer.cc b/chromium/content/public/common/referrer.cc
index 50245ea3c73..5993c910e04 100644
--- a/chromium/content/public/common/referrer.cc
+++ b/chromium/content/public/common/referrer.cc
@@ -5,11 +5,14 @@
 #include "content/public/common/referrer.h"
 
 #include <string>
+#include <type_traits>
 
 #include "base/numerics/safe_conversions.h"
 #include "content/public/common/content_features.h"
+#include "mojo/public/cpp/bindings/enum_utils.h"
 #include "net/base/features.h"
 #include "services/network/loader_util.h"
+#include "services/network/public/cpp/features.h"
 #include "third_party/blink/public/mojom/referrer.mojom.h"
 
 namespace content {
@@ -97,9 +100,13 @@ blink::mojom::ReferrerPtr Referrer::SanitizeForRequest(
       break;
   }
 
-  if (base::FeatureList::IsEnabled(net::features::kCapRefererHeaderLength) &&
-      base::saturated_cast<int>(sanitized_referrer->url.spec().length()) >
-          net::features::kMaxRefererHeaderLength.Get()) {
+  if ((base::FeatureList::IsEnabled(net::features::kCapRefererHeaderLength) &&
+       base::saturated_cast<int>(sanitized_referrer->url.spec().length()) >
+           net::features::kMaxRefererHeaderLength.Get()) ||
+      (base::FeatureList::IsEnabled(
+           network::features::kCapReferrerToOriginOnCrossOrigin) &&
+       !url::Origin::Create(sanitized_referrer->url)
+            .IsSameOriginWith(url::Origin::Create(request)))) {
     sanitized_referrer->url = sanitized_referrer->url.GetOrigin();
   }
 
@@ -117,13 +124,6 @@ url::Origin Referrer::SanitizeOriginForRequest(
 }
 
 // static
-void Referrer::SetReferrerForRequest(net::URLRequest* request,
-                                     const Referrer& referrer) {
-  request->SetReferrer(network::ComputeReferrer(referrer.url));
-  request->set_referrer_policy(ReferrerPolicyForUrlRequest(referrer.policy));
-}
-
-// static
 net::URLRequest::ReferrerPolicy Referrer::ReferrerPolicyForUrlRequest(
     network::mojom::ReferrerPolicy referrer_policy) {
   switch (referrer_policy) {
@@ -193,4 +193,10 @@ net::URLRequest::ReferrerPolicy Referrer::GetDefaultReferrerPolicy() {
   return net::URLRequest::CLEAR_REFERRER_ON_TRANSITION_FROM_SECURE_TO_INSECURE;
 }
 
+// static
+network::mojom::ReferrerPolicy Referrer::ConvertToPolicy(int32_t policy) {
+  return mojo::ConvertIntToMojoEnum<network::mojom::ReferrerPolicy>(policy)
+      .value_or(network::mojom::ReferrerPolicy::kDefault);
+}
+
 }  // namespace content
diff --git a/chromium/content/public/common/referrer.h b/chromium/content/public/common/referrer.h
index c6e32b65433..f5800a3f2c2 100644
--- a/chromium/content/public/common/referrer.h
+++ b/chromium/content/public/common/referrer.h
@@ -47,9 +47,6 @@ struct CONTENT_EXPORT Referrer {
       const url::Origin& initiator,
       network::mojom::ReferrerPolicy policy);
 
-  static void SetReferrerForRequest(net::URLRequest* request,
-                                    const Referrer& referrer);
-
   static net::URLRequest::ReferrerPolicy ReferrerPolicyForUrlRequest(
       network::mojom::ReferrerPolicy referrer_policy);
 
@@ -57,6 +54,11 @@ struct CONTENT_EXPORT Referrer {
       net::URLRequest::ReferrerPolicy net_policy);
 
   static net::URLRequest::ReferrerPolicy GetDefaultReferrerPolicy();
+
+  // Validates |policy| to make sure it represents one of the valid
+  // net::mojom::ReferrerPolicy enum values and returns it.  The relatively safe
+  // |kNever| value is returned if |policy| is not a valid value.
+  static network::mojom::ReferrerPolicy ConvertToPolicy(int32_t policy);
 };
 
 }  // namespace content
diff --git a/chromium/content/public/common/resource_usage_reporter.mojom b/chromium/content/public/common/resource_usage_reporter.mojom
index fc7363f5a14..9b36d6a2eda 100644
--- a/chromium/content/public/common/resource_usage_reporter.mojom
+++ b/chromium/content/public/common/resource_usage_reporter.mojom
@@ -4,7 +4,7 @@
 
 module content.mojom;
 
-// Mirror of blink::WebCache::ResourceTypeStat.
+// Mirror of blink::WebCacheResourceTypeStat.
 // Note: These are size_t in blink.
 struct ResourceTypeStat {
   uint64 count = 0;
@@ -14,7 +14,7 @@ struct ResourceTypeStat {
 };
 
 // Blink resource cache statistics. Mirror of
-// blink::WebCache::ResourceTypeStats.
+// blink::WebCacheResourceTypeStats.
 struct ResourceTypeStats {
   ResourceTypeStat images;
   ResourceTypeStat css_style_sheets;
diff --git a/chromium/content/public/common/resource_usage_reporter_type_converters.cc b/chromium/content/public/common/resource_usage_reporter_type_converters.cc
index cb67146c4b1..e15ab914cf7 100644
--- a/chromium/content/public/common/resource_usage_reporter_type_converters.cc
+++ b/chromium/content/public/common/resource_usage_reporter_type_converters.cc
@@ -13,7 +13,7 @@ namespace mojo {
 namespace {
 
 content::mojom::ResourceTypeStatPtr StatToMojo(
-    const blink::WebCache::ResourceTypeStat& obj) {
+    const blink::WebCacheResourceTypeStat& obj) {
   content::mojom::ResourceTypeStatPtr stat =
       content::mojom::ResourceTypeStat::New();
   stat->count = obj.count;
@@ -22,9 +22,9 @@ content::mojom::ResourceTypeStatPtr StatToMojo(
   return stat;
 }
 
-blink::WebCache::ResourceTypeStat StatFromMojo(
+blink::WebCacheResourceTypeStat StatFromMojo(
     const content::mojom::ResourceTypeStat& obj) {
-  blink::WebCache::ResourceTypeStat stat;
+  blink::WebCacheResourceTypeStat stat;
   stat.count = base::saturated_cast<size_t>(obj.count);
   stat.size = base::saturated_cast<size_t>(obj.size);
   stat.decoded_size = base::saturated_cast<size_t>(obj.decoded_size);
@@ -36,8 +36,8 @@ blink::WebCache::ResourceTypeStat StatFromMojo(
 // static
 content::mojom::ResourceTypeStatsPtr
 TypeConverter<content::mojom::ResourceTypeStatsPtr,
-              blink::WebCache::ResourceTypeStats>::
-    Convert(const blink::WebCache::ResourceTypeStats& obj) {
+              blink::WebCacheResourceTypeStats>::
+    Convert(const blink::WebCacheResourceTypeStats& obj) {
   content::mojom::ResourceTypeStatsPtr stats =
       content::mojom::ResourceTypeStats::New();
   stats->images = StatToMojo(obj.images);
@@ -50,15 +50,15 @@ TypeConverter<content::mojom::ResourceTypeStatsPtr,
 }
 
 // static
-blink::WebCache::ResourceTypeStats
-TypeConverter<blink::WebCache::ResourceTypeStats,
+blink::WebCacheResourceTypeStats
+TypeConverter<blink::WebCacheResourceTypeStats,
               content::mojom::ResourceTypeStats>::
     Convert(const content::mojom::ResourceTypeStats& obj) {
   if (!obj.images || !obj.css_style_sheets || !obj.scripts ||
       !obj.xsl_style_sheets || !obj.fonts || !obj.other) {
     return {};
   }
-  blink::WebCache::ResourceTypeStats stats;
+  blink::WebCacheResourceTypeStats stats;
   stats.images = StatFromMojo(*obj.images);
   stats.css_style_sheets = StatFromMojo(*obj.css_style_sheets);
   stats.scripts = StatFromMojo(*obj.scripts);
diff --git a/chromium/content/public/common/resource_usage_reporter_type_converters.h b/chromium/content/public/common/resource_usage_reporter_type_converters.h
index fd84192072e..74ab80e9bf8 100644
--- a/chromium/content/public/common/resource_usage_reporter_type_converters.h
+++ b/chromium/content/public/common/resource_usage_reporter_type_converters.h
@@ -14,15 +14,15 @@ namespace mojo {
 
 template <>
 struct CONTENT_EXPORT TypeConverter<content::mojom::ResourceTypeStatsPtr,
-                                    blink::WebCache::ResourceTypeStats> {
+                                    blink::WebCacheResourceTypeStats> {
   static content::mojom::ResourceTypeStatsPtr Convert(
-      const blink::WebCache::ResourceTypeStats& obj);
+      const blink::WebCacheResourceTypeStats& obj);
 };
 
 template <>
-struct CONTENT_EXPORT TypeConverter<blink::WebCache::ResourceTypeStats,
+struct CONTENT_EXPORT TypeConverter<blink::WebCacheResourceTypeStats,
                                     content::mojom::ResourceTypeStats> {
-  static blink::WebCache::ResourceTypeStats Convert(
+  static blink::WebCacheResourceTypeStats Convert(
       const content::mojom::ResourceTypeStats& obj);
 };
 
diff --git a/chromium/content/public/common/service_names.mojom b/chromium/content/public/common/service_names.mojom
index d51243a55d4..d381d33b5f5 100644
--- a/chromium/content/public/common/service_names.mojom
+++ b/chromium/content/public/common/service_names.mojom
@@ -34,6 +34,3 @@ const string kRendererServiceName = "content_renderer";
 // The default service name used to identify utility processes when connecting
 // them to the Service Manager.
 const string kUtilityServiceName = "content_utility";
-
-// The name for the network service running in the utility process.
-const string kNetworkServiceName = "network";
diff --git a/chromium/content/public/common/typemaps.gni b/chromium/content/public/common/typemaps.gni
index 7b4138bad30..0f203696ab9 100644
--- a/chromium/content/public/common/typemaps.gni
+++ b/chromium/content/public/common/typemaps.gni
@@ -3,6 +3,7 @@
 # found in the LICENSE file.
 
 typemaps = [
+  "//content/public/common/browser_controls_state.typemap",
   "//content/public/common/drop_data.typemap",
   "//content/public/common/resource_type.typemap",
   "//content/public/common/webplugininfo.typemap",
diff --git a/chromium/content/public/common/url_utils.cc b/chromium/content/public/common/url_utils.cc
index 0242fe3592e..e1879aaa5b5 100644
--- a/chromium/content/public/common/url_utils.cc
+++ b/chromium/content/public/common/url_utils.cc
@@ -115,8 +115,11 @@ bool IsRendererDebugURL(const GURL& url) {
 bool IsSafeRedirectTarget(const GURL& from_url, const GURL& to_url) {
   static const base::NoDestructor<base::flat_set<base::StringPiece>>
       kUnsafeSchemes(base::flat_set<base::StringPiece>({
-        url::kAboutScheme, url::kDataScheme, url::kFileScheme,
+        url::kAboutScheme, url::kFileScheme,
             url::kFileSystemScheme, url::kBlobScheme,
+#if !defined(CHROMECAST_BUILD)
+            url::kDataScheme,
+#endif
 #if defined(OS_ANDROID)
             url::kContentScheme,
 #endif
diff --git a/chromium/content/public/common/url_utils_unittest.cc b/chromium/content/public/common/url_utils_unittest.cc
index 3921c6cc47b..f09740586a9 100644
--- a/chromium/content/public/common/url_utils_unittest.cc
+++ b/chromium/content/public/common/url_utils_unittest.cc
@@ -41,8 +41,13 @@ TEST(UrlUtilsTest, IsSafeRedirectTarget) {
   EXPECT_FALSE(IsSafeRedirectTarget(GURL(), CreateValidURL("about:blank")));
   EXPECT_FALSE(IsSafeRedirectTarget(
       GURL(), CreateValidURL("filesystem:http://foo.com/bar")));
+#if !defined(CHROMECAST_BUILD)
   EXPECT_FALSE(
       IsSafeRedirectTarget(GURL(), CreateValidURL("data:text/plain,foo")));
+#else
+  EXPECT_TRUE(
+      IsSafeRedirectTarget(GURL(), CreateValidURL("data:text/plain,foo")));
+#endif
   EXPECT_FALSE(
       IsSafeRedirectTarget(GURL(), CreateValidURL("blob:https://foo.com/bar")));
 #if defined(OS_ANDROID)
diff --git a/chromium/content/public/common/web_preferences.cc b/chromium/content/public/common/web_preferences.cc
index 8c04e3b6d53..4b765944962 100644
--- a/chromium/content/public/common/web_preferences.cc
+++ b/chromium/content/public/common/web_preferences.cc
@@ -226,7 +226,6 @@ WebPreferences::WebPreferences()
       do_not_update_selection_on_mutating_selection_range(false),
       autoplay_policy(AutoplayPolicy::kDocumentUserActivationRequired),
       preferred_color_scheme(blink::PreferredColorScheme::kNoPreference),
-      forced_colors(blink::ForcedColors::kNone),
       low_priority_iframes_threshold(net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN),
       picture_in_picture_enabled(true),
       translate_service_available(false),
diff --git a/chromium/content/public/common/web_preferences.h b/chromium/content/public/common/web_preferences.h
index 7079cc86dca..700cba9043f 100644
--- a/chromium/content/public/common/web_preferences.h
+++ b/chromium/content/public/common/web_preferences.h
@@ -14,7 +14,6 @@
 #include "build/build_config.h"
 #include "content/common/content_export.h"
 #include "net/nqe/effective_connection_type.h"
-#include "third_party/blink/public/common/css/forced_colors.h"
 #include "third_party/blink/public/common/css/preferred_color_scheme.h"
 #include "third_party/blink/public/mojom/v8_cache_options.mojom.h"
 #include "ui/base/pointer/pointer_device.h"
@@ -320,12 +319,6 @@ struct CONTENT_EXPORT WebPreferences {
   blink::PreferredColorScheme preferred_color_scheme =
       blink::PreferredColorScheme::kNoPreference;
 
-  // Forced colors indicates whether forced color mode is active or not. Forced
-  // colors is used to evaluate the forced-colors and prefers-color-scheme
-  // media queries and is used to resolve the default color scheme as indicated
-  // by the preferred_color_scheme.
-  blink::ForcedColors forced_colors = blink::ForcedColors::kNone;
-
   // Network quality threshold below which resources from iframes are assigned
   // either kVeryLow or kVeryLow Blink priority.
   net::EffectiveConnectionType low_priority_iframes_threshold;
@@ -356,6 +349,7 @@ struct CONTENT_EXPORT WebPreferences {
       lazy_frame_loading_distance_thresholds_px;
   std::map<net::EffectiveConnectionType, int>
       lazy_image_loading_distance_thresholds_px;
+  std::map<net::EffectiveConnectionType, int> lazy_image_first_k_fully_load;
 
   // We try to keep the default values the same as the default values in
   // chrome, except for the cases where it would require lots of extra work for
diff --git a/chromium/content/public/common/webrtc_ip_handling_policy.cc b/chromium/content/public/common/webrtc_ip_handling_policy.cc
deleted file mode 100644
index beed096bb02..00000000000
--- a/chromium/content/public/common/webrtc_ip_handling_policy.cc
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/public/common/webrtc_ip_handling_policy.h"
-
-namespace content {
-
-// The set of strings here need to match what's specified in privacy.json.
-const char kWebRTCIPHandlingDefault[] = "default";
-const char kWebRTCIPHandlingDefaultPublicAndPrivateInterfaces[] =
-    "default_public_and_private_interfaces";
-const char kWebRTCIPHandlingDefaultPublicInterfaceOnly[] =
-    "default_public_interface_only";
-const char kWebRTCIPHandlingDisableNonProxiedUdp[] = "disable_non_proxied_udp";
-
-}  // namespace content
diff --git a/chromium/content/public/common/webrtc_ip_handling_policy.h b/chromium/content/public/common/webrtc_ip_handling_policy.h
deleted file mode 100644
index 77904233ccd..00000000000
--- a/chromium/content/public/common/webrtc_ip_handling_policy.h
+++ /dev/null
@@ -1,32 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_PUBLIC_RENDERER_WEBRTC_IP_HANDLING_POLICY_H_
-#define CONTENT_PUBLIC_RENDERER_WEBRTC_IP_HANDLING_POLICY_H_
-
-#include "content/common/content_export.h"
-
-namespace content {
-
-// This is the default behavior of Chrome. Currently, WebRTC has the right to
-// enumerate all interfaces and bind them to discover public interfaces.
-CONTENT_EXPORT extern const char kWebRTCIPHandlingDefault[];
-
-// WebRTC should only use the default route used by http. This also exposes the
-// associated default private address. Default route is the route chosen by the
-// OS on a multi-homed endpoint.
-CONTENT_EXPORT extern const char
-    kWebRTCIPHandlingDefaultPublicAndPrivateInterfaces[];
-
-// WebRTC should only use the default route used by http. This doesn't expose
-// any local addresses.
-CONTENT_EXPORT extern const char kWebRTCIPHandlingDefaultPublicInterfaceOnly[];
-
-// WebRTC should only use TCP to contact peers or servers unless the proxy
-// server supports UDP. This doesn't expose any local addresses either.
-CONTENT_EXPORT extern const char kWebRTCIPHandlingDisableNonProxiedUdp[];
-
-}  // namespace content
-
-#endif  // CONTENT_PUBLIC_RENDERER_WEBRTC_IP_HANDLING_POLICY_H_
diff --git a/chromium/content/public/renderer/content_renderer_client.cc b/chromium/content/public/renderer/content_renderer_client.cc
index 98b215e3b1d..ed275b4ab86 100644
--- a/chromium/content/public/renderer/content_renderer_client.cc
+++ b/chromium/content/public/renderer/content_renderer_client.cc
@@ -227,10 +227,6 @@ bool ContentRendererClient::IsIdleMediaSuspendEnabled() {
   return true;
 }
 
-bool ContentRendererClient::SuppressLegacyTLSVersionConsoleMessage() {
-  return false;
-}
-
 std::unique_ptr<URLLoaderThrottleProvider>
 ContentRendererClient::CreateURLLoaderThrottleProvider(
     URLLoaderThrottleProviderType provider_type) {
diff --git a/chromium/content/public/renderer/content_renderer_client.h b/chromium/content/public/renderer/content_renderer_client.h
index 7d53414dfbe..902bd023e6d 100644
--- a/chromium/content/public/renderer/content_renderer_client.h
+++ b/chromium/content/public/renderer/content_renderer_client.h
@@ -141,18 +141,15 @@ class CONTENT_EXPORT ContentRendererClient {
   // Note that |error_html| may be not written to in certain cases
   // (lack of information on the error code) so the caller should take care to
   // initialize it with a safe default before the call.
-  // TODO(dgozman): |ignoring_cache| is always false in these two methods.
   virtual void PrepareErrorPage(content::RenderFrame* render_frame,
                                 const blink::WebURLError& error,
                                 const std::string& http_method,
-                                bool ignoring_cache,
                                 std::string* error_html) {}
 
   virtual void PrepareErrorPageForHttpStatusError(
       content::RenderFrame* render_frame,
       const GURL& unreachable_url,
       const std::string& http_method,
-      bool ignoring_cache,
       int http_status,
       std::string* error_html) {}
 
@@ -327,6 +324,15 @@ class CONTENT_EXPORT ContentRendererClient {
   // function is called from the worker thread.
   virtual void WillInitializeServiceWorkerContextOnWorkerThread() {}
 
+  // Notifies that a service worker context has been created. This function is
+  // called from the worker thread.
+  // |context_proxy| is valid until
+  // WillDestroyServiceWorkerContextOnWorkerThread() is called.
+  virtual void DidInitializeServiceWorkerContextOnWorkerThread(
+      blink::WebServiceWorkerContextProxy* context_proxy,
+      const GURL& service_worker_scope,
+      const GURL& script_url) {}
+
   // Notifies that the main script of a service worker is about to evaluate.
   // This function is called from the worker thread.
   // |context_proxy| is valid until
@@ -385,12 +391,6 @@ class CONTENT_EXPORT ContentRendererClient {
   // suspended after a period of inactivity.
   virtual bool IsIdleMediaSuspendEnabled();
 
-  // Returns true to suppress the warning for deprecated TLS versions.
-  //
-  // This is a workaround for an outdated test server used by Blink tests on
-  // macOS. See https://crbug.com/936515.
-  virtual bool SuppressLegacyTLSVersionConsoleMessage();
-
   // Allows the embedder to return a (possibly null) URLLoaderThrottleProvider
   // for a frame or worker. For frames this is called on the main thread, and
   // for workers it's called on the worker thread.
diff --git a/chromium/content/public/renderer/document_state.cc b/chromium/content/public/renderer/document_state.cc
index 88e4a354459..99929fc3e87 100644
--- a/chromium/content/public/renderer/document_state.cc
+++ b/chromium/content/public/renderer/document_state.cc
@@ -6,28 +6,15 @@
 
 namespace content {
 
-DocumentState::DocumentState()
-    : was_fetched_via_spdy_(false),
-      was_alpn_negotiated_(false),
-      was_alternate_protocol_available_(false),
-      connection_info_(net::HttpResponseInfo::CONNECTION_INFO_UNKNOWN),
-      was_load_data_with_base_url_request_(false),
-      can_load_local_resources_(false) {}
+DocumentState::DocumentState() : was_load_data_with_base_url_request_(false) {}
 
 DocumentState::~DocumentState() {}
 
 std::unique_ptr<DocumentState> DocumentState::Clone() {
   std::unique_ptr<DocumentState> new_document_state(new DocumentState());
-  new_document_state->set_was_fetched_via_spdy(was_fetched_via_spdy_);
-  new_document_state->set_was_alpn_negotiated(was_alpn_negotiated_);
-  new_document_state->set_alpn_negotiated_protocol(alpn_negotiated_protocol_);
-  new_document_state->set_was_alternate_protocol_available(
-      was_alternate_protocol_available_);
-  new_document_state->set_connection_info(connection_info_);
   new_document_state->set_was_load_data_with_base_url_request(
       was_load_data_with_base_url_request_);
   new_document_state->set_data_url(data_url_);
-  new_document_state->set_can_load_local_resources(can_load_local_resources_);
   return new_document_state;
 }
 
diff --git a/chromium/content/public/renderer/document_state.h b/chromium/content/public/renderer/document_state.h
index e8d715be759..c78fba87644 100644
--- a/chromium/content/public/renderer/document_state.h
+++ b/chromium/content/public/renderer/document_state.h
@@ -35,35 +35,6 @@ class CONTENT_EXPORT DocumentState : public blink::WebDocumentLoader::ExtraData,
   // user data is not copied.
   std::unique_ptr<DocumentState> Clone();
 
-  // Indicator if SPDY was used as part of this page load.
-  bool was_fetched_via_spdy() const { return was_fetched_via_spdy_; }
-  void set_was_fetched_via_spdy(bool value) { was_fetched_via_spdy_ = value; }
-
-  bool was_alpn_negotiated() const { return was_alpn_negotiated_; }
-  void set_was_alpn_negotiated(bool value) { was_alpn_negotiated_ = value; }
-
-  const std::string& alpn_negotiated_protocol() const {
-    return alpn_negotiated_protocol_;
-  }
-  void set_alpn_negotiated_protocol(const std::string& value) {
-    alpn_negotiated_protocol_ = value;
-  }
-
-  bool was_alternate_protocol_available() const {
-    return was_alternate_protocol_available_;
-  }
-  void set_was_alternate_protocol_available(bool value) {
-    was_alternate_protocol_available_ = value;
-  }
-
-  net::HttpResponseInfo::ConnectionInfo connection_info() const {
-    return connection_info_;
-  }
-  void set_connection_info(
-      net::HttpResponseInfo::ConnectionInfo connection_info) {
-    connection_info_ = connection_info;
-  }
-
   // For LoadDataWithBaseURL navigations, |was_load_data_with_base_url_request_|
   // is set to true and |data_url_| is set to the data URL of the navigation.
   // Otherwise, |was_load_data_with_base_url_request_| is false and |data_url_|
@@ -81,22 +52,9 @@ class CONTENT_EXPORT DocumentState : public blink::WebDocumentLoader::ExtraData,
     data_url_ = data_url;
   }
 
-  bool can_load_local_resources() const { return can_load_local_resources_; }
-  void set_can_load_local_resources(bool can_load) {
-    can_load_local_resources_ = can_load;
-  }
-
  private:
-  bool was_fetched_via_spdy_;
-  bool was_alpn_negotiated_;
-  std::string alpn_negotiated_protocol_;
-  bool was_alternate_protocol_available_;
-  net::HttpResponseInfo::ConnectionInfo connection_info_;
-
   bool was_load_data_with_base_url_request_;
   GURL data_url_;
-
-  bool can_load_local_resources_;
 };
 
 }  // namespace content
diff --git a/chromium/content/public/renderer/render_frame.h b/chromium/content/public/renderer/render_frame.h
index 188d1ef1b86..4c36a22dbb8 100644
--- a/chromium/content/public/renderer/render_frame.h
+++ b/chromium/content/public/renderer/render_frame.h
@@ -20,26 +20,28 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
-#include "third_party/blink/public/common/loader/url_loader_factory_bundle.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/mojom/devtools/console_message.mojom.h"
 #include "third_party/blink/public/mojom/frame/document_interface_broker.mojom.h"
 #include "third_party/blink/public/platform/task_type.h"
 #include "third_party/blink/public/web/web_navigation_policy.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "ui/accessibility/ax_mode.h"
 
 namespace blink {
 class AssociatedInterfaceProvider;
 class AssociatedInterfaceRegistry;
 class BrowserInterfaceBrokerProxy;
+class WebElement;
 class WebFrame;
 class WebLocalFrame;
 class WebPlugin;
 struct WebPluginParams;
+struct WebRect;
 }
 
 namespace gfx {
 class Range;
+class RectF;
 class Size;
 }
 
@@ -142,6 +144,9 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   // menu is closed.
   virtual void CancelContextMenu(int request_id) = 0;
 
+  // Issues a request to show the virtual keyboard.
+  virtual void ShowVirtualKeyboard() = 0;
+
   // Create a new Pepper plugin depending on |info|. Returns NULL if no plugin
   // was found. |throttler| may be empty.
   virtual blink::WebPlugin* CreatePlugin(
@@ -244,20 +249,10 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
                                size_t offset,
                                const gfx::Range& range) = 0;
 
-  // Notifies the frame's RenderView that the zoom has changed.
-  virtual void SetZoomLevel(double zoom_level) = 0;
-
-  // Returns the page's zoom level from the frame's RenderView.
-  virtual double GetZoomLevel() = 0;
-
   // Adds |message| to the DevTools console.
   virtual void AddMessageToConsole(blink::mojom::ConsoleMessageLevel level,
                                    const std::string& message) = 0;
 
-  // Sets the PreviewsState of this frame, a bitmask of potentially several
-  // Previews optimizations.
-  virtual void SetPreviewsState(PreviewsState previews_state) = 0;
-
   // Returns the PreviewsState of this frame, a bitmask of potentially several
   // Previews optimizations.
   virtual PreviewsState GetPreviewsState() = 0;
@@ -302,16 +297,6 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   virtual void SetRenderFrameMediaPlaybackOptions(
       const RenderFrameMediaPlaybackOptions& opts) = 0;
 
-  // Requests that fetches initiated by |initiator_origin| should go through the
-  // provided |url_loader_factory|.  This method should be called before
-  // executing scripts in a isolated world - such scripts are typically
-  // associated with a security origin different from the main world (and
-  // therefore fetches from such scripts set |request_initiator| that is
-  // incompatible with |request_initiator_site_lock|.
-  virtual void MarkInitiatorAsRequiringSeparateURLLoaderFactory(
-      const url::Origin& initiator_origin,
-      network::mojom::URLLoaderFactoryPtr url_loader_factory) = 0;
-
   // Synchronously performs the complete set of document lifecycle phases,
   // including updates to the compositor state and rasterization, then sending
   // a frame to the viz display compositor. Does nothing if RenderFrame is not
@@ -321,6 +306,20 @@ class CONTENT_EXPORT RenderFrame : public IPC::Listener,
   // Sets that cross browsing instance frame lookup is allowed.
   virtual void SetAllowsCrossBrowsingInstanceFrameLookup() = 0;
 
+  // Returns the bounds of |element| in Window coordinates which are device
+  // scale independent. The bounds have been adjusted to include any
+  // transformations, including page scale. This function will update the layout
+  // if required.
+  virtual gfx::RectF ElementBoundsInWindow(
+      const blink::WebElement& element) = 0;
+
+  // Converts the |rect| to Window coordinates which are device scale
+  // independent.
+  virtual void ConvertViewportToWindow(blink::WebRect* rect) = 0;
+
+  // Returns the device scale factor of the display the render frame is in.
+  virtual float GetDeviceScaleFactor() = 0;
+
  protected:
   ~RenderFrame() override {}
 
diff --git a/chromium/content/public/renderer/render_frame_observer.h b/chromium/content/public/renderer/render_frame_observer.h
index 1f486813222..f764efa250c 100644
--- a/chromium/content/public/renderer/render_frame_observer.h
+++ b/chromium/content/public/renderer/render_frame_observer.h
@@ -18,10 +18,10 @@
 #include "ipc/ipc_sender.h"
 #include "mojo/public/cpp/bindings/scoped_interface_endpoint_handle.h"
 #include "mojo/public/cpp/system/message_pipe.h"
+#include "third_party/blink/public/common/loader/loading_behavior_flag.h"
 #include "third_party/blink/public/mojom/use_counter/css_property_id.mojom.h"
 #include "third_party/blink/public/mojom/web_client_hints/web_client_hints_types.mojom.h"
 #include "third_party/blink/public/mojom/web_feature/web_feature.mojom.h"
-#include "third_party/blink/public/platform/web_loading_behavior_flag.h"
 #include "third_party/blink/public/platform/web_vector.h"
 #include "third_party/blink/public/web/web_local_frame_client.h"
 #include "third_party/blink/public/web/web_meaningful_layout.h"
@@ -37,7 +37,6 @@ class WebDocumentLoader;
 class WebElement;
 class WebFormElement;
 class WebString;
-struct WebURLError;
 class WebWorkerFetchContext;
 }
 
@@ -72,14 +71,12 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
   virtual void WasHidden() {}
   virtual void WasShown() {}
 
-  // Called when associated widget is about to close.
-  virtual void WidgetWillClose() {}
-
   // Navigation callbacks.
   //
   // Each navigation starts with a DidStartNavigation call. Then it may be
   // followed by a ReadyToCommitNavigation (if the navigation has succeeded),
   // and should always end with a DidFinishNavigation.
+  // TODO(dgozman): ReadyToCommitNavigation will be removed soon.
   //
   // Unfortunately, this is currently a mess. For example, some started
   // navigations which did not commit won't receive any further notifications.
@@ -98,8 +95,11 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
       const GURL& url,
       base::Optional<blink::WebNavigationType> navigation_type) {}
 
-  // Called when a navigation is about to be committed and |document_loader|
+  // Called when a navigation has just committed and |document_loader|
   // will start loading a new document in the RenderFrame.
+  // TODO(dgozman): the name does not match functionality anymore, we should
+  // merge this with DidCommitProvisionalLoad, which will become
+  // DidFinishNavigation.
   virtual void ReadyToCommitNavigation(
       blink::WebDocumentLoader* document_loader) {}
 
@@ -109,7 +109,7 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
   // TODO(dgozman): replace next two methods with DidFinishNavigation.
   virtual void DidCommitProvisionalLoad(bool is_same_document_navigation,
                                         ui::PageTransition transition) {}
-  virtual void DidFailProvisionalLoad(const blink::WebURLError& error) {}
+  virtual void DidFailProvisionalLoad() {}
   virtual void DidFinishLoad() {}
   virtual void DidFinishDocumentLoad() {}
   virtual void DidHandleOnloadEvents() {}
@@ -158,8 +158,7 @@ class CONTENT_EXPORT RenderFrameObserver : public IPC::Listener,
 
   // Notification when the renderer uses a particular code path during a page
   // load. This is used for metrics collection.
-  virtual void DidObserveLoadingBehavior(
-      blink::WebLoadingBehaviorFlag behavior) {}
+  virtual void DidObserveLoadingBehavior(blink::LoadingBehaviorFlag behavior) {}
 
   // Notification when the renderer observes a new use counter usage during a
   // page load. This is used for UseCounter metrics.
diff --git a/chromium/content/public/renderer/render_view.h b/chromium/content/public/renderer/render_view.h
index b454d8a8753..5b3528dc173 100644
--- a/chromium/content/public/renderer/render_view.h
+++ b/chromium/content/public/renderer/render_view.h
@@ -12,21 +12,13 @@
 #include "base/strings/string16.h"
 #include "build/build_config.h"
 #include "content/common/content_export.h"
-#include "content/public/common/browser_controls_state.h"
 #include "ipc/ipc_sender.h"
-#include "ui/gfx/geometry/rect_f.h"
 #include "ui/gfx/native_widget_types.h"
 
 namespace blink {
-class WebElement;
 class WebView;
-struct WebRect;
 }  // namespace blink
 
-namespace gfx {
-class Size;
-}
-
 namespace content {
 
 class RenderFrame;
@@ -63,12 +55,6 @@ class CONTENT_EXPORT RenderView : public IPC::Sender {
   // Get the routing ID of the view.
   virtual int GetRoutingID() = 0;
 
-  // Returns the size of the view.
-  virtual gfx::Size GetSize() = 0;
-
-  // Returns the device scale factor of the display the render view is in.
-  virtual float GetDeviceScaleFactor() = 0;
-
   // Returns the page's zoom level for the render view.
   virtual float GetZoomLevel() = 0;
 
@@ -98,20 +84,6 @@ class CONTENT_EXPORT RenderView : public IPC::Sender {
   // Returns |renderer_preferences_.accept_languages| value.
   virtual const std::string& GetAcceptLanguages() = 0;
 
-  virtual void UpdateBrowserControlsState(BrowserControlsState constraints,
-                                          BrowserControlsState current,
-                                          bool animate) = 0;
-
-  // Converts the |rect| from Viewport coordinates to Window coordinates.
-  // See blink::WebWidgetClient::convertViewportToWindow for more details.
-  virtual void ConvertViewportToWindowViaWidget(blink::WebRect* rect) = 0;
-
-  // Returns the bounds of |element| in Window coordinates. The bounds have been
-  // adjusted to include any transformations, including page scale.
-  // This function will update the layout if required.
-  virtual gfx::RectF ElementBoundsInWindow(const blink::WebElement& element)
-      = 0;
-
  protected:
   ~RenderView() override {}
 
diff --git a/chromium/content/public/renderer/request_peer.h b/chromium/content/public/renderer/request_peer.h
index a7c31160036..c46104057ca 100644
--- a/chromium/content/public/renderer/request_peer.h
+++ b/chromium/content/public/renderer/request_peer.h
@@ -14,13 +14,13 @@
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/base/big_buffer.h"
 #include "mojo/public/cpp/system/data_pipe.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 
 namespace net {
 struct RedirectInfo;
 }
 
 namespace network {
-struct ResourceResponseInfo;
 struct URLLoaderCompletionStatus;
 }
 
@@ -40,17 +40,15 @@ class CONTENT_EXPORT RequestPeer {
   virtual void OnUploadProgress(uint64_t position, uint64_t size) = 0;
 
   // Called when a redirect occurs.  The implementation may return false to
-  // suppress the redirect.  The ResourceResponseInfo provides information about
+  // suppress the redirect.  The URLResponseHead provides information about
   // the redirect response and the RedirectInfo includes information about the
   // request to be made if the method returns true.
-  virtual bool OnReceivedRedirect(
-      const net::RedirectInfo& redirect_info,
-      const network::ResourceResponseInfo& info) = 0;
+  virtual bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
+                                  network::mojom::URLResponseHeadPtr head) = 0;
 
   // Called when response headers are available (after all redirects have
   // been followed).
-  virtual void OnReceivedResponse(
-      const network::ResourceResponseInfo& info) = 0;
+  virtual void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) = 0;
 
   // Called when the response body becomes available.
   virtual void OnStartLoadingResponseBody(
diff --git a/chromium/content/public/test/android/BUILD.gn b/chromium/content/public/test/android/BUILD.gn
index 705e84b9ed0..d2a6025eaee 100644
--- a/chromium/content/public/test/android/BUILD.gn
+++ b/chromium/content/public/test/android/BUILD.gn
@@ -2,6 +2,7 @@ import("//build/config/android/config.gni")
 import("//build/config/android/rules.gni")
 
 generate_jni("test_support_content_jni_headers") {
+  testonly = true
   sources = [
     "javatests/src/org/chromium/content_public/browser/test/NestedSystemMessageHandler.java",
   ]
@@ -37,6 +38,7 @@ android_library("content_java_test_support") {
     "javatests/src/org/chromium/content_public/browser/test/mock/MockNavigationController.java",
     "javatests/src/org/chromium/content_public/browser/test/mock/MockRenderFrameHost.java",
     "javatests/src/org/chromium/content_public/browser/test/mock/MockWebContents.java",
+    "javatests/src/org/chromium/content_public/browser/test/util/BackgroundSyncNetworkUtils.java",
     "javatests/src/org/chromium/content_public/browser/test/util/ClickUtils.java",
     "javatests/src/org/chromium/content_public/browser/test/util/Coordinates.java",
     "javatests/src/org/chromium/content_public/browser/test/util/Criteria.java",
diff --git a/chromium/content/renderer/BUILD.gn b/chromium/content/renderer/BUILD.gn
index 453b45b0844..4a3583edc48 100644
--- a/chromium/content/renderer/BUILD.gn
+++ b/chromium/content/renderer/BUILD.gn
@@ -6,7 +6,6 @@ import("//build/config/chromecast_build.gni")
 import("//build/config/features.gni")
 import("//build/config/jumbo.gni")
 import("//build/config/ui.gni")
-import("//build/split_static_library.gni")
 import("//content/common/features.gni")
 import("//media/media_options.gni")
 import("//ppapi/buildflags/buildflags.gni")
@@ -17,7 +16,7 @@ import("//tools/ipc_fuzzer/ipc_fuzzer.gni")
 if (is_component_build) {
   link_target_type = "jumbo_source_set"
 } else {
-  link_target_type = "jumbo_split_static_library"
+  link_target_type = "jumbo_static_library"
 }
 
 target(link_target_type, "renderer") {
@@ -200,34 +199,10 @@ target(link_target_type, "renderer") {
     "media/renderer_webmediaplayer_delegate.h",
     "media/webrtc/media_stream_track_metrics.cc",
     "media/webrtc/media_stream_track_metrics.h",
-    "media/webrtc/media_stream_video_webrtc_sink.cc",
-    "media/webrtc/media_stream_video_webrtc_sink.h",
-    "media/webrtc/peer_connection_dependency_factory.cc",
-    "media/webrtc/peer_connection_dependency_factory.h",
     "media/webrtc/peer_connection_tracker.cc",
     "media/webrtc/peer_connection_tracker.h",
-    "media/webrtc/rtc_certificate_generator.cc",
-    "media/webrtc/rtc_certificate_generator.h",
     "media/webrtc/rtc_peer_connection_handler.cc",
     "media/webrtc/rtc_peer_connection_handler.h",
-    "media/webrtc/rtc_rtp_receiver.cc",
-    "media/webrtc/rtc_rtp_receiver.h",
-    "media/webrtc/rtc_rtp_sender.cc",
-    "media/webrtc/rtc_rtp_sender.h",
-    "media/webrtc/rtc_rtp_transceiver.cc",
-    "media/webrtc/rtc_rtp_transceiver.h",
-    "media/webrtc/stun_field_trial.cc",
-    "media/webrtc/stun_field_trial.h",
-    "media/webrtc/transceiver_state_surfacer.cc",
-    "media/webrtc/transceiver_state_surfacer.h",
-    "media/webrtc/transmission_encoding_info_handler.cc",
-    "media/webrtc/transmission_encoding_info_handler.h",
-    "media/webrtc/video_codec_factory.cc",
-    "media/webrtc/video_codec_factory.h",
-    "media/webrtc/webrtc_media_stream_track_adapter.cc",
-    "media/webrtc/webrtc_media_stream_track_adapter.h",
-    "media/webrtc/webrtc_media_stream_track_adapter_map.cc",
-    "media/webrtc/webrtc_media_stream_track_adapter_map.h",
     "media/webrtc/webrtc_set_description_observer.cc",
     "media/webrtc/webrtc_set_description_observer.h",
     "menu_item_builder.cc",
@@ -244,30 +219,6 @@ target(link_target_type, "renderer") {
     "navigation_state.h",
     "net_info_helper.cc",
     "net_info_helper.h",
-    "p2p/empty_network_manager.cc",
-    "p2p/empty_network_manager.h",
-    "p2p/filtering_network_manager.cc",
-    "p2p/filtering_network_manager.h",
-    "p2p/host_address_request.cc",
-    "p2p/host_address_request.h",
-    "p2p/ipc_network_manager.cc",
-    "p2p/ipc_network_manager.h",
-    "p2p/ipc_socket_factory.cc",
-    "p2p/ipc_socket_factory.h",
-    "p2p/mdns_responder_adapter.cc",
-    "p2p/mdns_responder_adapter.h",
-    "p2p/network_list_manager.h",
-    "p2p/network_list_observer.h",
-    "p2p/network_manager_uma.cc",
-    "p2p/network_manager_uma.h",
-    "p2p/port_allocator.cc",
-    "p2p/port_allocator.h",
-    "p2p/socket_client.h",
-    "p2p/socket_client_delegate.h",
-    "p2p/socket_client_impl.cc",
-    "p2p/socket_client_impl.h",
-    "p2p/socket_dispatcher.cc",
-    "p2p/socket_dispatcher.h",
     "peripheral_content_heuristic.cc",
     "peripheral_content_heuristic.h",
     "queue_message_swap_promise.cc",
@@ -356,6 +307,8 @@ target(link_target_type, "renderer") {
     "worker/dedicated_worker_host_factory_client.h",
     "worker/embedded_shared_worker_stub.cc",
     "worker/embedded_shared_worker_stub.h",
+    "worker/fetch_client_settings_object_helpers.cc",
+    "worker/fetch_client_settings_object_helpers.h",
     "worker/shared_worker_factory_impl.cc",
     "worker/shared_worker_factory_impl.h",
     "worker/worker_thread_registry.cc",
@@ -369,15 +322,6 @@ target(link_target_type, "renderer") {
     ]
   }
 
-  if (!is_component_build) {
-    if (is_win && is_official_build) {
-      split_count = 2  # In certain configurations a full renderer.lib can
-                       # be 2+ GB which breaks some Windows tools.
-    } else {
-      split_count = 1
-    }
-  }
-
   configs += [
     "//content:content_implementation",
     "//build/config/compiler:no_size_t_to_int_warning",
@@ -406,7 +350,6 @@ target(link_target_type, "renderer") {
     "//components/viz/common",
     "//components/viz/service",
     "//content:resources",
-    "//content/app/strings:strings_grit",
     "//content/child",
     "//content/common",
     "//content/common:buildflags",
@@ -423,7 +366,6 @@ target(link_target_type, "renderer") {
     "//gpu/command_buffer/client:gles2_interface",
     "//gpu/command_buffer/client:raster_interface",
     "//gpu/command_buffer/client:webgpu_interface",
-    "//jingle:webrtc_glue",
     "//media",
     "//media:media_buildflags",
     "//media/blink",
@@ -461,6 +403,7 @@ target(link_target_type, "renderer") {
     "//third_party/blink/public:blink",
     "//third_party/blink/public:buildflags",
     "//third_party/blink/public/common",
+    "//third_party/blink/public/strings:strings_grit",
     "//third_party/boringssl",
     "//third_party/icu",
     "//third_party/libyuv",
@@ -468,13 +411,15 @@ target(link_target_type, "renderer") {
     "//third_party/webrtc/api:callfactory_api",
     "//third_party/webrtc/api:libjingle_logging_api",
     "//third_party/webrtc/api:libjingle_peerconnection_api",
+    "//third_party/webrtc/api:media_stream_interface",
+    "//third_party/webrtc/api:packet_socket_factory",
+    "//third_party/webrtc/api:rtc_error",
     "//third_party/webrtc/api:rtc_stats_api",
     "//third_party/webrtc/api:scoped_refptr",
     "//third_party/webrtc/api/audio:aec3_config",
     "//third_party/webrtc/api/audio:aec3_config_json",
     "//third_party/webrtc/api/audio:aec3_factory",
     "//third_party/webrtc/api/audio_codecs:audio_codecs_api",
-    "//third_party/webrtc/api/rtc_event_log:rtc_event_log_factory",
     "//third_party/webrtc/api/video:video_bitrate_allocation",
     "//third_party/webrtc/api/video:video_frame",
     "//third_party/webrtc/api/video:video_frame_i420",
@@ -483,7 +428,6 @@ target(link_target_type, "renderer") {
     "//third_party/webrtc/api/video_codecs:video_codecs_api",
     "//third_party/webrtc/common_video:common_video",
     "//third_party/webrtc/media:rtc_audio_video",
-    "//third_party/webrtc/media:rtc_internal_video_codecs",
     "//third_party/webrtc/media:rtc_media",
     "//third_party/webrtc/media:rtc_media_base",
     "//third_party/webrtc/media:rtc_simulcast_encoder_adapter",
@@ -493,7 +437,6 @@ target(link_target_type, "renderer") {
     "//third_party/webrtc/modules/audio_processing:api",
     "//third_party/webrtc/modules/audio_processing:audio_processing_statistics",
     "//third_party/webrtc/modules/audio_processing/aec_dump",
-    "//third_party/webrtc/modules/video_coding:webrtc_h264",
     "//third_party/webrtc/p2p:libstunprober",
     "//third_party/webrtc/p2p:rtc_p2p",
     "//third_party/webrtc/pc:libjingle_peerconnection",
@@ -506,13 +449,10 @@ target(link_target_type, "renderer") {
     "//third_party/webrtc/rtc_base:socket_address",
     "//third_party/webrtc/rtc_base:threading",
     "//third_party/webrtc/rtc_base:timeutils",
-
-    # TODO(titovartem) remove dependency on WebRTC internals.
     "//third_party/webrtc/rtc_base/third_party/sigslot:sigslot",
     "//third_party/webrtc/stats",
     "//third_party/webrtc/system_wrappers",
     "//third_party/webrtc_overrides:init_webrtc",
-    "//third_party/webrtc_overrides:task_queue_factory",
     "//third_party/widevine/cdm:headers",
     "//ui/accessibility",
     "//ui/base",
@@ -587,7 +527,7 @@ target(link_target_type, "renderer") {
       "renderer_main_platform_delegate_fuchsia.cc",
     ]
 
-    deps += [ "//media/fuchsia/cdm" ]
+    deps += [ "//media/fuchsia/cdm/client" ]
   }
 
   if (enable_media_remoting) {
@@ -671,8 +611,6 @@ target(link_target_type, "renderer") {
       "pepper/pepper_platform_video_capture.h",
       "pepper/pepper_plugin_instance_impl.cc",
       "pepper/pepper_plugin_instance_impl.h",
-      "pepper/pepper_plugin_instance_metrics.cc",
-      "pepper/pepper_plugin_instance_metrics.h",
       "pepper/pepper_plugin_registry.cc",
       "pepper/pepper_plugin_registry.h",
       "pepper/pepper_proxy_channel_delegate_impl.cc",
diff --git a/chromium/content/renderer/accessibility/ax_image_annotator.cc b/chromium/content/renderer/accessibility/ax_image_annotator.cc
index cc95c6cc54a..a5b7e079568 100644
--- a/chromium/content/renderer/accessibility/ax_image_annotator.cc
+++ b/chromium/content/renderer/accessibility/ax_image_annotator.cc
@@ -12,10 +12,10 @@
 #include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/utf_string_conversions.h"
-#include "content/app/strings/grit/content_strings.h"
 #include "content/public/common/content_client.h"
 #include "content/renderer/render_frame_impl.h"
 #include "crypto/sha2.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "third_party/blink/public/web/web_ax_object.h"
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/public/web/web_element.h"
@@ -197,9 +197,9 @@ AXImageAnnotator::ImageInfo::ImageInfo(const blink::WebAXObject& image)
 
 AXImageAnnotator::ImageInfo::~ImageInfo() = default;
 
-image_annotation::mojom::ImageProcessorPtr
+mojo::PendingRemote<image_annotation::mojom::ImageProcessor>
 AXImageAnnotator::ImageInfo::GetImageProcessor() {
-  return image_processor_.GetPtr();
+  return image_processor_.GetPendingRemote();
 }
 
 bool AXImageAnnotator::ImageInfo::HasAnnotation() const {
diff --git a/chromium/content/renderer/accessibility/ax_image_annotator.h b/chromium/content/renderer/accessibility/ax_image_annotator.h
index 264316d3df3..7f53380dc7d 100644
--- a/chromium/content/renderer/accessibility/ax_image_annotator.h
+++ b/chromium/content/renderer/accessibility/ax_image_annotator.h
@@ -15,6 +15,7 @@
 #include "base/optional.h"
 #include "content/common/content_export.h"
 #include "content/renderer/accessibility/render_accessibility_impl.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "services/image_annotation/public/cpp/image_processor.h"
 #include "services/image_annotation/public/mojom/image_annotation.mojom.h"
@@ -66,7 +67,8 @@ class CONTENT_EXPORT AXImageAnnotator : public base::CheckedObserver {
     ImageInfo(const blink::WebAXObject& image);
     virtual ~ImageInfo();
 
-    image_annotation::mojom::ImageProcessorPtr GetImageProcessor();
+    mojo::PendingRemote<image_annotation::mojom::ImageProcessor>
+    GetImageProcessor();
     bool HasAnnotation() const;
 
     ax::mojom::ImageAnnotationStatus status() const { return status_; }
diff --git a/chromium/content/renderer/accessibility/blink_ax_tree_source.cc b/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
index 9135655ceaf..7b1b8aa77e9 100644
--- a/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/chromium/content/renderer/accessibility/blink_ax_tree_source.cc
@@ -274,6 +274,8 @@ std::string GetEquivalentAriaRoleString(const ax::mojom::Role role) {
       return "figure";
     case ax::mojom::Role::kFooter:
       return "contentinfo";
+    case ax::mojom::Role::kHeader:
+      return "banner";
     case ax::mojom::Role::kHeading:
       return "heading";
     case ax::mojom::Role::kImage:
@@ -286,6 +288,9 @@ std::string GetEquivalentAriaRoleString(const ax::mojom::Role role) {
       return "radio";
     case ax::mojom::Role::kRegion:
       return "region";
+    case ax::mojom::Role::kSection:
+      // A <section> element uses the 'region' ARIA role mapping.
+      return "region";
     case ax::mojom::Role::kSlider:
       return "slider";
     case ax::mojom::Role::kTime:
@@ -803,10 +808,10 @@ void BlinkAXTreeSource::SerializeNode(WebAXObject src,
                                     src.AccessKey().Utf8());
     }
 
-    if (src.AriaAutoComplete().length()) {
+    if (src.AutoComplete().length()) {
       TruncateAndAddStringAttribute(dst,
                                     ax::mojom::StringAttribute::kAutoComplete,
-                                    src.AriaAutoComplete().Utf8());
+                                    src.AutoComplete().Utf8());
     }
 
     if (src.Action() != ax::mojom::DefaultActionVerb::kNone) {
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl.cc b/chromium/content/renderer/accessibility/render_accessibility_impl.cc
index 85475ee5c59..c864d406085 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl.cc
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl.cc
@@ -1127,7 +1127,7 @@ void RenderAccessibilityImpl::Scroll(const ui::AXActionTarget* target,
 void RenderAccessibilityImpl::RecordImageMetrics(AXContentTreeUpdate* update) {
   if (!render_frame_->accessibility_mode().has_mode(ui::AXMode::kScreenReader))
     return;
-  float scale_factor = render_frame_->GetRenderView()->GetDeviceScaleFactor();
+  float scale_factor = render_frame_->GetDeviceScaleFactor();
   for (size_t i = 0; i < update->nodes.size(); ++i) {
     ui::AXNodeData& node_data = update->nodes[i];
     if (node_data.role != ax::mojom::Role::kImage)
@@ -1139,7 +1139,7 @@ void RenderAccessibilityImpl::RecordImageMetrics(AXContentTreeUpdate* update) {
       continue;
     // We log the min size in a histogram with a max of 10000, so set a ceiling
     // of 10000 on min_size.
-    int min_size = std::min(std::min(width, height), 10000);
+    int min_size = std::min({width, height, 10000});
     int max_size = std::max(width, height);
     // The ratio is always the smaller divided by the larger so as not to go
     // over 100%.
diff --git a/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc b/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
index bcd72257dc7..147edceadb1 100644
--- a/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
+++ b/chromium/content/renderer/accessibility/render_accessibility_impl_browsertest.cc
@@ -26,6 +26,7 @@
 #include "content/renderer/accessibility/ax_image_annotator.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_view_impl.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "ppapi/c/private/ppp_pdf.h"
@@ -107,13 +108,17 @@ class MockAnnotationService : public image_annotation::mojom::Annotator {
     return remote;
   }
 
-  void AnnotateImage(const std::string& image_id,
-                     const std::string& /* description_language_tag */,
-                     image_annotation::mojom::ImageProcessorPtr image_processor,
-                     AnnotateImageCallback callback) override {
+  void AnnotateImage(
+      const std::string& image_id,
+      const std::string& /* description_language_tag */,
+      mojo::PendingRemote<image_annotation::mojom::ImageProcessor>
+          image_processor,
+      AnnotateImageCallback callback) override {
     image_ids_.push_back(image_id);
-    image_processors_.push_back(std::move(image_processor));
-    image_processors_.back().set_connection_error_handler(
+    image_processors_.push_back(
+        mojo::Remote<image_annotation::mojom::ImageProcessor>(
+            std::move(image_processor)));
+    image_processors_.back().set_disconnect_handler(
         base::BindOnce(&MockAnnotationService::ResetImageProcessor,
                        base::Unretained(this), image_processors_.size() - 1));
     callbacks_.push_back(std::move(callback));
@@ -121,7 +126,8 @@ class MockAnnotationService : public image_annotation::mojom::Annotator {
 
   // Tests should not delete entries in these lists.
   std::vector<std::string> image_ids_;
-  std::vector<image_annotation::mojom::ImageProcessorPtr> image_processors_;
+  std::vector<mojo::Remote<image_annotation::mojom::ImageProcessor>>
+      image_processors_;
   std::vector<AnnotateImageCallback> callbacks_;
 
  private:
diff --git a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
index 2d7b8e0cf7a..2375484e80a 100644
--- a/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
+++ b/chromium/content/renderer/android/synchronous_layer_tree_frame_sink.cc
@@ -361,6 +361,13 @@ void SynchronousLayerTreeFrameSink::SubmitCompositorFrame(
         root_local_surface_id_allocation_.local_surface_id(),
         std::move(embed_frame));
     display_->DrawAndSwap();
+
+    // We don't track metrics for frames submitted to |display_| but it still
+    // expects that every frame will receive a swap ack and presentation
+    // feedback so we send null signals here.
+    display_->DidReceiveSwapBuffersAck(gfx::SwapTimings());
+    display_->DidReceivePresentationFeedback(
+        gfx::PresentationFeedback::Failure());
   } else {
     // For hardware draws we send the whole frame to the client so it can draw
     // the content in it.
@@ -561,10 +568,8 @@ void SynchronousLayerTreeFrameSink::DidPresentCompositorFrame(
     const viz::FrameTimingDetailsMap& timing_details) {
   if (!client_)
     return;
-  for (const auto& pair : timing_details) {
-    client_->DidPresentCompositorFrame(pair.first,
-                                       pair.second.presentation_feedback);
-  }
+  for (const auto& pair : timing_details)
+    client_->DidPresentCompositorFrame(pair.first, pair.second);
 }
 
 void SynchronousLayerTreeFrameSink::BeginFrame(
diff --git a/chromium/content/renderer/browser_plugin/browser_plugin.cc b/chromium/content/renderer/browser_plugin/browser_plugin.cc
index 45e93abee2e..3505d051f11 100644
--- a/chromium/content/renderer/browser_plugin/browser_plugin.cc
+++ b/chromium/content/renderer/browser_plugin/browser_plugin.cc
@@ -91,7 +91,9 @@ BrowserPlugin::BrowserPlugin(
       browser_plugin_instance_id_(browser_plugin::kInstanceIDNone),
       delegate_(delegate),
       task_runner_(
-          render_frame->GetTaskRunner(blink::TaskType::kInternalDefault)) {
+          // Make sure BrowserPlugin::UpdateInternalInstanceId runs in FIFO
+          // order with respect to other loading tasks.
+          render_frame->GetTaskRunner(blink::TaskType::kInternalLoading)) {
   browser_plugin_instance_id_ =
       BrowserPluginManager::Get()->GetNextInstanceID();
 
diff --git a/chromium/content/renderer/browser_render_view_browsertest.cc b/chromium/content/renderer/browser_render_view_browsertest.cc
index 6cda730f2a0..28e0505c030 100644
--- a/chromium/content/renderer/browser_render_view_browsertest.cc
+++ b/chromium/content/renderer/browser_render_view_browsertest.cc
@@ -57,7 +57,6 @@ class TestShellContentRendererClient : public ShellContentRendererClient {
   void PrepareErrorPage(content::RenderFrame* render_frame,
                         const blink::WebURLError& error,
                         const std::string& http_method,
-                        bool ignoring_cache,
                         std::string* error_html) override {
     if (error_html)
       *error_html = "A suffusion of yellow.";
diff --git a/chromium/content/renderer/compositor/compositor_dependencies.h b/chromium/content/renderer/compositor/compositor_dependencies.h
index a2f87fc2383..021df9fb4d2 100644
--- a/chromium/content/renderer/compositor/compositor_dependencies.h
+++ b/chromium/content/renderer/compositor/compositor_dependencies.h
@@ -12,6 +12,8 @@
 #include "components/viz/common/display/renderer_settings.h"
 #include "content/common/content_export.h"
 #include "content/common/render_frame_metadata.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 
 class GURL;
 
@@ -33,6 +35,7 @@ class WebThreadScheduler;
 
 namespace content {
 class FrameSwapMessageQueue;
+class RenderWidget;
 
 class CONTENT_EXPORT CompositorDependencies {
  public:
@@ -50,6 +53,8 @@ class CONTENT_EXPORT CompositorDependencies {
   // compositor thread).
   virtual scoped_refptr<base::SingleThreadTaskRunner>
   GetCompositorImplThreadTaskRunner() = 0;
+  virtual scoped_refptr<base::SingleThreadTaskRunner>
+  GetCleanupTaskRunner() = 0;
   virtual blink::scheduler::WebThreadScheduler* GetWebMainThreadScheduler() = 0;
   virtual cc::TaskGraphRunner* GetTaskGraphRunner() = 0;
   virtual bool IsScrollAnimatorEnabled() = 0;
@@ -59,13 +64,14 @@ class CONTENT_EXPORT CompositorDependencies {
   using LayerTreeFrameSinkCallback =
       base::OnceCallback<void(std::unique_ptr<cc::LayerTreeFrameSink>)>;
   virtual void RequestNewLayerTreeFrameSink(
-      int widget_routing_id,
+      RenderWidget* render_widget,
       scoped_refptr<FrameSwapMessageQueue> frame_swap_message_queue,
       const GURL& url,
       LayerTreeFrameSinkCallback callback,
-      mojom::RenderFrameMetadataObserverClientRequest
-          render_frame_metadata_observer_client_request,
-      mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer_ptr,
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+          render_frame_metadata_observer_client_receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+          render_frame_metadata_observer_remote,
       const char* client_name) = 0;
 
 #ifdef OS_ANDROID
diff --git a/chromium/content/renderer/compositor/layer_tree_view.cc b/chromium/content/renderer/compositor/layer_tree_view.cc
index bf6db8073d3..948e694b8da 100644
--- a/chromium/content/renderer/compositor/layer_tree_view.cc
+++ b/chromium/content/renderer/compositor/layer_tree_view.cc
@@ -27,7 +27,6 @@
 #include "cc/debug/layer_tree_debug_state.h"
 #include "cc/input/layer_selection_bound.h"
 #include "cc/layers/layer.h"
-#include "cc/trees/latency_info_swap_promise_monitor.h"
 #include "cc/trees/layer_tree_host.h"
 #include "cc/trees/layer_tree_mutator.h"
 #include "cc/trees/render_frame_metadata_observer.h"
@@ -59,22 +58,24 @@ LayerTreeView::LayerTreeView(
     scoped_refptr<base::SingleThreadTaskRunner> compositor_thread,
     cc::TaskGraphRunner* task_graph_runner,
     blink::scheduler::WebThreadScheduler* scheduler)
-    : delegate_(delegate),
-      main_thread_(std::move(main_thread)),
+    : main_thread_(std::move(main_thread)),
       compositor_thread_(std::move(compositor_thread)),
       task_graph_runner_(task_graph_runner),
       web_main_thread_scheduler_(scheduler),
-      animation_host_(cc::AnimationHost::CreateMainInstance()) {}
+      animation_host_(cc::AnimationHost::CreateMainInstance()),
+      delegate_(delegate) {}
 
 LayerTreeView::~LayerTreeView() = default;
 
 void LayerTreeView::Initialize(
     const cc::LayerTreeSettings& settings,
     std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory) {
+  DCHECK(delegate_);
   const bool is_threaded = !!compositor_thread_;
 
   cc::LayerTreeHost::InitParams params;
   params.client = this;
+  params.scheduling_client = this;
   params.settings = &settings;
   params.task_graph_runner = task_graph_runner_;
   params.main_task_runner = main_thread_;
@@ -99,90 +100,26 @@ void LayerTreeView::Initialize(
   }
 }
 
+void LayerTreeView::Disconnect() {
+  DCHECK(delegate_);
+  // Drop compositor resources immediately, while keeping the compositor alive
+  // until after this class is destroyed.
+  layer_tree_host_->SetVisible(false);
+  layer_tree_host_->ReleaseLayerTreeFrameSink();
+  delegate_ = nullptr;
+}
+
 void LayerTreeView::SetVisible(bool visible) {
+  DCHECK(delegate_);
   layer_tree_host_->SetVisible(visible);
 
   if (visible && layer_tree_frame_sink_request_failed_while_invisible_)
     DidFailToInitializeLayerTreeFrameSink();
 }
 
-const base::WeakPtr<cc::InputHandler>& LayerTreeView::GetInputHandler() {
-  return layer_tree_host_->GetInputHandler();
-}
-
-void LayerTreeView::SetNeedsDisplayOnAllLayers() {
-  layer_tree_host_->SetNeedsDisplayOnAllLayers();
-}
-
-void LayerTreeView::SetRasterizeOnlyVisibleContent() {
-  cc::LayerTreeDebugState current = layer_tree_host_->GetDebugState();
-  current.rasterize_only_visible_content = true;
-  layer_tree_host_->SetDebugState(current);
-}
-
-void LayerTreeView::SetNeedsRedrawRect(gfx::Rect damage_rect) {
-  layer_tree_host_->SetNeedsRedrawRect(damage_rect);
-}
-
-std::unique_ptr<cc::SwapPromiseMonitor>
-LayerTreeView::CreateLatencyInfoSwapPromiseMonitor(ui::LatencyInfo* latency) {
-  return std::make_unique<cc::LatencyInfoSwapPromiseMonitor>(
-      latency, layer_tree_host_->GetSwapPromiseManager(), nullptr);
-}
-
-int LayerTreeView::GetSourceFrameNumber() const {
-  return layer_tree_host_->SourceFrameNumber();
-}
-
-const cc::Layer* LayerTreeView::GetRootLayer() const {
-  return layer_tree_host_->root_layer();
-}
-
-int LayerTreeView::ScheduleMicroBenchmark(
-    const std::string& name,
-    std::unique_ptr<base::Value> value,
-    base::OnceCallback<void(std::unique_ptr<base::Value>)> callback) {
-  return layer_tree_host_->ScheduleMicroBenchmark(name, std::move(value),
-                                                  std::move(callback));
-}
-
-bool LayerTreeView::SendMessageToMicroBenchmark(
-    int id,
-    std::unique_ptr<base::Value> value) {
-  return layer_tree_host_->SendMessageToMicroBenchmark(id, std::move(value));
-}
-
-void LayerTreeView::SetViewportRectAndScale(
-    const gfx::Rect& device_viewport_rect,
-    float device_scale_factor,
-    const viz::LocalSurfaceIdAllocation& local_surface_id_allocation) {
-  layer_tree_host_->SetViewportRectAndScale(
-      device_viewport_rect, device_scale_factor, local_surface_id_allocation);
-}
-
-void LayerTreeView::RequestNewLocalSurfaceId() {
-  layer_tree_host_->RequestNewLocalSurfaceId();
-}
-
-void LayerTreeView::RequestForceSendMetadata() {
-  layer_tree_host_->RequestForceSendMetadata();
-}
-
-void LayerTreeView::SetViewportVisibleRect(const gfx::Rect& visible_rect) {
-  layer_tree_host_->SetViewportVisibleRect(visible_rect);
-}
-
-void LayerTreeView::SetNonBlinkManagedRootLayer(
-    scoped_refptr<cc::Layer> layer) {
-  layer_tree_host_->SetNonBlinkManagedRootLayer(std::move(layer));
-}
-
-void LayerTreeView::SetNeedsBeginFrame() {
-  layer_tree_host_->SetNeedsAnimate();
-}
-
 void LayerTreeView::SetLayerTreeFrameSink(
     std::unique_ptr<cc::LayerTreeFrameSink> layer_tree_frame_sink) {
+  DCHECK(delegate_);
   if (!layer_tree_frame_sink) {
     DidFailToInitializeLayerTreeFrameSink();
     return;
@@ -191,18 +128,26 @@ void LayerTreeView::SetLayerTreeFrameSink(
 }
 
 void LayerTreeView::WillBeginMainFrame() {
+  if (!delegate_)
+    return;
   delegate_->WillBeginCompositorFrame();
 }
 
 void LayerTreeView::DidBeginMainFrame() {
+  if (!delegate_)
+    return;
   delegate_->DidBeginMainFrame();
 }
 
 void LayerTreeView::WillUpdateLayers() {
+  if (!delegate_)
+    return;
   delegate_->BeginUpdateLayers();
 }
 
 void LayerTreeView::DidUpdateLayers() {
+  if (!delegate_)
+    return;
   delegate_->EndUpdateLayers();
   // Dump property trees and layers if run with:
   //   --vmodule=layer_tree_view=3
@@ -214,52 +159,74 @@ void LayerTreeView::DidUpdateLayers() {
 }
 
 void LayerTreeView::BeginMainFrame(const viz::BeginFrameArgs& args) {
+  if (!delegate_)
+    return;
   web_main_thread_scheduler_->WillBeginFrame(args);
   delegate_->BeginMainFrame(args.frame_time);
 }
 
 void LayerTreeView::OnDeferMainFrameUpdatesChanged(bool status) {
+  if (!delegate_)
+    return;
   delegate_->OnDeferMainFrameUpdatesChanged(status);
 }
 
 void LayerTreeView::OnDeferCommitsChanged(bool status) {
+  if (!delegate_)
+    return;
   delegate_->OnDeferCommitsChanged(status);
 }
 
 void LayerTreeView::BeginMainFrameNotExpectedSoon() {
+  if (!delegate_)
+    return;
   web_main_thread_scheduler_->BeginFrameNotExpectedSoon();
 }
 
 void LayerTreeView::BeginMainFrameNotExpectedUntil(base::TimeTicks time) {
+  if (!delegate_)
+    return;
   web_main_thread_scheduler_->BeginMainFrameNotExpectedUntil(time);
 }
 
 void LayerTreeView::UpdateLayerTreeHost() {
+  if (!delegate_)
+    return;
   delegate_->UpdateVisualState();
 }
 
 void LayerTreeView::ApplyViewportChanges(
     const cc::ApplyViewportChangesArgs& args) {
+  if (!delegate_)
+    return;
   delegate_->ApplyViewportChanges(args);
 }
 
 void LayerTreeView::RecordManipulationTypeCounts(cc::ManipulationInfo info) {
+  if (!delegate_)
+    return;
   delegate_->RecordManipulationTypeCounts(info);
 }
 
 void LayerTreeView::SendOverscrollEventFromImplSide(
     const gfx::Vector2dF& overscroll_delta,
     cc::ElementId scroll_latched_element_id) {
+  if (!delegate_)
+    return;
   delegate_->SendOverscrollEventFromImplSide(overscroll_delta,
                                              scroll_latched_element_id);
 }
 
 void LayerTreeView::SendScrollEndEventFromImplSide(
     cc::ElementId scroll_latched_element_id) {
+  if (!delegate_)
+    return;
   delegate_->SendScrollEndEventFromImplSide(scroll_latched_element_id);
 }
 
 void LayerTreeView::RequestNewLayerTreeFrameSink() {
+  if (!delegate_)
+    return;
   // When the compositor is not visible it would not request a
   // LayerTreeFrameSink so this is a race where it requested one then became
   // not-visible. In that case, we can wait for it to become visible again
@@ -292,6 +259,8 @@ void LayerTreeView::RequestNewLayerTreeFrameSink() {
 void LayerTreeView::DidInitializeLayerTreeFrameSink() {}
 
 void LayerTreeView::DidFailToInitializeLayerTreeFrameSink() {
+  if (!delegate_)
+    return;
   if (!layer_tree_host_->IsVisible()) {
     layer_tree_frame_sink_request_failed_while_invisible_ = true;
     return;
@@ -303,25 +272,35 @@ void LayerTreeView::DidFailToInitializeLayerTreeFrameSink() {
 }
 
 void LayerTreeView::WillCommit() {
+  if (!delegate_)
+    return;
   delegate_->WillCommitCompositorFrame();
 }
 
 void LayerTreeView::DidCommit() {
+  if (!delegate_)
+    return;
   delegate_->DidCommitCompositorFrame();
   web_main_thread_scheduler_->DidCommitFrameToCompositor();
 }
 
 void LayerTreeView::DidCommitAndDrawFrame() {
+  if (!delegate_)
+    return;
   delegate_->DidCommitAndDrawCompositorFrame();
 }
 
 void LayerTreeView::DidCompletePageScaleAnimation() {
+  if (!delegate_)
+    return;
   delegate_->DidCompletePageScaleAnimation();
 }
 
 void LayerTreeView::DidPresentCompositorFrame(
     uint32_t frame_token,
     const gfx::PresentationFeedback& feedback) {
+  if (!delegate_)
+    return;
   DCHECK(layer_tree_host_->GetTaskRunnerProvider()
              ->MainThreadTaskRunner()
              ->RunsTasksInCurrentSequence());
@@ -336,44 +315,44 @@ void LayerTreeView::DidPresentCompositorFrame(
 }
 
 void LayerTreeView::RecordStartOfFrameMetrics() {
+  if (!delegate_)
+    return;
   delegate_->RecordStartOfFrameMetrics();
 }
 
 void LayerTreeView::RecordEndOfFrameMetrics(base::TimeTicks frame_begin_time) {
+  if (!delegate_)
+    return;
   delegate_->RecordEndOfFrameMetrics(frame_begin_time);
 }
 
-void LayerTreeView::DidSubmitCompositorFrame() {}
-
-void LayerTreeView::DidLoseLayerTreeFrameSink() {}
-
-void LayerTreeView::SetRasterColorSpace(const gfx::ColorSpace& color_space) {
-  layer_tree_host_->SetRasterColorSpace(color_space);
+std::unique_ptr<cc::BeginMainFrameMetrics>
+LayerTreeView::GetBeginMainFrameMetrics() {
+  if (!delegate_)
+    return nullptr;
+  return delegate_->GetBeginMainFrameMetrics();
 }
 
-void LayerTreeView::SetExternalPageScaleFactor(
-    float page_scale_factor,
-    bool is_external_pinch_gesture_active) {
-  layer_tree_host_->SetExternalPageScaleFactor(
-      page_scale_factor, is_external_pinch_gesture_active);
+void LayerTreeView::DidScheduleBeginMainFrame() {
+  if (!delegate_)
+    return;
+  web_main_thread_scheduler_->DidScheduleBeginMainFrame();
 }
 
-void LayerTreeView::ClearCachesOnNextCommit() {
-  layer_tree_host_->ClearCachesOnNextCommit();
+void LayerTreeView::DidRunBeginMainFrame() {
+  if (!delegate_)
+    return;
+  web_main_thread_scheduler_->DidRunBeginMainFrame();
 }
 
-const cc::LayerTreeSettings& LayerTreeView::GetLayerTreeSettings() const {
-  return layer_tree_host_->GetSettings();
-}
+void LayerTreeView::DidSubmitCompositorFrame() {}
 
-void LayerTreeView::SetRenderFrameObserver(
-    std::unique_ptr<cc::RenderFrameMetadataObserver> observer) {
-  layer_tree_host_->SetRenderFrameObserver(std::move(observer));
-}
+void LayerTreeView::DidLoseLayerTreeFrameSink() {}
 
 void LayerTreeView::AddPresentationCallback(
     uint32_t frame_token,
     base::OnceCallback<void(base::TimeTicks)> callback) {
+  DCHECK(delegate_);
   if (!presentation_callbacks_.empty()) {
     auto& previous = presentation_callbacks_.back();
     uint32_t previous_frame_token = previous.first;
@@ -390,12 +369,4 @@ void LayerTreeView::AddPresentationCallback(
   DCHECK_LE(presentation_callbacks_.size(), 25u);
 }
 
-void LayerTreeView::SetSourceURL(ukm::SourceId source_id, const GURL& url) {
-  layer_tree_host_->SetSourceURL(source_id, url);
-}
-
-void LayerTreeView::ReleaseLayerTreeFrameSink() {
-  layer_tree_host_->ReleaseLayerTreeFrameSink();
-}
-
 }  // namespace content
diff --git a/chromium/content/renderer/compositor/layer_tree_view.h b/chromium/content/renderer/compositor/layer_tree_view.h
index bbfa615ce89..845b1effebe 100644
--- a/chromium/content/renderer/compositor/layer_tree_view.h
+++ b/chromium/content/renderer/compositor/layer_tree_view.h
@@ -21,8 +21,6 @@
 #include "content/common/content_export.h"
 #include "ui/gfx/geometry/rect.h"
 
-class GURL;
-
 namespace blink {
 namespace scheduler {
 class WebThreadScheduler;
@@ -31,34 +29,19 @@ class WebThreadScheduler;
 
 namespace cc {
 class AnimationHost;
-class InputHandler;
-class Layer;
 class LayerTreeFrameSink;
 class LayerTreeHost;
 class LayerTreeSettings;
-class RenderFrameMetadataObserver;
 class TaskGraphRunner;
 class UkmRecorderFactory;
 }  // namespace cc
 
-namespace gfx {
-class ColorSpace;
-}  // namespace gfx
-
-namespace ui {
-class LatencyInfo;
-}
-
-namespace viz {
-class LocalSurfaceIdAllocation;
-}
-
 namespace content {
 class LayerTreeViewDelegate;
 
-class CONTENT_EXPORT LayerTreeView
-    : public cc::LayerTreeHostClient,
-      public cc::LayerTreeHostSingleThreadClient {
+class CONTENT_EXPORT LayerTreeView : public cc::LayerTreeHostClient,
+                                     public cc::LayerTreeHostSingleThreadClient,
+                                     public cc::LayerTreeHostSchedulingClient {
  public:
   // The |main_thread| is the task runner that the compositor will use for the
   // main thread (where it is constructed). The |compositor_thread| is the task
@@ -76,53 +59,13 @@ class CONTENT_EXPORT LayerTreeView
   void Initialize(const cc::LayerTreeSettings& settings,
                   std::unique_ptr<cc::UkmRecorderFactory> ukm_recorder_factory);
 
+  // Drops any references back to the delegate in preparation for being
+  // destroyed.
+  void Disconnect();
+
   cc::AnimationHost* animation_host() { return animation_host_.get(); }
 
   void SetVisible(bool visible);
-  const base::WeakPtr<cc::InputHandler>& GetInputHandler();
-  void SetNeedsDisplayOnAllLayers();
-  void SetRasterizeOnlyVisibleContent();
-  void SetNeedsRedrawRect(gfx::Rect damage_rect);
-
-  // Indicates that blink needs a BeginFrame, but that nothing might actually be
-  // dirty. Calls to this should never be done directly, but should go through
-  // WebWidgetClient::ScheduleAnimate() instead, or they can bypass test
-  // overrides.
-  void SetNeedsBeginFrame();
-  // Calling CreateLatencyInfoSwapPromiseMonitor() to get a scoped
-  // LatencyInfoSwapPromiseMonitor. During the life time of the
-  // LatencyInfoSwapPromiseMonitor, if SetNeedsCommit() or
-  // SetNeedsUpdateLayers() is called on LayerTreeHost, the original latency
-  // info will be turned into a LatencyInfoSwapPromise.
-  std::unique_ptr<cc::SwapPromiseMonitor> CreateLatencyInfoSwapPromiseMonitor(
-      ui::LatencyInfo* latency);
-  int GetSourceFrameNumber() const;
-  const cc::Layer* GetRootLayer() const;
-  int ScheduleMicroBenchmark(
-      const std::string& name,
-      std::unique_ptr<base::Value> value,
-      base::OnceCallback<void(std::unique_ptr<base::Value>)> callback);
-  bool SendMessageToMicroBenchmark(int id, std::unique_ptr<base::Value> value);
-  void SetRasterColorSpace(const gfx::ColorSpace& color_space);
-  void SetExternalPageScaleFactor(float page_scale_factor,
-                                  bool is_external_pinch_gesture_active);
-  void ClearCachesOnNextCommit();
-  void SetViewportRectAndScale(
-      const gfx::Rect& device_viewport_rect,
-      float device_scale_factor,
-      const viz::LocalSurfaceIdAllocation& local_surface_id_allocation);
-  void RequestNewLocalSurfaceId();
-  void RequestForceSendMetadata();
-  void SetViewportVisibleRect(const gfx::Rect& visible_rect);
-  void SetSourceURL(ukm::SourceId source_id, const GURL& url);
-  // Call this if the compositor is becoming non-visible in a way that it won't
-  // be used any longer. In this case, becoming visible is longer but this
-  // releases more resources (such as its use of the GpuChannel).
-  // TODO(crbug.com/419087): This is to support a swapped out RenderWidget which
-  // should just be destroyed instead.
-  void ReleaseLayerTreeFrameSink();
-
-  void SetNonBlinkManagedRootLayer(scoped_refptr<cc::Layer> layer);
 
   // cc::LayerTreeHostClient implementation.
   void WillBeginMainFrame() override;
@@ -155,17 +98,16 @@ class CONTENT_EXPORT LayerTreeView
       const gfx::PresentationFeedback& feedback) override;
   void RecordStartOfFrameMetrics() override;
   void RecordEndOfFrameMetrics(base::TimeTicks frame_begin_time) override;
+  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
+      override;
 
   // cc::LayerTreeHostSingleThreadClient implementation.
   void DidSubmitCompositorFrame() override;
   void DidLoseLayerTreeFrameSink() override;
 
-  const cc::LayerTreeSettings& GetLayerTreeSettings() const;
-
-  // Sets the RenderFrameMetadataObserver, which is sent to the compositor
-  // thread for binding.
-  void SetRenderFrameObserver(
-      std::unique_ptr<cc::RenderFrameMetadataObserver> observer);
+  // cc::LayerTreeHostSchedulingClient implementation.
+  void DidScheduleBeginMainFrame() override;
+  void DidRunBeginMainFrame() override;
 
   void AddPresentationCallback(
       uint32_t frame_token,
@@ -183,14 +125,21 @@ class CONTENT_EXPORT LayerTreeView
   void SetLayerTreeFrameSink(
       std::unique_ptr<cc::LayerTreeFrameSink> layer_tree_frame_sink);
 
-  LayerTreeViewDelegate* const delegate_;
   const scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
   const scoped_refptr<base::SingleThreadTaskRunner> compositor_thread_;
   cc::TaskGraphRunner* const task_graph_runner_;
   blink::scheduler::WebThreadScheduler* const web_main_thread_scheduler_;
   const std::unique_ptr<cc::AnimationHost> animation_host_;
+
+  // The delegate_ becomes null when Disconnect() is called. After that, the
+  // class should do nothing in calls from the LayerTreeHost, and just wait to
+  // be destroyed. It is not expected to be used at all after Disconnect()
+  // outside of handling/dropping LayerTreeHost client calls.
+  LayerTreeViewDelegate* delegate_;
   std::unique_ptr<cc::LayerTreeHost> layer_tree_host_;
 
+  // This class should do nothing and access no pointers once this value becomes
+  // true.
   bool layer_tree_frame_sink_request_failed_while_invisible_ = false;
 
   base::circular_deque<
diff --git a/chromium/content/renderer/compositor/layer_tree_view_delegate.h b/chromium/content/renderer/compositor/layer_tree_view_delegate.h
index 667a4c0c164..028f472fe2d 100644
--- a/chromium/content/renderer/compositor/layer_tree_view_delegate.h
+++ b/chromium/content/renderer/compositor/layer_tree_view_delegate.h
@@ -14,6 +14,7 @@
 
 namespace cc {
 class LayerTreeFrameSink;
+struct BeginMainFrameMetrics;
 struct ElementId;
 }  // namespace cc
 
@@ -82,6 +83,14 @@ class LayerTreeViewDelegate {
   // (at the same time Tracing measurements are taken).
   virtual void RecordStartOfFrameMetrics() = 0;
   virtual void RecordEndOfFrameMetrics(base::TimeTicks frame_begin_time) = 0;
+  // Return metrics information for the stages of BeginMainFrame. This is
+  // ultimately implemented by Blink's LocalFrameUKMAggregator. It must be a
+  // distinct call from the FrameMetrics above because the BeginMainFrameMetrics
+  // for compositor latency must be gathered before the layer tree is
+  // committed to the compositor, which is before the call to
+  // RecordEndOfFrameMetrics.
+  virtual std::unique_ptr<cc::BeginMainFrameMetrics>
+  GetBeginMainFrameMetrics() = 0;
 
   // Notification of the beginning and end of LayerTreeHost::UpdateLayers, for
   // metrics collection.
diff --git a/chromium/content/renderer/dom_serializer_browsertest.cc b/chromium/content/renderer/dom_serializer_browsertest.cc
index bda6ad18f38..eaf66a5e840 100644
--- a/chromium/content/renderer/dom_serializer_browsertest.cc
+++ b/chromium/content/renderer/dom_serializer_browsertest.cc
@@ -638,7 +638,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   GURL file_url = net::FilePathToFileURL(page_file_path);
   ASSERT_TRUE(file_url.SchemeIsFile());
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithDocTypeOnRenderer,
@@ -654,7 +654,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   GURL file_url = net::FilePathToFileURL(page_file_path);
   ASSERT_TRUE(file_url.SchemeIsFile());
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithoutDocTypeOnRenderer,
@@ -683,7 +683,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   ASSERT_TRUE(file_url.SchemeIsFile());
 
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeXMLDocWithBuiltInEntitiesOnRenderer,
@@ -708,7 +708,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   ASSERT_TRUE(file_url.SchemeIsFile());
 
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithAddingMOTWOnRenderer,
@@ -733,7 +733,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   ASSERT_TRUE(file_url.SchemeIsFile());
 
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithAddingMOTWOnRenderer,
@@ -755,7 +755,7 @@ IN_PROC_BROWSER_TEST_F(
   GURL file_url = net::FilePathToFileURL(page_file_path);
   ASSERT_TRUE(file_url.SchemeIsFile());
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::
@@ -777,7 +777,7 @@ IN_PROC_BROWSER_TEST_F(
   GURL file_url = net::FilePathToFileURL(page_file_path);
   ASSERT_TRUE(file_url.SchemeIsFile());
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::
@@ -791,7 +791,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   // Need to spin up the renderer and also navigate to a file url so that the
   // renderer code doesn't attempt a fork when it sees a load to file scheme
   // from non-file scheme.
-  NavigateToURL(shell(), GetTestUrl(".", "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(".", "simple_page.html")));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithEntitiesInTextOnRenderer,
@@ -806,7 +806,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   // Need to spin up the renderer and also navigate to a file url so that the
   // renderer code doesn't attempt a fork when it sees a load to file scheme
   // from non-file scheme.
-  NavigateToURL(shell(), GetTestUrl(".", "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(".", "simple_page.html")));
 
   PostTaskToInProcessRendererAndWait(
       base::BindOnce(&MAYBE_DomSerializerTests::
@@ -822,7 +822,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   base::FilePath page_file_path = GetTestFilePath(
       "dom_serializer", "nonstandard_htmlentities.htm");
   GURL file_url = net::FilePathToFileURL(page_file_path);
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(
       base::BindOnce(&MAYBE_DomSerializerTests::
@@ -848,7 +848,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests, SerializeHTMLDOMWithBaseTag) {
   GURL file_url = net::FilePathToFileURL(page_file_path);
   ASSERT_TRUE(file_url.SchemeIsFile());
   // Load the test file.
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithBaseTagOnRenderer,
@@ -861,7 +861,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   // Need to spin up the renderer and also navigate to a file url so that the
   // renderer code doesn't attempt a fork when it sees a load to file scheme
   // from non-file scheme.
-  NavigateToURL(shell(), GetTestUrl(".", "simple_page.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(".", "simple_page.html")));
 
   PostTaskToInProcessRendererAndWait(base::BindOnce(
       &MAYBE_DomSerializerTests::SerializeHTMLDOMWithEmptyHeadOnRenderer,
@@ -873,7 +873,7 @@ IN_PROC_BROWSER_TEST_F(MAYBE_DomSerializerTests,
   base::FilePath page_file_path = GetTestFilePath(
       "dom_serializer", "non_html_namespace.htm");
   GURL file_url = net::FilePathToFileURL(page_file_path);
-  NavigateToURL(shell(), file_url);
+  EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
   PostTaskToInProcessRendererAndWait(
       base::BindOnce(&MAYBE_DomSerializerTests::
diff --git a/chromium/content/renderer/gpu_benchmarking_extension.cc b/chromium/content/renderer/gpu_benchmarking_extension.cc
index c1f2d3f0d72..fecd4eb848d 100644
--- a/chromium/content/renderer/gpu_benchmarking_extension.cc
+++ b/chromium/content/renderer/gpu_benchmarking_extension.cc
@@ -24,6 +24,7 @@
 #include "cc/paint/skia_paint_canvas.h"
 #include "cc/trees/layer_tree_host.h"
 #include "content/common/input/actions_parser.h"
+#include "content/common/input/input_injector.mojom.h"
 #include "content/common/input/synthetic_gesture_params.h"
 #include "content/common/input/synthetic_pinch_gesture_params.h"
 #include "content/common/input/synthetic_pointer_action_list_params.h"
@@ -35,7 +36,6 @@
 #include "content/public/renderer/chrome_object_extensions_utils.h"
 #include "content/public/renderer/render_thread.h"
 #include "content/public/renderer/v8_value_converter.h"
-#include "content/renderer/compositor/layer_tree_view.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/skia_benchmarking_extension.h"
@@ -44,6 +44,7 @@
 #include "gin/object_template_builder.h"
 #include "gpu/config/gpu_driver_bug_workaround_type.h"
 #include "gpu/ipc/common/gpu_messages.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "third_party/blink/public/platform/web_mouse_event.h"
 #include "third_party/blink/public/web/blink.h"
@@ -186,40 +187,16 @@ class CallbackAndContext : public base::RefCounted<CallbackAndContext> {
   DISALLOW_COPY_AND_ASSIGN(CallbackAndContext);
 };
 
+// This class is a mostly unnecessary helper class. It extracts some commonly
+// used objects from RenderFrameImpl.
 class GpuBenchmarkingContext {
  public:
-  GpuBenchmarkingContext() = default;
-
-  bool Init(bool init_compositor) {
-    web_frame_ = WebLocalFrame::FrameForCurrentContext();
-    if (!web_frame_)
-      return false;
-
+  explicit GpuBenchmarkingContext(RenderFrameImpl* frame) {
+    web_frame_ = frame->GetWebFrame();
     web_view_ = web_frame_->View();
-    if (!web_view_) {
-      web_frame_ = nullptr;
-      return false;
-    }
-
     render_view_impl_ = RenderViewImpl::FromWebView(web_view_);
-    if (!render_view_impl_) {
-      web_frame_ = nullptr;
-      web_view_ = nullptr;
-      return false;
-    }
-
-    if (!init_compositor)
-      return true;
-
-    layer_tree_view_ = render_view_impl_->GetWidget()->layer_tree_view();
-    if (!layer_tree_view_) {
-      web_frame_ = nullptr;
-      web_view_ = nullptr;
-      render_view_impl_ = nullptr;
-      return false;
-    }
-
-    return true;
+    render_widget_ = frame->GetLocalRootRenderWidget();
+    layer_tree_host_ = render_widget_->layer_tree_host();
   }
 
   WebLocalFrame* web_frame() const {
@@ -234,16 +211,18 @@ class GpuBenchmarkingContext {
     DCHECK(render_view_impl_ != nullptr);
     return render_view_impl_;
   }
-  LayerTreeView* layer_tree_view() const {
-    DCHECK(layer_tree_view_ != nullptr);
-    return layer_tree_view_;
+  RenderWidget* render_widget() const { return render_widget_; }
+  cc::LayerTreeHost* layer_tree_host() const {
+    DCHECK(layer_tree_host_ != nullptr);
+    return layer_tree_host_;
   }
 
  private:
   WebLocalFrame* web_frame_ = nullptr;
   WebView* web_view_ = nullptr;
   RenderViewImpl* render_view_impl_ = nullptr;
-  LayerTreeView* layer_tree_view_ = nullptr;
+  RenderWidget* render_widget_ = nullptr;
+  cc::LayerTreeHost* layer_tree_host_ = nullptr;
 
   DISALLOW_COPY_AND_ASSIGN(GpuBenchmarkingContext);
 };
@@ -286,7 +265,7 @@ bool ThrowIfPointOutOfBounds(GpuBenchmarkingContext* context,
                              gin::Arguments* args,
                              const gfx::Point& point,
                              const std::string& message) {
-  gfx::Rect rect = context->render_view_impl()->GetWidget()->ViewRect();
+  gfx::Rect rect = context->render_widget()->ViewRect();
   rect -= rect.OffsetFromOrigin();
 
   // If the bounds are not available here, as is the case with an OOPIF,
@@ -304,7 +283,7 @@ bool ThrowIfPointOutOfBounds(GpuBenchmarkingContext* context,
 
 bool BeginSmoothScroll(GpuBenchmarkingContext* context,
                        gin::Arguments* args,
-                       mojom::InputInjectorPtr& injector,
+                       const mojo::Remote<mojom::InputInjector>& injector,
                        float pixels_to_scroll,
                        v8::Local<v8::Function> callback,
                        int gesture_source_type,
@@ -317,6 +296,7 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
                        bool precise_scrolling_deltas,
                        bool scroll_by_page,
                        bool cursor_visible) {
+  DCHECK(!(precise_scrolling_deltas && scroll_by_page));
   if (ThrowIfPointOutOfBounds(context, args, gfx::Point(start_x, start_y),
                               "Start point not in bounds")) {
     return false;
@@ -353,8 +333,17 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
 
   gesture_params.speed_in_pixels_s = speed_in_pixels_s;
   gesture_params.prevent_fling = prevent_fling;
-  gesture_params.precise_scrolling_deltas = precise_scrolling_deltas;
-  gesture_params.scroll_by_page = scroll_by_page;
+
+  if (scroll_by_page) {
+    gesture_params.granularity =
+        ui::input_types::ScrollGranularity::kScrollByPage;
+  } else if (precise_scrolling_deltas) {
+    gesture_params.granularity =
+        ui::input_types::ScrollGranularity::kScrollByPrecisePixel;
+  } else {
+    gesture_params.granularity =
+        ui::input_types::ScrollGranularity::kScrollByPixel;
+  }
 
   gesture_params.anchor.SetPoint(start_x, start_y);
 
@@ -408,7 +397,7 @@ bool BeginSmoothScroll(GpuBenchmarkingContext* context,
 
 bool BeginSmoothDrag(GpuBenchmarkingContext* context,
                      gin::Arguments* args,
-                     mojom::InputInjectorPtr& injector,
+                     const mojo::Remote<mojom::InputInjector>& injector,
                      float start_x,
                      float start_y,
                      float end_x,
@@ -472,10 +461,9 @@ static void PrintDocument(blink::WebLocalFrame* frame, SkDocument* doc) {
 
 static void PrintDocumentTofile(v8::Isolate* isolate,
                                 const std::string& filename,
-                                sk_sp<SkDocument> (*make_doc)(SkWStream*)) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return;
+                                sk_sp<SkDocument> (*make_doc)(SkWStream*),
+                                RenderFrameImpl* render_frame) {
+  GpuBenchmarkingContext context(render_frame);
 
   base::FilePath path = base::FilePath::FromUTF8Unsafe(filename);
   if (!base::PathIsWritable(path.DirName())) {
@@ -557,9 +545,9 @@ GpuBenchmarking::~GpuBenchmarking() {}
 
 void GpuBenchmarking::EnsureRemoteInterface() {
   if (!input_injector_) {
-    render_frame_->GetRemoteInterfaces()->GetInterface(mojo::MakeRequest(
-        &input_injector_,
-        render_frame_->GetTaskRunner(blink::TaskType::kInternalDefault)));
+    render_frame_->GetRemoteInterfaces()->GetInterface(
+        input_injector_.BindNewPipeAndPassReceiver(
+            render_frame_->GetTaskRunner(blink::TaskType::kInternalDefault)));
   }
 }
 
@@ -619,19 +607,15 @@ gin::ObjectTemplateBuilder GpuBenchmarking::GetObjectTemplateBuilder(
 }
 
 void GpuBenchmarking::SetNeedsDisplayOnAllLayers() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return;
-
-  context.layer_tree_view()->SetNeedsDisplayOnAllLayers();
+  GpuBenchmarkingContext context(render_frame_);
+  context.layer_tree_host()->SetNeedsDisplayOnAllLayers();
 }
 
 void GpuBenchmarking::SetRasterizeOnlyVisibleContent() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return;
-
-  context.layer_tree_view()->SetRasterizeOnlyVisibleContent();
+  GpuBenchmarkingContext context(render_frame_);
+  cc::LayerTreeDebugState current = context.layer_tree_host()->GetDebugState();
+  current.rasterize_only_visible_content = true;
+  context.layer_tree_host()->SetDebugState(current);
 }
 
 namespace {
@@ -641,13 +625,14 @@ sk_sp<SkDocument> make_multipicturedocument(SkWStream* stream) {
 }  // namespace
 void GpuBenchmarking::PrintPagesToSkPictures(v8::Isolate* isolate,
                                              const std::string& filename) {
-  PrintDocumentTofile(isolate, filename, &make_multipicturedocument);
+  PrintDocumentTofile(isolate, filename, &make_multipicturedocument,
+                      render_frame_);
 }
 
 void GpuBenchmarking::PrintPagesToXPS(v8::Isolate* isolate,
                                       const std::string& filename) {
 #if defined(OS_WIN) && !defined(NDEBUG)
-  PrintDocumentTofile(isolate, filename, &MakeXPSDocument);
+  PrintDocumentTofile(isolate, filename, &MakeXPSDocument, render_frame_);
 #else
   std::string msg("PrintPagesToXPS is unsupported.");
   isolate->ThrowException(v8::Exception::Error(
@@ -659,11 +644,9 @@ void GpuBenchmarking::PrintPagesToXPS(v8::Isolate* isolate,
 
 void GpuBenchmarking::PrintToSkPicture(v8::Isolate* isolate,
                                        const std::string& dirname) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return;
+  GpuBenchmarkingContext context(render_frame_);
 
-  const cc::Layer* root_layer = context.layer_tree_view()->GetRootLayer();
+  const cc::Layer* root_layer = context.layer_tree_host()->root_layer();
   if (!root_layer)
     return;
 
@@ -694,11 +677,8 @@ bool GpuBenchmarking::GestureSourceTypeSupported(int gesture_source_type) {
 }
 
 bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return false;
-
-  blink::WebRect rect = context.render_view_impl()->GetWidget()->ViewRect();
+  GpuBenchmarkingContext context(render_frame_);
+  blink::WebRect rect = context.render_widget()->ViewRect();
 
   float pixels_to_scroll = 0;
   v8::Local<v8::Function> callback;
@@ -738,10 +718,7 @@ bool GpuBenchmarking::SmoothScrollBy(gin::Arguments* args) {
 }
 
 bool GpuBenchmarking::SmoothDrag(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return false;
-
+  GpuBenchmarkingContext context(render_frame_);
   float start_x;
   float start_y;
   float end_x;
@@ -765,11 +742,8 @@ bool GpuBenchmarking::SmoothDrag(gin::Arguments* args) {
 }
 
 bool GpuBenchmarking::Swipe(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return false;
-
-  blink::WebRect rect = context.render_view_impl()->GetWidget()->ViewRect();
+  GpuBenchmarkingContext context(render_frame_);
+  blink::WebRect rect = context.render_widget()->ViewRect();
 
   std::string direction = "up";
   float pixels_to_scroll = 0;
@@ -806,12 +780,8 @@ bool GpuBenchmarking::Swipe(gin::Arguments* args) {
 }
 
 bool GpuBenchmarking::ScrollBounce(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return false;
-
-  blink::WebRect content_rect =
-      context.render_view_impl()->GetWidget()->ViewRect();
+  GpuBenchmarkingContext context(render_frame_);
+  blink::WebRect content_rect = context.render_widget()->ViewRect();
 
   std::string direction = "down";
   float distance_length = 0;
@@ -878,9 +848,7 @@ bool GpuBenchmarking::ScrollBounce(gin::Arguments* args) {
 }
 
 bool GpuBenchmarking::PinchBy(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return false;
+  GpuBenchmarkingContext context(render_frame_);
 
   float scale_factor;
   float anchor_x;
@@ -941,24 +909,18 @@ bool GpuBenchmarking::PinchBy(gin::Arguments* args) {
 }
 
 float GpuBenchmarking::PageScaleFactor() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return 0.0;
+  GpuBenchmarkingContext context(render_frame_);
   return context.web_view()->PageScaleFactor();
 }
 
 void GpuBenchmarking::SetPageScaleFactor(float scale) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return;
+  GpuBenchmarkingContext context(render_frame_);
   context.web_view()->SetPageScaleFactor(scale);
 }
 
 void GpuBenchmarking::SetBrowserControlsShown(bool show) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return;
-  context.layer_tree_view()->layer_tree_host()->UpdateBrowserControlsState(
+  GpuBenchmarkingContext context(render_frame_);
+  context.layer_tree_host()->UpdateBrowserControlsState(
       cc::BrowserControlsState::kBoth,
       show ? cc::BrowserControlsState::kShown
            : cc::BrowserControlsState::kHidden,
@@ -966,49 +928,39 @@ void GpuBenchmarking::SetBrowserControlsShown(bool show) {
 }
 
 float GpuBenchmarking::VisualViewportY() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return 0.0;
+  GpuBenchmarkingContext context(render_frame_);
   float y = context.web_view()->VisualViewportOffset().y;
   blink::WebRect rect(0, y, 0, 0);
-  context.render_view_impl()->GetWidget()->ConvertViewportToWindow(&rect);
+  context.render_widget()->ConvertViewportToWindow(&rect);
   return rect.y;
 }
 
 float GpuBenchmarking::VisualViewportX() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return 0.0;
+  GpuBenchmarkingContext context(render_frame_);
   float x = context.web_view()->VisualViewportOffset().x;
   blink::WebRect rect(x, 0, 0, 0);
-  context.render_view_impl()->GetWidget()->ConvertViewportToWindow(&rect);
+  context.render_widget()->ConvertViewportToWindow(&rect);
   return rect.x;
 }
 
 float GpuBenchmarking::VisualViewportHeight() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return 0.0;
+  GpuBenchmarkingContext context(render_frame_);
   float height = context.web_view()->VisualViewportSize().height;
   blink::WebRect rect(0, 0, 0, height);
-  context.render_view_impl()->GetWidget()->ConvertViewportToWindow(&rect);
+  context.render_widget()->ConvertViewportToWindow(&rect);
   return rect.height;
 }
 
 float GpuBenchmarking::VisualViewportWidth() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return 0.0;
+  GpuBenchmarkingContext context(render_frame_);
   float width = context.web_view()->VisualViewportSize().width;
   blink::WebRect rect(0, 0, width, 0);
-  context.render_view_impl()->GetWidget()->ConvertViewportToWindow(&rect);
+  context.render_widget()->ConvertViewportToWindow(&rect);
   return rect.width;
 }
 
 bool GpuBenchmarking::Tap(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return false;
+  GpuBenchmarkingContext context(render_frame_);
 
   float position_x;
   float position_y;
@@ -1053,9 +1005,7 @@ bool GpuBenchmarking::Tap(gin::Arguments* args) {
 }
 
 bool GpuBenchmarking::PointerActionSequence(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(false))
-    return false;
+  GpuBenchmarkingContext context(render_frame_);
 
   v8::Local<v8::Function> callback;
 
@@ -1109,9 +1059,7 @@ void GpuBenchmarking::ClearImageCache() {
 }
 
 int GpuBenchmarking::RunMicroBenchmark(gin::Arguments* args) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return 0;
+  GpuBenchmarkingContext context(render_frame_);
 
   std::string name;
   v8::Local<v8::Function> callback;
@@ -1130,7 +1078,7 @@ int GpuBenchmarking::RunMicroBenchmark(gin::Arguments* args) {
   std::unique_ptr<base::Value> value =
       V8ValueConverter::Create()->FromV8Value(arguments, v8_context);
 
-  return context.layer_tree_view()->ScheduleMicroBenchmark(
+  return context.layer_tree_host()->ScheduleMicroBenchmark(
       name, std::move(value),
       base::BindOnce(&OnMicroBenchmarkCompleted,
                      base::RetainedRef(callback_and_context)));
@@ -1139,16 +1087,14 @@ int GpuBenchmarking::RunMicroBenchmark(gin::Arguments* args) {
 bool GpuBenchmarking::SendMessageToMicroBenchmark(
     int id,
     v8::Local<v8::Object> message) {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return false;
+  GpuBenchmarkingContext context(render_frame_);
 
   v8::Local<v8::Context> v8_context =
       context.web_frame()->MainWorldScriptContext();
   std::unique_ptr<base::Value> value =
       V8ValueConverter::Create()->FromV8Value(message, v8_context);
 
-  return context.layer_tree_view()->SendMessageToMicroBenchmark(
+  return context.layer_tree_host()->SendMessageToMicroBenchmark(
       id, std::move(value));
 }
 
@@ -1226,9 +1172,7 @@ void GpuBenchmarking::StopProfiling() {
 }
 
 void GpuBenchmarking::Freeze() {
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return;
+  GpuBenchmarkingContext context(render_frame_);
   // TODO(fmeawad): Instead of forcing a visibility change, only allow
   // freezing a page if it was already hidden.
   context.web_view()->SetIsHidden(/*hidden=*/true,
@@ -1240,16 +1184,11 @@ bool GpuBenchmarking::AddSwapCompletionEventListener(gin::Arguments* args) {
   v8::Local<v8::Function> callback;
   if (!GetArg(args, &callback))
     return false;
-  if (!render_frame_)
-    return false;
-  RenderWidget* render_widget = render_frame_->GetLocalRootRenderWidget();
-  GpuBenchmarkingContext context;
-  if (!context.Init(true))
-    return false;
+  GpuBenchmarkingContext context(render_frame_);
 
   auto callback_and_context = base::MakeRefCounted<CallbackAndContext>(
       args->isolate(), callback, context.web_frame()->MainWorldScriptContext());
-  render_widget->NotifySwapTime(base::BindOnce(
+  context.render_widget()->NotifySwapTime(base::BindOnce(
       &OnSwapCompletedHelper, base::RetainedRef(callback_and_context)));
   return true;
 }
diff --git a/chromium/content/renderer/gpu_benchmarking_extension.h b/chromium/content/renderer/gpu_benchmarking_extension.h
index e113293e82b..f4fa25450b4 100644
--- a/chromium/content/renderer/gpu_benchmarking_extension.h
+++ b/chromium/content/renderer/gpu_benchmarking_extension.h
@@ -8,6 +8,7 @@
 #include "base/macros.h"
 #include "content/common/input/input_injector.mojom.h"
 #include "gin/wrappable.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace gin {
 class Arguments;
@@ -99,7 +100,7 @@ class GpuBenchmarking : public gin::Wrappable<GpuBenchmarking> {
   bool AddSwapCompletionEventListener(gin::Arguments* args);
 
   RenderFrameImpl* render_frame_;
-  mojom::InputInjectorPtr input_injector_;
+  mojo::Remote<mojom::InputInjector> input_injector_;
   DISALLOW_COPY_AND_ASSIGN(GpuBenchmarking);
 };
 
diff --git a/chromium/content/renderer/input/frame_input_handler_impl.cc b/chromium/content/renderer/input/frame_input_handler_impl.cc
index d9d4298675f..2b3feaac9d7 100644
--- a/chromium/content/renderer/input/frame_input_handler_impl.cc
+++ b/chromium/content/renderer/input/frame_input_handler_impl.cc
@@ -9,12 +9,15 @@
 #include "base/bind.h"
 #include "base/logging.h"
 #include "content/common/input/ime_text_span_conversions.h"
+#include "content/common/input/input_handler.mojom.h"
 #include "content/renderer/compositor/layer_tree_view.h"
 #include "content/renderer/ime_event_guard.h"
 #include "content/renderer/input/widget_input_handler_manager.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/renderer/render_widget.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "third_party/blink/public/web/web_input_method_controller.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 
@@ -22,9 +25,8 @@ namespace content {
 
 FrameInputHandlerImpl::FrameInputHandlerImpl(
     base::WeakPtr<RenderFrameImpl> render_frame,
-    mojom::FrameInputHandlerRequest request)
-    : binding_(this),
-      render_frame_(render_frame),
+    mojo::PendingReceiver<mojom::FrameInputHandler> receiver)
+    : render_frame_(render_frame),
       input_event_queue_(
           render_frame->GetLocalRootRenderWidget()->GetInputEventQueue()),
       main_thread_task_runner_(base::ThreadTaskRunnerHandle::Get()) {
@@ -37,10 +39,10 @@ FrameInputHandlerImpl::FrameInputHandlerImpl(
     // Mojo channel bound on compositor thread.
     RenderThreadImpl::current()->compositor_task_runner()->PostTask(
         FROM_HERE, base::BindOnce(&FrameInputHandlerImpl::BindNow,
-                                  base::Unretained(this), std::move(request)));
+                                  base::Unretained(this), std::move(receiver)));
   } else {
     // Mojo channel bound on main thread.
-    BindNow(std::move(request));
+    BindNow(std::move(receiver));
   }
 }
 
@@ -49,11 +51,11 @@ FrameInputHandlerImpl::~FrameInputHandlerImpl() {}
 // static
 void FrameInputHandlerImpl::CreateMojoService(
     base::WeakPtr<RenderFrameImpl> render_frame,
-    mojom::FrameInputHandlerRequest request) {
+    mojo::PendingReceiver<mojom::FrameInputHandler> receiver) {
   DCHECK(render_frame);
 
   // Owns itself. Will be deleted when message pipe is destroyed.
-  new FrameInputHandlerImpl(render_frame, std::move(request));
+  new FrameInputHandlerImpl(render_frame, std::move(receiver));
 }
 
 void FrameInputHandlerImpl::RunOnMainThread(base::OnceClosure closure) {
@@ -284,7 +286,7 @@ void FrameInputHandlerImpl::SelectRange(const gfx::Point& base,
 
   if (!render_frame_)
     return;
-  RenderWidget* window_widget = render_frame_->render_view()->GetWidget();
+  RenderWidget* window_widget = render_frame_->GetLocalRootRenderWidget();
   HandlingState handling_state(render_frame_, UpdateState::kIsSelectingRange);
   render_frame_->GetWebFrame()->SelectRange(
       window_widget->ConvertWindowPointToViewport(base),
@@ -381,7 +383,7 @@ void FrameInputHandlerImpl::MoveRangeSelectionExtent(const gfx::Point& extent) {
     return;
   HandlingState handling_state(render_frame_, UpdateState::kIsSelectingRange);
   render_frame_->GetWebFrame()->MoveRangeSelectionExtent(
-      render_frame_->render_view()->GetWidget()->ConvertWindowPointToViewport(
+      render_frame_->GetLocalRootRenderWidget()->ConvertWindowPointToViewport(
           extent));
 }
 
@@ -416,7 +418,7 @@ void FrameInputHandlerImpl::MoveCaret(const gfx::Point& point) {
     return;
 
   render_frame_->GetWebFrame()->MoveCaretSelection(
-      render_frame_->render_view()->GetWidget()->ConvertWindowPointToViewport(
+      render_frame_->GetLocalRootRenderWidget()->ConvertWindowPointToViewport(
           point));
 }
 
@@ -450,9 +452,9 @@ void FrameInputHandlerImpl::ExecuteCommandOnMainThread(
 
 void FrameInputHandlerImpl::Release() {
   if (!main_thread_task_runner_->BelongsToCurrentThread()) {
-    // Close the binding on the compositor thread first before telling the main
+    // Close the receiver on the compositor thread first before telling the main
     // thread to delete this object.
-    binding_.Close();
+    receiver_.reset();
     main_thread_task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&FrameInputHandlerImpl::Release, weak_this_));
     return;
@@ -460,9 +462,10 @@ void FrameInputHandlerImpl::Release() {
   delete this;
 }
 
-void FrameInputHandlerImpl::BindNow(mojom::FrameInputHandlerRequest request) {
-  binding_.Bind(std::move(request));
-  binding_.set_connection_error_handler(
+void FrameInputHandlerImpl::BindNow(
+    mojo::PendingReceiver<mojom::FrameInputHandler> receiver) {
+  receiver_.Bind(std::move(receiver));
+  receiver_.set_disconnect_handler(
       base::BindOnce(&FrameInputHandlerImpl::Release, base::Unretained(this)));
 }
 
diff --git a/chromium/content/renderer/input/frame_input_handler_impl.h b/chromium/content/renderer/input/frame_input_handler_impl.h
index 29e4a17bb0e..7780f07a68e 100644
--- a/chromium/content/renderer/input/frame_input_handler_impl.h
+++ b/chromium/content/renderer/input/frame_input_handler_impl.h
@@ -10,7 +10,8 @@
 #include "content/common/content_export.h"
 #include "content/common/input/input_handler.mojom.h"
 #include "content/renderer/render_frame_impl.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 
 namespace content {
 class MainThreadEventQueue;
@@ -41,7 +42,7 @@ class CONTENT_EXPORT FrameInputHandlerImpl : public mojom::FrameInputHandler {
  public:
   static void CreateMojoService(
       base::WeakPtr<RenderFrameImpl> render_frame,
-      mojom::FrameInputHandlerRequest request);
+      mojo::PendingReceiver<mojom::FrameInputHandler> receiver);
 
   void SetCompositionFromExistingText(
       int32_t start,
@@ -97,16 +98,17 @@ class CONTENT_EXPORT FrameInputHandlerImpl : public mojom::FrameInputHandler {
     bool original_pasting_value_;
   };
 
-  FrameInputHandlerImpl(base::WeakPtr<RenderFrameImpl> render_frame,
-                        mojom::FrameInputHandlerRequest request);
+  FrameInputHandlerImpl(
+      base::WeakPtr<RenderFrameImpl> render_frame,
+      mojo::PendingReceiver<mojom::FrameInputHandler> receiver);
 
   void RunOnMainThread(base::OnceClosure closure);
-  void BindNow(mojom::FrameInputHandlerRequest request);
+  void BindNow(mojo::PendingReceiver<mojom::FrameInputHandler> receiver);
   void ExecuteCommandOnMainThread(const std::string& command,
                                   UpdateState state);
   void Release();
 
-  mojo::Binding<mojom::FrameInputHandler> binding_;
+  mojo::Receiver<mojom::FrameInputHandler> receiver_{this};
 
   // |render_frame_| should only be accessed on the main thread. Use
   // GetRenderFrame so that it will DCHECK this for you.
diff --git a/chromium/content/renderer/input/input_event_prediction.cc b/chromium/content/renderer/input/input_event_prediction.cc
index 26e4f453d3a..39319e0a604 100644
--- a/chromium/content/renderer/input/input_event_prediction.cc
+++ b/chromium/content/renderer/input/input_event_prediction.cc
@@ -18,6 +18,25 @@ using blink::WebTouchEvent;
 
 namespace content {
 
+namespace {
+
+const WebPointerProperties* ToWebPointerProperties(const WebInputEvent* event) {
+  if (WebInputEvent::IsMouseEventType(event->GetType()))
+    return static_cast<const WebMouseEvent*>(event);
+  if (WebInputEvent::IsPointerEventType(event->GetType()))
+    return static_cast<const WebPointerEvent*>(event);
+  return nullptr;
+}
+WebPointerProperties* ToWebPointerProperties(WebInputEvent* event) {
+  if (WebInputEvent::IsMouseEventType(event->GetType()))
+    return static_cast<WebMouseEvent*>(event);
+  if (WebInputEvent::IsPointerEventType(event->GetType()))
+    return static_cast<WebPointerEvent*>(event);
+  return nullptr;
+}
+
+}  // namespace
+
 InputEventPrediction::InputEventPrediction(bool enable_resampling)
     : enable_resampling_(enable_resampling) {
   // When resampling is enabled, set predictor type by resampling flag params;
@@ -85,61 +104,45 @@ void InputEventPrediction::UpdatePrediction(const WebInputEvent& event) {
         UpdateSinglePointer(touch_event.touches[i], touch_event.TimeStamp());
       }
     }
-  } else if (WebInputEvent::IsMouseEventType(event.GetType())) {
-    DCHECK(event.GetType() == WebInputEvent::kMouseMove);
-    UpdateSinglePointer(static_cast<const WebMouseEvent&>(event),
-                        event.TimeStamp());
-  } else if (WebInputEvent::IsPointerEventType(event.GetType())) {
-    DCHECK(event.GetType() == WebInputEvent::kPointerMove);
-    UpdateSinglePointer(static_cast<const WebPointerEvent&>(event),
-                        event.TimeStamp());
+  } else {
+    DCHECK(event.GetType() == WebInputEvent::kMouseMove ||
+           event.GetType() == WebInputEvent::kPointerMove);
+    UpdateSinglePointer(*ToWebPointerProperties(&event), event.TimeStamp());
   }
   last_event_timestamp_ = event.TimeStamp();
 }
 
-// When resampling, we don't want to predict too far away because the result
-// will likely be inaccurate in that case. We then cut off the prediction to
-// the maximum available for the current predictor
 void InputEventPrediction::ApplyResampling(base::TimeTicks frame_time,
                                            WebInputEvent* event) {
   base::TimeDelta prediction_delta = frame_time - event->TimeStamp();
   base::TimeTicks predict_time;
-  WebPointerProperties* wpp_event;
 
   if (event->GetType() == WebInputEvent::kTouchMove) {
     WebTouchEvent* touch_event = static_cast<WebTouchEvent*>(event);
     for (unsigned i = 0; i < touch_event->touches_length; ++i) {
-      wpp_event = &touch_event->touches[i];
-      // Cutoff prediction if delta > MaxResampleTime
-      auto predictor = pointer_id_predictor_map_.find(wpp_event->id);
-      if (predictor != pointer_id_predictor_map_.end()) {
-        prediction_delta =
-            std::min(prediction_delta, predictor->second->MaxResampleTime());
-        predict_time = event->TimeStamp() + prediction_delta;
-        // Compute the prediction
-        if (GetPointerPrediction(predict_time, wpp_event))
-          event->SetTimeStamp(predict_time);
+      if (touch_event->touches[i].state == blink::WebTouchPoint::kStateMoved) {
+        if (auto* predictor = GetPredictor(touch_event->touches[i])) {
+          // When resampling, we don't want to predict too far away because the
+          // result will likely be inaccurate in that case. We then cut off the
+          // prediction to the MaxResampleTime for the predictor.
+          prediction_delta =
+              std::min(prediction_delta, predictor->MaxResampleTime());
+          predict_time = event->TimeStamp() + prediction_delta;
+
+          if (GetPointerPrediction(predict_time, &touch_event->touches[i]))
+            event->SetTimeStamp(predict_time);
+        }
       }
     }
-  } else if (event->GetType() == WebInputEvent::kMouseMove) {
-    wpp_event = static_cast<WebMouseEvent*>(event);
-    // Cutoff prediction if delta > MaxResampleTime
-    prediction_delta =
-        std::min(prediction_delta, mouse_predictor_->MaxResampleTime());
-    predict_time = event->TimeStamp() + prediction_delta;
-    // Compute the prediction
-    if (GetPointerPrediction(predict_time, wpp_event))
-      event->SetTimeStamp(predict_time);
-  } else if (event->GetType() == WebInputEvent::kPointerMove) {
-    wpp_event = static_cast<WebPointerEvent*>(event);
-    // Cutoff prediction if delta > MaxResampleTime
-    auto predictor = pointer_id_predictor_map_.find(wpp_event->id);
-    if (predictor != pointer_id_predictor_map_.end()) {
+  } else {
+    WebPointerProperties* pointer_event = ToWebPointerProperties(event);
+    if (auto* predictor = GetPredictor(*pointer_event)) {
+      // Cutoff prediction if delta > MaxResampleTime
       prediction_delta =
-          std::min(prediction_delta, predictor->second->MaxResampleTime());
+          std::min(prediction_delta, predictor->MaxResampleTime());
       predict_time = event->TimeStamp() + prediction_delta;
-      // Compute the prediction
-      if (GetPointerPrediction(predict_time, wpp_event))
+
+      if (GetPointerPrediction(predict_time, pointer_event))
         event->SetTimeStamp(predict_time);
     }
   }
@@ -178,27 +181,24 @@ void InputEventPrediction::AddPredictedEvents(
       base::TimeDelta touch_time_interval;
       for (unsigned i = 0; i < touch_event.touches_length; ++i) {
         touch_time_interval +=
-            GetPredictionTimeInterval(&touch_event.touches[i]);
+            GetPredictionTimeInterval(touch_event.touches[i]);
       }
       predict_time += touch_time_interval / touch_event.touches_length;
       if (predict_time <= max_prediction_timestamp) {
-        success = true;
-        for (unsigned i = 0; i < touch_event.touches_length; ++i)
-          success &=
-              GetPointerPrediction(predict_time, &touch_event.touches[i]);
+        for (unsigned i = 0; i < touch_event.touches_length; ++i) {
+          if (touch_event.touches[i].state ==
+              blink::WebTouchPoint::kStateMoved) {
+            success =
+                GetPointerPrediction(predict_time, &touch_event.touches[i]);
+          }
+        }
       }
-    } else if (predicted_event->GetType() == WebInputEvent::kMouseMove) {
-      WebMouseEvent& mouse_event =
-          static_cast<WebMouseEvent&>(*predicted_event);
-      predict_time += GetPredictionTimeInterval(&mouse_event);
-      success = predict_time <= max_prediction_timestamp &&
-                GetPointerPrediction(predict_time, &mouse_event);
-    } else if (predicted_event->GetType() == WebInputEvent::kPointerMove) {
-      WebPointerEvent& pointer_event =
-          static_cast<WebPointerEvent&>(*predicted_event);
-      predict_time += GetPredictionTimeInterval(&pointer_event);
+    } else {
+      WebPointerProperties* pointer_event =
+          ToWebPointerProperties(predicted_event.get());
+      predict_time += GetPredictionTimeInterval(*pointer_event);
       success = predict_time <= max_prediction_timestamp &&
-                GetPointerPrediction(predict_time, &pointer_event);
+                GetPointerPrediction(predict_time, pointer_event);
     }
     if (success) {
       predicted_event->SetTimeStamp(predict_time);
@@ -207,14 +207,22 @@ void InputEventPrediction::AddPredictedEvents(
   }
 }
 
+ui::InputPredictor* InputEventPrediction::GetPredictor(
+    const WebPointerProperties& event) const {
+  if (event.pointer_type == WebPointerProperties::PointerType::kMouse)
+    return mouse_predictor_.get();
+
+  auto predictor = pointer_id_predictor_map_.find(event.id);
+  if (predictor != pointer_id_predictor_map_.end())
+    return predictor->second.get();
+
+  return nullptr;
+}
+
 base::TimeDelta InputEventPrediction::GetPredictionTimeInterval(
-    WebPointerProperties* event) const {
-  if (event->pointer_type != WebPointerProperties::PointerType::kMouse) {
-    auto predictor = pointer_id_predictor_map_.find(event->id);
-    if (predictor != pointer_id_predictor_map_.end()) {
-      return predictor->second->TimeInterval();
-    }
-  }
+    const WebPointerProperties& event) const {
+  if (auto* predictor = GetPredictor(event))
+    return predictor->TimeInterval();
   return mouse_predictor_->TimeInterval();
 }
 
@@ -222,39 +230,26 @@ void InputEventPrediction::UpdateSinglePointer(
     const WebPointerProperties& event,
     base::TimeTicks event_time) {
   ui::InputPredictor::InputData data = {event.PositionInWidget(), event_time};
-  if (event.pointer_type == WebPointerProperties::PointerType::kMouse)
-    mouse_predictor_->Update(data);
-  else {
-    auto predictor = pointer_id_predictor_map_.find(event.id);
-    if (predictor != pointer_id_predictor_map_.end()) {
-      predictor->second->Update(data);
-    } else {
-      // Workaround for GLIBC C++ < 7.3 that fails to insert with braces
-      // See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82522
-      auto pair = std::make_pair(event.id, CreatePredictor());
-      pointer_id_predictor_map_.insert(std::move(pair));
-      pointer_id_predictor_map_[event.id]->Update(data);
-    }
+  if (auto* predictor = GetPredictor(event)) {
+    predictor->Update(data);
+  } else {
+    // Create new predictor.
+    auto pair = std::make_pair(event.id, CreatePredictor());
+    pointer_id_predictor_map_.insert(std::move(pair));
+    pointer_id_predictor_map_[event.id]->Update(data);
   }
 }
 
 bool InputEventPrediction::GetPointerPrediction(base::TimeTicks predict_time,
                                                 WebPointerProperties* event) {
-  ui::InputPredictor::InputData predict_result;
-  if (event->pointer_type == WebPointerProperties::PointerType::kMouse) {
-    if (mouse_predictor_->HasPrediction() &&
-        mouse_predictor_->GeneratePrediction(predict_time, &predict_result)) {
-      event->SetPositionInWidget(predict_result.pos);
-      return true;
-    }
-  } else {
-    // Reset mouse predictor if pointer type is touch or stylus
+  // Reset mouse predictor if pointer type is touch or stylus
+  if (event->pointer_type != WebPointerProperties::PointerType::kMouse)
     mouse_predictor_->Reset();
 
-    auto predictor = pointer_id_predictor_map_.find(event->id);
-    if (predictor != pointer_id_predictor_map_.end() &&
-        predictor->second->HasPrediction() &&
-        predictor->second->GeneratePrediction(predict_time, &predict_result)) {
+  ui::InputPredictor::InputData predict_result;
+  if (auto* predictor = GetPredictor(*event)) {
+    if (predictor->HasPrediction() &&
+        predictor->GeneratePrediction(predict_time, &predict_result)) {
       event->SetPositionInWidget(predict_result.pos);
       return true;
     }
@@ -288,12 +283,9 @@ void InputEventPrediction::ComputeAccuracy(const WebInputEvent& event) const {
     const WebTouchEvent& touch_event = static_cast<const WebTouchEvent&>(event);
     for (unsigned i = 0; i < touch_event.touches_length; ++i) {
       if (touch_event.touches[i].state == blink::WebTouchPoint::kStateMoved) {
-        auto predictor =
-            pointer_id_predictor_map_.find(touch_event.touches[i].id);
-        if (predictor != pointer_id_predictor_map_.end() &&
-            predictor->second->HasPrediction() &&
-            predictor->second->GeneratePrediction(event.TimeStamp(),
-                                                  &predict_result)) {
+        auto* predictor = GetPredictor(touch_event.touches[i]);
+        if (predictor && predictor->HasPrediction() &&
+            predictor->GeneratePrediction(event.TimeStamp(), &predict_result)) {
           float distance =
               (predict_result.pos -
                gfx::PointF(touch_event.touches[i].PositionInWidget()))
@@ -306,9 +298,9 @@ void InputEventPrediction::ComputeAccuracy(const WebInputEvent& event) const {
     }
   } else if (event.GetType() == WebInputEvent::kMouseMove) {
     const WebMouseEvent& mouse_event = static_cast<const WebMouseEvent&>(event);
-    if (mouse_predictor_->HasPrediction() &&
-        mouse_predictor_->GeneratePrediction(event.TimeStamp(),
-                                             &predict_result)) {
+    auto* predictor = GetPredictor(mouse_event);
+    if (predictor && predictor->HasPrediction() &&
+        predictor->GeneratePrediction(event.TimeStamp(), &predict_result)) {
       float distance =
           (predict_result.pos - gfx::PointF(mouse_event.PositionInWidget()))
               .Length();
diff --git a/chromium/content/renderer/input/input_event_prediction.h b/chromium/content/renderer/input/input_event_prediction.h
index 526591ef8be..e885ec38f37 100644
--- a/chromium/content/renderer/input/input_event_prediction.h
+++ b/chromium/content/renderer/input/input_event_prediction.h
@@ -63,7 +63,11 @@ class CONTENT_EXPORT InputEventPrediction {
 
   // Get time interval of a pointer. Default to mouse predictor if there is no
   // predictor for pointer.
-  base::TimeDelta GetPredictionTimeInterval(WebPointerProperties* event) const;
+  base::TimeDelta GetPredictionTimeInterval(
+      const WebPointerProperties& event) const;
+
+  // Returns a pointer to the predictor for given WebPointerProperties.
+  ui::InputPredictor* GetPredictor(const WebPointerProperties& event) const;
 
   // Get single predictor based on event id and type, and update the predictor
   // with new events coords.
diff --git a/chromium/content/renderer/input/input_event_prediction_unittest.cc b/chromium/content/renderer/input/input_event_prediction_unittest.cc
index 621445bdf64..b3949c53289 100644
--- a/chromium/content/renderer/input/input_event_prediction_unittest.cc
+++ b/chromium/content/renderer/input/input_event_prediction_unittest.cc
@@ -438,4 +438,28 @@ TEST_F(InputEventPredictionTest, PredictedEventsTimeIntervalEqualRealEvents) {
   }
 }
 
+// Test that touch points other than kStateMove will not have predicted events.
+TEST_F(InputEventPredictionTest, TouchPointStates) {
+  SyntheticWebTouchEvent touch_event;
+  touch_event.PressPoint(10, 10);
+  HandleEvents(touch_event);
+  // Send 3 moves to initialize predictor.
+  for (int i = 0; i < 3; i++) {
+    touch_event.MovePoint(0, 10, 10);
+    HandleEvents(touch_event);
+  }
+
+  for (int state = blink::WebTouchPoint::kStateUndefined;
+       state <= blink::WebTouchPoint::kStateMax; state++) {
+    touch_event.touches[0].state =
+        static_cast<blink::WebTouchPoint::State>(state);
+    blink::WebCoalescedInputEvent coalesced_event(touch_event);
+    event_predictor_->HandleEvents(coalesced_event, ui::EventTimeForNow());
+    if (state == blink::WebTouchPoint::kStateMoved)
+      EXPECT_GT(coalesced_event.PredictedEventSize(), 0u);
+    else
+      EXPECT_EQ(coalesced_event.PredictedEventSize(), 0u);
+  }
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/input/main_thread_event_queue_unittest.cc b/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
index dd1813410f5..af1f29abaec 100644
--- a/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
+++ b/chromium/content/renderer/input/main_thread_event_queue_unittest.cc
@@ -261,8 +261,8 @@ TEST_F(MainThreadEventQueueTest, ClientDoesntHandleInputEvent) {
   SyntheticWebTouchEvent event;
   event.PressPoint(10, 10);
   event.MovePoint(0, 20, 20);
-  WebMouseWheelEvent event2 =
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, 53, 0, false);
+  WebMouseWheelEvent event2 = SyntheticWebMouseWheelEventBuilder::Build(
+      10, 10, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel);
   HandleEvent(event2, INPUT_EVENT_ACK_STATE_NOT_CONSUMED);
   RunPendingTasksWithSimulatedRaf();
 
@@ -282,10 +282,14 @@ TEST_F(MainThreadEventQueueTest, ClientDoesntHandleInputEvent) {
 
 TEST_F(MainThreadEventQueueTest, NonBlockingWheel) {
   WebMouseWheelEvent kEvents[4] = {
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, 53, 0, false),
-      SyntheticWebMouseWheelEventBuilder::Build(20, 20, 0, 53, 0, false),
-      SyntheticWebMouseWheelEventBuilder::Build(30, 30, 0, 53, 1, false),
-      SyntheticWebMouseWheelEventBuilder::Build(30, 30, 0, 53, 1, false),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          10, 10, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          20, 20, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          30, 30, 0, 53, 1, ui::input_types::ScrollGranularity::kScrollByPixel),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          30, 30, 0, 53, 1, ui::input_types::ScrollGranularity::kScrollByPixel),
   };
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -527,8 +531,10 @@ TEST_F(MainThreadEventQueueTest, BlockingTouch) {
 
 TEST_F(MainThreadEventQueueTest, InterleavedEvents) {
   WebMouseWheelEvent kWheelEvents[2] = {
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, 53, 0, false),
-      SyntheticWebMouseWheelEventBuilder::Build(20, 20, 0, 53, 0, false),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          10, 10, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          20, 20, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel),
   };
   SyntheticWebTouchEvent kTouchEvents[2];
   kTouchEvents[0].PressPoint(10, 10);
@@ -599,9 +605,12 @@ TEST_F(MainThreadEventQueueTest, RafAlignedMouseInput) {
       SyntheticWebMouseEventBuilder::Build(WebInputEvent::kMouseUp, 10, 10, 0);
 
   WebMouseWheelEvent wheelEvents[3] = {
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, 53, 0, false),
-      SyntheticWebMouseWheelEventBuilder::Build(20, 20, 0, 53, 0, false),
-      SyntheticWebMouseWheelEventBuilder::Build(20, 20, 0, 53, 1, false),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          10, 10, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          20, 20, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel),
+      SyntheticWebMouseWheelEventBuilder::Build(
+          20, 20, 0, 53, 1, ui::input_types::ScrollGranularity::kScrollByPixel),
   };
 
   EXPECT_FALSE(main_task_runner_->HasPendingTask());
@@ -890,8 +899,8 @@ TEST_F(MainThreadEventQueueTest, LowLatency) {
 
   WebMouseEvent mouse_move = SyntheticWebMouseEventBuilder::Build(
       WebInputEvent::kMouseMove, 10, 10, 0);
-  WebMouseWheelEvent mouse_wheel =
-      SyntheticWebMouseWheelEventBuilder::Build(10, 10, 0, 53, 0, false);
+  WebMouseWheelEvent mouse_wheel = SyntheticWebMouseWheelEventBuilder::Build(
+      10, 10, 0, 53, 0, ui::input_types::ScrollGranularity::kScrollByPixel);
 
   HandleEvent(mouse_move, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
   HandleEvent(mouse_wheel, INPUT_EVENT_ACK_STATE_SET_NON_BLOCKING);
diff --git a/chromium/content/renderer/input/render_widget_input_handler.cc b/chromium/content/renderer/input/render_widget_input_handler.cc
index a7d66ff67e9..c557b3696e7 100644
--- a/chromium/content/renderer/input/render_widget_input_handler.cc
+++ b/chromium/content/renderer/input/render_widget_input_handler.cc
@@ -13,7 +13,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "build/build_config.h"
 #include "cc/paint/element_id.h"
-#include "cc/trees/swap_promise_monitor.h"
+#include "cc/trees/latency_info_swap_promise_monitor.h"
 #include "components/viz/common/surfaces/frame_sink_id.h"
 #include "content/common/input/input_event_ack.h"
 #include "content/public/common/content_switches.h"
@@ -270,7 +270,7 @@ viz::FrameSinkId RenderWidgetInputHandler::GetFrameSinkIdAtPoint(
 
 WebInputEventResult RenderWidgetInputHandler::HandleTouchEvent(
     const blink::WebCoalescedInputEvent& coalesced_event) {
-  // This method must only be called on non-frozen RenderWidget, which is
+  // This method must only be called on non-undead RenderWidget, which is
   // guaranteed to have a WebWidget.
   // TODO(https://crbug.com/995981): Eventually we should be able to remote this
   // DCHECK, since RenderWidget's lifetime [and thus this instance's] will be
@@ -309,7 +309,7 @@ void RenderWidgetInputHandler::HandleInputEvent(
     const blink::WebCoalescedInputEvent& coalesced_event,
     const ui::LatencyInfo& latency_info,
     HandledEventCallback callback) {
-  // This method must only be called on non-frozen RenderWidget, which is
+  // This method must only be called on non-undead RenderWidget, which is
   // guaranteed to have a WebWidget.
   // TODO(https://crbug.com/995981): Eventually we should be able to remote this
   // DCHECK, since RenderWidget's lifetime [and thus this instance's] will be
@@ -364,30 +364,33 @@ void RenderWidgetInputHandler::HandleInputEvent(
   if (!start_time.is_null())
     LogInputEventLatencyUma(input_event, start_time);
 
-  std::unique_ptr<cc::SwapPromiseMonitor> latency_info_swap_promise_monitor;
   ui::LatencyInfo swap_latency_info(latency_info);
-
   swap_latency_info.AddLatencyNumber(
       ui::LatencyComponentType::INPUT_EVENT_LATENCY_RENDERER_MAIN_COMPONENT);
-  if (widget_->layer_tree_view()) {
-    latency_info_swap_promise_monitor =
-        widget_->layer_tree_view()->CreateLatencyInfoSwapPromiseMonitor(
-            &swap_latency_info);
-  }
+  cc::LatencyInfoSwapPromiseMonitor swap_promise_monitor(
+      &swap_latency_info, widget_->layer_tree_host()->GetSwapPromiseManager(),
+      nullptr);
 
   bool prevent_default = false;
+  bool show_virtual_keyboard_for_mouse = false;
   if (WebInputEvent::IsMouseEventType(input_event.GetType())) {
     const WebMouseEvent& mouse_event =
         static_cast<const WebMouseEvent&>(input_event);
     TRACE_EVENT2("renderer", "HandleMouseMove", "x",
                  mouse_event.PositionInWidget().x, "y",
                  mouse_event.PositionInWidget().y);
+
     prevent_default = delegate_->WillHandleMouseEvent(mouse_event);
 
     // Reset the last known cursor if mouse has left this widget. So next
     // time that the mouse enters we always set the cursor accordingly.
     if (mouse_event.GetType() == WebInputEvent::kMouseLeave)
       current_cursor_.reset();
+
+    if (mouse_event.button == WebPointerProperties::Button::kLeft &&
+        mouse_event.GetType() == WebInputEvent::kMouseUp) {
+      show_virtual_keyboard_for_mouse = true;
+    }
   }
 
   if (WebInputEvent::IsKeyboardEventType(input_event.GetType())) {
@@ -494,9 +497,9 @@ void RenderWidgetInputHandler::HandleInputEvent(
 
   // Show the virtual keyboard if enabled and a user gesture triggers a focus
   // change.
-  if (processed != WebInputEventResult::kNotHandled &&
-      (input_event.GetType() == WebInputEvent::kTouchEnd ||
-       input_event.GetType() == WebInputEvent::kMouseUp)) {
+  if ((processed != WebInputEventResult::kNotHandled &&
+       input_event.GetType() == WebInputEvent::kTouchEnd) ||
+      show_virtual_keyboard_for_mouse) {
     delegate_->ShowVirtualKeyboard();
   }
 
@@ -586,7 +589,7 @@ void RenderWidgetInputHandler::InjectGestureScrollEvent(
                                           granularity);
     if (injected_type == WebInputEvent::Type::kGestureScrollBegin) {
       gesture_event->data.scroll_begin.scrollable_area_element_id =
-          scrollable_area_element_id.GetInternalValue();
+          scrollable_area_element_id.GetStableId();
     }
 
     ui::LatencyInfo latency_info;
@@ -603,7 +606,7 @@ void RenderWidgetInputHandler::HandleInjectedScrollGestures(
     std::vector<InjectScrollGestureParams> injected_scroll_params,
     const WebInputEvent& input_event,
     const ui::LatencyInfo& original_latency_info) {
-  // This method must only be called on non-frozen RenderWidget, which is
+  // This method must only be called on non-undead RenderWidget, which is
   // guaranteed to have a WebWidget.
   // TODO(https://crbug.com/995981): Eventually we should be able to remote this
   // DCHECK, since RenderWidget's lifetime [and thus this instance's] will be
@@ -659,27 +662,25 @@ void RenderWidgetInputHandler::HandleInjectedScrollGestures(
       }
     }
 
-    std::unique_ptr<cc::SwapPromiseMonitor> swap_promise_monitor;
-    if (widget_->layer_tree_view()) {
-      swap_promise_monitor =
-          widget_->layer_tree_view()->CreateLatencyInfoSwapPromiseMonitor(
-              &scrollbar_latency_info);
-    }
-
     std::unique_ptr<WebGestureEvent> gesture_event =
         ui::GenerateInjectedScrollGesture(
             params.type, input_event.TimeStamp(), params.device, position,
             params.scroll_delta, params.granularity);
     if (params.type == WebInputEvent::Type::kGestureScrollBegin) {
       gesture_event->data.scroll_begin.scrollable_area_element_id =
-          params.scrollable_area_element_id.GetInternalValue();
+          params.scrollable_area_element_id.GetStableId();
       last_injected_gesture_was_begin_ = true;
     } else {
       last_injected_gesture_was_begin_ = false;
     }
 
-    widget_->GetWebWidget()->HandleInputEvent(
-        blink::WebCoalescedInputEvent(*gesture_event.get()));
+    {
+      cc::LatencyInfoSwapPromiseMonitor swap_promise_monitor(
+          &scrollbar_latency_info,
+          widget_->layer_tree_host()->GetSwapPromiseManager(), nullptr);
+      widget_->GetWebWidget()->HandleInputEvent(
+          blink::WebCoalescedInputEvent(*gesture_event.get()));
+    }
   }
 }
 
diff --git a/chromium/content/renderer/input/synchronous_compositor_proxy.cc b/chromium/content/renderer/input/synchronous_compositor_proxy.cc
index 4d52a6f35e4..348c0dc0399 100644
--- a/chromium/content/renderer/input/synchronous_compositor_proxy.cc
+++ b/chromium/content/renderer/input/synchronous_compositor_proxy.cc
@@ -401,6 +401,8 @@ void SynchronousCompositorProxy::BindChannel(
   control_host_.Bind(std::move(control_host));
   host_.Bind(std::move(host));
   receiver_.Bind(std::move(compositor_request));
+  receiver_.set_disconnect_handler(base::BindOnce(
+      &SynchronousCompositorProxy::HostDisconnected, base::Unretained(this)));
 
   if (layer_tree_frame_sink_)
     LayerTreeFrameSinkCreated();
@@ -409,4 +411,13 @@ void SynchronousCompositorProxy::BindChannel(
     host_->SetNeedsBeginFrames(true);
 }
 
+void SynchronousCompositorProxy::HostDisconnected() {
+  // It is possible due to bugs that the Host is disconnected without pausing
+  // begin frames. This causes hard-to-reproduce but catastrophic bug of
+  // blocking the renderer main thread forever on a commit. See
+  // crbug.com/1010478 for when this happened. This is to prevent a similar
+  // bug in the future.
+  SetBeginFrameSourcePaused(true);
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/input/synchronous_compositor_proxy.h b/chromium/content/renderer/input/synchronous_compositor_proxy.h
index ae3ffab9d22..a175279a4fb 100644
--- a/chromium/content/renderer/input/synchronous_compositor_proxy.h
+++ b/chromium/content/renderer/input/synchronous_compositor_proxy.h
@@ -115,6 +115,7 @@ class SynchronousCompositorProxy : public ui::SynchronousInputHandler,
  private:
   void DoDemandDrawSw(const SyncCompositorDemandDrawSwParams& params);
   uint32_t NextMetadataVersion();
+  void HostDisconnected();
 
   struct SharedMemoryWithSize;
 
diff --git a/chromium/content/renderer/input/widget_input_handler_impl.cc b/chromium/content/renderer/input/widget_input_handler_impl.cc
index f74bc38edfc..8bca69e24bf 100644
--- a/chromium/content/renderer/input/widget_input_handler_impl.cc
+++ b/chromium/content/renderer/input/widget_input_handler_impl.cc
@@ -28,10 +28,9 @@ namespace {
 
 void RunClosureIfNotSwappedOut(base::WeakPtr<RenderWidget> render_widget,
                                base::OnceClosure closure) {
-  // Input messages must not be processed if the RenderWidget is in a frozen or
-  // closing state.
-  if (!render_widget || render_widget->is_frozen() ||
-      render_widget->is_closing()) {
+  // Input messages must not be processed if the RenderWidget was undead or is
+  // closing.
+  if (!render_widget || render_widget->IsUndeadOrProvisional()) {
     return;
   }
   std::move(closure).Run();
@@ -124,10 +123,8 @@ static void ImeCommitTextOnMainThread(
     const gfx::Range& range,
     int32_t relative_cursor_position,
     WidgetInputHandlerImpl::ImeCommitTextCallback callback) {
-  if (render_widget) {
-    render_widget->OnImeCommitText(text, ime_text_spans, range,
-                                   relative_cursor_position);
-  }
+  render_widget->OnImeCommitText(text, ime_text_spans, range,
+                                 relative_cursor_position);
   callback_task_runner->PostTask(FROM_HERE, std::move(callback));
 }
 
diff --git a/chromium/content/renderer/input/widget_input_handler_manager.cc b/chromium/content/renderer/input/widget_input_handler_manager.cc
index dfeb881b5dd..8df5e3d4f56 100644
--- a/chromium/content/renderer/input/widget_input_handler_manager.cc
+++ b/chromium/content/renderer/input/widget_input_handler_manager.cc
@@ -162,7 +162,7 @@ void WidgetInputHandlerManager::InitInputHandler() {
   uses_input_handler_ = true;
   base::OnceClosure init_closure = base::BindOnce(
       &WidgetInputHandlerManager::InitOnInputHandlingThread, this,
-      render_widget_->layer_tree_view()->GetInputHandler(),
+      render_widget_->layer_tree_host()->GetInputHandler(),
       render_widget_->compositor_deps()->IsScrollAnimatorEnabled(),
       sync_compositing);
   InputThreadTaskRunner()->PostTask(FROM_HERE, std::move(init_closure));
@@ -356,7 +356,7 @@ void WidgetInputHandlerManager::DispatchEvent(
   // move event.
   // We don't want users interacting with stuff they can't see, so we drop it.
   // We allow moves because we need to keep the current pointer location up
-  // to date. Tests can allow pre-commit input through the
+  // to date. Tests and other code can allow pre-commit input through the
   // "allow-pre-commit-input" command line flag.
   // TODO(schenney): Also allow scrolls? This would make some tests not flaky,
   // it seems, because they sometimes crash on seeing a scroll update/end
@@ -567,8 +567,7 @@ void WidgetInputHandlerManager::HandleInputEvent(
     const ui::WebScopedInputEvent& event,
     const ui::LatencyInfo& latency,
     mojom::WidgetInputHandler::DispatchEventCallback callback) {
-  if (!render_widget_ || render_widget_->is_frozen() ||
-      render_widget_->is_closing()) {
+  if (!render_widget_ || render_widget_->IsUndeadOrProvisional()) {
     if (callback) {
       std::move(callback).Run(InputEventAckSource::MAIN_THREAD, latency,
                               INPUT_EVENT_ACK_STATE_NOT_CONSUMED, base::nullopt,
diff --git a/chromium/content/renderer/internal_document_state_data.cc b/chromium/content/renderer/internal_document_state_data.cc
index 26f1cb41ea9..2497e2b2e42 100644
--- a/chromium/content/renderer/internal_document_state_data.cc
+++ b/chromium/content/renderer/internal_document_state_data.cc
@@ -19,11 +19,8 @@ const char kUserDataKey[] = "InternalDocumentStateData";
 }
 
 InternalDocumentStateData::InternalDocumentStateData()
-    : http_status_code_(0),
-      is_overriding_user_agent_(false),
-      must_reset_scroll_and_scale_state_(false),
-      cache_policy_override_set_(false),
-      cache_policy_override_(blink::mojom::FetchCacheMode::kDefault) {}
+    : is_overriding_user_agent_(false),
+      must_reset_scroll_and_scale_state_(false) {}
 
 // static
 InternalDocumentStateData* InternalDocumentStateData::FromDocumentLoader(
@@ -50,14 +47,10 @@ InternalDocumentStateData::~InternalDocumentStateData() {
 }
 
 void InternalDocumentStateData::CopyFrom(InternalDocumentStateData* other) {
-  http_status_code_ = other->http_status_code_;
   is_overriding_user_agent_ = other->is_overriding_user_agent_;
   must_reset_scroll_and_scale_state_ =
       other->must_reset_scroll_and_scale_state_;
-  cache_policy_override_set_ = other->cache_policy_override_set_;
-  cache_policy_override_ = other->cache_policy_override_;
   effective_connection_type_ = other->effective_connection_type_;
-  previews_state_ = other->previews_state_;
   request_id_ = other->request_id_;
 }
 
diff --git a/chromium/content/renderer/internal_document_state_data.h b/chromium/content/renderer/internal_document_state_data.h
index 1a71890a4d1..7aa1cfc7437 100644
--- a/chromium/content/renderer/internal_document_state_data.h
+++ b/chromium/content/renderer/internal_document_state_data.h
@@ -10,7 +10,6 @@
 
 #include "base/macros.h"
 #include "base/supports_user_data.h"
-#include "content/public/common/previews_state.h"
 #include "net/nqe/effective_connection_type.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "url/gurl.h"
@@ -36,11 +35,6 @@ class InternalDocumentStateData : public base::SupportsUserData::Data {
 
   void CopyFrom(InternalDocumentStateData* other);
 
-  int http_status_code() const { return http_status_code_; }
-  void set_http_status_code(int http_status_code) {
-    http_status_code_ = http_status_code;
-  }
-
   // True if the user agent was overridden for this page.
   bool is_overriding_user_agent() const { return is_overriding_user_agent_; }
   void set_is_overriding_user_agent(bool state) {
@@ -56,24 +50,6 @@ class InternalDocumentStateData : public base::SupportsUserData::Data {
     must_reset_scroll_and_scale_state_ = state;
   }
 
-  // Sets the cache policy. The cache policy is only used if explicitly set and
-  // by default is not set. You can mark a NavigationState as not having a cache
-  // state by way of clear_cache_policy_override.
-  void set_cache_policy_override(blink::mojom::FetchCacheMode cache_policy) {
-    cache_policy_override_ = cache_policy;
-    cache_policy_override_set_ = true;
-  }
-  blink::mojom::FetchCacheMode cache_policy_override() const {
-    return cache_policy_override_;
-  }
-  void clear_cache_policy_override() {
-    cache_policy_override_set_ = false;
-    cache_policy_override_ = blink::mojom::FetchCacheMode::kDefault;
-  }
-  bool is_cache_policy_override_set() const {
-    return cache_policy_override_set_;
-  }
-
   net::EffectiveConnectionType effective_connection_type() const {
     return effective_connection_type_;
   }
@@ -82,11 +58,6 @@ class InternalDocumentStateData : public base::SupportsUserData::Data {
     effective_connection_type_ = effective_connection_type;
   }
 
-  PreviewsState previews_state() const { return previews_state_; }
-  void set_previews_state(PreviewsState previews_state) {
-    previews_state_ = previews_state;
-  }
-
   // This is a fake navigation request id, which we send to the browser process
   // together with metrics. Note that renderer does not actually issue a request
   // for navigation (browser does it instead), but still reports metrics for it.
@@ -98,14 +69,10 @@ class InternalDocumentStateData : public base::SupportsUserData::Data {
   void set_navigation_state(std::unique_ptr<NavigationState> navigation_state);
 
  private:
-  int http_status_code_;
   bool is_overriding_user_agent_;
   bool must_reset_scroll_and_scale_state_;
-  bool cache_policy_override_set_;
-  blink::mojom::FetchCacheMode cache_policy_override_;
   net::EffectiveConnectionType effective_connection_type_ =
       net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN;
-  PreviewsState previews_state_ = PREVIEWS_UNSPECIFIED;
   int request_id_ = -1;
   std::unique_ptr<NavigationState> navigation_state_;
 
diff --git a/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc b/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
index 6bdea06a955..69bf7a5d1e1 100644
--- a/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
+++ b/chromium/content/renderer/loader/child_url_loader_factory_bundle.cc
@@ -120,7 +120,7 @@ ChildURLLoaderFactoryBundleInfo::ChildURLLoaderFactoryBundleInfo(
     : URLLoaderFactoryBundleInfo(
           std::move(base_factories->pending_default_factory()),
           std::move(base_factories->pending_scheme_specific_factories()),
-          std::move(base_factories->pending_initiator_specific_factories()),
+          std::move(base_factories->pending_isolated_world_factories()),
           base_factories->bypass_redirect_checks()) {
   pending_appcache_factory_ =
       std::move(base_factories->pending_appcache_factory());
@@ -132,16 +132,15 @@ ChildURLLoaderFactoryBundleInfo::ChildURLLoaderFactoryBundleInfo(
     mojo::PendingRemote<network::mojom::URLLoaderFactory>
         pending_appcache_factory,
     SchemeMap pending_scheme_specific_factories,
-    OriginMap pending_initiator_specific_factories,
+    OriginMap pending_isolated_world_factories,
     network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info,
     mojo::PendingRemote<network::mojom::URLLoaderFactory>
         pending_prefetch_loader_factory,
     bool bypass_redirect_checks)
-    : URLLoaderFactoryBundleInfo(
-          std::move(pending_default_factory),
-          std::move(pending_scheme_specific_factories),
-          std::move(pending_initiator_specific_factories),
-          bypass_redirect_checks),
+    : URLLoaderFactoryBundleInfo(std::move(pending_default_factory),
+                                 std::move(pending_scheme_specific_factories),
+                                 std::move(pending_isolated_world_factories),
+                                 bypass_redirect_checks),
       direct_network_factory_info_(std::move(direct_network_factory_info)),
       pending_prefetch_loader_factory_(
           std::move(pending_prefetch_loader_factory)) {
@@ -157,8 +156,8 @@ ChildURLLoaderFactoryBundleInfo::CreateFactory() {
   other->pending_appcache_factory_ = std::move(pending_appcache_factory_);
   other->pending_scheme_specific_factories_ =
       std::move(pending_scheme_specific_factories_);
-  other->pending_initiator_specific_factories_ =
-      std::move(pending_initiator_specific_factories_);
+  other->pending_isolated_world_factories_ =
+      std::move(pending_isolated_world_factories_);
   other->direct_network_factory_info_ = std::move(direct_network_factory_info_);
   other->pending_prefetch_loader_factory_ =
       std::move(pending_prefetch_loader_factory_);
@@ -327,7 +326,7 @@ ChildURLLoaderFactoryBundle::CloneInternal(bool include_appcache) {
       std::move(default_factory_pending_remote),
       std::move(appcache_factory_pending_remote),
       CloneRemoteMapToPendingRemoteMap(scheme_specific_factories_),
-      CloneRemoteMapToPendingRemoteMap(initiator_specific_factories_),
+      CloneRemoteMapToPendingRemoteMap(isolated_world_factories_),
       std::move(direct_network_factory_info),
       std::move(pending_prefetch_loader_factory), bypass_redirect_checks_);
 }
@@ -338,12 +337,12 @@ ChildURLLoaderFactoryBundle::PassInterface() {
 
   mojo::PendingRemote<network::mojom::URLLoaderFactory> pending_default_factory;
   if (default_factory_)
-    pending_default_factory = default_factory_.PassInterface();
+    pending_default_factory = default_factory_.Unbind();
 
   mojo::PendingRemote<network::mojom::URLLoaderFactory>
       pending_appcache_factory;
   if (appcache_factory_)
-    pending_appcache_factory = appcache_factory_.PassInterface();
+    pending_appcache_factory = appcache_factory_.Unbind();
 
   network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info;
   if (direct_network_factory_) {
@@ -359,8 +358,7 @@ ChildURLLoaderFactoryBundle::PassInterface() {
   return std::make_unique<ChildURLLoaderFactoryBundleInfo>(
       std::move(pending_default_factory), std::move(pending_appcache_factory),
       BoundRemoteMapToPendingRemoteMap(std::move(scheme_specific_factories_)),
-      BoundRemoteMapToPendingRemoteMap(
-          std::move(initiator_specific_factories_)),
+      BoundRemoteMapToPendingRemoteMap(std::move(isolated_world_factories_)),
       std::move(direct_network_factory_info),
       std::move(pending_prefetch_loader_factory), bypass_redirect_checks_);
 }
diff --git a/chromium/content/renderer/loader/child_url_loader_factory_bundle.h b/chromium/content/renderer/loader/child_url_loader_factory_bundle.h
index 8831d337520..9c0716e0a8a 100644
--- a/chromium/content/renderer/loader/child_url_loader_factory_bundle.h
+++ b/chromium/content/renderer/loader/child_url_loader_factory_bundle.h
@@ -41,7 +41,7 @@ class CONTENT_EXPORT ChildURLLoaderFactoryBundleInfo
       mojo::PendingRemote<network::mojom::URLLoaderFactory>
           pending_default_network_factory,
       SchemeMap pending_scheme_specific_factories,
-      OriginMap pending_initiator_specific_factories,
+      OriginMap pending_isolated_world_factories,
       network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info,
       mojo::PendingRemote<network::mojom::URLLoaderFactory>
           pending_prefetch_loader_factory,
diff --git a/chromium/content/renderer/loader/navigation_body_loader.cc b/chromium/content/renderer/loader/navigation_body_loader.cc
index a8810f2e3c1..09762f76528 100644
--- a/chromium/content/renderer/loader/navigation_body_loader.cc
+++ b/chromium/content/renderer/loader/navigation_body_loader.cc
@@ -10,7 +10,9 @@
 #include "content/renderer/loader/code_cache_loader_impl.h"
 #include "content/renderer/loader/resource_load_stats.h"
 #include "content/renderer/loader/web_url_loader_impl.h"
+#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/web/web_navigation_params.h"
 
 namespace content {
@@ -20,10 +22,10 @@ constexpr uint32_t NavigationBodyLoader::kMaxNumConsumedBytesInTask;
 
 // static
 void NavigationBodyLoader::FillNavigationParamsResponseAndBodyLoader(
-    const mojom::CommonNavigationParams& common_params,
-    const mojom::CommitNavigationParams& commit_params,
+    mojom::CommonNavigationParamsPtr common_params,
+    mojom::CommitNavigationParamsPtr commit_params,
     int request_id,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
     network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
@@ -32,29 +34,29 @@ void NavigationBodyLoader::FillNavigationParamsResponseAndBodyLoader(
     blink::WebNavigationParams* navigation_params) {
   // Use the original navigation url to start with. We'll replay the redirects
   // afterwards and will eventually arrive to the final url.
-  GURL url = !commit_params.original_url.is_empty() ? commit_params.original_url
-                                                    : common_params.url;
+  GURL url = !commit_params->original_url.is_empty()
+                 ? commit_params->original_url
+                 : common_params->url;
   auto resource_load_info = NotifyResourceLoadInitiated(
       render_frame_id, request_id, url,
-      !commit_params.original_method.empty() ? commit_params.original_method
-                                             : common_params.method,
-      common_params.referrer->url,
+      !commit_params->original_method.empty() ? commit_params->original_method
+                                              : common_params->method,
+      common_params->referrer->url,
       is_main_frame ? ResourceType::kMainFrame : ResourceType::kSubFrame,
       is_main_frame ? net::HIGHEST : net::LOWEST);
-  size_t redirect_count = commit_params.redirect_response.size();
+  size_t redirect_count = commit_params->redirect_response.size();
   navigation_params->redirects.reserve(redirect_count);
   navigation_params->redirects.resize(redirect_count);
   for (size_t i = 0; i < redirect_count; ++i) {
     blink::WebNavigationParams::RedirectInfo& redirect =
         navigation_params->redirects[i];
-    auto& redirect_info = commit_params.redirect_infos[i];
-    auto& redirect_response = commit_params.redirect_response[i];
-    NotifyResourceRedirectReceived(render_frame_id, resource_load_info.get(),
-                                   redirect_info, redirect_response);
+    auto& redirect_info = commit_params->redirect_infos[i];
+    auto& redirect_response = commit_params->redirect_response[i];
     WebURLLoaderImpl::PopulateURLResponse(
-        url, network::ResourceResponseHead(redirect_response),
-        &redirect.redirect_response, response_head.ssl_info.has_value(),
-        request_id);
+        url, *redirect_response, &redirect.redirect_response,
+        response_head->ssl_info.has_value(), request_id);
+    NotifyResourceRedirectReceived(render_frame_id, resource_load_info.get(),
+                                   redirect_info, std::move(redirect_response));
     if (url.SchemeIs(url::kDataScheme))
       redirect.redirect_response.SetHttpStatusCode(200);
     redirect.new_url = redirect_info.new_url;
@@ -69,28 +71,28 @@ void NavigationBodyLoader::FillNavigationParamsResponseAndBodyLoader(
   }
 
   WebURLLoaderImpl::PopulateURLResponse(
-      url, response_head, &navigation_params->response,
-      response_head.ssl_info.has_value(), request_id);
+      url, *response_head, &navigation_params->response,
+      response_head->ssl_info.has_value(), request_id);
   if (url.SchemeIs(url::kDataScheme))
     navigation_params->response.SetHttpStatusCode(200);
 
   if (url_loader_client_endpoints) {
     navigation_params->body_loader.reset(new NavigationBodyLoader(
-        response_head, std::move(response_body),
+        std::move(response_head), std::move(response_body),
         std::move(url_loader_client_endpoints), task_runner, render_frame_id,
         std::move(resource_load_info)));
   }
 }
 
 NavigationBodyLoader::NavigationBodyLoader(
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
     network::mojom::URLLoaderClientEndpointsPtr endpoints,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner,
     int render_frame_id,
     mojom::ResourceLoadInfoPtr resource_load_info)
     : render_frame_id_(render_frame_id),
-      response_head_(response_head),
+      response_head_(std::move(response_head)),
       response_body_(std::move(response_body)),
       endpoints_(std::move(endpoints)),
       task_runner_(std::move(task_runner)),
@@ -181,24 +183,29 @@ void NavigationBodyLoader::StartLoadingBody(
                resource_load_info_->url.possibly_invalid_spec());
   client_ = client;
 
+  base::Time response_head_response_time = response_head_->response_time;
   NotifyResourceResponseReceived(render_frame_id_, resource_load_info_.get(),
-                                 response_head_, content::PREVIEWS_OFF);
+                                 std::move(response_head_),
+                                 content::PREVIEWS_OFF);
 
   if (use_isolated_code_cache) {
     code_cache_loader_ = std::make_unique<CodeCacheLoaderImpl>();
     code_cache_loader_->FetchFromCodeCache(
         blink::mojom::CodeCacheType::kJavascript, resource_load_info_->url,
         base::BindOnce(&NavigationBodyLoader::CodeCacheReceived,
-                       weak_factory_.GetWeakPtr()));
+                       weak_factory_.GetWeakPtr(),
+                       response_head_response_time));
     return;
   }
 
   BindURLLoaderAndStartLoadingResponseBodyIfPossible();
 }
 
-void NavigationBodyLoader::CodeCacheReceived(base::Time response_time,
-                                             mojo_base::BigBuffer data) {
-  if (response_head_.response_time == response_time && client_) {
+void NavigationBodyLoader::CodeCacheReceived(
+    base::Time response_head_response_time,
+    base::Time response_time,
+    mojo_base::BigBuffer data) {
+  if (response_head_response_time == response_time && client_) {
     base::WeakPtr<NavigationBodyLoader> weak_self = weak_factory_.GetWeakPtr();
     client_->BodyCodeCacheReceived(std::move(data));
     if (!weak_self)
diff --git a/chromium/content/renderer/loader/navigation_body_loader.h b/chromium/content/renderer/loader/navigation_body_loader.h
index 75578b3cf7b..87803209ea9 100644
--- a/chromium/content/renderer/loader/navigation_body_loader.h
+++ b/chromium/content/renderer/loader/navigation_body_loader.h
@@ -22,6 +22,7 @@
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/platform/web_navigation_body_loader.h"
 
 namespace blink {
@@ -50,10 +51,10 @@ class CONTENT_EXPORT NavigationBodyLoader
   // This method fills navigation params related to the navigation request,
   // redirects and response, and also creates a body loader if needed.
   static void FillNavigationParamsResponseAndBodyLoader(
-      const mojom::CommonNavigationParams& common_params,
-      const mojom::CommitNavigationParams& commit_params,
+      mojom::CommonNavigationParamsPtr common_params,
+      mojom::CommitNavigationParamsPtr commit_params,
       int request_id,
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       mojo::ScopedDataPipeConsumerHandle response_body,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner,
@@ -93,7 +94,7 @@ class CONTENT_EXPORT NavigationBodyLoader
   static constexpr uint32_t kMaxNumConsumedBytesInTask = 64 * 1024;
 
   NavigationBodyLoader(
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       mojo::ScopedDataPipeConsumerHandle response_body,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner,
@@ -120,7 +121,9 @@ class CONTENT_EXPORT NavigationBodyLoader
       mojo::ScopedDataPipeConsumerHandle handle) override;
   void OnComplete(const network::URLLoaderCompletionStatus& status) override;
 
-  void CodeCacheReceived(base::Time response_time, mojo_base::BigBuffer data);
+  void CodeCacheReceived(base::Time response_head_response_time,
+                         base::Time response_time,
+                         mojo_base::BigBuffer data);
   void BindURLLoaderAndContinue();
   void OnConnectionClosed();
   void OnReadable(MojoResult unused);
@@ -132,7 +135,7 @@ class CONTENT_EXPORT NavigationBodyLoader
 
   // Navigation parameters.
   const int render_frame_id_;
-  const network::ResourceResponseHead response_head_;
+  network::mojom::URLResponseHeadPtr response_head_;
   mojo::ScopedDataPipeConsumerHandle response_body_;
   network::mojom::URLLoaderClientEndpointsPtr endpoints_;
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
diff --git a/chromium/content/renderer/loader/navigation_body_loader_unittest.cc b/chromium/content/renderer/loader/navigation_body_loader_unittest.cc
index 4bf8fc8383a..c2a058117c5 100644
--- a/chromium/content/renderer/loader/navigation_body_loader_unittest.cc
+++ b/chromium/content/renderer/loader/navigation_body_loader_unittest.cc
@@ -48,8 +48,8 @@ class NavigationBodyLoaderTest : public ::testing::Test,
     auto common_params = CreateCommonNavigationParams();
     auto commit_params = CreateCommitNavigationParams();
     NavigationBodyLoader::FillNavigationParamsResponseAndBodyLoader(
-        *common_params, *commit_params, 1 /* request_id */,
-        network::ResourceResponseHead(),
+        std::move(common_params), std::move(commit_params), 1 /* request_id */,
+        network::mojom::URLResponseHead::New(),
         mojo::ScopedDataPipeConsumerHandle() /* response_body */,
         std::move(endpoints),
         blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
@@ -294,8 +294,8 @@ TEST_F(NavigationBodyLoaderTest, SetDefersLoadingFromCloseThenOnComplete) {
 // Tests that FillNavigationParamsResponseAndBodyLoader populates security
 // details on the response when they are present.
 TEST_F(NavigationBodyLoaderTest, FillResponseWithSecurityDetails) {
-  network::ResourceResponseHead response;
-  response.ssl_info = net::SSLInfo();
+  auto response = network::mojom::URLResponseHead::New();
+  response->ssl_info = net::SSLInfo();
   net::CertificateList certs;
   ASSERT_TRUE(net::LoadCertificateFiles(
       {"subjectAltName_sanity_check.pem", "root_ca_cert.pem"}, &certs));
@@ -306,10 +306,10 @@ TEST_F(NavigationBodyLoaderTest, FillResponseWithSecurityDetails) {
   base::StringPiece cert1_der =
       net::x509_util::CryptoBufferAsStringPiece(certs[1]->cert_buffer());
 
-  response.ssl_info->cert =
+  response->ssl_info->cert =
       net::X509Certificate::CreateFromDERCertChain({cert0_der, cert1_der});
   net::SSLConnectionStatusSetVersion(net::SSL_CONNECTION_VERSION_TLS1_2,
-                                     &response.ssl_info->connection_status);
+                                     &response->ssl_info->connection_status);
 
   auto common_params = CreateCommonNavigationParams();
   common_params->url = GURL("https://example.test");
@@ -318,7 +318,8 @@ TEST_F(NavigationBodyLoaderTest, FillResponseWithSecurityDetails) {
   blink::WebNavigationParams navigation_params;
   auto endpoints = network::mojom::URLLoaderClientEndpoints::New();
   NavigationBodyLoader::FillNavigationParamsResponseAndBodyLoader(
-      *common_params, *commit_params, 1 /* request_id */, response,
+      std::move(common_params), std::move(commit_params), 1 /* request_id */,
+      std::move(response),
       mojo::ScopedDataPipeConsumerHandle() /* response_body */,
       std::move(endpoints),
       blink::scheduler::GetSingleThreadTaskRunnerForTesting(),
diff --git a/chromium/content/renderer/loader/resource_dispatcher.cc b/chromium/content/renderer/loader/resource_dispatcher.cc
index 470cc1d481b..7def57552ae 100644
--- a/chromium/content/renderer/loader/resource_dispatcher.cc
+++ b/chromium/content/renderer/loader/resource_dispatcher.cc
@@ -21,7 +21,6 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/common/inter_process_time_ticks_converter.h"
-#include "content/common/mime_sniffing_throttle.h"
 #include "content/common/navigation_params.h"
 #include "content/common/throttling_url_loader.h"
 #include "content/public/common/navigation_policy.h"
@@ -45,6 +44,8 @@
 #include "services/network/public/cpp/resource_request.h"
 #include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
+#include "third_party/blink/public/common/loader/mime_sniffing_throttle.h"
 
 namespace content {
 
@@ -141,38 +142,34 @@ void ResourceDispatcher::OnUploadProgress(int request_id,
 
 void ResourceDispatcher::OnReceivedResponse(
     int request_id,
-    const network::ResourceResponseHead& response_head) {
+    network::mojom::URLResponseHeadPtr response_head) {
   TRACE_EVENT0("loading", "ResourceDispatcher::OnReceivedResponse");
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
   if (!request_info)
     return;
   DCHECK(!request_info->navigation_response_override);
   request_info->local_response_start = base::TimeTicks::Now();
-  request_info->remote_request_start = response_head.load_timing.request_start;
+  request_info->remote_request_start = response_head->load_timing.request_start;
   // Now that response_start has been set, we can properly set the TimeTicks in
-  // the ResourceResponseHead.
-  network::ResourceResponseHead renderer_response_head;
-  ToResourceResponseHead(*request_info, response_head, &renderer_response_head);
-  request_info->load_timing_info = renderer_response_head.load_timing;
+  // the URLResponseHead.
+  ToLocalURLResponseHead(*request_info, *response_head);
+  request_info->load_timing_info = response_head->load_timing;
   if (delegate_) {
     std::unique_ptr<RequestPeer> new_peer = delegate_->OnReceivedResponse(
-        std::move(request_info->peer), response_head.mime_type,
+        std::move(request_info->peer), response_head->mime_type,
         request_info->url);
     DCHECK(new_peer);
     request_info->peer = std::move(new_peer);
   }
 
-  // Unfortunately, calling OnReceivedResponse on the peer can delete
-  // pending request and/or passed |response_head| reference.
-  // Make a copy of |response_head| for later use.
-  network::ResourceResponseHead response_head_copy = renderer_response_head;
-  request_info->peer->OnReceivedResponse(renderer_response_head);
+  request_info->peer->OnReceivedResponse(
+      network::ResourceResponseHead(response_head));
   if (!GetPendingRequestInfo(request_id))
     return;
 
   NotifyResourceResponseReceived(
       request_info->render_frame_id, request_info->resource_load_info.get(),
-      response_head_copy, request_info->previews_state);
+      std::move(response_head), request_info->previews_state);
 }
 
 void ResourceDispatcher::OnReceivedCachedMetadata(int request_id,
@@ -199,7 +196,7 @@ void ResourceDispatcher::OnStartLoadingResponseBody(
 void ResourceDispatcher::OnReceivedRedirect(
     int request_id,
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   TRACE_EVENT0("loading", "ResourceDispatcher::OnReceivedRedirect");
   PendingRequestInfo* request_info = GetPendingRequestInfo(request_id);
@@ -211,22 +208,22 @@ void ResourceDispatcher::OnReceivedRedirect(
     // URL. Handle this in a posted task, as we don't have the loader
     // pointer yet.
     base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::BindOnce(&ResourceDispatcher::OnReceivedRedirect,
-                                  weak_factory_.GetWeakPtr(), request_id,
-                                  redirect_info, response_head, task_runner));
+        FROM_HERE,
+        base::BindOnce(&ResourceDispatcher::OnReceivedRedirect,
+                       weak_factory_.GetWeakPtr(), request_id, redirect_info,
+                       std::move(response_head), task_runner));
     return;
   }
 
   request_info->local_response_start = base::TimeTicks::Now();
-  request_info->remote_request_start = response_head.load_timing.request_start;
+  request_info->remote_request_start = response_head->load_timing.request_start;
   request_info->redirect_requires_loader_restart =
       RedirectRequiresLoaderRestart(request_info->response_url,
                                     redirect_info.new_url);
 
-  network::ResourceResponseHead renderer_response_head;
-  ToResourceResponseHead(*request_info, response_head, &renderer_response_head);
-  if (request_info->peer->OnReceivedRedirect(redirect_info,
-                                             renderer_response_head)) {
+  ToLocalURLResponseHead(*request_info, *response_head);
+  if (request_info->peer->OnReceivedRedirect(
+          redirect_info, network::ResourceResponseHead(response_head))) {
     // Double-check if the request is still around. The call above could
     // potentially remove it.
     request_info = GetPendingRequestInfo(request_id);
@@ -236,7 +233,7 @@ void ResourceDispatcher::OnReceivedRedirect(
     request_info->has_pending_redirect = true;
     NotifyResourceRedirectReceived(request_info->render_frame_id,
                                    request_info->resource_load_info.get(),
-                                   redirect_info, response_head);
+                                   redirect_info, std::move(response_head));
     if (!request_info->is_deferred)
       FollowPendingRedirect(request_info);
   } else {
@@ -467,8 +464,8 @@ void ResourceDispatcher::StartSync(
 
   while (response->context_for_redirect) {
     DCHECK(response->redirect_info);
-    bool follow_redirect =
-        peer->OnReceivedRedirect(*response->redirect_info, response->info);
+    bool follow_redirect = peer->OnReceivedRedirect(*response->redirect_info,
+                                                    response->head.Clone());
     redirect_or_response_event.Reset();
     if (follow_redirect) {
       task_runner->PostTask(
@@ -553,7 +550,7 @@ int ResourceDispatcher::StartAsync(
     // MIME sniffing should be disabled for a request initiated by fetch().
     options |= network::mojom::kURLLoadOptionSniffMimeType;
     throttles.push_back(
-        std::make_unique<MimeSniffingThrottle>(loading_task_runner));
+        std::make_unique<blink::MimeSniffingThrottle>(loading_task_runner));
   }
   if (is_sync) {
     options |= network::mojom::kURLLoadOptionSynchronous;
@@ -571,26 +568,24 @@ int ResourceDispatcher::StartAsync(
   return request_id;
 }
 
-void ResourceDispatcher::ToResourceResponseHead(
+void ResourceDispatcher::ToLocalURLResponseHead(
     const PendingRequestInfo& request_info,
-    const network::ResourceResponseHead& browser_info,
-    network::ResourceResponseHead* renderer_info) const {
-  *renderer_info = browser_info;
+    network::mojom::URLResponseHead& response_head) const {
   if (base::TimeTicks::IsConsistentAcrossProcesses() ||
       request_info.local_request_start.is_null() ||
       request_info.local_response_start.is_null() ||
-      browser_info.request_start.is_null() ||
-      browser_info.response_start.is_null() ||
-      browser_info.load_timing.request_start.is_null()) {
+      response_head.request_start.is_null() ||
+      response_head.response_start.is_null() ||
+      response_head.load_timing.request_start.is_null()) {
     return;
   }
   InterProcessTimeTicksConverter converter(
       LocalTimeTicks::FromTimeTicks(request_info.local_request_start),
       LocalTimeTicks::FromTimeTicks(request_info.local_response_start),
-      RemoteTimeTicks::FromTimeTicks(browser_info.request_start),
-      RemoteTimeTicks::FromTimeTicks(browser_info.response_start));
+      RemoteTimeTicks::FromTimeTicks(response_head.request_start),
+      RemoteTimeTicks::FromTimeTicks(response_head.response_start));
 
-  net::LoadTimingInfo* load_timing = &renderer_info->load_timing;
+  net::LoadTimingInfo* load_timing = &response_head.load_timing;
   RemoteToLocalTimeTicks(converter, &load_timing->request_start);
   RemoteToLocalTimeTicks(converter, &load_timing->proxy_resolve_start);
   RemoteToLocalTimeTicks(converter, &load_timing->proxy_resolve_end);
@@ -606,8 +601,8 @@ void ResourceDispatcher::ToResourceResponseHead(
   RemoteToLocalTimeTicks(converter, &load_timing->receive_headers_end);
   RemoteToLocalTimeTicks(converter, &load_timing->push_start);
   RemoteToLocalTimeTicks(converter, &load_timing->push_end);
-  RemoteToLocalTimeTicks(converter, &renderer_info->service_worker_start_time);
-  RemoteToLocalTimeTicks(converter, &renderer_info->service_worker_ready_time);
+  RemoteToLocalTimeTicks(converter, &response_head.service_worker_start_time);
+  RemoteToLocalTimeTicks(converter, &response_head.service_worker_ready_time);
 }
 
 // TODO(dgozman): this is not used for navigation anymore, only for worker
@@ -626,7 +621,7 @@ void ResourceDispatcher::ContinueForNavigation(int request_id) {
   request_info->should_follow_redirect = false;
 
   URLLoaderClientImpl* client_ptr = request_info->url_loader_client.get();
-  // During navigations, the ResourceResponse has already been received on the
+  // During navigations, the Response has already been received on the
   // browser side, and has been passed down to the renderer. Replay the
   // redirects that happened during navigation.
   DCHECK_EQ(response_override->redirect_responses.size(),
diff --git a/chromium/content/renderer/loader/resource_dispatcher.h b/chromium/content/renderer/loader/resource_dispatcher.h
index 38e654eb161..c5908b2cbaa 100644
--- a/chromium/content/renderer/loader/resource_dispatcher.h
+++ b/chromium/content/renderer/loader/resource_dispatcher.h
@@ -31,6 +31,7 @@
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 #include "third_party/blink/public/mojom/blob/blob_registry.mojom.h"
 #include "third_party/blink/public/platform/web_url_request.h"
@@ -46,7 +47,6 @@ struct RedirectInfo;
 
 namespace network {
 struct ResourceRequest;
-struct ResourceResponseHead;
 struct URLLoaderCompletionStatus;
 namespace mojom {
 class URLLoaderFactory;
@@ -221,22 +221,21 @@ class CONTENT_EXPORT ResourceDispatcher {
 
   // Message response handlers, called by the message handler for this process.
   void OnUploadProgress(int request_id, int64_t position, int64_t size);
-  void OnReceivedResponse(int request_id, const network::ResourceResponseHead&);
+  void OnReceivedResponse(int request_id, network::mojom::URLResponseHeadPtr);
   void OnReceivedCachedMetadata(int request_id, mojo_base::BigBuffer data);
   void OnReceivedRedirect(
       int request_id,
       const net::RedirectInfo& redirect_info,
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
   void OnStartLoadingResponseBody(int request_id,
                                   mojo::ScopedDataPipeConsumerHandle body);
   void OnRequestComplete(int request_id,
                          const network::URLLoaderCompletionStatus& status);
 
-  void ToResourceResponseHead(
+  void ToLocalURLResponseHead(
       const PendingRequestInfo& request_info,
-      const network::ResourceResponseHead& browser_info,
-      network::ResourceResponseHead* renderer_info) const;
+      network::mojom::URLResponseHead& response_head) const;
 
   void ContinueForNavigation(int request_id);
 
diff --git a/chromium/content/renderer/loader/resource_dispatcher_unittest.cc b/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
index b44fc96daf9..2e973dc2ac4 100644
--- a/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
+++ b/chromium/content/renderer/loader/resource_dispatcher_unittest.cc
@@ -26,6 +26,7 @@
 #include "content/renderer/loader/navigation_response_override_parameters.h"
 #include "content/renderer/loader/request_extra_data.h"
 #include "content/renderer/loader/test_request_peer.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/base/net_errors.h"
 #include "net/base/request_priority.h"
 #include "net/http/http_response_headers.h"
@@ -95,7 +96,8 @@ class ResourceDispatcherTest : public testing::Test,
     loader_and_clients_.emplace_back(std::move(request), std::move(client));
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     NOTREACHED();
   }
 
@@ -158,7 +160,7 @@ class ResourceDispatcherTest : public testing::Test,
   std::vector<std::pair<network::mojom::URLLoaderRequest,
                         network::mojom::URLLoaderClientPtr>>
       loader_and_clients_;
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<ResourceDispatcher> dispatcher_;
 };
 
@@ -193,15 +195,13 @@ class TestResourceDispatcherDelegate : public ResourceDispatcherDelegate {
 
     void OnUploadProgress(uint64_t position, uint64_t size) override {}
 
-    bool OnReceivedRedirect(
-        const net::RedirectInfo& redirect_info,
-        const network::ResourceResponseInfo& info) override {
+    bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
+                            network::mojom::URLResponseHeadPtr head) override {
       return false;
     }
 
-    void OnReceivedResponse(
-        const network::ResourceResponseInfo& info) override {
-      response_info_ = info;
+    void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override {
+      response_head_ = std::move(head);
     }
 
     void OnStartLoadingResponseBody(
@@ -213,7 +213,7 @@ class TestResourceDispatcherDelegate : public ResourceDispatcherDelegate {
 
     void OnCompletedRequest(
         const network::URLLoaderCompletionStatus& status) override {
-      original_peer_->OnReceivedResponse(response_info_);
+      original_peer_->OnReceivedResponse(std::move(response_head_));
       original_peer_->OnStartLoadingResponseBody(std::move(body_handle_));
       original_peer_->OnCompletedRequest(status);
     }
@@ -223,7 +223,7 @@ class TestResourceDispatcherDelegate : public ResourceDispatcherDelegate {
 
    private:
     std::unique_ptr<RequestPeer> original_peer_;
-    network::ResourceResponseInfo response_info_;
+    network::mojom::URLResponseHeadPtr response_head_;
     mojo::ScopedDataPipeConsumerHandle body_handle_;
 
     DISALLOW_COPY_AND_ASSIGN(WrapperPeer);
diff --git a/chromium/content/renderer/loader/resource_load_stats.cc b/chromium/content/renderer/loader/resource_load_stats.cc
index 774cd4c6a8e..6323d50ec51 100644
--- a/chromium/content/renderer/loader/resource_load_stats.cc
+++ b/chromium/content/renderer/loader/resource_load_stats.cc
@@ -41,21 +41,20 @@ void UpdateUserGestureCarryoverInfo(int render_frame_id) {
 }
 #endif
 
-void ResourceResponseReceived(
-    int render_frame_id,
-    int request_id,
-    const GURL& response_url,
-    const network::ResourceResponseHead& response_head,
-    content::ResourceType resource_type,
-    PreviewsState previews_state) {
+void ResourceResponseReceived(int render_frame_id,
+                              int request_id,
+                              const GURL& response_url,
+                              network::mojom::URLResponseHeadPtr response_head,
+                              content::ResourceType resource_type,
+                              PreviewsState previews_state) {
   RenderFrameImpl* frame = RenderFrameImpl::FromRoutingID(render_frame_id);
   if (!frame)
     return;
   if (!IsResourceTypeFrame(resource_type)) {
     frame->GetFrameHost()->SubresourceResponseStarted(
-        response_url, response_head.cert_status);
+        response_url, response_head->cert_status);
   }
-  frame->DidStartResponse(response_url, request_id, response_head,
+  frame->DidStartResponse(response_url, request_id, std::move(response_head),
                           resource_type, previews_state);
 }
 
@@ -124,7 +123,7 @@ void NotifyResourceRedirectReceived(
     int render_frame_id,
     mojom::ResourceLoadInfo* resource_load_info,
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseHead& redirect_response) {
+    network::mojom::URLResponseHeadPtr redirect_response) {
   resource_load_info->url = redirect_info.new_url;
   resource_load_info->method = redirect_info.new_method;
   resource_load_info->referrer = GURL(redirect_info.new_referrer);
@@ -132,11 +131,11 @@ void NotifyResourceRedirectReceived(
   net_redirect_info->url = redirect_info.new_url;
   net_redirect_info->network_info = mojom::CommonNetworkInfo::New();
   net_redirect_info->network_info->network_accessed =
-      redirect_response.network_accessed;
+      redirect_response->network_accessed;
   net_redirect_info->network_info->always_access_network =
-      AlwaysAccessNetwork(redirect_response.headers);
+      AlwaysAccessNetwork(redirect_response->headers);
   net_redirect_info->network_info->remote_endpoint =
-      redirect_response.remote_endpoint;
+      redirect_response->remote_endpoint;
   resource_load_info->redirect_info_chain.push_back(
       std::move(net_redirect_info));
 }
@@ -144,48 +143,49 @@ void NotifyResourceRedirectReceived(
 void NotifyResourceResponseReceived(
     int render_frame_id,
     mojom::ResourceLoadInfo* resource_load_info,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     PreviewsState previews_state) {
-  if (response_head.network_accessed) {
+  if (response_head->network_accessed) {
     if (resource_load_info->resource_type == ResourceType::kMainFrame) {
       UMA_HISTOGRAM_ENUMERATION("Net.ConnectionInfo.MainFrame",
-                                response_head.connection_info,
+                                response_head->connection_info,
                                 net::HttpResponseInfo::NUM_OF_CONNECTION_INFOS);
     } else {
       UMA_HISTOGRAM_ENUMERATION("Net.ConnectionInfo.SubResource",
-                                response_head.connection_info,
+                                response_head->connection_info,
                                 net::HttpResponseInfo::NUM_OF_CONNECTION_INFOS);
     }
   }
 
-  resource_load_info->mime_type = response_head.mime_type;
-  resource_load_info->load_timing_info = response_head.load_timing;
+  resource_load_info->mime_type = response_head->mime_type;
+  resource_load_info->load_timing_info = response_head->load_timing;
   resource_load_info->network_info->network_accessed =
-      response_head.network_accessed;
+      response_head->network_accessed;
   resource_load_info->network_info->always_access_network =
-      AlwaysAccessNetwork(response_head.headers);
+      AlwaysAccessNetwork(response_head->headers);
   resource_load_info->network_info->remote_endpoint =
-      response_head.remote_endpoint;
+      response_head->remote_endpoint;
 
   auto task_runner = RenderThreadImpl::DeprecatedGetMainTaskRunner();
   if (!task_runner)
     return;
   if (task_runner->BelongsToCurrentThread()) {
     ResourceResponseReceived(render_frame_id, resource_load_info->request_id,
-                             resource_load_info->url, response_head,
+                             resource_load_info->url, std::move(response_head),
                              resource_load_info->resource_type, previews_state);
     return;
   }
 
-  // Make a deep copy of ResourceResponseHead before passing it cross-thread.
-  auto resource_response = base::MakeRefCounted<network::ResourceResponse>();
-  resource_response->head = response_head;
-  auto deep_copied_response = resource_response->DeepCopy();
+  // Make a deep copy of URLResponseHead before passing it cross-thread.
+  if (response_head->headers) {
+    response_head->headers =
+        new net::HttpResponseHeaders(response_head->headers->raw_headers());
+  }
   task_runner->PostTask(
       FROM_HERE,
       base::BindOnce(ResourceResponseReceived, render_frame_id,
                      resource_load_info->request_id, resource_load_info->url,
-                     deep_copied_response->head,
+                     std::move(response_head),
                      resource_load_info->resource_type, previews_state));
 }
 
diff --git a/chromium/content/renderer/loader/resource_load_stats.h b/chromium/content/renderer/loader/resource_load_stats.h
index df0b17517d4..5c99d140542 100644
--- a/chromium/content/renderer/loader/resource_load_stats.h
+++ b/chromium/content/renderer/loader/resource_load_stats.h
@@ -9,6 +9,7 @@
 #include "content/public/common/previews_state.h"
 #include "content/public/common/resource_load_info.mojom.h"
 #include "content/public/common/resource_type.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 
 class GURL;
 
@@ -17,7 +18,6 @@ struct RedirectInfo;
 }  // namespace net
 
 namespace network {
-struct ResourceResponseHead;
 struct URLLoaderCompletionStatus;
 }  // namespace network
 
@@ -47,12 +47,12 @@ void NotifyResourceRedirectReceived(
     int render_frame_id,
     mojom::ResourceLoadInfo* resource_load_info,
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseHead& redirect_response);
+    network::mojom::URLResponseHeadPtr redirect_response);
 
 void NotifyResourceResponseReceived(
     int render_frame_id,
     mojom::ResourceLoadInfo* resource_load_info,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     PreviewsState previews_state);
 
 void NotifyResourceTransferSizeUpdated(
diff --git a/chromium/content/renderer/loader/sync_load_context.cc b/chromium/content/renderer/loader/sync_load_context.cc
index 2a9746eadbd..e73cf4989d7 100644
--- a/chromium/content/renderer/loader/sync_load_context.cc
+++ b/chromium/content/renderer/loader/sync_load_context.cc
@@ -16,7 +16,7 @@
 #include "mojo/public/cpp/bindings/associated_remote.h"
 #include "net/url_request/redirect_info.h"
 #include "services/network/public/cpp/resource_request.h"
-#include "services/network/public/cpp/resource_response_info.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/loader/url_loader_throttle.h"
 
 namespace content {
@@ -147,10 +147,10 @@ void SyncLoadContext::OnUploadProgress(uint64_t position, uint64_t size) {}
 
 bool SyncLoadContext::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseInfo& info) {
+    network::mojom::URLResponseHeadPtr head) {
   DCHECK(!Completed());
   response_->url = redirect_info.new_url;
-  response_->info = info;
+  response_->head = std::move(head);
   response_->redirect_info = redirect_info;
   response_->context_for_redirect = this;
   resource_dispatcher_->SetDefersLoading(request_id_, true);
@@ -178,9 +178,9 @@ void SyncLoadContext::CancelRedirect() {
 }
 
 void SyncLoadContext::OnReceivedResponse(
-    const network::ResourceResponseInfo& info) {
+    network::mojom::URLResponseHeadPtr head) {
   DCHECK(!Completed());
-  response_->info = info;
+  response_->head = std::move(head);
 }
 
 void SyncLoadContext::OnStartLoadingResponseBody(
@@ -192,8 +192,8 @@ void SyncLoadContext::OnStartLoadingResponseBody(
     blob_response_started_ = true;
 
     download_to_blob_registry_->RegisterFromStream(
-        response_->info.mime_type, "",
-        std::max<int64_t>(0, response_->info.content_length), std::move(body),
+        response_->head->mime_type, "",
+        std::max<int64_t>(0, response_->head->content_length), std::move(body),
         mojo::NullAssociatedRemote(),
         base::BindOnce(&SyncLoadContext::OnFinishCreatingBlob,
                        base::Unretained(this)));
@@ -225,8 +225,8 @@ void SyncLoadContext::OnCompletedRequest(
   response_->error_code = status.error_code;
   response_->extended_error_code = status.extended_error_code;
   response_->cors_error = status.cors_error_status;
-  response_->info.encoded_data_length = status.encoded_data_length;
-  response_->info.encoded_body_length = status.encoded_body_length;
+  response_->head->encoded_data_length = status.encoded_data_length;
+  response_->head->encoded_body_length = status.encoded_body_length;
   if ((blob_response_started_ && !blob_finished_) || body_handle_.is_valid()) {
     // The body is still begin downloaded as a Blob, or being read through the
     // handle. Wait until it's completed.
diff --git a/chromium/content/renderer/loader/sync_load_context.h b/chromium/content/renderer/loader/sync_load_context.h
index 4671aa276a1..ccc73891121 100644
--- a/chromium/content/renderer/loader/sync_load_context.h
+++ b/chromium/content/renderer/loader/sync_load_context.h
@@ -88,8 +88,8 @@ class CONTENT_EXPORT SyncLoadContext : public RequestPeer {
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          const network::ResourceResponseInfo& info) override;
-  void OnReceivedResponse(const network::ResourceResponseInfo& info) override;
+                          network::mojom::URLResponseHeadPtr head) override;
+  void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
   void OnTransferSizeUpdated(int transfer_size_diff) override;
diff --git a/chromium/content/renderer/loader/sync_load_context_unittest.cc b/chromium/content/renderer/loader/sync_load_context_unittest.cc
index 7a7d0c84a38..ced6b20e03d 100644
--- a/chromium/content/renderer/loader/sync_load_context_unittest.cc
+++ b/chromium/content/renderer/loader/sync_load_context_unittest.cc
@@ -6,6 +6,7 @@
 #include "base/bind.h"
 #include "base/threading/thread.h"
 #include "content/renderer/loader/sync_load_response.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
@@ -33,7 +34,9 @@ class TestSharedURLLoaderFactory : public network::TestURLLoaderFactory,
         std::move(client), traffic_annotation);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest) override { NOTREACHED(); }
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory>) override {
+    NOTREACHED();
+  }
 
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> Clone() override {
     NOTREACHED();
@@ -129,7 +132,7 @@ class SyncLoadContextTest : public testing::Test {
     context->resource_dispatcher_ = std::move(dispatcher);
 
     // Simulate the response.
-    context->OnReceivedResponse(network::ResourceResponseInfo());
+    context->OnReceivedResponse(network::mojom::URLResponseHead::New());
     mojo::ScopedDataPipeProducerHandle producer_handle;
     mojo::ScopedDataPipeConsumerHandle consumer_handle;
     EXPECT_EQ(MOJO_RESULT_OK,
diff --git a/chromium/content/renderer/loader/sync_load_response.h b/chromium/content/renderer/loader/sync_load_response.h
index 882cadf91a2..d517bb20686 100644
--- a/chromium/content/renderer/loader/sync_load_response.h
+++ b/chromium/content/renderer/loader/sync_load_response.h
@@ -10,8 +10,8 @@
 #include "base/optional.h"
 #include "content/common/content_export.h"
 #include "services/network/public/cpp/cors/cors_error_status.h"
-#include "services/network/public/cpp/resource_response_info.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/mojom/blob/serialized_blob.mojom.h"
 #include "url/gurl.h"
 
@@ -31,7 +31,8 @@ struct CONTENT_EXPORT SyncLoadResponse {
   base::Optional<net::RedirectInfo> redirect_info;
   SyncLoadContext* context_for_redirect = nullptr;
 
-  network::ResourceResponseInfo info;
+  network::mojom::URLResponseHeadPtr head =
+      network::mojom::URLResponseHead::New();
 
   // The response error code.
   int error_code;
diff --git a/chromium/content/renderer/loader/test_request_peer.cc b/chromium/content/renderer/loader/test_request_peer.cc
index fa318b1a25b..f345a4b32ec 100644
--- a/chromium/content/renderer/loader/test_request_peer.cc
+++ b/chromium/content/renderer/loader/test_request_peer.cc
@@ -6,7 +6,7 @@
 
 #include "content/renderer/loader/resource_dispatcher.h"
 #include "net/url_request/redirect_info.h"
-#include "services/network/public/cpp/resource_response.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 
@@ -24,23 +24,23 @@ void TestRequestPeer::OnUploadProgress(uint64_t position, uint64_t size) {
 
 bool TestRequestPeer::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseInfo& info) {
+    network::mojom::URLResponseHeadPtr head) {
   EXPECT_FALSE(context_->cancelled);
   EXPECT_FALSE(context_->complete);
   ++context_->seen_redirects;
-  context_->last_load_timing = info.load_timing;
+  context_->last_load_timing = head->load_timing;
   if (context_->defer_on_redirect)
     dispatcher_->SetDefersLoading(context_->request_id, true);
   return context_->follow_redirects;
 }
 
 void TestRequestPeer::OnReceivedResponse(
-    const network::ResourceResponseInfo& info) {
+    network::mojom::URLResponseHeadPtr head) {
   EXPECT_FALSE(context_->cancelled);
   EXPECT_FALSE(context_->received_response);
   EXPECT_FALSE(context_->complete);
   context_->received_response = true;
-  context_->last_load_timing = info.load_timing;
+  context_->last_load_timing = head->load_timing;
   if (context_->cancel_on_receive_response) {
     dispatcher_->Cancel(
         context_->request_id,
diff --git a/chromium/content/renderer/loader/test_request_peer.h b/chromium/content/renderer/loader/test_request_peer.h
index a6296d95bc6..d61c1e8554c 100644
--- a/chromium/content/renderer/loader/test_request_peer.h
+++ b/chromium/content/renderer/loader/test_request_peer.h
@@ -13,15 +13,12 @@
 #include "content/public/renderer/request_peer.h"
 #include "net/base/load_timing_info.h"
 #include "services/network/public/cpp/url_loader_completion_status.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 
 namespace net {
 struct RedirectInfo;
 }  // namespace net
 
-namespace network {
-struct ResourceResponseInfo;
-}
-
 namespace content {
 
 class ResourceDispatcher;
@@ -36,8 +33,8 @@ class TestRequestPeer : public RequestPeer {
 
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          const network::ResourceResponseInfo& info) override;
-  void OnReceivedResponse(const network::ResourceResponseInfo& info) override;
+                          network::mojom::URLResponseHeadPtr head) override;
+  void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
   void OnTransferSizeUpdated(int transfer_size_diff) override;
diff --git a/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.cc b/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.cc
index dcb48aa4261..479467d0916 100644
--- a/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.cc
+++ b/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.cc
@@ -20,7 +20,7 @@ TrackedChildURLLoaderFactoryBundleInfo::TrackedChildURLLoaderFactoryBundleInfo(
     mojo::PendingRemote<network::mojom::URLLoaderFactory>
         pending_appcache_factory,
     SchemeMap pending_scheme_specific_factories,
-    OriginMap pending_initiator_specific_factories,
+    OriginMap pending_isolated_world_factories,
     network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info,
     mojo::PendingRemote<network::mojom::URLLoaderFactory>
         pending_prefetch_loader_factory,
@@ -30,7 +30,7 @@ TrackedChildURLLoaderFactoryBundleInfo::TrackedChildURLLoaderFactoryBundleInfo(
           std::move(pending_default_factory),
           std::move(pending_appcache_factory),
           std::move(pending_scheme_specific_factories),
-          std::move(pending_initiator_specific_factories),
+          std::move(pending_isolated_world_factories),
           std::move(direct_network_factory_info),
           std::move(pending_prefetch_loader_factory),
           bypass_redirect_checks),
@@ -46,8 +46,8 @@ TrackedChildURLLoaderFactoryBundleInfo::CreateFactory() {
   other->pending_appcache_factory_ = std::move(pending_appcache_factory_);
   other->pending_scheme_specific_factories_ =
       std::move(pending_scheme_specific_factories_);
-  other->pending_initiator_specific_factories_ =
-      std::move(pending_initiator_specific_factories_);
+  other->pending_isolated_world_factories_ =
+      std::move(pending_isolated_world_factories_);
   other->direct_network_factory_info_ = std::move(direct_network_factory_info_);
   other->pending_prefetch_loader_factory_ =
       std::move(pending_prefetch_loader_factory_);
@@ -88,7 +88,7 @@ TrackedChildURLLoaderFactoryBundle::Clone() {
       std::move(pending_factories->pending_default_factory()),
       std::move(pending_factories->pending_appcache_factory()),
       std::move(pending_factories->pending_scheme_specific_factories()),
-      std::move(pending_factories->pending_initiator_specific_factories()),
+      std::move(pending_factories->pending_isolated_world_factories()),
       std::move(pending_factories->direct_network_factory_info()),
       std::move(pending_factories->pending_prefetch_loader_factory()),
       std::move(main_thread_host_bundle_clone),
@@ -154,7 +154,7 @@ HostChildURLLoaderFactoryBundle::Clone() {
       std::move(pending_factories->pending_default_factory()),
       std::move(pending_factories->pending_appcache_factory()),
       std::move(pending_factories->pending_scheme_specific_factories()),
-      std::move(pending_factories->pending_initiator_specific_factories()),
+      std::move(pending_factories->pending_isolated_world_factories()),
       std::move(pending_factories->direct_network_factory_info()),
       std::move(pending_factories->pending_prefetch_loader_factory()),
       std::move(main_thread_host_bundle_clone),
@@ -177,7 +177,7 @@ HostChildURLLoaderFactoryBundle::CloneWithoutAppCacheFactory() {
       std::move(pending_factories->pending_default_factory()),
       std::move(pending_factories->pending_appcache_factory()),
       std::move(pending_factories->pending_scheme_specific_factories()),
-      std::move(pending_factories->pending_initiator_specific_factories()),
+      std::move(pending_factories->pending_isolated_world_factories()),
       std::move(pending_factories->direct_network_factory_info()),
       std::move(pending_factories->pending_prefetch_loader_factory()),
       std::move(main_thread_host_bundle_clone),
diff --git a/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.h b/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.h
index d75b70c256e..994f13736b2 100644
--- a/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.h
+++ b/chromium/content/renderer/loader/tracked_child_url_loader_factory_bundle.h
@@ -35,7 +35,7 @@ class CONTENT_EXPORT TrackedChildURLLoaderFactoryBundleInfo
       mojo::PendingRemote<network::mojom::URLLoaderFactory>
           pending_appcache_factory,
       SchemeMap pending_scheme_specific_factories,
-      OriginMap pending_initiator_specific_factories,
+      OriginMap pending_isolated_world_factories,
       network::mojom::URLLoaderFactoryPtrInfo direct_network_factory_info,
       mojo::PendingRemote<network::mojom::URLLoaderFactory>
           pending_prefetch_loader_factory,
diff --git a/chromium/content/renderer/loader/url_loader_client_impl.cc b/chromium/content/renderer/loader/url_loader_client_impl.cc
index 3bf05c3c631..70d6e068854 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl.cc
+++ b/chromium/content/renderer/loader/url_loader_client_impl.cc
@@ -15,7 +15,7 @@
 #include "content/renderer/loader/resource_dispatcher.h"
 #include "net/url_request/redirect_info.h"
 #include "services/network/public/cpp/features.h"
-#include "services/network/public/cpp/resource_response.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "third_party/blink/public/common/features.h"
 
 namespace content {
@@ -46,16 +46,16 @@ class URLLoaderClientImpl::DeferredOnReceiveResponse final
     : public DeferredMessage {
  public:
   explicit DeferredOnReceiveResponse(
-      const network::ResourceResponseHead& response_head)
-      : response_head_(response_head) {}
+      network::mojom::URLResponseHeadPtr response_head)
+      : response_head_(std::move(response_head)) {}
 
   void HandleMessage(ResourceDispatcher* dispatcher, int request_id) override {
-    dispatcher->OnReceivedResponse(request_id, response_head_);
+    dispatcher->OnReceivedResponse(request_id, std::move(response_head_));
   }
   bool IsCompletionMessage() const override { return false; }
 
  private:
-  const network::ResourceResponseHead response_head_;
+  network::mojom::URLResponseHeadPtr response_head_;
 };
 
 class URLLoaderClientImpl::DeferredOnReceiveRedirect final
@@ -63,21 +63,21 @@ class URLLoaderClientImpl::DeferredOnReceiveRedirect final
  public:
   DeferredOnReceiveRedirect(
       const net::RedirectInfo& redirect_info,
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner)
       : redirect_info_(redirect_info),
-        response_head_(response_head),
+        response_head_(std::move(response_head)),
         task_runner_(std::move(task_runner)) {}
 
   void HandleMessage(ResourceDispatcher* dispatcher, int request_id) override {
-    dispatcher->OnReceivedRedirect(request_id, redirect_info_, response_head_,
-                                   task_runner_);
+    dispatcher->OnReceivedRedirect(request_id, redirect_info_,
+                                   std::move(response_head_), task_runner_);
   }
   bool IsCompletionMessage() const override { return false; }
 
  private:
   const net::RedirectInfo redirect_info_;
-  const network::ResourceResponseHead response_head_;
+  network::mojom::URLResponseHeadPtr response_head_;
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 };
 
@@ -241,7 +241,7 @@ void URLLoaderClientImpl::OnReceiveResponse(
   has_received_response_head_ = true;
   if (NeedsStoringMessage()) {
     StoreAndDispatch(
-        std::make_unique<DeferredOnReceiveResponse>(response_head));
+        std::make_unique<DeferredOnReceiveResponse>(std::move(response_head)));
   } else {
     resource_dispatcher_->OnReceivedResponse(request_id_,
                                              std::move(response_head));
@@ -261,7 +261,7 @@ void URLLoaderClientImpl::OnReceiveRedirect(
   last_loaded_url_ = redirect_info.new_url;
   if (NeedsStoringMessage()) {
     StoreAndDispatch(std::make_unique<DeferredOnReceiveRedirect>(
-        redirect_info, response_head, task_runner_));
+        redirect_info, std::move(response_head), task_runner_));
   } else {
     resource_dispatcher_->OnReceivedRedirect(
         request_id_, redirect_info, std::move(response_head), task_runner_);
diff --git a/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc b/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
index 83a581c934b..7df006b739a 100644
--- a/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
+++ b/chromium/content/renderer/loader/url_loader_client_impl_unittest.cc
@@ -10,13 +10,13 @@
 #include "content/renderer/loader/navigation_response_override_parameters.h"
 #include "content/renderer/loader/resource_dispatcher.h"
 #include "content/renderer/loader/test_request_peer.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/interface_ptr.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/redirect_info.h"
-#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/fetch/fetch_api_request.mojom.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
@@ -86,7 +86,8 @@ class URLLoaderClientImplTest : public ::testing::Test,
     url_loader_client_ = std::move(client);
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     NOTREACHED();
   }
 
@@ -99,7 +100,7 @@ class URLLoaderClientImplTest : public ::testing::Test,
     return options;
   }
 
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<ResourceDispatcher> dispatcher_;
   TestRequestPeer::Context request_peer_context_;
   int request_id_ = 0;
@@ -107,9 +108,7 @@ class URLLoaderClientImplTest : public ::testing::Test,
 };
 
 TEST_F(URLLoaderClientImplTest, OnReceiveResponse) {
-  network::ResourceResponseHead response_head;
-
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
 
   EXPECT_FALSE(request_peer_context_.received_response);
   base::RunLoop().RunUntilIdle();
@@ -117,9 +116,7 @@ TEST_F(URLLoaderClientImplTest, OnReceiveResponse) {
 }
 
 TEST_F(URLLoaderClientImplTest, ResponseBody) {
-  network::ResourceResponseHead response_head;
-
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
 
   EXPECT_FALSE(request_peer_context_.received_response);
   base::RunLoop().RunUntilIdle();
@@ -139,10 +136,10 @@ TEST_F(URLLoaderClientImplTest, ResponseBody) {
 }
 
 TEST_F(URLLoaderClientImplTest, OnReceiveRedirect) {
-  network::ResourceResponseHead response_head;
   net::RedirectInfo redirect_info;
 
-  url_loader_client_->OnReceiveRedirect(redirect_info, response_head);
+  url_loader_client_->OnReceiveRedirect(redirect_info,
+                                        network::mojom::URLResponseHead::New());
 
   EXPECT_EQ(0, request_peer_context_.seen_redirects);
   base::RunLoop().RunUntilIdle();
@@ -150,12 +147,11 @@ TEST_F(URLLoaderClientImplTest, OnReceiveRedirect) {
 }
 
 TEST_F(URLLoaderClientImplTest, OnReceiveCachedMetadata) {
-  network::ResourceResponseHead response_head;
   std::vector<uint8_t> data;
   data.push_back('a');
   mojo_base::BigBuffer metadata(data);
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   url_loader_client_->OnReceiveCachedMetadata(std::move(metadata));
 
   EXPECT_FALSE(request_peer_context_.received_response);
@@ -167,9 +163,7 @@ TEST_F(URLLoaderClientImplTest, OnReceiveCachedMetadata) {
 }
 
 TEST_F(URLLoaderClientImplTest, OnTransferSizeUpdated) {
-  network::ResourceResponseHead response_head;
-
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   url_loader_client_->OnTransferSizeUpdated(4);
   url_loader_client_->OnTransferSizeUpdated(4);
 
@@ -181,10 +175,9 @@ TEST_F(URLLoaderClientImplTest, OnTransferSizeUpdated) {
 }
 
 TEST_F(URLLoaderClientImplTest, OnCompleteWithResponseBody) {
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe(DataPipeOptions());
   url_loader_client_->OnStartLoadingResponseBody(
       std::move(data_pipe.consumer_handle));
@@ -215,10 +208,9 @@ TEST_F(URLLoaderClientImplTest, OnCompleteWithResponseBody) {
 // bytes arrives after the completion message. URLLoaderClientImpl should
 // restore the order.
 TEST_F(URLLoaderClientImplTest, OnCompleteShouldBeTheLastMessage) {
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe(DataPipeOptions());
   url_loader_client_->OnStartLoadingResponseBody(
       std::move(data_pipe.consumer_handle));
@@ -241,10 +233,9 @@ TEST_F(URLLoaderClientImplTest, OnCompleteShouldBeTheLastMessage) {
 TEST_F(URLLoaderClientImplTest, CancelOnReceiveResponse) {
   request_peer_context_.cancel_on_receive_response = true;
 
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe(DataPipeOptions());
   url_loader_client_->OnStartLoadingResponseBody(
       std::move(data_pipe.consumer_handle));
@@ -261,10 +252,9 @@ TEST_F(URLLoaderClientImplTest, CancelOnReceiveResponse) {
 }
 
 TEST_F(URLLoaderClientImplTest, Defer) {
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe;
   data_pipe.producer_handle.reset();  // Empty body.
   url_loader_client_->OnStartLoadingResponseBody(
@@ -290,10 +280,9 @@ TEST_F(URLLoaderClientImplTest, Defer) {
 }
 
 TEST_F(URLLoaderClientImplTest, DeferWithResponseBody) {
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe(DataPipeOptions());
   uint32_t size = 5;
   MojoResult result = data_pipe.producer_handle->WriteData(
@@ -331,10 +320,9 @@ TEST_F(URLLoaderClientImplTest, DeferWithResponseBody) {
 // As "transfer size update" message is handled specially in the implementation,
 // we have a separate test.
 TEST_F(URLLoaderClientImplTest, DeferWithTransferSizeUpdated) {
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe(DataPipeOptions());
   uint32_t size = 5;
   MojoResult result = data_pipe.producer_handle->WriteData(
@@ -378,11 +366,11 @@ TEST_F(URLLoaderClientImplTest, SetDeferredDuringFlushingDeferredMessage) {
   request_peer_context_.defer_on_redirect = true;
 
   net::RedirectInfo redirect_info;
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveRedirect(redirect_info, response_head);
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveRedirect(redirect_info,
+                                        network::mojom::URLResponseHead::New());
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe(DataPipeOptions());
   uint32_t size = 5;
   MojoResult result = data_pipe.producer_handle->WriteData(
@@ -440,10 +428,9 @@ TEST_F(URLLoaderClientImplTest,
        SetDeferredDuringFlushingDeferredMessageOnTransferSizeUpdated) {
   request_peer_context_.defer_on_transfer_size_updated = true;
 
-  network::ResourceResponseHead response_head;
   network::URLLoaderCompletionStatus status;
 
-  url_loader_client_->OnReceiveResponse(response_head);
+  url_loader_client_->OnReceiveResponse(network::mojom::URLResponseHead::New());
   mojo::DataPipe data_pipe;
   data_pipe.producer_handle.reset();  // Empty body.
   url_loader_client_->OnStartLoadingResponseBody(
diff --git a/chromium/content/renderer/loader/web_url_loader_impl.cc b/chromium/content/renderer/loader/web_url_loader_impl.cc
index 5b47e5054b7..96a579453ed 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl.cc
+++ b/chromium/content/renderer/loader/web_url_loader_impl.cc
@@ -29,6 +29,7 @@
 #include "base/time/time.h"
 #include "build/build_config.h"
 #include "content/child/child_thread_impl.h"
+#include "content/common/frame.mojom.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_features.h"
 #include "content/public/common/navigation_policy.h"
@@ -40,6 +41,7 @@
 #include "content/renderer/loader/resource_dispatcher.h"
 #include "content/renderer/loader/sync_load_response.h"
 #include "content/renderer/loader/web_url_request_util.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "net/base/data_url.h"
 #include "net/base/filename_util.h"
 #include "net/base/host_port_pair.h"
@@ -58,15 +60,16 @@
 #include "net/url_request/url_request_data_job.h"
 #include "services/network/loader_util.h"
 #include "services/network/public/cpp/resource_request.h"
+#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/mojom/url_loader.mojom.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/common/mime_util/mime_util.h"
+#include "third_party/blink/public/common/security/security_style.h"
 #include "third_party/blink/public/platform/file_path_conversion.h"
 #include "third_party/blink/public/platform/interface_provider.h"
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/web_http_load_info.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
-#include "third_party/blink/public/platform/web_security_style.h"
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/platform/web_url_error.h"
 #include "third_party/blink/public/platform/web_url_load_timing.h"
@@ -182,32 +185,32 @@ WebString CryptoBufferAsWebString(const CRYPTO_BUFFER* buffer) {
 }
 
 void SetSecurityStyleAndDetails(const GURL& url,
-                                const network::ResourceResponseInfo& info,
+                                const network::mojom::URLResponseHead& head,
                                 WebURLResponse* response,
                                 bool report_security_info) {
   if (!report_security_info) {
-    response->SetSecurityStyle(blink::kWebSecurityStyleUnknown);
+    response->SetSecurityStyle(blink::SecurityStyle::kUnknown);
     return;
   }
   if (!url.SchemeIsCryptographic()) {
     // Some origins are considered secure even though they're not cryptographic,
     // so treat them as secure in the UI.
     if (IsOriginSecure(url))
-      response->SetSecurityStyle(blink::kWebSecurityStyleSecure);
+      response->SetSecurityStyle(blink::SecurityStyle::kSecure);
     else
-      response->SetSecurityStyle(blink::kWebSecurityStyleInsecure);
+      response->SetSecurityStyle(blink::SecurityStyle::kInsecure);
     return;
   }
 
   // The resource loader does not provide a guarantee that requests always have
-  // security info (such as a certificate) attached. Use WebSecurityStyleUnknown
+  // security info (such as a certificate) attached. Use SecurityStyleUnknown
   // in this case where there isn't enough information to be useful.
-  if (!info.ssl_info.has_value()) {
-    response->SetSecurityStyle(blink::kWebSecurityStyleUnknown);
+  if (!head.ssl_info.has_value()) {
+    response->SetSecurityStyle(blink::SecurityStyle::kUnknown);
     return;
   }
 
-  const net::SSLInfo& ssl_info = *info.ssl_info;
+  const net::SSLInfo& ssl_info = *head.ssl_info;
 
   const char* protocol = "";
   const char* key_exchange = "";
@@ -246,10 +249,10 @@ void SetSecurityStyleAndDetails(const GURL& url,
     }
   }
 
-  if (net::IsCertStatusError(info.cert_status)) {
-    response->SetSecurityStyle(blink::kWebSecurityStyleInsecure);
+  if (net::IsCertStatusError(head.cert_status)) {
+    response->SetSecurityStyle(blink::SecurityStyle::kInsecure);
   } else {
-    response->SetSecurityStyle(blink::kWebSecurityStyleSecure);
+    response->SetSecurityStyle(blink::SecurityStyle::kSecure);
   }
 
   blink::WebURLResponse::SignedCertificateTimestampList sct_list(
@@ -260,7 +263,7 @@ void SetSecurityStyleAndDetails(const GURL& url,
 
   if (!ssl_info.cert) {
     NOTREACHED();
-    response->SetSecurityStyle(blink::kWebSecurityStyleUnknown);
+    response->SetSecurityStyle(blink::SecurityStyle::kUnknown);
     return;
   }
 
@@ -358,9 +361,12 @@ std::unique_ptr<blink::WebURLLoader> WebURLLoaderFactoryImpl::CreateURLLoader(
     std::unique_ptr<WebResourceLoadingTaskRunnerHandle> task_runner_handle) {
   DCHECK(task_runner_handle);
   DCHECK(resource_dispatcher_);
-  return std::make_unique<WebURLLoaderImpl>(resource_dispatcher_.get(),
-                                            std::move(task_runner_handle),
-                                            loader_factory_);
+  // This default implementation does not support KeepAlive.
+  mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle =
+      mojo::NullRemote();
+  return std::make_unique<WebURLLoaderImpl>(
+      resource_dispatcher_.get(), std::move(task_runner_handle),
+      loader_factory_, std::move(keep_alive_handle));
 }
 
 // This inner class exists since the WebURLLoader may be deleted while inside a
@@ -373,7 +379,7 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context> {
       ResourceDispatcher* resource_dispatcher,
       std::unique_ptr<WebResourceLoadingTaskRunnerHandle> task_runner_handle,
       scoped_refptr<network::SharedURLLoaderFactory> factory,
-      mojom::KeepAliveHandlePtr keep_alive_handle);
+      mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle);
 
   ResourceDispatcher* resource_dispatcher() { return resource_dispatcher_; }
   int request_id() const { return request_id_; }
@@ -392,8 +398,8 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context> {
 
   void OnUploadProgress(uint64_t position, uint64_t size);
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          const network::ResourceResponseInfo& info);
-  void OnReceivedResponse(const network::ResourceResponseInfo& info);
+                          network::mojom::URLResponseHeadPtr head);
+  void OnReceivedResponse(network::mojom::URLResponseHeadPtr head);
   void OnStartLoadingResponseBody(mojo::ScopedDataPipeConsumerHandle body);
   void OnTransferSizeUpdated(int transfer_size_diff);
   void OnReceivedCachedMetadata(mojo_base::BigBuffer data);
@@ -438,7 +444,7 @@ class WebURLLoaderImpl::Context : public base::RefCounted<Context> {
   ResourceDispatcher* resource_dispatcher_;
   std::unique_ptr<WebResourceLoadingTaskRunnerHandle> task_runner_handle_;
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-  mojom::KeepAliveHandlePtr keep_alive_handle_;
+  mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle_;
   enum DeferState { NOT_DEFERRING, SHOULD_DEFER };
   DeferState defers_loading_;
   int request_id_;
@@ -462,8 +468,8 @@ class WebURLLoaderImpl::RequestPeerImpl : public RequestPeer {
   // RequestPeer methods:
   void OnUploadProgress(uint64_t position, uint64_t size) override;
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          const network::ResourceResponseInfo& info) override;
-  void OnReceivedResponse(const network::ResourceResponseInfo& info) override;
+                          network::mojom::URLResponseHeadPtr head) override;
+  void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override;
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override;
   void OnTransferSizeUpdated(int transfer_size_diff) override;
@@ -492,10 +498,10 @@ class WebURLLoaderImpl::SinkPeer : public RequestPeer {
   // RequestPeer implementation:
   void OnUploadProgress(uint64_t position, uint64_t size) override {}
   bool OnReceivedRedirect(const net::RedirectInfo& redirect_info,
-                          const network::ResourceResponseInfo& info) override {
+                          network::mojom::URLResponseHeadPtr head) override {
     return true;
   }
-  void OnReceivedResponse(const network::ResourceResponseInfo& info) override {}
+  void OnReceivedResponse(network::mojom::URLResponseHeadPtr head) override {}
   void OnStartLoadingResponseBody(
       mojo::ScopedDataPipeConsumerHandle body) override {
     body_handle_ = std::move(body);
@@ -557,14 +563,14 @@ WebURLLoaderImpl::Context::Context(
     ResourceDispatcher* resource_dispatcher,
     std::unique_ptr<WebResourceLoadingTaskRunnerHandle> task_runner_handle,
     scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
-    mojom::KeepAliveHandlePtr keep_alive_handle_ptr)
+    mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle)
     : loader_(loader),
       report_raw_headers_(false),
       client_(nullptr),
       resource_dispatcher_(resource_dispatcher),
       task_runner_handle_(std::move(task_runner_handle)),
       task_runner_(task_runner_handle_->GetTaskRunner()),
-      keep_alive_handle_(std::move(keep_alive_handle_ptr)),
+      keep_alive_handle_(std::move(keep_alive_handle)),
       defers_loading_(NOT_DEFERRING),
       request_id_(-1),
       url_loader_factory_(std::move(url_loader_factory)) {
@@ -643,11 +649,8 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
   resource_request->method = method;
   resource_request->url = url_;
   resource_request->site_for_cookies = request.SiteForCookies();
-  resource_request->top_frame_origin = request.TopFrameOrigin();
   resource_request->upgrade_if_insecure = request.UpgradeIfInsecure();
   resource_request->is_revalidating = request.IsRevalidating();
-  resource_request->should_also_use_factory_bound_origin_for_cors =
-      request.ShouldAlsoUseFactoryBoundOriginForCors();
   if (!request.RequestorOrigin().IsNull()) {
     if (request.RequestorOrigin().ToString() == "null") {
       // "file:" origin is treated like an opaque unique origin when
@@ -659,6 +662,8 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
       resource_request->request_initiator = request.RequestorOrigin();
     }
   }
+  if (!request.IsolatedWorldOrigin().IsNull())
+    resource_request->isolated_world_origin = request.IsolatedWorldOrigin();
   resource_request->referrer = referrer_url;
 
   resource_request->referrer_policy =
@@ -700,6 +705,8 @@ void WebURLLoaderImpl::Context::Start(const WebURLRequest& request,
 
   resource_request->load_flags = request.GetLoadFlagsForWebUrlRequest();
 
+  resource_request->recursive_prefetch_token = request.RecursivePrefetchToken();
+
   if (resource_request->resource_type ==
           static_cast<int>(ResourceType::kPrefetch) ||
       resource_request->resource_type ==
@@ -855,7 +862,7 @@ void WebURLLoaderImpl::Context::OnUploadProgress(uint64_t position,
 
 bool WebURLLoaderImpl::Context::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseInfo& info) {
+    network::mojom::URLResponseHeadPtr head) {
   if (!client_)
     return false;
 
@@ -864,12 +871,11 @@ bool WebURLLoaderImpl::Context::OnReceivedRedirect(
       this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 
   WebURLResponse response;
-  PopulateURLResponse(url_, info, &response, report_raw_headers_, request_id_);
+  PopulateURLResponse(url_, *head, &response, report_raw_headers_, request_id_);
 
   url_ = WebURL(redirect_info.new_url);
   return client_->WillFollowRedirect(
       url_, redirect_info.new_site_for_cookies,
-      redirect_info.new_top_frame_origin,
       WebString::FromUTF8(redirect_info.new_referrer),
       Referrer::NetReferrerPolicyToBlinkReferrerPolicy(
           redirect_info.new_referrer_policy),
@@ -878,7 +884,7 @@ bool WebURLLoaderImpl::Context::OnReceivedRedirect(
 }
 
 void WebURLLoaderImpl::Context::OnReceivedResponse(
-    const network::ResourceResponseInfo& info) {
+    network::mojom::URLResponseHeadPtr head) {
   if (!client_)
     return;
 
@@ -887,7 +893,7 @@ void WebURLLoaderImpl::Context::OnReceivedResponse(
       this, TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
 
   WebURLResponse response;
-  PopulateURLResponse(url_, info, &response, report_raw_headers_, request_id_);
+  PopulateURLResponse(url_, *head, &response, report_raw_headers_, request_id_);
 
   client_->DidReceiveResponse(response);
 
@@ -970,13 +976,13 @@ void WebURLLoaderImpl::RequestPeerImpl::OnUploadProgress(uint64_t position,
 
 bool WebURLLoaderImpl::RequestPeerImpl::OnReceivedRedirect(
     const net::RedirectInfo& redirect_info,
-    const network::ResourceResponseInfo& info) {
-  return context_->OnReceivedRedirect(redirect_info, info);
+    network::mojom::URLResponseHeadPtr head) {
+  return context_->OnReceivedRedirect(redirect_info, std::move(head));
 }
 
 void WebURLLoaderImpl::RequestPeerImpl::OnReceivedResponse(
-    const network::ResourceResponseInfo& info) {
-  context_->OnReceivedResponse(info);
+    network::mojom::URLResponseHeadPtr head) {
+  context_->OnReceivedResponse(std::move(head));
 }
 
 void WebURLLoaderImpl::RequestPeerImpl::OnStartLoadingResponseBody(
@@ -1006,17 +1012,8 @@ void WebURLLoaderImpl::RequestPeerImpl::OnCompletedRequest(
 WebURLLoaderImpl::WebURLLoaderImpl(
     ResourceDispatcher* resource_dispatcher,
     std::unique_ptr<WebResourceLoadingTaskRunnerHandle> task_runner_handle,
-    scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory)
-    : WebURLLoaderImpl(resource_dispatcher,
-                       std::move(task_runner_handle),
-                       std::move(url_loader_factory),
-                       nullptr) {}
-
-WebURLLoaderImpl::WebURLLoaderImpl(
-    ResourceDispatcher* resource_dispatcher,
-    std::unique_ptr<WebResourceLoadingTaskRunnerHandle> task_runner_handle,
     scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
-    mojom::KeepAliveHandlePtr keep_alive_handle)
+    mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle)
     : context_(new Context(this,
                            resource_dispatcher,
                            std::move(task_runner_handle),
@@ -1029,102 +1026,101 @@ WebURLLoaderImpl::~WebURLLoaderImpl() {
 
 void WebURLLoaderImpl::PopulateURLResponse(
     const WebURL& url,
-    const network::ResourceResponseInfo& info,
+    const network::mojom::URLResponseHead& head,
     WebURLResponse* response,
     bool report_security_info,
     int request_id) {
   response->SetCurrentRequestUrl(url);
-  response->SetResponseTime(info.response_time);
-  response->SetMimeType(WebString::FromUTF8(info.mime_type));
-  response->SetTextEncodingName(WebString::FromUTF8(info.charset));
-  response->SetExpectedContentLength(info.content_length);
+  response->SetResponseTime(head.response_time);
+  response->SetMimeType(WebString::FromUTF8(head.mime_type));
+  response->SetTextEncodingName(WebString::FromUTF8(head.charset));
+  response->SetExpectedContentLength(head.content_length);
   response->SetHasMajorCertificateErrors(
-      net::IsCertStatusError(info.cert_status));
-  response->SetCTPolicyCompliance(info.ct_policy_compliance);
-  response->SetIsLegacyTLSVersion(info.is_legacy_tls_version);
-  response->SetAppCacheID(info.appcache_id);
-  response->SetAppCacheManifestURL(info.appcache_manifest_url);
-  response->SetWasCached(!info.load_timing.request_start_time.is_null() &&
-                         info.response_time <
-                             info.load_timing.request_start_time);
+      net::IsCertStatusError(head.cert_status));
+  response->SetCTPolicyCompliance(head.ct_policy_compliance);
+  response->SetIsLegacyTLSVersion(head.is_legacy_tls_version);
+  response->SetAppCacheID(head.appcache_id);
+  response->SetAppCacheManifestURL(head.appcache_manifest_url);
+  response->SetWasCached(!head.load_timing.request_start_time.is_null() &&
+                         head.response_time <
+                             head.load_timing.request_start_time);
   response->SetRemoteIPAddress(WebString::FromUTF8(
-      net::HostPortPair::FromIPEndPoint(info.remote_endpoint).HostForURL()));
-  response->SetRemotePort(info.remote_endpoint.port());
-  response->SetConnectionID(info.load_timing.socket_log_id);
-  response->SetConnectionReused(info.load_timing.socket_reused);
-  response->SetWasFetchedViaSPDY(info.was_fetched_via_spdy);
-  response->SetWasFetchedViaServiceWorker(info.was_fetched_via_service_worker);
+      net::HostPortPair::FromIPEndPoint(head.remote_endpoint).HostForURL()));
+  response->SetRemotePort(head.remote_endpoint.port());
+  response->SetConnectionID(head.load_timing.socket_log_id);
+  response->SetConnectionReused(head.load_timing.socket_reused);
+  response->SetWasFetchedViaSPDY(head.was_fetched_via_spdy);
+  response->SetWasFetchedViaServiceWorker(head.was_fetched_via_service_worker);
   response->SetWasFallbackRequiredByServiceWorker(
-      info.was_fallback_required_by_service_worker);
-  response->SetType(info.response_type);
-  response->SetUrlListViaServiceWorker(info.url_list_via_service_worker);
+      head.was_fallback_required_by_service_worker);
+  response->SetType(head.response_type);
+  response->SetUrlListViaServiceWorker(head.url_list_via_service_worker);
   response->SetCacheStorageCacheName(
-      info.is_in_cache_storage
-          ? blink::WebString::FromUTF8(info.cache_storage_cache_name)
+      head.is_in_cache_storage
+          ? blink::WebString::FromUTF8(head.cache_storage_cache_name)
           : blink::WebString());
   blink::WebVector<blink::WebString> cors_exposed_header_names(
-      info.cors_exposed_header_names.size());
+      head.cors_exposed_header_names.size());
   std::transform(
-      info.cors_exposed_header_names.begin(),
-      info.cors_exposed_header_names.end(), cors_exposed_header_names.begin(),
+      head.cors_exposed_header_names.begin(),
+      head.cors_exposed_header_names.end(), cors_exposed_header_names.begin(),
       [](const std::string& h) { return blink::WebString::FromLatin1(h); });
   response->SetCorsExposedHeaderNames(cors_exposed_header_names);
   response->SetDidServiceWorkerNavigationPreload(
-      info.did_service_worker_navigation_preload);
-  response->SetEncodedDataLength(info.encoded_data_length);
-  response->SetEncodedBodyLength(info.encoded_body_length);
+      head.did_service_worker_navigation_preload);
+  response->SetEncodedDataLength(head.encoded_data_length);
+  response->SetEncodedBodyLength(head.encoded_body_length);
+  response->SetWasAlpnNegotiated(head.was_alpn_negotiated);
   response->SetAlpnNegotiatedProtocol(
-      WebString::FromUTF8(info.alpn_negotiated_protocol));
-  response->SetConnectionInfo(info.connection_info);
-  response->SetAsyncRevalidationRequested(info.async_revalidation_requested);
-  response->SetNetworkAccessed(info.network_accessed);
+      WebString::FromUTF8(head.alpn_negotiated_protocol));
+  response->SetWasAlternateProtocolAvailable(
+      head.was_alternate_protocol_available);
+  response->SetConnectionInfo(head.connection_info);
+  response->SetAsyncRevalidationRequested(head.async_revalidation_requested);
+  response->SetNetworkAccessed(head.network_accessed);
   response->SetRequestId(request_id);
   response->SetIsSignedExchangeInnerResponse(
-      info.is_signed_exchange_inner_response);
-  response->SetWasInPrefetchCache(info.was_in_prefetch_cache);
+      head.is_signed_exchange_inner_response);
+  response->SetWasInPrefetchCache(head.was_in_prefetch_cache);
+  response->SetRecursivePrefetchToken(head.recursive_prefetch_token);
 
-  SetSecurityStyleAndDetails(url, info, response, report_security_info);
+  SetSecurityStyleAndDetails(url, head, response, report_security_info);
 
   // If there's no received headers end time, don't set load timing.  This is
   // the case for non-HTTP requests, requests that don't go over the wire, and
   // certain error cases.
-  if (!info.load_timing.receive_headers_end.is_null()) {
+  if (!head.load_timing.receive_headers_end.is_null()) {
     WebURLLoadTiming timing;
-    PopulateURLLoadTiming(info.load_timing, &timing);
-    timing.SetWorkerStart(info.service_worker_start_time);
-    timing.SetWorkerReady(info.service_worker_ready_time);
+    PopulateURLLoadTiming(head.load_timing, &timing);
+    timing.SetWorkerStart(head.service_worker_start_time);
+    timing.SetWorkerReady(head.service_worker_ready_time);
     response->SetLoadTiming(timing);
   }
 
-  if (info.raw_request_response_info.get()) {
+  if (head.raw_request_response_info.get()) {
     WebHTTPLoadInfo load_info;
 
     load_info.SetHTTPStatusCode(
-        info.raw_request_response_info->http_status_code);
+        head.raw_request_response_info->http_status_code);
     load_info.SetHTTPStatusText(WebString::FromLatin1(
-        info.raw_request_response_info->http_status_text));
+        head.raw_request_response_info->http_status_text));
 
     load_info.SetRequestHeadersText(WebString::FromLatin1(
-        info.raw_request_response_info->request_headers_text));
+        head.raw_request_response_info->request_headers_text));
     load_info.SetResponseHeadersText(WebString::FromLatin1(
-        info.raw_request_response_info->response_headers_text));
-    const HeadersVector& request_headers =
-        info.raw_request_response_info->request_headers;
-    for (auto it = request_headers.begin(); it != request_headers.end(); ++it) {
-      load_info.AddRequestHeader(WebString::FromLatin1(it->first),
-                                 WebString::FromLatin1(it->second));
+        head.raw_request_response_info->response_headers_text));
+    for (auto& header : head.raw_request_response_info->request_headers) {
+      load_info.AddRequestHeader(WebString::FromLatin1(header->key),
+                                 WebString::FromLatin1(header->value));
     }
-    const HeadersVector& response_headers =
-        info.raw_request_response_info->response_headers;
-    for (auto it = response_headers.begin(); it != response_headers.end();
-         ++it) {
-      load_info.AddResponseHeader(WebString::FromLatin1(it->first),
-                                  WebString::FromLatin1(it->second));
+    for (auto& header : head.raw_request_response_info->response_headers) {
+      load_info.AddResponseHeader(WebString::FromLatin1(header->key),
+                                  WebString::FromLatin1(header->value));
     }
     response->SetHTTPLoadInfo(load_info);
   }
 
-  const net::HttpResponseHeaders* headers = info.headers.get();
+  const net::HttpResponseHeaders* headers = head.headers.get();
   if (!headers)
     return;
 
@@ -1151,6 +1147,13 @@ void WebURLLoaderImpl::PopulateURLResponse(
   }
 }
 
+void WebURLLoaderImpl::PopulateURLResponse(
+    const WebURL& url,
+    const network::ResourceResponseHead& head,
+    WebURLResponse* response,
+    bool report_security_info,
+    int request_id) {}
+
 // static
 WebURLError WebURLLoaderImpl::PopulateURLError(
     const network::URLLoaderCompletionStatus& status,
@@ -1205,16 +1208,16 @@ void WebURLLoaderImpl::LoadSynchronously(
     return;
   }
 
-  PopulateURLResponse(final_url, sync_load_response.info, &response,
+  PopulateURLResponse(final_url, *sync_load_response.head, &response,
                       request.ReportRawHeaders(), context_->request_id());
-  encoded_data_length = sync_load_response.info.encoded_data_length;
-  encoded_body_length = sync_load_response.info.encoded_body_length;
+  encoded_data_length = sync_load_response.head->encoded_data_length;
+  encoded_body_length = sync_load_response.head->encoded_body_length;
   if (sync_load_response.downloaded_blob) {
     downloaded_blob = blink::WebBlobInfo(
         WebString::FromLatin1(sync_load_response.downloaded_blob->uuid),
         WebString::FromLatin1(sync_load_response.downloaded_blob->content_type),
         sync_load_response.downloaded_blob->size,
-        sync_load_response.downloaded_blob->blob.PassHandle());
+        sync_load_response.downloaded_blob->blob.PassPipe());
   }
 
   data.Assign(sync_load_response.data.data(), sync_load_response.data.size());
diff --git a/chromium/content/renderer/loader/web_url_loader_impl.h b/chromium/content/renderer/loader/web_url_loader_impl.h
index c5b971593d0..837447e61b8 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl.h
+++ b/chromium/content/renderer/loader/web_url_loader_impl.h
@@ -11,15 +11,17 @@
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/common/frame.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "third_party/blink/public/platform/scheduler/web_resource_loading_task_runner_handle.h"
 #include "third_party/blink/public/platform/web_url_loader.h"
 #include "third_party/blink/public/platform/web_url_loader_factory.h"
 
 namespace network {
-struct ResourceResponseInfo;
+struct ResourceResponseHead;
 }
 
 namespace content {
@@ -48,11 +50,6 @@ class CONTENT_EXPORT WebURLLoaderFactoryImpl
 
 class CONTENT_EXPORT WebURLLoaderImpl : public blink::WebURLLoader {
  public:
-  WebURLLoaderImpl(
-      ResourceDispatcher* resource_dispatcher,
-      std::unique_ptr<blink::scheduler::WebResourceLoadingTaskRunnerHandle>
-          task_runner_handle,
-      scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory);
   // When non-null |keep_alive_handle| is specified, this loader prolongs
   // this render process's lifetime.
   WebURLLoaderImpl(
@@ -60,11 +57,16 @@ class CONTENT_EXPORT WebURLLoaderImpl : public blink::WebURLLoader {
       std::unique_ptr<blink::scheduler::WebResourceLoadingTaskRunnerHandle>
           task_runner_handle,
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
-      mojom::KeepAliveHandlePtr keep_alive_handle);
+      mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle);
   ~WebURLLoaderImpl() override;
 
   static void PopulateURLResponse(const blink::WebURL& url,
-                                  const network::ResourceResponseInfo& info,
+                                  const network::ResourceResponseHead& head,
+                                  blink::WebURLResponse* response,
+                                  bool report_security_info,
+                                  int request_id);
+  static void PopulateURLResponse(const blink::WebURL& url,
+                                  const network::mojom::URLResponseHead& head,
                                   blink::WebURLResponse* response,
                                   bool report_security_info,
                                   int request_id);
diff --git a/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc b/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
index b0473041674..b8131d5b67b 100644
--- a/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
+++ b/chromium/content/renderer/loader/web_url_loader_impl_unittest.cc
@@ -24,6 +24,7 @@
 #include "content/renderer/loader/request_extra_data.h"
 #include "content/renderer/loader/resource_dispatcher.h"
 #include "content/renderer/loader/sync_load_response.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "net/base/host_port_pair.h"
 #include "net/base/ip_endpoint.h"
@@ -35,8 +36,8 @@
 #include "net/test/cert_test_util.h"
 #include "net/traffic_annotation/network_traffic_annotation_test_helper.h"
 #include "net/url_request/redirect_info.h"
-#include "services/network/public/cpp/resource_response_info.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "third_party/blink/public/platform/web_data.h"
@@ -89,7 +90,7 @@ class TestResourceDispatcher : public ResourceDispatcher {
       std::unique_ptr<NavigationResponseOverrideParameters>
           navigation_response_override_params) override {
     EXPECT_FALSE(peer_);
-    if (sync_load_response_.info.encoded_body_length != -1)
+    if (sync_load_response_.head->encoded_body_length != -1)
       EXPECT_TRUE(is_sync);
     peer_ = std::move(peer);
     url_ = request->url;
@@ -154,7 +155,8 @@ class FakeURLLoaderFactory final : public network::mojom::URLLoaderFactory {
     NOTREACHED();
   }
 
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override {
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override {
     NOTREACHED();
   }
 
@@ -171,7 +173,8 @@ class TestWebURLLoaderClient : public blink::WebURLLoaderClient {
                 CreateUnprioritized(
                     blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
             base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
-                &fake_url_loader_factory_))),
+                &fake_url_loader_factory_),
+            /*keep_alive_handle=*/mojo::NullRemote())),
         delete_on_receive_redirect_(false),
         delete_on_receive_response_(false),
         delete_on_receive_data_(false),
@@ -187,7 +190,6 @@ class TestWebURLLoaderClient : public blink::WebURLLoaderClient {
   bool WillFollowRedirect(
       const blink::WebURL& new_url,
       const blink::WebURL& new_site_for_cookies,
-      const base::Optional<blink::WebSecurityOrigin>& new_top_frame_origin,
       const blink::WebString& new_referrer,
       network::mojom::ReferrerPolicy new_referrer_policy,
       const blink::WebString& new_method,
@@ -322,7 +324,8 @@ class WebURLLoaderImplTest : public testing::Test {
     redirect_info.new_method = "GET";
     redirect_info.new_url = GURL(kTestURL);
     redirect_info.new_site_for_cookies = GURL(kTestURL);
-    peer()->OnReceivedRedirect(redirect_info, network::ResourceResponseInfo());
+    peer()->OnReceivedRedirect(redirect_info,
+                               network::mojom::URLResponseHead::New());
     EXPECT_TRUE(client()->did_receive_redirect());
   }
 
@@ -333,13 +336,14 @@ class WebURLLoaderImplTest : public testing::Test {
     redirect_info.new_method = "GET";
     redirect_info.new_url = GURL(kTestHTTPSURL);
     redirect_info.new_site_for_cookies = GURL(kTestHTTPSURL);
-    peer()->OnReceivedRedirect(redirect_info, network::ResourceResponseInfo());
+    peer()->OnReceivedRedirect(redirect_info,
+                               network::mojom::URLResponseHead::New());
     EXPECT_TRUE(client()->did_receive_redirect());
   }
 
   void DoReceiveResponse() {
     EXPECT_FALSE(client()->did_receive_response());
-    peer()->OnReceivedResponse(network::ResourceResponseInfo());
+    peer()->OnReceivedResponse(network::mojom::URLResponseHead::New());
     EXPECT_TRUE(client()->did_receive_response());
   }
 
@@ -386,7 +390,7 @@ class WebURLLoaderImplTest : public testing::Test {
   RequestPeer* peer() { return dispatcher()->peer(); }
 
  private:
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   TestResourceDispatcher dispatcher_;
   mojo::ScopedDataPipeProducerHandle body_handle_;
   std::unique_ptr<TestWebURLLoaderClient> client_;
@@ -479,8 +483,7 @@ TEST_F(WebURLLoaderImplTest, ResponseOverride) {
 
   response_override = dispatcher()->TakeNavigationResponseOverrideParams();
   ASSERT_TRUE(response_override);
-  peer()->OnReceivedResponse(
-      network::ResourceResponseHead(response_override->response_head));
+  peer()->OnReceivedResponse(std::move(response_override->response_head));
 
   EXPECT_TRUE(client()->did_receive_response());
 
@@ -512,12 +515,12 @@ TEST_F(WebURLLoaderImplTest, ResponseIPAddress) {
 
   for (const auto& test : cases) {
     SCOPED_TRACE(test.ip);
-    network::ResourceResponseInfo info;
+    network::mojom::URLResponseHead head;
     net::IPAddress address;
     ASSERT_TRUE(address.AssignFromIPLiteral(test.ip));
-    info.remote_endpoint = net::IPEndPoint(address, 443);
+    head.remote_endpoint = net::IPEndPoint(address, 443);
     blink::WebURLResponse response;
-    WebURLLoaderImpl::PopulateURLResponse(url, info, &response, true, -1);
+    WebURLLoaderImpl::PopulateURLResponse(url, head, &response, true, -1);
     EXPECT_EQ(test.expected, response.RemoteIPAddress().Utf8());
   };
 }
@@ -541,10 +544,10 @@ TEST_F(WebURLLoaderImplTest, ResponseCert) {
   net::SSLConnectionStatusSetVersion(net::SSL_CONNECTION_VERSION_TLS1_2,
                                      &ssl_info.connection_status);
 
-  network::ResourceResponseInfo info;
-  info.ssl_info = ssl_info;
+  network::mojom::URLResponseHead head;
+  head.ssl_info = ssl_info;
   blink::WebURLResponse web_url_response;
-  WebURLLoaderImpl::PopulateURLResponse(url, info, &web_url_response, true, -1);
+  WebURLLoaderImpl::PopulateURLResponse(url, head, &web_url_response, true, -1);
 
   base::Optional<blink::WebURLResponse::WebSecurityDetails> security_details =
       web_url_response.SecurityDetailsForTesting();
@@ -579,10 +582,10 @@ TEST_F(WebURLLoaderImplTest, ResponseCertWithNoSANs) {
   net::SSLConnectionStatusSetVersion(net::SSL_CONNECTION_VERSION_TLS1_2,
                                      &ssl_info.connection_status);
   ssl_info.cert = certs[0];
-  network::ResourceResponseInfo info;
-  info.ssl_info = ssl_info;
+  network::mojom::URLResponseHead head;
+  head.ssl_info = ssl_info;
   blink::WebURLResponse web_url_response;
-  WebURLLoaderImpl::PopulateURLResponse(url, info, &web_url_response, true, -1);
+  WebURLLoaderImpl::PopulateURLResponse(url, head, &web_url_response, true, -1);
 
   base::Optional<blink::WebURLResponse::WebSecurityDetails> security_details =
       web_url_response.SecurityDetailsForTesting();
@@ -615,8 +618,8 @@ TEST_F(WebURLLoaderImplTest, SyncLengths) {
   sync_load_response.url = url;
   sync_load_response.data = kBodyData;
   ASSERT_EQ(17u, sync_load_response.data.size());
-  sync_load_response.info.encoded_body_length = kEncodedBodyLength;
-  sync_load_response.info.encoded_data_length = kEncodedDataLength;
+  sync_load_response.head->encoded_body_length = kEncodedBodyLength;
+  sync_load_response.head->encoded_data_length = kEncodedDataLength;
   dispatcher()->set_sync_load_response(std::move(sync_load_response));
 
   blink::WebURLResponse response;
diff --git a/chromium/content/renderer/loader/web_url_request_util.cc b/chromium/content/renderer/loader/web_url_request_util.cc
index 9e568b3caca..69c189774b2 100644
--- a/chromium/content/renderer/loader/web_url_request_util.cc
+++ b/chromium/content/renderer/loader/web_url_request_util.cc
@@ -15,7 +15,8 @@
 #include "content/child/child_thread_impl.h"
 #include "content/public/common/service_names.mojom.h"
 #include "content/renderer/loader/request_extra_data.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_util.h"
@@ -245,8 +246,7 @@ WebHTTPBody GetWebHTTPBodyForRequestBody(
           http_body.AppendBlob(WebString::FromASCII(element.blob_uuid()));
         break;
       case network::mojom::DataElementType::kDataPipe: {
-        http_body.AppendDataPipe(
-            element.CloneDataPipeGetter().PassInterface().PassHandle());
+        http_body.AppendDataPipe(element.CloneDataPipeGetter().PassPipe());
         break;
       }
       case network::mojom::DataElementType::kUnknown:
@@ -300,31 +300,34 @@ scoped_refptr<network::ResourceRequestBody> GetRequestBodyForWebHTTPBody(
         break;
       case WebHTTPBody::Element::kTypeBlob: {
         DCHECK(element.optional_blob_handle.is_valid());
-        blink::mojom::BlobPtr blob_ptr(
-            blink::mojom::BlobPtrInfo(std::move(element.optional_blob_handle),
-                                      blink::mojom::Blob::Version_));
+        mojo::Remote<blink::mojom::Blob> blob_remote(
+            mojo::PendingRemote<blink::mojom::Blob>(
+                std::move(element.optional_blob_handle),
+                blink::mojom::Blob::Version_));
 
-        network::mojom::DataPipeGetterPtr data_pipe_getter_ptr;
-        blob_ptr->AsDataPipeGetter(MakeRequest(&data_pipe_getter_ptr));
+        mojo::PendingRemote<network::mojom::DataPipeGetter>
+            data_pipe_getter_remote;
+        blob_remote->AsDataPipeGetter(
+            data_pipe_getter_remote.InitWithNewPipeAndPassReceiver());
 
-        request_body->AppendDataPipe(std::move(data_pipe_getter_ptr));
+        request_body->AppendDataPipe(std::move(data_pipe_getter_remote));
         break;
       }
       case WebHTTPBody::Element::kTypeDataPipe: {
-        // Convert the raw message pipe to network::mojom::DataPipeGetterPtr.
-        network::mojom::DataPipeGetterPtr data_pipe_getter;
-        data_pipe_getter.Bind(network::mojom::DataPipeGetterPtrInfo(
-            std::move(element.data_pipe_getter), 0u));
+        // Convert the raw message pipe to
+        // mojo::Remote<network::mojom::DataPipeGetter> data_pipe_getter.
+        mojo::Remote<network::mojom::DataPipeGetter> data_pipe_getter(
+            mojo::PendingRemote<network::mojom::DataPipeGetter>(
+                std::move(element.data_pipe_getter), 0u));
 
         // Set the cloned DataPipeGetter to the output |request_body|, while
         // keeping the original message pipe back in the input |httpBody|. This
         // way the consumer of the |httpBody| can retrieve the data pipe
         // multiple times (e.g. during redirects) until the request is finished.
-        network::mojom::DataPipeGetterPtr cloned_getter;
-        data_pipe_getter->Clone(mojo::MakeRequest(&cloned_getter));
+        mojo::PendingRemote<network::mojom::DataPipeGetter> cloned_getter;
+        data_pipe_getter->Clone(cloned_getter.InitWithNewPipeAndPassReceiver());
         request_body->AppendDataPipe(std::move(cloned_getter));
-        element.data_pipe_getter =
-            data_pipe_getter.PassInterface().PassHandle();
+        element.data_pipe_getter = data_pipe_getter.Unbind().PassPipe();
         break;
       }
     }
diff --git a/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc b/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
index d1e5c86a5f1..cd6f5538da5 100644
--- a/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
+++ b/chromium/content/renderer/loader/web_worker_fetch_context_impl.cc
@@ -19,6 +19,7 @@
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/renderer/url_loader_throttle_provider.h"
 #include "content/public/renderer/websocket_handshake_throttle_provider.h"
+#include "content/renderer/loader/child_url_loader_factory_bundle.h"
 #include "content/renderer/loader/code_cache_loader_impl.h"
 #include "content/renderer/loader/frame_request_blocker.h"
 #include "content/renderer/loader/request_extra_data.h"
@@ -46,14 +47,14 @@ void CreateServiceWorkerSubresourceLoaderFactory(
         remote_container_host,
     const std::string& client_id,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory,
-    network::mojom::URLLoaderFactoryRequest request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
     scoped_refptr<base::SequencedTaskRunner> task_runner) {
   ServiceWorkerSubresourceLoaderFactory::Create(
       base::MakeRefCounted<ControllerServiceWorkerConnector>(
           std::move(remote_container_host),
           mojo::NullRemote() /* remote_controller */, client_id),
       network::SharedURLLoaderFactory::Create(std::move(fallback_factory)),
-      std::move(request), std::move(task_runner));
+      std::move(receiver), std::move(task_runner));
 }
 
 }  // namespace
@@ -84,17 +85,22 @@ class WebWorkerFetchContextImpl::Factory : public blink::WebURLLoaderFactory {
           task_runner_handle) override {
     DCHECK(task_runner_handle);
     DCHECK(resource_dispatcher_);
+
+    // KeepAlive is not yet supported in web workers.
+    mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle =
+        mojo::NullRemote();
+
     if (CanCreateServiceWorkerURLLoader(request)) {
       // Create our own URLLoader to route the request to the controller service
       // worker.
-      return std::make_unique<WebURLLoaderImpl>(resource_dispatcher_.get(),
-                                                std::move(task_runner_handle),
-                                                service_worker_loader_factory_);
+      return std::make_unique<WebURLLoaderImpl>(
+          resource_dispatcher_.get(), std::move(task_runner_handle),
+          service_worker_loader_factory_, std::move(keep_alive_handle));
     }
 
-    return std::make_unique<WebURLLoaderImpl>(resource_dispatcher_.get(),
-                                              std::move(task_runner_handle),
-                                              loader_factory_);
+    return std::make_unique<WebURLLoaderImpl>(
+        resource_dispatcher_.get(), std::move(task_runner_handle),
+        loader_factory_, std::move(keep_alive_handle));
   }
 
   void SetServiceWorkerURLLoaderFactory(
@@ -152,8 +158,9 @@ scoped_refptr<WebWorkerFetchContextImpl> WebWorkerFetchContextImpl::Create(
     mojo::PendingReceiver<blink::mojom::RendererPreferenceWatcher>
         watcher_receiver,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
-    std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-        fallback_factory_info) {
+    std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info,
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+        pending_subresource_loader_updater) {
   mojo::PendingReceiver<blink::mojom::ServiceWorkerWorkerClient>
       service_worker_client_receiver;
   mojo::PendingRemote<blink::mojom::ServiceWorkerWorkerClientRegistry>
@@ -183,6 +190,7 @@ scoped_refptr<WebWorkerFetchContextImpl> WebWorkerFetchContextImpl::Create(
           std::move(service_worker_worker_client_registry),
           std::move(service_worker_container_host),
           std::move(loader_factory_info), std::move(fallback_factory_info),
+          std::move(pending_subresource_loader_updater),
           GetContentClient()->renderer()->CreateURLLoaderThrottleProvider(
               URLLoaderThrottleProviderType::kWorker),
           GetContentClient()
@@ -213,6 +221,8 @@ WebWorkerFetchContextImpl::WebWorkerFetchContextImpl(
         service_worker_container_host,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info,
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+        pending_subresource_loader_updater,
     std::unique_ptr<URLLoaderThrottleProvider> throttle_provider,
     std::unique_ptr<WebSocketHandshakeThrottleProvider>
         websocket_handshake_throttle_provider,
@@ -226,6 +236,8 @@ WebWorkerFetchContextImpl::WebWorkerFetchContextImpl(
           std::move(service_worker_container_host)),
       loader_factory_info_(std::move(loader_factory_info)),
       fallback_factory_info_(std::move(fallback_factory_info)),
+      pending_subresource_loader_updater_(
+          std::move(pending_subresource_loader_updater)),
       thread_safe_sender_(thread_safe_sender),
       renderer_preferences_(std::move(renderer_preferences)),
       preference_watcher_pending_receiver_(
@@ -270,12 +282,16 @@ WebWorkerFetchContextImpl::CloneForNestedWorkerDeprecated(
         service_worker_container_host.InitWithNewPipeAndPassReceiver());
   }
 
+  // |pending_subresource_loader_updater| is not used for
+  // non-PlzDedicatedWorker.
   scoped_refptr<WebWorkerFetchContextImpl> new_context =
       CloneForNestedWorkerInternal(
           std::move(service_worker_client_receiver),
           std::move(service_worker_worker_client_registry),
           std::move(service_worker_container_host), loader_factory_->Clone(),
-          fallback_factory_->Clone(), std::move(task_runner));
+          fallback_factory_->Clone(),
+          /*pending_subresource_loader_updater=*/mojo::NullReceiver(),
+          std::move(task_runner));
   new_context->controller_service_worker_mode_ =
       controller_service_worker_mode_;
 
@@ -287,6 +303,8 @@ WebWorkerFetchContextImpl::CloneForNestedWorker(
     ServiceWorkerProviderContext* service_worker_provider_context,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info,
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+        pending_subresource_loader_updater,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   DCHECK(base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
   DCHECK(loader_factory_info);
@@ -298,7 +316,8 @@ WebWorkerFetchContextImpl::CloneForNestedWorker(
         /*service_worker_client_receiver=*/mojo::NullReceiver(),
         /*service_worker_worker_client_registry=*/mojo::NullRemote(),
         /*container_host=*/mojo::NullRemote(), std::move(loader_factory_info),
-        std::move(fallback_factory_info), std::move(task_runner));
+        std::move(fallback_factory_info),
+        std::move(pending_subresource_loader_updater), std::move(task_runner));
   }
 
   mojo::PendingRemote<blink::mojom::ServiceWorkerWorkerClientRegistry>
@@ -323,6 +342,7 @@ WebWorkerFetchContextImpl::CloneForNestedWorker(
           std::move(service_worker_worker_client_registry),
           std::move(service_worker_container_host),
           std::move(loader_factory_info), std::move(fallback_factory_info),
+          std::move(pending_subresource_loader_updater),
           std::move(task_runner));
   new_context->controller_service_worker_mode_ =
       service_worker_provider_context->GetControllerServiceWorkerMode();
@@ -343,6 +363,9 @@ void WebWorkerFetchContextImpl::InitializeOnWorkerThread(
       network::SharedURLLoaderFactory::Create(std::move(loader_factory_info_));
   fallback_factory_ = network::SharedURLLoaderFactory::Create(
       std::move(fallback_factory_info_));
+  subresource_loader_updater_.Bind(
+      std::move(pending_subresource_loader_updater_));
+
   if (service_worker_client_receiver_.is_valid())
     receiver_.Bind(std::move(service_worker_client_receiver_));
 
@@ -548,6 +571,8 @@ WebWorkerFetchContextImpl::CloneForNestedWorkerInternal(
         service_worker_container_host,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info,
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+        pending_subresource_loader_updater,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   mojo::PendingRemote<blink::mojom::RendererPreferenceWatcher>
       preference_watcher;
@@ -558,6 +583,7 @@ WebWorkerFetchContextImpl::CloneForNestedWorkerInternal(
       std::move(service_worker_worker_client_registry),
       std::move(service_worker_container_host), std::move(loader_factory_info),
       std::move(fallback_factory_info),
+      std::move(pending_subresource_loader_updater),
       throttle_provider_ ? throttle_provider_->Clone() : nullptr,
       websocket_handshake_throttle_provider_
           ? websocket_handshake_throttle_provider_->Clone(
@@ -608,6 +634,22 @@ void WebWorkerFetchContextImpl::ResetServiceWorkerURLLoaderFactory() {
       std::move(service_worker_url_loader_factory));
 }
 
+void WebWorkerFetchContextImpl::UpdateSubresourceLoaderFactories(
+    std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
+        subresource_loader_factories) {
+  auto subresource_loader_factory_bundle =
+      base::MakeRefCounted<ChildURLLoaderFactoryBundle>(
+          std::make_unique<ChildURLLoaderFactoryBundleInfo>(
+              std::move(subresource_loader_factories)));
+  loader_factory_ = network::SharedURLLoaderFactory::Create(
+      subresource_loader_factory_bundle->Clone());
+  fallback_factory_ = network::SharedURLLoaderFactory::Create(
+      subresource_loader_factory_bundle->CloneWithoutAppCacheFactory());
+  web_loader_factory_ = std::make_unique<Factory>(
+      resource_dispatcher_->GetWeakPtr(), loader_factory_);
+  ResetServiceWorkerURLLoaderFactory();
+}
+
 void WebWorkerFetchContextImpl::NotifyUpdate(
     blink::mojom::RendererPreferencesPtr new_prefs) {
   if (accept_languages_watcher_ &&
diff --git a/chromium/content/renderer/loader/web_worker_fetch_context_impl.h b/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
index 83da0217ef4..9569bcbb662 100644
--- a/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
+++ b/chromium/content/renderer/loader/web_worker_fetch_context_impl.h
@@ -26,6 +26,7 @@
 #include "third_party/blink/public/mojom/service_worker/service_worker_container.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
+#include "third_party/blink/public/mojom/worker/subresource_loader_updater.mojom.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_worker_fetch_context.h"
 #include "url/gurl.h"
@@ -50,6 +51,7 @@ struct NavigationResponseOverrideParameters;
 // service workers, ServiceWorkerFetchContextImpl class is used instead.
 class CONTENT_EXPORT WebWorkerFetchContextImpl
     : public blink::WebWorkerFetchContext,
+      public blink::mojom::SubresourceLoaderUpdater,
       public blink::mojom::ServiceWorkerWorkerClient,
       public blink::mojom::RendererPreferenceWatcher {
  public:
@@ -78,7 +80,9 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
           watcher_receiver,
       std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
       std::unique_ptr<network::SharedURLLoaderFactoryInfo>
-          fallback_factory_info);
+          fallback_factory_info,
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+          pending_subresource_loader_updater);
 
   // Clones this fetch context for a nested worker.
   // For non-PlzDedicatedWorker. This will be removed once PlzDedicatedWorker is
@@ -93,6 +97,8 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
       std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
       std::unique_ptr<network::SharedURLLoaderFactoryInfo>
           fallback_factory_info,
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+          pending_subresource_loader_updater,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   // blink::WebWorkerFetchContext implementation:
@@ -188,6 +194,8 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
       std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
       std::unique_ptr<network::SharedURLLoaderFactoryInfo>
           fallback_factory_info,
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+          pending_subresource_loader_updater,
       std::unique_ptr<URLLoaderThrottleProvider> throttle_provider,
       std::unique_ptr<WebSocketHandshakeThrottleProvider>
           websocket_handshake_throttle_provider,
@@ -206,6 +214,8 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
       std::unique_ptr<network::SharedURLLoaderFactoryInfo> loader_factory_info,
       std::unique_ptr<network::SharedURLLoaderFactoryInfo>
           fallback_factory_info,
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+          pending_subresource_loader_updater,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   bool Send(IPC::Message* message);
@@ -216,6 +226,11 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   // controlled by a service worker.
   void ResetServiceWorkerURLLoaderFactory();
 
+  // Implements blink::mojom::SubresourceLoaderUpdater.
+  void UpdateSubresourceLoaderFactories(
+      std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
+          subresource_loader_factories) override;
+
   // Implements blink::mojom::RendererPreferenceWatcher.
   void NotifyUpdate(blink::mojom::RendererPreferencesPtr new_prefs) override;
 
@@ -270,6 +285,18 @@ class CONTENT_EXPORT WebWorkerFetchContextImpl
   scoped_refptr<network::SharedURLLoaderFactory> fallback_factory_;
 
   // Initialized on the worker thread when InitializeOnWorkerThread() is called.
+  // Used to reconnect to the Network Service after the Network Service crash.
+  // This is only used for dedicated workers when PlzDedicatedWorker is enabled.
+  // When PlzDedicatedWorker is disabled, the ancestor render frame updates the
+  // loaders via Host/TrackedChildURLLoaderFactoryBundle. For shared workers,
+  // the renderer process detects the crash, and terminates the worker instead
+  // of recovery.
+  mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+      pending_subresource_loader_updater_;
+  mojo::Receiver<blink::mojom::SubresourceLoaderUpdater>
+      subresource_loader_updater_{this};
+
+  // Initialized on the worker thread when InitializeOnWorkerThread() is called.
   scoped_refptr<base::RefCountedData<mojo::Remote<blink::mojom::BlobRegistry>>>
       blob_registry_;
 
diff --git a/chromium/content/renderer/media/android/media_player_renderer_client.cc b/chromium/content/renderer/media/android/media_player_renderer_client.cc
index 20c61db1755..284d4065e5b 100644
--- a/chromium/content/renderer/media/android/media_player_renderer_client.cc
+++ b/chromium/content/renderer/media/android/media_player_renderer_client.cc
@@ -115,13 +115,28 @@ void MediaPlayerRendererClient::OnRemoteRendererInitialized(
     renderer_extension_ptr_->InitiateScopedSurfaceRequest(
         base::Bind(&MediaPlayerRendererClient::OnScopedSurfaceRequested,
                    weak_factory_.GetWeakPtr()));
+
+    // Signal that we're using MediaPlayer so that we can properly differentiate
+    // within our metrics.
+    media::PipelineStatistics stats;
+    stats.video_decoder_info =
+        stats.audio_decoder_info = {true, false, "MediaPlayer"};
+    client_->OnStatisticsUpdate(stats);
   }
   std::move(init_cb_).Run(status);
 }
 
 void MediaPlayerRendererClient::OnFrameAvailable() {
   DCHECK(compositor_task_runner_->BelongsToCurrentThread());
-  sink_->PaintSingleFrame(stream_texture_wrapper_->GetCurrentFrame(), true);
+
+  // The frame generated by the StreamTextureWrapper is "static", i.e., even as
+  // new frames are drawn it does not change. Downstream components expect that
+  // each new VideoFrame will have a different unique_id() when it changes, so
+  // we need to add a wrapping frame with a new unique_id().
+  auto frame = stream_texture_wrapper_->GetCurrentFrame();
+  auto unique_frame = media::VideoFrame::WrapVideoFrame(
+      frame, frame->format(), frame->visible_rect(), frame->natural_size());
+  sink_->PaintSingleFrame(std::move(unique_frame));
 }
 
 void MediaPlayerRendererClient::OnVideoSizeChange(const gfx::Size& size) {
diff --git a/chromium/content/renderer/media/android/stream_texture_factory.cc b/chromium/content/renderer/media/android/stream_texture_factory.cc
index 7743193a353..9cf99742121 100644
--- a/chromium/content/renderer/media/android/stream_texture_factory.cc
+++ b/chromium/content/renderer/media/android/stream_texture_factory.cc
@@ -21,6 +21,14 @@ void StreamTextureProxy::Release() {
   // Cannot call |received_frame_cb_| after returning from here.
   ClearReceivedFrameCB();
 
+  // |this| can be deleted by the |task_runner_| on the compositor thread by
+  // posting task to that thread. So we need to clear the |set_ycbcr_info_cb_|
+  // here first so that its not called on the compositor thread before |this| is
+  // deleted. The problem is that |set_ycbcr_info_cb_| is provided by the owner
+  // of StreamTextureProxy, which is being destroyed and is releasing
+  // StreamTextureProxy.
+  ClearSetYcbcrInfoCB();
+
   // Release is analogous to the destructor, so there should be no more external
   // calls to this object in Release. Therefore there is no need to acquire the
   // lock to access |task_runner_|.
@@ -35,8 +43,14 @@ void StreamTextureProxy::ClearReceivedFrameCB() {
   received_frame_cb_.Reset();
 }
 
+void StreamTextureProxy::ClearSetYcbcrInfoCB() {
+  base::AutoLock lock(lock_);
+  set_ycbcr_info_cb_.Reset();
+}
+
 void StreamTextureProxy::BindToTaskRunner(
     const base::RepeatingClosure& received_frame_cb,
+    SetYcbcrInfoCb set_ycbcr_info_cb,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   DCHECK(task_runner.get());
 
@@ -45,6 +59,7 @@ void StreamTextureProxy::BindToTaskRunner(
     DCHECK(!task_runner_.get() || (task_runner.get() == task_runner_.get()));
     task_runner_ = task_runner;
     received_frame_cb_ = received_frame_cb;
+    set_ycbcr_info_cb_ = std::move(set_ycbcr_info_cb);
   }
 
   if (task_runner->BelongsToCurrentThread()) {
@@ -68,6 +83,17 @@ void StreamTextureProxy::OnFrameAvailable() {
     received_frame_cb_.Run();
 }
 
+void StreamTextureProxy::OnFrameWithYcbcrInfoAvailable(
+    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+  base::AutoLock lock(lock_);
+  // Set the ycbcr info before running the received frame callback so that the
+  // first frame has it.
+  if (!set_ycbcr_info_cb_.is_null())
+    std::move(set_ycbcr_info_cb_).Run(std::move(ycbcr_info));
+  if (!received_frame_cb_.is_null())
+    received_frame_cb_.Run();
+}
+
 void StreamTextureProxy::ForwardStreamTextureForSurfaceRequest(
     const base::UnguessableToken& request_token) {
   host_->ForwardStreamTextureForSurfaceRequest(request_token);
diff --git a/chromium/content/renderer/media/android/stream_texture_factory.h b/chromium/content/renderer/media/android/stream_texture_factory.h
index 88e6e6287ad..6cd3e6122d3 100644
--- a/chromium/content/renderer/media/android/stream_texture_factory.h
+++ b/chromium/content/renderer/media/android/stream_texture_factory.h
@@ -23,6 +23,7 @@ namespace gpu {
 class GpuChannelHost;
 class SharedImageInterface;
 struct SyncToken;
+struct VulkanYCbCrInfo;
 }  // namespace gpu
 
 namespace content {
@@ -33,6 +34,9 @@ class StreamTextureFactory;
 // when a new video frame is available.
 class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
  public:
+  using SetYcbcrInfoCb =
+      base::OnceCallback<void(base::Optional<gpu::VulkanYCbCrInfo>)>;
+
   ~StreamTextureProxy() override;
 
   // Initialize and bind to |task_runner|, which becomes the thread that the
@@ -40,10 +44,13 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   // must be called with the same |task_runner| every time.
   void BindToTaskRunner(
       const base::RepeatingClosure& received_frame_cb,
+      SetYcbcrInfoCb set_ycbcr_info_cb,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
 
   // StreamTextureHost::Listener implementation:
   void OnFrameAvailable() override;
+  void OnFrameWithYcbcrInfoAvailable(
+      base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) override;
 
   // Sends an IPC to the GPU process.
   // Asks the StreamTexture to forward its SurfaceTexture to the
@@ -74,11 +81,15 @@ class CONTENT_EXPORT StreamTextureProxy : public StreamTextureHost::Listener {
   void BindOnThread();
   void Release();
 
+  // Clears |set_ycbcr_info_cb_| in a thread safe way.
+  void ClearSetYcbcrInfoCB();
+
   const std::unique_ptr<StreamTextureHost> host_;
 
   // Protects access to |received_frame_cb_| and |task_runner_|.
   base::Lock lock_;
   base::RepeatingClosure received_frame_cb_;
+  SetYcbcrInfoCb set_ycbcr_info_cb_;
   scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 
   DISALLOW_IMPLICIT_CONSTRUCTORS(StreamTextureProxy);
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
index 79fdb71dac1..26bda04938f 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.cc
@@ -5,6 +5,7 @@
 #include "content/renderer/media/android/stream_texture_wrapper_impl.h"
 
 #include "base/bind.h"
+#include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "cc/layers/video_frame_provider.h"
 #include "gpu/GLES2/gl2extchromium.h"
@@ -69,6 +70,7 @@ void StreamTextureWrapperImpl::ReallocateVideoFrame() {
               base::BindOnce(&OnReleaseVideoFrame, factory_, mailbox)),
           natural_size_, gfx::Rect(natural_size_), natural_size_,
           base::TimeDelta());
+  new_frame->set_ycbcr_info(ycbcr_info_);
 
   if (enable_texture_copy_) {
     new_frame->metadata()->SetBoolean(media::VideoFrameMetadata::COPY_REQUIRED,
@@ -95,6 +97,14 @@ void StreamTextureWrapperImpl::SetCurrentFrameInternal(
   current_frame_ = std::move(video_frame);
 }
 
+void StreamTextureWrapperImpl::SetYcbcrInfo(
+    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+  DCHECK(!ycbcr_info_);
+
+  current_frame_->set_ycbcr_info(ycbcr_info);
+  ycbcr_info_ = std::move(ycbcr_info);
+}
+
 void StreamTextureWrapperImpl::UpdateTextureSize(const gfx::Size& new_size) {
   DVLOG(2) << __func__;
 
@@ -154,8 +164,14 @@ void StreamTextureWrapperImpl::InitializeOnMainThread(
 
   ReallocateVideoFrame();
 
-  stream_texture_proxy_->BindToTaskRunner(received_frame_cb,
-                                          compositor_task_runner_);
+  // Unretained is safe here since |stream_texture_proxy_| is a scoped member of
+  // the this StreamTextureWrapperImpl class which clears/resets this callback
+  // before |this| is destroyed.
+  stream_texture_proxy_->BindToTaskRunner(
+      received_frame_cb,
+      base::BindOnce(&StreamTextureWrapperImpl::SetYcbcrInfo,
+                     base::Unretained(this)),
+      compositor_task_runner_);
 
   init_cb.Run(true);
 }
diff --git a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
index eb302e596dd..f65d03eda33 100644
--- a/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
+++ b/chromium/content/renderer/media/android/stream_texture_wrapper_impl.h
@@ -105,6 +105,12 @@ class CONTENT_EXPORT StreamTextureWrapperImpl
 
   void SetCurrentFrameInternal(scoped_refptr<media::VideoFrame> video_frame);
 
+  // Sets the ycbcr_info on the |current_frame_|. This is called before the
+  // first frame becomes available, at which point no frames are in use, so
+  // modification of the frame is safe. The same info is re-used for all future
+  // frames.
+  void SetYcbcrInfo(base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info);
+
   bool enable_texture_copy_;
 
   // Object for calling back the compositor thread to repaint the video when a
@@ -118,6 +124,7 @@ class CONTENT_EXPORT StreamTextureWrapperImpl
 
   base::Lock current_frame_lock_;
   scoped_refptr<media::VideoFrame> current_frame_;
+  base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info_;
 
   scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> compositor_task_runner_;
diff --git a/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc b/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
index c1bd877f952..4b49ebecb60 100644
--- a/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_input_ipc_factory.cc
@@ -14,6 +14,8 @@
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
 #include "content/renderer/media/audio/mojo_audio_input_ipc.h"
 #include "content/renderer/render_frame_impl.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 
@@ -24,8 +26,9 @@ namespace {
 void CreateMojoAudioInputStreamOnMainThread(
     int frame_id,
     const media::AudioSourceParameters& source_params,
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
-    audio::mojom::AudioProcessorControlsRequest controls_request,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
+    mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
+        controls_receiver,
     const media::AudioParameters& params,
     bool automatic_gain_control,
     uint32_t total_segments) {
@@ -34,7 +37,7 @@ void CreateMojoAudioInputStreamOnMainThread(
     audio::mojom::AudioProcessingConfigPtr processing_config;
     if (source_params.processing) {
       processing_config = audio::mojom::AudioProcessingConfig::New(
-          std::move(controls_request), source_params.processing->id,
+          std::move(controls_receiver), source_params.processing->id,
           source_params.processing->settings);
     }
     frame->GetAudioInputStreamFactory()->CreateStream(
@@ -47,15 +50,16 @@ void CreateMojoAudioInputStream(
     scoped_refptr<base::SequencedTaskRunner> main_task_runner,
     int frame_id,
     const media::AudioSourceParameters& source_params,
-    mojom::RendererAudioInputStreamFactoryClientPtr client,
-    audio::mojom::AudioProcessorControlsRequest controls_request,
+    mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
+    mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
+        controls_receiver,
     const media::AudioParameters& params,
     bool automatic_gain_control,
     uint32_t total_segments) {
   main_task_runner->PostTask(
       FROM_HERE, base::BindOnce(&CreateMojoAudioInputStreamOnMainThread,
                                 frame_id, source_params, std::move(client),
-                                std::move(controls_request), params,
+                                std::move(controls_receiver), params,
                                 automatic_gain_control, total_segments));
 }
 
diff --git a/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc b/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
index cff7e005d42..6fc112da547 100644
--- a/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
+++ b/chromium/content/renderer/media/audio/audio_output_ipc_factory.cc
@@ -25,7 +25,7 @@ AudioOutputIPCFactory::AudioOutputIPCFactory(
 
 AudioOutputIPCFactory::~AudioOutputIPCFactory() {
   // Allow destruction in tests.
-  DCHECK(factory_ptrs_.empty());
+  DCHECK(factory_remotes_.empty());
   DCHECK_EQ(instance_, this);
   instance_ = nullptr;
 }
@@ -42,16 +42,16 @@ AudioOutputIPCFactory::CreateAudioOutputIPC(int frame_id) const {
 void AudioOutputIPCFactory::RegisterRemoteFactory(
     int frame_id,
     service_manager::InterfaceProvider* interface_provider) {
-  mojom::RendererAudioOutputStreamFactoryPtr factory_ptr;
-  interface_provider->GetInterface(&factory_ptr);
-  // PassInterface unbinds the message pipe from the current thread. This
-  // allows us to bind it to the IO thread.
+  mojo::PendingRemote<mojom::RendererAudioOutputStreamFactory> factory_remote;
+  interface_provider->GetInterface(
+      factory_remote.InitWithNewPipeAndPassReceiver());
   // Unretained is safe due to the contract at the top of the header file.
+  // It's safe to pass the |factory_remote| PendingRemote between threads.
   io_task_runner_->PostTask(
       FROM_HERE,
       base::BindOnce(&AudioOutputIPCFactory::RegisterRemoteFactoryOnIOThread,
                      base::Unretained(this), frame_id,
-                     factory_ptr.PassInterface()));
+                     std::move(factory_remote)));
 }
 
 void AudioOutputIPCFactory::MaybeDeregisterRemoteFactory(int frame_id) {
@@ -65,17 +65,17 @@ void AudioOutputIPCFactory::MaybeDeregisterRemoteFactory(int frame_id) {
 mojom::RendererAudioOutputStreamFactory*
 AudioOutputIPCFactory::GetRemoteFactory(int frame_id) const {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
-  auto it = factory_ptrs_.find(frame_id);
-  return it == factory_ptrs_.end() ? nullptr : it->second.get();
+  auto it = factory_remotes_.find(frame_id);
+  return it == factory_remotes_.end() ? nullptr : it->second.get();
 }
 
 void AudioOutputIPCFactory::RegisterRemoteFactoryOnIOThread(
     int frame_id,
-    mojom::RendererAudioOutputStreamFactoryPtrInfo factory_ptr_info) {
+    mojo::PendingRemote<mojom::RendererAudioOutputStreamFactory>
+        factory_pending_remote) {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
   std::pair<StreamFactoryMap::iterator, bool> emplace_result =
-      factory_ptrs_.emplace(frame_id,
-                            mojo::MakeProxy(std::move(factory_ptr_info)));
+      factory_remotes_.emplace(frame_id, std::move(factory_pending_remote));
 
   DCHECK(emplace_result.second) << "Attempt to register a factory for a "
                                    "frame which already has a factory "
@@ -85,9 +85,9 @@ void AudioOutputIPCFactory::RegisterRemoteFactoryOnIOThread(
   DCHECK(emplaced_factory.is_bound())
       << "Factory is not bound to a remote implementation.";
 
-  // Unretained is safe because |this| owns the binding, so a connection error
+  // Unretained is safe because |this| owns the remote, so a connection error
   // cannot trigger after destruction.
-  emplaced_factory.set_connection_error_handler(base::BindOnce(
+  emplaced_factory.set_disconnect_handler(base::BindOnce(
       &AudioOutputIPCFactory::MaybeDeregisterRemoteFactoryOnIOThread,
       base::Unretained(this), frame_id));
 }
@@ -96,10 +96,10 @@ void AudioOutputIPCFactory::MaybeDeregisterRemoteFactoryOnIOThread(
     int frame_id) {
   DCHECK(io_task_runner_->BelongsToCurrentThread());
   // This function can be called both by the frame and the connection error
-  // handler of the factory pointer. Calling erase multiple times even though
+  // handler of the factory remote. Calling erase multiple times even though
   // there is nothing to erase is safe, so we don't have to handle this in any
   // particular way.
-  factory_ptrs_.erase(frame_id);
+  factory_remotes_.erase(frame_id);
 }
 
 }  // namespace content
diff --git a/chromium/content/renderer/media/audio/audio_output_ipc_factory.h b/chromium/content/renderer/media/audio/audio_output_ipc_factory.h
index 0f87cfdd9b0..a19ea1a75ee 100644
--- a/chromium/content/renderer/media/audio/audio_output_ipc_factory.h
+++ b/chromium/content/renderer/media/audio/audio_output_ipc_factory.h
@@ -11,6 +11,8 @@
 #include "base/memory/ref_counted.h"
 #include "content/common/content_export.h"
 #include "content/common/media/renderer_audio_output_stream_factory.mojom.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace base {
 class SingleThreadTaskRunner;
@@ -63,13 +65,15 @@ class CONTENT_EXPORT AudioOutputIPCFactory {
 
  private:
   using StreamFactoryMap =
-      base::flat_map<int, mojom::RendererAudioOutputStreamFactoryPtr>;
+      base::flat_map<int,
+                     mojo::Remote<mojom::RendererAudioOutputStreamFactory>>;
 
   mojom::RendererAudioOutputStreamFactory* GetRemoteFactory(int frame_id) const;
 
   void RegisterRemoteFactoryOnIOThread(
       int frame_id,
-      mojom::RendererAudioOutputStreamFactoryPtrInfo factory_ptr_info);
+      mojo::PendingRemote<mojom::RendererAudioOutputStreamFactory>
+          factory_pending_remote);
 
   void MaybeDeregisterRemoteFactoryOnIOThread(int frame_id);
 
@@ -77,7 +81,7 @@ class CONTENT_EXPORT AudioOutputIPCFactory {
   bool UsingMojoFactories() const;
 
   // Maps frame id to the corresponding factory.
-  StreamFactoryMap factory_ptrs_;
+  StreamFactoryMap factory_remotes_;
 
   const scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
 
diff --git a/chromium/content/renderer/media/audio/audio_output_ipc_factory_unittest.cc b/chromium/content/renderer/media/audio/audio_output_ipc_factory_unittest.cc
index 4c561f40803..d203e2ac7e2 100644
--- a/chromium/content/renderer/media/audio/audio_output_ipc_factory_unittest.cc
+++ b/chromium/content/renderer/media/audio/audio_output_ipc_factory_unittest.cc
@@ -14,8 +14,9 @@
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
 #include "media/audio/audio_output_ipc.h"
-#include "mojo/public/cpp/bindings/binding.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -38,11 +39,12 @@ std::unique_ptr<base::Thread> MakeIOThread() {
 
 class FakeRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
  public:
-  FakeRemoteFactory() : binding_(this) {}
+  FakeRemoteFactory() = default;
   ~FakeRemoteFactory() override {}
 
   void RequestDeviceAuthorization(
-      media::mojom::AudioOutputStreamProviderRequest stream_provider,
+      mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+          stream_provider,
       const base::Optional<base::UnguessableToken>& session_id,
       const std::string& device_id,
       RequestDeviceAuthorizationCallback callback) override {
@@ -58,14 +60,14 @@ class FakeRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
   }
 
   void Bind(mojo::ScopedMessagePipeHandle handle) {
-    EXPECT_FALSE(binding_.is_bound());
-    binding_.Bind(
+    EXPECT_FALSE(receiver_.is_bound());
+    receiver_.Bind(
         mojo::InterfaceRequest<mojom::RendererAudioOutputStreamFactory>(
             std::move(handle)));
   }
 
  private:
-  mojo::Binding<mojom::RendererAudioOutputStreamFactory> binding_;
+  mojo::Receiver<mojom::RendererAudioOutputStreamFactory> receiver_{this};
   base::OnceClosure on_called_;
 };
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
index b61dc6fdf55..22398430991 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.cc
@@ -22,8 +22,7 @@ MojoAudioInputIPC::MojoAudioInputIPC(
     : source_params_(source_params),
       stream_creator_(std::move(stream_creator)),
       stream_associator_(std::move(stream_associator)),
-      stream_client_binding_(this),
-      factory_client_binding_(this) {
+      stream_client_binding_(this) {
   DETACH_FROM_SEQUENCE(sequence_checker_);
   DCHECK(stream_creator_);
   DCHECK(stream_associator_);
@@ -41,17 +40,17 @@ void MojoAudioInputIPC::CreateStream(media::AudioInputIPCDelegate* delegate,
 
   delegate_ = delegate;
 
-  mojom::RendererAudioInputStreamFactoryClientPtr client;
-  factory_client_binding_.Bind(mojo::MakeRequest(&client));
-  factory_client_binding_.set_connection_error_handler(base::BindOnce(
+  mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client;
+  factory_client_receiver_.Bind(client.InitWithNewPipeAndPassReceiver());
+  factory_client_receiver_.set_disconnect_handler(base::BindOnce(
       &media::AudioInputIPCDelegate::OnError, base::Unretained(delegate_)));
 
   stream_creation_start_time_ = base::TimeTicks::Now();
-  audio::mojom::AudioProcessorControlsRequest controls_request;
+  mojo::PendingReceiver<audio::mojom::AudioProcessorControls> controls_receiver;
   if (source_params_.processing.has_value())
-    controls_request = mojo::MakeRequest(&processor_controls_);
+    controls_receiver = processor_controls_.BindNewPipeAndPassReceiver();
   stream_creator_.Run(source_params_, std::move(client),
-                      std::move(controls_request), params,
+                      std::move(controls_receiver), params,
                       automatic_gain_control, total_segments);
 }
 
@@ -83,8 +82,8 @@ media::AudioProcessorControls* MojoAudioInputIPC::GetProcessorControls() {
 void MojoAudioInputIPC::CloseStream() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   delegate_ = nullptr;
-  if (factory_client_binding_.is_bound())
-    factory_client_binding_.Unbind();
+  if (factory_client_receiver_.is_bound())
+    factory_client_receiver_.reset();
   if (stream_client_binding_.is_bound())
     stream_client_binding_.Unbind();
   stream_.reset();
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
index a95865b966c..e72643b1946 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc.h
@@ -19,6 +19,10 @@
 #include "media/mojo/mojom/audio_input_stream.mojom.h"
 #include "media/webrtc/audio_processor_controls.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "services/audio/public/mojom/audio_processing.mojom.h"
 
 namespace content {
@@ -37,8 +41,9 @@ class CONTENT_EXPORT MojoAudioInputIPC
   // called or |client| is destructed.
   using StreamCreatorCB = base::RepeatingCallback<void(
       const media::AudioSourceParameters& source_params,
-      mojom::RendererAudioInputStreamFactoryClientPtr client,
-      audio::mojom::AudioProcessorControlsRequest controls_request,
+      mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient> client,
+      mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
+          controls_receiver,
       const media::AudioParameters& params,
       bool automatic_gain_control,
       uint32_t total_segments)>;
@@ -87,11 +92,12 @@ class CONTENT_EXPORT MojoAudioInputIPC
   StreamAssociatorCB stream_associator_;
 
   media::mojom::AudioInputStreamPtr stream_;
-  audio::mojom::AudioProcessorControlsPtr processor_controls_;
+  mojo::Remote<audio::mojom::AudioProcessorControls> processor_controls_;
   // Initialized on StreamCreated.
   base::Optional<base::UnguessableToken> stream_id_;
   mojo::Binding<AudioInputStreamClient> stream_client_binding_;
-  mojo::Binding<RendererAudioInputStreamFactoryClient> factory_client_binding_;
+  mojo::Receiver<RendererAudioInputStreamFactoryClient>
+      factory_client_receiver_{this};
   media::AudioInputIPCDelegate* delegate_ = nullptr;
 
   base::TimeTicks stream_creation_start_time_;
diff --git a/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc b/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
index e225d9835c8..ae3a58d088e 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_input_ipc_unittest.cc
@@ -18,6 +18,9 @@
 #include "media/base/audio_parameters.h"
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/buffer.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -79,15 +82,18 @@ class FakeStreamCreator {
       : stream_(stream), binding_(stream_), initially_muted_(initially_muted) {}
 
   void Create(const media::AudioSourceParameters& source_params,
-              mojom::RendererAudioInputStreamFactoryClientPtr factory_client,
-              audio::mojom::AudioProcessorControlsRequest controls_request,
+              mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+                  factory_client,
+              mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
+                  controls_receiver,
               const media::AudioParameters& params,
               bool automatic_gain_control,
               uint32_t total_segments) {
     EXPECT_FALSE(binding_.is_bound());
     EXPECT_NE(stream_, nullptr);
     EXPECT_EQ(source_params.session_id, SourceParams().session_id);
-    std::swap(factory_client_, factory_client);
+    factory_client_.reset();
+    factory_client_.Bind(std::move(factory_client));
     media::mojom::AudioInputStreamPtr stream_ptr;
     binding_.Bind(mojo::MakeRequest(&stream_ptr));
     base::CancelableSyncSocket foreign_socket;
@@ -120,7 +126,7 @@ class FakeStreamCreator {
  private:
   media::mojom::AudioInputStream* stream_;
   media::mojom::AudioInputStreamClientPtr stream_client_;
-  mojom::RendererAudioInputStreamFactoryClientPtr factory_client_;
+  mojo::Remote<mojom::RendererAudioInputStreamFactoryClient> factory_client_;
   mojo::Binding<media::mojom::AudioInputStream> binding_;
   bool initially_muted_;
   base::CancelableSyncSocket socket_;
@@ -160,16 +166,18 @@ TEST(MojoAudioInputIPC, FactoryDisconnected_SendsError) {
       base::test::SingleThreadTaskEnvironment::MainThreadType::IO);
   StrictMock<MockDelegate> delegate;
 
-  const std::unique_ptr<media::AudioInputIPC> ipc =
-      std::make_unique<MojoAudioInputIPC>(
-          SourceParams(),
-          base::BindRepeating(
-              [](const media::AudioSourceParameters&,
-                 mojom::RendererAudioInputStreamFactoryClientPtr factory_client,
-                 audio::mojom::AudioProcessorControlsRequest controls_request,
-                 const media::AudioParameters& params,
-                 bool automatic_gain_control, uint32_t total_segments) {}),
-          base::BindRepeating(&AssociateOutputForAec));
+  const std::unique_ptr<media::AudioInputIPC> ipc = std::make_unique<
+      MojoAudioInputIPC>(
+      SourceParams(),
+      base::BindRepeating(
+          [](const media::AudioSourceParameters&,
+             mojo::PendingRemote<mojom::RendererAudioInputStreamFactoryClient>
+                 factory_client,
+             mojo::PendingReceiver<audio::mojom::AudioProcessorControls>
+                 controls_receiver,
+             const media::AudioParameters& params, bool automatic_gain_control,
+             uint32_t total_segments) {}),
+      base::BindRepeating(&AssociateOutputForAec));
 
   EXPECT_CALL(delegate, OnError());
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
index bb9224a1a72..715a530594d 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.cc
@@ -27,7 +27,6 @@ MojoAudioOutputIPC::MojoAudioOutputIPC(
     FactoryAccessorCB factory_accessor,
     scoped_refptr<base::SingleThreadTaskRunner> io_task_runner)
     : factory_accessor_(std::move(factory_accessor)),
-      binding_(this),
       io_task_runner_(std::move(io_task_runner)) {}
 
 MojoAudioOutputIPC::~MojoAudioOutputIPC() {
@@ -82,16 +81,17 @@ void MojoAudioOutputIPC::CreateStream(
   }
 
   DCHECK_EQ(delegate_, delegate);
-  // Since the creation callback won't fire if the provider binding is gone
+  // Since the creation callback won't fire if the provider receiver is gone
   // and |this| owns |stream_provider_|, unretained is safe.
   stream_creation_start_time_ = base::TimeTicks::Now();
-  media::mojom::AudioOutputStreamProviderClientPtr client_ptr;
-  binding_.Bind(mojo::MakeRequest(&client_ptr));
-  // Unretained is safe because |this| owns |binding_|.
-  binding_.set_connection_error_with_reason_handler(
+  mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+      client_remote;
+  receiver_.Bind(client_remote.InitWithNewPipeAndPassReceiver());
+  // Unretained is safe because |this| owns |receiver_|.
+  receiver_.set_disconnect_with_reason_handler(
       base::BindOnce(&MojoAudioOutputIPC::ProviderClientBindingDisconnected,
                      base::Unretained(this)));
-  stream_provider_->Acquire(params, std::move(client_ptr), processing_id);
+  stream_provider_->Acquire(params, std::move(client_remote), processing_id);
 }
 
 void MojoAudioOutputIPC::PlayStream() {
@@ -118,7 +118,7 @@ void MojoAudioOutputIPC::CloseStream() {
   DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   stream_provider_.reset();
   stream_.reset();
-  binding_.Close();
+  receiver_.reset();
   delegate_ = nullptr;
   expected_state_ = kPaused;
   volume_ = base::nullopt;
@@ -155,15 +155,13 @@ bool MojoAudioOutputIPC::AuthorizationRequested() const {
 }
 
 bool MojoAudioOutputIPC::StreamCreationRequested() const {
-  return binding_.is_bound();
+  return receiver_.is_bound();
 }
 
-media::mojom::AudioOutputStreamProviderRequest
-MojoAudioOutputIPC::MakeProviderRequest() {
+mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+MojoAudioOutputIPC::MakeProviderReceiver() {
   DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(!AuthorizationRequested());
-  media::mojom::AudioOutputStreamProviderRequest request =
-      mojo::MakeRequest(&stream_provider_);
 
   // Don't set a connection error handler.
   // There are three possible reasons for a connection error.
@@ -176,7 +174,7 @@ MojoAudioOutputIPC::MakeProviderRequest() {
   // 3. The connection was broken after authorization succeeded. This is because
   //    of the frame owning this stream being destructed, and this object will
   //    be cleaned up soon.
-  return request;
+  return stream_provider_.BindNewPipeAndPassReceiver();
 }
 
 void MojoAudioOutputIPC::DoRequestDeviceAuthorization(
@@ -188,8 +186,8 @@ void MojoAudioOutputIPC::DoRequestDeviceAuthorization(
   if (!factory) {
     LOG(ERROR) << "MojoAudioOutputIPC failed to acquire factory";
 
-    // Create a provider request for consistency with the normal case.
-    MakeProviderRequest();
+    // Create a provider receiver for consistency with the normal case.
+    MakeProviderReceiver();
     // Resetting the callback asynchronously ensures consistent behaviour with
     // when the factory is destroyed before reply, i.e. calling
     // OnDeviceAuthorized with ERROR_INTERNAL in the normal case.
@@ -203,7 +201,7 @@ void MojoAudioOutputIPC::DoRequestDeviceAuthorization(
   static_assert(sizeof(int) == sizeof(int32_t),
                 "sizeof(int) == sizeof(int32_t)");
   factory->RequestDeviceAuthorization(
-      MakeProviderRequest(),
+      MakeProviderReceiver(),
       session_id.is_empty() ? base::Optional<base::UnguessableToken>()
                             : session_id,
       device_id, std::move(callback));
@@ -228,14 +226,15 @@ void MojoAudioOutputIPC::ReceivedDeviceAuthorization(
 }
 
 void MojoAudioOutputIPC::Created(
-    media::mojom::AudioOutputStreamPtr stream,
+    mojo::PendingRemote<media::mojom::AudioOutputStream> pending_stream,
     media::mojom::ReadWriteAudioDataPipePtr data_pipe) {
   DCHECK(io_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(delegate_);
 
   UMA_HISTOGRAM_TIMES("Media.Audio.Render.OutputDeviceStreamCreationTime",
                       base::TimeTicks::Now() - stream_creation_start_time_);
-  stream_ = std::move(stream);
+  stream_.reset();
+  stream_.Bind(std::move(pending_stream));
 
   base::PlatformFile socket_handle;
   auto result =
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
index cc1ec182f53..6a957c553f4 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc.h
@@ -18,7 +18,10 @@
 #include "media/audio/audio_output_ipc.h"
 #include "media/mojo/mojom/audio_data_pipe.mojom.h"
 #include "media/mojo/mojom/audio_output_stream.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace content {
 
@@ -55,7 +58,7 @@ class CONTENT_EXPORT MojoAudioOutputIPC
   void SetVolume(double volume) override;
 
   // media::mojom::AudioOutputStreamProviderClient implementation.
-  void Created(media::mojom::AudioOutputStreamPtr stream,
+  void Created(mojo::PendingRemote<media::mojom::AudioOutputStream> stream,
                media::mojom::ReadWriteAudioDataPipePtr data_pipe) override;
 
  private:
@@ -70,7 +73,8 @@ class CONTENT_EXPORT MojoAudioOutputIPC
   void ProviderClientBindingDisconnected(uint32_t disconnect_reason,
                                          const std::string& description);
 
-  media::mojom::AudioOutputStreamProviderRequest MakeProviderRequest();
+  mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+  MakeProviderReceiver();
 
   // Tries to acquire a RendererAudioOutputStreamFactory and requests device
   // authorization. On failure to aquire a factory, |callback| is destructed
@@ -91,9 +95,9 @@ class CONTENT_EXPORT MojoAudioOutputIPC
   enum { kPaused, kPlaying } expected_state_ = kPaused;
   base::Optional<double> volume_;
 
-  mojo::Binding<media::mojom::AudioOutputStreamProviderClient> binding_;
-  media::mojom::AudioOutputStreamProviderPtr stream_provider_;
-  media::mojom::AudioOutputStreamPtr stream_;
+  mojo::Receiver<media::mojom::AudioOutputStreamProviderClient> receiver_{this};
+  mojo::Remote<media::mojom::AudioOutputStreamProvider> stream_provider_;
+  mojo::Remote<media::mojom::AudioOutputStream> stream_;
   media::AudioOutputIPCDelegate* delegate_ = nullptr;
   scoped_refptr<base::SingleThreadTaskRunner> io_task_runner_;
 
diff --git a/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc b/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
index bf402aa52a5..87d2aa317c3 100644
--- a/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
+++ b/chromium/content/renderer/media/audio/mojo_audio_output_ipc_unittest.cc
@@ -16,7 +16,10 @@
 #include "base/test/task_environment.h"
 #include "media/audio/audio_device_description.h"
 #include "media/base/audio_parameters.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/platform_handle.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -54,23 +57,26 @@ class TestStreamProvider : public media::mojom::AudioOutputStreamProvider {
   ~TestStreamProvider() override {
     // If we expected a stream to be acquired, make sure it is so.
     if (stream_)
-      EXPECT_TRUE(binding_);
+      EXPECT_TRUE(receiver_);
   }
 
   void Acquire(
       const media::AudioParameters& params,
-      media::mojom::AudioOutputStreamProviderClientPtr provider_client,
+      mojo::PendingRemote<media::mojom::AudioOutputStreamProviderClient>
+          pending_provider_client,
       const base::Optional<base::UnguessableToken>& processing_id) override {
-    EXPECT_EQ(binding_, base::nullopt);
+    EXPECT_EQ(receiver_, base::nullopt);
     EXPECT_NE(stream_, nullptr);
-    std::swap(provider_client, provider_client_);
-    media::mojom::AudioOutputStreamPtr stream_ptr;
-    binding_.emplace(stream_, mojo::MakeRequest(&stream_ptr));
+    provider_client_.reset();
+    provider_client_.Bind(std::move(pending_provider_client));
+    mojo::PendingRemote<media::mojom::AudioOutputStream> stream_pending_remote;
+    receiver_.emplace(stream_,
+                      stream_pending_remote.InitWithNewPipeAndPassReceiver());
     base::CancelableSyncSocket foreign_socket;
     EXPECT_TRUE(
         base::CancelableSyncSocket::CreatePair(&socket_, &foreign_socket));
     provider_client_->Created(
-        std::move(stream_ptr),
+        std::move(stream_pending_remote),
         {base::in_place, base::UnsafeSharedMemoryRegion::Create(kMemoryLength),
          mojo::WrapPlatformFile(foreign_socket.Release())});
   }
@@ -84,8 +90,8 @@ class TestStreamProvider : public media::mojom::AudioOutputStreamProvider {
 
  private:
   media::mojom::AudioOutputStream* stream_;
-  media::mojom::AudioOutputStreamProviderClientPtr provider_client_;
-  base::Optional<mojo::Binding<media::mojom::AudioOutputStream>> binding_;
+  mojo::Remote<media::mojom::AudioOutputStreamProviderClient> provider_client_;
+  base::Optional<mojo::Receiver<media::mojom::AudioOutputStream>> receiver_;
   base::CancelableSyncSocket socket_;
 };
 
@@ -93,12 +99,13 @@ class TestRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
  public:
   TestRemoteFactory()
       : expect_request_(false),
-        binding_(this, mojo::MakeRequest(&this_proxy_)) {}
+        receiver_(this, this_remote_.BindNewPipeAndPassReceiver()) {}
 
   ~TestRemoteFactory() override {}
 
   void RequestDeviceAuthorization(
-      media::mojom::AudioOutputStreamProviderRequest stream_provider_request,
+      mojo::PendingReceiver<media::mojom::AudioOutputStreamProvider>
+          stream_provider_receiver,
       const base::Optional<base::UnguessableToken>& session_id,
       const std::string& device_id,
       RequestDeviceAuthorizationCallback callback) override {
@@ -109,8 +116,8 @@ class TestRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
       std::move(callback).Run(
           media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_OK, Params(),
           std::string(kReturnedDeviceId));
-      provider_binding_.emplace(provider_.get(),
-                                std::move(stream_provider_request));
+      provider_receiver_.emplace(provider_.get(),
+                                 std::move(stream_provider_receiver));
     } else {
       std::move(callback).Run(
           media::OutputDeviceStatus::OUTPUT_DEVICE_STATUS_ERROR_NOT_AUTHORIZED,
@@ -129,7 +136,7 @@ class TestRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
                                ? base::Optional<base::UnguessableToken>()
                                : session_id;
     expected_device_id_ = device_id;
-    provider_binding_.reset();
+    provider_receiver_.reset();
     std::swap(provider_, provider);
   }
 
@@ -146,10 +153,10 @@ class TestRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
   }
 
   void Disconnect() {
-    binding_.Close();
-    this_proxy_.reset();
-    binding_.Bind(mojo::MakeRequest(&this_proxy_));
-    provider_binding_.reset();
+    receiver_.reset();
+    this_remote_.reset();
+    receiver_.Bind(this_remote_.BindNewPipeAndPassReceiver());
+    provider_receiver_.reset();
     provider_.reset();
     expect_request_ = false;
   }
@@ -159,17 +166,17 @@ class TestRemoteFactory : public mojom::RendererAudioOutputStreamFactory {
   }
 
  private:
-  mojom::RendererAudioOutputStreamFactory* get() { return this_proxy_.get(); }
+  mojom::RendererAudioOutputStreamFactory* get() { return this_remote_.get(); }
 
   bool expect_request_;
   base::Optional<base::UnguessableToken> expected_session_id_;
   std::string expected_device_id_;
 
-  mojom::RendererAudioOutputStreamFactoryPtr this_proxy_;
-  mojo::Binding<mojom::RendererAudioOutputStreamFactory> binding_;
+  mojo::Remote<mojom::RendererAudioOutputStreamFactory> this_remote_;
+  mojo::Receiver<mojom::RendererAudioOutputStreamFactory> receiver_{this};
   std::unique_ptr<TestStreamProvider> provider_;
-  base::Optional<mojo::Binding<media::mojom::AudioOutputStreamProvider>>
-      provider_binding_;
+  base::Optional<mojo::Receiver<media::mojom::AudioOutputStreamProvider>>
+      provider_receiver_;
 };
 
 class MockStream : public media::mojom::AudioOutputStream {
diff --git a/chromium/content/renderer/media/inspector_media_event_handler.cc b/chromium/content/renderer/media/inspector_media_event_handler.cc
index 700146cd6d1..504b278b4bb 100644
--- a/chromium/content/renderer/media/inspector_media_event_handler.cc
+++ b/chromium/content/renderer/media/inspector_media_event_handler.cc
@@ -54,6 +54,14 @@ void InspectorMediaEventHandler::SendQueuedMediaEvents(
           event.type == media::MediaLogEvent::MEDIA_DEBUG_LOG_ENTRY) {
         event_type = blink::InspectorPlayerEvent::MESSAGE_EVENT;
       }
+      if (event.params.size() == 0) {
+        blink::InspectorPlayerEvent ev = {
+            blink::InspectorPlayerEvent::PLAYBACK_EVENT, event.time,
+            blink::WebString::FromUTF8("Event"),
+            blink::WebString::FromUTF8(
+                media::MediaLog::EventTypeToString(event.type))};
+        events.emplace_back(ev);
+      }
       for (auto&& itr : event.params.DictItems()) {
         blink::InspectorPlayerEvent ev = {event_type, event.time,
                                           blink::WebString::FromUTF8(itr.first),
diff --git a/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc b/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
index 2564f990ed5..fbcdbeeeb1d 100644
--- a/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
+++ b/chromium/content/renderer/media/inspector_media_event_handler_unittest.cc
@@ -203,4 +203,26 @@ TEST_F(InspectorMediaEventHandlerTest, ConvertsEventsAndProperties) {
   handler_->SendQueuedMediaEvents(events);
 }
 
+TEST_F(InspectorMediaEventHandlerTest, PassesPlayAndPauseEvents) {
+  std::vector<media::MediaLogEvent> events = {
+      CreateEvent(media::MediaLogEvent::PLAY),
+      CreateEvent(media::MediaLogEvent::PAUSE)};
+
+  blink::InspectorPlayerEvents expected_events;
+  blink::InspectorPlayerEvent play = {
+      blink::InspectorPlayerEvent::PLAYBACK_EVENT, base::TimeTicks(),
+      blink::WebString::FromUTF8("Event"), blink::WebString::FromUTF8("PLAY")};
+  blink::InspectorPlayerEvent pause = {
+      blink::InspectorPlayerEvent::PLAYBACK_EVENT, base::TimeTicks(),
+      blink::WebString::FromUTF8("Event"), blink::WebString::FromUTF8("PAUSE")};
+  expected_events.emplace_back(play);
+  expected_events.emplace_back(pause);
+
+  EXPECT_CALL(*mock_context_,
+              MockNotifyPlayerEvents(EventsEqualTo(expected_events)))
+      .Times(1);
+
+  handler_->SendQueuedMediaEvents(events);
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/media/media_factory.cc b/chromium/content/renderer/media/media_factory.cc
index e992e3c4c54..b50e43f44f7 100644
--- a/chromium/content/renderer/media/media_factory.cc
+++ b/chromium/content/renderer/media/media_factory.cc
@@ -72,7 +72,7 @@
 #endif
 
 #if defined(OS_FUCHSIA)
-#include "media/fuchsia/cdm/fuchsia_cdm_factory.h"
+#include "media/fuchsia/cdm/client/fuchsia_cdm_util.h"
 #elif BUILDFLAG(ENABLE_MOJO_CDM)
 #include "media/mojo/clients/mojo_cdm_factory.h"  // nogncheck
 #else
@@ -650,7 +650,7 @@ media::CdmFactory* MediaFactory::GetCdmFactory() {
     return cdm_factory_.get();
 
 #if defined(OS_FUCHSIA)
-  cdm_factory_ = std::make_unique<media::FuchsiaCdmFactory>(remote_interfaces_);
+  cdm_factory_ = media::CreateFuchsiaCdmFactory(remote_interfaces_);
 #elif BUILDFLAG(ENABLE_MOJO_CDM)
   cdm_factory_ =
       std::make_unique<media::MojoCdmFactory>(GetMediaInterfaceFactory());
diff --git a/chromium/content/renderer/media/media_interface_factory.cc b/chromium/content/renderer/media/media_interface_factory.cc
index 0c7f656e31e..db4ab4499bf 100644
--- a/chromium/content/renderer/media/media_interface_factory.cc
+++ b/chromium/content/renderer/media/media_interface_factory.cc
@@ -27,16 +27,16 @@ MediaInterfaceFactory::~MediaInterfaceFactory() {
 }
 
 void MediaInterfaceFactory::CreateAudioDecoder(
-    media::mojom::AudioDecoderRequest request) {
+    mojo::PendingReceiver<media::mojom::AudioDecoder> receiver) {
   if (!task_runner_->BelongsToCurrentThread()) {
     task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&MediaInterfaceFactory::CreateAudioDecoder,
-                                  weak_this_, std::move(request)));
+                                  weak_this_, std::move(receiver)));
     return;
   }
 
   DVLOG(1) << __func__;
-  GetMediaInterfaceFactory()->CreateAudioDecoder(std::move(request));
+  GetMediaInterfaceFactory()->CreateAudioDecoder(std::move(receiver));
 }
 
 void MediaInterfaceFactory::CreateVideoDecoder(
@@ -143,21 +143,21 @@ void MediaInterfaceFactory::CreateCdm(
 
 void MediaInterfaceFactory::CreateDecryptor(
     int cdm_id,
-    media::mojom::DecryptorRequest request) {
+    mojo::PendingReceiver<media::mojom::Decryptor> receiver) {
   if (!task_runner_->BelongsToCurrentThread()) {
     task_runner_->PostTask(
         FROM_HERE, base::BindOnce(&MediaInterfaceFactory::CreateDecryptor,
-                                  weak_this_, cdm_id, std::move(request)));
+                                  weak_this_, cdm_id, std::move(receiver)));
     return;
   }
 
   DVLOG(1) << __func__;
-  GetMediaInterfaceFactory()->CreateDecryptor(cdm_id, std::move(request));
+  GetMediaInterfaceFactory()->CreateDecryptor(cdm_id, std::move(receiver));
 }
 
 void MediaInterfaceFactory::CreateCdmProxy(
     const base::Token& cdm_guid,
-    media::mojom::CdmProxyRequest request) {
+    mojo::PendingReceiver<media::mojom::CdmProxy> receiver) {
   NOTREACHED() << "CdmProxy should only be connected from a library CDM";
 }
 
diff --git a/chromium/content/renderer/media/media_interface_factory.h b/chromium/content/renderer/media/media_interface_factory.h
index ecf0f89f0d2..45a5460b76a 100644
--- a/chromium/content/renderer/media/media_interface_factory.h
+++ b/chromium/content/renderer/media/media_interface_factory.h
@@ -14,6 +14,7 @@
 #include "content/common/content_export.h"
 #include "media/mojo/buildflags.h"
 #include "media/mojo/mojom/interface_factory.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "url/gurl.h"
 
 namespace service_manager {
@@ -33,7 +34,8 @@ class CONTENT_EXPORT MediaInterfaceFactory
   ~MediaInterfaceFactory() final;
 
   // media::mojom::InterfaceFactory implementation.
-  void CreateAudioDecoder(media::mojom::AudioDecoderRequest request) final;
+  void CreateAudioDecoder(
+      mojo::PendingReceiver<media::mojom::AudioDecoder> receiver) final;
   void CreateVideoDecoder(media::mojom::VideoDecoderRequest request) final;
   void CreateDefaultRenderer(const std::string& audio_device_id,
                              media::mojom::RendererRequest request) final;
@@ -54,11 +56,13 @@ class CONTENT_EXPORT MediaInterfaceFactory
 #endif  // defined(OS_ANDROID)
   void CreateCdm(const std::string& key_system,
                  media::mojom::ContentDecryptionModuleRequest request) final;
-  void CreateDecryptor(int cdm_id,
-                       media::mojom::DecryptorRequest request) final;
+  void CreateDecryptor(
+      int cdm_id,
+      mojo::PendingReceiver<media::mojom::Decryptor> receiver) final;
   // TODO(xhwang): We should not expose this here.
-  void CreateCdmProxy(const base::Token& cdm_guid,
-                      media::mojom::CdmProxyRequest request) final;
+  void CreateCdmProxy(
+      const base::Token& cdm_guid,
+      mojo::PendingReceiver<media::mojom::CdmProxy> receiver) final;
 
  private:
   media::mojom::InterfaceFactory* GetMediaInterfaceFactory();
diff --git a/chromium/content/renderer/media/media_permission_dispatcher.cc b/chromium/content/renderer/media/media_permission_dispatcher.cc
index 44bc50b654a..cc75adba2d5 100644
--- a/chromium/content/renderer/media/media_permission_dispatcher.cc
+++ b/chromium/content/renderer/media/media_permission_dispatcher.cc
@@ -130,7 +130,7 @@ uint32_t MediaPermissionDispatcher::RegisterCallback(
 blink::mojom::PermissionService*
 MediaPermissionDispatcher::GetPermissionService() {
   if (!permission_service_) {
-    render_frame_->GetRemoteInterfaces()->GetInterface(
+    render_frame_->GetBrowserInterfaceBroker()->GetInterface(
         permission_service_.BindNewPipeAndPassReceiver());
     permission_service_.set_disconnect_handler(base::BindOnce(
         &MediaPermissionDispatcher::OnConnectionError, base::Unretained(this)));
diff --git a/chromium/content/renderer/media/webrtc/fake_rtc_rtp_transceiver.cc b/chromium/content/renderer/media/webrtc/fake_rtc_rtp_transceiver.cc
deleted file mode 100644
index 1c5cf82df66..00000000000
--- a/chromium/content/renderer/media/webrtc/fake_rtc_rtp_transceiver.cc
+++ /dev/null
@@ -1,252 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include <utility>
-
-#include "content/renderer/media/webrtc/fake_rtc_rtp_transceiver.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
-
-namespace content {
-
-blink::WebMediaStreamTrack CreateWebMediaStreamTrack(
-    const std::string& id,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  blink::WebMediaStreamSource web_source;
-  web_source.Initialize(blink::WebString::FromUTF8(id),
-                        blink::WebMediaStreamSource::kTypeAudio,
-                        blink::WebString::FromUTF8("audio_track"), false);
-  std::unique_ptr<blink::MediaStreamAudioSource> audio_source_ptr =
-      std::make_unique<blink::MediaStreamAudioSource>(
-          std::move(task_runner), true /* is_local_source */);
-  blink::MediaStreamAudioSource* audio_source = audio_source_ptr.get();
-  // Takes ownership of |audio_source_ptr|.
-  web_source.SetPlatformSource(std::move(audio_source_ptr));
-
-  blink::WebMediaStreamTrack web_track;
-  web_track.Initialize(web_source.Id(), web_source);
-  audio_source->ConnectToTrack(web_track);
-  return web_track;
-}
-
-FakeRTCRtpSender::FakeRTCRtpSender(
-    base::Optional<std::string> track_id,
-    std::vector<std::string> stream_ids,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : track_id_(std::move(track_id)),
-      stream_ids_(std::move(stream_ids)),
-      task_runner_(task_runner) {}
-
-FakeRTCRtpSender::FakeRTCRtpSender(const FakeRTCRtpSender&) = default;
-
-FakeRTCRtpSender::~FakeRTCRtpSender() {}
-
-FakeRTCRtpSender& FakeRTCRtpSender::operator=(const FakeRTCRtpSender&) =
-    default;
-
-std::unique_ptr<blink::WebRTCRtpSender> FakeRTCRtpSender::ShallowCopy() const {
-  return std::make_unique<FakeRTCRtpSender>(*this);
-}
-
-uintptr_t FakeRTCRtpSender::Id() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-FakeRTCRtpSender::DtlsTransport() {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-webrtc::DtlsTransportInformation FakeRTCRtpSender::DtlsTransportInformation() {
-  NOTIMPLEMENTED();
-  static webrtc::DtlsTransportInformation dummy(
-      webrtc::DtlsTransportState::kNew);
-  return dummy;
-}
-
-blink::WebMediaStreamTrack FakeRTCRtpSender::Track() const {
-  return track_id_ ? CreateWebMediaStreamTrack(*track_id_, task_runner_)
-                   : blink::WebMediaStreamTrack();  // null
-}
-
-blink::WebVector<blink::WebString> FakeRTCRtpSender::StreamIds() const {
-  blink::WebVector<blink::WebString> web_stream_ids(stream_ids_.size());
-  for (size_t i = 0; i < stream_ids_.size(); ++i) {
-    web_stream_ids[i] = blink::WebString::FromUTF8(stream_ids_[i]);
-  }
-  return web_stream_ids;
-}
-
-void FakeRTCRtpSender::ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                                    blink::WebRTCVoidRequest request) {
-  NOTIMPLEMENTED();
-}
-
-std::unique_ptr<blink::WebRTCDTMFSenderHandler>
-FakeRTCRtpSender::GetDtmfSender() const {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-std::unique_ptr<webrtc::RtpParameters> FakeRTCRtpSender::GetParameters() const {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-void FakeRTCRtpSender::SetParameters(
-    blink::WebVector<webrtc::RtpEncodingParameters>,
-    webrtc::DegradationPreference,
-    blink::WebRTCVoidRequest) {
-  NOTIMPLEMENTED();
-}
-
-void FakeRTCRtpSender::GetStats(
-    blink::WebRTCStatsReportCallback,
-    const blink::WebVector<webrtc::NonStandardGroupId>&) {
-  NOTIMPLEMENTED();
-}
-
-void FakeRTCRtpSender::SetStreams(
-    const blink::WebVector<blink::WebString>& stream_ids) {
-  NOTIMPLEMENTED();
-}
-
-FakeRTCRtpReceiver::FakeRTCRtpReceiver(
-    const std::string& track_id,
-    std::vector<std::string> stream_ids,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : track_(CreateWebMediaStreamTrack(track_id, task_runner)),
-      stream_ids_(std::move(stream_ids)) {}
-
-FakeRTCRtpReceiver::FakeRTCRtpReceiver(const FakeRTCRtpReceiver&) = default;
-
-FakeRTCRtpReceiver::~FakeRTCRtpReceiver() {}
-
-FakeRTCRtpReceiver& FakeRTCRtpReceiver::operator=(const FakeRTCRtpReceiver&) =
-    default;
-
-std::unique_ptr<blink::WebRTCRtpReceiver> FakeRTCRtpReceiver::ShallowCopy()
-    const {
-  return std::make_unique<FakeRTCRtpReceiver>(*this);
-}
-
-uintptr_t FakeRTCRtpReceiver::Id() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-FakeRTCRtpReceiver::DtlsTransport() {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-webrtc::DtlsTransportInformation
-FakeRTCRtpReceiver::DtlsTransportInformation() {
-  NOTIMPLEMENTED();
-  static webrtc::DtlsTransportInformation dummy(
-      webrtc::DtlsTransportState::kNew);
-  return dummy;
-}
-
-const blink::WebMediaStreamTrack& FakeRTCRtpReceiver::Track() const {
-  return track_;
-}
-
-blink::WebVector<blink::WebString> FakeRTCRtpReceiver::StreamIds() const {
-  blink::WebVector<blink::WebString> web_stream_ids(stream_ids_.size());
-  for (size_t i = 0; i < stream_ids_.size(); ++i) {
-    web_stream_ids[i] = blink::WebString::FromUTF8(stream_ids_[i]);
-  }
-  return web_stream_ids;
-}
-
-blink::WebVector<std::unique_ptr<blink::WebRTCRtpSource>>
-FakeRTCRtpReceiver::GetSources() {
-  NOTIMPLEMENTED();
-  return {};
-}
-
-void FakeRTCRtpReceiver::GetStats(
-    blink::WebRTCStatsReportCallback,
-    const blink::WebVector<webrtc::NonStandardGroupId>&) {
-  NOTIMPLEMENTED();
-}
-
-std::unique_ptr<webrtc::RtpParameters> FakeRTCRtpReceiver::GetParameters()
-    const {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-void FakeRTCRtpReceiver::SetJitterBufferMinimumDelay(
-    base::Optional<double> delay_seconds) {
-  NOTIMPLEMENTED();
-}
-
-FakeRTCRtpTransceiver::FakeRTCRtpTransceiver(
-    base::Optional<std::string> mid,
-    FakeRTCRtpSender sender,
-    FakeRTCRtpReceiver receiver,
-    bool stopped,
-    webrtc::RtpTransceiverDirection direction,
-    base::Optional<webrtc::RtpTransceiverDirection> current_direction)
-    : mid_(std::move(mid)),
-      sender_(std::move(sender)),
-      receiver_(std::move(receiver)),
-      stopped_(stopped),
-      direction_(std::move(direction)),
-      current_direction_(std::move(current_direction)) {}
-
-FakeRTCRtpTransceiver::~FakeRTCRtpTransceiver() {}
-
-blink::WebRTCRtpTransceiverImplementationType
-FakeRTCRtpTransceiver::ImplementationType() const {
-  return blink::WebRTCRtpTransceiverImplementationType::kFullTransceiver;
-}
-
-uintptr_t FakeRTCRtpTransceiver::Id() const {
-  NOTIMPLEMENTED();
-  return 0u;
-}
-
-blink::WebString FakeRTCRtpTransceiver::Mid() const {
-  return mid_ ? blink::WebString::FromUTF8(*mid_) : blink::WebString();
-}
-
-std::unique_ptr<blink::WebRTCRtpSender> FakeRTCRtpTransceiver::Sender() const {
-  return sender_.ShallowCopy();
-}
-
-std::unique_ptr<blink::WebRTCRtpReceiver> FakeRTCRtpTransceiver::Receiver()
-    const {
-  return receiver_.ShallowCopy();
-}
-
-bool FakeRTCRtpTransceiver::Stopped() const {
-  return stopped_;
-}
-
-webrtc::RtpTransceiverDirection FakeRTCRtpTransceiver::Direction() const {
-  return direction_;
-}
-
-void FakeRTCRtpTransceiver::SetDirection(
-    webrtc::RtpTransceiverDirection direction) {
-  NOTIMPLEMENTED();
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-FakeRTCRtpTransceiver::CurrentDirection() const {
-  return current_direction_;
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-FakeRTCRtpTransceiver::FiredDirection() const {
-  NOTIMPLEMENTED();
-  return base::nullopt;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/fake_rtc_rtp_transceiver.h b/chromium/content/renderer/media/webrtc/fake_rtc_rtp_transceiver.h
deleted file mode 100644
index 46e5cca252b..00000000000
--- a/chromium/content/renderer/media/webrtc/fake_rtc_rtp_transceiver.h
+++ /dev/null
@@ -1,128 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_FAKE_RTC_RTP_TRANSCEIVER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_FAKE_RTC_RTP_TRANSCEIVER_H_
-
-#include <memory>
-#include <string>
-#include <vector>
-
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
-#include "third_party/blink/public/platform/web_media_constraints.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_rtc_dtmf_sender_handler.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_receiver.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_sender.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_source.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_transceiver.h"
-
-namespace content {
-
-// TODO(https://crbug.com/868868): Similar methods to this exist in many content
-// unittests. Move to a separate file and reuse it in all of them.
-blink::WebMediaStreamTrack CreateWebMediaStreamTrack(
-    const std::string& id,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
-class FakeRTCRtpSender : public blink::WebRTCRtpSender {
- public:
-  FakeRTCRtpSender(base::Optional<std::string> track_id,
-                   std::vector<std::string> stream_ids,
-                   scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-  FakeRTCRtpSender(const FakeRTCRtpSender&);
-  ~FakeRTCRtpSender() override;
-  FakeRTCRtpSender& operator=(const FakeRTCRtpSender&);
-
-  std::unique_ptr<blink::WebRTCRtpSender> ShallowCopy() const override;
-  uintptr_t Id() const override;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> DtlsTransport() override;
-  webrtc::DtlsTransportInformation DtlsTransportInformation() override;
-  blink::WebMediaStreamTrack Track() const override;
-  blink::WebVector<blink::WebString> StreamIds() const override;
-  void ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                    blink::WebRTCVoidRequest request) override;
-  std::unique_ptr<blink::WebRTCDTMFSenderHandler> GetDtmfSender()
-      const override;
-  std::unique_ptr<webrtc::RtpParameters> GetParameters() const override;
-  void SetParameters(blink::WebVector<webrtc::RtpEncodingParameters>,
-                     webrtc::DegradationPreference,
-                     blink::WebRTCVoidRequest) override;
-  void GetStats(blink::WebRTCStatsReportCallback,
-                const blink::WebVector<webrtc::NonStandardGroupId>&) override;
-  void SetStreams(
-      const blink::WebVector<blink::WebString>& stream_ids) override;
-
- private:
-  base::Optional<std::string> track_id_;
-  std::vector<std::string> stream_ids_;
-  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
-};
-
-class FakeRTCRtpReceiver : public blink::WebRTCRtpReceiver {
- public:
-  FakeRTCRtpReceiver(const std::string& track_id,
-                     std::vector<std::string> stream_ids,
-                     scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-  FakeRTCRtpReceiver(const FakeRTCRtpReceiver&);
-  ~FakeRTCRtpReceiver() override;
-  FakeRTCRtpReceiver& operator=(const FakeRTCRtpReceiver&);
-
-  std::unique_ptr<blink::WebRTCRtpReceiver> ShallowCopy() const override;
-  uintptr_t Id() const override;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> DtlsTransport() override;
-  webrtc::DtlsTransportInformation DtlsTransportInformation() override;
-  const blink::WebMediaStreamTrack& Track() const override;
-  blink::WebVector<blink::WebString> StreamIds() const override;
-  blink::WebVector<std::unique_ptr<blink::WebRTCRtpSource>> GetSources()
-      override;
-  void GetStats(blink::WebRTCStatsReportCallback,
-                const blink::WebVector<webrtc::NonStandardGroupId>&) override;
-  std::unique_ptr<webrtc::RtpParameters> GetParameters() const override;
-  void SetJitterBufferMinimumDelay(
-      base::Optional<double> delay_seconds) override;
-
- private:
-  blink::WebMediaStreamTrack track_;
-  std::vector<std::string> stream_ids_;
-};
-
-class FakeRTCRtpTransceiver : public blink::WebRTCRtpTransceiver {
- public:
-  FakeRTCRtpTransceiver(
-      base::Optional<std::string> mid,
-      FakeRTCRtpSender sender,
-      FakeRTCRtpReceiver receiver,
-      bool stopped,
-      webrtc::RtpTransceiverDirection direction,
-      base::Optional<webrtc::RtpTransceiverDirection> current_direction);
-  ~FakeRTCRtpTransceiver() override;
-
-  blink::WebRTCRtpTransceiverImplementationType ImplementationType()
-      const override;
-  uintptr_t Id() const override;
-  blink::WebString Mid() const override;
-  std::unique_ptr<blink::WebRTCRtpSender> Sender() const override;
-  std::unique_ptr<blink::WebRTCRtpReceiver> Receiver() const override;
-  bool Stopped() const override;
-  webrtc::RtpTransceiverDirection Direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection direction) override;
-  base::Optional<webrtc::RtpTransceiverDirection> CurrentDirection()
-      const override;
-  base::Optional<webrtc::RtpTransceiverDirection> FiredDirection()
-      const override;
-
- private:
-  base::Optional<std::string> mid_;
-  FakeRTCRtpSender sender_;
-  FakeRTCRtpReceiver receiver_;
-  bool stopped_;
-  webrtc::RtpTransceiverDirection direction_;
-  base::Optional<webrtc::RtpTransceiverDirection> current_direction_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_FAKE_RTC_RTP_TRANSCEIVER_H_
diff --git a/chromium/content/renderer/media/webrtc/media_stream_remote_video_source_unittest.cc b/chromium/content/renderer/media/webrtc/media_stream_remote_video_source_unittest.cc
deleted file mode 100644
index 8d98387b31c..00000000000
--- a/chromium/content/renderer/media/webrtc/media_stream_remote_video_source_unittest.cc
+++ /dev/null
@@ -1,242 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "third_party/blink/public/web/modules/peerconnection/media_stream_remote_video_source.h"
-
-#include <memory>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/strings/utf_string_conversions.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/test/task_environment.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "media/base/video_frame.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/mojom/mediastream/media_stream.mojom-shared.h"
-#include "third_party/blink/public/platform/modules/webrtc/track_observer.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_video_track.h"
-#include "third_party/blink/public/web/modules/mediastream/mock_media_stream_video_sink.h"
-#include "third_party/blink/public/web/web_heap.h"
-#include "third_party/webrtc/api/video/color_space.h"
-#include "third_party/webrtc/api/video/i420_buffer.h"
-#include "ui/gfx/color_space.h"
-
-namespace content {
-
-ACTION_P(RunClosure, closure) {
-  closure.Run();
-}
-
-class MediaStreamRemoteVideoSourceUnderTest
-    : public blink::MediaStreamRemoteVideoSource {
- public:
-  explicit MediaStreamRemoteVideoSourceUnderTest(
-      std::unique_ptr<blink::TrackObserver> observer)
-      : MediaStreamRemoteVideoSource(std::move(observer)) {}
-  using MediaStreamRemoteVideoSource::SinkInterfaceForTesting;
-  using MediaStreamRemoteVideoSource::StartSourceImpl;
-};
-
-class MediaStreamRemoteVideoSourceTest
-    : public ::testing::Test {
- public:
-  MediaStreamRemoteVideoSourceTest()
-      : task_environment_(base::test::TaskEnvironment::MainThreadType::UI),
-        child_process_(new ChildProcess()),
-        mock_factory_(new MockPeerConnectionDependencyFactory()),
-        webrtc_video_track_(MockWebRtcVideoTrack::Create("test")),
-        remote_source_(nullptr),
-        number_of_successful_track_starts_(0),
-        number_of_failed_track_starts_(0) {}
-
-  void SetUp() override {
-    scoped_refptr<base::SingleThreadTaskRunner> main_thread =
-        blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-
-    base::WaitableEvent waitable_event(
-        base::WaitableEvent::ResetPolicy::MANUAL,
-        base::WaitableEvent::InitialState::NOT_SIGNALED);
-
-    std::unique_ptr<blink::TrackObserver> track_observer;
-    mock_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            [](scoped_refptr<base::SingleThreadTaskRunner> main_thread,
-               webrtc::MediaStreamTrackInterface* webrtc_track,
-               std::unique_ptr<blink::TrackObserver>* track_observer,
-               base::WaitableEvent* waitable_event) {
-              track_observer->reset(
-                  new blink::TrackObserver(main_thread, webrtc_track));
-              waitable_event->Signal();
-            },
-            main_thread, base::Unretained(webrtc_video_track_.get()),
-            base::Unretained(&track_observer),
-            base::Unretained(&waitable_event)));
-    waitable_event.Wait();
-
-    remote_source_ =
-        new MediaStreamRemoteVideoSourceUnderTest(std::move(track_observer));
-    webkit_source_.Initialize(blink::WebString::FromASCII("dummy_source_id"),
-                              blink::WebMediaStreamSource::kTypeVideo,
-                              blink::WebString::FromASCII("dummy_source_name"),
-                              true /* remote */);
-    webkit_source_.SetPlatformSource(base::WrapUnique(remote_source_));
-  }
-
-  void TearDown() override {
-    remote_source_->OnSourceTerminated();
-    webkit_source_.Reset();
-    blink::WebHeap::CollectAllGarbageForTesting();
-  }
-
-  MediaStreamRemoteVideoSourceUnderTest* source() {
-    return remote_source_;
-  }
-
-  blink::MediaStreamVideoTrack* CreateTrack() {
-    bool enabled = true;
-    return new blink::MediaStreamVideoTrack(
-        source(),
-        base::Bind(&MediaStreamRemoteVideoSourceTest::OnTrackStarted,
-                   base::Unretained(this)),
-        enabled);
-  }
-
-  int NumberOfSuccessConstraintsCallbacks() const {
-    return number_of_successful_track_starts_;
-  }
-
-  int NumberOfFailedConstraintsCallbacks() const {
-    return number_of_failed_track_starts_;
-  }
-
-  void StopWebRtcTrack() {
-    base::WaitableEvent waitable_event(
-        base::WaitableEvent::ResetPolicy::MANUAL,
-        base::WaitableEvent::InitialState::NOT_SIGNALED);
-    mock_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE, base::BindOnce(
-                       [](MockWebRtcVideoTrack* video_track,
-                          base::WaitableEvent* waitable_event) {
-                         video_track->SetEnded();
-                         waitable_event->Signal();
-                       },
-                       base::Unretained(static_cast<MockWebRtcVideoTrack*>(
-                           webrtc_video_track_.get())),
-                       base::Unretained(&waitable_event)));
-    waitable_event.Wait();
-  }
-
-  const blink::WebMediaStreamSource& webkit_source() const {
-    return  webkit_source_;
-  }
-
- private:
-  void OnTrackStarted(blink::WebPlatformMediaStreamSource* source,
-                      blink::mojom::MediaStreamRequestResult result,
-                      const blink::WebString& result_name) {
-    ASSERT_EQ(source, remote_source_);
-    if (result == blink::mojom::MediaStreamRequestResult::OK)
-      ++number_of_successful_track_starts_;
-    else
-      ++number_of_failed_track_starts_;
-  }
-
-  base::test::TaskEnvironment task_environment_;
-  std::unique_ptr<ChildProcess> child_process_;
-  std::unique_ptr<MockPeerConnectionDependencyFactory> mock_factory_;
-  scoped_refptr<webrtc::VideoTrackInterface> webrtc_video_track_;
-  // |remote_source_| is owned by |webkit_source_|.
-  MediaStreamRemoteVideoSourceUnderTest* remote_source_;
-  blink::WebMediaStreamSource webkit_source_;
-  int number_of_successful_track_starts_;
-  int number_of_failed_track_starts_;
-};
-
-TEST_F(MediaStreamRemoteVideoSourceTest, StartTrack) {
-  std::unique_ptr<blink::MediaStreamVideoTrack> track(CreateTrack());
-  EXPECT_EQ(1, NumberOfSuccessConstraintsCallbacks());
-
-  blink::MockMediaStreamVideoSink sink;
-  track->AddSink(&sink, sink.GetDeliverFrameCB(), false);
-  base::RunLoop run_loop;
-  base::Closure quit_closure = run_loop.QuitClosure();
-  EXPECT_CALL(sink, OnVideoFrame())
-      .WillOnce(RunClosure(std::move(quit_closure)));
-  rtc::scoped_refptr<webrtc::I420Buffer> buffer(
-      new rtc::RefCountedObject<webrtc::I420Buffer>(320, 240));
-
-  webrtc::I420Buffer::SetBlack(buffer);
-
-  source()->SinkInterfaceForTesting()->OnFrame(
-      webrtc::VideoFrame::Builder()
-          .set_video_frame_buffer(buffer)
-          .set_rotation(webrtc::kVideoRotation_0)
-          .set_timestamp_us(1000)
-          .build());
-  run_loop.Run();
-
-  EXPECT_EQ(1, sink.number_of_frames());
-  track->RemoveSink(&sink);
-}
-
-TEST_F(MediaStreamRemoteVideoSourceTest, RemoteTrackStop) {
-  std::unique_ptr<blink::MediaStreamVideoTrack> track(CreateTrack());
-
-  blink::MockMediaStreamVideoSink sink;
-  track->AddSink(&sink, sink.GetDeliverFrameCB(), false);
-  EXPECT_EQ(blink::WebMediaStreamSource::kReadyStateLive, sink.state());
-  EXPECT_EQ(blink::WebMediaStreamSource::kReadyStateLive,
-            webkit_source().GetReadyState());
-  StopWebRtcTrack();
-  base::RunLoop().RunUntilIdle();
-  EXPECT_EQ(blink::WebMediaStreamSource::kReadyStateEnded,
-            webkit_source().GetReadyState());
-  EXPECT_EQ(blink::WebMediaStreamSource::kReadyStateEnded, sink.state());
-
-  track->RemoveSink(&sink);
-}
-
-TEST_F(MediaStreamRemoteVideoSourceTest, PreservesColorSpace) {
-  std::unique_ptr<blink::MediaStreamVideoTrack> track(CreateTrack());
-  blink::MockMediaStreamVideoSink sink;
-  track->AddSink(&sink, sink.GetDeliverFrameCB(), false);
-
-  base::RunLoop run_loop;
-  EXPECT_CALL(sink, OnVideoFrame())
-      .WillOnce(RunClosure(run_loop.QuitClosure()));
-  rtc::scoped_refptr<webrtc::I420Buffer> buffer(
-      new rtc::RefCountedObject<webrtc::I420Buffer>(320, 240));
-  webrtc::ColorSpace kColorSpace(webrtc::ColorSpace::PrimaryID::kSMPTE240M,
-                                 webrtc::ColorSpace::TransferID::kSMPTE240M,
-                                 webrtc::ColorSpace::MatrixID::kSMPTE240M,
-                                 webrtc::ColorSpace::RangeID::kLimited);
-  const webrtc::VideoFrame& input_frame =
-      webrtc::VideoFrame::Builder()
-          .set_video_frame_buffer(buffer)
-          .set_timestamp_ms(0)
-          .set_rotation(webrtc::kVideoRotation_0)
-          .set_color_space(kColorSpace)
-          .build();
-  source()->SinkInterfaceForTesting()->OnFrame(input_frame);
-  run_loop.Run();
-
-  EXPECT_EQ(1, sink.number_of_frames());
-  scoped_refptr<media::VideoFrame> output_frame = sink.last_frame();
-  EXPECT_TRUE(output_frame);
-  EXPECT_TRUE(output_frame->ColorSpace() ==
-              gfx::ColorSpace(gfx::ColorSpace::PrimaryID::SMPTE240M,
-                              gfx::ColorSpace::TransferID::SMPTE240M,
-                              gfx::ColorSpace::MatrixID::SMPTE240M,
-                              gfx::ColorSpace::RangeID::LIMITED));
-  track->RemoveSink(&sink);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/media_stream_track_metrics.cc b/chromium/content/renderer/media/webrtc/media_stream_track_metrics.cc
index f2451e9ee7d..31a5b5c52fe 100644
--- a/chromium/content/renderer/media/webrtc/media_stream_track_metrics.cc
+++ b/chromium/content/renderer/media/webrtc/media_stream_track_metrics.cc
@@ -8,10 +8,10 @@
 #include <string>
 
 #include "base/hash/md5.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/child/child_thread_impl.h"
-#include "content/public/common/service_names.mojom.h"
-#include "content/renderer/render_thread_impl.h"
+#include "base/strings/stringprintf.h"
+#include "base/threading/thread_checker.h"
+#include "third_party/blink/public/common/thread_safe_browser_interface_broker_proxy.h"
+#include "third_party/blink/public/platform/platform.h"
 
 namespace content {
 
@@ -213,19 +213,14 @@ void MediaStreamTrackMetrics::SendLifetimeMessage(const std::string& track_id,
                                                   Kind kind,
                                                   LifetimeEvent event,
                                                   Direction direction) {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  // |render_thread| can be NULL in certain cases when running as part
-  // |of a unit test.
-  if (render_thread) {
-    if (event == LifetimeEvent::kConnected) {
-      GetMediaStreamTrackMetricsHost()->AddTrack(
-          MakeUniqueId(track_id, direction), kind == Kind::kAudio,
-          direction == Direction::kReceive);
-    } else {
-      DCHECK_EQ(LifetimeEvent::kDisconnected, event);
-      GetMediaStreamTrackMetricsHost()->RemoveTrack(
-          MakeUniqueId(track_id, direction));
-    }
+  if (event == LifetimeEvent::kConnected) {
+    GetMediaStreamTrackMetricsHost()->AddTrack(
+        MakeUniqueId(track_id, direction), kind == Kind::kAudio,
+        direction == Direction::kReceive);
+  } else {
+    DCHECK_EQ(LifetimeEvent::kDisconnected, event);
+    GetMediaStreamTrackMetricsHost()->RemoveTrack(
+        MakeUniqueId(track_id, direction));
   }
 }
 
@@ -261,11 +256,11 @@ uint64_t MediaStreamTrackMetrics::MakeUniqueId(const std::string& track_id,
       direction);
 }
 
-blink::mojom::MediaStreamTrackMetricsHostPtr&
+mojo::Remote<blink::mojom::MediaStreamTrackMetricsHost>&
 MediaStreamTrackMetrics::GetMediaStreamTrackMetricsHost() {
   if (!track_metrics_host_) {
-    ChildThreadImpl::current()->BindHostReceiver(
-        mojo::MakeRequest(&track_metrics_host_));
+    blink::Platform::Current()->GetBrowserInterfaceBrokerProxy()->GetInterface(
+        track_metrics_host_.BindNewPipeAndPassReceiver());
   }
   return track_metrics_host_;
 }
diff --git a/chromium/content/renderer/media/webrtc/media_stream_track_metrics.h b/chromium/content/renderer/media/webrtc/media_stream_track_metrics.h
index 0125c079cc0..5b2657c9ee6 100644
--- a/chromium/content/renderer/media/webrtc/media_stream_track_metrics.h
+++ b/chromium/content/renderer/media/webrtc/media_stream_track_metrics.h
@@ -12,6 +12,7 @@
 
 #include "base/sequence_checker.h"
 #include "content/common/content_export.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "third_party/blink/public/mojom/mediastream/media_stream.mojom.h"
 #include "third_party/webrtc/api/peer_connection_interface.h"
 
@@ -86,10 +87,10 @@ class CONTENT_EXPORT MediaStreamTrackMetrics {
   // track object and the PeerConnection it is attached to both exist.
   uint64_t MakeUniqueId(const std::string& track_id, Direction direction);
 
-  blink::mojom::MediaStreamTrackMetricsHostPtr&
+  mojo::Remote<blink::mojom::MediaStreamTrackMetricsHost>&
   GetMediaStreamTrackMetricsHost();
 
-  blink::mojom::MediaStreamTrackMetricsHostPtr track_metrics_host_;
+  mojo::Remote<blink::mojom::MediaStreamTrackMetricsHost> track_metrics_host_;
 
   typedef std::vector<std::unique_ptr<MediaStreamTrackMetricsObserver>>
       ObserverVector;
diff --git a/chromium/content/renderer/media/webrtc/media_stream_track_metrics_unittest.cc b/chromium/content/renderer/media/webrtc/media_stream_track_metrics_unittest.cc
index f2ac326e056..277f2232877 100644
--- a/chromium/content/renderer/media/webrtc/media_stream_track_metrics_unittest.cc
+++ b/chromium/content/renderer/media/webrtc/media_stream_track_metrics_unittest.cc
@@ -9,9 +9,9 @@
 #include "base/test/task_environment.h"
 #include "base/threading/thread.h"
 #include "content/renderer/media/webrtc/media_stream_track_metrics.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_dependency_factory.h"
 #include "third_party/webrtc/api/media_stream_interface.h"
 
 using webrtc::AudioSourceInterface;
@@ -85,12 +85,13 @@ class MockMediaStreamTrackMetrics : public MediaStreamTrackMetrics {
 class MediaStreamTrackMetricsTest : public testing::Test {
  public:
   MediaStreamTrackMetricsTest()
-      : task_environment_(base::test::TaskEnvironment::MainThreadType::UI),
+      : task_environment_(
+            base::test::SingleThreadTaskEnvironment::MainThreadType::UI),
         signaling_thread_("signaling_thread") {}
 
   void SetUp() override {
     metrics_.reset(new MockMediaStreamTrackMetrics());
-    stream_ = new rtc::RefCountedObject<MockMediaStream>("stream");
+    stream_ = new rtc::RefCountedObject<blink::MockMediaStream>("stream");
     signaling_thread_.Start();
   }
 
@@ -150,7 +151,7 @@ class MediaStreamTrackMetricsTest : public testing::Test {
   std::unique_ptr<MockMediaStreamTrackMetrics> metrics_;
   scoped_refptr<MediaStreamInterface> stream_;
 
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   base::Thread signaling_thread_;
 };
 
diff --git a/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc b/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc
deleted file mode 100644
index 6eb65719c24..00000000000
--- a/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink.cc
+++ /dev/null
@@ -1,317 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/media_stream_video_webrtc_sink.h"
-
-#include <algorithm>
-#include <memory>
-#include <string>
-
-#include "base/bind.h"
-#include "base/feature_list.h"
-#include "base/location.h"
-#include "base/numerics/safe_conversions.h"
-#include "base/single_thread_task_runner.h"
-#include "base/strings/utf_string_conversions.h"
-#include "base/synchronization/lock.h"
-#include "base/timer/timer.h"
-#include "content/public/common/content_features.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-#include "media/base/limits.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_video_track_source.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_constraints_util.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_video_track.h"
-#include "third_party/blink/public/web/modules/mediastream/web_media_stream_utils.h"
-#include "third_party/webrtc/api/video_track_source_proxy.h"
-
-namespace content {
-
-namespace {
-
-absl::optional<bool> ToAbslOptionalBool(const base::Optional<bool>& value) {
-  return value ? absl::optional<bool>(*value) : absl::nullopt;
-}
-
-}  // namespace
-
-namespace {
-
-// The default number of microseconds that should elapse since the last video
-// frame was received, before requesting a refresh frame.
-const int64_t kDefaultRefreshIntervalMicros =
-    base::Time::kMicrosecondsPerSecond;
-
-// A lower-bound for the refresh interval.
-const int64_t kLowerBoundRefreshIntervalMicros =
-    base::Time::kMicrosecondsPerSecond / media::limits::kMaxFramesPerSecond;
-
-webrtc::VideoTrackInterface::ContentHint ContentHintTypeToWebRtcContentHint(
-    blink::WebMediaStreamTrack::ContentHintType content_hint) {
-  switch (content_hint) {
-    case blink::WebMediaStreamTrack::ContentHintType::kNone:
-      return webrtc::VideoTrackInterface::ContentHint::kNone;
-    case blink::WebMediaStreamTrack::ContentHintType::kAudioSpeech:
-    case blink::WebMediaStreamTrack::ContentHintType::kAudioMusic:
-      NOTREACHED();
-      break;
-    case blink::WebMediaStreamTrack::ContentHintType::kVideoMotion:
-      return webrtc::VideoTrackInterface::ContentHint::kFluid;
-    case blink::WebMediaStreamTrack::ContentHintType::kVideoDetail:
-      return webrtc::VideoTrackInterface::ContentHint::kDetailed;
-    case blink::WebMediaStreamTrack::ContentHintType::kVideoText:
-      return webrtc::VideoTrackInterface::ContentHint::kText;
-  }
-  NOTREACHED();
-  return webrtc::VideoTrackInterface::ContentHint::kNone;
-}
-
-}  // namespace
-
-// Simple help class used for receiving video frames on the IO-thread from a
-// MediaStreamVideoTrack and forward the frames to a WebRtcVideoCapturerAdapter
-// on libjingle's worker thread. WebRtcVideoCapturerAdapter implements a video
-// capturer for libjingle.
-class MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter
-    : public base::RefCountedThreadSafe<WebRtcVideoSourceAdapter> {
- public:
-  WebRtcVideoSourceAdapter(
-      const scoped_refptr<base::SingleThreadTaskRunner>&
-          libjingle_worker_thread,
-      const scoped_refptr<blink::WebRtcVideoTrackSource>& source,
-      base::TimeDelta refresh_interval,
-      const base::RepeatingClosure& refresh_callback,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
-  // MediaStreamVideoWebRtcSink can be destroyed on the main render thread or
-  // libjingles worker thread since it posts video frames on that thread. But
-  // |video_source_| must be released on the main render thread before the
-  // PeerConnectionFactory has been destroyed. The only way to ensure that is to
-  // make sure |video_source_| is released when MediaStreamVideoWebRtcSink() is
-  // destroyed.
-  void ReleaseSourceOnMainThread();
-
-  void OnVideoFrameOnIO(scoped_refptr<media::VideoFrame> frame,
-                        base::TimeTicks estimated_capture_time);
-
- private:
-  friend class base::RefCountedThreadSafe<WebRtcVideoSourceAdapter>;
-
-  void OnVideoFrameOnWorkerThread(scoped_refptr<media::VideoFrame> frame);
-
-  virtual ~WebRtcVideoSourceAdapter();
-
-  // Called whenever a video frame was just delivered on the IO thread. This
-  // restarts the delay period before the |refresh_timer_| will fire the next
-  // time.
-  void ResetRefreshTimerOnMainThread();
-
-  scoped_refptr<base::SingleThreadTaskRunner> render_task_runner_;
-
-  // |render_thread_checker_| is bound to the main render thread.
-  base::ThreadChecker render_thread_checker_;
-  // Used to DCHECK that frames are called on the IO-thread.
-  base::ThreadChecker io_thread_checker_;
-
-  // Used for posting frames to libjingle's worker thread. Accessed on the
-  // IO-thread.
-  scoped_refptr<base::SingleThreadTaskRunner> libjingle_worker_thread_;
-
-  scoped_refptr<blink::WebRtcVideoTrackSource> video_source_;
-
-  // Used to protect |video_source_|. It is taken by libjingle's worker
-  // thread for each video frame that is delivered but only taken on the
-  // main render thread in ReleaseSourceOnMainThread() when
-  // the owning MediaStreamVideoWebRtcSink is being destroyed.
-  base::Lock video_source_stop_lock_;
-
-  // Requests a refresh frame at regular intervals. The delay on this timer is
-  // reset each time a frame is received so that it will not fire for at least
-  // an additional period. This means refresh frames will only be requested when
-  // the source has halted delivery (e.g., a screen capturer stops sending
-  // frames because the screen is not being updated).
-  //
-  // This mechanism solves a number of problems. First, it will ensure that
-  // remote clients that join a distributed session receive a first video frame
-  // in a timely manner. Second, it will allow WebRTC's internal bandwidth
-  // estimation logic to maintain a more optimal state, since sending a video
-  // frame will "prime it." Third, it allows lossy encoders to clean up
-  // artifacts in a still image.  http://crbug.com/486274
-  base::RepeatingTimer refresh_timer_;
-};
-
-MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::WebRtcVideoSourceAdapter(
-    const scoped_refptr<base::SingleThreadTaskRunner>& libjingle_worker_thread,
-    const scoped_refptr<blink::WebRtcVideoTrackSource>& source,
-    base::TimeDelta refresh_interval,
-    const base::RepeatingClosure& refresh_callback,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
-    : render_task_runner_(std::move(task_runner)),
-      libjingle_worker_thread_(libjingle_worker_thread),
-      video_source_(source) {
-  DCHECK(render_task_runner_->RunsTasksInCurrentSequence());
-  io_thread_checker_.DetachFromThread();
-  if (!refresh_interval.is_zero()) {
-    VLOG(1) << "Starting frame refresh timer with interval "
-            << refresh_interval.InMillisecondsF() << " ms.";
-    refresh_timer_.Start(FROM_HERE, refresh_interval, refresh_callback);
-  }
-}
-
-MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::
-    ~WebRtcVideoSourceAdapter() {
-  DVLOG(3) << "~WebRtcVideoSourceAdapter()";
-  DCHECK(!video_source_);
-  // This object can be destroyed on the main render thread or libjingles worker
-  // thread since it posts video frames on that thread. But |video_source_| must
-  // be released on the main render thread before the PeerConnectionFactory has
-  // been destroyed. The only way to ensure that is to make sure |video_source_|
-  // is released when MediaStreamVideoWebRtcSink() is destroyed.
-}
-
-void MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::
-    ResetRefreshTimerOnMainThread() {
-  DCHECK(render_thread_checker_.CalledOnValidThread());
-  if (refresh_timer_.IsRunning())
-    refresh_timer_.Reset();
-}
-
-void MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::
-    ReleaseSourceOnMainThread() {
-  DCHECK(render_thread_checker_.CalledOnValidThread());
-  // Since frames are posted to the worker thread, this object might be deleted
-  // on that thread. However, since |video_source_| was created on the render
-  // thread, it should be released on the render thread.
-  base::AutoLock auto_lock(video_source_stop_lock_);
-  video_source_ = nullptr;
-}
-
-void MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::OnVideoFrameOnIO(
-    scoped_refptr<media::VideoFrame> frame,
-    base::TimeTicks estimated_capture_time) {
-  DCHECK(io_thread_checker_.CalledOnValidThread());
-  render_task_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&WebRtcVideoSourceAdapter::ResetRefreshTimerOnMainThread,
-                     this));
-  libjingle_worker_thread_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&WebRtcVideoSourceAdapter::OnVideoFrameOnWorkerThread,
-                     this, std::move(frame)));
-}
-
-void MediaStreamVideoWebRtcSink::WebRtcVideoSourceAdapter::
-    OnVideoFrameOnWorkerThread(scoped_refptr<media::VideoFrame> frame) {
-  DCHECK(libjingle_worker_thread_->BelongsToCurrentThread());
-  base::AutoLock auto_lock(video_source_stop_lock_);
-  if (video_source_)
-    video_source_->OnFrameCaptured(std::move(frame));
-}
-
-MediaStreamVideoWebRtcSink::MediaStreamVideoWebRtcSink(
-    const blink::WebMediaStreamTrack& track,
-    PeerConnectionDependencyFactory* factory,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  blink::MediaStreamVideoTrack* video_track =
-      blink::MediaStreamVideoTrack::GetVideoTrack(track);
-  DCHECK(video_track);
-
-  absl::optional<bool> needs_denoising =
-      ToAbslOptionalBool(video_track->noise_reduction());
-
-  bool is_screencast = video_track->is_screencast();
-  base::Optional<double> min_frame_rate = video_track->min_frame_rate();
-  base::Optional<double> max_frame_rate = video_track->max_frame_rate();
-
-  // Enable automatic frame refreshes for the screen capture sources, which will
-  // stop producing frames whenever screen content is not changing. Check the
-  // frameRate constraint to determine the rate of refreshes. If a minimum
-  // frameRate is provided, use that. Otherwise, use the maximum frameRate if it
-  // happens to be less than the default.
-  base::TimeDelta refresh_interval = base::TimeDelta::FromMicroseconds(0);
-  if (is_screencast) {
-    // Start with the default refresh interval, and refine based on constraints.
-    refresh_interval =
-        base::TimeDelta::FromMicroseconds(kDefaultRefreshIntervalMicros);
-    if (min_frame_rate.has_value()) {
-      refresh_interval =
-          base::TimeDelta::FromMicroseconds(base::saturated_cast<int64_t>(
-              base::Time::kMicrosecondsPerSecond / *min_frame_rate));
-    }
-    if (max_frame_rate.has_value()) {
-      const base::TimeDelta alternate_refresh_interval =
-          base::TimeDelta::FromMicroseconds(base::saturated_cast<int64_t>(
-              base::Time::kMicrosecondsPerSecond / *max_frame_rate));
-      refresh_interval = std::max(refresh_interval, alternate_refresh_interval);
-    }
-    if (refresh_interval.InMicroseconds() < kLowerBoundRefreshIntervalMicros) {
-      refresh_interval =
-          base::TimeDelta::FromMicroseconds(kLowerBoundRefreshIntervalMicros);
-    }
-  }
-
-  // TODO(pbos): Consolidate WebRtcVideoCapturerAdapter into WebRtcVideoSource
-  // by removing the need for and dependency on a cricket::VideoCapturer.
-  video_source_ = scoped_refptr<blink::WebRtcVideoTrackSource>(
-      new rtc::RefCountedObject<blink::WebRtcVideoTrackSource>(
-          is_screencast, needs_denoising));
-
-  // TODO(pbos): Consolidate the local video track with the source proxy and
-  // move into PeerConnectionDependencyFactory. This now separately holds on a
-  // reference to the proxy object because
-  // PeerConnectionFactory::CreateVideoTrack doesn't do reference counting.
-  video_source_proxy_ =
-      factory->CreateVideoTrackSourceProxy(video_source_.get());
-  video_track_ = factory->CreateLocalVideoTrack(track.Id().Utf8(),
-                                                video_source_proxy_.get());
-
-  video_track_->set_content_hint(
-      ContentHintTypeToWebRtcContentHint(track.ContentHint()));
-  video_track_->set_enabled(track.IsEnabled());
-
-  source_adapter_ = new WebRtcVideoSourceAdapter(
-      factory->GetWebRtcWorkerThread(), video_source_.get(), refresh_interval,
-      base::Bind(&MediaStreamVideoWebRtcSink::RequestRefreshFrame,
-                 weak_factory_.GetWeakPtr()),
-      std::move(task_runner));
-
-  blink::MediaStreamVideoSink::ConnectToTrack(
-      track,
-      base::Bind(&WebRtcVideoSourceAdapter::OnVideoFrameOnIO, source_adapter_),
-      false);
-
-  DVLOG(3) << "MediaStreamVideoWebRtcSink ctor() : is_screencast "
-           << is_screencast;
-}
-
-MediaStreamVideoWebRtcSink::~MediaStreamVideoWebRtcSink() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DVLOG(3) << "MediaStreamVideoWebRtcSink dtor().";
-  weak_factory_.InvalidateWeakPtrs();
-  blink::MediaStreamVideoSink::DisconnectFromTrack();
-  source_adapter_->ReleaseSourceOnMainThread();
-}
-
-void MediaStreamVideoWebRtcSink::OnEnabledChanged(bool enabled) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  video_track_->set_enabled(enabled);
-}
-
-void MediaStreamVideoWebRtcSink::OnContentHintChanged(
-    blink::WebMediaStreamTrack::ContentHintType content_hint) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  video_track_->set_content_hint(
-      ContentHintTypeToWebRtcContentHint(content_hint));
-}
-
-void MediaStreamVideoWebRtcSink::RequestRefreshFrame() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  blink::RequestRefreshFrameFromVideoTrack(connected_track());
-}
-
-absl::optional<bool>
-MediaStreamVideoWebRtcSink::SourceNeedsDenoisingForTesting() const {
-  return video_source_->needs_denoising();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink.h b/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink.h
deleted file mode 100644
index e253aa0cf8a..00000000000
--- a/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink.h
+++ /dev/null
@@ -1,87 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_VIDEO_TRACK_ADAPTER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_VIDEO_TRACK_ADAPTER_H_
-
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-#include "base/threading/thread_checker.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_video_sink.h"
-#include "third_party/webrtc/api/media_stream_interface.h"
-
-namespace base {
-class SingleThreadTaskRunner;
-}
-
-namespace blink {
-class MediaStreamVideoTrack;
-class WebRtcVideoTrackSource;
-}
-
-namespace content {
-
-class PeerConnectionDependencyFactory;
-
-// MediaStreamVideoWebRtcSink is an adapter between a
-// blink::MediaStreamVideoTrack object and a webrtc VideoTrack that is
-// currently sent on a PeerConnection.
-// The responsibility of the class is to create and own a representation of a
-// webrtc VideoTrack that can be added and removed from a RTCPeerConnection. An
-// instance of MediaStreamVideoWebRtcSink is created when a VideoTrack is added
-// to an RTCPeerConnection object.
-// Instances of this class is owned by the WebRtcMediaStreamAdapter object that
-// created it.
-class CONTENT_EXPORT MediaStreamVideoWebRtcSink
-    : public blink::MediaStreamVideoSink {
- public:
-  MediaStreamVideoWebRtcSink(
-      const blink::WebMediaStreamTrack& track,
-      PeerConnectionDependencyFactory* factory,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-  ~MediaStreamVideoWebRtcSink() override;
-
-  webrtc::VideoTrackInterface* webrtc_video_track() {
-    return video_track_.get();
-  }
-
-  absl::optional<bool> SourceNeedsDenoisingForTesting() const;
-
- protected:
-  // Implementation of MediaStreamSink.
-  void OnEnabledChanged(bool enabled) override;
-  void OnContentHintChanged(
-      blink::WebMediaStreamTrack::ContentHintType content_hint) override;
-
- private:
-  // Helper to request a refresh frame from the source. Called via the callback
-  // passed to WebRtcVideoSourceAdapter.
-  void RequestRefreshFrame();
-
-  // Used to DCHECK that we are called on the correct thread.
-  base::ThreadChecker thread_checker_;
-
-  // |video_source_| and |video_source_proxy_| are held as
-  // references to outlive |video_track_| since the interfaces between them
-  // don't use reference counting.
-  scoped_refptr<blink::WebRtcVideoTrackSource> video_source_;
-  scoped_refptr<webrtc::VideoTrackSourceInterface> video_source_proxy_;
-  scoped_refptr<webrtc::VideoTrackInterface> video_track_;
-
-  class WebRtcVideoSourceAdapter;
-  scoped_refptr<WebRtcVideoSourceAdapter> source_adapter_;
-
-  // Provides WebRtcVideoSourceAdapter a weak reference to
-  // MediaStreamVideoWebRtcSink in order to allow it to request refresh frames.
-  // See comments in media_stream_video_webrtc_sink.cc.
-  base::WeakPtrFactory<MediaStreamVideoWebRtcSink> weak_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(MediaStreamVideoWebRtcSink);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_VIDEO_TRACK_ADAPTER_H_
diff --git a/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink_unittest.cc b/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink_unittest.cc
deleted file mode 100644
index 56be875c017..00000000000
--- a/chromium/content/renderer/media/webrtc/media_stream_video_webrtc_sink_unittest.cc
+++ /dev/null
@@ -1,68 +0,0 @@
-// Copyright 2016 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/media_stream_video_webrtc_sink.h"
-
-#include "base/test/task_environment.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/web/modules/mediastream/mock_media_stream_registry.h"
-#include "third_party/blink/public/web/modules/mediastream/video_track_adapter_settings.h"
-
-namespace content {
-namespace {
-
-class MediaStreamVideoWebRtcSinkTest : public ::testing::Test {
- public:
-  MediaStreamVideoWebRtcSinkTest()
-      : task_environment_(base::test::TaskEnvironment::MainThreadType::UI) {}
-
-  void SetVideoTrack() {
-    registry_.Init();
-    registry_.AddVideoTrack("test video track");
-    blink::WebVector<blink::WebMediaStreamTrack> video_tracks =
-        registry_.test_stream().VideoTracks();
-    track_ = video_tracks[0];
-    // TODO(hta): Verify that track_ is valid. When constraints produce
-    // no valid format, using the track will cause a crash.
-  }
-
-  void SetVideoTrack(const base::Optional<bool>& noise_reduction) {
-    registry_.Init();
-    registry_.AddVideoTrack("test video track",
-                            blink::VideoTrackAdapterSettings(), noise_reduction,
-                            false, 0.0);
-    blink::WebVector<blink::WebMediaStreamTrack> video_tracks =
-        registry_.test_stream().VideoTracks();
-    track_ = video_tracks[0];
-    // TODO(hta): Verify that track_ is valid. When constraints produce
-    // no valid format, using the track will cause a crash.
-  }
-
- protected:
-  blink::WebMediaStreamTrack track_;
-  MockPeerConnectionDependencyFactory dependency_factory_;
-
- private:
-  blink::MockMediaStreamRegistry registry_;
-  // A ChildProcess is needed to fool the Tracks and Sources into believing they
-  // are on the right threads. A TaskEnvironment must be instantiated
-  // before ChildProcess to prevent it from leaking a ThreadPool.
-  base::test::TaskEnvironment task_environment_;
-  const ChildProcess child_process_;
-};
-
-TEST_F(MediaStreamVideoWebRtcSinkTest, NoiseReductionDefaultsToNotSet) {
-  SetVideoTrack();
-  MediaStreamVideoWebRtcSink my_sink(
-      track_, &dependency_factory_,
-      blink::scheduler::GetSingleThreadTaskRunnerForTesting());
-  EXPECT_TRUE(my_sink.webrtc_video_track());
-  EXPECT_FALSE(my_sink.SourceNeedsDenoisingForTesting());
-}
-
-}  // namespace
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/mock_data_channel_impl.cc b/chromium/content/renderer/media/webrtc/mock_data_channel_impl.cc
deleted file mode 100644
index 1d3547f5a7d..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_data_channel_impl.cc
+++ /dev/null
@@ -1,88 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/mock_data_channel_impl.h"
-
-#include "base/logging.h"
-
-namespace content {
-
-MockDataChannel::MockDataChannel(const std::string& label,
-                const webrtc::DataChannelInit* config)
-    : label_(label),
-      reliable_(config->reliable),
-      state_(webrtc::DataChannelInterface::kConnecting),
-      config_(*config),
-      observer_(nullptr) {
-}
-
-MockDataChannel::~MockDataChannel() {
-}
-
-void MockDataChannel::RegisterObserver(webrtc::DataChannelObserver* observer) {
-  observer_ = observer;
-}
-
-void MockDataChannel::UnregisterObserver() {
-  observer_ = nullptr;
-}
-
-std::string MockDataChannel::label() const { return label_; }
-
-bool MockDataChannel::reliable() const { return reliable_; }
-
-bool MockDataChannel::ordered() const { return config_.ordered; }
-
-std::string MockDataChannel::protocol() const { return config_.protocol; }
-
-bool MockDataChannel::negotiated() const { return config_.negotiated; }
-
-int MockDataChannel::id() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-MockDataChannel::DataState MockDataChannel::state() const { return state_; }
-
-uint32_t MockDataChannel::messages_sent() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-uint64_t MockDataChannel::bytes_sent() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-uint32_t MockDataChannel::messages_received() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-uint64_t MockDataChannel::bytes_received() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-// For testing.
-void MockDataChannel::changeState(DataState state) {
-  state_ = state;
-  if (observer_)
-    observer_->OnStateChange();
-}
-
-uint64_t MockDataChannel::buffered_amount() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-void MockDataChannel::Close() {
-  changeState(webrtc::DataChannelInterface::kClosing);
-}
-
-bool MockDataChannel::Send(const webrtc::DataBuffer& buffer) {
-  return state_ == webrtc::DataChannelInterface::kOpen;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/mock_data_channel_impl.h b/chromium/content/renderer/media/webrtc/mock_data_channel_impl.h
deleted file mode 100644
index 6fbf726b3d9..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_data_channel_impl.h
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_DATA_CHANNEL_IMPL_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_DATA_CHANNEL_IMPL_H_
-
-#include <stdint.h>
-
-#include <string>
-
-#include "base/macros.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-
-namespace content {
-
-class MockDataChannel : public webrtc::DataChannelInterface {
- public:
-  MockDataChannel(const std::string& label,
-                  const webrtc::DataChannelInit* config);
-
-  void RegisterObserver(webrtc::DataChannelObserver* observer) override;
-  void UnregisterObserver() override;
-  std::string label() const override;
-  bool reliable() const override;
-  bool ordered() const override;
-  std::string protocol() const override;
-  bool negotiated() const override;
-  int id() const override;
-  DataState state() const override;
-  uint32_t messages_sent() const override;
-  uint64_t bytes_sent() const override;
-  uint32_t messages_received() const override;
-  uint64_t bytes_received() const override;
-  uint64_t buffered_amount() const override;
-  void Close() override;
-  bool Send(const webrtc::DataBuffer& buffer) override;
-
-  // For testing.
-  void changeState(DataState state);
-
- protected:
-  ~MockDataChannel() override;
-
- private:
-  std::string label_;
-  bool reliable_;
-  webrtc::DataChannelInterface::DataState state_;
-  webrtc::DataChannelInit config_;
-  webrtc::DataChannelObserver* observer_;
-
-  DISALLOW_COPY_AND_ASSIGN(MockDataChannel);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_DATA_CHANNEL_IMPL_H_
diff --git a/chromium/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc b/chromium/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc
deleted file mode 100644
index 066421a4217..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.cc
+++ /dev/null
@@ -1,394 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-
-#include <stddef.h>
-
-#include "base/logging.h"
-#include "base/strings/utf_string_conversions.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/webrtc/api/media_stream_interface.h"
-#include "third_party/webrtc/api/scoped_refptr.h"
-
-using webrtc::AudioSourceInterface;
-using webrtc::AudioTrackInterface;
-using webrtc::AudioTrackVector;
-using webrtc::IceCandidateCollection;
-using webrtc::IceCandidateInterface;
-using webrtc::MediaStreamInterface;
-using webrtc::ObserverInterface;
-using webrtc::SessionDescriptionInterface;
-using webrtc::VideoTrackSourceInterface;
-using webrtc::VideoTrackInterface;
-using webrtc::VideoTrackVector;
-
-namespace content {
-
-template <class V>
-static typename V::iterator FindTrack(V* vector,
-                                      const std::string& track_id) {
-  auto it = vector->begin();
-  for (; it != vector->end(); ++it) {
-    if ((*it)->id() == track_id) {
-      break;
-    }
-  }
-  return it;
-}
-
-MockWebRtcAudioSource::MockWebRtcAudioSource(bool is_remote)
-    : is_remote_(is_remote) {}
-void MockWebRtcAudioSource::RegisterObserver(ObserverInterface* observer) {}
-void MockWebRtcAudioSource::UnregisterObserver(ObserverInterface* observer) {}
-
-MockWebRtcAudioSource::SourceState MockWebRtcAudioSource::state() const {
-  return SourceState::kLive;
-}
-
-bool MockWebRtcAudioSource::remote() const {
-  return is_remote_;
-}
-
-MockMediaStream::MockMediaStream(const std::string& id) : id_(id) {}
-
-bool MockMediaStream::AddTrack(AudioTrackInterface* track) {
-  audio_track_vector_.push_back(track);
-  NotifyObservers();
-  return true;
-}
-
-bool MockMediaStream::AddTrack(VideoTrackInterface* track) {
-  video_track_vector_.push_back(track);
-  NotifyObservers();
-  return true;
-}
-
-bool MockMediaStream::RemoveTrack(AudioTrackInterface* track) {
-  auto it = FindTrack(&audio_track_vector_, track->id());
-  if (it == audio_track_vector_.end())
-    return false;
-  audio_track_vector_.erase(it);
-  NotifyObservers();
-  return true;
-}
-
-bool MockMediaStream::RemoveTrack(VideoTrackInterface* track) {
-  auto it = FindTrack(&video_track_vector_, track->id());
-  if (it == video_track_vector_.end())
-    return false;
-  video_track_vector_.erase(it);
-  NotifyObservers();
-  return true;
-}
-
-std::string MockMediaStream::id() const {
-  return id_;
-}
-
-AudioTrackVector MockMediaStream::GetAudioTracks() {
-  return audio_track_vector_;
-}
-
-VideoTrackVector MockMediaStream::GetVideoTracks() {
-  return video_track_vector_;
-}
-
-rtc::scoped_refptr<AudioTrackInterface> MockMediaStream::FindAudioTrack(
-    const std::string& track_id) {
-  auto it = FindTrack(&audio_track_vector_, track_id);
-  return it == audio_track_vector_.end() ? nullptr : *it;
-}
-
-rtc::scoped_refptr<VideoTrackInterface> MockMediaStream::FindVideoTrack(
-    const std::string& track_id) {
-  auto it = FindTrack(&video_track_vector_, track_id);
-  return it == video_track_vector_.end() ? nullptr : *it;
-}
-
-void MockMediaStream::RegisterObserver(ObserverInterface* observer) {
-  DCHECK(observers_.find(observer) == observers_.end());
-  observers_.insert(observer);
-}
-
-void MockMediaStream::UnregisterObserver(ObserverInterface* observer) {
-  auto it = observers_.find(observer);
-  DCHECK(it != observers_.end());
-  observers_.erase(it);
-}
-
-void MockMediaStream::NotifyObservers() {
-  for (auto it = observers_.begin(); it != observers_.end(); ++it) {
-    (*it)->OnChanged();
-  }
-}
-
-MockMediaStream::~MockMediaStream() {}
-
-scoped_refptr<MockWebRtcAudioTrack> MockWebRtcAudioTrack::Create(
-    const std::string& id) {
-  return new rtc::RefCountedObject<MockWebRtcAudioTrack>(id);
-}
-
-MockWebRtcAudioTrack::MockWebRtcAudioTrack(const std::string& id)
-    : id_(id),
-      source_(new rtc::RefCountedObject<MockWebRtcAudioSource>(true)),
-      enabled_(true),
-      state_(webrtc::MediaStreamTrackInterface::kLive) {}
-
-MockWebRtcAudioTrack::~MockWebRtcAudioTrack() {}
-
-std::string MockWebRtcAudioTrack::kind() const {
-  return kAudioKind;
-}
-
-webrtc::AudioSourceInterface* MockWebRtcAudioTrack::GetSource() const {
-  return source_.get();
-}
-
-std::string MockWebRtcAudioTrack::id() const {
-  return id_;
-}
-
-bool MockWebRtcAudioTrack::enabled() const {
-  return enabled_;
-}
-
-MockWebRtcVideoTrack::TrackState MockWebRtcAudioTrack::state() const {
-  return state_;
-}
-
-bool MockWebRtcAudioTrack::set_enabled(bool enable) {
-  enabled_ = enable;
-  return true;
-}
-
-void MockWebRtcAudioTrack::RegisterObserver(ObserverInterface* observer) {
-  DCHECK(observers_.find(observer) == observers_.end());
-  observers_.insert(observer);
-}
-
-void MockWebRtcAudioTrack::UnregisterObserver(ObserverInterface* observer) {
-  DCHECK(observers_.find(observer) != observers_.end());
-  observers_.erase(observer);
-}
-
-void MockWebRtcAudioTrack::SetEnded() {
-  DCHECK_EQ(webrtc::MediaStreamTrackInterface::kLive, state_);
-  state_ = webrtc::MediaStreamTrackInterface::kEnded;
-  for (auto* o : observers_)
-    o->OnChanged();
-}
-
-MockWebRtcVideoTrack::MockWebRtcVideoTrack(
-    const std::string& id,
-    webrtc::VideoTrackSourceInterface* source)
-    : id_(id),
-      source_(source),
-      enabled_(true),
-      state_(webrtc::MediaStreamTrackInterface::kLive),
-      sink_(nullptr) {}
-
-MockWebRtcVideoTrack::~MockWebRtcVideoTrack() {}
-
-scoped_refptr<MockWebRtcVideoTrack> MockWebRtcVideoTrack::Create(
-    const std::string& id) {
-  return new rtc::RefCountedObject<MockWebRtcVideoTrack>(id, nullptr);
-}
-
-void MockWebRtcVideoTrack::AddOrUpdateSink(
-    rtc::VideoSinkInterface<webrtc::VideoFrame>* sink,
-    const rtc::VideoSinkWants& wants) {
-  DCHECK(!sink_);
-  sink_ = sink;
-}
-
-void MockWebRtcVideoTrack::RemoveSink(
-    rtc::VideoSinkInterface<webrtc::VideoFrame>* sink) {
-  DCHECK(sink_ == sink);
-  sink_ = nullptr;
-}
-
-VideoTrackSourceInterface* MockWebRtcVideoTrack::GetSource() const {
-  return source_.get();
-}
-
-std::string MockWebRtcVideoTrack::kind() const {
-  return kVideoKind;
-}
-
-std::string MockWebRtcVideoTrack::id() const { return id_; }
-
-bool MockWebRtcVideoTrack::enabled() const { return enabled_; }
-
-MockWebRtcVideoTrack::TrackState MockWebRtcVideoTrack::state() const {
-  return state_;
-}
-
-bool MockWebRtcVideoTrack::set_enabled(bool enable) {
-  enabled_ = enable;
-  return true;
-}
-
-void MockWebRtcVideoTrack::RegisterObserver(ObserverInterface* observer) {
-  DCHECK(observers_.find(observer) == observers_.end());
-  observers_.insert(observer);
-}
-
-void MockWebRtcVideoTrack::UnregisterObserver(ObserverInterface* observer) {
-  DCHECK(observers_.find(observer) != observers_.end());
-  observers_.erase(observer);
-}
-
-void MockWebRtcVideoTrack::SetEnded() {
-  DCHECK_EQ(webrtc::MediaStreamTrackInterface::kLive, state_);
-  state_ = webrtc::MediaStreamTrackInterface::kEnded;
-  for (auto* o : observers_)
-    o->OnChanged();
-}
-
-class MockSessionDescription : public SessionDescriptionInterface {
- public:
-  MockSessionDescription(const std::string& type,
-                         const std::string& sdp)
-      : type_(type),
-        sdp_(sdp) {
-  }
-  ~MockSessionDescription() override {}
-  cricket::SessionDescription* description() override {
-    NOTIMPLEMENTED();
-    return nullptr;
-  }
-  const cricket::SessionDescription* description() const override {
-    NOTIMPLEMENTED();
-    return nullptr;
-  }
-  std::string session_id() const override {
-    NOTIMPLEMENTED();
-    return std::string();
-  }
-  std::string session_version() const override {
-    NOTIMPLEMENTED();
-    return std::string();
-  }
-  std::string type() const override { return type_; }
-  bool AddCandidate(const IceCandidateInterface* candidate) override {
-    NOTIMPLEMENTED();
-    return false;
-  }
-  size_t number_of_mediasections() const override {
-    NOTIMPLEMENTED();
-    return 0;
-  }
-  const IceCandidateCollection* candidates(
-      size_t mediasection_index) const override {
-    NOTIMPLEMENTED();
-    return nullptr;
-  }
-
-  bool ToString(std::string* out) const override {
-    *out = sdp_;
-    return true;
-  }
-
- private:
-  std::string type_;
-  std::string sdp_;
-};
-
-class MockIceCandidate : public IceCandidateInterface {
- public:
-  MockIceCandidate(const std::string& sdp_mid,
-                   int sdp_mline_index,
-                   const std::string& sdp)
-      : sdp_mid_(sdp_mid),
-        sdp_mline_index_(sdp_mline_index),
-        sdp_(sdp) {
-    // Assign an valid address to |candidate_| to pass assert in code.
-    candidate_.set_address(rtc::SocketAddress("127.0.0.1", 5000));
-  }
-  ~MockIceCandidate() override {}
-  std::string sdp_mid() const override { return sdp_mid_; }
-  int sdp_mline_index() const override { return sdp_mline_index_; }
-  const cricket::Candidate& candidate() const override { return candidate_; }
-  bool ToString(std::string* out) const override {
-    *out = sdp_;
-    return true;
-  }
-
- private:
-  std::string sdp_mid_;
-  int sdp_mline_index_;
-  std::string sdp_;
-  cricket::Candidate candidate_;
-};
-
-MockPeerConnectionDependencyFactory::MockPeerConnectionDependencyFactory()
-    : PeerConnectionDependencyFactory(nullptr),
-      signaling_thread_("MockPCFactory WebRtc Signaling Thread") {
-  EnsureWebRtcAudioDeviceImpl();
-  CHECK(signaling_thread_.Start());
-}
-
-MockPeerConnectionDependencyFactory::~MockPeerConnectionDependencyFactory() {}
-
-scoped_refptr<webrtc::PeerConnectionInterface>
-MockPeerConnectionDependencyFactory::CreatePeerConnection(
-    const webrtc::PeerConnectionInterface::RTCConfiguration& config,
-    blink::WebLocalFrame* frame,
-    webrtc::PeerConnectionObserver* observer) {
-  return new rtc::RefCountedObject<MockPeerConnectionImpl>(this, observer);
-}
-
-scoped_refptr<webrtc::VideoTrackSourceInterface>
-MockPeerConnectionDependencyFactory::CreateVideoTrackSourceProxy(
-    webrtc::VideoTrackSourceInterface* source) {
-  return nullptr;
-}
-scoped_refptr<webrtc::MediaStreamInterface>
-MockPeerConnectionDependencyFactory::CreateLocalMediaStream(
-    const std::string& label) {
-  return new rtc::RefCountedObject<MockMediaStream>(label);
-}
-
-scoped_refptr<webrtc::VideoTrackInterface>
-MockPeerConnectionDependencyFactory::CreateLocalVideoTrack(
-    const std::string& id,
-    webrtc::VideoTrackSourceInterface* source) {
-  scoped_refptr<webrtc::VideoTrackInterface> track(
-      new rtc::RefCountedObject<MockWebRtcVideoTrack>(
-          id, source));
-  return track;
-}
-
-SessionDescriptionInterface*
-MockPeerConnectionDependencyFactory::CreateSessionDescription(
-    const std::string& type,
-    const std::string& sdp,
-    webrtc::SdpParseError* error) {
-  if (fail_to_create_session_description_)
-    return nullptr;
-  return new MockSessionDescription(type, sdp);
-}
-
-webrtc::IceCandidateInterface*
-MockPeerConnectionDependencyFactory::CreateIceCandidate(
-    const std::string& sdp_mid,
-    int sdp_mline_index,
-    const std::string& sdp) {
-  return new MockIceCandidate(sdp_mid, sdp_mline_index, sdp);
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-MockPeerConnectionDependencyFactory::GetWebRtcSignalingThread() const {
-  return signaling_thread_.task_runner();
-}
-
-void MockPeerConnectionDependencyFactory::SetFailToCreateSessionDescription(
-    bool fail) {
-  fail_to_create_session_description_ = fail;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h b/chromium/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h
deleted file mode 100644
index 61e25246a2f..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h
+++ /dev/null
@@ -1,175 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_PEER_CONNECTION_DEPENDENCY_FACTORY_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_PEER_CONNECTION_DEPENDENCY_FACTORY_H_
-
-#include <set>
-#include <string>
-#include <vector>
-
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "base/single_thread_task_runner.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-#include "third_party/webrtc/api/media_stream_interface.h"
-
-namespace content {
-
-typedef std::set<webrtc::ObserverInterface*> ObserverSet;
-
-class MockWebRtcAudioSource : public webrtc::AudioSourceInterface {
- public:
-  MockWebRtcAudioSource(bool is_remote);
-  void RegisterObserver(webrtc::ObserverInterface* observer) override;
-  void UnregisterObserver(webrtc::ObserverInterface* observer) override;
-
-  SourceState state() const override;
-  bool remote() const override;
-
- private:
-  const bool is_remote_;
-};
-
-class MockWebRtcAudioTrack : public webrtc::AudioTrackInterface {
- public:
-  static scoped_refptr<MockWebRtcAudioTrack> Create(const std::string& id);
-
-  void AddSink(webrtc::AudioTrackSinkInterface* sink) override {}
-  void RemoveSink(webrtc::AudioTrackSinkInterface* sink) override {}
-  webrtc::AudioSourceInterface* GetSource() const override;
-
-  std::string kind() const override;
-  std::string id() const override;
-  bool enabled() const override;
-  webrtc::MediaStreamTrackInterface::TrackState state() const override;
-  bool set_enabled(bool enable) override;
-
-  void RegisterObserver(webrtc::ObserverInterface* observer) override;
-  void UnregisterObserver(webrtc::ObserverInterface* observer) override;
-
-  void SetEnded();
-
- protected:
-  MockWebRtcAudioTrack(const std::string& id);
-  ~MockWebRtcAudioTrack() override;
-
- private:
-  std::string id_;
-  scoped_refptr<webrtc::AudioSourceInterface> source_;
-  bool enabled_;
-  TrackState state_;
-  ObserverSet observers_;
-};
-
-class MockWebRtcVideoTrack : public webrtc::VideoTrackInterface {
- public:
-  static scoped_refptr<MockWebRtcVideoTrack> Create(const std::string& id);
-  MockWebRtcVideoTrack(const std::string& id,
-                       webrtc::VideoTrackSourceInterface* source);
-  void AddOrUpdateSink(rtc::VideoSinkInterface<webrtc::VideoFrame>* sink,
-                       const rtc::VideoSinkWants& wants) override;
-  void RemoveSink(rtc::VideoSinkInterface<webrtc::VideoFrame>* sink) override;
-  webrtc::VideoTrackSourceInterface* GetSource() const override;
-
-  std::string kind() const override;
-  std::string id() const override;
-  bool enabled() const override;
-  webrtc::MediaStreamTrackInterface::TrackState state() const override;
-  bool set_enabled(bool enable) override;
-
-  void RegisterObserver(webrtc::ObserverInterface* observer) override;
-  void UnregisterObserver(webrtc::ObserverInterface* observer) override;
-
-  void SetEnded();
-
- protected:
-  ~MockWebRtcVideoTrack() override;
-
- private:
-  std::string id_;
-  scoped_refptr<webrtc::VideoTrackSourceInterface> source_;
-  bool enabled_;
-  TrackState state_;
-  ObserverSet observers_;
-  rtc::VideoSinkInterface<webrtc::VideoFrame>* sink_;
-};
-
-class MockMediaStream : public webrtc::MediaStreamInterface {
- public:
-  explicit MockMediaStream(const std::string& id);
-
-  bool AddTrack(webrtc::AudioTrackInterface* track) override;
-  bool AddTrack(webrtc::VideoTrackInterface* track) override;
-  bool RemoveTrack(webrtc::AudioTrackInterface* track) override;
-  bool RemoveTrack(webrtc::VideoTrackInterface* track) override;
-  std::string id() const override;
-  webrtc::AudioTrackVector GetAudioTracks() override;
-  webrtc::VideoTrackVector GetVideoTracks() override;
-  rtc::scoped_refptr<webrtc::AudioTrackInterface> FindAudioTrack(
-      const std::string& track_id) override;
-  rtc::scoped_refptr<webrtc::VideoTrackInterface> FindVideoTrack(
-      const std::string& track_id) override;
-  void RegisterObserver(webrtc::ObserverInterface* observer) override;
-  void UnregisterObserver(webrtc::ObserverInterface* observer) override;
-
- protected:
-  ~MockMediaStream() override;
-
- private:
-  void NotifyObservers();
-
-  std::string id_;
-  webrtc::AudioTrackVector audio_track_vector_;
-  webrtc::VideoTrackVector video_track_vector_;
-
-  ObserverSet observers_;
-};
-
-// A mock factory for creating different objects for
-// RTC PeerConnections.
-class MockPeerConnectionDependencyFactory
-     : public PeerConnectionDependencyFactory {
- public:
-  MockPeerConnectionDependencyFactory();
-  ~MockPeerConnectionDependencyFactory() override;
-
-  scoped_refptr<webrtc::PeerConnectionInterface> CreatePeerConnection(
-      const webrtc::PeerConnectionInterface::RTCConfiguration& config,
-      blink::WebLocalFrame* frame,
-      webrtc::PeerConnectionObserver* observer) override;
-  scoped_refptr<webrtc::VideoTrackSourceInterface> CreateVideoTrackSourceProxy(
-      webrtc::VideoTrackSourceInterface* source) override;
-  scoped_refptr<webrtc::MediaStreamInterface> CreateLocalMediaStream(
-      const std::string& label) override;
-  scoped_refptr<webrtc::VideoTrackInterface> CreateLocalVideoTrack(
-      const std::string& id,
-      webrtc::VideoTrackSourceInterface* source) override;
-  webrtc::SessionDescriptionInterface* CreateSessionDescription(
-      const std::string& type,
-      const std::string& sdp,
-      webrtc::SdpParseError* error) override;
-  webrtc::IceCandidateInterface* CreateIceCandidate(
-      const std::string& sdp_mid,
-      int sdp_mline_index,
-      const std::string& sdp) override;
-
-  scoped_refptr<base::SingleThreadTaskRunner> GetWebRtcSignalingThread()
-      const override;
-
-  // If |fail| is true, subsequent calls to CreateSessionDescription will
-  // return nullptr. This can be used to fake a blob of SDP that fails to be
-  // parsed.
-  void SetFailToCreateSessionDescription(bool fail);
-
- private:
-  base::Thread signaling_thread_;
-  bool fail_to_create_session_description_ = false;
-
-  DISALLOW_COPY_AND_ASSIGN(MockPeerConnectionDependencyFactory);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_PEER_CONNECTION_DEPENDENCY_FACTORY_H_
diff --git a/chromium/content/renderer/media/webrtc/mock_peer_connection_impl.cc b/chromium/content/renderer/media/webrtc/mock_peer_connection_impl.cc
deleted file mode 100644
index 1e8e2fb3007..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_peer_connection_impl.cc
+++ /dev/null
@@ -1,533 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-
-#include <stddef.h>
-
-#include <utility>
-#include <vector>
-
-#include "base/logging.h"
-#include "base/stl_util.h"
-#include "content/renderer/media/webrtc/mock_data_channel_impl.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
-#include "third_party/webrtc/api/rtp_receiver_interface.h"
-#include "third_party/webrtc/rtc_base/ref_counted_object.h"
-
-using testing::_;
-using webrtc::AudioTrackInterface;
-using webrtc::CreateSessionDescriptionObserver;
-using webrtc::DtmfSenderInterface;
-using webrtc::DtmfSenderObserverInterface;
-using webrtc::IceCandidateInterface;
-using webrtc::MediaStreamInterface;
-using webrtc::PeerConnectionInterface;
-using webrtc::SessionDescriptionInterface;
-using webrtc::SetSessionDescriptionObserver;
-
-namespace content {
-
-class MockStreamCollection : public webrtc::StreamCollectionInterface {
- public:
-  size_t count() override { return streams_.size(); }
-  MediaStreamInterface* at(size_t index) override { return streams_[index]; }
-  MediaStreamInterface* find(const std::string& id) override {
-    for (size_t i = 0; i < streams_.size(); ++i) {
-      if (streams_[i]->id() == id)
-        return streams_[i];
-    }
-    return nullptr;
-  }
-  webrtc::MediaStreamTrackInterface* FindAudioTrack(
-      const std::string& id) override {
-    for (size_t i = 0; i < streams_.size(); ++i) {
-      webrtc::MediaStreamTrackInterface* track =
-          streams_.at(i)->FindAudioTrack(id);
-      if (track)
-        return track;
-    }
-    return nullptr;
-  }
-  webrtc::MediaStreamTrackInterface* FindVideoTrack(
-      const std::string& id) override {
-    for (size_t i = 0; i < streams_.size(); ++i) {
-      webrtc::MediaStreamTrackInterface* track =
-          streams_.at(i)->FindVideoTrack(id);
-      if (track)
-        return track;
-    }
-    return nullptr;
-  }
-  void AddStream(MediaStreamInterface* stream) {
-    streams_.push_back(stream);
-  }
-  void RemoveStream(MediaStreamInterface* stream) {
-    auto it = streams_.begin();
-    for (; it != streams_.end(); ++it) {
-      if (it->get() == stream) {
-        streams_.erase(it);
-        break;
-      }
-    }
-  }
-
- protected:
-  ~MockStreamCollection() override {}
-
- private:
-  typedef std::vector<rtc::scoped_refptr<MediaStreamInterface> >
-      StreamVector;
-  StreamVector streams_;
-};
-
-class MockDtmfSender : public DtmfSenderInterface {
- public:
-  void RegisterObserver(DtmfSenderObserverInterface* observer) override {
-    observer_ = observer;
-  }
-  void UnregisterObserver() override { observer_ = nullptr; }
-  bool CanInsertDtmf() override { return true; }
-  bool InsertDtmf(const std::string& tones,
-                  int duration,
-                  int inter_tone_gap) override {
-    tones_ = tones;
-    duration_ = duration;
-    inter_tone_gap_ = inter_tone_gap;
-    return true;
-  }
-  std::string tones() const override { return tones_; }
-  int duration() const override { return duration_; }
-  int inter_tone_gap() const override { return inter_tone_gap_; }
-
- private:
-  DtmfSenderObserverInterface* observer_ = nullptr;
-  std::string tones_;
-  int duration_ = 0;
-  int inter_tone_gap_ = 0;
-};
-
-FakeRtpSender::FakeRtpSender(
-    rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-    std::vector<std::string> stream_ids)
-    : track_(std::move(track)), stream_ids_(std::move(stream_ids)) {}
-
-FakeRtpSender::~FakeRtpSender() {}
-
-bool FakeRtpSender::SetTrack(webrtc::MediaStreamTrackInterface* track) {
-  NOTIMPLEMENTED();
-  return false;
-}
-
-rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> FakeRtpSender::track()
-    const {
-  return track_;
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-FakeRtpSender::dtls_transport() const {
-  return transport_;
-}
-
-uint32_t FakeRtpSender::ssrc() const {
-  NOTIMPLEMENTED();
-  return 0;
-}
-
-cricket::MediaType FakeRtpSender::media_type() const {
-  NOTIMPLEMENTED();
-  return cricket::MEDIA_TYPE_AUDIO;
-}
-
-std::string FakeRtpSender::id() const {
-  NOTIMPLEMENTED();
-  return "";
-}
-
-std::vector<std::string> FakeRtpSender::stream_ids() const {
-  return stream_ids_;
-}
-
-std::vector<webrtc::RtpEncodingParameters> FakeRtpSender::init_send_encodings()
-    const {
-  return {};
-}
-
-webrtc::RtpParameters FakeRtpSender::GetParameters() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpParameters();
-}
-
-webrtc::RTCError FakeRtpSender::SetParameters(
-    const webrtc::RtpParameters& parameters) {
-  NOTIMPLEMENTED();
-  return webrtc::RTCError::OK();
-}
-
-rtc::scoped_refptr<webrtc::DtmfSenderInterface> FakeRtpSender::GetDtmfSender()
-    const {
-  return new rtc::RefCountedObject<MockDtmfSender>();
-}
-
-FakeRtpReceiver::FakeRtpReceiver(
-    rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-    std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>> streams)
-    : track_(std::move(track)), streams_(std::move(streams)) {}
-
-FakeRtpReceiver::~FakeRtpReceiver() {}
-
-rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> FakeRtpReceiver::track()
-    const {
-  return track_;
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-FakeRtpReceiver::dtls_transport() const {
-  return transport_;
-}
-
-std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>
-FakeRtpReceiver::streams() const {
-  return streams_;
-}
-
-std::vector<std::string> FakeRtpReceiver::stream_ids() const {
-  std::vector<std::string> stream_ids;
-  for (const auto& stream : streams_)
-    stream_ids.push_back(stream->id());
-  return stream_ids;
-}
-
-cricket::MediaType FakeRtpReceiver::media_type() const {
-  NOTIMPLEMENTED();
-  return cricket::MEDIA_TYPE_AUDIO;
-}
-
-std::string FakeRtpReceiver::id() const {
-  NOTIMPLEMENTED();
-  return "";
-}
-
-webrtc::RtpParameters FakeRtpReceiver::GetParameters() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpParameters();
-}
-
-bool FakeRtpReceiver::SetParameters(const webrtc::RtpParameters& parameters) {
-  NOTIMPLEMENTED();
-  return false;
-}
-
-void FakeRtpReceiver::SetObserver(
-    webrtc::RtpReceiverObserverInterface* observer) {
-  NOTIMPLEMENTED();
-}
-
-void FakeRtpReceiver::SetJitterBufferMinimumDelay(
-    absl::optional<double> delay_seconds) {
-  NOTIMPLEMENTED();
-}
-
-std::vector<webrtc::RtpSource> FakeRtpReceiver::GetSources() const {
-  NOTIMPLEMENTED();
-  return std::vector<webrtc::RtpSource>();
-}
-
-FakeRtpTransceiver::FakeRtpTransceiver(
-    cricket::MediaType media_type,
-    rtc::scoped_refptr<FakeRtpSender> sender,
-    rtc::scoped_refptr<FakeRtpReceiver> receiver,
-    base::Optional<std::string> mid,
-    bool stopped,
-    webrtc::RtpTransceiverDirection direction,
-    base::Optional<webrtc::RtpTransceiverDirection> current_direction)
-    : media_type_(media_type),
-      sender_(std::move(sender)),
-      receiver_(std::move(receiver)),
-      mid_(blink::ToAbslOptional(std::move(mid))),
-      stopped_(stopped),
-      direction_(direction),
-      current_direction_(blink::ToAbslOptional(current_direction)) {}
-
-FakeRtpTransceiver::~FakeRtpTransceiver() {}
-
-cricket::MediaType FakeRtpTransceiver::media_type() const {
-  return media_type_;
-}
-
-absl::optional<std::string> FakeRtpTransceiver::mid() const {
-  return mid_;
-}
-
-rtc::scoped_refptr<webrtc::RtpSenderInterface> FakeRtpTransceiver::sender()
-    const {
-  return sender_;
-}
-
-rtc::scoped_refptr<webrtc::RtpReceiverInterface> FakeRtpTransceiver::receiver()
-    const {
-  return receiver_;
-}
-
-bool FakeRtpTransceiver::stopped() const {
-  return stopped_;
-}
-
-webrtc::RtpTransceiverDirection FakeRtpTransceiver::direction() const {
-  return direction_;
-}
-
-void FakeRtpTransceiver::SetDirection(
-    webrtc::RtpTransceiverDirection new_direction) {
-  NOTIMPLEMENTED();
-}
-
-absl::optional<webrtc::RtpTransceiverDirection>
-FakeRtpTransceiver::current_direction() const {
-  return current_direction_;
-}
-
-void FakeRtpTransceiver::Stop() {
-  NOTIMPLEMENTED();
-}
-
-void FakeRtpTransceiver::SetTransport(
-    rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport) {
-  sender_->SetTransport(transport);
-  receiver_->SetTransport(transport);
-}
-
-FakeDtlsTransport::FakeDtlsTransport() {}
-
-rtc::scoped_refptr<webrtc::IceTransportInterface>
-FakeDtlsTransport::ice_transport() {
-  return nullptr;
-}
-
-webrtc::DtlsTransportInformation FakeDtlsTransport::Information() {
-  return webrtc::DtlsTransportInformation(webrtc::DtlsTransportState::kNew);
-}
-
-const char MockPeerConnectionImpl::kDummyOffer[] = "dummy offer";
-const char MockPeerConnectionImpl::kDummyAnswer[] = "dummy answer";
-
-MockPeerConnectionImpl::MockPeerConnectionImpl(
-    MockPeerConnectionDependencyFactory* factory,
-    webrtc::PeerConnectionObserver* observer)
-    : dependency_factory_(factory),
-      remote_streams_(new rtc::RefCountedObject<MockStreamCollection>),
-      hint_audio_(false),
-      hint_video_(false),
-      getstats_result_(true),
-      sdp_mline_index_(-1),
-      observer_(observer) {
-  ON_CALL(*this, SetLocalDescription(_, _)).WillByDefault(testing::Invoke(
-      this, &MockPeerConnectionImpl::SetLocalDescriptionWorker));
-  // TODO(hbos): Remove once no longer mandatory to implement.
-  ON_CALL(*this, SetRemoteDescription(_, _)).WillByDefault(testing::Invoke(
-      this, &MockPeerConnectionImpl::SetRemoteDescriptionWorker));
-  ON_CALL(*this, SetRemoteDescriptionForMock(_, _))
-      .WillByDefault(testing::Invoke(
-          [this](
-              std::unique_ptr<webrtc::SessionDescriptionInterface>* desc,
-              rtc::scoped_refptr<webrtc::SetRemoteDescriptionObserverInterface>*
-                  observer) {
-            SetRemoteDescriptionWorker(nullptr, desc->release());
-          }));
-}
-
-MockPeerConnectionImpl::~MockPeerConnectionImpl() {}
-
-webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpSenderInterface>>
-MockPeerConnectionImpl::AddTrack(
-    rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-    const std::vector<std::string>& stream_ids) {
-  DCHECK(track);
-  DCHECK_EQ(1u, stream_ids.size());
-  for (const auto& sender : senders_) {
-    if (sender->track() == track)
-      return webrtc::RTCError(webrtc::RTCErrorType::INVALID_PARAMETER);
-  }
-  for (const auto& stream_id : stream_ids) {
-    if (!base::Contains(local_stream_ids_, stream_id)) {
-      stream_label_ = stream_id;
-      local_stream_ids_.push_back(stream_id);
-    }
-  }
-  auto* sender = new rtc::RefCountedObject<FakeRtpSender>(track, stream_ids);
-  senders_.push_back(sender);
-  return rtc::scoped_refptr<webrtc::RtpSenderInterface>(sender);
-}
-
-bool MockPeerConnectionImpl::RemoveTrack(webrtc::RtpSenderInterface* s) {
-  rtc::scoped_refptr<FakeRtpSender> sender = static_cast<FakeRtpSender*>(s);
-  auto it = std::find(senders_.begin(), senders_.end(), sender);
-  if (it == senders_.end())
-    return false;
-  senders_.erase(it);
-  auto track = sender->track();
-
-  for (const auto& stream_id : sender->stream_ids()) {
-    auto local_stream_it = std::find(local_stream_ids_.begin(),
-                                     local_stream_ids_.end(), stream_id);
-    if (local_stream_it != local_stream_ids_.end())
-      local_stream_ids_.erase(local_stream_it);
-  }
-  return true;
-}
-
-std::vector<rtc::scoped_refptr<webrtc::RtpSenderInterface>>
-MockPeerConnectionImpl::GetSenders() const {
-  std::vector<rtc::scoped_refptr<webrtc::RtpSenderInterface>> senders;
-  for (const auto& sender : senders_)
-    senders.push_back(sender);
-  return senders;
-}
-
-std::vector<rtc::scoped_refptr<webrtc::RtpReceiverInterface>>
-MockPeerConnectionImpl::GetReceivers() const {
-  std::vector<rtc::scoped_refptr<webrtc::RtpReceiverInterface>> receivers;
-  for (size_t i = 0; i < remote_streams_->count(); ++i) {
-    for (const auto& audio_track : remote_streams_->at(i)->GetAudioTracks()) {
-      receivers.push_back(
-          new rtc::RefCountedObject<FakeRtpReceiver>(audio_track));
-    }
-    for (const auto& video_track : remote_streams_->at(i)->GetVideoTracks()) {
-      receivers.push_back(
-          new rtc::RefCountedObject<FakeRtpReceiver>(video_track));
-    }
-  }
-  return receivers;
-}
-
-rtc::scoped_refptr<webrtc::DataChannelInterface>
-MockPeerConnectionImpl::CreateDataChannel(const std::string& label,
-                      const webrtc::DataChannelInit* config) {
-  return new rtc::RefCountedObject<MockDataChannel>(label, config);
-}
-
-bool MockPeerConnectionImpl::GetStats(
-    webrtc::StatsObserver* observer,
-    webrtc::MediaStreamTrackInterface* track,
-    StatsOutputLevel level) {
-  if (!getstats_result_)
-    return false;
-
-  DCHECK_EQ(kStatsOutputLevelStandard, level);
-  webrtc::StatsReport report1(webrtc::StatsReport::NewTypedId(
-      webrtc::StatsReport::kStatsReportTypeSsrc, "1234"));
-  webrtc::StatsReport report2(webrtc::StatsReport::NewTypedId(
-      webrtc::StatsReport::kStatsReportTypeSession, "nontrack"));
-  report1.set_timestamp(42);
-  report1.AddString(webrtc::StatsReport::kStatsValueNameFingerprint,
-                    "trackvalue");
-
-  webrtc::StatsReports reports;
-  reports.push_back(&report1);
-
-  // If selector is given, we pass back one report.
-  // If selector is not given, we pass back two.
-  if (!track) {
-    report2.set_timestamp(44);
-    report2.AddString(webrtc::StatsReport::kStatsValueNameFingerprintAlgorithm,
-                      "somevalue");
-    reports.push_back(&report2);
-  }
-
-  // Note that the callback is synchronous, not asynchronous; it will
-  // happen before the request call completes.
-  observer->OnComplete(reports);
-
-  return true;
-}
-
-void MockPeerConnectionImpl::GetStats(
-    webrtc::RTCStatsCollectorCallback* callback) {
-  DCHECK(callback);
-  DCHECK(stats_report_);
-  callback->OnStatsDelivered(stats_report_);
-}
-
-void MockPeerConnectionImpl::GetStats(
-    rtc::scoped_refptr<webrtc::RtpSenderInterface> selector,
-    rtc::scoped_refptr<webrtc::RTCStatsCollectorCallback> callback) {
-  callback->OnStatsDelivered(stats_report_);
-}
-
-void MockPeerConnectionImpl::GetStats(
-    rtc::scoped_refptr<webrtc::RtpReceiverInterface> selector,
-    rtc::scoped_refptr<webrtc::RTCStatsCollectorCallback> callback) {
-  callback->OnStatsDelivered(stats_report_);
-}
-
-void MockPeerConnectionImpl::SetGetStatsReport(webrtc::RTCStatsReport* report) {
-  stats_report_ = report;
-}
-
-const webrtc::SessionDescriptionInterface*
-MockPeerConnectionImpl::local_description() const {
-  return local_desc_.get();
-}
-
-const webrtc::SessionDescriptionInterface*
-MockPeerConnectionImpl::remote_description() const {
-  return remote_desc_.get();
-}
-
-void MockPeerConnectionImpl::AddRemoteStream(MediaStreamInterface* stream) {
-  remote_streams_->AddStream(stream);
-}
-
-void MockPeerConnectionImpl::CreateOffer(
-    CreateSessionDescriptionObserver* observer,
-    const RTCOfferAnswerOptions& options) {
-  DCHECK(observer);
-  created_sessiondescription_.reset(
-      dependency_factory_->CreateSessionDescription("unknown", kDummyOffer,
-                                                    nullptr));
-}
-
-void MockPeerConnectionImpl::CreateAnswer(
-    CreateSessionDescriptionObserver* observer,
-    const RTCOfferAnswerOptions& options) {
-  DCHECK(observer);
-  created_sessiondescription_.reset(
-      dependency_factory_->CreateSessionDescription("unknown", kDummyAnswer,
-                                                    nullptr));
-}
-
-void MockPeerConnectionImpl::SetLocalDescriptionWorker(
-    SetSessionDescriptionObserver* observer,
-    SessionDescriptionInterface* desc) {
-  desc->ToString(&description_sdp_);
-  local_desc_.reset(desc);
-}
-
-void MockPeerConnectionImpl::SetRemoteDescriptionWorker(
-    SetSessionDescriptionObserver* observer,
-    SessionDescriptionInterface* desc) {
-  desc->ToString(&description_sdp_);
-  remote_desc_.reset(desc);
-}
-
-webrtc::RTCError MockPeerConnectionImpl::SetConfiguration(
-    const RTCConfiguration& configuration) {
-  return webrtc::RTCError(setconfiguration_error_type_);
-}
-
-bool MockPeerConnectionImpl::AddIceCandidate(
-    const IceCandidateInterface* candidate) {
-  sdp_mid_ = candidate->sdp_mid();
-  sdp_mline_index_ = candidate->sdp_mline_index();
-  return candidate->ToString(&ice_sdp_);
-}
-
-webrtc::RTCError MockPeerConnectionImpl::SetBitrate(
-    const webrtc::BitrateSettings& bitrate) {
-  NOTIMPLEMENTED();
-  return webrtc::RTCError::OK();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/mock_peer_connection_impl.h b/chromium/content/renderer/media/webrtc/mock_peer_connection_impl.h
deleted file mode 100644
index dff3766a214..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_peer_connection_impl.h
+++ /dev/null
@@ -1,394 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_PEER_CONNECTION_IMPL_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_PEER_CONNECTION_IMPL_H_
-
-#include <memory>
-#include <string>
-
-#include "base/compiler_specific.h"
-#include "base/logging.h"
-#include "base/macros.h"
-#include "base/optional.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "third_party/webrtc/api/dtls_transport_interface.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-#include "third_party/webrtc/api/sctp_transport_interface.h"
-#include "third_party/webrtc/api/stats/rtc_stats_report.h"
-
-namespace content {
-
-class MockPeerConnectionDependencyFactory;
-class MockStreamCollection;
-
-class FakeRtpSender : public webrtc::RtpSenderInterface {
- public:
-  FakeRtpSender(rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-                std::vector<std::string> stream_ids);
-  ~FakeRtpSender() override;
-
-  bool SetTrack(webrtc::MediaStreamTrackInterface* track) override;
-  rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track() const override;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> dtls_transport()
-      const override;
-  uint32_t ssrc() const override;
-  cricket::MediaType media_type() const override;
-  std::string id() const override;
-  std::vector<std::string> stream_ids() const override;
-  std::vector<webrtc::RtpEncodingParameters> init_send_encodings()
-      const override;
-  webrtc::RtpParameters GetParameters() const override;
-  webrtc::RTCError SetParameters(
-      const webrtc::RtpParameters& parameters) override;
-  rtc::scoped_refptr<webrtc::DtmfSenderInterface> GetDtmfSender()
-      const override;
-  void SetTransport(
-      rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport) {
-    transport_ = transport;
-  }
-
- private:
-  rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track_;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport_;
-  std::vector<std::string> stream_ids_;
-};
-
-class FakeRtpReceiver : public webrtc::RtpReceiverInterface {
- public:
-  FakeRtpReceiver(rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-                  std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>
-                      streams = {});
-  ~FakeRtpReceiver() override;
-
-  rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track() const override;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> dtls_transport()
-      const override;
-  std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>> streams()
-      const override;
-  std::vector<std::string> stream_ids() const override;
-  cricket::MediaType media_type() const override;
-  std::string id() const override;
-  webrtc::RtpParameters GetParameters() const override;
-  bool SetParameters(const webrtc::RtpParameters& parameters) override;
-  void SetObserver(webrtc::RtpReceiverObserverInterface* observer) override;
-  void SetJitterBufferMinimumDelay(
-      absl::optional<double> delay_seconds) override;
-  std::vector<webrtc::RtpSource> GetSources() const override;
-  void SetTransport(
-      rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport) {
-    transport_ = transport;
-  }
-
- private:
-  rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track_;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport_;
-  std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>> streams_;
-};
-
-class FakeRtpTransceiver : public webrtc::RtpTransceiverInterface {
- public:
-  FakeRtpTransceiver(
-      cricket::MediaType media_type,
-      rtc::scoped_refptr<FakeRtpSender> sender,
-      rtc::scoped_refptr<FakeRtpReceiver> receiver,
-      base::Optional<std::string> mid,
-      bool stopped,
-      webrtc::RtpTransceiverDirection direction,
-      base::Optional<webrtc::RtpTransceiverDirection> current_direction);
-  ~FakeRtpTransceiver() override;
-
-  FakeRtpTransceiver& operator=(const FakeRtpTransceiver& other) = default;
-
-  cricket::MediaType media_type() const override;
-  absl::optional<std::string> mid() const override;
-  rtc::scoped_refptr<webrtc::RtpSenderInterface> sender() const override;
-  rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver() const override;
-  bool stopped() const override;
-  webrtc::RtpTransceiverDirection direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection new_direction) override;
-  absl::optional<webrtc::RtpTransceiverDirection> current_direction()
-      const override;
-  void Stop() override;
-  void SetTransport(
-      rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport);
-
- private:
-  cricket::MediaType media_type_;
-  rtc::scoped_refptr<FakeRtpSender> sender_;
-  rtc::scoped_refptr<FakeRtpReceiver> receiver_;
-  absl::optional<std::string> mid_;
-  bool stopped_;
-  webrtc::RtpTransceiverDirection direction_;
-  absl::optional<webrtc::RtpTransceiverDirection> current_direction_;
-};
-
-class FakeDtlsTransport : public webrtc::DtlsTransportInterface {
- public:
-  FakeDtlsTransport();
-  rtc::scoped_refptr<webrtc::IceTransportInterface> ice_transport() override;
-  webrtc::DtlsTransportInformation Information() override;
-  void RegisterObserver(
-      webrtc::DtlsTransportObserverInterface* observer) override {}
-  void UnregisterObserver() override {}
-};
-
-// TODO(hbos): The use of fakes and mocks is the wrong approach for testing of
-// this. It introduces complexity, is error prone (not testing the right thing
-// and bugs in the mocks). This class is a maintenance burden and should be
-// removed. https://crbug.com/788659
-class MockPeerConnectionImpl : public webrtc::PeerConnectionInterface {
- public:
-  explicit MockPeerConnectionImpl(MockPeerConnectionDependencyFactory* factory,
-                                  webrtc::PeerConnectionObserver* observer);
-
-  // PeerConnectionInterface implementation.
-  rtc::scoped_refptr<webrtc::StreamCollectionInterface> local_streams()
-      override {
-    NOTIMPLEMENTED();
-    return nullptr;
-  }
-  rtc::scoped_refptr<webrtc::StreamCollectionInterface> remote_streams()
-      override {
-    NOTIMPLEMENTED();
-    return nullptr;
-  }
-  bool AddStream(webrtc::MediaStreamInterface* local_stream) override {
-    NOTIMPLEMENTED();
-    return false;
-  }
-  void RemoveStream(webrtc::MediaStreamInterface* local_stream) override {
-    NOTIMPLEMENTED();
-  }
-  webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-  AddTransceiver(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track) override {
-    NOTIMPLEMENTED();
-    return webrtc::RTCErrorOr<
-        rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>();
-  }
-  webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-  AddTransceiver(rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-                 const webrtc::RtpTransceiverInit& init) override {
-    NOTIMPLEMENTED();
-    return webrtc::RTCErrorOr<
-        rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>();
-  }
-
-  webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-  AddTransceiver(cricket::MediaType media_type) override {
-    NOTIMPLEMENTED();
-    return webrtc::RTCErrorOr<
-        rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>();
-  }
-  webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-  AddTransceiver(cricket::MediaType media_type,
-                 const webrtc::RtpTransceiverInit& init) override {
-    NOTIMPLEMENTED();
-    return webrtc::RTCErrorOr<
-        rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>();
-  }
-
-  rtc::scoped_refptr<webrtc::RtpSenderInterface> CreateSender(
-      const std::string& kind,
-      const std::string& stream_id) override {
-    NOTIMPLEMENTED();
-    return nullptr;
-  }
-
-  webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpSenderInterface>> AddTrack(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-      const std::vector<std::string>& stream_ids) override;
-  bool RemoveTrack(webrtc::RtpSenderInterface* sender) override;
-  std::vector<rtc::scoped_refptr<webrtc::RtpSenderInterface>> GetSenders()
-      const override;
-  std::vector<rtc::scoped_refptr<webrtc::RtpReceiverInterface>> GetReceivers()
-      const override;
-  std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-  GetTransceivers() const override {
-    return {};
-  }
-  MOCK_CONST_METHOD0(GetSctpTransport,
-                     rtc::scoped_refptr<webrtc::SctpTransportInterface>());
-  rtc::scoped_refptr<webrtc::DataChannelInterface>
-      CreateDataChannel(const std::string& label,
-                        const webrtc::DataChannelInit* config) override;
-
-  bool GetStats(webrtc::StatsObserver* observer,
-                webrtc::MediaStreamTrackInterface* track,
-                StatsOutputLevel level) override;
-  void GetStats(webrtc::RTCStatsCollectorCallback* callback) override;
-  void GetStats(
-      rtc::scoped_refptr<webrtc::RtpSenderInterface> selector,
-      rtc::scoped_refptr<webrtc::RTCStatsCollectorCallback> callback) override;
-  void GetStats(
-      rtc::scoped_refptr<webrtc::RtpReceiverInterface> selector,
-      rtc::scoped_refptr<webrtc::RTCStatsCollectorCallback> callback) override;
-
-  // Call this function to make sure next call to legacy GetStats fail.
-  void SetGetStatsResult(bool result) { getstats_result_ = result; }
-  // Set the report that |GetStats(RTCStatsCollectorCallback*)| returns.
-  void SetGetStatsReport(webrtc::RTCStatsReport* report);
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> LookupDtlsTransportByMid(
-      const std::string& mid) override {
-    return nullptr;
-  }
-
-  SignalingState signaling_state() override {
-    NOTIMPLEMENTED();
-    return PeerConnectionInterface::kStable;
-  }
-  IceConnectionState ice_connection_state() override {
-    NOTIMPLEMENTED();
-    return PeerConnectionInterface::kIceConnectionNew;
-  }
-  IceConnectionState standardized_ice_connection_state() override {
-    NOTIMPLEMENTED();
-    return PeerConnectionInterface::kIceConnectionNew;
-  }
-
-  PeerConnectionState peer_connection_state() override {
-    NOTIMPLEMENTED();
-    return PeerConnectionState::kNew;
-  }
-
-  IceGatheringState ice_gathering_state() override {
-    NOTIMPLEMENTED();
-    return PeerConnectionInterface::kIceGatheringNew;
-  }
-
-  bool StartRtcEventLog(std::unique_ptr<webrtc::RtcEventLogOutput> output,
-                        int64_t output_period_ms) override {
-    NOTIMPLEMENTED();
-    return false;
-  }
-  bool StartRtcEventLog(
-      std::unique_ptr<webrtc::RtcEventLogOutput> output) override {
-    NOTIMPLEMENTED();
-    return false;
-  }
-  void StopRtcEventLog() override { NOTIMPLEMENTED(); }
-
-  MOCK_METHOD0(Close, void());
-
-  const webrtc::SessionDescriptionInterface* local_description() const override;
-  const webrtc::SessionDescriptionInterface* remote_description()
-      const override;
-  const webrtc::SessionDescriptionInterface* current_local_description()
-      const override {
-    return nullptr;
-  }
-  const webrtc::SessionDescriptionInterface* current_remote_description()
-      const override {
-    return nullptr;
-  }
-  const webrtc::SessionDescriptionInterface* pending_local_description()
-      const override {
-    return nullptr;
-  }
-  const webrtc::SessionDescriptionInterface* pending_remote_description()
-      const override {
-    return nullptr;
-  }
-
-  // JSEP01 APIs
-  void CreateOffer(webrtc::CreateSessionDescriptionObserver* observer,
-                   const RTCOfferAnswerOptions& options) override;
-  void CreateAnswer(webrtc::CreateSessionDescriptionObserver* observer,
-                    const RTCOfferAnswerOptions& options) override;
-  MOCK_METHOD2(SetLocalDescription,
-               void(webrtc::SetSessionDescriptionObserver* observer,
-                    webrtc::SessionDescriptionInterface* desc));
-  void SetLocalDescriptionWorker(
-      webrtc::SetSessionDescriptionObserver* observer,
-      webrtc::SessionDescriptionInterface* desc);
-  // TODO(hbos): Remove once no longer mandatory to implement.
-  MOCK_METHOD2(SetRemoteDescription,
-               void(webrtc::SetSessionDescriptionObserver* observer,
-                    webrtc::SessionDescriptionInterface* desc));
-  void SetRemoteDescription(
-      std::unique_ptr<webrtc::SessionDescriptionInterface> desc,
-      rtc::scoped_refptr<webrtc::SetRemoteDescriptionObserverInterface>
-          observer) override {
-    SetRemoteDescriptionForMock(&desc, &observer);
-  }
-  // Work-around due to MOCK_METHOD being unable to handle move-only arguments.
-  MOCK_METHOD2(
-      SetRemoteDescriptionForMock,
-      void(std::unique_ptr<webrtc::SessionDescriptionInterface>* desc,
-           rtc::scoped_refptr<webrtc::SetRemoteDescriptionObserverInterface>*
-               observer));
-  void SetRemoteDescriptionWorker(
-      webrtc::SetSessionDescriptionObserver* observer,
-      webrtc::SessionDescriptionInterface* desc);
-  webrtc::PeerConnectionInterface::RTCConfiguration GetConfiguration() {
-    NOTIMPLEMENTED();
-    return webrtc::PeerConnectionInterface::RTCConfiguration();
-  }
-  webrtc::RTCError SetConfiguration(
-      const RTCConfiguration& configuration) override;
-
-  bool AddIceCandidate(const webrtc::IceCandidateInterface* candidate) override;
-  bool RemoveIceCandidates(
-      const std::vector<cricket::Candidate>& candidates) override {
-    NOTIMPLEMENTED();
-    return false;
-  }
-
-  webrtc::RTCError SetBitrate(const webrtc::BitrateSettings& bitrate) override;
-
-  void AddRemoteStream(webrtc::MediaStreamInterface* stream);
-
-  const std::string& stream_label() const { return stream_label_; }
-  bool hint_audio() const { return hint_audio_; }
-  bool hint_video() const { return hint_video_; }
-  const std::string& description_sdp() const { return description_sdp_; }
-  const std::string& sdp_mid() const { return sdp_mid_; }
-  int sdp_mline_index() const { return sdp_mline_index_; }
-  const std::string& ice_sdp() const { return ice_sdp_; }
-  webrtc::SessionDescriptionInterface* created_session_description() const {
-    return created_sessiondescription_.get();
-  }
-  webrtc::PeerConnectionObserver* observer() {
-    return observer_;
-  }
-  void set_setconfiguration_error_type(webrtc::RTCErrorType error_type) {
-    setconfiguration_error_type_ = error_type;
-  }
-  static const char kDummyOffer[];
-  static const char kDummyAnswer[];
-
- protected:
-  ~MockPeerConnectionImpl() override;
-
- private:
-  // Used for creating MockSessionDescription.
-  MockPeerConnectionDependencyFactory* dependency_factory_;
-
-  std::string stream_label_;
-  std::vector<std::string> local_stream_ids_;
-  rtc::scoped_refptr<MockStreamCollection> remote_streams_;
-  std::vector<rtc::scoped_refptr<FakeRtpSender>> senders_;
-  std::unique_ptr<webrtc::SessionDescriptionInterface> local_desc_;
-  std::unique_ptr<webrtc::SessionDescriptionInterface> remote_desc_;
-  std::unique_ptr<webrtc::SessionDescriptionInterface>
-      created_sessiondescription_;
-  bool hint_audio_;
-  bool hint_video_;
-  bool getstats_result_;
-  std::string description_sdp_;
-  std::string sdp_mid_;
-  int sdp_mline_index_;
-  std::string ice_sdp_;
-  webrtc::PeerConnectionObserver* observer_;
-  webrtc::RTCErrorType setconfiguration_error_type_ =
-      webrtc::RTCErrorType::NONE;
-  rtc::scoped_refptr<webrtc::RTCStatsReport> stats_report_;
-
-  DISALLOW_COPY_AND_ASSIGN(MockPeerConnectionImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_PEER_CONNECTION_IMPL_H_
diff --git a/chromium/content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.cc b/chromium/content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.cc
deleted file mode 100644
index 880ab858371..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.cc
+++ /dev/null
@@ -1,53 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-#include "content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h"
-
-#include "base/logging.h"
-#include "base/strings/utf_string_conversions.h"
-#include "third_party/blink/public/platform/web_media_stream.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_receiver.h"
-#include "third_party/blink/public/platform/web_string.h"
-
-using testing::_;
-
-namespace content {
-
-MockWebRTCPeerConnectionHandlerClient::MockWebRTCPeerConnectionHandlerClient() {
-  ON_CALL(*this, DidGenerateICECandidate(_))
-      .WillByDefault(
-          testing::Invoke(this, &MockWebRTCPeerConnectionHandlerClient::
-                                    didGenerateICECandidateWorker));
-  ON_CALL(*this, DidAddReceiverPlanBForMock(_))
-      .WillByDefault(testing::Invoke(
-          this, &MockWebRTCPeerConnectionHandlerClient::didAddReceiverWorker));
-  ON_CALL(*this, DidRemoveReceiverPlanBForMock(_))
-      .WillByDefault(testing::Invoke(
-          this,
-          &MockWebRTCPeerConnectionHandlerClient::didRemoveReceiverWorker));
-}
-
-MockWebRTCPeerConnectionHandlerClient::
-~MockWebRTCPeerConnectionHandlerClient() {}
-
-void MockWebRTCPeerConnectionHandlerClient::didGenerateICECandidateWorker(
-    scoped_refptr<blink::WebRTCICECandidate> candidate) {
-  candidate_sdp_ = candidate->Candidate().Utf8();
-  candidate_mline_index_ = candidate->SdpMLineIndex();
-  candidate_mid_ = candidate->SdpMid().Utf8();
-}
-
-void MockWebRTCPeerConnectionHandlerClient::didAddReceiverWorker(
-    std::unique_ptr<blink::WebRTCRtpReceiver>* web_rtp_receiver) {
-  blink::WebVector<blink::WebString> stream_ids =
-      (*web_rtp_receiver)->StreamIds();
-  DCHECK_EQ(1u, stream_ids.size());
-  remote_stream_id_ = stream_ids[0];
-}
-
-void MockWebRTCPeerConnectionHandlerClient::didRemoveReceiverWorker(
-    std::unique_ptr<blink::WebRTCRtpReceiver>* web_rtp_receiver) {
-  remote_stream_id_ = blink::WebString();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h b/chromium/content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h
deleted file mode 100644
index 1a9c6445cb9..00000000000
--- a/chromium/content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h
+++ /dev/null
@@ -1,104 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_WEB_RTC_PEER_CONNECTION_HANDLER_CLIENT_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_WEB_RTC_PEER_CONNECTION_HANDLER_CLIENT_H_
-
-#include <memory>
-#include <string>
-#include <vector>
-
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "third_party/blink/public/platform/web_media_stream.h"
-#include "third_party/blink/public/platform/web_rtc_ice_candidate.h"
-#include "third_party/blink/public/platform/web_rtc_peer_connection_handler_client.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_receiver.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_transceiver.h"
-
-namespace content {
-
-class MockWebRTCPeerConnectionHandlerClient
-    : public blink::WebRTCPeerConnectionHandlerClient {
- public:
-  MockWebRTCPeerConnectionHandlerClient();
-  ~MockWebRTCPeerConnectionHandlerClient() override;
-
-  // WebRTCPeerConnectionHandlerClient implementation.
-  MOCK_METHOD0(NegotiationNeeded, void());
-  MOCK_METHOD1(DidGenerateICECandidate,
-               void(scoped_refptr<blink::WebRTCICECandidate> candidate));
-  MOCK_METHOD4(DidFailICECandidate,
-               void(const blink::WebString& host_candidate,
-                    const blink::WebString& url,
-                    int error_code,
-                    const blink::WebString& error_text));
-  MOCK_METHOD1(DidChangeSignalingState,
-               void(webrtc::PeerConnectionInterface::SignalingState state));
-  MOCK_METHOD1(DidChangeIceGatheringState,
-               void(webrtc::PeerConnectionInterface::IceGatheringState state));
-  MOCK_METHOD1(DidChangeIceConnectionState,
-               void(webrtc::PeerConnectionInterface::IceConnectionState state));
-  MOCK_METHOD1(
-      DidChangePeerConnectionState,
-      void(webrtc::PeerConnectionInterface::PeerConnectionState state));
-  void DidAddReceiverPlanB(
-      std::unique_ptr<blink::WebRTCRtpReceiver> web_rtp_receiver) override {
-    DidAddReceiverPlanBForMock(&web_rtp_receiver);
-  }
-  void DidRemoveReceiverPlanB(
-      std::unique_ptr<blink::WebRTCRtpReceiver> web_rtp_receiver) override {
-    DidRemoveReceiverPlanBForMock(&web_rtp_receiver);
-  }
-  MOCK_METHOD1(DidModifySctpTransport,
-               void(blink::WebRTCSctpTransportSnapshot snapshot));
-  void DidModifyTransceivers(
-      blink::WebVector<std::unique_ptr<blink::WebRTCRtpTransceiver>>
-          web_transceivers,
-      bool is_remote_description) override {
-    DidModifyTransceiversForMock(&web_transceivers, is_remote_description);
-  }
-  MOCK_METHOD1(DidAddRemoteDataChannel,
-               void(scoped_refptr<webrtc::DataChannelInterface>));
-  MOCK_METHOD1(DidNoteInterestingUsage, void(int));
-  MOCK_METHOD0(ReleasePeerConnectionHandler, void());
-
-  // Move-only arguments do not play nicely with MOCK, the workaround is to
-  // EXPECT_CALL with these instead.
-  MOCK_METHOD1(DidAddReceiverPlanBForMock,
-               void(std::unique_ptr<blink::WebRTCRtpReceiver>*));
-  MOCK_METHOD1(DidRemoveReceiverPlanBForMock,
-               void(std::unique_ptr<blink::WebRTCRtpReceiver>*));
-  MOCK_METHOD2(
-      DidModifyTransceiversForMock,
-      void(blink::WebVector<std::unique_ptr<blink::WebRTCRtpTransceiver>>*,
-           bool));
-
-  void didGenerateICECandidateWorker(
-      scoped_refptr<blink::WebRTCICECandidate> candidate);
-  void didAddReceiverWorker(
-      std::unique_ptr<blink::WebRTCRtpReceiver>* stream_web_rtp_receivers);
-  void didRemoveReceiverWorker(
-      std::unique_ptr<blink::WebRTCRtpReceiver>* stream_web_rtp_receivers);
-
-  const std::string& candidate_sdp() const { return candidate_sdp_; }
-  const base::Optional<uint16_t>& candidate_mlineindex() const {
-    return candidate_mline_index_;
-  }
-  const std::string& candidate_mid() const { return candidate_mid_ ; }
-  const blink::WebString& remote_stream_id() const { return remote_stream_id_; }
-
- private:
-  blink::WebString remote_stream_id_;
-  std::string candidate_sdp_;
-  base::Optional<uint16_t> candidate_mline_index_;
-  std::string candidate_mid_;
-
-  DISALLOW_COPY_AND_ASSIGN(MockWebRTCPeerConnectionHandlerClient);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_MOCK_WEB_RTC_PEER_CONNECTION_HANDLER_CLIENT_H_
diff --git a/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory.cc b/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory.cc
deleted file mode 100644
index bafde269f38..00000000000
--- a/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory.cc
+++ /dev/null
@@ -1,675 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-
-#include <stddef.h>
-
-#include <memory>
-#include <utility>
-#include <vector>
-
-#include "base/bind.h"
-#include "base/bind_helpers.h"
-#include "base/command_line.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/macros.h"
-#include "base/metrics/field_trial.h"
-#include "base/strings/string_util.h"
-#include "base/strings/utf_string_conversions.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "build/build_config.h"
-#include "content/public/common/content_client.h"
-#include "content/public/common/content_features.h"
-#include "content/public/common/content_switches.h"
-#include "content/public/common/webrtc_ip_handling_policy.h"
-#include "content/public/renderer/content_renderer_client.h"
-#include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
-#include "content/renderer/media/webrtc/stun_field_trial.h"
-#include "content/renderer/media/webrtc/video_codec_factory.h"
-#include "content/renderer/p2p/empty_network_manager.h"
-#include "content/renderer/p2p/filtering_network_manager.h"
-#include "content/renderer/p2p/ipc_network_manager.h"
-#include "content/renderer/p2p/ipc_socket_factory.h"
-#include "content/renderer/p2p/mdns_responder_adapter.h"
-#include "content/renderer/p2p/port_allocator.h"
-#include "content/renderer/render_frame_impl.h"
-#include "content/renderer/render_thread_impl.h"
-#include "content/renderer/render_view_impl.h"
-#include "crypto/openssl_util.h"
-#include "jingle/glue/thread_wrapper.h"
-#include "media/base/media_permission.h"
-#include "media/media_buildflags.h"
-#include "media/video/gpu_video_accelerator_factories.h"
-#include "third_party/blink/public/common/features.h"
-#include "third_party/blink/public/platform/modules/mediastream/webrtc_uma_histograms.h"
-#include "third_party/blink/public/platform/modules/peerconnection/audio_codec_factory.h"
-#include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
-#include "third_party/blink/public/platform/web_media_constraints.h"
-#include "third_party/blink/public/platform/web_media_stream.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_url.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_video_source.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_video_track.h"
-#include "third_party/blink/public/web/modules/webrtc/webrtc_audio_device_impl.h"
-#include "third_party/blink/public/web/web_document.h"
-#include "third_party/blink/public/web/web_local_frame.h"
-#include "third_party/webrtc/api/call/call_factory_interface.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-#include "third_party/webrtc/api/rtc_event_log/rtc_event_log_factory.h"
-#include "third_party/webrtc/api/video_track_source_proxy.h"
-#include "third_party/webrtc/media/engine/fake_video_codec_factory.h"
-#include "third_party/webrtc/media/engine/multiplex_codec_factory.h"
-#include "third_party/webrtc/media/engine/webrtc_media_engine.h"
-#include "third_party/webrtc/modules/audio_processing/include/audio_processing.h"
-#include "third_party/webrtc/modules/video_coding/codecs/h264/include/h264.h"
-#include "third_party/webrtc/rtc_base/ref_counted_object.h"
-#include "third_party/webrtc/rtc_base/ssl_adapter.h"
-#include "third_party/webrtc_overrides/task_queue_factory.h"
-
-namespace content {
-
-namespace {
-
-enum WebRTCIPHandlingPolicy {
-  DEFAULT,
-  DEFAULT_PUBLIC_AND_PRIVATE_INTERFACES,
-  DEFAULT_PUBLIC_INTERFACE_ONLY,
-  DISABLE_NON_PROXIED_UDP,
-};
-
-WebRTCIPHandlingPolicy GetWebRTCIPHandlingPolicy(
-    const std::string& preference) {
-  if (preference == kWebRTCIPHandlingDefaultPublicAndPrivateInterfaces)
-    return DEFAULT_PUBLIC_AND_PRIVATE_INTERFACES;
-  if (preference == kWebRTCIPHandlingDefaultPublicInterfaceOnly)
-    return DEFAULT_PUBLIC_INTERFACE_ONLY;
-  if (preference == kWebRTCIPHandlingDisableNonProxiedUdp)
-    return DISABLE_NON_PROXIED_UDP;
-  return DEFAULT;
-}
-
-bool IsValidPortRange(uint16_t min_port, uint16_t max_port) {
-  DCHECK(min_port <= max_port);
-  return min_port != 0 && max_port != 0;
-}
-
-// PeerConnectionDependencies wants to own the factory, so we provide a simple
-// object that delegates calls to the IpcPacketSocketFactory.
-// TODO(zstein): Move the creation logic from IpcPacketSocketFactory in to this
-// class.
-class ProxyAsyncResolverFactory final : public webrtc::AsyncResolverFactory {
- public:
-  ProxyAsyncResolverFactory(IpcPacketSocketFactory* ipc_psf)
-      : ipc_psf_(ipc_psf) {
-    DCHECK(ipc_psf);
-  }
-
-  rtc::AsyncResolverInterface* Create() override {
-    return ipc_psf_->CreateAsyncResolver();
-  }
-
- private:
-  IpcPacketSocketFactory* ipc_psf_;
-};
-
-}  // namespace
-
-PeerConnectionDependencyFactory::PeerConnectionDependencyFactory(
-    P2PSocketDispatcher* p2p_socket_dispatcher)
-    : network_manager_(nullptr),
-      p2p_socket_dispatcher_(p2p_socket_dispatcher),
-      signaling_thread_(nullptr),
-      worker_thread_(nullptr),
-      chrome_signaling_thread_("Chrome_libJingle_Signaling"),
-      chrome_worker_thread_("Chrome_libJingle_WorkerThread") {
-  TryScheduleStunProbeTrial();
-}
-
-PeerConnectionDependencyFactory::~PeerConnectionDependencyFactory() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  DVLOG(1) << "~PeerConnectionDependencyFactory()";
-  DCHECK(!pc_factory_);
-}
-
-std::unique_ptr<blink::WebRTCPeerConnectionHandler>
-PeerConnectionDependencyFactory::CreateRTCPeerConnectionHandler(
-    blink::WebRTCPeerConnectionHandlerClient* client,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  // Save histogram data so we can see how much PeerConnetion is used.
-  // The histogram counts the number of calls to the JS API
-  // webKitRTCPeerConnection.
-  UpdateWebRTCMethodCount(blink::WebRTCAPIName::kRTCPeerConnection);
-
-  return std::make_unique<RTCPeerConnectionHandler>(client, this, task_runner);
-}
-
-const scoped_refptr<webrtc::PeerConnectionFactoryInterface>&
-PeerConnectionDependencyFactory::GetPcFactory() {
-  if (!pc_factory_.get())
-    CreatePeerConnectionFactory();
-  CHECK(pc_factory_.get());
-  return pc_factory_;
-}
-
-void PeerConnectionDependencyFactory::WillDestroyCurrentMessageLoop() {
-  CleanupPeerConnectionFactory();
-}
-
-void PeerConnectionDependencyFactory::CreatePeerConnectionFactory() {
-  DCHECK(!pc_factory_.get());
-  DCHECK(!signaling_thread_);
-  DCHECK(!worker_thread_);
-  DCHECK(!network_manager_);
-  DCHECK(!socket_factory_);
-  DCHECK(!chrome_signaling_thread_.IsRunning());
-  DCHECK(!chrome_worker_thread_.IsRunning());
-
-  DVLOG(1) << "PeerConnectionDependencyFactory::CreatePeerConnectionFactory()";
-
-#if BUILDFLAG(RTC_USE_H264) && BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS)
-  // Building /w |rtc_use_h264|, is the corresponding run-time feature enabled?
-  if (!base::FeatureList::IsEnabled(
-          blink::features::kWebRtcH264WithOpenH264FFmpeg)) {
-    // Feature is to be disabled.
-    webrtc::DisableRtcUseH264();
-  }
-#else
-  webrtc::DisableRtcUseH264();
-#endif  // BUILDFLAG(RTC_USE_H264) && BUILDFLAG(ENABLE_FFMPEG_VIDEO_DECODERS)
-
-  base::MessageLoopCurrent::Get()->AddDestructionObserver(this);
-  // To allow sending to the signaling/worker threads.
-  jingle_glue::JingleThreadWrapper::EnsureForCurrentMessageLoop();
-  jingle_glue::JingleThreadWrapper::current()->set_send_allowed(true);
-
-  EnsureWebRtcAudioDeviceImpl();
-
-  CHECK(chrome_signaling_thread_.Start());
-  CHECK(chrome_worker_thread_.Start());
-
-  base::WaitableEvent start_worker_event(
-      base::WaitableEvent::ResetPolicy::MANUAL,
-      base::WaitableEvent::InitialState::NOT_SIGNALED);
-  chrome_worker_thread_.task_runner()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&PeerConnectionDependencyFactory::InitializeWorkerThread,
-                     base::Unretained(this), &worker_thread_,
-                     &start_worker_event));
-
-  base::WaitableEvent create_network_manager_event(
-      base::WaitableEvent::ResetPolicy::MANUAL,
-      base::WaitableEvent::InitialState::NOT_SIGNALED);
-  std::unique_ptr<MdnsResponderAdapter> mdns_responder;
-#if BUILDFLAG(ENABLE_MDNS)
-  if (base::FeatureList::IsEnabled(features::kWebRtcHideLocalIpsWithMdns)) {
-    // Note that MdnsResponderAdapter is created on the main thread to have
-    // access to the connector to the service manager.
-    mdns_responder = std::make_unique<MdnsResponderAdapter>();
-  }
-#endif  // BUILDFLAG(ENABLE_MDNS)
-  chrome_worker_thread_.task_runner()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&PeerConnectionDependencyFactory::
-                         CreateIpcNetworkManagerOnWorkerThread,
-                     base::Unretained(this), &create_network_manager_event,
-                     std::move(mdns_responder)));
-
-  start_worker_event.Wait();
-  create_network_manager_event.Wait();
-
-  CHECK(worker_thread_);
-
-  // Init SSL, which will be needed by PeerConnection.
-  if (!rtc::InitializeSSL()) {
-    LOG(ERROR) << "Failed on InitializeSSL.";
-    NOTREACHED();
-    return;
-  }
-
-  base::WaitableEvent start_signaling_event(
-      base::WaitableEvent::ResetPolicy::MANUAL,
-      base::WaitableEvent::InitialState::NOT_SIGNALED);
-  chrome_signaling_thread_.task_runner()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &PeerConnectionDependencyFactory::InitializeSignalingThread,
-          base::Unretained(this),
-          RenderThreadImpl::current()->GetGpuFactories(),
-          &start_signaling_event));
-
-  start_signaling_event.Wait();
-  CHECK(signaling_thread_);
-}
-
-void PeerConnectionDependencyFactory::InitializeSignalingThread(
-    media::GpuVideoAcceleratorFactories* gpu_factories,
-    base::WaitableEvent* event) {
-  DCHECK(chrome_signaling_thread_.task_runner()->BelongsToCurrentThread());
-  DCHECK(worker_thread_);
-  DCHECK(p2p_socket_dispatcher_.get());
-
-  jingle_glue::JingleThreadWrapper::EnsureForCurrentMessageLoop();
-  jingle_glue::JingleThreadWrapper::current()->set_send_allowed(true);
-  signaling_thread_ = jingle_glue::JingleThreadWrapper::current();
-
-  net::NetworkTrafficAnnotationTag traffic_annotation =
-      net::DefineNetworkTrafficAnnotation("webrtc_peer_connection", R"(
-        semantics {
-          sender: "WebRTC"
-          description:
-            "WebRTC is an API that provides web applications with Real Time "
-            "Communication (RTC) capabilities. It is used to establish a "
-            "secure session with a remote peer, transmitting and receiving "
-            "audio, video and potentially other data."
-          trigger:
-            "Application creates an RTCPeerConnection and connects it to a "
-            "remote peer by exchanging an SDP offer and answer."
-          data:
-            "Media encrypted using DTLS-SRTP, and protocol-level messages for "
-            "the various subprotocols employed by WebRTC (including ICE, DTLS, "
-            "RTCP, etc.). Note that ICE connectivity checks may leak the "
-            "user's IP address(es), subject to the restrictions/guidance in "
-            "https://datatracker.ietf.org/doc/draft-ietf-rtcweb-ip-handling."
-          destination: OTHER
-          destination_other:
-            "A destination determined by the web application that created the "
-            "connection."
-        }
-        policy {
-          cookies_allowed: NO
-          setting:
-            "This feature cannot be disabled in settings, but it won't be used "
-            "unless the application creates an RTCPeerConnection. Media can "
-            "only be captured with user's consent, but data may be sent "
-            "withouth that."
-          policy_exception_justification:
-            "Not implemented. 'WebRtcUdpPortRange' policy can limit the range "
-            "of ports used by WebRTC, but there is no policy to generally "
-            "block it."
-        }
-    )");
-  socket_factory_.reset(new IpcPacketSocketFactory(p2p_socket_dispatcher_.get(),
-                                                   traffic_annotation));
-
-  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
-
-  std::unique_ptr<webrtc::VideoEncoderFactory> webrtc_encoder_factory =
-      CreateWebrtcVideoEncoderFactory(gpu_factories);
-  std::unique_ptr<webrtc::VideoDecoderFactory> webrtc_decoder_factory =
-      CreateWebrtcVideoDecoderFactory(gpu_factories);
-
-  // Enable Multiplex codec in SDP optionally.
-  if (base::FeatureList::IsEnabled(features::kWebRtcMultiplexCodec)) {
-    webrtc_encoder_factory = std::make_unique<webrtc::MultiplexEncoderFactory>(
-        std::move(webrtc_encoder_factory));
-    webrtc_decoder_factory = std::make_unique<webrtc::MultiplexDecoderFactory>(
-        std::move(webrtc_decoder_factory));
-  }
-
-  if (cmd_line->HasSwitch(switches::kUseFakeCodecForPeerConnection)) {
-    webrtc_encoder_factory =
-        std::make_unique<webrtc::FakeVideoEncoderFactory>();
-    webrtc_decoder_factory =
-        std::make_unique<webrtc::FakeVideoDecoderFactory>();
-  }
-
-  webrtc::PeerConnectionFactoryDependencies pcf_deps;
-  pcf_deps.worker_thread = worker_thread_;
-  pcf_deps.network_thread = worker_thread_;
-  pcf_deps.signaling_thread = signaling_thread_;
-  pcf_deps.task_queue_factory = CreateWebRtcTaskQueueFactory();
-  pcf_deps.call_factory = webrtc::CreateCallFactory();
-  pcf_deps.event_log_factory = std::make_unique<webrtc::RtcEventLogFactory>(
-      pcf_deps.task_queue_factory.get());
-  cricket::MediaEngineDependencies media_deps;
-  media_deps.task_queue_factory = pcf_deps.task_queue_factory.get();
-  media_deps.adm = audio_device_.get();
-  media_deps.audio_encoder_factory = blink::CreateWebrtcAudioEncoderFactory();
-  media_deps.audio_decoder_factory = blink::CreateWebrtcAudioDecoderFactory();
-  media_deps.video_encoder_factory = std::move(webrtc_encoder_factory);
-  media_deps.video_decoder_factory = std::move(webrtc_decoder_factory);
-  media_deps.audio_processing = webrtc::AudioProcessingBuilder().Create();
-  pcf_deps.media_engine = cricket::CreateMediaEngine(std::move(media_deps));
-  pc_factory_ = webrtc::CreateModularPeerConnectionFactory(std::move(pcf_deps));
-  CHECK(pc_factory_.get());
-
-  webrtc::PeerConnectionFactoryInterface::Options factory_options;
-  factory_options.disable_sctp_data_channels = false;
-  factory_options.disable_encryption =
-      cmd_line->HasSwitch(switches::kDisableWebRtcEncryption);
-  pc_factory_->SetOptions(factory_options);
-
-  event->Signal();
-}
-
-bool PeerConnectionDependencyFactory::PeerConnectionFactoryCreated() {
-  return pc_factory_.get() != nullptr;
-}
-
-scoped_refptr<webrtc::PeerConnectionInterface>
-PeerConnectionDependencyFactory::CreatePeerConnection(
-    const webrtc::PeerConnectionInterface::RTCConfiguration& config,
-    blink::WebLocalFrame* web_frame,
-    webrtc::PeerConnectionObserver* observer) {
-  CHECK(web_frame);
-  CHECK(observer);
-  if (!GetPcFactory().get())
-    return nullptr;
-
-  webrtc::PeerConnectionDependencies dependencies(observer);
-  dependencies.allocator = CreatePortAllocator(web_frame);
-  dependencies.async_resolver_factory = CreateAsyncResolverFactory();
-  return GetPcFactory()
-      ->CreatePeerConnection(config, std::move(dependencies))
-      .get();
-}
-
-std::unique_ptr<P2PPortAllocator>
-PeerConnectionDependencyFactory::CreatePortAllocator(
-    blink::WebLocalFrame* web_frame) {
-  DCHECK(web_frame);
-
-  // Copy the flag from Preference associated with this WebLocalFrame.
-  P2PPortAllocator::Config port_config;
-  uint16_t min_port = 0;
-  uint16_t max_port = 0;
-
-  // |media_permission| will be called to check mic/camera permission. If at
-  // least one of them is granted, P2PPortAllocator is allowed to gather local
-  // host IP addresses as ICE candidates. |media_permission| could be nullptr,
-  // which means the permission will be granted automatically. This could be the
-  // case when either the experiment is not enabled or the preference is not
-  // enforced.
-  //
-  // Note on |media_permission| lifetime: |media_permission| is owned by a frame
-  // (RenderFrameImpl). It is also stored as an indirect member of
-  // RTCPeerConnectionHandler (through PeerConnection/PeerConnectionInterface ->
-  // P2PPortAllocator -> FilteringNetworkManager -> |media_permission|).
-  // The RTCPeerConnectionHandler is owned as RTCPeerConnection::m_peerHandler
-  // in Blink, which will be reset in RTCPeerConnection::stop(). Since
-  // ActiveDOMObject::stop() is guaranteed to be called before a frame is
-  // detached, it is impossible for RTCPeerConnectionHandler to outlive the
-  // frame. Therefore using a raw pointer of |media_permission| is safe here.
-  media::MediaPermission* media_permission = nullptr;
-  if (!GetContentClient()
-           ->renderer()
-           ->ShouldEnforceWebRTCRoutingPreferences()) {
-    port_config.enable_multiple_routes = true;
-    port_config.enable_nonproxied_udp = true;
-    VLOG(3) << "WebRTC routing preferences will not be enforced";
-  } else {
-    if (web_frame && web_frame->View()) {
-      RenderViewImpl* renderer_view_impl =
-          RenderViewImpl::FromWebView(web_frame->View());
-      if (renderer_view_impl) {
-        // TODO(guoweis): |enable_multiple_routes| should be renamed to
-        // |request_multiple_routes|. Whether local IP addresses could be
-        // collected depends on if mic/camera permission is granted for this
-        // origin.
-        WebRTCIPHandlingPolicy policy =
-            GetWebRTCIPHandlingPolicy(renderer_view_impl->renderer_preferences()
-                                          .webrtc_ip_handling_policy);
-        switch (policy) {
-          // TODO(guoweis): specify the flag of disabling local candidate
-          // collection when webrtc is updated.
-          case DEFAULT_PUBLIC_INTERFACE_ONLY:
-          case DEFAULT_PUBLIC_AND_PRIVATE_INTERFACES:
-            port_config.enable_multiple_routes = false;
-            port_config.enable_nonproxied_udp = true;
-            port_config.enable_default_local_candidate =
-                (policy == DEFAULT_PUBLIC_AND_PRIVATE_INTERFACES);
-            break;
-          case DISABLE_NON_PROXIED_UDP:
-            port_config.enable_multiple_routes = false;
-            port_config.enable_nonproxied_udp = false;
-            break;
-          case DEFAULT:
-            port_config.enable_multiple_routes = true;
-            port_config.enable_nonproxied_udp = true;
-            break;
-        }
-
-        min_port =
-            renderer_view_impl->renderer_preferences().webrtc_udp_min_port;
-        max_port =
-            renderer_view_impl->renderer_preferences().webrtc_udp_max_port;
-
-        VLOG(3) << "WebRTC routing preferences: "
-                << "policy: " << policy
-                << ", multiple_routes: " << port_config.enable_multiple_routes
-                << ", nonproxied_udp: " << port_config.enable_nonproxied_udp
-                << ", min_udp_port: " << min_port
-                << ", max_udp_port: " << max_port;
-      }
-    }
-    if (port_config.enable_multiple_routes) {
-      bool create_media_permission =
-          base::CommandLine::ForCurrentProcess()->HasSwitch(
-              switches::kEnforceWebRtcIPPermissionCheck);
-      create_media_permission =
-          create_media_permission ||
-          !StartsWith(base::FieldTrialList::FindFullName(
-                          "WebRTC-LocalIPPermissionCheck"),
-                      "Disabled", base::CompareCase::SENSITIVE);
-      if (create_media_permission) {
-        content::RenderFrameImpl* render_frame =
-            content::RenderFrameImpl::FromWebFrame(web_frame);
-        if (render_frame)
-          media_permission = render_frame->GetMediaPermission();
-        DCHECK(media_permission);
-      }
-    }
-  }
-
-  const GURL& requesting_origin =
-      GURL(web_frame->GetDocument().Url()).GetOrigin();
-
-  std::unique_ptr<rtc::NetworkManager> network_manager;
-  if (port_config.enable_multiple_routes) {
-    network_manager = std::make_unique<FilteringNetworkManager>(
-        network_manager_.get(), requesting_origin, media_permission);
-  } else {
-    network_manager =
-        std::make_unique<EmptyNetworkManager>(network_manager_.get());
-  }
-  auto port_allocator = std::make_unique<P2PPortAllocator>(
-      p2p_socket_dispatcher_, std::move(network_manager), socket_factory_.get(),
-      port_config, requesting_origin);
-  if (IsValidPortRange(min_port, max_port))
-    port_allocator->SetPortRange(min_port, max_port);
-
-  return port_allocator;
-}
-
-std::unique_ptr<webrtc::AsyncResolverFactory>
-PeerConnectionDependencyFactory::CreateAsyncResolverFactory() {
-  return std::make_unique<ProxyAsyncResolverFactory>(socket_factory_.get());
-}
-
-scoped_refptr<webrtc::MediaStreamInterface>
-PeerConnectionDependencyFactory::CreateLocalMediaStream(
-    const std::string& label) {
-  return GetPcFactory()->CreateLocalMediaStream(label).get();
-}
-
-scoped_refptr<webrtc::VideoTrackSourceInterface>
-PeerConnectionDependencyFactory::CreateVideoTrackSourceProxy(
-    webrtc::VideoTrackSourceInterface* source) {
-  // PeerConnectionFactory needs to be instantiated to make sure that
-  // signaling_thread_ and worker_thread_ exist.
-  if (!PeerConnectionFactoryCreated())
-    CreatePeerConnectionFactory();
-
-  return webrtc::VideoTrackSourceProxy::Create(signaling_thread_,
-                                               worker_thread_, source)
-      .get();
-}
-
-scoped_refptr<webrtc::VideoTrackInterface>
-PeerConnectionDependencyFactory::CreateLocalVideoTrack(
-    const std::string& id,
-    webrtc::VideoTrackSourceInterface* source) {
-  return GetPcFactory()->CreateVideoTrack(id, source).get();
-}
-
-webrtc::SessionDescriptionInterface*
-PeerConnectionDependencyFactory::CreateSessionDescription(
-    const std::string& type,
-    const std::string& sdp,
-    webrtc::SdpParseError* error) {
-  return webrtc::CreateSessionDescription(type, sdp, error);
-}
-
-webrtc::IceCandidateInterface*
-PeerConnectionDependencyFactory::CreateIceCandidate(
-    const std::string& sdp_mid,
-    int sdp_mline_index,
-    const std::string& sdp) {
-  return webrtc::CreateIceCandidate(sdp_mid, sdp_mline_index, sdp, nullptr);
-}
-
-blink::WebRtcAudioDeviceImpl*
-PeerConnectionDependencyFactory::GetWebRtcAudioDevice() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  EnsureWebRtcAudioDeviceImpl();
-  return audio_device_.get();
-}
-
-void PeerConnectionDependencyFactory::InitializeWorkerThread(
-    rtc::Thread** thread,
-    base::WaitableEvent* event) {
-  jingle_glue::JingleThreadWrapper::EnsureForCurrentMessageLoop();
-  jingle_glue::JingleThreadWrapper::current()->set_send_allowed(true);
-  *thread = jingle_glue::JingleThreadWrapper::current();
-  event->Signal();
-}
-
-void PeerConnectionDependencyFactory::TryScheduleStunProbeTrial() {
-  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
-
-  if (!cmd_line->HasSwitch(switches::kWebRtcStunProbeTrialParameter))
-    return;
-
-  GetPcFactory();
-
-  const std::string params =
-      cmd_line->GetSwitchValueASCII(switches::kWebRtcStunProbeTrialParameter);
-
-  chrome_worker_thread_.task_runner()->PostDelayedTask(
-      FROM_HERE,
-      base::BindOnce(
-          &PeerConnectionDependencyFactory::StartStunProbeTrialOnWorkerThread,
-          base::Unretained(this), params),
-      base::TimeDelta::FromMilliseconds(kExperimentStartDelayMs));
-}
-
-void PeerConnectionDependencyFactory::StartStunProbeTrialOnWorkerThread(
-    const std::string& params) {
-  DCHECK(network_manager_);
-  DCHECK(chrome_worker_thread_.task_runner()->BelongsToCurrentThread());
-  stun_trial_.reset(new StunProberTrial(network_manager_.get(), params,
-                                        socket_factory_.get()));
-}
-
-void PeerConnectionDependencyFactory::CreateIpcNetworkManagerOnWorkerThread(
-    base::WaitableEvent* event,
-    std::unique_ptr<MdnsResponderAdapter> mdns_responder) {
-  DCHECK(chrome_worker_thread_.task_runner()->BelongsToCurrentThread());
-  network_manager_ = std::make_unique<IpcNetworkManager>(
-      p2p_socket_dispatcher_.get(), std::move(mdns_responder));
-  event->Signal();
-}
-
-void PeerConnectionDependencyFactory::DeleteIpcNetworkManager() {
-  DCHECK(chrome_worker_thread_.task_runner()->BelongsToCurrentThread());
-  network_manager_.reset();
-}
-
-void PeerConnectionDependencyFactory::CleanupPeerConnectionFactory() {
-  DVLOG(1) << "PeerConnectionDependencyFactory::CleanupPeerConnectionFactory()";
-  pc_factory_ = nullptr;
-  if (network_manager_) {
-    // The network manager needs to free its resources on the thread they were
-    // created, which is the worked thread.
-    if (chrome_worker_thread_.IsRunning()) {
-      chrome_worker_thread_.task_runner()->PostTask(
-          FROM_HERE,
-          base::BindOnce(
-              &PeerConnectionDependencyFactory::DeleteIpcNetworkManager,
-              base::Unretained(this)));
-      // Stopping the thread will wait until all tasks have been
-      // processed before returning. We wait for the above task to finish before
-      // letting the the function continue to avoid any potential race issues.
-      chrome_worker_thread_.Stop();
-    } else {
-      NOTREACHED() << "Worker thread not running.";
-    }
-  }
-}
-
-void PeerConnectionDependencyFactory::EnsureInitialized() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  GetPcFactory();
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-PeerConnectionDependencyFactory::GetWebRtcWorkerThread() const {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return chrome_worker_thread_.IsRunning() ? chrome_worker_thread_.task_runner()
-                                           : nullptr;
-}
-
-rtc::Thread* PeerConnectionDependencyFactory::GetWebRtcWorkerThreadRtcThread()
-    const {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return chrome_worker_thread_.IsRunning() ? worker_thread_ : nullptr;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-PeerConnectionDependencyFactory::GetWebRtcSignalingThread() const {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return chrome_signaling_thread_.IsRunning()
-             ? chrome_signaling_thread_.task_runner()
-             : nullptr;
-}
-
-void PeerConnectionDependencyFactory::EnsureWebRtcAudioDeviceImpl() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  if (audio_device_.get())
-    return;
-
-  audio_device_ = new rtc::RefCountedObject<blink::WebRtcAudioDeviceImpl>();
-}
-
-std::unique_ptr<webrtc::RtpCapabilities>
-PeerConnectionDependencyFactory::GetSenderCapabilities(
-    const std::string& kind) {
-  if (kind == "audio") {
-    return std::make_unique<webrtc::RtpCapabilities>(
-        GetPcFactory()->GetRtpSenderCapabilities(cricket::MEDIA_TYPE_AUDIO));
-  } else if (kind == "video") {
-    return std::make_unique<webrtc::RtpCapabilities>(
-        GetPcFactory()->GetRtpSenderCapabilities(cricket::MEDIA_TYPE_VIDEO));
-  }
-  return nullptr;
-}
-
-std::unique_ptr<webrtc::RtpCapabilities>
-PeerConnectionDependencyFactory::GetReceiverCapabilities(
-    const std::string& kind) {
-  if (kind == "audio") {
-    return std::make_unique<webrtc::RtpCapabilities>(
-        GetPcFactory()->GetRtpReceiverCapabilities(cricket::MEDIA_TYPE_AUDIO));
-  } else if (kind == "video") {
-    return std::make_unique<webrtc::RtpCapabilities>(
-        GetPcFactory()->GetRtpReceiverCapabilities(cricket::MEDIA_TYPE_VIDEO));
-  }
-  return nullptr;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory.h b/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory.h
deleted file mode 100644
index 75a3b73b919..00000000000
--- a/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory.h
+++ /dev/null
@@ -1,185 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_PEER_CONNECTION_DEPENDENCY_FACTORY_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_PEER_CONNECTION_DEPENDENCY_FACTORY_H_
-
-#include <string>
-
-#include "base/files/file.h"
-#include "base/macros.h"
-#include "base/message_loop/message_loop_current.h"
-#include "base/sequence_checker.h"
-#include "base/single_thread_task_runner.h"
-#include "base/threading/thread.h"
-#include "content/common/content_export.h"
-#include "content/renderer/media/webrtc/stun_field_trial.h"
-#include "content/renderer/p2p/socket_dispatcher.h"
-#include "ipc/ipc_platform_file.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-#include "third_party/webrtc/p2p/stunprober/stun_prober.h"
-
-namespace base {
-class WaitableEvent;
-}
-
-namespace media {
-class GpuVideoAcceleratorFactories;
-}
-
-namespace rtc {
-class Thread;
-}
-
-namespace blink {
-class WebLocalFrame;
-class WebRTCPeerConnectionHandler;
-class WebRTCPeerConnectionHandlerClient;
-class WebRtcAudioDeviceImpl;
-}
-
-namespace content {
-
-class IpcNetworkManager;
-class IpcPacketSocketFactory;
-class MdnsResponderAdapter;
-class P2PPortAllocator;
-
-// Object factory for RTC PeerConnections.
-class CONTENT_EXPORT PeerConnectionDependencyFactory
-    : base::MessageLoopCurrent::DestructionObserver {
- public:
-  PeerConnectionDependencyFactory(P2PSocketDispatcher* p2p_socket_dispatcher);
-  ~PeerConnectionDependencyFactory() override;
-
-  // Create a RTCPeerConnectionHandler object that implements the
-  // WebKit WebRTCPeerConnectionHandler interface.
-  std::unique_ptr<blink::WebRTCPeerConnectionHandler>
-  CreateRTCPeerConnectionHandler(
-      blink::WebRTCPeerConnectionHandlerClient* client,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner);
-
-  // Create a proxy object for a VideoTrackSource that makes sure it's called on
-  // the correct threads.
-  virtual scoped_refptr<webrtc::VideoTrackSourceInterface>
-  CreateVideoTrackSourceProxy(webrtc::VideoTrackSourceInterface* source);
-
-  // Asks the PeerConnection factory to create a Local MediaStream object.
-  virtual scoped_refptr<webrtc::MediaStreamInterface>
-      CreateLocalMediaStream(const std::string& label);
-
-  // Asks the PeerConnection factory to create a Local VideoTrack object.
-  virtual scoped_refptr<webrtc::VideoTrackInterface> CreateLocalVideoTrack(
-      const std::string& id,
-      webrtc::VideoTrackSourceInterface* source);
-
-  // Asks the libjingle PeerConnection factory to create a libjingle
-  // PeerConnection object.
-  // The PeerConnection object is owned by PeerConnectionHandler.
-  virtual scoped_refptr<webrtc::PeerConnectionInterface> CreatePeerConnection(
-      const webrtc::PeerConnectionInterface::RTCConfiguration& config,
-      blink::WebLocalFrame* web_frame,
-      webrtc::PeerConnectionObserver* observer);
-
-  // Creates a PortAllocator that uses Chrome IPC sockets and enforces privacy
-  // controls according to the permissions granted on the page.
-  virtual std::unique_ptr<P2PPortAllocator> CreatePortAllocator(
-      blink::WebLocalFrame* web_frame);
-
-  // Creates an AsyncResolverFactory that uses the networking Mojo service.
-  virtual std::unique_ptr<webrtc::AsyncResolverFactory>
-  CreateAsyncResolverFactory();
-
-  // Creates a libjingle representation of a Session description. Used by a
-  // RTCPeerConnectionHandler instance.
-  virtual webrtc::SessionDescriptionInterface* CreateSessionDescription(
-      const std::string& type,
-      const std::string& sdp,
-      webrtc::SdpParseError* error);
-
-  // Creates a libjingle representation of an ice candidate.
-  virtual webrtc::IceCandidateInterface* CreateIceCandidate(
-      const std::string& sdp_mid,
-      int sdp_mline_index,
-      const std::string& sdp);
-
-  // Returns the most optimistic view of the capabilities of the system for
-  // sending or receiving media of the given kind ("audio" or "video").
-  virtual std::unique_ptr<webrtc::RtpCapabilities> GetSenderCapabilities(
-      const std::string& kind);
-  virtual std::unique_ptr<webrtc::RtpCapabilities> GetReceiverCapabilities(
-      const std::string& kind);
-
-  blink::WebRtcAudioDeviceImpl* GetWebRtcAudioDevice();
-
-  void EnsureInitialized();
-  scoped_refptr<base::SingleThreadTaskRunner> GetWebRtcWorkerThread() const;
-  // TODO(bugs.webrtc.org/9419): Remove once WebRTC can be built as a component.
-  rtc::Thread* GetWebRtcWorkerThreadRtcThread() const;
-  virtual scoped_refptr<base::SingleThreadTaskRunner> GetWebRtcSignalingThread()
-      const;
-
- protected:
-  virtual const scoped_refptr<webrtc::PeerConnectionFactoryInterface>&
-      GetPcFactory();
-  virtual bool PeerConnectionFactoryCreated();
-
-  // Helper method to create a WebRtcAudioDeviceImpl.
-  void EnsureWebRtcAudioDeviceImpl();
-
- private:
-  // Implement base::MessageLoopCurrent::DestructionObserver.
-  // This makes sure the libjingle PeerConnectionFactory is released before
-  // the renderer message loop is destroyed.
-  void WillDestroyCurrentMessageLoop() override;
-
-  // Functions related to Stun probing trial to determine how fast we could send
-  // Stun request without being dropped by NAT.
-  void TryScheduleStunProbeTrial();
-  void StartStunProbeTrialOnWorkerThread(const std::string& params);
-
-  // Creates |pc_factory_|, which in turn is used for
-  // creating PeerConnection objects.
-  void CreatePeerConnectionFactory();
-
-  void InitializeSignalingThread(
-      media::GpuVideoAcceleratorFactories* gpu_factories,
-      base::WaitableEvent* event);
-
-  void InitializeWorkerThread(rtc::Thread** thread,
-                              base::WaitableEvent* event);
-
-  void CreateIpcNetworkManagerOnWorkerThread(
-      base::WaitableEvent* event,
-      std::unique_ptr<MdnsResponderAdapter> mdns_responder);
-  void DeleteIpcNetworkManager();
-  void CleanupPeerConnectionFactory();
-
-  // network_manager_ must be deleted on the worker thread. The network manager
-  // uses |p2p_socket_dispatcher_|.
-  std::unique_ptr<IpcNetworkManager> network_manager_;
-  std::unique_ptr<IpcPacketSocketFactory> socket_factory_;
-
-  scoped_refptr<webrtc::PeerConnectionFactoryInterface> pc_factory_;
-
-  scoped_refptr<P2PSocketDispatcher> p2p_socket_dispatcher_;
-  scoped_refptr<blink::WebRtcAudioDeviceImpl> audio_device_;
-
-  std::unique_ptr<StunProberTrial> stun_trial_;
-
-  // PeerConnection threads. signaling_thread_ is created from the
-  // "current" chrome thread.
-  rtc::Thread* signaling_thread_;
-  rtc::Thread* worker_thread_;
-  base::Thread chrome_signaling_thread_;
-  base::Thread chrome_worker_thread_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  DISALLOW_COPY_AND_ASSIGN(PeerConnectionDependencyFactory);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_PEER_CONNECTION_DEPENDENCY_FACTORY_H_
diff --git a/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory_unittest.cc b/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory_unittest.cc
index d8e1e4147c7..b3492c4937a 100644
--- a/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory_unittest.cc
+++ b/chromium/content/renderer/media/webrtc/peer_connection_dependency_factory_unittest.cc
@@ -3,27 +3,71 @@
 // found in the LICENSE file.
 
 #include "base/test/task_environment.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h"
+#include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_rtc_peer_connection_handler.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_dependency_factory.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_web_rtc_peer_connection_handler_client.h"
 
 namespace content {
 
+// blink::Platform implementation that overrides the known method needed
+// by the test: CreateRTCPeerConnectionHandler().
+//
+// TODO(crbug.com/787254): When this file moves to blink/renderer/, the
+// implementation of
+// PeerConnectionDependencyFactory::CreateRTCPeerConnectionHandler will not
+// route through Platform anymore, and this custom implementation below ain't
+// going to be needed.
+class PeerConnectionDependencyFactoryTestingPlatformSupport
+    : public blink::Platform {
+ public:
+  PeerConnectionDependencyFactoryTestingPlatformSupport(
+      blink::MockPeerConnectionDependencyFactory* dependency_factory)
+      : dependency_factory_(dependency_factory) {}
+
+  std::unique_ptr<blink::WebRTCPeerConnectionHandler>
+  CreateRTCPeerConnectionHandler(
+      blink::WebRTCPeerConnectionHandlerClient* client,
+      scoped_refptr<base::SingleThreadTaskRunner> task_runner) override {
+    return std::make_unique<RTCPeerConnectionHandler>(
+        client, dependency_factory_, task_runner);
+  }
+
+ private:
+  blink::MockPeerConnectionDependencyFactory* dependency_factory_ = nullptr;
+};
+
 class PeerConnectionDependencyFactoryTest : public ::testing::Test {
  public:
   void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
+    dependency_factory_.reset(new blink::MockPeerConnectionDependencyFactory());
+
+    platform_original_ = blink::Platform::Current();
+    peer_connection_dependency_factory_platform_support_.reset(
+        new PeerConnectionDependencyFactoryTestingPlatformSupport(
+            dependency_factory_.get()));
+    blink::Platform::SetCurrentPlatformForTesting(
+        peer_connection_dependency_factory_platform_support_.get());
+  }
+
+  void TearDown() override {
+    blink::Platform::SetCurrentPlatformForTesting(platform_original_);
   }
 
  protected:
-  base::test::TaskEnvironment task_environment_;
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
+  std::unique_ptr<blink::MockPeerConnectionDependencyFactory>
+      dependency_factory_;
+
+  std::unique_ptr<PeerConnectionDependencyFactoryTestingPlatformSupport>
+      peer_connection_dependency_factory_platform_support_;
+  blink::Platform* platform_original_ = nullptr;
 };
 
 TEST_F(PeerConnectionDependencyFactoryTest, CreateRTCPeerConnectionHandler) {
-  MockWebRTCPeerConnectionHandlerClient client_jsep;
+  blink::MockWebRTCPeerConnectionHandlerClient client_jsep;
   std::unique_ptr<blink::WebRTCPeerConnectionHandler> pc_handler(
       dependency_factory_->CreateRTCPeerConnectionHandler(
           &client_jsep,
diff --git a/chromium/content/renderer/media/webrtc/peer_connection_tracker.cc b/chromium/content/renderer/media/webrtc/peer_connection_tracker.cc
index c8e1637cf0d..ccb773f8d05 100644
--- a/chromium/content/renderer/media/webrtc/peer_connection_tracker.cc
+++ b/chromium/content/renderer/media/webrtc/peer_connection_tracker.cc
@@ -708,19 +708,21 @@ void PeerConnectionTracker::RegisterPeerConnection(
   DCHECK(pc_handler);
   DCHECK_EQ(GetLocalIDForHandler(pc_handler), -1);
   DVLOG(1) << "PeerConnectionTracker::RegisterPeerConnection()";
-  PeerConnectionInfo info;
+  auto info = mojom::PeerConnectionInfo::New();
 
-  info.lid = GetNextLocalID();
-  info.rtc_configuration = SerializeConfiguration(config);
+  info->lid = GetNextLocalID();
+  info->rtc_configuration = SerializeConfiguration(config);
 
-  info.constraints = SerializeMediaConstraints(constraints);
+  info->constraints = SerializeMediaConstraints(constraints);
   if (frame)
-    info.url = frame->GetDocument().Url().GetString().Utf8();
+    info->url = frame->GetDocument().Url().GetString().Utf8();
   else
-    info.url = "test:testing";
-  SendTarget()->Send(new PeerConnectionTrackerHost_AddPeerConnection(info));
+    info->url = "test:testing";
 
-  peer_connection_local_id_map_.insert(std::make_pair(pc_handler, info.lid));
+  int32_t lid = info->lid;
+  GetPeerConnectionTrackerHost()->AddPeerConnection(std::move(info));
+
+  peer_connection_local_id_map_.insert(std::make_pair(pc_handler, lid));
 }
 
 void PeerConnectionTracker::UnregisterPeerConnection(
diff --git a/chromium/content/renderer/media/webrtc/peer_connection_tracker_unittest.cc b/chromium/content/renderer/media/webrtc/peer_connection_tracker_unittest.cc
index 53ec6549f11..9c3da6df5ae 100644
--- a/chromium/content/renderer/media/webrtc/peer_connection_tracker_unittest.cc
+++ b/chromium/content/renderer/media/webrtc/peer_connection_tracker_unittest.cc
@@ -8,9 +8,6 @@
 #include "content/common/media/peer_connection_tracker.mojom.h"
 #include "content/common/media/peer_connection_tracker_messages.h"
 #include "content/public/test/mock_render_thread.h"
-#include "content/renderer/media/webrtc/fake_rtc_rtp_transceiver.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h"
 #include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
 #include "ipc/ipc_message_macros.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
@@ -22,6 +19,9 @@
 #include "third_party/blink/public/platform/web_rtc_rtp_receiver.h"
 #include "third_party/blink/public/platform/web_rtc_rtp_sender.h"
 #include "third_party/blink/public/platform/web_rtc_rtp_transceiver.h"
+#include "third_party/blink/public/web/modules/peerconnection/fake_rtc_rtp_transceiver_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_dependency_factory.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_web_rtc_peer_connection_handler_client.h"
 
 using ::testing::_;
 
@@ -60,6 +60,7 @@ class MockPeerConnectionTrackerHost : public mojom::PeerConnectionTrackerHost {
   MockPeerConnectionTrackerHost() : binding_(this) {}
   MOCK_METHOD3(UpdatePeerConnection,
                void(int, const std::string&, const std::string&));
+  MOCK_METHOD1(AddPeerConnection, void(mojom::PeerConnectionInfoPtr));
   MOCK_METHOD1(RemovePeerConnection, void(int));
   MOCK_METHOD2(OnPeerConnectionSessionIdSet, void(int, const std::string&));
   MOCK_METHOD5(GetUserMedia,
@@ -90,53 +91,35 @@ class MockPeerConnectionTrackerHost : public mojom::PeerConnectionTrackerHost {
 std::unique_ptr<blink::WebRTCRtpTransceiver> CreateDefaultTransceiver(
     blink::WebRTCRtpTransceiverImplementationType implementation_type) {
   std::unique_ptr<blink::WebRTCRtpTransceiver> transceiver;
-  FakeRTCRtpSender sender(
+  blink::FakeRTCRtpSenderImpl sender(
       "senderTrackId", {"senderStreamId"},
       blink::scheduler::GetSingleThreadTaskRunnerForTesting());
-  FakeRTCRtpReceiver receiver(
+  blink::FakeRTCRtpReceiverImpl receiver(
       "receiverTrackId", {"receiverStreamId"},
       blink::scheduler::GetSingleThreadTaskRunnerForTesting());
   if (implementation_type ==
       blink::WebRTCRtpTransceiverImplementationType::kFullTransceiver) {
-    transceiver = std::make_unique<FakeRTCRtpTransceiver>(
+    transceiver = std::make_unique<blink::FakeRTCRtpTransceiverImpl>(
         base::nullopt, std::move(sender), std::move(receiver),
         false /* stopped */,
         webrtc::RtpTransceiverDirection::kSendOnly /* direction */,
         base::nullopt /* current_direction */);
   } else if (implementation_type ==
              blink::WebRTCRtpTransceiverImplementationType::kPlanBSenderOnly) {
-    transceiver = std::make_unique<RTCRtpSenderOnlyTransceiver>(
-        std::make_unique<FakeRTCRtpSender>(sender));
+    transceiver = std::make_unique<blink::RTCRtpSenderOnlyTransceiver>(
+        std::make_unique<blink::FakeRTCRtpSenderImpl>(sender));
   } else {
     DCHECK_EQ(
         implementation_type,
         blink::WebRTCRtpTransceiverImplementationType::kPlanBReceiverOnly);
-    transceiver = std::make_unique<RTCRtpReceiverOnlyTransceiver>(
-        std::make_unique<FakeRTCRtpReceiver>(receiver));
+    transceiver = std::make_unique<blink::RTCRtpReceiverOnlyTransceiver>(
+        std::make_unique<blink::FakeRTCRtpReceiverImpl>(receiver));
   }
   return transceiver;
 }
 
 namespace {
 
-class MockSendTargetThread : public MockRenderThread {
- public:
-  MOCK_METHOD1(OnAddPeerConnection, void(PeerConnectionInfo));
-
- private:
-  bool OnMessageReceived(const IPC::Message& msg) override;
-};
-
-bool MockSendTargetThread::OnMessageReceived(const IPC::Message& msg) {
-  bool handled = true;
-  IPC_BEGIN_MESSAGE_MAP(MockSendTargetThread, msg)
-    IPC_MESSAGE_HANDLER(PeerConnectionTrackerHost_AddPeerConnection,
-                        OnAddPeerConnection)
-    IPC_MESSAGE_UNHANDLED(handled = false)
-  IPC_END_MESSAGE_MAP()
-  return handled;
-}
-
 // TODO(https://crbug.com/868868): Move this into a separate file.
 class MockPeerConnectionHandler : public RTCPeerConnectionHandler {
  public:
@@ -148,8 +131,8 @@ class MockPeerConnectionHandler : public RTCPeerConnectionHandler {
   MOCK_METHOD0(CloseClientPeerConnection, void());
 
  private:
-  MockPeerConnectionDependencyFactory dependency_factory_;
-  MockWebRTCPeerConnectionHandlerClient client_;
+  blink::MockPeerConnectionDependencyFactory dependency_factory_;
+  blink::MockWebRTCPeerConnectionHandlerClient client_;
 };
 
 class PeerConnectionTrackerTest : public ::testing::Test {
@@ -159,24 +142,22 @@ class PeerConnectionTrackerTest : public ::testing::Test {
     tracker_.reset(new PeerConnectionTracker(
         mock_host_->CreateInterfacePtrAndBind(),
         blink::scheduler::GetSingleThreadTaskRunnerForTesting()));
-    target_thread_.reset(new MockSendTargetThread());
-    tracker_->OverrideSendTargetForTesting(target_thread_.get());
   }
 
   void CreateAndRegisterPeerConnectionHandler() {
     mock_handler_.reset(new MockPeerConnectionHandler());
-    EXPECT_CALL(*target_thread_, OnAddPeerConnection(_));
+    EXPECT_CALL(*mock_host_, AddPeerConnection(_));
     tracker_->RegisterPeerConnection(
         mock_handler_.get(),
         webrtc::PeerConnectionInterface::RTCConfiguration(),
         blink::WebMediaConstraints(), nullptr);
+    task_environment_.RunUntilIdle();
   }
 
  protected:
-  base::test::TaskEnvironment task_environment_;
+  base::test::SingleThreadTaskEnvironment task_environment_;
   std::unique_ptr<MockPeerConnectionTrackerHost> mock_host_;
   std::unique_ptr<PeerConnectionTracker> tracker_;
-  std::unique_ptr<MockSendTargetThread> target_thread_;
   std::unique_ptr<MockPeerConnectionHandler> mock_handler_;
 };
 
@@ -213,11 +194,12 @@ TEST_F(PeerConnectionTrackerTest, OnSuspend) {
 TEST_F(PeerConnectionTrackerTest, AddTransceiverWithOptionalValuesPresent) {
   CreateTrackerWithMocks();
   CreateAndRegisterPeerConnectionHandler();
-  FakeRTCRtpTransceiver transceiver(
+  blink::FakeRTCRtpTransceiverImpl transceiver(
       "midValue",
-      FakeRTCRtpSender("senderTrackId", {"streamIdA", "streamIdB"},
-                       blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
-      FakeRTCRtpReceiver(
+      blink::FakeRTCRtpSenderImpl(
+          "senderTrackId", {"streamIdA", "streamIdB"},
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
+      blink::FakeRTCRtpReceiverImpl(
           "receiverTrackId", {"streamIdC"},
           blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
       true /* stopped */,
@@ -254,11 +236,12 @@ TEST_F(PeerConnectionTrackerTest, AddTransceiverWithOptionalValuesPresent) {
 TEST_F(PeerConnectionTrackerTest, AddTransceiverWithOptionalValuesNull) {
   CreateTrackerWithMocks();
   CreateAndRegisterPeerConnectionHandler();
-  FakeRTCRtpTransceiver transceiver(
+  blink::FakeRTCRtpTransceiverImpl transceiver(
       base::nullopt,
-      FakeRTCRtpSender(base::nullopt, {},
-                       blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
-      FakeRTCRtpReceiver(
+      blink::FakeRTCRtpSenderImpl(
+          base::nullopt, {},
+          blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
+      blink::FakeRTCRtpReceiverImpl(
           "receiverTrackId", {},
           blink::scheduler::GetSingleThreadTaskRunnerForTesting()),
       false /* stopped */,
diff --git a/chromium/content/renderer/media/webrtc/rtc_certificate_generator.cc b/chromium/content/renderer/media/webrtc/rtc_certificate_generator.cc
deleted file mode 100644
index a57e278d83c..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_certificate_generator.cc
+++ /dev/null
@@ -1,157 +0,0 @@
-// Copyright (c) 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_certificate_generator.h"
-
-#include <string>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/single_thread_task_runner.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-#include "content/renderer/render_thread_impl.h"
-#include "media/media_buildflags.h"
-#include "third_party/webrtc/api/scoped_refptr.h"
-#include "third_party/webrtc/rtc_base/rtc_certificate.h"
-#include "third_party/webrtc/rtc_base/rtc_certificate_generator.h"
-#include "url/gurl.h"
-
-namespace content {
-namespace {
-
-rtc::KeyParams WebRTCKeyParamsToKeyParams(
-    const blink::WebRTCKeyParams& key_params) {
-  switch (key_params.KeyType()) {
-    case blink::kWebRTCKeyTypeRSA:
-      return rtc::KeyParams::RSA(key_params.RsaParams().mod_length,
-                                 key_params.RsaParams().pub_exp);
-    case blink::kWebRTCKeyTypeECDSA:
-      return rtc::KeyParams::ECDSA(
-          static_cast<rtc::ECCurve>(key_params.EcCurve()));
-    default:
-      NOTREACHED();
-      return rtc::KeyParams();
-  }
-}
-
-// A certificate generation request spawned by
-// |GenerateCertificateWithOptionalExpiration|. This
-// is handled by a separate class so that reference counting can keep the
-// request alive independently of the |RTCCertificateGenerator| that spawned it.
-class RTCCertificateGeneratorRequest
-    : public base::RefCountedThreadSafe<RTCCertificateGeneratorRequest> {
- public:
-  RTCCertificateGeneratorRequest(
-      const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
-      const scoped_refptr<base::SingleThreadTaskRunner>& worker_thread)
-      : main_thread_(main_thread),
-        worker_thread_(worker_thread) {
-    DCHECK(main_thread_);
-    DCHECK(worker_thread_);
-  }
-
-  void GenerateCertificateAsync(
-      const blink::WebRTCKeyParams& key_params,
-      const absl::optional<uint64_t>& expires_ms,
-      blink::WebRTCCertificateCallback completion_callback) {
-    DCHECK(main_thread_->BelongsToCurrentThread());
-    DCHECK(completion_callback);
-
-    worker_thread_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCCertificateGeneratorRequest::GenerateCertificateOnWorkerThread,
-            this, key_params, expires_ms, std::move(completion_callback)));
-  }
-
- private:
-  friend class base::RefCountedThreadSafe<RTCCertificateGeneratorRequest>;
-  ~RTCCertificateGeneratorRequest() {}
-
-  void GenerateCertificateOnWorkerThread(
-      const blink::WebRTCKeyParams key_params,
-      const absl::optional<uint64_t> expires_ms,
-      blink::WebRTCCertificateCallback completion_callback) {
-    DCHECK(worker_thread_->BelongsToCurrentThread());
-
-    rtc::scoped_refptr<rtc::RTCCertificate> certificate =
-        rtc::RTCCertificateGenerator::GenerateCertificate(
-            WebRTCKeyParamsToKeyParams(key_params), expires_ms);
-
-    main_thread_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&RTCCertificateGeneratorRequest::DoCallbackOnMainThread,
-                       this, std::move(completion_callback), certificate));
-  }
-
-  void DoCallbackOnMainThread(
-      blink::WebRTCCertificateCallback completion_callback,
-      rtc::scoped_refptr<rtc::RTCCertificate> certificate) {
-    DCHECK(main_thread_->BelongsToCurrentThread());
-    DCHECK(completion_callback);
-    std::move(completion_callback).Run(std::move(certificate));
-  }
-
-  // The main thread is the renderer thread.
-  const scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  // The WebRTC worker thread.
-  const scoped_refptr<base::SingleThreadTaskRunner> worker_thread_;
-};
-
-void GenerateCertificateWithOptionalExpiration(
-    const blink::WebRTCKeyParams& key_params,
-    const absl::optional<uint64_t>& expires_ms,
-    blink::WebRTCCertificateCallback completion_callback,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  DCHECK(WebRTCKeyParamsToKeyParams(key_params).IsValid());
-  PeerConnectionDependencyFactory* pc_dependency_factory =
-      RenderThreadImpl::current()->GetPeerConnectionDependencyFactory();
-  pc_dependency_factory->EnsureInitialized();
-
-  scoped_refptr<RTCCertificateGeneratorRequest> request =
-      new RTCCertificateGeneratorRequest(
-          task_runner, pc_dependency_factory->GetWebRtcWorkerThread());
-  request->GenerateCertificateAsync(key_params, expires_ms,
-                                    std::move(completion_callback));
-}
-
-}  // namespace
-
-void RTCCertificateGenerator::GenerateCertificate(
-    const blink::WebRTCKeyParams& key_params,
-    blink::WebRTCCertificateCallback completion_callback,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  GenerateCertificateWithOptionalExpiration(
-      key_params, absl::nullopt, std::move(completion_callback), task_runner);
-}
-
-void RTCCertificateGenerator::GenerateCertificateWithExpiration(
-    const blink::WebRTCKeyParams& key_params,
-    uint64_t expires_ms,
-    blink::WebRTCCertificateCallback completion_callback,
-    scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  GenerateCertificateWithOptionalExpiration(
-      key_params, expires_ms, std::move(completion_callback), task_runner);
-}
-
-bool RTCCertificateGenerator::IsSupportedKeyParams(
-    const blink::WebRTCKeyParams& key_params) {
-  return WebRTCKeyParamsToKeyParams(key_params).IsValid();
-}
-
-rtc::scoped_refptr<rtc::RTCCertificate> RTCCertificateGenerator::FromPEM(
-    blink::WebString pem_private_key,
-    blink::WebString pem_certificate) {
-  rtc::scoped_refptr<rtc::RTCCertificate> certificate =
-      rtc::RTCCertificate::FromPEM(rtc::RTCCertificatePEM(
-          pem_private_key.Utf8(), pem_certificate.Utf8()));
-  if (!certificate)
-    return nullptr;
-  return certificate;
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/rtc_certificate_generator.h b/chromium/content/renderer/media/webrtc/rtc_certificate_generator.h
deleted file mode 100644
index 76ce08f882c..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_certificate_generator.h
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright (c) 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_RTC_CERTIFICATE_GENERATOR_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_RTC_CERTIFICATE_GENERATOR_H_
-
-#include "base/macros.h"
-#include "base/single_thread_task_runner.h"
-#include "third_party/blink/public/platform/web_rtc_certificate_generator.h"
-#include "third_party/blink/public/platform/web_rtc_key_params.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-
-namespace content {
-
-// Chromium's WebRTCCertificateGenerator implementation; uses the
-// PeerConnectionIdentityStore/SSLIdentity::Generate to generate the identity,
-// rtc::RTCCertificate and content::RTCCertificate.
-class RTCCertificateGenerator : public blink::WebRTCCertificateGenerator {
- public:
-  RTCCertificateGenerator() {}
-  ~RTCCertificateGenerator() override {}
-
-  // blink::WebRTCCertificateGenerator implementation.
-  void GenerateCertificate(
-      const blink::WebRTCKeyParams& key_params,
-      blink::WebRTCCertificateCallback completion_callback,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner) override;
-  void GenerateCertificateWithExpiration(
-      const blink::WebRTCKeyParams& key_params,
-      uint64_t expires_ms,
-      blink::WebRTCCertificateCallback completion_callback,
-      scoped_refptr<base::SingleThreadTaskRunner> task_runner) override;
-  bool IsSupportedKeyParams(const blink::WebRTCKeyParams& key_params) override;
-  rtc::scoped_refptr<rtc::RTCCertificate> FromPEM(
-      blink::WebString pem_private_key,
-      blink::WebString pem_certificate) override;
-
- private:
-  DISALLOW_COPY_AND_ASSIGN(RTCCertificateGenerator);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_RTC_CERTIFICATE_GENERATOR_H_
diff --git a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
index 13c303e7c8d..799dcc81e06 100644
--- a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
+++ b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.cc
@@ -16,7 +16,6 @@
 #include <vector>
 
 #include "base/bind.h"
-#include "base/command_line.h"
 #include "base/location.h"
 #include "base/logging.h"
 #include "base/metrics/histogram_functions.h"
@@ -24,12 +23,8 @@
 #include "base/stl_util.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/threading/thread_checker.h"
-#include "base/threading/thread_task_runner_handle.h"
 #include "base/trace_event/trace_event.h"
 #include "base/unguessable_token.h"
-#include "content/public/common/content_features.h"
-#include "content/public/common/content_switches.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
 #include "content/renderer/media/webrtc/peer_connection_tracker.h"
 #include "content/renderer/media/webrtc/webrtc_set_description_observer.h"
 #include "content/renderer/render_thread_impl.h"
@@ -38,6 +33,7 @@
 #include "third_party/blink/public/platform/modules/mediastream/webrtc_uma_histograms.h"
 #include "third_party/blink/public/platform/modules/peerconnection/rtc_event_log_output_sink.h"
 #include "third_party/blink/public/platform/modules/peerconnection/rtc_event_log_output_sink_proxy_util.h"
+#include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/public/platform/web_media_constraints.h"
 #include "third_party/blink/public/platform/web_rtc_answer_options.h"
 #include "third_party/blink/public/platform/web_rtc_data_channel_init.h"
@@ -53,6 +49,8 @@
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/web/modules/mediastream/media_stream_constraints_util.h"
+#include "third_party/blink/public/web/modules/peerconnection/peer_connection_dependency_factory.h"
+#include "third_party/blink/public/web/modules/peerconnection/rtc_rtp_receiver_impl.h"
 #include "third_party/blink/public/web/modules/webrtc/webrtc_audio_device_impl.h"
 #include "third_party/webrtc/api/rtc_event_log_output.h"
 #include "third_party/webrtc/pc/media_session.h"
@@ -567,7 +565,7 @@ std::set<RTCPeerConnectionHandler*>* GetPeerConnectionHandlers() {
 
 // Counts the number of senders that have |stream_id| as an associated stream.
 size_t GetLocalStreamUsageCount(
-    const std::vector<std::unique_ptr<RTCRtpSender>>& rtp_senders,
+    const std::vector<std::unique_ptr<blink::RTCRtpSenderImpl>>& rtp_senders,
     const std::string stream_id) {
   size_t usage_count = 0;
   for (const auto& sender : rtp_senders) {
@@ -582,7 +580,8 @@ size_t GetLocalStreamUsageCount(
 }
 
 bool IsRemoteStream(
-    const std::vector<std::unique_ptr<RTCRtpReceiver>>& rtp_receivers,
+    const std::vector<std::unique_ptr<blink::RTCRtpReceiverImpl>>&
+        rtp_receivers,
     const std::string& stream_id) {
   for (const auto& receiver : rtp_receivers) {
     for (const auto& receiver_stream_id : receiver->state().stream_ids()) {
@@ -593,7 +592,6 @@ bool IsRemoteStream(
   return false;
 }
 
-
 MediaStreamTrackMetrics::Kind MediaStreamTrackMetricsKind(
     const blink::WebMediaStreamTrack& track) {
   return track.Source().GetType() == blink::WebMediaStreamSource::kTypeAudio
@@ -734,7 +732,7 @@ class RTCPeerConnectionHandler::WebRtcSetDescriptionObserverImpl
 
     // Determine which receivers have been removed before processing the
     // removal as to not invalidate the iterator.
-    std::vector<RTCRtpReceiver*> removed_receivers;
+    std::vector<blink::RTCRtpReceiverImpl*> removed_receivers;
     for (auto it = handler_->rtp_receivers_.begin();
          it != handler_->rtp_receivers_.end(); ++it) {
       if (ReceiverWasRemoved(*(*it), states.transceiver_states))
@@ -752,15 +750,15 @@ class RTCPeerConnectionHandler::WebRtcSetDescriptionObserverImpl
     for (auto* removed_receiver : removed_receivers) {
       if (handler_) {
         // |handler_| can become null after this call.
-        handler_->OnRemoveReceiverPlanB(RTCRtpReceiver::getId(
+        handler_->OnRemoveReceiverPlanB(blink::RTCRtpReceiverImpl::getId(
             removed_receiver->state().webrtc_receiver().get()));
       }
     }
   }
 
-  bool ReceiverWasAdded(const RtpTransceiverState& transceiver_state) {
+  bool ReceiverWasAdded(const blink::RtpTransceiverState& transceiver_state) {
     DCHECK(handler_);
-    uintptr_t receiver_id = RTCRtpReceiver::getId(
+    uintptr_t receiver_id = blink::RTCRtpReceiverImpl::getId(
         transceiver_state.receiver_state()->webrtc_receiver().get());
     for (const auto& receiver : handler_->rtp_receivers_) {
       if (receiver->Id() == receiver_id)
@@ -770,8 +768,8 @@ class RTCPeerConnectionHandler::WebRtcSetDescriptionObserverImpl
   }
 
   bool ReceiverWasRemoved(
-      const RTCRtpReceiver& receiver,
-      const std::vector<RtpTransceiverState>& transceiver_states) {
+      const blink::RTCRtpReceiverImpl& receiver,
+      const std::vector<blink::RtpTransceiverState>& transceiver_states) {
     for (const auto& transceiver_state : transceiver_states) {
       if (transceiver_state.receiver_state()->webrtc_receiver() ==
           receiver.state().webrtc_receiver()) {
@@ -973,15 +971,15 @@ class RTCPeerConnectionHandler::Observer
 
 RTCPeerConnectionHandler::RTCPeerConnectionHandler(
     blink::WebRTCPeerConnectionHandlerClient* client,
-    PeerConnectionDependencyFactory* dependency_factory,
+    blink::PeerConnectionDependencyFactory* dependency_factory,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : initialize_called_(false),
       client_(client),
       is_closed_(false),
       dependency_factory_(dependency_factory),
       track_adapter_map_(
-          new WebRtcMediaStreamTrackAdapterMap(dependency_factory_,
-                                               task_runner)),
+          new blink::WebRtcMediaStreamTrackAdapterMap(dependency_factory_,
+                                                      task_runner)),
       task_runner_(std::move(task_runner)) {
   CHECK(client_);
 
@@ -1025,8 +1023,7 @@ bool RTCPeerConnectionHandler::Initialize(
   // Choose between RTC smoothness algorithm and prerenderer smoothing.
   // Prerenderer smoothing is turned on if RTC smoothness is turned off.
   configuration_.set_prerenderer_smoothing(
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kDisableRTCSmoothnessAlgorithm));
+      !blink::Platform::Current()->RTCSmoothnessAlgorithmEnabled());
 
   configuration_.set_experiment_cpu_load_estimator(
       base::FeatureList::IsEnabled(media::kNewEncodeCpuLoadEstimator));
@@ -1034,11 +1031,9 @@ bool RTCPeerConnectionHandler::Initialize(
   // Configure optional SRTP configurations enabled via the command line.
   configuration_.crypto_options = webrtc::CryptoOptions{};
   configuration_.crypto_options->srtp.enable_gcm_crypto_suites =
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableWebRtcSrtpAesGcm);
+      blink::Platform::Current()->IsWebRtcSrtpAesGcmEnabled();
   configuration_.crypto_options->srtp.enable_encrypted_rtp_header_extensions =
-      base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kEnableWebRtcSrtpEncryptedHeaders);
+      blink::Platform::Current()->IsWebRtcSrtpEncryptedHeadersEnabled();
 
   // Copy all the relevant constraints into |config|.
   CopyConstraintsIntoRtcConfiguration(options, &configuration_);
@@ -1128,8 +1123,8 @@ RTCPeerConnectionHandler::CreateOfferInternal(
           peer_connection_tracker_,
           PeerConnectionTracker::ACTION_CREATE_OFFER));
 
-  TransceiverStateSurfacer transceiver_state_surfacer(task_runner_,
-                                                      signaling_thread());
+  blink::TransceiverStateSurfacer transceiver_state_surfacer(
+      task_runner_, signaling_thread());
   RunSynchronousRepeatingClosureOnSignalingThread(
       base::BindRepeating(
           &RTCPeerConnectionHandler::CreateOfferOnSignalingThread,
@@ -1142,7 +1137,7 @@ RTCPeerConnectionHandler::CreateOfferInternal(
   std::vector<std::unique_ptr<blink::WebRTCRtpTransceiver>> transceivers;
   for (auto& transceiver_state : transceiver_states) {
     auto transceiver = CreateOrUpdateTransceiver(
-        std::move(transceiver_state), TransceiverStateUpdateMode::kAll);
+        std::move(transceiver_state), blink::TransceiverStateUpdateMode::kAll);
     transceivers.push_back(std::move(transceiver));
   }
   return transceivers;
@@ -1151,7 +1146,7 @@ RTCPeerConnectionHandler::CreateOfferInternal(
 void RTCPeerConnectionHandler::CreateOfferOnSignalingThread(
     webrtc::CreateSessionDescriptionObserver* observer,
     webrtc::PeerConnectionInterface::RTCOfferAnswerOptions offer_options,
-    TransceiverStateSurfacer* transceiver_state_surfacer) {
+    blink::TransceiverStateSurfacer* transceiver_state_surfacer) {
   native_peer_connection_->CreateOffer(observer, offer_options);
   std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
       transceivers =
@@ -1602,10 +1597,10 @@ RTCPeerConnectionHandler::AddTransceiverWithTrack(
     const webrtc::RtpTransceiverInit& init) {
   DCHECK_EQ(configuration_.sdp_semantics, webrtc::SdpSemantics::kUnifiedPlan);
   DCHECK(task_runner_->RunsTasksInCurrentSequence());
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref =
-      track_adapter_map_->GetOrCreateLocalTrackAdapter(web_track);
-  TransceiverStateSurfacer transceiver_state_surfacer(task_runner_,
-                                                      signaling_thread());
+  std::unique_ptr<blink::WebRtcMediaStreamTrackAdapterMap::AdapterRef>
+      track_ref = track_adapter_map_->GetOrCreateLocalTrackAdapter(web_track);
+  blink::TransceiverStateSurfacer transceiver_state_surfacer(
+      task_runner_, signaling_thread());
   webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
       error_or_transceiver;
   RunSynchronousRepeatingClosureOnSignalingThread(
@@ -1622,8 +1617,9 @@ RTCPeerConnectionHandler::AddTransceiverWithTrack(
   }
 
   auto transceiver_states = transceiver_state_surfacer.ObtainStates();
-  auto transceiver = CreateOrUpdateTransceiver(
-      std::move(transceiver_states[0]), TransceiverStateUpdateMode::kAll);
+  auto transceiver =
+      CreateOrUpdateTransceiver(std::move(transceiver_states[0]),
+                                blink::TransceiverStateUpdateMode::kAll);
   std::unique_ptr<blink::WebRTCRtpTransceiver> web_transceiver =
       std::move(transceiver);
   return web_transceiver;
@@ -1632,7 +1628,7 @@ RTCPeerConnectionHandler::AddTransceiverWithTrack(
 void RTCPeerConnectionHandler::AddTransceiverWithTrackOnSignalingThread(
     rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track,
     webrtc::RtpTransceiverInit init,
-    TransceiverStateSurfacer* transceiver_state_surfacer,
+    blink::TransceiverStateSurfacer* transceiver_state_surfacer,
     webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>*
         error_or_transceiver) {
   *error_or_transceiver =
@@ -1657,8 +1653,8 @@ RTCPeerConnectionHandler::AddTransceiverWithKind(
     DCHECK_EQ(kind, webrtc::MediaStreamTrackInterface::kVideoKind);
     media_type = cricket::MEDIA_TYPE_VIDEO;
   }
-  TransceiverStateSurfacer transceiver_state_surfacer(task_runner_,
-                                                      signaling_thread());
+  blink::TransceiverStateSurfacer transceiver_state_surfacer(
+      task_runner_, signaling_thread());
   webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
       error_or_transceiver;
   RunSynchronousRepeatingClosureOnSignalingThread(
@@ -1676,8 +1672,9 @@ RTCPeerConnectionHandler::AddTransceiverWithKind(
   }
 
   auto transceiver_states = transceiver_state_surfacer.ObtainStates();
-  auto transceiver = CreateOrUpdateTransceiver(
-      std::move(transceiver_states[0]), TransceiverStateUpdateMode::kAll);
+  auto transceiver =
+      CreateOrUpdateTransceiver(std::move(transceiver_states[0]),
+                                blink::TransceiverStateUpdateMode::kAll);
   std::unique_ptr<blink::WebRTCRtpTransceiver> web_transceiver =
       std::move(transceiver);
   return std::move(web_transceiver);
@@ -1686,7 +1683,7 @@ RTCPeerConnectionHandler::AddTransceiverWithKind(
 void RTCPeerConnectionHandler::AddTransceiverWithMediaTypeOnSignalingThread(
     cricket::MediaType media_type,
     webrtc::RtpTransceiverInit init,
-    TransceiverStateSurfacer* transceiver_state_surfacer,
+    blink::TransceiverStateSurfacer* transceiver_state_surfacer,
     webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>*
         error_or_transceiver) {
   *error_or_transceiver =
@@ -1705,8 +1702,8 @@ RTCPeerConnectionHandler::AddTrack(
   DCHECK(task_runner_->RunsTasksInCurrentSequence());
   TRACE_EVENT0("webrtc", "RTCPeerConnectionHandler::AddTrack");
 
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref =
-      track_adapter_map_->GetOrCreateLocalTrackAdapter(track);
+  std::unique_ptr<blink::WebRtcMediaStreamTrackAdapterMap::AdapterRef>
+      track_ref = track_adapter_map_->GetOrCreateLocalTrackAdapter(track);
   std::vector<std::string> stream_ids(streams.size());
   for (size_t i = 0; i < streams.size(); ++i)
     stream_ids[i] = streams[i].Id().Utf8();
@@ -1715,8 +1712,8 @@ RTCPeerConnectionHandler::AddTrack(
   // transceiver (Plan B: sender only).
   // TODO(hbos): Implement and surface full transceiver support under Unified
   // Plan. https://crbug.com/777617
-  TransceiverStateSurfacer transceiver_state_surfacer(task_runner_,
-                                                      signaling_thread());
+  blink::TransceiverStateSurfacer transceiver_state_surfacer(
+      task_runner_, signaling_thread());
   webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpSenderInterface>>
       error_or_sender;
   RunSynchronousRepeatingClosureOnSignalingThread(
@@ -1745,19 +1742,19 @@ RTCPeerConnectionHandler::AddTrack(
     // Plan B: Create sender only.
     DCHECK(transceiver_state.sender_state());
     auto webrtc_sender = transceiver_state.sender_state()->webrtc_sender();
-    DCHECK(FindSender(RTCRtpSender::getId(webrtc_sender.get())) ==
+    DCHECK(FindSender(blink::RTCRtpSenderImpl::getId(webrtc_sender.get())) ==
            rtp_senders_.end());
-    RtpSenderState sender_state = transceiver_state.MoveSenderState();
+    blink::RtpSenderState sender_state = transceiver_state.MoveSenderState();
     DCHECK(sender_state.is_initialized());
-    rtp_senders_.push_back(std::make_unique<RTCRtpSender>(
+    rtp_senders_.push_back(std::make_unique<blink::RTCRtpSenderImpl>(
         native_peer_connection_, track_adapter_map_, std::move(sender_state)));
-    web_transceiver = std::make_unique<RTCRtpSenderOnlyTransceiver>(
-        std::make_unique<RTCRtpSender>(*rtp_senders_.back().get()));
+    web_transceiver = std::make_unique<blink::RTCRtpSenderOnlyTransceiver>(
+        std::make_unique<blink::RTCRtpSenderImpl>(*rtp_senders_.back().get()));
   } else {
     DCHECK_EQ(configuration_.sdp_semantics, webrtc::SdpSemantics::kUnifiedPlan);
     // Unified Plan: Create or recycle a transceiver.
     auto transceiver = CreateOrUpdateTransceiver(
-        std::move(transceiver_state), TransceiverStateUpdateMode::kAll);
+        std::move(transceiver_state), blink::TransceiverStateUpdateMode::kAll);
     web_transceiver = std::move(transceiver);
   }
   if (peer_connection_tracker_) {
@@ -1779,7 +1776,7 @@ RTCPeerConnectionHandler::AddTrack(
 void RTCPeerConnectionHandler::AddTrackOnSignalingThread(
     rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
     std::vector<std::string> stream_ids,
-    TransceiverStateSurfacer* transceiver_state_surfacer,
+    blink::TransceiverStateSurfacer* transceiver_state_surfacer,
     webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpSenderInterface>>*
         error_or_sender) {
   *error_or_sender = native_peer_connection_->AddTrack(track, stream_ids);
@@ -1787,7 +1784,7 @@ void RTCPeerConnectionHandler::AddTrackOnSignalingThread(
   if (error_or_sender->ok()) {
     auto sender = error_or_sender->value();
     if (configuration_.sdp_semantics == webrtc::SdpSemantics::kPlanB) {
-      transceivers = {new SurfaceSenderStateOnly(sender)};
+      transceivers = {new blink::SurfaceSenderStateOnly(sender)};
     } else {
       DCHECK_EQ(configuration_.sdp_semantics,
                 webrtc::SdpSemantics::kUnifiedPlan);
@@ -1840,8 +1837,8 @@ bool RTCPeerConnectionHandler::RemoveTrackPlanB(
                              web_track.Id().Utf8());
   if (peer_connection_tracker_) {
     auto sender_only_transceiver =
-        std::make_unique<RTCRtpSenderOnlyTransceiver>(
-            std::make_unique<RTCRtpSender>(*it->get()));
+        std::make_unique<blink::RTCRtpSenderOnlyTransceiver>(
+            std::make_unique<blink::RTCRtpSenderImpl>(*it->get()));
     size_t sender_index = GetTransceiverIndex(*sender_only_transceiver);
     peer_connection_tracker_->TrackRemoveTransceiver(
         this, PeerConnectionTracker::TransceiverUpdatedReason::kRemoveTrack,
@@ -1870,8 +1867,8 @@ RTCPeerConnectionHandler::RemoveTrackUnifiedPlan(
   const auto& sender = *it;
   auto webrtc_sender = sender->state().webrtc_sender();
 
-  TransceiverStateSurfacer transceiver_state_surfacer(task_runner_,
-                                                      signaling_thread());
+  blink::TransceiverStateSurfacer transceiver_state_surfacer(
+      task_runner_, signaling_thread());
   bool result;
   RunSynchronousRepeatingClosureOnSignalingThread(
       base::BindRepeating(
@@ -1895,7 +1892,7 @@ RTCPeerConnectionHandler::RemoveTrackUnifiedPlan(
 
   // Update the transceiver.
   auto transceiver = CreateOrUpdateTransceiver(
-      std::move(transceiver_state), TransceiverStateUpdateMode::kAll);
+      std::move(transceiver_state), blink::TransceiverStateUpdateMode::kAll);
   if (peer_connection_tracker_) {
     size_t transceiver_index = GetTransceiverIndex(*transceiver);
     peer_connection_tracker_->TrackModifyTransceiver(
@@ -1909,7 +1906,7 @@ RTCPeerConnectionHandler::RemoveTrackUnifiedPlan(
 
 void RTCPeerConnectionHandler::RemoveTrackUnifiedPlanOnSignalingThread(
     rtc::scoped_refptr<webrtc::RtpSenderInterface> sender,
-    TransceiverStateSurfacer* transceiver_state_surfacer,
+    blink::TransceiverStateSurfacer* transceiver_state_surfacer,
     bool* result) {
   *result = native_peer_connection_->RemoveTrack(sender);
   std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>> transceivers;
@@ -2156,7 +2153,7 @@ void RTCPeerConnectionHandler::OnRenegotiationNeeded() {
 }
 
 void RTCPeerConnectionHandler::OnAddReceiverPlanB(
-    RtpReceiverState receiver_state) {
+    blink::RtpReceiverState receiver_state) {
   DCHECK(task_runner_->RunsTasksInCurrentSequence());
   DCHECK(receiver_state.is_initialized());
   TRACE_EVENT0("webrtc", "RTCPeerConnectionHandler::OnAddReceiverPlanB");
@@ -2172,15 +2169,16 @@ void RTCPeerConnectionHandler::OnAddReceiverPlanB(
           ->IncrementStreamCounter();
   }
   uintptr_t receiver_id =
-      RTCRtpReceiver::getId(receiver_state.webrtc_receiver().get());
+      blink::RTCRtpReceiverImpl::getId(receiver_state.webrtc_receiver().get());
   DCHECK(FindReceiver(receiver_id) == rtp_receivers_.end());
-  auto rtp_receiver = std::make_unique<RTCRtpReceiver>(
+  auto rtp_receiver = std::make_unique<blink::RTCRtpReceiverImpl>(
       native_peer_connection_, std::move(receiver_state));
-  rtp_receivers_.push_back(std::make_unique<RTCRtpReceiver>(*rtp_receiver));
+  rtp_receivers_.push_back(
+      std::make_unique<blink::RTCRtpReceiverImpl>(*rtp_receiver));
   if (peer_connection_tracker_) {
     auto receiver_only_transceiver =
-        std::make_unique<RTCRtpReceiverOnlyTransceiver>(
-            std::make_unique<RTCRtpReceiver>(*rtp_receiver));
+        std::make_unique<blink::RTCRtpReceiverOnlyTransceiver>(
+            std::make_unique<blink::RTCRtpReceiverImpl>(*rtp_receiver));
     size_t receiver_index = GetTransceiverIndex(*receiver_only_transceiver);
     peer_connection_tracker_->TrackAddTransceiver(
         this,
@@ -2197,15 +2195,15 @@ void RTCPeerConnectionHandler::OnRemoveReceiverPlanB(uintptr_t receiver_id) {
 
   auto it = FindReceiver(receiver_id);
   DCHECK(it != rtp_receivers_.end());
-  auto receiver = std::make_unique<RTCRtpReceiver>(*(*it));
+  auto receiver = std::make_unique<blink::RTCRtpReceiverImpl>(*(*it));
   // Update metrics.
   track_metrics_.RemoveTrack(MediaStreamTrackMetrics::Direction::kReceive,
                              MediaStreamTrackMetricsKind(receiver->Track()),
                              receiver->Track().Id().Utf8());
   if (peer_connection_tracker_) {
     auto receiver_only_transceiver =
-        std::make_unique<RTCRtpReceiverOnlyTransceiver>(
-            std::make_unique<RTCRtpReceiver>(*receiver));
+        std::make_unique<blink::RTCRtpReceiverOnlyTransceiver>(
+            std::make_unique<blink::RTCRtpReceiverImpl>(*receiver));
     size_t receiver_index = GetTransceiverIndex(*receiver_only_transceiver);
     peer_connection_tracker_->TrackRemoveTransceiver(
         this,
@@ -2229,7 +2227,7 @@ void RTCPeerConnectionHandler::OnModifySctpTransport(
 }
 
 void RTCPeerConnectionHandler::OnModifyTransceivers(
-    std::vector<RtpTransceiverState> transceiver_states,
+    std::vector<blink::RtpTransceiverState> transceiver_states,
     bool is_remote_description) {
   DCHECK_EQ(configuration_.sdp_semantics, webrtc::SdpSemantics::kUnifiedPlan);
   std::vector<std::unique_ptr<blink::WebRTCRtpTransceiver>> web_transceivers(
@@ -2243,7 +2241,7 @@ void RTCPeerConnectionHandler::OnModifyTransceivers(
     // Figure out if this transceiver is new or if setting the state modified
     // the transceiver such that it should be logged by the
     // |peer_connection_tracker_|.
-    uintptr_t transceiver_id = RTCRtpTransceiver::GetId(
+    uintptr_t transceiver_id = blink::RTCRtpTransceiverImpl::GetId(
         transceiver_states[i].webrtc_transceiver().get());
     auto it = FindTransceiver(transceiver_id);
     bool transceiver_is_new = (it == rtp_transceivers_.end());
@@ -2259,9 +2257,9 @@ void RTCPeerConnectionHandler::OnModifyTransceivers(
     }
 
     // Update the transceiver.
-    web_transceivers[i] =
-        CreateOrUpdateTransceiver(std::move(transceiver_states[i]),
-                                  TransceiverStateUpdateMode::kSetDescription);
+    web_transceivers[i] = CreateOrUpdateTransceiver(
+        std::move(transceiver_states[i]),
+        blink::TransceiverStateUpdateMode::kSetDescription);
 
     // Log a "transceiverAdded" or "transceiverModified" event in
     // chrome://webrtc-internals if new or modified.
@@ -2389,7 +2387,7 @@ void RTCPeerConnectionHandler::ReportFirstSessionDescriptions(
   // video or not.
 }
 
-std::vector<std::unique_ptr<RTCRtpSender>>::iterator
+std::vector<std::unique_ptr<blink::RTCRtpSenderImpl>>::iterator
 RTCPeerConnectionHandler::FindSender(uintptr_t id) {
   for (auto it = rtp_senders_.begin(); it != rtp_senders_.end(); ++it) {
     if ((*it)->Id() == id)
@@ -2398,7 +2396,7 @@ RTCPeerConnectionHandler::FindSender(uintptr_t id) {
   return rtp_senders_.end();
 }
 
-std::vector<std::unique_ptr<RTCRtpReceiver>>::iterator
+std::vector<std::unique_ptr<blink::RTCRtpReceiverImpl>>::iterator
 RTCPeerConnectionHandler::FindReceiver(uintptr_t id) {
   for (auto it = rtp_receivers_.begin(); it != rtp_receivers_.end(); ++it) {
     if ((*it)->Id() == id)
@@ -2407,7 +2405,7 @@ RTCPeerConnectionHandler::FindReceiver(uintptr_t id) {
   return rtp_receivers_.end();
 }
 
-std::vector<std::unique_ptr<RTCRtpTransceiver>>::iterator
+std::vector<std::unique_ptr<blink::RTCRtpTransceiverImpl>>::iterator
 RTCPeerConnectionHandler::FindTransceiver(uintptr_t id) {
   for (auto it = rtp_transceivers_.begin(); it != rtp_transceivers_.end();
        ++it) {
@@ -2446,10 +2444,10 @@ size_t RTCPeerConnectionHandler::GetTransceiverIndex(
   return 0u;
 }
 
-std::unique_ptr<RTCRtpTransceiver>
+std::unique_ptr<blink::RTCRtpTransceiverImpl>
 RTCPeerConnectionHandler::CreateOrUpdateTransceiver(
-    RtpTransceiverState transceiver_state,
-    TransceiverStateUpdateMode update_mode) {
+    blink::RtpTransceiverState transceiver_state,
+    blink::TransceiverStateUpdateMode update_mode) {
   DCHECK_EQ(configuration_.sdp_semantics, webrtc::SdpSemantics::kUnifiedPlan);
   DCHECK(transceiver_state.is_initialized());
   DCHECK(transceiver_state.sender_state());
@@ -2458,30 +2456,31 @@ RTCPeerConnectionHandler::CreateOrUpdateTransceiver(
   auto webrtc_sender = transceiver_state.sender_state()->webrtc_sender();
   auto webrtc_receiver = transceiver_state.receiver_state()->webrtc_receiver();
 
-  std::unique_ptr<RTCRtpTransceiver> transceiver;
-  auto it = FindTransceiver(RTCRtpTransceiver::GetId(webrtc_transceiver.get()));
+  std::unique_ptr<blink::RTCRtpTransceiverImpl> transceiver;
+  auto it = FindTransceiver(
+      blink::RTCRtpTransceiverImpl::GetId(webrtc_transceiver.get()));
   if (it == rtp_transceivers_.end()) {
     // Create a new transceiver, including a sender and a receiver.
-    transceiver = std::make_unique<RTCRtpTransceiver>(
+    transceiver = std::make_unique<blink::RTCRtpTransceiverImpl>(
         native_peer_connection_, track_adapter_map_,
         std::move(transceiver_state));
     rtp_transceivers_.push_back(transceiver->ShallowCopy());
-    DCHECK(FindSender(RTCRtpSender::getId(webrtc_sender.get())) ==
+    DCHECK(FindSender(blink::RTCRtpSenderImpl::getId(webrtc_sender.get())) ==
            rtp_senders_.end());
-    rtp_senders_.push_back(
-        std::make_unique<RTCRtpSender>(*transceiver->content_sender()));
-    DCHECK(FindReceiver(RTCRtpReceiver::getId(webrtc_receiver.get())) ==
-           rtp_receivers_.end());
-    rtp_receivers_.push_back(
-        std::make_unique<RTCRtpReceiver>(*transceiver->content_receiver()));
+    rtp_senders_.push_back(std::make_unique<blink::RTCRtpSenderImpl>(
+        *transceiver->content_sender()));
+    DCHECK(FindReceiver(blink::RTCRtpReceiverImpl::getId(
+               webrtc_receiver.get())) == rtp_receivers_.end());
+    rtp_receivers_.push_back(std::make_unique<blink::RTCRtpReceiverImpl>(
+        *transceiver->content_receiver()));
   } else {
     // Update the transceiver. This also updates the sender and receiver.
     transceiver = (*it)->ShallowCopy();
     transceiver->set_state(std::move(transceiver_state), update_mode);
-    DCHECK(FindSender(RTCRtpSender::getId(webrtc_sender.get())) !=
+    DCHECK(FindSender(blink::RTCRtpSenderImpl::getId(webrtc_sender.get())) !=
            rtp_senders_.end());
-    DCHECK(FindReceiver(RTCRtpReceiver::getId(webrtc_receiver.get())) !=
-           rtp_receivers_.end());
+    DCHECK(FindReceiver(blink::RTCRtpReceiverImpl::getId(
+               webrtc_receiver.get())) != rtp_receivers_.end());
   }
   return transceiver;
 }
@@ -2489,7 +2488,7 @@ RTCPeerConnectionHandler::CreateOrUpdateTransceiver(
 scoped_refptr<base::SingleThreadTaskRunner>
 RTCPeerConnectionHandler::signaling_thread() const {
   DCHECK(task_runner_->RunsTasksInCurrentSequence());
-  return dependency_factory_->GetWebRtcSignalingThread();
+  return dependency_factory_->GetWebRtcSignalingTaskRunner();
 }
 
 blink::WebRTCSessionDescription
diff --git a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.h b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.h
index e8861b12d42..36761026a20 100644
--- a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.h
+++ b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler.h
@@ -20,20 +20,21 @@
 #include "base/threading/thread.h"
 #include "content/common/content_export.h"
 #include "content/renderer/media/webrtc/media_stream_track_metrics.h"
-#include "content/renderer/media/webrtc/rtc_rtp_receiver.h"
-#include "content/renderer/media/webrtc/rtc_rtp_sender.h"
-#include "content/renderer/media/webrtc/transceiver_state_surfacer.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
 #include "third_party/blink/public/platform/web_media_stream_source.h"
 #include "third_party/blink/public/platform/web_rtc_peer_connection_handler.h"
 #include "third_party/blink/public/platform/web_rtc_peer_connection_handler_client.h"
 #include "third_party/blink/public/platform/web_rtc_stats.h"
 #include "third_party/blink/public/platform/web_rtc_stats_request.h"
 #include "third_party/blink/public/platform/web_rtc_stats_response.h"
+#include "third_party/blink/public/web/modules/peerconnection/rtc_rtp_receiver_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/rtc_rtp_sender_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/transceiver_state_surfacer.h"
+#include "third_party/blink/public/web/modules/peerconnection/webrtc_media_stream_track_adapter_map.h"
 #include "third_party/webrtc/api/stats/rtc_stats.h"
 #include "third_party/webrtc/api/stats/rtc_stats_collector_callback.h"
 
 namespace blink {
+class PeerConnectionDependencyFactory;
 class WebLocalFrame;
 class WebRTCAnswerOptions;
 class WebRTCLegacyStats;
@@ -43,7 +44,6 @@ class WebRTCPeerConnectionHandlerClient;
 
 namespace content {
 
-class PeerConnectionDependencyFactory;
 class PeerConnectionTracker;
 class SetLocalDescriptionRequest;
 
@@ -95,7 +95,7 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
  public:
   RTCPeerConnectionHandler(
       blink::WebRTCPeerConnectionHandlerClient* client,
-      PeerConnectionDependencyFactory* dependency_factory,
+      blink::PeerConnectionDependencyFactory* dependency_factory,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner);
   ~RTCPeerConnectionHandler() override;
 
@@ -232,11 +232,12 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
   void OnIceGatheringChange(
       webrtc::PeerConnectionInterface::IceGatheringState new_state);
   void OnRenegotiationNeeded();
-  void OnAddReceiverPlanB(RtpReceiverState receiver_state);
+  void OnAddReceiverPlanB(blink::RtpReceiverState receiver_state);
   void OnRemoveReceiverPlanB(uintptr_t receiver_id);
   void OnModifySctpTransport(blink::WebRTCSctpTransportSnapshot state);
-  void OnModifyTransceivers(std::vector<RtpTransceiverState> transceiver_states,
-                            bool is_remote_description);
+  void OnModifyTransceivers(
+      std::vector<blink::RtpTransceiverState> transceiver_states,
+      bool is_remote_description);
   void OnDataChannel(scoped_refptr<webrtc::DataChannelInterface> channel);
   void OnIceCandidate(const std::string& sdp,
                       const std::string& sdp_mid,
@@ -288,19 +289,19 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
   void AddTransceiverWithTrackOnSignalingThread(
       rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track,
       webrtc::RtpTransceiverInit init,
-      TransceiverStateSurfacer* transceiver_state_surfacer,
+      blink::TransceiverStateSurfacer* transceiver_state_surfacer,
       webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>*
           error_or_transceiver);
   void AddTransceiverWithMediaTypeOnSignalingThread(
       cricket::MediaType media_type,
       webrtc::RtpTransceiverInit init,
-      TransceiverStateSurfacer* transceiver_state_surfacer,
+      blink::TransceiverStateSurfacer* transceiver_state_surfacer,
       webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>*
           error_or_transceiver);
   void AddTrackOnSignalingThread(
       rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
       std::vector<std::string> stream_ids,
-      TransceiverStateSurfacer* transceiver_state_surfacer,
+      blink::TransceiverStateSurfacer* transceiver_state_surfacer,
       webrtc::RTCErrorOr<rtc::scoped_refptr<webrtc::RtpSenderInterface>>*
           error_or_sender);
   bool RemoveTrackPlanB(blink::WebRTCRtpSender* web_sender);
@@ -308,7 +309,7 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
   RemoveTrackUnifiedPlan(blink::WebRTCRtpSender* web_sender);
   void RemoveTrackUnifiedPlanOnSignalingThread(
       rtc::scoped_refptr<webrtc::RtpSenderInterface> sender,
-      TransceiverStateSurfacer* transceiver_state_surfacer,
+      blink::TransceiverStateSurfacer* transceiver_state_surfacer,
       bool* result);
   std::vector<std::unique_ptr<blink::WebRTCRtpTransceiver>> CreateOfferInternal(
       const blink::WebRTCSessionDescriptionRequest& request,
@@ -316,12 +317,13 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
   void CreateOfferOnSignalingThread(
       webrtc::CreateSessionDescriptionObserver* observer,
       webrtc::PeerConnectionInterface::RTCOfferAnswerOptions offer_options,
-      TransceiverStateSurfacer* transceiver_state_surfacer);
-  std::vector<std::unique_ptr<RTCRtpSender>>::iterator FindSender(uintptr_t id);
-  std::vector<std::unique_ptr<RTCRtpReceiver>>::iterator FindReceiver(
-      uintptr_t id);
-  std::vector<std::unique_ptr<RTCRtpTransceiver>>::iterator FindTransceiver(
+      blink::TransceiverStateSurfacer* transceiver_state_surfacer);
+  std::vector<std::unique_ptr<blink::RTCRtpSenderImpl>>::iterator FindSender(
       uintptr_t id);
+  std::vector<std::unique_ptr<blink::RTCRtpReceiverImpl>>::iterator
+  FindReceiver(uintptr_t id);
+  std::vector<std::unique_ptr<blink::RTCRtpTransceiverImpl>>::iterator
+  FindTransceiver(uintptr_t id);
   // For full transceiver implementations, returns the index of
   // |rtp_transceivers_| that correspond to |web_transceiver|.
   // For sender-only transceiver implementations, returns the index of
@@ -331,9 +333,9 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
   // NOTREACHED()-crashes if no correspondent is found.
   size_t GetTransceiverIndex(
       const blink::WebRTCRtpTransceiver& web_transceiver);
-  std::unique_ptr<RTCRtpTransceiver> CreateOrUpdateTransceiver(
-      RtpTransceiverState transceiver_state,
-      TransceiverStateUpdateMode update_mode);
+  std::unique_ptr<blink::RTCRtpTransceiverImpl> CreateOrUpdateTransceiver(
+      blink::RtpTransceiverState transceiver_state,
+      blink::TransceiverStateUpdateMode update_mode);
 
   scoped_refptr<base::SingleThreadTaskRunner> signaling_thread() const;
 
@@ -352,7 +354,7 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
 
   // |dependency_factory_| is a raw pointer, and is valid for the lifetime of
   // RenderThreadImpl.
-  PeerConnectionDependencyFactory* const dependency_factory_;
+  blink::PeerConnectionDependencyFactory* const dependency_factory_;
 
   blink::WebLocalFrame* frame_ = nullptr;
 
@@ -363,17 +365,17 @@ class CONTENT_EXPORT RTCPeerConnectionHandler
   // Track adapters are created on the fly when a component (such as a stream)
   // needs to reference it, and automatically disposed when there are no longer
   // any components referencing it.
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
+  scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
   // In Plan B, senders and receivers are added or removed independently of one
   // another. In Unified Plan, senders and receivers are created in pairs as
   // transceivers. Transceivers may become inactive, but are never removed.
   // TODO(hbos): Implement transceiver behaviors. https://crbug.com/777617
   // Content layer correspondents of |webrtc::RtpSenderInterface|.
-  std::vector<std::unique_ptr<RTCRtpSender>> rtp_senders_;
+  std::vector<std::unique_ptr<blink::RTCRtpSenderImpl>> rtp_senders_;
   // Content layer correspondents of |webrtc::RtpReceiverInterface|.
-  std::vector<std::unique_ptr<RTCRtpReceiver>> rtp_receivers_;
+  std::vector<std::unique_ptr<blink::RTCRtpReceiverImpl>> rtp_receivers_;
   // Content layer correspondents of |webrtc::RtpTransceiverInterface|.
-  std::vector<std::unique_ptr<RTCRtpTransceiver>> rtp_transceivers_;
+  std::vector<std::unique_ptr<blink::RTCRtpTransceiverImpl>> rtp_transceivers_;
 
   base::WeakPtr<PeerConnectionTracker> peer_connection_tracker_;
 
diff --git a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler_unittest.cc b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler_unittest.cc
index 786fd539a4b..a31bfb1929c 100644
--- a/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler_unittest.cc
+++ b/chromium/content/renderer/media/webrtc/rtc_peer_connection_handler_unittest.cc
@@ -25,10 +25,6 @@
 #include "base/values.h"
 #include "content/child/child_process.h"
 #include "content/renderer/media/audio/mock_audio_device_factory.h"
-#include "content/renderer/media/webrtc/mock_data_channel_impl.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "content/renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h"
 #include "content/renderer/media/webrtc/peer_connection_tracker.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -55,6 +51,10 @@
 #include "third_party/blink/public/web/modules/mediastream/media_stream_video_track.h"
 #include "third_party/blink/public/web/modules/mediastream/mock_media_stream_video_source.h"
 #include "third_party/blink/public/web/modules/mediastream/processed_local_audio_source.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_data_channel_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_dependency_factory.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_web_rtc_peer_connection_handler_client.h"
 #include "third_party/blink/public/web/modules/webrtc/webrtc_audio_device_impl.h"
 #include "third_party/blink/public/web/web_heap.h"
 #include "third_party/webrtc/api/peer_connection_interface.h"
@@ -83,20 +83,12 @@ ACTION_TEMPLATE(SaveArgPointeeMove,
 }
 
 // Test blink::Platform implementation that overrides the known methods needed
-// by the tests, including creation of WebRtcAudioDevice and
-// AudioCapturerSource instances.
+// by the tests, including creation of AudioCapturerSource instances.
 //
 // TODO(crbug.com/704136): When this test moves to blink/renderer/ it should
 // inherit from TestingPlatformSupport and use ScopedTestingPlatformSupport.
-class WebRtcAudioDeviceTestingPlatformSupport : public blink::Platform {
+class AudioCapturerSourceTestingPlatformSupport : public blink::Platform {
  public:
-  WebRtcAudioDeviceTestingPlatformSupport(
-      MockPeerConnectionDependencyFactory* pc_factory)
-      : pc_factory_(pc_factory) {}
-  blink::WebRtcAudioDeviceImpl* GetWebRtcAudioDevice() override {
-    return pc_factory_->GetWebRtcAudioDevice();
-  }
-
   scoped_refptr<base::SingleThreadTaskRunner> GetIOTaskRunner() const override {
     return ChildProcess::current() ? ChildProcess::current()->io_task_runner()
                                    : nullptr;
@@ -109,9 +101,6 @@ class WebRtcAudioDeviceTestingPlatformSupport : public blink::Platform {
     EXPECT_EQ(nullptr, web_frame);
     return AudioDeviceFactory::NewAudioCapturerSource(MSG_ROUTING_NONE, params);
   }
-
- private:
-  MockPeerConnectionDependencyFactory* pc_factory_;
 };
 
 class MockRTCStatsResponse : public LocalRTCStatsResponse {
@@ -279,14 +268,14 @@ class RTCPeerConnectionHandlerUnderTest : public RTCPeerConnectionHandler {
  public:
   RTCPeerConnectionHandlerUnderTest(
       WebRTCPeerConnectionHandlerClient* client,
-      PeerConnectionDependencyFactory* dependency_factory)
+      blink::PeerConnectionDependencyFactory* dependency_factory)
       : RTCPeerConnectionHandler(
             client,
             dependency_factory,
             blink::scheduler::GetSingleThreadTaskRunnerForTesting()) {}
 
-  MockPeerConnectionImpl* native_peer_connection() {
-    return static_cast<MockPeerConnectionImpl*>(
+  blink::MockPeerConnectionImpl* native_peer_connection() {
+    return static_cast<blink::MockPeerConnectionImpl*>(
         RTCPeerConnectionHandler::native_peer_connection());
   }
 
@@ -300,13 +289,14 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
   RTCPeerConnectionHandlerTest() : mock_peer_connection_(nullptr) {}
 
   void SetUp() override {
-    mock_client_.reset(new NiceMock<MockWebRTCPeerConnectionHandlerClient>());
-    mock_dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
+    mock_client_.reset(
+        new NiceMock<blink::MockWebRTCPeerConnectionHandlerClient>());
+    mock_dependency_factory_.reset(
+        new blink::MockPeerConnectionDependencyFactory());
 
     platform_original_ = blink::Platform::Current();
-    webrtc_audio_device_platform_support_.reset(
-        new WebRtcAudioDeviceTestingPlatformSupport(
-            mock_dependency_factory_.get()));
+    webrtc_audio_device_platform_support_ =
+        std::make_unique<AudioCapturerSourceTestingPlatformSupport>();
     blink::Platform::SetCurrentPlatformForTesting(
         webrtc_audio_device_platform_support_.get());
 
@@ -403,12 +393,12 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
     rtc::scoped_refptr<webrtc::MediaStreamInterface> stream(
         mock_dependency_factory_->CreateLocalMediaStream(stream_label).get());
     if (!video_track_label.empty()) {
-      InvokeAddTrack(stream,
-                     MockWebRtcVideoTrack::Create(video_track_label).get());
+      InvokeAddTrack(
+          stream, blink::MockWebRtcVideoTrack::Create(video_track_label).get());
     }
     if (!audio_track_label.empty()) {
-      InvokeAddTrack(stream,
-                     MockWebRtcAudioTrack::Create(audio_track_label).get());
+      InvokeAddTrack(
+          stream, blink::MockWebRtcAudioTrack::Create(audio_track_label).get());
     }
     mock_peer_connection_->AddRemoteStream(stream);
     return stream;
@@ -431,8 +421,8 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
             error_or_transceiver.value()->ImplementationType(),
             blink::WebRTCRtpTransceiverImplementationType::kPlanBSenderOnly);
         auto sender = error_or_transceiver.value()->Sender();
-        senders_.push_back(std::unique_ptr<RTCRtpSender>(
-            static_cast<RTCRtpSender*>(sender.release())));
+        senders_.push_back(std::unique_ptr<blink::RTCRtpSenderImpl>(
+            static_cast<blink::RTCRtpSenderImpl*>(sender.release())));
       }
     }
     for (const auto& web_video_track : web_stream.VideoTracks()) {
@@ -443,15 +433,15 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
             error_or_transceiver.value()->ImplementationType(),
             blink::WebRTCRtpTransceiverImplementationType::kPlanBSenderOnly);
         auto sender = error_or_transceiver.value()->Sender();
-        senders_.push_back(std::unique_ptr<RTCRtpSender>(
-            static_cast<RTCRtpSender*>(sender.release())));
+        senders_.push_back(std::unique_ptr<blink::RTCRtpSenderImpl>(
+            static_cast<blink::RTCRtpSenderImpl*>(sender.release())));
       }
     }
     return senders_size_before_add < senders_.size();
   }
 
-  std::vector<std::unique_ptr<RTCRtpSender>>::iterator FindSenderForTrack(
-      const blink::WebMediaStreamTrack& web_track) {
+  std::vector<std::unique_ptr<blink::RTCRtpSenderImpl>>::iterator
+  FindSenderForTrack(const blink::WebMediaStreamTrack& web_track) {
     for (auto it = senders_.begin(); it != senders_.end(); ++it) {
       if ((*it)->Track().UniqueId() == web_track.UniqueId())
         return it;
@@ -490,7 +480,7 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
       const rtc::scoped_refptr<webrtc::MediaStreamTrackInterface>& remote_track,
       const rtc::scoped_refptr<webrtc::MediaStreamInterface>& remote_stream) {
     rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver(
-        new rtc::RefCountedObject<FakeRtpReceiver>(remote_track));
+        new rtc::RefCountedObject<blink::FakeRtpReceiver>(remote_track));
     receivers_by_track_.insert(std::make_pair(remote_track.get(), receiver));
     std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>
         receiver_streams;
@@ -568,7 +558,7 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
 
   template <typename T>
   void InvokeOnSignalingThread(T callback) {
-    mock_dependency_factory_->GetWebRtcSignalingThread()->PostTask(
+    mock_dependency_factory_->GetWebRtcSignalingTaskRunner()->PostTask(
         FROM_HERE, std::move(callback));
     RunMessageLoopsUntilIdle();
   }
@@ -579,7 +569,7 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
     base::WaitableEvent waitable_event(
         base::WaitableEvent::ResetPolicy::MANUAL,
         base::WaitableEvent::InitialState::NOT_SIGNALED);
-    mock_dependency_factory_->GetWebRtcSignalingThread()->PostTask(
+    mock_dependency_factory_->GetWebRtcSignalingTaskRunner()->PostTask(
         FROM_HERE, base::BindOnce(&base::WaitableEvent::Signal,
                                   base::Unretained(&waitable_event)));
     waitable_event.Wait();
@@ -596,19 +586,20 @@ class RTCPeerConnectionHandlerTest : public ::testing::Test {
   // ThreadPool.
   base::test::TaskEnvironment task_environment_;
   ChildProcess child_process_;
-  std::unique_ptr<WebRtcAudioDeviceTestingPlatformSupport>
+  std::unique_ptr<AudioCapturerSourceTestingPlatformSupport>
       webrtc_audio_device_platform_support_;
   blink::Platform* platform_original_ = nullptr;
-  std::unique_ptr<MockWebRTCPeerConnectionHandlerClient> mock_client_;
-  std::unique_ptr<MockPeerConnectionDependencyFactory> mock_dependency_factory_;
+  std::unique_ptr<blink::MockWebRTCPeerConnectionHandlerClient> mock_client_;
+  std::unique_ptr<blink::MockPeerConnectionDependencyFactory>
+      mock_dependency_factory_;
   std::unique_ptr<NiceMock<MockPeerConnectionTracker>> mock_tracker_;
   std::unique_ptr<RTCPeerConnectionHandlerUnderTest> pc_handler_;
   MockAudioDeviceFactory mock_audio_device_factory_;
 
   // Weak reference to the mocked native peer connection implementation.
-  MockPeerConnectionImpl* mock_peer_connection_;
+  blink::MockPeerConnectionImpl* mock_peer_connection_;
 
-  std::vector<std::unique_ptr<RTCRtpSender>> senders_;
+  std::vector<std::unique_ptr<blink::RTCRtpSenderImpl>> senders_;
   std::map<webrtc::MediaStreamTrackInterface*,
            rtc::scoped_refptr<webrtc::RtpReceiverInterface>>
       receivers_by_track_;
@@ -654,7 +645,7 @@ TEST_F(RTCPeerConnectionHandlerTest, NoCallbacksToClientAfterStop) {
   EXPECT_CALL(*mock_client_.get(), DidAddRemoteDataChannel(_)).Times(0);
   webrtc::DataChannelInit config;
   rtc::scoped_refptr<webrtc::DataChannelInterface> remote_data_channel(
-      new rtc::RefCountedObject<MockDataChannel>("dummy", &config));
+      new rtc::RefCountedObject<blink::MockDataChannel>("dummy", &config));
   pc_handler_->observer()->OnDataChannel(remote_data_channel);
 
   RunMessageLoopsUntilIdle();
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_receiver.cc b/chromium/content/renderer/media/webrtc/rtc_rtp_receiver.cc
deleted file mode 100644
index a5438de20d8..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_receiver.cc
+++ /dev/null
@@ -1,381 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_rtp_receiver.h"
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_source.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-#include "third_party/webrtc/api/scoped_refptr.h"
-
-namespace content {
-
-RtpReceiverState::RtpReceiverState(
-    scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
-    scoped_refptr<webrtc::RtpReceiverInterface> webrtc_receiver,
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref,
-    std::vector<std::string> stream_id)
-    : main_task_runner_(std::move(main_task_runner)),
-      signaling_task_runner_(std::move(signaling_task_runner)),
-      webrtc_receiver_(std::move(webrtc_receiver)),
-      webrtc_dtls_transport_(webrtc_receiver_->dtls_transport()),
-      webrtc_dtls_transport_information_(webrtc::DtlsTransportState::kNew),
-      is_initialized_(false),
-      track_ref_(std::move(track_ref)),
-      stream_ids_(std::move(stream_id)) {
-  DCHECK(main_task_runner_);
-  DCHECK(signaling_task_runner_);
-  DCHECK(webrtc_receiver_);
-  DCHECK(track_ref_);
-  if (webrtc_dtls_transport_) {
-    webrtc_dtls_transport_information_ = webrtc_dtls_transport_->Information();
-  }
-}
-
-RtpReceiverState::RtpReceiverState(RtpReceiverState&& other)
-    : main_task_runner_(other.main_task_runner_),
-      signaling_task_runner_(other.signaling_task_runner_),
-      webrtc_receiver_(std::move(other.webrtc_receiver_)),
-      webrtc_dtls_transport_(std::move(other.webrtc_dtls_transport_)),
-      webrtc_dtls_transport_information_(
-          other.webrtc_dtls_transport_information_),
-      is_initialized_(other.is_initialized_),
-      track_ref_(std::move(other.track_ref_)),
-      stream_ids_(std::move(other.stream_ids_)) {
-  // Explicitly null |other|'s task runners for use in destructor.
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-}
-
-RtpReceiverState::~RtpReceiverState() {
-  // It's OK to not be on the main thread if this state has been moved, in which
-  // case |main_task_runner_| is null.
-  DCHECK(!main_task_runner_ || main_task_runner_->BelongsToCurrentThread());
-}
-
-RtpReceiverState& RtpReceiverState::operator=(RtpReceiverState&& other) {
-  DCHECK_EQ(main_task_runner_, other.main_task_runner_);
-  DCHECK_EQ(signaling_task_runner_, other.signaling_task_runner_);
-  // Explicitly null |other|'s task runners for use in destructor.
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-  webrtc_receiver_ = std::move(other.webrtc_receiver_);
-  webrtc_dtls_transport_ = std::move(other.webrtc_dtls_transport_);
-  webrtc_dtls_transport_information_ = other.webrtc_dtls_transport_information_;
-  track_ref_ = std::move(other.track_ref_);
-  stream_ids_ = std::move(other.stream_ids_);
-  return *this;
-}
-
-bool RtpReceiverState::is_initialized() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return is_initialized_;
-}
-
-void RtpReceiverState::Initialize() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  if (is_initialized_)
-    return;
-  track_ref_->InitializeOnMainThread();
-  is_initialized_ = true;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner> RtpReceiverState::main_task_runner()
-    const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return main_task_runner_;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-RtpReceiverState::signaling_task_runner() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return signaling_task_runner_;
-}
-
-scoped_refptr<webrtc::RtpReceiverInterface> RtpReceiverState::webrtc_receiver()
-    const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_receiver_;
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-RtpReceiverState::webrtc_dtls_transport() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_dtls_transport_;
-}
-
-webrtc::DtlsTransportInformation
-RtpReceiverState::webrtc_dtls_transport_information() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_dtls_transport_information_;
-}
-
-const std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>&
-RtpReceiverState::track_ref() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return track_ref_;
-}
-
-const std::vector<std::string>& RtpReceiverState::stream_ids() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return stream_ids_;
-}
-
-class RTCRtpReceiver::RTCRtpReceiverInternal
-    : public base::RefCountedThreadSafe<
-          RTCRtpReceiver::RTCRtpReceiverInternal,
-          RTCRtpReceiver::RTCRtpReceiverInternalTraits> {
- public:
-  RTCRtpReceiverInternal(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      RtpReceiverState state)
-      : native_peer_connection_(std::move(native_peer_connection)),
-        main_task_runner_(state.main_task_runner()),
-        signaling_task_runner_(state.signaling_task_runner()),
-        webrtc_receiver_(state.webrtc_receiver()),
-        state_(std::move(state)) {
-    DCHECK(native_peer_connection_);
-    DCHECK(state_.is_initialized());
-  }
-
-  const RtpReceiverState& state() const {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    return state_;
-  }
-
-  void set_state(RtpReceiverState state) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    DCHECK(state.main_task_runner() == main_task_runner_);
-    DCHECK(state.signaling_task_runner() == signaling_task_runner_);
-    DCHECK(state.webrtc_receiver() == webrtc_receiver_);
-    DCHECK(state.is_initialized());
-    state_ = std::move(state);
-  }
-
-  blink::WebVector<std::unique_ptr<blink::WebRTCRtpSource>> GetSources() {
-    // The webrtc_recever_ is a proxy, so this is a blocking call to the webrtc
-    // signalling thread.
-    auto webrtc_sources = webrtc_receiver_->GetSources();
-    blink::WebVector<std::unique_ptr<blink::WebRTCRtpSource>> sources(
-        webrtc_sources.size());
-    for (size_t i = 0; i < webrtc_sources.size(); ++i) {
-      sources[i] = blink::CreateRTCRtpSource(webrtc_sources[i]);
-    }
-    return sources;
-  }
-
-  void GetStats(
-      blink::WebRTCStatsReportCallback callback,
-      const blink::WebVector<webrtc::NonStandardGroupId>& exposed_group_ids) {
-    signaling_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&RTCRtpReceiverInternal::GetStatsOnSignalingThread, this,
-                       std::move(callback), exposed_group_ids));
-  }
-
-  std::unique_ptr<webrtc::RtpParameters> GetParameters() {
-    return std::make_unique<webrtc::RtpParameters>(
-        webrtc_receiver_->GetParameters());
-  }
-
-  void SetJitterBufferMinimumDelay(base::Optional<double> delay_seconds) {
-    webrtc_receiver_->SetJitterBufferMinimumDelay(
-        blink::ToAbslOptional(delay_seconds));
-  }
-
- private:
-  friend struct RTCRtpReceiver::RTCRtpReceiverInternalTraits;
-
-  ~RTCRtpReceiverInternal() {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-  }
-
-  void GetStatsOnSignalingThread(
-      blink::WebRTCStatsReportCallback callback,
-      const blink::WebVector<webrtc::NonStandardGroupId>& exposed_group_ids) {
-    native_peer_connection_->GetStats(
-        webrtc_receiver_.get(),
-        blink::CreateRTCStatsCollectorCallback(
-            main_task_runner_, std::move(callback), exposed_group_ids));
-  }
-
-  const scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection_;
-  // Task runners and webrtc receiver: Same information as stored in
-  // |state_| but const and safe to touch on the signaling thread to
-  // avoid race with set_state().
-  const scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  const scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  const scoped_refptr<webrtc::RtpReceiverInterface> webrtc_receiver_;
-  RtpReceiverState state_;
-};
-
-struct RTCRtpReceiver::RTCRtpReceiverInternalTraits {
- private:
-  friend class base::RefCountedThreadSafe<RTCRtpReceiverInternal,
-                                          RTCRtpReceiverInternalTraits>;
-
-  static void Destruct(const RTCRtpReceiverInternal* receiver) {
-    // RTCRtpReceiverInternal owns AdapterRefs which have to be destroyed on the
-    // main thread, this ensures delete always happens there.
-    if (!receiver->main_task_runner_->BelongsToCurrentThread()) {
-      receiver->main_task_runner_->PostTask(
-          FROM_HERE,
-          base::BindOnce(
-              &RTCRtpReceiver::RTCRtpReceiverInternalTraits::Destruct,
-              base::Unretained(receiver)));
-      return;
-    }
-    delete receiver;
-  }
-};
-
-uintptr_t RTCRtpReceiver::getId(
-    const webrtc::RtpReceiverInterface* webrtc_rtp_receiver) {
-  return reinterpret_cast<uintptr_t>(webrtc_rtp_receiver);
-}
-
-RTCRtpReceiver::RTCRtpReceiver(
-    scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-    RtpReceiverState state)
-    : internal_(new RTCRtpReceiverInternal(std::move(native_peer_connection),
-                                           std::move(state))) {}
-
-RTCRtpReceiver::RTCRtpReceiver(const RTCRtpReceiver& other)
-    : internal_(other.internal_) {}
-
-RTCRtpReceiver::~RTCRtpReceiver() {}
-
-RTCRtpReceiver& RTCRtpReceiver::operator=(const RTCRtpReceiver& other) {
-  internal_ = other.internal_;
-  return *this;
-}
-
-const RtpReceiverState& RTCRtpReceiver::state() const {
-  return internal_->state();
-}
-
-void RTCRtpReceiver::set_state(RtpReceiverState state) {
-  internal_->set_state(std::move(state));
-}
-
-std::unique_ptr<blink::WebRTCRtpReceiver> RTCRtpReceiver::ShallowCopy() const {
-  return std::make_unique<RTCRtpReceiver>(*this);
-}
-
-uintptr_t RTCRtpReceiver::Id() const {
-  return getId(internal_->state().webrtc_receiver().get());
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-RTCRtpReceiver::DtlsTransport() {
-  return internal_->state().webrtc_dtls_transport();
-}
-
-webrtc::DtlsTransportInformation RTCRtpReceiver::DtlsTransportInformation() {
-  return internal_->state().webrtc_dtls_transport_information();
-}
-
-const blink::WebMediaStreamTrack& RTCRtpReceiver::Track() const {
-  return internal_->state().track_ref()->web_track();
-}
-
-blink::WebVector<blink::WebString> RTCRtpReceiver::StreamIds() const {
-  const auto& stream_ids = internal_->state().stream_ids();
-  blink::WebVector<blink::WebString> web_stream_ids(stream_ids.size());
-  for (size_t i = 0; i < stream_ids.size(); ++i)
-    web_stream_ids[i] = blink::WebString::FromUTF8(stream_ids[i]);
-  return web_stream_ids;
-}
-
-blink::WebVector<std::unique_ptr<blink::WebRTCRtpSource>>
-RTCRtpReceiver::GetSources() {
-  return internal_->GetSources();
-}
-
-void RTCRtpReceiver::GetStats(
-    blink::WebRTCStatsReportCallback callback,
-    const blink::WebVector<webrtc::NonStandardGroupId>& exposed_group_ids) {
-  internal_->GetStats(std::move(callback), exposed_group_ids);
-}
-
-std::unique_ptr<webrtc::RtpParameters> RTCRtpReceiver::GetParameters() const {
-  return internal_->GetParameters();
-}
-
-void RTCRtpReceiver::SetJitterBufferMinimumDelay(
-    base::Optional<double> delay_seconds) {
-  internal_->SetJitterBufferMinimumDelay(delay_seconds);
-}
-
-RTCRtpReceiverOnlyTransceiver::RTCRtpReceiverOnlyTransceiver(
-    std::unique_ptr<blink::WebRTCRtpReceiver> receiver)
-    : receiver_(std::move(receiver)) {
-  DCHECK(receiver_);
-}
-
-RTCRtpReceiverOnlyTransceiver::~RTCRtpReceiverOnlyTransceiver() {}
-
-blink::WebRTCRtpTransceiverImplementationType
-RTCRtpReceiverOnlyTransceiver::ImplementationType() const {
-  return blink::WebRTCRtpTransceiverImplementationType::kPlanBReceiverOnly;
-}
-
-uintptr_t RTCRtpReceiverOnlyTransceiver::Id() const {
-  NOTIMPLEMENTED();
-  return 0u;
-}
-
-blink::WebString RTCRtpReceiverOnlyTransceiver::Mid() const {
-  NOTIMPLEMENTED();
-  return blink::WebString();
-}
-
-std::unique_ptr<blink::WebRTCRtpSender> RTCRtpReceiverOnlyTransceiver::Sender()
-    const {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-std::unique_ptr<blink::WebRTCRtpReceiver>
-RTCRtpReceiverOnlyTransceiver::Receiver() const {
-  return receiver_->ShallowCopy();
-}
-
-bool RTCRtpReceiverOnlyTransceiver::Stopped() const {
-  NOTIMPLEMENTED();
-  return false;
-}
-
-webrtc::RtpTransceiverDirection RTCRtpReceiverOnlyTransceiver::Direction()
-    const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-void RTCRtpReceiverOnlyTransceiver::SetDirection(
-    webrtc::RtpTransceiverDirection direction) {
-  NOTIMPLEMENTED();
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RTCRtpReceiverOnlyTransceiver::CurrentDirection() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RTCRtpReceiverOnlyTransceiver::FiredDirection() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-webrtc::RTCError RTCRtpReceiverOnlyTransceiver::SetCodecPreferences(
-    blink::WebVector<webrtc::RtpCodecCapability>) {
-  NOTIMPLEMENTED();
-  return {};
-}
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_receiver.h b/chromium/content/renderer/media/webrtc/rtc_rtp_receiver.h
deleted file mode 100644
index 54e2eadb573..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_receiver.h
+++ /dev/null
@@ -1,174 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_RECEIVER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_RECEIVER_H_
-
-#include <vector>
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/single_thread_task_runner.h"
-#include "content/common/content_export.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "third_party/blink/public/platform/web_media_stream.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_receiver.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_transceiver.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-#include "third_party/webrtc/api/media_stream_interface.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-#include "third_party/webrtc/api/rtp_receiver_interface.h"
-#include "third_party/webrtc/api/stats/rtc_stats.h"
-
-namespace content {
-
-// This class represents the state of a receiver; a snapshot of what a
-// webrtc-layer receiver looked like when it was inspected on the signaling
-// thread such that this information can be moved to the main thread in a single
-// PostTask. It is used to surface state changes to make the blink-layer
-// receiver up-to-date.
-//
-// Blink objects live on the main thread and webrtc objects live on the
-// signaling thread. If multiple asynchronous operations begin execution on the
-// main thread they are posted and executed in order on the signaling thread.
-// For example, operation A and operation B are called in JavaScript. When A is
-// done on the signaling thread, webrtc object states will be updated. A
-// callback is posted to the main thread so that blink objects can be updated to
-// match the result of operation A. But if callback A tries to inspect the
-// webrtc objects from the main thread this requires posting back to the
-// signaling thread and waiting, which also includes waiting for the previously
-// posted task: operation B. Inspecting the webrtc object like this does not
-// guarantee you to get the state of operation A.
-//
-// As such, all state changes associated with an operation have to be surfaced
-// in the same callback. This includes copying any states into a separate object
-// so that it can be inspected on the main thread without any additional thread
-// hops.
-//
-// The RtpReceiverState is a snapshot of what the webrtc::RtpReceiverInterface
-// looked like when the RtpReceiverState was created on the signaling thread. It
-// also takes care of initializing track adapters, such that we have access to a
-// blink track corresponding to the webrtc track of the receiver.
-//
-// Except for initialization logic and operator=(), the RtpReceiverState is
-// immutable and only accessible on the main thread.
-//
-// TODO(hbos): [Onion Soup] When the sender implementation is moved to blink
-// this will be part of the blink sender instead of the content sender.
-// https://crbug.com/787254
-class CONTENT_EXPORT RtpReceiverState {
- public:
-  RtpReceiverState(
-      scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
-      scoped_refptr<webrtc::RtpReceiverInterface> webrtc_receiver,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref,
-      std::vector<std::string> stream_ids);
-  RtpReceiverState(RtpReceiverState&&);
-  RtpReceiverState(const RtpReceiverState&) = delete;
-  ~RtpReceiverState();
-
-  // This is intended to be used for moving the object from the signaling thread
-  // to the main thread and as such has no thread checks. Once moved to the main
-  // this should only be invoked on the main thread.
-  RtpReceiverState& operator=(RtpReceiverState&&);
-  RtpReceiverState& operator=(const RtpReceiverState&) = delete;
-
-  bool is_initialized() const;
-  void Initialize();
-
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner() const;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner() const;
-  scoped_refptr<webrtc::RtpReceiverInterface> webrtc_receiver() const;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> webrtc_dtls_transport()
-      const;
-  webrtc::DtlsTransportInformation webrtc_dtls_transport_information() const;
-
-  const std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>&
-  track_ref() const;
-  const std::vector<std::string>& stream_ids() const;
-
- private:
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  scoped_refptr<webrtc::RtpReceiverInterface> webrtc_receiver_;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> webrtc_dtls_transport_;
-  webrtc::DtlsTransportInformation webrtc_dtls_transport_information_;
-  bool is_initialized_;
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref_;
-  std::vector<std::string> stream_ids_;
-};
-
-// Used to surface |webrtc::RtpReceiverInterface| to blink. Multiple
-// |RTCRtpReceiver|s could reference the same webrtc receiver; |id| is the value
-// of the pointer to the webrtc receiver.
-class CONTENT_EXPORT RTCRtpReceiver : public blink::WebRTCRtpReceiver {
- public:
-  static uintptr_t getId(
-      const webrtc::RtpReceiverInterface* webrtc_rtp_receiver);
-
-  RTCRtpReceiver(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      RtpReceiverState state);
-  RTCRtpReceiver(const RTCRtpReceiver& other);
-  ~RTCRtpReceiver() override;
-
-  RTCRtpReceiver& operator=(const RTCRtpReceiver& other);
-
-  const RtpReceiverState& state() const;
-  void set_state(RtpReceiverState state);
-
-  std::unique_ptr<blink::WebRTCRtpReceiver> ShallowCopy() const override;
-  uintptr_t Id() const override;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> DtlsTransport() override;
-  webrtc::DtlsTransportInformation DtlsTransportInformation() override;
-
-  const blink::WebMediaStreamTrack& Track() const override;
-  blink::WebVector<blink::WebString> StreamIds() const override;
-  blink::WebVector<std::unique_ptr<blink::WebRTCRtpSource>> GetSources()
-      override;
-  void GetStats(blink::WebRTCStatsReportCallback,
-                const blink::WebVector<webrtc::NonStandardGroupId>&) override;
-  std::unique_ptr<webrtc::RtpParameters> GetParameters() const override;
-  void SetJitterBufferMinimumDelay(
-      base::Optional<double> delay_seconds) override;
-
- private:
-  class RTCRtpReceiverInternal;
-  struct RTCRtpReceiverInternalTraits;
-
-  scoped_refptr<RTCRtpReceiverInternal> internal_;
-};
-
-class CONTENT_EXPORT RTCRtpReceiverOnlyTransceiver
-    : public blink::WebRTCRtpTransceiver {
- public:
-  RTCRtpReceiverOnlyTransceiver(
-      std::unique_ptr<blink::WebRTCRtpReceiver> receiver);
-  ~RTCRtpReceiverOnlyTransceiver() override;
-
-  blink::WebRTCRtpTransceiverImplementationType ImplementationType()
-      const override;
-  uintptr_t Id() const override;
-  blink::WebString Mid() const override;
-  std::unique_ptr<blink::WebRTCRtpSender> Sender() const override;
-  std::unique_ptr<blink::WebRTCRtpReceiver> Receiver() const override;
-  bool Stopped() const override;
-  webrtc::RtpTransceiverDirection Direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection direction) override;
-  base::Optional<webrtc::RtpTransceiverDirection> CurrentDirection()
-      const override;
-  base::Optional<webrtc::RtpTransceiverDirection> FiredDirection()
-      const override;
-  webrtc::RTCError SetCodecPreferences(
-      blink::WebVector<webrtc::RtpCodecCapability>) override;
-
- private:
-  std::unique_ptr<blink::WebRTCRtpReceiver> receiver_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_RECEIVER_H_
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_receiver_unittest.cc b/chromium/content/renderer/media/webrtc/rtc_rtp_receiver_unittest.cc
deleted file mode 100644
index 4feab2f80dd..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_receiver_unittest.cc
+++ /dev/null
@@ -1,170 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_rtp_receiver.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "base/memory/ref_counted.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/test/task_environment.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/blink/public/web/web_heap.h"
-#include "third_party/webrtc/api/stats/rtc_stats_report.h"
-#include "third_party/webrtc/api/stats/rtcstats_objects.h"
-#include "third_party/webrtc/api/test/mock_rtpreceiver.h"
-
-namespace content {
-
-class RTCRtpReceiverTest : public ::testing::Test {
- public:
-  void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
-    main_thread_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-    track_map_ = new WebRtcMediaStreamTrackAdapterMap(dependency_factory_.get(),
-                                                      main_thread_);
-    peer_connection_ = new rtc::RefCountedObject<MockPeerConnectionImpl>(
-        dependency_factory_.get(), nullptr);
-  }
-
-  void TearDown() override {
-    receiver_.reset();
-    // Syncing up with the signaling thread ensures any pending operations on
-    // that thread are executed. If they post back to the main thread, such as
-    // the sender's destructor traits, this is allowed to execute before the
-    // test shuts down the threads.
-    SyncWithSignalingThread();
-    blink::WebHeap::CollectAllGarbageForTesting();
-  }
-
-  // Wait for the signaling thread to perform any queued tasks, executing tasks
-  // posted to the current thread in the meantime while waiting.
-  void SyncWithSignalingThread() const {
-    base::RunLoop run_loop;
-    dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE, run_loop.QuitClosure());
-    run_loop.Run();
-  }
-
-  std::unique_ptr<RTCRtpReceiver> CreateReceiver(
-      scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track) {
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref;
-    base::RunLoop run_loop;
-    dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&RTCRtpReceiverTest::CreateReceiverOnSignalingThread,
-                       base::Unretained(this), std::move(webrtc_track),
-                       base::Unretained(&track_ref),
-                       base::Unretained(&run_loop)));
-    run_loop.Run();
-    DCHECK(mock_webrtc_receiver_);
-    DCHECK(track_ref);
-    RtpReceiverState state(
-        main_thread_, dependency_factory_->GetWebRtcSignalingThread(),
-        mock_webrtc_receiver_.get(), std::move(track_ref), {});
-    state.Initialize();
-    return std::make_unique<RTCRtpReceiver>(peer_connection_.get(),
-                                            std::move(state));
-  }
-
-  scoped_refptr<WebRTCStatsReportObtainer> GetStats() {
-    scoped_refptr<WebRTCStatsReportObtainer> obtainer =
-        new WebRTCStatsReportObtainer();
-    receiver_->GetStats(obtainer->GetStatsCallbackWrapper(), {});
-    return obtainer;
-  }
-
- protected:
-  void CreateReceiverOnSignalingThread(
-      scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>* track_ref,
-      base::RunLoop* run_loop) {
-    mock_webrtc_receiver_ =
-        new rtc::RefCountedObject<webrtc::MockRtpReceiver>();
-    *track_ref = track_map_->GetOrCreateRemoteTrackAdapter(webrtc_track);
-    run_loop->Quit();
-  }
-
-  // Code under test expects to be run in a process with an initialized
-  // ChildProcess, which requires ThreadPool, and a main-thread MessageLoop,
-  // which the TaskEnvironment also provides.
-  base::test::TaskEnvironment task_environment_;
-  ChildProcess child_process_;
-
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map_;
-  rtc::scoped_refptr<MockPeerConnectionImpl> peer_connection_;
-  rtc::scoped_refptr<webrtc::MockRtpReceiver> mock_webrtc_receiver_;
-  std::unique_ptr<RTCRtpReceiver> receiver_;
-};
-
-TEST_F(RTCRtpReceiverTest, CreateReceiver) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("webrtc_track");
-  receiver_ = CreateReceiver(webrtc_track);
-  EXPECT_FALSE(receiver_->Track().IsNull());
-  EXPECT_EQ(receiver_->Track().Id().Utf8(), webrtc_track->id());
-  EXPECT_EQ(receiver_->state().track_ref()->webrtc_track(), webrtc_track);
-}
-
-TEST_F(RTCRtpReceiverTest, ShallowCopy) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("webrtc_track");
-  receiver_ = CreateReceiver(webrtc_track);
-  auto copy = std::make_unique<RTCRtpReceiver>(*receiver_);
-  EXPECT_EQ(receiver_->state().track_ref()->webrtc_track(), webrtc_track);
-  const auto& webrtc_receiver = receiver_->state().webrtc_receiver();
-  auto web_track_unique_id = receiver_->Track().UniqueId();
-  // Copy is identical to original.
-  EXPECT_EQ(copy->state().webrtc_receiver(), webrtc_receiver);
-  EXPECT_EQ(copy->state().track_ref()->webrtc_track(), webrtc_track);
-  EXPECT_EQ(copy->Track().UniqueId(), web_track_unique_id);
-  // Copy keeps the internal state alive.
-  receiver_.reset();
-  EXPECT_EQ(copy->state().webrtc_receiver(), webrtc_receiver);
-  EXPECT_EQ(copy->state().track_ref()->webrtc_track(), webrtc_track);
-  EXPECT_EQ(copy->Track().UniqueId(), web_track_unique_id);
-}
-
-TEST_F(RTCRtpReceiverTest, GetStats) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("webrtc_track");
-  receiver_ = CreateReceiver(webrtc_track);
-
-  // Make the mock return a blink version of the |webtc_report|. The mock does
-  // not perform any stats filtering, we just set it to a dummy value.
-  rtc::scoped_refptr<webrtc::RTCStatsReport> webrtc_report =
-      webrtc::RTCStatsReport::Create(0u);
-  webrtc_report->AddStats(
-      std::make_unique<webrtc::RTCInboundRTPStreamStats>("stats-id", 1234u));
-  peer_connection_->SetGetStatsReport(webrtc_report);
-
-  auto obtainer = GetStats();
-  // Make sure the operation is async.
-  EXPECT_FALSE(obtainer->report());
-  // Wait for the report, this performs the necessary run-loop.
-  auto* report = obtainer->WaitForReport();
-  EXPECT_TRUE(report);
-
-  // Verify dummy value.
-  EXPECT_EQ(report->Size(), 1u);
-  auto stats = report->GetStats(blink::WebString::FromUTF8("stats-id"));
-  EXPECT_TRUE(stats);
-  EXPECT_EQ(stats->Timestamp(), 1.234);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_sender.cc b/chromium/content/renderer/media/webrtc/rtc_rtp_sender.cc
deleted file mode 100644
index e54ce411dd9..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_sender.cc
+++ /dev/null
@@ -1,562 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_rtp_sender.h"
-
-#include <memory>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "third_party/blink/public/platform/web_rtc_dtmf_sender_handler.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-
-namespace content {
-
-namespace {
-
-// TODO(hbos): Replace WebRTCVoidRequest with something resolving promises based
-// on RTCError, as to surface both exception type and error message.
-// https://crbug.com/790007
-void OnReplaceTrackCompleted(blink::WebRTCVoidRequest request, bool result) {
-  if (result)
-    request.RequestSucceeded();
-  else
-    request.RequestFailed(
-        webrtc::RTCError(webrtc::RTCErrorType::INVALID_MODIFICATION));
-}
-
-void OnSetParametersCompleted(blink::WebRTCVoidRequest request,
-                              webrtc::RTCError result) {
-  if (result.ok())
-    request.RequestSucceeded();
-  else
-    request.RequestFailed(result);
-}
-
-}  // namespace
-
-RtpSenderState::RtpSenderState(
-    scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
-    scoped_refptr<webrtc::RtpSenderInterface> webrtc_sender,
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref,
-    std::vector<std::string> stream_ids)
-    : main_task_runner_(std::move(main_task_runner)),
-      signaling_task_runner_(std::move(signaling_task_runner)),
-      webrtc_sender_(std::move(webrtc_sender)),
-      webrtc_dtls_transport_(webrtc_sender_->dtls_transport()),
-      webrtc_dtls_transport_information_(webrtc::DtlsTransportState::kNew),
-      is_initialized_(false),
-      track_ref_(std::move(track_ref)),
-      stream_ids_(std::move(stream_ids)) {
-  DCHECK(main_task_runner_);
-  DCHECK(signaling_task_runner_);
-  DCHECK(webrtc_sender_);
-  if (webrtc_dtls_transport_) {
-    webrtc_dtls_transport_information_ = webrtc_dtls_transport_->Information();
-  }
-}
-
-RtpSenderState::RtpSenderState(RtpSenderState&& other)
-    : main_task_runner_(other.main_task_runner_),
-      signaling_task_runner_(other.signaling_task_runner_),
-      webrtc_sender_(std::move(other.webrtc_sender_)),
-      webrtc_dtls_transport_(std::move(other.webrtc_dtls_transport_)),
-      webrtc_dtls_transport_information_(
-          other.webrtc_dtls_transport_information_),
-      is_initialized_(other.is_initialized_),
-      track_ref_(std::move(other.track_ref_)),
-      stream_ids_(std::move(other.stream_ids_)) {
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-}
-
-RtpSenderState::~RtpSenderState() {
-  // It's OK to not be on the main thread if this state has been moved, in which
-  // case |main_task_runner_| is null.
-  DCHECK(!main_task_runner_ || main_task_runner_->BelongsToCurrentThread());
-}
-
-RtpSenderState& RtpSenderState::operator=(RtpSenderState&& other) {
-  DCHECK_EQ(main_task_runner_, other.main_task_runner_);
-  DCHECK_EQ(signaling_task_runner_, other.signaling_task_runner_);
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-  webrtc_sender_ = std::move(other.webrtc_sender_);
-  webrtc_dtls_transport_ = std::move(other.webrtc_dtls_transport_);
-  webrtc_dtls_transport_information_ = other.webrtc_dtls_transport_information_;
-  is_initialized_ = other.is_initialized_;
-  track_ref_ = std::move(other.track_ref_);
-  stream_ids_ = std::move(other.stream_ids_);
-  return *this;
-}
-
-bool RtpSenderState::is_initialized() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return is_initialized_;
-}
-
-void RtpSenderState::Initialize() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  if (track_ref_)
-    track_ref_->InitializeOnMainThread();
-  is_initialized_ = true;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner> RtpSenderState::main_task_runner()
-    const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return main_task_runner_;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-RtpSenderState::signaling_task_runner() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return signaling_task_runner_;
-}
-
-scoped_refptr<webrtc::RtpSenderInterface> RtpSenderState::webrtc_sender()
-    const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_sender_;
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-RtpSenderState::webrtc_dtls_transport() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_dtls_transport_;
-}
-
-webrtc::DtlsTransportInformation
-RtpSenderState::webrtc_dtls_transport_information() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_dtls_transport_information_;
-}
-
-const std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>&
-RtpSenderState::track_ref() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return track_ref_;
-}
-
-void RtpSenderState::set_track_ref(
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref) {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  DCHECK(!is_initialized_ || !track_ref || track_ref->is_initialized());
-  track_ref_ = std::move(track_ref);
-}
-
-std::vector<std::string> RtpSenderState::stream_ids() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return stream_ids_;
-}
-
-class RTCRtpSender::RTCRtpSenderInternal
-    : public base::RefCountedThreadSafe<
-          RTCRtpSender::RTCRtpSenderInternal,
-          RTCRtpSender::RTCRtpSenderInternalTraits> {
- public:
-  RTCRtpSenderInternal(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map,
-      RtpSenderState state)
-      : native_peer_connection_(std::move(native_peer_connection)),
-        track_map_(std::move(track_map)),
-        main_task_runner_(state.main_task_runner()),
-        signaling_task_runner_(state.signaling_task_runner()),
-        webrtc_sender_(state.webrtc_sender()),
-        state_(std::move(state)) {
-    DCHECK(track_map_);
-    DCHECK(state_.is_initialized());
-  }
-
-  const RtpSenderState& state() const {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    return state_;
-  }
-
-  void set_state(RtpSenderState state) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    DCHECK_EQ(state.main_task_runner(), main_task_runner_);
-    DCHECK_EQ(state.signaling_task_runner(), signaling_task_runner_);
-    DCHECK(state.webrtc_sender() == webrtc_sender_);
-    DCHECK(state.is_initialized());
-    state_ = std::move(state);
-  }
-
-  void ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                    base::OnceCallback<void(bool)> callback) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref;
-    webrtc::MediaStreamTrackInterface* webrtc_track = nullptr;
-    if (!with_track.IsNull()) {
-      track_ref = track_map_->GetOrCreateLocalTrackAdapter(with_track);
-      webrtc_track = track_ref->webrtc_track();
-    }
-    signaling_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpSender::RTCRtpSenderInternal::ReplaceTrackOnSignalingThread,
-            this, std::move(track_ref), base::Unretained(webrtc_track),
-            std::move(callback)));
-  }
-
-  std::unique_ptr<blink::WebRTCDTMFSenderHandler> GetDtmfSender() const {
-    // The webrtc_sender() is a proxy, so this is a blocking call to the
-    // webrtc signalling thread.
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    auto dtmf_sender = webrtc_sender_->GetDtmfSender();
-    return blink::CreateRTCDTMFSenderHandler(main_task_runner_, dtmf_sender);
-  }
-
-  std::unique_ptr<webrtc::RtpParameters> GetParameters() {
-    // The webrtc_sender() is a proxy, so this is a blocking call to the
-    // webrtc signalling thread.
-    parameters_ = webrtc_sender_->GetParameters();
-    return std::make_unique<webrtc::RtpParameters>(parameters_);
-  }
-
-  void SetParameters(blink::WebVector<webrtc::RtpEncodingParameters> encodings,
-                     webrtc::DegradationPreference degradation_preference,
-                     base::OnceCallback<void(webrtc::RTCError)> callback) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-
-    webrtc::RtpParameters new_parameters = parameters_;
-
-    new_parameters.degradation_preference = degradation_preference;
-
-    for (std::size_t i = 0; i < new_parameters.encodings.size(); ++i) {
-      // Encodings have other parameters in the native layer that aren't exposed
-      // to the blink layer. So instead of copying the new struct over the old
-      // one, we copy the members one by one over the old struct, effectively
-      // patching the changes done by the user.
-      const auto& encoding = encodings[i];
-      new_parameters.encodings[i].codec_payload_type =
-          encoding.codec_payload_type;
-      new_parameters.encodings[i].dtx = encoding.dtx;
-      new_parameters.encodings[i].active = encoding.active;
-      new_parameters.encodings[i].bitrate_priority = encoding.bitrate_priority;
-      new_parameters.encodings[i].network_priority = encoding.network_priority;
-      new_parameters.encodings[i].ptime = encoding.ptime;
-      new_parameters.encodings[i].max_bitrate_bps = encoding.max_bitrate_bps;
-      new_parameters.encodings[i].max_framerate = encoding.max_framerate;
-      new_parameters.encodings[i].rid = encoding.rid;
-      new_parameters.encodings[i].scale_resolution_down_by =
-          encoding.scale_resolution_down_by;
-    }
-
-    signaling_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpSender::RTCRtpSenderInternal::SetParametersOnSignalingThread,
-            this, std::move(new_parameters), std::move(callback)));
-  }
-
-  void GetStats(
-      blink::WebRTCStatsReportCallback callback,
-      const blink::WebVector<webrtc::NonStandardGroupId>& exposed_group_ids) {
-    signaling_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpSender::RTCRtpSenderInternal::GetStatsOnSignalingThread,
-            this, std::move(callback), exposed_group_ids));
-  }
-
-  bool RemoveFromPeerConnection(webrtc::PeerConnectionInterface* pc) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    if (!pc->RemoveTrack(webrtc_sender_.get()))
-      return false;
-    // TODO(hbos): Removing the track should null the sender's track, or we
-    // should do |webrtc_sender_->SetTrack(null)| but that is not allowed on a
-    // stopped sender. In the meantime, there is a discrepancy between layers.
-    // https://crbug.com/webrtc/7945
-    state_.set_track_ref(nullptr);
-    return true;
-  }
-
-  void SetStreams(std::vector<std::string> stream_ids) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    signaling_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpSender::RTCRtpSenderInternal::SetStreamsOnSignalingThread,
-            this, std::move(stream_ids)));
-  }
-
- private:
-  friend struct RTCRtpSender::RTCRtpSenderInternalTraits;
-
-  ~RTCRtpSenderInternal() {
-    // Ensured by destructor traits.
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-  }
-
-  // |webrtc_track| is passed as an argument because |track_ref->webrtc_track()|
-  // cannot be accessed on the signaling thread. https://crbug.com/756436
-  void ReplaceTrackOnSignalingThread(
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref,
-      webrtc::MediaStreamTrackInterface* webrtc_track,
-      base::OnceCallback<void(bool)> callback) {
-    DCHECK(signaling_task_runner_->BelongsToCurrentThread());
-    bool result = webrtc_sender_->SetTrack(webrtc_track);
-    main_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpSender::RTCRtpSenderInternal::ReplaceTrackCallback, this,
-            result, std::move(track_ref), std::move(callback)));
-  }
-
-  void ReplaceTrackCallback(
-      bool result,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref,
-      base::OnceCallback<void(bool)> callback) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    if (result)
-      state_.set_track_ref(std::move(track_ref));
-    std::move(callback).Run(result);
-  }
-
-  void GetStatsOnSignalingThread(
-      blink::WebRTCStatsReportCallback callback,
-      const blink::WebVector<webrtc::NonStandardGroupId>& exposed_group_ids) {
-    native_peer_connection_->GetStats(
-        webrtc_sender_.get(),
-        blink::CreateRTCStatsCollectorCallback(
-            main_task_runner_, std::move(callback), exposed_group_ids));
-  }
-
-  void SetParametersOnSignalingThread(
-      webrtc::RtpParameters parameters,
-      base::OnceCallback<void(webrtc::RTCError)> callback) {
-    DCHECK(signaling_task_runner_->BelongsToCurrentThread());
-    webrtc::RTCError result = webrtc_sender_->SetParameters(parameters);
-    main_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpSender::RTCRtpSenderInternal::SetParametersCallback, this,
-            std::move(result), std::move(callback)));
-  }
-
-  void SetParametersCallback(
-      webrtc::RTCError result,
-      base::OnceCallback<void(webrtc::RTCError)> callback) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    std::move(callback).Run(std::move(result));
-  }
-
-  void SetStreamsOnSignalingThread(std::vector<std::string> stream_ids) {
-    DCHECK(signaling_task_runner_->BelongsToCurrentThread());
-    webrtc_sender_->SetStreams(stream_ids);
-  }
-
-  const scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection_;
-  const scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map_;
-  // Task runners and webrtc sender: Same information as stored in
-  // |state_| but const and safe to touch on the signaling thread to
-  // avoid race with set_state().
-  const scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  const scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  const scoped_refptr<webrtc::RtpSenderInterface> webrtc_sender_;
-  RtpSenderState state_;
-  webrtc::RtpParameters parameters_;
-};
-
-struct RTCRtpSender::RTCRtpSenderInternalTraits {
- private:
-  friend class base::RefCountedThreadSafe<RTCRtpSenderInternal,
-                                          RTCRtpSenderInternalTraits>;
-
-  static void Destruct(const RTCRtpSenderInternal* sender) {
-    // RTCRtpSenderInternal owns AdapterRefs which have to be destroyed on the
-    // main thread, this ensures delete always happens there.
-    if (!sender->main_task_runner_->BelongsToCurrentThread()) {
-      sender->main_task_runner_->PostTask(
-          FROM_HERE,
-          base::BindOnce(&RTCRtpSender::RTCRtpSenderInternalTraits::Destruct,
-                         base::Unretained(sender)));
-      return;
-    }
-    delete sender;
-  }
-};
-
-uintptr_t RTCRtpSender::getId(const webrtc::RtpSenderInterface* webrtc_sender) {
-  return reinterpret_cast<uintptr_t>(webrtc_sender);
-}
-
-RTCRtpSender::RTCRtpSender(
-    scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map,
-    RtpSenderState state)
-    : internal_(new RTCRtpSenderInternal(std::move(native_peer_connection),
-                                         std::move(track_map),
-                                         std::move(state))) {}
-
-RTCRtpSender::RTCRtpSender(const RTCRtpSender& other)
-    : internal_(other.internal_) {}
-
-RTCRtpSender::~RTCRtpSender() {}
-
-RTCRtpSender& RTCRtpSender::operator=(const RTCRtpSender& other) {
-  internal_ = other.internal_;
-  return *this;
-}
-
-const RtpSenderState& RTCRtpSender::state() const {
-  return internal_->state();
-}
-
-void RTCRtpSender::set_state(RtpSenderState state) {
-  internal_->set_state(std::move(state));
-}
-
-std::unique_ptr<blink::WebRTCRtpSender> RTCRtpSender::ShallowCopy() const {
-  return std::make_unique<RTCRtpSender>(*this);
-}
-
-uintptr_t RTCRtpSender::Id() const {
-  return getId(internal_->state().webrtc_sender().get());
-}
-
-rtc::scoped_refptr<webrtc::DtlsTransportInterface>
-RTCRtpSender::DtlsTransport() {
-  return internal_->state().webrtc_dtls_transport();
-}
-
-webrtc::DtlsTransportInformation RTCRtpSender::DtlsTransportInformation() {
-  return internal_->state().webrtc_dtls_transport_information();
-}
-
-blink::WebMediaStreamTrack RTCRtpSender::Track() const {
-  const auto& track_ref = internal_->state().track_ref();
-  return track_ref ? track_ref->web_track() : blink::WebMediaStreamTrack();
-}
-
-blink::WebVector<blink::WebString> RTCRtpSender::StreamIds() const {
-  const auto& stream_ids = internal_->state().stream_ids();
-  blink::WebVector<blink::WebString> web_stream_ids(stream_ids.size());
-  for (size_t i = 0; i < stream_ids.size(); ++i)
-    web_stream_ids[i] = blink::WebString::FromUTF8(stream_ids[i]);
-  return web_stream_ids;
-}
-
-void RTCRtpSender::ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                                blink::WebRTCVoidRequest request) {
-  internal_->ReplaceTrack(
-      std::move(with_track),
-      base::BindOnce(&OnReplaceTrackCompleted, std::move(request)));
-}
-
-std::unique_ptr<blink::WebRTCDTMFSenderHandler> RTCRtpSender::GetDtmfSender()
-    const {
-  return internal_->GetDtmfSender();
-}
-
-std::unique_ptr<webrtc::RtpParameters> RTCRtpSender::GetParameters() const {
-  return internal_->GetParameters();
-}
-
-void RTCRtpSender::SetParameters(
-    blink::WebVector<webrtc::RtpEncodingParameters> encodings,
-    webrtc::DegradationPreference degradation_preference,
-    blink::WebRTCVoidRequest request) {
-  internal_->SetParameters(
-      std::move(encodings), degradation_preference,
-      base::BindOnce(&OnSetParametersCompleted, std::move(request)));
-}
-
-void RTCRtpSender::GetStats(
-    blink::WebRTCStatsReportCallback callback,
-    const blink::WebVector<webrtc::NonStandardGroupId>& exposed_group_ids) {
-  internal_->GetStats(std::move(callback), exposed_group_ids);
-}
-
-void RTCRtpSender::SetStreams(
-    const blink::WebVector<blink::WebString>& stream_ids) {
-  std::vector<std::string> ids;
-  for (auto stream_id : stream_ids)
-    ids.emplace_back(stream_id.Utf8());
-
-  internal_->SetStreams(std::move(ids));
-}
-
-void RTCRtpSender::ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                                base::OnceCallback<void(bool)> callback) {
-  internal_->ReplaceTrack(std::move(with_track), std::move(callback));
-}
-
-bool RTCRtpSender::RemoveFromPeerConnection(
-    webrtc::PeerConnectionInterface* pc) {
-  return internal_->RemoveFromPeerConnection(pc);
-}
-
-RTCRtpSenderOnlyTransceiver::RTCRtpSenderOnlyTransceiver(
-    std::unique_ptr<blink::WebRTCRtpSender> sender)
-    : sender_(std::move(sender)) {
-  DCHECK(sender_);
-}
-
-RTCRtpSenderOnlyTransceiver::~RTCRtpSenderOnlyTransceiver() {}
-
-blink::WebRTCRtpTransceiverImplementationType
-RTCRtpSenderOnlyTransceiver::ImplementationType() const {
-  return blink::WebRTCRtpTransceiverImplementationType::kPlanBSenderOnly;
-}
-
-uintptr_t RTCRtpSenderOnlyTransceiver::Id() const {
-  NOTIMPLEMENTED();
-  return 0u;
-}
-
-blink::WebString RTCRtpSenderOnlyTransceiver::Mid() const {
-  NOTIMPLEMENTED();
-  return blink::WebString();
-}
-
-std::unique_ptr<blink::WebRTCRtpSender> RTCRtpSenderOnlyTransceiver::Sender()
-    const {
-  return sender_->ShallowCopy();
-}
-
-std::unique_ptr<blink::WebRTCRtpReceiver>
-RTCRtpSenderOnlyTransceiver::Receiver() const {
-  NOTIMPLEMENTED();
-  return nullptr;
-}
-
-bool RTCRtpSenderOnlyTransceiver::Stopped() const {
-  NOTIMPLEMENTED();
-  return false;
-}
-
-webrtc::RtpTransceiverDirection RTCRtpSenderOnlyTransceiver::Direction() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-void RTCRtpSenderOnlyTransceiver::SetDirection(
-    webrtc::RtpTransceiverDirection direction) {
-  NOTIMPLEMENTED();
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RTCRtpSenderOnlyTransceiver::CurrentDirection() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RTCRtpSenderOnlyTransceiver::FiredDirection() const {
-  NOTIMPLEMENTED();
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-webrtc::RTCError RTCRtpSenderOnlyTransceiver::SetCodecPreferences(
-    blink::WebVector<webrtc::RtpCodecCapability>) {
-  NOTIMPLEMENTED();
-  return {};
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_sender.h b/chromium/content/renderer/media/webrtc/rtc_rtp_sender.h
deleted file mode 100644
index 041b1ad0134..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_sender.h
+++ /dev/null
@@ -1,192 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_SENDER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_SENDER_H_
-
-#include <memory>
-#include <string>
-#include <vector>
-
-#include "base/callback.h"
-#include "base/single_thread_task_runner.h"
-#include "content/common/content_export.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_sender.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_transceiver.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-#include "third_party/webrtc/api/peer_connection_interface.h"
-#include "third_party/webrtc/api/rtp_sender_interface.h"
-#include "third_party/webrtc/api/scoped_refptr.h"
-
-namespace content {
-
-// This class represents the state of a sender; a snapshot of what a
-// webrtc-layer sender looked like when it was inspected on the signaling thread
-// such that this information can be moved to the main thread in a single
-// PostTask. It is used to surface state changes to make the blink-layer sender
-// up-to-date.
-//
-// Blink objects live on the main thread and webrtc objects live on the
-// signaling thread. If multiple asynchronous operations begin execution on the
-// main thread they are posted and executed in order on the signaling thread.
-// For example, operation A and operation B are called in JavaScript. When A is
-// done on the signaling thread, webrtc object states will be updated. A
-// callback is posted to the main thread so that blink objects can be updated to
-// match the result of operation A. But if callback A tries to inspect the
-// webrtc objects from the main thread this requires posting back to the
-// signaling thread and waiting, which also includes waiting for the previously
-// posted task: operation B. Inspecting the webrtc object like this does not
-// guarantee you to get the state of operation A.
-//
-// As such, all state changes associated with an operation have to be surfaced
-// in the same callback. This includes copying any states into a separate object
-// so that it can be inspected on the main thread without any additional thread
-// hops.
-//
-// The RtpSenderState is a snapshot of what the webrtc::RtpSenderInterface
-// looked like when the RtpSenderState was created on the signaling thread. It
-// also takes care of initializing track adapters, such that we have access to a
-// blink track corresponding to the webrtc track of the sender.
-//
-// Except for initialization logic and operator=(), the RtpSenderState is
-// immutable and only accessible on the main thread.
-//
-// TODO(hbos): [Onion Soup] When the sender implementation is moved to blink
-// this will be part of the blink sender instead of the content sender.
-// https://crbug.com/787254
-class CONTENT_EXPORT RtpSenderState {
- public:
-  RtpSenderState(
-      scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
-      scoped_refptr<webrtc::RtpSenderInterface> webrtc_sender,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref,
-      std::vector<std::string> stream_ids);
-  RtpSenderState(RtpSenderState&&);
-  RtpSenderState(const RtpSenderState&) = delete;
-  ~RtpSenderState();
-
-  // This is intended to be used for moving the object from the signaling thread
-  // to the main thread and as such has no thread checks. Once moved to the main
-  // this should only be invoked on the main thread.
-  RtpSenderState& operator=(RtpSenderState&&);
-  RtpSenderState& operator=(const RtpSenderState&) = delete;
-
-  bool is_initialized() const;
-  void Initialize();
-
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner() const;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner() const;
-  scoped_refptr<webrtc::RtpSenderInterface> webrtc_sender() const;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> webrtc_dtls_transport()
-      const;
-  webrtc::DtlsTransportInformation webrtc_dtls_transport_information() const;
-  const std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>&
-  track_ref() const;
-  void set_track_ref(
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref);
-  std::vector<std::string> stream_ids() const;
-
- private:
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  scoped_refptr<webrtc::RtpSenderInterface> webrtc_sender_;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> webrtc_dtls_transport_;
-  webrtc::DtlsTransportInformation webrtc_dtls_transport_information_;
-  bool is_initialized_;
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref_;
-  std::vector<std::string> stream_ids_;
-};
-
-// Used to surface |webrtc::RtpSenderInterface| to blink. Multiple
-// |RTCRtpSender|s could reference the same webrtc sender; |id| is the value
-// of the pointer to the webrtc sender.
-// TODO(hbos): [Onion Soup] Move all of the implementation inside the blink
-// object and remove this class and interface. The blink object is reference
-// counted and we can get rid of this "Web"-copyable with "internal" nonsense,
-// all the blink object will need is the RtpSenderState. Requires coordination
-// with transceivers and receivers since these are tightly coupled.
-// https://crbug.com/787254
-class CONTENT_EXPORT RTCRtpSender : public blink::WebRTCRtpSender {
- public:
-  static uintptr_t getId(const webrtc::RtpSenderInterface* webrtc_sender);
-
-  RTCRtpSender(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map,
-      RtpSenderState state);
-  RTCRtpSender(const RTCRtpSender& other);
-  ~RTCRtpSender() override;
-  RTCRtpSender& operator=(const RTCRtpSender& other);
-
-  const RtpSenderState& state() const;
-  void set_state(RtpSenderState state);
-
-  // blink::WebRTCRtpSender.
-  std::unique_ptr<blink::WebRTCRtpSender> ShallowCopy() const override;
-  uintptr_t Id() const override;
-  rtc::scoped_refptr<webrtc::DtlsTransportInterface> DtlsTransport() override;
-  webrtc::DtlsTransportInformation DtlsTransportInformation() override;
-  blink::WebMediaStreamTrack Track() const override;
-  blink::WebVector<blink::WebString> StreamIds() const override;
-  void ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                    blink::WebRTCVoidRequest request) override;
-  std::unique_ptr<blink::WebRTCDTMFSenderHandler> GetDtmfSender()
-      const override;
-  std::unique_ptr<webrtc::RtpParameters> GetParameters() const override;
-  void SetParameters(blink::WebVector<webrtc::RtpEncodingParameters>,
-                     webrtc::DegradationPreference,
-                     blink::WebRTCVoidRequest) override;
-  void GetStats(blink::WebRTCStatsReportCallback,
-                const blink::WebVector<webrtc::NonStandardGroupId>&) override;
-  void SetStreams(
-      const blink::WebVector<blink::WebString>& stream_ids) override;
-
-  // The ReplaceTrack() that takes a blink::WebRTCVoidRequest is implemented on
-  // top of this, which returns the result in a callback instead. Allows doing
-  // ReplaceTrack() without having a blink::WebRTCVoidRequest, which can only be
-  // constructed inside of blink.
-  void ReplaceTrack(blink::WebMediaStreamTrack with_track,
-                    base::OnceCallback<void(bool)> callback);
-  bool RemoveFromPeerConnection(webrtc::PeerConnectionInterface* pc);
-
- private:
-  class RTCRtpSenderInternal;
-  struct RTCRtpSenderInternalTraits;
-
-  scoped_refptr<RTCRtpSenderInternal> internal_;
-};
-
-class CONTENT_EXPORT RTCRtpSenderOnlyTransceiver
-    : public blink::WebRTCRtpTransceiver {
- public:
-  explicit RTCRtpSenderOnlyTransceiver(
-      std::unique_ptr<blink::WebRTCRtpSender> sender);
-  ~RTCRtpSenderOnlyTransceiver() override;
-
-  blink::WebRTCRtpTransceiverImplementationType ImplementationType()
-      const override;
-  uintptr_t Id() const override;
-  blink::WebString Mid() const override;
-  std::unique_ptr<blink::WebRTCRtpSender> Sender() const override;
-  std::unique_ptr<blink::WebRTCRtpReceiver> Receiver() const override;
-  bool Stopped() const override;
-  webrtc::RtpTransceiverDirection Direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection direction) override;
-  base::Optional<webrtc::RtpTransceiverDirection> CurrentDirection()
-      const override;
-  base::Optional<webrtc::RtpTransceiverDirection> FiredDirection()
-      const override;
-  webrtc::RTCError SetCodecPreferences(
-      blink::WebVector<webrtc::RtpCodecCapability>) override;
-
- private:
-  std::unique_ptr<blink::WebRTCRtpSender> sender_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_SENDER_H_
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_sender_unittest.cc b/chromium/content/renderer/media/webrtc/rtc_rtp_sender_unittest.cc
deleted file mode 100644
index 33702bfe339..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_sender_unittest.cc
+++ /dev/null
@@ -1,264 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_rtp_sender.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/memory/ref_counted.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/test/task_environment.h"
-#include "build/build_config.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-#include "third_party/blink/public/platform/web_rtc_void_request.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/blink/public/web/web_heap.h"
-#include "third_party/webrtc/api/stats/rtc_stats_report.h"
-#include "third_party/webrtc/api/stats/rtcstats_objects.h"
-#include "third_party/webrtc/api/test/mock_rtpsender.h"
-
-using ::testing::_;
-using ::testing::Return;
-
-namespace content {
-
-class RTCRtpSenderTest : public ::testing::Test {
- public:
-  void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
-    main_thread_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-    track_map_ = new WebRtcMediaStreamTrackAdapterMap(dependency_factory_.get(),
-                                                      main_thread_);
-    peer_connection_ = new rtc::RefCountedObject<MockPeerConnectionImpl>(
-        dependency_factory_.get(), nullptr);
-    mock_webrtc_sender_ = new rtc::RefCountedObject<webrtc::MockRtpSender>();
-  }
-
-  void TearDown() override {
-    sender_.reset();
-    // Syncing up with the signaling thread ensures any pending operations on
-    // that thread are executed. If they post back to the main thread, such as
-    // the sender's destructor traits, this is allowed to execute before the
-    // test shuts down the threads.
-    SyncWithSignalingThread();
-    blink::WebHeap::CollectAllGarbageForTesting();
-  }
-
-  // Wait for the signaling thread to perform any queued tasks, executing tasks
-  // posted to the current thread in the meantime while waiting.
-  void SyncWithSignalingThread() const {
-    base::RunLoop run_loop;
-    dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE, run_loop.QuitClosure());
-    run_loop.Run();
-  }
-
-  blink::WebMediaStreamTrack CreateWebTrack(const std::string& id) {
-    blink::WebMediaStreamSource web_source;
-    web_source.Initialize(
-        blink::WebString::FromUTF8(id), blink::WebMediaStreamSource::kTypeAudio,
-        blink::WebString::FromUTF8("local_audio_track"), false);
-    blink::MediaStreamAudioSource* audio_source =
-        new blink::MediaStreamAudioSource(
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(), true);
-    // Takes ownership of |audio_source|.
-    web_source.SetPlatformSource(base::WrapUnique(audio_source));
-    blink::WebMediaStreamTrack web_track;
-    web_track.Initialize(web_source.Id(), web_source);
-    audio_source->ConnectToTrack(web_track);
-    return web_track;
-  }
-
-  std::unique_ptr<RTCRtpSender> CreateSender(
-      blink::WebMediaStreamTrack web_track) {
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref;
-    if (!web_track.IsNull()) {
-      track_ref = track_map_->GetOrCreateLocalTrackAdapter(web_track);
-      DCHECK(track_ref->is_initialized());
-    }
-    RtpSenderState sender_state(main_thread_,
-                                dependency_factory_->GetWebRtcSignalingThread(),
-                                mock_webrtc_sender_.get(), std::move(track_ref),
-                                std::vector<std::string>());
-    sender_state.Initialize();
-    return std::make_unique<RTCRtpSender>(peer_connection_.get(), track_map_,
-                                          std::move(sender_state));
-  }
-
-  // Calls replaceTrack(), which is asynchronous, returning a callback that when
-  // invoked waits for (run-loops) the operation to complete and returns whether
-  // replaceTrack() was successful.
-  base::OnceCallback<bool()> ReplaceTrack(
-      blink::WebMediaStreamTrack web_track) {
-    std::unique_ptr<base::RunLoop> run_loop = std::make_unique<base::RunLoop>();
-    std::unique_ptr<bool> result_holder(new bool());
-    // On complete, |*result_holder| is set with the result of replaceTrack()
-    // and the |run_loop| quit.
-    sender_->ReplaceTrack(
-        web_track, base::BindOnce(&RTCRtpSenderTest::CallbackOnComplete,
-                                  base::Unretained(this), result_holder.get(),
-                                  run_loop.get()));
-    // When the resulting callback is invoked, waits for |run_loop| to complete
-    // and returns |*result_holder|.
-    return base::BindOnce(&RTCRtpSenderTest::RunLoopAndReturnResult,
-                          base::Unretained(this), std::move(result_holder),
-                          std::move(run_loop));
-  }
-
-  scoped_refptr<WebRTCStatsReportObtainer> CallGetStats() {
-    scoped_refptr<WebRTCStatsReportObtainer> obtainer =
-        new WebRTCStatsReportObtainer();
-    sender_->GetStats(obtainer->GetStatsCallbackWrapper(), {});
-    return obtainer;
-  }
-
- protected:
-  void CallbackOnComplete(bool* result_out,
-                          base::RunLoop* run_loop,
-                          bool result) {
-    *result_out = result;
-    run_loop->Quit();
-  }
-
-  bool RunLoopAndReturnResult(std::unique_ptr<bool> result_holder,
-                              std::unique_ptr<base::RunLoop> run_loop) {
-    run_loop->Run();
-    return *result_holder;
-  }
-
-  // Code under test expects to be run in a process with an initialized
-  // ChildProcess, which requires ThreadPool, and a main-thread MessageLoop,
-  // which the TaskEnvironment also provides.
-  base::test::TaskEnvironment task_environment_;
-  ChildProcess child_process_;
-
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map_;
-  rtc::scoped_refptr<MockPeerConnectionImpl> peer_connection_;
-  rtc::scoped_refptr<webrtc::MockRtpSender> mock_webrtc_sender_;
-  std::unique_ptr<RTCRtpSender> sender_;
-};
-
-TEST_F(RTCRtpSenderTest, CreateSender) {
-  auto web_track = CreateWebTrack("track_id");
-  sender_ = CreateSender(web_track);
-  EXPECT_FALSE(sender_->Track().IsNull());
-  EXPECT_EQ(web_track.UniqueId(), sender_->Track().UniqueId());
-}
-
-TEST_F(RTCRtpSenderTest, CreateSenderWithNullTrack) {
-  blink::WebMediaStreamTrack null_track;
-  sender_ = CreateSender(null_track);
-  EXPECT_TRUE(sender_->Track().IsNull());
-}
-
-TEST_F(RTCRtpSenderTest, ReplaceTrackSetsTrack) {
-  auto web_track1 = CreateWebTrack("track1");
-  sender_ = CreateSender(web_track1);
-
-  auto web_track2 = CreateWebTrack("track2");
-  EXPECT_CALL(*mock_webrtc_sender_, SetTrack(_)).WillOnce(Return(true));
-  auto replaceTrackRunLoopAndGetResult = ReplaceTrack(web_track2);
-  EXPECT_TRUE(std::move(replaceTrackRunLoopAndGetResult).Run());
-  ASSERT_FALSE(sender_->Track().IsNull());
-  EXPECT_EQ(web_track2.UniqueId(), sender_->Track().UniqueId());
-}
-
-TEST_F(RTCRtpSenderTest, ReplaceTrackWithNullTrack) {
-  auto web_track = CreateWebTrack("track_id");
-  sender_ = CreateSender(web_track);
-
-  blink::WebMediaStreamTrack null_track;
-  EXPECT_CALL(*mock_webrtc_sender_, SetTrack(_)).WillOnce(Return(true));
-  auto replaceTrackRunLoopAndGetResult = ReplaceTrack(null_track);
-  EXPECT_TRUE(std::move(replaceTrackRunLoopAndGetResult).Run());
-  EXPECT_TRUE(sender_->Track().IsNull());
-}
-
-TEST_F(RTCRtpSenderTest, ReplaceTrackCanFail) {
-  auto web_track = CreateWebTrack("track_id");
-  sender_ = CreateSender(web_track);
-  ASSERT_FALSE(sender_->Track().IsNull());
-  EXPECT_EQ(web_track.UniqueId(), sender_->Track().UniqueId());
-
-  blink::WebMediaStreamTrack null_track;
-  EXPECT_CALL(*mock_webrtc_sender_, SetTrack(_)).WillOnce(Return(false));
-  auto replaceTrackRunLoopAndGetResult = ReplaceTrack(null_track);
-  EXPECT_FALSE(std::move(replaceTrackRunLoopAndGetResult).Run());
-  // The track should not have been set.
-  ASSERT_FALSE(sender_->Track().IsNull());
-  EXPECT_EQ(web_track.UniqueId(), sender_->Track().UniqueId());
-}
-
-TEST_F(RTCRtpSenderTest, ReplaceTrackIsNotSetSynchronously) {
-  auto web_track1 = CreateWebTrack("track1");
-  sender_ = CreateSender(web_track1);
-
-  auto web_track2 = CreateWebTrack("track2");
-  EXPECT_CALL(*mock_webrtc_sender_, SetTrack(_)).WillOnce(Return(true));
-  auto replaceTrackRunLoopAndGetResult = ReplaceTrack(web_track2);
-  // The track should not be set until the run loop has executed.
-  ASSERT_FALSE(sender_->Track().IsNull());
-  EXPECT_NE(web_track2.UniqueId(), sender_->Track().UniqueId());
-  // Wait for operation to run to ensure EXPECT_CALL is satisfied.
-  std::move(replaceTrackRunLoopAndGetResult).Run();
-}
-
-TEST_F(RTCRtpSenderTest, GetStats) {
-  auto web_track = CreateWebTrack("track_id");
-  sender_ = CreateSender(web_track);
-
-  // Make the mock return a blink version of the |webtc_report|. The mock does
-  // not perform any stats filtering, we just set it to a dummy value.
-  rtc::scoped_refptr<webrtc::RTCStatsReport> webrtc_report =
-      webrtc::RTCStatsReport::Create(0u);
-  webrtc_report->AddStats(
-      std::make_unique<webrtc::RTCOutboundRTPStreamStats>("stats-id", 1234u));
-  peer_connection_->SetGetStatsReport(webrtc_report);
-
-  auto obtainer = CallGetStats();
-  // Make sure the operation is async.
-  EXPECT_FALSE(obtainer->report());
-  // Wait for the report, this performs the necessary run-loop.
-  auto* report = obtainer->WaitForReport();
-  EXPECT_TRUE(report);
-
-  // Verify dummy value.
-  EXPECT_EQ(report->Size(), 1u);
-  auto stats = report->GetStats(blink::WebString::FromUTF8("stats-id"));
-  EXPECT_TRUE(stats);
-  EXPECT_EQ(stats->Timestamp(), 1.234);
-}
-
-TEST_F(RTCRtpSenderTest, CopiedSenderSharesInternalStates) {
-  auto web_track = CreateWebTrack("track_id");
-  sender_ = CreateSender(web_track);
-  auto copy = std::make_unique<RTCRtpSender>(*sender_);
-  // Copy shares original's ID.
-  EXPECT_EQ(sender_->Id(), copy->Id());
-
-  blink::WebMediaStreamTrack null_track;
-  EXPECT_CALL(*mock_webrtc_sender_, SetTrack(_)).WillOnce(Return(true));
-  auto replaceTrackRunLoopAndGetResult = ReplaceTrack(null_track);
-  EXPECT_TRUE(std::move(replaceTrackRunLoopAndGetResult).Run());
-
-  // Both original and copy shows a modified state.
-  EXPECT_TRUE(sender_->Track().IsNull());
-  EXPECT_TRUE(copy->Track().IsNull());
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver.cc b/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver.cc
deleted file mode 100644
index ab36db44b25..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver.cc
+++ /dev/null
@@ -1,382 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_rtp_transceiver.h"
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "base/memory/ref_counted.h"
-
-namespace content {
-
-RtpTransceiverState::RtpTransceiverState(
-    scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
-    scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver,
-    base::Optional<RtpSenderState> sender_state,
-    base::Optional<RtpReceiverState> receiver_state,
-    base::Optional<std::string> mid,
-    bool stopped,
-    webrtc::RtpTransceiverDirection direction,
-    base::Optional<webrtc::RtpTransceiverDirection> current_direction,
-    base::Optional<webrtc::RtpTransceiverDirection> fired_direction)
-    : main_task_runner_(std::move(main_task_runner)),
-      signaling_task_runner_(std::move(signaling_task_runner)),
-      webrtc_transceiver_(std::move(webrtc_transceiver)),
-      is_initialized_(false),
-      sender_state_(std::move(sender_state)),
-      receiver_state_(std::move(receiver_state)),
-      mid_(std::move(mid)),
-      stopped_(std::move(stopped)),
-      direction_(std::move(direction)),
-      current_direction_(std::move(current_direction)),
-      fired_direction_(std::move(fired_direction)) {
-  DCHECK(main_task_runner_);
-  DCHECK(signaling_task_runner_);
-  DCHECK(webrtc_transceiver_);
-}
-
-RtpTransceiverState::RtpTransceiverState(RtpTransceiverState&& other)
-    : main_task_runner_(other.main_task_runner_),
-      signaling_task_runner_(other.signaling_task_runner_),
-      webrtc_transceiver_(std::move(other.webrtc_transceiver_)),
-      is_initialized_(other.is_initialized_),
-      sender_state_(std::move(other.sender_state_)),
-      receiver_state_(std::move(other.receiver_state_)),
-      mid_(std::move(other.mid_)),
-      stopped_(std::move(other.stopped_)),
-      direction_(std::move(other.direction_)),
-      current_direction_(std::move(other.current_direction_)),
-      fired_direction_(std::move(other.fired_direction_)) {
-  // Explicitly null |other|'s task runners for use in destructor.
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-}
-
-RtpTransceiverState::~RtpTransceiverState() {
-  // It's OK to not be on the main thread if this state has been moved, in which
-  // case |main_task_runner_| is null.
-  DCHECK(!main_task_runner_ || main_task_runner_->BelongsToCurrentThread());
-}
-
-RtpTransceiverState& RtpTransceiverState::operator=(
-    RtpTransceiverState&& other) {
-  DCHECK_EQ(main_task_runner_, other.main_task_runner_);
-  DCHECK_EQ(signaling_task_runner_, other.signaling_task_runner_);
-  // Need to be on main thread for sender/receiver state's destructor that can
-  // be triggered by replacing .
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  // Explicitly null |other|'s task runners for use in destructor.
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-  webrtc_transceiver_ = std::move(other.webrtc_transceiver_);
-  is_initialized_ = other.is_initialized_;
-  sender_state_ = std::move(other.sender_state_);
-  receiver_state_ = std::move(other.receiver_state_);
-  mid_ = std::move(other.mid_);
-  stopped_ = std::move(other.stopped_);
-  direction_ = std::move(other.direction_);
-  current_direction_ = std::move(other.current_direction_);
-  fired_direction_ = std::move(other.fired_direction_);
-  return *this;
-}
-
-bool RtpTransceiverState::is_initialized() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return is_initialized_;
-}
-
-void RtpTransceiverState::Initialize() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  if (sender_state_)
-    sender_state_->Initialize();
-  if (receiver_state_)
-    receiver_state_->Initialize();
-  is_initialized_ = true;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-RtpTransceiverState::main_task_runner() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return main_task_runner_;
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-RtpTransceiverState::signaling_task_runner() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return signaling_task_runner_;
-}
-
-scoped_refptr<webrtc::RtpTransceiverInterface>
-RtpTransceiverState::webrtc_transceiver() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return webrtc_transceiver_;
-}
-
-const base::Optional<RtpSenderState>& RtpTransceiverState::sender_state()
-    const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return sender_state_;
-}
-
-RtpSenderState RtpTransceiverState::MoveSenderState() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  base::Optional<RtpSenderState> temp(base::nullopt);
-  sender_state_.swap(temp);
-  return *std::move(temp);
-}
-
-const base::Optional<RtpReceiverState>& RtpTransceiverState::receiver_state()
-    const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return receiver_state_;
-}
-
-RtpReceiverState RtpTransceiverState::MoveReceiverState() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  base::Optional<RtpReceiverState> temp(base::nullopt);
-  receiver_state_.swap(temp);
-  return *std::move(temp);
-}
-
-base::Optional<std::string> RtpTransceiverState::mid() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return mid_;
-}
-
-bool RtpTransceiverState::stopped() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return stopped_;
-}
-
-webrtc::RtpTransceiverDirection RtpTransceiverState::direction() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return direction_;
-}
-
-void RtpTransceiverState::set_direction(
-    webrtc::RtpTransceiverDirection direction) {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  direction_ = direction;
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RtpTransceiverState::current_direction() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return current_direction_;
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RtpTransceiverState::fired_direction() const {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  return fired_direction_;
-}
-
-class RTCRtpTransceiver::RTCRtpTransceiverInternal
-    : public base::RefCountedThreadSafe<
-          RTCRtpTransceiver::RTCRtpTransceiverInternal,
-          RTCRtpTransceiver::RTCRtpTransceiverInternalTraits> {
- public:
-  RTCRtpTransceiverInternal(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map,
-      RtpTransceiverState state)
-      : main_task_runner_(state.main_task_runner()),
-        signaling_task_runner_(state.signaling_task_runner()),
-        webrtc_transceiver_(state.webrtc_transceiver()),
-        state_(std::move(state)) {
-    sender_ = std::make_unique<RTCRtpSender>(native_peer_connection, track_map,
-                                             state_.MoveSenderState());
-    receiver_ = std::make_unique<RTCRtpReceiver>(native_peer_connection,
-                                                 state_.MoveReceiverState());
-  }
-
-  const RtpTransceiverState& state() const {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    return state_;
-  }
-
-  void set_state(RtpTransceiverState state,
-                 TransceiverStateUpdateMode update_mode) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    DCHECK_EQ(state.main_task_runner(), main_task_runner_);
-    DCHECK_EQ(state.signaling_task_runner(), signaling_task_runner_);
-    DCHECK(state.webrtc_transceiver() == webrtc_transceiver_);
-    DCHECK(state.is_initialized());
-    auto previous_direction = state_.direction();
-    state_ = std::move(state);
-    auto sender_state = state_.MoveSenderState();
-    if (update_mode == TransceiverStateUpdateMode::kSetDescription) {
-      // setLocalDescription() and setRemoteDescription() cannot modify
-      // "sender.track" or "direction", so this part of the state information is
-      // either identical to the current state or out-dated information.
-      // Surfacing out-dated information has caused crashes and other problems,
-      // see https://crbug.com/950280.
-      sender_state.set_track_ref(sender_->state().track_ref()
-                                     ? sender_->state().track_ref()->Copy()
-                                     : nullptr);
-      state_.set_direction(previous_direction);
-    }
-    sender_->set_state(std::move(sender_state));
-    receiver_->set_state(state_.MoveReceiverState());
-  }
-
-  RTCRtpSender* content_sender() {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    return sender_.get();
-  }
-
-  RTCRtpReceiver* content_receiver() {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    return receiver_.get();
-  }
-
-  void SetDirection(webrtc::RtpTransceiverDirection direction) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    // This implicitly performs a blocking invoke on the webrtc signaling thread
-    // due to use of PROXY references for |webrtc_transceiver_|.
-    webrtc_transceiver_->SetDirection(direction);
-    state_.set_direction(webrtc_transceiver_->direction());
-  }
-
-  webrtc::RTCError setCodecPreferences(
-      std::vector<webrtc::RtpCodecCapability> codec_preferences) {
-    return webrtc_transceiver_->SetCodecPreferences(codec_preferences);
-  }
-
- private:
-  friend struct RTCRtpTransceiver::RTCRtpTransceiverInternalTraits;
-
-  ~RTCRtpTransceiverInternal() {
-    // Ensured by destructor traits.
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-  }
-
-  // Task runners and webrtc transceiver: Same information as stored in |state_|
-  // but const and safe to touch on the signaling thread to avoid race with
-  // set_state().
-  const scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  const scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  const scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver_;
-  RtpTransceiverState state_;
-  std::unique_ptr<RTCRtpSender> sender_;
-  std::unique_ptr<RTCRtpReceiver> receiver_;
-};
-
-struct RTCRtpTransceiver::RTCRtpTransceiverInternalTraits {
- private:
-  friend class base::RefCountedThreadSafe<RTCRtpTransceiverInternal,
-                                          RTCRtpTransceiverInternalTraits>;
-
-  static void Destruct(const RTCRtpTransceiverInternal* transceiver) {
-    // RTCRtpTransceiverInternal owns AdapterRefs which have to be destroyed on
-    // the main thread, this ensures delete always happens there.
-    if (!transceiver->main_task_runner_->BelongsToCurrentThread()) {
-      transceiver->main_task_runner_->PostTask(
-          FROM_HERE,
-          base::BindOnce(
-              &RTCRtpTransceiver::RTCRtpTransceiverInternalTraits::Destruct,
-              base::Unretained(transceiver)));
-      return;
-    }
-    delete transceiver;
-  }
-};
-
-uintptr_t RTCRtpTransceiver::GetId(
-    const webrtc::RtpTransceiverInterface* webrtc_transceiver) {
-  return reinterpret_cast<uintptr_t>(webrtc_transceiver);
-}
-
-RTCRtpTransceiver::RTCRtpTransceiver(
-    scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map,
-    RtpTransceiverState transceiver_state)
-    : internal_(new RTCRtpTransceiverInternal(std::move(native_peer_connection),
-                                              std::move(track_map),
-                                              std::move(transceiver_state))) {}
-
-RTCRtpTransceiver::RTCRtpTransceiver(const RTCRtpTransceiver& other)
-    : internal_(other.internal_) {}
-
-RTCRtpTransceiver::~RTCRtpTransceiver() {}
-
-RTCRtpTransceiver& RTCRtpTransceiver::operator=(
-    const RTCRtpTransceiver& other) {
-  internal_ = other.internal_;
-  return *this;
-}
-
-std::unique_ptr<RTCRtpTransceiver> RTCRtpTransceiver::ShallowCopy() const {
-  return std::make_unique<RTCRtpTransceiver>(*this);
-}
-
-const RtpTransceiverState& RTCRtpTransceiver::state() const {
-  return internal_->state();
-}
-
-RTCRtpSender* RTCRtpTransceiver::content_sender() {
-  return internal_->content_sender();
-}
-
-RTCRtpReceiver* RTCRtpTransceiver::content_receiver() {
-  return internal_->content_receiver();
-}
-
-void RTCRtpTransceiver::set_state(RtpTransceiverState transceiver_state,
-                                  TransceiverStateUpdateMode update_mode) {
-  internal_->set_state(std::move(transceiver_state), update_mode);
-}
-
-blink::WebRTCRtpTransceiverImplementationType
-RTCRtpTransceiver::ImplementationType() const {
-  return blink::WebRTCRtpTransceiverImplementationType::kFullTransceiver;
-}
-
-uintptr_t RTCRtpTransceiver::Id() const {
-  return GetId(internal_->state().webrtc_transceiver().get());
-}
-
-blink::WebString RTCRtpTransceiver::Mid() const {
-  const auto& mid = internal_->state().mid();
-  return mid ? blink::WebString::FromUTF8(*mid)
-             : blink::WebString();  // IsNull()
-}
-
-std::unique_ptr<blink::WebRTCRtpSender> RTCRtpTransceiver::Sender() const {
-  return internal_->content_sender()->ShallowCopy();
-}
-
-std::unique_ptr<blink::WebRTCRtpReceiver> RTCRtpTransceiver::Receiver() const {
-  return internal_->content_receiver()->ShallowCopy();
-}
-
-bool RTCRtpTransceiver::Stopped() const {
-  return internal_->state().stopped();
-}
-
-webrtc::RtpTransceiverDirection RTCRtpTransceiver::Direction() const {
-  return internal_->state().direction();
-}
-
-void RTCRtpTransceiver::SetDirection(
-    webrtc::RtpTransceiverDirection direction) {
-  internal_->SetDirection(direction);
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RTCRtpTransceiver::CurrentDirection() const {
-  return internal_->state().current_direction();
-}
-
-base::Optional<webrtc::RtpTransceiverDirection>
-RTCRtpTransceiver::FiredDirection() const {
-  return internal_->state().fired_direction();
-}
-
-webrtc::RTCError RTCRtpTransceiver::SetCodecPreferences(
-    blink::WebVector<webrtc::RtpCodecCapability> codec_preferences) {
-  return internal_->setCodecPreferences(codec_preferences.ReleaseVector());
-}
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver.h b/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver.h
deleted file mode 100644
index e99719e2054..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver.h
+++ /dev/null
@@ -1,193 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_TRANSCEIVER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_TRANSCEIVER_H_
-
-#include "base/memory/scoped_refptr.h"
-#include "base/optional.h"
-#include "base/single_thread_task_runner.h"
-#include "content/renderer/media/webrtc/rtc_rtp_receiver.h"
-#include "content/renderer/media/webrtc/rtc_rtp_sender.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "third_party/blink/public/platform/web_rtc_rtp_transceiver.h"
-#include "third_party/webrtc/api/rtp_transceiver_interface.h"
-
-namespace content {
-
-// This class represents the state of a transceiver; a snapshot of what a
-// webrtc-layer transceiver looked like when it was inspected on the signaling
-// thread such that this information can be moved to the main thread in a single
-// PostTask. It is used to surface state changes to make the blink-layer
-// transceiver up-to-date.
-//
-// Blink objects live on the main thread and webrtc objects live on the
-// signaling thread. If multiple asynchronous operations begin execution on the
-// main thread they are posted and executed in order on the signaling thread.
-// For example, operation A and operation B are called in JavaScript. When A is
-// done on the signaling thread, webrtc object states will be updated. A
-// callback is posted to the main thread so that blink objects can be updated to
-// match the result of operation A. But if callback A tries to inspect the
-// webrtc objects from the main thread this requires posting back to the
-// signaling thread and waiting, which also includes waiting for the previously
-// posted task: operation B. Inspecting the webrtc object like this does not
-// guarantee you to get the state of operation A.
-//
-// As such, all state changes associated with an operation have to be surfaced
-// in the same callback. This includes copying any states into a separate object
-// so that it can be inspected on the main thread without any additional thread
-// hops.
-//
-// The RtpTransceiverState is a snapshot of what the
-// webrtc::RtpTransceiverInterface looked like when the RtpTransceiverState was
-// created on the signaling thread. It also takes care of initializing sender
-// and receiver states, including their track adapters such that we have access
-// to a blink track corresponding to the webrtc tracks of the sender and
-// receiver.
-//
-// Except for initialization logic and operator=(), the RtpTransceiverState is
-// immutable and only accessible on the main thread.
-//
-// TODO(hbos): [Onion Soup] When the transceiver implementation is moved to
-// blink this will be part of the blink transceiver instead of the content
-// transceiver. https://crbug.com/787254
-class CONTENT_EXPORT RtpTransceiverState {
- public:
-  RtpTransceiverState(
-      scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
-      scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver,
-      base::Optional<RtpSenderState> sender_state,
-      base::Optional<RtpReceiverState> receiver_state,
-      base::Optional<std::string> mid,
-      bool stopped,
-      webrtc::RtpTransceiverDirection direction,
-      base::Optional<webrtc::RtpTransceiverDirection> current_direction,
-      base::Optional<webrtc::RtpTransceiverDirection> fired_direction);
-  RtpTransceiverState(RtpTransceiverState&&);
-  RtpTransceiverState(const RtpTransceiverState&) = delete;
-  ~RtpTransceiverState();
-
-  // This is intended to be used for moving the object from the signaling thread
-  // to the main thread and as such has no thread checks. Once moved to the main
-  // this should only be invoked on the main thread.
-  RtpTransceiverState& operator=(RtpTransceiverState&&);
-  RtpTransceiverState& operator=(const RtpTransceiverState&) = delete;
-
-  bool is_initialized() const;
-  void Initialize();
-
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner() const;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner() const;
-  scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver() const;
-  const base::Optional<RtpSenderState>& sender_state() const;
-  RtpSenderState MoveSenderState();
-  const base::Optional<RtpReceiverState>& receiver_state() const;
-  RtpReceiverState MoveReceiverState();
-  base::Optional<std::string> mid() const;
-  bool stopped() const;
-  webrtc::RtpTransceiverDirection direction() const;
-  void set_direction(webrtc::RtpTransceiverDirection);
-  base::Optional<webrtc::RtpTransceiverDirection> current_direction() const;
-  base::Optional<webrtc::RtpTransceiverDirection> fired_direction() const;
-
- private:
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver_;
-  bool is_initialized_;
-  base::Optional<RtpSenderState> sender_state_;
-  base::Optional<RtpReceiverState> receiver_state_;
-  base::Optional<std::string> mid_;
-  bool stopped_;
-  webrtc::RtpTransceiverDirection direction_;
-  base::Optional<webrtc::RtpTransceiverDirection> current_direction_;
-  base::Optional<webrtc::RtpTransceiverDirection> fired_direction_;
-};
-
-// RTCRtpTransceiver::set_state() performs differently depending on the update
-// mode. The update mode exists to get around problems with the webrtc threading
-// model: https://crbug.com/webrtc/8692.
-//
-// Transceiver state information can be surfaced as a result of invoking a
-// number of different JavaScript APIs. The way states are surfaced from webrtc
-// to content/blink fall into two categories:
-//   Blocking operations and callback-based operations.
-//
-// When a blocking operation is invoked, the main thread is blocked on the
-// webrtc signaling thread, and the state information is surfaced immediately
-// - guaranteed to be up-to-date. An example of this is addTrack().
-// Callback-based operations on the other hand will post a task from the
-// signaling thread to the main thread, placing the task to update the state
-// information in queue. There is no guarantee that something - such as
-// addTrack() - doesn't happen in-between the posting of the task and the
-// execution of it. In such cases, the state information surfaced might not be
-// up-to-date (in edge cases). Examples of callback-based operations include
-// setLocalDescription() and setRemoteDescription().
-enum class TransceiverStateUpdateMode {
-  // In this mode, all state information is updated. Use this enum unless
-  // a different update mode applies.
-  kAll,
-  // Use this enum when surfacing state information as a result of
-  // setLocalDescription() or setRemoteDescription().
-  // Behaves like "kAll" except "transceiver.sender.track" and
-  // "transceiver.direction" are not updated.
-  kSetDescription,
-};
-
-// Used to surface |webrtc::RtpTransceiverInterface| to blink. Multiple
-// |RTCRtpTransceiver|s could reference the same webrtc transceiver; |id| is
-// unique per webrtc transceiver.
-// Its methods are accessed on the main thread, internally also performs
-// operations on the signaling thread.
-// TODO(hbos): [Onion Soup] Remove the content layer versions of this class and
-// rely on webrtc directly from blink. Requires coordination with senders and
-// receivers. https://crbug.com/787254
-class CONTENT_EXPORT RTCRtpTransceiver : public blink::WebRTCRtpTransceiver {
- public:
-  static uintptr_t GetId(
-      const webrtc::RtpTransceiverInterface* webrtc_transceiver);
-
-  RTCRtpTransceiver(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map,
-      RtpTransceiverState state);
-  RTCRtpTransceiver(const RTCRtpTransceiver& other);
-  ~RTCRtpTransceiver() override;
-
-  RTCRtpTransceiver& operator=(const RTCRtpTransceiver& other);
-  std::unique_ptr<RTCRtpTransceiver> ShallowCopy() const;
-
-  const RtpTransceiverState& state() const;
-  void set_state(RtpTransceiverState state,
-                 TransceiverStateUpdateMode update_mode);
-  RTCRtpSender* content_sender();
-  RTCRtpReceiver* content_receiver();
-
-  blink::WebRTCRtpTransceiverImplementationType ImplementationType()
-      const override;
-  uintptr_t Id() const override;
-  blink::WebString Mid() const override;
-  std::unique_ptr<blink::WebRTCRtpSender> Sender() const override;
-  std::unique_ptr<blink::WebRTCRtpReceiver> Receiver() const override;
-  bool Stopped() const override;
-  webrtc::RtpTransceiverDirection Direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection direction) override;
-  base::Optional<webrtc::RtpTransceiverDirection> CurrentDirection()
-      const override;
-  base::Optional<webrtc::RtpTransceiverDirection> FiredDirection()
-      const override;
-  webrtc::RTCError SetCodecPreferences(
-      blink::WebVector<webrtc::RtpCodecCapability>) override;
-
- private:
-  class RTCRtpTransceiverInternal;
-  struct RTCRtpTransceiverInternalTraits;
-
-  scoped_refptr<RTCRtpTransceiverInternal> internal_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_RTC_RTP_TRANSCEIVER_H_
diff --git a/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver_unittest.cc b/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver_unittest.cc
deleted file mode 100644
index 0809e72004d..00000000000
--- a/chromium/content/renderer/media/webrtc/rtc_rtp_transceiver_unittest.cc
+++ /dev/null
@@ -1,422 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/rtc_rtp_transceiver.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/logging.h"
-#include "base/memory/ref_counted.h"
-#include "base/optional.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/test/task_environment.h"
-#include "build/build_config.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/blink/public/web/web_heap.h"
-#include "third_party/webrtc/api/test/mock_rtpreceiver.h"
-#include "third_party/webrtc/api/test/mock_rtpsender.h"
-
-namespace content {
-
-class RTCRtpTransceiverTest : public ::testing::Test {
- public:
-  void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
-    main_task_runner_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-    track_map_ = new WebRtcMediaStreamTrackAdapterMap(dependency_factory_.get(),
-                                                      main_task_runner_);
-    peer_connection_ = new rtc::RefCountedObject<MockPeerConnectionImpl>(
-        dependency_factory_.get(), nullptr);
-  }
-
-  void TearDown() override {
-    // Syncing up with the signaling thread ensures any pending operations on
-    // that thread are executed. If they post back to the main thread, such as
-    // the sender or receiver destructor traits, this is allowed to execute
-    // before the test shuts down the threads.
-    SyncWithSignalingThread();
-    blink::WebHeap::CollectAllGarbageForTesting();
-  }
-
-  // Wait for the signaling thread to perform any queued tasks, executing tasks
-  // posted to the current thread in the meantime while waiting.
-  void SyncWithSignalingThread() const {
-    base::RunLoop run_loop;
-    dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE, run_loop.QuitClosure());
-    run_loop.Run();
-  }
-
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner() const {
-    return dependency_factory_->GetWebRtcSignalingThread();
-  }
-
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-  CreateLocalTrackAndAdapter(const std::string& id) {
-    return track_map_->GetOrCreateLocalTrackAdapter(CreateBlinkLocalTrack(id));
-  }
-
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-  CreateRemoteTrackAndAdapter(const std::string& id) {
-    rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track =
-        MockWebRtcAudioTrack::Create(id).get();
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> track_ref;
-    base::RunLoop run_loop;
-    signaling_task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &RTCRtpTransceiverTest::CreateRemoteTrackAdapterOnSignalingThread,
-            base::Unretained(this), std::move(webrtc_track),
-            base::Unretained(&track_ref), base::Unretained(&run_loop)));
-    run_loop.Run();
-    DCHECK(track_ref);
-    return track_ref;
-  }
-
-  rtc::scoped_refptr<FakeRtpSender> CreateWebRtcSender(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-      const std::string& stream_id) {
-    return new rtc::RefCountedObject<FakeRtpSender>(
-        std::move(track), std::vector<std::string>({stream_id}));
-  }
-
-  rtc::scoped_refptr<FakeRtpReceiver> CreateWebRtcReceiver(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-      const std::string& stream_id) {
-    rtc::scoped_refptr<webrtc::MediaStreamInterface> remote_stream(
-        new rtc::RefCountedObject<MockMediaStream>(stream_id));
-    return new rtc::RefCountedObject<FakeRtpReceiver>(
-        track.get(),
-        std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>(
-            {remote_stream}));
-  }
-
-  rtc::scoped_refptr<FakeRtpTransceiver> CreateWebRtcTransceiver(
-      rtc::scoped_refptr<FakeRtpSender> sender,
-      rtc::scoped_refptr<FakeRtpReceiver> receiver,
-      base::Optional<std::string> mid,
-      bool stopped,
-      webrtc::RtpTransceiverDirection direction,
-      base::Optional<webrtc::RtpTransceiverDirection> current_direction) {
-    DCHECK(!sender->track() ||
-           sender->track()->kind() == receiver->track()->kind());
-    return new rtc::RefCountedObject<FakeRtpTransceiver>(
-        receiver->track()->kind() ==
-                webrtc::MediaStreamTrackInterface::kAudioKind
-            ? cricket::MEDIA_TYPE_AUDIO
-            : cricket::MEDIA_TYPE_VIDEO,
-        std::move(sender), std::move(receiver), std::move(mid), stopped,
-        direction, std::move(current_direction));
-  }
-
-  RtpTransceiverState CreateTransceiverState(
-      rtc::scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-          sender_track_ref,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-          receiver_track_ref) {
-    std::vector<std::string> receiver_stream_ids;
-    for (const auto& stream : webrtc_transceiver->receiver()->streams()) {
-      receiver_stream_ids.push_back(stream->id());
-    }
-    return RtpTransceiverState(
-        main_task_runner_, signaling_task_runner(), webrtc_transceiver.get(),
-        RtpSenderState(main_task_runner_, signaling_task_runner(),
-                       webrtc_transceiver->sender().get(),
-                       std::move(sender_track_ref),
-                       webrtc_transceiver->sender()->stream_ids()),
-        RtpReceiverState(main_task_runner_, signaling_task_runner(),
-                         webrtc_transceiver->receiver().get(),
-                         std::move(receiver_track_ref),
-                         std::move(receiver_stream_ids)),
-        blink::ToBaseOptional(webrtc_transceiver->mid()),
-        webrtc_transceiver->stopped(), webrtc_transceiver->direction(),
-        blink::ToBaseOptional(webrtc_transceiver->current_direction()),
-        blink::ToBaseOptional(webrtc_transceiver->fired_direction()));
-  }
-
- protected:
-  blink::WebMediaStreamTrack CreateBlinkLocalTrack(const std::string& id) {
-    blink::WebMediaStreamSource web_source;
-    web_source.Initialize(
-        blink::WebString::FromUTF8(id), blink::WebMediaStreamSource::kTypeAudio,
-        blink::WebString::FromUTF8("local_audio_track"), false);
-    blink::MediaStreamAudioSource* audio_source =
-        new blink::MediaStreamAudioSource(
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(), true);
-    // Takes ownership of |audio_source|.
-    web_source.SetPlatformSource(base::WrapUnique(audio_source));
-
-    blink::WebMediaStreamTrack web_track;
-    web_track.Initialize(web_source.Id(), web_source);
-    audio_source->ConnectToTrack(web_track);
-    return web_track;
-  }
-
-  void CreateRemoteTrackAdapterOnSignalingThread(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>* track_ref,
-      base::RunLoop* run_loop) {
-    *track_ref = track_map_->GetOrCreateRemoteTrackAdapter(webrtc_track.get());
-    run_loop->Quit();
-  }
-
- private:
-  base::test::TaskEnvironment task_environment_;
-
- protected:
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_map_;
-  rtc::scoped_refptr<MockPeerConnectionImpl> peer_connection_;
-};
-
-TEST_F(RTCRtpTransceiverTest, InitializeTransceiverState) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto remote_track_adapter = CreateRemoteTrackAndAdapter("remote_track");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      CreateWebRtcSender(local_track_adapter->webrtc_track(), "local_stream"),
-      CreateWebRtcReceiver(remote_track_adapter->webrtc_track(),
-                           "remote_stream"),
-      base::nullopt, false, webrtc::RtpTransceiverDirection::kSendRecv,
-      base::nullopt);
-  RtpTransceiverState transceiver_state =
-      CreateTransceiverState(webrtc_transceiver, std::move(local_track_adapter),
-                             std::move(remote_track_adapter));
-  EXPECT_FALSE(transceiver_state.is_initialized());
-  transceiver_state.Initialize();
-
-  EXPECT_TRUE(transceiver_state.is_initialized());
-  // Inspect sender states.
-  const auto& sender_state = transceiver_state.sender_state();
-  EXPECT_TRUE(sender_state);
-  EXPECT_TRUE(sender_state->is_initialized());
-  const auto& webrtc_sender = webrtc_transceiver->sender();
-  EXPECT_EQ(sender_state->webrtc_sender().get(), webrtc_sender.get());
-  EXPECT_TRUE(sender_state->track_ref()->is_initialized());
-  EXPECT_EQ(sender_state->track_ref()->webrtc_track(),
-            webrtc_sender->track().get());
-  EXPECT_EQ(sender_state->stream_ids(), webrtc_sender->stream_ids());
-  // Inspect receiver states.
-  const auto& receiver_state = transceiver_state.receiver_state();
-  EXPECT_TRUE(receiver_state);
-  EXPECT_TRUE(receiver_state->is_initialized());
-  const auto& webrtc_receiver = webrtc_transceiver->receiver();
-  EXPECT_EQ(receiver_state->webrtc_receiver().get(), webrtc_receiver.get());
-  EXPECT_TRUE(receiver_state->track_ref()->is_initialized());
-  EXPECT_EQ(receiver_state->track_ref()->webrtc_track(),
-            webrtc_receiver->track().get());
-  std::vector<std::string> receiver_stream_ids;
-  for (const auto& stream : webrtc_receiver->streams()) {
-    receiver_stream_ids.push_back(stream->id());
-  }
-  EXPECT_EQ(receiver_state->stream_ids(), receiver_stream_ids);
-  // Inspect transceiver states.
-  EXPECT_TRUE(blink::OptionalEquals(transceiver_state.mid(),
-                                    webrtc_transceiver->mid()));
-  EXPECT_EQ(transceiver_state.stopped(), webrtc_transceiver->stopped());
-  EXPECT_TRUE(transceiver_state.direction() == webrtc_transceiver->direction());
-  EXPECT_TRUE(blink::OptionalEquals(transceiver_state.current_direction(),
-                                    webrtc_transceiver->current_direction()));
-  EXPECT_TRUE(blink::OptionalEquals(transceiver_state.fired_direction(),
-                                    webrtc_transceiver->fired_direction()));
-}
-
-TEST_F(RTCRtpTransceiverTest, CreateTranceiver) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto remote_track_adapter = CreateRemoteTrackAndAdapter("remote_track");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      CreateWebRtcSender(local_track_adapter->webrtc_track(), "local_stream"),
-      CreateWebRtcReceiver(remote_track_adapter->webrtc_track(),
-                           "remote_stream"),
-      base::nullopt, false, webrtc::RtpTransceiverDirection::kSendRecv,
-      base::nullopt);
-  RtpTransceiverState transceiver_state =
-      CreateTransceiverState(webrtc_transceiver, std::move(local_track_adapter),
-                             std::move(remote_track_adapter));
-  EXPECT_FALSE(transceiver_state.is_initialized());
-  transceiver_state.Initialize();
-
-  RTCRtpTransceiver transceiver(peer_connection_.get(), track_map_,
-                                std::move(transceiver_state));
-  EXPECT_TRUE(transceiver.Mid().IsNull());
-  EXPECT_TRUE(transceiver.Sender());
-  EXPECT_TRUE(transceiver.Receiver());
-  EXPECT_FALSE(transceiver.Stopped());
-  EXPECT_EQ(transceiver.Direction(),
-            webrtc::RtpTransceiverDirection::kSendRecv);
-  EXPECT_FALSE(transceiver.CurrentDirection());
-  EXPECT_FALSE(transceiver.FiredDirection());
-}
-
-TEST_F(RTCRtpTransceiverTest, ModifyTransceiver) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto remote_track_adapter = CreateRemoteTrackAndAdapter("remote_track");
-  auto webrtc_sender =
-      CreateWebRtcSender(local_track_adapter->webrtc_track(), "local_stream");
-  auto webrtc_receiver = CreateWebRtcReceiver(
-      remote_track_adapter->webrtc_track(), "remote_stream");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      webrtc_sender, webrtc_receiver, base::nullopt, false,
-      webrtc::RtpTransceiverDirection::kSendRecv, base::nullopt);
-
-  // Create initial state.
-  RtpTransceiverState initial_transceiver_state =
-      CreateTransceiverState(webrtc_transceiver, local_track_adapter->Copy(),
-                             remote_track_adapter->Copy());
-  EXPECT_FALSE(initial_transceiver_state.is_initialized());
-  initial_transceiver_state.Initialize();
-
-  // Modify the webrtc transceiver and create a new state object for the
-  // modified state.
-  *webrtc_transceiver =
-      *CreateWebRtcTransceiver(webrtc_sender, webrtc_receiver, "MidyMacMidface",
-                               true, webrtc::RtpTransceiverDirection::kInactive,
-                               webrtc::RtpTransceiverDirection::kSendRecv);
-  RtpTransceiverState modified_transceiver_state =
-      CreateTransceiverState(webrtc_transceiver, local_track_adapter->Copy(),
-                             remote_track_adapter->Copy());
-  EXPECT_FALSE(modified_transceiver_state.is_initialized());
-  modified_transceiver_state.Initialize();
-
-  // Modifying the webrtc transceiver after the initial state was created should
-  // not have affected the transceiver state.
-  RTCRtpTransceiver transceiver(peer_connection_.get(), track_map_,
-                                std::move(initial_transceiver_state));
-  EXPECT_TRUE(transceiver.Mid().IsNull());
-  EXPECT_TRUE(transceiver.Sender());
-  EXPECT_TRUE(transceiver.Receiver());
-  EXPECT_FALSE(transceiver.Stopped());
-  EXPECT_EQ(transceiver.Direction(),
-            webrtc::RtpTransceiverDirection::kSendRecv);
-  EXPECT_FALSE(transceiver.CurrentDirection());
-  EXPECT_FALSE(transceiver.FiredDirection());
-
-  // Setting the state should make the transceiver state up-to-date.
-  transceiver.set_state(std::move(modified_transceiver_state),
-                        TransceiverStateUpdateMode::kAll);
-  EXPECT_EQ(transceiver.Mid(), "MidyMacMidface");
-  EXPECT_TRUE(transceiver.Sender());
-  EXPECT_TRUE(transceiver.Receiver());
-  EXPECT_TRUE(transceiver.Stopped());
-  EXPECT_EQ(transceiver.Direction(),
-            webrtc::RtpTransceiverDirection::kInactive);
-  EXPECT_TRUE(transceiver.CurrentDirection() ==
-              webrtc::RtpTransceiverDirection::kSendRecv);
-  EXPECT_FALSE(transceiver.FiredDirection());
-}
-
-TEST_F(RTCRtpTransceiverTest, ShallowCopy) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto remote_track_adapter = CreateRemoteTrackAndAdapter("remote_track");
-  auto webrtc_sender =
-      CreateWebRtcSender(local_track_adapter->webrtc_track(), "local_stream");
-  auto webrtc_receiver = CreateWebRtcReceiver(
-      remote_track_adapter->webrtc_track(), "remote_stream");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      webrtc_sender, webrtc_receiver, base::nullopt, false /* stopped */,
-      webrtc::RtpTransceiverDirection::kSendRecv, base::nullopt);
-
-  std::unique_ptr<RTCRtpTransceiver> transceiver;
-  // Create transceiver.
-  {
-    RtpTransceiverState transceiver_state =
-        CreateTransceiverState(webrtc_transceiver, local_track_adapter->Copy(),
-                               remote_track_adapter->Copy());
-    EXPECT_FALSE(transceiver_state.is_initialized());
-    transceiver_state.Initialize();
-    transceiver.reset(new RTCRtpTransceiver(peer_connection_.get(), track_map_,
-                                            std::move(transceiver_state)));
-  }
-  DCHECK(transceiver);
-  EXPECT_FALSE(transceiver->Stopped());
-
-  std::unique_ptr<RTCRtpTransceiver> shallow_copy = transceiver->ShallowCopy();
-  // Modifying the shallow copy should modify the original too since they have a
-  // shared internal state.
-  {
-    // Modify webrtc transceiver to be stopped.
-    *webrtc_transceiver = *CreateWebRtcTransceiver(
-        webrtc_sender, webrtc_receiver, base::nullopt, true /* stopped */,
-        webrtc::RtpTransceiverDirection::kSendRecv, base::nullopt);
-    RtpTransceiverState transceiver_state =
-        CreateTransceiverState(webrtc_transceiver, local_track_adapter->Copy(),
-                               remote_track_adapter->Copy());
-    EXPECT_FALSE(transceiver_state.is_initialized());
-    transceiver_state.Initialize();
-    // Set the state of the shallow copy.
-    shallow_copy->set_state(std::move(transceiver_state),
-                            TransceiverStateUpdateMode::kAll);
-  }
-  EXPECT_TRUE(shallow_copy->Stopped());
-  EXPECT_TRUE(transceiver->Stopped());
-}
-
-TEST_F(RTCRtpTransceiverTest, TransceiverStateUpdateModeSetDescription) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto remote_track_adapter = CreateRemoteTrackAndAdapter("remote_track");
-  auto webrtc_sender =
-      CreateWebRtcSender(local_track_adapter->webrtc_track(), "local_stream");
-  auto webrtc_receiver = CreateWebRtcReceiver(
-      remote_track_adapter->webrtc_track(), "remote_stream");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      webrtc_sender, webrtc_receiver, base::nullopt, false,
-      webrtc::RtpTransceiverDirection::kSendRecv, base::nullopt);
-
-  // Create initial state.
-  RtpTransceiverState initial_transceiver_state =
-      CreateTransceiverState(webrtc_transceiver, local_track_adapter->Copy(),
-                             remote_track_adapter->Copy());
-  EXPECT_FALSE(initial_transceiver_state.is_initialized());
-  initial_transceiver_state.Initialize();
-
-  // Modify the webrtc transceiver and create a new state object for the
-  // modified state.
-  webrtc_sender->SetTrack(nullptr);
-  *webrtc_transceiver =
-      *CreateWebRtcTransceiver(webrtc_sender, webrtc_receiver, "MidyMacMidface",
-                               true, webrtc::RtpTransceiverDirection::kInactive,
-                               webrtc::RtpTransceiverDirection::kSendRecv);
-  RtpTransceiverState modified_transceiver_state =
-      CreateTransceiverState(webrtc_transceiver, local_track_adapter->Copy(),
-                             remote_track_adapter->Copy());
-  EXPECT_FALSE(modified_transceiver_state.is_initialized());
-  modified_transceiver_state.Initialize();
-
-  // Construct a transceiver from the initial state.
-  RTCRtpTransceiver transceiver(peer_connection_.get(), track_map_,
-                                std::move(initial_transceiver_state));
-  // Setting the state with TransceiverStateUpdateMode::kSetDescription should
-  // make the transceiver state up-to-date, except leaving
-  // "transceiver.direction" and "transceiver.sender.track" unmodified.
-  transceiver.set_state(std::move(modified_transceiver_state),
-                        TransceiverStateUpdateMode::kSetDescription);
-  EXPECT_EQ(transceiver.Mid(), "MidyMacMidface");
-  EXPECT_TRUE(transceiver.Sender());
-  EXPECT_TRUE(transceiver.Receiver());
-  EXPECT_TRUE(transceiver.Stopped());
-  EXPECT_TRUE(transceiver.CurrentDirection() ==
-              webrtc::RtpTransceiverDirection::kSendRecv);
-  EXPECT_FALSE(transceiver.FiredDirection());
-  // The sender still has a track, even though the modified state doesn't.
-  EXPECT_FALSE(transceiver.Sender()->Track().IsNull());
-  // The direction still "sendrecv", even though the modified state has
-  // "inactive".
-  EXPECT_EQ(transceiver.Direction(),
-            webrtc::RtpTransceiverDirection::kSendRecv);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/stun_field_trial.cc b/chromium/content/renderer/media/webrtc/stun_field_trial.cc
deleted file mode 100644
index 183d8e8d8df..00000000000
--- a/chromium/content/renderer/media/webrtc/stun_field_trial.cc
+++ /dev/null
@@ -1,313 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/stun_field_trial.h"
-
-#include <math.h>
-
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/rand_util.h"
-#include "base/stl_util.h"
-#include "base/strings/string_number_conversions.h"
-#include "base/strings/string_split.h"
-#include "base/strings/stringprintf.h"
-#include "base/time/time.h"
-#include "third_party/webrtc/p2p/base/packet_socket_factory.h"
-#include "third_party/webrtc/rtc_base/async_packet_socket.h"
-#include "third_party/webrtc/rtc_base/async_resolver_interface.h"
-#include "third_party/webrtc/rtc_base/ip_address.h"
-#include "third_party/webrtc/rtc_base/network.h"
-#include "third_party/webrtc/rtc_base/socket_address.h"
-#include "third_party/webrtc/rtc_base/thread.h"
-
-using stunprober::StunProber;
-
-namespace content {
-
-namespace {
-
-// This needs to be the same as NatTypeCounters in histograms.xml.
-enum NatType {
-  NAT_TYPE_NONE,
-  NAT_TYPE_UNKNOWN,
-  NAT_TYPE_SYMMETRIC,
-  NAT_TYPE_NON_SYMMETRIC,
-  NAT_TYPE_MAX
-};
-
-// This needs to match "NatType" in histograms.xml.
-const char* const NatTypeNames[] =
-    {"NoNAT", "UnknownNAT", "SymNAT", "NonSymNAT"};
-static_assert(base::size(NatTypeNames) == NAT_TYPE_MAX,
-              "NatType enums must match names");
-
-NatType GetNatType(stunprober::NatType nat_type) {
-  switch (nat_type) {
-    case stunprober::NATTYPE_NONE:
-      return NAT_TYPE_NONE;
-    case stunprober::NATTYPE_UNKNOWN:
-      return NAT_TYPE_UNKNOWN;
-    case stunprober::NATTYPE_SYMMETRIC:
-      return NAT_TYPE_SYMMETRIC;
-    case stunprober::NATTYPE_NON_SYMMETRIC:
-      return NAT_TYPE_NON_SYMMETRIC;
-    default:
-      return NAT_TYPE_MAX;
-  }
-}
-
-std::string HistogramName(const std::string& prefix,
-                          NatType nat_type,
-                          int interval_ms,
-                          int batch_index) {
-  return base::StringPrintf("WebRTC.Stun.%s.%s.%dms.%d", prefix.c_str(),
-                            NatTypeNames[nat_type], interval_ms, batch_index);
-}
-
-}  // namespace
-
-StunProberTrial::Param::Param() {}
-
-StunProberTrial::Param::~Param() {}
-
-StunProberTrial::StunProberTrial(rtc::NetworkManager* network_manager,
-                                 const std::string& params,
-                                 rtc::PacketSocketFactory* factory)
-    : network_manager_(network_manager),
-      param_line_(params),
-      factory_(factory) {
-  // We have to connect to the signal to avoid a race condition if network
-  // manager hasn't received the network update when we start, the StunProber
-  // will just fail.
-  network_manager_->SignalNetworksChanged.connect(
-      this, &StunProberTrial::OnNetworksChanged);
-  network_manager_->StartUpdating();
-}
-
-StunProberTrial::~StunProberTrial() {}
-
-void StunProberTrial::SaveHistogramData() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  NatType nat_type = NAT_TYPE_UNKNOWN;
-  int interval_ms = 0;
-  int count = 0;
-  int total_requests_sent = 0;
-  int total_responses_received = 0;
-  for (auto* prober : probers_) {
-    ++count;
-
-    // Get the stats.
-    StunProber::Stats stats;
-    if (!prober->GetStats(&stats))
-      return;
-
-    // Check if the NAT type is consistent.
-    if (nat_type == NAT_TYPE_UNKNOWN) {
-      nat_type = GetNatType(stats.nat_type);
-    } else {
-      NatType type = GetNatType(stats.nat_type);
-      // For subsequent probers, we might get unknown as nattype if all the
-      // bindings fail, but it's ok.
-      if (nat_type != type && type != NAT_TYPE_UNKNOWN)
-        return;
-    }
-
-    // Check that the interval is consistent. Use the real probe interval for
-    // reporting, converting from nanosecond to millisecond.
-    int new_interval_ms =
-        round(static_cast<float>(stats.actual_request_interval_ns) / 1000);
-    if (interval_ms == 0) {
-      interval_ms = new_interval_ms;
-    } else if (abs(interval_ms - new_interval_ms) > 3) {
-      DVLOG(1) << "current interval: " << new_interval_ms
-               << " is too far off from previous one: " << interval_ms;
-      continue;
-    }
-
-    // Sum up the total sent and recv packets.
-    total_requests_sent += stats.raw_num_request_sent;
-    total_responses_received += stats.num_response_received;
-
-    if (count % batch_size_ > 0)
-      continue;
-
-    // If 50% of probers are not counted, ignore this batch.
-    // |raw_num_request_sent| should be the same for each prober.
-    if (total_requests_sent < (stats.raw_num_request_sent * batch_size_ / 2)) {
-      total_responses_received = 0;
-      total_requests_sent = 0;
-      continue;
-    }
-
-    int success_rate = total_responses_received * 100 / total_requests_sent;
-    // Use target_request_interval_ns for naming of UMA to avoid inconsistency.
-    std::string histogram_name = HistogramName(
-        "BatchSuccessPercent", nat_type,
-        stats.target_request_interval_ns / 1000, count / batch_size_);
-
-    // Mimic the same behavior as UMA_HISTOGRAM_PERCENTAGE. We can't use
-    // that macro as the histogram name is determined dynamically.
-    base::HistogramBase* histogram =
-        base::Histogram::FactoryGet(histogram_name, 1, 101, 102,
-                                    base::Histogram::kUmaTargetedHistogramFlag);
-    histogram->Add(success_rate);
-
-    DVLOG(1) << "Histogram '" << histogram_name.c_str()
-             << "' = " << success_rate;
-
-    DVLOG(1) << "Shared Socket Mode: " << stats.shared_socket_mode;
-    DVLOG(1) << "Requests sent: " << total_requests_sent;
-    DVLOG(1) << "Responses received: " << total_responses_received;
-    DVLOG(1) << "Target interval (ns): " << stats.target_request_interval_ns;
-    DVLOG(1) << "Actual interval (ns): " << stats.actual_request_interval_ns;
-    DVLOG(1) << "NAT Type: " << NatTypeNames[nat_type];
-    DVLOG(1) << "Host IP: " << stats.host_ip;
-
-    total_requests_sent = 0;
-    total_responses_received = 0;
-  }
-}
-
-bool StunProberTrial::ParseParameters(const std::string& param_line,
-                                      StunProberTrial::Param* params) {
-  std::vector<std::string> stun_params = base::SplitString(
-      param_line, "/", base::TRIM_WHITESPACE, base::SPLIT_WANT_ALL);
-
-  if (stun_params.size() < 5) {
-    DLOG(ERROR) << "Not enough parameters specified in StartStunProbeTrial";
-    return false;
-  }
-  auto param = stun_params.begin();
-
-  if (param->empty()) {
-    params->requests_per_ip = 10;
-  } else if (!base::StringToInt(*param, &params->requests_per_ip)) {
-    DLOG(ERROR) << "Failed to parse request_per_ip in StartStunProbeTrial";
-    return false;
-  }
-  param++;
-
-  // Set inter-probe interval randomly from 0, 5, 10, ... 50, 100 ms.
-  if ((*param).empty()) {
-    params->interval_ms = base::RandInt(0, 11) * 5;
-  } else if (!base::StringToInt(*param, &params->interval_ms)) {
-    DLOG(ERROR) << "Failed to parse interval in StartStunProbeTrial";
-    return false;
-  }
-  param++;
-
-  if ((*param).empty()) {
-    params->shared_socket_mode = base::RandInt(0, 1);
-  } else if (!base::StringToInt(*param, &params->shared_socket_mode)) {
-    DLOG(ERROR) << "Failed to parse shared_socket_mode in StartStunProbeTrial";
-    return false;
-  }
-  param++;
-
-  if (param->empty()) {
-    params->batch_size = 5;
-  } else if (!base::StringToInt(*param, &params->batch_size)) {
-    DLOG(ERROR) << "Failed to parse batch_size in StartStunProbeTrial";
-    return false;
-  }
-  param++;
-
-  if (param->empty()) {
-    params->total_batches = 5;
-  } else if (!base::StringToInt(*param, &params->total_batches)) {
-    DLOG(ERROR) << "Failed to parse total_batches in StartStunProbeTrial";
-    return false;
-  }
-  param++;
-
-  while (param != stun_params.end() && !param->empty()) {
-    rtc::SocketAddress server;
-    if (!server.FromString(*param)) {
-      DLOG(ERROR) << "Failed to parse address in StartStunProbeTrial";
-      return false;
-    }
-    params->servers.push_back(server);
-    param++;
-  }
-
-  return !params->servers.empty();
-}
-
-void StunProberTrial::OnNetworksChanged() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DVLOG(1) << "Starting stun trial with params: " << param_line_;
-  rtc::NetworkManager::NetworkList networks;
-  network_manager_->GetNetworks(&networks);
-
-  // If we don't have local addresses, we won't be able to determine whether
-  // we're behind NAT or not.
-  if (networks.empty()) {
-    DLOG(ERROR) << "No networks specified in StartStunProbeTrial";
-    return;
-  }
-
-  network_manager_->StopUpdating();
-  network_manager_->SignalNetworksChanged.disconnect(this);
-
-  StunProberTrial::Param params;
-  if (!ParseParameters(param_line_, &params)) {
-    return;
-  }
-
-  batch_size_ = params.batch_size;
-  total_probers_ = params.total_batches * batch_size_;
-
-  for (int i = 0; i < total_probers_; i++) {
-    std::unique_ptr<StunProber> prober(
-        new StunProber(factory_, rtc::Thread::Current(), networks));
-    if (!prober->Prepare(params.servers, (params.shared_socket_mode != 0),
-                         params.interval_ms, params.requests_per_ip, 1000,
-                         this)) {
-      DLOG(ERROR) << "Failed to Prepare in StartStunProbeTrial";
-      return;
-    }
-
-    probers_.push_back(prober.release());
-  }
-}
-
-void StunProberTrial::OnFinished(StunProber* prober,
-                                 StunProber::Status result) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (result == StunProber::SUCCESS)
-    ++finished_probers_;
-
-  if (finished_probers_ == total_probers_)
-    SaveHistogramData();
-}
-
-void StunProberTrial::OnPrepared(StunProber* prober,
-                                 StunProber::Status result) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (result == StunProber::SUCCESS)
-    ++ready_probers_;
-
-  if (ready_probers_ == total_probers_) {
-    // TODO(guoweis) estimated_execution_time() is the same for all probers. It
-    // could be moved up to the StunProberTrial class once the DNS resolution
-    // part is moved up too.
-    timer_.Start(FROM_HERE, base::TimeDelta::FromMilliseconds(
-                                probers_.front()->estimated_execution_time()),
-                 this, &StunProberTrial::OnTimer);
-  }
-}
-
-void StunProberTrial::OnTimer() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  probers_[started_probers_]->Start(this);
-  started_probers_++;
-
-  if (started_probers_ == total_probers_)
-    timer_.Stop();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/stun_field_trial.h b/chromium/content/renderer/media/webrtc/stun_field_trial.h
deleted file mode 100644
index 81b7419c8f6..00000000000
--- a/chromium/content/renderer/media/webrtc/stun_field_trial.h
+++ /dev/null
@@ -1,103 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_STUN_FIELD_TRIAL_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_STUN_FIELD_TRIAL_H_
-
-#include <memory>
-#include <string>
-#include <vector>
-
-#include "base/gtest_prod_util.h"
-#include "base/macros.h"
-#include "base/threading/thread_checker.h"
-#include "base/timer/timer.h"
-#include "content/common/content_export.h"
-#include "content/renderer/p2p/network_list_manager.h"
-#include "content/renderer/p2p/network_list_observer.h"
-#include "third_party/webrtc/p2p/stunprober/stun_prober.h"
-#include "third_party/webrtc/rtc_base/network.h"
-#include "third_party/webrtc/rtc_base/third_party/sigslot/sigslot.h"
-
-namespace rtc {
-class PacketSocketFactory;
-class SocketAddress;
-}  // namespace rtc
-
-namespace content {
-
-// Wait for 30 seconds to avoid high CPU usage during browser start-up which
-// might affect the accuracy of the trial. The trial wakes up the browser every
-// 1 ms for no more than 3 seconds to see if time has passed for sending next
-// stun probe.
-static const int kExperimentStartDelayMs = 30000;
-
-class StunProberTrial : public stunprober::StunProber::Observer,
-                        public sigslot::has_slots<> {
- public:
-  struct CONTENT_EXPORT Param {
-    Param();
-    ~Param();
-    int requests_per_ip = 0;
-    int interval_ms = 0;
-    int shared_socket_mode = 0;
-    int batch_size = 0;
-    int total_batches = 0;
-    std::vector<rtc::SocketAddress> servers;
-  };
-
-  StunProberTrial(rtc::NetworkManager* network_manager,
-                  const std::string& params,
-                  rtc::PacketSocketFactory* factory);
-  ~StunProberTrial() override;
-
- private:
-  // This will use |factory_| to create sockets, send stun binding requests with
-  // various intervals as determined by |params|, observed the success rate and
-  // latency of the stun responses and report through UMA.
-  void OnNetworksChanged();
-
-  // Parsing function to decode the '/' separated parameter string |params|.
-  static CONTENT_EXPORT bool ParseParameters(const std::string& param_line,
-                                             Param* params);
-
-  // stunprober::StunProber::Observer:
-  void OnPrepared(stunprober::StunProber* prober,
-                  stunprober::StunProber::Status status) override;
-  // OnFinished is invoked when the StunProber receives all the responses or
-  // times out.
-  void OnFinished(stunprober::StunProber* prober,
-                  stunprober::StunProber::Status status) override;
-
-  // This will be invoked repeatedly for |total_probers_| times with the
-  // interval equal to the estimated run time of a prober.
-  void OnTimer();
-
-  void SaveHistogramData();
-
-  rtc::NetworkManager* network_manager_;
-  std::string param_line_;
-  rtc::PacketSocketFactory* factory_ = nullptr;
-  int total_probers_ = 0;
-  int batch_size_ = 0;
-  int ready_probers_ = 0;
-  int started_probers_ = 0;
-  int finished_probers_ = 0;
-  std::vector<stunprober::StunProber*> probers_;
-  base::ThreadChecker thread_checker_;
-
-  // The reason we use a timer instead of depending on the OnFinished callback
-  // of each prober is that the OnFinished is not fired at the last of STUN
-  // request of each prober, instead, it includes a timeout period which waits
-  // the server response to come back. Having a timer guarantees the
-  // inter-prober intervals is the same as the STUN interval inside a prober.
-  base::RepeatingTimer timer_;
-
-  FRIEND_TEST_ALL_PREFIXES(StunProbeTrial, VerifyParameterParsing);
-  DISALLOW_COPY_AND_ASSIGN(StunProberTrial);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_STUN_FIELD_TRIAL_H_
diff --git a/chromium/content/renderer/media/webrtc/stun_field_trial_unittest.cc b/chromium/content/renderer/media/webrtc/stun_field_trial_unittest.cc
deleted file mode 100644
index 67c3962ab80..00000000000
--- a/chromium/content/renderer/media/webrtc/stun_field_trial_unittest.cc
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/stun_field_trial.h"
-
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/webrtc/rtc_base/socket_address.h"
-
-namespace content {
-
-TEST(StunProbeTrial, VerifyParameterParsing) {
-  StunProberTrial::Param params;
-  std::string param_line;
-
-  param_line = "20/100/1/3/3/server:3478/server2:3478";
-  EXPECT_TRUE(StunProberTrial::ParseParameters(param_line, &params));
-  EXPECT_EQ(params.requests_per_ip, 20);
-  EXPECT_EQ(params.interval_ms, 100);
-  EXPECT_EQ(params.shared_socket_mode, 1);
-  EXPECT_EQ(params.batch_size, 3);
-  EXPECT_EQ(params.total_batches, 3);
-  EXPECT_EQ(params.servers.size(), 2u);
-  EXPECT_EQ(params.servers[0], rtc::SocketAddress("server", 3478));
-  EXPECT_EQ(params.servers[1], rtc::SocketAddress("server2", 3478));
-  params.servers.clear();
-
-  param_line = "/////server:3478";
-  EXPECT_TRUE(StunProberTrial::ParseParameters(param_line, &params));
-  EXPECT_EQ(params.requests_per_ip, 10);
-  EXPECT_EQ(params.servers.size(), 1u);
-  EXPECT_EQ(params.servers[0], rtc::SocketAddress("server", 3478));
-  params.servers.clear();
-
-  // Make sure there is no crash. Parsing will fail as there is no server
-  // specified.
-  param_line = "/////";
-  EXPECT_FALSE(StunProberTrial::ParseParameters(param_line, &params));
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.cc b/chromium/content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.cc
deleted file mode 100644
index 4ac01eb36e7..00000000000
--- a/chromium/content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.cc
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.h"
-
-#include "base/bind.h"
-#include "base/callback.h"
-
-namespace content {
-
-WebRTCStatsReportObtainer::WebRTCStatsReportObtainer() {}
-
-WebRTCStatsReportObtainer::~WebRTCStatsReportObtainer() {}
-
-blink::WebRTCStatsReportCallback
-WebRTCStatsReportObtainer::GetStatsCallbackWrapper() {
-  return base::BindOnce(&WebRTCStatsReportObtainer::OnStatsDelivered, this);
-}
-
-blink::WebRTCStatsReport* WebRTCStatsReportObtainer::report() const {
-  return report_.get();
-}
-
-blink::WebRTCStatsReport* WebRTCStatsReportObtainer::WaitForReport() {
-  run_loop_.Run();
-  return report_.get();
-}
-
-void WebRTCStatsReportObtainer::OnStatsDelivered(
-    std::unique_ptr<blink::WebRTCStatsReport> report) {
-  report_ = std::move(report);
-  run_loop_.Quit();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.h b/chromium/content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.h
deleted file mode 100644
index ce1c105be22..00000000000
--- a/chromium/content/renderer/media/webrtc/test/webrtc_stats_report_obtainer.h
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_TEST_WEBRTC_STATS_REPORT_OBTAINER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_TEST_WEBRTC_STATS_REPORT_OBTAINER_H_
-
-#include <memory>
-
-#include "base/memory/ref_counted.h"
-#include "base/run_loop.h"
-#include "third_party/blink/public/platform/web_rtc_stats.h"
-
-namespace content {
-
-// The obtainer is a test-only helper class capable of waiting for a GetStats()
-// callback to be called. It takes ownership of and exposes the resulting
-// blink::WebRTCStatsReport.
-// While WaitForReport() is waiting for the report, tasks posted on the current
-// thread are executed (see base::RunLoop::Run()) making it safe to wait on the
-// same thread that the stats report callback occurs on without blocking the
-// callback.
-class WebRTCStatsReportObtainer
-    : public base::RefCountedThreadSafe<WebRTCStatsReportObtainer> {
- public:
-  WebRTCStatsReportObtainer();
-
-  blink::WebRTCStatsReportCallback GetStatsCallbackWrapper();
-
-  blink::WebRTCStatsReport* report() const;
-  blink::WebRTCStatsReport* WaitForReport();
-
- private:
-  friend class base::RefCountedThreadSafe<WebRTCStatsReportObtainer>;
-  friend class CallbackWrapper;
-  virtual ~WebRTCStatsReportObtainer();
-
-  void OnStatsDelivered(std::unique_ptr<blink::WebRTCStatsReport> report);
-
-  base::RunLoop run_loop_;
-  std::unique_ptr<blink::WebRTCStatsReport> report_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_TEST_WEBRTC_STATS_REPORT_OBTAINER_H_
diff --git a/chromium/content/renderer/media/webrtc/transceiver_state_surfacer.cc b/chromium/content/renderer/media/webrtc/transceiver_state_surfacer.cc
deleted file mode 100644
index 03fe437fc08..00000000000
--- a/chromium/content/renderer/media/webrtc/transceiver_state_surfacer.cc
+++ /dev/null
@@ -1,239 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/transceiver_state_surfacer.h"
-
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
-#include "third_party/webrtc/api/rtp_transceiver_interface.h"
-#include "third_party/webrtc/api/sctp_transport_interface.h"
-
-namespace content {
-
-TransceiverStateSurfacer::TransceiverStateSurfacer(
-    scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-    scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner)
-    : main_task_runner_(std::move(main_task_runner)),
-      signaling_task_runner_(std::move(signaling_task_runner)),
-      is_initialized_(false),
-      states_obtained_(false) {
-  DCHECK(main_task_runner_);
-  DCHECK(signaling_task_runner_);
-}
-
-TransceiverStateSurfacer::TransceiverStateSurfacer(
-    TransceiverStateSurfacer&& other)
-    : main_task_runner_(other.main_task_runner_),
-      signaling_task_runner_(other.signaling_task_runner_),
-      is_initialized_(other.is_initialized_),
-      states_obtained_(other.states_obtained_),
-      sctp_transport_snapshot_(other.sctp_transport_snapshot_),
-      transceiver_states_(std::move(other.transceiver_states_)) {
-  // Explicitly null |other|'s task runners for use in destructor.
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-}
-
-TransceiverStateSurfacer::~TransceiverStateSurfacer() {
-  // It's OK to not be on the main thread if this object has been moved, in
-  // which case |main_task_runner_| is null.
-  DCHECK(!main_task_runner_ || main_task_runner_->BelongsToCurrentThread());
-}
-
-TransceiverStateSurfacer& TransceiverStateSurfacer::operator=(
-    TransceiverStateSurfacer&& other) {
-  main_task_runner_ = other.main_task_runner_;
-  signaling_task_runner_ = other.signaling_task_runner_;
-  states_obtained_ = other.states_obtained_;
-  sctp_transport_snapshot_ = other.sctp_transport_snapshot_;
-  transceiver_states_ = std::move(other.transceiver_states_);
-  // Explicitly null |other|'s task runners for use in destructor.
-  other.main_task_runner_ = nullptr;
-  other.signaling_task_runner_ = nullptr;
-  return *this;
-}
-
-void TransceiverStateSurfacer::Initialize(
-    scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
-    std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-        webrtc_transceivers) {
-  DCHECK(signaling_task_runner_->BelongsToCurrentThread());
-  DCHECK(!is_initialized_);
-  DCHECK(native_peer_connection);
-  sctp_transport_snapshot_.transport =
-      native_peer_connection->GetSctpTransport();
-  if (sctp_transport_snapshot_.transport) {
-    sctp_transport_snapshot_.sctp_transport_state =
-        sctp_transport_snapshot_.transport->Information();
-    if (sctp_transport_snapshot_.sctp_transport_state.dtls_transport()) {
-      sctp_transport_snapshot_.dtls_transport_state =
-          sctp_transport_snapshot_.sctp_transport_state.dtls_transport()
-              ->Information();
-    }
-  }
-
-  for (auto& webrtc_transceiver : webrtc_transceivers) {
-    // Create the sender state.
-    base::Optional<RtpSenderState> sender_state;
-    auto webrtc_sender = webrtc_transceiver->sender();
-    if (webrtc_sender) {
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-          sender_track_ref;
-      if (webrtc_sender->track()) {
-        // The track adapter for this track must already exist for us to obtain
-        // it, since this cannot be created from the signaling thread.
-        // TODO(hbos): Consider either making it possible to create local track
-        // adapters on the signaling thread for initialization on the main
-        // thread or wait for Onion Souping to simplify this.
-        // https://crbug.com/787254
-        sender_track_ref =
-            track_adapter_map->GetLocalTrackAdapter(webrtc_sender->track());
-        CHECK(sender_track_ref);
-      }
-      sender_state = RtpSenderState(
-          main_task_runner_, signaling_task_runner_, webrtc_sender.get(),
-          std::move(sender_track_ref), webrtc_sender->stream_ids());
-    }
-    // Create the receiver state.
-    base::Optional<RtpReceiverState> receiver_state;
-    auto webrtc_receiver = webrtc_transceiver->receiver();
-    if (webrtc_receiver) {
-      DCHECK(webrtc_receiver->track());
-      auto receiver_track_ref =
-          track_adapter_map->GetOrCreateRemoteTrackAdapter(
-              webrtc_receiver->track().get());
-      DCHECK(receiver_track_ref);
-      std::vector<std::string> receiver_stream_ids;
-      for (auto& stream : webrtc_receiver->streams()) {
-        receiver_stream_ids.push_back(stream->id());
-      }
-      receiver_state = RtpReceiverState(
-          main_task_runner_, signaling_task_runner_, webrtc_receiver.get(),
-          std::move(receiver_track_ref), std::move(receiver_stream_ids));
-    }
-    // Create the transceiver state.
-    transceiver_states_.push_back(RtpTransceiverState(
-        main_task_runner_, signaling_task_runner_, webrtc_transceiver.get(),
-        std::move(sender_state), std::move(receiver_state),
-        blink::ToBaseOptional(webrtc_transceiver->mid()),
-        webrtc_transceiver->stopped(), webrtc_transceiver->direction(),
-        blink::ToBaseOptional(webrtc_transceiver->current_direction()),
-        blink::ToBaseOptional(webrtc_transceiver->fired_direction())));
-  }
-  is_initialized_ = true;
-}
-
-blink::WebRTCSctpTransportSnapshot
-TransceiverStateSurfacer::SctpTransportSnapshot() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  DCHECK(is_initialized_);
-  return sctp_transport_snapshot_;
-}
-
-std::vector<RtpTransceiverState> TransceiverStateSurfacer::ObtainStates() {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  DCHECK(is_initialized_);
-  for (auto& transceiver_state : transceiver_states_)
-    transceiver_state.Initialize();
-  states_obtained_ = true;
-  return std::move(transceiver_states_);
-}
-
-SurfaceSenderStateOnly::SurfaceSenderStateOnly(
-    rtc::scoped_refptr<webrtc::RtpSenderInterface> sender)
-    : sender_(std::move(sender)) {
-  DCHECK(sender_);
-}
-
-SurfaceSenderStateOnly::~SurfaceSenderStateOnly() {}
-
-cricket::MediaType SurfaceSenderStateOnly::media_type() const {
-  return sender_->media_type();
-}
-
-absl::optional<std::string> SurfaceSenderStateOnly::mid() const {
-  return absl::nullopt;
-}
-
-rtc::scoped_refptr<webrtc::RtpSenderInterface> SurfaceSenderStateOnly::sender()
-    const {
-  return sender_;
-}
-
-rtc::scoped_refptr<webrtc::RtpReceiverInterface>
-SurfaceSenderStateOnly::receiver() const {
-  return nullptr;
-}
-
-bool SurfaceSenderStateOnly::stopped() const {
-  return false;
-}
-
-webrtc::RtpTransceiverDirection SurfaceSenderStateOnly::direction() const {
-  return webrtc::RtpTransceiverDirection::kSendOnly;
-}
-
-void SurfaceSenderStateOnly::SetDirection(
-    webrtc::RtpTransceiverDirection new_direction) {
-  NOTIMPLEMENTED();
-}
-
-absl::optional<webrtc::RtpTransceiverDirection>
-SurfaceSenderStateOnly::current_direction() const {
-  return absl::nullopt;
-}
-
-void SurfaceSenderStateOnly::Stop() {
-  NOTIMPLEMENTED();
-}
-
-SurfaceReceiverStateOnly::SurfaceReceiverStateOnly(
-    rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver)
-    : receiver_(std::move(receiver)) {
-  DCHECK(receiver_);
-}
-
-SurfaceReceiverStateOnly::~SurfaceReceiverStateOnly() {}
-
-cricket::MediaType SurfaceReceiverStateOnly::media_type() const {
-  return receiver_->media_type();
-}
-
-absl::optional<std::string> SurfaceReceiverStateOnly::mid() const {
-  return absl::nullopt;
-}
-
-rtc::scoped_refptr<webrtc::RtpSenderInterface>
-SurfaceReceiverStateOnly::sender() const {
-  return nullptr;
-}
-
-rtc::scoped_refptr<webrtc::RtpReceiverInterface>
-SurfaceReceiverStateOnly::receiver() const {
-  return receiver_;
-}
-
-bool SurfaceReceiverStateOnly::stopped() const {
-  return false;
-}
-
-webrtc::RtpTransceiverDirection SurfaceReceiverStateOnly::direction() const {
-  return webrtc::RtpTransceiverDirection::kRecvOnly;
-}
-
-void SurfaceReceiverStateOnly::SetDirection(
-    webrtc::RtpTransceiverDirection new_direction) {
-  NOTIMPLEMENTED();
-}
-
-absl::optional<webrtc::RtpTransceiverDirection>
-SurfaceReceiverStateOnly::current_direction() const {
-  return absl::nullopt;
-}
-
-void SurfaceReceiverStateOnly::Stop() {
-  NOTIMPLEMENTED();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/transceiver_state_surfacer.h b/chromium/content/renderer/media/webrtc/transceiver_state_surfacer.h
deleted file mode 100644
index 133a206d7b9..00000000000
--- a/chromium/content/renderer/media/webrtc/transceiver_state_surfacer.h
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_TRANSCEIVER_STATE_SURFACER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_TRANSCEIVER_STATE_SURFACER_H_
-
-#include "content/renderer/media/webrtc/rtc_rtp_transceiver.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-#include "third_party/blink/public/platform/web_rtc_peer_connection_handler_client.h"
-#include "third_party/webrtc/api/rtp_transceiver_interface.h"
-#include "third_party/webrtc/api/sctp_transport_interface.h"
-#include "third_party/webrtc/rtc_base/ref_count.h"
-#include "third_party/webrtc/rtc_base/ref_counted_object.h"
-
-namespace content {
-
-// Takes care of creating and initializing transceiver states (including sender
-// and receiver states). This is usable for both blocking and non-blocking calls
-// to the webrtc signaling thread.
-//
-// The surfacer is initialized on the signaling thread and states are obtained
-// on the main thread. It is designed to be initialized and handed off; it is
-// not thread safe for concurrent thread usage.
-class CONTENT_EXPORT TransceiverStateSurfacer {
- public:
-  TransceiverStateSurfacer(
-      scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
-      scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner);
-  TransceiverStateSurfacer(TransceiverStateSurfacer&&);
-  TransceiverStateSurfacer(const TransceiverStateSurfacer&) = delete;
-  ~TransceiverStateSurfacer();
-
-  // This is intended to be used for moving the object from the signaling thread
-  // to the main thread and as such has no thread checks. Once moved to the main
-  // this should only be invoked on the main thread.
-  TransceiverStateSurfacer& operator=(TransceiverStateSurfacer&&);
-  TransceiverStateSurfacer& operator=(const TransceiverStateSurfacer&) = delete;
-
-  bool is_initialized() const { return is_initialized_; }
-
-  // Must be invoked on the signaling thread.
-  void Initialize(
-      scoped_refptr<webrtc::PeerConnectionInterface> native_peer_connection,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
-      std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-          transceivers);
-
-  // Must be invoked on the main thread.
-  blink::WebRTCSctpTransportSnapshot SctpTransportSnapshot();
-  std::vector<RtpTransceiverState> ObtainStates();
-
- protected:
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
-  bool is_initialized_;
-  bool states_obtained_;
-  blink::WebRTCSctpTransportSnapshot sctp_transport_snapshot_;
-  std::vector<RtpTransceiverState> transceiver_states_;
-};
-
-// A dummy implementation of a transceiver used to surface sender state
-// information only. It is not thread safe, only designed to be passed on to
-// TransceiverStateSurfacer::Initialize().
-class CONTENT_EXPORT SurfaceSenderStateOnly
-    : public rtc::RefCountedObject<webrtc::RtpTransceiverInterface> {
- public:
-  SurfaceSenderStateOnly(rtc::scoped_refptr<webrtc::RtpSenderInterface> sender);
-  ~SurfaceSenderStateOnly() override;
-
-  cricket::MediaType media_type() const override;
-  absl::optional<std::string> mid() const override;
-  rtc::scoped_refptr<webrtc::RtpSenderInterface> sender() const override;
-  rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver() const override;
-  bool stopped() const override;
-  webrtc::RtpTransceiverDirection direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection new_direction) override;
-  absl::optional<webrtc::RtpTransceiverDirection> current_direction()
-      const override;
-  void Stop() override;
-
- private:
-  rtc::scoped_refptr<webrtc::RtpSenderInterface> sender_;
-};
-
-// A dummy implementation of a transceiver used to surface receiver state
-// information only. It is not thread safe, only designed to be passed on to
-// TransceiverStateSurfacer::Initialize().
-class CONTENT_EXPORT SurfaceReceiverStateOnly
-    : public rtc::RefCountedObject<webrtc::RtpTransceiverInterface> {
- public:
-  SurfaceReceiverStateOnly(
-      rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver);
-  ~SurfaceReceiverStateOnly() override;
-
-  cricket::MediaType media_type() const override;
-  absl::optional<std::string> mid() const override;
-  rtc::scoped_refptr<webrtc::RtpSenderInterface> sender() const override;
-  rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver() const override;
-  bool stopped() const override;
-  webrtc::RtpTransceiverDirection direction() const override;
-  void SetDirection(webrtc::RtpTransceiverDirection new_direction) override;
-  absl::optional<webrtc::RtpTransceiverDirection> current_direction()
-      const override;
-  void Stop() override;
-
- private:
-  rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_TRANSCEIVER_STATE_SURFACER_H_
diff --git a/chromium/content/renderer/media/webrtc/transceiver_state_surfacer_unittest.cc b/chromium/content/renderer/media/webrtc/transceiver_state_surfacer_unittest.cc
deleted file mode 100644
index 9412dc0a3a4..00000000000
--- a/chromium/content/renderer/media/webrtc/transceiver_state_surfacer_unittest.cc
+++ /dev/null
@@ -1,385 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/transceiver_state_surfacer.h"
-
-#include <memory>
-#include <tuple>
-
-#include "base/bind.h"
-#include "base/memory/ref_counted.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/test/task_environment.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/blink/public/web/web_heap.h"
-
-using testing::AnyNumber;
-using testing::Return;
-
-namespace content {
-
-class MockSctpTransport : public webrtc::SctpTransportInterface {
- public:
-  MOCK_CONST_METHOD0(dtls_transport,
-                     rtc::scoped_refptr<webrtc::DtlsTransportInterface>());
-  MOCK_CONST_METHOD0(Information, webrtc::SctpTransportInformation());
-  MOCK_METHOD1(RegisterObserver, void(webrtc::SctpTransportObserverInterface*));
-  MOCK_METHOD0(UnregisterObserver, void());
-};
-
-class TransceiverStateSurfacerTest : public ::testing::Test {
- public:
-  void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
-    main_task_runner_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-    track_adapter_map_ = new WebRtcMediaStreamTrackAdapterMap(
-        dependency_factory_.get(), main_task_runner_);
-    surfacer_.reset(new TransceiverStateSurfacer(main_task_runner_,
-                                                 signaling_task_runner()));
-    peer_connection_ = dependency_factory_->CreatePeerConnection(
-        webrtc::PeerConnectionInterface::RTCConfiguration(), nullptr, nullptr);
-    EXPECT_CALL(*(static_cast<MockPeerConnectionImpl*>(peer_connection_.get())),
-                GetSctpTransport())
-        .Times(AnyNumber());
-  }
-
-  void TearDown() override {
-    // Make sure posted tasks get a chance to execute or else the stuff is
-    // teared down while things are in flight.
-    base::RunLoop().RunUntilIdle();
-    blink::WebHeap::CollectAllGarbageForTesting();
-  }
-
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner() const {
-    return dependency_factory_->GetWebRtcSignalingThread();
-  }
-
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-  CreateLocalTrackAndAdapter(const std::string& id) {
-    return track_adapter_map_->GetOrCreateLocalTrackAdapter(
-        CreateBlinkLocalTrack(id));
-  }
-
-  rtc::scoped_refptr<FakeRtpTransceiver> CreateWebRtcTransceiver(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> local_track,
-      const std::string& local_stream_id,
-      const std::string& remote_track_id,
-      const std::string& remote_stream_id,
-      rtc::scoped_refptr<webrtc::DtlsTransportInterface> transport) {
-    rtc::scoped_refptr<FakeRtpTransceiver> transceiver =
-        new rtc::RefCountedObject<FakeRtpTransceiver>(
-            local_track->kind() == webrtc::MediaStreamTrackInterface::kAudioKind
-                ? cricket::MEDIA_TYPE_AUDIO
-                : cricket::MEDIA_TYPE_VIDEO,
-            CreateWebRtcSender(local_track, local_stream_id),
-            CreateWebRtcReceiver(remote_track_id, remote_stream_id),
-            base::nullopt, false, webrtc::RtpTransceiverDirection::kSendRecv,
-            base::nullopt);
-    if (transport.get()) {
-      transceiver->SetTransport(transport);
-    }
-    return transceiver;
-  }
-
-  rtc::scoped_refptr<FakeRtpSender> CreateWebRtcSender(
-      rtc::scoped_refptr<webrtc::MediaStreamTrackInterface> track,
-      const std::string& stream_id) {
-    return new rtc::RefCountedObject<FakeRtpSender>(
-        std::move(track), std::vector<std::string>({stream_id}));
-  }
-
-  rtc::scoped_refptr<FakeRtpReceiver> CreateWebRtcReceiver(
-      const std::string& track_id,
-      const std::string& stream_id) {
-    rtc::scoped_refptr<webrtc::AudioTrackInterface> remote_track =
-        MockWebRtcAudioTrack::Create(track_id).get();
-    rtc::scoped_refptr<webrtc::MediaStreamInterface> remote_stream(
-        new rtc::RefCountedObject<MockMediaStream>(stream_id));
-    return new rtc::RefCountedObject<FakeRtpReceiver>(
-        remote_track.get(),
-        std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>(
-            {remote_stream}));
-  }
-
-  // Initializes the surfacer on the signaling thread and signals the waitable
-  // event when done. The WaitableEvent's Wait() blocks the main thread until
-  // initialization occurs.
-  std::unique_ptr<base::WaitableEvent> AsyncInitializeSurfacerWithWaitableEvent(
-      std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-          transceivers) {
-    std::unique_ptr<base::WaitableEvent> waitable_event(new base::WaitableEvent(
-        base::WaitableEvent::ResetPolicy::MANUAL,
-        base::WaitableEvent::InitialState::NOT_SIGNALED));
-    signaling_task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &TransceiverStateSurfacerTest::
-                AsyncInitializeSurfacerWithWaitableEventOnSignalingThread,
-            base::Unretained(this), std::move(transceivers),
-            waitable_event.get()));
-    return waitable_event;
-  }
-
-  // Initializes the surfacer on the signaling thread and posts back to the main
-  // thread to execute the callback when done. The RunLoop quits after the
-  // callback is executed. Use the RunLoop's Run() method to allow the posted
-  // task (such as the callback) to be executed while waiting. The caller must
-  // let the loop Run() before destroying it.
-  std::unique_ptr<base::RunLoop> AsyncInitializeSurfacerWithCallback(
-      std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-          transceivers,
-      base::OnceCallback<void()> callback) {
-    std::unique_ptr<base::RunLoop> run_loop(new base::RunLoop());
-    signaling_task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&TransceiverStateSurfacerTest::
-                           AsyncInitializeSurfacerWithCallbackOnSignalingThread,
-                       base::Unretained(this), std::move(transceivers),
-                       std::move(callback), run_loop.get()));
-    return run_loop;
-  }
-
-  void ObtainStatesAndExpectInitialized(
-      rtc::scoped_refptr<webrtc::RtpTransceiverInterface> webrtc_transceiver) {
-    // Inspect SCTP transport
-    auto sctp_snapshot = surfacer_->SctpTransportSnapshot();
-    EXPECT_EQ(peer_connection_->GetSctpTransport(), sctp_snapshot.transport);
-    if (peer_connection_->GetSctpTransport()) {
-      EXPECT_EQ(peer_connection_->GetSctpTransport()->dtls_transport(),
-                sctp_snapshot.sctp_transport_state.dtls_transport());
-    }
-    // Inspect transceivers
-    auto transceiver_states = surfacer_->ObtainStates();
-    EXPECT_EQ(1u, transceiver_states.size());
-    auto& transceiver_state = transceiver_states[0];
-    EXPECT_EQ(transceiver_state.webrtc_transceiver().get(),
-              webrtc_transceiver.get());
-    // Inspect sender states.
-    const auto& sender_state = transceiver_state.sender_state();
-    EXPECT_TRUE(sender_state);
-    EXPECT_TRUE(sender_state->is_initialized());
-    const auto& webrtc_sender = webrtc_transceiver->sender();
-    EXPECT_EQ(sender_state->webrtc_sender().get(), webrtc_sender.get());
-    EXPECT_TRUE(sender_state->track_ref()->is_initialized());
-    EXPECT_EQ(sender_state->track_ref()->webrtc_track(),
-              webrtc_sender->track().get());
-    EXPECT_EQ(sender_state->stream_ids(), webrtc_sender->stream_ids());
-    EXPECT_EQ(sender_state->webrtc_dtls_transport(),
-              webrtc_sender->dtls_transport());
-    if (webrtc_sender->dtls_transport()) {
-      EXPECT_EQ(webrtc_sender->dtls_transport()->Information().state(),
-                sender_state->webrtc_dtls_transport_information().state());
-    } else {
-      EXPECT_EQ(webrtc::DtlsTransportState::kNew,
-                sender_state->webrtc_dtls_transport_information().state());
-    }
-    // Inspect receiver states.
-    const auto& receiver_state = transceiver_state.receiver_state();
-    EXPECT_TRUE(receiver_state);
-    EXPECT_TRUE(receiver_state->is_initialized());
-    const auto& webrtc_receiver = webrtc_transceiver->receiver();
-    EXPECT_EQ(receiver_state->webrtc_receiver().get(), webrtc_receiver.get());
-    EXPECT_TRUE(receiver_state->track_ref()->is_initialized());
-    EXPECT_EQ(receiver_state->track_ref()->webrtc_track(),
-              webrtc_receiver->track().get());
-    std::vector<std::string> receiver_stream_ids;
-    for (const auto& stream : webrtc_receiver->streams()) {
-      receiver_stream_ids.push_back(stream->id());
-    }
-    EXPECT_EQ(receiver_state->stream_ids(), receiver_stream_ids);
-    EXPECT_EQ(receiver_state->webrtc_dtls_transport(),
-              webrtc_receiver->dtls_transport());
-    if (webrtc_receiver->dtls_transport()) {
-      EXPECT_EQ(webrtc_receiver->dtls_transport()->Information().state(),
-                receiver_state->webrtc_dtls_transport_information().state());
-    } else {
-      EXPECT_EQ(webrtc::DtlsTransportState::kNew,
-                receiver_state->webrtc_dtls_transport_information().state());
-    }
-    // Inspect transceiver states.
-    EXPECT_TRUE(blink::OptionalEquals(transceiver_state.mid(),
-                                      webrtc_transceiver->mid()));
-    EXPECT_EQ(transceiver_state.stopped(), webrtc_transceiver->stopped());
-    EXPECT_TRUE(transceiver_state.direction() ==
-                webrtc_transceiver->direction());
-    EXPECT_TRUE(blink::OptionalEquals(transceiver_state.current_direction(),
-                                      webrtc_transceiver->current_direction()));
-  }
-
- private:
-  blink::WebMediaStreamTrack CreateBlinkLocalTrack(const std::string& id) {
-    blink::WebMediaStreamSource web_source;
-    web_source.Initialize(
-        blink::WebString::FromUTF8(id), blink::WebMediaStreamSource::kTypeAudio,
-        blink::WebString::FromUTF8("local_audio_track"), false);
-    blink::MediaStreamAudioSource* audio_source =
-        new blink::MediaStreamAudioSource(
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(), true);
-    // Takes ownership of |audio_source|.
-    web_source.SetPlatformSource(base::WrapUnique(audio_source));
-
-    blink::WebMediaStreamTrack web_track;
-    web_track.Initialize(web_source.Id(), web_source);
-    audio_source->ConnectToTrack(web_track);
-    return web_track;
-  }
-
-  void AsyncInitializeSurfacerWithWaitableEventOnSignalingThread(
-      std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-          transceivers,
-      base::WaitableEvent* waitable_event) {
-    DCHECK(signaling_task_runner()->BelongsToCurrentThread());
-    surfacer_->Initialize(peer_connection_, track_adapter_map_,
-                          std::move(transceivers));
-    waitable_event->Signal();
-  }
-
-  void AsyncInitializeSurfacerWithCallbackOnSignalingThread(
-      std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
-          transceivers,
-      base::OnceCallback<void()> callback,
-      base::RunLoop* run_loop) {
-    DCHECK(signaling_task_runner()->BelongsToCurrentThread());
-    surfacer_->Initialize(peer_connection_, track_adapter_map_,
-                          std::move(transceivers));
-    main_task_runner_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&TransceiverStateSurfacerTest::
-                           AsyncInitializeSurfacerWithCallbackOnMainThread,
-                       base::Unretained(this), std::move(callback), run_loop));
-  }
-
-  void AsyncInitializeSurfacerWithCallbackOnMainThread(
-      base::OnceCallback<void()> callback,
-      base::RunLoop* run_loop) {
-    DCHECK(main_task_runner_->BelongsToCurrentThread());
-    DCHECK(surfacer_->is_initialized());
-    std::move(callback).Run();
-    run_loop->Quit();
-  }
-
-  base::test::TaskEnvironment task_environment_;
-
- protected:
-  scoped_refptr<webrtc::PeerConnectionInterface> peer_connection_;
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
-  std::unique_ptr<TransceiverStateSurfacer> surfacer_;
-};
-
-TEST_F(TransceiverStateSurfacerTest, SurfaceTransceiverBlockingly) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      local_track_adapter->webrtc_track(), "local_stream", "remote_track",
-      "remote_stream", nullptr);
-  auto waitable_event =
-      AsyncInitializeSurfacerWithWaitableEvent({webrtc_transceiver});
-  waitable_event->Wait();
-  ObtainStatesAndExpectInitialized(webrtc_transceiver);
-}
-
-TEST_F(TransceiverStateSurfacerTest, SurfaceTransceiverInCallback) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      local_track_adapter->webrtc_track(), "local_stream", "remote_track",
-      "remote_stream", nullptr);
-  auto run_loop = AsyncInitializeSurfacerWithCallback(
-      {webrtc_transceiver},
-      base::BindOnce(
-          &TransceiverStateSurfacerTest::ObtainStatesAndExpectInitialized,
-          base::Unretained(this), webrtc_transceiver));
-  run_loop->Run();
-}
-
-TEST_F(TransceiverStateSurfacerTest, SurfaceTransceiverWithTransport) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      local_track_adapter->webrtc_track(), "local_stream", "remote_track",
-      "remote_stream", new rtc::RefCountedObject<FakeDtlsTransport>());
-  auto run_loop = AsyncInitializeSurfacerWithCallback(
-      {webrtc_transceiver},
-      base::BindOnce(
-          &TransceiverStateSurfacerTest::ObtainStatesAndExpectInitialized,
-          base::Unretained(this), webrtc_transceiver));
-  run_loop->Run();
-}
-
-TEST_F(TransceiverStateSurfacerTest, SurfaceSenderStateOnly) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto webrtc_sender =
-      CreateWebRtcSender(local_track_adapter->webrtc_track(), "local_stream");
-  auto waitable_event = AsyncInitializeSurfacerWithWaitableEvent(
-      {new SurfaceSenderStateOnly(webrtc_sender)});
-  waitable_event->Wait();
-  auto transceiver_states = surfacer_->ObtainStates();
-  EXPECT_EQ(1u, transceiver_states.size());
-  auto& transceiver_state = transceiver_states[0];
-  EXPECT_TRUE(transceiver_state.sender_state());
-  EXPECT_TRUE(transceiver_state.sender_state()->is_initialized());
-  EXPECT_FALSE(transceiver_state.receiver_state());
-  // Expect transceiver members be be missing for optional members and have
-  // sensible values for non-optional members.
-  EXPECT_FALSE(transceiver_state.mid());
-  EXPECT_FALSE(transceiver_state.stopped());
-  EXPECT_EQ(transceiver_state.direction(),
-            webrtc::RtpTransceiverDirection::kSendOnly);
-  EXPECT_FALSE(transceiver_state.current_direction());
-}
-
-TEST_F(TransceiverStateSurfacerTest, SurfaceReceiverStateOnly) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto webrtc_receiver = CreateWebRtcReceiver("remote_track", "remote_stream");
-  auto waitable_event = AsyncInitializeSurfacerWithWaitableEvent(
-      {new SurfaceReceiverStateOnly(webrtc_receiver)});
-  waitable_event->Wait();
-  auto transceiver_states = surfacer_->ObtainStates();
-  EXPECT_EQ(1u, transceiver_states.size());
-  auto& transceiver_state = transceiver_states[0];
-  EXPECT_FALSE(transceiver_state.sender_state());
-  EXPECT_TRUE(transceiver_state.receiver_state());
-  EXPECT_TRUE(transceiver_state.receiver_state()->is_initialized());
-  // Expect transceiver members be be missing for optional members and have
-  // sensible values for non-optional members.
-  EXPECT_FALSE(transceiver_state.mid());
-  EXPECT_FALSE(transceiver_state.stopped());
-  EXPECT_EQ(transceiver_state.direction(),
-            webrtc::RtpTransceiverDirection::kRecvOnly);
-  EXPECT_FALSE(transceiver_state.current_direction());
-}
-
-TEST_F(TransceiverStateSurfacerTest, SurfaceTransceiverWithSctpTransport) {
-  auto local_track_adapter = CreateLocalTrackAndAdapter("local_track");
-  auto webrtc_transceiver = CreateWebRtcTransceiver(
-      local_track_adapter->webrtc_track(), "local_stream", "remote_track",
-      "remote_stream", nullptr);
-  rtc::scoped_refptr<MockSctpTransport> mock_sctp_transport =
-      new rtc::RefCountedObject<MockSctpTransport>();
-  webrtc::SctpTransportInformation sctp_transport_info(
-      webrtc::SctpTransportState::kNew);
-  EXPECT_CALL(*(static_cast<MockPeerConnectionImpl*>(peer_connection_.get())),
-              GetSctpTransport())
-      .WillRepeatedly(Return(mock_sctp_transport));
-  EXPECT_CALL(*mock_sctp_transport.get(), Information())
-      .WillRepeatedly(Return(sctp_transport_info));
-  EXPECT_CALL(*mock_sctp_transport.get(), dtls_transport()).Times(AnyNumber());
-  auto waitable_event =
-      AsyncInitializeSurfacerWithWaitableEvent({webrtc_transceiver});
-  waitable_event->Wait();
-  EXPECT_TRUE(surfacer_->SctpTransportSnapshot().transport);
-  ObtainStatesAndExpectInitialized(webrtc_transceiver);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler.cc b/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler.cc
deleted file mode 100644
index 283a74407e2..00000000000
--- a/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler.cc
+++ /dev/null
@@ -1,196 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/transmission_encoding_info_handler.h"
-
-#include <utility>
-#include <vector>
-
-#include "base/bind.h"
-#include "base/cpu.h"
-#include "base/logging.h"
-#include "base/numerics/safe_conversions.h"
-#include "base/stl_util.h"
-#include "base/strings/string_util.h"
-#include "base/strings/stringprintf.h"
-#include "base/system/sys_info.h"
-#include "content/renderer/media/gpu/gpu_video_accelerator_factories_impl.h"
-#include "content/renderer/media/webrtc/video_codec_factory.h"
-#include "content/renderer/render_thread_impl.h"
-#include "third_party/blink/public/platform/modules/media_capabilities/web_media_configuration.h"
-#include "third_party/blink/public/platform/modules/media_capabilities/web_video_configuration.h"
-#include "third_party/blink/public/platform/modules/peerconnection/audio_codec_factory.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/webrtc/api/audio_codecs/audio_encoder_factory.h"
-#include "third_party/webrtc/api/audio_codecs/audio_format.h"
-#include "third_party/webrtc/api/scoped_refptr.h"
-#include "third_party/webrtc/api/video_codecs/sdp_video_format.h"
-#include "third_party/webrtc/api/video_codecs/video_encoder_factory.h"
-
-namespace content {
-
-namespace {
-
-// Composes elements of set<string> to a string with ", " delimiter.
-std::string StringFlatSetToString(
-    const base::flat_set<std::string>& string_set) {
-  std::string result;
-  std::string delim;
-  for (auto& s : string_set) {
-    result += delim + s;
-    if (delim.empty())
-      delim = ", ";
-  }
-  return result;
-}
-
-// Composes human readable string for |info|.
-std::string ToString(const blink::WebMediaCapabilitiesInfo& info) {
-  return base::StringPrintf("(supported:%s, smooth:%s, power_efficient:%s)",
-                            info.supported ? "true" : "false",
-                            info.smooth ? "true" : "false",
-                            info.power_efficient ? "true" : "false");
-}
-
-// Gets GpuVideoAcceleratorFactories instance pointer.
-// Returns nullptr if RenderThreadImpl instance is not available.
-media::GpuVideoAcceleratorFactories* GetGpuFactories() {
-  auto* const render_thread_impl = content::RenderThreadImpl::current();
-  if (render_thread_impl)
-    return render_thread_impl->GetGpuFactories();
-  return nullptr;
-}
-
-// Returns true if CPU can encode HD video smoothly.
-// The logic is borrowed from Google Meet (crbug.com/941352).
-bool CanCpuEncodeHdSmoothly() {
-  const int num_processors = base::SysInfo::NumberOfProcessors();
-  if (num_processors >= 4)
-    return true;
-  if (num_processors < 2)
-    return false;
-  return base::CPU().has_sse41();
-}
-
-const unsigned int kHdVideoAreaSize = 1280 * 720;
-
-}  // namespace
-
-// If GetGpuFactories() returns null, CreateWebrtcVideoEncoderFactory()
-// returns software encoder factory only.
-TransmissionEncodingInfoHandler::TransmissionEncodingInfoHandler()
-    : TransmissionEncodingInfoHandler(
-          CreateWebrtcVideoEncoderFactory(GetGpuFactories()),
-          CanCpuEncodeHdSmoothly()) {}
-
-TransmissionEncodingInfoHandler::TransmissionEncodingInfoHandler(
-    std::unique_ptr<webrtc::VideoEncoderFactory> video_encoder_factory,
-    bool cpu_hd_smooth)
-    : cpu_hd_smooth_(cpu_hd_smooth) {
-  std::vector<webrtc::SdpVideoFormat> supported_video_formats =
-      video_encoder_factory->GetSupportedFormats();
-  for (const auto& video_format : supported_video_formats) {
-    const std::string codec_name = base::ToLowerASCII(video_format.name);
-    supported_video_codecs_.emplace(codec_name);
-    const auto codec_info =
-        video_encoder_factory->QueryVideoEncoder(video_format);
-    if (codec_info.is_hardware_accelerated)
-      hardware_accelerated_video_codecs_.emplace(codec_name);
-  }
-
-  rtc::scoped_refptr<webrtc::AudioEncoderFactory> audio_encoder_factory =
-      blink::CreateWebrtcAudioEncoderFactory();
-  std::vector<webrtc::AudioCodecSpec> supported_audio_specs =
-      audio_encoder_factory->GetSupportedEncoders();
-  for (const auto& audio_spec : supported_audio_specs)
-    supported_audio_codecs_.emplace(base::ToLowerASCII(audio_spec.format.name));
-  DVLOG(2) << base::StringPrintf(
-      "supported_video_codecs_:[%s] hardware_accelerated_video_codecs_:[%s] "
-      "supported_audio_codecs_:[%s]",
-      StringFlatSetToString(supported_video_codecs_).c_str(),
-      StringFlatSetToString(hardware_accelerated_video_codecs_).c_str(),
-      StringFlatSetToString(supported_audio_codecs_).c_str());
-}
-
-TransmissionEncodingInfoHandler::~TransmissionEncodingInfoHandler() = default;
-
-std::string TransmissionEncodingInfoHandler::ExtractSupportedCodecFromMimeType(
-    const std::string& mime_type) const {
-  const char* video_prefix = "video/";
-  const char* audio_prefix = "audio/";
-  if (base::StartsWith(mime_type, video_prefix, base::CompareCase::SENSITIVE)) {
-    // Currently support "video/vp8" only.
-    // TODO(crbug.com/941320): support "video/vp9" and "video/h264" once their
-    // MIME type parser are implemented.
-    const std::string codec_name = mime_type.substr(strlen(video_prefix));
-    if (codec_name == "vp8")
-      return codec_name;
-  } else if (base::StartsWith(mime_type, audio_prefix,
-                              base::CompareCase::SENSITIVE)) {
-    const std::string codec_name = mime_type.substr(strlen(audio_prefix));
-    if (base::Contains(supported_audio_codecs_, codec_name))
-      return codec_name;
-  }
-  return "";
-}
-
-bool TransmissionEncodingInfoHandler::CanCpuEncodeSmoothly(
-    const blink::WebVideoConfiguration& configuration) const {
-  if (configuration.width * configuration.height < kHdVideoAreaSize)
-    return true;
-  return cpu_hd_smooth_;
-}
-
-void TransmissionEncodingInfoHandler::EncodingInfo(
-    const blink::WebMediaConfiguration& configuration,
-    OnMediaCapabilitiesEncodingInfoCallback callback) const {
-  DCHECK(configuration.video_configuration ||
-         configuration.audio_configuration);
-
-  auto info = std::make_unique<blink::WebMediaCapabilitiesInfo>();
-  if (!configuration.video_configuration &&
-      !configuration.audio_configuration) {
-    DVLOG(2) << "Neither video nor audio configuration specified.";
-    std::move(callback).Run(std::move(info));
-    return;
-  }
-
-  // Either video or audio capabilities will be AND-ed so set |info|'s default
-  // value to true.
-  info->supported = info->smooth = info->power_efficient = true;
-  if (configuration.video_configuration) {
-    const auto& video_config = configuration.video_configuration.value();
-    const std::string mime_type =
-        base::ToLowerASCII(video_config.mime_type.Utf8());
-    const std::string codec_name = ExtractSupportedCodecFromMimeType(mime_type);
-    info->supported = !codec_name.empty();
-    if (info->supported) {
-      const bool is_hardware_accelerated =
-          base::Contains(hardware_accelerated_video_codecs_, codec_name);
-      info->smooth =
-          is_hardware_accelerated || CanCpuEncodeSmoothly(video_config);
-      info->power_efficient = is_hardware_accelerated;
-    } else {
-      info->smooth = false;
-      info->power_efficient = false;
-    }
-    DVLOG(2) << "Video MIME type:" << mime_type
-             << " capabilities:" << ToString(*info);
-  }
-  if (configuration.audio_configuration) {
-    const std::string mime_type =
-        base::ToLowerASCII(configuration.audio_configuration->mime_type.Utf8());
-    const std::string codec_name = ExtractSupportedCodecFromMimeType(mime_type);
-    info->supported &= !codec_name.empty();
-    // Audio is always assumed to be smooth and efficient whenever it is
-    // supported.
-    info->smooth &= info->supported;
-    info->power_efficient &= info->supported;
-    DVLOG(2) << "Audio MIME type:" << mime_type
-             << " capabilities:" << ToString(*info);
-  }
-  std::move(callback).Run(std::move(info));
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler.h b/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler.h
deleted file mode 100644
index b5aca6aa26b..00000000000
--- a/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler.h
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_TRANSMISSION_ENCODING_INFO_HANDLER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_TRANSMISSION_ENCODING_INFO_HANDLER_H_
-
-#include <memory>
-#include <string>
-
-#include "base/containers/flat_set.h"
-#include "base/macros.h"
-#include "content/common/content_export.h"
-#include "third_party/blink/public/platform/web_transmission_encoding_info_handler.h"
-
-namespace blink {
-struct WebVideoConfiguration;
-}  // namespace blink
-
-namespace webrtc {
-class VideoEncoderFactory;
-}  // namespace webrtc
-
-namespace content {
-
-// blink::WebTransmissionEncodingInfoHandler implementation.
-class CONTENT_EXPORT TransmissionEncodingInfoHandler final
-    : public blink::WebTransmissionEncodingInfoHandler {
- public:
-  TransmissionEncodingInfoHandler();
-  // Constructor for unittest to inject VideoEncodeFactory instance and
-  // |cpu_hd_smooth|.
-  explicit TransmissionEncodingInfoHandler(
-      std::unique_ptr<webrtc::VideoEncoderFactory> video_encoder_factory,
-      bool cpu_hd_smooth);
-  ~TransmissionEncodingInfoHandler() override;
-
-  // blink::WebTransmissionEncodingInfoHandler implementation.
-  void EncodingInfo(const blink::WebMediaConfiguration& configuration,
-                    OnMediaCapabilitiesEncodingInfoCallback cb) const override;
-
- private:
-  // Extracts supported video/audio codec name from |mime_type|. Returns "" if
-  // it is not supported.
-  std::string ExtractSupportedCodecFromMimeType(
-      const std::string& mime_type) const;
-
-  // True if it can encode |configuration| smoothly via CPU.
-  bool CanCpuEncodeSmoothly(
-      const blink::WebVideoConfiguration& configuration) const;
-
-  // List of supported video codecs.
-  base::flat_set<std::string> supported_video_codecs_;
-  // List of hardware accelerated codecs.
-  base::flat_set<std::string> hardware_accelerated_video_codecs_;
-  // List of supported audio codecs.
-  base::flat_set<std::string> supported_audio_codecs_;
-
-  // True if CPU is capable to encode 720p video smoothly.
-  bool cpu_hd_smooth_;
-
-  DISALLOW_COPY_AND_ASSIGN(TransmissionEncodingInfoHandler);
-};
-
-}  // namespace content
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_TRANSMISSION_ENCODING_INFO_HANDLER_H_
diff --git a/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler_unittest.cc b/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler_unittest.cc
deleted file mode 100644
index 813130c1da8..00000000000
--- a/chromium/content/renderer/media/webrtc/transmission_encoding_info_handler_unittest.cc
+++ /dev/null
@@ -1,323 +0,0 @@
-// Copyright 2019 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/transmission_encoding_info_handler.h"
-
-#include <utility>
-#include <vector>
-
-#include "base/bind.h"
-#include "media/base/video_codecs.h"
-#include "media/video/video_encode_accelerator.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/media_capabilities/web_audio_configuration.h"
-#include "third_party/blink/public/platform/modules/media_capabilities/web_media_configuration.h"
-#include "third_party/blink/public/platform/modules/media_capabilities/web_video_configuration.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/webrtc/api/video_codecs/sdp_video_format.h"
-#include "third_party/webrtc/api/video_codecs/video_encoder.h"
-#include "third_party/webrtc/api/video_codecs/video_encoder_factory.h"
-#include "ui/gfx/geometry/size.h"
-
-namespace content {
-
-namespace {
-
-class FakeVideoEncoderFactory : public webrtc::VideoEncoderFactory {
- public:
-  FakeVideoEncoderFactory() = default;
-  ~FakeVideoEncoderFactory() override = default;
-
-  void AddSupportedFormat(const webrtc::SdpVideoFormat& video_format,
-                          bool is_hardware_accelerated = false,
-                          bool has_internal_source = false) {
-    supported_video_formats_.push_back(video_format);
-    codec_info_.push_back({.is_hardware_accelerated = is_hardware_accelerated,
-                           .has_internal_source = has_internal_source});
-  }
-
-  std::vector<webrtc::SdpVideoFormat> GetSupportedFormats() const override {
-    return supported_video_formats_;
-  }
-
-  CodecInfo QueryVideoEncoder(
-      const webrtc::SdpVideoFormat& format) const override {
-    DCHECK_EQ(supported_video_formats_.size(), codec_info_.size());
-    for (size_t i = 0; i < supported_video_formats_.size(); ++i) {
-      if (supported_video_formats_[i] == format)
-        return codec_info_[i];
-    }
-    NOTREACHED() << "QueryVideoEncoder() assumes |format| is supported.";
-    return CodecInfo();
-  }
-
-  std::unique_ptr<webrtc::VideoEncoder> CreateVideoEncoder(
-      const webrtc::SdpVideoFormat& format) override {
-    return std::unique_ptr<webrtc::VideoEncoder>();
-  }
-
- private:
-  std::vector<webrtc::SdpVideoFormat> supported_video_formats_;
-  std::vector<CodecInfo> codec_info_;
-};
-
-}  // namespace
-
-// Stores WebMediaCapabilitiesEncodingInfoCallbacks' result for verify.
-class EncodingInfoObserver {
- public:
-  EncodingInfoObserver() = default;
-  ~EncodingInfoObserver() = default;
-
-  void OnSuccess(std::unique_ptr<blink::WebMediaCapabilitiesInfo> info) {
-    info_.swap(info);
-    is_success_ = true;
-  }
-  void OnError() { is_error_ = true; }
-
-  const blink::WebMediaCapabilitiesInfo* info() const { return info_.get(); }
-  bool IsCalled() const { return is_success_ || is_error_; }
-  bool is_success() const { return is_success_; }
-  bool is_error() const { return is_error_; }
-
- private:
-  std::unique_ptr<blink::WebMediaCapabilitiesInfo> info_;
-  bool is_success_;
-  bool is_error_;
-};
-
-// It places callback's result to EncodingInfoObserver for testing code
-// to verify. Because blink::WebMediaCapabilitiesEncodingInfoCallbacks instance
-// is handed to TransmissionEncodingInfoHandler, we cannot directly inspect
-// OnSuccess() received argument. So it moves OnSuccess()'s received argument,
-// WebMediaCapabilitiesInfo instance, to EncodingInfoObserver instance for
-// inspection.
-class WebMediaCapabilitiesEncodingInfoCallbacksForTest {
- public:
-  WebMediaCapabilitiesEncodingInfoCallbacksForTest(
-      EncodingInfoObserver* observer)
-      : observer_(observer) {
-    DCHECK(observer_);
-  }
-  virtual ~WebMediaCapabilitiesEncodingInfoCallbacksForTest() = default;
-
-  void OnSuccess(std::unique_ptr<blink::WebMediaCapabilitiesInfo> info) {
-    observer_->OnSuccess(std::move(info));
-  }
-
-  void OnError() { observer_->OnError(); }
-
- private:
-  EncodingInfoObserver* observer_;
-};
-
-class TransmissionEncodingInfoHandlerTest : public testing::Test {
- protected:
-  blink::WebVideoConfiguration ComposeVideoConfiguration(
-      const std::string& mime_type,
-      const std::string& codec,
-      unsigned int width = 1920,
-      unsigned int height = 1080,
-      double framerate = 30.0) {
-    constexpr int kBitrate = 2661034;
-    return blink::WebVideoConfiguration{blink::WebString::FromASCII(mime_type),
-                                        blink::WebString::FromASCII(codec),
-                                        width,
-                                        height,
-                                        kBitrate,
-                                        framerate};
-  }
-
-  blink::WebAudioConfiguration ComposeAudioConfiguration(
-      const std::string& mime_type,
-      const std::string& codec) {
-    return blink::WebAudioConfiguration{blink::WebString::FromASCII(mime_type),
-                                        blink::WebString::FromASCII(codec),
-                                        blink::WebString(), base::nullopt,
-                                        base::nullopt};
-  }
-
-  blink::WebMediaConfiguration ComposeWebMediaConfigurationForVideo(
-      const std::string& mime_type,
-      const std::string& codec) {
-    return blink::WebMediaConfiguration(
-        blink::MediaConfigurationType::kTransmission, base::nullopt,
-        ComposeVideoConfiguration(mime_type, codec));
-  }
-
-  blink::WebMediaConfiguration ComposeWebMediaConfigurationForAudio(
-      const std::string& mime_type,
-      const std::string& codec) {
-    return blink::WebMediaConfiguration(
-        blink::MediaConfigurationType::kTransmission,
-        ComposeAudioConfiguration(mime_type, codec), base::nullopt);
-  }
-
-  void VerifyEncodingInfo(const TransmissionEncodingInfoHandler& handler,
-                          const blink::WebMediaConfiguration& configuration,
-                          bool expect_supported,
-                          bool expect_smooth,
-                          bool expect_power_efficient) {
-    EncodingInfoObserver observer;
-    auto callbacks =
-        std::make_unique<WebMediaCapabilitiesEncodingInfoCallbacksForTest>(
-            &observer);
-    handler.EncodingInfo(
-        configuration,
-        base::BindOnce(
-            &WebMediaCapabilitiesEncodingInfoCallbacksForTest::OnSuccess,
-            base::Unretained(callbacks.get())));
-
-    EXPECT_TRUE(observer.IsCalled());
-    EXPECT_TRUE(observer.is_success());
-    const blink::WebMediaCapabilitiesInfo* encoding_info = observer.info();
-    ASSERT_TRUE(encoding_info);
-    EXPECT_EQ(expect_supported, encoding_info->supported);
-    EXPECT_EQ(expect_smooth, encoding_info->smooth);
-    EXPECT_EQ(expect_power_efficient, encoding_info->power_efficient);
-  }
-};
-
-TEST_F(TransmissionEncodingInfoHandlerTest, SupportedVideoCodec) {
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            false);
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          false);
-  VerifyEncodingInfo(handler,
-                     ComposeWebMediaConfigurationForVideo("video/vp8", ""),
-                     true, false, false);
-  // Temporarily unsupported: "video/vp9" and "video/h264".
-  // TODO(crbug.com/941320): "video/vp9" and "video/h264" should be supported
-  // once their MIME type parser are implemented.
-  VerifyEncodingInfo(handler,
-                     ComposeWebMediaConfigurationForVideo("video/vp9", ""),
-                     false, false, false);
-  VerifyEncodingInfo(handler,
-                     ComposeWebMediaConfigurationForVideo("video/h264", ""),
-                     false, false, false);
-  // "video/webm" is not a "transmission" MIME type.
-  VerifyEncodingInfo(handler,
-                     ComposeWebMediaConfigurationForVideo("video/webm", "vp8"),
-                     false, false, false);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, SupportedAudioCodec) {
-  TransmissionEncodingInfoHandler handler;
-  for (const char* mime_type :
-       {"audio/g722", "audio/isac", "audio/opus", "audio/pcma", "audio/pcmu"}) {
-    // For audio codec, if it is supported, it is smooth.
-    VerifyEncodingInfo(handler,
-                       ComposeWebMediaConfigurationForAudio(mime_type, ""),
-                       true, true, true);
-  }
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, HardwareAcceleratedVideoCodec) {
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            true);
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          false);
-  VerifyEncodingInfo(handler,
-                     ComposeWebMediaConfigurationForVideo("video/vp8", ""),
-                     true, true, true);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, SmoothVideoCodecPowerfulCpu) {
-  // Assume no HW vp8 encoder.
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            false);
-  // Assume powerful CPU.
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          true);
-  VerifyEncodingInfo(handler,
-                     ComposeWebMediaConfigurationForVideo("video/vp8", ""),
-                     true, true, false);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, SmoothVideoCodecVgaResolution) {
-  // Assume no HW vp8 encoder.
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            false);
-  // Assume no powerful CPU.
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          false);
-
-  // VP8 encoding for 640x480 video.
-  blink::WebMediaConfiguration config(
-      blink::MediaConfigurationType::kTransmission, base::nullopt,
-      ComposeVideoConfiguration("video/vp8", "", 640, 480));
-
-  VerifyEncodingInfo(handler, config, true, true, false);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, SmoothVideoCodecBelowHdResolution) {
-  // Assume no HW vp8 encoder.
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            false);
-  // Assume no powerful CPU.
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          false);
-
-  // VP8 encoding for 1024x768 video. Note its area size is below 1280x720).
-  blink::WebMediaConfiguration config(
-      blink::MediaConfigurationType::kTransmission, base::nullopt,
-      ComposeVideoConfiguration("video/vp8", "", 1024, 768));
-
-  VerifyEncodingInfo(handler, config, true, true, false);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, AudioAndVideoCodec) {
-  // Both video/vp8 and audio/opus are given.
-  blink::WebMediaConfiguration config(
-      blink::MediaConfigurationType::kTransmission,
-      ComposeAudioConfiguration("audio/opus", ""),
-      ComposeVideoConfiguration("video/vp8", ""));
-
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            false);
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          false);
-  VerifyEncodingInfo(handler, config, true, false, false);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest,
-       AudioAndVideoCodecWithVideoHardwareEncoder) {
-  // Both video/vp8 and audio/opus are given.
-  blink::WebMediaConfiguration config(
-      blink::MediaConfigurationType::kTransmission,
-      ComposeAudioConfiguration("audio/opus", ""),
-      ComposeVideoConfiguration("video/vp8", ""));
-
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            true);
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          false);
-  VerifyEncodingInfo(handler, config, true, true, true);
-}
-
-TEST_F(TransmissionEncodingInfoHandlerTest, AudioAndVideoCodecWithPowerfulCpu) {
-  // Both video/vp8 and audio/opus are given.
-  blink::WebMediaConfiguration config(
-      blink::MediaConfigurationType::kTransmission,
-      ComposeAudioConfiguration("audio/opus", ""),
-      ComposeVideoConfiguration("video/vp8", ""));
-
-  // Assume no HW vp8 encoder.
-  auto video_encoder_factory = std::make_unique<FakeVideoEncoderFactory>();
-  video_encoder_factory->AddSupportedFormat(webrtc::SdpVideoFormat("vp8"),
-                                            false);
-  // Assume powerful CPU.
-  TransmissionEncodingInfoHandler handler(std::move(video_encoder_factory),
-                                          true);
-  VerifyEncodingInfo(handler, config, true, true, false);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/video_codec_factory.cc b/chromium/content/renderer/media/webrtc/video_codec_factory.cc
deleted file mode 100644
index 22ceef1e9a3..00000000000
--- a/chromium/content/renderer/media/webrtc/video_codec_factory.cc
+++ /dev/null
@@ -1,208 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/video_codec_factory.h"
-
-#include "base/base_switches.h"
-#include "base/command_line.h"
-#include "base/memory/ptr_util.h"
-#include "build/build_config.h"
-#include "content/public/common/content_switches.h"
-#include "media/base/media_switches.h"
-#include "third_party/blink/public/platform/modules/peerconnection/rtc_video_decoder_factory_util.h"
-#include "third_party/blink/public/platform/modules/peerconnection/rtc_video_encoder_factory_util.h"
-#include "third_party/webrtc/api/video_codecs/video_decoder_software_fallback_wrapper.h"
-#include "third_party/webrtc/api/video_codecs/video_encoder_software_fallback_wrapper.h"
-#include "third_party/webrtc/media/base/codec.h"
-#include "third_party/webrtc/media/engine/encoder_simulcast_proxy.h"
-#include "third_party/webrtc/media/engine/internal_decoder_factory.h"
-#include "third_party/webrtc/media/engine/internal_encoder_factory.h"
-#include "third_party/webrtc/media/engine/simulcast_encoder_adapter.h"
-
-#if defined(OS_ANDROID)
-#include "media/base/android/media_codec_util.h"
-#endif
-
-namespace content {
-
-namespace {
-
-bool IsFormatSupported(
-    const std::vector<webrtc::SdpVideoFormat>& supported_formats,
-    const webrtc::SdpVideoFormat& format) {
-  for (const webrtc::SdpVideoFormat& supported_format : supported_formats) {
-    if (cricket::IsSameCodec(format.name, format.parameters,
-                             supported_format.name,
-                             supported_format.parameters)) {
-      return true;
-    }
-  }
-  return false;
-}
-
-template <typename Factory>
-bool IsFormatSupported(const Factory* factory,
-                       const webrtc::SdpVideoFormat& format) {
-  return factory && IsFormatSupported(factory->GetSupportedFormats(), format);
-}
-
-// Merge |formats1| and |formats2|, but avoid adding duplicate formats.
-std::vector<webrtc::SdpVideoFormat> MergeFormats(
-    std::vector<webrtc::SdpVideoFormat> formats1,
-    const std::vector<webrtc::SdpVideoFormat>& formats2) {
-  for (const webrtc::SdpVideoFormat& format : formats2) {
-    // Don't add same format twice.
-    if (!IsFormatSupported(formats1, format))
-      formats1.push_back(format);
-  }
-  return formats1;
-}
-
-std::unique_ptr<webrtc::VideoDecoder> CreateDecoder(
-    webrtc::VideoDecoderFactory* factory,
-    const webrtc::SdpVideoFormat& format) {
-  return factory ? factory->CreateVideoDecoder(format) : nullptr;
-}
-
-std::unique_ptr<webrtc::VideoDecoder> Wrap(
-    std::unique_ptr<webrtc::VideoDecoder> software_decoder,
-    std::unique_ptr<webrtc::VideoDecoder> hardware_decoder) {
-  if (software_decoder && hardware_decoder) {
-    return webrtc::CreateVideoDecoderSoftwareFallbackWrapper(
-        std::move(software_decoder), std::move(hardware_decoder));
-  }
-  return hardware_decoder ? std::move(hardware_decoder)
-                          : std::move(software_decoder);
-}
-
-std::unique_ptr<webrtc::VideoEncoder> Wrap(
-    std::unique_ptr<webrtc::VideoEncoder> software_encoder,
-    std::unique_ptr<webrtc::VideoEncoder> hardware_encoder) {
-  if (software_encoder && hardware_encoder) {
-    return webrtc::CreateVideoEncoderSoftwareFallbackWrapper(
-        std::move(software_encoder), std::move(hardware_encoder));
-  }
-  return hardware_encoder ? std::move(hardware_encoder)
-                          : std::move(software_encoder);
-}
-
-// This class combines a hardware factory with the internal factory and adds
-// internal SW codecs, simulcast, and SW fallback wrappers.
-class EncoderAdapter : public webrtc::VideoEncoderFactory {
- public:
-  explicit EncoderAdapter(
-      std::unique_ptr<webrtc::VideoEncoderFactory> hardware_encoder_factory)
-      : hardware_encoder_factory_(std::move(hardware_encoder_factory)) {}
-
-  webrtc::VideoEncoderFactory::CodecInfo QueryVideoEncoder(
-      const webrtc::SdpVideoFormat& format) const override {
-    const webrtc::VideoEncoderFactory* factory =
-        IsFormatSupported(hardware_encoder_factory_.get(), format)
-            ? hardware_encoder_factory_.get()
-            : &software_encoder_factory_;
-    return factory->QueryVideoEncoder(format);
-  }
-
-  std::unique_ptr<webrtc::VideoEncoder> CreateVideoEncoder(
-      const webrtc::SdpVideoFormat& format) override {
-    std::unique_ptr<webrtc::VideoEncoder> software_encoder;
-    if (IsFormatSupported(&software_encoder_factory_, format)) {
-      software_encoder = std::make_unique<webrtc::EncoderSimulcastProxy>(
-          &software_encoder_factory_, format);
-    }
-
-    std::unique_ptr<webrtc::VideoEncoder> hardware_encoder;
-    if (IsFormatSupported(hardware_encoder_factory_.get(), format)) {
-      hardware_encoder =
-          base::EqualsCaseInsensitiveASCII(format.name.c_str(),
-                                           cricket::kVp8CodecName)
-              ? std::make_unique<webrtc::SimulcastEncoderAdapter>(
-                    hardware_encoder_factory_.get(), format)
-              : hardware_encoder_factory_->CreateVideoEncoder(format);
-    }
-
-    return Wrap(std::move(software_encoder), std::move(hardware_encoder));
-  }
-
-  std::vector<webrtc::SdpVideoFormat> GetSupportedFormats() const override {
-    std::vector<webrtc::SdpVideoFormat> software_formats =
-        software_encoder_factory_.GetSupportedFormats();
-    return hardware_encoder_factory_
-               ? MergeFormats(software_formats,
-                              hardware_encoder_factory_->GetSupportedFormats())
-               : software_formats;
-  }
-
- private:
-  webrtc::InternalEncoderFactory software_encoder_factory_;
-  const std::unique_ptr<webrtc::VideoEncoderFactory> hardware_encoder_factory_;
-};
-
-// This class combines a hardware codec factory with the internal factory and
-// adds internal SW codecs and SW fallback wrappers.
-class DecoderAdapter : public webrtc::VideoDecoderFactory {
- public:
-  explicit DecoderAdapter(
-      std::unique_ptr<webrtc::VideoDecoderFactory> hardware_decoder_factory)
-      : hardware_decoder_factory_(std::move(hardware_decoder_factory)) {}
-
-  std::unique_ptr<webrtc::VideoDecoder> CreateVideoDecoder(
-      const webrtc::SdpVideoFormat& format) override {
-    std::unique_ptr<webrtc::VideoDecoder> software_decoder =
-        CreateDecoder(&software_decoder_factory_, format);
-
-    std::unique_ptr<webrtc::VideoDecoder> hardware_decoder =
-        CreateDecoder(hardware_decoder_factory_.get(), format);
-
-    return Wrap(std::move(software_decoder), std::move(hardware_decoder));
-  }
-
-  std::vector<webrtc::SdpVideoFormat> GetSupportedFormats() const override {
-    std::vector<webrtc::SdpVideoFormat> software_formats =
-        software_decoder_factory_.GetSupportedFormats();
-    return hardware_decoder_factory_
-               ? MergeFormats(software_formats,
-                              hardware_decoder_factory_->GetSupportedFormats())
-               : software_formats;
-  }
-
- private:
-  webrtc::InternalDecoderFactory software_decoder_factory_;
-  const std::unique_ptr<webrtc::VideoDecoderFactory> hardware_decoder_factory_;
-};
-
-}  // namespace
-
-std::unique_ptr<webrtc::VideoEncoderFactory> CreateWebrtcVideoEncoderFactory(
-    media::GpuVideoAcceleratorFactories* gpu_factories) {
-  std::unique_ptr<webrtc::VideoEncoderFactory> encoder_factory;
-
-  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
-  if (gpu_factories && gpu_factories->IsGpuVideoAcceleratorEnabled() &&
-      !cmd_line->HasSwitch(switches::kDisableWebRtcHWEncoding)) {
-    encoder_factory = blink::CreateRTCVideoEncoderFactory(gpu_factories);
-  }
-
-#if defined(OS_ANDROID)
-  if (!media::MediaCodecUtil::SupportsSetParameters())
-    encoder_factory.reset();
-#endif
-
-  return std::make_unique<EncoderAdapter>(std::move(encoder_factory));
-}
-
-std::unique_ptr<webrtc::VideoDecoderFactory> CreateWebrtcVideoDecoderFactory(
-    media::GpuVideoAcceleratorFactories* gpu_factories) {
-  std::unique_ptr<webrtc::VideoDecoderFactory> decoder_factory;
-
-  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
-  if (gpu_factories && gpu_factories->IsGpuVideoAcceleratorEnabled() &&
-      !cmd_line->HasSwitch(switches::kDisableWebRtcHWDecoding)) {
-    decoder_factory = blink::CreateRTCVideoDecoderFactory(gpu_factories);
-  }
-
-  return std::make_unique<DecoderAdapter>(std::move(decoder_factory));
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/video_codec_factory.h b/chromium/content/renderer/media/webrtc/video_codec_factory.h
deleted file mode 100644
index 07904c1c834..00000000000
--- a/chromium/content/renderer/media/webrtc/video_codec_factory.h
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_VIDEO_CODEC_FACTORY_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_VIDEO_CODEC_FACTORY_H_
-
-#include "media/video/gpu_video_accelerator_factories.h"
-#include "third_party/webrtc/api/video_codecs/video_decoder_factory.h"
-#include "third_party/webrtc/api/video_codecs/video_encoder_factory.h"
-
-namespace content {
-
-std::unique_ptr<webrtc::VideoEncoderFactory> CreateWebrtcVideoEncoderFactory(
-    media::GpuVideoAcceleratorFactories* gpu_factories);
-std::unique_ptr<webrtc::VideoDecoderFactory> CreateWebrtcVideoDecoderFactory(
-    media::GpuVideoAcceleratorFactories* gpu_factories);
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_VIDEO_CODEC_FACTORY_H_
diff --git a/chromium/content/renderer/media/webrtc/webrtc_audio_renderer_unittest.cc b/chromium/content/renderer/media/webrtc/webrtc_audio_renderer_unittest.cc
index 76aebf0cbd6..16d3fe4a4d7 100644
--- a/chromium/content/renderer/media/webrtc/webrtc_audio_renderer_unittest.cc
+++ b/chromium/content/renderer/media/webrtc/webrtc_audio_renderer_unittest.cc
@@ -184,8 +184,8 @@ class WebRtcAudioRendererTest : public testing::Test,
       audio_device_factory_platform_;
   const base::Optional<base::UnguessableToken> kAudioProcessingId =
       base::UnguessableToken::Create();
-  base::test::TaskEnvironment task_environment_{
-      base::test::TaskEnvironment::MainThreadType::IO};
+  base::test::SingleThreadTaskEnvironment task_environment_{
+      base::test::SingleThreadTaskEnvironment::MainThreadType::IO};
   scoped_refptr<media::MockAudioRendererSink> mock_sink_;
   std::unique_ptr<MockAudioRendererSource> source_;
   blink::WebMediaStream stream_;
diff --git a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter.cc b/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter.cc
deleted file mode 100644
index 70c2325e16e..00000000000
--- a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter.cc
+++ /dev/null
@@ -1,338 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h"
-
-#include "base/bind.h"
-#include "content/renderer/media/webrtc/media_stream_video_webrtc_sink.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_track.h"
-#include "third_party/blink/public/web/modules/mediastream/processed_local_audio_source.h"
-
-namespace content {
-
-// static
-scoped_refptr<WebRtcMediaStreamTrackAdapter>
-WebRtcMediaStreamTrackAdapter::CreateLocalTrackAdapter(
-    PeerConnectionDependencyFactory* factory,
-    const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
-    const blink::WebMediaStreamTrack& web_track) {
-  DCHECK(factory);
-  DCHECK(main_thread->BelongsToCurrentThread());
-  DCHECK(!web_track.IsNull());
-  scoped_refptr<WebRtcMediaStreamTrackAdapter> local_track_adapter(
-      new WebRtcMediaStreamTrackAdapter(factory, main_thread));
-  if (web_track.Source().GetType() == blink::WebMediaStreamSource::kTypeAudio) {
-    local_track_adapter->InitializeLocalAudioTrack(web_track);
-  } else {
-    DCHECK_EQ(web_track.Source().GetType(),
-              blink::WebMediaStreamSource::kTypeVideo);
-    local_track_adapter->InitializeLocalVideoTrack(web_track);
-  }
-  return local_track_adapter;
-}
-
-// static
-scoped_refptr<WebRtcMediaStreamTrackAdapter>
-WebRtcMediaStreamTrackAdapter::CreateRemoteTrackAdapter(
-    PeerConnectionDependencyFactory* factory,
-    const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
-    const scoped_refptr<webrtc::MediaStreamTrackInterface>& webrtc_track) {
-  DCHECK(factory);
-  DCHECK(!main_thread->BelongsToCurrentThread());
-  DCHECK(webrtc_track);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter> remote_track_adapter(
-      new WebRtcMediaStreamTrackAdapter(factory, main_thread));
-  if (webrtc_track->kind() == webrtc::MediaStreamTrackInterface::kAudioKind) {
-    remote_track_adapter->InitializeRemoteAudioTrack(base::WrapRefCounted(
-        static_cast<webrtc::AudioTrackInterface*>(webrtc_track.get())));
-  } else {
-    DCHECK_EQ(webrtc_track->kind(),
-              webrtc::MediaStreamTrackInterface::kVideoKind);
-    remote_track_adapter->InitializeRemoteVideoTrack(base::WrapRefCounted(
-        static_cast<webrtc::VideoTrackInterface*>(webrtc_track.get())));
-  }
-  return remote_track_adapter;
-}
-
-WebRtcMediaStreamTrackAdapter::WebRtcMediaStreamTrackAdapter(
-    PeerConnectionDependencyFactory* factory,
-    const scoped_refptr<base::SingleThreadTaskRunner>& main_thread)
-    : factory_(factory),
-      main_thread_(main_thread),
-      remote_track_can_complete_initialization_(
-          base::WaitableEvent::ResetPolicy::MANUAL,
-          base::WaitableEvent::InitialState::NOT_SIGNALED),
-      is_initialized_(false),
-      is_disposed_(false) {
-  DCHECK(factory_);
-  DCHECK(main_thread_);
-}
-
-WebRtcMediaStreamTrackAdapter::~WebRtcMediaStreamTrackAdapter() {
-  DCHECK(!remote_track_can_complete_initialization_.IsSignaled());
-  DCHECK(is_disposed_);
-  // Ensured by destructor traits.
-  DCHECK(main_thread_->BelongsToCurrentThread());
-}
-
-// static
-void WebRtcMediaStreamTrackAdapterTraits::Destruct(
-    const WebRtcMediaStreamTrackAdapter* adapter) {
-  if (!adapter->main_thread_->BelongsToCurrentThread()) {
-    adapter->main_thread_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&WebRtcMediaStreamTrackAdapterTraits::Destruct,
-                       base::Unretained(adapter)));
-    return;
-  }
-  delete adapter;
-}
-
-void WebRtcMediaStreamTrackAdapter::Dispose() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(is_initialized_);
-  if (is_disposed_)
-    return;
-  remote_track_can_complete_initialization_.Reset();
-  is_disposed_ = true;
-  if (web_track_.Source().GetType() ==
-      blink::WebMediaStreamSource::kTypeAudio) {
-    if (local_track_audio_sink_)
-      DisposeLocalAudioTrack();
-    else
-      DisposeRemoteAudioTrack();
-  } else {
-    DCHECK_EQ(web_track_.Source().GetType(),
-              blink::WebMediaStreamSource::kTypeVideo);
-    if (local_track_video_sink_)
-      DisposeLocalVideoTrack();
-    else
-      DisposeRemoteVideoTrack();
-  }
-}
-
-bool WebRtcMediaStreamTrackAdapter::is_initialized() const {
-  return is_initialized_;
-}
-
-void WebRtcMediaStreamTrackAdapter::InitializeOnMainThread() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  if (is_initialized_)
-    return;
-  // TODO(hbos): Only ever initialize explicitly,
-  // remove EnsureTrackIsInitialized(). https://crbug.com/857458
-  EnsureTrackIsInitialized();
-}
-
-const blink::WebMediaStreamTrack& WebRtcMediaStreamTrackAdapter::web_track() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  EnsureTrackIsInitialized();
-  DCHECK(!web_track_.IsNull());
-  return web_track_;
-}
-
-webrtc::MediaStreamTrackInterface*
-WebRtcMediaStreamTrackAdapter::webrtc_track() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(webrtc_track_);
-  EnsureTrackIsInitialized();
-  return webrtc_track_.get();
-}
-
-bool WebRtcMediaStreamTrackAdapter::IsEqual(
-    const blink::WebMediaStreamTrack& web_track) {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  EnsureTrackIsInitialized();
-  return web_track_.GetPlatformTrack() == web_track.GetPlatformTrack();
-}
-
-void WebRtcMediaStreamTrackAdapter::InitializeLocalAudioTrack(
-    const blink::WebMediaStreamTrack& web_track) {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(!is_initialized_);
-  DCHECK(!web_track.IsNull());
-  DCHECK_EQ(web_track.Source().GetType(),
-            blink::WebMediaStreamSource::kTypeAudio);
-  web_track_ = web_track;
-  blink::MediaStreamAudioTrack* native_track =
-      blink::MediaStreamAudioTrack::From(web_track_);
-  DCHECK(native_track);
-
-  // Non-WebRtc remote sources and local sources do not provide an instance of
-  // the webrtc::AudioSourceInterface, and also do not need references to the
-  // audio level calculator or audio processor passed to the sink.
-  webrtc::AudioSourceInterface* source_interface = nullptr;
-  local_track_audio_sink_.reset(new blink::WebRtcAudioSink(
-      web_track_.Id().Utf8(), source_interface,
-      factory_->GetWebRtcSignalingThread(), main_thread_));
-
-  if (auto* media_stream_source = blink::ProcessedLocalAudioSource::From(
-          blink::MediaStreamAudioSource::From(web_track_.Source()))) {
-    local_track_audio_sink_->SetLevel(media_stream_source->audio_level());
-    // The sink only grabs stats from the audio processor. Stats are only
-    // available if audio processing is turned on. Therefore, only provide the
-    // sink a reference to the processor if audio processing is turned on.
-    if (media_stream_source->HasAudioProcessing()) {
-      local_track_audio_sink_->SetAudioProcessor(
-          media_stream_source->GetAudioProcessor());
-    }
-  }
-  native_track->AddSink(local_track_audio_sink_.get());
-  webrtc_track_ = local_track_audio_sink_->webrtc_audio_track();
-  DCHECK(webrtc_track_);
-  is_initialized_ = true;
-}
-
-void WebRtcMediaStreamTrackAdapter::InitializeLocalVideoTrack(
-    const blink::WebMediaStreamTrack& web_track) {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(!is_initialized_);
-  DCHECK(!web_track.IsNull());
-  DCHECK_EQ(web_track.Source().GetType(),
-            blink::WebMediaStreamSource::kTypeVideo);
-  web_track_ = web_track;
-  local_track_video_sink_.reset(
-      new MediaStreamVideoWebRtcSink(web_track_, factory_, main_thread_));
-  webrtc_track_ = local_track_video_sink_->webrtc_video_track();
-  DCHECK(webrtc_track_);
-  is_initialized_ = true;
-}
-
-void WebRtcMediaStreamTrackAdapter::InitializeRemoteAudioTrack(
-    const scoped_refptr<webrtc::AudioTrackInterface>& webrtc_audio_track) {
-  DCHECK(!main_thread_->BelongsToCurrentThread());
-  DCHECK(!is_initialized_);
-  DCHECK(!remote_track_can_complete_initialization_.IsSignaled());
-  DCHECK(webrtc_audio_track);
-  DCHECK_EQ(webrtc_audio_track->kind(),
-            webrtc::MediaStreamTrackInterface::kAudioKind);
-  remote_audio_track_adapter_ =
-      base::MakeRefCounted<blink::RemoteAudioTrackAdapter>(
-          main_thread_, webrtc_audio_track.get());
-  webrtc_track_ = webrtc_audio_track;
-  // Set the initial volume to zero. When the track is put in an audio tag for
-  // playout, its volume is set to that of the tag. Without this, we could end
-  // up playing out audio that's not attached to any tag, see:
-  // http://crbug.com/810848
-  webrtc_audio_track->GetSource()->SetVolume(0);
-  remote_track_can_complete_initialization_.Signal();
-  main_thread_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&WebRtcMediaStreamTrackAdapter::
-                         FinalizeRemoteTrackInitializationOnMainThread,
-                     this));
-}
-
-void WebRtcMediaStreamTrackAdapter::InitializeRemoteVideoTrack(
-    const scoped_refptr<webrtc::VideoTrackInterface>& webrtc_video_track) {
-  DCHECK(!main_thread_->BelongsToCurrentThread());
-  DCHECK(webrtc_video_track);
-  DCHECK_EQ(webrtc_video_track->kind(),
-            webrtc::MediaStreamTrackInterface::kVideoKind);
-  remote_video_track_adapter_ =
-      base::MakeRefCounted<blink::RemoteVideoTrackAdapter>(
-          main_thread_, webrtc_video_track.get());
-  webrtc_track_ = webrtc_video_track;
-  remote_track_can_complete_initialization_.Signal();
-  main_thread_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&WebRtcMediaStreamTrackAdapter::
-                         FinalizeRemoteTrackInitializationOnMainThread,
-                     this));
-}
-
-void WebRtcMediaStreamTrackAdapter::
-    FinalizeRemoteTrackInitializationOnMainThread() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(remote_audio_track_adapter_ || remote_video_track_adapter_);
-  if (is_initialized_)
-    return;
-
-  if (remote_audio_track_adapter_) {
-    remote_audio_track_adapter_->Initialize();
-    web_track_ = *remote_audio_track_adapter_->web_track();
-  } else {
-    remote_video_track_adapter_->Initialize();
-    web_track_ = *remote_video_track_adapter_->web_track();
-  }
-  is_initialized_ = true;
-}
-
-void WebRtcMediaStreamTrackAdapter::EnsureTrackIsInitialized() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  if (is_initialized_)
-    return;
-
-  // Remote tracks may not be fully initialized yet, since they are partly
-  // initialized on the signaling thread.
-  remote_track_can_complete_initialization_.Wait();
-  FinalizeRemoteTrackInitializationOnMainThread();
-}
-
-void WebRtcMediaStreamTrackAdapter::DisposeLocalAudioTrack() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(local_track_audio_sink_);
-  DCHECK_EQ(web_track_.Source().GetType(),
-            blink::WebMediaStreamSource::kTypeAudio);
-  blink::MediaStreamAudioTrack* audio_track =
-      blink::MediaStreamAudioTrack::From(web_track_);
-  DCHECK(audio_track);
-  audio_track->RemoveSink(local_track_audio_sink_.get());
-  local_track_audio_sink_.reset();
-  webrtc_track_ = nullptr;
-  web_track_.Reset();
-}
-
-void WebRtcMediaStreamTrackAdapter::DisposeLocalVideoTrack() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(local_track_video_sink_);
-  DCHECK_EQ(web_track_.Source().GetType(),
-            blink::WebMediaStreamSource::kTypeVideo);
-  local_track_video_sink_.reset();
-  webrtc_track_ = nullptr;
-  web_track_.Reset();
-}
-
-void WebRtcMediaStreamTrackAdapter::DisposeRemoteAudioTrack() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(remote_audio_track_adapter_);
-  DCHECK_EQ(web_track_.Source().GetType(),
-            blink::WebMediaStreamSource::kTypeAudio);
-  factory_->GetWebRtcSignalingThread()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&WebRtcMediaStreamTrackAdapter::
-                         UnregisterRemoteAudioTrackAdapterOnSignalingThread,
-                     this));
-}
-
-void WebRtcMediaStreamTrackAdapter::DisposeRemoteVideoTrack() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(remote_video_track_adapter_);
-  DCHECK_EQ(web_track_.Source().GetType(),
-            blink::WebMediaStreamSource::kTypeVideo);
-  FinalizeRemoteTrackDisposingOnMainThread();
-}
-
-void WebRtcMediaStreamTrackAdapter::
-    UnregisterRemoteAudioTrackAdapterOnSignalingThread() {
-  DCHECK(!main_thread_->BelongsToCurrentThread());
-  DCHECK(remote_audio_track_adapter_);
-  remote_audio_track_adapter_->Unregister();
-  main_thread_->PostTask(
-      FROM_HERE, base::BindOnce(&WebRtcMediaStreamTrackAdapter::
-                                    FinalizeRemoteTrackDisposingOnMainThread,
-                                this));
-}
-
-void WebRtcMediaStreamTrackAdapter::FinalizeRemoteTrackDisposingOnMainThread() {
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  DCHECK(is_disposed_);
-  remote_audio_track_adapter_ = nullptr;
-  remote_video_track_adapter_ = nullptr;
-  webrtc_track_ = nullptr;
-  web_track_.Reset();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h b/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h
deleted file mode 100644
index d14c01c73f2..00000000000
--- a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h
+++ /dev/null
@@ -1,151 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_MEDIA_STREAM_TRACK_ADAPTER_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_MEDIA_STREAM_TRACK_ADAPTER_H_
-
-#include <memory>
-
-#include "base/memory/ref_counted.h"
-#include "base/synchronization/waitable_event.h"
-#include "content/common/content_export.h"
-#include "content/renderer/media/webrtc/media_stream_video_webrtc_sink.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h"
-#include "third_party/blink/public/platform/modules/peerconnection/webrtc_audio_sink.h"
-#include "third_party/blink/public/platform/web_media_stream.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/web/modules/mediastream/remote_media_stream_track_adapter.h"
-#include "third_party/webrtc/api/media_stream_interface.h"
-
-namespace content {
-
-class PeerConnectionDependencyFactory;
-struct WebRtcMediaStreamTrackAdapterTraits;
-
-// This is a mapping between a webrtc and blink media stream track. It takes
-// care of creation, initialization and disposing of tracks independently of
-// media streams.
-// There are different sinks/adapters used whether the track is local or remote
-// and whether it is an audio or video track; this adapter hides that fact and
-// lets you use a single class for any type of track.
-class CONTENT_EXPORT WebRtcMediaStreamTrackAdapter
-    : public base::RefCountedThreadSafe<WebRtcMediaStreamTrackAdapter,
-                                        WebRtcMediaStreamTrackAdapterTraits> {
- public:
-  // Invoke on the main thread. The returned adapter is fully initialized, see
-  // |is_initialized|. The adapter will keep a reference to the |main_thread|.
-  static scoped_refptr<WebRtcMediaStreamTrackAdapter> CreateLocalTrackAdapter(
-      PeerConnectionDependencyFactory* factory,
-      const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
-      const blink::WebMediaStreamTrack& web_track);
-  // Invoke on the webrtc signaling thread. Initialization finishes on the main
-  // thread in a post, meaning returned adapters are ensured to be initialized
-  // in posts to the main thread, see |is_initialized|. The adapter will keep
-  // references to the |main_thread| and |webrtc_track|.
-  static scoped_refptr<WebRtcMediaStreamTrackAdapter> CreateRemoteTrackAdapter(
-      PeerConnectionDependencyFactory* factory,
-      const scoped_refptr<base::SingleThreadTaskRunner>& main_thread,
-      const scoped_refptr<webrtc::MediaStreamTrackInterface>& webrtc_track);
-  // Must be called before all external references are released (i.e. before
-  // destruction). Invoke on the main thread. Disposing may finish
-  // asynchronously using the webrtc signaling thread and the main thread. After
-  // calling this method it is safe to release all external references to the
-  // adapter.
-  void Dispose();
-
-  bool is_initialized() const;
-  void InitializeOnMainThread();
-  // These methods must be called on the main thread.
-  // TODO(hbos): Allow these methods to be called on any thread and make them
-  // const. https://crbug.com/756436
-  const blink::WebMediaStreamTrack& web_track();
-  webrtc::MediaStreamTrackInterface* webrtc_track();
-  bool IsEqual(const blink::WebMediaStreamTrack& web_track);
-
-  // For testing.
-  blink::WebRtcAudioSink* GetLocalTrackAudioSinkForTesting() {
-    return local_track_audio_sink_.get();
-  }
-  MediaStreamVideoWebRtcSink* GetLocalTrackVideoSinkForTesting() {
-    return local_track_video_sink_.get();
-  }
-  blink::RemoteAudioTrackAdapter* GetRemoteAudioTrackAdapterForTesting() {
-    return remote_audio_track_adapter_.get();
-  }
-  blink::RemoteVideoTrackAdapter* GetRemoteVideoTrackAdapterForTesting() {
-    return remote_video_track_adapter_.get();
-  }
-
- protected:
-  friend class base::RefCountedThreadSafe<WebRtcMediaStreamTrackAdapter,
-                                          WebRtcMediaStreamTrackAdapterTraits>;
-  friend struct WebRtcMediaStreamTrackAdapterTraits;
-
-  WebRtcMediaStreamTrackAdapter(
-      PeerConnectionDependencyFactory* factory,
-      const scoped_refptr<base::SingleThreadTaskRunner>& main_thread);
-  virtual ~WebRtcMediaStreamTrackAdapter();
-
- private:
-  // Initialization of local tracks occurs on the main thread.
-  void InitializeLocalAudioTrack(const blink::WebMediaStreamTrack& web_track);
-  void InitializeLocalVideoTrack(const blink::WebMediaStreamTrack& web_track);
-  // Initialization of remote tracks starts on the webrtc signaling thread and
-  // finishes on the main thread.
-  void InitializeRemoteAudioTrack(
-      const scoped_refptr<webrtc::AudioTrackInterface>& webrtc_audio_track);
-  void InitializeRemoteVideoTrack(
-      const scoped_refptr<webrtc::VideoTrackInterface>& webrtc_video_track);
-  void FinalizeRemoteTrackInitializationOnMainThread();
-  void EnsureTrackIsInitialized();
-
-  // Disposing starts and finishes on the main thread. Local tracks and remote
-  // video tracks are disposed synchronously. Remote audio tracks are disposed
-  // asynchronously with a jump to the webrtc signaling thread and back.
-  void DisposeLocalAudioTrack();
-  void DisposeLocalVideoTrack();
-  void DisposeRemoteAudioTrack();
-  void DisposeRemoteVideoTrack();
-  void UnregisterRemoteAudioTrackAdapterOnSignalingThread();
-  void FinalizeRemoteTrackDisposingOnMainThread();
-
-  // Pointer to a |PeerConnectionDependencyFactory| owned by the |RenderThread|.
-  // It's valid for the lifetime of |RenderThread|.
-  PeerConnectionDependencyFactory* const factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-
-  // Part of the initialization of remote tracks occurs on the signaling thread.
-  // |remote_track_can_complete_initialization_| allows waiting until that part
-  // of the process is finished, so that full initialization of the track can be
-  // completed on the main thread.
-  base::WaitableEvent remote_track_can_complete_initialization_;
-  bool is_initialized_;
-  bool is_disposed_;
-  blink::WebMediaStreamTrack web_track_;
-  scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track_;
-  // If the track is local, a sink is added to the local webrtc track that is
-  // owned by us.
-  std::unique_ptr<blink::WebRtcAudioSink> local_track_audio_sink_;
-  std::unique_ptr<MediaStreamVideoWebRtcSink> local_track_video_sink_;
-  // If the track is remote, an adapter is used that listens to notifications on
-  // the remote webrtc track and notifies Blink.
-  scoped_refptr<blink::RemoteAudioTrackAdapter> remote_audio_track_adapter_;
-  scoped_refptr<blink::RemoteVideoTrackAdapter> remote_video_track_adapter_;
-
-  DISALLOW_COPY_AND_ASSIGN(WebRtcMediaStreamTrackAdapter);
-};
-
-struct CONTENT_EXPORT WebRtcMediaStreamTrackAdapterTraits {
- private:
-  friend class base::RefCountedThreadSafe<WebRtcMediaStreamTrackAdapter,
-                                          WebRtcMediaStreamTrackAdapterTraits>;
-
-  // Ensure destruction occurs on main thread so that "Web" and other resources
-  // are destroyed on the correct thread.
-  static void Destruct(const WebRtcMediaStreamTrackAdapter* adapter);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_MEDIA_STREAM_TRACK_ADAPTER_H_
diff --git a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.cc b/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.cc
deleted file mode 100644
index db6b0c6041d..00000000000
--- a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.cc
+++ /dev/null
@@ -1,213 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-
-#include <utility>
-
-#include "base/bind.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-
-namespace content {
-
-WebRtcMediaStreamTrackAdapterMap::AdapterRef::AdapterRef(
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> map,
-    Type type,
-    scoped_refptr<WebRtcMediaStreamTrackAdapter> adapter)
-    : map_(std::move(map)), type_(type), adapter_(std::move(adapter)) {
-  DCHECK(map_);
-  DCHECK(adapter_);
-}
-
-WebRtcMediaStreamTrackAdapterMap::AdapterRef::~AdapterRef() {
-  DCHECK(map_->main_thread_->BelongsToCurrentThread());
-  scoped_refptr<WebRtcMediaStreamTrackAdapter> removed_adapter;
-  {
-    base::AutoLock scoped_lock(map_->lock_);
-    // The adapter is stored in the track adapter map and we have |adapter_|,
-    // so there must be at least two references to the adapter.
-    DCHECK(!adapter_->HasOneRef());
-    // Using a raw pointer instead of |adapter_| allows the reference count to
-    // go down to one if this is the last |AdapterRef|.
-    WebRtcMediaStreamTrackAdapter* adapter = adapter_.get();
-    adapter_ = nullptr;
-    if (adapter->HasOneRef()) {
-      removed_adapter = adapter;
-      // "GetOrCreate..." ensures the adapter is initialized and the secondary
-      // key is set before the last |AdapterRef| is destroyed. We can use either
-      // the primary or secondary key for removal.
-      DCHECK(adapter->is_initialized());
-      if (type_ == Type::kLocal) {
-        map_->local_track_adapters_.EraseByPrimary(
-            adapter->web_track().UniqueId());
-      } else {
-        map_->remote_track_adapters_.EraseByPrimary(adapter->webrtc_track());
-      }
-    }
-  }
-  // Dispose the adapter if it was removed. This is performed after releasing
-  // the lock so that it is safe for any disposal mechanism to do synchronous
-  // invokes to the signaling thread without any risk of deadlock.
-  if (removed_adapter) {
-    removed_adapter->Dispose();
-  }
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::AdapterRef::Copy() const {
-  base::AutoLock scoped_lock(map_->lock_);
-  return base::WrapUnique(new AdapterRef(map_, type_, adapter_));
-}
-
-void WebRtcMediaStreamTrackAdapterMap::AdapterRef::InitializeOnMainThread() {
-  adapter_->InitializeOnMainThread();
-  if (type_ == WebRtcMediaStreamTrackAdapterMap::AdapterRef::Type::kRemote) {
-    base::AutoLock scoped_lock(map_->lock_);
-    if (!map_->remote_track_adapters_.FindBySecondary(web_track().UniqueId())) {
-      map_->remote_track_adapters_.SetSecondaryKey(webrtc_track(),
-                                                   web_track().UniqueId());
-    }
-  }
-}
-
-WebRtcMediaStreamTrackAdapterMap::WebRtcMediaStreamTrackAdapterMap(
-    PeerConnectionDependencyFactory* const factory,
-    scoped_refptr<base::SingleThreadTaskRunner> main_thread)
-    : factory_(factory), main_thread_(std::move(main_thread)) {
-  DCHECK(factory_);
-  DCHECK(main_thread_);
-}
-
-WebRtcMediaStreamTrackAdapterMap::~WebRtcMediaStreamTrackAdapterMap() {
-  DCHECK(local_track_adapters_.empty());
-  DCHECK(remote_track_adapters_.empty());
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::GetLocalTrackAdapter(
-    const blink::WebMediaStreamTrack& web_track) {
-  base::AutoLock scoped_lock(lock_);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter>* adapter_ptr =
-      local_track_adapters_.FindByPrimary(web_track.UniqueId());
-  if (!adapter_ptr)
-    return nullptr;
-  return base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kLocal, *adapter_ptr));
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::GetLocalTrackAdapter(
-    webrtc::MediaStreamTrackInterface* webrtc_track) {
-  base::AutoLock scoped_lock(lock_);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter>* adapter_ptr =
-      local_track_adapters_.FindBySecondary(webrtc_track);
-  if (!adapter_ptr)
-    return nullptr;
-  return base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kLocal, *adapter_ptr));
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::GetOrCreateLocalTrackAdapter(
-    const blink::WebMediaStreamTrack& web_track) {
-  DCHECK(!web_track.IsNull());
-  DCHECK(main_thread_->BelongsToCurrentThread());
-  base::AutoLock scoped_lock(lock_);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter>* adapter_ptr =
-      local_track_adapters_.FindByPrimary(web_track.UniqueId());
-  if (adapter_ptr) {
-    return base::WrapUnique(
-        new AdapterRef(this, AdapterRef::Type::kLocal, *adapter_ptr));
-  }
-  scoped_refptr<WebRtcMediaStreamTrackAdapter> new_adapter;
-  {
-    // Do not hold |lock_| while creating the adapter in case that operation
-    // synchronizes with the signaling thread. If we do and the signaling thread
-    // is blocked waiting for |lock_| we end up in a deadlock.
-    base::AutoUnlock scoped_unlock(lock_);
-    new_adapter = WebRtcMediaStreamTrackAdapter::CreateLocalTrackAdapter(
-        factory_, main_thread_, web_track);
-  }
-  DCHECK(new_adapter->is_initialized());
-  local_track_adapters_.Insert(web_track.UniqueId(), new_adapter);
-  local_track_adapters_.SetSecondaryKey(web_track.UniqueId(),
-                                        new_adapter->webrtc_track());
-  return base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kLocal, new_adapter));
-}
-
-size_t WebRtcMediaStreamTrackAdapterMap::GetLocalTrackCount() const {
-  base::AutoLock scoped_lock(lock_);
-  return local_track_adapters_.PrimarySize();
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::GetRemoteTrackAdapter(
-    const blink::WebMediaStreamTrack& web_track) {
-  base::AutoLock scoped_lock(lock_);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter>* adapter_ptr =
-      remote_track_adapters_.FindBySecondary(web_track.UniqueId());
-  if (!adapter_ptr)
-    return nullptr;
-  DCHECK((*adapter_ptr)->is_initialized());
-  return base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kRemote, *adapter_ptr));
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::GetRemoteTrackAdapter(
-    webrtc::MediaStreamTrackInterface* webrtc_track) {
-  base::AutoLock scoped_lock(lock_);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter>* adapter_ptr =
-      remote_track_adapters_.FindByPrimary(webrtc_track);
-  if (!adapter_ptr)
-    return nullptr;
-  return base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kRemote, *adapter_ptr));
-}
-
-std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-WebRtcMediaStreamTrackAdapterMap::GetOrCreateRemoteTrackAdapter(
-    scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track) {
-  DCHECK(webrtc_track);
-  DCHECK(!main_thread_->BelongsToCurrentThread());
-  base::AutoLock scoped_lock(lock_);
-  scoped_refptr<WebRtcMediaStreamTrackAdapter>* adapter_ptr =
-      remote_track_adapters_.FindByPrimary(webrtc_track.get());
-  if (adapter_ptr) {
-    return base::WrapUnique(
-        new AdapterRef(this, AdapterRef::Type::kRemote, *adapter_ptr));
-  }
-  scoped_refptr<WebRtcMediaStreamTrackAdapter> new_adapter;
-  {
-    // Do not hold |lock_| while creating the adapter in case that operation
-    // synchronizes with the main thread. If we do and the main thread is
-    // blocked waiting for |lock_| we end up in a deadlock.
-    base::AutoUnlock scoped_unlock(lock_);
-    new_adapter = WebRtcMediaStreamTrackAdapter::CreateRemoteTrackAdapter(
-        factory_, main_thread_, webrtc_track);
-  }
-  remote_track_adapters_.Insert(webrtc_track.get(), new_adapter);
-  // The new adapter is initialized in a post to the main thread. As soon as it
-  // is initialized we map its |webrtc_track| to the |remote_track_adapters_|
-  // entry as its secondary key. This ensures that there is at least one
-  // |AdapterRef| alive until after the adapter is initialized and its secondary
-  // key is set.
-  auto adapter_ref = base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kRemote, new_adapter));
-  main_thread_->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &WebRtcMediaStreamTrackAdapterMap::AdapterRef::InitializeOnMainThread,
-          std::move(adapter_ref)));
-  return base::WrapUnique(
-      new AdapterRef(this, AdapterRef::Type::kRemote, new_adapter));
-}
-
-size_t WebRtcMediaStreamTrackAdapterMap::GetRemoteTrackCount() const {
-  base::AutoLock scoped_lock(lock_);
-  return remote_track_adapters_.PrimarySize();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h b/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h
deleted file mode 100644
index 024e8fc5ea6..00000000000
--- a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h
+++ /dev/null
@@ -1,153 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_MEDIA_STREAM_TRACK_ADAPTER_MAP_H_
-#define CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_MEDIA_STREAM_TRACK_ADAPTER_MAP_H_
-
-#include <map>
-#include <string>
-
-#include "base/memory/ref_counted.h"
-#include "base/single_thread_task_runner.h"
-#include "content/common/content_export.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h"
-#include "third_party/blink/public/platform/modules/peerconnection/two_keys_adapter_map.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/webrtc/api/media_stream_interface.h"
-
-namespace content {
-
-class PeerConnectionDependencyFactory;
-
-// A map and owner of |WebRtcMediaStreamTrackAdapter|s. It takes care of
-// creating, initializing and disposing track adapters independently of media
-// streams. Adapters are accessed via |AdapterRef|s, when all references to an
-// adapter are destroyed it is disposed and removed from the map.
-class CONTENT_EXPORT WebRtcMediaStreamTrackAdapterMap
-    : public base::RefCountedThreadSafe<WebRtcMediaStreamTrackAdapterMap> {
- public:
-  // Acts as an accessor to adapter members without leaking a reference to the
-  // adapter. When the last |AdapterRef| is destroyed, the corresponding adapter
-  // is |Dispose|d and removed from the map.
-  class CONTENT_EXPORT AdapterRef {
-   public:
-    // Must be invoked on the main thread. If this was the last reference to the
-    // adapter it will be disposed and removed from the map.
-    ~AdapterRef();
-
-    std::unique_ptr<AdapterRef> Copy() const;
-    bool is_initialized() const { return adapter_->is_initialized(); }
-    void InitializeOnMainThread();
-    const blink::WebMediaStreamTrack& web_track() const {
-      return adapter_->web_track();
-    }
-    webrtc::MediaStreamTrackInterface* webrtc_track() const {
-      return adapter_->webrtc_track();
-    }
-
-    // Warning: Holding an external reference to the adapter will prevent
-    // |~AdapterRef| from disposing the adapter.
-    WebRtcMediaStreamTrackAdapter* GetAdapterForTesting() const {
-      return adapter_.get();
-    }
-
-   private:
-    friend class WebRtcMediaStreamTrackAdapterMap;
-
-    enum class Type { kLocal, kRemote };
-
-    // Assumes map's |lock_| is held.
-    AdapterRef(scoped_refptr<WebRtcMediaStreamTrackAdapterMap> map,
-               Type type,
-               scoped_refptr<WebRtcMediaStreamTrackAdapter> adapter);
-
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> map_;
-    Type type_;
-    // A reference to the entry's adapter, ensures that |HasOneRef()| is false
-    // as long as the |AdapterRef| is kept alive (the map entry has one
-    // reference to it too).
-    scoped_refptr<WebRtcMediaStreamTrackAdapter> adapter_;
-  };
-
-  // Must be invoked on the main thread.
-  WebRtcMediaStreamTrackAdapterMap(
-      PeerConnectionDependencyFactory* const factory,
-      scoped_refptr<base::SingleThreadTaskRunner> main_thread);
-
-  // Gets a new reference to the local track adapter, or null if no such adapter
-  // was found. When all references are destroyed the adapter is disposed and
-  // removed from the map. This method can be called from any thread, but
-  // references must be destroyed on the main thread.
-  // The adapter is a associated with a blink and webrtc track, lookup works by
-  // either track.
-  std::unique_ptr<AdapterRef> GetLocalTrackAdapter(
-      const blink::WebMediaStreamTrack& web_track);
-  std::unique_ptr<AdapterRef> GetLocalTrackAdapter(
-      webrtc::MediaStreamTrackInterface* webrtc_track);
-  // Invoke on the main thread. Gets a new reference to the local track adapter
-  // for the web track. If no adapter exists for the track one is created and
-  // initialized. When all references are destroyed the adapter is disposed and
-  // removed from the map. References must be destroyed on the main thread.
-  std::unique_ptr<AdapterRef> GetOrCreateLocalTrackAdapter(
-      const blink::WebMediaStreamTrack& web_track);
-  size_t GetLocalTrackCount() const;
-
-  // Gets a new reference to the remote track adapter. When all references are
-  // destroyed the adapter is disposed and removed from the map. This method can
-  // be called from any thread, but references must be destroyed on the main
-  // thread. The adapter is a associated with a blink and webrtc track, lookup
-  // works by either track.
-  // First variety: If an adapter exists it will already be initialized, if one
-  // does not exist null is returned.
-  std::unique_ptr<AdapterRef> GetRemoteTrackAdapter(
-      const blink::WebMediaStreamTrack& web_track);
-  // Second variety: If an adapter exists it may or may not be initialized, see
-  // |AdapterRef::is_initialized|. If an adapter does not exist null is
-  // returned.
-  std::unique_ptr<AdapterRef> GetRemoteTrackAdapter(
-      webrtc::MediaStreamTrackInterface* webrtc_track);
-  // Invoke on the webrtc signaling thread. Gets a new reference to the remote
-  // track adapter for the webrtc track. If no adapter exists for the track one
-  // is created and initialization completes on the main thread in a post. When
-  // all references are destroyed the adapter is disposed and removed from the
-  // map. References must be destroyed on the main thread.
-  std::unique_ptr<AdapterRef> GetOrCreateRemoteTrackAdapter(
-      scoped_refptr<webrtc::MediaStreamTrackInterface> webrtc_track);
-  size_t GetRemoteTrackCount() const;
-
- private:
-  friend class base::RefCountedThreadSafe<WebRtcMediaStreamTrackAdapterMap>;
-
-  // "(blink::WebMediaStreamTrack, webrtc::MediaStreamTrackInterface) ->
-  // WebRtcMediaStreamTrackAdapter" maps. The primary key is based on the object
-  // used to create the adapter. Local tracks are created from
-  // |blink::WebMediaStreamTrack|s, remote tracks are created from
-  // |webrtc::MediaStreamTrackInterface|s.
-  // The adapter keeps the |webrtc::MediaStreamTrackInterface| alive with ref
-  // counting making it safe to use a raw pointer for key.
-  using LocalTrackAdapterMap =
-      blink::TwoKeysAdapterMap<int,  // blink::WebMediaStreamTrack::UniqueId()
-                               webrtc::MediaStreamTrackInterface*,
-                               scoped_refptr<WebRtcMediaStreamTrackAdapter>>;
-  using RemoteTrackAdapterMap =
-      blink::TwoKeysAdapterMap<webrtc::MediaStreamTrackInterface*,
-                               int,  // blink::WebMediaStreamTrack::UniqueId()
-                               scoped_refptr<WebRtcMediaStreamTrackAdapter>>;
-
-  // Invoke on the main thread.
-  virtual ~WebRtcMediaStreamTrackAdapterMap();
-
-  // Pointer to a |PeerConnectionDependencyFactory| owned by the |RenderThread|.
-  // It's valid for the lifetime of |RenderThread|.
-  PeerConnectionDependencyFactory* const factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-
-  mutable base::Lock lock_;
-  LocalTrackAdapterMap local_track_adapters_;
-  RemoteTrackAdapterMap remote_track_adapters_;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_MEDIA_WEBRTC_WEBRTC_MEDIA_STREAM_TRACK_ADAPTER_MAP_H_
diff --git a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map_unittest.cc b/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map_unittest.cc
deleted file mode 100644
index 0158d94298b..00000000000
--- a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map_unittest.cc
+++ /dev/null
@@ -1,346 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/memory/ref_counted.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/test/task_environment.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/blink/public/web/web_heap.h"
-
-namespace content {
-
-class WebRtcMediaStreamTrackAdapterMapTest : public ::testing::Test {
- public:
-  void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
-    main_thread_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-    map_ = new WebRtcMediaStreamTrackAdapterMap(dependency_factory_.get(),
-                                                main_thread_);
-  }
-
-  void TearDown() override { blink::WebHeap::CollectAllGarbageForTesting(); }
-
-  scoped_refptr<base::SingleThreadTaskRunner> signaling_thread() const {
-    return dependency_factory_->GetWebRtcSignalingThread();
-  }
-
-  blink::WebMediaStreamTrack CreateLocalTrack(const std::string& id) {
-    blink::WebMediaStreamSource web_source;
-    web_source.Initialize(
-        blink::WebString::FromUTF8(id), blink::WebMediaStreamSource::kTypeAudio,
-        blink::WebString::FromUTF8("local_audio_track"), false);
-    blink::MediaStreamAudioSource* audio_source =
-        new blink::MediaStreamAudioSource(
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(), true);
-    // Takes ownership of |audio_source|.
-    web_source.SetPlatformSource(base::WrapUnique(audio_source));
-
-    blink::WebMediaStreamTrack web_track;
-    web_track.Initialize(web_source.Id(), web_source);
-    audio_source->ConnectToTrack(web_track);
-    return web_track;
-  }
-
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>
-  GetOrCreateRemoteTrackAdapter(webrtc::MediaStreamTrackInterface* webrtc_track,
-                                bool wait_for_initialization = true) {
-    DCHECK(main_thread_->BelongsToCurrentThread());
-    std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> adapter;
-    signaling_thread()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&WebRtcMediaStreamTrackAdapterMapTest::
-                           GetOrCreateRemoteTrackAdapterOnSignalingThread,
-                       base::Unretained(this), base::Unretained(webrtc_track),
-                       &adapter));
-    RunMessageLoopsUntilIdle(wait_for_initialization);
-    DCHECK(adapter);
-    if (wait_for_initialization) {
-      DCHECK(adapter->is_initialized());
-    } else {
-      DCHECK(!adapter->is_initialized());
-    }
-    return adapter;
-  }
-
-  void GetOrCreateRemoteTrackAdapterOnSignalingThread(
-      webrtc::MediaStreamTrackInterface* webrtc_track,
-      std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>* adapter) {
-    DCHECK(signaling_thread()->BelongsToCurrentThread());
-    *adapter = map_->GetOrCreateRemoteTrackAdapter(webrtc_track);
-  }
-
-  // Runs message loops on the webrtc signaling thread and the main thread until
-  // idle.
-  void RunMessageLoopsUntilIdle(bool run_loop_on_main_thread = true) {
-    DCHECK(main_thread_->BelongsToCurrentThread());
-    base::WaitableEvent waitable_event(
-        base::WaitableEvent::ResetPolicy::MANUAL,
-        base::WaitableEvent::InitialState::NOT_SIGNALED);
-    signaling_thread()->PostTask(
-        FROM_HERE, base::BindOnce(&WebRtcMediaStreamTrackAdapterMapTest::
-                                      RunMessageLoopUntilIdleOnSignalingThread,
-                                  base::Unretained(this), &waitable_event));
-    waitable_event.Wait();
-    if (run_loop_on_main_thread)
-      base::RunLoop().RunUntilIdle();
-  }
-
-  void RunMessageLoopUntilIdleOnSignalingThread(
-      base::WaitableEvent* waitable_event) {
-    DCHECK(signaling_thread()->BelongsToCurrentThread());
-    base::RunLoop().RunUntilIdle();
-    waitable_event->Signal();
-  }
-
- protected:
-  // The TaskEnvironment prevents the ChildProcess from leaking a
-  // ThreadPool.
-  base::test::TaskEnvironment task_environment_;
-  ChildProcess child_process_;
-
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> map_;
-};
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapTest, AddAndRemoveLocalTrackAdapter) {
-  blink::WebMediaStreamTrack web_track = CreateLocalTrack("local_track");
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> adapter_ref =
-      map_->GetOrCreateLocalTrackAdapter(web_track);
-  EXPECT_TRUE(adapter_ref->is_initialized());
-  EXPECT_EQ(adapter_ref->GetAdapterForTesting(),
-            map_->GetLocalTrackAdapter(web_track)->GetAdapterForTesting());
-  EXPECT_EQ(1u, map_->GetLocalTrackCount());
-
-  // "GetOrCreate" for already existing track.
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> adapter_ref2 =
-      map_->GetOrCreateLocalTrackAdapter(web_track);
-  EXPECT_EQ(adapter_ref->GetAdapterForTesting(),
-            adapter_ref2->GetAdapterForTesting());
-  EXPECT_EQ(1u, map_->GetLocalTrackCount());
-
-  adapter_ref2.reset();  // Not the last reference.
-  EXPECT_TRUE(adapter_ref->GetAdapterForTesting()->is_initialized());
-  EXPECT_EQ(1u, map_->GetLocalTrackCount());
-
-  // Destroying all references to the adapter should remove it from the map and
-  // dispose it.
-  adapter_ref.reset();
-  EXPECT_EQ(0u, map_->GetLocalTrackCount());
-  EXPECT_EQ(nullptr, map_->GetLocalTrackAdapter(web_track));
-  // Allow the disposing of track to occur.
-  RunMessageLoopsUntilIdle();
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapTest, AddAndRemoveRemoteTrackAdapter) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("remote_track");
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> adapter_ref =
-      GetOrCreateRemoteTrackAdapter(webrtc_track.get());
-  EXPECT_TRUE(adapter_ref->is_initialized());
-  EXPECT_EQ(
-      adapter_ref->GetAdapterForTesting(),
-      map_->GetRemoteTrackAdapter(webrtc_track.get())->GetAdapterForTesting());
-  EXPECT_EQ(1u, map_->GetRemoteTrackCount());
-
-  // "GetOrCreate" for already existing track.
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> adapter_ref2 =
-      GetOrCreateRemoteTrackAdapter(webrtc_track.get());
-  EXPECT_EQ(adapter_ref->GetAdapterForTesting(),
-            adapter_ref2->GetAdapterForTesting());
-  EXPECT_EQ(1u, map_->GetRemoteTrackCount());
-
-  adapter_ref2.reset();  // Not the last reference.
-  EXPECT_TRUE(adapter_ref->GetAdapterForTesting()->is_initialized());
-  EXPECT_EQ(1u, map_->GetRemoteTrackCount());
-
-  // Destroying all references to the adapter should remove it from the map and
-  // dispose it.
-  adapter_ref.reset();
-  EXPECT_EQ(0u, map_->GetRemoteTrackCount());
-  EXPECT_EQ(nullptr, map_->GetRemoteTrackAdapter(webrtc_track.get()));
-  // Allow the disposing of track to occur.
-  RunMessageLoopsUntilIdle();
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapTest,
-       InitializeRemoteTrackAdapterExplicitly) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("remote_track");
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> adapter_ref =
-      GetOrCreateRemoteTrackAdapter(webrtc_track.get(), false);
-  EXPECT_FALSE(adapter_ref->is_initialized());
-  adapter_ref->InitializeOnMainThread();
-  EXPECT_TRUE(adapter_ref->is_initialized());
-
-  EXPECT_EQ(1u, map_->GetRemoteTrackCount());
-  // Ensure the implicit initialization's posted task is run after it is already
-  // initialized.
-  RunMessageLoopsUntilIdle();
-  // Destroying all references to the adapter should remove it from the map and
-  // dispose it.
-  adapter_ref.reset();
-  EXPECT_EQ(0u, map_->GetRemoteTrackCount());
-  EXPECT_EQ(nullptr, map_->GetRemoteTrackAdapter(webrtc_track.get()));
-  // Allow the disposing of track to occur.
-  RunMessageLoopsUntilIdle();
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapTest,
-       LocalAndRemoteTrackAdaptersWithSameID) {
-  // Local and remote tracks should be able to use the same id without conflict.
-  const char* id = "id";
-
-  blink::WebMediaStreamTrack local_web_track = CreateLocalTrack(id);
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> local_adapter =
-      map_->GetOrCreateLocalTrackAdapter(local_web_track);
-  EXPECT_TRUE(local_adapter->is_initialized());
-  EXPECT_EQ(
-      local_adapter->GetAdapterForTesting(),
-      map_->GetLocalTrackAdapter(local_web_track)->GetAdapterForTesting());
-  EXPECT_EQ(1u, map_->GetLocalTrackCount());
-
-  scoped_refptr<MockWebRtcAudioTrack> remote_webrtc_track =
-      MockWebRtcAudioTrack::Create(id);
-  std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef> remote_adapter =
-      GetOrCreateRemoteTrackAdapter(remote_webrtc_track.get());
-  EXPECT_TRUE(remote_adapter->is_initialized());
-  EXPECT_EQ(remote_adapter->GetAdapterForTesting(),
-            map_->GetRemoteTrackAdapter(remote_webrtc_track.get())
-                ->GetAdapterForTesting());
-  EXPECT_NE(local_adapter->GetAdapterForTesting(),
-            remote_adapter->GetAdapterForTesting());
-  EXPECT_EQ(1u, map_->GetRemoteTrackCount());
-
-  // Destroying all references to the adapters should remove them from the map.
-  local_adapter.reset();
-  remote_adapter.reset();
-  EXPECT_EQ(0u, map_->GetLocalTrackCount());
-  EXPECT_EQ(0u, map_->GetRemoteTrackCount());
-  EXPECT_EQ(nullptr, map_->GetLocalTrackAdapter(local_web_track));
-  EXPECT_EQ(nullptr, map_->GetRemoteTrackAdapter(remote_webrtc_track.get()));
-  // Allow the disposing of tracks to occur.
-  RunMessageLoopsUntilIdle();
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapTest, GetMissingLocalTrackAdapter) {
-  blink::WebMediaStreamTrack local_web_track = CreateLocalTrack("missing");
-  EXPECT_EQ(nullptr, map_->GetLocalTrackAdapter(local_web_track));
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapTest, GetMissingRemoteTrackAdapter) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("missing");
-  EXPECT_EQ(nullptr, map_->GetRemoteTrackAdapter(webrtc_track.get()));
-}
-
-// Continuously calls GetOrCreateLocalTrackAdapter() on the main thread and
-// GetOrCreateRemoteTrackAdapter() on the signaling thread hoping to hit
-// deadlocks if the operations were to synchronize with the other thread while
-// holding the lock.
-//
-// Note that this deadlock has been notoriously difficult to reproduce. This
-// test is added as an attempt to guard against this type of regression, but do
-// not trust that if this test passes there is no risk of deadlock.
-class WebRtcMediaStreamTrackAdapterMapStressTest
-    : public WebRtcMediaStreamTrackAdapterMapTest {
- public:
-  WebRtcMediaStreamTrackAdapterMapStressTest()
-      : WebRtcMediaStreamTrackAdapterMapTest(), remaining_iterations_(0u) {}
-
-  void RunStressTest(size_t iterations) {
-    base::RunLoop run_loop;
-    remaining_iterations_ = iterations;
-    PostSignalingThreadLoop();
-    MainThreadLoop(&run_loop);
-    run_loop.Run();
-    // The run loop ensures all operations have began executing, but does not
-    // guarantee that all of them are complete, i.e. that track adapters have
-    // been fully initialized and subequently disposed. For that we need to run
-    // until idle or else we may tear down the test prematurely.
-    RunMessageLoopsUntilIdle();
-  }
-
-  void MainThreadLoop(base::RunLoop* run_loop) {
-    for (size_t i = 0u; i < 5u; ++i) {
-      map_->GetOrCreateLocalTrackAdapter(CreateLocalTrack("local_track_id"));
-    }
-    if (--remaining_iterations_ > 0) {
-      PostSignalingThreadLoop();
-      PostMainThreadLoop(run_loop);
-    } else {
-      // We are now done, but there may still be operations pending to execute
-      // on signaling thread so we perform Quit() in a post to the signaling
-      // thread. This ensures that Quit() is called after all operations have
-      // began executing (but does not guarantee that all operations have
-      // completed).
-      signaling_thread()->PostTask(
-          FROM_HERE,
-          base::BindOnce(&WebRtcMediaStreamTrackAdapterMapStressTest::
-                             QuitRunLoopOnSignalingThread,
-                         base::Unretained(this), base::Unretained(run_loop)));
-    }
-  }
-
-  void PostMainThreadLoop(base::RunLoop* run_loop) {
-    main_thread_->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &WebRtcMediaStreamTrackAdapterMapStressTest::MainThreadLoop,
-            base::Unretained(this), base::Unretained(run_loop)));
-  }
-
-  void SignalingThreadLoop() {
-    std::vector<std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>>
-        track_refs;
-    for (size_t i = 0u; i < 5u; ++i) {
-      track_refs.push_back(map_->GetOrCreateRemoteTrackAdapter(
-          MockWebRtcAudioTrack::Create("remote_track_id")));
-    }
-    main_thread_->PostTask(
-        FROM_HERE,
-        base::BindOnce(&WebRtcMediaStreamTrackAdapterMapStressTest::
-                           DestroyAdapterRefsOnMainThread,
-                       base::Unretained(this), std::move(track_refs)));
-  }
-
-  void PostSignalingThreadLoop() {
-    signaling_thread()->PostTask(
-        FROM_HERE,
-        base::BindOnce(
-            &WebRtcMediaStreamTrackAdapterMapStressTest::SignalingThreadLoop,
-            base::Unretained(this)));
-  }
-
-  void DestroyAdapterRefsOnMainThread(
-      std::vector<std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>>
-          track_refs) {}
-
-  void QuitRunLoopOnSignalingThread(base::RunLoop* run_loop) {
-    run_loop->Quit();
-  }
-
- private:
-  size_t remaining_iterations_;
-};
-
-TEST_F(WebRtcMediaStreamTrackAdapterMapStressTest, StressTest) {
-  const size_t kNumStressTestIterations = 1000u;
-  RunStressTest(kNumStressTestIterations);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_unittest.cc b/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_unittest.cc
deleted file mode 100644
index f6f9f0221d5..00000000000
--- a/chromium/content/renderer/media/webrtc/webrtc_media_stream_track_adapter_unittest.cc
+++ /dev/null
@@ -1,271 +0,0 @@
-// Copyright (c) 2017 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter.h"
-
-#include <memory>
-
-#include "base/bind.h"
-#include "base/memory/ref_counted.h"
-#include "base/run_loop.h"
-#include "base/single_thread_task_runner.h"
-#include "base/synchronization/waitable_event.h"
-#include "base/test/task_environment.h"
-#include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
-#include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
-#include "third_party/blink/public/platform/web_media_stream_source.h"
-#include "third_party/blink/public/platform/web_media_stream_track.h"
-#include "third_party/blink/public/platform/web_string.h"
-#include "third_party/blink/public/web/modules/mediastream/media_stream_video_track.h"
-#include "third_party/blink/public/web/modules/mediastream/mock_media_stream_video_source.h"
-#include "third_party/blink/public/web/web_heap.h"
-
-namespace content {
-
-class WebRtcMediaStreamTrackAdapterTest : public ::testing::Test {
- public:
-  void SetUp() override {
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
-    main_thread_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-  }
-
-  void TearDown() override {
-    if (track_adapter_) {
-      EXPECT_TRUE(track_adapter_->is_initialized());
-      track_adapter_->Dispose();
-      track_adapter_ = nullptr;
-      RunMessageLoopsUntilIdle();
-    }
-    blink::WebHeap::CollectAllGarbageForTesting();
-  }
-
-  blink::WebMediaStreamTrack CreateLocalAudioTrack() {
-    blink::WebMediaStreamSource web_source;
-    web_source.Initialize(blink::WebString::FromUTF8("local_audio_id"),
-                          blink::WebMediaStreamSource::kTypeAudio,
-                          blink::WebString::FromUTF8("local_audio_track"),
-                          false);
-    blink::MediaStreamAudioSource* audio_source =
-        new blink::MediaStreamAudioSource(
-            blink::scheduler::GetSingleThreadTaskRunnerForTesting(), true);
-    // Takes ownership of |audio_source|.
-    web_source.SetPlatformSource(base::WrapUnique(audio_source));
-
-    blink::WebMediaStreamTrack web_track;
-    web_track.Initialize(web_source.Id(), web_source);
-    audio_source->ConnectToTrack(web_track);
-    return web_track;
-  }
-
-  blink::WebMediaStreamTrack CreateLocalVideoTrack() {
-    blink::WebMediaStreamSource web_source;
-    web_source.Initialize(blink::WebString::FromUTF8("local_video_id"),
-                          blink::WebMediaStreamSource::kTypeVideo,
-                          blink::WebString::FromUTF8("local_video_track"),
-                          false);
-    blink::MockMediaStreamVideoSource* video_source =
-        new blink::MockMediaStreamVideoSource();
-    // Takes ownership of |video_source|.
-    web_source.SetPlatformSource(base::WrapUnique(video_source));
-
-    return blink::MediaStreamVideoTrack::CreateVideoTrack(
-        video_source, blink::MediaStreamVideoSource::ConstraintsCallback(),
-        true);
-  }
-
-  void CreateRemoteTrackAdapter(
-      webrtc::MediaStreamTrackInterface* webrtc_track) {
-    track_adapter_ = WebRtcMediaStreamTrackAdapter::CreateRemoteTrackAdapter(
-        dependency_factory_.get(), main_thread_, webrtc_track);
-  }
-
-  void HoldOntoAdapterReference(
-      base::WaitableEvent* waitable_event,
-      scoped_refptr<WebRtcMediaStreamTrackAdapter> adapter) {
-    waitable_event->Wait();
-  }
-
-  // Runs message loops on the webrtc signaling thread and optionally the main
-  // thread until idle.
-  void RunMessageLoopsUntilIdle(bool run_loop_on_main_thread = true) {
-    base::WaitableEvent waitable_event(
-        base::WaitableEvent::ResetPolicy::MANUAL,
-        base::WaitableEvent::InitialState::NOT_SIGNALED);
-    dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-        FROM_HERE, base::BindOnce(&WebRtcMediaStreamTrackAdapterTest::
-                                      RunMessageLoopUntilIdleOnSignalingThread,
-                                  base::Unretained(this), &waitable_event));
-    waitable_event.Wait();
-    if (run_loop_on_main_thread)
-      base::RunLoop().RunUntilIdle();
-  }
-
-  void RunMessageLoopUntilIdleOnSignalingThread(
-      base::WaitableEvent* waitable_event) {
-    DCHECK(dependency_factory_->GetWebRtcSignalingThread()
-               ->BelongsToCurrentThread());
-    base::RunLoop().RunUntilIdle();
-    waitable_event->Signal();
-  }
-
- protected:
-  // The TaskEnvironment prevents the ChildProcess from leaking a
-  // ThreadPool.
-  base::test::TaskEnvironment task_environment_;
-  ChildProcess child_process_;
-
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
-  scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapter> track_adapter_;
-};
-
-TEST_F(WebRtcMediaStreamTrackAdapterTest, LocalAudioTrack) {
-  track_adapter_ = WebRtcMediaStreamTrackAdapter::CreateLocalTrackAdapter(
-      dependency_factory_.get(), main_thread_, CreateLocalAudioTrack());
-  EXPECT_TRUE(track_adapter_->is_initialized());
-  EXPECT_TRUE(!track_adapter_->web_track().IsNull());
-  EXPECT_EQ(track_adapter_->web_track().Source().GetType(),
-            blink::WebMediaStreamSource::kTypeAudio);
-  EXPECT_TRUE(track_adapter_->webrtc_track());
-  EXPECT_EQ(track_adapter_->webrtc_track()->kind(),
-            webrtc::MediaStreamTrackInterface::kAudioKind);
-  EXPECT_EQ(track_adapter_->webrtc_track()->id().c_str(),
-            track_adapter_->web_track().Id());
-  EXPECT_TRUE(track_adapter_->GetLocalTrackAudioSinkForTesting());
-  EXPECT_EQ(
-      track_adapter_->GetLocalTrackAudioSinkForTesting()->webrtc_audio_track(),
-      track_adapter_->webrtc_track());
-}
-
-// Flaky, see https://crbug.com/982200.
-TEST_F(WebRtcMediaStreamTrackAdapterTest, DISABLED_LocalVideoTrack) {
-  track_adapter_ = WebRtcMediaStreamTrackAdapter::CreateLocalTrackAdapter(
-      dependency_factory_.get(), main_thread_, CreateLocalVideoTrack());
-  EXPECT_TRUE(track_adapter_->is_initialized());
-  EXPECT_TRUE(!track_adapter_->web_track().IsNull());
-  EXPECT_EQ(track_adapter_->web_track().Source().GetType(),
-            blink::WebMediaStreamSource::kTypeVideo);
-  EXPECT_TRUE(track_adapter_->webrtc_track());
-  EXPECT_EQ(track_adapter_->webrtc_track()->kind(),
-            webrtc::MediaStreamTrackInterface::kVideoKind);
-  EXPECT_EQ(track_adapter_->webrtc_track()->id().c_str(),
-            track_adapter_->web_track().Id());
-  EXPECT_TRUE(track_adapter_->GetLocalTrackVideoSinkForTesting());
-  EXPECT_EQ(
-      track_adapter_->GetLocalTrackVideoSinkForTesting()->webrtc_video_track(),
-      track_adapter_->webrtc_track());
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterTest, RemoteAudioTrack) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("remote_audio_track");
-  dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &WebRtcMediaStreamTrackAdapterTest::CreateRemoteTrackAdapter,
-          base::Unretained(this), base::Unretained(webrtc_track.get())));
-  // The adapter is initialized implicitly in a PostTask, allow it to run.
-  RunMessageLoopsUntilIdle();
-  DCHECK(track_adapter_);
-  EXPECT_TRUE(track_adapter_->is_initialized());
-  EXPECT_TRUE(!track_adapter_->web_track().IsNull());
-  EXPECT_EQ(track_adapter_->web_track().Source().GetType(),
-            blink::WebMediaStreamSource::kTypeAudio);
-  EXPECT_TRUE(track_adapter_->webrtc_track());
-  EXPECT_EQ(track_adapter_->webrtc_track()->kind(),
-            webrtc::MediaStreamTrackInterface::kAudioKind);
-  EXPECT_EQ(track_adapter_->webrtc_track()->id().c_str(),
-            track_adapter_->web_track().Id());
-  EXPECT_TRUE(track_adapter_->GetRemoteAudioTrackAdapterForTesting());
-  EXPECT_TRUE(
-      track_adapter_->GetRemoteAudioTrackAdapterForTesting()->initialized());
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterTest, RemoteVideoTrack) {
-  scoped_refptr<MockWebRtcVideoTrack> webrtc_track =
-      MockWebRtcVideoTrack::Create("remote_video_track");
-  dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &WebRtcMediaStreamTrackAdapterTest::CreateRemoteTrackAdapter,
-          base::Unretained(this), base::Unretained(webrtc_track.get())));
-  // The adapter is initialized implicitly in a PostTask, allow it to run.
-  RunMessageLoopsUntilIdle();
-  DCHECK(track_adapter_);
-  EXPECT_TRUE(track_adapter_->is_initialized());
-  EXPECT_TRUE(!track_adapter_->web_track().IsNull());
-  EXPECT_EQ(track_adapter_->web_track().Source().GetType(),
-            blink::WebMediaStreamSource::kTypeVideo);
-  EXPECT_TRUE(track_adapter_->webrtc_track());
-  EXPECT_EQ(track_adapter_->webrtc_track()->kind(),
-            webrtc::MediaStreamTrackInterface::kVideoKind);
-  EXPECT_EQ(track_adapter_->webrtc_track()->id().c_str(),
-            track_adapter_->web_track().Id());
-  EXPECT_TRUE(track_adapter_->GetRemoteVideoTrackAdapterForTesting());
-  EXPECT_TRUE(
-      track_adapter_->GetRemoteVideoTrackAdapterForTesting()->initialized());
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterTest, RemoteTrackExplicitlyInitialized) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("remote_audio_track");
-  dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &WebRtcMediaStreamTrackAdapterTest::CreateRemoteTrackAdapter,
-          base::Unretained(this), base::Unretained(webrtc_track.get())));
-  // Wait for the CreateRemoteTrackAdapter() call, but don't run the main thread
-  // loop that would have implicitly initialized the adapter.
-  RunMessageLoopsUntilIdle(false);
-  DCHECK(track_adapter_);
-  EXPECT_FALSE(track_adapter_->is_initialized());
-  // Explicitly initialize before the main thread loop has a chance to run.
-  track_adapter_->InitializeOnMainThread();
-  EXPECT_TRUE(track_adapter_->is_initialized());
-  EXPECT_TRUE(!track_adapter_->web_track().IsNull());
-  EXPECT_EQ(track_adapter_->web_track().Source().GetType(),
-            blink::WebMediaStreamSource::kTypeAudio);
-  EXPECT_TRUE(track_adapter_->webrtc_track());
-  EXPECT_EQ(track_adapter_->webrtc_track()->kind(),
-            webrtc::MediaStreamTrackInterface::kAudioKind);
-  EXPECT_EQ(track_adapter_->webrtc_track()->id().c_str(),
-            track_adapter_->web_track().Id());
-  EXPECT_TRUE(track_adapter_->GetRemoteAudioTrackAdapterForTesting());
-  EXPECT_TRUE(
-      track_adapter_->GetRemoteAudioTrackAdapterForTesting()->initialized());
-}
-
-TEST_F(WebRtcMediaStreamTrackAdapterTest, LastReferenceOnSignalingThread) {
-  scoped_refptr<MockWebRtcAudioTrack> webrtc_track =
-      MockWebRtcAudioTrack::Create("remote_audio_track");
-  dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &WebRtcMediaStreamTrackAdapterTest::CreateRemoteTrackAdapter,
-          base::Unretained(this), base::Unretained(webrtc_track.get())));
-  // The adapter is initialized implicitly in a PostTask, allow it to run.
-  RunMessageLoopsUntilIdle();
-  DCHECK(track_adapter_);
-  EXPECT_TRUE(track_adapter_->is_initialized());
-
-  base::WaitableEvent waitable_event(
-      base::WaitableEvent::ResetPolicy::MANUAL,
-      base::WaitableEvent::InitialState::NOT_SIGNALED);
-  dependency_factory_->GetWebRtcSignalingThread()->PostTask(
-      FROM_HERE,
-      base::BindOnce(
-          &WebRtcMediaStreamTrackAdapterTest::HoldOntoAdapterReference,
-          base::Unretained(this), base::Unretained(&waitable_event),
-          track_adapter_));
-  // Clear last reference on main thread.
-  track_adapter_->Dispose();
-  track_adapter_ = nullptr;
-  waitable_event.Signal();
-  RunMessageLoopsUntilIdle();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.cc b/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.cc
index bb3a737f57b..7054b20ca11 100644
--- a/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.cc
+++ b/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.cc
@@ -37,7 +37,8 @@ WebRtcSetDescriptionObserverHandlerImpl::
         scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
         scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
         scoped_refptr<webrtc::PeerConnectionInterface> pc,
-        scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+        scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap>
+            track_adapter_map,
         scoped_refptr<WebRtcSetDescriptionObserver> observer,
         bool surface_receivers_only)
     : main_task_runner_(std::move(main_task_runner)),
@@ -59,19 +60,19 @@ void WebRtcSetDescriptionObserverHandlerImpl::OnSetDescriptionComplete(
   // Only surface transceiver/receiver states if the peer connection is not
   // closed. If the peer connection is closed, the peer connection handler may
   // have been destroyed along with any track adapters that
-  // TransceiverStateSurfacer assumes exist. This is treated as a special case
-  // due to https://crbug.com/897251.
+  // blink::TransceiverStateSurfacer assumes exist. This is treated as a special
+  // case due to https://crbug.com/897251.
   if (pc_->signaling_state() != webrtc::PeerConnectionInterface::kClosed) {
     if (surface_receivers_only_) {
       for (const auto& receiver : pc_->GetReceivers()) {
-        transceivers.push_back(new SurfaceReceiverStateOnly(receiver));
+        transceivers.push_back(new blink::SurfaceReceiverStateOnly(receiver));
       }
     } else {
       transceivers = pc_->GetTransceivers();
     }
   }
-  TransceiverStateSurfacer transceiver_state_surfacer(main_task_runner_,
-                                                      signaling_task_runner_);
+  blink::TransceiverStateSurfacer transceiver_state_surfacer(
+      main_task_runner_, signaling_task_runner_);
   transceiver_state_surfacer.Initialize(pc_, track_adapter_map_,
                                         std::move(transceivers));
   main_task_runner_->PostTask(
@@ -85,7 +86,7 @@ void WebRtcSetDescriptionObserverHandlerImpl::
     OnSetDescriptionCompleteOnMainThread(
         webrtc::RTCError error,
         webrtc::PeerConnectionInterface::SignalingState signaling_state,
-        TransceiverStateSurfacer transceiver_state_surfacer) {
+        blink::TransceiverStateSurfacer transceiver_state_surfacer) {
   CHECK(main_task_runner_->BelongsToCurrentThread());
   WebRtcSetDescriptionObserver::States states;
   states.signaling_state = signaling_state;
@@ -100,7 +101,7 @@ WebRtcSetLocalDescriptionObserverHandler::Create(
     scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
     scoped_refptr<webrtc::PeerConnectionInterface> pc,
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+    scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
     scoped_refptr<WebRtcSetDescriptionObserver> observer,
     bool surface_receivers_only) {
   return new rtc::RefCountedObject<WebRtcSetLocalDescriptionObserverHandler>(
@@ -114,7 +115,8 @@ WebRtcSetLocalDescriptionObserverHandler::
         scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
         scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
         scoped_refptr<webrtc::PeerConnectionInterface> pc,
-        scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+        scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap>
+            track_adapter_map,
         scoped_refptr<WebRtcSetDescriptionObserver> observer,
         bool surface_receivers_only)
     : handler_impl_(new WebRtcSetDescriptionObserverHandlerImpl(
@@ -142,7 +144,7 @@ WebRtcSetRemoteDescriptionObserverHandler::Create(
     scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
     scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
     scoped_refptr<webrtc::PeerConnectionInterface> pc,
-    scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+    scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
     scoped_refptr<WebRtcSetDescriptionObserver> observer,
     bool surface_receivers_only) {
   return new rtc::RefCountedObject<WebRtcSetRemoteDescriptionObserverHandler>(
@@ -156,7 +158,8 @@ WebRtcSetRemoteDescriptionObserverHandler::
         scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
         scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
         scoped_refptr<webrtc::PeerConnectionInterface> pc,
-        scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+        scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap>
+            track_adapter_map,
         scoped_refptr<WebRtcSetDescriptionObserver> observer,
         bool surface_receivers_only)
     : handler_impl_(new WebRtcSetDescriptionObserverHandlerImpl(
diff --git a/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.h b/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.h
index 7d8acefbc5d..d927ac1d6e7 100644
--- a/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.h
+++ b/chromium/content/renderer/media/webrtc/webrtc_set_description_observer.h
@@ -14,11 +14,11 @@
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/common/content_export.h"
 #include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
-#include "content/renderer/media/webrtc/rtc_rtp_receiver.h"
-#include "content/renderer/media/webrtc/rtc_rtp_sender.h"
-#include "content/renderer/media/webrtc/rtc_rtp_transceiver.h"
-#include "content/renderer/media/webrtc/transceiver_state_surfacer.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
+#include "third_party/blink/public/web/modules/peerconnection/rtc_rtp_receiver_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/rtc_rtp_sender_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/rtc_rtp_transceiver_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/transceiver_state_surfacer.h"
+#include "third_party/blink/public/web/modules/peerconnection/webrtc_media_stream_track_adapter_map.h"
 #include "third_party/webrtc/api/jsep.h"
 #include "third_party/webrtc/api/peer_connection_interface.h"
 #include "third_party/webrtc/api/rtc_error.h"
@@ -50,7 +50,7 @@ class CONTENT_EXPORT WebRtcSetDescriptionObserver
 
     webrtc::PeerConnectionInterface::SignalingState signaling_state;
     blink::WebRTCSctpTransportSnapshot sctp_transport_state;
-    std::vector<RtpTransceiverState> transceiver_states;
+    std::vector<blink::RtpTransceiverState> transceiver_states;
 
     DISALLOW_COPY_AND_ASSIGN(States);
   };
@@ -88,7 +88,7 @@ class CONTENT_EXPORT WebRtcSetDescriptionObserverHandlerImpl
       scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
       scoped_refptr<webrtc::PeerConnectionInterface> pc,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+      scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
       scoped_refptr<WebRtcSetDescriptionObserver> observer,
       bool surface_receivers_only);
 
@@ -104,12 +104,12 @@ class CONTENT_EXPORT WebRtcSetDescriptionObserverHandlerImpl
   void OnSetDescriptionCompleteOnMainThread(
       webrtc::RTCError error,
       webrtc::PeerConnectionInterface::SignalingState signaling_state,
-      TransceiverStateSurfacer transceiver_state_surfacer);
+      blink::TransceiverStateSurfacer transceiver_state_surfacer);
 
   scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
   scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner_;
   scoped_refptr<webrtc::PeerConnectionInterface> pc_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
+  scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
   scoped_refptr<WebRtcSetDescriptionObserver> observer_;
   bool surface_receivers_only_;
 
@@ -125,7 +125,7 @@ class CONTENT_EXPORT WebRtcSetLocalDescriptionObserverHandler
       scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
       scoped_refptr<webrtc::PeerConnectionInterface> pc,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+      scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
       scoped_refptr<WebRtcSetDescriptionObserver> observer,
       bool surface_receivers_only);
 
@@ -139,7 +139,7 @@ class CONTENT_EXPORT WebRtcSetLocalDescriptionObserverHandler
       scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
       scoped_refptr<webrtc::PeerConnectionInterface> pc,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+      scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
       scoped_refptr<WebRtcSetDescriptionObserver> observer,
       bool surface_receivers_only);
   ~WebRtcSetLocalDescriptionObserverHandler() override;
@@ -158,7 +158,7 @@ class CONTENT_EXPORT WebRtcSetRemoteDescriptionObserverHandler
       scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
       scoped_refptr<webrtc::PeerConnectionInterface> pc,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+      scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
       scoped_refptr<WebRtcSetDescriptionObserver> observer,
       bool surface_receivers_only);
 
@@ -172,7 +172,7 @@ class CONTENT_EXPORT WebRtcSetRemoteDescriptionObserverHandler
       scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
       scoped_refptr<webrtc::PeerConnectionInterface> pc,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+      scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
       scoped_refptr<WebRtcSetDescriptionObserver> observer,
       bool surface_receivers_only);
   ~WebRtcSetRemoteDescriptionObserverHandler() override;
diff --git a/chromium/content/renderer/media/webrtc/webrtc_set_description_observer_unittest.cc b/chromium/content/renderer/media/webrtc/webrtc_set_description_observer_unittest.cc
index ea3e3d77dc3..de38efa169f 100644
--- a/chromium/content/renderer/media/webrtc/webrtc_set_description_observer_unittest.cc
+++ b/chromium/content/renderer/media/webrtc/webrtc_set_description_observer_unittest.cc
@@ -15,13 +15,13 @@
 #include "base/test/task_environment.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/child/child_process.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/mock_peer_connection_impl.h"
-#include "content/renderer/media/webrtc/webrtc_media_stream_track_adapter_map.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/platform/modules/mediastream/media_stream_audio_source.h"
 #include "third_party/blink/public/platform/modules/peerconnection/webrtc_util.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_dependency_factory.h"
+#include "third_party/blink/public/web/modules/peerconnection/mock_peer_connection_impl.h"
+#include "third_party/blink/public/web/modules/peerconnection/webrtc_media_stream_track_adapter_map.h"
 #include "third_party/blink/public/web/web_heap.h"
 #include "third_party/webrtc/api/peer_connection_interface.h"
 #include "third_party/webrtc/api/test/mock_peerconnectioninterface.h"
@@ -78,7 +78,7 @@ class ObserverHandlerWrapper {
       scoped_refptr<base::SingleThreadTaskRunner> main_task_runner,
       scoped_refptr<base::SingleThreadTaskRunner> signaling_task_runner,
       scoped_refptr<webrtc::PeerConnectionInterface> pc,
-      scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
+      scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map,
       scoped_refptr<WebRtcSetDescriptionObserver> observer,
       bool surface_receivers_only)
       : signaling_task_runner_(std::move(signaling_task_runner)),
@@ -224,14 +224,14 @@ class WebRtcSetDescriptionObserverHandlerTest
 
   void SetUp() override {
     pc_ = new webrtc::MockPeerConnectionInterface;
-    dependency_factory_.reset(new MockPeerConnectionDependencyFactory());
+    dependency_factory_.reset(new blink::MockPeerConnectionDependencyFactory());
     main_thread_ = blink::scheduler::GetSingleThreadTaskRunnerForTesting();
-    track_adapter_map_ = new WebRtcMediaStreamTrackAdapterMap(
+    track_adapter_map_ = new blink::WebRtcMediaStreamTrackAdapterMap(
         dependency_factory_.get(), main_thread_);
     observer_ = new WebRtcSetDescriptionObserverForTest();
     observer_handler_ = std::make_unique<ObserverHandlerWrapper>(
         handler_type_, main_thread_,
-        dependency_factory_->GetWebRtcSignalingThread(), pc_,
+        dependency_factory_->GetWebRtcSignalingTaskRunner(), pc_,
         track_adapter_map_, observer_,
         surfacer_type_ == StateSurfacerType::kReceiversOnly);
   }
@@ -263,8 +263,8 @@ class WebRtcSetDescriptionObserverHandlerTest
         track_adapter_map_->GetOrCreateLocalTrackAdapter(web_local_track);
     scoped_refptr<webrtc::MediaStreamTrackInterface> local_track =
         local_track_adapter->webrtc_track();
-    rtc::scoped_refptr<FakeRtpSender> sender(
-        new rtc::RefCountedObject<FakeRtpSender>(
+    rtc::scoped_refptr<blink::FakeRtpSender> sender(
+        new rtc::RefCountedObject<blink::FakeRtpSender>(
             local_track.get(), std::vector<std::string>({"local_stream"})));
     // A requirement of WebRtcSet[Local/Remote]DescriptionObserverHandler is
     // that local tracks have existing track adapters when the callback is
@@ -272,17 +272,17 @@ class WebRtcSetDescriptionObserverHandlerTest
     // Here in testing, we ensure it by adding it to |local_track_adapters_|.
     local_track_adapters_.push_back(std::move(local_track_adapter));
 
-    scoped_refptr<MockWebRtcAudioTrack> remote_track =
-        MockWebRtcAudioTrack::Create("remote_track");
+    scoped_refptr<blink::MockWebRtcAudioTrack> remote_track =
+        blink::MockWebRtcAudioTrack::Create("remote_track");
     scoped_refptr<webrtc::MediaStreamInterface> remote_stream(
-        new rtc::RefCountedObject<MockMediaStream>("remote_stream"));
-    rtc::scoped_refptr<FakeRtpReceiver> receiver(
-        new rtc::RefCountedObject<FakeRtpReceiver>(
+        new rtc::RefCountedObject<blink::MockMediaStream>("remote_stream"));
+    rtc::scoped_refptr<blink::FakeRtpReceiver> receiver(
+        new rtc::RefCountedObject<blink::FakeRtpReceiver>(
             remote_track.get(),
             std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>(
                 {remote_stream.get()})));
     rtc::scoped_refptr<webrtc::RtpTransceiverInterface> transceiver(
-        new rtc::RefCountedObject<FakeRtpTransceiver>(
+        new rtc::RefCountedObject<blink::FakeRtpTransceiver>(
             cricket::MEDIA_TYPE_AUDIO, sender, receiver, base::nullopt, false,
             webrtc::RtpTransceiverDirection::kSendRecv, base::nullopt));
     transceivers_.push_back(transceiver);
@@ -297,7 +297,7 @@ class WebRtcSetDescriptionObserverHandlerTest
     auto sender = transceiver->sender();
     auto receiver = transceiver->receiver();
     EXPECT_EQ(1u, observer_->states().transceiver_states.size());
-    const RtpTransceiverState& transceiver_state =
+    const blink::RtpTransceiverState& transceiver_state =
         observer_->states().transceiver_states[0];
     // Inspect transceiver states.
     EXPECT_TRUE(transceiver_state.is_initialized());
@@ -312,14 +312,15 @@ class WebRtcSetDescriptionObserverHandlerTest
                                       transceiver->fired_direction()));
     // Inspect sender states.
     EXPECT_TRUE(transceiver_state.sender_state());
-    const RtpSenderState& sender_state = *transceiver_state.sender_state();
+    const blink::RtpSenderState& sender_state =
+        *transceiver_state.sender_state();
     EXPECT_TRUE(sender_state.is_initialized());
     EXPECT_EQ(sender.get(), sender_state.webrtc_sender());
     EXPECT_EQ(sender->track(), sender_state.track_ref()->webrtc_track());
     EXPECT_EQ(sender->stream_ids(), sender_state.stream_ids());
     // Inspect receiver states.
     EXPECT_TRUE(transceiver_state.receiver_state());
-    const RtpReceiverState& receiver_state =
+    const blink::RtpReceiverState& receiver_state =
         *transceiver_state.receiver_state();
     EXPECT_TRUE(receiver_state.is_initialized());
     EXPECT_EQ(receiver.get(), receiver_state.webrtc_receiver());
@@ -330,12 +331,12 @@ class WebRtcSetDescriptionObserverHandlerTest
   void CreateReceivers() {
     ASSERT_EQ(StateSurfacerType::kReceiversOnly, surfacer_type_);
 
-    scoped_refptr<MockWebRtcAudioTrack> remote_track =
-        MockWebRtcAudioTrack::Create("remote_track");
+    scoped_refptr<blink::MockWebRtcAudioTrack> remote_track =
+        blink::MockWebRtcAudioTrack::Create("remote_track");
     scoped_refptr<webrtc::MediaStreamInterface> remote_stream(
-        new rtc::RefCountedObject<MockMediaStream>("remote_stream"));
+        new rtc::RefCountedObject<blink::MockMediaStream>("remote_stream"));
     rtc::scoped_refptr<webrtc::RtpReceiverInterface> receiver(
-        new rtc::RefCountedObject<FakeRtpReceiver>(
+        new rtc::RefCountedObject<blink::FakeRtpReceiver>(
             remote_track.get(),
             std::vector<rtc::scoped_refptr<webrtc::MediaStreamInterface>>(
                 {remote_stream.get()})));
@@ -349,11 +350,11 @@ class WebRtcSetDescriptionObserverHandlerTest
 
     auto receiver = receivers_[0];
     EXPECT_EQ(1u, observer_->states().transceiver_states.size());
-    const RtpTransceiverState& transceiver_state =
+    const blink::RtpTransceiverState& transceiver_state =
         observer_->states().transceiver_states[0];
     EXPECT_FALSE(transceiver_state.sender_state());
     EXPECT_TRUE(transceiver_state.receiver_state());
-    const RtpReceiverState& receiver_state =
+    const blink::RtpReceiverState& receiver_state =
         *transceiver_state.receiver_state();
     EXPECT_TRUE(receiver_state.is_initialized());
     EXPECT_EQ(receiver.get(), receiver_state.webrtc_receiver());
@@ -368,9 +369,10 @@ class WebRtcSetDescriptionObserverHandlerTest
   ChildProcess child_process_;
 
   scoped_refptr<webrtc::MockPeerConnectionInterface> pc_;
-  std::unique_ptr<MockPeerConnectionDependencyFactory> dependency_factory_;
+  std::unique_ptr<blink::MockPeerConnectionDependencyFactory>
+      dependency_factory_;
   scoped_refptr<base::SingleThreadTaskRunner> main_thread_;
-  scoped_refptr<WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
+  scoped_refptr<blink::WebRtcMediaStreamTrackAdapterMap> track_adapter_map_;
   scoped_refptr<WebRtcSetDescriptionObserverForTest> observer_;
 
   ObserverHandlerType handler_type_;
@@ -379,7 +381,8 @@ class WebRtcSetDescriptionObserverHandlerTest
 
   std::vector<rtc::scoped_refptr<webrtc::RtpTransceiverInterface>>
       transceivers_;
-  std::vector<std::unique_ptr<WebRtcMediaStreamTrackAdapterMap::AdapterRef>>
+  std::vector<
+      std::unique_ptr<blink::WebRtcMediaStreamTrackAdapterMap::AdapterRef>>
       local_track_adapters_;
   // Used instead of |transceivers_| when |surfacer_type_| is
   // StateSurfacerType::kReceiversOnly.
diff --git a/chromium/content/renderer/navigation_client.cc b/chromium/content/renderer/navigation_client.cc
index f8b7c83c4f5..3172486adfb 100644
--- a/chromium/content/renderer/navigation_client.cc
+++ b/chromium/content/renderer/navigation_client.cc
@@ -11,7 +11,7 @@
 namespace content {
 
 NavigationClient::NavigationClient(RenderFrameImpl* render_frame)
-    : navigation_client_binding_(this), render_frame_(render_frame) {}
+    : render_frame_(render_frame) {}
 
 NavigationClient::~NavigationClient() {}
 
@@ -36,9 +36,10 @@ void NavigationClient::CommitNavigation(
   // unexpectedly abort the ongoing navigation. Remove when the races are fixed.
   ResetDisconnectionHandler();
   render_frame_->CommitPerNavigationMojoInterfaceNavigation(
-      std::move(common_params), std::move(commit_params), response_head,
-      std::move(response_body), std::move(url_loader_client_endpoints),
-      std::move(subresource_loaders), std::move(subresource_overrides),
+      std::move(common_params), std::move(commit_params),
+      std::move(response_head), std::move(response_body),
+      std::move(url_loader_client_endpoints), std::move(subresource_loaders),
+      std::move(subresource_overrides),
       std::move(controller_service_worker_info), std::move(provider_info),
       std::move(prefetch_loader_factory), devtools_navigation_token,
       std::move(callback));
@@ -59,10 +60,11 @@ void NavigationClient::CommitFailedNavigation(
       std::move(subresource_loaders), std::move(callback));
 }
 
-void NavigationClient::Bind(mojom::NavigationClientAssociatedRequest request) {
-  navigation_client_binding_.Bind(
-      std::move(request), render_frame_->GetTaskRunner(
-                              blink::TaskType::kInternalNavigationAssociated));
+void NavigationClient::Bind(
+    mojo::PendingAssociatedReceiver<mojom::NavigationClient> receiver) {
+  navigation_client_receiver_.Bind(
+      std::move(receiver), render_frame_->GetTaskRunner(
+                               blink::TaskType::kInternalNavigationAssociated));
   SetDisconnectionHandler();
 }
 
@@ -72,12 +74,12 @@ void NavigationClient::MarkWasInitiatedInThisFrame() {
 }
 
 void NavigationClient::SetDisconnectionHandler() {
-  navigation_client_binding_.set_connection_error_handler(base::BindOnce(
+  navigation_client_receiver_.set_disconnect_handler(base::BindOnce(
       &NavigationClient::OnDroppedNavigation, base::Unretained(this)));
 }
 
 void NavigationClient::ResetDisconnectionHandler() {
-  navigation_client_binding_.set_connection_error_handler(base::DoNothing());
+  navigation_client_receiver_.set_disconnect_handler(base::DoNothing());
 }
 
 void NavigationClient::OnDroppedNavigation() {
diff --git a/chromium/content/renderer/navigation_client.h b/chromium/content/renderer/navigation_client.h
index 927e5f2f359..614a1c82fe3 100644
--- a/chromium/content/renderer/navigation_client.h
+++ b/chromium/content/renderer/navigation_client.h
@@ -6,7 +6,8 @@
 #define CONTENT_RENDERER_NAVIGATION_CLIENT_H_
 
 #include "content/common/navigation_client.mojom.h"
-#include "mojo/public/cpp/bindings/associated_binding.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
 
 namespace content {
 
@@ -43,7 +44,7 @@ class NavigationClient : mojom::NavigationClient {
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo> subresource_loaders,
       CommitFailedNavigationCallback callback) override;
 
-  void Bind(mojom::NavigationClientAssociatedRequest request);
+  void Bind(mojo::PendingAssociatedReceiver<mojom::NavigationClient> receiver);
 
   // See NavigationState::was_initiated_in_this_frame for details.
   void MarkWasInitiatedInThisFrame();
@@ -59,7 +60,8 @@ class NavigationClient : mojom::NavigationClient {
   void SetDisconnectionHandler();
   void ResetDisconnectionHandler();
 
-  mojo::AssociatedBinding<mojom::NavigationClient> navigation_client_binding_;
+  mojo::AssociatedReceiver<mojom::NavigationClient> navigation_client_receiver_{
+      this};
   RenderFrameImpl* render_frame_;
   bool was_initiated_in_this_frame_ = false;
 };
diff --git a/chromium/content/renderer/navigation_state.cc b/chromium/content/renderer/navigation_state.cc
index d32bfe45f47..ac6023ffa0d 100644
--- a/chromium/content/renderer/navigation_state.cc
+++ b/chromium/content/renderer/navigation_state.cc
@@ -87,8 +87,7 @@ NavigationState::NavigationState(
         per_navigation_mojo_interface_commit_callback,
     std::unique_ptr<NavigationClient> navigation_client,
     bool was_initiated_in_this_frame)
-    : request_committed_(false),
-      was_within_same_document_(false),
+    : was_within_same_document_(false),
       was_initiated_in_this_frame_(was_initiated_in_this_frame),
       is_content_initiated_(is_content_initiated),
       common_params_(std::move(common_params)),
diff --git a/chromium/content/renderer/navigation_state.h b/chromium/content/renderer/navigation_state.h
index 5d3b40db56f..af759431763 100644
--- a/chromium/content/renderer/navigation_state.h
+++ b/chromium/content/renderer/navigation_state.h
@@ -57,11 +57,9 @@ class CONTENT_EXPORT NavigationState {
   const mojom::CommitNavigationParams& commit_params() const {
     return *commit_params_;
   }
-  bool request_committed() const { return request_committed_; }
   bool uses_per_navigation_mojo_interface() const {
     return navigation_client_.get();
   }
-  void set_request_committed(bool value) { request_committed_ = value; }
   void set_was_within_same_document(bool value) {
     was_within_same_document_ = value;
   }
@@ -106,7 +104,6 @@ class CONTENT_EXPORT NavigationState {
       std::unique_ptr<NavigationClient> navigation_client,
       bool was_initiated_in_this_frame);
 
-  bool request_committed_;
   bool was_within_same_document_;
 
   // Indicates whether the navigation was initiated by the same RenderFrame
diff --git a/chromium/content/renderer/p2p/OWNERS b/chromium/content/renderer/p2p/OWNERS
deleted file mode 100644
index 70573c449d9..00000000000
--- a/chromium/content/renderer/p2p/OWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-sergeyu@chromium.org
-juberti@chromium.org
-
-# COMPONENT: Blink>WebRTC
diff --git a/chromium/content/renderer/p2p/empty_network_manager.cc b/chromium/content/renderer/p2p/empty_network_manager.cc
deleted file mode 100644
index 76165e2b5f4..00000000000
--- a/chromium/content/renderer/p2p/empty_network_manager.cc
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/empty_network_manager.h"
-
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/renderer/p2p/network_manager_uma.h"
-
-namespace content {
-
-EmptyNetworkManager::EmptyNetworkManager(rtc::NetworkManager* network_manager)
-    : network_manager_(network_manager) {
-  DCHECK(network_manager);
-  thread_checker_.DetachFromThread();
-  set_enumeration_permission(ENUMERATION_BLOCKED);
-  network_manager_->SignalNetworksChanged.connect(
-      this, &EmptyNetworkManager::OnNetworksChanged);
-}
-
-EmptyNetworkManager::~EmptyNetworkManager() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-}
-
-void EmptyNetworkManager::StartUpdating() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  ++start_count_;
-  network_manager_->StartUpdating();
-}
-
-void EmptyNetworkManager::StopUpdating() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  network_manager_->StopUpdating();
-  --start_count_;
-  DCHECK_GE(start_count_, 0);
-}
-
-void EmptyNetworkManager::GetNetworks(NetworkList* networks) const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  networks->clear();
-}
-
-bool EmptyNetworkManager::GetDefaultLocalAddress(
-    int family,
-    rtc::IPAddress* ipaddress) const {
-  return network_manager_->GetDefaultLocalAddress(family, ipaddress);
-}
-
-void EmptyNetworkManager::OnNetworksChanged() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  if (!start_count_)
-    return;
-
-  if (!sent_first_update_)
-    ReportIPPermissionStatus(PERMISSION_NOT_REQUESTED);
-
-  sent_first_update_ = true;
-  SignalNetworksChanged();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/empty_network_manager.h b/chromium/content/renderer/p2p/empty_network_manager.h
deleted file mode 100644
index 65220f46e78..00000000000
--- a/chromium/content/renderer/p2p/empty_network_manager.h
+++ /dev/null
@@ -1,69 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_EMPTY_NETWORK_MANAGER_H_
-#define CONTENT_RENDERER_P2P_EMPTY_NETWORK_MANAGER_H_
-
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-#include "base/threading/thread_checker.h"
-#include "content/common/content_export.h"
-#include "third_party/webrtc/rtc_base/network.h"
-#include "third_party/webrtc/rtc_base/third_party/sigslot/sigslot.h"
-
-namespace rtc {
-class IPAddress;
-}  // namespace rtc
-
-namespace content {
-
-// A NetworkManager implementation which handles the case where local address
-// enumeration is not requested and just returns empty network lists. This class
-// is not thread safe and should only be used by WebRTC's network thread.
-class EmptyNetworkManager : public rtc::NetworkManagerBase,
-                            public sigslot::has_slots<> {
- public:
-  // This class is created by WebRTC's signaling thread but used by WebRTC's
-  // worker thread |task_runner|.
-  CONTENT_EXPORT explicit EmptyNetworkManager(
-      rtc::NetworkManager* network_manager);
-  CONTENT_EXPORT ~EmptyNetworkManager() override;
-
-  // rtc::NetworkManager:
-  void StartUpdating() override;
-  void StopUpdating() override;
-  void GetNetworks(NetworkList* networks) const override;
-  bool GetDefaultLocalAddress(int family,
-                              rtc::IPAddress* ipaddress) const override;
-
- private:
-  // Receive callback from the wrapped NetworkManager when the underneath
-  // network list is changed.
-  //
-  // We wait for this so that we don't signal networks changed before we have
-  // default IP addresses.
-  void OnNetworksChanged();
-
-  base::ThreadChecker thread_checker_;
-
-  // Whether we have fired the first SignalNetworksChanged.
-  // Used to ensure we only report metrics once.
-  bool sent_first_update_ = false;
-
-  // SignalNetworksChanged will only be fired if there is any outstanding
-  // StartUpdating.
-  int start_count_ = 0;
-
-  // |network_manager_| is just a reference, owned by
-  // PeerConnectionDependencyFactory.
-  rtc::NetworkManager* network_manager_;
-
-  base::WeakPtrFactory<EmptyNetworkManager> weak_ptr_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(EmptyNetworkManager);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_EMPTY_NETWORK_MANAGER_H_
diff --git a/chromium/content/renderer/p2p/filtering_network_manager.cc b/chromium/content/renderer/p2p/filtering_network_manager.cc
deleted file mode 100644
index 93d42f755b6..00000000000
--- a/chromium/content/renderer/p2p/filtering_network_manager.cc
+++ /dev/null
@@ -1,216 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/filtering_network_manager.h"
-
-#include <utility>
-
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/logging.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "media/base/media_permission.h"
-
-namespace content {
-
-FilteringNetworkManager::FilteringNetworkManager(
-    rtc::NetworkManager* network_manager,
-    const GURL& requesting_origin,
-    media::MediaPermission* media_permission)
-    : network_manager_(network_manager),
-      media_permission_(media_permission),
-      requesting_origin_(requesting_origin) {
-  thread_checker_.DetachFromThread();
-  set_enumeration_permission(ENUMERATION_BLOCKED);
-
-  // If the feature is not enabled, just return ALLOWED as it's requested.
-  if (!media_permission_) {
-    started_permission_check_ = true;
-    set_enumeration_permission(ENUMERATION_ALLOWED);
-    VLOG(3) << "media_permission is not passed, granting permission";
-    return;
-  }
-}
-
-FilteringNetworkManager::~FilteringNetworkManager() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  // This helps to catch the case if permission never comes back.
-  if (!start_updating_time_.is_null())
-    ReportMetrics(false);
-}
-
-base::WeakPtr<FilteringNetworkManager> FilteringNetworkManager::GetWeakPtr() {
-  return weak_ptr_factory_.GetWeakPtr();
-}
-
-void FilteringNetworkManager::Initialize() {
-  rtc::NetworkManagerBase::Initialize();
-  if (media_permission_)
-    CheckPermission();
-}
-
-void FilteringNetworkManager::StartUpdating() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(started_permission_check_);
-
-  if (start_updating_time_.is_null()) {
-    start_updating_time_ = base::TimeTicks::Now();
-    network_manager_->SignalNetworksChanged.connect(
-        this, &FilteringNetworkManager::OnNetworksChanged);
-  }
-
-  // Update |pending_network_update_| and |start_count_| before calling
-  // StartUpdating, in case the update signal is fired synchronously.
-  pending_network_update_ = true;
-  ++start_count_;
-  network_manager_->StartUpdating();
-  // If we have not sent the first update, which implies we have not received
-  // the first network update from the base network manager, we wait until the
-  // base network manager signals a network change for us to populate the
-  // network information in |OnNetworksChanged| and fire the event there.
-  if (sent_first_update_) {
-    FireEventIfStarted();
-  }
-}
-
-void FilteringNetworkManager::StopUpdating() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  network_manager_->StopUpdating();
-  DCHECK_GT(start_count_, 0);
-  --start_count_;
-}
-
-void FilteringNetworkManager::GetNetworks(NetworkList* networks) const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  networks->clear();
-
-  if (enumeration_permission() == ENUMERATION_ALLOWED)
-    NetworkManagerBase::GetNetworks(networks);
-
-  VLOG(3) << "GetNetworks() returns " << networks->size() << " networks.";
-}
-
-webrtc::MdnsResponderInterface* FilteringNetworkManager::GetMdnsResponder()
-    const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  if (enumeration_permission() == ENUMERATION_ALLOWED)
-    return nullptr;
-
-  return network_manager_->GetMdnsResponder();
-}
-
-void FilteringNetworkManager::CheckPermission() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(!started_permission_check_);
-
-  started_permission_check_ = true;
-  pending_permission_checks_ = 2;
-
-  VLOG(1) << "FilteringNetworkManager checking permission status.";
-  // Request for media permission asynchronously.
-  media_permission_->HasPermission(
-      media::MediaPermission::AUDIO_CAPTURE,
-      base::BindOnce(&FilteringNetworkManager::OnPermissionStatus,
-                     GetWeakPtr()));
-  media_permission_->HasPermission(
-      media::MediaPermission::VIDEO_CAPTURE,
-      base::BindOnce(&FilteringNetworkManager::OnPermissionStatus,
-                     GetWeakPtr()));
-}
-
-void FilteringNetworkManager::OnPermissionStatus(bool granted) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK_GT(pending_permission_checks_, 0);
-  VLOG(1) << "FilteringNetworkManager received permission status: "
-          << (granted ? "granted" : "denied");
-  IPPermissionStatus old_status = GetIPPermissionStatus();
-
-  --pending_permission_checks_;
-
-  if (granted)
-    set_enumeration_permission(ENUMERATION_ALLOWED);
-
-  // If the IP permission status changed *and* we have an up-to-date network
-  // list, fire a network change event.
-  if (GetIPPermissionStatus() != old_status && !pending_network_update_)
-    FireEventIfStarted();
-}
-
-void FilteringNetworkManager::OnNetworksChanged() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  pending_network_update_ = false;
-
-  // Update the default local addresses.
-  rtc::IPAddress ipv4_default;
-  rtc::IPAddress ipv6_default;
-  network_manager_->GetDefaultLocalAddress(AF_INET, &ipv4_default);
-  network_manager_->GetDefaultLocalAddress(AF_INET6, &ipv6_default);
-  set_default_local_addresses(ipv4_default, ipv6_default);
-
-  // Copy and merge the networks. Fire a signal if the permission status is
-  // known.
-  NetworkList networks;
-  network_manager_->GetNetworks(&networks);
-  NetworkList copied_networks;
-  copied_networks.reserve(networks.size());
-  for (rtc::Network* network : networks) {
-    auto copied_network = std::make_unique<rtc::Network>(*network);
-    copied_network->set_default_local_address_provider(this);
-    copied_network->set_mdns_responder_provider(this);
-    copied_networks.push_back(copied_network.release());
-  }
-  bool changed;
-  MergeNetworkList(copied_networks, &changed);
-  // We wait until our permission status is known before firing a network
-  // change signal, so that the listener(s) don't miss out on receiving a
-  // full network list.
-  if (changed && GetIPPermissionStatus() != PERMISSION_UNKNOWN)
-    FireEventIfStarted();
-}
-
-void FilteringNetworkManager::ReportMetrics(bool report_start_latency) {
-  if (report_start_latency) {
-    ReportTimeToUpdateNetworkList(base::TimeTicks::Now() -
-                                  start_updating_time_);
-  }
-
-  ReportIPPermissionStatus(GetIPPermissionStatus());
-}
-
-IPPermissionStatus FilteringNetworkManager::GetIPPermissionStatus() const {
-  if (enumeration_permission() == ENUMERATION_ALLOWED) {
-    return media_permission_ ? PERMISSION_GRANTED_WITH_CHECKING
-                             : PERMISSION_GRANTED_WITHOUT_CHECKING;
-  }
-
-  if (!pending_permission_checks_ &&
-      enumeration_permission() == ENUMERATION_BLOCKED) {
-    return PERMISSION_DENIED;
-  }
-
-  return PERMISSION_UNKNOWN;
-}
-
-void FilteringNetworkManager::FireEventIfStarted() {
-  if (!start_count_)
-    return;
-
-  if (!sent_first_update_)
-    ReportMetrics(true);
-
-  // Post a task to avoid reentrancy.
-  base::ThreadTaskRunnerHandle::Get()->PostTask(
-      FROM_HERE,
-      base::BindOnce(&FilteringNetworkManager::SendNetworksChangedSignal,
-                     GetWeakPtr()));
-
-  sent_first_update_ = true;
-}
-
-void FilteringNetworkManager::SendNetworksChangedSignal() {
-  SignalNetworksChanged();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/filtering_network_manager.h b/chromium/content/renderer/p2p/filtering_network_manager.h
deleted file mode 100644
index f15f7623ac2..00000000000
--- a/chromium/content/renderer/p2p/filtering_network_manager.h
+++ /dev/null
@@ -1,125 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_FILTERING_NETWORK_MANAGER_H_
-#define CONTENT_RENDERER_P2P_FILTERING_NETWORK_MANAGER_H_
-
-#include "base/macros.h"
-#include "base/memory/weak_ptr.h"
-#include "base/threading/thread_checker.h"
-#include "base/time/time.h"
-#include "content/common/content_export.h"
-#include "content/renderer/p2p/network_manager_uma.h"
-#include "third_party/webrtc/rtc_base/network.h"
-#include "third_party/webrtc/rtc_base/third_party/sigslot/sigslot.h"
-#include "url/gurl.h"
-
-namespace media {
-class MediaPermission;
-}  // namespace media
-
-namespace content {
-
-// FilteringNetworkManager exposes rtc::NetworkManager to
-// PeerConnectionDependencyFactory and wraps the IpcNetworkManager. It only
-// handles the case where multiple_routes is requested. It checks at least one
-// of mic/camera permissions is granted before allowing WebRTC to use the local
-// IP addresses as ICE candidates. The class handles asynchronous signals like
-// SignalNetworksChanged from IpcNetworkManager and permission status from
-// MediaPermission before it signals WebRTC that the network information is
-// ready. It is designed to fire the network change event at the earliest time
-// to reduce any extra call setup delay. This class is not thread safe and
-// should only be used by WebRTC's network thread. It inherits from
-// rtc::NetworkManagerBase to have the same implementation of
-// GetAnyAddressNetworks(). We can't mark the whole class CONTENT_EXPORT as it
-// requires all super classes to be CONTENT_EXPORT as well.
-class FilteringNetworkManager : public rtc::NetworkManagerBase,
-                                public sigslot::has_slots<> {
- public:
-  // This class is created by WebRTC's signaling thread but used by WebRTC's
-  // worker thread |task_runner|.
-  CONTENT_EXPORT FilteringNetworkManager(
-      rtc::NetworkManager* network_manager,
-      const GURL& requesting_origin,
-      media::MediaPermission* media_permission);
-
-  CONTENT_EXPORT ~FilteringNetworkManager() override;
-
-  // rtc::NetworkManager:
-  void Initialize() override;
-  void StartUpdating() override;
-  void StopUpdating() override;
-  void GetNetworks(NetworkList* networks) const override;
-
-  webrtc::MdnsResponderInterface* GetMdnsResponder() const override;
-
- private:
-  // Check mic/camera permission.
-  void CheckPermission();
-
-  // Receive callback from MediaPermission when the permission status is
-  // available.
-  void OnPermissionStatus(bool granted);
-
-  base::WeakPtr<FilteringNetworkManager> GetWeakPtr();
-
-  // Receive callback from the wrapped NetworkManager when the underneath
-  // network list is changed.
-  void OnNetworksChanged();
-
-  // Reporting the IPPermissionStatus and how long it takes to send
-  // SignalNetworksChanged. |report_start_latency| is false when called by the
-  // destructor to report no networks changed signal is ever fired and could
-  // potentially be a bug.
-  void ReportMetrics(bool report_start_latency);
-
-  // A tri-state permission checking status. It starts with UNKNOWN and will
-  // change to GRANTED if one of permissions is granted. Otherwise, DENIED will
-  // be returned.
-  IPPermissionStatus GetIPPermissionStatus() const;
-
-  void FireEventIfStarted();
-
-  void SendNetworksChangedSignal();
-
-  // |network_manager_| is just a reference, owned by
-  // PeerConnectionDependencyFactory.
-  rtc::NetworkManager* network_manager_;
-
-  // The class is created by the signaling thread but used by the worker thread.
-  base::ThreadChecker thread_checker_;
-
-  media::MediaPermission* media_permission_;
-
-  int pending_permission_checks_ = 0;
-
-  // Whether we're waiting for a network change signal from |network_manager_|.
-  bool pending_network_update_ = false;
-
-  // Whether we have fired the first SignalNetworksChanged.
-  // Used to ensure we only report metrics once.
-  bool sent_first_update_ = false;
-
-  // SignalNetworksChanged will only be fired if there is any outstanding
-  // StartUpdating.
-  int start_count_ = 0;
-
-  // Track whether CheckPermission has been called before StartUpdating.
-  bool started_permission_check_ = false;
-
-  // Track how long it takes for client to receive SignalNetworksChanged. This
-  // helps to identify if the signal is delayed by permission check and increase
-  // the setup time.
-  base::TimeTicks start_updating_time_;
-
-  GURL requesting_origin_;
-
-  base::WeakPtrFactory<FilteringNetworkManager> weak_ptr_factory_{this};
-
-  DISALLOW_COPY_AND_ASSIGN(FilteringNetworkManager);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_FILTERING_NETWORK_MANAGER_H_
diff --git a/chromium/content/renderer/p2p/filtering_network_manager_unittest.cc b/chromium/content/renderer/p2p/filtering_network_manager_unittest.cc
deleted file mode 100644
index 9888bd529d6..00000000000
--- a/chromium/content/renderer/p2p/filtering_network_manager_unittest.cc
+++ /dev/null
@@ -1,490 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/filtering_network_manager.h"
-
-#include <stddef.h>
-
-#include <memory>
-#include <utility>
-#include <vector>
-
-#include "base/logging.h"
-#include "base/memory/ref_counted.h"
-#include "base/stl_util.h"
-#include "base/test/test_simple_task_runner.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/renderer/p2p/empty_network_manager.h"
-#include "media/base/media_permission.h"
-#include "testing/gmock/include/gmock/gmock.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/webrtc/rtc_base/ip_address.h"
-
-using NetworkList = rtc::NetworkManager::NetworkList;
-using ::testing::SizeIs;
-
-namespace {
-
-enum EventType {
-  MIC_DENIED,      // Receive mic permission denied.
-  MIC_GRANTED,     // Receive mic permission granted.
-  CAMERA_DENIED,   // Receive camera permission denied.
-  CAMERA_GRANTED,  // Receive camera permission granted.
-  START_UPDATING,  // Client calls StartUpdating() on FilteringNetworkManager.
-  STOP_UPDATING,   // Client calls StopUpdating() on FilteringNetworkManager.
-  MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK,   // MockNetworkManager has signaled
-                                            // networks changed event and the
-                                            // underlying network is replaced by
-                                            // a new one.
-  MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK,  // MockNetworkManager has signaled
-                                            // networks changed event but the
-                                            // underlying network stays the
-                                            // same.
-};
-
-enum ResultType {
-  NO_SIGNAL,                   // Do not expect SignalNetworksChanged fired.
-  SIGNAL_ENUMERATION_BLOCKED,  // Expect SignalNetworksChanged and
-                               // ENUMERATION_BLOCKED.
-  SIGNAL_ENUMERATION_ALLOWED,  // Expect SignalNetworksChanged and
-                               // ENUMERATION_ALLOWED.
-};
-
-struct TestEntry {
-  EventType event;
-  ResultType expected_result;
-};
-
-class EmptyMdnsResponder : public webrtc::MdnsResponderInterface {
- public:
-  void CreateNameForAddress(const rtc::IPAddress& addr,
-                            NameCreatedCallback callback) override {
-    NOTREACHED();
-  }
-  void RemoveNameForAddress(const rtc::IPAddress& addr,
-                            NameRemovedCallback callback) override {
-    NOTREACHED();
-  }
-};
-
-class MockNetworkManager : public rtc::NetworkManagerBase {
- public:
-  MockNetworkManager() : mdns_responder_(new EmptyMdnsResponder()) {}
-  // Mimic the current behavior that once the first signal is sent, any future
-  // StartUpdating() will trigger another one.
-  void StartUpdating() override {
-    if (sent_first_update_)
-      SignalNetworksChanged();
-  }
-  void StopUpdating() override {}
-  void GetNetworks(NetworkList* networks) const override {
-    networks->push_back(network_.get());
-  }
-
-  void SendNetworksChanged() {
-    sent_first_update_ = true;
-    SignalNetworksChanged();
-  }
-
-  webrtc::MdnsResponderInterface* GetMdnsResponder() const override {
-    return mdns_responder_.get();
-  }
-
-  void CopyAndSetNetwork(const rtc::Network& network) {
-    network_ = std::make_unique<rtc::Network>(network);
-    network_->AddIP(network_->GetBestIP());
-  }
-
- private:
-  bool sent_first_update_ = false;
-  std::unique_ptr<rtc::Network> network_;
-  std::unique_ptr<EmptyMdnsResponder> mdns_responder_;
-};
-
-class MockMediaPermission : public media::MediaPermission {
- public:
-  MockMediaPermission() {}
-  ~MockMediaPermission() override {}
-
-  void RequestPermission(Type type,
-                         PermissionStatusCB permission_status_cb) override {
-    NOTIMPLEMENTED();
-  }
-
-  void HasPermission(Type type,
-                     PermissionStatusCB permission_status_cb) override {
-    if (type == MediaPermission::AUDIO_CAPTURE) {
-      DCHECK(mic_callback_.is_null());
-      mic_callback_ = std::move(permission_status_cb);
-    } else {
-      DCHECK(type == MediaPermission::VIDEO_CAPTURE);
-      DCHECK(camera_callback_.is_null());
-      camera_callback_ = std::move(permission_status_cb);
-    }
-  }
-
-  bool IsEncryptedMediaEnabled() override { return true; }
-
-  void SetMicPermission(bool granted) {
-    if (!mic_callback_)
-      return;
-
-    std::move(mic_callback_).Run(granted);
-  }
-
-  void SetCameraPermission(bool granted) {
-    if (!camera_callback_)
-      return;
-
-    std::move(camera_callback_).Run(granted);
-  }
-
- private:
-  PermissionStatusCB mic_callback_;
-  PermissionStatusCB camera_callback_;
-};
-
-}  // namespace
-
-namespace content {
-
-class FilteringNetworkManagerTest : public testing::Test,
-                                    public sigslot::has_slots<> {
- public:
-  FilteringNetworkManagerTest()
-      : media_permission_(new MockMediaPermission()),
-        task_runner_(new base::TestSimpleTaskRunner()),
-        task_runner_handle_(task_runner_) {
-    networks_.emplace_back("test_eth0", "Test Network Adapter 1",
-                           rtc::IPAddress(0x12345600U), 24,
-                           rtc::ADAPTER_TYPE_ETHERNET),
-        networks_.back().AddIP(rtc::IPAddress(0x12345678));
-    networks_.emplace_back("test_eth1", "Test Network Adapter 2",
-                           rtc::IPAddress(0x87654300U), 24,
-                           rtc::ADAPTER_TYPE_ETHERNET),
-        networks_.back().AddIP(rtc::IPAddress(0x87654321));
-  }
-
-  void SetupNetworkManager(bool multiple_routes_requested) {
-    base_network_manager_ = std::make_unique<MockNetworkManager>();
-    SetNewNetworkForBaseNetworkManager();
-    if (multiple_routes_requested) {
-      network_manager_ = std::make_unique<FilteringNetworkManager>(
-          base_network_manager_.get(), GURL(), media_permission_.get());
-      network_manager_->Initialize();
-    } else {
-      network_manager_ =
-          std::make_unique<EmptyNetworkManager>(base_network_manager_.get());
-    }
-    network_manager_->SignalNetworksChanged.connect(
-        this, &FilteringNetworkManagerTest::OnNetworksChanged);
-  }
-
-  void RunTests(TestEntry* tests, size_t size) {
-    for (size_t i = 0; i < size; ++i) {
-      EXPECT_EQ(tests[i].expected_result, ProcessEvent(tests[i].event))
-          << " in step: " << i;
-    }
-  }
-
-  void SetNewNetworkForBaseNetworkManager() {
-    base_network_manager_->CopyAndSetNetwork(networks_[next_new_network_id_]);
-    next_new_network_id_ = (next_new_network_id_ + 1) % networks_.size();
-  }
-
-  ResultType ProcessEvent(EventType event) {
-    clear_callback_called();
-    switch (event) {
-      case MIC_DENIED:
-      case MIC_GRANTED:
-        media_permission_->SetMicPermission(event == MIC_GRANTED);
-        break;
-      case CAMERA_DENIED:
-      case CAMERA_GRANTED:
-        media_permission_->SetCameraPermission(event == CAMERA_GRANTED);
-        break;
-      case START_UPDATING:
-        network_manager_->StartUpdating();
-        break;
-      case STOP_UPDATING:
-        network_manager_->StopUpdating();
-        break;
-      case MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK:
-        SetNewNetworkForBaseNetworkManager();
-        base_network_manager_->SendNetworksChanged();
-        break;
-      case MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK:
-        base_network_manager_->SendNetworksChanged();
-        break;
-    }
-
-    task_runner_->RunUntilIdle();
-
-    if (!callback_called_)
-      return NO_SIGNAL;
-
-    if (network_manager_->enumeration_permission() ==
-        rtc::NetworkManager::ENUMERATION_BLOCKED) {
-      EXPECT_EQ(0u, GetP2PNetworkList().size());
-      return SIGNAL_ENUMERATION_BLOCKED;
-    }
-    EXPECT_EQ(1u, GetP2PNetworkList().size());
-    return SIGNAL_ENUMERATION_ALLOWED;
-  }
-
- protected:
-  const NetworkList& GetP2PNetworkList() {
-    network_list_.clear();
-    network_manager_->GetNetworks(&network_list_);
-    return network_list_;
-  }
-
-  void OnNetworksChanged() { callback_called_ = true; }
-  void clear_callback_called() { callback_called_ = false; }
-
-  bool callback_called_ = false;
-  std::unique_ptr<rtc::NetworkManager> network_manager_;
-  std::unique_ptr<MockNetworkManager> base_network_manager_;
-
-  std::unique_ptr<MockMediaPermission> media_permission_;
-
-  std::vector<rtc::Network> networks_;
-  int next_new_network_id_ = 0;
-
-  NetworkList network_list_;
-  scoped_refptr<base::TestSimpleTaskRunner> task_runner_;
-  base::ThreadTaskRunnerHandle task_runner_handle_;
-};
-
-// Test that when multiple routes is not requested, SignalNetworksChanged is
-// fired right after the StartUpdating().
-TEST_F(FilteringNetworkManagerTest, MultipleRoutesNotRequested) {
-  SetupNetworkManager(false);
-  TestEntry tests[] = {
-      // Underneath network manager signals, no callback as StartUpdating() is
-      // not called.
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      // StartUpdating() is called, should receive callback as the multiple
-      // routes is not requested.
-      {START_UPDATING, SIGNAL_ENUMERATION_BLOCKED},
-      // Further network signal should trigger callback, since the
-      // EmptyNetworkManager always forwards the signal from the base network
-      // manager if there is any outstanding StartUpdate();
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, SIGNAL_ENUMERATION_BLOCKED},
-      // StartUpdating() always triggers callback after we have sent the first
-      // network update.
-      {START_UPDATING, SIGNAL_ENUMERATION_BLOCKED},
-      {STOP_UPDATING, NO_SIGNAL},
-      {STOP_UPDATING, NO_SIGNAL},
-      // No outstanding StartUpdating(), no more signal.
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that multiple routes request is blocked and signaled right after
-// StartUpdating() since mic/camera permissions are denied.
-TEST_F(FilteringNetworkManagerTest, BlockMultipleRoutesByStartUpdating) {
-  SetupNetworkManager(true);
-
-  TestEntry tests[] = {
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      // Both mic and camera are denied.
-      {MIC_DENIED, NO_SIGNAL},
-      {CAMERA_DENIED, NO_SIGNAL},
-      // Once StartUpdating() is called, signal network changed event with
-      // ENUMERATION_BLOCKED.
-      {START_UPDATING, SIGNAL_ENUMERATION_BLOCKED},
-      // Further network signal should not trigger callback, since the set of
-      // networks does not change after merging.
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      // Signal when observing a change after merging while there is any
-      // outstanding StartUpdate();
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, SIGNAL_ENUMERATION_BLOCKED},
-      {START_UPDATING, SIGNAL_ENUMERATION_BLOCKED},
-      {STOP_UPDATING, NO_SIGNAL},
-      {STOP_UPDATING, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that multiple routes request is blocked and signaled right after
-// last pending permission check is denied since StartUpdating() has been called
-// previously.
-TEST_F(FilteringNetworkManagerTest, BlockMultipleRoutesByPermissionsDenied) {
-  SetupNetworkManager(true);
-
-  TestEntry tests[] = {
-      // StartUpdating() should not fire the event before we send the first
-      // update.
-      {START_UPDATING, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      {MIC_DENIED, NO_SIGNAL},
-      // The last permission check being denied should immediately trigger the
-      // networks changed signal, since we already have an updated network list.
-      {CAMERA_DENIED, SIGNAL_ENUMERATION_BLOCKED},
-      {START_UPDATING, SIGNAL_ENUMERATION_BLOCKED},
-      {STOP_UPDATING, NO_SIGNAL},
-      {STOP_UPDATING, NO_SIGNAL},
-      // No outstanding StartUpdating(), no more signal.
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that after permissions have been denied, a network change signal from
-// the internal NetworkManager is still needed before signaling a network
-// change outwards. This is because even if network enumeration is blocked,
-// we still want to give time to obtain the default IP addresses.
-TEST_F(FilteringNetworkManagerTest, BlockMultipleRoutesByNetworksChanged) {
-  SetupNetworkManager(true);
-
-  TestEntry tests[] = {
-      {START_UPDATING, NO_SIGNAL},
-      {MIC_DENIED, NO_SIGNAL},
-      {CAMERA_DENIED, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, SIGNAL_ENUMERATION_BLOCKED},
-      {START_UPDATING, SIGNAL_ENUMERATION_BLOCKED},
-      {STOP_UPDATING, NO_SIGNAL},
-      {STOP_UPDATING, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that multiple routes request is granted and signaled right after
-// a pending permission check is granted since StartUpdating() has been called
-// previously.
-TEST_F(FilteringNetworkManagerTest, AllowMultipleRoutesByPermissionsGranted) {
-  SetupNetworkManager(true);
-
-  TestEntry tests[] = {
-      {START_UPDATING, NO_SIGNAL},
-      {MIC_DENIED, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      // Once one media type is granted, signal networks changed with
-      // ENUMERATION_ALLOWED.
-      {CAMERA_GRANTED, SIGNAL_ENUMERATION_ALLOWED},
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      {START_UPDATING, SIGNAL_ENUMERATION_ALLOWED},
-      {STOP_UPDATING, NO_SIGNAL},
-      // If there is any outstanding StartUpdating(), new event from underneath
-      // network manger should trigger SignalNetworksChanged.
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, SIGNAL_ENUMERATION_ALLOWED},
-      {STOP_UPDATING, NO_SIGNAL},
-      // No outstanding StartUpdating(), no more signal.
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that multiple routes request is granted and signaled right after
-// StartUpdating() since there is at least one media permission granted.
-TEST_F(FilteringNetworkManagerTest, AllowMultipleRoutesByStartUpdating) {
-  SetupNetworkManager(true);
-
-  TestEntry tests[] = {
-      {MIC_DENIED, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      {CAMERA_GRANTED, NO_SIGNAL},
-      // StartUpdating() should signal the event with the status of permissions
-      // granted.
-      {START_UPDATING, SIGNAL_ENUMERATION_ALLOWED},
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      {START_UPDATING, SIGNAL_ENUMERATION_ALLOWED},
-      {STOP_UPDATING, NO_SIGNAL},
-      // Signal when observing a change after merging while there is any
-      // outstanding StartUpdate();
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, SIGNAL_ENUMERATION_ALLOWED},
-      {STOP_UPDATING, NO_SIGNAL},
-      // No outstanding StartUpdating(), no more signal.
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that multiple routes request is granted and signaled right after
-// underneath NetworkManager's SignalNetworksChanged() as at least one
-// permission is granted and StartUpdating() has been called.
-TEST_F(FilteringNetworkManagerTest, AllowMultipleRoutesByNetworksChanged) {
-  SetupNetworkManager(true);
-
-  TestEntry tests[] = {
-      {START_UPDATING, NO_SIGNAL},
-      {CAMERA_GRANTED, NO_SIGNAL},
-      // Underneath network manager's signal networks changed should trigger
-      // SignalNetworksChanged with ENUMERATION_ALLOWED.
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, SIGNAL_ENUMERATION_ALLOWED},
-      {MIC_DENIED, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, SIGNAL_ENUMERATION_ALLOWED},
-      {START_UPDATING, SIGNAL_ENUMERATION_ALLOWED},
-      {STOP_UPDATING, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, SIGNAL_ENUMERATION_ALLOWED},
-      {STOP_UPDATING, NO_SIGNAL},
-      {MOCK_NETWORKS_CHANGED_WITH_NEW_NETWORK, NO_SIGNAL},
-  };
-
-  RunTests(tests, base::size(tests));
-}
-
-// Test that the networks provided by the GetNetworks() and
-// GetAnyAddressNetworks() are not associated with an mDNS responder if the
-// enumeration permission is granted.
-TEST_F(FilteringNetworkManagerTest, NullMdnsResponderAfterPermissionGranted) {
-  SetupNetworkManager(true);
-
-  TestEntry setup_steps[] = {
-      {MOCK_NETWORKS_CHANGED_WITH_SAME_NETWORK, NO_SIGNAL},
-      // Both mic and camera are granted.
-      {MIC_GRANTED, NO_SIGNAL},
-      {CAMERA_GRANTED, NO_SIGNAL},
-      // Once StartUpdating() is called, signal network changed event with
-      // ENUMERATION_ALLOWED.
-      {START_UPDATING, SIGNAL_ENUMERATION_ALLOWED},
-  };
-  RunTests(setup_steps, base::size(setup_steps));
-
-  NetworkList networks;
-  network_manager_->GetNetworks(&networks);
-  EXPECT_THAT(networks, SizeIs(1u));
-  for (const rtc::Network* network : networks) {
-    EXPECT_EQ(nullptr, network->GetMdnsResponder());
-  }
-
-  networks.clear();
-  network_manager_->GetAnyAddressNetworks(&networks);
-  EXPECT_THAT(networks, SizeIs(2u));
-  for (const rtc::Network* network : networks) {
-    EXPECT_EQ(nullptr, network->GetMdnsResponder());
-  }
-}
-
-// Test the networks on the default routes given by GetAnyAddressNetworks() are
-// associated with an mDNS responder if the enumeration is blocked.
-TEST_F(FilteringNetworkManagerTest,
-       ProvideMdnsResponderForDefaultRouteAfterPermissionDenied) {
-  SetupNetworkManager(true);
-  // By default, the enumeration is blocked if we provide |media_permission_|;
-  EXPECT_EQ(rtc::NetworkManager::ENUMERATION_BLOCKED,
-            network_manager_->enumeration_permission());
-
-  NetworkList networks;
-  network_manager_->GetNetworks(&networks);
-  EXPECT_TRUE(networks.empty());
-
-  network_manager_->GetAnyAddressNetworks(&networks);
-  EXPECT_THAT(networks, SizeIs(2u));
-  EXPECT_NE(nullptr, network_manager_->GetMdnsResponder());
-  for (const rtc::Network* network : networks) {
-    EXPECT_EQ(network_manager_->GetMdnsResponder(),
-              network->GetMdnsResponder());
-  }
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/host_address_request.cc b/chromium/content/renderer/p2p/host_address_request.cc
deleted file mode 100644
index 1424c153c13..00000000000
--- a/chromium/content/renderer/p2p/host_address_request.cc
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/host_address_request.h"
-
-#include <utility>
-
-#include "base/bind.h"
-#include "base/feature_list.h"
-#include "base/location.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/public/common/content_features.h"
-#include "content/renderer/p2p/socket_dispatcher.h"
-#include "jingle/glue/utils.h"
-
-namespace content {
-
-P2PAsyncAddressResolver::P2PAsyncAddressResolver(
-    P2PSocketDispatcher* dispatcher)
-    : dispatcher_(dispatcher), state_(STATE_CREATED) {
-  AddRef();  // Balanced in Destroy().
-}
-
-P2PAsyncAddressResolver::~P2PAsyncAddressResolver() {
-  DCHECK(state_ == STATE_CREATED || state_ == STATE_FINISHED);
-}
-
-void P2PAsyncAddressResolver::Start(const rtc::SocketAddress& host_name,
-                                    DoneCallback done_callback) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK_EQ(STATE_CREATED, state_);
-
-  state_ = STATE_SENT;
-  done_callback_ = std::move(done_callback);
-  bool enable_mdns =
-      base::FeatureList::IsEnabled(features::kWebRtcHideLocalIpsWithMdns);
-  dispatcher_->GetP2PSocketManager()->get()->GetHostAddress(
-      host_name.hostname(), enable_mdns,
-      base::BindOnce(&P2PAsyncAddressResolver::OnResponse,
-                     base::Unretained(this)));
-}
-
-void P2PAsyncAddressResolver::Cancel() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  if (state_ != STATE_FINISHED)
-    state_ = STATE_FINISHED;
-
-  done_callback_.Reset();
-}
-
-void P2PAsyncAddressResolver::OnResponse(const net::IPAddressList& addresses) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (state_ == STATE_SENT) {
-    state_ = STATE_FINISHED;
-    std::move(done_callback_).Run(addresses);
-  }
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/host_address_request.h b/chromium/content/renderer/p2p/host_address_request.h
deleted file mode 100644
index cbfc93c26f2..00000000000
--- a/chromium/content/renderer/p2p/host_address_request.h
+++ /dev/null
@@ -1,64 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_HOST_ADDRESS_REQUEST_H_
-#define CONTENT_RENDERER_P2P_HOST_ADDRESS_REQUEST_H_
-
-#include <stdint.h>
-
-#include <string>
-
-#include "base/callback.h"
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/threading/thread_checker.h"
-#include "content/common/content_export.h"
-#include "net/base/ip_address.h"
-#include "third_party/webrtc/rtc_base/async_resolver_interface.h"
-
-namespace content {
-
-class P2PSocketDispatcher;
-
-// P2PAsyncAddressResolver performs DNS hostname resolution. It's used
-// to resolve addresses of STUN and relay servers.
-class P2PAsyncAddressResolver
-    : public base::RefCountedThreadSafe<P2PAsyncAddressResolver> {
- public:
-  using DoneCallback = base::OnceCallback<void(const net::IPAddressList&)>;
-
-  P2PAsyncAddressResolver(P2PSocketDispatcher* dispatcher);
-  // Start address resolve process.
-  void Start(const rtc::SocketAddress& addr, DoneCallback done_callback);
-  // Clients must unregister before exiting for cleanup.
-  void Cancel();
-
- private:
-  enum State {
-    STATE_CREATED,
-    STATE_SENT,
-    STATE_FINISHED,
-  };
-
-  friend class P2PSocketDispatcher;
-
-  friend class base::RefCountedThreadSafe<P2PAsyncAddressResolver>;
-
-  virtual ~P2PAsyncAddressResolver();
-
-  void OnResponse(const net::IPAddressList& address);
-
-  P2PSocketDispatcher* dispatcher_;
-  base::ThreadChecker thread_checker_;
-
-  // State must be accessed from delegate thread only.
-  State state_;
-  DoneCallback done_callback_;
-
-  DISALLOW_COPY_AND_ASSIGN(P2PAsyncAddressResolver);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_HOST_ADDRESS_REQUEST_H_
diff --git a/chromium/content/renderer/p2p/ipc_network_manager.cc b/chromium/content/renderer/p2p/ipc_network_manager.cc
deleted file mode 100644
index 9d3b263c680..00000000000
--- a/chromium/content/renderer/p2p/ipc_network_manager.cc
+++ /dev/null
@@ -1,200 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/ipc_network_manager.h"
-
-#include <string>
-#include <utility>
-
-#include "base/bind.h"
-#include "base/command_line.h"
-#include "base/location.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/single_thread_task_runner.h"
-#include "base/sys_byteorder.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "content/public/common/content_switches.h"
-#include "jingle/glue/utils.h"
-#include "net/base/ip_address.h"
-#include "net/base/network_change_notifier.h"
-#include "net/base/network_interfaces.h"
-#include "third_party/webrtc/rtc_base/socket_address.h"
-
-namespace content {
-
-namespace {
-
-rtc::AdapterType ConvertConnectionTypeToAdapterType(
-    net::NetworkChangeNotifier::ConnectionType type) {
-  switch (type) {
-    case net::NetworkChangeNotifier::CONNECTION_UNKNOWN:
-        return rtc::ADAPTER_TYPE_UNKNOWN;
-    case net::NetworkChangeNotifier::CONNECTION_ETHERNET:
-        return rtc::ADAPTER_TYPE_ETHERNET;
-    case net::NetworkChangeNotifier::CONNECTION_WIFI:
-        return rtc::ADAPTER_TYPE_WIFI;
-    case net::NetworkChangeNotifier::CONNECTION_2G:
-    case net::NetworkChangeNotifier::CONNECTION_3G:
-    case net::NetworkChangeNotifier::CONNECTION_4G:
-        return rtc::ADAPTER_TYPE_CELLULAR;
-    default:
-        return rtc::ADAPTER_TYPE_UNKNOWN;
-  }
-}
-
-}  // namespace
-
-IpcNetworkManager::IpcNetworkManager(
-    NetworkListManager* network_list_manager,
-    std::unique_ptr<webrtc::MdnsResponderInterface> mdns_responder)
-    : network_list_manager_(network_list_manager),
-      mdns_responder_(std::move(mdns_responder)) {
-  network_list_manager_->AddNetworkListObserver(this);
-}
-
-IpcNetworkManager::~IpcNetworkManager() {
-  DCHECK(!start_count_);
-  network_list_manager_->RemoveNetworkListObserver(this);
-}
-
-void IpcNetworkManager::StartUpdating() {
-  if (network_list_received_) {
-    // Post a task to avoid reentrancy.
-    base::ThreadTaskRunnerHandle::Get()->PostTask(
-        FROM_HERE, base::BindOnce(&IpcNetworkManager::SendNetworksChangedSignal,
-                                  weak_factory_.GetWeakPtr()));
-  } else {
-    VLOG(1) << "IpcNetworkManager::StartUpdating called; still waiting for "
-               "network list from browser process.";
-  }
-  ++start_count_;
-}
-
-void IpcNetworkManager::StopUpdating() {
-  DCHECK_GT(start_count_, 0);
-  --start_count_;
-}
-
-void IpcNetworkManager::OnNetworkListChanged(
-    const net::NetworkInterfaceList& list,
-    const net::IPAddress& default_ipv4_local_address,
-    const net::IPAddress& default_ipv6_local_address) {
-  // Update flag if network list received for the first time.
-  if (!network_list_received_) {
-    VLOG(1) << "IpcNetworkManager received network list from browser process "
-               "for the first time.";
-    network_list_received_ = true;
-  }
-
-  // Default addresses should be set only when they are in the filtered list of
-  // network addresses.
-  bool use_default_ipv4_address = false;
-  bool use_default_ipv6_address = false;
-
-  // rtc::Network uses these prefix_length to compare network
-  // interfaces discovered.
-  std::vector<rtc::Network*> networks;
-  for (auto it = list.begin(); it != list.end(); it++) {
-    rtc::IPAddress ip_address =
-        jingle_glue::NetIPAddressToRtcIPAddress(it->address);
-    DCHECK(!ip_address.IsNil());
-
-    rtc::IPAddress prefix = rtc::TruncateIP(ip_address, it->prefix_length);
-    rtc::AdapterType adapter_type =
-        ConvertConnectionTypeToAdapterType(it->type);
-    // If the adapter type is unknown, try to guess it using WebRTC's string
-    // matching rules.
-    if (adapter_type == rtc::ADAPTER_TYPE_UNKNOWN) {
-      adapter_type = rtc::GetAdapterTypeFromName(it->name.c_str());
-    }
-    std::unique_ptr<rtc::Network> network(new rtc::Network(
-        it->name, it->name, prefix, it->prefix_length, adapter_type));
-    network->set_default_local_address_provider(this);
-    network->set_mdns_responder_provider(this);
-
-    rtc::InterfaceAddress iface_addr;
-    if (it->address.IsIPv4()) {
-      use_default_ipv4_address |= (default_ipv4_local_address == it->address);
-      iface_addr = rtc::InterfaceAddress(ip_address);
-    } else {
-      DCHECK(it->address.IsIPv6());
-      iface_addr = rtc::InterfaceAddress(ip_address, it->ip_address_attributes);
-
-      // Only allow non-private, non-deprecated IPv6 addresses which don't
-      // contain MAC.
-      if (rtc::IPIsMacBased(iface_addr) ||
-          (it->ip_address_attributes & net::IP_ADDRESS_ATTRIBUTE_DEPRECATED) ||
-          rtc::IPIsPrivate(iface_addr)) {
-        continue;
-      }
-
-      use_default_ipv6_address |= (default_ipv6_local_address == it->address);
-    }
-    network->AddIP(iface_addr);
-    networks.push_back(network.release());
-  }
-
-  // Update the default local addresses.
-  rtc::IPAddress ipv4_default;
-  rtc::IPAddress ipv6_default;
-  if (use_default_ipv4_address) {
-    ipv4_default =
-        jingle_glue::NetIPAddressToRtcIPAddress(default_ipv4_local_address);
-  }
-  if (use_default_ipv6_address) {
-    ipv6_default =
-        jingle_glue::NetIPAddressToRtcIPAddress(default_ipv6_local_address);
-  }
-  set_default_local_addresses(ipv4_default, ipv6_default);
-
-  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-          switches::kAllowLoopbackInPeerConnection)) {
-    std::string name_v4("loopback_ipv4");
-    rtc::IPAddress ip_address_v4(INADDR_LOOPBACK);
-    rtc::Network* network_v4 = new rtc::Network(
-        name_v4, name_v4, ip_address_v4, 32, rtc::ADAPTER_TYPE_UNKNOWN);
-    network_v4->set_default_local_address_provider(this);
-    network_v4->set_mdns_responder_provider(this);
-    network_v4->AddIP(ip_address_v4);
-    networks.push_back(network_v4);
-
-    rtc::IPAddress ipv6_default_address;
-    // Only add IPv6 loopback if we can get default local address for IPv6. If
-    // we can't, it means that we don't have IPv6 enabled on this machine and
-    // bind() to the IPv6 loopback address will fail.
-    if (GetDefaultLocalAddress(AF_INET6, &ipv6_default_address)) {
-      DCHECK(!ipv6_default_address.IsNil());
-      std::string name_v6("loopback_ipv6");
-      rtc::IPAddress ip_address_v6(in6addr_loopback);
-      rtc::Network* network_v6 = new rtc::Network(
-          name_v6, name_v6, ip_address_v6, 64, rtc::ADAPTER_TYPE_UNKNOWN);
-      network_v6->set_default_local_address_provider(this);
-      network_v6->set_mdns_responder_provider(this);
-      network_v6->AddIP(ip_address_v6);
-      networks.push_back(network_v6);
-    }
-  }
-
-  bool changed = false;
-  NetworkManager::Stats stats;
-  MergeNetworkList(networks, &changed, &stats);
-  if (changed)
-    SignalNetworksChanged();
-
-  // Send interface counts to UMA.
-  UMA_HISTOGRAM_COUNTS_100("WebRTC.PeerConnection.IPv4Interfaces",
-                           stats.ipv4_network_count);
-  UMA_HISTOGRAM_COUNTS_100("WebRTC.PeerConnection.IPv6Interfaces",
-                           stats.ipv6_network_count);
-}
-
-webrtc::MdnsResponderInterface* IpcNetworkManager::GetMdnsResponder() const {
-  return mdns_responder_.get();
-}
-
-void IpcNetworkManager::SendNetworksChangedSignal() {
-  SignalNetworksChanged();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/ipc_network_manager.h b/chromium/content/renderer/p2p/ipc_network_manager.h
deleted file mode 100644
index d0d3b0bcf23..00000000000
--- a/chromium/content/renderer/p2p/ipc_network_manager.h
+++ /dev/null
@@ -1,60 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_IPC_NETWORK_MANAGER_H_
-#define CONTENT_RENDERER_P2P_IPC_NETWORK_MANAGER_H_
-
-#include <memory>
-#include <vector>
-
-#include "base/compiler_specific.h"
-#include "base/memory/weak_ptr.h"
-#include "content/common/content_export.h"
-#include "content/renderer/p2p/network_list_manager.h"
-#include "content/renderer/p2p/network_list_observer.h"
-#include "third_party/webrtc/rtc_base/mdns_responder_interface.h"
-#include "third_party/webrtc/rtc_base/network.h"
-
-namespace net {
-class IPAddress;
-}  // namespace net
-
-namespace content {
-
-// IpcNetworkManager is a NetworkManager for libjingle that gets a
-// list of network interfaces from the browser.
-class IpcNetworkManager : public rtc::NetworkManagerBase,
-                          public NetworkListObserver {
- public:
-  // Constructor doesn't take ownership of the |network_list_manager|.
-  CONTENT_EXPORT IpcNetworkManager(
-      NetworkListManager* network_list_manager,
-      std::unique_ptr<webrtc::MdnsResponderInterface> mdns_responder);
-  ~IpcNetworkManager() override;
-
-  // rtc:::NetworkManager:
-  void StartUpdating() override;
-  void StopUpdating() override;
-  webrtc::MdnsResponderInterface* GetMdnsResponder() const override;
-
-  // P2PSocketDispatcher::NetworkListObserver interface.
-  void OnNetworkListChanged(
-      const net::NetworkInterfaceList& list,
-      const net::IPAddress& default_ipv4_local_address,
-      const net::IPAddress& default_ipv6_local_address) override;
-
- private:
-  void SendNetworksChangedSignal();
-
-  NetworkListManager* network_list_manager_;
-  std::unique_ptr<webrtc::MdnsResponderInterface> mdns_responder_;
-  int start_count_ = 0;
-  bool network_list_received_ = false;
-
-  base::WeakPtrFactory<IpcNetworkManager> weak_factory_{this};
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_IPC_NETWORK_MANAGER_H_
diff --git a/chromium/content/renderer/p2p/ipc_network_manager_unittest.cc b/chromium/content/renderer/p2p/ipc_network_manager_unittest.cc
deleted file mode 100644
index e85e4b91763..00000000000
--- a/chromium/content/renderer/p2p/ipc_network_manager_unittest.cc
+++ /dev/null
@@ -1,201 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/ipc_network_manager.h"
-
-#include <algorithm>
-#include <memory>
-
-#include "content/renderer/p2p/network_list_manager.h"
-#include "net/base/ip_address.h"
-#include "net/base/network_change_notifier.h"
-#include "net/base/network_interfaces.h"
-#include "testing/gtest/include/gtest/gtest.h"
-#include "third_party/webrtc/rtc_base/mdns_responder_interface.h"
-
-namespace content {
-
-namespace {
-
-class MockP2PSocketDispatcher : public NetworkListManager {
- public:
-  void AddNetworkListObserver(
-      NetworkListObserver* network_list_observer) override {}
-
-  void RemoveNetworkListObserver(
-      NetworkListObserver* network_list_observer) override {}
-
-  ~MockP2PSocketDispatcher() override {}
-};
-
-class EmptyMdnsResponder : public webrtc::MdnsResponderInterface {
- public:
-  void CreateNameForAddress(const rtc::IPAddress& addr,
-                            NameCreatedCallback callback) override {}
-  void RemoveNameForAddress(const rtc::IPAddress& addr,
-                            NameRemovedCallback callback) override {}
-};
-
-}  // namespace
-
-// 2 IPv6 addresses with only last digit different.
-static const char kIPv6PublicAddrString1[] =
-    "2401:fa00:4:1000:be30:5b30:50e5:c3";
-static const char kIPv6PublicAddrString2[] =
-    "2401:fa00:4:1000:be30:5b30:50e5:c4";
-static const char kIPv4MappedAddrString[] = "::ffff:38.32.0.0";
-
-class IpcNetworkManagerTest : public testing::Test {
- public:
-  IpcNetworkManagerTest()
-      : network_list_manager_(new MockP2PSocketDispatcher()),
-        network_manager_(std::make_unique<IpcNetworkManager>(
-            network_list_manager_.get(),
-            std::make_unique<EmptyMdnsResponder>())) {}
-
- protected:
-  std::unique_ptr<MockP2PSocketDispatcher> network_list_manager_;
-  std::unique_ptr<IpcNetworkManager> network_manager_;
-};
-
-// Test overall logic of IpcNetworkManager on OnNetworkListChanged
-// that it should group addresses with the same network key under
-// single Network class. This also tests the logic inside
-// IpcNetworkManager in addition to MergeNetworkList.
-// TODO(guoweis): disable this test case for now until fix for webrtc
-// issue 19249005 integrated into chromium
-TEST_F(IpcNetworkManagerTest, TestMergeNetworkList) {
-  net::NetworkInterfaceList list;
-  net::IPAddress ip;
-  std::vector<rtc::Network*> networks;
-  rtc::IPAddress ip_address;
-
-  // Add 2 networks with the same prefix and prefix length.
-  EXPECT_TRUE(ip.AssignFromIPLiteral(kIPv6PublicAddrString1));
-  list.push_back(net::NetworkInterface(
-      "em1", "em1", 0, net::NetworkChangeNotifier::CONNECTION_UNKNOWN, ip, 64,
-      net::IP_ADDRESS_ATTRIBUTE_NONE));
-
-  EXPECT_TRUE(ip.AssignFromIPLiteral(kIPv6PublicAddrString2));
-  list.push_back(net::NetworkInterface(
-      "em1", "em1", 0, net::NetworkChangeNotifier::CONNECTION_UNKNOWN, ip, 64,
-      net::IP_ADDRESS_ATTRIBUTE_NONE));
-
-  network_manager_->OnNetworkListChanged(list, net::IPAddress(),
-                                         net::IPAddress());
-  network_manager_->GetNetworks(&networks);
-  EXPECT_EQ(1uL, networks.size());
-  EXPECT_EQ(2uL, networks[0]->GetIPs().size());
-
-  // Add another network with different prefix length, should result in
-  // a different network.
-  networks.clear();
-  list.push_back(net::NetworkInterface(
-      "em1", "em1", 0, net::NetworkChangeNotifier::CONNECTION_UNKNOWN, ip, 48,
-      net::IP_ADDRESS_ATTRIBUTE_NONE));
-
-  // Push an unknown address as the default address.
-  EXPECT_TRUE(ip.AssignFromIPLiteral(kIPv4MappedAddrString));
-  network_manager_->OnNetworkListChanged(list, net::IPAddress(), ip);
-
-  // The unknown default address should be ignored.
-  EXPECT_FALSE(network_manager_->GetDefaultLocalAddress(AF_INET6, &ip_address));
-
-  network_manager_->GetNetworks(&networks);
-
-  // Verify we have 2 networks now.
-  EXPECT_EQ(2uL, networks.size());
-  // Verify the network with prefix length of 64 has 2 IP addresses.
-  auto network_with_two_ips = std::find_if(
-      networks.begin(), networks.end(),
-      [](rtc::Network* network) { return network->prefix_length() == 64; });
-  ASSERT_NE(networks.end(), network_with_two_ips);
-  EXPECT_EQ(2uL, (*network_with_two_ips)->GetIPs().size());
-  // IPs should be in the same order as the list passed into
-  // OnNetworkListChanged.
-  EXPECT_TRUE(rtc::IPFromString(kIPv6PublicAddrString1, &ip_address));
-  EXPECT_EQ((*network_with_two_ips)->GetIPs()[0],
-            rtc::InterfaceAddress(ip_address));
-  EXPECT_TRUE(rtc::IPFromString(kIPv6PublicAddrString2, &ip_address));
-  EXPECT_EQ((*network_with_two_ips)->GetIPs()[1],
-            rtc::InterfaceAddress(ip_address));
-  // Verify the network with prefix length of 48 has 1 IP address.
-  auto network_with_one_ip = std::find_if(
-      networks.begin(), networks.end(),
-      [](rtc::Network* network) { return network->prefix_length() == 48; });
-  ASSERT_NE(networks.end(), network_with_one_ip);
-  EXPECT_EQ(1uL, (*network_with_one_ip)->GetIPs().size());
-  EXPECT_TRUE(rtc::IPFromString(kIPv6PublicAddrString2, &ip_address));
-  EXPECT_EQ((*network_with_one_ip)->GetIPs()[0],
-            rtc::InterfaceAddress(ip_address));
-}
-
-// Test that IpcNetworkManager will guess a network type from the interface
-// name when not otherwise available.
-TEST_F(IpcNetworkManagerTest, DeterminesNetworkTypeFromNameIfUnknown) {
-  net::NetworkInterfaceList list;
-  net::IPAddress ip;
-  std::vector<rtc::Network*> networks;
-  rtc::IPAddress ip_address;
-
-  // Add a "tun1" entry of type "unknown" and "tun2" entry of type Wi-Fi. The
-  // "tun1" entry (and only it) should have its type determined from its name,
-  // since its type is unknown.
-  EXPECT_TRUE(ip.AssignFromIPLiteral(kIPv6PublicAddrString1));
-  list.push_back(net::NetworkInterface(
-      "tun1", "tun1", 0, net::NetworkChangeNotifier::CONNECTION_UNKNOWN, ip, 64,
-      net::IP_ADDRESS_ATTRIBUTE_NONE));
-
-  EXPECT_TRUE(ip.AssignFromIPLiteral(kIPv6PublicAddrString2));
-  list.push_back(net::NetworkInterface(
-      "tun2", "tun2", 0, net::NetworkChangeNotifier::CONNECTION_WIFI, ip, 64,
-      net::IP_ADDRESS_ATTRIBUTE_NONE));
-
-  network_manager_->OnNetworkListChanged(list, net::IPAddress(),
-                                         net::IPAddress());
-  network_manager_->GetNetworks(&networks);
-  EXPECT_EQ(2uL, networks.size());
-
-  auto tun1 = std::find_if(
-      networks.begin(), networks.end(),
-      [](rtc::Network* network) { return network->name() == "tun1"; });
-  ASSERT_NE(networks.end(), tun1);
-  auto tun2 = std::find_if(
-      networks.begin(), networks.end(),
-      [](rtc::Network* network) { return network->name() == "tun2"; });
-  ASSERT_NE(networks.end(), tun1);
-
-  EXPECT_EQ(rtc::ADAPTER_TYPE_VPN, (*tun1)->type());
-  EXPECT_EQ(rtc::ADAPTER_TYPE_WIFI, (*tun2)->type());
-}
-
-// Test that IpcNetworkManager will act as the mDNS responder provider for
-// all networks that it returns.
-TEST_F(IpcNetworkManagerTest,
-       ServeAsMdnsResponderProviderForNetworksEnumerated) {
-  net::NetworkInterfaceList list;
-  // Add networks.
-  net::IPAddress ip;
-  EXPECT_TRUE(ip.AssignFromIPLiteral(kIPv6PublicAddrString1));
-  list.push_back(net::NetworkInterface(
-      "em1", "em1", 0, net::NetworkChangeNotifier::CONNECTION_UNKNOWN, ip, 64,
-      net::IP_ADDRESS_ATTRIBUTE_NONE));
-
-  network_manager_->OnNetworkListChanged(list, net::IPAddress(),
-                                         net::IPAddress());
-  std::vector<rtc::Network*> networks;
-  network_manager_->GetNetworks(&networks);
-
-  ASSERT_EQ(1u, networks.size());
-  webrtc::MdnsResponderInterface* const mdns_responder =
-      network_manager_->GetMdnsResponder();
-  EXPECT_EQ(mdns_responder, networks[0]->GetMdnsResponder());
-  networks.clear();
-  network_manager_->GetAnyAddressNetworks(&networks);
-  ASSERT_EQ(2u, networks.size());
-  EXPECT_EQ(mdns_responder, networks[0]->GetMdnsResponder());
-  EXPECT_EQ(mdns_responder, networks[1]->GetMdnsResponder());
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/ipc_socket_factory.cc b/chromium/content/renderer/p2p/ipc_socket_factory.cc
deleted file mode 100644
index 39e0f1c500a..00000000000
--- a/chromium/content/renderer/p2p/ipc_socket_factory.cc
+++ /dev/null
@@ -1,797 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/ipc_socket_factory.h"
-
-#include <stddef.h>
-
-#include <algorithm>
-#include <list>
-
-#include "base/bind.h"
-#include "base/compiler_specific.h"
-#include "base/logging.h"
-#include "base/macros.h"
-#include "base/metrics/histogram_macros.h"
-#include "base/sequence_checker.h"
-#include "base/strings/stringprintf.h"
-#include "base/threading/thread_checker.h"
-#include "base/trace_event/trace_event.h"
-#include "content/renderer/p2p/host_address_request.h"
-#include "content/renderer/p2p/socket_client_delegate.h"
-#include "content/renderer/p2p/socket_client_impl.h"
-#include "content/renderer/p2p/socket_dispatcher.h"
-#include "jingle/glue/utils.h"
-#include "net/base/ip_address.h"
-#include "third_party/blink/public/platform/modules/webrtc/webrtc_logging.h"
-#include "third_party/webrtc/rtc_base/async_packet_socket.h"
-
-namespace content {
-
-namespace {
-
-const int kDefaultNonSetOptionValue = -1;
-
-bool IsTcpClientSocket(network::P2PSocketType type) {
-  return (type == network::P2P_SOCKET_STUN_TCP_CLIENT) ||
-         (type == network::P2P_SOCKET_TCP_CLIENT) ||
-         (type == network::P2P_SOCKET_STUN_SSLTCP_CLIENT) ||
-         (type == network::P2P_SOCKET_SSLTCP_CLIENT) ||
-         (type == network::P2P_SOCKET_TLS_CLIENT) ||
-         (type == network::P2P_SOCKET_STUN_TLS_CLIENT);
-}
-
-bool JingleSocketOptionToP2PSocketOption(rtc::Socket::Option option,
-                                         network::P2PSocketOption* ipc_option) {
-  switch (option) {
-    case rtc::Socket::OPT_RCVBUF:
-      *ipc_option = network::P2P_SOCKET_OPT_RCVBUF;
-      break;
-    case rtc::Socket::OPT_SNDBUF:
-      *ipc_option = network::P2P_SOCKET_OPT_SNDBUF;
-      break;
-    case rtc::Socket::OPT_DSCP:
-      *ipc_option = network::P2P_SOCKET_OPT_DSCP;
-      break;
-    case rtc::Socket::OPT_DONTFRAGMENT:
-    case rtc::Socket::OPT_NODELAY:
-    case rtc::Socket::OPT_IPV6_V6ONLY:
-    case rtc::Socket::OPT_RTP_SENDTIME_EXTN_ID:
-      return false;  // Not supported by the chrome sockets.
-    default:
-      NOTREACHED();
-      return false;
-  }
-  return true;
-}
-
-const size_t kMaximumInFlightBytes = 64 * 1024;  // 64 KB
-
-// IpcPacketSocket implements rtc::AsyncPacketSocket interface
-// using P2PSocketClient that works over IPC-channel. It must be used
-// on the thread it was created.
-class IpcPacketSocket : public rtc::AsyncPacketSocket,
-                        public P2PSocketClientDelegate {
- public:
-  IpcPacketSocket();
-  ~IpcPacketSocket() override;
-
-  // Struct to track information when a packet is received by this socket for
-  // send. The information tracked here will be used to match with the
-  // P2PSendPacketMetrics from the underneath system socket.
-  struct InFlightPacketRecord {
-    InFlightPacketRecord(uint64_t packet_id, size_t packet_size)
-        : packet_id(packet_id), packet_size(packet_size) {}
-
-    uint64_t packet_id;
-    size_t packet_size;
-  };
-
-  typedef std::list<InFlightPacketRecord> InFlightPacketList;
-
-  // Always takes ownership of client even if initialization fails.
-  bool Init(network::P2PSocketType type,
-            std::unique_ptr<P2PSocketClientImpl> client,
-            const rtc::SocketAddress& local_address,
-            uint16_t min_port,
-            uint16_t max_port,
-            const rtc::SocketAddress& remote_address);
-
-  // rtc::AsyncPacketSocket interface.
-  rtc::SocketAddress GetLocalAddress() const override;
-  rtc::SocketAddress GetRemoteAddress() const override;
-  int Send(const void* pv,
-           size_t cb,
-           const rtc::PacketOptions& options) override;
-  int SendTo(const void* pv,
-             size_t cb,
-             const rtc::SocketAddress& addr,
-             const rtc::PacketOptions& options) override;
-  int Close() override;
-  State GetState() const override;
-  int GetOption(rtc::Socket::Option option, int* value) override;
-  int SetOption(rtc::Socket::Option option, int value) override;
-  int GetError() const override;
-  void SetError(int error) override;
-
-  // P2PSocketClientDelegate implementation.
-  void OnOpen(const net::IPEndPoint& local_address,
-              const net::IPEndPoint& remote_address) override;
-  void OnIncomingTcpConnection(
-      const net::IPEndPoint& address,
-      std::unique_ptr<P2PSocketClient> client) override;
-  void OnSendComplete(
-      const network::P2PSendPacketMetrics& send_metrics) override;
-  void OnError() override;
-  void OnDataReceived(const net::IPEndPoint& address,
-                      const std::vector<int8_t>& data,
-                      const base::TimeTicks& timestamp) override;
-
- private:
-  enum InternalState {
-    IS_UNINITIALIZED,
-    IS_OPENING,
-    IS_OPEN,
-    IS_CLOSED,
-    IS_ERROR,
-  };
-
-  // Increment the counter for consecutive bytes discarded as socket is running
-  // out of buffer.
-  void IncrementDiscardCounters(size_t bytes_discarded);
-
-  // Update trace of send throttling internal state. This should be called
-  // immediately after any changes to |send_bytes_available_| and/or
-  // |in_flight_packet_records_|.
-  void TraceSendThrottlingState() const;
-
-  void InitAcceptedTcp(std::unique_ptr<P2PSocketClient> client,
-                       const rtc::SocketAddress& local_address,
-                       const rtc::SocketAddress& remote_address);
-
-  int DoSetOption(network::P2PSocketOption option, int value);
-
-  network::P2PSocketType type_;
-
-  // Used to verify that a method runs on the thread that created this socket.
-  base::ThreadChecker thread_checker_;
-
-  // Corresponding P2P socket client.
-  std::unique_ptr<P2PSocketClient> client_;
-
-  // Local address is allocated by the browser process, and the
-  // renderer side doesn't know the address until it receives OnOpen()
-  // event from the browser.
-  rtc::SocketAddress local_address_;
-
-  // Remote address for client TCP connections.
-  rtc::SocketAddress remote_address_;
-
-  // Current state of the object.
-  InternalState state_;
-
-  // Track the number of bytes allowed to be sent non-blocking. This is used to
-  // throttle the sending of packets to the browser process. For each packet
-  // sent, the value is decreased. As callbacks to OnSendComplete() (as IPCs
-  // from the browser process) are made, the value is increased back. This
-  // allows short bursts of high-rate sending without dropping packets, but
-  // quickly restricts the client to a sustainable steady-state rate.
-  size_t send_bytes_available_;
-
-  // Used to detect when browser doesn't send SendComplete message for some
-  // packets. In normal case, the first packet should be the one that we're
-  // going to receive the next completion signal.
-  InFlightPacketList in_flight_packet_records_;
-
-  // Set to true once EWOULDBLOCK was returned from Send(). Indicates that the
-  // caller expects SignalWritable notification.
-  bool writable_signal_expected_;
-
-  // Current error code. Valid when state_ == IS_ERROR.
-  int error_;
-  int options_[network::P2P_SOCKET_OPT_MAX];
-
-  // Track the maximum and current consecutive bytes discarded due to not enough
-  // send_bytes_available_.
-  size_t max_discard_bytes_sequence_;
-  size_t current_discard_bytes_sequence_;
-
-  // Track the total number of packets and the number of packets discarded.
-  size_t packets_discarded_;
-  size_t total_packets_;
-
-  DISALLOW_COPY_AND_ASSIGN(IpcPacketSocket);
-};
-
-// Simple wrapper around P2PAsyncAddressResolver. The main purpose of this
-// class is to send SignalDone, after OnDone callback from
-// P2PAsyncAddressResolver. Libjingle sig slots are not thread safe. In case
-// of MT sig slots clients must call disconnect. This class is to make sure
-// we destruct from the same thread on which is created.
-class AsyncAddressResolverImpl : public rtc::AsyncResolverInterface {
- public:
-  AsyncAddressResolverImpl(P2PSocketDispatcher* dispatcher);
-  ~AsyncAddressResolverImpl() override;
-
-  // rtc::AsyncResolverInterface interface.
-  void Start(const rtc::SocketAddress& addr) override;
-  bool GetResolvedAddress(int family, rtc::SocketAddress* addr) const override;
-  int GetError() const override;
-  void Destroy(bool wait) override;
-
- private:
-  virtual void OnAddressResolved(const net::IPAddressList& addresses);
-
-  scoped_refptr<P2PAsyncAddressResolver> resolver_;
-
-  SEQUENCE_CHECKER(sequence_checker_);
-
-  rtc::SocketAddress addr_;                // Address to resolve.
-  std::vector<rtc::IPAddress> addresses_;  // Resolved addresses.
-};
-
-IpcPacketSocket::IpcPacketSocket()
-    : type_(network::P2P_SOCKET_UDP),
-      state_(IS_UNINITIALIZED),
-      send_bytes_available_(kMaximumInFlightBytes),
-      writable_signal_expected_(false),
-      error_(0),
-      max_discard_bytes_sequence_(0),
-      current_discard_bytes_sequence_(0),
-      packets_discarded_(0),
-      total_packets_(0) {
-  static_assert(kMaximumInFlightBytes > 0, "would send at zero rate");
-  std::fill_n(options_, static_cast<int>(network::P2P_SOCKET_OPT_MAX),
-              kDefaultNonSetOptionValue);
-}
-
-IpcPacketSocket::~IpcPacketSocket() {
-  if (state_ == IS_OPENING || state_ == IS_OPEN ||
-      state_ == IS_ERROR) {
-    Close();
-  }
-
-  UMA_HISTOGRAM_CUSTOM_COUNTS("WebRTC.ApplicationMaxConsecutiveBytesDiscard.v2",
-                              max_discard_bytes_sequence_, 1, 1000000, 200);
-  if (total_packets_ > 0) {
-    UMA_HISTOGRAM_PERCENTAGE("WebRTC.ApplicationPercentPacketsDiscarded",
-                             (packets_discarded_ * 100) / total_packets_);
-  }
-}
-
-void IpcPacketSocket::TraceSendThrottlingState() const {
-  TRACE_COUNTER_ID1("p2p", "P2PSendBytesAvailable", local_address_.port(),
-                    send_bytes_available_);
-  TRACE_COUNTER_ID1("p2p", "P2PSendPacketsInFlight", local_address_.port(),
-                    in_flight_packet_records_.size());
-}
-
-void IpcPacketSocket::IncrementDiscardCounters(size_t bytes_discarded) {
-  current_discard_bytes_sequence_ += bytes_discarded;
-  packets_discarded_++;
-
-  if (current_discard_bytes_sequence_ > max_discard_bytes_sequence_) {
-    max_discard_bytes_sequence_ = current_discard_bytes_sequence_;
-  }
-}
-
-bool IpcPacketSocket::Init(network::P2PSocketType type,
-                           std::unique_ptr<P2PSocketClientImpl> client,
-                           const rtc::SocketAddress& local_address,
-                           uint16_t min_port,
-                           uint16_t max_port,
-                           const rtc::SocketAddress& remote_address) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK_EQ(state_, IS_UNINITIALIZED);
-
-  type_ = type;
-  auto* client_ptr = client.get();
-  client_ = std::move(client);
-  local_address_ = local_address;
-  remote_address_ = remote_address;
-  state_ = IS_OPENING;
-
-  net::IPEndPoint local_endpoint;
-  if (!jingle_glue::SocketAddressToIPEndPoint(
-          local_address, &local_endpoint)) {
-    return false;
-  }
-
-  net::IPEndPoint remote_endpoint;
-  if (!remote_address.IsNil()) {
-    DCHECK(IsTcpClientSocket(type_));
-
-    if (remote_address.IsUnresolvedIP()) {
-      remote_endpoint =
-          net::IPEndPoint(net::IPAddress(), remote_address.port());
-    } else {
-      if (!jingle_glue::SocketAddressToIPEndPoint(remote_address,
-                                                  &remote_endpoint)) {
-        return false;
-      }
-    }
-  }
-
-  // We need to send both resolved and unresolved address in Init. Unresolved
-  // address will be used in case of TLS for certificate hostname matching.
-  // Certificate will be tied to domain name not to IP address.
-  network::P2PHostAndIPEndPoint remote_info(remote_address.hostname(),
-                                            remote_endpoint);
-
-  client_ptr->Init(type, local_endpoint, min_port, max_port, remote_info, this);
-
-  return true;
-}
-
-void IpcPacketSocket::InitAcceptedTcp(
-    std::unique_ptr<P2PSocketClient> client,
-    const rtc::SocketAddress& local_address,
-    const rtc::SocketAddress& remote_address) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK_EQ(state_, IS_UNINITIALIZED);
-
-  client_ = std::move(client);
-  local_address_ = local_address;
-  remote_address_ = remote_address;
-  state_ = IS_OPEN;
-  TraceSendThrottlingState();
-  client_->SetDelegate(this);
-}
-
-// rtc::AsyncPacketSocket interface.
-rtc::SocketAddress IpcPacketSocket::GetLocalAddress() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return local_address_;
-}
-
-rtc::SocketAddress IpcPacketSocket::GetRemoteAddress() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return remote_address_;
-}
-
-int IpcPacketSocket::Send(const void *data, size_t data_size,
-                          const rtc::PacketOptions& options) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return SendTo(data, data_size, remote_address_, options);
-}
-
-int IpcPacketSocket::SendTo(const void *data, size_t data_size,
-                            const rtc::SocketAddress& address,
-                            const rtc::PacketOptions& options) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  switch (state_) {
-    case IS_UNINITIALIZED:
-      NOTREACHED();
-      error_ = EWOULDBLOCK;
-      return -1;
-    case IS_OPENING:
-      error_ = EWOULDBLOCK;
-      return -1;
-    case IS_CLOSED:
-      error_ = ENOTCONN;
-      return -1;
-    case IS_ERROR:
-      return -1;
-    case IS_OPEN:
-      // Continue sending the packet.
-      break;
-  }
-
-  if (data_size == 0) {
-    NOTREACHED();
-    return 0;
-  }
-
-  total_packets_++;
-
-  if (data_size > send_bytes_available_) {
-    TRACE_EVENT_INSTANT1("p2p", "MaxPendingBytesWouldBlock",
-                         TRACE_EVENT_SCOPE_THREAD,
-                         "id",
-                         client_->GetSocketID());
-    if (!writable_signal_expected_) {
-      blink::WebRtcLogMessage(base::StringPrintf(
-          "IpcPacketSocket: sending is blocked. %d packets_in_flight.",
-          static_cast<int>(in_flight_packet_records_.size())));
-
-      writable_signal_expected_ = true;
-    }
-
-    error_ = EWOULDBLOCK;
-    IncrementDiscardCounters(data_size);
-    return -1;
-  } else {
-    current_discard_bytes_sequence_ = 0;
-  }
-
-  net::IPEndPoint address_chrome;
-  if (address.IsUnresolvedIP()) {
-    address_chrome = net::IPEndPoint(net::IPAddress(), address.port());
-  } else {
-    if (!jingle_glue::SocketAddressToIPEndPoint(address, &address_chrome)) {
-      LOG(WARNING) << "Failed to convert remote address to IPEndPoint: address="
-                   << address.ipaddr().ToSensitiveString()
-                   << ", remote_address_="
-                   << remote_address_.ipaddr().ToSensitiveString();
-      NOTREACHED();
-      error_ = EINVAL;
-      return -1;
-    }
-  }
-
-  send_bytes_available_ -= data_size;
-
-  const int8_t* data_char = reinterpret_cast<const int8_t*>(data);
-  std::vector<int8_t> data_vector(data_char, data_char + data_size);
-  uint64_t packet_id = client_->Send(address_chrome, data_vector, options);
-
-  // Ensure packet_id is not 0. It can't be the case according to
-  // P2PSocketClientImpl::Send().
-  DCHECK_NE(packet_id, 0uL);
-
-  in_flight_packet_records_.push_back(
-      InFlightPacketRecord(packet_id, data_size));
-  TraceSendThrottlingState();
-
-  // Fake successful send. The caller ignores result anyway.
-  return data_size;
-}
-
-int IpcPacketSocket::Close() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  client_->Close();
-  state_ = IS_CLOSED;
-
-  return 0;
-}
-
-rtc::AsyncPacketSocket::State IpcPacketSocket::GetState() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  switch (state_) {
-    case IS_UNINITIALIZED:
-      NOTREACHED();
-      return STATE_CLOSED;
-
-    case IS_OPENING:
-      return STATE_BINDING;
-
-    case IS_OPEN:
-      if (IsTcpClientSocket(type_)) {
-        return STATE_CONNECTED;
-      } else {
-        return STATE_BOUND;
-      }
-
-    case IS_CLOSED:
-    case IS_ERROR:
-      return STATE_CLOSED;
-  }
-
-  NOTREACHED();
-  return STATE_CLOSED;
-}
-
-int IpcPacketSocket::GetOption(rtc::Socket::Option option, int* value) {
-  network::P2PSocketOption p2p_socket_option = network::P2P_SOCKET_OPT_MAX;
-  if (!JingleSocketOptionToP2PSocketOption(option, &p2p_socket_option)) {
-    // unsupported option.
-    return -1;
-  }
-
-  *value = options_[p2p_socket_option];
-  return 0;
-}
-
-int IpcPacketSocket::SetOption(rtc::Socket::Option option, int value) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  network::P2PSocketOption p2p_socket_option = network::P2P_SOCKET_OPT_MAX;
-  if (!JingleSocketOptionToP2PSocketOption(option, &p2p_socket_option)) {
-    // Option is not supported.
-    return -1;
-  }
-
-  options_[p2p_socket_option] = value;
-
-  if (state_ == IS_OPEN) {
-    // Options will be applied when state becomes IS_OPEN in OnOpen.
-    return DoSetOption(p2p_socket_option, value);
-  }
-  return 0;
-}
-
-int IpcPacketSocket::DoSetOption(network::P2PSocketOption option, int value) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK_EQ(state_, IS_OPEN);
-
-  client_->SetOption(option, value);
-  return 0;
-}
-
-int IpcPacketSocket::GetError() const {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  return error_;
-}
-
-void IpcPacketSocket::SetError(int error) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  error_ = error;
-}
-
-void IpcPacketSocket::OnOpen(const net::IPEndPoint& local_address,
-                             const net::IPEndPoint& remote_address) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  if (!jingle_glue::IPEndPointToSocketAddress(local_address, &local_address_)) {
-    // Always expect correct IPv4 address to be allocated.
-    NOTREACHED();
-    OnError();
-    return;
-  }
-
-  state_ = IS_OPEN;
-  TraceSendThrottlingState();
-
-  // Set all pending options if any.
-  for (int i = 0; i < network::P2P_SOCKET_OPT_MAX; ++i) {
-    if (options_[i] != kDefaultNonSetOptionValue)
-      DoSetOption(static_cast<network::P2PSocketOption>(i), options_[i]);
-  }
-
-  SignalAddressReady(this, local_address_);
-  if (IsTcpClientSocket(type_)) {
-    // If remote address is unresolved, set resolved remote IP address received
-    // in the callback. This address will be used while sending the packets
-    // over the network.
-    if (remote_address_.IsUnresolvedIP()) {
-      rtc::SocketAddress jingle_socket_address;
-      // |remote_address| could be unresolved if the connection is behind a
-      // proxy.
-      if (!remote_address.address().empty() &&
-          jingle_glue::IPEndPointToSocketAddress(
-              remote_address, &jingle_socket_address)) {
-        // Set only the IP address.
-        remote_address_.SetResolvedIP(jingle_socket_address.ipaddr());
-      }
-    }
-
-    // SignalConnect after updating the |remote_address_| so that the listener
-    // can get the resolved remote address.
-    SignalConnect(this);
-  }
-}
-
-void IpcPacketSocket::OnIncomingTcpConnection(
-    const net::IPEndPoint& address,
-    std::unique_ptr<P2PSocketClient> client) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  std::unique_ptr<IpcPacketSocket> socket(new IpcPacketSocket());
-
-  rtc::SocketAddress remote_address;
-  if (!jingle_glue::IPEndPointToSocketAddress(address, &remote_address)) {
-    // Always expect correct IPv4 address to be allocated.
-    NOTREACHED();
-  }
-  socket->InitAcceptedTcp(std::move(client), local_address_, remote_address);
-  SignalNewConnection(this, socket.release());
-}
-
-void IpcPacketSocket::OnSendComplete(
-    const network::P2PSendPacketMetrics& send_metrics) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  CHECK(!in_flight_packet_records_.empty());
-
-  const InFlightPacketRecord& record = in_flight_packet_records_.front();
-
-  // Tracking is not turned on for TCP so it's always 0. For UDP, this will
-  // cause a crash when the packet ids don't match.
-  CHECK(send_metrics.packet_id == 0 ||
-        record.packet_id == send_metrics.packet_id);
-
-  send_bytes_available_ += record.packet_size;
-
-  DCHECK_LE(send_bytes_available_, kMaximumInFlightBytes);
-
-  in_flight_packet_records_.pop_front();
-  TraceSendThrottlingState();
-
-  SignalSentPacket(this, rtc::SentPacket(send_metrics.rtc_packet_id,
-                                         send_metrics.send_time_ms));
-
-  if (writable_signal_expected_ && send_bytes_available_ > 0) {
-    blink::WebRtcLogMessage(base::StringPrintf(
-        "IpcPacketSocket: sending is unblocked. %d packets in flight.",
-        static_cast<int>(in_flight_packet_records_.size())));
-
-    writable_signal_expected_ = false;
-    SignalReadyToSend(this);
-  }
-}
-
-void IpcPacketSocket::OnError() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  bool was_closed = (state_ == IS_ERROR || state_ == IS_CLOSED);
-  state_ = IS_ERROR;
-  error_ = ECONNABORTED;
-  if (!was_closed) {
-    SignalClose(this, 0);
-  }
-}
-
-void IpcPacketSocket::OnDataReceived(const net::IPEndPoint& address,
-                                     const std::vector<int8_t>& data,
-                                     const base::TimeTicks& timestamp) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  rtc::SocketAddress address_lj;
-
-  if (address.address().empty()) {
-    DCHECK(IsTcpClientSocket(type_));
-    // |address| could be empty for TCP connections behind a proxy.
-    address_lj = remote_address_;
-  } else {
-    if (!jingle_glue::IPEndPointToSocketAddress(address, &address_lj)) {
-      // We should always be able to convert address here because we
-      // don't expect IPv6 address on IPv4 connections.
-      NOTREACHED();
-      return;
-    }
-  }
-
-  SignalReadPacket(this, reinterpret_cast<const char*>(&data[0]), data.size(),
-                   address_lj, timestamp.since_origin().InMicroseconds());
-}
-
-AsyncAddressResolverImpl::AsyncAddressResolverImpl(
-    P2PSocketDispatcher* dispatcher)
-    : resolver_(new P2PAsyncAddressResolver(dispatcher)) {
-}
-
-AsyncAddressResolverImpl::~AsyncAddressResolverImpl() {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-}
-
-void AsyncAddressResolverImpl::Start(const rtc::SocketAddress& addr) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  // Port and hostname must be copied to the resolved address returned from
-  // GetResolvedAddress.
-  addr_ = addr;
-
-  resolver_->Start(addr,
-                   base::BindOnce(&AsyncAddressResolverImpl::OnAddressResolved,
-                                  base::Unretained(this)));
-}
-
-bool AsyncAddressResolverImpl::GetResolvedAddress(
-    int family, rtc::SocketAddress* addr) const {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-
-  if (addresses_.empty())
-   return false;
-
-  for (size_t i = 0; i < addresses_.size(); ++i) {
-    if (family == addresses_[i].family()) {
-      *addr = addr_;
-      addr->SetResolvedIP(addresses_[i]);
-      return true;
-    }
-  }
-  return false;
-}
-
-int AsyncAddressResolverImpl::GetError() const {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  return addresses_.empty() ? -1 : 0;
-}
-
-void AsyncAddressResolverImpl::Destroy(bool wait) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  resolver_->Cancel();
-  // Libjingle doesn't need this object any more and it's not going to delete
-  // it explicitly.
-  delete this;
-}
-
-void AsyncAddressResolverImpl::OnAddressResolved(
-    const net::IPAddressList& addresses) {
-  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  for (size_t i = 0; i < addresses.size(); ++i) {
-    rtc::SocketAddress socket_address;
-    if (!jingle_glue::IPEndPointToSocketAddress(
-            net::IPEndPoint(addresses[i], 0), &socket_address)) {
-      NOTREACHED();
-    }
-    addresses_.push_back(socket_address.ipaddr());
-  }
-  SignalDone(this);
-}
-
-}  // namespace
-
-IpcPacketSocketFactory::IpcPacketSocketFactory(
-    P2PSocketDispatcher* socket_dispatcher,
-    const net::NetworkTrafficAnnotationTag& traffic_annotation)
-    : socket_dispatcher_(socket_dispatcher),
-      traffic_annotation_(traffic_annotation) {}
-
-IpcPacketSocketFactory::~IpcPacketSocketFactory() {
-}
-
-rtc::AsyncPacketSocket* IpcPacketSocketFactory::CreateUdpSocket(
-    const rtc::SocketAddress& local_address,
-    uint16_t min_port,
-    uint16_t max_port) {
-  auto socket_client = std::make_unique<P2PSocketClientImpl>(
-      socket_dispatcher_, traffic_annotation_);
-  std::unique_ptr<IpcPacketSocket> socket(new IpcPacketSocket());
-  if (!socket->Init(network::P2P_SOCKET_UDP, std::move(socket_client),
-                    local_address, min_port, max_port, rtc::SocketAddress())) {
-    return nullptr;
-  }
-  return socket.release();
-}
-
-rtc::AsyncPacketSocket* IpcPacketSocketFactory::CreateServerTcpSocket(
-    const rtc::SocketAddress& local_address,
-    uint16_t min_port,
-    uint16_t max_port,
-    int opts) {
-  // TODO(sergeyu): Implement SSL support.
-  if (opts & rtc::PacketSocketFactory::OPT_SSLTCP)
-    return nullptr;
-
-  network::P2PSocketType type = (opts & rtc::PacketSocketFactory::OPT_STUN)
-                                    ? network::P2P_SOCKET_STUN_TCP_SERVER
-                                    : network::P2P_SOCKET_TCP_SERVER;
-  auto socket_client = std::make_unique<P2PSocketClientImpl>(
-      socket_dispatcher_, traffic_annotation_);
-  std::unique_ptr<IpcPacketSocket> socket(new IpcPacketSocket());
-  if (!socket->Init(type, std::move(socket_client), local_address, min_port,
-                    max_port, rtc::SocketAddress())) {
-    return nullptr;
-  }
-  return socket.release();
-}
-
-rtc::AsyncPacketSocket* IpcPacketSocketFactory::CreateClientTcpSocket(
-    const rtc::SocketAddress& local_address,
-    const rtc::SocketAddress& remote_address,
-    const rtc::ProxyInfo& proxy_info,
-    const std::string& user_agent, int opts) {
-  network::P2PSocketType type;
-  if (opts & rtc::PacketSocketFactory::OPT_SSLTCP) {
-    type = (opts & rtc::PacketSocketFactory::OPT_STUN)
-               ? network::P2P_SOCKET_STUN_SSLTCP_CLIENT
-               : network::P2P_SOCKET_SSLTCP_CLIENT;
-  } else if (opts & rtc::PacketSocketFactory::OPT_TLS) {
-    type = (opts & rtc::PacketSocketFactory::OPT_STUN)
-               ? network::P2P_SOCKET_STUN_TLS_CLIENT
-               : network::P2P_SOCKET_TLS_CLIENT;
-  } else {
-    type = (opts & rtc::PacketSocketFactory::OPT_STUN)
-               ? network::P2P_SOCKET_STUN_TCP_CLIENT
-               : network::P2P_SOCKET_TCP_CLIENT;
-  }
-  auto socket_client = std::make_unique<P2PSocketClientImpl>(
-      socket_dispatcher_, traffic_annotation_);
-  std::unique_ptr<IpcPacketSocket> socket(new IpcPacketSocket());
-  if (!socket->Init(type, std::move(socket_client), local_address, 0, 0,
-                    remote_address))
-    return nullptr;
-  return socket.release();
-}
-
-rtc::AsyncResolverInterface*
-IpcPacketSocketFactory::CreateAsyncResolver() {
-  std::unique_ptr<AsyncAddressResolverImpl> resolver(
-      new AsyncAddressResolverImpl(socket_dispatcher_));
-  return resolver.release();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/ipc_socket_factory.h b/chromium/content/renderer/p2p/ipc_socket_factory.h
deleted file mode 100644
index 3eda7a34fab..00000000000
--- a/chromium/content/renderer/p2p/ipc_socket_factory.h
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright (c) 2011 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_IPC_SOCKET_FACTORY_H_
-#define CONTENT_RENDERER_P2P_IPC_SOCKET_FACTORY_H_
-
-#include <stdint.h>
-
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "content/common/content_export.h"
-#include "net/traffic_annotation/network_traffic_annotation.h"
-#include "third_party/webrtc/p2p/base/packet_socket_factory.h"
-
-namespace content {
-
-class P2PSocketDispatcher;
-
-// IpcPacketSocketFactory implements rtc::PacketSocketFactory
-// interface for libjingle using IPC-based P2P sockets. The class must
-// be used on a thread that is a libjingle thread (implements
-// rtc::Thread) and also has associated base::MessageLoop. Each
-// socket created by the factory must be used on the thread it was
-// created on.
-class IpcPacketSocketFactory : public rtc::PacketSocketFactory {
- public:
-  CONTENT_EXPORT explicit IpcPacketSocketFactory(
-      P2PSocketDispatcher* socket_dispatcher,
-      const net::NetworkTrafficAnnotationTag& traffic_annotation);
-  ~IpcPacketSocketFactory() override;
-
-  rtc::AsyncPacketSocket* CreateUdpSocket(
-      const rtc::SocketAddress& local_address,
-      uint16_t min_port,
-      uint16_t max_port) override;
-  rtc::AsyncPacketSocket* CreateServerTcpSocket(
-      const rtc::SocketAddress& local_address,
-      uint16_t min_port,
-      uint16_t max_port,
-      int opts) override;
-  rtc::AsyncPacketSocket* CreateClientTcpSocket(
-      const rtc::SocketAddress& local_address,
-      const rtc::SocketAddress& remote_address,
-      const rtc::ProxyInfo& proxy_info,
-      const std::string& user_agent,
-      int opts) override;
-  rtc::AsyncResolverInterface* CreateAsyncResolver() override;
-
- private:
-  P2PSocketDispatcher* socket_dispatcher_;
-  const net::NetworkTrafficAnnotationTag traffic_annotation_;
-
-  DISALLOW_COPY_AND_ASSIGN(IpcPacketSocketFactory);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_IPC_SOCKET_FACTORY_H_
diff --git a/chromium/content/renderer/p2p/mdns_responder_adapter.cc b/chromium/content/renderer/p2p/mdns_responder_adapter.cc
deleted file mode 100644
index c208cd185c0..00000000000
--- a/chromium/content/renderer/p2p/mdns_responder_adapter.cc
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/mdns_responder_adapter.h"
-
-#include <string>
-
-#include "base/bind.h"
-#include "content/child/child_thread_impl.h"
-#include "content/public/common/service_names.mojom.h"
-#include "jingle/glue/utils.h"
-#include "net/base/ip_address.h"
-#include "net/base/ip_endpoint.h"
-#include "third_party/webrtc/rtc_base/ip_address.h"
-
-namespace content {
-
-namespace {
-
-void OnNameCreatedForAddress(
-    webrtc::MdnsResponderInterface::NameCreatedCallback callback,
-    const rtc::IPAddress& addr,
-    const std::string& name,
-    bool announcement_scheduled) {
-  // We currently ignore whether there is an announcement sent for the name.
-  callback(addr, name);
-}
-
-void OnNameRemovedForAddress(
-    webrtc::MdnsResponderInterface::NameRemovedCallback callback,
-    bool removed,
-    bool goodbye_scheduled) {
-  // We currently ignore whether there is a goodbye sent for the name.
-  callback(removed);
-}
-
-}  // namespace
-
-MdnsResponderAdapter::MdnsResponderAdapter() {
-  network::mojom::MdnsResponderPtr client;
-  auto request = mojo::MakeRequest(&client);
-  thread_safe_client_ =
-      network::mojom::ThreadSafeMdnsResponderPtr::Create(std::move(client));
-  DCHECK(ChildThreadImpl::current());
-  ChildThreadImpl::current()->BindHostReceiver(std::move(request));
-}
-
-MdnsResponderAdapter::~MdnsResponderAdapter() = default;
-
-void MdnsResponderAdapter::CreateNameForAddress(const rtc::IPAddress& addr,
-                                                NameCreatedCallback callback) {
-  thread_safe_client_->get()->CreateNameForAddress(
-      jingle_glue::RtcIPAddressToNetIPAddress(addr),
-      base::BindOnce(&OnNameCreatedForAddress, callback, addr));
-}
-
-void MdnsResponderAdapter::RemoveNameForAddress(const rtc::IPAddress& addr,
-                                                NameRemovedCallback callback) {
-  thread_safe_client_->get()->RemoveNameForAddress(
-      jingle_glue::RtcIPAddressToNetIPAddress(addr),
-      base::BindOnce(&OnNameRemovedForAddress, callback));
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/mdns_responder_adapter.h b/chromium/content/renderer/p2p/mdns_responder_adapter.h
deleted file mode 100644
index 3e532a574e9..00000000000
--- a/chromium/content/renderer/p2p/mdns_responder_adapter.h
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2018 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_MDNS_RESPONDER_ADAPTER_H_
-#define CONTENT_RENDERER_P2P_MDNS_RESPONDER_ADAPTER_H_
-
-#include "services/network/public/mojom/mdns_responder.mojom.h"
-#include "third_party/webrtc/rtc_base/mdns_responder_interface.h"
-
-namespace rtc {
-class IPAddress;
-}  // namespace rtc
-
-namespace content {
-
-// This class is created on the main thread but is used only on the WebRTC
-// worker threads. The MdnsResponderAdapter implements the WebRTC mDNS responder
-// interface via the MdnsResponder service in Chromium, and is used to register
-// and resolve mDNS hostnames to conceal local IP addresses.
-class MdnsResponderAdapter : public webrtc::MdnsResponderInterface {
- public:
-  // The adapter should be created on the main thread to have access to the
-  // connector to the service manager.
-  MdnsResponderAdapter();
-  ~MdnsResponderAdapter() override;
-
-  // webrtc::MdnsResponderInterface implementation.
-  void CreateNameForAddress(const rtc::IPAddress& addr,
-                            NameCreatedCallback callback) override;
-  void RemoveNameForAddress(const rtc::IPAddress& addr,
-                            NameRemovedCallback callback) override;
-
- private:
-  scoped_refptr<network::mojom::ThreadSafeMdnsResponderPtr> thread_safe_client_;
-
-  DISALLOW_COPY_AND_ASSIGN(MdnsResponderAdapter);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_MDNS_RESPONDER_ADAPTER_H_
diff --git a/chromium/content/renderer/p2p/network_list_manager.h b/chromium/content/renderer/p2p/network_list_manager.h
deleted file mode 100644
index c0e0f58bdae..00000000000
--- a/chromium/content/renderer/p2p/network_list_manager.h
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// NetworkListManager interface is introduced to enable unit test on
-// IpcNetworkManager such that it doesn't depend on implementation of
-// P2PSocketDispatcher.
-
-#ifndef CONTENT_RENDERER_P2P_NETWORK_LIST_MANAGER_H_
-#define CONTENT_RENDERER_P2P_NETWORK_LIST_MANAGER_H_
-
-namespace content {
-
-class NetworkListObserver;
-
-class CONTENT_EXPORT NetworkListManager {
- public:
-  // Add a new network list observer. Each observer is called
-  // immidiately after it is registered and then later whenever
-  // network configuration changes. Can be called on any thread. The
-  // observer is always called on the thread it was added.
-  virtual void AddNetworkListObserver(
-      NetworkListObserver* network_list_observer) = 0;
-
-  // Removes network list observer. Must be called on the thread on
-  // which the observer was added.
-  virtual void RemoveNetworkListObserver(
-      NetworkListObserver* network_list_observer) = 0;
-
- protected:
-  // Marked as protected to prevent explicit deletion, as
-  // P2PSocketDispatcher is not owned by IpcNetworkManager.
-  virtual ~NetworkListManager() {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_NETWORK_LIST_MANAGER_H_
diff --git a/chromium/content/renderer/p2p/network_list_observer.h b/chromium/content/renderer/p2p/network_list_observer.h
deleted file mode 100644
index 309f0ce0f0b..00000000000
--- a/chromium/content/renderer/p2p/network_list_observer.h
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_NETWORK_LIST_OBSERVER_H_
-#define CONTENT_RENDERER_P2P_NETWORK_LIST_OBSERVER_H_
-
-#include <vector>
-
-namespace net {
-class IPAddress;
-struct NetworkInterface;
-typedef std::vector<NetworkInterface> NetworkInterfaceList;
-}  // namespace net
-
-namespace content {
-
-class NetworkListObserver {
- public:
-  virtual ~NetworkListObserver() {}
-
-  virtual void OnNetworkListChanged(
-      const net::NetworkInterfaceList& list,
-      const net::IPAddress& default_ipv4_local_address,
-      const net::IPAddress& default_ipv6_local_address) = 0;
-
- protected:
-  NetworkListObserver() {}
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_NETWORK_LIST_OBSERVER_H_
diff --git a/chromium/content/renderer/p2p/network_manager_uma.cc b/chromium/content/renderer/p2p/network_manager_uma.cc
deleted file mode 100644
index 40f91a2106e..00000000000
--- a/chromium/content/renderer/p2p/network_manager_uma.cc
+++ /dev/null
@@ -1,21 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/network_manager_uma.h"
-
-#include "base/metrics/histogram_macros.h"
-#include "base/time/time.h"
-
-namespace content {
-
-void ReportTimeToUpdateNetworkList(const base::TimeDelta& ticks) {
-  UMA_HISTOGRAM_TIMES("WebRTC.PeerConnection.TimeToNetworkUpdated", ticks);
-}
-
-void ReportIPPermissionStatus(IPPermissionStatus status) {
-  UMA_HISTOGRAM_ENUMERATION("WebRTC.PeerConnection.IPPermissionStatus", status,
-                            PERMISSION_MAX);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/network_manager_uma.h b/chromium/content/renderer/p2p/network_manager_uma.h
deleted file mode 100644
index 370acf99b1c..00000000000
--- a/chromium/content/renderer/p2p/network_manager_uma.h
+++ /dev/null
@@ -1,31 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_NETWORK_MANAGER_UMA_H_
-#define CONTENT_RENDERER_P2P_NETWORK_MANAGER_UMA_H_
-
-namespace base {
-class TimeDelta;
-}  // namespace
-
-namespace content {
-
-// Need to be kept the same order as in histograms.xml
-enum IPPermissionStatus {
-  PERMISSION_UNKNOWN,  // Requested but have never fired SignalNetworksChanged.
-  PERMISSION_NOT_REQUESTED,             // Multiple routes is not requested.
-  PERMISSION_DENIED,                    // Requested but denied.
-  PERMISSION_GRANTED_WITH_CHECKING,     // Requested and granted after checking
-                                        // mic/camera permission.
-  PERMISSION_GRANTED_WITHOUT_CHECKING,  // Requested and granted without
-                                        // checking mic/camera permission.
-  PERMISSION_MAX,
-};
-
-void ReportIPPermissionStatus(IPPermissionStatus status);
-void ReportTimeToUpdateNetworkList(const base::TimeDelta& ticks);
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_NETWORK_MANAGER_UMA_H_
diff --git a/chromium/content/renderer/p2p/port_allocator.cc b/chromium/content/renderer/p2p/port_allocator.cc
deleted file mode 100644
index 00ee3beddab..00000000000
--- a/chromium/content/renderer/p2p/port_allocator.cc
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/port_allocator.h"
-
-#include <stdint.h>
-
-#include <memory>
-#include <utility>
-
-#include "base/command_line.h"
-#include "base/logging.h"
-#include "content/public/common/content_switches.h"
-#include "content/renderer/p2p/socket_dispatcher.h"
-
-namespace content {
-
-P2PPortAllocator::P2PPortAllocator(
-    const scoped_refptr<P2PSocketDispatcher>& socket_dispatcher,
-    std::unique_ptr<rtc::NetworkManager> network_manager,
-    rtc::PacketSocketFactory* socket_factory,
-    const Config& config,
-    const GURL& origin)
-    : cricket::BasicPortAllocator(network_manager.get(), socket_factory),
-      network_manager_(std::move(network_manager)),
-      socket_dispatcher_(socket_dispatcher),
-      config_(config),
-      origin_(origin) {
-  DCHECK(socket_dispatcher);
-  DCHECK(network_manager_);
-  DCHECK(socket_factory);
-  uint32_t flags = 0;
-  if (!config_.enable_multiple_routes) {
-    flags |= cricket::PORTALLOCATOR_DISABLE_ADAPTER_ENUMERATION;
-  }
-  if (!config_.enable_default_local_candidate) {
-    flags |= cricket::PORTALLOCATOR_DISABLE_DEFAULT_LOCAL_CANDIDATE;
-  }
-  if (!config_.enable_nonproxied_udp) {
-    flags |= cricket::PORTALLOCATOR_DISABLE_UDP |
-             cricket::PORTALLOCATOR_DISABLE_STUN |
-             cricket::PORTALLOCATOR_DISABLE_UDP_RELAY;
-  }
-  set_flags(flags);
-  set_allow_tcp_listen(false);
-  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
-  bool enable_webrtc_stun_origin =
-      cmd_line->HasSwitch(switches::kEnableWebRtcStunOrigin);
-  if (enable_webrtc_stun_origin) {
-    set_origin(origin_.spec());
-  }
-}
-
-P2PPortAllocator::~P2PPortAllocator() {}
-
-void P2PPortAllocator::Initialize() {
-  BasicPortAllocator::Initialize();
-  network_manager_->Initialize();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/port_allocator.h b/chromium/content/renderer/p2p/port_allocator.h
deleted file mode 100644
index 69417682faf..00000000000
--- a/chromium/content/renderer/p2p/port_allocator.h
+++ /dev/null
@@ -1,62 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_PORT_ALLOCATOR_H_
-#define CONTENT_RENDERER_P2P_PORT_ALLOCATOR_H_
-
-#include <memory>
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/single_thread_task_runner.h"
-#include "third_party/webrtc/p2p/client/basic_port_allocator.h"
-#include "url/gurl.h"
-
-namespace content {
-
-class P2PSocketDispatcher;
-
-class P2PPortAllocator : public cricket::BasicPortAllocator {
- public:
-  struct Config {
-    // Enable non-proxied UDP-based transport when set to true. When set to
-    // false, it effectively disables all UDP traffic until UDP-supporting proxy
-    // RETURN is available in the future.
-    bool enable_nonproxied_udp = true;
-
-    // Request binding to individual NICs. Whether multiple routes is allowed is
-    // subject to the permission check on mic/camera. When specified as false or
-    // the permission request is denied, it still uses the default local address
-    // to generate a single local candidate. TODO(guoweis): Rename this to
-    // |request_multiple_routes|.
-    bool enable_multiple_routes = true;
-
-    // Enable exposing the default local address when set to true. This is
-    // only in effect when the |enable_multiple_routes| is false or the
-    // permission check of mic/camera is denied.
-    bool enable_default_local_candidate = true;
-  };
-
-  P2PPortAllocator(const scoped_refptr<P2PSocketDispatcher>& socket_dispatcher,
-                   std::unique_ptr<rtc::NetworkManager> network_manager,
-                   rtc::PacketSocketFactory* socket_factory,
-                   const Config& config,
-                   const GURL& origin);
-  ~P2PPortAllocator() override;
-
-  // Will also initialize the network manager passed into the constructor.
-  void Initialize() override;
-
- private:
-  std::unique_ptr<rtc::NetworkManager> network_manager_;
-  scoped_refptr<P2PSocketDispatcher> socket_dispatcher_;
-  Config config_;
-  GURL origin_;
-
-  DISALLOW_COPY_AND_ASSIGN(P2PPortAllocator);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_PORT_ALLOCATOR_H_
diff --git a/chromium/content/renderer/p2p/socket_client.h b/chromium/content/renderer/p2p/socket_client.h
deleted file mode 100644
index 694d10e9fc6..00000000000
--- a/chromium/content/renderer/p2p/socket_client.h
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_SOCKET_CLIENT_H_
-#define CONTENT_RENDERER_P2P_SOCKET_CLIENT_H_
-
-#include <stdint.h>
-
-#include <vector>
-
-#include "net/base/ip_endpoint.h"
-#include "services/network/public/cpp/p2p_socket_type.h"
-
-namespace rtc {
-struct PacketOptions;
-}
-
-namespace content {
-
-class P2PSocketClientDelegate;
-
-// P2P socket that routes all calls over IPC.
-class P2PSocketClient {
- public:
-  virtual ~P2PSocketClient() {}
-
-  // Send the |data| to the |address| using Differentiated Services Code Point
-  // |dscp|. Return value is the unique packet_id for this packet.
-  virtual uint64_t Send(const net::IPEndPoint& address,
-                        const std::vector<int8_t>& data,
-                        const rtc::PacketOptions& options) = 0;
-
-  virtual void SetOption(network::P2PSocketOption option, int value) = 0;
-
-  // Must be called before the socket is destroyed.
-  virtual void Close() = 0;
-
-  virtual int GetSocketID() const = 0;
-  virtual void SetDelegate(P2PSocketClientDelegate* delegate) = 0;
-
- protected:
-  P2PSocketClient() {}
-};
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_SOCKET_CLIENT_H_
diff --git a/chromium/content/renderer/p2p/socket_client_delegate.h b/chromium/content/renderer/p2p/socket_client_delegate.h
deleted file mode 100644
index 680e6f2f84b..00000000000
--- a/chromium/content/renderer/p2p/socket_client_delegate.h
+++ /dev/null
@@ -1,48 +0,0 @@
-// Copyright 2014 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_SOCKET_CLIENT_DELEGATE_H_
-#define CONTENT_RENDERER_P2P_SOCKET_CLIENT_DELEGATE_H_
-
-#include <vector>
-
-#include "net/base/ip_endpoint.h"
-#include "services/network/public/cpp/p2p_socket_type.h"
-
-namespace content {
-
-class P2PSocketClient;
-
-class P2PSocketClientDelegate {
- public:
-  virtual ~P2PSocketClientDelegate() { }
-
-  // Called after the socket has been opened with the local endpoint address
-  // as argument. Please note that in the precence of multiple interfaces,
-  // you should not rely on the local endpoint address if possible.
-  virtual void OnOpen(const net::IPEndPoint& local_address,
-                      const net::IPEndPoint& remote_address) = 0;
-
-  // For a socket that is listening on incoming TCP connectsion, this
-  // function is called when a new client connects.
-  virtual void OnIncomingTcpConnection(
-      const net::IPEndPoint& address,
-      std::unique_ptr<P2PSocketClient> client) = 0;
-
-  // Called once for each Send() call after the send is complete.
-  virtual void OnSendComplete(
-      const network::P2PSendPacketMetrics& send_metrics) = 0;
-
-  // Called if an non-retryable error occurs.
-  virtual void OnError() = 0;
-
-  // Called when data is received on the socket.
-  virtual void OnDataReceived(const net::IPEndPoint& address,
-                              const std::vector<int8_t>& data,
-                              const base::TimeTicks& timestamp) = 0;
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_SOCKET_CLIENT_DELEGATE_H_
diff --git a/chromium/content/renderer/p2p/socket_client_impl.cc b/chromium/content/renderer/p2p/socket_client_impl.cc
deleted file mode 100644
index d9222de22be..00000000000
--- a/chromium/content/renderer/p2p/socket_client_impl.cc
+++ /dev/null
@@ -1,177 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/socket_client_impl.h"
-
-#include "base/bind.h"
-#include "base/location.h"
-#include "base/single_thread_task_runner.h"
-#include "base/threading/thread_task_runner_handle.h"
-#include "base/time/time.h"
-#include "content/renderer/p2p/socket_client_delegate.h"
-#include "content/renderer/p2p/socket_dispatcher.h"
-#include "content/renderer/render_thread_impl.h"
-#include "crypto/random.h"
-#include "services/network/public/cpp/p2p_param_traits.h"
-
-namespace {
-
-uint64_t GetUniqueId(uint32_t random_socket_id, uint32_t packet_id) {
-  uint64_t uid = random_socket_id;
-  uid <<= 32;
-  uid |= packet_id;
-  return uid;
-}
-
-}  // namespace
-
-namespace content {
-
-P2PSocketClientImpl::P2PSocketClientImpl(
-    P2PSocketDispatcher* dispatcher,
-    const net::NetworkTrafficAnnotationTag& traffic_annotation)
-    : dispatcher_(dispatcher),
-      socket_id_(0),
-      delegate_(nullptr),
-      state_(STATE_UNINITIALIZED),
-      traffic_annotation_(traffic_annotation),
-      random_socket_id_(0),
-      next_packet_id_(0),
-      binding_(this) {
-  crypto::RandBytes(&random_socket_id_, sizeof(random_socket_id_));
-}
-
-P2PSocketClientImpl::~P2PSocketClientImpl() {
-  CHECK(state_ == STATE_CLOSED || state_ == STATE_UNINITIALIZED);
-}
-
-void P2PSocketClientImpl::Init(
-    network::P2PSocketType type,
-    const net::IPEndPoint& local_address,
-    uint16_t min_port,
-    uint16_t max_port,
-    const network::P2PHostAndIPEndPoint& remote_address,
-    P2PSocketClientDelegate* delegate) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  DCHECK(delegate);
-  // |delegate_| is only accessesed on |delegate_message_loop_|.
-  delegate_ = delegate;
-
-  DCHECK_EQ(state_, STATE_UNINITIALIZED);
-  state_ = STATE_OPENING;
-  network::mojom::P2PSocketClientPtr socket_client;
-  binding_.Bind(mojo::MakeRequest(&socket_client));
-  binding_.set_connection_error_handler(base::BindOnce(
-      &P2PSocketClientImpl::OnConnectionError, base::Unretained(this)));
-  dispatcher_->GetP2PSocketManager()->get()->CreateSocket(
-      type, local_address, network::P2PPortRange(min_port, max_port),
-      remote_address, std::move(socket_client), mojo::MakeRequest(&socket_));
-}
-
-uint64_t P2PSocketClientImpl::Send(const net::IPEndPoint& address,
-                                   const std::vector<int8_t>& data,
-                                   const rtc::PacketOptions& options) {
-  uint64_t unique_id = GetUniqueId(random_socket_id_, ++next_packet_id_);
-
-  // Can send data only when the socket is open.
-  DCHECK(state_ == STATE_OPEN || state_ == STATE_ERROR);
-  if (state_ == STATE_OPEN) {
-    SendWithPacketId(address, data, options, unique_id);
-  }
-
-  return unique_id;
-}
-
-void P2PSocketClientImpl::SendWithPacketId(const net::IPEndPoint& address,
-                                           const std::vector<int8_t>& data,
-                                           const rtc::PacketOptions& options,
-                                           uint64_t packet_id) {
-  TRACE_EVENT_ASYNC_BEGIN0("p2p", "Send", packet_id);
-
-  socket_->Send(data, network::P2PPacketInfo(address, options, packet_id),
-                net::MutableNetworkTrafficAnnotationTag(traffic_annotation_));
-}
-
-void P2PSocketClientImpl::SetOption(network::P2PSocketOption option,
-                                    int value) {
-  DCHECK(state_ == STATE_OPEN || state_ == STATE_ERROR);
-  if (state_ == STATE_OPEN)
-    socket_->SetOption(option, value);
-}
-
-void P2PSocketClientImpl::Close() {
-  DCHECK(thread_checker_.CalledOnValidThread());
-
-  delegate_ = nullptr;
-  if (socket_)
-    socket_.reset();
-
-  state_ = STATE_CLOSED;
-}
-
-int P2PSocketClientImpl::GetSocketID() const {
-  return socket_id_;
-}
-
-void P2PSocketClientImpl::SetDelegate(P2PSocketClientDelegate* delegate) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  delegate_ = delegate;
-}
-
-void P2PSocketClientImpl::SocketCreated(const net::IPEndPoint& local_address,
-                                        const net::IPEndPoint& remote_address) {
-  state_ = STATE_OPEN;
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (delegate_)
-    delegate_->OnOpen(local_address, remote_address);
-}
-
-void P2PSocketClientImpl::SendComplete(
-    const network::P2PSendPacketMetrics& send_metrics) {
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (delegate_)
-    delegate_->OnSendComplete(send_metrics);
-}
-
-void P2PSocketClientImpl::IncomingTcpConnection(
-    const net::IPEndPoint& socket_address,
-    network::mojom::P2PSocketPtr socket,
-    network::mojom::P2PSocketClientRequest client_request) {
-  DCHECK_EQ(state_, STATE_OPEN);
-
-  auto new_client =
-      std::make_unique<P2PSocketClientImpl>(dispatcher_, traffic_annotation_);
-  new_client->state_ = STATE_OPEN;
-
-  network::mojom::P2PSocketClientPtr socket_client;
-  new_client->socket_ = std::move(socket);
-  new_client->binding_.Bind(std::move(client_request));
-  new_client->binding_.set_connection_error_handler(base::BindOnce(
-      &P2PSocketClientImpl::OnConnectionError, base::Unretained(this)));
-
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (delegate_) {
-    delegate_->OnIncomingTcpConnection(socket_address, std::move(new_client));
-  } else {
-    // Just close the socket if there is no delegate to accept it.
-    new_client->Close();
-  }
-}
-
-void P2PSocketClientImpl::DataReceived(const net::IPEndPoint& socket_address,
-                                       const std::vector<int8_t>& data,
-                                       base::TimeTicks timestamp) {
-  DCHECK_EQ(STATE_OPEN, state_);
-  DCHECK(thread_checker_.CalledOnValidThread());
-  if (delegate_)
-    delegate_->OnDataReceived(socket_address, data, timestamp);
-}
-
-void P2PSocketClientImpl::OnConnectionError() {
-  state_ = STATE_ERROR;
-  if (delegate_)
-    delegate_->OnError();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/socket_client_impl.h b/chromium/content/renderer/p2p/socket_client_impl.h
deleted file mode 100644
index cb9bb37be94..00000000000
--- a/chromium/content/renderer/p2p/socket_client_impl.h
+++ /dev/null
@@ -1,119 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_P2P_SOCKET_CLIENT_IMPL_H_
-#define CONTENT_RENDERER_P2P_SOCKET_CLIENT_IMPL_H_
-
-#include <stdint.h>
-
-#include <vector>
-
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/threading/thread_checker.h"
-#include "content/renderer/p2p/socket_client.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "net/base/ip_endpoint.h"
-#include "net/traffic_annotation/network_traffic_annotation.h"
-#include "services/network/public/cpp/p2p_socket_type.h"
-#include "services/network/public/mojom/p2p.mojom.h"
-
-namespace base {
-class TimeTicks;
-}  // namespace base
-
-namespace content {
-
-class P2PSocketDispatcher;
-
-// P2P socket that routes all calls over Mojo.
-//
-// The object runs on the WebRTC worker thread.
-class P2PSocketClientImpl : public P2PSocketClient,
-                            public network::mojom::P2PSocketClient {
- public:
-  P2PSocketClientImpl(
-      P2PSocketDispatcher* dispatcher,
-      const net::NetworkTrafficAnnotationTag& traffic_annotation);
-  ~P2PSocketClientImpl() override;
-
-  // Initialize socket of the specified |type| and connected to the
-  // specified |address|. |address| matters only when |type| is set to
-  // P2P_SOCKET_TCP_CLIENT.
-  virtual void Init(network::P2PSocketType type,
-                    const net::IPEndPoint& local_address,
-                    uint16_t min_port,
-                    uint16_t max_port,
-                    const network::P2PHostAndIPEndPoint& remote_address,
-                    P2PSocketClientDelegate* delegate);
-
-  // Send the |data| to the |address| using Differentiated Services Code Point
-  // |dscp|. Return value is the unique packet_id for this packet.
-  uint64_t Send(const net::IPEndPoint& address,
-                const std::vector<int8_t>& data,
-                const rtc::PacketOptions& options) override;
-
-  // Setting socket options.
-  void SetOption(network::P2PSocketOption option, int value) override;
-
-  // Must be called before the socket is destroyed. The delegate may
-  // not be called after |closed_task| is executed.
-  void Close() override;
-
-  int GetSocketID() const override;
-
-  void SetDelegate(P2PSocketClientDelegate* delegate) override;
-
- private:
-  enum State {
-    STATE_UNINITIALIZED,
-    STATE_OPENING,
-    STATE_OPEN,
-    STATE_CLOSED,
-    STATE_ERROR,
-  };
-
-  friend class P2PSocketDispatcher;
-
-  // Helper function to be called by Send to handle different threading
-  // condition.
-  void SendWithPacketId(const net::IPEndPoint& address,
-                        const std::vector<int8_t>& data,
-                        const rtc::PacketOptions& options,
-                        uint64_t packet_id);
-
-  // network::mojom::P2PSocketClient interface.
-  void SocketCreated(const net::IPEndPoint& local_address,
-                     const net::IPEndPoint& remote_address) override;
-  void SendComplete(const network::P2PSendPacketMetrics& send_metrics) override;
-  void IncomingTcpConnection(
-      const net::IPEndPoint& socket_address,
-      network::mojom::P2PSocketPtr socket,
-      network::mojom::P2PSocketClientRequest client_request) override;
-  void DataReceived(const net::IPEndPoint& socket_address,
-                    const std::vector<int8_t>& data,
-                    base::TimeTicks timestamp) override;
-
-  void OnConnectionError();
-
-  P2PSocketDispatcher* dispatcher_;
-  base::ThreadChecker thread_checker_;
-  int socket_id_;
-  P2PSocketClientDelegate* delegate_;
-  State state_;
-  const net::NetworkTrafficAnnotationTag traffic_annotation_;
-
-  // These two fields are used to identify packets for tracing.
-  uint32_t random_socket_id_;
-  uint32_t next_packet_id_;
-
-  network::mojom::P2PSocketPtr socket_;
-  mojo::Binding<network::mojom::P2PSocketClient> binding_;
-
-  DISALLOW_COPY_AND_ASSIGN(P2PSocketClientImpl);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_SOCKET_CLIENT_IMPL_H_
diff --git a/chromium/content/renderer/p2p/socket_dispatcher.cc b/chromium/content/renderer/p2p/socket_dispatcher.cc
deleted file mode 100644
index 7b6b7ea5407..00000000000
--- a/chromium/content/renderer/p2p/socket_dispatcher.cc
+++ /dev/null
@@ -1,101 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/p2p/socket_dispatcher.h"
-
-#include "base/bind.h"
-#include "base/memory/ref_counted.h"
-#include "content/child/child_process.h"
-#include "content/child/child_thread_impl.h"
-#include "content/public/common/service_names.mojom.h"
-#include "content/renderer/p2p/network_list_observer.h"
-#include "content/renderer/p2p/socket_client_impl.h"
-#include "content/renderer/render_view_impl.h"
-#include "services/network/public/cpp/p2p_param_traits.h"
-
-namespace content {
-
-P2PSocketDispatcher::P2PSocketDispatcher()
-    : main_task_runner_(base::ThreadTaskRunnerHandle::Get()),
-      network_list_observers_(
-          new base::ObserverListThreadSafe<NetworkListObserver>()),
-      network_notification_client_binding_(this) {
-}
-
-P2PSocketDispatcher::~P2PSocketDispatcher() {
-}
-
-void P2PSocketDispatcher::AddNetworkListObserver(
-    NetworkListObserver* network_list_observer) {
-  network_list_observers_->AddObserver(network_list_observer);
-  main_task_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&P2PSocketDispatcher::RequestNetworkEventsIfNecessary,
-                     this));
-}
-
-void P2PSocketDispatcher::RemoveNetworkListObserver(
-    NetworkListObserver* network_list_observer) {
-  network_list_observers_->RemoveObserver(network_list_observer);
-}
-
-scoped_refptr<network::mojom::ThreadSafeP2PSocketManagerPtr>
-P2PSocketDispatcher::GetP2PSocketManager() {
-  base::AutoLock lock(p2p_socket_manager_lock_);
-  if (!thread_safe_p2p_socket_manager_) {
-    network::mojom::P2PSocketManagerPtr p2p_socket_manager;
-    p2p_socket_manager_request_ = mojo::MakeRequest(&p2p_socket_manager);
-    p2p_socket_manager.set_connection_error_handler(base::BindOnce(
-        &P2PSocketDispatcher::OnConnectionError, base::Unretained(this)));
-    thread_safe_p2p_socket_manager_ =
-        network::mojom::ThreadSafeP2PSocketManagerPtr::Create(
-            std::move(p2p_socket_manager));
-  }
-  main_task_runner_->PostTask(
-      FROM_HERE,
-      base::BindOnce(&P2PSocketDispatcher::RequestInterfaceIfNecessary, this));
-  return thread_safe_p2p_socket_manager_;
-}
-
-void P2PSocketDispatcher::NetworkListChanged(
-    const std::vector<net::NetworkInterface>& networks,
-    const net::IPAddress& default_ipv4_local_address,
-    const net::IPAddress& default_ipv6_local_address) {
-  DCHECK(main_task_runner_->BelongsToCurrentThread());
-  networks_ = networks;
-  default_ipv4_local_address_ = default_ipv4_local_address;
-  default_ipv6_local_address_ = default_ipv6_local_address;
-  network_list_observers_->Notify(
-      FROM_HERE, &NetworkListObserver::OnNetworkListChanged, networks,
-      default_ipv4_local_address, default_ipv6_local_address);
-}
-
-void P2PSocketDispatcher::RequestInterfaceIfNecessary() {
-  if (!p2p_socket_manager_request_.is_pending())
-    return;
-
-  ChildThreadImpl::current()->BindHostReceiver(
-      std::move(p2p_socket_manager_request_));
-}
-
-void P2PSocketDispatcher::RequestNetworkEventsIfNecessary() {
-  if (network_notification_client_binding_.is_bound()) {
-    network_list_observers_->Notify(
-        FROM_HERE, &NetworkListObserver::OnNetworkListChanged, networks_,
-        default_ipv4_local_address_, default_ipv6_local_address_);
-  } else {
-    network::mojom::P2PNetworkNotificationClientPtr network_notification_client;
-    network_notification_client_binding_.Bind(
-        mojo::MakeRequest(&network_notification_client));
-    GetP2PSocketManager()->get()->StartNetworkNotifications(
-        std::move(network_notification_client));
-  }
-}
-
-void P2PSocketDispatcher::OnConnectionError() {
-  base::AutoLock lock(p2p_socket_manager_lock_);
-  thread_safe_p2p_socket_manager_.reset();
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/p2p/socket_dispatcher.h b/chromium/content/renderer/p2p/socket_dispatcher.h
deleted file mode 100644
index 7ceceaf764a..00000000000
--- a/chromium/content/renderer/p2p/socket_dispatcher.h
+++ /dev/null
@@ -1,108 +0,0 @@
-// Copyright (c) 2012 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// P2PSocketDispatcher is a per-renderer object that dispatchers all
-// P2P messages received from the browser and relays all P2P messages
-// sent to the browser. P2PSocketClient instances register themselves
-// with the dispatcher using RegisterClient() and UnregisterClient().
-//
-// Relationship of classes.
-//
-//       P2PSocketHost                     P2PSocketClient
-//            ^                                   ^
-//            |                                   |
-//            v                  IPC              v
-//  P2PSocketDispatcherHost  <--------->  P2PSocketDispatcher
-//
-// P2PSocketDispatcher receives and dispatches messages on the
-// IO thread.
-
-#ifndef CONTENT_RENDERER_P2P_SOCKET_DISPATCHER_H_
-#define CONTENT_RENDERER_P2P_SOCKET_DISPATCHER_H_
-
-#include <stdint.h>
-
-#include <vector>
-
-#include "base/callback_forward.h"
-#include "base/compiler_specific.h"
-#include "base/macros.h"
-#include "base/memory/ref_counted.h"
-#include "base/observer_list_threadsafe.h"
-#include "base/synchronization/lock.h"
-#include "content/common/content_export.h"
-#include "content/renderer/p2p/network_list_manager.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/thread_safe_interface_ptr.h"
-#include "net/base/ip_address.h"
-#include "net/base/network_interfaces.h"
-#include "services/network/public/cpp/p2p_socket_type.h"
-#include "services/network/public/mojom/p2p.mojom.h"
-
-namespace base {
-class SingleThreadTaskRunner;
-}  // namespace base
-
-namespace content {
-
-class NetworkListObserver;
-
-// This class is created on the main thread, but is used primarily on the
-// WebRTC worker threads.
-class CONTENT_EXPORT P2PSocketDispatcher
-    : public base::RefCountedThreadSafe<P2PSocketDispatcher>,
-      public NetworkListManager,
-      public network::mojom::P2PNetworkNotificationClient {
- public:
-  P2PSocketDispatcher();
-
-  // NetworkListManager interface:
-  void AddNetworkListObserver(
-      NetworkListObserver* network_list_observer) override;
-  void RemoveNetworkListObserver(
-      NetworkListObserver* network_list_observer) override;
-
-  scoped_refptr<network::mojom::ThreadSafeP2PSocketManagerPtr>
-  GetP2PSocketManager();
-
- private:
-  friend class base::RefCountedThreadSafe<P2PSocketDispatcher>;
-
-  ~P2PSocketDispatcher() override;
-
-  // network::mojom::P2PNetworkNotificationClient interface.
-  void NetworkListChanged(
-      const std::vector<net::NetworkInterface>& networks,
-      const net::IPAddress& default_ipv4_local_address,
-      const net::IPAddress& default_ipv6_local_address) override;
-
-  void RequestInterfaceIfNecessary();
-  void RequestNetworkEventsIfNecessary();
-
-  void OnConnectionError();
-
-  scoped_refptr<base::SingleThreadTaskRunner> main_task_runner_;
-
-  scoped_refptr<base::ObserverListThreadSafe<NetworkListObserver>>
-      network_list_observers_;
-
-  network::mojom::P2PSocketManagerRequest p2p_socket_manager_request_;
-  scoped_refptr<network::mojom::ThreadSafeP2PSocketManagerPtr>
-      thread_safe_p2p_socket_manager_;
-  base::Lock p2p_socket_manager_lock_;
-
-  // Cached from last |NetworkListChanged| call.
-  std::vector<net::NetworkInterface> networks_;
-  net::IPAddress default_ipv4_local_address_;
-  net::IPAddress default_ipv6_local_address_;
-
-  mojo::Binding<network::mojom::P2PNetworkNotificationClient>
-      network_notification_client_binding_;
-
-  DISALLOW_COPY_AND_ASSIGN(P2PSocketDispatcher);
-};
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_P2P_SOCKET_DISPATCHER_H_
diff --git a/chromium/content/renderer/pepper/event_conversion.cc b/chromium/content/renderer/pepper/event_conversion.cc
index 8d6ffbd3776..82e73f97fea 100644
--- a/chromium/content/renderer/pepper/event_conversion.cc
+++ b/chromium/content/renderer/pepper/event_conversion.cc
@@ -11,6 +11,7 @@
 #include <algorithm>
 #include <memory>
 
+#include "base/feature_list.h"
 #include "base/i18n/char_iterator.h"
 #include "base/logging.h"
 #include "base/strings/string16.h"
@@ -20,6 +21,7 @@
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
 #include "content/common/input/web_touch_event_traits.h"
+#include "content/public/common/content_features.h"
 #include "device/gamepad/public/cpp/gamepads.h"
 #include "ppapi/c/pp_input_event.h"
 #include "ppapi/shared_impl/ppb_input_event_shared.h"
@@ -201,6 +203,7 @@ void AppendCharEvent(const WebInputEvent& event,
 }
 
 void AppendMouseEvent(const WebInputEvent& event,
+                      std::unique_ptr<gfx::PointF>* in_out_last_mouse_position,
                       std::vector<InputEventData>* result_events) {
   static_assert(static_cast<int>(WebMouseEvent::Button::kNoButton) ==
                     static_cast<int>(PP_INPUTEVENT_MOUSEBUTTON_NONE),
@@ -236,8 +239,29 @@ void AppendMouseEvent(const WebInputEvent& event,
   result.mouse_position.x = mouse_event.PositionInWidget().x;
   result.mouse_position.y = mouse_event.PositionInWidget().y;
   result.mouse_click_count = mouse_event.click_count;
-  result.mouse_movement.x = mouse_event.movement_x;
-  result.mouse_movement.y = mouse_event.movement_y;
+
+  if (base::FeatureList::IsEnabled(features::kConsolidatedMovementXY)) {
+    if (mouse_event.GetType() == WebInputEvent::kMouseMove &&
+        *in_out_last_mouse_position) {
+      result.mouse_movement.x =
+          mouse_event.PositionInScreen().x - (*in_out_last_mouse_position)->x();
+      result.mouse_movement.y =
+          mouse_event.PositionInScreen().y - (*in_out_last_mouse_position)->y();
+    }
+    *in_out_last_mouse_position =
+        std::make_unique<gfx::PointF>(mouse_event.PositionInScreen());
+
+    // Filter out event generated by recentering the cursor when mouse locked.
+    // See |RenderWidgetHostViewEventHandler::HandleMouseEventWhileLocked|.
+    if ((mouse_event.GetModifiers() &
+         WebInputEvent::Modifiers::kRelativeMotionEvent)) {
+      return;
+    }
+  } else {
+    result.mouse_movement.x = mouse_event.movement_x;
+    result.mouse_movement.y = mouse_event.movement_y;
+  }
+
   result_events->push_back(result);
 }
 
@@ -252,7 +276,9 @@ void AppendMouseWheelEvent(const WebInputEvent& event,
   result.wheel_delta.y = mouse_wheel_event.delta_y;
   result.wheel_ticks.x = mouse_wheel_event.wheel_ticks_x;
   result.wheel_ticks.y = mouse_wheel_event.wheel_ticks_y;
-  result.wheel_scroll_by_page = !!mouse_wheel_event.scroll_by_page;
+  result.wheel_scroll_by_page =
+      (mouse_wheel_event.delta_units ==
+       ui::input_types::ScrollGranularity::kScrollByPage);
   result_events->push_back(result);
 }
 
@@ -507,7 +533,10 @@ WebMouseWheelEvent* BuildMouseWheelEvent(const InputEventData& event) {
   mouse_wheel_event->delta_y = event.wheel_delta.y;
   mouse_wheel_event->wheel_ticks_x = event.wheel_ticks.x;
   mouse_wheel_event->wheel_ticks_y = event.wheel_ticks.y;
-  mouse_wheel_event->scroll_by_page = event.wheel_scroll_by_page;
+  mouse_wheel_event->delta_units =
+      event.wheel_scroll_by_page
+          ? ui::input_types::ScrollGranularity::kScrollByPage
+          : ui::input_types::ScrollGranularity::kScrollByPixel;
   return mouse_wheel_event;
 }
 
@@ -597,8 +626,10 @@ void GetKeyCode(const std::string& char_text,
 
 }  // namespace
 
-void CreateInputEventData(const WebInputEvent& event,
-                          std::vector<InputEventData>* result) {
+void CreateInputEventData(
+    const WebInputEvent& event,
+    std::unique_ptr<gfx::PointF>* in_out_last_mouse_position,
+    std::vector<InputEventData>* result) {
   result->clear();
 
   switch (event.GetType()) {
@@ -608,7 +639,7 @@ void CreateInputEventData(const WebInputEvent& event,
     case WebInputEvent::kMouseEnter:
     case WebInputEvent::kMouseLeave:
     case WebInputEvent::kContextMenu:
-      AppendMouseEvent(event, result);
+      AppendMouseEvent(event, in_out_last_mouse_position, result);
       break;
     case WebInputEvent::kMouseWheel:
       AppendMouseWheelEvent(event, result);
diff --git a/chromium/content/renderer/pepper/event_conversion.h b/chromium/content/renderer/pepper/event_conversion.h
index 884e73ca124..35a3235388e 100644
--- a/chromium/content/renderer/pepper/event_conversion.h
+++ b/chromium/content/renderer/pepper/event_conversion.h
@@ -29,6 +29,7 @@ namespace content {
 // events will ge generated and the vector will be empty.
 CONTENT_EXPORT void CreateInputEventData(
     const blink::WebInputEvent& event,
+    std::unique_ptr<gfx::PointF>* last_mouse_position,
     std::vector<ppapi::InputEventData>* pp_events);
 
 // Creates a WebInputEvent from the given PP_InputEvent.  If it fails, returns
diff --git a/chromium/content/renderer/pepper/event_conversion_unittest.cc b/chromium/content/renderer/pepper/event_conversion_unittest.cc
index 26595c9ea8a..edb8d4eb05f 100644
--- a/chromium/content/renderer/pepper/event_conversion_unittest.cc
+++ b/chromium/content/renderer/pepper/event_conversion_unittest.cc
@@ -48,7 +48,7 @@ TEST_F(EventConversionTest, TouchStart) {
   touch.PressPoint(1.f, 2.f);
 
   std::vector<ppapi::InputEventData> pp_events;
-  CreateInputEventData(touch, &pp_events);
+  CreateInputEventData(touch, nullptr, &pp_events);
   ASSERT_EQ(1U, pp_events.size());
 
   const ppapi::InputEventData& pp_event = pp_events[0];
@@ -76,7 +76,7 @@ TEST_F(EventConversionTest, TouchMove) {
   touch.MovePoint(1, 5.f, 6.f);
 
   std::vector<ppapi::InputEventData> pp_events;
-  CreateInputEventData(touch, &pp_events);
+  CreateInputEventData(touch, nullptr, &pp_events);
   ASSERT_EQ(1U, pp_events.size());
 
   const ppapi::InputEventData& pp_event = pp_events[0];
@@ -104,7 +104,7 @@ TEST_F(EventConversionTest, TouchEnd) {
   touch.ReleasePoint(0);
 
   std::vector<ppapi::InputEventData> pp_events;
-  CreateInputEventData(touch, &pp_events);
+  CreateInputEventData(touch, nullptr, &pp_events);
   ASSERT_EQ(1U, pp_events.size());
 
   const ppapi::InputEventData& pp_event = pp_events[0];
@@ -133,7 +133,7 @@ TEST_F(EventConversionTest, TouchCancel) {
   touch.CancelPoint(0);
 
   std::vector<ppapi::InputEventData> pp_events;
-  CreateInputEventData(touch, &pp_events);
+  CreateInputEventData(touch, nullptr, &pp_events);
   ASSERT_EQ(1U, pp_events.size());
 
   const ppapi::InputEventData& pp_event = pp_events[0];
@@ -152,4 +152,33 @@ TEST_F(EventConversionTest, TouchCancel) {
   CompareWebTouchEvents(touch, *touch_out);
 }
 
+TEST_F(EventConversionTest, MouseMove) {
+  std::unique_ptr<gfx::PointF> last_mouse_position;
+  blink::WebMouseEvent mouse_event = SyntheticWebMouseEventBuilder::Build(
+      blink::WebInputEvent::kMouseMove, 100, 200, 0);
+
+  std::vector<ppapi::InputEventData> pp_events;
+  CreateInputEventData(mouse_event, &last_mouse_position, &pp_events);
+  ASSERT_EQ(1U, pp_events.size());
+  const ppapi::InputEventData& pp_event = pp_events[0];
+  ASSERT_EQ(PP_INPUTEVENT_TYPE_MOUSEMOVE, pp_event.event_type);
+  ASSERT_EQ(pp_event.mouse_position.x, mouse_event.PositionInWidget().x);
+  ASSERT_EQ(pp_event.mouse_position.y, mouse_event.PositionInWidget().y);
+  ASSERT_EQ(pp_event.mouse_movement.x, 0);
+  ASSERT_EQ(pp_event.mouse_movement.y, 0);
+  if (last_mouse_position) {
+    ASSERT_EQ(*last_mouse_position.get(),
+              gfx::PointF(mouse_event.PositionInScreen()));
+  }
+
+  mouse_event = SyntheticWebMouseEventBuilder::Build(
+      blink::WebInputEvent::kMouseMove, 123, 188, 0);
+  CreateInputEventData(mouse_event, &last_mouse_position, &pp_events);
+  ASSERT_EQ(PP_INPUTEVENT_TYPE_MOUSEMOVE, pp_event.event_type);
+  ASSERT_EQ(pp_event.mouse_position.x, mouse_event.PositionInWidget().x);
+  ASSERT_EQ(pp_event.mouse_position.y, mouse_event.PositionInWidget().y);
+  ASSERT_EQ(pp_event.mouse_movement.x, 23);
+  ASSERT_EQ(pp_event.mouse_movement.y, -12);
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/pepper/pepper_file_chooser_host.cc b/chromium/content/renderer/pepper/pepper_file_chooser_host.cc
index d0eaf74470e..99ecd4dd7cf 100644
--- a/chromium/content/renderer/pepper/pepper_file_chooser_host.cc
+++ b/chromium/content/renderer/pepper/pepper_file_chooser_host.cc
@@ -13,11 +13,12 @@
 #include "content/public/renderer/renderer_ppapi_host.h"
 #include "content/renderer/pepper/pepper_file_ref_renderer_host.h"
 #include "content/renderer/render_view_impl.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/host/dispatch_host_message.h"
 #include "ppapi/host/ppapi_host.h"
 #include "ppapi/proxy/ppapi_messages.h"
-#include "services/service_manager/public/cpp/interface_provider.h"
+#include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "third_party/blink/public/platform/file_path_conversion.h"
 #include "third_party/blink/public/platform/web_string.h"
@@ -38,8 +39,9 @@ class PepperFileChooserHost::CompletionHandler {
                        blink::mojom::FileChooserParamsPtr params) {
     if (!render_frame)
       return false;
-    render_frame->GetInterfaceProvider()->GetInterface(&file_chooser_);
-    file_chooser_.set_connection_error_handler(base::BindOnce(
+    render_frame->GetBrowserInterfaceBroker()->GetInterface(
+        file_chooser_.BindNewPipeAndPassReceiver());
+    file_chooser_.set_disconnect_handler(base::BindOnce(
         &CompletionHandler::OnConnectionError, base::Unretained(this)));
     file_chooser_->OpenFileChooser(
         std::move(params), base::BindOnce(&CompletionHandler::DidChooseFiles,
@@ -81,7 +83,7 @@ class PepperFileChooserHost::CompletionHandler {
   }
 
   base::WeakPtr<PepperFileChooserHost> host_;
-  blink::mojom::FileChooserPtr file_chooser_;
+  mojo::Remote<blink::mojom::FileChooser> file_chooser_;
 
   DISALLOW_COPY_AND_ASSIGN(CompletionHandler);
 };
diff --git a/chromium/content/renderer/pepper/pepper_file_chooser_host_unittest.cc b/chromium/content/renderer/pepper/pepper_file_chooser_host_unittest.cc
index 21c64e39ce4..a0347d74d09 100644
--- a/chromium/content/renderer/pepper/pepper_file_chooser_host_unittest.cc
+++ b/chromium/content/renderer/pepper/pepper_file_chooser_host_unittest.cc
@@ -2,8 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "content/renderer/pepper/pepper_file_chooser_host.h"
+
 #include <stdint.h>
+
+#include <memory>
 #include <tuple>
+#include <utility>
 
 #include "base/bind.h"
 #include "base/files/file_path.h"
@@ -12,9 +17,10 @@
 #include "content/public/test/render_view_test.h"
 #include "content/public/test/test_utils.h"
 #include "content/renderer/pepper/mock_renderer_ppapi_host.h"
-#include "content/renderer/pepper/pepper_file_chooser_host.h"
 #include "content/renderer/render_view_impl.h"
 #include "content/test/test_content_client.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
 #include "ppapi/c/pp_errors.h"
 #include "ppapi/host/host_message_context.h"
 #include "ppapi/host/ppapi_host.h"
@@ -26,7 +32,6 @@
 #include "ppapi/shared_impl/proxy_lock.h"
 #include "ppapi/shared_impl/resource_tracker.h"
 #include "ppapi/shared_impl/test_globals.h"
-#include "services/service_manager/public/cpp/interface_provider.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 
@@ -37,27 +42,23 @@ using blink::mojom::FileChooserFileInfo;
 using blink::mojom::FileChooserFileInfoPtr;
 using blink::mojom::FileChooserParams;
 using blink::mojom::FileChooserParamsPtr;
-using blink::mojom::FileChooserPtr;
-using blink::mojom::FileChooserRequest;
 
 namespace {
 
 class MockFileChooser : public FileChooser {
  public:
-  MockFileChooser(service_manager::InterfaceProvider* provider,
+  MockFileChooser(blink::BrowserInterfaceBrokerProxy* broker,
                   base::OnceClosure reached_callback)
       : reached_callback_(std::move(reached_callback)) {
-    service_manager::InterfaceProvider::TestApi test_api(provider);
-    test_api.SetBinderForName(
+    broker->SetBinderForTesting(
         FileChooser::Name_,
-        base::BindRepeating(&MockFileChooser::OnFileChooserRequest,
+        base::BindRepeating(&MockFileChooser::BindFileChooserReceiver,
                             base::Unretained(this)));
-    provider_ = provider;
+    broker_ = broker;
   }
 
   ~MockFileChooser() override {
-    service_manager::InterfaceProvider::TestApi test_api(provider_);
-    test_api.ClearBinderForName(FileChooser::Name_);
+    broker_->SetBinderForTesting(FileChooser::Name_, {});
   }
 
   const FileChooserParams& params() const {
@@ -70,12 +71,12 @@ class MockFileChooser : public FileChooser {
     DCHECK(params_);
     std::move(callback_).Run(blink::mojom::FileChooserResult::New(
         std::move(files), base::FilePath()));
-    bindings_.FlushForTesting();
+    receivers_.FlushForTesting();
   }
 
  private:
-  void OnFileChooserRequest(mojo::ScopedMessagePipeHandle handle) {
-    bindings_.AddBinding(this, FileChooserRequest(std::move(handle)));
+  void BindFileChooserReceiver(mojo::ScopedMessagePipeHandle handle) {
+    receivers_.Add(this, mojo::PendingReceiver<FileChooser>(std::move(handle)));
   }
 
   void OpenFileChooser(FileChooserParamsPtr params,
@@ -89,8 +90,8 @@ class MockFileChooser : public FileChooser {
       const base::FilePath& directory_path,
       EnumerateChosenDirectoryCallback callback) override {}
 
-  service_manager::InterfaceProvider* provider_;
-  mojo::BindingSet<FileChooser> bindings_;
+  blink::BrowserInterfaceBrokerProxy* broker_;
+  mojo::ReceiverSet<FileChooser> receivers_;
   OpenFileChooserCallback callback_;
   FileChooserParamsPtr params_;
   base::OnceClosure reached_callback_;
@@ -107,7 +108,7 @@ class PepperFileChooserHostTest : public RenderViewTest {
     globals_.GetResourceTracker()->DidCreateInstance(pp_instance_);
     mock_file_chooser_ = std::make_unique<MockFileChooser>(
         static_cast<RenderFrameImpl*>(view_->GetMainRenderFrame())
-            ->GetInterfaceProvider(),
+            ->GetBrowserInterfaceBroker(),
         run_loop_.QuitClosure());
   }
   void TearDown() override {
diff --git a/chromium/content/renderer/pepper/pepper_file_system_host.cc b/chromium/content/renderer/pepper/pepper_file_system_host.cc
index e075122aee2..4a85e16ccc0 100644
--- a/chromium/content/renderer/pepper/pepper_file_system_host.cc
+++ b/chromium/content/renderer/pepper/pepper_file_system_host.cc
@@ -163,7 +163,7 @@ int32_t PepperFileSystemHost::OnHostMsgInitIsolatedFileSystem(
 blink::mojom::FileSystemManager& PepperFileSystemHost::GetFileSystemManager() {
   if (!file_system_manager_) {
     ChildThreadImpl::current()->BindHostReceiver(
-        mojo::MakeRequest(&file_system_manager_));
+        file_system_manager_.BindNewPipeAndPassReceiver());
   }
   return *file_system_manager_;
 }
diff --git a/chromium/content/renderer/pepper/pepper_file_system_host.h b/chromium/content/renderer/pepper/pepper_file_system_host.h
index 9017bc258cc..07908c437f5 100644
--- a/chromium/content/renderer/pepper/pepper_file_system_host.h
+++ b/chromium/content/renderer/pepper/pepper_file_system_host.h
@@ -12,6 +12,7 @@
 #include "base/files/file.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "ppapi/c/pp_file_info.h"
 #include "ppapi/c/private/ppb_isolated_file_system_private.h"
 #include "ppapi/host/host_message_context.h"
@@ -78,7 +79,7 @@ class PepperFileSystemHost
   bool opened_;  // whether open is successful.
   GURL root_url_;
   bool called_open_;  // whether open has been called.
-  blink::mojom::FileSystemManagerPtr file_system_manager_;
+  mojo::Remote<blink::mojom::FileSystemManager> file_system_manager_;
 
   DISALLOW_COPY_AND_ASSIGN(PepperFileSystemHost);
 };
diff --git a/chromium/content/renderer/pepper/pepper_media_device_manager.cc b/chromium/content/renderer/pepper/pepper_media_device_manager.cc
index 7c2c6571f74..9b90bc48692 100644
--- a/chromium/content/renderer/pepper/pepper_media_device_manager.cc
+++ b/chromium/content/renderer/pepper/pepper_media_device_manager.cc
@@ -273,8 +273,7 @@ blink::mojom::MediaStreamDispatcherHost*
 PepperMediaDeviceManager::GetMediaStreamDispatcherHost() {
   if (!dispatcher_host_) {
     CHECK(render_frame());
-    CHECK(render_frame()->GetRemoteInterfaces());
-    render_frame()->GetRemoteInterfaces()->GetInterface(
+    render_frame()->GetBrowserInterfaceBroker()->GetInterface(
         dispatcher_host_.BindNewPipeAndPassReceiver());
   }
   return dispatcher_host_.get();
@@ -290,16 +289,15 @@ PepperMediaDeviceManager::GetMediaStreamDeviceObserver() const {
   return observer;
 }
 
-const blink::mojom::MediaDevicesDispatcherHostPtr&
+blink::mojom::MediaDevicesDispatcherHost*
 PepperMediaDeviceManager::GetMediaDevicesDispatcher() {
   if (!media_devices_dispatcher_) {
     CHECK(render_frame());
-    CHECK(render_frame()->GetRemoteInterfaces());
-    render_frame()->GetRemoteInterfaces()->GetInterface(
-        mojo::MakeRequest(&media_devices_dispatcher_));
+    render_frame()->GetBrowserInterfaceBroker()->GetInterface(
+        media_devices_dispatcher_.BindNewPipeAndPassReceiver());
   }
 
-  return media_devices_dispatcher_;
+  return media_devices_dispatcher_.get();
 }
 
 void PepperMediaDeviceManager::OnDestruct() {
diff --git a/chromium/content/renderer/pepper/pepper_media_device_manager.h b/chromium/content/renderer/pepper/pepper_media_device_manager.h
index b3b4dd8eb53..0eb00f10ef3 100644
--- a/chromium/content/renderer/pepper/pepper_media_device_manager.h
+++ b/chromium/content/renderer/pepper/pepper_media_device_manager.h
@@ -104,8 +104,7 @@ class PepperMediaDeviceManager
 
   blink::mojom::MediaStreamDispatcherHost* GetMediaStreamDispatcherHost();
   blink::WebMediaStreamDeviceObserver* GetMediaStreamDeviceObserver() const;
-  const blink::mojom::MediaDevicesDispatcherHostPtr&
-  GetMediaDevicesDispatcher();
+  blink::mojom::MediaDevicesDispatcherHost* GetMediaDevicesDispatcher();
 
   int next_id_ = 1;
   using OpenCallbackMap = std::map<int, OpenDeviceCallback>;
@@ -116,7 +115,8 @@ class PepperMediaDeviceManager
   SubscriptionList device_change_subscriptions_[blink::NUM_MEDIA_DEVICE_TYPES];
 
   mojo::Remote<blink::mojom::MediaStreamDispatcherHost> dispatcher_host_;
-  blink::mojom::MediaDevicesDispatcherHostPtr media_devices_dispatcher_;
+  mojo::Remote<blink::mojom::MediaDevicesDispatcherHost>
+      media_devices_dispatcher_;
 
   mojo::ReceiverSet<blink::mojom::MediaDevicesListener> receivers_;
 
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
index c2e45ddb69c..b4faece85ac 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.cc
@@ -39,7 +39,6 @@
 #include "content/renderer/pepper/pepper_file_ref_renderer_host.h"
 #include "content/renderer/pepper/pepper_graphics_2d_host.h"
 #include "content/renderer/pepper/pepper_in_process_router.h"
-#include "content/renderer/pepper/pepper_plugin_instance_metrics.h"
 #include "content/renderer/pepper/pepper_try_catch.h"
 #include "content/renderer/pepper/pepper_url_loader_host.h"
 #include "content/renderer/pepper/plugin_instance_throttler_impl.h"
@@ -110,6 +109,7 @@
 #include "third_party/blink/public/platform/web_url_request.h"
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/public/web/web_document_loader.h"
+#include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_ime_text_span.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_plugin_container.h"
@@ -293,6 +293,8 @@ STATIC_ASSERT_ENUM(blink::kWebPrintScalingOptionFitToPrintableArea,
                    PP_PRINTSCALINGOPTION_FIT_TO_PRINTABLE_AREA);
 STATIC_ASSERT_ENUM(blink::kWebPrintScalingOptionSourceSize,
                    PP_PRINTSCALINGOPTION_SOURCE_SIZE);
+STATIC_ASSERT_ENUM(blink::kWebPrintScalingOptionFitToPaper,
+                   PP_PRINTSCALINGOPTION_FIT_TO_PAPER);
 
 #undef STATIC_ASSERT_ENUM
 
@@ -1131,10 +1133,6 @@ bool PepperPluginInstanceImpl::HandleInputEvent(
       event.GetType() == blink::WebInputEvent::kMouseDown &&
       (event.GetModifiers() & blink::WebInputEvent::kLeftButtonDown)) {
     has_been_clicked_ = true;
-    blink::WebRect bounds = container()->GetElement().BoundsInViewport();
-    render_frame()->GetLocalRootRenderWidget()->ConvertViewportToWindow(
-        &bounds);
-    RecordFlashClickSizeMetric(bounds.width, bounds.height);
   }
 
   if (throttler_ && throttler_->ConsumeInputEvent(event))
@@ -1168,9 +1166,10 @@ bool PepperPluginInstanceImpl::HandleInputEvent(
       std::unique_ptr<const WebInputEvent> event_in_dip(
           ui::ScaleWebInputEvent(event, viewport_to_dip_scale_));
       if (event_in_dip)
-        CreateInputEventData(*event_in_dip.get(), &events);
+        CreateInputEventData(*event_in_dip.get(), &last_mouse_position_,
+                             &events);
       else
-        CreateInputEventData(event, &events);
+        CreateInputEventData(event, &last_mouse_position_, &events);
 
       // Each input event may generate more than one PP_InputEvent.
       for (size_t i = 0; i < events.size(); i++) {
@@ -1842,16 +1841,9 @@ void PepperPluginInstanceImpl::SendDidChangeView() {
       viewport_to_dip_scale_);
 
   // During the first view update, initialize the throttler.
-  if (!sent_initial_did_change_view_) {
-    if (is_flash_plugin_ && RenderThread::Get()) {
-      RecordFlashSizeMetric(unobscured_rect_.width(),
-                            unobscured_rect_.height());
-    }
-
-    if (throttler_) {
-      throttler_->Initialize(render_frame_, url::Origin::Create(plugin_url_),
-                             module()->name(), unobscured_rect_.size());
-    }
+  if (!sent_initial_did_change_view_ && throttler_) {
+    throttler_->Initialize(render_frame_, url::Origin::Create(plugin_url_),
+                           module()->name(), unobscured_rect_.size());
   }
 
   ppapi::ViewData view_data = view_data_;
@@ -1959,6 +1951,11 @@ int PepperPluginInstanceImpl::PrintBegin(const WebPrintParams& print_params) {
     num_pages = plugin_pdf_interface_->PrintBegin(
         pp_instance(), &print_settings, &pdf_print_settings);
   } else {
+    // If the content is not from the PDF plugin, "fit to paper" should have
+    // never been a scaling option for the user to begin with.
+    DCHECK_NE(print_settings.print_scaling_option,
+              PP_PRINTSCALINGOPTION_FIT_TO_PAPER);
+
     num_pages = plugin_print_interface_->Begin(pp_instance(), &print_settings);
   }
   if (!num_pages)
@@ -2058,6 +2055,10 @@ bool PepperPluginInstanceImpl::GetPrintPresetOptionsFromDocument(
   return true;
 }
 
+bool PepperPluginInstanceImpl::IsPdfPlugin() {
+  return LoadPdfInterface();
+}
+
 bool PepperPluginInstanceImpl::CanRotateView() {
   if (!LoadPdfInterface() || module()->is_crashed())
     return false;
@@ -2636,9 +2637,10 @@ PP_Bool PepperPluginInstanceImpl::GetScreenSize(PP_Instance instance,
     *size = view_data_.rect.size;
   } else {
     // All other cases: Report the screen size.
-    if (!render_frame_ || !render_frame_->GetLocalRootRenderWidget())
+    if (!render_frame_)
       return PP_FALSE;
-    blink::WebScreenInfo info = render_frame_->render_view()->GetScreenInfo();
+    blink::WebScreenInfo info =
+        render_frame_->GetLocalRootRenderWidget()->GetScreenInfo();
     *size = PP_MakeSize(info.rect.width, info.rect.height);
   }
   return PP_TRUE;
@@ -3221,7 +3223,8 @@ void PepperPluginInstanceImpl::SetSizeAttributesForFullscreen() {
   // behavior, the width and height should probably be set to 100%, rather than
   // a fixed screen size.
 
-  blink::WebScreenInfo info = render_frame_->render_view()->GetScreenInfo();
+  blink::WebScreenInfo info =
+      render_frame_->GetLocalRootRenderWidget()->GetScreenInfo();
   screen_size_for_fullscreen_ = gfx::Size(info.rect.width, info.rect.height);
   std::string width = base::NumberToString(screen_size_for_fullscreen_.width());
   std::string height =
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
index 617e9cca560..a45a1294c99 100644
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
+++ b/chromium/content/renderer/pepper/pepper_plugin_instance_impl.h
@@ -276,6 +276,7 @@ class CONTENT_EXPORT PepperPluginInstanceImpl
   void PrintEnd();
   bool GetPrintPresetOptionsFromDocument(
       blink::WebPrintPresetOptions* preset_options);
+  bool IsPdfPlugin();
 
   bool CanRotateView();
   void RotateView(blink::WebPlugin::RotationType type);
@@ -870,6 +871,11 @@ class CONTENT_EXPORT PepperPluginInstanceImpl
 
   scoped_refptr<ppapi::TrackedCallback> lock_mouse_callback_;
 
+  // Last mouse position from mouse event, used for calculating movements. Null
+  // means no mouse event received yet. This value is updated by
+  // |CreateInputEventData|.
+  std::unique_ptr<gfx::PointF> last_mouse_position_;
+
   // We store the arguments so we can re-send them if we are reset to talk to
   // NaCl via the IPC NaCl proxy.
   std::vector<std::string> argn_;
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_metrics.cc b/chromium/content/renderer/pepper/pepper_plugin_instance_metrics.cc
deleted file mode 100644
index 34a87fb5a7f..00000000000
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_metrics.cc
+++ /dev/null
@@ -1,76 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "content/renderer/pepper/pepper_plugin_instance_metrics.h"
-
-#include <stddef.h>
-
-#include "base/metrics/histogram_functions.h"
-#include "base/metrics/histogram_macros.h"
-#include "build/build_config.h"
-#include "ppapi/shared_impl/ppapi_preferences.h"
-
-#define UMA_HISTOGRAM_ASPECT_RATIO(name, width, height) \
-  base::UmaHistogramSparse(                             \
-      name, (height) ? ((width)*100) / (height) : kInfiniteRatio);
-
-namespace content {
-
-namespace {
-
-// Histogram tracking prevalence of tiny Flash instances. Units in pixels.
-enum PluginFlashTinyContentSize {
-  TINY_CONTENT_SIZE_1_1 = 0,
-  TINY_CONTENT_SIZE_5_5 = 1,
-  TINY_CONTENT_SIZE_10_10 = 2,
-  TINY_CONTENT_SIZE_LARGE = 3,
-  TINY_CONTENT_SIZE_NUM_ITEMS
-};
-
-const int kInfiniteRatio = 99999;
-
-const char kFlashClickSizeAspectRatioHistogram[] =
-    "Plugin.Flash.ClickSize.AspectRatio";
-const char kFlashClickSizeHeightHistogram[] = "Plugin.Flash.ClickSize.Height";
-const char kFlashClickSizeWidthHistogram[] = "Plugin.Flash.ClickSize.Width";
-const char kFlashTinyContentSizeHistogram[] = "Plugin.Flash.TinyContentSize";
-
-}  // namespace
-
-void RecordFlashSizeMetric(int width, int height) {
-  PluginFlashTinyContentSize size = TINY_CONTENT_SIZE_LARGE;
-
-  if (width <= 1 && height <= 1)
-    size = TINY_CONTENT_SIZE_1_1;
-  else if (width <= 5 && height <= 5)
-    size = TINY_CONTENT_SIZE_5_5;
-  else if (width <= 10 && height <= 10)
-    size = TINY_CONTENT_SIZE_10_10;
-
-  UMA_HISTOGRAM_ENUMERATION(kFlashTinyContentSizeHistogram, size,
-                            TINY_CONTENT_SIZE_NUM_ITEMS);
-}
-
-void RecordFlashClickSizeMetric(int width, int height) {
-  base::HistogramBase* width_histogram = base::LinearHistogram::FactoryGet(
-      kFlashClickSizeWidthHistogram,
-      0,    // minimum width
-      500,  // maximum width
-      100,  // number of buckets.
-      base::HistogramBase::kUmaTargetedHistogramFlag);
-  width_histogram->Add(width);
-
-  base::HistogramBase* height_histogram = base::LinearHistogram::FactoryGet(
-      kFlashClickSizeHeightHistogram,
-      0,    // minimum height
-      400,  // maximum height
-      100,  // number of buckets.
-      base::HistogramBase::kUmaTargetedHistogramFlag);
-  height_histogram->Add(height);
-
-  UMA_HISTOGRAM_ASPECT_RATIO(kFlashClickSizeAspectRatioHistogram, width,
-                             height);
-}
-
-}  // namespace content
diff --git a/chromium/content/renderer/pepper/pepper_plugin_instance_metrics.h b/chromium/content/renderer/pepper/pepper_plugin_instance_metrics.h
deleted file mode 100644
index 33739ea6314..00000000000
--- a/chromium/content/renderer/pepper/pepper_plugin_instance_metrics.h
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2015 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef CONTENT_RENDERER_PEPPER_PEPPER_PLUGIN_INSTANCE_METRICS_H_
-#define CONTENT_RENDERER_PEPPER_PEPPER_PLUGIN_INSTANCE_METRICS_H_
-
-namespace content {
-
-// Record size metrics for all Flash instances.
-void RecordFlashSizeMetric(int width, int height);
-
-// Records size metrics for Flash instances that are clicked.
-void RecordFlashClickSizeMetric(int width, int height);
-
-}  // namespace content
-
-#endif  // CONTENT_RENDERER_PEPPER_PEPPER_PLUGIN_INSTANCE_METRICS_H_
diff --git a/chromium/content/renderer/pepper/pepper_video_capture_host.cc b/chromium/content/renderer/pepper/pepper_video_capture_host.cc
index e85a337eeea..6794414d61c 100644
--- a/chromium/content/renderer/pepper/pepper_video_capture_host.cc
+++ b/chromium/content/renderer/pepper/pepper_video_capture_host.cc
@@ -4,6 +4,7 @@
 
 #include "content/renderer/pepper/pepper_video_capture_host.h"
 
+#include "base/numerics/ranges.h"
 #include "content/renderer/pepper/host_globals.h"
 #include "content/renderer/pepper/pepper_media_device_manager.h"
 #include "content/renderer/pepper/pepper_platform_video_capture.h"
@@ -20,6 +21,7 @@
 #include "ppapi/thunk/enter.h"
 #include "ppapi/thunk/ppb_buffer_api.h"
 #include "third_party/blink/public/web/modules/mediastream/media_stream_video_source.h"
+#include "third_party/webrtc/common_video/libyuv/include/webrtc_libyuv.h"
 
 using ppapi::HostResource;
 using ppapi::TrackedCallback;
@@ -135,9 +137,9 @@ void PepperVideoCaptureHost::OnFrameReady(const media::VideoFrame& frame) {
 
   for (uint32_t i = 0; i < buffers_.size(); ++i) {
     if (!buffers_[i].in_use) {
-      DCHECK_EQ(frame.format(), media::PIXEL_FORMAT_I420);
       if (buffers_[i].buffer->size() <
-          media::VideoFrame::AllocationSize(frame.format(), alloc_size_)) {
+          media::VideoFrame::AllocationSize(media::PIXEL_FORMAT_I420,
+                                            alloc_size_)) {
         // TODO(ihf): handle size mismatches gracefully here.
         return;
       }
@@ -145,17 +147,70 @@ void PepperVideoCaptureHost::OnFrameReady(const media::VideoFrame& frame) {
       static_assert(media::VideoFrame::kYPlane == 0, "y plane should be 0");
       static_assert(media::VideoFrame::kUPlane == 1, "u plane should be 1");
       static_assert(media::VideoFrame::kVPlane == 2, "v plane should be 2");
-      for (size_t j = 0; j < media::VideoFrame::NumPlanes(frame.format());
-           ++j) {
-        const uint8_t* src = frame.visible_data(j);
-        const size_t row_bytes = frame.row_bytes(j);
-        const size_t src_stride = frame.stride(j);
-        for (int k = 0; k < frame.rows(j); ++k) {
-          memcpy(dst, src, row_bytes);
-          dst += row_bytes;
-          src += src_stride;
+
+      if (frame.storage_type() ==
+          media::VideoFrame::STORAGE_GPU_MEMORY_BUFFER) {
+        // NV12 is the only supported GMB pixel format at the moment.
+        DCHECK_EQ(frame.format(), media::PIXEL_FORMAT_NV12);
+        auto* gmb = frame.GetGpuMemoryBuffer();
+        if (!gmb->Map()) {
+          DLOG(ERROR) << "Error mapping GpuMemoryBuffer video frame";
+          return;
+        }
+
+        const size_t src_y_stride = gmb->stride(0);
+        const size_t src_uv_stride = gmb->stride(1);
+        const uint8_t* src_y_plane =
+            (static_cast<uint8_t*>(gmb->memory(0)) + frame.visible_rect().x() +
+             (frame.visible_rect().y() * src_y_stride));
+        // UV plane of NV12 has 2-byte pixel width, with half chroma subsampling
+        // both horizontally and vertically.
+        const uint8_t* src_uv_plane =
+            (static_cast<uint8_t*>(gmb->memory(1)) +
+             ((frame.visible_rect().x() * 2) / 2) +
+             ((frame.visible_rect().y() / 2) * src_uv_stride));
+
+        const size_t dst_width = frame.natural_size().width();
+        const gfx::Size dst_size = frame.natural_size();
+        const size_t dst_y_stride = media::VideoFrame::RowBytes(
+            media::VideoFrame::kYPlane, media::PIXEL_FORMAT_I420, dst_width);
+        const size_t dst_u_stride = media::VideoFrame::RowBytes(
+            media::VideoFrame::kUPlane, media::PIXEL_FORMAT_I420, dst_width);
+        const size_t dst_v_stride = media::VideoFrame::RowBytes(
+            media::VideoFrame::kVPlane, media::PIXEL_FORMAT_I420, dst_width);
+        const size_t dst_y_plane_area =
+            media::VideoFrame::PlaneSize(media::PIXEL_FORMAT_I420,
+                                         media::VideoFrame::kYPlane, dst_size)
+                .GetArea();
+        const size_t dst_u_plane_area =
+            media::VideoFrame::PlaneSize(media::PIXEL_FORMAT_I420,
+                                         media::VideoFrame::kUPlane, dst_size)
+                .GetArea();
+
+        webrtc::NV12ToI420Scaler scaler;
+        scaler.NV12ToI420Scale(
+            src_y_plane, src_y_stride, src_uv_plane, src_uv_stride,
+            frame.coded_size().width(), frame.coded_size().height(), dst,
+            dst_y_stride, dst + dst_y_plane_area, dst_u_stride,
+            dst + dst_y_plane_area + dst_u_plane_area, dst_v_stride,
+            frame.natural_size().width(), frame.natural_size().height());
+
+        gmb->Unmap();
+      } else {
+        DCHECK_EQ(frame.format(), media::PIXEL_FORMAT_I420);
+        for (size_t j = 0; j < media::VideoFrame::NumPlanes(frame.format());
+             ++j) {
+          const uint8_t* src = frame.visible_data(j);
+          const size_t row_bytes = frame.row_bytes(j);
+          const size_t src_stride = frame.stride(j);
+          for (int k = 0; k < frame.rows(j); ++k) {
+            memcpy(dst, src, row_bytes);
+            dst += row_bytes;
+            src += src_stride;
+          }
         }
       }
+
       buffers_[i].in_use = true;
       host()->SendUnsolicitedReply(
           pp_resource(), PpapiPluginMsg_VideoCapture_OnBufferReady(i));
@@ -339,11 +394,11 @@ void PepperVideoCaptureHost::SetRequestedInfo(
     const PP_VideoCaptureDeviceInfo_Dev& device_info,
     uint32_t buffer_count) {
   // Clamp the buffer count to between 1 and |kMaxBuffers|.
-  buffer_count_hint_ = std::min(std::max(buffer_count, 1U), kMaxBuffers);
+  buffer_count_hint_ = base::ClampToRange(buffer_count, 1U, kMaxBuffers);
   // Clamp the frame rate to between 1 and |kMaxFramesPerSecond - 1|.
   int frames_per_second =
-      std::min(std::max(device_info.frames_per_second, 1U),
-               static_cast<uint32_t>(media::limits::kMaxFramesPerSecond - 1));
+      base::ClampToRange(device_info.frames_per_second, 1U,
+                         uint32_t{media::limits::kMaxFramesPerSecond - 1});
 
   video_capture_params_.requested_format = media::VideoCaptureFormat(
       gfx::Size(device_info.width, device_info.height), frames_per_second,
diff --git a/chromium/content/renderer/pepper/pepper_webplugin_impl.cc b/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
index db8dfbcf03e..9b3bcfda681 100644
--- a/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
+++ b/chromium/content/renderer/pepper/pepper_webplugin_impl.cc
@@ -457,6 +457,14 @@ bool PepperWebPluginImpl::GetPrintPresetOptionsFromDocument(
   return instance_->GetPrintPresetOptionsFromDocument(preset_options);
 }
 
+bool PepperWebPluginImpl::IsPdfPlugin() {
+  // Re-entrancy may cause JS to try to execute script on the plugin before it
+  // is fully initialized. See: crbug.com/715747.
+  if (!instance_)
+    return false;
+  return instance_->IsPdfPlugin();
+}
+
 bool PepperWebPluginImpl::CanRotateView() {
   // Re-entrancy may cause JS to try to execute script on the plugin before it
   // is fully initialized. See: crbug.com/715747.
diff --git a/chromium/content/renderer/pepper/pepper_webplugin_impl.h b/chromium/content/renderer/pepper/pepper_webplugin_impl.h
index 0be81fc17e0..7c1f1c6c84e 100644
--- a/chromium/content/renderer/pepper/pepper_webplugin_impl.h
+++ b/chromium/content/renderer/pepper/pepper_webplugin_impl.h
@@ -73,6 +73,7 @@ class PepperWebPluginImpl : public blink::WebPlugin {
   blink::WebURL LinkAtPosition(const blink::WebPoint& position) const override;
   bool GetPrintPresetOptionsFromDocument(
       blink::WebPrintPresetOptions* preset_options) override;
+  bool IsPdfPlugin() override;
   bool StartFind(const blink::WebString& search_text,
                  bool case_sensitive,
                  int identifier) override;
diff --git a/chromium/content/renderer/pepper/plugin_power_saver_helper.cc b/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
index fe35e53c303..3d3cc75e47c 100644
--- a/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
+++ b/chromium/content/renderer/pepper/plugin_power_saver_helper.cc
@@ -8,7 +8,6 @@
 
 #include "base/command_line.h"
 #include "base/location.h"
-#include "base/metrics/histogram_macros.h"
 #include "base/single_thread_task_runner.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/threading/thread_task_runner_handle.h"
@@ -22,13 +21,6 @@
 
 namespace content {
 
-namespace {
-
-const char kPeripheralHeuristicHistogram[] =
-    "Plugin.PowerSaver.PeripheralHeuristicInitialDecision";
-
-}  // namespace
-
 PluginPowerSaverHelper::PeripheralPlugin::PeripheralPlugin(
     const url::Origin& content_origin,
     base::OnceClosure unthrottle_callback)
@@ -112,15 +104,8 @@ PluginPowerSaverHelper::GetPeripheralContentStatus(
     return RenderFrame::CONTENT_STATUS_PERIPHERAL;
   }
 
-  auto status = PeripheralContentHeuristic::GetPeripheralStatus(
+  return PeripheralContentHeuristic::GetPeripheralStatus(
       origin_whitelist_, main_frame_origin, content_origin, unobscured_size);
-
-  if (record_decision == RenderFrame::RECORD_DECISION) {
-    UMA_HISTOGRAM_ENUMERATION(kPeripheralHeuristicHistogram, status,
-                              RenderFrame::CONTENT_STATUS_NUM_ITEMS);
-  }
-
-  return status;
 }
 
 void PluginPowerSaverHelper::WhitelistContentOrigin(
diff --git a/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc b/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
index b3892053437..735637b353f 100644
--- a/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
+++ b/chromium/content/renderer/pepper/ppb_video_decoder_impl.cc
@@ -166,7 +166,7 @@ int32_t PPB_VideoDecoder_Impl::Decode(
   // but only after PPB_Buffer_Impl is updated to deal with that.
   media::BitstreamBuffer decode_buffer(bitstream_buffer->id,
                                        buffer->shared_memory().Duplicate(),
-                                       buffer->shared_memory().GetSize());
+                                       bitstream_buffer->size);
   if (!SetBitstreamBufferCallback(bitstream_buffer->id, callback))
     return PP_ERROR_BADARGUMENT;
 
diff --git a/chromium/content/renderer/pepper/url_request_info_util.cc b/chromium/content/renderer/pepper/url_request_info_util.cc
index 1fb229e3767..8029a6f4a4e 100644
--- a/chromium/content/renderer/pepper/url_request_info_util.cc
+++ b/chromium/content/renderer/pepper/url_request_info_util.cc
@@ -17,6 +17,7 @@
 #include "content/renderer/pepper/plugin_module.h"
 #include "content/renderer/pepper/renderer_ppapi_host_impl.h"
 #include "content/renderer/render_thread_impl.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/http/http_util.h"
 #include "ppapi/c/pp_bool.h"
 #include "ppapi/c/pp_var.h"
@@ -50,11 +51,11 @@ namespace content {
 
 namespace {
 
-blink::mojom::FileSystemManagerPtr GetFileSystemManager() {
-  blink::mojom::FileSystemManagerPtr file_system_manager_ptr;
+mojo::Remote<blink::mojom::FileSystemManager> GetFileSystemManager() {
+  mojo::Remote<blink::mojom::FileSystemManager> file_system_manager;
   ChildThreadImpl::current()->BindHostReceiver(
-      mojo::MakeRequest(&file_system_manager_ptr));
-  return file_system_manager_ptr;
+      file_system_manager.BindNewPipeAndPassReceiver());
+  return file_system_manager;
 }
 
 // Appends the file ref given the Resource pointer associated with it to the
diff --git a/chromium/content/renderer/pepper/v8_var_converter_unittest.cc b/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
index 3645f7d0b58..d699fd8a7c0 100644
--- a/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
+++ b/chromium/content/renderer/pepper/v8_var_converter_unittest.cc
@@ -239,8 +239,8 @@ class V8VarConverterTest : public testing::Test {
   std::unique_ptr<V8VarConverter> converter_;
 
  private:
-  base::test::SingleThreadTaskEnvironment
-      task_environment_;  // Required to receive callbacks.
+  // Required to receive callbacks.
+  base::test::TaskEnvironment task_environment_;
 
   TestGlobals globals_;
 };
diff --git a/chromium/content/renderer/render_frame_impl.cc b/chromium/content/renderer/render_frame_impl.cc
index f8f8209786f..ac736036792 100644
--- a/chromium/content/renderer/render_frame_impl.cc
+++ b/chromium/content/renderer/render_frame_impl.cc
@@ -53,6 +53,7 @@
 #include "content/common/content_security_policy/content_security_policy.h"
 #include "content/common/content_security_policy_header.h"
 #include "content/common/edit_command.h"
+#include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/frame_replication_state.h"
@@ -146,7 +147,11 @@
 #include "content/renderer/web_ui_extension_data.h"
 #include "content/renderer/worker/dedicated_worker_host_factory_client.h"
 #include "crypto/sha2.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/base/data_url.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
@@ -155,8 +160,9 @@
 #include "net/http/http_util.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
-#include "services/service_manager/public/cpp/connector.h"
+#include "services/network/public/mojom/url_response_head.mojom.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
@@ -318,10 +324,6 @@ const int kBurstDownloadLimit = 10;
 const PreviewsState kDisabledPreviewsBits =
     PREVIEWS_OFF | PREVIEWS_NO_TRANSFORM;
 
-// Print up to |kMaxSecurityWarningMessages| console messages per frame about
-// certificates or TLS versions that will be distrusted in future.
-const uint32_t kMaxSecurityWarningMessages = 10;
-
 typedef std::map<int, RenderFrameImpl*> RoutingIDFrameMap;
 static base::LazyInstance<RoutingIDFrameMap>::DestructorAtExit
     g_routing_id_frame_map = LAZY_INSTANCE_INITIALIZER;
@@ -473,6 +475,11 @@ void FillNavigationParamsRequest(
     }
   }
 
+  if (common_params.previews_state & kDisabledPreviewsBits) {
+    // Sanity check disabled vs. enabled bits here before passing on.
+    DCHECK(!(common_params.previews_state & ~kDisabledPreviewsBits))
+        << common_params.previews_state;
+  }
   navigation_params->previews_state =
       static_cast<WebURLRequest::PreviewsState>(common_params.previews_state);
 
@@ -499,9 +506,8 @@ void FillNavigationParamsRequest(
     for (const auto& exchange : commit_params.prefetched_signed_exchanges) {
       blink::WebURLResponse web_response;
       WebURLLoaderImpl::PopulateURLResponse(
-          exchange->inner_url,
-          network::ResourceResponseHead(exchange->inner_response),
-          &web_response, false /* report_security_info*/, -1 /* request_id */);
+          exchange->inner_url, *exchange->inner_response, &web_response,
+          false /* report_security_info*/, -1 /* request_id */);
       navigation_params->prefetched_signed_exchanges.emplace_back(
           std::make_unique<
               blink::WebNavigationParams::PrefetchedSignedExchange>(
@@ -515,6 +521,8 @@ void FillNavigationParamsRequest(
   }
 
   navigation_params->had_transient_activation = common_params.has_user_gesture;
+  navigation_params->base_url_override_for_bundled_exchanges =
+      commit_params.base_url_override_for_bundled_exchanges;
 }
 
 mojom::CommonNavigationParamsPtr MakeCommonNavigationParams(
@@ -842,7 +850,7 @@ void RecordSuffixedRendererMemoryMetrics(
       memory_metrics.total_allocated_per_render_view_mb);
 }
 
-// See also LOG_NAVIGATION_TIMING_HISTOGRAM in NavigationHandleImpl.
+// See also LOG_NAVIGATION_TIMING_HISTOGRAM in NavigationRequest.
 void RecordReadyToCommitUntilCommitHistogram(base::TimeDelta delay,
                                              ui::PageTransition transition) {
   UMA_HISTOGRAM_TIMES("Navigation.Renderer.ReadyToCommitUntilCommit", delay);
@@ -894,7 +902,6 @@ std::unique_ptr<DocumentState> BuildDocumentStateFromParams(
     mojom::FrameNavigationControl::CommitNavigationCallback commit_callback,
     mojom::NavigationClient::CommitNavigationCallback
         per_navigation_mojo_interface_commit_callback,
-    const network::ResourceResponseHead* head,
     std::unique_ptr<NavigationClient> navigation_client,
     int request_id,
     bool was_initiated_in_this_frame) {
@@ -905,46 +912,12 @@ std::unique_ptr<DocumentState> BuildDocumentStateFromParams(
   DCHECK(!common_params.navigation_start.is_null());
   DCHECK(!common_params.url.SchemeIs(url::kJavaScriptScheme));
 
-  if (common_params.navigation_type == mojom::NavigationType::RESTORE) {
-    // We're doing a load of a page that was restored from the last session.
-    // By default this prefers the cache over loading
-    // (LOAD_SKIP_CACHE_VALIDATION) which can result in stale data for pages
-    // that are set to expire. We explicitly override that by setting the
-    // policy here so that as necessary we load from the network.
-    //
-    // TODO(davidben): Remove this in favor of passing a cache policy to the
-    // loadHistoryItem call in OnNavigate. That requires not overloading
-    // UseProtocolCachePolicy to mean both "normal load" and "determine cache
-    // policy based on load type, etc".
-    internal_data->set_cache_policy_override(
-        blink::mojom::FetchCacheMode::kDefault);
-  }
-
   internal_data->set_is_overriding_user_agent(
       commit_params.is_overriding_user_agent);
   internal_data->set_must_reset_scroll_and_scale_state(
       common_params.navigation_type ==
       mojom::NavigationType::RELOAD_ORIGINAL_REQUEST_URL);
-  internal_data->set_previews_state(common_params.previews_state);
   internal_data->set_request_id(request_id);
-  document_state->set_can_load_local_resources(
-      commit_params.can_load_local_resources);
-
-  if (head) {
-    if (head->headers)
-      internal_data->set_http_status_code(head->headers->response_code());
-    else if (common_params.url.SchemeIs(url::kDataScheme))
-      internal_data->set_http_status_code(200);
-    document_state->set_was_fetched_via_spdy(head->was_fetched_via_spdy);
-    document_state->set_was_alpn_negotiated(head->was_alpn_negotiated);
-    document_state->set_alpn_negotiated_protocol(
-        head->alpn_negotiated_protocol);
-    document_state->set_was_alternate_protocol_available(
-        head->was_alternate_protocol_available);
-    document_state->set_connection_info(head->connection_info);
-    internal_data->set_effective_connection_type(
-        head->effective_connection_type);
-  }
 
   bool load_data = !common_params.base_url_for_data_url.is_empty() &&
                    !common_params.history_url_for_data_url.is_empty() &&
@@ -1044,18 +1017,41 @@ void FillMiscNavigationParams(
 
   navigation_params->is_browser_initiated = commit_params.is_browser_initiated;
 
+#if defined(OS_ANDROID)
+  // Only android webview uses this.
+  navigation_params->grant_load_local_resources =
+      commit_params.can_load_local_resources;
+#else
+  DCHECK(!commit_params.can_load_local_resources);
+#endif
+
   if (commit_params.origin_to_commit) {
     navigation_params->origin_to_commit =
         commit_params.origin_to_commit.value();
   }
   navigation_params->appcache_host_id =
       commit_params.appcache_host_id.value_or(base::UnguessableToken());
+
+  if (common_params.navigation_type == mojom::NavigationType::RESTORE) {
+    // We're doing a load of a page that was restored from the last session.
+    // By default this prefers the cache over loading
+    // (LOAD_SKIP_CACHE_VALIDATION) which can result in stale data for pages
+    // that are set to expire. We explicitly override that by setting the
+    // policy here so that as necessary we load from the network.
+    //
+    // TODO(davidben): Remove this in favor of passing a cache policy to the
+    // loadHistoryItem call in OnNavigate. That requires not overloading
+    // UseProtocolCachePolicy to mean both "normal load" and "determine cache
+    // policy based on load type, etc".
+    navigation_params->force_fetch_cache_mode =
+        blink::mojom::FetchCacheMode::kDefault;
+  }
 }
 
 // Fills in the origin policy associated with this response, if any is present.
 // Converts it into a format that blink understands: WebOriginPolicy.
 void FillNavigationParamsOriginPolicy(
-    const network::ResourceResponseHead& head,
+    const network::mojom::URLResponseHead& head,
     blink::WebNavigationParams* navigation_params) {
   if (head.origin_policy.has_value() && head.origin_policy.value().contents) {
     navigation_params->origin_policy = blink::WebOriginPolicy();
@@ -1151,10 +1147,10 @@ class RenderFrameImpl::FrameURLLoaderFactory
     // This should not be called if the frame is detached.
     DCHECK(frame_);
 
-    mojom::KeepAliveHandlePtr keep_alive_handle;
+    mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle;
     if (request.GetKeepalive()) {
       frame_->GetFrameHost()->IssueKeepAliveHandle(
-          mojo::MakeRequest(&keep_alive_handle));
+          keep_alive_handle.InitWithNewPipeAndPassReceiver());
     }
     return std::make_unique<WebURLLoaderImpl>(
         RenderThreadImpl::current()->resource_dispatcher(),
@@ -1464,27 +1460,24 @@ RenderFrameImpl* RenderFrameImpl::CreateMainFrame(
   // RenderFrame.
   render_view->render_widget_ = RenderWidget::CreateForFrame(
       params->main_frame_widget_routing_id, compositor_deps,
-      params->visual_properties.screen_info,
       params->visual_properties.display_mode,
-      /*is_frozen=*/params->main_frame_routing_id == MSG_ROUTING_NONE,
+      /*is_undead=*/params->main_frame_routing_id == MSG_ROUTING_NONE,
       params->never_visible);
-  render_view->GetWidget()->set_delegate(render_view);
 
   RenderWidget* render_widget = render_view->GetWidget();
+  render_widget->set_delegate(render_view);
 
   // Non-owning pointer that is self-referencing and destroyed by calling
   // Close(). The RenderViewImpl has a RenderWidget already, but not a
   // WebFrameWidget, which is now attached here.
-  auto* web_frame_widget = blink::WebFrameWidget::CreateForMainFrame(
-      render_view->GetWidget(), web_frame);
+  auto* web_frame_widget =
+      blink::WebFrameWidget::CreateForMainFrame(render_widget, web_frame);
 
-  render_widget->Init(std::move(show_callback), web_frame_widget);
-
-  render_view->AttachWebFrameWidget(web_frame_widget);
-  // TODO(crbug.com/419087): This was added in 6ccadf770766e89c3 to prevent an
-  // empty ScreenInfo, but the WebView has already been created and initialized
-  // by RenderViewImpl, so this is surely redundant?
-  render_widget->UpdateWebViewWithDeviceScaleFactor();
+  render_widget->InitForMainFrame(std::move(show_callback), web_frame_widget,
+                                  &params->visual_properties.screen_info);
+  // AttachWebFrameWidget() is not needed here since InitForMainFrame() received
+  // the WebFrameWidget.
+  render_widget->OnUpdateVisualProperties(params->visual_properties);
 
   // The WebFrame created here was already attached to the Page as its
   // main frame, and the WebFrameWidget has been initialized, so we can call
@@ -1516,7 +1509,7 @@ void RenderFrameImpl::CreateFrame(
     const base::UnguessableToken& devtools_frame_token,
     const FrameReplicationState& replicated_state,
     CompositorDependencies* compositor_deps,
-    const mojom::CreateFrameWidgetParams& widget_params,
+    const mojom::CreateFrameWidgetParams* widget_params,
     const FrameOwnerProperties& frame_owner_properties,
     bool has_committed_real_load) {
   // TODO(danakj): Split this method into two pieces. The first block makes a
@@ -1617,55 +1610,47 @@ void RenderFrameImpl::CreateFrame(
 
   // We now have a WebLocalFrame for the new frame. The next step is to set
   // up a RenderWidget for it, if it is needed.
-  //
-  // If there is no widget routing id, then the new frame is not a local root,
-  // and does not need a RenderWidget. In that case we'll do nothing. Otherwise
-  // it does.
   if (is_main_frame) {
     // For a main frame, we use the RenderWidget already attached to the
     // RenderView (this is being changed by https://crbug.com/419087).
 
-    // Main frames are always local roots, so they should always have a routing
-    // id. Surprisingly, this routing id is *not* used though, as the routing id
-    // on the existing RenderWidget is not changed. (I don't know why.)
+    // Main frames are always local roots, so they should always have a
+    // |widget_params| (and it always comes with a routing id). Surprisingly,
+    // this routing id is *not* used though, as the routing id on the existing
+    // RenderWidget is not changed. (I don't know why.)
     // TODO(crbug.com/888105): It's a bug that the RenderWidget is not using
     // this routing id.
-    DCHECK_NE(widget_params.routing_id, MSG_ROUTING_NONE);
+    DCHECK(widget_params);
+    DCHECK_NE(widget_params->routing_id, MSG_ROUTING_NONE);
 
-    // The RenderViewImpl and its RenderWidget already exist by the time we
-    // get here (we get them from the RenderFrameProxy).
-    // TODO(crbug.com/419087): We probably want to create the RenderWidget
-    // here though (when we make the WebFrameWidget?).
-    RenderWidget* render_widget = render_view->GetWidget();
+    // We revive the undead main frame RenderWidget at the same time we would
+    // create the RenderWidget if the RenderFrame owned it instead of having the
+    // RenderWidget live for eternity on the RenderView (after setting up the
+    // WebFrameWidget since that would be part of creating the RenderWidget).
+    //
+    // This is equivalent to creating a new RenderWidget if it wasn't undead.
+    RenderWidget* render_widget =
+        render_view->ReviveUndeadMainFrameRenderWidget();
+    DCHECK(!render_widget->GetWebWidget());
 
     // Non-owning pointer that is self-referencing and destroyed by calling
     // Close(). The RenderViewImpl has a RenderWidget already, but not a
     // WebFrameWidget, which is now attached here.
     auto* web_frame_widget = blink::WebFrameWidget::CreateForMainFrame(
         render_view->GetWidget(), web_frame);
-    render_view->AttachWebFrameWidget(web_frame_widget);
-    // TODO(crbug.com/419087): This was added in 6ccadf770766e89c3 to prevent
-    // an empty ScreenInfo, but the WebView has already been created and
-    // initialized by RenderViewImpl, so this is surely redundant? It will be
-    // pulling the device scale factor off the WebView itself.
-    render_widget->UpdateWebViewWithDeviceScaleFactor();
+    // This is equivalent to calling InitForMainFrame() on a new RenderWidget
+    // if it wasn't undead.
+    render_widget->InitForRevivedMainFrame(
+        web_frame_widget, widget_params->visual_properties.screen_info);
 
     // Note that we do *not* call WebViewImpl's DidAttachLocalMainFrame() here
     // yet because this frame is provisional and not attached to the Page yet.
     // We will tell WebViewImpl about it once it is swapped in.
 
-    // It may be questionable, since we create un-frozen RenderWidgets at this
-    // point for subframes, but we don't un-freeze the main frame's RenderWidget
-    // here, instead deferring until the non-provisional frame is swapped in.
-    // But we do need to start the creating compositor resources in parallel to
-    // the navigation being done with the provisional frame, so we inform the
-    // frozen RenderWidget to get prepared. We must abort this if we are no
-    // longer planning to un-freeze the RenderWidget (ie in FrameDetached).
-    render_widget->WarmupCompositor();
-
     render_frame->render_widget_ = render_widget;
     DCHECK(!render_frame->owned_render_widget_);
-  } else if (widget_params.routing_id != MSG_ROUTING_NONE) {
+  } else if (widget_params) {
+    DCHECK(widget_params->routing_id != MSG_ROUTING_NONE);
     // This frame is a child local root, so we require a separate RenderWidget
     // for it from any other frames in the frame tree. Each local root defines
     // a separate context/coordinate space/world for compositing, painting,
@@ -1678,18 +1663,13 @@ void RenderFrameImpl::CreateFrame(
     // and the main frame, thus its coordinate space etc is not known relative
     // to the main frame.
 
-    // TODO(crbug.com/419087): This is grabbing something off the view's
-    // widget but if the main frame is remote this widget would not be valid?
-    const ScreenInfo& screen_info_from_main_frame =
-        render_view->GetWidget()->GetWebScreenInfo();
-
     // Makes a new RenderWidget for the child local root. It provides the
     // local root with a new compositing, painting, and input coordinate
     // space/context.
     std::unique_ptr<RenderWidget> render_widget = RenderWidget::CreateForFrame(
-        widget_params.routing_id, compositor_deps, screen_info_from_main_frame,
-        blink::kWebDisplayModeUndefined,
-        /*is_frozen=*/false, /*never_visible=*/false);
+        widget_params->routing_id, compositor_deps,
+        blink::mojom::DisplayMode::kUndefined,
+        /*is_undead=*/false, /*never_visible=*/false);
 
     // Non-owning pointer that is self-referencing and destroyed by calling
     // Close(). We use the new RenderWidget as the client for this
@@ -1701,17 +1681,24 @@ void RenderFrameImpl::CreateFrame(
     // Adds a reference on RenderWidget, making it self-referencing. So it
     // will not be destroyed by scoped_refptr unless Close() has been called
     // and run.
-    render_widget->InitForChildLocalRoot(web_frame_widget);
-    // TODO(crbug.com/419087): This was added in 6ccadf770766e89c3 to prevent
-    // an empty ScreenInfo, but the WebView has already been created and
-    // initialized by RenderViewImpl, so this is surely redundant? It will be
-    // pulling the device scale factor off the WebView itself.
-    render_widget->UpdateWebViewWithDeviceScaleFactor();
+    render_widget->InitForChildLocalRoot(
+        web_frame_widget, widget_params->visual_properties.screen_info);
 
     render_frame->render_widget_ = render_widget.get();
     render_frame->owned_render_widget_ = std::move(render_widget);
   }
 
+  if (widget_params) {
+    DCHECK(render_frame->render_widget_);
+    // The RenderWidget should start with valid VisualProperties, including a
+    // non-zero size. While RenderWidget would not normally receive IPCs and
+    // thus would not get VisualProperty updates while the frame is provisional,
+    // we need at least one update to them in order to meet expectations in the
+    // renderer, and that update comes as part of the CreateFrame message.
+    render_frame->render_widget_->OnUpdateVisualProperties(
+        widget_params->visual_properties);
+  }
+
   if (has_committed_real_load)
     render_frame->frame_->SetCommittedFirstRealLoad();
 
@@ -1873,9 +1860,6 @@ RenderFrameImpl::RenderFrameImpl(CreateParams params)
       selection_range_(gfx::Range::InvalidRange()),
       handling_select_range_(false),
       render_accessibility_(nullptr),
-      previews_state_(PREVIEWS_UNSPECIFIED),
-      effective_connection_type_(
-          blink::WebEffectiveConnectionType::kTypeUnknown),
       is_pasting_(false),
       suppress_further_dialogs_(false),
       blame_context_(nullptr),
@@ -1883,13 +1867,6 @@ RenderFrameImpl::RenderFrameImpl(CreateParams params)
       focused_pepper_plugin_(nullptr),
       pepper_last_mouse_event_target_(nullptr),
 #endif
-      autoplay_configuration_binding_(this),
-      frame_binding_(this),
-      host_zoom_binding_(this),
-      frame_bindings_control_binding_(this),
-      frame_navigation_control_receiver_(this),
-      fullscreen_binding_(this),
-      mhtml_file_writer_binding_(this),
       navigation_client_impl_(nullptr),
       has_accessed_initial_document_(false),
       media_factory_(
@@ -1936,9 +1913,9 @@ RenderFrameImpl::RenderFrameImpl(CreateParams params)
 }
 
 mojom::FrameHost* RenderFrameImpl::GetFrameHost() {
-  if (!frame_host_ptr_.is_bound())
-    GetRemoteAssociatedInterfaces()->GetInterface(&frame_host_ptr_);
-  return frame_host_ptr_.get();
+  if (!frame_host_remote_.is_bound())
+    GetRemoteAssociatedInterfaces()->GetInterface(&frame_host_remote_);
+  return frame_host_remote_.get();
 }
 
 RenderFrameImpl::~RenderFrameImpl() {
@@ -1977,13 +1954,6 @@ void RenderFrameImpl::Initialize() {
 
   GetLocalRootRenderWidget()->RegisterRenderFrame(this);
 
-  RenderFrameImpl* parent_frame =
-      RenderFrameImpl::FromWebFrame(frame_->Parent());
-  if (parent_frame) {
-    previews_state_ = parent_frame->GetPreviewsState();
-    effective_connection_type_ = parent_frame->GetEffectiveConnectionType();
-  }
-
   bool is_tracing_rail = false;
   bool is_tracing_navigation = false;
   TRACE_EVENT_CATEGORY_GROUP_ENABLED("navigation", &is_tracing_navigation);
@@ -2127,9 +2097,9 @@ RenderWidgetFullscreenPepper* RenderFrameImpl::CreatePepperFullscreenContainer(
   if (main_frame->IsWebLocalFrame())
     main_frame_url = main_frame->ToWebLocalFrame()->GetDocument().Url();
 
-  mojom::WidgetPtr widget_channel;
-  mojom::WidgetRequest widget_channel_request =
-      mojo::MakeRequest(&widget_channel);
+  mojo::PendingRemote<mojom::Widget> widget_channel;
+  mojo::PendingReceiver<mojom::Widget> widget_channel_receiver =
+      widget_channel.InitWithNewPipeAndPassReceiver();
 
   // Synchronous IPC to obtain a routing id for the fullscreen widget.
   int32_t fullscreen_widget_routing_id = MSG_ROUTING_NONE;
@@ -2143,13 +2113,11 @@ RenderWidgetFullscreenPepper* RenderFrameImpl::CreatePepperFullscreenContainer(
       base::BindOnce(&RenderViewImpl::ShowCreatedFullscreenWidget,
                      render_view()->GetWeakPtr());
 
-  // TODO(fsamuel): It's not clear if we should be passing in the
-  // web ScreenInfo or the original ScreenInfo here.
   RenderWidgetFullscreenPepper* widget = RenderWidgetFullscreenPepper::Create(
       fullscreen_widget_routing_id, std::move(show_callback),
-      GetLocalRootRenderWidget()->compositor_deps(), plugin,
-      std::move(main_frame_url), GetLocalRootRenderWidget()->GetWebScreenInfo(),
-      std::move(widget_channel_request));
+      GetLocalRootRenderWidget()->compositor_deps(),
+      GetLocalRootRenderWidget()->GetOriginalScreenInfo(), plugin,
+      std::move(main_frame_url), std::move(widget_channel_receiver));
   // TODO(nick): The show() handshake seems like unnecessary complexity here,
   // since there's no real delay between CreateFullscreenWidget and
   // ShowCreatedFullscreenWidget. Would it be simpler to have the
@@ -2190,10 +2158,6 @@ void RenderFrameImpl::SimulateImeCommitText(
                                               replacement_range, 0);
 }
 
-void RenderFrameImpl::SimulateImeFinishComposingText(bool keep_selection) {
-  GetMainFrameRenderWidget()->OnImeFinishComposingText(keep_selection);
-}
-
 void RenderFrameImpl::OnImeSetComposition(
     const base::string16& text,
     const std::vector<blink::WebImeTextSpan>& ime_text_spans,
@@ -2256,7 +2220,9 @@ void RenderFrameImpl::DidHideExternalPopupMenu() {
 #endif
 
 bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
-  // Forward Page IPCs to the RenderView.
+  // Page IPCs are routed via the main frame (both local and remote) and then
+  // forwarded to the RenderView. See comment in
+  // RenderFrameHostManager::SendPageMessage() for more information.
   if ((IPC_MESSAGE_CLASS(msg) == PageMsgStart)) {
     if (render_view())
       return render_view()->OnMessageReceived(msg);
@@ -2300,7 +2266,6 @@ bool RenderFrameImpl::OnMessageReceived(const IPC::Message& msg) {
     IPC_MESSAGE_HANDLER(FrameMsg_VisualStateRequest,
                         OnVisualStateRequest)
     IPC_MESSAGE_HANDLER(FrameMsg_Reload, OnReload)
-    IPC_MESSAGE_HANDLER(FrameMsg_ReloadLoFiImages, OnReloadLoFiImages)
     IPC_MESSAGE_HANDLER(FrameMsg_SetAccessibilityMode,
                         OnSetAccessibilityMode)
     IPC_MESSAGE_HANDLER(AccessibilityMsg_SnapshotTree,
@@ -2361,29 +2326,31 @@ void RenderFrameImpl::OnAssociatedInterfaceRequest(
 }
 
 void RenderFrameImpl::BindFullscreen(
-    mojom::FullscreenVideoElementHandlerAssociatedRequest request) {
-  fullscreen_binding_.Bind(std::move(request),
-                           GetTaskRunner(blink::TaskType::kInternalIPC));
+    mojo::PendingAssociatedReceiver<mojom::FullscreenVideoElementHandler>
+        receiver) {
+  fullscreen_receiver_.Bind(std::move(receiver),
+                            GetTaskRunner(blink::TaskType::kInternalIPC));
 }
 
 void RenderFrameImpl::BindAutoplayConfiguration(
-    blink::mojom::AutoplayConfigurationClientAssociatedRequest request) {
-  autoplay_configuration_binding_.Bind(
-      std::move(request), GetTaskRunner(blink::TaskType::kInternalIPC));
+    mojo::PendingAssociatedReceiver<blink::mojom::AutoplayConfigurationClient>
+        receiver) {
+  autoplay_configuration_receiver_.Bind(
+      std::move(receiver), GetTaskRunner(blink::TaskType::kInternalIPC));
 }
 
 void RenderFrameImpl::BindFrame(
     const service_manager::BindSourceInfo& browser_info,
-    mojom::FrameRequest request) {
+    mojo::PendingReceiver<mojom::Frame> receiver) {
   browser_info_ = browser_info;
-  frame_binding_.Bind(std::move(request),
-                      GetTaskRunner(blink::TaskType::kInternalIPC));
+  frame_receiver_.Bind(std::move(receiver),
+                       GetTaskRunner(blink::TaskType::kInternalIPC));
 }
 
 void RenderFrameImpl::BindFrameBindingsControl(
-    mojom::FrameBindingsControlAssociatedRequest request) {
-  frame_bindings_control_binding_.Bind(
-      std::move(request), GetTaskRunner(blink::TaskType::kInternalIPC));
+    mojo::PendingAssociatedReceiver<mojom::FrameBindingsControl> receiver) {
+  frame_bindings_control_receiver_.Bind(
+      std::move(receiver), GetTaskRunner(blink::TaskType::kInternalIPC));
 }
 
 void RenderFrameImpl::BindFrameNavigationControl(
@@ -2393,9 +2360,9 @@ void RenderFrameImpl::BindFrameNavigationControl(
 }
 
 void RenderFrameImpl::BindNavigationClient(
-    mojom::NavigationClientAssociatedRequest request) {
+    mojo::PendingAssociatedReceiver<mojom::NavigationClient> receiver) {
   navigation_client_impl_ = std::make_unique<NavigationClient>(this);
-  navigation_client_impl_->Bind(std::move(request));
+  navigation_client_impl_->Bind(std::move(receiver));
 }
 
 void RenderFrameImpl::OnBeforeUnload(bool is_reload) {
@@ -2438,15 +2405,6 @@ void RenderFrameImpl::OnSwapOut(
   RenderFrameProxy* proxy = RenderFrameProxy::CreateProxyToReplaceFrame(
       this, proxy_routing_id, replicated_frame_state.scope);
 
-  // Swap out and stop sending any IPC messages that are not ACKs.
-  if (is_main_frame_) {
-    // The RenderWidget isn't actually closed here because we might need to use
-    // it again. It can't be destroyed and recreated later as it is part of
-    // the |render_view_|, which must be kept alive. So instead freeze the
-    // widget.
-    render_view_->GetWidget()->SetIsFrozen(true);
-  }
-
   RenderViewImpl* render_view = render_view_;
   bool is_main_frame = is_main_frame_;
   int routing_id = GetRoutingID();
@@ -2838,6 +2796,13 @@ void RenderFrameImpl::SetLifecycleState(
   frame_->SetLifecycleState(state);
 }
 
+void RenderFrameImpl::UpdateBrowserControlsState(
+    BrowserControlsState constraints,
+    BrowserControlsState current,
+    bool animate) {
+  render_view_->UpdateBrowserControlsState(constraints, current, animate);
+}
+
 void RenderFrameImpl::VisibilityChanged(
     blink::mojom::FrameVisibility visibility) {
   GetFrameHost()->VisibilityChanged(visibility);
@@ -2965,14 +2930,8 @@ void RenderFrameImpl::PostMessageEvent(int32_t source_routing_id,
                                               msg_event);
 }
 
-void RenderFrameImpl::OnReload(bool bypass_cache) {
-  frame_->StartReload(bypass_cache ? WebFrameLoadType::kReloadBypassingCache
-                                   : WebFrameLoadType::kReload);
-}
-
-void RenderFrameImpl::OnReloadLoFiImages() {
-  previews_state_ = PREVIEWS_NO_TRANSFORM;
-  GetWebFrame()->ReloadLoFiImages();
+void RenderFrameImpl::OnReload() {
+  frame_->StartReload(WebFrameLoadType::kReload);
 }
 
 bool RenderFrameImpl::RunJavaScriptDialog(JavaScriptDialogType type,
@@ -3014,56 +2973,9 @@ bool RenderFrameImpl::RunJavaScriptDialog(JavaScriptDialogType type,
   return success;
 }
 
-void RenderFrameImpl::DidFailProvisionalLoad(const WebURLError& error,
-                                             const WebString& http_method) {
-  DCHECK_EQ(net::ERR_ABORTED, error.reason());
-  TRACE_EVENT1("navigation,benchmark,rail",
-               "RenderFrameImpl::didFailProvisionalLoad", "id", routing_id_);
-  // Note: It is important this notification occur before DidStopLoading so the
-  //       SSL manager can react to the provisional load failure before being
-  //       notified the load stopped.
-  //
-  NotifyObserversOfFailedProvisionalLoad(error);
-
-  // Notify the browser that we failed a provisional load with an error.
-  SendFailedProvisionalLoad(http_method.Ascii(), error, frame_);
-}
-
-void RenderFrameImpl::NotifyObserversOfFailedProvisionalLoad(
-    const blink::WebURLError& error) {
+void RenderFrameImpl::NotifyObserversOfFailedProvisionalLoad() {
   for (auto& observer : observers_)
-    observer.DidFailProvisionalLoad(error);
-}
-
-void RenderFrameImpl::LoadNavigationErrorPage(
-    WebDocumentLoader* document_loader,
-    const WebURLError& error,
-    const base::Optional<std::string>& error_page_content,
-    bool replace_current_item) {
-  std::string error_html;
-  if (error_page_content) {
-    error_html = error_page_content.value();
-  } else {
-    GetContentClient()->renderer()->PrepareErrorPage(
-        this, error, document_loader->HttpMethod().Ascii(),
-        false /* ignoring_cache */, &error_html);
-  }
-
-  // Make sure we never show errors in view source mode.
-  frame_->EnableViewSourceMode(false);
-
-  auto navigation_params = WebNavigationParams::CreateForErrorPage(
-      document_loader, error_html, GURL(kUnreachableWebDataURL), error.url(),
-      error.reason());
-  if (replace_current_item)
-    navigation_params->frame_load_type = WebFrameLoadType::kReplaceCurrentItem;
-  navigation_params->service_worker_network_provider =
-      ServiceWorkerNetworkProviderForFrame::CreateInvalidInstance();
-
-  // The load of the error page can result in this frame being removed.
-  frame_->CommitNavigation(std::move(navigation_params), BuildDocumentState(),
-                           base::DoNothing::Once());
-  // Do not access |this| or |frame_| without checking weak self.
+    observer.DidFailProvisionalLoad();
 }
 
 void RenderFrameImpl::DidMeaningfulLayout(
@@ -3131,6 +3043,10 @@ void RenderFrameImpl::CancelContextMenu(int request_id) {
   pending_context_menus_.Remove(request_id);
 }
 
+void RenderFrameImpl::ShowVirtualKeyboard() {
+  GetLocalRootRenderWidget()->ShowVirtualKeyboard();
+}
+
 blink::WebPlugin* RenderFrameImpl::CreatePlugin(
     const WebPluginInfo& info,
     const blink::WebPluginParams& params,
@@ -3169,12 +3085,6 @@ blink::WebPlugin* RenderFrameImpl::CreatePlugin(
   return nullptr;
 }
 
-void RenderFrameImpl::LoadErrorPage(int reason) {
-  LoadNavigationErrorPage(frame_->GetDocumentLoader(),
-                          WebURLError(reason, frame_->GetDocument().Url()),
-                          base::nullopt, true /* replace_current_item */);
-}
-
 void RenderFrameImpl::ExecuteJavaScript(const base::string16& javascript) {
   JavaScriptExecuteRequest(javascript, false, base::DoNothing());
 }
@@ -3211,9 +3121,10 @@ RenderFrameImpl::GetRemoteAssociatedInterfaces() {
   if (!remote_associated_interfaces_) {
     ChildThreadImpl* thread = ChildThreadImpl::current();
     if (thread) {
-      blink::mojom::AssociatedInterfaceProviderAssociatedPtr remote_interfaces;
+      mojo::PendingAssociatedRemote<blink::mojom::AssociatedInterfaceProvider>
+          remote_interfaces;
       thread->GetRemoteRouteProvider()->GetRoute(
-          routing_id_, mojo::MakeRequest(&remote_interfaces));
+          routing_id_, remote_interfaces.InitWithNewEndpointAndPassReceiver());
       remote_associated_interfaces_ =
           std::make_unique<blink::AssociatedInterfaceProvider>(
               std::move(remote_interfaces),
@@ -3280,12 +3191,19 @@ void RenderFrameImpl::SetSelectedText(const base::string16& selection_text,
                                          static_cast<uint32_t>(offset), range));
 }
 
-void RenderFrameImpl::SetZoomLevel(double zoom_level) {
-  render_view_->UpdateZoomLevel(zoom_level);
+bool RenderFrameImpl::SetZoomLevelOnRenderView(double zoom_level) {
+  return render_view_->SetZoomLevel(zoom_level);
 }
 
-double RenderFrameImpl::GetZoomLevel() {
-  return render_view_->page_zoom_level();
+void RenderFrameImpl::SetPreferCompositingToLCDTextEnabledOnRenderView(
+    bool prefer) {
+  render_view_->SetPreferCompositingToLCDTextEnabled(prefer);
+}
+
+void RenderFrameImpl::SetDeviceScaleFactorOnRenderView(
+    bool use_zoom_for_dsf,
+    float device_scale_factor) {
+  render_view_->SetDeviceScaleFactor(use_zoom_for_dsf, device_scale_factor);
 }
 
 void RenderFrameImpl::AddMessageToConsole(
@@ -3294,12 +3212,10 @@ void RenderFrameImpl::AddMessageToConsole(
   AddMessageToConsoleImpl(level, message, false /* discard_duplicates */);
 }
 
-void RenderFrameImpl::SetPreviewsState(PreviewsState previews_state) {
-  previews_state_ = previews_state;
-}
-
 PreviewsState RenderFrameImpl::GetPreviewsState() {
-  return previews_state_;
+  WebDocumentLoader* document_loader = frame_->GetDocumentLoader();
+  return document_loader ? document_loader->GetPreviewsState()
+                         : PREVIEWS_UNSPECIFIED;
 }
 
 bool RenderFrameImpl::IsPasting() {
@@ -3339,13 +3255,9 @@ void RenderFrameImpl::AddAutoplayFlags(const url::Origin& origin,
 
 void RenderFrameImpl::GetInterfaceProvider(
     service_manager::mojom::InterfaceProviderRequest request) {
-  service_manager::Connector* connector = ChildThread::Get()->GetConnector();
-  service_manager::mojom::InterfaceProviderPtr provider;
-  interface_provider_bindings_.AddBinding(this, mojo::MakeRequest(&provider));
-  connector->FilterInterfaces(mojom::kNavigation_FrameSpec,
-                              browser_info_.identity, std::move(request),
-                              std::move(provider));
+  interface_provider_bindings_.AddBinding(this, std::move(request));
 }
+
 void RenderFrameImpl::GetCanonicalUrlForSharing(
     GetCanonicalUrlForSharingCallback callback) {
   WebURL canonical_url = GetWebFrame()->GetDocument().CanonicalUrlForSharing();
@@ -3380,6 +3292,10 @@ void RenderFrameImpl::AllowBindings(int32_t enabled_bindings_flags) {
   RenderProcess::current()->AddBindings(enabled_bindings_flags);
 }
 
+void RenderFrameImpl::EnableMojoJsBindings() {
+  enable_mojo_js_bindings_ = true;
+}
+
 // mojom::FrameNavigationControl implementation --------------------------------
 
 void RenderFrameImpl::CommitNavigation(
@@ -3403,8 +3319,9 @@ void RenderFrameImpl::CommitNavigation(
   // IsPerNavigationMojoInterfaceEnabled() == true, for non-committed
   // interstitials where no NavigationRequest was created. Therefore, no DCHECK.
   CommitNavigationInternal(
-      std::move(common_params), std::move(commit_params), response_head,
-      std::move(response_body), std::move(url_loader_client_endpoints),
+      std::move(common_params), std::move(commit_params),
+      std::move(response_head), std::move(response_body),
+      std::move(url_loader_client_endpoints),
       std::move(subresource_loader_factories), std::move(subresource_overrides),
       std::move(controller_service_worker_info), std::move(provider_info),
       std::move(prefetch_loader_factory), devtools_navigation_token,
@@ -3415,7 +3332,7 @@ void RenderFrameImpl::CommitNavigation(
 void RenderFrameImpl::CommitPerNavigationMojoInterfaceNavigation(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::CommitNavigationParamsPtr commit_params,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
     network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
     std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -3432,8 +3349,9 @@ void RenderFrameImpl::CommitPerNavigationMojoInterfaceNavigation(
   DCHECK(navigation_client_impl_);
   DCHECK(IsPerNavigationMojoInterfaceEnabled());
   CommitNavigationInternal(
-      std::move(common_params), std::move(commit_params), response_head,
-      std::move(response_body), std::move(url_loader_client_endpoints),
+      std::move(common_params), std::move(commit_params),
+      std::move(response_head), std::move(response_body),
+      std::move(url_loader_client_endpoints),
       std::move(subresource_loader_factories), std::move(subresource_overrides),
       std::move(controller_service_worker_info), std::move(provider_info),
       std::move(prefetch_loader_factory), devtools_navigation_token,
@@ -3444,7 +3362,7 @@ void RenderFrameImpl::CommitPerNavigationMojoInterfaceNavigation(
 void RenderFrameImpl::CommitNavigationInternal(
     mojom::CommonNavigationParamsPtr common_params,
     mojom::CommitNavigationParamsPtr commit_params,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     mojo::ScopedDataPipeConsumerHandle response_body,
     network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
     std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -3485,19 +3403,12 @@ void RenderFrameImpl::CommitNavigationInternal(
   DCHECK(common_params->url.SchemeIs(url::kJavaScriptScheme) ||
          common_params->url.IsAboutSrcdoc() || subresource_loader_factories);
 
-  // We only save metrics of the main frame's main resource to the
-  // document state. In view source mode, we effectively let the user
-  // see the source of the server's error page instead of using custom
-  // one derived from the metrics saved to document state.
-  const network::ResourceResponseHead* document_state_response_head =
-      (!frame_->Parent() && !frame_->IsViewSourceModeEnabled()) ? &response_head
-                                                                : nullptr;
   int request_id = ResourceDispatcher::MakeRequestID();
   std::unique_ptr<DocumentState> document_state = BuildDocumentStateFromParams(
       *common_params, *commit_params, base::TimeTicks::Now(),
       std::move(callback), std::move(per_navigation_mojo_interface_callback),
-      document_state_response_head, std::move(navigation_client_impl_),
-      request_id, was_initiated_in_this_frame);
+      std::move(navigation_client_impl_), request_id,
+      was_initiated_in_this_frame);
 
   // Check if the navigation being committed originated as a client redirect.
   bool is_client_redirect =
@@ -3555,20 +3466,21 @@ void RenderFrameImpl::CommitNavigationInternal(
                                             WebString::FromUTF8(charset), data);
   } else {
     NavigationBodyLoader::FillNavigationParamsResponseAndBodyLoader(
-        *common_params, *commit_params, request_id, response_head,
-        std::move(response_body), std::move(url_loader_client_endpoints),
+        std::move(common_params), std::move(commit_params), request_id,
+        response_head.Clone(), std::move(response_body),
+        std::move(url_loader_client_endpoints),
         GetTaskRunner(blink::TaskType::kInternalLoading), GetRoutingID(),
         !frame_->Parent(), navigation_params.get());
   }
 
-  FillNavigationParamsOriginPolicy(response_head, navigation_params.get());
+  FillNavigationParamsOriginPolicy(*response_head, navigation_params.get());
 
   // The MHTML mime type should be same as the one we check in the browser
   // process's download_utils::MustDownload.
   bool is_mhtml_archive =
-      base::LowerCaseEqualsASCII(response_head.mime_type,
+      base::LowerCaseEqualsASCII(response_head->mime_type,
                                  "multipart/related") ||
-      base::LowerCaseEqualsASCII(response_head.mime_type, "message/rfc822");
+      base::LowerCaseEqualsASCII(response_head->mime_type, "message/rfc822");
   if (is_mhtml_archive && navigation_params->body_loader) {
     // Load full mhtml archive before committing navigation.
     // We need this to retrieve the document mime type prior to committing.
@@ -3830,7 +3742,7 @@ void RenderFrameImpl::CommitFailedNavigationInternal(
   if (commit_params->nav_entry_id == 0) {
     // For renderer initiated navigations, we send out a
     // DidFailProvisionalLoad() notification.
-    NotifyObserversOfFailedProvisionalLoad(error);
+    NotifyObserversOfFailedProvisionalLoad();
 
     // |browser_side_navigation_pending_| can be false if we are committing
     // failed navigation in a different process than it was started, e.g.
@@ -3879,18 +3791,13 @@ void RenderFrameImpl::CommitFailedNavigationInternal(
     history_entry = PageStateToHistoryEntry(commit_params->page_state);
 
   std::string error_html;
-  if (error_page_content.has_value()) {
+  std::string* error_html_ptr = &error_html;
+  if (error_page_content) {
     error_html = error_page_content.value();
-    // We don't need the actual error page content, but still call this
-    // for any possible side effects.
-    GetContentClient()->renderer()->PrepareErrorPage(
-        this, error, navigation_params->http_method.Ascii(),
-        false /* ignoring_cache */, nullptr);
-  } else {
-    GetContentClient()->renderer()->PrepareErrorPage(
-        this, error, navigation_params->http_method.Ascii(),
-        false /* ignoring_cache */, &error_html);
+    error_html_ptr = nullptr;
   }
+  GetContentClient()->renderer()->PrepareErrorPage(
+      this, error, navigation_params->http_method.Ascii(), error_html_ptr);
 
   // Make sure we never show errors in view source mode.
   frame_->EnableViewSourceMode(false);
@@ -3914,7 +3821,7 @@ void RenderFrameImpl::CommitFailedNavigationInternal(
   // |was_initiated_in_this_frame| is false.
   std::unique_ptr<DocumentState> document_state = BuildDocumentStateFromParams(
       *common_params, *commit_params, base::TimeTicks(), std::move(callback),
-      std::move(per_navigation_mojo_interface_callback), nullptr,
+      std::move(per_navigation_mojo_interface_callback),
       std::move(navigation_client_impl_), ResourceDispatcher::MakeRequestID(),
       false /* was_initiated_in_this_frame */);
 
@@ -4052,40 +3959,12 @@ void RenderFrameImpl::UpdateSubresourceLoaderFactories(
   }
 }
 
-void RenderFrameImpl::MarkInitiatorAsRequiringSeparateURLLoaderFactory(
-    const url::Origin& initiator_origin,
-    network::mojom::URLLoaderFactoryPtr url_loader_factory) {
-  // Set up |loader_factories_| to be updated by the
-  // UpdateSubresourceLoaderFactories() below.
-  GetLoaderFactoryBundle();
-  auto factory_bundle = std::make_unique<blink::URLLoaderFactoryBundleInfo>();
-  factory_bundle->pending_initiator_specific_factories()[initiator_origin] =
-      url_loader_factory.PassInterface();
-  UpdateSubresourceLoaderFactories(std::move(factory_bundle));
-}
-
 void RenderFrameImpl::BindDevToolsAgent(
     mojo::PendingAssociatedRemote<blink::mojom::DevToolsAgentHost> host,
     mojo::PendingAssociatedReceiver<blink::mojom::DevToolsAgent> receiver) {
   frame_->BindDevToolsAgent(host.PassHandle(), receiver.PassHandle());
 }
 
-// mojom::HostZoom implementation ----------------------------------------------
-
-void RenderFrameImpl::SetHostZoomLevel(const GURL& url, double zoom_level) {
-  // TODO(wjmaclean): We should see if this restriction is really necessary,
-  // since it isn't enforced in other parts of the page zoom system (e.g.
-  // when a users changes the zoom of a currently displayed page). Android
-  // has no UI for this, so in theory the following code would normally just use
-  // the default zoom anyways.
-#if !defined(OS_ANDROID)
-  // On Android, page zoom isn't used, and in case of WebView, text zoom is used
-  // for legacy WebView text scaling emulation. Thus, the code that resets
-  // the zoom level from this map will be effectively resetting text zoom level.
-  host_zoom_levels_[url] = zoom_level;
-#endif
-}
-
 // blink::WebLocalFrameClient implementation
 // ----------------------------------------
 blink::BrowserInterfaceBrokerProxy*
@@ -4186,11 +4065,10 @@ blink::WebMediaPlayer* RenderFrameImpl::CreateMediaPlayer(
     WebMediaPlayerEncryptedMediaClient* encrypted_client,
     WebContentDecryptionModule* initial_cdm,
     const blink::WebString& sink_id) {
-  const cc::LayerTreeSettings& settings =
-      GetLocalRootRenderWidget()->layer_tree_view()->GetLayerTreeSettings();
   return media_factory_.CreateMediaPlayer(
       source, client, inspector_context, encrypted_client, initial_cdm, sink_id,
-      GetLocalRootRenderWidget()->GetFrameSinkId(), settings);
+      GetLocalRootRenderWidget()->GetFrameSinkId(),
+      GetLocalRootRenderWidget()->layer_tree_host()->GetSettings());
 }
 
 std::unique_ptr<blink::WebContentSettingsClient>
@@ -4213,11 +4091,14 @@ RenderFrameImpl::CreateWorkerFetchContext() {
       watcher_receiver = watcher.InitWithNewPipeAndPassReceiver();
   render_view()->RegisterRendererPreferenceWatcher(std::move(watcher));
 
+  // |pending_subresource_loader_updater| is not used for non-PlzDedicatedWorker
+  // and worklets.
   scoped_refptr<WebWorkerFetchContextImpl> worker_fetch_context =
       WebWorkerFetchContextImpl::Create(
           provider->context(), render_view_->renderer_preferences(),
           std::move(watcher_receiver), GetLoaderFactoryBundle()->Clone(),
-          GetLoaderFactoryBundle()->CloneWithoutAppCacheFactory());
+          GetLoaderFactoryBundle()->CloneWithoutAppCacheFactory(),
+          /*pending_subresource_loader_updater=*/mojo::NullReceiver());
 
   worker_fetch_context->set_ancestor_frame_id(routing_id_);
   worker_fetch_context->set_frame_request_blocker(frame_request_blocker_);
@@ -4274,11 +4155,11 @@ WebExternalPopupMenu* RenderFrameImpl::CreateExternalPopupMenu(
   // popup. So from the user perspective, only the first one will show, and
   // will have to close the first one before another one can be shown.
   if (external_popup_menu_)
-    return NULL;
-  external_popup_menu_.reset(
-      new ExternalPopupMenu(this, popup_menu_info, popup_menu_client));
-  render_view_->GetWidget()->SetExternalPopupOriginAdjustmentsForEmulation(
-      external_popup_menu_.get());
+    return nullptr;
+  external_popup_menu_ = std::make_unique<ExternalPopupMenu>(
+      this, popup_menu_info, popup_menu_client);
+  external_popup_menu_->SetOriginScaleForEmulation(
+      GetLocalRootRenderWidget()->GetEmulatorScale());
   return external_popup_menu_.get();
 #else
   return nullptr;
@@ -4329,16 +4210,10 @@ void RenderFrameImpl::DidAccessInitialDocument() {
   // NOTE: Do not call back into JavaScript here, since this call is made from a
   // V8 security check.
 
-  // If the request hasn't yet committed, notify the browser process that it is
-  // no longer safe to show the pending URL of the main frame, since a URL spoof
-  // is now possible. (If the request has committed, the browser already knows.)
-  if (!has_accessed_initial_document_) {
-    NavigationState* navigation_state =
-        NavigationState::FromDocumentLoader(frame_->GetDocumentLoader());
-    if (!navigation_state->request_committed()) {
-      Send(new FrameHostMsg_DidAccessInitialDocument(routing_id_));
-    }
-  }
+  // Notify the browser process that it is no longer safe to show the pending
+  // URL of the main frame, since a URL spoof is now possible.
+  if (!has_accessed_initial_document_)
+    Send(new FrameHostMsg_DidAccessInitialDocument(routing_id_));
 
   has_accessed_initial_document_ = true;
 }
@@ -4529,24 +4404,16 @@ void RenderFrameImpl::FrameDetached(DetachType type) {
   // Clean up the associated RenderWidget for the frame, if there is one.
   GetLocalRootRenderWidget()->UnregisterRenderFrame(this);
   if (is_main_frame_) {
-    // TODO(crbug.com/419087): The RenderWidget for the main frame can't be
-    // closed/destroyed since it is part of the RenderView. So instead it is
-    // swapped out, which we would be in the middle of here. So instead of
-    // closing the RenderWidget we only drop the WebFrameWidget in order to also
-    // drop its reference on the WebLocalFrameImpl for this detaching frame.
-    render_view_->DetachWebFrameWidget();
-    // In the main frame case, we WarmupCompositor() when setting up the
-    // WebFrameWidget, because we can't unfreeze the RenderWidget until
-    // navigation completes. If that navigation aborts then we detach the
-    // provisional main frame, and drop the WebFrameWidget. Since we then no
-    // longer expect to use this RenderWidget immediately, we drop any resources
-    // that were being prepared. This is a no-op if the RenderWidget was already
-    // unfrozen and not in a warming up state.
-    render_widget_->AbortWarmupCompositor();
     DCHECK(!owned_render_widget_);
+    // TODO(crbug.com/419087): The RenderWidget for the main frame can't be
+    // closed/destroyed here, since there is no way to recreate it without also
+    // fixing the lifetimes of the related browser side objects. Closing is
+    // delegated to the RenderViewImpl which will stash the RenderWidget away
+    // as undead if needed.
+    render_view_->CloseMainFrameRenderWidget();
   } else if (render_widget_) {
-    // This closes/deletes the RenderWidget if this frame was a local root.
     DCHECK(owned_render_widget_);
+    // This closes/deletes the RenderWidget if this frame was a local root.
     render_widget_->CloseForFrame(std::move(owned_render_widget_));
   }
 
@@ -4701,24 +4568,21 @@ void RenderFrameImpl::DidAddMessageToConsole(
 
 void RenderFrameImpl::DownloadURL(
     const blink::WebURLRequest& request,
-    CrossOriginRedirects cross_origin_redirect_behavior,
+    network::mojom::RedirectMode cross_origin_redirect_behavior,
     mojo::ScopedMessagePipeHandle blob_url_token) {
   if (ShouldThrottleDownload())
     return;
 
   FrameHostMsg_DownloadUrl_Params params;
-  params.render_view_id = render_view_->GetRoutingID();
-  params.render_frame_id = GetRoutingID();
   params.url = request.Url();
   params.referrer = RenderViewImpl::GetReferrerFromRequest(frame_, request);
   params.initiator_origin = request.RequestorOrigin();
   if (request.GetSuggestedFilename().has_value())
     params.suggested_name = request.GetSuggestedFilename()->Utf16();
-  params.follow_cross_origin_redirects =
-      (cross_origin_redirect_behavior == CrossOriginRedirects::kFollow);
+  params.cross_origin_redirects = cross_origin_redirect_behavior;
   params.blob_url_token = blob_url_token.release();
 
-  Send(new FrameHostMsg_DownloadUrl(params));
+  Send(new FrameHostMsg_DownloadUrl(routing_id_, params));
 }
 
 void RenderFrameImpl::WillSendSubmitEvent(const blink::WebFormElement& form) {
@@ -4779,16 +4643,6 @@ void RenderFrameImpl::DidCommitProvisionalLoad(
   NavigationState* navigation_state = internal_data->navigation_state();
   DCHECK(!navigation_state->WasWithinSameDocument());
 
-  // Only update the PreviewsState and effective connection type states for new
-  // main frame documents. Subframes inherit from the main frame and should not
-  // change at commit time.
-  if (is_main_frame_) {
-    previews_state_ = internal_data->previews_state();
-    effective_connection_type_ =
-        EffectiveConnectionTypeToWebEffectiveConnectionType(
-            internal_data->effective_connection_type());
-  }
-
   if (previous_routing_id_ != MSG_ROUTING_NONE) {
     // If this is a provisional frame associated with a proxy (i.e., a frame
     // created for a remote-to-local navigation), swap it into the frame tree
@@ -4808,7 +4662,7 @@ void RenderFrameImpl::DidCommitProvisionalLoad(
     // represents a new UKM source.
     // Note that this is only done for the main frame since the metrics for all
     // frames are keyed to the main frame's URL.
-    GetLocalRootRenderWidget()->layer_tree_view()->SetSourceURL(
+    GetLocalRootRenderWidget()->layer_tree_host()->SetSourceURL(
         frame_->GetDocument().GetUkmSourceId(), GetLoadingUrl());
   }
 
@@ -4929,9 +4783,6 @@ void RenderFrameImpl::DidCommitProvisionalLoad(
 
   // Check whether we have new encoding name.
   UpdateEncoding(frame_, frame_->View()->PageEncoding().Utf8());
-
-  // Reset warning state that prevents log spam.
-  tls_version_warning_origins_.clear();
 }
 
 void RenderFrameImpl::DidCreateNewDocument() {
@@ -5072,30 +4923,34 @@ void RenderFrameImpl::RunScriptsAtDocumentReady(bool document_is_empty) {
   // If this is an empty document with an http status code indicating an error,
   // we may want to display our own error page, so the user doesn't end up
   // with an unexplained blank page.
-  if (!document_is_empty)
+  if (!document_is_empty || !IsMainFrame())
     return;
 
   // Display error page instead of a blank page, if appropriate.
-  InternalDocumentStateData* internal_data =
-      InternalDocumentStateData::FromDocumentLoader(
-          frame_->GetDocumentLoader());
-  int http_status_code = internal_data->http_status_code();
-  if (GetContentClient()->renderer()->HasErrorPage(http_status_code)) {
-    WebDocumentLoader* document_loader = frame_->GetDocumentLoader();
-    WebURL unreachable_url = frame_->GetDocument().Url();
-    std::string error_html;
-    GetContentClient()->renderer()->PrepareErrorPageForHttpStatusError(
-        this, unreachable_url, document_loader->HttpMethod().Ascii(),
-        false /* ignoring_cache */, http_status_code, &error_html);
-    // This call may run scripts, e.g. via the beforeunload event, and possibly
-    // delete |this|.
-    LoadNavigationErrorPage(document_loader,
-                            WebURLError(net::ERR_FAILED, unreachable_url),
-                            error_html, true /* replace_current_item */);
-    if (!weak_self)
-      return;
-    // Do not use |this| or |frame_| here without checking |weak_self|.
-  }
+  WebDocumentLoader* document_loader = frame_->GetDocumentLoader();
+  int http_status_code = document_loader->GetResponse().HttpStatusCode();
+  if (!GetContentClient()->renderer()->HasErrorPage(http_status_code))
+    return;
+
+  WebURL unreachable_url = frame_->GetDocument().Url();
+  std::string error_html;
+  GetContentClient()->renderer()->PrepareErrorPageForHttpStatusError(
+      this, unreachable_url, document_loader->HttpMethod().Ascii(),
+      http_status_code, &error_html);
+  // Make sure we never show errors in view source mode.
+  frame_->EnableViewSourceMode(false);
+
+  auto navigation_params = WebNavigationParams::CreateForErrorPage(
+      document_loader, error_html, GURL(kUnreachableWebDataURL),
+      unreachable_url, net::ERR_FAILED);
+  navigation_params->frame_load_type = WebFrameLoadType::kReplaceCurrentItem;
+  navigation_params->service_worker_network_provider =
+      ServiceWorkerNetworkProviderForFrame::CreateInvalidInstance();
+
+  frame_->CommitNavigation(std::move(navigation_params), BuildDocumentState(),
+                           base::DoNothing::Once());
+  // WARNING: The previous call may have have deleted |this|.
+  // Do not use |this| or |frame_| here without checking |weak_self|.
 }
 
 void RenderFrameImpl::RunScriptsAtDocumentIdle() {
@@ -5183,8 +5038,7 @@ void RenderFrameImpl::DidChangeThemeColor() {
   if (frame_->Parent())
     return;
 
-  Send(new FrameHostMsg_DidChangeThemeColor(
-      routing_id_, frame_->GetDocument().ThemeColor()));
+  GetFrameHost()->DidChangeThemeColor(frame_->GetDocument().ThemeColor());
 }
 
 void RenderFrameImpl::ForwardResourceTimingToParent(
@@ -5197,27 +5051,6 @@ void RenderFrameImpl::DispatchLoad() {
   Send(new FrameHostMsg_DispatchLoad(routing_id_));
 }
 
-blink::WebEffectiveConnectionType
-RenderFrameImpl::GetEffectiveConnectionType() {
-  return effective_connection_type_;
-}
-
-void RenderFrameImpl::SetEffectiveConnectionTypeForTesting(
-    blink::WebEffectiveConnectionType type) {
-  effective_connection_type_ = type;
-}
-
-blink::WebURLRequest::PreviewsState RenderFrameImpl::GetPreviewsStateForFrame()
-    const {
-  PreviewsState disabled_state = previews_state_ & kDisabledPreviewsBits;
-  if (disabled_state) {
-    // Sanity check disabled vs. enabled bits here before passing on.
-    DCHECK(!(previews_state_ & ~kDisabledPreviewsBits)) << previews_state_;
-    return disabled_state;
-  }
-  return static_cast<WebURLRequest::PreviewsState>(previews_state_);
-}
-
 void RenderFrameImpl::DidBlockNavigation(
     const WebURL& blocked_url,
     const WebURL& initiator_url,
@@ -5227,11 +5060,10 @@ void RenderFrameImpl::DidBlockNavigation(
 }
 
 void RenderFrameImpl::NavigateBackForwardSoon(int offset,
-                                              bool has_user_gesture,
-                                              bool from_script) {
+                                              bool has_user_gesture) {
   render_view()->NavigateBackForwardSoon(offset, has_user_gesture);
   Send(new FrameHostMsg_GoToEntryAtOffset(GetRoutingID(), offset,
-                                          has_user_gesture, from_script));
+                                          has_user_gesture));
 }
 
 base::UnguessableToken RenderFrameImpl::GetDevToolsFrameToken() {
@@ -5246,6 +5078,7 @@ void RenderFrameImpl::AbortClientNavigation() {
   browser_side_navigation_pending_ = false;
   sync_navigation_callback_.Cancel();
   mhtml_body_loader_client_.reset();
+  NotifyObserversOfFailedProvisionalLoad();
   if (!IsPerNavigationMojoInterfaceEnabled()) {
     Send(new FrameHostMsg_AbortNavigation(routing_id_));
   } else {
@@ -5324,14 +5157,22 @@ bool RenderFrameImpl::RunModalBeforeUnloadDialog(bool is_reload) {
 
 void RenderFrameImpl::ShowContextMenu(const blink::WebContextMenuData& data) {
   ContextMenuParams params = ContextMenuParamsBuilder::Build(data);
-  blink::WebRect position_in_window(params.x, params.y, 0, 0);
-  GetLocalRootRenderWidget()->ConvertViewportToWindow(&position_in_window);
-  params.x = position_in_window.x;
-  params.y = position_in_window.y;
-  GetLocalRootRenderWidget()->OnShowHostContextMenu(&params);
   if (GetLocalRootRenderWidget()->has_host_context_menu_location()) {
+    // If the context menu request came from the browser, it came with a
+    // position that was stored on RenderWidget and is relative to the
+    // WindowScreenRect.
     params.x = GetLocalRootRenderWidget()->host_context_menu_location().x();
     params.y = GetLocalRootRenderWidget()->host_context_menu_location().y();
+  } else {
+    // If the context menu request came from the renderer, the position in
+    // |params| is real, but they come in blink viewport coordiates, which
+    // include the device scale factor, but not emulation scale. Here we convert
+    // them to DIP coordiates relative to the WindowScreenRect.
+    blink::WebRect position_in_window(params.x, params.y, 0, 0);
+    GetLocalRootRenderWidget()->ConvertViewportToWindow(&position_in_window);
+    const float scale = GetLocalRootRenderWidget()->GetEmulatorScale();
+    params.x = position_in_window.x * scale;
+    params.y = position_in_window.y * scale;
   }
 
   // Serializing a GURL longer than kMaxURLChars will fail, so don't do
@@ -5366,8 +5207,7 @@ void RenderFrameImpl::SaveImageFromDataURL(const blink::WebString& data_url) {
   // Note: We should basically send GURL but we use size-limited string instead
   // in order to send a larger data url to save a image for <canvas> or <img>.
   if (data_url.length() < kMaxLengthOfDataURLString) {
-    Send(new FrameHostMsg_SaveImageFromDataURL(render_view_->GetRoutingID(),
-                                               routing_id_, data_url.Utf8()));
+    Send(new FrameHostMsg_SaveImageFromDataURL(routing_id_, data_url.Utf8()));
   }
 }
 
@@ -5386,23 +5226,17 @@ void RenderFrameImpl::WillSendRequest(blink::WebURLRequest& request) {
   WebDocumentLoader* document_loader = frame_->GetDocumentLoader();
   WillSendRequestInternal(
       request, WebURLRequestToResourceType(request),
-      DocumentState::FromDocumentLoader(document_loader),
       GetTransitionType(document_loader, IsMainFrame(), false /* loading */));
 }
 
 void RenderFrameImpl::WillSendRequestInternal(
     blink::WebURLRequest& request,
     ResourceType resource_type,
-    DocumentState* document_state,
     ui::PageTransition transition_type) {
   if (render_view_->renderer_preferences_.enable_do_not_track)
     request.SetHttpHeaderField(blink::WebString::FromUTF8(kDoNotTrackHeader),
                                "1");
 
-  InternalDocumentStateData* internal_data =
-      InternalDocumentStateData::FromDocumentState(document_state);
-  NavigationState* navigation_state = internal_data->navigation_state();
-
   ApplyFilePathAlias(&request);
   GURL new_url;
   bool attach_same_site_cookies = false;
@@ -5417,9 +5251,6 @@ void RenderFrameImpl::WillSendRequestInternal(
   if (!new_url.is_empty())
     request.SetUrl(WebURL(new_url));
 
-  if (internal_data->is_cache_policy_override_set())
-    request.SetCacheMode(internal_data->cache_policy_override());
-
   // The request's extra data may indicate that we should set a custom user
   // agent. This needs to be done here, after WebKit is through with setting the
   // user agent on its own.
@@ -5469,25 +5300,6 @@ void RenderFrameImpl::WillSendRequestInternal(
             routing_id_, request, resource_type));
   }
 
-  if (request.GetPreviewsState() == WebURLRequest::kPreviewsUnspecified) {
-    if (is_main_frame_ && !navigation_state->request_committed()) {
-      request.SetPreviewsState(static_cast<WebURLRequest::PreviewsState>(
-          navigation_state->common_params().previews_state));
-    } else {
-      WebURLRequest::PreviewsState request_previews_state =
-          static_cast<WebURLRequest::PreviewsState>(previews_state_);
-
-      // The decision of whether or not to enable Client Lo-Fi is made earlier
-      // in the request lifetime, in LocalFrame::MaybeAllowImagePlaceholder(),
-      // so don't add the Client Lo-Fi bit to the request here.
-      request_previews_state &= ~(WebURLRequest::kLazyImageLoadDeferred);
-      if (request_previews_state == WebURLRequest::kPreviewsUnspecified)
-        request_previews_state = WebURLRequest::kPreviewsOff;
-
-      request.SetPreviewsState(request_previews_state);
-    }
-  }
-
   // This is an instance where we embed a copy of the routing id
   // into the data portion of the message. This can cause problems if we
   // don't register this id on the browser side, since the download manager
@@ -5527,11 +5339,12 @@ void RenderFrameImpl::DidLoadResourceFromMemoryCache(
 void RenderFrameImpl::DidStartResponse(
     const GURL& response_url,
     int request_id,
-    const network::ResourceResponseHead& response_head,
+    network::mojom::URLResponseHeadPtr response_head,
     content::ResourceType resource_type,
     PreviewsState previews_state) {
   for (auto& observer : observers_)
-    observer.DidStartResponse(response_url, request_id, response_head,
+    observer.DidStartResponse(response_url, request_id,
+                              network::ResourceResponseHead(response_head),
                               resource_type, previews_state);
 }
 
@@ -5580,60 +5393,6 @@ void RenderFrameImpl::DidRunContentWithCertificateErrors() {
   Send(new FrameHostMsg_DidRunContentWithCertificateErrors(routing_id_));
 }
 
-void RenderFrameImpl::ReportLegacyTLSVersion(const blink::WebURL& url) {
-  url::Origin origin = url::Origin::Create(GURL(url));
-  // To prevent log spam, only log the message once per origin.
-  if (base::Contains(tls_version_warning_origins_, origin))
-    return;
-
-  size_t num_warnings = tls_version_warning_origins_.size();
-  // After |kMaxSecurityWarningMessages| warnings, stop printing messages to the
-  // console. At exactly |kMaxSecurityWarningMessages| warnings, print a message
-  // that additional resources on the page use legacy certificates without
-  // specifying which exact resources. Before |kMaxSecurityWarningMessages|
-  // messages, print the exact resource URL in the message to help the developer
-  // pinpoint the problematic resources.
-  if (num_warnings > kMaxSecurityWarningMessages)
-    return;
-
-  // Allow the embedded to suppress these warnings. This is a workaround for an
-  // outdated test server used by Blink tests on macOS. See
-  // https://crbug.com/936515.
-  if (GetContentClient()
-          ->renderer()
-          ->SuppressLegacyTLSVersionConsoleMessage()) {
-    return;
-  }
-
-  std::string console_message;
-  if (num_warnings == kMaxSecurityWarningMessages) {
-    console_message =
-        "Additional resources on this page were loaded with TLS 1.0 or TLS "
-        "1.1, which are deprecated and will be disabled in the future. Once "
-        "disabled, users will be prevented from loading these resources. "
-        "Servers should enable TLS 1.2 or later. See "
-        "https://www.chromestatus.com/feature/5654791610957824 for more "
-        "information.";
-  } else {
-    console_message = base::StringPrintf(
-        "The connection used to load resources from %s used TLS 1.0 or TLS "
-        "1.1, which are deprecated and will be disabled in the future. Once "
-        "disabled, users will be prevented from loading these resources. The "
-        "server should enable TLS 1.2 or later. See "
-        "https://www.chromestatus.com/feature/5654791610957824 for more "
-        "information.",
-        origin.Serialize().c_str());
-  }
-
-  tls_version_warning_origins_.insert(origin);
-  // To avoid spamming the console, use verbose message level for subframe
-  // resources, and only use the warning level for main-frame resources.
-  AddMessageToConsole(frame_->Parent()
-                          ? blink::mojom::ConsoleMessageLevel::kVerbose
-                          : blink::mojom::ConsoleMessageLevel::kWarning,
-                      console_message);
-}
-
 void RenderFrameImpl::DidChangePerformanceTiming() {
   for (auto& observer : observers_)
     observer.DidChangePerformanceTiming();
@@ -5650,7 +5409,7 @@ void RenderFrameImpl::DidChangeActiveSchedulerTrackedFeatures(
 }
 
 void RenderFrameImpl::DidObserveLoadingBehavior(
-    blink::WebLoadingBehaviorFlag behavior) {
+    blink::LoadingBehaviorFlag behavior) {
   for (auto& observer : observers_)
     observer.DidObserveLoadingBehavior(behavior);
 }
@@ -5686,8 +5445,9 @@ bool RenderFrameImpl::ShouldTrackUseCounter(const blink::WebURL& url) {
 
 void RenderFrameImpl::DidCreateScriptContext(v8::Local<v8::Context> context,
                                              int world_id) {
-  if ((enabled_bindings_ & BINDINGS_POLICY_MOJO_WEB_UI) && IsMainFrame() &&
-      world_id == ISOLATED_WORLD_ID_GLOBAL) {
+  if (((enabled_bindings_ & BINDINGS_POLICY_MOJO_WEB_UI) ||
+       enable_mojo_js_bindings_) &&
+      IsMainFrame() && world_id == ISOLATED_WORLD_ID_GLOBAL) {
     // We only allow these bindings to be installed when creating the main
     // world context of the main frame.
     blink::WebContextFeatures::EnableMojoJS(context, true);
@@ -5761,7 +5521,8 @@ blink::WebString RenderFrameImpl::DoNotTrackValue() {
 mojom::RendererAudioInputStreamFactory*
 RenderFrameImpl::GetAudioInputStreamFactory() {
   if (!audio_input_stream_factory_)
-    GetRemoteInterfaces()->GetInterface(&audio_input_stream_factory_);
+    GetRemoteInterfaces()->GetInterface(
+        audio_input_stream_factory_.BindNewPipeAndPassReceiver());
   return audio_input_stream_factory_.get();
 }
 
@@ -5811,22 +5572,9 @@ void RenderFrameImpl::HandleAccessibilityFindInPageTermination() {
     render_accessibility_->HandleAccessibilityFindInPageTermination();
 }
 
-void RenderFrameImpl::EnterFullscreen(
-    const blink::WebFullscreenOptions& options) {
-  Send(new FrameHostMsg_EnterFullscreen(routing_id_, options));
-}
-
-void RenderFrameImpl::ExitFullscreen() {
-  Send(new FrameHostMsg_ExitFullscreen(routing_id_));
-}
-
-void RenderFrameImpl::FullscreenStateChanged(bool is_fullscreen) {
-  GetFrameHost()->FullscreenStateChanged(is_fullscreen);
-}
-
 void RenderFrameImpl::SuddenTerminationDisablerChanged(
     bool present,
-    blink::WebSuddenTerminationDisablerType disabler_type) {
+    blink::SuddenTerminationDisablerType disabler_type) {
   Send(new FrameHostMsg_SuddenTerminationDisablerChanged(routing_id_, present,
                                                          disabler_type));
 }
@@ -5910,11 +5658,6 @@ void RenderFrameImpl::WasShown() {
 #endif  // ENABLE_PLUGINS
 }
 
-void RenderFrameImpl::WidgetWillClose() {
-  for (auto& observer : observers_)
-    observer.WidgetWillClose();
-}
-
 bool RenderFrameImpl::IsMainFrame() {
   return is_main_frame_;
 }
@@ -6101,45 +5844,6 @@ RenderFrameImpl::MakeDidCommitProvisionalLoadParams(
   return params;
 }
 
-void RenderFrameImpl::UpdateZoomLevel() {
-  if (!frame_->Parent()) {
-    // Reset the zoom limits in case a plugin had changed them previously. This
-    // will also call us back which will cause us to send a message to
-    // update WebContentsImpl.
-    render_view_->webview()->ZoomLimitsChanged(
-        ZoomFactorToZoomLevel(kMinimumZoomFactor),
-        ZoomFactorToZoomLevel(kMaximumZoomFactor));
-
-    // Set zoom level, but don't do it for full-page plugin since they don't use
-    // the same zoom settings.
-    auto host_zoom = host_zoom_levels_.find(GetLoadingUrl());
-    if (render_view_->webview()->MainFrame()->IsWebLocalFrame() &&
-        render_view_->webview()
-            ->MainFrame()
-            ->ToWebLocalFrame()
-            ->GetDocument()
-            .IsPluginDocument()) {
-      // Reset the zoom levels for plugins.
-      render_view_->SetZoomLevel(0);
-    } else {
-      // If the zoom level is not found, then do nothing. In-page navigation
-      // relies on not changing the zoom level in this case.
-      if (host_zoom != host_zoom_levels_.end())
-        render_view_->SetZoomLevel(host_zoom->second);
-    }
-
-    if (host_zoom != host_zoom_levels_.end()) {
-      // This zoom level was merely recorded transiently for this load.  We can
-      // erase it now.  If at some point we reload this page, the browser will
-      // send us a new, up-to-date zoom level.
-      host_zoom_levels_.erase(host_zoom);
-    }
-  } else {
-    // Subframes should match the zoom level of the main frame.
-    render_view_->SetZoomLevel(render_view_->page_zoom_level());
-  }
-}
-
 bool RenderFrameImpl::UpdateNavigationHistory(
     const blink::WebHistoryItem& item,
     blink::WebHistoryCommitType commit_type) {
@@ -6211,8 +5915,6 @@ void RenderFrameImpl::UpdateStateForCommit(
     render_view_->webview()->ResetScrollAndScaleState();
     internal_data->set_must_reset_scroll_and_scale_state(false);
   }
-  UpdateZoomLevel();
-
   if (!frame_->Parent()) {  // Only for top frames.
     RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
     if (render_thread_impl) {  // Can be NULL in tests.
@@ -6221,12 +5923,25 @@ void RenderFrameImpl::UpdateStateForCommit(
     }
   }
 
-  // Remember that we've already processed this request, so we don't update
-  // the session history again.  We do this regardless of whether this is
-  // a session history navigation, because if we attempted a session history
-  // navigation without valid HistoryItem state, WebCore will think it is a
-  // new navigation.
-  navigation_state->set_request_committed(true);
+  if (render_widget_) {
+    // This goes to WebViewImpl and sets the zoom factor which will be
+    // propagated down to this RenderFrameImpl's LocalFrame in blink.
+    // Non-local-roots are able to grab the value off their parents but local
+    // roots can not and this is a huge action-at-a-distance to make up for that
+    // flaw in how LocalFrame determines the zoom factor.
+    // TODO(danakj): This should not be needed if the zoom factor/device scale
+    // factor did not need to be propagated to each frame. Since they are a
+    // global that should be okay?? The test that fails without this, for
+    // child frames, is in content_browsertests:
+    //     SitePerProcessHighDPIBrowserTest.
+    //         SubframeLoadsWithCorrectDeviceScaleFactor
+    // And when UseZoomForDSF is disabled, in content_browsertests:
+    //     IFrameZoomBrowserTest.SubframesDontZoomIndependently (and the whole
+    //     suite).
+    render_view_->PropagatePageZoomToNewlyAttachedFrame(
+        render_widget_->compositor_deps()->IsUseZoomForDSFEnabled(),
+        render_widget_->GetScreenInfo().device_scale_factor);
+  }
 
   // If we are a top frame navigation to another document we should clear any
   // existing autoplay flags on the Page. This is because flags are stored at
@@ -6386,16 +6101,10 @@ bool RenderFrameImpl::SwapIn() {
 
   // If this is the main frame going from a remote frame to a local frame,
   // it needs to set RenderViewImpl's pointer for the main frame to itself,
-  // ensure RenderWidget is no longer frozen.
+  // ensure RenderWidget is no longer undead.
   if (is_main_frame_) {
     CHECK(!render_view_->main_render_frame_);
     render_view_->main_render_frame_ = this;
-    if (render_view_->GetWidget()->is_frozen()) {
-      // TODO(crbug.com/419087): The RenderWidget should be newly created here,
-      // then we won't have to do this.
-      render_view_->GetWidget()->SetIsFrozen(false);
-    }
-    render_view_->GetWidget()->UpdateWebViewWithDeviceScaleFactor();
 
     // The WebFrame being swapped in here has now been attached to the Page as
     // its main frame, and the WebFrameWidget was previously initialized when
@@ -6572,29 +6281,13 @@ void RenderFrameImpl::BeginNavigation(
     // All navigations to or from WebUI URLs or within WebUI-enabled
     // RenderProcesses must be handled by the browser process so that the
     // correct bindings and data sources can be registered.
-    // Similarly, navigations to view-source URLs or within ViewSource mode
-    // must be handled by the browser process (except for reloads - those are
-    // safe to leave within the renderer).
-    // Lastly, access to file:// URLs from non-file:// URL pages must be
-    // handled by the browser so that ordinary renderer processes don't get
-    // blessed with file permissions.
     int cumulative_bindings = RenderProcess::current()->GetEnabledBindings();
-    bool is_initial_navigation = render_view_->history_list_length_ == 0;
-    bool should_fork =
-        HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
-        (cumulative_bindings & kWebUIBindingsPolicyMask) ||
-        url.SchemeIs(kViewSourceScheme) ||
-        (frame_->IsViewSourceModeEnabled() &&
-         info->navigation_type != blink::kWebNavigationTypeReload);
-    if (!should_fork && url.SchemeIs(url::kFileScheme)) {
-      // Fork non-file to file opens.  Note that this may fork unnecessarily if
-      // another tab (hosting a file or not) targeted this one before its
-      // initial navigation, but that shouldn't cause a problem.
-      should_fork = !old_url.SchemeIs(url::kFileScheme);
-    }
+    bool should_fork = HasWebUIScheme(url) || HasWebUIScheme(old_url) ||
+                       (cumulative_bindings & kWebUIBindingsPolicyMask);
 
     if (!should_fork) {
       // Give the embedder a chance.
+      bool is_initial_navigation = render_view_->history_list_length_ == 0;
       should_fork = GetContentClient()->renderer()->ShouldFork(
           frame_, url, info->url_request.HttpMethod().Utf8(),
           is_initial_navigation, false /* is_redirect */);
@@ -6635,9 +6328,6 @@ void RenderFrameImpl::BeginNavigation(
     sync_navigation_callback_.Cancel();
     mhtml_body_loader_client_.reset();
 
-    for (auto& observer : observers_)
-      observer.DidStartNavigation(url, info->navigation_type);
-
     // First navigation in a frame to an empty document must be handled
     // synchronously.
     bool is_first_real_empty_document_navigation =
@@ -6646,6 +6336,8 @@ void RenderFrameImpl::BeginNavigation(
 
     if (is_first_real_empty_document_navigation &&
         !is_history_navigation_in_new_child_frame) {
+      for (auto& observer : observers_)
+        observer.DidStartNavigation(url, info->navigation_type);
       CommitSyncNavigation(std::move(info));
       return;
     }
@@ -6659,6 +6351,8 @@ void RenderFrameImpl::BeginNavigation(
       if (!frame_->WillStartNavigation(
               *info, false /* is_history_navigation_in_new_child_frame */))
         return;
+      for (auto& observer : observers_)
+        observer.DidStartNavigation(url, info->navigation_type);
       // Only the first navigation in a frame to an empty document must be
       // handled synchronously, the others are required to happen
       // asynchronously. So a PostTask is used.
@@ -6680,8 +6374,7 @@ void RenderFrameImpl::BeginNavigation(
   if (info->navigation_policy == blink::kWebNavigationPolicyDownload) {
     mojo::PendingRemote<blink::mojom::BlobURLToken> blob_url_token =
         CloneBlobURLToken(info->blob_url_token.get());
-    DownloadURL(info->url_request,
-                blink::WebLocalFrameClient::CrossOriginRedirects::kFollow,
+    DownloadURL(info->url_request, network::mojom::RedirectMode::kFollow,
                 blob_url_token.PassPipe());
   } else {
     OpenURL(std::move(info));
@@ -7182,11 +6875,12 @@ void RenderFrameImpl::PrepareRenderViewForNavigation(
 void RenderFrameImpl::BeginNavigationInternal(
     std::unique_ptr<blink::WebNavigationInfo> info,
     bool is_history_navigation_in_new_child_frame) {
-  std::unique_ptr<DocumentState> document_state = BuildDocumentState();
   if (!frame_->WillStartNavigation(*info,
                                    is_history_navigation_in_new_child_frame))
     return;
 
+  for (auto& observer : observers_)
+    observer.DidStartNavigation(info->url_request.Url(), info->navigation_type);
   browser_side_navigation_pending_ = true;
   browser_side_navigation_pending_url_ = info->url_request.Url();
 
@@ -7221,7 +6915,7 @@ void RenderFrameImpl::BeginNavigationInternal(
   WillSendRequestInternal(
       request,
       frame_->Parent() ? ResourceType::kSubFrame : ResourceType::kMainFrame,
-      document_state.get(), transition_type);
+      transition_type);
 
   if (!info->url_request.GetExtraData())
     info->url_request.SetExtraData(std::make_unique<RequestExtraData>());
@@ -7282,9 +6976,11 @@ void RenderFrameImpl::BeginNavigationInternal(
           initiator ? base::make_optional<base::Value>(std::move(*initiator))
                     : base::nullopt);
 
-  mojom::NavigationClientAssociatedPtrInfo navigation_client_info;
+  mojo::PendingAssociatedRemote<mojom::NavigationClient>
+      navigation_client_remote;
   if (IsPerNavigationMojoInterfaceEnabled()) {
-    BindNavigationClient(mojo::MakeRequest(&navigation_client_info));
+    BindNavigationClient(
+        navigation_client_remote.InitWithNewEndpointAndPassReceiver());
     navigation_client_impl_->MarkWasInitiatedInThisFrame();
   }
 
@@ -7303,7 +6999,7 @@ void RenderFrameImpl::BeginNavigationInternal(
                                  load_flags, has_download_sandbox_flag, from_ad,
                                  is_history_navigation_in_new_child_frame),
       std::move(begin_navigation_params), std::move(blob_url_token),
-      std::move(navigation_client_info), std::move(navigation_initiator));
+      std::move(navigation_client_remote), std::move(navigation_initiator));
 }
 
 void RenderFrameImpl::DecodeDataURL(
@@ -7469,25 +7165,12 @@ void RenderFrameImpl::RegisterMojoInterfaces() {
 
   GetAssociatedInterfaceRegistry()->AddInterface(base::BindRepeating(
       &RenderFrameImpl::BindMhtmlFileWriter, base::Unretained(this)));
-
-  if (!frame_->Parent()) {
-    // Host zoom is per-page, so only added on the main frame.
-    GetAssociatedInterfaceRegistry()->AddInterface(base::BindRepeating(
-        &RenderFrameImpl::OnHostZoomClientRequest, weak_factory_.GetWeakPtr()));
-  }
-}
-
-void RenderFrameImpl::OnHostZoomClientRequest(
-    mojom::HostZoomAssociatedRequest request) {
-  DCHECK(!host_zoom_binding_.is_bound());
-  host_zoom_binding_.Bind(std::move(request),
-                          GetTaskRunner(blink::TaskType::kInternalIPC));
 }
 
 void RenderFrameImpl::BindMhtmlFileWriter(
-    mojom::MhtmlFileWriterAssociatedRequest request) {
-  mhtml_file_writer_binding_.Bind(
-      std::move(request), GetTaskRunner(blink::TaskType::kInternalDefault));
+    mojo::PendingAssociatedReceiver<mojom::MhtmlFileWriter> receiver) {
+  mhtml_file_writer_receiver_.Bind(
+      std::move(receiver), GetTaskRunner(blink::TaskType::kInternalDefault));
 }
 
 void RenderFrameImpl::CheckIfAudioSinkExistsAndIsAuthorized(
@@ -7720,8 +7403,9 @@ void RenderFrameImpl::RenderWidgetWillHandleMouseEvent() {
 #endif
 }
 
-void RenderFrameImpl::BindWidget(mojom::WidgetRequest request) {
-  GetLocalRootRenderWidget()->SetWidgetBinding(std::move(request));
+void RenderFrameImpl::BindWidget(
+    mojo::PendingReceiver<mojom::Widget> receiver) {
+  GetLocalRootRenderWidget()->SetWidgetReceiver(std::move(receiver));
 }
 
 blink::WebComputedAXTree* RenderFrameImpl::GetOrCreateWebComputedAXTree() {
@@ -7816,4 +7500,19 @@ void RenderFrameImpl::SetWebURLLoaderFactoryOverrideForTest(
   web_url_loader_factory_override_for_test_ = std::move(factory);
 }
 
+gfx::RectF RenderFrameImpl::ElementBoundsInWindow(
+    const blink::WebElement& element) {
+  blink::WebRect bounding_box_in_window = element.BoundsInViewport();
+  GetLocalRootRenderWidget()->ConvertViewportToWindow(&bounding_box_in_window);
+  return gfx::RectF(bounding_box_in_window);
+}
+
+void RenderFrameImpl::ConvertViewportToWindow(blink::WebRect* rect) {
+  GetLocalRootRenderWidget()->ConvertViewportToWindow(rect);
+}
+
+float RenderFrameImpl::GetDeviceScaleFactor() {
+  return GetLocalRootRenderWidget()->GetScreenInfo().device_scale_factor;
+}
+
 }  // namespace content
diff --git a/chromium/content/renderer/render_frame_impl.h b/chromium/content/renderer/render_frame_impl.h
index 0dc583ddbef..873403b161a 100644
--- a/chromium/content/renderer/render_frame_impl.h
+++ b/chromium/content/renderer/render_frame_impl.h
@@ -35,12 +35,12 @@
 #include "content/common/download/mhtml_file_writer.mojom.h"
 #include "content/common/frame.mojom.h"
 #include "content/common/frame_delete_intention.h"
-#include "content/common/host_zoom.mojom.h"
 #include "content/common/media/renderer_audio_input_stream_factory.mojom.h"
 #include "content/common/navigation_params.mojom.h"
 #include "content/common/renderer.mojom.h"
 #include "content/common/unique_name_helper.h"
 #include "content/common/widget.mojom.h"
+#include "content/public/common/browser_controls_state.h"
 #include "content/public/common/fullscreen_video_element.mojom.h"
 #include "content/public/common/javascript_dialog_type.h"
 #include "content/public/common/previews_state.h"
@@ -62,23 +62,28 @@
 #include "media/base/routing_token_callback.h"
 #include "mojo/public/cpp/bindings/associated_binding.h"
 #include "mojo/public/cpp/bindings/associated_receiver.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/system/data_pipe.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
+#include "services/network/public/mojom/url_response_head.mojom-forward.h"
 #include "services/service_manager/public/cpp/bind_source_info.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
-#include "services/service_manager/public/mojom/connector.mojom.h"
 #include "services/service_manager/public/mojom/interface_provider.mojom.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_registry.h"
 #include "third_party/blink/public/common/browser_interface_broker_proxy.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_owner_element_type.h"
+#include "third_party/blink/public/common/loader/loading_behavior_flag.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/mojom/autoplay/autoplay.mojom.h"
 #include "third_party/blink/public/mojom/choosers/file_chooser.mojom.h"
 #include "third_party/blink/public/mojom/commit_result/commit_result.mojom.h"
@@ -87,9 +92,7 @@
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
 #include "third_party/blink/public/mojom/use_counter/css_property_id.mojom.h"
-#include "third_party/blink/public/platform/web_effective_connection_type.h"
 #include "third_party/blink/public/platform/web_focus_type.h"
-#include "third_party/blink/public/platform/web_loading_behavior_flag.h"
 #include "third_party/blink/public/platform/web_media_player.h"
 #include "third_party/blink/public/web/web_ax_object.h"
 #include "third_party/blink/public/web/web_document_loader.h"
@@ -100,7 +103,6 @@
 #include "third_party/blink/public/web/web_local_frame_client.h"
 #include "third_party/blink/public/web/web_meaningful_layout.h"
 #include "third_party/blink/public/web/web_script_execution_callback.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "ui/accessibility/ax_mode.h"
 #include "ui/gfx/range/range.h"
 #include "url/gurl.h"
@@ -143,10 +145,6 @@ namespace media {
 class MediaPermission;
 }
 
-namespace network {
-struct ResourceResponseHead;
-}
-
 namespace service_manager {
 class InterfaceProvider;
 }
@@ -182,7 +180,6 @@ class CONTENT_EXPORT RenderFrameImpl
       mojom::Frame,
       mojom::FrameNavigationControl,
       mojom::FullscreenVideoElementHandler,
-      mojom::HostZoom,
       mojom::FrameBindingsControl,
       mojom::MhtmlFileWriter,
       public blink::WebLocalFrameClient,
@@ -212,6 +209,9 @@ class CONTENT_EXPORT RenderFrameImpl
   // owner FrameTreeNode. It can only be used for tagging requests and calls
   // for context frame attribution. It should never be passed back to the
   // browser as a frame identifier in the control flows calls.
+  // The |widget_params| is not null if the frame is to be a local root, which
+  // means it will own a RenderWidget, in which case the |widget_params| hold
+  // the routing id and initialization properties for the RenderWidget.
   //
   // Note: This is called only when RenderFrame is being created in response
   // to IPC message from the browser process. All other frame creation is driven
@@ -232,7 +232,7 @@ class CONTENT_EXPORT RenderFrameImpl
       const base::UnguessableToken& devtools_frame_token,
       const FrameReplicationState& replicated_state,
       CompositorDependencies* compositor_deps,
-      const mojom::CreateFrameWidgetParams& params,
+      const mojom::CreateFrameWidgetParams* widget_params,
       const FrameOwnerProperties& frame_owner_properties,
       bool has_committed_real_load);
 
@@ -323,7 +323,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // Notifications from RenderWidget.
   void WasHidden();
   void WasShown();
-  void WidgetWillClose();
 
   // Start/Stop loading notifications.
   // TODO(nasko): Those are page-level methods at this time and come from
@@ -414,7 +413,6 @@ class CONTENT_EXPORT RenderFrameImpl
       const base::string16& text,
       const std::vector<blink::WebImeTextSpan>& ime_text_spans,
       const gfx::Range& replacement_range);
-  void SimulateImeFinishComposingText(bool keep_selection);
 
   // TODO(jam): remove these once the IPC handler moves from RenderView to
   // RenderFrame.
@@ -454,6 +452,7 @@ class CONTENT_EXPORT RenderFrameImpl
   int ShowContextMenu(ContextMenuClient* client,
                       const ContextMenuParams& params) override;
   void CancelContextMenu(int request_id) override;
+  void ShowVirtualKeyboard() override;
   blink::WebPlugin* CreatePlugin(
       const WebPluginInfo& info,
       const blink::WebPluginParams& params,
@@ -486,11 +485,8 @@ class CONTENT_EXPORT RenderFrameImpl
   void SetSelectedText(const base::string16& selection_text,
                        size_t offset,
                        const gfx::Range& range) override;
-  void SetZoomLevel(double zoom_level) override;
-  double GetZoomLevel() override;
   void AddMessageToConsole(blink::mojom::ConsoleMessageLevel level,
                            const std::string& message) override;
-  void SetPreviewsState(PreviewsState previews_state) override;
   PreviewsState GetPreviewsState() override;
   bool IsPasting() override;
   bool IsBrowserSideNavigationPending() override;
@@ -510,6 +506,9 @@ class CONTENT_EXPORT RenderFrameImpl
       const RenderFrameMediaPlaybackOptions& opts) override;
   void UpdateAllLifecyclePhasesAndCompositeForTesting() override;
   void SetAllowsCrossBrowsingInstanceFrameLookup() override;
+  gfx::RectF ElementBoundsInWindow(const blink::WebElement& element) override;
+  void ConvertViewportToWindow(blink::WebRect* rect) override;
+  float GetDeviceScaleFactor() override;
 
   // blink::mojom::AutoplayConfigurationClient implementation:
   void AddAutoplayFlags(const url::Origin& origin,
@@ -524,6 +523,9 @@ class CONTENT_EXPORT RenderFrameImpl
   void ResumeBlockedRequests() override;
   void CancelBlockedRequests() override;
   void SetLifecycleState(blink::mojom::FrameLifecycleState state) override;
+  void UpdateBrowserControlsState(BrowserControlsState constraints,
+                                  BrowserControlsState current,
+                                  bool animate) override;
 
 #if defined(OS_ANDROID)
   void ExtractSmartClipData(
@@ -533,6 +535,7 @@ class CONTENT_EXPORT RenderFrameImpl
 
   // mojom::FrameBindingsControl implementation:
   void AllowBindings(int32_t enabled_bindings_flags) override;
+  void EnableMojoJsBindings() override;
 
   // mojom::FrameNavigationControl implementation:
   void PostMessageEvent(int32_t source_routing_id,
@@ -570,7 +573,7 @@ class CONTENT_EXPORT RenderFrameImpl
   void CommitPerNavigationMojoInterfaceNavigation(
       mojom::CommonNavigationParamsPtr common_params,
       mojom::CommitNavigationParamsPtr commit_params,
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       mojo::ScopedDataPipeConsumerHandle response_body,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -618,9 +621,6 @@ class CONTENT_EXPORT RenderFrameImpl
   void UpdateSubresourceLoaderFactories(
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
           subresource_loader_factories) override;
-  void MarkInitiatorAsRequiringSeparateURLLoaderFactory(
-      const url::Origin& initiator_origin,
-      network::mojom::URLLoaderFactoryPtr url_loader_factory) override;
   void BindDevToolsAgent(
       mojo::PendingAssociatedRemote<blink::mojom::DevToolsAgentHost> host,
       mojo::PendingAssociatedReceiver<blink::mojom::DevToolsAgent> receiver)
@@ -651,9 +651,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // mojom::FullscreenVideoElementHandler implementation:
   void RequestFullscreenVideoElement() override;
 
-  // mojom::HostZoom implementation:
-  void SetHostZoomLevel(const GURL& url, double zoom_level) override;
-
   // mojom::MhtmlFileWriter implementation:
   void SerializeAsMHTML(const mojom::SerializeAsMHTMLParamsPtr params,
                         SerializeAsMHTMLCallback callback) override;
@@ -736,17 +733,14 @@ class CONTENT_EXPORT RenderFrameImpl
                               unsigned source_line,
                               const blink::WebString& stack_trace) override;
   void DownloadURL(const blink::WebURLRequest& request,
-                   CrossOriginRedirects cross_origin_redirect_behavior,
+                   network::mojom::RedirectMode cross_origin_redirect_behavior,
                    mojo::ScopedMessagePipeHandle blob_url_token) override;
-  void LoadErrorPage(int reason) override;
   void BeginNavigation(std::unique_ptr<blink::WebNavigationInfo> info) override;
   void WillSendSubmitEvent(const blink::WebFormElement& form) override;
   void DidCreateDocumentLoader(
       blink::WebDocumentLoader* document_loader) override;
   void DidStartProvisionalLoad(
       blink::WebDocumentLoader* document_loader) override;
-  void DidFailProvisionalLoad(const blink::WebURLError& error,
-                              const blink::WebString& http_method) override;
   void DidCommitProvisionalLoad(
       const blink::WebHistoryItem& item,
       blink::WebHistoryCommitType commit_type,
@@ -774,16 +768,10 @@ class CONTENT_EXPORT RenderFrameImpl
   void ForwardResourceTimingToParent(
       const blink::WebResourceTimingInfo& info) override;
   void DispatchLoad() override;
-  blink::WebEffectiveConnectionType GetEffectiveConnectionType() override;
-  void SetEffectiveConnectionTypeForTesting(
-      blink::WebEffectiveConnectionType) override;
-  blink::WebURLRequest::PreviewsState GetPreviewsStateForFrame() const override;
   void DidBlockNavigation(const blink::WebURL& blocked_url,
                           const blink::WebURL& initiator_url,
                           blink::NavigationBlockedReason reason) override;
-  void NavigateBackForwardSoon(int offset,
-                               bool has_user_gesture,
-                               bool from_script) override;
+  void NavigateBackForwardSoon(int offset, bool has_user_gesture) override;
   base::UnguessableToken GetDevToolsFrameToken() override;
   void RenderFallbackContentInParentProcess() override;
   void AbortClientNavigation() override;
@@ -808,12 +796,10 @@ class CONTENT_EXPORT RenderFrameImpl
                              const blink::WebURL& target) override;
   void DidDisplayContentWithCertificateErrors() override;
   void DidRunContentWithCertificateErrors() override;
-  void ReportLegacyTLSVersion(const blink::WebURL& url) override;
   void DidChangePerformanceTiming() override;
   void DidChangeCpuTiming(base::TimeDelta time) override;
   void DidChangeActiveSchedulerTrackedFeatures(uint64_t features_mask) override;
-  void DidObserveLoadingBehavior(
-      blink::WebLoadingBehaviorFlag behavior) override;
+  void DidObserveLoadingBehavior(blink::LoadingBehaviorFlag behavior) override;
   void DidObserveNewFeatureUsage(blink::mojom::WebFeature feature) override;
   void DidObserveNewCssPropertyUsage(blink::mojom::CSSSampleId css_property,
                                      bool is_animated) override;
@@ -848,12 +834,9 @@ class CONTENT_EXPORT RenderFrameImpl
                                            const blink::WebNode& end_node,
                                            int end_offset) override;
   void HandleAccessibilityFindInPageTermination() override;
-  void EnterFullscreen(const blink::WebFullscreenOptions& options) override;
-  void ExitFullscreen() override;
-  void FullscreenStateChanged(bool is_fullscreen) override;
   void SuddenTerminationDisablerChanged(
       bool present,
-      blink::WebSuddenTerminationDisablerType disabler_type) override;
+      blink::SuddenTerminationDisablerType disabler_type) override;
   void RegisterProtocolHandler(const blink::WebString& scheme,
                                const blink::WebURL& url,
                                const blink::WebString& title) override;
@@ -885,31 +868,45 @@ class CONTENT_EXPORT RenderFrameImpl
 
   // Binds to the fullscreen service in the browser.
   void BindFullscreen(
-      mojom::FullscreenVideoElementHandlerAssociatedRequest request);
+      mojo::PendingAssociatedReceiver<mojom::FullscreenVideoElementHandler>
+          receiver);
 
   // Binds to the MHTML file generation service in the browser.
-  void BindMhtmlFileWriter(mojom::MhtmlFileWriterAssociatedRequest request);
+  void BindMhtmlFileWriter(
+      mojo::PendingAssociatedReceiver<mojom::MhtmlFileWriter> receiver);
 
   // Binds to the autoplay configuration service in the browser.
   void BindAutoplayConfiguration(
-      blink::mojom::AutoplayConfigurationClientAssociatedRequest request);
+      mojo::PendingAssociatedReceiver<blink::mojom::AutoplayConfigurationClient>
+          receiver);
 
   // Binds to the FrameHost in the browser.
   void BindFrame(const service_manager::BindSourceInfo& browser_info,
-                 mojom::FrameRequest request);
+                 mojo::PendingReceiver<mojom::Frame> receiver);
 
   // Virtual so that a TestRenderFrame can mock out the interface.
   virtual mojom::FrameHost* GetFrameHost();
 
   void BindFrameBindingsControl(
-      mojom::FrameBindingsControlAssociatedRequest request);
+      mojo::PendingAssociatedReceiver<mojom::FrameBindingsControl> receiver);
   void BindFrameNavigationControl(
       mojo::PendingAssociatedReceiver<mojom::FrameNavigationControl> receiver);
   // Only used when PerNavigationMojoInterface is enabled.
-  void BindNavigationClient(mojom::NavigationClientAssociatedRequest request);
+  void BindNavigationClient(
+      mojo::PendingAssociatedReceiver<mojom::NavigationClient> receiver);
 
   media::MediaPermission* GetMediaPermission();
 
+  // Proxies the call to set the zoom level over to the RenderViewImpl and
+  // returns its result.
+  bool SetZoomLevelOnRenderView(double zoom_level);
+  // Proxies the call to set the prefer compositing flag over to the
+  // RenderViewImpl.
+  void SetPreferCompositingToLCDTextEnabledOnRenderView(bool prefer);
+  // Proxies the call to set the device scale factor over to the RenderViewImpl.
+  void SetDeviceScaleFactorOnRenderView(bool use_zoom_for_dsf,
+                                        float device_scale_factor);
+
   // Sends the current frame's navigation state to the browser.
   void SendUpdateState();
 
@@ -919,7 +916,7 @@ class CONTENT_EXPORT RenderFrameImpl
   // the Mojo IPC layer.
   void MaybeEnableMojoBindings();
 
-  void NotifyObserversOfFailedProvisionalLoad(const blink::WebURLError& error);
+  void NotifyObserversOfFailedProvisionalLoad();
 
   bool handling_select_range() const { return handling_select_range_; }
 
@@ -982,7 +979,7 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void DidStartResponse(const GURL& response_url,
                         int request_id,
-                        const network::ResourceResponseHead& response_head,
+                        network::mojom::URLResponseHeadPtr response_head,
                         content::ResourceType resource_type,
                         PreviewsState previews_state);
   void DidCompleteResponse(int request_id,
@@ -1076,8 +1073,6 @@ class CONTENT_EXPORT RenderFrameImpl
 
   class FrameURLLoaderFactory;
 
-  typedef std::map<GURL, double> HostZoomLevels;
-
   // Creates a new RenderFrame. |render_view| is the RenderView object that this
   // frame belongs to, |interface_provider| is the RenderFrameHost's
   // InterfaceProvider through which services are exposed to the RenderFrame,
@@ -1136,8 +1131,8 @@ class CONTENT_EXPORT RenderFrameImpl
                              const std::string& message,
                              bool discard_duplicates);
   void OnVisualStateRequest(uint64_t key);
-  void OnReload(bool bypass_cache);
-  void OnReloadLoFiImages();
+  // TODO(https://crbug.com/995428): Deprecated.
+  void OnReload();
   void OnSetAccessibilityMode(ui::AXMode new_mode);
   void OnSnapshotAccessibilityTree(int callback_id, ui::AXMode ax_mode);
   void OnUpdateOpener(int opener_routing_id);
@@ -1231,13 +1226,6 @@ class CONTENT_EXPORT RenderFrameImpl
                            const base::string16& default_value,
                            base::string16* result);
 
-  // Loads the appropriate error page for the specified failure into the frame.
-  void LoadNavigationErrorPage(
-      blink::WebDocumentLoader* document_loader,
-      const blink::WebURLError& error,
-      const base::Optional<std::string>& error_page_content,
-      bool replace_current_item);
-
   base::Value GetJavaScriptExecutionResult(v8::Local<v8::Value> result);
 
   void InitializeMediaStreamDeviceObserver();
@@ -1299,13 +1287,9 @@ class CONTENT_EXPORT RenderFrameImpl
   bool ShouldDisplayErrorPageForFailedLoad(int error_code,
                                            const GURL& unreachable_url);
 
-  // |document_state| and |transition_type| correspond to the document which
-  // triggered this request. For main resource requests (navigations),
-  // |document_state| is a newly created one, and will be used for committing
-  // the navigation and creating the new document.
+  // |transition_type| corresponds to the document which triggered this request.
   void WillSendRequestInternal(blink::WebURLRequest& request,
                                ResourceType resource_type,
-                               DocumentState* document_state,
                                ui::PageTransition transition_type);
 
   // Returns the URL being loaded by the |frame_|'s request.
@@ -1317,8 +1301,6 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void RegisterMojoInterfaces();
 
-  void OnHostZoomClientRequest(mojom::HostZoomAssociatedRequest request);
-
   void InitializeBlameContext(RenderFrameImpl* parent_frame);
 
   // service_manager::mojom::InterfaceProvider:
@@ -1334,7 +1316,7 @@ class CONTENT_EXPORT RenderFrameImpl
 
   void SendUpdateFaviconURL();
 
-  void BindWidget(mojom::WidgetRequest request);
+  void BindWidget(mojo::PendingReceiver<mojom::Widget> receiver);
 
   void ShowDeferredContextMenu(const ContextMenuParams& params);
 
@@ -1343,9 +1325,6 @@ class CONTENT_EXPORT RenderFrameImpl
   MakeDidCommitProvisionalLoadParams(blink::WebHistoryCommitType commit_type,
                                      ui::PageTransition transition);
 
-  // Updates the Zoom level of the render view to match current content.
-  void UpdateZoomLevel();
-
   // Updates the navigation history depending on the passed parameters.
   // This could result either in the creation of a new entry or a modification
   // of the current entry or nothing. If a new entry was created,
@@ -1432,7 +1411,7 @@ class CONTENT_EXPORT RenderFrameImpl
   void CommitNavigationInternal(
       mojom::CommonNavigationParamsPtr common_params,
       mojom::CommitNavigationParamsPtr commit_params,
-      const network::ResourceResponseHead& response_head,
+      network::mojom::URLResponseHeadPtr response_head,
       mojo::ScopedDataPipeConsumerHandle response_body,
       network::mojom::URLLoaderClientEndpointsPtr url_loader_client_endpoints,
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
@@ -1602,7 +1581,8 @@ class CONTENT_EXPORT RenderFrameImpl
   std::unique_ptr<blink::WebMediaStreamDeviceObserver>
       web_media_stream_device_observer_;
 
-  mojom::RendererAudioInputStreamFactoryPtr audio_input_stream_factory_;
+  mojo::Remote<mojom::RendererAudioInputStreamFactory>
+      audio_input_stream_factory_;
 
   // The media permission dispatcher attached to this frame.
   std::unique_ptr<MediaPermissionDispatcher> media_permission_dispatcher_;
@@ -1618,9 +1598,6 @@ class CONTENT_EXPORT RenderFrameImpl
   service_manager::BindSourceInfo local_info_;
   service_manager::BindSourceInfo remote_info_;
 
-  // The Connector proxy used to connect to services.
-  service_manager::mojom::ConnectorPtr connector_;
-
   // The current accessibility mode.
   ui::AXMode accessibility_mode_;
 
@@ -1628,18 +1605,6 @@ class CONTENT_EXPORT RenderFrameImpl
   // flag set.
   RenderAccessibilityImpl* render_accessibility_;
 
-  // The PreviewsState of this RenderFrame that indicates which Previews can
-  // be used. The PreviewsState is a bitmask of potentially several Previews
-  // optimizations.
-  // TODO(sclittle): Consider moving this into Blink to be owned and managed by
-  // LocalFrame or another class around there.
-  PreviewsState previews_state_;
-
-  // Effective connection type when the document of this frame was fetched.
-  // TODO(sclittle): Consider moving this into Blink to be owned and managed by
-  // LocalFrame or another class around there.
-  blink::WebEffectiveConnectionType effective_connection_type_;
-
   // Whether or not this RenderFrame is currently pasting.
   bool is_pasting_;
 
@@ -1670,22 +1635,20 @@ class CONTENT_EXPORT RenderFrameImpl
   PepperPluginInstanceImpl* pepper_last_mouse_event_target_;
 #endif
 
-  HostZoomLevels host_zoom_levels_;
-
   using AutoplayOriginAndFlags = std::pair<url::Origin, int32_t>;
   AutoplayOriginAndFlags autoplay_flags_;
 
-  mojo::AssociatedBinding<blink::mojom::AutoplayConfigurationClient>
-      autoplay_configuration_binding_;
-  mojo::Binding<mojom::Frame> frame_binding_;
-  mojo::AssociatedBinding<mojom::HostZoom> host_zoom_binding_;
-  mojo::AssociatedBinding<mojom::FrameBindingsControl>
-      frame_bindings_control_binding_;
+  mojo::AssociatedReceiver<blink::mojom::AutoplayConfigurationClient>
+      autoplay_configuration_receiver_{this};
+  mojo::Receiver<mojom::Frame> frame_receiver_{this};
+  mojo::AssociatedReceiver<mojom::FrameBindingsControl>
+      frame_bindings_control_receiver_{this};
   mojo::AssociatedReceiver<mojom::FrameNavigationControl>
-      frame_navigation_control_receiver_;
-  mojo::AssociatedBinding<mojom::FullscreenVideoElementHandler>
-      fullscreen_binding_;
-  mojo::AssociatedBinding<mojom::MhtmlFileWriter> mhtml_file_writer_binding_;
+      frame_navigation_control_receiver_{this};
+  mojo::AssociatedReceiver<mojom::FullscreenVideoElementHandler>
+      fullscreen_receiver_{this};
+  mojo::AssociatedReceiver<mojom::MhtmlFileWriter> mhtml_file_writer_receiver_{
+      this};
 
   // Only used when PerNavigationMojoInterface is enabled.
   std::unique_ptr<NavigationClient> navigation_client_impl_;
@@ -1710,9 +1673,13 @@ class CONTENT_EXPORT RenderFrameImpl
   // See BindingsPolicy for details.
   int enabled_bindings_ = 0;
 
+  // This boolean indicates whether JS bindings for Mojo should be enabled at
+  // the time the next script context is created.
+  bool enable_mojo_js_bindings_ = false;
+
   service_manager::BindSourceInfo browser_info_;
 
-  mojom::FrameHostAssociatedPtr frame_host_ptr_;
+  mojo::AssociatedRemote<mojom::FrameHost> frame_host_remote_;
   mojo::BindingSet<service_manager::mojom::InterfaceProvider>
       interface_provider_bindings_;
 
@@ -1761,10 +1728,6 @@ class CONTENT_EXPORT RenderFrameImpl
   mojo::Remote<blink::mojom::ClipboardHost> clipboard_host_;
 #endif
 
-  // The origins for which a legacy TLS version warning has been printed. The
-  // size of this set is capped, after which no more warnings are printed.
-  std::set<url::Origin> tls_version_warning_origins_;
-
   std::unique_ptr<WebSocketHandshakeThrottleProvider>
       websocket_handshake_throttle_provider_;
 
diff --git a/chromium/content/renderer/render_frame_impl_browsertest.cc b/chromium/content/renderer/render_frame_impl_browsertest.cc
index ab2c3440129..cf7c89392a2 100644
--- a/chromium/content/renderer/render_frame_impl_browsertest.cc
+++ b/chromium/content/renderer/render_frame_impl_browsertest.cc
@@ -49,7 +49,6 @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/blink/public/mojom/frame/frame_host_test_interface.mojom.h"
-#include "third_party/blink/public/platform/web_effective_connection_type.h"
 #include "third_party/blink/public/platform/web_runtime_features.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/platform/web_url.h"
@@ -101,6 +100,7 @@ class RenderFrameImplTest : public RenderViewTest {
   void LoadChildFrame() {
     mojom::CreateFrameWidgetParams widget_params;
     widget_params.routing_id = kSubframeWidgetRouteId;
+    widget_params.visual_properties.new_size = gfx::Size(100, 100);
 
     FrameReplicationState frame_replication_state;
     frame_replication_state.name = "frame";
@@ -135,7 +135,7 @@ class RenderFrameImplTest : public RenderViewTest {
         std::move(stub_browser_interface_broker), MSG_ROUTING_NONE,
         MSG_ROUTING_NONE, kFrameProxyRouteId, MSG_ROUTING_NONE,
         base::UnguessableToken::Create(), frame_replication_state,
-        &compositor_deps_, widget_params, FrameOwnerProperties(),
+        &compositor_deps_, &widget_params, FrameOwnerProperties(),
         /*has_committed_real_load=*/true);
 
     frame_ = static_cast<TestRenderFrame*>(
@@ -152,15 +152,6 @@ class RenderFrameImplTest : public RenderViewTest {
      RenderViewTest::TearDown();
   }
 
-  void SetPreviewsState(RenderFrameImpl* frame, PreviewsState previews_state) {
-    frame->previews_state_ = previews_state;
-  }
-
-  void SetEffectionConnectionType(RenderFrameImpl* frame,
-                                  blink::WebEffectiveConnectionType type) {
-    frame->effective_connection_type_ = type;
-  }
-
   TestRenderFrame* GetMainRenderFrame() {
     return static_cast<TestRenderFrame*>(view_->GetMainRenderFrame());
   }
@@ -228,19 +219,22 @@ TEST_F(RenderFrameImplTest, FrameResize) {
   visual_properties.browser_controls_shrink_blink_size = false;
   visual_properties.is_fullscreen_granted = false;
 
-  WidgetMsg_SynchronizeVisualProperties resize_message(0, visual_properties);
-
   // The main frame's widget will receive the resize message before the
   // subframe's widget, and it will set the size for the WebView.
   RenderWidget* main_frame_widget =
       GetMainRenderFrame()->GetLocalRootRenderWidget();
+  WidgetMsg_UpdateVisualProperties resize_message(
+      main_frame_widget->routing_id(), visual_properties);
+
   main_frame_widget->OnMessageReceived(resize_message);
   EXPECT_EQ(view_->GetWebView()->MainFrameWidget()->Size(),
             blink::WebSize(size));
   EXPECT_NE(frame_widget()->GetWebWidget()->Size(), blink::WebSize(size));
 
   // The subframe sets the size only for itself.
-  frame_widget()->OnMessageReceived(resize_message);
+  WidgetMsg_UpdateVisualProperties resize_message_subframe(
+      frame_widget()->routing_id(), visual_properties);
+  frame_widget()->OnMessageReceived(resize_message_subframe);
   EXPECT_EQ(frame_widget()->GetWebWidget()->Size(), blink::WebSize(size));
 }
 
@@ -302,72 +296,6 @@ TEST_F(RenderFrameImplTest, LocalChildFrameWasShown) {
   EXPECT_TRUE(observer.visible());
 }
 
-// Test that effective connection type only updates for new main frame
-// documents.
-TEST_F(RenderFrameImplTest, EffectiveConnectionType) {
-  EXPECT_EQ(blink::WebEffectiveConnectionType::kTypeUnknown,
-            frame()->GetEffectiveConnectionType());
-  EXPECT_EQ(blink::WebEffectiveConnectionType::kTypeUnknown,
-            GetMainRenderFrame()->GetEffectiveConnectionType());
-
-  const struct {
-    blink::WebEffectiveConnectionType type;
-  } tests[] = {{blink::WebEffectiveConnectionType::kTypeUnknown},
-               {blink::WebEffectiveConnectionType::kType2G},
-               {blink::WebEffectiveConnectionType::kType4G}};
-
-  for (size_t i = 0; i < base::size(tests); ++i) {
-    SetEffectionConnectionType(GetMainRenderFrame(), tests[i].type);
-    SetEffectionConnectionType(frame(), tests[i].type);
-
-    EXPECT_EQ(tests[i].type, frame()->GetEffectiveConnectionType());
-    EXPECT_EQ(tests[i].type,
-              GetMainRenderFrame()->GetEffectiveConnectionType());
-
-    blink::WebHistoryItem item;
-    item.Initialize();
-
-    // The main frame's and subframe's effective connection type should stay the
-    // same on same-document navigations.
-    frame()->DidFinishSameDocumentNavigation(item, blink::kWebStandardCommit,
-                                             false /* content_initiated */);
-    EXPECT_EQ(tests[i].type, frame()->GetEffectiveConnectionType());
-    GetMainRenderFrame()->DidFinishSameDocumentNavigation(
-        item, blink::kWebStandardCommit, false /* content_initiated */);
-    EXPECT_EQ(tests[i].type, frame()->GetEffectiveConnectionType());
-
-    // The subframe's effective connection type should not be reset on commit.
-    NavigationState* navigation_state = NavigationState::FromDocumentLoader(
-        frame()->GetWebFrame()->GetDocumentLoader());
-    navigation_state->set_was_within_same_document(false);
-
-    mojo::PendingRemote<blink::mojom::DocumentInterfaceBroker>
-        stub_document_interface_broker;
-    frame()->DidCommitProvisionalLoad(
-        item, blink::kWebStandardCommit,
-        stub_document_interface_broker.InitWithNewPipeAndPassReceiver()
-            .PassPipe());
-    EXPECT_EQ(tests[i].type, frame()->GetEffectiveConnectionType());
-
-    // The main frame's effective connection type should be reset on commit.
-    navigation_state = NavigationState::FromDocumentLoader(
-        GetMainRenderFrame()->GetWebFrame()->GetDocumentLoader());
-    navigation_state->set_was_within_same_document(false);
-
-    stub_document_interface_broker.reset();
-    GetMainRenderFrame()->DidCommitProvisionalLoad(
-        item, blink::kWebStandardCommit,
-        stub_document_interface_broker.InitWithNewPipeAndPassReceiver()
-            .PassPipe());
-    EXPECT_EQ(blink::WebEffectiveConnectionType::kTypeUnknown,
-              GetMainRenderFrame()->GetEffectiveConnectionType());
-
-    // The subframe would be deleted here after a cross-document navigation.
-    // It happens to be left around in this test because this does not simulate
-    // the frame detach.
-  }
-}
-
 TEST_F(RenderFrameImplTest, SaveImageFromDataURL) {
   const IPC::Message* msg1 = render_thread_->sink().GetFirstMessageMatching(
       FrameHostMsg_SaveImageFromDataURL::ID);
@@ -385,7 +313,7 @@ TEST_F(RenderFrameImplTest, SaveImageFromDataURL) {
 
   FrameHostMsg_SaveImageFromDataURL::Param param1;
   FrameHostMsg_SaveImageFromDataURL::Read(msg2, &param1);
-  EXPECT_EQ(std::get<2>(param1), image_data_url);
+  EXPECT_EQ(std::get<0>(param1), image_data_url);
 
   base::RunLoop().RunUntilIdle();
   render_thread_->sink().ClearMessages();
@@ -400,7 +328,7 @@ TEST_F(RenderFrameImplTest, SaveImageFromDataURL) {
 
   FrameHostMsg_SaveImageFromDataURL::Param param2;
   FrameHostMsg_SaveImageFromDataURL::Read(msg3, &param2);
-  EXPECT_EQ(std::get<2>(param2), large_data_url);
+  EXPECT_EQ(std::get<0>(param2), large_data_url);
 
   base::RunLoop().RunUntilIdle();
   render_thread_->sink().ClearMessages();
@@ -427,9 +355,8 @@ TEST_F(RenderFrameImplTest, DownloadUrlLimit) {
       blink::WebSecurityOrigin::Create(GURL("http://test")));
 
   for (int i = 0; i < 10; ++i) {
-    frame()->DownloadURL(
-        request, blink::WebLocalFrameClient::CrossOriginRedirects::kNavigate,
-        mojo::ScopedMessagePipeHandle());
+    frame()->DownloadURL(request, network::mojom::RedirectMode::kManual,
+                         mojo::ScopedMessagePipeHandle());
     base::RunLoop().RunUntilIdle();
     const IPC::Message* msg2 = render_thread_->sink().GetFirstMessageMatching(
         FrameHostMsg_DownloadUrl::ID);
@@ -438,42 +365,14 @@ TEST_F(RenderFrameImplTest, DownloadUrlLimit) {
     render_thread_->sink().ClearMessages();
   }
 
-  frame()->DownloadURL(
-      request, blink::WebLocalFrameClient::CrossOriginRedirects::kNavigate,
-      mojo::ScopedMessagePipeHandle());
+  frame()->DownloadURL(request, network::mojom::RedirectMode::kManual,
+                       mojo::ScopedMessagePipeHandle());
   base::RunLoop().RunUntilIdle();
   const IPC::Message* msg3 = render_thread_->sink().GetFirstMessageMatching(
       FrameHostMsg_DownloadUrl::ID);
   EXPECT_FALSE(msg3);
 }
 
-TEST_F(RenderFrameImplTest, ZoomLimit) {
-  const double kMinZoomLevel = ZoomFactorToZoomLevel(kMinimumZoomFactor);
-  const double kMaxZoomLevel = ZoomFactorToZoomLevel(kMaximumZoomFactor);
-
-  // Verifies navigation to a URL with preset zoom level indeed sets the level.
-  // Regression test for http://crbug.com/139559, where the level was not
-  // properly set when it is out of the default zoom limits of WebView.
-  auto common_params = CreateCommonNavigationParams();
-  common_params->url = GURL("data:text/html,min_zoomlimit_test");
-  common_params->navigation_type = mojom::NavigationType::DIFFERENT_DOCUMENT;
-  GetMainRenderFrame()->SetHostZoomLevel(common_params->url, kMinZoomLevel);
-  GetMainRenderFrame()->Navigate(common_params.Clone(),
-                                 CreateCommitNavigationParams());
-  base::RunLoop().RunUntilIdle();
-  EXPECT_DOUBLE_EQ(kMinZoomLevel, view_->GetWebView()->ZoomLevel());
-
-  // It should work even when the zoom limit is temporarily changed in the page.
-  view_->GetWebView()->ZoomLimitsChanged(ZoomFactorToZoomLevel(1.0),
-                                         ZoomFactorToZoomLevel(1.0));
-  common_params->url = GURL("data:text/html,max_zoomlimit_test");
-  GetMainRenderFrame()->SetHostZoomLevel(common_params->url, kMaxZoomLevel);
-  GetMainRenderFrame()->Navigate(common_params.Clone(),
-                                 CreateCommitNavigationParams());
-  base::RunLoop().RunUntilIdle();
-  EXPECT_DOUBLE_EQ(kMaxZoomLevel, view_->GetWebView()->ZoomLevel());
-}
-
 // Regression test for crbug.com/692557. It shouldn't crash if we inititate a
 // text finding, and then delete the frame immediately before the text finding
 // returns any text match.
@@ -535,15 +434,6 @@ TEST_F(RenderFrameImplTest, TestOverlayRoutingTokenSendsNow) {
 }
 #endif
 
-TEST_F(RenderFrameImplTest, GetPreviewsStateForFrame) {
-  SetPreviewsState(frame(), PREVIEWS_OFF);
-  EXPECT_EQ(WebURLRequest::kPreviewsOff, frame()->GetPreviewsStateForFrame());
-
-  SetPreviewsState(frame(), PREVIEWS_OFF | PREVIEWS_NO_TRANSFORM);
-  EXPECT_EQ(WebURLRequest::kPreviewsOff | WebURLRequest::kPreviewsNoTransform,
-            frame()->GetPreviewsStateForFrame());
-}
-
 TEST_F(RenderFrameImplTest, AutoplayFlags) {
   // Add autoplay flags to the page.
   GetMainRenderFrame()->AddAutoplayFlags(
@@ -696,32 +586,6 @@ TEST_F(RenderFrameImplTest, TestDocumentInterfaceBrokerOverride) {
   frame_interface_broker.Flush();
 }
 
-TEST_F(RenderFrameImplTest, IPAddressSpace) {
-  // Verifies that the IPAddressSpace provided in the commit navigation params
-  // influences the web-visible `.addressSpace`.
-  auto common_params = CreateCommonNavigationParams();
-  common_params->url = GURL("data:text/html,ip_address_space");
-  common_params->navigation_type = mojom::NavigationType::DIFFERENT_DOCUMENT;
-
-  network::mojom::IPAddressSpace values[] = {
-      network::mojom::IPAddressSpace::kUnknown,
-      network::mojom::IPAddressSpace::kLocal,
-      network::mojom::IPAddressSpace::kPrivate,
-      network::mojom::IPAddressSpace::kPublic};
-
-  for (auto value : values) {
-    auto commit_params = CreateCommitNavigationParams();
-    commit_params->ip_address_space = value;
-    GetMainRenderFrame()->Navigate(common_params.Clone(),
-                                   commit_params.Clone());
-    base::RunLoop().RunUntilIdle();
-    EXPECT_EQ(value, GetMainRenderFrame()
-                         ->GetWebFrame()
-                         ->GetDocumentLoader()
-                         ->GetIPAddressSpace());
-  }
-}
-
 // RenderFrameRemoteInterfacesTest ------------------------------------
 
 namespace {
@@ -788,7 +652,7 @@ class TestSimpleDocumentInterfaceBrokerImpl
  public:
   using BinderCallback = base::RepeatingCallback<void(
       mojo::PendingReceiver<blink::mojom::FrameHostTestInterface>)>;
-  TestSimpleDocumentInterfaceBrokerImpl(BinderCallback binder_callback)
+  explicit TestSimpleDocumentInterfaceBrokerImpl(BinderCallback binder_callback)
       : binder_callback_(binder_callback) {}
   void BindAndFlush(
       mojo::PendingReceiver<blink::mojom::DocumentInterfaceBroker> receiver) {
@@ -804,15 +668,6 @@ class TestSimpleDocumentInterfaceBrokerImpl
       override {
     binder_callback_.Run(std::move(receiver));
   }
-  void GetCredentialManager(
-      mojo::PendingReceiver<blink::mojom::CredentialManager>) override {}
-  void GetAuthenticator(
-      mojo::PendingReceiver<blink::mojom::Authenticator> receiver) override {}
-  void GetPushMessaging(
-      mojo::PendingReceiver<blink::mojom::PushMessaging> receiver) override {}
-  void GetVirtualAuthenticatorManager(
-      mojo::PendingReceiver<blink::test::mojom::VirtualAuthenticatorManager>
-          receiver) override {}
 
   mojo::Receiver<blink::mojom::DocumentInterfaceBroker> receiver_{this};
   BinderCallback binder_callback_;
@@ -1255,7 +1110,7 @@ TEST_F(RenderFrameRemoteInterfacesTest, ChildFrameAtFirstCommittedLoad) {
       {{GURL(kNoDocumentMarkerURL), kFrameEventDidCreateNewFrame},
        {initial_empty_url, kFrameEventDidCreateNewDocument},
        {initial_empty_url, kFrameEventDidCreateDocumentElement},
-       {initial_empty_url, kFrameEventReadyToCommitNavigation},
+       {child_frame_url, kFrameEventReadyToCommitNavigation},
        // TODO(https://crbug.com/555773): It seems strange that the new
        // document is created and DidCreateNewDocument is invoked *before* the
        // provisional load would have even committed.
@@ -1309,7 +1164,7 @@ TEST_F(RenderFrameRemoteInterfacesTest,
       main_frame_exerciser
           .browser_interface_broker_receiver_for_initial_empty_document(),
       {{initial_empty_url, kFrameEventDidCreateNewFrame},
-       {initial_empty_url, kFrameEventReadyToCommitNavigation},
+       {new_window_url, kFrameEventReadyToCommitNavigation},
        {new_window_url, kFrameEventDidCreateNewDocument}});
   ExpectPendingInterfaceRequestsFromSources(
       main_frame_exerciser.interface_request_for_first_document(),
@@ -1377,7 +1232,7 @@ TEST_F(RenderFrameRemoteInterfacesTest,
         {{GURL(kNoDocumentMarkerURL), kFrameEventDidCreateNewFrame},
          {initial_empty_url, kFrameEventDidCreateNewDocument},
          {initial_empty_url, kFrameEventDidCreateDocumentElement},
-         {initial_empty_url, kFrameEventReadyToCommitNavigation},
+         {child_frame_url, kFrameEventReadyToCommitNavigation},
          {child_frame_url, kFrameEventDidCreateNewDocument},
          {child_frame_url, kFrameEventDidCommitProvisionalLoad},
          {child_frame_url, kFrameEventDidCreateDocumentElement}});
@@ -1435,7 +1290,7 @@ TEST_F(RenderFrameRemoteInterfacesTest, ReplacedOnNonSameDocumentNavigation) {
       std::move(document_interface_broker_receiver_for_first_document),
       std::move(browser_interface_broker_receiver_for_first_document),
       {{GURL(kTestFirstURL), kFrameEventAfterCommit},
-       {GURL(kTestFirstURL), kFrameEventReadyToCommitNavigation},
+       {GURL(kTestSecondURL), kFrameEventReadyToCommitNavigation},
        {GURL(kTestSecondURL), kFrameEventDidCreateNewDocument}});
 
   ASSERT_TRUE(interface_provider_request_for_second_document.is_pending());
diff --git a/chromium/content/renderer/render_frame_metadata_observer_impl.cc b/chromium/content/renderer/render_frame_metadata_observer_impl.cc
index 6d723113ca4..ab4b23963f9 100644
--- a/chromium/content/renderer/render_frame_metadata_observer_impl.cc
+++ b/chromium/content/renderer/render_frame_metadata_observer_impl.cc
@@ -6,6 +6,7 @@
 
 #include <cmath>
 
+#include "base/trace_event/trace_event.h"
 #include "build/build_config.h"
 #include "components/viz/common/quads/compositor_frame_metadata.h"
 
@@ -18,18 +19,17 @@ constexpr float kEdgeThreshold = 10.0f;
 }
 
 RenderFrameMetadataObserverImpl::RenderFrameMetadataObserverImpl(
-    mojom::RenderFrameMetadataObserverRequest request,
-    mojom::RenderFrameMetadataObserverClientPtrInfo client_info)
-    : request_(std::move(request)),
-      client_info_(std::move(client_info)),
-      render_frame_metadata_observer_binding_(this) {}
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver,
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient> client_remote)
+    : receiver_(std::move(receiver)),
+      client_remote_(std::move(client_remote)) {}
 
 RenderFrameMetadataObserverImpl::~RenderFrameMetadataObserverImpl() {}
 
 void RenderFrameMetadataObserverImpl::BindToCurrentThread() {
-  DCHECK(request_.is_pending());
-  render_frame_metadata_observer_binding_.Bind(std::move(request_));
-  render_frame_metadata_observer_client_.Bind(std::move(client_info_));
+  DCHECK(receiver_.is_valid());
+  render_frame_metadata_observer_receiver_.Bind(std::move(receiver_));
+  render_frame_metadata_observer_client_.Bind(std::move(client_remote_));
 }
 
 void RenderFrameMetadataObserverImpl::OnRenderFrameSubmission(
diff --git a/chromium/content/renderer/render_frame_metadata_observer_impl.h b/chromium/content/renderer/render_frame_metadata_observer_impl.h
index c0335ae90b7..f253f7b82bd 100644
--- a/chromium/content/renderer/render_frame_metadata_observer_impl.h
+++ b/chromium/content/renderer/render_frame_metadata_observer_impl.h
@@ -10,7 +10,10 @@
 #include "cc/trees/render_frame_metadata_observer.h"
 #include "content/common/content_export.h"
 #include "content/common/render_frame_metadata.mojom.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 
 namespace content {
 
@@ -28,8 +31,9 @@ class CONTENT_EXPORT RenderFrameMetadataObserverImpl
       public mojom::RenderFrameMetadataObserver {
  public:
   RenderFrameMetadataObserverImpl(
-      mojom::RenderFrameMetadataObserverRequest request,
-      mojom::RenderFrameMetadataObserverClientPtrInfo client_info);
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient>
+          client_remote);
   ~RenderFrameMetadataObserverImpl() override;
 
   // cc::RenderFrameMetadataObserver:
@@ -74,12 +78,12 @@ class CONTENT_EXPORT RenderFrameMetadataObserverImpl
   base::Optional<cc::RenderFrameMetadata> last_render_frame_metadata_;
 
   // These are destroyed when BindToCurrentThread() is called.
-  mojom::RenderFrameMetadataObserverRequest request_;
-  mojom::RenderFrameMetadataObserverClientPtrInfo client_info_;
+  mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver_;
+  mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient> client_remote_;
 
-  mojo::Binding<mojom::RenderFrameMetadataObserver>
-      render_frame_metadata_observer_binding_;
-  mojom::RenderFrameMetadataObserverClientPtr
+  mojo::Receiver<mojom::RenderFrameMetadataObserver>
+      render_frame_metadata_observer_receiver_{this};
+  mojo::Remote<mojom::RenderFrameMetadataObserverClient>
       render_frame_metadata_observer_client_;
 
   DISALLOW_COPY_AND_ASSIGN(RenderFrameMetadataObserverImpl);
diff --git a/chromium/content/renderer/render_frame_metadata_observer_impl_unittest.cc b/chromium/content/renderer/render_frame_metadata_observer_impl_unittest.cc
index e871e725ab8..0883bde5bfe 100644
--- a/chromium/content/renderer/render_frame_metadata_observer_impl_unittest.cc
+++ b/chromium/content/renderer/render_frame_metadata_observer_impl_unittest.cc
@@ -11,6 +11,9 @@
 #include "components/viz/common/quads/compositor_frame_metadata.h"
 #include "content/common/render_frame_metadata.mojom.h"
 #include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -27,12 +30,13 @@ class MockRenderFrameMetadataObserverClient
     : public mojom::RenderFrameMetadataObserverClient {
  public:
   MockRenderFrameMetadataObserverClient(
-      mojom::RenderFrameMetadataObserverClientRequest client_request,
-      mojom::RenderFrameMetadataObserverPtr observer)
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+          client_receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserver> observer)
       : render_frame_metadata_observer_client_binding_(
             this,
-            std::move(client_request)),
-        render_frame_metadata_observer_ptr_(std::move(observer)) {}
+            std::move(client_receiver)),
+        render_frame_metadata_observer_remote_(std::move(observer)) {}
 
   MOCK_METHOD2(OnRenderFrameMetadataChanged,
                void(uint32_t frame_token,
@@ -42,7 +46,8 @@ class MockRenderFrameMetadataObserverClient
  private:
   mojo::Binding<mojom::RenderFrameMetadataObserverClient>
       render_frame_metadata_observer_client_binding_;
-  mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer_ptr_;
+  mojo::Remote<mojom::RenderFrameMetadataObserver>
+      render_frame_metadata_observer_remote_;
 
   DISALLOW_COPY_AND_ASSIGN(MockRenderFrameMetadataObserverClient);
 };
@@ -58,17 +63,17 @@ class RenderFrameMetadataObserverImplTest : public testing::Test {
 
   // testing::Test:
   void SetUp() override {
-    mojom::RenderFrameMetadataObserverPtr ptr;
-    mojom::RenderFrameMetadataObserverRequest request = mojo::MakeRequest(&ptr);
-    mojom::RenderFrameMetadataObserverClientPtrInfo client_info;
-    mojom::RenderFrameMetadataObserverClientRequest client_request =
-        mojo::MakeRequest(&client_info);
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserver> observer_remote;
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserver> receiver =
+        observer_remote.InitWithNewPipeAndPassReceiver();
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient> client_remote;
 
     client_ = std::make_unique<
         testing::NiceMock<MockRenderFrameMetadataObserverClient>>(
-        std::move(client_request), std::move(ptr));
+        client_remote.InitWithNewPipeAndPassReceiver(),
+        std::move(observer_remote));
     observer_impl_ = std::make_unique<RenderFrameMetadataObserverImpl>(
-        std::move(request), std::move(client_info));
+        std::move(receiver), std::move(client_remote));
     observer_impl_->BindToCurrentThread();
   }
 
diff --git a/chromium/content/renderer/render_frame_proxy.cc b/chromium/content/renderer/render_frame_proxy.cc
index fc04afea4f4..112c70324d9 100644
--- a/chromium/content/renderer/render_frame_proxy.cc
+++ b/chromium/content/renderer/render_frame_proxy.cc
@@ -35,15 +35,16 @@
 #include "content/renderer/render_widget.h"
 #include "content/renderer/resource_timing_info_conversions.h"
 #include "ipc/ipc_message_macros.h"
+#include "mojo/public/cpp/bindings/pending_associated_remote.h"
 #include "printing/buildflags/buildflags.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/frame_policy.h"
+#include "third_party/blink/public/common/navigation/triggering_event_info.h"
 #include "third_party/blink/public/platform/url_conversion.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_resource_timing_info.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/web/web_local_frame.h"
-#include "third_party/blink/public/web/web_triggering_event_info.h"
 #include "third_party/blink/public/web/web_user_gesture_indicator.h"
 #include "third_party/blink/public/web/web_view.h"
 #include "ui/gfx/geometry/size_conversions.h"
@@ -99,7 +100,7 @@ RenderFrameProxy* RenderFrameProxy::CreateProxyToReplaceFrame(
           ? frame_to_replace->GetLocalRootRenderWidget()
           : RenderFrameProxy::FromWebFrame(
                 frame_to_replace->GetWebFrame()->Parent()->ToWebRemoteFrame())
-                ->render_widget();
+                ->render_widget_;
   proxy->Init(web_frame, frame_to_replace->render_view(), widget,
               parent_is_local);
   return proxy.release();
@@ -134,13 +135,6 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
     web_frame = blink::WebRemoteFrame::CreateMainFrame(
         render_view->GetWebView(), proxy.get(), opener);
     render_widget = render_view->GetWidget();
-
-    // If the RenderView is reused by this proxy after having been used for a
-    // pending RenderFrame that was discarded, its widget needs to be frozen, as
-    // the OnSwapOut flow which normally does this won't happen in that case.
-    // See https://crbug.com/653746 and https://crbug.com/651980.
-    if (!render_widget->is_frozen())
-      render_widget->SetIsFrozen(true);
   } else {
     // Create a frame under an existing parent. The parent is always expected
     // to be a RenderFrameProxy, because navigations initiated by local frames
@@ -152,7 +146,7 @@ RenderFrameProxy* RenderFrameProxy::CreateFrameProxy(
         replicated_state.frame_owner_element_type, proxy.get(), opener);
     proxy->unique_name_ = replicated_state.unique_name;
     render_view = parent->render_view();
-    render_widget = parent->render_widget();
+    render_widget = parent->render_widget_;
   }
 
   proxy->Init(web_frame, render_view, render_widget, false);
@@ -227,7 +221,8 @@ RenderFrameProxy::RenderFrameProxy(int routing_id)
 }
 
 RenderFrameProxy::~RenderFrameProxy() {
-  render_widget_->UnregisterRenderFrameProxy(this);
+  if (render_widget_)
+    render_widget_->UnregisterRenderFrameProxy(this);
 
   CHECK(!web_frame_);
   RenderThread::Get()->RemoveRoute(routing_id_);
@@ -240,13 +235,21 @@ void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
                             bool parent_is_local) {
   CHECK(web_frame);
   CHECK(render_view);
-  CHECK(render_widget);
 
   web_frame_ = web_frame;
   render_view_ = render_view;
   render_widget_ = render_widget;
 
-  render_widget_->RegisterRenderFrameProxy(this);
+  // |render_widget_| can be null if this is a proxy for a remote main frame, or
+  // a subframe of that proxy. We don't need to register as an observer [since
+  // the RenderWidget is undead/won't exist]. The observer is used to propagate
+  // VisualProperty changes down the frame/process hierarchy. Remote main frame
+  // proxies do not participate in this flow.
+  if (render_widget_) {
+    render_widget_->RegisterRenderFrameProxy(this);
+    pending_visual_properties_.screen_info =
+        render_widget_->GetOriginalScreenInfo();
+  }
 
   std::pair<FrameProxyMap::iterator, bool> result =
       g_frame_proxy_map.Get().insert(std::make_pair(web_frame_, this));
@@ -254,9 +257,6 @@ void RenderFrameProxy::Init(blink::WebRemoteFrame* web_frame,
 
   if (parent_is_local)
     compositing_helper_ = std::make_unique<ChildFrameCompositingHelper>(this);
-
-  pending_visual_properties_.screen_info =
-      render_widget_->GetOriginalScreenInfo();
 }
 
 void RenderFrameProxy::ResendVisualProperties() {
@@ -375,7 +375,9 @@ void RenderFrameProxy::OnDidSetFramePolicyHeaders(
 }
 
 bool RenderFrameProxy::OnMessageReceived(const IPC::Message& msg) {
-  // Forward Page IPCs to the RenderView.
+  // Page IPCs are routed via the main frame (both local and remote) and then
+  // forwarded to the RenderView. See comment in
+  // RenderFrameHostManager::SendPageMessage() for more information.
   if ((IPC_MESSAGE_CLASS(msg) == PageMsgStart)) {
     if (render_view())
       return render_view()->OnMessageReceived(msg);
@@ -795,7 +797,7 @@ void RenderFrameProxy::Navigate(
   params.disposition = WindowOpenDisposition::CURRENT_TAB;
   params.should_replace_current_entry = should_replace_current_entry;
   params.user_gesture = request.HasUserGesture();
-  params.triggering_event_info = blink::WebTriggeringEventInfo::kUnknown;
+  params.triggering_event_info = blink::TriggeringEventInfo::kUnknown;
   params.blob_url_token = blob_url_token.release();
 
   // Note: For the AdFrame download policy here it only covers the case where
@@ -816,8 +818,10 @@ void RenderFrameProxy::FrameRectsChanged(
   pending_visual_properties_.screen_space_rect = gfx::Rect(screen_space_rect);
   pending_visual_properties_.local_frame_size =
       gfx::Size(local_frame_rect.width, local_frame_rect.height);
-  pending_visual_properties_.screen_info =
-      render_widget_->GetOriginalScreenInfo();
+  if (render_widget_) {
+    pending_visual_properties_.screen_info =
+        render_widget_->GetOriginalScreenInfo();
+  }
   if (crashed_) {
     // Update the sad page to match the current size.
     compositing_helper_->ChildFrameGone(local_frame_size(),
@@ -944,18 +948,19 @@ const viz::LocalSurfaceId& RenderFrameProxy::GetLocalSurfaceId() const {
 }
 
 mojom::RenderFrameProxyHost* RenderFrameProxy::GetFrameProxyHost() {
-  if (!frame_proxy_host_ptr_.is_bound())
-    GetRemoteAssociatedInterfaces()->GetInterface(&frame_proxy_host_ptr_);
-  return frame_proxy_host_ptr_.get();
+  if (!frame_proxy_host_remote_.is_bound())
+    GetRemoteAssociatedInterfaces()->GetInterface(&frame_proxy_host_remote_);
+  return frame_proxy_host_remote_.get();
 }
 
 blink::AssociatedInterfaceProvider*
 RenderFrameProxy::GetRemoteAssociatedInterfaces() {
   if (!remote_associated_interfaces_) {
     ChildThreadImpl* thread = ChildThreadImpl::current();
-    blink::mojom::AssociatedInterfaceProviderAssociatedPtr remote_interfaces;
+    mojo::PendingAssociatedRemote<blink::mojom::AssociatedInterfaceProvider>
+        remote_interfaces;
     thread->GetRemoteRouteProvider()->GetRoute(
-        routing_id_, mojo::MakeRequest(&remote_interfaces));
+        routing_id_, remote_interfaces.InitWithNewEndpointAndPassReceiver());
     remote_associated_interfaces_ =
         std::make_unique<blink::AssociatedInterfaceProvider>(
             std::move(remote_interfaces));
diff --git a/chromium/content/renderer/render_frame_proxy.h b/chromium/content/renderer/render_frame_proxy.h
index c7202fe2297..3844c2cf3b0 100644
--- a/chromium/content/renderer/render_frame_proxy.h
+++ b/chromium/content/renderer/render_frame_proxy.h
@@ -17,6 +17,7 @@
 #include "content/renderer/child_frame_compositor.h"
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_sender.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
 #include "third_party/blink/public/common/frame/user_activation_update_type.h"
@@ -154,9 +155,6 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
 
   int provisional_frame_routing_id() { return provisional_frame_routing_id_; }
 
-  // Returns the widget used for the local frame root.
-  RenderWidget* render_widget() { return render_widget_; }
-
   void SynchronizeVisualProperties();
 
   const gfx::Rect& screen_space_rect() const {
@@ -291,7 +289,7 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
 
   // Provides the mojo interface to this RenderFrameProxy's
   // RenderFrameProxyHost.
-  mojom::RenderFrameProxyHostAssociatedPtr frame_proxy_host_ptr_;
+  mojo::AssociatedRemote<mojom::RenderFrameProxyHost> frame_proxy_host_remote_;
   std::unique_ptr<blink::AssociatedInterfaceProvider>
       remote_associated_interfaces_;
 
@@ -299,7 +297,11 @@ class CONTENT_EXPORT RenderFrameProxy : public IPC::Listener,
   std::unique_ptr<ChildFrameCompositingHelper> compositing_helper_;
 
   RenderViewImpl* render_view_;
-  RenderWidget* render_widget_;
+
+  // The widget used for the local frame root. Can be nullptr if there
+  // is no local frame root. This happens for main frame proxies or subframes of
+  // main frame proxies.
+  RenderWidget* render_widget_ = nullptr;
 
   // Contains token to be used as a frame id in the devtools protocol.
   // It is derived from the content's devtools_frame_token, is
diff --git a/chromium/content/renderer/render_thread_impl.cc b/chromium/content/renderer/render_thread_impl.cc
index f133e1651a2..e2cb076d3a6 100644
--- a/chromium/content/renderer/render_thread_impl.cc
+++ b/chromium/content/renderer/render_thread_impl.cc
@@ -49,8 +49,8 @@
 #include "cc/mojo_embedder/async_layer_tree_frame_sink.h"
 #include "cc/raster/task_graph_runner.h"
 #include "cc/trees/layer_tree_frame_sink.h"
-#include "cc/trees/layer_tree_host_common.h"
 #include "cc/trees/layer_tree_settings.h"
+#include "cc/trees/ukm_manager.h"
 #include "components/discardable_memory/client/client_discardable_shared_memory_manager.h"
 #include "components/metrics/public/mojom/single_sample_metrics.mojom.h"
 #include "components/metrics/single_sample_metrics.h"
@@ -63,6 +63,7 @@
 #include "content/child/thread_safe_sender.h"
 #include "content/common/buildflags.h"
 #include "content/common/content_constants_internal.h"
+#include "content/common/frame.mojom.h"
 #include "content/common/frame_messages.h"
 #include "content/common/frame_owner_properties.h"
 #include "content/common/view_messages.h"
@@ -91,11 +92,8 @@
 #include "content/renderer/media/audio/audio_renderer_mixer_manager.h"
 #include "content/renderer/media/gpu/gpu_video_accelerator_factories_impl.h"
 #include "content/renderer/media/render_media_client.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
 #include "content/renderer/media/webrtc/peer_connection_tracker.h"
-#include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
 #include "content/renderer/net_info_helper.h"
-#include "content/renderer/p2p/socket_dispatcher.h"
 #include "content/renderer/render_frame_proxy.h"
 #include "content/renderer/render_process_impl.h"
 #include "content/renderer/render_view_impl.h"
@@ -122,8 +120,10 @@
 #include "media/base/media_switches.h"
 #include "media/media_buildflags.h"
 #include "media/video/gpu_video_accelerator_factories.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/system/message_pipe.h"
 #include "net/base/net_errors.h"
 #include "net/base/port_util.h"
@@ -132,7 +132,6 @@
 #include "ppapi/buildflags/buildflags.h"
 #include "services/metrics/public/cpp/mojo_ukm_recorder.h"
 #include "services/network/public/cpp/network_switches.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "services/viz/public/cpp/gpu/gpu.h"
@@ -150,6 +149,7 @@
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_document.h"
 #include "third_party/blink/public/web/web_frame.h"
+#include "third_party/blink/public/web/web_render_theme.h"
 #include "third_party/blink/public/web/web_script_controller.h"
 #include "third_party/blink/public/web/web_security_policy.h"
 #include "third_party/blink/public/web/web_view.h"
@@ -302,6 +302,15 @@ void AddCrashKey(v8::CrashKeyId id, const std::string& value) {
                                      bd::CrashKeySize::Size32);
       bd::SetCrashKeyString(code_space_firstpage_address, value);
       break;
+    case v8::CrashKeyId::kDumpType:
+      static bd::CrashKeyString* dump_type =
+          bd::AllocateCrashKeyString("dump-type", bd::CrashKeySize::Size32);
+      bd::SetCrashKeyString(dump_type, value);
+      break;
+    default:
+      // Doing nothing for new keys is a valid option. Having this case allows
+      // to introduce new CrashKeyId's without triggering a build break.
+      break;
   }
 }
 
@@ -312,8 +321,9 @@ class FrameFactoryImpl : public mojom::FrameFactory {
 
  private:
   // mojom::FrameFactory:
-  void CreateFrame(int32_t frame_routing_id,
-                   mojom::FrameRequest frame_request) override {
+  void CreateFrame(
+      int32_t frame_routing_id,
+      mojo::PendingReceiver<mojom::Frame> frame_receiver) override {
     // TODO(morrita): This is for investigating http://crbug.com/415059 and
     // should be removed once it is fixed.
     CHECK_LT(routing_id_highmark_, frame_routing_id);
@@ -326,11 +336,11 @@ class FrameFactoryImpl : public mojom::FrameFactory {
     // we want.
     if (!frame) {
       RenderThreadImpl::current()->RegisterPendingFrameCreate(
-          source_info_, frame_routing_id, std::move(frame_request));
+          source_info_, frame_routing_id, std::move(frame_receiver));
       return;
     }
 
-    frame->BindFrame(source_info_, std::move(frame_request));
+    frame->BindFrame(source_info_, std::move(frame_receiver));
   }
 
  private:
@@ -338,10 +348,10 @@ class FrameFactoryImpl : public mojom::FrameFactory {
   int32_t routing_id_highmark_;
 };
 
-void CreateFrameFactory(mojom::FrameFactoryRequest request,
+void CreateFrameFactory(mojo::PendingReceiver<mojom::FrameFactory> receiver,
                         const service_manager::BindSourceInfo& source_info) {
-  mojo::MakeStrongBinding(std::make_unique<FrameFactoryImpl>(source_info),
-                          std::move(request));
+  mojo::MakeSelfOwnedReceiver(std::make_unique<FrameFactoryImpl>(source_info),
+                              std::move(receiver));
 }
 
 scoped_refptr<viz::ContextProviderCommandBuffer> CreateOffscreenContext(
@@ -392,8 +402,9 @@ scoped_refptr<viz::ContextProviderCommandBuffer> CreateOffscreenContext(
 // connect from the renderer process to the browser process.
 void CreateSingleSampleMetricsProvider(
     mojo::SharedRemote<mojom::ChildProcessHost> process_host,
-    metrics::mojom::SingleSampleMetricsProviderRequest request) {
-  process_host->BindHostReceiver(std::move(request));
+    mojo::PendingReceiver<metrics::mojom::SingleSampleMetricsProvider>
+        receiver) {
+  process_host->BindHostReceiver(std::move(receiver));
 }
 
 // This factory is used to defer binding of the InterfacePtr to the compositor
@@ -472,7 +483,7 @@ class ResourceUsageReporterImpl : public content::mojom::ResourceUsageReporter {
       return;
     }
 
-    blink::WebCache::ResourceTypeStats stats;
+    blink::WebCacheResourceTypeStats stats;
     blink::WebCache::GetResourceTypeStats(&stats);
     usage_data_->web_cache_stats = mojom::ResourceTypeStats::From(stats);
 
@@ -512,10 +523,11 @@ class ResourceUsageReporterImpl : public content::mojom::ResourceUsageReporter {
   DISALLOW_COPY_AND_ASSIGN(ResourceUsageReporterImpl);
 };
 
-void CreateResourceUsageReporter(base::WeakPtr<RenderThread> thread,
-                                 mojom::ResourceUsageReporterRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<ResourceUsageReporterImpl>(thread),
-                          std::move(request));
+void CreateResourceUsageReporter(
+    base::WeakPtr<RenderThread> thread,
+    mojo::PendingReceiver<mojom::ResourceUsageReporter> receiver) {
+  mojo::MakeSelfOwnedReceiver(
+      std::make_unique<ResourceUsageReporterImpl>(thread), std::move(receiver));
 }
 
 }  // namespace
@@ -677,9 +689,7 @@ RenderThreadImpl::RenderThreadImpl(
                           .Build()),
       main_thread_scheduler_(std::move(scheduler)),
       categorized_worker_pool_(new CategorizedWorkerPool()),
-      renderer_binding_(this),
-      client_id_(1),
-      compositing_mode_watcher_binding_(this) {
+      client_id_(1) {
   TRACE_EVENT0("startup", "RenderThreadImpl::Create");
   Init();
 }
@@ -696,9 +706,7 @@ RenderThreadImpl::RenderThreadImpl(
                           .Build()),
       main_thread_scheduler_(std::move(scheduler)),
       categorized_worker_pool_(new CategorizedWorkerPool()),
-      is_scroll_animator_enabled_(false),
-      renderer_binding_(this),
-      compositing_mode_watcher_binding_(this) {
+      is_scroll_animator_enabled_(false) {
   TRACE_EVENT0("startup", "RenderThreadImpl::Create");
   DCHECK(base::CommandLine::ForCurrentProcess()->HasSwitch(
       switches::kRendererClientId));
@@ -749,11 +757,6 @@ void RenderThreadImpl::Init() {
       new PeerConnectionTracker(main_thread_runner()));
   AddObserver(peer_connection_tracker_.get());
 
-  p2p_socket_dispatcher_ = new P2PSocketDispatcher();
-
-  peer_connection_factory_.reset(
-      new PeerConnectionDependencyFactory(p2p_socket_dispatcher_.get()));
-
   unfreezable_message_filter_ = new UnfreezableMessageFilter(this);
   AddFilter(unfreezable_message_filter_.get());
 
@@ -767,6 +770,23 @@ void RenderThreadImpl::Init() {
                                              weak_factory_.GetWeakPtr()),
                          base::ThreadTaskRunnerHandle::Get());
 
+  if (base::FeatureList::IsEnabled(
+          blink::features::kOffMainThreadServiceWorkerStartup)) {
+    auto task_runner = base::CreateSingleThreadTaskRunner(
+        {base::ThreadPool(), base::MayBlock(),
+         base::TaskPriority::USER_BLOCKING,
+         base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
+    registry->AddInterface(
+        base::BindRepeating(&EmbeddedWorkerInstanceClientImpl::CreateForRequest,
+                            task_runner),
+        task_runner);
+  } else {
+    registry->AddInterface(
+        base::BindRepeating(&EmbeddedWorkerInstanceClientImpl::CreateForRequest,
+                            GetWebMainThreadScheduler()->DefaultTaskRunner()),
+        GetWebMainThreadScheduler()->DefaultTaskRunner());
+  }
+
   GetServiceManagerConnection()->AddConnectionFilter(
       std::make_unique<SimpleConnectionFilter>(std::move(registry)));
 
@@ -791,7 +811,7 @@ void RenderThreadImpl::Init() {
   StartServiceManagerConnection();
 
   GetAssociatedInterfaceRegistry()->AddInterface(base::BindRepeating(
-      &RenderThreadImpl::OnRendererInterfaceRequest, base::Unretained(this)));
+      &RenderThreadImpl::OnRendererInterfaceReceiver, base::Unretained(this)));
 
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
@@ -916,13 +936,14 @@ void RenderThreadImpl::Init() {
 #endif
   categorized_worker_pool_->Start(num_raster_threads);
 
-  discardable_memory::mojom::DiscardableSharedMemoryManagerPtr manager_ptr;
-  ChildThread::Get()->GetConnector()->BindInterface(
-      mojom::kBrowserServiceName, mojo::MakeRequest(&manager_ptr));
+  mojo::PendingRemote<discardable_memory::mojom::DiscardableSharedMemoryManager>
+      manager_remote;
+  ChildThread::Get()->BindHostReceiver(
+      manager_remote.InitWithNewPipeAndPassReceiver());
 
   discardable_shared_memory_manager_ = std::make_unique<
       discardable_memory::ClientDiscardableSharedMemoryManager>(
-      std::move(manager_ptr), GetIOTaskRunner());
+      std::move(manager_remote), GetIOTaskRunner());
 
   // TODO(boliu): In single process, browser main loop should set up the
   // discardable memory manager, and should skip this if kSingleProcess.
@@ -942,17 +963,13 @@ void RenderThreadImpl::Init() {
   needs_to_record_first_active_paint_ = false;
   was_backgrounded_time_ = base::TimeTicks::Min();
 
-  BindHostReceiver(mojo::MakeRequest(&frame_sink_provider_));
+  BindHostReceiver(frame_sink_provider_.BindNewPipeAndPassReceiver());
 
   if (!is_gpu_compositing_disabled_) {
     BindHostReceiver(mojo::MakeRequest(&compositing_mode_reporter_));
 
-    // Make |this| a CompositingModeWatcher for the
-    // |compositing_mode_reporter_|.
-    viz::mojom::CompositingModeWatcherPtr watcher_ptr;
-    compositing_mode_watcher_binding_.Bind(mojo::MakeRequest(&watcher_ptr));
     compositing_mode_reporter_->AddCompositingModeWatcher(
-        std::move(watcher_ptr));
+        compositing_mode_watcher_receiver_.BindNewPipeAndPassRemote());
   }
 }
 
@@ -1066,7 +1083,7 @@ void RenderThreadImpl::AddRoute(int32_t routing_id, IPC::Listener* listener) {
       frame->GetTaskRunner(blink::TaskType::kInternalNavigationAssociated));
 
   scoped_refptr<PendingFrameCreate> create(it->second);
-  frame->BindFrame(it->second->browser_info(), it->second->TakeFrameRequest());
+  frame->BindFrame(it->second->browser_info(), it->second->TakeFrameReceiver());
   pending_frame_creates_.erase(it);
 }
 
@@ -1078,11 +1095,12 @@ void RenderThreadImpl::RemoveRoute(int32_t routing_id) {
 void RenderThreadImpl::RegisterPendingFrameCreate(
     const service_manager::BindSourceInfo& browser_info,
     int routing_id,
-    mojom::FrameRequest frame_request) {
+    mojo::PendingReceiver<mojom::Frame> frame_receiver) {
   std::pair<PendingFrameCreateMap::iterator, bool> result =
       pending_frame_creates_.insert(std::make_pair(
-          routing_id, base::MakeRefCounted<PendingFrameCreate>(
-                          browser_info, routing_id, std::move(frame_request))));
+          routing_id,
+          base::MakeRefCounted<PendingFrameCreate>(browser_info, routing_id,
+                                                   std::move(frame_receiver))));
   CHECK(result.second) << "Inserting a duplicate item.";
 }
 
@@ -1526,6 +1544,13 @@ RenderThreadImpl::GetCompositorImplThreadTaskRunner() {
   return compositor_task_runner_;
 }
 
+scoped_refptr<base::SingleThreadTaskRunner>
+RenderThreadImpl::GetCleanupTaskRunner() {
+  return current_blink_platform_impl()
+      ->main_thread_scheduler()
+      ->CleanupTaskRunner();
+}
+
 gpu::GpuMemoryBufferManager* RenderThreadImpl::GetGpuMemoryBufferManager() {
   return gpu_->gpu_memory_buffer_manager();
 }
@@ -1832,13 +1857,14 @@ scoped_refptr<gpu::GpuChannelHost> RenderThreadImpl::EstablishGpuChannelSync() {
 }
 
 void RenderThreadImpl::RequestNewLayerTreeFrameSink(
-    int widget_routing_id,
+    RenderWidget* render_widget,
     scoped_refptr<FrameSwapMessageQueue> frame_swap_message_queue,
     const GURL& url,
     LayerTreeFrameSinkCallback callback,
-    mojom::RenderFrameMetadataObserverClientRequest
-        render_frame_metadata_observer_client_request,
-    mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer_ptr,
+    mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+        render_frame_metadata_observer_client_receiver,
+    mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+        render_frame_metadata_observer_remote,
     const char* client_name) {
   // Misconfigured bots (eg. crbug.com/780757) could run web tests on a
   // machine where gpu compositing doesn't work. Don't crash in that case.
@@ -1877,21 +1903,23 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
 
   params.client_name = client_name;
 
-  viz::mojom::CompositorFrameSinkRequest compositor_frame_sink_request =
-      mojo::MakeRequest(&params.pipes.compositor_frame_sink_info);
-  viz::mojom::CompositorFrameSinkClientPtr compositor_frame_sink_client;
-  params.pipes.client_request =
-      mojo::MakeRequest(&compositor_frame_sink_client);
+  mojo::PendingReceiver<viz::mojom::CompositorFrameSink>
+      compositor_frame_sink_receiver = params.pipes.compositor_frame_sink_remote
+                                           .InitWithNewPipeAndPassReceiver();
+  mojo::PendingRemote<viz::mojom::CompositorFrameSinkClient>
+      compositor_frame_sink_client;
+  params.pipes.client_receiver =
+      compositor_frame_sink_client.InitWithNewPipeAndPassReceiver();
 
   if (is_gpu_compositing_disabled_) {
     DCHECK(!web_test_mode());
     frame_sink_provider_->CreateForWidget(
-        widget_routing_id, std::move(compositor_frame_sink_request),
+        render_widget->routing_id(), std::move(compositor_frame_sink_receiver),
         std::move(compositor_frame_sink_client));
     frame_sink_provider_->RegisterRenderFrameMetadataObserver(
-        widget_routing_id,
-        std::move(render_frame_metadata_observer_client_request),
-        std::move(render_frame_metadata_observer_ptr));
+        render_widget->routing_id(),
+        std::move(render_frame_metadata_observer_client_receiver),
+        std::move(render_frame_metadata_observer_remote));
     std::move(callback).Run(
         std::make_unique<cc::mojo_embedder::AsyncLayerTreeFrameSink>(
             nullptr, nullptr, &params));
@@ -1948,36 +1976,31 @@ void RenderThreadImpl::RequestNewLayerTreeFrameSink(
 
 #if defined(OS_ANDROID)
   if (GetContentClient()->UsingSynchronousCompositing()) {
-    RenderWidget* widget = RenderWidget::FromRoutingID(widget_routing_id);
-    if (widget) {
-      // TODO(ericrk): Collapse with non-webview registration below.
-      frame_sink_provider_->RegisterRenderFrameMetadataObserver(
-          widget_routing_id,
-          std::move(render_frame_metadata_observer_client_request),
-          std::move(render_frame_metadata_observer_ptr));
-
-      std::move(callback).Run(std::make_unique<SynchronousLayerTreeFrameSink>(
-          std::move(context_provider), std::move(worker_context_provider),
-          compositor_task_runner_, GetGpuMemoryBufferManager(),
-          sync_message_filter(), widget_routing_id,
-          g_next_layer_tree_frame_sink_id++,
-          std::move(params.synthetic_begin_frame_source),
-          widget->widget_input_handler_manager()
-              ->GetSynchronousCompositorRegistry(),
-          std::move(frame_swap_message_queue)));
-      return;
-    } else {
-      NOTREACHED();
-    }
+    // TODO(ericrk): Collapse with non-webview registration below.
+    frame_sink_provider_->RegisterRenderFrameMetadataObserver(
+        render_widget->routing_id(),
+        std::move(render_frame_metadata_observer_client_receiver),
+        std::move(render_frame_metadata_observer_remote));
+
+    std::move(callback).Run(std::make_unique<SynchronousLayerTreeFrameSink>(
+        std::move(context_provider), std::move(worker_context_provider),
+        compositor_task_runner_, GetGpuMemoryBufferManager(),
+        sync_message_filter(), render_widget->routing_id(),
+        g_next_layer_tree_frame_sink_id++,
+        std::move(params.synthetic_begin_frame_source),
+        render_widget->widget_input_handler_manager()
+            ->GetSynchronousCompositorRegistry(),
+        std::move(frame_swap_message_queue)));
+    return;
   }
 #endif
   frame_sink_provider_->CreateForWidget(
-      widget_routing_id, std::move(compositor_frame_sink_request),
+      render_widget->routing_id(), std::move(compositor_frame_sink_receiver),
       std::move(compositor_frame_sink_client));
   frame_sink_provider_->RegisterRenderFrameMetadataObserver(
-      widget_routing_id,
-      std::move(render_frame_metadata_observer_client_request),
-      std::move(render_frame_metadata_observer_ptr));
+      render_widget->routing_id(),
+      std::move(render_frame_metadata_observer_client_receiver),
+      std::move(render_frame_metadata_observer_remote));
   params.gpu_memory_buffer_manager = GetGpuMemoryBufferManager();
   std::move(callback).Run(
       std::make_unique<cc::mojo_embedder::AsyncLayerTreeFrameSink>(
@@ -1990,11 +2013,6 @@ RenderThreadImpl::GetAssociatedInterfaceRegistry() {
   return &associated_interfaces_;
 }
 
-PeerConnectionDependencyFactory*
-RenderThreadImpl::GetPeerConnectionDependencyFactory() {
-  return peer_connection_factory_.get();
-}
-
 mojom::RenderMessageFilter* RenderThreadImpl::render_message_filter() {
   if (!render_message_filter_)
     GetChannel()->GetRemoteAssociatedInterface(&render_message_filter_);
@@ -2048,7 +2066,7 @@ void RenderThreadImpl::CreateFrame(mojom::CreateFrameParamsPtr params) {
       std::move(browser_interface_broker), params->previous_routing_id,
       params->opener_routing_id, params->parent_routing_id,
       params->previous_sibling_routing_id, params->devtools_frame_token,
-      params->replication_state, compositor_deps, *params->widget_params,
+      params->replication_state, compositor_deps, params->widget_params.get(),
       params->frame_owner_properties, params->has_committed_real_load);
 }
 
@@ -2065,39 +2083,6 @@ void RenderThreadImpl::CreateFrameProxy(
       replicated_state, devtools_frame_token);
 }
 
-void StartEmbeddedWorkerInstanceClientOnThreadPool(
-    mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>
-        client_receiver,
-    scoped_refptr<base::SingleThreadTaskRunner> initiator_task_runner) {
-  DCHECK(initiator_task_runner->BelongsToCurrentThread());
-  EmbeddedWorkerInstanceClientImpl::Create(std::move(client_receiver),
-                                           std::move(initiator_task_runner));
-}
-
-void RenderThreadImpl::SetUpEmbeddedWorkerChannelForServiceWorker(
-    mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>
-        client_receiver) {
-  // TODO(bashi): This is a tentative workaround to start service worker on a
-  // background thread. We should decouple EmbeddedWorkerInstanceClient from
-  // Renderer and bind EmbeddedWorkerInstanceClient on a background thread.
-  if (base::FeatureList::IsEnabled(
-          blink::features::kOffMainThreadServiceWorkerStartup)) {
-    auto task_runner = base::CreateSingleThreadTaskRunner(
-        {base::ThreadPool(), base::MayBlock(),
-         base::TaskPriority::USER_BLOCKING,
-         base::TaskShutdownBehavior::SKIP_ON_SHUTDOWN});
-    task_runner->PostTask(
-        FROM_HERE,
-        base::BindOnce(&StartEmbeddedWorkerInstanceClientOnThreadPool,
-                       std::move(client_receiver), std::move(task_runner)));
-    return;
-  }
-
-  EmbeddedWorkerInstanceClientImpl::Create(
-      std::move(client_receiver),
-      GetWebMainThreadScheduler()->DefaultTaskRunner());
-}
-
 void RenderThreadImpl::OnNetworkConnectionChanged(
     net::NetworkChangeNotifier::ConnectionType type,
     double max_bandwidth_mbps) {
@@ -2181,6 +2166,7 @@ void RenderThreadImpl::UpdateSystemColorInfo(
   ui::NativeTheme::GetInstanceForWeb()->UpdateSystemColorInfo(
       params->is_dark_mode, params->is_high_contrast,
       params->preferred_color_scheme, params->colors);
+  blink::SystemColorsChanged();
 }
 
 void RenderThreadImpl::PurgePluginListCache(bool reload_pages) {
@@ -2388,10 +2374,10 @@ void RenderThreadImpl::ReleaseFreeMemory() {
 RenderThreadImpl::PendingFrameCreate::PendingFrameCreate(
     const service_manager::BindSourceInfo& browser_info,
     int routing_id,
-    mojom::FrameRequest frame_request)
+    mojo::PendingReceiver<mojom::Frame> frame_receiver)
     : browser_info_(browser_info),
       routing_id_(routing_id),
-      frame_request_(std::move(frame_request)) {}
+      frame_receiver_(std::move(frame_receiver)) {}
 
 RenderThreadImpl::PendingFrameCreate::~PendingFrameCreate() {
 }
@@ -2424,11 +2410,11 @@ void RenderThreadImpl::OnSyncMemoryPressure(
       v8_memory_pressure_level);
 }
 
-void RenderThreadImpl::OnRendererInterfaceRequest(
-    mojom::RendererAssociatedRequest request) {
-  DCHECK(!renderer_binding_.is_bound());
-  renderer_binding_.Bind(std::move(request),
-                         GetWebMainThreadScheduler()->IPCTaskRunner());
+void RenderThreadImpl::OnRendererInterfaceReceiver(
+    mojo::PendingAssociatedReceiver<mojom::Renderer> receiver) {
+  DCHECK(!renderer_receiver_.is_bound());
+  renderer_receiver_.Bind(std::move(receiver),
+                          GetWebMainThreadScheduler()->IPCTaskRunner());
 }
 
 bool RenderThreadImpl::NeedsToRecordFirstActivePaint(
diff --git a/chromium/content/renderer/render_thread_impl.h b/chromium/content/renderer/render_thread_impl.h
index 8c16f0c2693..7dfca92df2d 100644
--- a/chromium/content/renderer/render_thread_impl.h
+++ b/chromium/content/renderer/render_thread_impl.h
@@ -23,9 +23,7 @@
 #include "base/observer_list.h"
 #include "base/optional.h"
 #include "base/strings/string16.h"
-#include "base/threading/thread_checker.h"
 #include "base/time/time.h"
-#include "base/timer/timer.h"
 #include "build/build_config.h"
 #include "content/child/child_thread_impl.h"
 #include "content/common/content_export.h"
@@ -44,8 +42,12 @@
 #include "gpu/ipc/client/gpu_channel_host.h"
 #include "ipc/ipc_sync_channel.h"
 #include "media/media_buildflags.h"
-#include "mojo/public/cpp/bindings/associated_binding.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_associated_receiver.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
+#include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "mojo/public/cpp/bindings/thread_safe_interface_ptr.h"
 #include "net/base/network_change_notifier.h"
 #include "net/nqe/effective_connection_type.h"
@@ -61,10 +63,6 @@
 #include "third_party/blink/public/web/web_memory_statistics.h"
 #include "ui/gfx/native_widget_types.h"
 
-#if defined(OS_MACOSX)
-#include "third_party/blink/public/platform/mac/web_scrollbar_theme.h"
-#endif
-
 class SkBitmap;
 
 namespace blink {
@@ -77,8 +75,6 @@ class Thread;
 }
 
 namespace cc {
-class BeginFrameSource;
-class SyntheticBeginFrameSource;
 class TaskGraphRunner;
 }
 
@@ -90,20 +86,11 @@ namespace gpu {
 class GpuChannelHost;
 }
 
-namespace IPC {
-class MessageFilter;
-}
-
 namespace media {
 class GpuVideoAcceleratorFactories;
 }
 
-namespace v8 {
-class Extension;
-}
-
 namespace viz {
-class BeginFrameSource;
 class ContextProviderCommandBuffer;
 class Gpu;
 class RasterContextProvider;
@@ -116,8 +103,6 @@ class BrowserPluginManager;
 class CategorizedWorkerPool;
 class GpuVideoAcceleratorFactoriesImpl;
 class LowMemoryModeController;
-class P2PSocketDispatcher;
-class PeerConnectionDependencyFactory;
 class PeerConnectionTracker;
 class RenderThreadObserver;
 class RendererBlinkPlatformImpl;
@@ -227,18 +212,20 @@ class CONTENT_EXPORT RenderThreadImpl
   GetCompositorMainThreadTaskRunner() override;
   scoped_refptr<base::SingleThreadTaskRunner>
   GetCompositorImplThreadTaskRunner() override;
+  scoped_refptr<base::SingleThreadTaskRunner> GetCleanupTaskRunner() override;
   blink::scheduler::WebThreadScheduler* GetWebMainThreadScheduler() override;
   cc::TaskGraphRunner* GetTaskGraphRunner() override;
   bool IsScrollAnimatorEnabled() override;
   std::unique_ptr<cc::UkmRecorderFactory> CreateUkmRecorderFactory() override;
   void RequestNewLayerTreeFrameSink(
-      int widget_routing_id,
+      RenderWidget* render_widget,
       scoped_refptr<FrameSwapMessageQueue> frame_swap_message_queue,
       const GURL& url,
       LayerTreeFrameSinkCallback callback,
-      mojom::RenderFrameMetadataObserverClientRequest
-          render_frame_metadata_observer_client_request,
-      mojom::RenderFrameMetadataObserverPtr render_frame_metadata_observer_ptr,
+      mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+          render_frame_metadata_observer_client_receiver,
+      mojo::PendingRemote<mojom::RenderFrameMetadataObserver>
+          render_frame_metadata_observer_remote,
       const char* client_name) override;
 #ifdef OS_ANDROID
   bool UsingSynchronousCompositing() override;
@@ -304,18 +291,10 @@ class CONTENT_EXPORT RenderThreadImpl
     return browser_plugin_manager_.get();
   }
 
-  // Returns a factory used for creating RTC PeerConnection objects.
-  PeerConnectionDependencyFactory* GetPeerConnectionDependencyFactory();
-
   PeerConnectionTracker* peer_connection_tracker() {
     return peer_connection_tracker_.get();
   }
 
-  // Current P2PSocketDispatcher. Set to NULL if P2P API is disabled.
-  P2PSocketDispatcher* p2p_socket_dispatcher() {
-    return p2p_socket_dispatcher_.get();
-  }
-
   blink::WebVideoCaptureImplManager* video_capture_impl_manager() const {
     return vc_manager_.get();
   }
@@ -361,11 +340,6 @@ class CONTENT_EXPORT RenderThreadImpl
   // first call.
   AudioRendererMixerManager* GetAudioRendererMixerManager();
 
-#if defined(OS_WIN)
-  void PreCacheFontCharacters(const LOGFONT& log_font,
-                              const base::string16& str);
-#endif
-
   class UnfreezableMessageFilter : public IPC::MessageFilter {
    public:
     explicit UnfreezableMessageFilter(RenderThreadImpl* render_thread_impl);
@@ -448,7 +422,7 @@ class CONTENT_EXPORT RenderThreadImpl
   void RegisterPendingFrameCreate(
       const service_manager::BindSourceInfo& source_info,
       int routing_id,
-      mojom::FrameRequest frame);
+      mojo::PendingReceiver<mojom::Frame> frame);
 
   mojom::RendererHost* GetRendererHost();
 
@@ -516,9 +490,6 @@ class CONTENT_EXPORT RenderThreadImpl
       int32_t parent_routing_id,
       const FrameReplicationState& replicated_state,
       const base::UnguessableToken& devtools_frame_token) override;
-  void SetUpEmbeddedWorkerChannelForServiceWorker(
-      mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>
-          client_receiver) override;
   void OnNetworkConnectionChanged(
       net::NetworkChangeNotifier::ConnectionType type,
       double max_bandwidth_mbps) override;
@@ -567,7 +538,8 @@ class CONTENT_EXPORT RenderThreadImpl
   std::unique_ptr<viz::SyntheticBeginFrameSource>
   CreateSyntheticBeginFrameSource();
 
-  void OnRendererInterfaceRequest(mojom::RendererAssociatedRequest request);
+  void OnRendererInterfaceReceiver(
+      mojo::PendingAssociatedReceiver<mojom::Renderer> receiver);
 
   std::unique_ptr<discardable_memory::ClientDiscardableSharedMemoryManager>
       discardable_shared_memory_manager_;
@@ -580,15 +552,10 @@ class CONTENT_EXPORT RenderThreadImpl
 
   std::unique_ptr<BrowserPluginManager> browser_plugin_manager_;
 
-  std::unique_ptr<PeerConnectionDependencyFactory> peer_connection_factory_;
-
   // This is used to communicate to the browser process the status
   // of all the peer connections created in the renderer.
   std::unique_ptr<PeerConnectionTracker> peer_connection_tracker_;
 
-  // Dispatches all P2P sockets.
-  scoped_refptr<P2PSocketDispatcher> p2p_socket_dispatcher_;
-
   // Filter out unfreezable messages and pass it to unfreezable task runners.
   scoped_refptr<UnfreezableMessageFilter> unfreezable_message_filter_;
 
@@ -685,12 +652,14 @@ class CONTENT_EXPORT RenderThreadImpl
    public:
     PendingFrameCreate(const service_manager::BindSourceInfo& source_info,
                        int routing_id,
-                       mojom::FrameRequest frame_request);
+                       mojo::PendingReceiver<mojom::Frame> frame_receiver);
 
     const service_manager::BindSourceInfo& browser_info() const {
       return browser_info_;
     }
-    mojom::FrameRequest TakeFrameRequest() { return std::move(frame_request_); }
+    mojo::PendingReceiver<mojom::Frame> TakeFrameReceiver() {
+      return std::move(frame_receiver_);
+    }
 
    private:
     friend class base::RefCounted<PendingFrameCreate>;
@@ -702,7 +671,7 @@ class CONTENT_EXPORT RenderThreadImpl
 
     service_manager::BindSourceInfo browser_info_;
     int routing_id_;
-    mojom::FrameRequest frame_request_;
+    mojo::PendingReceiver<mojom::Frame> frame_receiver_;
   };
 
   using PendingFrameCreateMap =
@@ -713,7 +682,7 @@ class CONTENT_EXPORT RenderThreadImpl
 
   blink::AssociatedInterfaceRegistry associated_interfaces_;
 
-  mojo::AssociatedBinding<mojom::Renderer> renderer_binding_;
+  mojo::AssociatedReceiver<mojom::Renderer> renderer_receiver_{this};
 
   mojom::RenderMessageFilterAssociatedPtr render_message_filter_;
 
@@ -725,14 +694,14 @@ class CONTENT_EXPORT RenderThreadImpl
 
   int32_t client_id_;
 
-  mojom::FrameSinkProviderPtr frame_sink_provider_;
+  mojo::Remote<mojom::FrameSinkProvider> frame_sink_provider_;
 
   // A mojo connection to the CompositingModeReporter service.
   viz::mojom::CompositingModeReporterPtr compositing_mode_reporter_;
   // The class is a CompositingModeWatcher, which is bound to mojo through
   // this member.
-  mojo::Binding<viz::mojom::CompositingModeWatcher>
-      compositing_mode_watcher_binding_;
+  mojo::Receiver<viz::mojom::CompositingModeWatcher>
+      compositing_mode_watcher_receiver_{this};
 
   base::WeakPtrFactory<RenderThreadImpl> weak_factory_{this};
 
diff --git a/chromium/content/renderer/render_thread_impl_browsertest.cc b/chromium/content/renderer/render_thread_impl_browsertest.cc
index 2fa4fee2538..91dab8b2038 100644
--- a/chromium/content/renderer/render_thread_impl_browsertest.cc
+++ b/chromium/content/renderer/render_thread_impl_browsertest.cc
@@ -23,6 +23,7 @@
 #include "base/strings/string_number_conversions.h"
 #include "base/task/post_task.h"
 #include "base/task/thread_pool/thread_pool_instance.h"
+#include "base/test/test_switches.h"
 #include "base/threading/sequenced_task_runner_handle.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/app/mojo/mojo_init.h"
@@ -227,7 +228,7 @@ class RenderThreadImplBrowserTest : public testing::Test {
 
   void TearDown() override {
     if (base::CommandLine::ForCurrentProcess()->HasSwitch(
-            kSingleProcessTestsFlag)) {
+            switches::kSingleProcessTests)) {
       // In a single-process mode, we need to avoid destructing mock_process_
       // because it will call _exit(0) and kill the process before the browser
       // side is ready to exit.
@@ -453,7 +454,7 @@ class RenderThreadImplGpuMemoryBufferBrowserTest
   }
 
   void SetUpOnMainThread() override {
-    NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+    EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
     PostTaskToInProcessRendererAndWait(base::BindOnce(
         &RenderThreadImplGpuMemoryBufferBrowserTest::SetUpOnRenderThread,
         base::Unretained(this)));
diff --git a/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc b/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
index 179c98fd333..bdb4f38269b 100644
--- a/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
+++ b/chromium/content/renderer/render_thread_impl_discardable_memory_browsertest.cc
@@ -42,7 +42,7 @@ class RenderThreadImplDiscardableMemoryBrowserTest : public ContentBrowserTest {
   }
 
   void SetUpOnMainThread() override {
-    NavigateToURL(shell(), GURL(url::kAboutBlankURL));
+    EXPECT_TRUE(NavigateToURL(shell(), GURL(url::kAboutBlankURL)));
     PostTaskToInProcessRendererAndWait(base::BindOnce(
         &RenderThreadImplDiscardableMemoryBrowserTest::SetUpOnRenderThread,
         base::Unretained(this)));
diff --git a/chromium/content/renderer/render_view_browsertest.cc b/chromium/content/renderer/render_view_browsertest.cc
index ad387b274ae..d7a24077342 100644
--- a/chromium/content/renderer/render_view_browsertest.cc
+++ b/chromium/content/renderer/render_view_browsertest.cc
@@ -37,7 +37,6 @@
 #include "content/public/browser/web_ui_controller_factory.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/content_switches.h"
-#include "content/public/common/page_zoom.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "content/public/common/use_zoom_for_dsf_policy.h"
@@ -70,6 +69,7 @@
 #include "third_party/blink/public/common/dom_storage/session_storage_namespace_id.h"
 #include "third_party/blink/public/common/origin_trials/origin_trial_policy.h"
 #include "third_party/blink/public/common/origin_trials/trial_token_validator.h"
+#include "third_party/blink/public/common/page/page_zoom.h"
 #include "third_party/blink/public/mojom/loader/request_context_frame_type.mojom.h"
 #include "third_party/blink/public/platform/modules/service_worker/web_service_worker_network_provider.h"
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
@@ -425,14 +425,10 @@ class RenderViewImplTest : public RenderViewTest {
     return view()->preferred_size_;
   }
 
-  void SetZoomLevel(double level) { view()->UpdateZoomLevel(level); }
-
-  double GetZoomLevel() { return view()->page_zoom_level(); }
-
   int GetScrollbarWidth() {
     blink::WebView* webview = view()->webview();
     return webview->MainFrameWidget()->Size().width -
-           webview->MainFrame()->VisibleContentRect().width;
+           webview->MainFrame()->ToWebLocalFrame()->VisibleContentRect().width;
   }
 
  private:
@@ -468,6 +464,16 @@ class RenderViewImplScaleFactorTest : public RenderViewImplTest {
   }
 
   void SetDeviceScaleFactor(float dsf) {
+    RenderWidget* widget = view()->GetWidget();
+    WidgetMsg_UpdateVisualProperties msg(
+        widget->routing_id(), MakeVisualPropertiesWithDeviceScaleFactor(dsf));
+    widget->OnMessageReceived(msg);
+
+    ASSERT_EQ(dsf, view()->GetMainRenderFrame()->GetDeviceScaleFactor());
+    ASSERT_EQ(dsf, widget->GetOriginalScreenInfo().device_scale_factor);
+  }
+
+  VisualProperties MakeVisualPropertiesWithDeviceScaleFactor(float dsf) {
     VisualProperties visual_properties;
     visual_properties.screen_info.device_scale_factor = dsf;
     visual_properties.new_size = gfx::Size(100, 100);
@@ -485,10 +491,7 @@ class RenderViewImplScaleFactorTest : public RenderViewImplTest {
         viz::LocalSurfaceIdAllocation(
             viz::LocalSurfaceId(1, 1, base::UnguessableToken::Create()),
             base::TimeTicks::Now());
-    view()->GetWidget()->OnSynchronizeVisualProperties(visual_properties);
-    ASSERT_EQ(dsf, view()->GetWidget()->GetWebScreenInfo().device_scale_factor);
-    ASSERT_EQ(dsf,
-              view()->GetWidget()->GetOriginalScreenInfo().device_scale_factor);
+    return visual_properties;
   }
 
   void TestEmulatedSizeDprDsf(int width, int height, float dpr,
@@ -620,6 +623,124 @@ TEST_F(RenderViewImplTest, OnNavStateChanged) {
       FrameHostMsg_UpdateState::ID));
 }
 
+class RenderViewImplEmulatingPopupTest : public RenderViewImplTest {
+ protected:
+  VisualProperties InitialVisualProperties() override {
+    VisualProperties visual_properties =
+        RenderViewImplTest::InitialVisualProperties();
+    visual_properties.screen_info.rect = gfx::Rect(800, 600);
+    return visual_properties;
+  }
+};
+
+// Popup RenderWidgets should inherit emulation params from the parent.
+TEST_F(RenderViewImplEmulatingPopupTest, EmulatingPopupRect) {
+  // Real screen rect set to 800x600.
+  gfx::Rect screen_rect(800, 600);
+  // Real widget and window screen rects.
+  gfx::Rect window_screen_rect(1, 2, 137, 139);
+  gfx::Rect widget_screen_rect(5, 7, 57, 59);
+
+  // Verify screen rect will be set.
+  EXPECT_EQ(gfx::Rect(view()->GetWidget()->GetScreenInfo().rect), screen_rect);
+
+  {
+    // Make a popup widget.
+    blink::WebPagePopup* popup = view()->CreatePopup(frame()->GetWebFrame());
+    RenderWidget* popup_widget =
+        static_cast<RenderWidget*>(popup->GetClientForTesting());
+    ASSERT_TRUE(popup_widget);
+
+    // Set its size.
+    {
+      WidgetMsg_UpdateScreenRects msg(popup_widget->routing_id(),
+                                      widget_screen_rect, window_screen_rect);
+      popup_widget->OnMessageReceived(msg);
+    }
+
+    // The WindowScreenRect, WidgetScreenRect, and ScreenRect are all available
+    // to the popup.
+    EXPECT_EQ(window_screen_rect, gfx::Rect(popup_widget->WindowRect()));
+    EXPECT_EQ(widget_screen_rect, gfx::Rect(popup_widget->ViewRect()));
+    EXPECT_EQ(screen_rect, gfx::Rect(popup_widget->GetScreenInfo().rect));
+
+    // Close and destroy the widget.
+    {
+      WidgetMsg_Close msg(popup_widget->routing_id());
+      popup_widget->OnMessageReceived(msg);
+    }
+  }
+
+  // Enable device emulation on the parent widget.
+  blink::WebDeviceEmulationParams emulation_params;
+  gfx::Rect emulated_widget_rect(150, 160, 980, 1200);
+  // In mobile emulation the WindowScreenRect and ScreenRect are both set to
+  // match the WidgetScreenRect, which we set here.
+  emulation_params.screen_position = blink::WebDeviceEmulationParams::kMobile;
+  emulation_params.view_size = emulated_widget_rect.size();
+  emulation_params.view_position = emulated_widget_rect.origin();
+  {
+    WidgetMsg_EnableDeviceEmulation msg(view()->GetWidget()->routing_id(),
+                                        emulation_params);
+    view()->GetWidget()->OnMessageReceived(msg);
+  }
+
+  {
+    // Make a popup again. It should inherit device emulation params.
+    blink::WebPagePopup* popup = view()->CreatePopup(frame()->GetWebFrame());
+    RenderWidget* popup_widget =
+        static_cast<RenderWidget*>(popup->GetClientForTesting());
+    ASSERT_TRUE(popup_widget);
+
+    // Set its size again.
+    {
+      WidgetMsg_UpdateScreenRects msg(popup_widget->routing_id(),
+                                      widget_screen_rect, window_screen_rect);
+      popup_widget->OnMessageReceived(msg);
+    }
+
+    // This time, the position of the WidgetScreenRect and WindowScreenRect
+    // should be affected by emulation params.
+    // TODO(danakj): This means the popup sees the top level widget at the
+    // emulated position *plus* the real position. Whereas the top level
+    // widget will see itself at the emulation position. Why this inconsistency?
+    int window_x = emulated_widget_rect.x() + window_screen_rect.x();
+    int window_y = emulated_widget_rect.y() + window_screen_rect.y();
+    EXPECT_EQ(window_x, popup_widget->WindowRect().x);
+    EXPECT_EQ(window_y, popup_widget->WindowRect().y);
+
+    int widget_x = emulated_widget_rect.x() + widget_screen_rect.x();
+    int widget_y = emulated_widget_rect.y() + widget_screen_rect.y();
+    EXPECT_EQ(widget_x, popup_widget->ViewRect().x);
+    EXPECT_EQ(widget_y, popup_widget->ViewRect().y);
+
+    // TODO(danakj): Why don't the sizes get changed by emulation? The comments
+    // that used to be in this test suggest that the sizes used to change, and
+    // we were testing for that. But now we only test for positions changing?
+    EXPECT_EQ(window_screen_rect.width(), popup_widget->WindowRect().width);
+    EXPECT_EQ(window_screen_rect.height(), popup_widget->WindowRect().height);
+    EXPECT_EQ(widget_screen_rect.width(), popup_widget->ViewRect().width);
+    EXPECT_EQ(widget_screen_rect.height(), popup_widget->ViewRect().height);
+    EXPECT_EQ(emulated_widget_rect, gfx::Rect(view()->GetWidget()->ViewRect()));
+    EXPECT_EQ(emulated_widget_rect,
+              gfx::Rect(view()->GetWidget()->WindowRect()));
+
+    // TODO(danakj): Why isn't the ScreenRect visible to the popup an emulated
+    // value? The ScreenRect has been changed by emulation as demonstrated
+    // below.
+    EXPECT_EQ(gfx::Rect(800, 600),
+              gfx::Rect(popup_widget->GetScreenInfo().rect));
+    EXPECT_EQ(emulated_widget_rect,
+              gfx::Rect(view()->GetWidget()->GetScreenInfo().rect));
+
+    // Close and destroy the widget.
+    {
+      WidgetMsg_Close msg(popup_widget->routing_id());
+      popup_widget->OnMessageReceived(msg);
+    }
+  }
+}
+
 TEST_F(RenderViewImplTest, OnNavigationHttpPost) {
   // An http url will trigger a resource load so cannot be used here.
   auto common_params = CreateCommonNavigationParams();
@@ -859,73 +980,6 @@ TEST_F(RenderViewImplTest, BeginNavigationForWebUI) {
       FrameHostMsg_OpenURL::ID));
 }
 
-class AlwaysForkingRenderViewTest : public RenderViewImplTest {
- public:
-  ContentRendererClient* CreateContentRendererClient() override {
-    return new TestContentRendererClient;
-  }
-
- private:
-  class TestContentRendererClient : public ContentRendererClient {
-   public:
-    bool ShouldFork(blink::WebLocalFrame* frame,
-                    const GURL& url,
-                    const std::string& http_method,
-                    bool is_initial_navigation,
-                    bool is_server_redirect) override {
-      return true;
-    }
-  };
-};
-
-TEST_F(AlwaysForkingRenderViewTest, BeginNavigationDoesNotForkEmptyUrl) {
-  GURL example_url("http://example.com");
-  GURL empty_url("");
-
-  LoadHTMLWithUrlOverride("<body></body", example_url.spec().c_str());
-  EXPECT_EQ(example_url,
-            GURL(frame()->GetWebFrame()->GetDocumentLoader()->GetUrl()));
-
-  // Empty url should never fork.
-  blink::WebURLRequest request(empty_url);
-  request.SetMode(network::mojom::RequestMode::kNavigate);
-  request.SetRedirectMode(network::mojom::RedirectMode::kManual);
-  request.SetRequestContext(blink::mojom::RequestContextType::INTERNAL);
-  request.SetRequestorOrigin(blink::WebSecurityOrigin::Create(example_url));
-  auto navigation_info = std::make_unique<blink::WebNavigationInfo>();
-  navigation_info->url_request = request;
-  navigation_info->frame_type =
-      network::mojom::RequestContextFrameType::kTopLevel;
-  navigation_info->navigation_policy = blink::kWebNavigationPolicyCurrentTab;
-  frame()->BeginNavigation(std::move(navigation_info));
-  EXPECT_FALSE(render_thread_->sink().GetUniqueMessageMatching(
-      FrameHostMsg_OpenURL::ID));
-}
-
-TEST_F(AlwaysForkingRenderViewTest, BeginNavigationDoesNotForkAboutBlank) {
-  GURL example_url("http://example.com");
-  GURL blank_url(url::kAboutBlankURL);
-
-  LoadHTMLWithUrlOverride("<body></body", example_url.spec().c_str());
-  EXPECT_EQ(example_url,
-            GURL(frame()->GetWebFrame()->GetDocumentLoader()->GetUrl()));
-
-  // about:blank should never fork.
-  blink::WebURLRequest request(blank_url);
-  request.SetMode(network::mojom::RequestMode::kNavigate);
-  request.SetRedirectMode(network::mojom::RedirectMode::kManual);
-  request.SetRequestContext(blink::mojom::RequestContextType::INTERNAL);
-  request.SetRequestorOrigin(blink::WebSecurityOrigin::Create(example_url));
-  auto navigation_info = std::make_unique<blink::WebNavigationInfo>();
-  navigation_info->url_request = request;
-  navigation_info->frame_type =
-      network::mojom::RequestContextFrameType::kTopLevel;
-  navigation_info->navigation_policy = blink::kWebNavigationPolicyCurrentTab;
-  frame()->BeginNavigation(std::move(navigation_info));
-  EXPECT_FALSE(render_thread_->sink().GetUniqueMessageMatching(
-      FrameHostMsg_OpenURL::ID));
-}
-
 // This test verifies that when device emulation is enabled, RenderFrameProxy
 // continues to receive the original ScreenInfo and not the emualted
 // ScreenInfo.
@@ -955,8 +1009,7 @@ TEST_F(RenderViewImplScaleFactorTest, DeviceEmulationWithOOPIF) {
 
   // Verify that the system device scale factor has propagated into the
   // RenderFrameProxy.
-  EXPECT_EQ(device_scale,
-            view()->GetWidget()->GetWebScreenInfo().device_scale_factor);
+  EXPECT_EQ(device_scale, view()->GetMainRenderFrame()->GetDeviceScaleFactor());
   EXPECT_EQ(device_scale,
             view()->GetWidget()->GetOriginalScreenInfo().device_scale_factor);
   EXPECT_EQ(device_scale, child_proxy->screen_info().device_scale_factor);
@@ -964,7 +1017,7 @@ TEST_F(RenderViewImplScaleFactorTest, DeviceEmulationWithOOPIF) {
   TestEmulatedSizeDprDsf(640, 480, 3.f, compositor_dsf);
 
   // Verify that the RenderFrameProxy device scale factor is still the same.
-  EXPECT_EQ(3.f, view()->GetWidget()->GetWebScreenInfo().device_scale_factor);
+  EXPECT_EQ(3.f, view()->GetMainRenderFrame()->GetDeviceScaleFactor());
   EXPECT_EQ(device_scale,
             view()->GetWidget()->GetOriginalScreenInfo().device_scale_factor);
   EXPECT_EQ(device_scale, child_proxy->screen_info().device_scale_factor);
@@ -1021,10 +1074,15 @@ TEST_F(RenderViewImplTest, OriginReplicationForSwapOut) {
 TEST_F(RenderViewImplEnableZoomForDSFTest, UpdateDSFAfterSwapIn) {
   const float device_scale = 3.0f;
   SetDeviceScaleFactor(device_scale);
-  EXPECT_EQ(device_scale, view()->GetDeviceScaleFactor());
+  EXPECT_EQ(device_scale, view()->GetMainRenderFrame()->GetDeviceScaleFactor());
 
   LoadHTML("Hello world!");
 
+  // Early grab testing values as the main-frame widget becomes inaccessible
+  // when it swaps out.
+  VisualProperties test_visual_properties =
+      MakeVisualPropertiesWithDeviceScaleFactor(device_scale);
+
   // Swap the main frame out after which it should become a WebRemoteFrame.
   content::FrameReplicationState replication_state =
       ReconstructReplicationStateForTesting(frame());
@@ -1049,8 +1107,11 @@ TEST_F(RenderViewImplEnableZoomForDSFTest, UpdateDSFAfterSwapIn) {
       stub_browser_interface_broker;
   ignore_result(stub_browser_interface_broker.InitWithNewPipeAndPassReceiver());
 
+  // The new frame is initialized with |device_scale| as the device scale
+  // factor.
   mojom::CreateFrameWidgetParams widget_params;
-  widget_params.routing_id = view()->GetRoutingID();
+  widget_params.routing_id = kProxyRoutingId + 2;
+  widget_params.visual_properties = test_visual_properties;
   RenderFrameImpl::CreateFrame(
       routing_id, std::move(stub_interface_provider),
       std::move(stub_document_interface_broker_content),
@@ -1058,7 +1119,7 @@ TEST_F(RenderViewImplEnableZoomForDSFTest, UpdateDSFAfterSwapIn) {
       std::move(stub_browser_interface_broker), kProxyRoutingId,
       MSG_ROUTING_NONE, MSG_ROUTING_NONE, MSG_ROUTING_NONE,
       base::UnguessableToken::Create(), replication_state, nullptr,
-      widget_params, FrameOwnerProperties(), /*has_committed_real_load=*/true);
+      &widget_params, FrameOwnerProperties(), /*has_committed_real_load=*/true);
   TestRenderFrame* provisional_frame =
       static_cast<TestRenderFrame*>(RenderFrameImpl::FromRoutingID(routing_id));
   EXPECT_TRUE(provisional_frame);
@@ -1073,7 +1134,7 @@ TEST_F(RenderViewImplEnableZoomForDSFTest, UpdateDSFAfterSwapIn) {
                               CreateCommitNavigationParams());
   base::RunLoop().RunUntilIdle();
 
-  EXPECT_EQ(device_scale, view()->GetDeviceScaleFactor());
+  EXPECT_EQ(device_scale, view()->GetMainRenderFrame()->GetDeviceScaleFactor());
   EXPECT_EQ(device_scale, view()->webview()->ZoomFactorForDeviceScaleFactor());
 
   double device_pixel_ratio;
@@ -1124,8 +1185,6 @@ TEST_F(RenderViewImplTest, DetachingProxyAlsoDestroysProvisionalFrame) {
       stub_browser_interface_broker;
   ignore_result(stub_browser_interface_broker.InitWithNewPipeAndPassReceiver());
 
-  mojom::CreateFrameWidgetParams widget_params;
-  widget_params.routing_id = MSG_ROUTING_NONE;
   RenderFrameImpl::CreateFrame(
       routing_id, std::move(stub_interface_provider),
       std::move(stub_document_interface_broker_content),
@@ -1133,7 +1192,8 @@ TEST_F(RenderViewImplTest, DetachingProxyAlsoDestroysProvisionalFrame) {
       std::move(stub_browser_interface_broker), kProxyRoutingId,
       MSG_ROUTING_NONE, frame()->GetRoutingID(), MSG_ROUTING_NONE,
       base::UnguessableToken::Create(), replication_state, nullptr,
-      widget_params, FrameOwnerProperties(), /*has_committed_real_load=*/true);
+      /*widget_params=*/nullptr, FrameOwnerProperties(),
+      /*has_committed_real_load=*/true);
   {
     TestRenderFrame* provisional_frame = static_cast<TestRenderFrame*>(
         RenderFrameImpl::FromRoutingID(routing_id));
@@ -1526,7 +1586,7 @@ TEST_F(RenderViewImplTest, OnSetTextDirection) {
   }
 }
 
-TEST_F(RenderViewImplTest, DidFailProvisionalLoadWithErrorForCancellation) {
+TEST_F(RenderViewImplTest, DroppedNavigationStaysInViewSourceMode) {
   GetMainFrame()->EnableViewSourceMode(true);
   WebURLError error(net::ERR_ABORTED, GURL("http://foo"));
   WebLocalFrame* web_frame = GetMainFrame();
@@ -1539,7 +1599,7 @@ TEST_F(RenderViewImplTest, DidFailProvisionalLoadWithErrorForCancellation) {
   frame()->Navigate(std::move(common_params), CreateCommitNavigationParams());
 
   // A cancellation occurred.
-  view()->GetMainRenderFrame()->DidFailProvisionalLoad(error, "GET");
+  view()->GetMainRenderFrame()->OnDroppedNavigation();
   // Frame should stay in view-source mode.
   EXPECT_TRUE(web_frame->IsViewSourceModeEnabled());
 }
@@ -1999,7 +2059,6 @@ class RendererErrorPageTest : public RenderViewImplTest {
     void PrepareErrorPage(content::RenderFrame* render_frame,
                           const blink::WebURLError& error,
                           const std::string& http_method,
-                          bool ignoring_cache,
                           std::string* error_html) override {
       if (error_html)
         *error_html = "A suffusion of yellow.";
@@ -2008,7 +2067,6 @@ class RendererErrorPageTest : public RenderViewImplTest {
     void PrepareErrorPageForHttpStatusError(content::RenderFrame* render_frame,
                                             const GURL& unreachable_url,
                                             const std::string& http_method,
-                                            bool ignoring_cache,
                                             int http_status,
                                             std::string* error_html) override {
       if (error_html)
@@ -2345,7 +2403,7 @@ TEST_F(RenderViewImplTest, PreferredSizeZoomed) {
   gfx::Size size = GetPreferredSize();
   EXPECT_EQ(gfx::Size(400 + scrollbar_width, 400), size);
 
-  SetZoomLevel(ZoomFactorToZoomLevel(2.0));
+  EXPECT_TRUE(view()->SetZoomLevel(blink::PageZoomFactorToZoomLevel(2.0)));
   size = GetPreferredSize();
   EXPECT_EQ(gfx::Size(800 + scrollbar_width, 800), size);
 }
@@ -2725,14 +2783,13 @@ TEST_F(RenderViewImplScaleFactorTest, AutoResizeWithoutZoomForDSF) {
   EXPECT_EQ(size_at_1x, size_at_2x);
 }
 
-TEST_F(RenderViewImplScaleFactorTest, ZoomLevelUpdate) {
-  // 0 is the default zoom level, nothing will change.
-  SetZoomLevel(0);
-  EXPECT_NEAR(0.0, GetZoomLevel(), 0.01);
+TEST_F(RenderViewImplTest, ZoomLevelUpdate) {
+  // 0 will use the minimum zoom level, which is the default, nothing will
+  // change.
+  EXPECT_FALSE(view()->SetZoomLevel(0));
 
   // Change the zoom level to 25% and check if the view gets the change.
-  SetZoomLevel(content::ZoomFactorToZoomLevel(0.25));
-  EXPECT_NEAR(content::ZoomFactorToZoomLevel(0.25), GetZoomLevel(), 0.01);
+  EXPECT_TRUE(view()->SetZoomLevel(blink::PageZoomFactorToZoomLevel(0.25)));
 }
 
 #endif
diff --git a/chromium/content/renderer/render_view_browsertest_mac.mm b/chromium/content/renderer/render_view_browsertest_mac.mm
index 3be4c18342a..947e19d1536 100644
--- a/chromium/content/renderer/render_view_browsertest_mac.mm
+++ b/chromium/content/renderer/render_view_browsertest_mac.mm
@@ -147,40 +147,4 @@ TEST_F(RenderViewTest, MacTestCmdUp) {
   EXPECT_EQ(kArrowUpNoScroll, output);
 }
 
-// TODO(ekaramad): This test could be removed once we do not send irrelevant
-// IPCs from browser during the time RenderViewImpl is swapped out
-// (https://crbug.com/669219).
-// This test verfies that when RenderViewImpl is swapped out, handling IPCs
-// which need a WebFrameWidget will not lead to a crash.
-TEST_F(RenderViewTest, HandleIPCsInSwappedOutState) {
-  LoadHTML("<input/>");
-
-  // We have a WebFrameWidget on the root RenderWidget while a local main frame
-  // is attached.
-  EXPECT_TRUE(GetWebWidget());
-
-  // Swap out the main frame so that the frame widget is destroyed.
-  auto* view = static_cast<RenderViewImpl*>(view_);
-  auto* main_frame = view->GetMainRenderFrame();
-  main_frame->OnMessageReceived(UnfreezableFrameMsg_SwapOut(
-      main_frame->GetRoutingID(), 123, true, FrameReplicationState()));
-
-  // We no longer have a frame widget.
-  EXPECT_FALSE(GetWebWidget());
-
-  int routing_id = view->GetRoutingID();
-  // Now simulate some TextInputClientMac IPCs. These will be handled by
-  // RenderWidget which forwards them to the TextInputClientObserver
-  using Range = gfx::Range;
-  using Point = gfx::Point;
-  view->GetWidget()->OnMessageReceived(
-      TextInputClientMsg_CharacterIndexForPoint(routing_id, Point()));
-  view->GetWidget()->OnMessageReceived(
-      TextInputClientMsg_FirstRectForCharacterRange(routing_id, Range()));
-  view->GetWidget()->OnMessageReceived(
-      TextInputClientMsg_StringForRange(routing_id, Range()));
-  view->GetWidget()->OnMessageReceived(
-      TextInputClientMsg_CharacterIndexForPoint(routing_id, Point()));
-}
-
 }  // namespace content
diff --git a/chromium/content/renderer/render_view_impl.cc b/chromium/content/renderer/render_view_impl.cc
index 64aaf7e6949..16b6279b222 100644
--- a/chromium/content/renderer/render_view_impl.cc
+++ b/chromium/content/renderer/render_view_impl.cc
@@ -54,11 +54,9 @@
 #include "content/public/common/content_switches.h"
 #include "content/public/common/page_importance_signals.h"
 #include "content/public/common/page_state.h"
-#include "content/public/common/page_zoom.h"
 #include "content/public/common/referrer_type_converters.h"
 #include "content/public/common/three_d_api_types.h"
 #include "content/public/common/url_constants.h"
-#include "content/public/common/use_zoom_for_dsf_policy.h"
 #include "content/public/common/web_preferences.h"
 #include "content/public/renderer/content_renderer_client.h"
 #include "content/public/renderer/document_state.h"
@@ -74,7 +72,6 @@
 #include "content/renderer/internal_document_state_data.h"
 #include "content/renderer/loader/request_extra_data.h"
 #include "content/renderer/media/audio/audio_device_factory.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
 #include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
 #include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_frame_proxy.h"
@@ -90,6 +87,7 @@
 #include "media/media_buildflags.h"
 #include "media/renderers/audio_renderer_impl.h"
 #include "media/video/gpu_video_accelerator_factories.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "net/base/data_url.h"
 #include "net/base/escape.h"
 #include "net/base/net_errors.h"
@@ -101,6 +99,7 @@
 #include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/common/dom_storage/session_storage_namespace_id.h"
 #include "third_party/blink/public/common/frame/user_activation_update_source.h"
+#include "third_party/blink/public/common/plugin/plugin_action.h"
 #include "third_party/blink/public/platform/file_path_conversion.h"
 #include "third_party/blink/public/platform/modules/video_capture/web_video_capture_impl_manager.h"
 #include "third_party/blink/public/platform/url_conversion.h"
@@ -143,7 +142,6 @@
 #include "third_party/blink/public/web/web_page_importance_signals.h"
 #include "third_party/blink/public/web/web_page_popup.h"
 #include "third_party/blink/public/web/web_plugin.h"
-#include "third_party/blink/public/web/web_plugin_action.h"
 #include "third_party/blink/public/web/web_range.h"
 #include "third_party/blink/public/web/web_render_theme.h"
 #include "third_party/blink/public/web/web_script_source.h"
@@ -185,6 +183,7 @@
 #include "content/renderer/pepper/pepper_plugin_registry.h"
 #endif
 
+using blink::PluginAction;
 using blink::WebAXObject;
 using blink::WebConsoleMessage;
 using blink::WebData;
@@ -197,8 +196,8 @@ using blink::WebFrame;
 using blink::WebFrameContentDumper;
 using blink::WebGestureEvent;
 using blink::WebHistoryItem;
-using blink::WebHTTPBody;
 using blink::WebHitTestResult;
+using blink::WebHTTPBody;
 using blink::WebImage;
 using blink::WebInputElement;
 using blink::WebInputEvent;
@@ -207,9 +206,9 @@ using blink::WebMouseEvent;
 using blink::WebNavigationPolicy;
 using blink::WebNavigationType;
 using blink::WebNode;
-using blink::WebPluginAction;
 using blink::WebPoint;
 using blink::WebRect;
+using blink::WebRuntimeFeatures;
 using blink::WebSandboxFlags;
 using blink::WebScriptSource;
 using blink::WebSearchableFormData;
@@ -229,7 +228,6 @@ using blink::WebVector;
 using blink::WebView;
 using blink::WebWidget;
 using blink::WebWindowFeatures;
-using blink::WebRuntimeFeatures;
 
 namespace content {
 
@@ -460,6 +458,7 @@ RenderViewImpl::RenderViewImpl(CompositorDependencies* compositor_deps,
     : routing_id_(params.view_id),
       renderer_wide_named_frame_lookup_(
           params.renderer_wide_named_frame_lookup),
+      compositor_deps_(compositor_deps),
       webkit_preferences_(params.web_preferences),
       session_storage_namespace_id_(params.session_storage_namespace_id) {
   DCHECK(!session_storage_namespace_id_.empty())
@@ -473,6 +472,9 @@ void RenderViewImpl::Initialize(
     RenderWidget::ShowCallback show_callback,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
   DCHECK(RenderThread::IsMainThread());
+  // We have either a main frame or a proxy routing id.
+  DCHECK_NE(params->main_frame_routing_id != MSG_ROUTING_NONE,
+            params->proxy_routing_id != MSG_ROUTING_NONE);
 
   RenderThread::Get()->AddRoute(routing_id_, this);
 
@@ -491,37 +493,32 @@ void RenderViewImpl::Initialize(
   g_view_map.Get().insert(std::make_pair(webview(), this));
   g_routing_id_view_map.Get().insert(std::make_pair(GetRoutingID(), this));
 
-  webview()->SetDisplayMode(params->visual_properties.display_mode);
+  bool local_main_frame = params->main_frame_routing_id != MSG_ROUTING_NONE;
+
+  // TODO(danakj): Put this in with making the RenderFrame? Does order matter?
+  if (local_main_frame)
+    webview()->SetDisplayMode(params->visual_properties.display_mode);
 
   ApplyWebPreferences(webkit_preferences_, webview());
   ApplyCommandLineToSettings(webview()->GetSettings());
 
-  // We have either a main frame or a proxy routing id.
-  DCHECK_NE(params->main_frame_routing_id != MSG_ROUTING_NONE,
-            params->proxy_routing_id != MSG_ROUTING_NONE);
-
-  if (params->main_frame_routing_id != MSG_ROUTING_NONE) {
+  if (local_main_frame) {
     main_render_frame_ = RenderFrameImpl::CreateMainFrame(
         this, compositor_deps, opener_frame, &params, std::move(show_callback));
   } else {
     // TODO(https://crbug.com/995981): We should not need to create a
     // RenderWidget for a remote main frame.
-    render_widget_ = RenderWidget::CreateForFrame(
+    undead_render_widget_ = RenderWidget::CreateForFrame(
         params->main_frame_widget_routing_id, compositor_deps,
-        params->visual_properties.screen_info,
         params->visual_properties.display_mode,
-        /*is_frozen=*/params->main_frame_routing_id == MSG_ROUTING_NONE,
-        params->never_visible);
-    GetWidget()->set_delegate(this);
-    // Note: The GetWidget->Init() call causes an AddRef() to itself meaning
-    // that IPC system has taken conceptual ownership of the object. Though it
-    // is tempting to have RenderView retain the RenderWidget(), this lifecycle
-    // only requires single ownership and adding scoped_refptr<RenderWidget>
-    // muddies this unnecessarily -- especially since this RenderWidget should
-    // ultimately be own by the main frame.
-    // We intentionally pass in a null webwidget since it shouldn't be needed
-    // for remote frames.
-    GetWidget()->Init(std::move(show_callback), nullptr);
+        /*is_undead=*/true, params->never_visible);
+    undead_render_widget_->set_delegate(this);
+    // We intentionally pass in a null webwidget since it is not needed
+    // for remote frames, and we don't have one or a ScreenInfo until we have
+    // a local main frame.
+    undead_render_widget_->InitForMainFrame(std::move(show_callback),
+                                            /*web_frame_widget=*/nullptr,
+                                            /*screen_info=*/nullptr);
 
     RenderFrameProxy::CreateFrameProxy(params->proxy_routing_id, GetRoutingID(),
                                        opener_frame, MSG_ROUTING_NONE,
@@ -533,12 +530,9 @@ void RenderViewImpl::Initialize(
   if (params->window_was_created_with_opener)
     webview()->SetOpenedByDOM();
 
-  GetWidget()->UpdateWebViewWithDeviceScaleFactor();
   OnSetRendererPrefs(*params->renderer_preferences);
-  GetWidget()->OnSynchronizeVisualProperties(params->visual_properties);
 
   GetContentClient()->renderer()->RenderViewCreated(this);
-  page_zoom_level_ = 0;
 
   nav_state_sync_timer_.SetTaskRunner(task_runner);
 
@@ -560,7 +554,9 @@ void RenderViewImpl::Initialize(
 }
 
 RenderViewImpl::~RenderViewImpl() {
-  DCHECK(!frame_widget_);
+  DCHECK(destroying_);  // Always deleted through Destroy().
+
+  g_routing_id_view_map.Get().erase(routing_id_);
   RenderThread::Get()->RemoveRoute(routing_id_);
 
 #ifndef NDEBUG
@@ -923,7 +919,6 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,
 
   settings->SetLazyLoadEnabled(prefs.lazy_load_enabled);
   settings->SetPreferredColorScheme(prefs.preferred_color_scheme);
-  settings->SetForcedColors(prefs.forced_colors);
 
   for (const auto& ect_distance_pair :
        prefs.lazy_frame_loading_distance_thresholds_px) {
@@ -991,6 +986,31 @@ void RenderView::ApplyWebPreferences(const WebPreferences& prefs,
     NOTREACHED();
   }
 
+  for (const auto& fully_load_k_pair : prefs.lazy_image_first_k_fully_load) {
+    switch (fully_load_k_pair.first) {
+      case net::EFFECTIVE_CONNECTION_TYPE_OFFLINE:
+        continue;
+      case net::EFFECTIVE_CONNECTION_TYPE_UNKNOWN:
+        settings->SetLazyImageFirstKFullyLoadUnknown(fully_load_k_pair.second);
+        continue;
+      case net::EFFECTIVE_CONNECTION_TYPE_SLOW_2G:
+        settings->SetLazyImageFirstKFullyLoadSlow2G(fully_load_k_pair.second);
+        continue;
+      case net::EFFECTIVE_CONNECTION_TYPE_2G:
+        settings->SetLazyImageFirstKFullyLoad2G(fully_load_k_pair.second);
+        continue;
+      case net::EFFECTIVE_CONNECTION_TYPE_3G:
+        settings->SetLazyImageFirstKFullyLoad3G(fully_load_k_pair.second);
+        continue;
+      case net::EFFECTIVE_CONNECTION_TYPE_4G:
+        settings->SetLazyImageFirstKFullyLoad4G(fully_load_k_pair.second);
+        continue;
+      case net::EFFECTIVE_CONNECTION_TYPE_LAST:
+        continue;
+    }
+    NOTREACHED();
+  }
+
 #if defined(OS_MACOSX)
   web_view->SetMaximumLegibleScale(prefs.default_maximum_page_scale_factor);
 #endif
@@ -1024,7 +1044,12 @@ RenderViewImpl* RenderViewImpl::Create(
 }
 
 void RenderViewImpl::Destroy() {
-  GetWidget()->PrepareForClose();
+  destroying_ = true;
+
+  // If there is no local main frame, then destroying the WebView will not
+  // detach anything, and the RenderWidget will not be destroyed. So we have
+  // to do it here.
+  bool close_render_widget_here = !main_render_frame_;
 
   webview_->Close();
   // The webview_ is already destroyed by the time we get here, remove any
@@ -1032,9 +1057,14 @@ void RenderViewImpl::Destroy() {
   g_view_map.Get().erase(webview_);
   webview_ = nullptr;
 
-  GetWidget()->Close(std::move(render_widget_));
-
-  g_routing_id_view_map.Get().erase(GetRoutingID());
+  // We do this after WebView has closed, though it should not matter. WebView
+  // only uses the RenderWidget through WebWidgetClient that it accesses through
+  // a main frame. So it should not be able to see this happening when there is
+  // no local main frame.
+  if (close_render_widget_here) {
+    RenderWidget* closing_widget = undead_render_widget_.get();
+    closing_widget->CloseForFrame(std::move(undead_render_widget_));
+  }
 
   delete this;
 }
@@ -1066,13 +1096,6 @@ const blink::WebView* RenderViewImpl::webview() const {
 
 // RenderWidgetOwnerDelegate -----------------------------------------
 
-bool RenderViewImpl::RenderWidgetWillHandleMouseEventForWidget(
-    const blink::WebMouseEvent& event) {
-  // If the mouse is locked, only the current owner of the mouse lock can
-  // process mouse events.
-  return GetWidget()->mouse_lock_dispatcher()->WillHandleMouseEvent(event);
-}
-
 void RenderViewImpl::SetActiveForWidget(bool active) {
   if (webview())
     webview()->SetIsActive(active);
@@ -1096,7 +1119,7 @@ void RenderViewImpl::CancelPagePopupForWidget() {
 }
 
 void RenderViewImpl::ApplyNewDisplayModeForWidget(
-    const blink::WebDisplayMode& new_display_mode) {
+    blink::mojom::DisplayMode new_display_mode) {
   webview()->SetDisplayMode(new_display_mode);
 }
 
@@ -1111,7 +1134,8 @@ void RenderViewImpl::DisableAutoResizeForWidget() {
 
 void RenderViewImpl::ScrollFocusedNodeIntoViewForWidget() {
   if (WebLocalFrame* focused_frame = GetWebView()->FocusedFrame()) {
-    auto* frame_widget = focused_frame->LocalRoot()->FrameWidget();
+    blink::WebFrameWidget* frame_widget =
+        focused_frame->LocalRoot()->FrameWidget();
     frame_widget->ScrollFocusedEditableElementIntoView();
   }
 }
@@ -1242,7 +1266,6 @@ bool RenderViewImpl::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(ViewMsg_MoveOrResizeStarted, OnMoveOrResizeStarted)
     IPC_MESSAGE_HANDLER(ViewMsg_EnablePreferredSizeChangedMode,
                         OnEnablePreferredSizeChangedMode)
-    IPC_MESSAGE_HANDLER(ViewMsg_SetRendererPrefs, OnSetRendererPrefs)
     IPC_MESSAGE_HANDLER(ViewMsg_PluginActionAt, OnPluginActionAt)
     IPC_MESSAGE_HANDLER(ViewMsg_AnimateDoubleTapZoom,
                         OnAnimateDoubleTapZoomInMainFrame)
@@ -1255,7 +1278,6 @@ bool RenderViewImpl::OnMessageReceived(const IPC::Message& message) {
     IPC_MESSAGE_HANDLER(PageMsg_SetHistoryOffsetAndLength,
                         OnSetHistoryOffsetAndLength)
     IPC_MESSAGE_HANDLER(PageMsg_AudioStateChanged, OnAudioStateChanged)
-    IPC_MESSAGE_HANDLER(PageMsg_UpdateScreenInfo, OnUpdateScreenInfo)
     IPC_MESSAGE_HANDLER(PageMsg_UpdatePageVisualProperties,
                         OnUpdatePageVisualProperties)
     IPC_MESSAGE_HANDLER(PageMsg_SetPageFrozen, SetPageFrozen)
@@ -1265,6 +1287,7 @@ bool RenderViewImpl::OnMessageReceived(const IPC::Message& message) {
                         RestorePageFromBackForwardCache)
     IPC_MESSAGE_HANDLER(PageMsg_UpdateTextAutosizerPageInfoForRemoteMainFrames,
                         OnTextAutosizerPageInfoChanged)
+    IPC_MESSAGE_HANDLER(PageMsg_SetRendererPrefs, OnSetRendererPrefs)
 
     // Adding a new message? Add platform independent ones first, then put the
     // platform specific ones at the end.
@@ -1367,9 +1390,6 @@ WebView* RenderViewImpl::CreateView(
   // TODO(vangelis): Can we tell if the new view will be a background page?
   bool never_visible = false;
 
-  VisualProperties visual_properties = VisualProperties();
-  visual_properties.screen_info = GetWidget()->screen_info();
-
   // The initial hidden state for the RenderViewImpl here has to match what the
   // browser will eventually decide for the given disposition. Since we have to
   // return from this call synchronously, we just have to make our best guess
@@ -1406,7 +1426,7 @@ WebView* RenderViewImpl::CreateView(
   view_params->devtools_main_frame_token = reply->devtools_main_frame_token;
   view_params->hidden = is_background_tab;
   view_params->never_visible = never_visible;
-  view_params->visual_properties = visual_properties;
+  view_params->visual_properties = reply->visual_properties;
 
   // Unretained() is safe here because our calling function will also call
   // show().
@@ -1415,8 +1435,7 @@ WebView* RenderViewImpl::CreateView(
                      base::Unretained(creator_frame), opened_by_user_gesture);
 
   RenderViewImpl* view = RenderViewImpl::Create(
-      GetWidget()->compositor_deps(), std::move(view_params),
-      std::move(show_callback),
+      compositor_deps_, std::move(view_params), std::move(show_callback),
       creator->GetTaskRunner(blink::TaskType::kInternalDefault));
 
   return view->webview();
@@ -1424,9 +1443,9 @@ WebView* RenderViewImpl::CreateView(
 
 blink::WebPagePopup* RenderViewImpl::CreatePopup(
     blink::WebLocalFrame* creator) {
-  mojom::WidgetPtr widget_channel;
-  mojom::WidgetRequest widget_channel_request =
-      mojo::MakeRequest(&widget_channel);
+  mojo::PendingRemote<mojom::Widget> widget_channel;
+  mojo::PendingReceiver<mojom::Widget> widget_channel_receiver =
+      widget_channel.InitWithNewPipeAndPassReceiver();
 
   // Do a synchronous IPC to obtain a routing ID.
   int32_t widget_routing_id = MSG_ROUTING_NONE;
@@ -1441,21 +1460,14 @@ blink::WebPagePopup* RenderViewImpl::CreatePopup(
   RenderWidget::ShowCallback opener_callback = base::BindOnce(
       &RenderViewImpl::ShowCreatedPopupWidget, weak_ptr_factory_.GetWeakPtr());
 
-  // The RenderWidget associated with the RenderView. This should be the
-  // RenderWidget for the main frame, but may be a zombie RenderWidget when
-  // the main frame is remote (we don't need a RenderWidget for it then).
-  // However for now (https://crbug.com/419087) we know it exists and grab
-  // state off it for the popup.
-  // TODO(crbug.com/419087): This should probably be using the local root's
-  // RenderWidget for the frame making the popup.
-  RenderWidget* view_render_widget = GetWidget();
+  RenderWidget* opener_render_widget =
+      RenderFrameImpl::FromWebFrame(creator)->GetLocalRootRenderWidget();
 
   RenderWidget* popup_widget = RenderWidget::CreateForPopup(
-      widget_routing_id, view_render_widget->compositor_deps(),
-      view_render_widget->screen_info(), blink::kWebDisplayModeUndefined,
-      /*is_frozen=*/false,
+      widget_routing_id, opener_render_widget->compositor_deps(),
+      blink::mojom::DisplayMode::kUndefined,
       /*hidden=*/false,
-      /*never_visible=*/false, std::move(widget_channel_request));
+      /*never_visible=*/false, std::move(widget_channel_receiver));
 
   // The returned WebPagePopup is self-referencing, so the pointer here is not
   // an owning pointer. It is de-referenced by calling Close().
@@ -1465,17 +1477,14 @@ blink::WebPagePopup* RenderViewImpl::CreatePopup(
   // Adds a self-reference on the |popup_widget| so it will not be destroyed
   // when leaving scope. The WebPagePopup takes responsibility for Close()ing
   // and thus destroying the RenderWidget.
-  popup_widget->InitForPopup(std::move(opener_callback), popup_web_widget);
+  popup_widget->InitForPopup(std::move(opener_callback), opener_render_widget,
+                             popup_web_widget,
+                             opener_render_widget->GetOriginalScreenInfo());
   // TODO(crbug.com/419087): RenderWidget has some weird logic for picking a
   // WebWidget which doesn't apply to this case. So we verify. This can go away
   // when RenderWidget::GetWebWidget() is just a simple accessor.
   DCHECK_EQ(popup_widget->GetWebWidget(), popup_web_widget);
 
-  // Devtools emulation, which may be currently applied to the
-  // |view_render_widget|, should also apply to the new popup. This doesn't
-  // happen automatically.
-  popup_widget->ApplyEmulatedScreenMetricsForPopupWidget(view_render_widget);
-
   return popup_web_widget;
 }
 
@@ -1488,11 +1497,11 @@ void RenderViewImpl::DoDeferredClose() {
 
 void RenderViewImpl::CloseWindowSoon() {
   DCHECK(RenderThread::IsMainThread());
-  if (render_widget_->is_frozen()) {
+  if (!render_widget_ || render_widget_->IsUndeadOrProvisional()) {
     // Ask the RenderViewHost with a local main frame to initiate close.  We
     // could be called from deep in Javascript.  If we ask the RenderViewHost to
     // close now, the window could be closed before the JS finishes executing,
-    // thanks to nested message loops running and handling the resuliting Close
+    // thanks to nested message loops running and handling the resulting Close
     // IPC. So instead, post a message back to the message loop, which won't run
     // until the JS is complete, and then the Close request can be sent.
     GetCleanupTaskRunner()->PostTask(
@@ -1501,7 +1510,7 @@ void RenderViewImpl::CloseWindowSoon() {
     return;
   }
 
-  // If the main widget is not frozen then the Close request goes directly
+  // If the main widget is not undead then the Close request goes directly
   // through it, because the RenderWidget ultimately owns the RenderViewImpl.
   render_widget_->CloseWidgetSoon();
 }
@@ -1512,43 +1521,45 @@ base::StringPiece RenderViewImpl::GetSessionStorageNamespaceId() {
 }
 
 void RenderViewImpl::PrintPage(WebLocalFrame* frame) {
-  RenderFrameImpl::FromWebFrame(frame)->ScriptedPrint(
-      GetWidget()->input_handler().handling_input_event());
-}
+  RenderFrameImpl* render_frame = RenderFrameImpl::FromWebFrame(frame);
+  RenderWidget* render_widget = render_frame->GetLocalRootRenderWidget();
 
-void RenderViewImpl::AttachWebFrameWidget(blink::WebFrameWidget* frame_widget) {
-  // The previous WebFrameWidget must already be detached by CloseForFrame().
-  DCHECK(!frame_widget_);
-  frame_widget_ = frame_widget;
-  GetWidget()->SetWebWidgetInternal(frame_widget);
-
-  // Initialization for the WebFrameWidget that should only occur for the main
-  // frame, and that uses types not allowed in blink. This should maybe be
-  // passed to the creation of the WebFrameWidget or the main RenderFrame.
-  const base::CommandLine& command_line =
-      *base::CommandLine::ForCurrentProcess();
-  render_widget_->SetShowFPSCounter(
-      command_line.HasSwitch(cc::switches::kShowFPSCounter));
+  render_frame->ScriptedPrint(
+      render_widget->input_handler().handling_input_event());
 }
 
-void RenderViewImpl::DetachWebFrameWidget() {
-  DCHECK(GetWidget()->is_frozen() || GetWidget()->is_closing());
-  DCHECK(frame_widget_);
-  frame_widget_->Close();
-  frame_widget_ = nullptr;
-
-  // This just clears the webwidget_internal_ member from RenderWidget.
-  GetWidget()->SetWebWidgetInternal(nullptr);
-}
+bool RenderViewImpl::SetZoomLevel(double zoom_level) {
+  if (zoom_level == page_zoom_level_)
+    return false;
 
-void RenderViewImpl::SetZoomLevel(double zoom_level) {
   // If we change the zoom level for the view, make sure any subsequent subframe
   // loads reflect the current zoom level.
   page_zoom_level_ = zoom_level;
-
   webview()->SetZoomLevel(zoom_level);
   for (auto& observer : observers_)
     observer.OnZoomLevelChanged();
+  return true;
+}
+
+void RenderViewImpl::SetPreferCompositingToLCDTextEnabled(bool prefer) {
+  webview()->GetSettings()->SetPreferCompositingToLCDTextEnabled(prefer);
+}
+
+void RenderViewImpl::SetDeviceScaleFactor(bool use_zoom_for_dsf,
+                                          float device_scale_factor) {
+  if (use_zoom_for_dsf)
+    webview()->SetZoomFactorForDeviceScaleFactor(device_scale_factor);
+  else
+    webview()->SetDeviceScaleFactor(device_scale_factor);
+}
+
+void RenderViewImpl::PropagatePageZoomToNewlyAttachedFrame(
+    bool use_zoom_for_dsf,
+    float device_scale_factor) {
+  if (use_zoom_for_dsf)
+    webview()->SetZoomFactorForDeviceScaleFactor(device_scale_factor);
+  else
+    webview()->SetZoomLevel(page_zoom_level_);
 }
 
 void RenderViewImpl::SetValidationMessageDirection(
@@ -1691,6 +1702,26 @@ void RenderViewImpl::DidCommitProvisionalHistoryLoad() {
   history_navigation_virtual_time_pauser_.UnpauseVirtualTime();
 }
 
+void RenderViewImpl::UpdateBrowserControlsState(
+    BrowserControlsState constraints,
+    BrowserControlsState current,
+    bool animate) {
+  TRACE_EVENT2("renderer", "RenderViewImpl::UpdateBrowserControlsState",
+               "Constraint", static_cast<int>(constraints), "Current",
+               static_cast<int>(current));
+  TRACE_EVENT_INSTANT1("renderer", "is_animated", TRACE_EVENT_SCOPE_THREAD,
+                       "animated", animate);
+
+  if (render_widget_ && render_widget_->layer_tree_view()) {
+    render_widget_->layer_tree_view()
+        ->layer_tree_host()
+        ->UpdateBrowserControlsState(ContentToCc(constraints),
+                                     ContentToCc(current), animate);
+  }
+
+  top_controls_constraints_ = constraints;
+}
+
 void RenderViewImpl::RegisterRendererPreferenceWatcher(
     mojo::PendingRemote<blink::mojom::RendererPreferenceWatcher> watcher) {
   renderer_preference_watchers_.Add(std::move(watcher));
@@ -1710,58 +1741,39 @@ bool RenderViewImpl::CanHandleGestureEvent() {
   return true;
 }
 
-// TODO(https://crbug.com/1010509): Re-enable this in Chrome 80.
 // TODO(https://crbug.com/937569): Remove this in Chrome 82.
 bool RenderViewImpl::AllowPopupsDuringPageUnload() {
-  return true;
-#if 0
+  // The switch version is for enabling via enterprise policy. The feature
+  // version is for enabling via about:flags and Finch policy.
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
-  return command_line.HasSwitch(switches::kAllowPopupsDuringPageUnload);
-#endif
+  return command_line.HasSwitch(switches::kAllowPopupsDuringPageUnload) ||
+         base::FeatureList::IsEnabled(features::kAllowPopupsDuringPageUnload);
 }
 
 bool RenderViewImpl::CanUpdateLayout() {
   return true;
 }
 
-// blink::WebLocalFrameClient
-// -----------------------------------------------------
-
 void RenderViewImpl::SetEditCommandForNextKeyEvent(const std::string& name,
                                                    const std::string& value) {
-  GetWidget()->SetEditCommandForNextKeyEvent(name, value);
+  // This is test-only code. Only propagate the command if there is a main
+  // render frame.
+  if (main_render_frame_)
+    render_widget_->SetEditCommandForNextKeyEvent(name, value);
 }
 
 void RenderViewImpl::ClearEditCommands() {
-  GetWidget()->ClearEditCommands();
+  // This is test-only code. Only propagate the command if there is a main
+  // render frame.
+  if (main_render_frame_)
+    render_widget_->ClearEditCommands();
 }
 
 const std::string& RenderViewImpl::GetAcceptLanguages() {
   return renderer_preferences_.accept_languages;
 }
 
-void RenderViewImpl::UpdateBrowserControlsState(
-    BrowserControlsState constraints,
-    BrowserControlsState current,
-    bool animate) {
-  TRACE_EVENT2("renderer", "RenderViewImpl::UpdateBrowserControlsState",
-               "Constraint", static_cast<int>(constraints), "Current",
-               static_cast<int>(current));
-  TRACE_EVENT_INSTANT1("renderer", "is_animated", TRACE_EVENT_SCOPE_THREAD,
-                       "animated", animate);
-
-  if (GetWidget() && GetWidget()->layer_tree_view()) {
-    GetWidget()
-        ->layer_tree_view()
-        ->layer_tree_host()
-        ->UpdateBrowserControlsState(ContentToCc(constraints),
-                                     ContentToCc(current), animate);
-  }
-
-  top_controls_constraints_ = constraints;
-}
-
 #if defined(OS_ANDROID) || defined(OS_CHROMEOS)
 
 void RenderViewImpl::didScrollWithKeyboard(const blink::WebSize& delta) {
@@ -1777,38 +1789,26 @@ void RenderViewImpl::didScrollWithKeyboard(const blink::WebSize& delta) {
 
 #endif
 
-void RenderViewImpl::ConvertViewportToWindowViaWidget(blink::WebRect* rect) {
-  render_widget_->ConvertViewportToWindow(rect);
-}
-
-gfx::RectF RenderViewImpl::ElementBoundsInWindow(
-    const blink::WebElement& element) {
-  blink::WebRect bounding_box_in_window = element.BoundsInViewport();
-  render_widget_->ConvertViewportToWindow(&bounding_box_in_window);
-  return gfx::RectF(bounding_box_in_window);
-}
-
 void RenderViewImpl::UpdatePreferredSize() {
   // We don't always want to send the change messages over IPC, only if we've
   // been put in that mode by getting a |ViewMsg_EnablePreferredSizeChangedMode|
   // message.
-  if (!send_preferred_size_changes_ || !webview())
+  if (!send_preferred_size_changes_ || !webview() || !main_render_frame_)
     return;
 
   if (!needs_preferred_size_update_)
     return;
   needs_preferred_size_update_ = false;
 
-  blink::WebSize tmp_size = webview()->ContentsPreferredMinimumSize();
-  blink::WebRect tmp_rect(0, 0, tmp_size.width, tmp_size.height);
-  render_widget_->ConvertViewportToWindow(&tmp_rect);
-  gfx::Size size(tmp_rect.width, tmp_rect.height);
-  if (size == preferred_size_)
-    return;
+  blink::WebSize web_size = webview()->ContentsPreferredMinimumSize();
+  blink::WebRect web_rect(0, 0, web_size.width, web_size.height);
+  render_widget_->ConvertViewportToWindow(&web_rect);
+  gfx::Size size(web_rect.width, web_rect.height);
 
-  preferred_size_ = size;
-  Send(new ViewHostMsg_DidContentsPreferredSizeChange(GetRoutingID(),
-                                                      preferred_size_));
+  if (size != preferred_size_) {
+    preferred_size_ = size;
+    Send(new ViewHostMsg_DidContentsPreferredSizeChange(GetRoutingID(), size));
+  }
 }
 
 blink::WebString RenderViewImpl::AcceptLanguages() {
@@ -1821,12 +1821,6 @@ bool RenderViewImpl::Send(IPC::Message* message) {
   // No messages sent through RenderView come without a routing id, yay. Let's
   // keep that up.
   CHECK_NE(message->routing_id(), MSG_ROUTING_NONE);
-
-  // Don't send any messages after the browser has told us to close.
-  if (GetWidget()->is_closing()) {
-    delete message;
-    return false;
-  }
   return RenderThread::Get()->Send(message);
 }
 
@@ -1834,10 +1828,6 @@ RenderWidget* RenderViewImpl::GetWidget() {
   return render_widget_.get();
 }
 
-const RenderWidget* RenderViewImpl::GetWidget() const {
-  return render_widget_.get();
-}
-
 RenderFrameImpl* RenderViewImpl::GetMainRenderFrame() {
   return main_render_frame_;
 }
@@ -1846,14 +1836,6 @@ int RenderViewImpl::GetRoutingID() {
   return routing_id_;
 }
 
-gfx::Size RenderViewImpl::GetSize() {
-  return GetWidget()->size();
-}
-
-float RenderViewImpl::GetDeviceScaleFactor() {
-  return GetWidget()->GetWebScreenInfo().device_scale_factor;
-}
-
 float RenderViewImpl::GetZoomLevel() {
   return page_zoom_level_;
 }
@@ -1880,17 +1862,42 @@ void RenderViewImpl::OnSetPageScale(float page_scale_factor) {
   webview()->SetPageScaleFactor(page_scale_factor);
 }
 
-void RenderViewImpl::UpdateZoomLevel(double zoom_level) {
-  webview()->CancelPagePopup();
-  SetZoomLevel(zoom_level);
-}
-
 void RenderViewImpl::ApplyPageHidden(bool hidden, bool initial_setting) {
   webview()->SetIsHidden(hidden, initial_setting);
   // Note: RenderWidget visibility is separately set from the IPC handlers, and
   // does not change when tests override the visibility of the Page.
 }
 
+RenderWidget* RenderViewImpl::ReviveUndeadMainFrameRenderWidget() {
+  render_widget_ = std::move(undead_render_widget_);
+  render_widget_->SetIsUndead(false);
+  return render_widget_.get();
+}
+
+void RenderViewImpl::CloseMainFrameRenderWidget() {
+  // There is a WebFrameWidget previously attached by AttachWebFrameWidget().
+  DCHECK(render_widget_->GetWebWidget());
+
+  if (destroying_) {
+    // We are inside RenderViewImpl::Destroy() and the main frame is being
+    // detached as part of shutdown. So we can destroy the RenderWidget.
+
+    // We pass ownership of |render_widget_| to itself. Grab a raw pointer to
+    // call the Close() method on so we don't have to be a C++ expert to know
+    // whether we will end up with a nullptr where we didn't intend due to order
+    // of execution.
+    RenderWidget* closing_widget = render_widget_.get();
+    closing_widget->CloseForFrame(std::move(render_widget_));
+  } else {
+    // We are not inside RenderViewImpl::Destroy(), the main frame is being
+    // detached and replaced with a remote frame proxy. We can't close the
+    // RenderWidget, and it is marked undead instead.
+    render_widget_->SetIsUndead(true);
+
+    undead_render_widget_ = std::move(render_widget_);
+  }
+}
+
 void RenderViewImpl::OnUpdateWebPreferences(const WebPreferences& prefs) {
   webkit_preferences_ = prefs;
   ApplyWebPreferences(webkit_preferences_, webview());
@@ -1956,7 +1963,7 @@ void RenderViewImpl::OnSetRendererPrefs(
 }
 
 void RenderViewImpl::OnPluginActionAt(const gfx::Point& location,
-                                      const WebPluginAction& action) {
+                                      const PluginAction& action) {
   if (webview())
     webview()->PerformPluginAction(action, location);
 }
@@ -1998,41 +2005,26 @@ void RenderViewImpl::OnPageWasShown() {
   ApplyPageHidden(/*hidden=*/false, /*initial_setting=*/false);
 }
 
-void RenderViewImpl::OnUpdateScreenInfo(const ScreenInfo& screen_info) {
-  // This IPC only updates the screen info on RenderViews that have a remote
-  // main frame. For local main frames, the ScreenInfo is updated in
-  // ViewMsg_Resize.
-  // TODO(danakj): Move this message to RenderWidget?
-  if (!main_render_frame_)
-    GetWidget()->set_screen_info(screen_info);
-}
-
 void RenderViewImpl::OnUpdatePageVisualProperties(
-    const gfx::Size& viewport_size) {
+    const gfx::Size& viewport_size_for_blink) {
+  // TODO(https://crbug.com/998273): Handle visual_properties appropriately.
   // Using this pathway to update the visual viewport should only happen for
   // remote main frames. Local main frames will update the viewport size by
   // RenderWidget calling RenderViewImpl::ResizeVisualViewport() directly.
-  if (!main_render_frame_) {
-    // Since the viewport size comes directly from the browser, we may
-    // need to adjust it for device scale factor.
-    // TODO(wjmaclean): we should look into having the browser apply this scale
-    // before sending the viewport size.
-    gfx::Size device_scale_factor_scaled_visual_viewport_size = viewport_size;
-    if (RenderThreadImpl::current()->IsUseZoomForDSFEnabled()) {
-      device_scale_factor_scaled_visual_viewport_size = gfx::ScaleToCeiledSize(
-          viewport_size, GetScreenInfo().device_scale_factor);
-    }
-    webview()->Resize(device_scale_factor_scaled_visual_viewport_size);
-  }
+  // TODO(danakj): This should be part of VisualProperties and walk down the
+  // RenderWidget tree like other VisualProperties do, in order to set the
+  // value in each WebView holds a part of the local frame tree.
+  if (!main_render_frame_)
+    webview()->Resize(viewport_size_for_blink);
 }
 
 void RenderViewImpl::ResizeVisualViewportForWidget(
     const gfx::Size& scaled_viewport_size) {
   // This function is currently only called for local main frames. Once remote
   // main frames no longer have a RenderWidget, they may also route through
-  // here via RenderViewImpl::OnUpdatePageVisualProperties(). In that case,
-  // WebViewImpl will need to implement its Size() function based on something
-  // other than the widget size.
+  // here via RenderViewImpl::OnUpdateLocalMainFramePageVisualProperties(). In
+  // that case, WebViewImpl will need to implement its Size() function based on
+  // something other than the widget size.
   webview()->ResizeVisualViewport(scaled_viewport_size);
 }
 
@@ -2071,19 +2063,6 @@ void RenderViewImpl::SetFocus(bool enable) {
   webview()->SetFocus(enable);
 }
 
-void RenderViewImpl::ZoomLimitsChanged(double minimum_level,
-                                       double maximum_level) {
-  // Round the double to avoid returning incorrect minimum/maximum zoom
-  // percentages.
-  int minimum_percent = round(
-      ZoomLevelToZoomFactor(minimum_level) * 100);
-  int maximum_percent = round(
-      ZoomLevelToZoomFactor(maximum_level) * 100);
-
-  Send(new ViewHostMsg_UpdateZoomLimits(GetRoutingID(), minimum_percent,
-                                        maximum_percent));
-}
-
 void RenderViewImpl::PageScaleFactorChanged(float page_scale_factor) {
   if (!webview())
     return;
@@ -2113,7 +2092,9 @@ void RenderViewImpl::PageImportanceSignalsChanged() {
 }
 
 void RenderViewImpl::DidAutoResize(const blink::WebSize& newSize) {
-  GetWidget()->DidAutoResize(newSize);
+  // Auto resize should only happen on local main frames.
+  DCHECK(render_widget_);
+  render_widget_->DidAutoResize(newSize);
 }
 
 void RenderViewImpl::DidFocus(blink::WebLocalFrame* calling_frame) {
@@ -2132,43 +2113,6 @@ void RenderViewImpl::DidFocus(blink::WebLocalFrame* calling_frame) {
   }
 }
 
-blink::WebScreenInfo RenderViewImpl::GetScreenInfo() {
-  const ScreenInfo& info = GetWidget()->screen_info();
-
-  blink::WebScreenInfo web_screen_info;
-  web_screen_info.device_scale_factor = info.device_scale_factor;
-  web_screen_info.color_space = info.color_space;
-  web_screen_info.depth = info.depth;
-  web_screen_info.depth_per_component = info.depth_per_component;
-  web_screen_info.is_monochrome = info.is_monochrome;
-  web_screen_info.rect = blink::WebRect(info.rect);
-  web_screen_info.available_rect = blink::WebRect(info.available_rect);
-  switch (info.orientation_type) {
-    case SCREEN_ORIENTATION_VALUES_PORTRAIT_PRIMARY:
-      web_screen_info.orientation_type =
-          blink::kWebScreenOrientationPortraitPrimary;
-      break;
-    case SCREEN_ORIENTATION_VALUES_PORTRAIT_SECONDARY:
-      web_screen_info.orientation_type =
-          blink::kWebScreenOrientationPortraitSecondary;
-      break;
-    case SCREEN_ORIENTATION_VALUES_LANDSCAPE_PRIMARY:
-      web_screen_info.orientation_type =
-          blink::kWebScreenOrientationLandscapePrimary;
-      break;
-    case SCREEN_ORIENTATION_VALUES_LANDSCAPE_SECONDARY:
-      web_screen_info.orientation_type =
-          blink::kWebScreenOrientationLandscapeSecondary;
-      break;
-    default:
-      web_screen_info.orientation_type = blink::kWebScreenOrientationUndefined;
-      break;
-  }
-  web_screen_info.orientation_angle = info.orientation_angle;
-
-  return web_screen_info;
-}
-
 #if defined(OS_ANDROID)
 void RenderViewImpl::SuspendVideoCaptureDevices(bool suspend) {
   if (!main_render_frame_)
@@ -2197,16 +2141,16 @@ void RenderViewImpl::SetFocusAndActivateForTesting(bool enable) {
   if (webview()->MainFrame()->IsWebRemoteFrame())
     return;
 
-  if (enable == GetWidget()->has_focus())
+  if (enable == render_widget_->has_focus())
     return;
 
   if (enable) {
     SetActiveForWidget(true);
     // Fake an IPC message so go through the IPC handler.
-    GetWidget()->OnSetFocus(true);
+    render_widget_->OnSetFocus(true);
   } else {
     // Fake an IPC message so go through the IPC handler.
-    GetWidget()->OnSetFocus(false);
+    render_widget_->OnSetFocus(false);
     SetActiveForWidget(false);
   }
 }
diff --git a/chromium/content/renderer/render_view_impl.h b/chromium/content/renderer/render_view_impl.h
index f3a3167f7f4..61f38f211b8 100644
--- a/chromium/content/renderer/render_view_impl.h
+++ b/chromium/content/renderer/render_view_impl.h
@@ -14,6 +14,7 @@
 #include <string>
 #include <vector>
 
+#include "base/containers/flat_map.h"
 #include "base/containers/id_map.h"
 #include "base/gtest_prod_util.h"
 #include "base/macros.h"
@@ -36,6 +37,7 @@
 #include "content/renderer/render_widget.h"
 #include "content/renderer/render_widget_delegate.h"
 #include "ipc/ipc_platform_file.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/remote_set.h"
 #include "third_party/blink/public/common/dom_storage/session_storage_namespace_id.h"
 #include "third_party/blink/public/common/feature_policy/feature_policy.h"
@@ -47,7 +49,6 @@
 #include "third_party/blink/public/web/web_ax_object.h"
 #include "third_party/blink/public/web/web_console_message.h"
 #include "third_party/blink/public/web/web_element.h"
-#include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_history_item.h"
 #include "third_party/blink/public/web/web_navigation_type.h"
 #include "third_party/blink/public/web/web_node.h"
@@ -59,9 +60,8 @@
 #include "ui/surface/transport_dib.h"
 
 namespace blink {
-class WebMouseEvent;
 class WebURLRequest;
-struct WebPluginAction;
+struct PluginAction;
 struct WebWindowFeatures;
 }  // namespace blink
 
@@ -140,9 +140,10 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   blink::WebView* webview();
   const blink::WebView* webview() const;
 
-  // Returns the RenderWidget for this RenderView.
+  // Returns the RenderWidget owned by this RenderView. Can be nullptr if the
+  // RenderView does not own a RenderWidget [e.g. for remote main frame in
+  // future].
   RenderWidget* GetWidget();
-  const RenderWidget* GetWidget() const;
 
   const WebPreferences& webkit_preferences() const {
     return webkit_preferences_;
@@ -160,26 +161,25 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void AddObserver(RenderViewObserver* observer);
   void RemoveObserver(RenderViewObserver* observer);
 
-  // Sets the zoom level and notifies observers.
-  void SetZoomLevel(double zoom_level);
+  // Sets the zoom level and notifies observers. Returns true if the zoom level
+  // changed. A value of 0 means the default zoom level.
+  bool SetZoomLevel(double zoom_level);
 
-  double page_zoom_level() {
-    return page_zoom_level_;
-  }
+  // Passes along the prefer compositing preference to the WebView's settings.
+  void SetPreferCompositingToLCDTextEnabled(bool prefer);
+
+  // Passes along the device scale factor to the WebView.
+  void SetDeviceScaleFactor(bool use_zoom_for_dsf, float device_scale_factor);
+
+  // Passes along the page zoom to the WebView to set it on a newly attached
+  // LocalFrame.
+  void PropagatePageZoomToNewlyAttachedFrame(bool use_zoom_for_dsf,
+                                             float device_scale_factor);
 
   // Sets page-level focus in this view and notifies plugins and Blink's
   // FocusController.
   void SetFocus(bool enable);
 
-  // Attaches a WebFrameWidget that will provide a WebFrameWidget interface to
-  // the WebView. Called as part of initialization or when the main frame
-  // RenderWidget is unfrozen, to connect it to the new local main frame.
-  void AttachWebFrameWidget(blink::WebFrameWidget* frame_widget);
-  // Detaches the current WebFrameWidget, disconnecting it from the main frame.
-  // Called when the RenderWidget is being frozen, because the local main
-  // frame is going away.
-  void DetachWebFrameWidget();
-
   // Starts a timer to send an UpdateState message on behalf of |frame|, if the
   // timer isn't already running. This allows multiple state changing events to
   // be coalesced into one update.
@@ -207,6 +207,10 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   void NavigateBackForwardSoon(int offset, bool has_user_gesture);
   void DidCommitProvisionalHistoryLoad();
 
+  void UpdateBrowserControlsState(BrowserControlsState constraints,
+                                  BrowserControlsState current,
+                                  bool animate);
+
   // Registers a watcher to observe changes in the
   // blink::mojom::RendererPreferences.
   void RegisterRendererPreferenceWatcher(
@@ -247,14 +251,12 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   blink::WebString AcceptLanguages() override;
   int HistoryBackListCount() override;
   int HistoryForwardListCount() override;
-  void ZoomLimitsChanged(double minimum_level, double maximum_level) override;
   void PageScaleFactorChanged(float page_scale_factor) override;
   void DidUpdateTextAutosizerPageInfo(
       const blink::WebTextAutosizerPageInfo& page_info) override;
   void PageImportanceSignalsChanged() override;
   void DidAutoResize(const blink::WebSize& newSize) override;
   void DidFocus(blink::WebLocalFrame* calling_frame) override;
-  blink::WebScreenInfo GetScreenInfo() override;
   bool CanHandleGestureEvent() override;
   bool AllowPopupsDuringPageUnload() override;
 
@@ -263,25 +265,22 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   bool Send(IPC::Message* message) override;
   RenderFrameImpl* GetMainRenderFrame() override;
   int GetRoutingID() override;
-  gfx::Size GetSize() override;
-  float GetDeviceScaleFactor() override;
   float GetZoomLevel() override;
   const WebPreferences& GetWebkitPreferences() override;
   void SetWebkitPreferences(const WebPreferences& preferences) override;
   blink::WebView* GetWebView() override;
   bool GetContentStateImmediately() override;
+
+  // Only used for testing.
   void SetEditCommandForNextKeyEvent(const std::string& name,
                                      const std::string& value) override;
+  // Only used for testing.
   void ClearEditCommands() override;
+
   const std::string& GetAcceptLanguages() override;
-  void UpdateBrowserControlsState(BrowserControlsState constraints,
-                                  BrowserControlsState current,
-                                  bool animate) override;
 #if defined(OS_ANDROID) || defined(OS_CHROMEOS)
   virtual void didScrollWithKeyboard(const blink::WebSize& delta);
 #endif
-  void ConvertViewportToWindowViaWidget(blink::WebRect* rect) override;
-  gfx::RectF ElementBoundsInWindow(const blink::WebElement& element) override;
 
   // Please do not add your stuff randomly to the end here. If there is an
   // appropriate section, add it there. If not, there are some random functions
@@ -294,7 +293,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   bool renderer_wide_named_frame_lookup() {
     return renderer_wide_named_frame_lookup_;
   }
-  void UpdateZoomLevel(double zoom_level);
 
  protected:
   RenderViewImpl(CompositorDependencies* compositor_deps,
@@ -306,6 +304,13 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   // be able to specify |initial_setting| where IPC handlers do not.
   void ApplyPageHidden(bool hidden, bool initial_setting);
 
+  // Instead of creating a new RenderWidget, a RenderFrame for a main frame
+  // revives the undead RenderWidget;
+  RenderWidget* ReviveUndeadMainFrameRenderWidget();
+  // Closes the main frame RenderWidget. If not shutting down, this will close
+  // my marking it undead, to be revived later.
+  void CloseMainFrameRenderWidget();
+
  private:
   // For unit tests.
   friend class DevToolsAgentTest;
@@ -319,6 +324,7 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   // code away from this class.
   friend class RenderFrameImpl;
 
+  FRIEND_TEST_ALL_PREFIXES(RenderViewImplTest, EmulatingPopupRect);
   FRIEND_TEST_ALL_PREFIXES(RenderViewImplTest, RenderFrameMessageAfterDetach);
   FRIEND_TEST_ALL_PREFIXES(RenderViewImplTest, BeginNavigationForWebUI);
   FRIEND_TEST_ALL_PREFIXES(RenderViewImplTest,
@@ -383,14 +389,12 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
 
   // RenderWidgetDelegate implementation ----------------------------------
 
-  bool RenderWidgetWillHandleMouseEventForWidget(
-      const blink::WebMouseEvent& event) override;
   void SetActiveForWidget(bool active) override;
   bool SupportsMultipleWindowsForWidget() override;
   bool ShouldAckSyntheticInputImmediately() override;
   void CancelPagePopupForWidget() override;
   void ApplyNewDisplayModeForWidget(
-      const blink::WebDisplayMode& new_display_mode) override;
+      blink::mojom::DisplayMode new_display_mode) override;
   void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                       const gfx::Size& max_size) override;
   void DisableAutoResizeForWidget() override;
@@ -439,7 +443,7 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
       const gfx::Size& disable_scrollbars_size_limit);
   void OnEnablePreferredSizeChangedMode();
   void OnPluginActionAt(const gfx::Point& location,
-                        const blink::WebPluginAction& action);
+                        const blink::PluginAction& action);
   void OnAnimateDoubleTapZoomInMainFrame(const blink::WebPoint& point,
                                          const blink::WebRect& rect_to_zoom);
   void OnZoomToFindInPageRect(const blink::WebRect& rect_to_zoom);
@@ -522,14 +526,31 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   // it in the same order in the .cc file as it was in the header.
   // ---------------------------------------------------------------------------
 
+  // Becomes true when Destroy() is called.
+  bool destroying_ = false;
+
   // This is the |render_widget_| for the main frame.
   //
   // Instances of RenderWidget for child frame local roots, popups, and
   // fullscreen widgets are never contained by this pointer. Child frame
   // local roots are owned by a RenderFrame. The others are owned by the IPC
   // system.
+  //
+  // Note that when the main frame moves out of process, |render_widget_|
+  // is moved in to |undead_render_widget_|. In the future, the
+  // |render_widget_| should just be deleted and recreated. However, this
+  // requires reattached various objects browser process so it cannot be
+  // done yet.
   std::unique_ptr<RenderWidget> render_widget_;
 
+  // Instances of RenderViewImpl with a proxy main frame do not need a
+  // RenderWidget. Unfortunately, we can't delete the object because the browser
+  // side RenderWidgetHost/RenderViewHost lifetimes are still entangled. We
+  // store the RenderWidget in this member, but it should not be used.
+  // TODO(crbug.com/419087): Remove this once RenderWidgets are owned by the
+  // main frame.
+  std::unique_ptr<RenderWidget> undead_render_widget_;
+
   // Routing ID that allows us to communicate with the corresponding
   // RenderViewHost in the parent browser process.
   const int32_t routing_id_;
@@ -539,6 +560,10 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
   // beyond the usual opener-relationship-based BrowsingInstance boundaries).
   const bool renderer_wide_named_frame_lookup_;
 
+  // Dependency injection for RenderWidget and compositing to inject behaviour
+  // and not depend on RenderThreadImpl in tests.
+  CompositorDependencies* const compositor_deps_;
+
   // Settings ------------------------------------------------------------------
 
   WebPreferences webkit_preferences_;
@@ -635,10 +660,6 @@ class CONTENT_EXPORT RenderViewImpl : public blink::WebViewClient,
 
   RenderFrameImpl* main_render_frame_ = nullptr;
 
-  // Note: RenderViewImpl is pulling double duty: it's the RenderWidget for the
-  // "view", but it's also the RenderWidget for the main frame.
-  blink::WebFrameWidget* frame_widget_ = nullptr;
-
 #if defined(OS_ANDROID)
   // Android Specific ----------------------------------------------------------
 
diff --git a/chromium/content/renderer/render_widget.cc b/chromium/content/renderer/render_widget.cc
index 1d8ba6af8f7..1e5d62857eb 100644
--- a/chromium/content/renderer/render_widget.cc
+++ b/chromium/content/renderer/render_widget.cc
@@ -79,6 +79,7 @@
 #include "ipc/ipc_sync_message.h"
 #include "ipc/ipc_sync_message_filter.h"
 #include "media/base/media_switches.h"
+#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "skia/ext/platform_canvas.h"
 #include "third_party/blink/public/platform/file_path_conversion.h"
@@ -196,24 +197,14 @@ class WebWidgetLockTarget : public content::MouseLockDispatcher::LockTarget {
       : render_widget_(render_widget) {}
 
   void OnLockMouseACK(bool succeeded) override {
-    // TODO(https://crbug.com/995981): Once RenderWidget and WebWidget lifetimes
-    // are synchronized, we should remove these conditionals.
-    WebWidget* web_widget = render_widget_->GetWebWidget();
-    if (!web_widget)
-      return;
-
     if (succeeded)
-      web_widget->DidAcquirePointerLock();
+      render_widget_->GetWebWidget()->DidAcquirePointerLock();
     else
-      web_widget->DidNotAcquirePointerLock();
+      render_widget_->GetWebWidget()->DidNotAcquirePointerLock();
   }
 
   void OnMouseLockLost() override {
-    WebWidget* web_widget = render_widget_->GetWebWidget();
-    if (!web_widget)
-      return;
-
-    web_widget->DidLosePointerLock();
+    render_widget_->GetWebWidget()->DidLosePointerLock();
   }
 
   bool HandleMouseLockedInputEvent(const blink::WebMouseEvent& event) override {
@@ -391,8 +382,9 @@ static bool DeviceScaleEnsuresTextQuality(float device_scale_factor) {
 #endif
 }
 
-static bool PreferCompositingToLCDText(CompositorDependencies* compositor_deps,
-                                       float device_scale_factor) {
+static bool ComputePreferCompositingToLCDText(
+    CompositorDependencies* compositor_deps,
+    float device_scale_factor) {
   const base::CommandLine& command_line =
       *base::CommandLine::ForCurrentProcess();
   if (command_line.HasSwitch(switches::kDisablePreferCompositingToLCDText))
@@ -419,53 +411,48 @@ void RenderWidget::InstallCreateForFrameHook(
 std::unique_ptr<RenderWidget> RenderWidget::CreateForFrame(
     int32_t widget_routing_id,
     CompositorDependencies* compositor_deps,
-    const ScreenInfo& screen_info,
-    blink::WebDisplayMode display_mode,
-    bool is_frozen,
+    blink::mojom::DisplayMode display_mode,
+    bool is_undead,
     bool never_visible) {
   if (g_create_render_widget_for_frame) {
-    return g_create_render_widget_for_frame(widget_routing_id, compositor_deps,
-                                            screen_info, display_mode,
-                                            is_frozen, never_visible, nullptr);
+    return g_create_render_widget_for_frame(
+        widget_routing_id, compositor_deps, display_mode, is_undead,
+        never_visible, mojo::NullReceiver());
   }
 
   return std::make_unique<RenderWidget>(
-      widget_routing_id, compositor_deps, screen_info, display_mode, is_frozen,
-      /*hidden=*/true, never_visible, nullptr);
+      widget_routing_id, compositor_deps, display_mode, is_undead,
+      /*hidden=*/true, never_visible, mojo::NullReceiver());
 }
 
 RenderWidget* RenderWidget::CreateForPopup(
     int32_t widget_routing_id,
     CompositorDependencies* compositor_deps,
-    const ScreenInfo& screen_info,
-    blink::WebDisplayMode display_mode,
-    bool is_frozen,
+    blink::mojom::DisplayMode display_mode,
     bool hidden,
     bool never_visible,
-    mojom::WidgetRequest widget_request) {
-  return new RenderWidget(widget_routing_id, compositor_deps, screen_info,
-                          display_mode, is_frozen, hidden, never_visible,
-                          std::move(widget_request));
+    mojo::PendingReceiver<mojom::Widget> widget_receiver) {
+  return new RenderWidget(widget_routing_id, compositor_deps, display_mode,
+                          /*is_undead=*/false, hidden, never_visible,
+                          std::move(widget_receiver));
 }
 
 RenderWidget::RenderWidget(int32_t widget_routing_id,
                            CompositorDependencies* compositor_deps,
-                           const ScreenInfo& screen_info,
-                           blink::WebDisplayMode display_mode,
-                           bool is_frozen,
+                           blink::mojom::DisplayMode display_mode,
+                           bool is_undead,
                            bool hidden,
                            bool never_visible,
-                           mojom::WidgetRequest widget_request)
+                           mojo::PendingReceiver<mojom::Widget> widget_receiver)
     : routing_id_(widget_routing_id),
       compositor_deps_(compositor_deps),
       is_hidden_(hidden),
       compositor_never_visible_(never_visible),
       display_mode_(display_mode),
-      is_frozen_(is_frozen),
+      is_undead_(is_undead),
       next_previous_flags_(kInvalidNextPreviousFlagsValue),
-      screen_info_(screen_info),
       frame_swap_message_queue_(new FrameSwapMessageQueue(routing_id_)),
-      widget_binding_(this, std::move(widget_request)) {
+      widget_receiver_(this, std::move(widget_receiver)) {
   DCHECK_NE(routing_id_, MSG_ROUTING_NONE);
   DCHECK(RenderThread::IsMainThread());
 
@@ -482,8 +469,8 @@ RenderWidget::RenderWidget(int32_t widget_routing_id,
 }
 
 RenderWidget::~RenderWidget() {
-  DCHECK(!webwidget_internal_) << "Leaking our WebWidget!";
-  DCHECK(closed_)
+  DCHECK(!webwidget_) << "Leaking our WebWidget!";
+  DCHECK(closing_)
       << " RenderWidget must be destroyed via RenderWidget::Close()";
 
   // TODO(ajwong): Add in check that routing_id_ has been removed from
@@ -502,74 +489,73 @@ RenderWidget* RenderWidget::FromRoutingID(int32_t routing_id) {
 }
 
 void RenderWidget::InitForPopup(ShowCallback show_callback,
-                                blink::WebPagePopup* web_page_popup) {
+                                RenderWidget* opener_widget,
+                                blink::WebPagePopup* web_page_popup,
+                                const ScreenInfo& screen_info) {
   popup_ = true;
-  Init(std::move(show_callback), web_page_popup);
+  UnconditionalInit(std::move(show_callback));
+  LivingInit(web_page_popup, screen_info);
+
+  if (opener_widget->device_emulator_) {
+    opener_widget_screen_origin_ =
+        opener_widget->device_emulator_->ViewRectOrigin();
+    opener_original_widget_screen_origin_ =
+        opener_widget->device_emulator_->original_view_rect().origin();
+    opener_emulator_scale_ = opener_widget->GetEmulatorScale();
+  }
+}
+
+void RenderWidget::InitForPepperFullscreen(ShowCallback show_callback,
+                                           blink::WebWidget* web_widget,
+                                           const ScreenInfo& screen_info) {
+  pepper_fullscreen_ = true;
+  UnconditionalInit(std::move(show_callback));
+  LivingInit(web_widget, screen_info);
+}
+
+void RenderWidget::InitForMainFrame(ShowCallback show_callback,
+                                    blink::WebFrameWidget* web_frame_widget,
+                                    const ScreenInfo* screen_info) {
+  UnconditionalInit(std::move(show_callback));
+  // Main frame widgets can be created as undead. Then LivingInit() is deferred.
+  DCHECK_EQ(is_undead_, !web_frame_widget);
+  if (web_frame_widget)
+    LivingInit(web_frame_widget, *screen_info);
+}
+
+void RenderWidget::InitForRevivedMainFrame(
+    blink::WebFrameWidget* web_frame_widget,
+    const ScreenInfo& screen_info) {
+  DCHECK(web_frame_widget);
+  DCHECK(!is_undead_);
+
+  // UnconditionalInit() has already been done. LivingInit() may have previously
+  // occured if the RenderWidget was living previously, but we call it each time
+  // the RenderWidget transitions out of an undead state.
+  LivingInit(web_frame_widget, screen_info);
 }
 
 void RenderWidget::InitForChildLocalRoot(
-    blink::WebFrameWidget* web_frame_widget) {
+    blink::WebFrameWidget* web_frame_widget,
+    const ScreenInfo& screen_info) {
   for_child_local_root_frame_ = true;
-  // Init() increments the reference count on |this|, making it
-  // self-referencing.
-  Init(base::NullCallback(), web_frame_widget);
+  UnconditionalInit(base::NullCallback());
+  // Child local roots can not be undead.
+  LivingInit(web_frame_widget, screen_info);
 }
 
 void RenderWidget::CloseForFrame(std::unique_ptr<RenderWidget> widget) {
-  DCHECK(for_child_local_root_frame_);
-  PrepareForClose();
+  DCHECK(for_frame());
+  DCHECK_EQ(widget.get(), this);  // This method takes ownership of |this|.
 
-  // The RenderWidget may be deattached from JS, which in turn may be called
-  // in a re-entrant context. We cannot synchronously destroy the object, so we
-  // post a task to do so later.
-  GetCleanupTaskRunner()->PostNonNestableTask(
-      FROM_HERE,
-      base::BindOnce(&RenderWidget::Close, close_weak_ptr_factory_.GetWeakPtr(),
-                     std::move(widget)));
+  Close(std::move(widget));
 }
 
-void RenderWidget::Init(ShowCallback show_callback, WebWidget* web_widget) {
-  DCHECK(!webwidget_internal_);
+void RenderWidget::UnconditionalInit(ShowCallback show_callback) {
   DCHECK_NE(routing_id_, MSG_ROUTING_NONE);
 
-  RenderThreadImpl* render_thread_impl = RenderThreadImpl::current();
-
   input_handler_ = std::make_unique<RenderWidgetInputHandler>(this, this);
 
-  LayerTreeView* layer_tree_view = InitializeLayerTreeView();
-
-  // TODO(https://crbug.com/995981): This conditional is temporary logic to
-  // handle the case of remote main frame RenderWidgets [which shouldn't exist
-  // to begin with].
-  if (web_widget)
-    web_widget->SetAnimationHost(layer_tree_view->animation_host());
-
-  blink::scheduler::WebThreadScheduler* main_thread_scheduler = nullptr;
-  if (render_thread_impl)
-    main_thread_scheduler = render_thread_impl->GetWebMainThreadScheduler();
-  blink::scheduler::WebThreadScheduler* compositor_thread_scheduler =
-      blink::scheduler::WebThreadScheduler::CompositorThreadScheduler();
-  scoped_refptr<base::SingleThreadTaskRunner> compositor_input_task_runner;
-  // Use the compositor thread task runner unless this is a popup or other such
-  // non-frame widgets. The |compositor_thread_scheduler| can be null in tests
-  // without a compositor thread.
-  if (for_frame() && compositor_thread_scheduler) {
-    compositor_input_task_runner =
-        compositor_thread_scheduler->InputTaskRunner();
-  }
-
-  // We only use an external input handler for frame RenderWidgets because only
-  // frames use the compositor for input handling. Other kinds of RenderWidgets
-  // (e.g.  popups, plugins) must forward their input directly through
-  // RenderWidgetInputHandler into Blink.
-  bool uses_input_handler = for_frame();
-  widget_input_handler_manager_ = WidgetInputHandlerManager::Create(
-      weak_ptr_factory_.GetWeakPtr(), std::move(compositor_input_task_runner),
-      main_thread_scheduler, uses_input_handler);
-  base::CommandLine* command_line = base::CommandLine::ForCurrentProcess();
-  if (command_line->HasSwitch(switches::kAllowPreCommitInput))
-    widget_input_handler_manager_->AllowPreCommitInput();
-
   show_callback_ = std::move(show_callback);
 
 #if defined(OS_MACOSX)
@@ -577,76 +563,81 @@ void RenderWidget::Init(ShowCallback show_callback, WebWidget* web_widget) {
       std::make_unique<TextInputClientObserver>(for_frame() ? this : nullptr);
 #endif
 
-  webwidget_internal_ = web_widget;
   webwidget_mouse_lock_target_.reset(new WebWidgetLockTarget(this));
   mouse_lock_dispatcher_.reset(new RenderWidgetMouseLockDispatcher(this));
 
   RenderThread::Get()->AddRoute(routing_id_, this);
 }
 
-void RenderWidget::ApplyEmulatedScreenMetricsForPopupWidget(
-    RenderWidget* origin_widget) {
-  RenderWidgetScreenMetricsEmulator* emulator =
-      origin_widget->screen_metrics_emulator_.get();
-  if (!emulator)
-    return;
-  popup_origin_scale_for_emulation_ = emulator->scale();
-  popup_view_origin_for_emulation_ = emulator->applied_widget_rect().origin();
-  popup_screen_origin_for_emulation_ =
-      emulator->original_screen_rect().origin();
-  UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
-                             CompositorViewportRect(),
-                             emulator->original_screen_info());
-}
+void RenderWidget::LivingInit(WebWidget* web_widget,
+                              const ScreenInfo& screen_info) {
+  DCHECK(!is_undead_);
+  DCHECK(!webwidget_);
+  DCHECK(web_widget);
 
-gfx::Rect RenderWidget::AdjustValidationMessageAnchor(const gfx::Rect& anchor) {
-  if (screen_metrics_emulator_)
-    return screen_metrics_emulator_->AdjustValidationMessageAnchor(anchor);
-  return anchor;
-}
+  if (!layer_tree_view_)
+    InitCompositing(screen_info);
 
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-void RenderWidget::SetExternalPopupOriginAdjustmentsForEmulation(
-    ExternalPopupMenu* popup) {
-  if (screen_metrics_emulator_)
-    popup->SetOriginScaleForEmulation(screen_metrics_emulator_->scale());
-}
-#endif
+  const auto& command_line = *base::CommandLine::ForCurrentProcess();
+  SetShowFPSCounter(command_line.HasSwitch(cc::switches::kShowFPSCounter));
+
+  // If the widget is hidden, delay starting the compositor until the user
+  // shows it. Also if the RenderWidget is undead, we delay starting the
+  // compositor until we expect to use the widget, which will be signaled
+  // through reviving the undead RenderWidget.
+  if (!is_hidden_)
+    StartStopCompositor();
 
-void RenderWidget::OnShowHostContextMenu(ContextMenuParams* params) {
-  if (screen_metrics_emulator_)
-    screen_metrics_emulator_->OnShowContextMenu(params);
+  webwidget_ = web_widget;
+  web_widget->SetAnimationHost(layer_tree_view_->animation_host());
+  // Note that this calls into the WebWidget.
+  UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
+                             CompositorViewportRect(), screen_info);
 }
 
 bool RenderWidget::OnMessageReceived(const IPC::Message& message) {
+  // TODO(https://crbug.com/1000502): Don't process IPC messages on undead
+  // RenderWidgets. We would like to eventually remove them altogether, so they
+  // won't be able to process IPC messages. An undead widget may become
+  // provisional again, so we must check for that too. Provisional frames don't
+  // receive messages until swapped in.
+  if (is_undead_)
+    return false;
+
+  // The EnableDeviceEmulation message is sent to a provisional RenderWidget
+  // before the navigation completes. Some investigation into why is done in
+  // https://chromium-review.googlesource.com/c/chromium/src/+/1853675/5#message-e6edc3fd708d7d267ee981ffe43cae090b37a906
+  // but it's unclear what would need to be done to delay this until after
+  // navigation.
   bool handled = false;
   IPC_BEGIN_MESSAGE_MAP(RenderWidget, message)
-    IPC_MESSAGE_HANDLER(WidgetMsg_SynchronizeVisualProperties,
-                        OnSynchronizeVisualProperties)
     IPC_MESSAGE_HANDLER(WidgetMsg_EnableDeviceEmulation,
                         OnEnableDeviceEmulation)
-    IPC_MESSAGE_HANDLER(WidgetMsg_DisableDeviceEmulation,
-                        OnDisableDeviceEmulation)
   IPC_END_MESSAGE_MAP()
   if (handled)
     return true;
 
-  // TODO(https://crbug.com/1000502): Don't process IPC messages on frozen
-  // RenderWidgets. We would like to eventually remove them altogether, so they
-  // won't be able to process IPC messages.
-  if (is_frozen())
+  // We shouldn't receive IPC messages on provisional frames. It's possible the
+  // message was destined for a RenderWidget that was made undead and then
+  // revived since it keeps the same routing id. Just drop it here if that
+  // happened.
+  if (IsForProvisionalFrame())
     return false;
+
 #if defined(OS_MACOSX)
   if (IPC_MESSAGE_CLASS(message) == TextInputClientMsgStart)
     return text_input_client_observer_->OnMessageReceived(message);
 #endif
-  if (mouse_lock_dispatcher_ &&
-      mouse_lock_dispatcher_->OnMessageReceived(message))
+  if (mouse_lock_dispatcher_->OnMessageReceived(message))
     return true;
 
   IPC_BEGIN_MESSAGE_MAP(RenderWidget, message)
+    IPC_MESSAGE_HANDLER(WidgetMsg_DisableDeviceEmulation,
+                        OnDisableDeviceEmulation)
     IPC_MESSAGE_HANDLER(WidgetMsg_ShowContextMenu, OnShowContextMenu)
     IPC_MESSAGE_HANDLER(WidgetMsg_Close, OnClose)
+    IPC_MESSAGE_HANDLER(WidgetMsg_UpdateVisualProperties,
+                        OnUpdateVisualProperties)
     IPC_MESSAGE_HANDLER(WidgetMsg_WasHidden, OnWasHidden)
     IPC_MESSAGE_HANDLER(WidgetMsg_WasShown, OnWasShown)
     IPC_MESSAGE_HANDLER(WidgetMsg_SetActive, OnSetActive)
@@ -676,23 +667,12 @@ bool RenderWidget::OnMessageReceived(const IPC::Message& message) {
 }
 
 bool RenderWidget::Send(IPC::Message* message) {
-  // Don't send any messages after the browser has told us to close, and filter
-  // most outgoing messages when frozen.
-  if (closing_) {
-    delete message;
-    return false;
-  }
-  // TODO(danakj): We believe that we should be able to not block IPC sending.
-  // When there's a provisional main frame using this widget, we should not be
-  // sending messages with the RenderWidget yet. And when the widget is frozen
-  // because there is no local main frame, there should be no code using
-  // RenderWidget and sending messages through it.
-  // We should CHECK() that the RenderWidget is not frozen and that the frame
-  // attached to it is not provisional, instead of dropping messages.
-  if (is_frozen_) {
-    delete message;
-    return false;
-  }
+  // Undead RenderWidgets should not be used.
+  CHECK(!is_undead_);
+  // Provisional frames don't send IPCs until they are swapped in/committed.
+  CHECK(!IsForProvisionalFrame());
+  // Don't send any messages during shutdown.
+  DCHECK(!closing_);
 
   // If given a messsage without a routing ID, then assign our routing ID.
   if (message->routing_id() == MSG_ROUTING_NONE)
@@ -701,11 +681,6 @@ bool RenderWidget::Send(IPC::Message* message) {
   return RenderThread::Get()->Send(message);
 }
 
-void RenderWidget::SendOrCrash(IPC::Message* message) {
-  bool result = Send(message);
-  CHECK(closing_ || result) << "Failed to send message";
-}
-
 bool RenderWidget::ShouldHandleImeEvents() const {
   if (delegate())
     return has_focus_;
@@ -725,41 +700,18 @@ bool RenderWidget::ShouldHandleImeEvents() const {
 void RenderWidget::OnClose() {
   DCHECK(popup_ || pepper_fullscreen_);
 
-  PrepareForClose();
-
-  // IPCs can be invoked from nested message loops. We must dispatch this
-  // task non-nested to avoid re-entrancy issues.
-  GetCleanupTaskRunner()->PostNonNestableTask(
-      FROM_HERE,
-      base::BindOnce(&RenderWidget::Close, close_weak_ptr_factory_.GetWeakPtr(),
-                     base::WrapUnique(this)));
+  Close(base::WrapUnique(this));
 }
 
-void RenderWidget::PrepareForClose() {
-  DCHECK(RenderThread::IsMainThread());
-  if (closing_)
-    return;
-  for (auto& observer : render_frames_)
-    observer.WidgetWillClose();
-  closing_ = true;
-
-  // Browser correspondence is no longer needed at this point.
-  if (routing_id_ != MSG_ROUTING_NONE) {
-    RenderThread::Get()->RemoveRoute(routing_id_);
-    g_routing_id_widget_map.Get().erase(routing_id_);
-  }
-
-  // Stop handling main thread input events immediately so we don't have them
-  // running while things are partly shut down.
-  if (input_event_queue_)
-    input_event_queue_->ClearClient();
-
-  CloseWebWidget();
-}
-
-void RenderWidget::OnSynchronizeVisualProperties(
+void RenderWidget::OnUpdateVisualProperties(
     const VisualProperties& visual_properties_from_browser) {
-  TRACE_EVENT0("renderer", "RenderWidget::OnSynchronizeVisualProperties");
+  TRACE_EVENT0("renderer", "RenderWidget::OnUpdateVisualProperties");
+
+  // TODO(crbug.com/995981): We shouldn't be sending VisualProperties to undead
+  // RenderWidgets already, but if we do we could crash if the RenderWidget
+  // hasn't been initialized yet. So this acts defensively until we destroy
+  // undead RenderWidgets.
+  DCHECK(!is_undead_);
 
   VisualProperties visual_properties = visual_properties_from_browser;
   // Web tests can override the device scale factor in the renderer.
@@ -771,6 +723,9 @@ void RenderWidget::OnSynchronizeVisualProperties(
             visual_properties.new_size,
             visual_properties.screen_info.device_scale_factor));
   }
+  // Web tests can override the zoom level in the renderer.
+  if (zoom_level_for_testing_ != -INFINITY)
+    visual_properties.zoom_level = zoom_level_for_testing_;
 
   // Inform the rendering thread of the color space indicating the presence of
   // HDR capabilities. The HDR bit happens to be globally true/false for all
@@ -790,6 +745,9 @@ void RenderWidget::OnSynchronizeVisualProperties(
   if (delegate()) {
     if (size_ != visual_properties.new_size) {
       // Only hide popups when the size changes. Eg https://crbug.com/761908.
+      // TODO(danakj): If OnSynchronizeVisualProperties doesn't happen on an
+      // undead widget then this can go through the WebFrameWidget->WebView
+      // instead of through the delegate, letting us delete that delegate API.
       delegate()->CancelPagePopupForWidget();
     }
 
@@ -798,27 +756,10 @@ void RenderWidget::OnSynchronizeVisualProperties(
       delegate()->ApplyNewDisplayModeForWidget(visual_properties.display_mode);
     }
 
-    bool auto_resize_mode_changed =
-        auto_resize_mode_ != visual_properties.auto_resize_enabled;
-    auto_resize_mode_ = visual_properties.auto_resize_enabled;
-    min_size_for_auto_resize_ = visual_properties.min_size_for_auto_resize;
-    max_size_for_auto_resize_ = visual_properties.max_size_for_auto_resize;
-
-    if (auto_resize_mode_) {
-      gfx::Size min_auto_size = min_size_for_auto_resize_;
-      gfx::Size max_auto_size = max_size_for_auto_resize_;
-      if (compositor_deps_->IsUseZoomForDSFEnabled()) {
-        min_auto_size = gfx::ScaleToCeiledSize(
-            min_auto_size, visual_properties.screen_info.device_scale_factor);
-        max_auto_size = gfx::ScaleToCeiledSize(
-            max_auto_size, visual_properties.screen_info.device_scale_factor);
-      }
-      delegate()->ApplyAutoResizeLimitsForWidget(min_auto_size, max_auto_size);
-    } else if (auto_resize_mode_changed) {
-      delegate()->DisableAutoResizeForWidget();
-      if (visual_properties.new_size.IsEmpty())
-        return;
-    }
+    SetAutoResizeMode(visual_properties.auto_resize_enabled,
+                      visual_properties.min_size_for_auto_resize,
+                      visual_properties.max_size_for_auto_resize,
+                      visual_properties.screen_info.device_scale_factor);
 
     browser_controls_shrink_blink_size_ =
         visual_properties.browser_controls_shrink_blink_size;
@@ -826,125 +767,269 @@ void RenderWidget::OnSynchronizeVisualProperties(
     bottom_controls_height_ = visual_properties.bottom_controls_height;
   }
 
-  bool ignore_resize_ipc = false;
-  if (synchronous_resize_mode_for_testing_) {
+  if (for_frame()) {
+    SetZoomLevel(visual_properties.zoom_level);
+
+    bool capture_sequence_number_changed =
+        visual_properties.capture_sequence_number !=
+        last_capture_sequence_number_;
+    if (capture_sequence_number_changed) {
+      last_capture_sequence_number_ = visual_properties.capture_sequence_number;
+
+      // Propagate changes down to child local root RenderWidgets and
+      // BrowserPlugins in other frame trees/processes.
+      for (auto& observer : render_frame_proxies_) {
+        observer.UpdateCaptureSequenceNumber(
+            visual_properties.capture_sequence_number);
+      }
+      for (auto& observer : browser_plugins_) {
+        observer.UpdateCaptureSequenceNumber(
+            visual_properties.capture_sequence_number);
+      }
+    }
+  }
+
+  layer_tree_host_->SetBrowserControlsHeight(
+      visual_properties.top_controls_height,
+      visual_properties.bottom_controls_height,
+      visual_properties.browser_controls_shrink_blink_size);
+
+  if (!auto_resize_mode_) {
+    if (visual_properties.is_fullscreen_granted != is_fullscreen_granted_) {
+      is_fullscreen_granted_ = visual_properties.is_fullscreen_granted;
+      if (is_fullscreen_granted_)
+        GetWebWidget()->DidEnterFullscreen();
+      else
+        GetWebWidget()->DidExitFullscreen();
+    }
+  }
+
+  gfx::Size old_visible_viewport_size = visible_viewport_size_;
+
+  if (device_emulator_) {
+    DCHECK(!auto_resize_mode_);
+    DCHECK(!synchronous_resize_mode_for_testing_);
+
+    // TODO(danakj): Have RenderWidget grab emulated values from the emulator
+    // instead of making it call back into RenderWidget, then we can do this
+    // with a single UpdateSurfaceAndScreenInfo() call. The emulator may
+    // change the ScreenInfo and then will call back to RenderWidget. Before
+    // that we keep the current (possibly emulated) ScreenInfo.
+    UpdateSurfaceAndScreenInfo(
+        visual_properties.local_surface_id_allocation.value_or(
+            viz::LocalSurfaceIdAllocation()),
+        visual_properties.compositor_viewport_pixel_rect, screen_info_);
+
+    // This will call back into this class to set the widget size, visible
+    // viewport size, screen info and screen rects, based on the device
+    // emulation.
+    device_emulator_->OnSynchronizeVisualProperties(
+        visual_properties.screen_info, visual_properties.new_size,
+        visual_properties.visible_viewport_size);
+  } else {
     // We can ignore browser-initialized resizing during synchronous
     // (renderer-controlled) mode, unless it is switching us to/from
     // fullsreen mode or changing the device scale factor.
-    // TODO(danakj): Does the browser actually change DSF inside a web test??
-    // TODO(danakj): Isn't the display mode check redundant with the fullscreen
-    // one?
-    if (visual_properties.is_fullscreen_granted == is_fullscreen_granted_ &&
-        visual_properties.display_mode == display_mode_ &&
-        visual_properties.screen_info.device_scale_factor ==
-            screen_info_.device_scale_factor)
-      ignore_resize_ipc = true;
-  }
-
-  // When controlling the size in the renderer, we should ignore sizes given by
-  // the browser IPC here.
-  // TODO(danakj): There are many things also being ignored that aren't the
-  // widget's size params. It works because tests that use this mode don't
-  // change those parameters, I guess. But it's more complicated then because it
-  // looks like they are related to sync resize mode. Let's move them out of
-  // this block.
-  // TODO(danakj): It would be nice if we can still use the emulator to emulate
-  // things other than the size if we are in sync resize mode - if the emulator
-  // is even used in sync resize tests. It probably isn't though, so either way
-  // it'd be good to get the emulator out of this block (maybe by overwriting
-  // some of |visual_properties| in sync resize mode instead of just
-  // skipping the emulator.
-  if (!ignore_resize_ipc) {
-    if (screen_metrics_emulator_) {
-      // This will call our SynchronizeVisualProperties() method with a
-      // different set of VisualProperties, holding emulated values. Though not
-      // all VisualProperties are modified by the metrics emulator, so it's a
-      // bit unclear to do this with the full structure. Anything it does not
-      // modify can be consumed directly here instead of in
-      // SynchronizeVisualProperties().
-      screen_metrics_emulator_->OnSynchronizeVisualProperties(
-          visual_properties);
-    } else {
-      if (!delegate()) {
-        // The main frame controls the page scale factor, from blink. For other
-        // frame widgets, the page scale is received from its parent as part of
-        // the visual properties here. While blink doesn't need to know this
-        // page scale factor outside the main frame, the compositor does in
-        // order to produce its output at the correct scale.
-        layer_tree_view_->SetExternalPageScaleFactor(
-            visual_properties.page_scale_factor,
-            visual_properties.is_pinch_gesture_active);
-        // Store the value to give to any new RenderFrameProxy that is
-        // registered.
-        page_scale_factor_from_mainframe_ = visual_properties.page_scale_factor;
-        // Similarly, only the main frame knows when a pinch gesture is active,
-        // but this information is needed in subframes so they can throttle
-        // re-rastering in the same manner as the main frame.
-        // |is_pinch_gesture_active| follows the same path to the subframe
-        // compositor(s) as |page_scale_factor|.
-        is_pinch_gesture_active_from_mainframe_ =
-            visual_properties.is_pinch_gesture_active;
-        // Push the page scale factor down to any child RenderWidgets via our
-        // child proxy frames.
-        // TODO(danakj): This ends up setting the page scale factor in the
-        // RenderWidgetHost of the child RenderWidget, so that it can bounce
-        // the value down to its RenderWidget. Since this is essentially a
-        // global value per-page, we could instead store it once in the browser
-        // (such as in RenderViewHost) and distribute it to each frame-hosted
-        // RenderWidget from there.
-        for (auto& child_proxy : render_frame_proxies_) {
-          child_proxy.OnPageScaleFactorChanged(
-              visual_properties.page_scale_factor,
-              visual_properties.is_pinch_gesture_active);
-        }
+    bool ignore_resize_ipc = synchronous_resize_mode_for_testing_;
+    if (ignore_resize_ipc) {
+      // TODO(danakj): Does the browser actually change DSF inside a web test??
+      // TODO(danakj): Isn't the display mode check redundant with the
+      // fullscreen one?
+      if (visual_properties.is_fullscreen_granted != is_fullscreen_granted_ ||
+          visual_properties.display_mode != display_mode_ ||
+          visual_properties.screen_info.device_scale_factor !=
+              screen_info_.device_scale_factor)
+        ignore_resize_ipc = false;
+    }
+
+    // When controlling the size in the renderer, we should ignore sizes given
+    // by the browser IPC here.
+    // TODO(danakj): There are many things also being ignored that aren't the
+    // widget's size params. It works because tests that use this mode don't
+    // change those parameters, I guess. But it's more complicated then because
+    // it looks like they are related to sync resize mode. Let's move them out
+    // of this block.
+    if (!ignore_resize_ipc) {
+      gfx::Rect new_compositor_viewport_pixel_rect =
+          visual_properties.compositor_viewport_pixel_rect;
+      if (auto_resize_mode_) {
+        new_compositor_viewport_pixel_rect = gfx::Rect(gfx::ScaleToCeiledSize(
+            size_, visual_properties.screen_info.device_scale_factor));
       }
 
-      gfx::Size old_visible_viewport_size = visible_viewport_size_;
-      SynchronizeVisualProperties(visual_properties);
-      if (old_visible_viewport_size != visible_viewport_size_) {
-        for (auto& render_frame : render_frames_)
-          render_frame.ResetHasScrolledFocusedEditableIntoView();
+      UpdateSurfaceAndScreenInfo(
+          visual_properties.local_surface_id_allocation.value_or(
+              viz::LocalSurfaceIdAllocation()),
+          new_compositor_viewport_pixel_rect, visual_properties.screen_info);
+
+      if (for_frame()) {
+        RenderFrameImpl* render_frame =
+            RenderFrameImpl::FromWebFrame(GetFrameWidget()->LocalRoot());
+        // This causes compositing state to be modified which dirties the
+        // document lifecycle. Android Webview relies on the document
+        // lifecycle being clean after the RenderWidget is initialized, in
+        // order to send IPCs that query and change compositing state. So
+        // ResizeWebWidget() must come after this call, as it runs the entire
+        // document lifecycle.
+        //
+        // TODO(danakj): Only the top-most RenderWidget per RenderView should
+        // be responsible for setting values onto the RenderView.
+        render_frame->SetPreferCompositingToLCDTextEnabledOnRenderView(
+            ComputePreferCompositingToLCDText(
+                compositor_deps_, screen_info_.device_scale_factor));
+      }
+
+      if (!auto_resize_mode_) {
+        display_mode_ = visual_properties.display_mode;
+
+        visible_viewport_size_ = visual_properties.visible_viewport_size;
+        size_ = visual_properties.new_size;
+        ResizeWebWidget();
       }
     }
   }
 
+  if (!delegate()) {
+    // The main frame controls the page scale factor, from blink. For other
+    // frame widgets, the page scale is received from its parent as part of
+    // the visual properties here. While blink doesn't need to know this
+    // page scale factor outside the main frame, the compositor does in
+    // order to produce its output at the correct scale.
+    layer_tree_host_->SetExternalPageScaleFactor(
+        visual_properties.page_scale_factor,
+        visual_properties.is_pinch_gesture_active);
+
+    // Store the value to give to any new RenderFrameProxy that is
+    // registered.
+    page_scale_factor_from_mainframe_ = visual_properties.page_scale_factor;
+    // Similarly, only the main frame knows when a pinch gesture is active,
+    // but this information is needed in subframes so they can throttle
+    // re-rastering in the same manner as the main frame.
+    // |is_pinch_gesture_active| follows the same path to the subframe
+    // compositor(s) as |page_scale_factor|.
+    is_pinch_gesture_active_from_mainframe_ =
+        visual_properties.is_pinch_gesture_active;
+
+    // Push the page scale factor down to any child RenderWidgets via our
+    // child proxy frames.
+    // TODO(danakj): This ends up setting the page scale factor in the
+    // RenderWidgetHost of the child RenderWidget, so that it can bounce
+    // the value down to its RenderWidget. Since this is essentially a
+    // global value per-page, we could instead store it once in the browser
+    // (such as in RenderViewHost) and distribute it to each frame-hosted
+    // RenderWidget from there.
+    for (auto& child_proxy : render_frame_proxies_) {
+      if (!is_undead_) {
+        child_proxy.OnPageScaleFactorChanged(
+            visual_properties.page_scale_factor,
+            visual_properties.is_pinch_gesture_active);
+      }
+    }
+  }
+
+  if (old_visible_viewport_size != visible_viewport_size_) {
+    for (auto& render_frame : render_frames_)
+      render_frame.ResetHasScrolledFocusedEditableIntoView();
+  }
   // TODO(crbug.com/939118): ScrollFocusedNodeIntoViewForWidget does not work
   // when the focused node is inside an OOPIF. This code path where
   // scroll_focused_node_into_view is set is used only for WebView, crbug
   // 939118 tracks fixing webviews to not use scroll_focused_node_into_view.
   if (delegate() && visual_properties.scroll_focused_node_into_view)
     delegate()->ScrollFocusedNodeIntoViewForWidget();
+
+  AfterUpdateVisualProperties();
 }
 
 void RenderWidget::OnEnableDeviceEmulation(
     const blink::WebDeviceEmulationParams& params) {
-  if (!screen_metrics_emulator_) {
-    VisualProperties visual_properties;
-    visual_properties.screen_info = screen_info_;
-    visual_properties.new_size = size_;
-    visual_properties.compositor_viewport_pixel_rect = CompositorViewportRect();
-    visual_properties.local_surface_id_allocation =
-        local_surface_id_allocation_from_parent_;
-    visual_properties.visible_viewport_size = visible_viewport_size_;
-    visual_properties.is_fullscreen_granted = is_fullscreen_granted_;
-    visual_properties.display_mode = display_mode_;
-    screen_metrics_emulator_.reset(new RenderWidgetScreenMetricsEmulator(
-        this, params, visual_properties, widget_screen_rect_,
-        window_screen_rect_));
-    screen_metrics_emulator_->Apply();
-  } else {
-    screen_metrics_emulator_->ChangeEmulationParams(params);
+  // Device emulation can only be applied to the local main frame render widget.
+  // TODO(https://crbug.com/1006052): We should move emulation into the browser
+  // and send consistent ScreenInfo and ScreenRects to all RenderWidgets based
+  // on emulation.
+  if (!delegate_)
+    return;
+
+  if (!device_emulator_) {
+    device_emulator_ = std::make_unique<RenderWidgetScreenMetricsEmulator>(
+        this, screen_info_, size_, visible_viewport_size_, widget_screen_rect_,
+        window_screen_rect_);
   }
+  device_emulator_->ChangeEmulationParams(params);
 }
 
 void RenderWidget::OnDisableDeviceEmulation() {
-  screen_metrics_emulator_.reset();
+  // Device emulation can only be applied to the local main frame render widget.
+  // TODO(https://crbug.com/1006052): We should move emulation into the browser
+  // and send consistent ScreenInfo and ScreenRects to all RenderWidgets based
+  // on emulation.
+  if (!delegate_)
+    return;
+  DCHECK(device_emulator_);
+  device_emulator_->DisableAndApply();
+  device_emulator_.reset();
+}
+
+float RenderWidget::GetEmulatorScale() const {
+  if (device_emulator_)
+    return device_emulator_->scale();
+  return 1;
+}
+
+void RenderWidget::SetAutoResizeMode(bool auto_resize,
+                                     const gfx::Size& min_size_before_dsf,
+                                     const gfx::Size& max_size_before_dsf,
+                                     float device_scale_factor) {
+  bool was_changed = auto_resize_mode_ != auto_resize;
+  auto_resize_mode_ = auto_resize;
+
+  min_size_for_auto_resize_ = min_size_before_dsf;
+  max_size_for_auto_resize_ = max_size_before_dsf;
+
+  if (auto_resize) {
+    gfx::Size min_auto_size = min_size_for_auto_resize_;
+    gfx::Size max_auto_size = max_size_for_auto_resize_;
+    if (compositor_deps_->IsUseZoomForDSFEnabled()) {
+      min_auto_size =
+          gfx::ScaleToCeiledSize(min_auto_size, device_scale_factor);
+      max_auto_size =
+          gfx::ScaleToCeiledSize(max_auto_size, device_scale_factor);
+    }
+    delegate()->ApplyAutoResizeLimitsForWidget(min_auto_size, max_auto_size);
+  } else if (was_changed) {
+    delegate()->DisableAutoResizeForWidget();
+  }
+}
+
+void RenderWidget::SetZoomLevel(double zoom_level) {
+  RenderFrameImpl* render_frame =
+      RenderFrameImpl::FromWebFrame(GetFrameWidget()->LocalRoot());
+
+  // TODO(danakj): Only the top-most RenderWidget per RenderView should be
+  // responsible for setting values onto the RenderView.
+  bool zoom_level_changed = render_frame->SetZoomLevelOnRenderView(zoom_level);
+  if (zoom_level_changed) {
+    // Hide popups when the zoom changes.
+    // TODO(danakj): This should go through RenderFrame, and the Delegate path
+    // should be replaced.
+    blink::WebView* web_view = GetFrameWidget()->LocalRoot()->View();
+    web_view->CancelPagePopup();
+
+    // Propagate changes down to child local root RenderWidgets and
+    // BrowserPlugins in other frame trees/processes.
+    for (auto& observer : render_frame_proxies_)
+      observer.OnZoomLevelChanged(zoom_level);
+    for (auto& plugin : browser_plugins_)
+      plugin.OnZoomLevelChanged(zoom_level);
+  }
 }
 
 void RenderWidget::OnWasHidden() {
-  // A frozen main frame widget will never be hidden since that would require it
-  // to be shown first. It must be thawed before changing visibility.
-  DCHECK(!is_frozen_);
+  // An undead or provisional main frame widget will never be hidden since that
+  // would require it to be shown first. The main frame must be attached to the
+  // frame tree before changing visibility.
+  DCHECK(!is_undead_);
+  DCHECK(!IsForProvisionalFrame());
 
   TRACE_EVENT0("renderer", "RenderWidget::OnWasHidden");
 
@@ -961,9 +1046,11 @@ void RenderWidget::OnWasShown(
     bool was_evicted,
     const base::Optional<content::RecordTabSwitchTimeRequest>&
         record_tab_switch_time_request) {
-  // A frozen main frame widget does not become shown, since it has no frame
-  // associated with it. It must be thawed before changing visibility.
-  DCHECK(!is_frozen_);
+  // An undead or provisional main frame widget will never be hidden since that
+  // would require it to be shown first. The main frame must be attached to the
+  // frame tree before changing visibility.
+  DCHECK(!is_undead_);
+  DCHECK(!IsForProvisionalFrame());
 
   TRACE_EVENT_WITH_FLOW0("renderer", "RenderWidget::OnWasShown", routing_id(),
                          TRACE_EVENT_FLAG_FLOW_IN);
@@ -972,7 +1059,7 @@ void RenderWidget::OnWasShown(
 
   SetHidden(false);
   if (record_tab_switch_time_request) {
-    layer_tree_view_->layer_tree_host()->RequestPresentationTimeForNextFrame(
+    layer_tree_host_->RequestPresentationTimeForNextFrame(
         tab_switch_time_recorder_.TabWasShown(
             false /* has_saved_frames */,
             record_tab_switch_time_request.value(), show_request_timestamp));
@@ -998,9 +1085,8 @@ void RenderWidget::OnForceRedraw(int snapshot_id) {
 }
 
 void RenderWidget::RequestPresentation(PresentationTimeCallback callback) {
-  layer_tree_view_->layer_tree_host()->RequestPresentationTimeForNextFrame(
-      std::move(callback));
-  layer_tree_view_->layer_tree_host()->SetNeedsCommitWithForcedRedraw();
+  layer_tree_host_->RequestPresentationTimeForNextFrame(std::move(callback));
+  layer_tree_host_->SetNeedsCommitWithForcedRedraw();
 }
 
 void RenderWidget::DidPresentForceDrawFrame(
@@ -1015,14 +1101,14 @@ viz::FrameSinkId RenderWidget::GetFrameSinkIdAtPoint(const gfx::PointF& point,
 }
 
 bool RenderWidget::HasPendingPageScaleAnimation() const {
-  return layer_tree_view_->layer_tree_host()->HasPendingPageScaleAnimation();
+  return layer_tree_host_->HasPendingPageScaleAnimation();
 }
 
 bool RenderWidget::HandleInputEvent(
     const blink::WebCoalescedInputEvent& input_event,
     const ui::LatencyInfo& latency_info,
     HandledEventCallback callback) {
-  if (is_frozen_)
+  if (IsUndeadOrProvisional())
     return false;
   input_handler_->HandleInputEvent(input_event, latency_info,
                                    std::move(callback));
@@ -1038,22 +1124,35 @@ scoped_refptr<MainThreadEventQueue> RenderWidget::GetInputEventQueue() {
 }
 
 void RenderWidget::OnCursorVisibilityChange(bool is_visible) {
-  if (GetWebWidget())
-    GetWebWidget()->SetCursorVisibilityState(is_visible);
+  // This is a mojo IPC entry point. We don't want IPCs when undead.
+  if (IsUndeadOrProvisional())
+    return;
+
+  GetWebWidget()->SetCursorVisibilityState(is_visible);
 }
 
 void RenderWidget::OnFallbackCursorModeToggled(bool is_on) {
-  if (GetWebWidget())
-    GetWebWidget()->OnFallbackCursorModeToggled(is_on);
+  // This is a mojo IPC entry point. We don't want IPCs when undead.
+  if (IsUndeadOrProvisional())
+    return;
+
+  GetWebWidget()->OnFallbackCursorModeToggled(is_on);
 }
 
 void RenderWidget::OnMouseCaptureLost() {
-  if (GetWebWidget())
-    GetWebWidget()->MouseCaptureLost();
+  // This is a mojo IPC entry point. We don't want IPCs when undead.
+  if (IsUndeadOrProvisional())
+    return;
+
+  GetWebWidget()->MouseCaptureLost();
 }
 
 void RenderWidget::OnSetEditCommandsForNextKeyEvent(
     const EditCommands& edit_commands) {
+  // This is a mojo IPC entry point. We don't want IPCs when undead.
+  if (IsUndeadOrProvisional())
+    return;
+
   edit_commands_ = edit_commands;
 }
 
@@ -1063,21 +1162,21 @@ void RenderWidget::OnSetActive(bool active) {
 }
 
 void RenderWidget::OnSetFocus(bool enable) {
+  // This is a mojo IPC entry point. We don't want IPCs when undead.
+  if (IsUndeadOrProvisional())
+    return;
+
   if (delegate())
     delegate()->DidReceiveSetFocusEventForWidget();
-  SetFocus(enable);
-}
 
-void RenderWidget::SetFocus(bool enable) {
   has_focus_ = enable;
 
-  if (GetWebWidget())
-    GetWebWidget()->SetFocus(enable);
+  GetWebWidget()->SetFocus(enable);
 
   for (auto& observer : render_frames_)
     observer.RenderWidgetSetFocus(enable);
 
-  // Notify all BrowserPlugins of the RenderView's focus state.
+  // Notify all BrowserPlugins of the RenderWidget's focus state.
   if (BrowserPluginManager::Get())
     BrowserPluginManager::Get()->UpdateFocusState();
 }
@@ -1087,43 +1186,33 @@ void RenderWidget::SetFocus(bool enable) {
 
 void RenderWidget::ApplyViewportChanges(
     const cc::ApplyViewportChangesArgs& args) {
-  if (!GetWebWidget())
-    return;
   GetWebWidget()->ApplyViewportChanges(args);
 }
 
 void RenderWidget::RecordManipulationTypeCounts(cc::ManipulationInfo info) {
-  if (!GetWebWidget())
-    return;
   GetWebWidget()->RecordManipulationTypeCounts(info);
 }
 
 void RenderWidget::SendOverscrollEventFromImplSide(
     const gfx::Vector2dF& overscroll_delta,
     cc::ElementId scroll_latched_element_id) {
-  if (!GetWebWidget())
-    return;
   GetWebWidget()->SendOverscrollEventFromImplSide(overscroll_delta,
                                                   scroll_latched_element_id);
 }
 void RenderWidget::SendScrollEndEventFromImplSide(
     cc::ElementId scroll_latched_element_id) {
-  if (!GetWebWidget())
-    return;
   GetWebWidget()->SendScrollEndEventFromImplSide(scroll_latched_element_id);
 }
 
 void RenderWidget::BeginMainFrame(base::TimeTicks frame_time) {
-  if (!GetWebWidget())
-    return;
-
-  DCHECK(!is_frozen_);
+  DCHECK(!is_undead_);
+  DCHECK(!IsForProvisionalFrame());
 
   // We record metrics only when running in multi-threaded mode, not
   // single-thread mode for testing.
   bool record_main_frame_metrics =
       !!compositor_deps_->GetCompositorImplThreadTaskRunner();
-  if (input_event_queue_) {
+  {
     base::Optional<ScopedUkmRafAlignedInputTimer> ukm_timer;
     if (record_main_frame_metrics) {
       ukm_timer.emplace(GetWebWidget());
@@ -1135,23 +1224,30 @@ void RenderWidget::BeginMainFrame(base::TimeTicks frame_time) {
 }
 
 void RenderWidget::OnDeferMainFrameUpdatesChanged(bool deferral_state) {
+  // LayerTreeHost::CreateThreaded() will defer main frame updates immediately
+  // until it gets a LocalSurfaceIdAllocation. That's before the
+  // |widget_input_handler_manager_| is created, so it can be null here. We
+  // detect that by seeing a null LayerTreeHost.
+  // TODO(schenney): To avoid ping-ponging between defer main frame states
+  // during initialization, and requiring null checks here, we should probably
+  // pass the LocalSurfaceIdAllocation to the compositor while it is
+  // initialized so that it doesn't have to immediately switch into deferred
+  // mode without being requested to.
+  if (!layer_tree_host_)
+    return;
+
   // The input handler wants to know about the mainframe update status to
   // enable/disable input and for metrics.
-  if (widget_input_handler_manager_)
-    widget_input_handler_manager_->OnDeferMainFrameUpdatesChanged(
-        deferral_state);
+  widget_input_handler_manager_->OnDeferMainFrameUpdatesChanged(deferral_state);
 }
 
 void RenderWidget::OnDeferCommitsChanged(bool deferral_state) {
   // The input handler wants to know about the commit status for metric purposes
   // and to enable/disable input.
-  if (widget_input_handler_manager_)
-    widget_input_handler_manager_->OnDeferCommitsChanged(deferral_state);
+  widget_input_handler_manager_->OnDeferCommitsChanged(deferral_state);
 }
 
 void RenderWidget::DidBeginMainFrame() {
-  if (!GetWebWidget())
-    return;
   GetWebWidget()->DidBeginFrame();
 }
 
@@ -1160,48 +1256,21 @@ void RenderWidget::RequestNewLayerTreeFrameSink(
   // For widgets that are never visible, we don't start the compositor, so we
   // never get a request for a cc::LayerTreeFrameSink.
   DCHECK(!compositor_never_visible_);
-  // Frozen RenderWidgets should not be doing any compositing.
-  DCHECK(!is_frozen_);
-
-  if (is_closing()) {
-    // In this case, we drop the request which means the compositor waits
-    // forever, which is fine since we're going to destroy it.
-    return;
-  }
-
-  // If we have a warmup in progress, wait for that and store the callback
-  // to be run when the warmup completes.
-  if (warmup_frame_sink_request_pending_) {
-    after_warmup_callback_ = std::move(callback);
-    return;
-  }
-  // If a warmup previously completed, use the result.
-  if (warmup_frame_sink_) {
-    std::move(callback).Run(std::move(warmup_frame_sink_));
-    return;
-  }
-
-  DoRequestNewLayerTreeFrameSink(std::move(callback));
-}
-
-void RenderWidget::DoRequestNewLayerTreeFrameSink(
-    LayerTreeFrameSinkCallback callback) {
-  // TODO:(https://crbug.com/995981): If there is no WebWidget, then the
-  // RenderWidget should also be destroyed, and this DCHECK should not be
-  // necessary.
-  DCHECK(GetWebWidget());
+  // Undead RenderWidgets should not be doing any compositing. However note that
+  // widgets for provisional frames do start their compositor.
+  DCHECK(!is_undead_);
 
   // TODO(jonross): have this generated by the LayerTreeFrameSink itself, which
   // would then handle binding.
-  mojom::RenderFrameMetadataObserverPtr ptr;
-  mojom::RenderFrameMetadataObserverRequest request = mojo::MakeRequest(&ptr);
-  mojom::RenderFrameMetadataObserverClientPtrInfo client_info;
-  mojom::RenderFrameMetadataObserverClientRequest client_request =
-      mojo::MakeRequest(&client_info);
+  mojo::PendingRemote<mojom::RenderFrameMetadataObserver> observer_remote;
+  mojo::PendingRemote<mojom::RenderFrameMetadataObserverClient> client_remote;
+  mojo::PendingReceiver<mojom::RenderFrameMetadataObserverClient>
+      client_receiver = client_remote.InitWithNewPipeAndPassReceiver();
   auto render_frame_metadata_observer =
-      std::make_unique<RenderFrameMetadataObserverImpl>(std::move(request),
-                                                        std::move(client_info));
-  layer_tree_view_->SetRenderFrameObserver(
+      std::make_unique<RenderFrameMetadataObserverImpl>(
+          observer_remote.InitWithNewPipeAndPassReceiver(),
+          std::move(client_remote));
+  layer_tree_host_->SetRenderFrameObserver(
       std::move(render_frame_metadata_observer));
   GURL url = GetWebWidget()->GetURLForDebugTrace();
   // The |url| is not always available, fallback to a fixed string.
@@ -1215,9 +1284,8 @@ void RenderWidget::DoRequestNewLayerTreeFrameSink(
   // would also be used for other widgets such as popups.
   const char* client_name = for_child_local_root_frame_ ? kOOPIF : kRenderer;
   compositor_deps_->RequestNewLayerTreeFrameSink(
-      routing_id_, frame_swap_message_queue_, std::move(url),
-      std::move(callback), std::move(client_request), std::move(ptr),
-      client_name);
+      this, frame_swap_message_queue_, std::move(url), std::move(callback),
+      std::move(client_receiver), std::move(observer_remote), client_name);
 }
 
 void RenderWidget::DidCommitAndDrawCompositorFrame() {
@@ -1230,105 +1298,95 @@ void RenderWidget::DidCommitAndDrawCompositorFrame() {
 
   // Notify subclasses that we initiated the paint operation.
   DidInitiatePaint();
-
-  Send(new WidgetHostMsg_DidCommitAndDrawCompositorFrame(routing_id_));
 }
 
 void RenderWidget::WillCommitCompositorFrame() {
-  if (GetWebWidget())
-    GetWebWidget()->BeginCommitCompositorFrame();
+  DCHECK(!is_undead_);
+  GetWebWidget()->BeginCommitCompositorFrame();
 }
 
 void RenderWidget::DidCommitCompositorFrame() {
+  DCHECK(!is_undead_);
   if (delegate())
     delegate()->DidCommitCompositorFrameForWidget();
-  if (GetWebWidget())
-    GetWebWidget()->EndCommitCompositorFrame();
+  GetWebWidget()->EndCommitCompositorFrame();
 }
 
 void RenderWidget::DidCompletePageScaleAnimation() {
+  DCHECK(!is_undead_);
   if (delegate())
     delegate()->DidCompletePageScaleAnimationForWidget();
 }
 
 void RenderWidget::SetLayerTreeMutator(
     std::unique_ptr<cc::LayerTreeMutator> mutator) {
-  layer_tree_view_->layer_tree_host()->SetLayerTreeMutator(std::move(mutator));
+  layer_tree_host_->SetLayerTreeMutator(std::move(mutator));
 }
 
 void RenderWidget::SetPaintWorkletLayerPainterClient(
     std::unique_ptr<cc::PaintWorkletLayerPainter> client) {
-  layer_tree_view_->layer_tree_host()->SetPaintWorkletLayerPainter(
-      std::move(client));
+  layer_tree_host_->SetPaintWorkletLayerPainter(std::move(client));
 }
 
 void RenderWidget::SetRootLayer(scoped_refptr<cc::Layer> layer) {
-  layer_tree_view_->layer_tree_host()->SetRootLayer(std::move(layer));
+  layer_tree_host_->SetRootLayer(std::move(layer));
 }
 
 void RenderWidget::ScheduleAnimation() {
   // This call is not needed in single thread mode for tests without a
   // scheduler, but they override this method in order to schedule a synchronous
   // composite task themselves.
-  layer_tree_view_->SetNeedsBeginFrame();
+  layer_tree_host_->SetNeedsAnimate();
 }
 
 void RenderWidget::SetShowFPSCounter(bool show) {
-  cc::LayerTreeHost* host = layer_tree_view_->layer_tree_host();
-  cc::LayerTreeDebugState debug_state = host->GetDebugState();
+  cc::LayerTreeDebugState debug_state = layer_tree_host_->GetDebugState();
   debug_state.show_fps_counter = show;
-  host->SetDebugState(debug_state);
+  layer_tree_host_->SetDebugState(debug_state);
 }
 
 void RenderWidget::SetShowLayoutShiftRegions(bool show) {
-  cc::LayerTreeHost* host = layer_tree_view_->layer_tree_host();
-  cc::LayerTreeDebugState debug_state = host->GetDebugState();
+  cc::LayerTreeDebugState debug_state = layer_tree_host_->GetDebugState();
   debug_state.show_layout_shift_regions = show;
-  host->SetDebugState(debug_state);
+  layer_tree_host_->SetDebugState(debug_state);
 }
 
 void RenderWidget::SetShowPaintRects(bool show) {
-  cc::LayerTreeHost* host = layer_tree_view_->layer_tree_host();
-  cc::LayerTreeDebugState debug_state = host->GetDebugState();
+  cc::LayerTreeDebugState debug_state = layer_tree_host_->GetDebugState();
   debug_state.show_paint_rects = show;
-  host->SetDebugState(debug_state);
+  layer_tree_host_->SetDebugState(debug_state);
 }
 
 void RenderWidget::SetShowDebugBorders(bool show) {
-  cc::LayerTreeHost* host = layer_tree_view_->layer_tree_host();
-  cc::LayerTreeDebugState debug_state = host->GetDebugState();
+  cc::LayerTreeDebugState debug_state = layer_tree_host_->GetDebugState();
   if (show)
     debug_state.show_debug_borders.set();
   else
     debug_state.show_debug_borders.reset();
-  host->SetDebugState(debug_state);
+  layer_tree_host_->SetDebugState(debug_state);
 }
 
 void RenderWidget::SetShowScrollBottleneckRects(bool show) {
-  cc::LayerTreeHost* host = layer_tree_view_->layer_tree_host();
-  cc::LayerTreeDebugState debug_state = host->GetDebugState();
+  cc::LayerTreeDebugState debug_state = layer_tree_host_->GetDebugState();
   debug_state.show_touch_event_handler_rects = show;
   debug_state.show_wheel_event_handler_rects = show;
   debug_state.show_non_fast_scrollable_rects = show;
-  host->SetDebugState(debug_state);
+  layer_tree_host_->SetDebugState(debug_state);
 }
 
 void RenderWidget::SetShowHitTestBorders(bool show) {
-  cc::LayerTreeHost* host = layer_tree_view_->layer_tree_host();
-  cc::LayerTreeDebugState debug_state = host->GetDebugState();
+  cc::LayerTreeDebugState debug_state = layer_tree_host_->GetDebugState();
   debug_state.show_hit_test_borders = show;
-  host->SetDebugState(debug_state);
+  layer_tree_host_->SetDebugState(debug_state);
 }
 
 void RenderWidget::SetBackgroundColor(SkColor color) {
-  layer_tree_view_->layer_tree_host()->set_background_color(color);
+  layer_tree_host_->set_background_color(color);
 }
 
 void RenderWidget::UpdateVisualState() {
-  if (!GetWebWidget())
-    return;
-
-  DCHECK(!is_frozen_);
+  DCHECK(!is_undead_);
+  DCHECK(!IsForProvisionalFrame());
 
   // We record metrics only when running in multi-threaded mode, not
   // single-thread mode for testing.
@@ -1370,30 +1428,34 @@ void RenderWidget::RecordTimeToFirstActivePaint() {
 }
 
 void RenderWidget::RecordStartOfFrameMetrics() {
-  if (GetWebWidget())
-    GetWebWidget()->RecordStartOfFrameMetrics();
+  DCHECK(!is_undead_);
+  GetWebWidget()->RecordStartOfFrameMetrics();
 }
 
 void RenderWidget::RecordEndOfFrameMetrics(base::TimeTicks frame_begin_time) {
-  if (GetWebWidget())
-    GetWebWidget()->RecordEndOfFrameMetrics(frame_begin_time);
+  DCHECK(!is_undead_);
+  GetWebWidget()->RecordEndOfFrameMetrics(frame_begin_time);
+}
+
+std::unique_ptr<cc::BeginMainFrameMetrics>
+RenderWidget::GetBeginMainFrameMetrics() {
+  DCHECK(!is_undead_);
+  return GetWebWidget()->GetBeginMainFrameMetrics();
 }
 
 void RenderWidget::BeginUpdateLayers() {
-  if (GetWebWidget())
-    GetWebWidget()->BeginUpdateLayers();
+  DCHECK(!is_undead_);
+  GetWebWidget()->BeginUpdateLayers();
 }
 
 void RenderWidget::EndUpdateLayers() {
-  if (GetWebWidget())
-    GetWebWidget()->EndUpdateLayers();
+  DCHECK(!is_undead_);
+  GetWebWidget()->EndUpdateLayers();
 }
 
 void RenderWidget::WillBeginCompositorFrame() {
   TRACE_EVENT0("gpu", "RenderWidget::willBeginCompositorFrame");
-
-  if (!GetWebWidget())
-    return;
+  DCHECK(!is_undead_);
 
   GetWebWidget()->SetSuppressFrameRequestsWorkaroundFor704763Only(true);
 
@@ -1466,10 +1528,6 @@ void RenderWidget::SetInputHandler(RenderWidgetInputHandler* input_handler) {
 }
 
 void RenderWidget::ShowVirtualKeyboard() {
-  // Blink can continue running and change input state between the Close IPC
-  // and the task that actually closes this class.
-  if (closing_)
-    return;
   UpdateTextInputStateInternal(true, false);
 }
 
@@ -1483,10 +1541,6 @@ void RenderWidget::ClearTextInputState() {
 }
 
 void RenderWidget::UpdateTextInputState() {
-  // Blink can continue running and change input state between the Close IPC
-  // and the task that actually closes this class.
-  if (closing_)
-    return;
   UpdateTextInputStateInternal(false, false);
 }
 
@@ -1578,7 +1632,7 @@ void RenderWidget::UpdateTextInputStateInternal(bool show_virtual_keyboard,
     // new RenderFrameMetadata, as the IME will need this info to be updated.
     // TODO(ericrk): Consider folding the above IPC into RenderFrameMetadata.
     // https://crbug.com/912309
-    layer_tree_view_->RequestForceSendMetadata();
+    layer_tree_host_->RequestForceSendMetadata();
 #endif
   }
 }
@@ -1601,105 +1655,88 @@ bool RenderWidget::WillHandleMouseEvent(const blink::WebMouseEvent& event) {
   possible_drag_event_info_.event_location =
       gfx::Point(event.PositionInScreen().x, event.PositionInScreen().y);
 
-  if (delegate())
-    return delegate()->RenderWidgetWillHandleMouseEventForWidget(event);
-
-  return false;
+  return mouse_lock_dispatcher()->WillHandleMouseEvent(event);
 }
 
-///////////////////////////////////////////////////////////////////////////////
-// RenderWidgetScreenMetricsDelegate
-
 void RenderWidget::ResizeWebWidget() {
-  gfx::Size size = GetSizeForWebWidget();
+  // In auto resize mode, blink controls sizes and RenderWidget should not be
+  // passing values back in.
+  DCHECK(!auto_resize_mode_);
+
+  // The widget size given to blink is scaled by the (non-emulated,
+  // see https://crbug.com/819903) device scale factor (if UseZoomForDSF is
+  // enabled).
+  gfx::Size size_for_blink;
+  if (!compositor_deps_->IsUseZoomForDSFEnabled()) {
+    size_for_blink = size_;
+  } else {
+    size_for_blink = gfx::ScaleToCeiledSize(
+        size_, GetOriginalScreenInfo().device_scale_factor);
+  }
+
   if (delegate()) {
-    delegate()->ResizeWebWidgetForWidget(size, top_controls_height_,
+    // The visual viewport size given to blink is scaled by the (non-emulated,
+    // see https://crbug.com/819903) device scale factor (if UseZoomForDSF is
+    // enabled).
+    gfx::Size visible_viewport_size_for_blink;
+    if (!compositor_deps_->IsUseZoomForDSFEnabled()) {
+      visible_viewport_size_for_blink = visible_viewport_size_;
+    } else {
+      visible_viewport_size_for_blink = gfx::ScaleToCeiledSize(
+          visible_viewport_size_, GetOriginalScreenInfo().device_scale_factor);
+    }
+
+    // When associated with a RenderView, the RenderView is in control of the
+    // main frame's size, because it includes other factors for top and bottom
+    // controls.
+    delegate()->ResizeWebWidgetForWidget(size_for_blink, top_controls_height_,
                                          bottom_controls_height_,
                                          browser_controls_shrink_blink_size_);
-    return;
-  }
-  // TODO:(https://crbug.com/995981): If there is no WebWidget, then the
-  // RenderWidget should also be destroyed, and this DCHECK should not be
-  // necessary.
-  DCHECK(GetWebWidget());
-  GetWebWidget()->Resize(size);
-}
-
-gfx::Size RenderWidget::GetSizeForWebWidget() const {
-  if (compositor_deps_->IsUseZoomForDSFEnabled()) {
-    return gfx::ScaleToCeiledSize(size_,
-                                  GetOriginalScreenInfo().device_scale_factor);
+    delegate()->ResizeVisualViewportForWidget(visible_viewport_size_for_blink);
+  } else {
+    // When not associated with a RenderView, the RenderWidget is in control of
+    // the frame's (or other type of widget's) size.
+    GetWebWidget()->Resize(size_for_blink);
   }
-
-  return size_;
 }
 
 gfx::Rect RenderWidget::CompositorViewportRect() const {
-  return layer_tree_view_->layer_tree_host()->device_viewport_rect();
+  return layer_tree_host_->device_viewport_rect();
 }
 
-void RenderWidget::UpdateZoom(double zoom_level) {
-  blink::WebFrameWidget* frame_widget = GetFrameWidget();
-  if (!frame_widget)
-    return;
-  RenderFrameImpl* render_frame =
-      RenderFrameImpl::FromWebFrame(frame_widget->LocalRoot());
-
-  // Return early if zoom level is unchanged.
-  if (render_frame->GetZoomLevel() == zoom_level) {
-    return;
-  }
-
-  render_frame->SetZoomLevel(zoom_level);
-
-  for (auto& observer : render_frame_proxies_)
-    observer.OnZoomLevelChanged(zoom_level);
-
-  for (auto& plugin : browser_plugins_)
-    plugin.OnZoomLevelChanged(zoom_level);
-}
-
-void RenderWidget::SynchronizeVisualProperties(
-    const VisualProperties& visual_properties) {
-  gfx::Rect new_compositor_viewport_pixel_rect =
-      visual_properties.auto_resize_enabled
-          ? gfx::Rect(gfx::ScaleToCeiledSize(
-                size_, visual_properties.screen_info.device_scale_factor))
-          : visual_properties.compositor_viewport_pixel_rect;
-  UpdateSurfaceAndScreenInfo(
-      visual_properties.local_surface_id_allocation.value_or(
-          viz::LocalSurfaceIdAllocation()),
-      new_compositor_viewport_pixel_rect, visual_properties.screen_info);
-  UpdateCaptureSequenceNumber(visual_properties.capture_sequence_number);
-  layer_tree_view_->layer_tree_host()->SetBrowserControlsHeight(
-      visual_properties.top_controls_height,
-      visual_properties.bottom_controls_height,
-      visual_properties.browser_controls_shrink_blink_size);
-
-  UpdateZoom(visual_properties.zoom_level);
-
-  if (!visual_properties.auto_resize_enabled) {
-    visible_viewport_size_ = visual_properties.visible_viewport_size;
-    display_mode_ = visual_properties.display_mode;
-    size_ = visual_properties.new_size;
+void RenderWidget::SetScreenInfoAndSize(
+    const ScreenInfo& screen_info,
+    const gfx::Size& widget_size,
+    const gfx::Size& visible_viewport_size) {
+  // Emulation only happens on the main frame.
+  DCHECK(delegate());
+  DCHECK(for_frame());
+  // Emulation happens on regular main frames which don't use auto-resize mode.
+  DCHECK(!auto_resize_mode_);
 
-    ResizeWebWidget();
+  UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
+                             CompositorViewportRect(), screen_info);
 
-    gfx::Size visual_viewport_size = visible_viewport_size_;
-    if (compositor_deps_->IsUseZoomForDSFEnabled()) {
-      visual_viewport_size = gfx::ScaleToCeiledSize(
-          visual_viewport_size, GetOriginalScreenInfo().device_scale_factor);
-    }
-    // When this function is invoked for a main frame widget, it is only if
-    // (i) we are initializing the widget, or (ii) the widget supports a local
-    // mainframe. For widgets supporting a remote main frame, the visual
-    // viewport is updated through the RenderView.
-    if (delegate())
-      delegate()->ResizeVisualViewportForWidget(visual_viewport_size);
+  RenderFrameImpl* render_frame =
+      RenderFrameImpl::FromWebFrame(GetFrameWidget()->LocalRoot());
+  // UpdateSurfaceAndScreenInfo() changes properties including the device scale
+  // factor, which changes PreferCompositingToLCDText decisions.
+  // TODO(danakj): Do this in UpdateSurfaceAndScreenInfo? But requires a Resize
+  // to happen after (see comment on
+  // SetPreferCompositingToLCDTextEnabledOnRenderView).
+  //
+  // This causes compositing state to be modified which dirties the document
+  // lifecycle. Android Webview relies on the document lifecycle being clean
+  // after the RenderWidget is initialized, in order to send IPCs that query
+  // and change compositing state. So ResizeWebWidget() must come after this
+  // call, as it runs the entire document lifecycle.
+  render_frame->SetPreferCompositingToLCDTextEnabledOnRenderView(
+      ComputePreferCompositingToLCDText(compositor_deps_,
+                                        screen_info_.device_scale_factor));
 
-    // NOTE: We may have entered fullscreen mode without changing our size.
-    SetIsFullscreen(visual_properties.is_fullscreen_granted);
-  }
+  visible_viewport_size_ = visible_viewport_size;
+  size_ = widget_size;
+  ResizeWebWidget();
 }
 
 void RenderWidget::SetScreenMetricsEmulationParameters(
@@ -1754,9 +1791,6 @@ void RenderWidget::SetHandlingInputEvent(bool handling_input_event) {
 }
 
 void RenderWidget::QueueMessage(std::unique_ptr<IPC::Message> msg) {
-  if (closing_)
-    return;
-
   // RenderThreadImpl::current() is NULL in some tests.
   if (!RenderThreadImpl::current()) {
     Send(msg.release());
@@ -1766,10 +1800,9 @@ void RenderWidget::QueueMessage(std::unique_ptr<IPC::Message> msg) {
   std::unique_ptr<cc::SwapPromise> swap_promise =
       QueueMessageImpl(std::move(msg), frame_swap_message_queue_.get(),
                        RenderThreadImpl::current()->sync_message_filter(),
-                       layer_tree_view_->GetSourceFrameNumber());
+                       layer_tree_host_->SourceFrameNumber());
   if (swap_promise) {
-    layer_tree_view_->layer_tree_host()->QueueSwapPromise(
-        std::move(swap_promise));
+    layer_tree_host_->QueueSwapPromise(std::move(swap_promise));
   }
 }
 
@@ -1825,7 +1858,8 @@ void RenderWidget::Show(WebNavigationPolicy policy) {
   SetPendingWindowRect(initial_rect_);
 }
 
-LayerTreeView* RenderWidget::InitializeLayerTreeView() {
+void RenderWidget::InitCompositing(const ScreenInfo& screen_info) {
+  DCHECK(!is_undead_);
   TRACE_EVENT0("blink", "RenderWidget::InitializeLayerTreeView");
 
   layer_tree_view_ = std::make_unique<LayerTreeView>(
@@ -1835,30 +1869,41 @@ LayerTreeView* RenderWidget::InitializeLayerTreeView() {
       compositor_deps_->GetWebMainThreadScheduler());
   layer_tree_view_->Initialize(
       GenerateLayerTreeSettings(compositor_deps_, for_child_local_root_frame_,
-                                screen_info_.rect.size(),
-                                screen_info_.device_scale_factor),
+                                screen_info.rect.size(),
+                                screen_info.device_scale_factor),
       compositor_deps_->CreateUkmRecorderFactory());
+  layer_tree_host_ = layer_tree_view_->layer_tree_host();
 
-  UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
-                             CompositorViewportRect(), screen_info_);
-  // If the widget is hidden, delay starting the compositor until the user shows
-  // it. Also if the RenderWidget is frozen, we delay starting the compositor
-  // until we expect to use the widget, which will be signaled through
-  // WarmupCompositor().
-  if (!is_frozen_ && !is_hidden_)
-    StartStopCompositor();
-
-  DCHECK_NE(MSG_ROUTING_NONE, routing_id_);
+  blink::scheduler::WebThreadScheduler* main_thread_scheduler =
+      compositor_deps_->GetWebMainThreadScheduler();
 
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  if (render_thread) {
-    input_event_queue_ = base::MakeRefCounted<MainThreadEventQueue>(
-        this, render_thread->GetWebMainThreadScheduler()->InputTaskRunner(),
-        render_thread->GetWebMainThreadScheduler(),
-        /*allow_raf_aligned_input=*/!compositor_never_visible_);
+  blink::scheduler::WebThreadScheduler* compositor_thread_scheduler =
+      blink::scheduler::WebThreadScheduler::CompositorThreadScheduler();
+  scoped_refptr<base::SingleThreadTaskRunner> compositor_input_task_runner;
+  // Use the compositor thread task runner unless this is a popup or other such
+  // non-frame widgets. The |compositor_thread_scheduler| can be null in tests
+  // without a compositor thread.
+  if (for_frame() && compositor_thread_scheduler) {
+    compositor_input_task_runner =
+        compositor_thread_scheduler->InputTaskRunner();
   }
 
-  return layer_tree_view_.get();
+  input_event_queue_ = base::MakeRefCounted<MainThreadEventQueue>(
+      this, main_thread_scheduler->InputTaskRunner(), main_thread_scheduler,
+      /*allow_raf_aligned_input=*/!compositor_never_visible_);
+
+  // We only use an external input handler for frame RenderWidgets because only
+  // frames use the compositor for input handling. Other kinds of RenderWidgets
+  // (e.g.  popups, plugins) must forward their input directly through
+  // RenderWidgetInputHandler into Blink.
+  bool uses_input_handler = for_frame();
+  widget_input_handler_manager_ = WidgetInputHandlerManager::Create(
+      weak_ptr_factory_.GetWeakPtr(), std::move(compositor_input_task_runner),
+      main_thread_scheduler, uses_input_handler);
+  const base::CommandLine& command_line =
+      *base::CommandLine::ForCurrentProcess();
+  if (command_line.HasSwitch(switches::kAllowPreCommitInput))
+    widget_input_handler_manager_->AllowPreCommitInput();
 }
 
 void RenderWidget::StartStopCompositor() {
@@ -1866,17 +1911,18 @@ void RenderWidget::StartStopCompositor() {
     return;
 
   // TODO(danakj): We should start the compositor before becoming shown for
-  // *all* provisional frames not just provisional main frames (as they become
-  // thawed). However we need to also prevent BeginMainFrame from occurring, in
-  // both cases, until the frame is attached at least. And in the case of main
-  // frames, until blink requests them through StopDeferringMainFrameUpdate().
-  if (is_frozen_) {
+  // *all* provisional frames not just provisional main frames (as they come
+  // back from being undead). However we need to also prevent BeginMainFrame
+  // from occurring, in both cases, until the frame is attached at least. And in
+  // the case of main frames, until blink requests them through
+  // StopDeferringMainFrameUpdate().
+  if (is_undead_) {
     layer_tree_view_->SetVisible(false);
     // Drop all gpu resources, this makes SetVisible(true) more expensive/slower
     // but we don't expect to use this RenderWidget again until some possible
     // future navigation. This brings us a bit closer to emulating deleting the
     // RenderWidget instead of just stopping the compositor.
-    layer_tree_view_->ReleaseLayerTreeFrameSink();
+    layer_tree_host_->ReleaseLayerTreeFrameSink();
   } else if (is_hidden_) {
     layer_tree_view_->SetVisible(false);
   } else {
@@ -1884,66 +1930,30 @@ void RenderWidget::StartStopCompositor() {
   }
 }
 
-void RenderWidget::SetIsFrozen(bool is_frozen) {
-  DCHECK_NE(is_frozen, is_frozen_);
-  is_frozen_ = is_frozen;
-  // If hidden, then frozen changing doesn't change anything with the
-  // compositor since when hidden the compositor is always stopped.
-  if (!is_hidden_)
-    StartStopCompositor();
-}
-
-void RenderWidget::WarmupCompositor() {
-  DCHECK(is_frozen_);
-  if (compositor_never_visible_)
-    return;
-
-  // Keeping things simple. This would cancel any outstanding warmup if we
-  // happened to have one (this should be basically impossible). This avoids any
-  // extra book keeping about the outstanding reqeust.
-  warmup_weak_ptr_factory_.InvalidateWeakPtrs();
-  // And if we already did a warmup then we're done.
-  if (warmup_frame_sink_)
-    return;
-
-  // Mark us pending the warmup frame sink *before* calling
-  // DoRequestNewLayerTreeFrameSink() as it may run the reply callback
-  // synchronously. So we don't want to change any state after the call
-  // to DoRequestNewLayerTreeFrameSink() here.
-  warmup_frame_sink_request_pending_ = true;
-
-  auto cb = base::BindOnce(&RenderWidget::OnReplyForWarmupCompositor,
-                           warmup_weak_ptr_factory_.GetWeakPtr());
-  DoRequestNewLayerTreeFrameSink(std::move(cb));
-}
-
-void RenderWidget::OnReplyForWarmupCompositor(
-    std::unique_ptr<cc::LayerTreeFrameSink> sink) {
-  warmup_frame_sink_request_pending_ = false;
+void RenderWidget::SetIsUndead(bool is_undead) {
+  DCHECK_NE(is_undead, is_undead_);
+  is_undead_ = is_undead;
 
-  if (after_warmup_callback_)
-    std::move(after_warmup_callback_).Run(std::move(sink));
-  else
-    warmup_frame_sink_ = std::move(sink);
-}
-
-void RenderWidget::AbortWarmupCompositor() {
-  warmup_frame_sink_request_pending_ = false;
-  // Drop any pending warmup.
-  warmup_weak_ptr_factory_.InvalidateWeakPtrs();
-  // And drop any completed one.
-  warmup_frame_sink_.reset();
+  if (is_undead_) {
+    StartStopCompositor();
 
-  // If we had saved a callback to run after warmup, just do so now indicating
-  // failure.
-  if (after_warmup_callback_)
-    std::move(after_warmup_callback_).Run(nullptr);
+    webwidget_->Close();
+    webwidget_ = nullptr;
+    // Remove undead RenderWidgets from the routing map so that they cannot be
+    // looked up with FromRoutingId().
+    g_routing_id_widget_map.Get().erase(routing_id_);
+  } else {
+    // When revived from undead, act like a "new RenderWidget". This method is
+    // equivalent to the constructor, and initialization comes separately
+    // through InitForRevivedMainFrame().
+    g_routing_id_widget_map.Get().emplace(routing_id_, this);
+  }
 }
 
 // static
 void RenderWidget::DoDeferredClose(int widget_routing_id) {
   // DoDeferredClose() was a posted task, which means the RenderWidget may have
-  // become frozen in the meantime. Frozen RenderWidgets do not send messages,
+  // become undead in the meantime. Undead RenderWidgets do not send messages,
   // so break the dependency on RenderWidget here, by making this method static
   // and going to RenderThread directly to send.
   RenderThread::Get()->Send(new WidgetHostMsg_Close(widget_routing_id));
@@ -1959,13 +1969,6 @@ void RenderWidget::ClosePopupWidgetSoon() {
 
 void RenderWidget::CloseWidgetSoon() {
   DCHECK(RenderThread::IsMainThread());
-  // Prevent compositor from setting up new IPC channels, since we know a
-  // WidgetMsg_Close is coming. We do this immediately, not in DoDeferredClose,
-  // as the caller (eg WebPagePopupImpl) may start tearing down things after
-  // calling this method, including detaching the frame from this RenderWidget.
-  // Then trying to make a LayerTreeFrameSink would crash.
-  // https://crbug.com/906340
-  host_will_close_this_ = true;
 
   // If a page calls window.close() twice, we'll end up here twice, but that's
   // OK.  It is safe to send multiple Close messages.
@@ -1976,112 +1979,135 @@ void RenderWidget::CloseWidgetSoon() {
   // loops running and handling the resuliting Close IPC. So instead, post a
   // message back to the message loop, which won't run until the JS is
   // complete, and then the Close request can be sent.
-  GetCleanupTaskRunner()->PostTask(
+  compositor_deps_->GetCleanupTaskRunner()->PostTask(
       FROM_HERE, base::BindOnce(&RenderWidget::DoDeferredClose, routing_id_));
 }
 
 void RenderWidget::Close(std::unique_ptr<RenderWidget> widget) {
-  layer_tree_view_.reset();
-  // Note the ACK is a control message going to the RenderProcessHost.
-  RenderThread::Get()->Send(new WidgetHostMsg_Close_ACK(routing_id()));
-  closed_ = true;
-
   // At the end of this method, |widget| which points to this is deleted.
   DCHECK_EQ(widget.get(), this);
-}
+  DCHECK(RenderThread::IsMainThread());
+  DCHECK(!closing_);
 
-void RenderWidget::CloseWebWidget() {
-  // If the browser has not sent OnDisableDeviceEmulation, we have an emulator
-  // hanging out still. Destroying it must happen *after* the IPC route is
-  // removed so that another IPC does not arrive and re-create the emulator
-  // during closing.
-  //
-  // This destruction is normally part of an IPC and expects objects to be alive
-  // that would be alive while the IPC route is active such as the
-  // |layer_tree_view_|. So we ensure that it is the first thing to be
-  // destroyed here before deleting things from the RenderWidget or the
-  // delegate().
-  //
-  // TODO(danakj): The emulator could reset to non-emulated values in an
-  // explicit method call (instead of in the destructor) that occurs when
-  // emulation is disabled, but does not need to occur during RenderWidget
-  // closing. Then we would not have to destroy this so carefully.
-  screen_metrics_emulator_.reset();
-
-  // TODO(https://crbug.com/995981): This logic is very confusing and should be
-  // fixed. When the RenderWidget is associated with a RenderView,
-  // webwidget_internal_ points to an instance of WebView. This is owned by the
-  // RenderView, which also owns the RenderWidget and is calling into this
-  // method. We do nothing here and let RenderView destroy the WebView.
-  //
-  // For all other RenderWidgets, webwidget_internal_ points at a 'real'
-  // instance of a WebWidget which is owned by the RenderWidget. In this case,
-  // we must close the webwidget.
-  if (!delegate())
-    webwidget_internal_->Close();
-  webwidget_internal_ = nullptr;
+  closing_ = true;
 
-  close_weak_ptr_factory_.InvalidateWeakPtrs();
-}
+  // Browser correspondence is no longer needed at this point.
+  if (routing_id_ != MSG_ROUTING_NONE) {
+    RenderThread::Get()->RemoveRoute(routing_id_);
+    g_routing_id_widget_map.Get().erase(routing_id_);
+  }
 
-void RenderWidget::UpdateWebViewWithDeviceScaleFactor() {
-  blink::WebFrameWidget* frame_widget = GetFrameWidget();
-  blink::WebFrame* current_frame =
-      frame_widget ? frame_widget->LocalRoot() : nullptr;
-  blink::WebView* webview = current_frame ? current_frame->View() : nullptr;
-  if (webview) {
-    if (compositor_deps_->IsUseZoomForDSFEnabled())
-      webview->SetZoomFactorForDeviceScaleFactor(
-          GetWebScreenInfo().device_scale_factor);
-    else
-      webview->SetDeviceScaleFactor(GetWebScreenInfo().device_scale_factor);
+  // The |webwidget_| will be null when the main frame RenderWidget is undead.
+  if (webwidget_)
+    webwidget_->Close();
+  webwidget_ = nullptr;
+
+  // A RenderWidget can be created as undead and never revived, so never
+  // initialized compositing.
+  if (layer_tree_view_) {
+    // The |input_event_queue_| is refcounted and will live while an event is
+    // being handled. This drops the connection back to this RenderWidget which
+    // is being destroyed.
+    input_event_queue_->ClearClient();
 
-    webview->GetSettings()->SetPreferCompositingToLCDTextEnabled(
-        PreferCompositingToLCDText(compositor_deps_,
-                                   GetWebScreenInfo().device_scale_factor));
+    // The LayerTreeHost may already be in the call stack, if this RenderWidget
+    // is being destroyed during an animation callback for instance. We can not
+    // delete it here and unwind the stack back up to it, or it will crash. So
+    // we post the deletion to another task, but disconnect the LayerTreeHost
+    // (via the LayerTreeView) from the destroying RenderWidget. The
+    // LayerTreeView owns the LayerTreeHost, and is its client, so they are kept
+    // alive together for a clean call stack.
+    layer_tree_view_->Disconnect();
+    compositor_deps_->GetCleanupTaskRunner()->DeleteSoon(
+        FROM_HERE, std::move(layer_tree_view_));
+    // The |widget_input_handler_manager_| is referenced through the
+    // LayerTreeHost on the compositor thread, so must outlive the
+    // LayerTreeHost.
+    compositor_deps_->GetCleanupTaskRunner()->ReleaseSoon(
+        FROM_HERE, std::move(widget_input_handler_manager_));
   }
+
+  // Note the ACK is a control message going to the RenderProcessHost.
+  RenderThread::Get()->Send(new WidgetHostMsg_Close_ACK(routing_id()));
 }
 
 blink::WebFrameWidget* RenderWidget::GetFrameWidget() const {
   // TODO(danakj): Remove this check and don't call this method for non-frames.
   if (!for_frame())
     return nullptr;
-  // TODO(danakj): Is this needed? IPCs stop after closing, but code used to
-  // check for a null WebWidget.
-  if (closing_)
-    return nullptr;
-
-  return static_cast<blink::WebFrameWidget*>(webwidget_internal_);
+  return static_cast<blink::WebFrameWidget*>(webwidget_);
 }
 
-void RenderWidget::ScreenRectToEmulatedIfNeeded(WebRect* window_rect) const {
-  DCHECK(window_rect);
-  float scale = popup_origin_scale_for_emulation_;
-  if (!scale)
-    return;
-  window_rect->x =
-      popup_view_origin_for_emulation_.x() +
-      (window_rect->x - popup_screen_origin_for_emulation_.x()) / scale;
-  window_rect->y =
-      popup_view_origin_for_emulation_.y() +
-      (window_rect->y - popup_screen_origin_for_emulation_.y()) / scale;
-}
-
-void RenderWidget::EmulatedToScreenRectIfNeeded(WebRect* window_rect) const {
-  DCHECK(window_rect);
-  float scale = popup_origin_scale_for_emulation_;
-  if (!scale)
-    return;
-  window_rect->x =
-      popup_screen_origin_for_emulation_.x() +
-      (window_rect->x - popup_view_origin_for_emulation_.x()) * scale;
-  window_rect->y =
-      popup_screen_origin_for_emulation_.y() +
-      (window_rect->y - popup_view_origin_for_emulation_.y()) * scale;
+bool RenderWidget::IsForProvisionalFrame() const {
+  if (!for_frame())
+    return false;
+  // No widget here means the main frame is remote and there is no
+  // provisional frame at the moment.
+  if (!webwidget_)
+    return false;
+  auto* frame_widget = static_cast<blink::WebFrameWidget*>(webwidget_);
+  return frame_widget->LocalRoot()->IsProvisional();
+}
+
+void RenderWidget::ScreenRectToEmulated(gfx::Rect* screen_rect) const {
+  screen_rect->set_x(
+      opener_widget_screen_origin_.x() +
+      (screen_rect->x() - opener_original_widget_screen_origin_.x()) /
+          opener_emulator_scale_);
+  screen_rect->set_y(
+      opener_widget_screen_origin_.y() +
+      (screen_rect->y() - opener_original_widget_screen_origin_.y()) /
+          opener_emulator_scale_);
+}
+
+void RenderWidget::EmulatedToScreenRect(gfx::Rect* screen_rect) const {
+  screen_rect->set_x(opener_original_widget_screen_origin_.x() +
+                     (screen_rect->x() - opener_widget_screen_origin_.x()) *
+                         opener_emulator_scale_);
+  screen_rect->set_y(opener_original_widget_screen_origin_.y() +
+                     (screen_rect->y() - opener_widget_screen_origin_.y()) *
+                         opener_emulator_scale_);
+}
+
+blink::WebScreenInfo RenderWidget::GetScreenInfo() {
+  const ScreenInfo& info = screen_info_;
+
+  blink::WebScreenInfo web_screen_info;
+  web_screen_info.device_scale_factor = info.device_scale_factor;
+  web_screen_info.color_space = info.color_space;
+  web_screen_info.depth = info.depth;
+  web_screen_info.depth_per_component = info.depth_per_component;
+  web_screen_info.is_monochrome = info.is_monochrome;
+  web_screen_info.rect = blink::WebRect(info.rect);
+  web_screen_info.available_rect = blink::WebRect(info.available_rect);
+  switch (info.orientation_type) {
+    case SCREEN_ORIENTATION_VALUES_PORTRAIT_PRIMARY:
+      web_screen_info.orientation_type =
+          blink::kWebScreenOrientationPortraitPrimary;
+      break;
+    case SCREEN_ORIENTATION_VALUES_PORTRAIT_SECONDARY:
+      web_screen_info.orientation_type =
+          blink::kWebScreenOrientationPortraitSecondary;
+      break;
+    case SCREEN_ORIENTATION_VALUES_LANDSCAPE_PRIMARY:
+      web_screen_info.orientation_type =
+          blink::kWebScreenOrientationLandscapePrimary;
+      break;
+    case SCREEN_ORIENTATION_VALUES_LANDSCAPE_SECONDARY:
+      web_screen_info.orientation_type =
+          blink::kWebScreenOrientationLandscapeSecondary;
+      break;
+    default:
+      web_screen_info.orientation_type = blink::kWebScreenOrientationUndefined;
+      break;
+  }
+  web_screen_info.orientation_angle = info.orientation_angle;
+
+  return web_screen_info;
 }
 
 WebRect RenderWidget::WindowRect() {
-  WebRect rect;
+  gfx::Rect rect;
   if (pending_window_rect_count_) {
     // NOTE(mbelshe): If there is a pending_window_rect_, then getting
     // the RootWindowRect is probably going to return wrong results since the
@@ -2093,13 +2119,24 @@ WebRect RenderWidget::WindowRect() {
     rect = window_screen_rect_;
   }
 
-  ScreenRectToEmulatedIfNeeded(&rect);
+  // Popup widgets aren't emulated, but the WindowRect (aka WindowScreenRect)
+  // given to them should be.
+  if (opener_emulator_scale_) {
+    DCHECK(popup_);
+    ScreenRectToEmulated(&rect);
+  }
   return rect;
 }
 
 WebRect RenderWidget::ViewRect() {
-  WebRect rect = widget_screen_rect_;
-  ScreenRectToEmulatedIfNeeded(&rect);
+  gfx::Rect rect = widget_screen_rect_;
+
+  // Popup widgets aren't emulated, but the ViewRect (aka WidgetScreenRect)
+  // given to them should be.
+  if (opener_emulator_scale_) {
+    DCHECK(popup_);
+    ScreenRectToEmulated(&rect);
+  }
   return rect;
 }
 
@@ -2117,8 +2154,15 @@ void RenderWidget::SetWindowRect(const WebRect& rect_in_screen) {
   if (for_child_local_root_frame_)
     return;
 
-  WebRect window_rect = rect_in_screen;
-  EmulatedToScreenRectIfNeeded(&window_rect);
+  gfx::Rect window_rect = rect_in_screen;
+
+  // Popups aren't emulated, but the WidgetScreenRect and WindowScreenRect
+  // given to them are. When they set the WindowScreenRect it is based on those
+  // emulated values, so we reverse the emulation.
+  if (opener_emulator_scale_) {
+    DCHECK(popup_);
+    EmulatedToScreenRect(&window_rect);
+  }
 
   if (synchronous_resize_mode_for_testing_) {
     // This is a web-test-only path. At one point, it was planned to be
@@ -2154,10 +2198,8 @@ void RenderWidget::OnShowContextMenu(ui::MenuSourceType source_type,
                                      const gfx::Point& location) {
   has_host_context_menu_location_ = true;
   host_context_menu_location_ = location;
-  if (GetWebWidget()) {
-    GetWebWidget()->ShowContextMenu(
-        static_cast<blink::WebMenuSourceType>(source_type));
-  }
+  GetWebWidget()->ShowContextMenu(
+      static_cast<blink::WebMenuSourceType>(source_type));
   has_host_context_menu_location_ = false;
 }
 
@@ -2237,8 +2279,6 @@ void RenderWidget::OnImeFinishComposingText(bool keep_selection) {
   }
 #endif
 
-  if (!GetWebWidget())
-    return;
   ImeEventGuard guard(this);
   input_handler_->set_handling_input_event(true);
   if (auto* controller = GetInputMethodController()) {
@@ -2257,8 +2297,6 @@ void RenderWidget::UpdateSurfaceAndScreenInfo(
   bool orientation_changed =
       screen_info_.orientation_angle != new_screen_info.orientation_angle ||
       screen_info_.orientation_type != new_screen_info.orientation_type;
-  bool web_device_scale_factor_changed =
-      screen_info_.device_scale_factor != new_screen_info.device_scale_factor;
   ScreenInfo previous_original_screen_info = GetOriginalScreenInfo();
 
   local_surface_id_allocation_from_parent_ = new_local_surface_id_allocation;
@@ -2266,49 +2304,70 @@ void RenderWidget::UpdateSurfaceAndScreenInfo(
 
   // Note carefully that the DSF specified in |new_screen_info| is not the
   // DSF used by the compositor during device emulation!
-  layer_tree_view_->SetViewportRectAndScale(
+  layer_tree_host_->SetViewportRectAndScale(
       compositor_viewport_pixel_rect,
       GetOriginalScreenInfo().device_scale_factor,
       local_surface_id_allocation_from_parent_);
   // The ViewportVisibleRect derives from the LayerTreeView's viewport size,
   // which is set above.
-  layer_tree_view_->SetViewportVisibleRect(ViewportVisibleRect());
-  layer_tree_view_->SetRasterColorSpace(
+  layer_tree_host_->SetViewportVisibleRect(ViewportVisibleRect());
+  layer_tree_host_->SetRasterColorSpace(
       screen_info_.color_space.GetRasterColorSpace());
 
   if (orientation_changed)
     OnOrientationChange();
 
-  if (previous_original_screen_info != GetOriginalScreenInfo()) {
-    for (auto& observer : render_frame_proxies_)
-      observer.OnScreenInfoChanged(GetOriginalScreenInfo());
+  if (for_frame()) {
+    RenderFrameImpl* render_frame =
+        RenderFrameImpl::FromWebFrame(GetFrameWidget()->LocalRoot());
+    // TODO(danakj): RenderWidget knows the DSF and could avoid calling into
+    // blink when it hasn't changed, but it sets an initial |screen_info_|
+    // during construction, so it is hard to tell if the value is not the
+    // default value once we get to OnSynchronizeVisualProperties. Thus we
+    // call into blink unconditionally and let it early out if it's already
+    // set.
+    //
+    // TODO(danakj): Only the top-most RenderWidget per RenderView should
+    // be responsible for setting values onto the RenderView.
+    render_frame->SetDeviceScaleFactorOnRenderView(
+        compositor_deps_->IsUseZoomForDSFEnabled(),
+        screen_info_.device_scale_factor);
+  }
 
-    // Notify all embedded BrowserPlugins of the updated ScreenInfo.
+  // Propagate changes down to child local root RenderWidgets and BrowserPlugins
+  // in other frame trees/processes.
+  if (previous_original_screen_info != GetOriginalScreenInfo()) {
+    for (auto& observer : render_frame_proxies_) {
+      if (!is_undead_)
+        observer.OnScreenInfoChanged(GetOriginalScreenInfo());
+    }
     for (auto& observer : browser_plugins_)
       observer.ScreenInfoChanged(GetOriginalScreenInfo());
   }
-
-  if (web_device_scale_factor_changed)
-    UpdateWebViewWithDeviceScaleFactor();
 }
 
 void RenderWidget::SetWindowRectSynchronously(
     const gfx::Rect& new_window_rect) {
-  VisualProperties visual_properties;
-  visual_properties.screen_info = screen_info_;
-  visual_properties.new_size = new_window_rect.size();
-  visual_properties.compositor_viewport_pixel_rect =
-      gfx::Rect(gfx::ScaleToCeiledSize(new_window_rect.size(),
-                                       GetWebScreenInfo().device_scale_factor));
-  visual_properties.visible_viewport_size = new_window_rect.size();
-  visual_properties.is_fullscreen_granted = is_fullscreen_granted_;
-  visual_properties.display_mode = display_mode_;
-  visual_properties.local_surface_id_allocation =
-      local_surface_id_allocation_from_parent_;
+  // This method is only call in tests, and it applies the |new_window_rect| to
+  // all three of:
+  // a) widget size (in |size_|)
+  // b) blink viewport (in |visible_viewport_size_|)
+  // c) compositor viewport (in cc::LayerTreeHost)
+  // Normally the browser controls these three things independently, but this is
+  // used in tests to control the size from the renderer.
+
   // We are resizing the window from the renderer, so allocate a new
   // viz::LocalSurfaceId to avoid surface invariants violations in tests.
-  layer_tree_view_->RequestNewLocalSurfaceId();
-  SynchronizeVisualProperties(visual_properties);
+  layer_tree_host_->RequestNewLocalSurfaceId();
+
+  gfx::Rect compositor_viewport_pixel_rect(gfx::ScaleToCeiledSize(
+      new_window_rect.size(), screen_info_.device_scale_factor));
+  UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
+                             compositor_viewport_pixel_rect, screen_info_);
+
+  visible_viewport_size_ = new_window_rect.size();
+  size_ = new_window_rect.size();
+  ResizeWebWidget();
 
   widget_screen_rect_ = new_window_rect;
   window_screen_rect_ = new_window_rect;
@@ -2320,19 +2379,6 @@ void RenderWidget::SetWindowRectSynchronously(
   }
 }
 
-void RenderWidget::UpdateCaptureSequenceNumber(
-    uint32_t capture_sequence_number) {
-  if (capture_sequence_number == last_capture_sequence_number_)
-    return;
-  last_capture_sequence_number_ = capture_sequence_number;
-
-  // Notify observers of the new capture sequence number.
-  for (auto& observer : render_frame_proxies_)
-    observer.UpdateCaptureSequenceNumber(capture_sequence_number);
-  for (auto& observer : browser_plugins_)
-    observer.UpdateCaptureSequenceNumber(capture_sequence_number);
-}
-
 void RenderWidget::OnSetTextDirection(WebTextDirection direction) {
   if (auto* frame = GetFocusedWebLocalFrameInWidget())
     frame->SetTextDirection(direction);
@@ -2340,9 +2386,9 @@ void RenderWidget::OnSetTextDirection(WebTextDirection direction) {
 
 void RenderWidget::OnUpdateScreenRects(const gfx::Rect& widget_screen_rect,
                                        const gfx::Rect& window_screen_rect) {
-  if (screen_metrics_emulator_) {
-    screen_metrics_emulator_->OnUpdateScreenRects(widget_screen_rect,
-                                                  window_screen_rect);
+  if (device_emulator_) {
+    device_emulator_->OnUpdateScreenRects(widget_screen_rect,
+                                          window_screen_rect);
   } else {
     SetScreenRects(widget_screen_rect, window_screen_rect);
   }
@@ -2357,7 +2403,7 @@ void RenderWidget::OnSetViewportIntersection(
     compositor_visible_rect_ = compositor_visible_rect;
     frame_widget->SetRemoteViewportIntersection(viewport_intersection,
                                                 occlusion_state);
-    layer_tree_view_->SetViewportVisibleRect(ViewportVisibleRect());
+    layer_tree_host_->SetViewportVisibleRect(ViewportVisibleRect());
   }
 }
 
@@ -2514,8 +2560,7 @@ void RenderWidget::ConvertViewportToWindow(blink::WebRect* rect) {
     float reverse = 1 / GetOriginalScreenInfo().device_scale_factor;
     // TODO(oshima): We may need to allow pixel precision here as the the
     // anchor element can be placed at half pixel.
-    gfx::Rect window_rect =
-        gfx::ScaleToEnclosedRect(gfx::Rect(*rect), reverse);
+    gfx::Rect window_rect = gfx::ScaleToEnclosedRect(gfx::Rect(*rect), reverse);
     rect->x = window_rect.x();
     rect->y = window_rect.y();
     rect->width = window_rect.width();
@@ -2543,10 +2588,6 @@ void RenderWidget::ConvertWindowToViewport(blink::WebFloatRect* rect) {
 
 void RenderWidget::OnRequestTextInputStateUpdate() {
 #if defined(OS_ANDROID)
-  // This task may run between the Close IPC and the task that actually closes
-  // this class.
-  if (closing_)
-    return;
   DCHECK(!ime_event_guard_);
   UpdateSelectionBounds();
   UpdateTextInputStateInternal(false, true /* reply_to_request */);
@@ -2575,9 +2616,11 @@ void RenderWidget::OnOrientationChange() {
 }
 
 void RenderWidget::SetHidden(bool hidden) {
-  // A frozen main frame widget does not become shown or hidden, since it has
-  // no frame associated with it. It must be thawed before changing visibility.
-  DCHECK(!is_frozen_);
+  // An undead or provisional main frame widget will never be hidden since that
+  // would require it to be shown first. The main frame must be attached to the
+  // frame tree before changing visibility.
+  DCHECK(!is_undead_);
+  DCHECK(!IsForProvisionalFrame());
 
   if (is_hidden_ == hidden)
     return;
@@ -2600,26 +2643,6 @@ void RenderWidget::SetHidden(bool hidden) {
   StartStopCompositor();
 }
 
-void RenderWidget::SetIsFullscreen(bool fullscreen) {
-  // TODO:(https://crbug.com/995981): If there is no WebWidget, then the
-  // RenderWidget should also be destroyed, and this conditional should not be
-  // necessary.
-  // We intentionally avoid setting internal state so that the next time visual
-  // properties are synchronized, state will be correctly propagated to the
-  // WebWidget.
-  if (!GetWebWidget())
-    return;
-
-  if (fullscreen == is_fullscreen_granted_)
-    return;
-  is_fullscreen_granted_ = fullscreen;
-  if (is_fullscreen_granted_) {
-    GetWebWidget()->DidEnterFullscreen();
-  } else {
-    GetWebWidget()->DidExitFullscreen();
-  }
-}
-
 void RenderWidget::OnImeEventGuardStart(ImeEventGuard* guard) {
   if (!ime_event_guard_)
     ime_event_guard_ = guard;
@@ -2667,8 +2690,6 @@ void RenderWidget::GetSelectionBounds(gfx::Rect* focus, gfx::Rect* anchor) {
 
 void RenderWidget::UpdateSelectionBounds() {
   TRACE_EVENT0("renderer", "RenderWidget::UpdateSelectionBounds");
-  if (!GetWebWidget())
-    return;
   if (ime_event_guard_)
     return;
 
@@ -2706,11 +2727,6 @@ void RenderWidget::UpdateSelectionBounds() {
 }
 
 void RenderWidget::DidAutoResize(const gfx::Size& new_size) {
-  // Blink can continue running and do a layout/resize between the Close IPC
-  // and the task that actually closes this class.
-  if (closing_)
-    return;
-
   WebRect new_size_in_window(0, 0, new_size.width(), new_size.height());
   ConvertViewportToWindow(&new_size_in_window);
   if (size_.width() != new_size_in_window.width ||
@@ -2728,9 +2744,9 @@ void RenderWidget::DidAutoResize(const gfx::Size& new_size) {
     // |size_| from the compositor's viewport size. Also note that the
     // calculation of |new_compositor_viewport_pixel_rect| does not appear to
     // take into account device emulation.
-    layer_tree_view_->RequestNewLocalSurfaceId();
+    layer_tree_host_->RequestNewLocalSurfaceId();
     gfx::Rect new_compositor_viewport_pixel_rect = gfx::Rect(
-        gfx::ScaleToCeiledSize(size_, GetWebScreenInfo().device_scale_factor));
+        gfx::ScaleToCeiledSize(size_, screen_info_.device_scale_factor));
     UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
                                new_compositor_viewport_pixel_rect,
                                screen_info_);
@@ -2848,7 +2864,7 @@ void RenderWidget::DidOverscroll(
 #endif
   input_handler_->DidOverscrollFromBlink(
       overscroll_delta, accumulated_overscroll, position, velocity,
-      layer_tree_view_->layer_tree_host()->overscroll_behavior());
+      layer_tree_host_->overscroll_behavior());
 }
 
 void RenderWidget::InjectGestureScrollEvent(
@@ -2863,7 +2879,7 @@ void RenderWidget::InjectGestureScrollEvent(
 
 void RenderWidget::SetOverscrollBehavior(
     const cc::OverscrollBehavior& behavior) {
-  layer_tree_view_->layer_tree_host()->SetOverscrollBehavior(behavior);
+  layer_tree_host_->SetOverscrollBehavior(behavior);
 }
 
 // static
@@ -2878,6 +2894,7 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
   const base::CommandLine& cmd = *base::CommandLine::ForCurrentProcess();
   cc::LayerTreeSettings settings;
 
+  settings.use_zoom_for_dsf = compositor_deps->IsUseZoomForDSFEnabled();
   settings.compositor_threaded_scrollbar_scrolling =
       base::FeatureList::IsEnabled(
           features::kCompositorThreadedScrollbarScrolling);
@@ -3049,7 +3066,6 @@ cc::LayerTreeSettings RenderWidget::GenerateLayerTreeSettings(
 
   settings.initial_debug_state.SetRecordRenderingStats(
       cmd.HasSwitch(cc::switches::kEnableGpuBenchmarking));
-  settings.enable_surface_synchronization = true;
   settings.build_hit_test_data = features::IsVizHitTestingSurfaceLayerEnabled();
 
   if (cmd.HasSwitch(cc::switches::kSlowDownRasterScaleFactor)) {
@@ -3328,8 +3344,7 @@ cc::ManagedMemoryPolicy RenderWidget::GetGpuMemoryPolicy(
 }
 
 void RenderWidget::SetHasPointerRawUpdateEventHandlers(bool has_handlers) {
-  if (input_event_queue_)
-    input_event_queue_->HasPointerRawUpdateEventHandlers(has_handlers);
+  input_event_queue_->HasPointerRawUpdateEventHandlers(has_handlers);
 }
 
 void RenderWidget::SetHasTouchEventHandlers(bool has_handlers) {
@@ -3343,18 +3358,15 @@ void RenderWidget::SetHasTouchEventHandlers(bool has_handlers) {
 }
 
 void RenderWidget::SetHaveScrollEventHandlers(bool have_handlers) {
-  layer_tree_view_->layer_tree_host()->SetHaveScrollEventHandlers(
-      have_handlers);
+  layer_tree_host_->SetHaveScrollEventHandlers(have_handlers);
 }
 
 void RenderWidget::SetNeedsLowLatencyInput(bool needs_low_latency) {
-  if (input_event_queue_)
-    input_event_queue_->SetNeedsLowLatency(needs_low_latency);
+  input_event_queue_->SetNeedsLowLatency(needs_low_latency);
 }
 
 void RenderWidget::SetNeedsUnbufferedInputForDebugger(bool unbuffered) {
-  if (input_event_queue_)
-    input_event_queue_->SetNeedsUnbufferedInputForDebugger(unbuffered);
+  input_event_queue_->SetNeedsUnbufferedInputForDebugger(unbuffered);
 }
 
 void RenderWidget::AnimateDoubleTapZoomInMainFrame(
@@ -3374,12 +3386,8 @@ void RenderWidget::ZoomToFindInPageRectInMainFrame(
                                                          rect_to_zoom));
 }
 
-void RenderWidget::RegisterViewportLayers(const cc::ViewportLayers& layers) {
-  layer_tree_view_->layer_tree_host()->RegisterViewportLayers(layers);
-}
-
 void RenderWidget::RegisterSelection(const cc::LayerSelection& selection) {
-  layer_tree_view_->layer_tree_host()->RegisterSelection(selection);
+  layer_tree_host_->RegisterSelection(selection);
 }
 
 void RenderWidget::FallbackCursorModeLockCursor(bool left,
@@ -3394,17 +3402,12 @@ void RenderWidget::FallbackCursorModeSetCursorVisibility(bool visible) {
   widget_input_handler_manager_->FallbackCursorModeSetCursorVisibility(visible);
 }
 
-void RenderWidget::SetAllowGpuRasterization(bool allow_gpu_raster) {
-  layer_tree_view_->layer_tree_host()->SetHasGpuRasterizationTrigger(
-      allow_gpu_raster);
-}
-
 void RenderWidget::SetPageScaleStateAndLimits(float page_scale_factor,
                                               bool is_pinch_gesture_active,
                                               float minimum,
                                               float maximum) {
-  layer_tree_view_->layer_tree_host()->SetPageScaleFactorAndLimits(
-      page_scale_factor, minimum, maximum);
+  layer_tree_host_->SetPageScaleFactorAndLimits(page_scale_factor, minimum,
+                                                maximum);
 
   // Only continue if this is a mainframe, or something's actually changed.
   if (!delegate() ||
@@ -3413,17 +3416,20 @@ void RenderWidget::SetPageScaleStateAndLimits(float page_scale_factor,
     return;
   }
 
+  DCHECK(!is_undead_);
+  DCHECK(!IsForProvisionalFrame());
+
   // The page scale is controlled by the WebView for the local main frame of
-  // the Page. So this is called from blink by for the RenderWidget of that
+  // the Page. So this is called from blink for the RenderWidget of that
   // local main frame. We forward the value on to each child RenderWidget (each
   // of which will be via proxy child frame). These will each in turn forward
   // the message to their child RenderWidgets (through their proxy child
   // frames).
-  DCHECK(!is_frozen_);
-
   for (auto& observer : render_frame_proxies_) {
-    observer.OnPageScaleFactorChanged(page_scale_factor,
-                                      is_pinch_gesture_active);
+    if (!is_undead_) {
+      observer.OnPageScaleFactorChanged(page_scale_factor,
+                                        is_pinch_gesture_active);
+    }
   }
   // Store the value to give to any new RenderFrameProxy that is registered.
   page_scale_factor_from_mainframe_ = page_scale_factor;
@@ -3434,18 +3440,17 @@ void RenderWidget::StartPageScaleAnimation(const gfx::Vector2d& target_offset,
                                            bool use_anchor,
                                            float new_page_scale,
                                            base::TimeDelta duration) {
-  layer_tree_view_->layer_tree_host()->StartPageScaleAnimation(
-      target_offset, use_anchor, new_page_scale, duration);
+  layer_tree_host_->StartPageScaleAnimation(target_offset, use_anchor,
+                                            new_page_scale, duration);
 }
 
 void RenderWidget::ForceRecalculateRasterScales() {
-  layer_tree_view_->layer_tree_host()->SetNeedsRecalculateRasterScales();
+  layer_tree_host_->SetNeedsRecalculateRasterScales();
 }
 
 void RenderWidget::RequestDecode(const cc::PaintImage& image,
                                  base::OnceCallback<void(bool)> callback) {
-  layer_tree_view_->layer_tree_host()->QueueImageDecode(image,
-                                                        std::move(callback));
+  layer_tree_host_->QueueImageDecode(image, std::move(callback));
 }
 
 // Enables measuring and reporting both presentation times and swap times in
@@ -3582,47 +3587,44 @@ void RenderWidget::NotifySwapTime(ReportTimeCallback callback) {
 void RenderWidget::SetEventListenerProperties(
     cc::EventListenerClass event_class,
     cc::EventListenerProperties properties) {
-  layer_tree_view_->layer_tree_host()->SetEventListenerProperties(event_class,
-                                                                  properties);
+  layer_tree_host_->SetEventListenerProperties(event_class, properties);
 }
 
 cc::EventListenerProperties RenderWidget::EventListenerProperties(
     cc::EventListenerClass event_class) const {
-  return layer_tree_view_->layer_tree_host()->event_listener_properties(
-      event_class);
+  return layer_tree_host_->event_listener_properties(event_class);
 }
 
 std::unique_ptr<cc::ScopedDeferMainFrameUpdate>
 RenderWidget::DeferMainFrameUpdate() {
-  return layer_tree_view_->layer_tree_host()->DeferMainFrameUpdate();
+  return layer_tree_host_->DeferMainFrameUpdate();
 }
 
 void RenderWidget::StartDeferringCommits(base::TimeDelta timeout) {
-  layer_tree_view_->layer_tree_host()->StartDeferringCommits(timeout);
+  layer_tree_host_->StartDeferringCommits(timeout);
 }
 
 void RenderWidget::StopDeferringCommits(cc::PaintHoldingCommitTrigger trigger) {
-  layer_tree_view_->layer_tree_host()->StopDeferringCommits(trigger);
+  layer_tree_host_->StopDeferringCommits(trigger);
 }
 
 void RenderWidget::RequestBeginMainFrameNotExpected(bool request) {
-  layer_tree_view_->layer_tree_host()->RequestBeginMainFrameNotExpected(
-      request);
+  layer_tree_host_->RequestBeginMainFrameNotExpected(request);
 }
 
 int RenderWidget::GetLayerTreeId() const {
-  return layer_tree_view_->layer_tree_host()->GetId();
+  return layer_tree_host_->GetId();
 }
 
 void RenderWidget::SetBrowserControlsShownRatio(float ratio) {
-  layer_tree_view_->layer_tree_host()->SetBrowserControlsShownRatio(ratio);
+  layer_tree_host_->SetBrowserControlsShownRatio(ratio);
 }
 
 void RenderWidget::SetBrowserControlsHeight(float top_height,
                                             float bottom_height,
                                             bool shrink_viewport) {
-  layer_tree_view_->layer_tree_host()->SetBrowserControlsHeight(
-      top_height, bottom_height, shrink_viewport);
+  layer_tree_host_->SetBrowserControlsHeight(top_height, bottom_height,
+                                             shrink_viewport);
 }
 
 viz::FrameSinkId RenderWidget::GetFrameSinkId() {
@@ -3632,18 +3634,14 @@ viz::FrameSinkId RenderWidget::GetFrameSinkId() {
 void RenderWidget::NotifySwapAndPresentationTime(
     ReportTimeCallback swap_time_callback,
     ReportTimeCallback presentation_time_callback) {
-  cc::LayerTreeHost* layer_tree_host = layer_tree_view_->layer_tree_host();
-  // When the WebWidget is closed we cancel any pending SwapPromise that would
-  // call back into blink, so we use |close_weak_ptr_factory_|.
-  layer_tree_host->QueueSwapPromise(std::make_unique<ReportTimeSwapPromise>(
+  layer_tree_host_->QueueSwapPromise(std::make_unique<ReportTimeSwapPromise>(
       std::move(swap_time_callback), std::move(presentation_time_callback),
-      layer_tree_host->GetTaskRunnerProvider()->MainThreadTaskRunner(),
-      close_weak_ptr_factory_.GetWeakPtr()));
+      layer_tree_host_->GetTaskRunnerProvider()->MainThreadTaskRunner(),
+      weak_ptr_factory_.GetWeakPtr()));
 }
 
 void RenderWidget::RequestUnbufferedInputEvents() {
-  if (input_event_queue_)
-    input_event_queue_->RequestUnbufferedInputEvents();
+  input_event_queue_->RequestUnbufferedInputEvents();
 }
 
 void RenderWidget::SetTouchAction(cc::TouchAction touch_action) {
@@ -3691,14 +3689,10 @@ void RenderWidget::OnWaitNextFrameForTests(
       main_frame_thread_observer_routing_id));
 }
 
-const ScreenInfo& RenderWidget::GetWebScreenInfo() const {
-  return screen_info_;
-}
-
 const ScreenInfo& RenderWidget::GetOriginalScreenInfo() const {
-  return screen_metrics_emulator_
-             ? screen_metrics_emulator_->original_screen_info()
-             : screen_info_;
+  if (device_emulator_)
+    return device_emulator_->original_screen_info();
+  return screen_info_;
 }
 
 gfx::PointF RenderWidget::ConvertWindowPointToViewport(
@@ -3744,12 +3738,6 @@ void RenderWidget::StartDragging(network::mojom::ReferrerPolicy policy,
 }
 
 void RenderWidget::DidNavigate() {
-  // Blink may be navigating still between the Close IPC and the task that
-  // actually closes this class, and for a main frame that would come through
-  // this method. But since we are closing we can skip it.
-  if (closing_)
-    return;
-
   // The input handler wants to know about navigation so that it can
   // suppress input until the newly navigated page has a committed frame.
   // It also resets the state for UMA reporting of input arrival with respect
@@ -3757,7 +3745,7 @@ void RenderWidget::DidNavigate() {
   DCHECK(widget_input_handler_manager_);
   widget_input_handler_manager_->DidNavigate();
 
-  layer_tree_view_->ClearCachesOnNextCommit();
+  layer_tree_host_->ClearCachesOnNextCommit();
 }
 
 blink::WebInputMethodController* RenderWidget::GetInputMethodController()
@@ -3775,11 +3763,12 @@ void RenderWidget::SetupWidgetInputHandler(
                                               std::move(host));
 }
 
-void RenderWidget::SetWidgetBinding(mojom::WidgetRequest request) {
-  // Close the old binding if there was one.
+void RenderWidget::SetWidgetReceiver(
+    mojo::PendingReceiver<mojom::Widget> recevier) {
+  // Close the old receiver if there was one.
   // A RenderWidgetHost should not need more than one channel.
-  widget_binding_.Close();
-  widget_binding_.Bind(std::move(request));
+  widget_receiver_.reset();
+  widget_receiver_.Bind(std::move(recevier));
 }
 
 void RenderWidget::SetMouseCapture(bool capture) {
@@ -3798,37 +3787,44 @@ void RenderWidget::SetDeviceScaleFactorForTesting(float factor) {
 
   // We are changing the device scale factor from the renderer, so allocate a
   // new viz::LocalSurfaceId to avoid surface invariants violations in tests.
-  layer_tree_view_->RequestNewLocalSurfaceId();
+  layer_tree_host_->RequestNewLocalSurfaceId();
 
   ScreenInfo info = screen_info_;
   info.device_scale_factor = factor;
   gfx::Size viewport_pixel_size = gfx::ScaleToCeiledSize(size_, factor);
   UpdateSurfaceAndScreenInfo(local_surface_id_allocation_from_parent_,
                              gfx::Rect(viewport_pixel_size), info);
+  if (!auto_resize_mode_)
+    ResizeWebWidget();  // This picks up the new device scale factor in |info|.
 
-  ResizeWebWidget();  // This picks up the new device scale factor in |info|.
+  RenderFrameImpl* render_frame =
+      RenderFrameImpl::FromWebFrame(GetFrameWidget()->LocalRoot());
+  render_frame->SetPreferCompositingToLCDTextEnabledOnRenderView(
+      ComputePreferCompositingToLCDText(compositor_deps_,
+                                        screen_info_.device_scale_factor));
 
-  gfx::Size visible_viewport_size = visible_viewport_size_;
-  if (compositor_deps_->IsUseZoomForDSFEnabled()) {
-    visible_viewport_size =
-        gfx::ScaleToCeiledSize(visible_viewport_size, factor);
-  }
+  // Make sure to override any future OnSynchronizeVisualProperties IPCs.
+  device_scale_factor_for_testing_ = factor;
+}
 
-  DCHECK(delegate()) << "Resizing the viewport for a cross-process subframe "
-                        "must be done via the RenderView.";
-  delegate()->ResizeVisualViewportForWidget(visible_viewport_size);
+void RenderWidget::SetZoomLevelForTesting(double zoom_level) {
+  DCHECK_NE(zoom_level, -INFINITY);
+  SetZoomLevel(zoom_level);
 
-  // Make sure the DSF override stays for future VisualProperties updates, and
-  // that includes overriding the VisualProperties'
-  // compositor_viewport_pixel_rect with size * this for-testing DSF.
-  device_scale_factor_for_testing_ = factor;
+  // Make sure to override any future OnSynchronizeVisualProperties IPCs.
+  zoom_level_for_testing_ = zoom_level;
+}
+
+void RenderWidget::ResetZoomLevelForTesting() {
+  zoom_level_for_testing_ = -INFINITY;
+  SetZoomLevel(0);
 }
 
 void RenderWidget::SetDeviceColorSpaceForTesting(
     const gfx::ColorSpace& color_space) {
   // We are changing the device color space from the renderer, so allocate a
   // new viz::LocalSurfaceId to avoid surface invariants violations in tests.
-  layer_tree_view_->RequestNewLocalSurfaceId();
+  layer_tree_host_->RequestNewLocalSurfaceId();
 
   ScreenInfo info = screen_info_;
   info.color_space = color_space;
@@ -3843,34 +3839,22 @@ void RenderWidget::SetWindowRectSynchronouslyForTesting(
 
 void RenderWidget::EnableAutoResizeForTesting(const gfx::Size& min_size,
                                               const gfx::Size& max_size) {
-  VisualProperties visual_properties;
-  visual_properties.auto_resize_enabled = true;
-  visual_properties.min_size_for_auto_resize = min_size;
-  visual_properties.max_size_for_auto_resize = max_size;
-  visual_properties.local_surface_id_allocation =
-      base::Optional<viz::LocalSurfaceIdAllocation>(
-          viz::LocalSurfaceIdAllocation(
-              viz::LocalSurfaceId(1, 1, base::UnguessableToken::Create()),
-              base::TimeTicks::Now()));
-  OnSynchronizeVisualProperties(visual_properties);
+  SetAutoResizeMode(true, min_size, max_size, screen_info_.device_scale_factor);
 }
 
 void RenderWidget::DisableAutoResizeForTesting(const gfx::Size& new_size) {
   if (!auto_resize_mode_)
     return;
 
-  VisualProperties visual_properties;
-  visual_properties.auto_resize_enabled = false;
-  visual_properties.screen_info = screen_info_;
-  visual_properties.new_size = new_size;
-  visual_properties.compositor_viewport_pixel_rect = CompositorViewportRect();
-  visual_properties.browser_controls_shrink_blink_size =
-      browser_controls_shrink_blink_size_;
-  visual_properties.top_controls_height = top_controls_height_;
-  visual_properties.visible_viewport_size = visible_viewport_size_;
-  visual_properties.is_fullscreen_granted = is_fullscreen_granted_;
-  visual_properties.display_mode = display_mode_;
-  OnSynchronizeVisualProperties(visual_properties);
+  SetAutoResizeMode(false, gfx::Size(), gfx::Size(),
+                    screen_info_.device_scale_factor);
+
+  // The |new_size| is empty when resetting auto resize in between tests. In
+  // this case the current size should just be preserved.
+  if (!new_size.IsEmpty()) {
+    size_ = new_size;
+    ResizeWebWidget();
+  }
 }
 
 blink::WebLocalFrame* RenderWidget::GetFocusedWebLocalFrameInWidget() const {
@@ -3913,25 +3897,8 @@ gfx::Rect RenderWidget::ViewportVisibleRect() {
   return CompositorViewportRect();
 }
 
-// static
-scoped_refptr<base::SingleThreadTaskRunner>
-RenderWidget::GetCleanupTaskRunner() {
-  return RenderThreadImpl::current_blink_platform_impl()
-      ->main_thread_scheduler()
-      ->CleanupTaskRunner();
-}
-
 base::WeakPtr<RenderWidget> RenderWidget::AsWeakPtr() {
   return weak_ptr_factory_.GetWeakPtr();
 }
 
-void RenderWidget::SetWebWidgetInternal(blink::WebWidget* web_widget) {
-  // TODO(https://crbug.com/995981): This method should not need to exist, since
-  // we should be creating and destroying a RenderWidget along with the
-  // WebWidget.
-  if (web_widget)
-    web_widget->SetAnimationHost(layer_tree_view_->animation_host());
-  webwidget_internal_ = web_widget;
-}
-
 }  // namespace content
diff --git a/chromium/content/renderer/render_widget.h b/chromium/content/renderer/render_widget.h
index 59283e06ade..48724e5c616 100644
--- a/chromium/content/renderer/render_widget.h
+++ b/chromium/content/renderer/render_widget.h
@@ -37,7 +37,6 @@
 #include "content/common/tab_switch_time_recorder.h"
 #include "content/common/widget.mojom.h"
 #include "content/public/common/drop_data.h"
-#include "content/public/common/screen_info.h"
 #include "content/renderer/compositor/layer_tree_view_delegate.h"
 #include "content/renderer/input/main_thread_event_queue.h"
 #include "content/renderer/input/render_widget_input_handler.h"
@@ -49,11 +48,12 @@
 #include "ipc/ipc_listener.h"
 #include "ipc/ipc_message.h"
 #include "ipc/ipc_sender.h"
-#include "mojo/public/cpp/bindings/binding.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/receiver.h"
 #include "ppapi/buildflags/buildflags.h"
 #include "services/network/public/mojom/referrer_policy.mojom.h"
 #include "third_party/blink/public/common/frame/occlusion_state.h"
-#include "third_party/blink/public/common/manifest/web_display_mode.h"
+#include "third_party/blink/public/mojom/manifest/display_mode.mojom.h"
 #include "third_party/blink/public/platform/web_input_event.h"
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_text_input_info.h"
@@ -111,7 +111,6 @@ struct DidOverscrollParams;
 namespace content {
 class BrowserPlugin;
 class CompositorDependencies;
-class ExternalPopupMenu;
 class FrameSwapMessageQueue;
 class ImeEventGuard;
 class LayerTreeView;
@@ -123,7 +122,6 @@ class RenderViewImpl;
 class RenderWidgetDelegate;
 class RenderWidgetScreenMetricsEmulator;
 class WidgetInputHandlerManager;
-struct ContextMenuParams;
 struct VisualProperties;
 
 // RenderWidget provides a communication bridge between a WebWidget and
@@ -136,13 +134,28 @@ struct VisualProperties;
 // - Widgets for frames (the main frame, and subframes due to out-of-process
 //   iframe support)
 //
-// Because the main frame RenderWidget is used to implement RenderViewImpl
-// (deprecated) it has a shared lifetime. But the RenderViewImpl may have
-// a proxy main frame which does not use a RenderWidget. Thus a RenderWidget
-// can be frozen, during the time in which we wish we could delete it but we
-// can't, and it should be (relatively.. it's a work in progress) unused during
-// that time. This does not apply to subframes, whose lifetimes are not tied to
-// the RenderViewImpl.
+// Background info:
+// OOPIF causes webpages to be renderered by multiple renderers. Each renderer
+// has one instance of a RenderViewImpl, which represents page state shared by
+// each renderer. The frame tree is mirrored across each renderer. Local nodes
+// are represented by RenderFrame, and remote nodes are represented by
+// RenderFrameProxy. Each local root has a corresponding RenderWidget. This
+// RenderWidget is used to route input and graphical output between the browser
+// and the renderer.
+//
+// For legacy reasons, each RenderViewImpl also has a RenderWidget. The
+// RenderViewImpl hosting the local main frame legitimately needs a
+// RenderWidget, since this is a local root. To reduce complexity, we'd like the
+// RenderFrame to own the RenderWidget, which it already does for local root
+// subframes. This is tracked by https://crbug.com/419087.
+//
+// RenderViewImpls with a proxy main frame still own a RenderWidget, even though
+// the RenderWidget is not used by content/renderer or blink. This is because
+// the browser side semantics for RenderWidgetHost, RenderViewHost and
+// RenderFrameHost are still entangled. If we destroyed the RenderWidget
+// without destroying the corresponding RenderWidgetHost, we'd break IPC
+// channels that would not be re-established when recreating the RenderWidget.
+// These RenderWidgets are called "undead", and they should never be used.
 class CONTENT_EXPORT RenderWidget
     : public IPC::Listener,
       public IPC::Sender,
@@ -155,12 +168,11 @@ class CONTENT_EXPORT RenderWidget
  public:
   RenderWidget(int32_t widget_routing_id,
                CompositorDependencies* compositor_deps,
-               const ScreenInfo& screen_info,
-               blink::WebDisplayMode display_mode,
-               bool is_frozen,
+               blink::mojom::DisplayMode display_mode,
+               bool is_undead,
                bool hidden,
                bool never_visible,
-               mojom::WidgetRequest widget_request);
+               mojo::PendingReceiver<mojom::Widget> widget_receiver);
 
   ~RenderWidget() override;
 
@@ -177,14 +189,13 @@ class CONTENT_EXPORT RenderWidget
 
   // Convenience type for creation method taken by InstallCreateForFrameHook().
   // The method signature matches the RenderWidget constructor.
-  using CreateRenderWidgetFunction =
-      std::unique_ptr<RenderWidget> (*)(int32_t,
-                                        CompositorDependencies*,
-                                        const ScreenInfo&,
-                                        blink::WebDisplayMode display_mode,
-                                        bool is_frozen,
-                                        bool never_visible,
-                                        mojom::WidgetRequest widget_request);
+  using CreateRenderWidgetFunction = std::unique_ptr<RenderWidget> (*)(
+      int32_t,
+      CompositorDependencies*,
+      blink::mojom::DisplayMode display_mode,
+      bool is_undead,
+      bool never_visible,
+      mojo::PendingReceiver<mojom::Widget> widget_receiver);
   // Overrides the implementation of CreateForFrame() function below. Used by
   // web tests to return a partial fake of RenderWidget.
   static void InstallCreateForFrameHook(
@@ -196,9 +207,8 @@ class CONTENT_EXPORT RenderWidget
   static std::unique_ptr<RenderWidget> CreateForFrame(
       int32_t widget_routing_id,
       CompositorDependencies* compositor_deps,
-      const ScreenInfo& screen_info,
-      blink::WebDisplayMode display_mode,
-      bool is_frozen,
+      blink::mojom::DisplayMode display_mode,
+      bool is_undead,
       bool never_visible);
 
   // Creates a RenderWidget for a popup. This is separate from CreateForFrame()
@@ -206,27 +216,45 @@ class CONTENT_EXPORT RenderWidget
   // A RenderWidget popup is owned by the browser process. The object will be
   // destroyed by the WidgetMsg_Close message. The object can request its own
   // destruction via ClosePopupWidgetSoon().
-  static RenderWidget* CreateForPopup(int32_t widget_routing_id,
-                                      CompositorDependencies* compositor_deps,
-                                      const ScreenInfo& screen_info,
-                                      blink::WebDisplayMode display_mode,
-                                      bool is_frozen,
-                                      bool hidden,
-                                      bool never_visible,
-                                      mojom::WidgetRequest widget_request);
+  static RenderWidget* CreateForPopup(
+      int32_t widget_routing_id,
+      CompositorDependencies* compositor_deps,
+      blink::mojom::DisplayMode display_mode,
+      bool hidden,
+      bool never_visible,
+      mojo::PendingReceiver<mojom::Widget> widget_receiver);
 
   // Initialize a new RenderWidget for a popup. The |show_callback| is called
-  // when RenderWidget::Show() happens. This method increments the reference
-  // count on the RenderWidget, making it self-referencing, which is then
-  // release when a WidgetMsg_Close IPC is received.
+  // when RenderWidget::Show() happens. The |opener_widget| is the local root
+  // of the frame that is opening the popup.
   void InitForPopup(ShowCallback show_callback,
-                    blink::WebPagePopup* web_page_popup);
+                    RenderWidget* opener_widget,
+                    blink::WebPagePopup* web_page_popup,
+                    const ScreenInfo& screen_info);
+
+  // Initialize a new RenderWidget for pepper fullscreen. The |show_callback| is
+  // called when RenderWidget::Show() happens.
+  void InitForPepperFullscreen(ShowCallback show_callback,
+                               blink::WebWidget* web_widget,
+                               const ScreenInfo& screen_info);
+
+  // Initialize a new RenderWidget that will be attached to a RenderFrame (via
+  // the WebFrameWidget), for a frame that is a main frame. When WebFrameWidget
+  // is given, a ScreenInfo must be also.
+  void InitForMainFrame(ShowCallback show_callback,
+                        blink::WebFrameWidget* web_frame_widget,
+                        const ScreenInfo* screen_info);
+
+  // Initialize (or re-initialize) a main frame RenderWidget that has been
+  // revived from undead state.
+  void InitForRevivedMainFrame(blink::WebFrameWidget* web_frame_widget,
+                               const ScreenInfo& screen_info);
 
   // Initialize a new RenderWidget that will be attached to a RenderFrame (via
   // the WebFrameWidget), for a frame that is a local root, but not the main
-  // frame. This method increments the reference count on the RenderWidget,
-  // making it self-referencing, which can be released by calling Close().
-  void InitForChildLocalRoot(blink::WebFrameWidget* web_frame_widget);
+  // frame.
+  void InitForChildLocalRoot(blink::WebFrameWidget* web_frame_widget,
+                             const ScreenInfo& screen_info);
 
   // Sets a delegate to handle certain RenderWidget operations that need an
   // escape to the RenderView.
@@ -244,16 +272,6 @@ class CONTENT_EXPORT RenderWidget
   // passed into this object to asynchronously delete itself.
   void CloseForFrame(std::unique_ptr<RenderWidget> widget);
 
-  // RenderWidgets cannot always be synchronously destroyed, since that may
-  // happen in a re-entrancy scenario, and there may be existing references on
-  // the stack. This method shuts down further sources of input to the
-  // RenderWidget. This must be called before Close().
-  void PrepareForClose();
-
-  // Close the underlying WebWidget and stop the compositor. This method deletes
-  // the object.
-  virtual void Close(std::unique_ptr<RenderWidget> widget);
-
   int32_t routing_id() const { return routing_id_; }
 
   CompositorDependencies* compositor_deps() const { return compositor_deps_; }
@@ -262,7 +280,7 @@ class CONTENT_EXPORT RenderWidget
   // is true, the widget returned is a blink::WebFrameWidget.
   // TODO(crbug.com/419087): The main frame RenderWidget will also return
   // nullptr while the main frame is remote.
-  blink::WebWidget* GetWebWidget() const { return webwidget_internal_; }
+  blink::WebWidget* GetWebWidget() const { return webwidget_; }
 
   // Returns the current instance of WebInputMethodController which is to be
   // used for IME related tasks. This instance corresponds to the one from
@@ -271,10 +289,8 @@ class CONTENT_EXPORT RenderWidget
 
   const gfx::Size& size() const { return size_; }
   bool is_fullscreen_granted() const { return is_fullscreen_granted_; }
-  blink::WebDisplayMode display_mode() const { return display_mode_; }
+  blink::mojom::DisplayMode display_mode() const { return display_mode_; }
   bool is_hidden() const { return is_hidden_; }
-  // Temporary for debugging purposes...
-  bool closing() const { return closing_; }
   bool has_host_context_menu_location() const {
     return has_host_context_menu_location_;
   }
@@ -285,44 +301,21 @@ class CONTENT_EXPORT RenderWidget
     return visible_viewport_size_;
   }
 
-  ScreenInfo screen_info() const { return screen_info_; }
-  void set_screen_info(const ScreenInfo& info) { screen_info_ = info; }
-
-  // Sets whether this RenderWidget should be moved into or out of a frozen
+  // Sets whether this RenderWidget should be moved into or out of an undead
   // state. This state is used for the RenderWidget attached to a RenderViewImpl
   // for its main frame, when there is no local main frame present.
   // In this case, the RenderWidget can't be deleted currently but should
   // otherwise act as if it is dead. Only whitelisted new IPC messages will be
   // sent, and it does no compositing. The process is free to exit when there
-  // are no other unfrozen (thawed) RenderWidgets.
-  void SetIsFrozen(bool is_frozen);
-  bool is_frozen() const { return is_frozen_; }
-
-  // When a RenderWidget is created, even if frozen, if we expect to unfreeze
-  // and use the RenderWidget imminently, then we want to pre-emptively start
-  // the process of getting the resources needed for the compositor. This helps
-  // to parallelize the critical path to first pixels with the loading process.
-  // This should only be called when the RenderWidget is frozen, otherwise it
-  // would be redundant at best. Non-frozen RenderWidgets will start to warmup
-  // immediately on their own.
-  void WarmupCompositor();
-  // If after calling WarmupCompositor() we can determine that the RenderWidget
-  // does not expect to be used shortly after all, call this to cancel the
-  // warmup process and release any unused resources that had been created by
-  // it.
-  void AbortWarmupCompositor();
-
-  // This is true once a Close IPC has been received. The actual action of
-  // closing must be done on another stack frame, in case the IPC receipt
-  // is in a nested message loop and will unwind back up to javascript (from
-  // plugins). So this will be true between those two things, to avoid work
-  // when the RenderWidget will be closed.
-  // Additionally, as an optimization, this is true after we know the renderer
-  // has asked the browser to close this RenderWidget.
-  //
-  // TODO(crbug.com/545684): Once RenderViewImpl and RenderWidget are split,
-  // attempt to combine two states so the shutdown logic is cleaner.
-  bool is_closing() const { return host_will_close_this_ || closing_; }
+  // are no other non-undead RenderWidgets.
+  void SetIsUndead(bool is_undead);
+
+  // A main frame RenderWidget is made undead instead of being deleted. Then
+  // when a provisional frame is created, the RenderWidget is recycled and
+  // attached to it. Code that wants to prevent using the RenderWidget once it
+  // has been made undead would race with a new provisional frame attaching it,
+  // so should check for both states via this method instead.
+  bool IsUndeadOrProvisional() { return is_undead_ || IsForProvisionalFrame(); }
 
   // Manage edit commands to be used for the next keyboard event.
   const EditCommands& edit_commands() const { return edit_commands_; }
@@ -370,6 +363,9 @@ class CONTENT_EXPORT RenderWidget
   void DidCompletePageScaleAnimation() override;
   void RecordStartOfFrameMetrics() override;
   void RecordEndOfFrameMetrics(base::TimeTicks frame_begin_time) override;
+  std::unique_ptr<cc::BeginMainFrameMetrics> GetBeginMainFrameMetrics()
+      override;
+
   void BeginUpdateLayers() override;
   void EndUpdateLayers() override;
   void UpdateVisualState() override;
@@ -393,11 +389,12 @@ class CONTENT_EXPORT RenderWidget
   bool WillHandleMouseEvent(const blink::WebMouseEvent& event) override;
 
   // RenderWidgetScreenMetricsEmulatorDelegate
-  void SynchronizeVisualProperties(
-      const VisualProperties& visual_properties) override;
   void SetScreenMetricsEmulationParameters(
       bool enabled,
       const blink::WebDeviceEmulationParams& params) override;
+  void SetScreenInfoAndSize(const ScreenInfo& screen_info,
+                            const gfx::Size& widget_size,
+                            const gfx::Size& visible_viewport_size) override;
   void SetScreenRects(const gfx::Rect& widget_screen_rect,
                       const gfx::Rect& window_screen_rect) override;
 
@@ -423,6 +420,7 @@ class CONTENT_EXPORT RenderWidget
   void AutoscrollEnd() override;
   void ClosePopupWidgetSoon() override;
   void Show(blink::WebNavigationPolicy) override;
+  blink::WebScreenInfo GetScreenInfo() override;
   blink::WebRect WindowRect() override;
   blink::WebRect ViewRect() override;
   void SetToolTipText(const blink::WebString& text,
@@ -465,15 +463,12 @@ class CONTENT_EXPORT RenderWidget
                                        const blink::WebRect& bounds) override;
   void ZoomToFindInPageRectInMainFrame(
       const blink::WebRect& rect_to_zoom) override;
-  void RegisterViewportLayers(
-      const cc::ViewportLayers& viewport_layers) override;
   void RegisterSelection(const cc::LayerSelection& selection) override;
   void FallbackCursorModeLockCursor(bool left,
                                     bool right,
                                     bool up,
                                     bool down) override;
   void FallbackCursorModeSetCursorVisibility(bool visible) override;
-  void SetAllowGpuRasterization(bool allow_gpu_raster) override;
   void SetPageScaleStateAndLimits(float page_scale_factor,
                                   bool is_pinch_gesture_active,
                                   float minimum,
@@ -503,6 +498,12 @@ class CONTENT_EXPORT RenderWidget
                                 bool shrink_viewport) override;
   viz::FrameSinkId GetFrameSinkId() override;
 
+  // Returns the scale being applied to the document in blink by the device
+  // emulator. Returns 1 if there is no emulation active. Use this to position
+  // things when the coordinates did not come from blink, such as from the mouse
+  // position.
+  float GetEmulatorScale() const;
+
   // Registers a SwapPromise to report presentation time and possibly swap time.
   // If |swap_time_callback| is not a null callback, it would be called once
   // swap happens. |presentation_time_callback| will be called some time after
@@ -531,6 +532,7 @@ class CONTENT_EXPORT RenderWidget
       float initial_device_scale_factor);
 
   LayerTreeView* layer_tree_view() const { return layer_tree_view_.get(); }
+  cc::LayerTreeHost* layer_tree_host() { return layer_tree_host_; }
   WidgetInputHandlerManager* widget_input_handler_manager() {
     return widget_input_handler_manager_.get();
   }
@@ -555,18 +557,12 @@ class CONTENT_EXPORT RenderWidget
   void OnImeEventGuardStart(ImeEventGuard* guard);
   void OnImeEventGuardFinish(ImeEventGuard* guard);
 
-  void ApplyEmulatedScreenMetricsForPopupWidget(RenderWidget* origin_widget);
-
-  gfx::Rect AdjustValidationMessageAnchor(const gfx::Rect& anchor);
-
   // Checks if the selection bounds have been changed. If they are changed,
   // the new value will be sent to the browser process.
   void UpdateSelectionBounds();
 
   void GetSelectionBounds(gfx::Rect* start, gfx::Rect* end);
 
-  void OnShowHostContextMenu(ContextMenuParams* params);
-
   // Checks if the composition range or composition character bounds have been
   // changed. If they are changed, the new value will be sent to the browser
   // process. This method does nothing when the browser process is not able to
@@ -594,10 +590,6 @@ class CONTENT_EXPORT RenderWidget
     return mouse_lock_dispatcher_.get();
   }
 
-  // Returns the ScreenInfo exposed to Blink. In device emulation, this
-  // may not match the compositor ScreenInfo.
-  const ScreenInfo& GetWebScreenInfo() const;
-
   // When emulated, this returns the original (non-emulated) ScreenInfo.
   const ScreenInfo& GetOriginalScreenInfo() const;
 
@@ -657,10 +649,6 @@ class CONTENT_EXPORT RenderWidget
                        int relative_cursor_pos);
   void OnImeFinishComposingText(bool keep_selection);
 
-  // This does the actual focus change, but is called in more situations than
-  // just as an IPC message.
-  void SetFocus(bool enable);
-
   // Called by the browser process to update text input state.
   void OnRequestTextInputStateUpdate();
 
@@ -673,63 +661,38 @@ class CONTENT_EXPORT RenderWidget
   // composition info (when in monitor mode).
   void OnRequestCompositionUpdates(bool immediate_request,
                                    bool monitor_updates);
-  void SetWidgetBinding(mojom::WidgetRequest request);
+  void SetWidgetReceiver(mojo::PendingReceiver<mojom::Widget> receiver);
 
   void SetMouseCapture(bool capture);
 
   void UseSynchronousResizeModeForTesting(bool enable);
   void SetDeviceScaleFactorForTesting(float factor);
+  void SetZoomLevelForTesting(double zoom_level);
+  void ResetZoomLevelForTesting();
   void SetDeviceColorSpaceForTesting(const gfx::ColorSpace& color_space);
+  void SetPageZoomLevelForTesting(double zoom_level);
   void SetWindowRectSynchronouslyForTesting(const gfx::Rect& new_window_rect);
   void EnableAutoResizeForTesting(const gfx::Size& min_size,
                                   const gfx::Size& max_size);
   void DisableAutoResizeForTesting(const gfx::Size& new_size);
 
-  // Update the WebView's device scale factor.
-  // TODO(ajwong): This should be moved into RenderView.
-  void UpdateWebViewWithDeviceScaleFactor();
-
   // Forces a redraw and invokes the callback once the frame's been displayed
   // to the user.
   using PresentationTimeCallback =
       base::OnceCallback<void(const gfx::PresentationFeedback&)>;
   virtual void RequestPresentation(PresentationTimeCallback callback);
 
-  // RenderWidget IPC message handler that can be overridden by subclasses.
-  virtual void OnSynchronizeVisualProperties(
-      const VisualProperties& visual_properties);
-
-  bool in_synchronous_composite_for_testing() const {
-    return in_synchronous_composite_for_testing_;
-  }
-  void set_in_synchronous_composite_for_testing(bool in) {
-    in_synchronous_composite_for_testing_ = in;
-  }
-
-  // Called by Create() functions and subclasses to finish initialization.
-  // |show_callback| will be invoked once WebWidgetClient::Show() occurs, and
-  // should be null if Show() won't be triggered for this widget.
-  void Init(ShowCallback show_callback, blink::WebWidget* web_widget);
-
   base::WeakPtr<RenderWidget> AsWeakPtr();
 
-  // TODO(https://crbug.com/995981): Eventually, the lifetime of RenderWidget
-  // should be tied to the lifetime of the WebWidget. In the short term, for
-  // main frames, the RenderView has to explicitly set/unset the WebWidget on
-  // attach/detach.
-  void SetWebWidgetInternal(blink::WebWidget* web_widget);
-
  protected:
   // Notify subclasses that we initiated the paint operation.
   virtual void DidInitiatePaint() {}
 
-  // RenderWidgets are created for frames, popups and pepper fullscreen. In the
-  // former case, the caller frame takes ownership and eventually passes the
-  // unique_ptr back in Close(). In the latter cases, the browser process takes
-  // ownership via IPC.  These booleans exist to allow us to confirm than an IPC
-  // message to kill the render widget is coming for a popup or fullscreen.
-  bool popup_ = false;
-  bool pepper_fullscreen_ = false;
+  // Notify subclasses that we handled OnUpdateVisualProperties.
+  virtual void AfterUpdateVisualProperties() {}
+
+  // Destroy the RenderWidget. The |widget| is the owning pointer of |this|.
+  virtual void Close(std::unique_ptr<RenderWidget> widget);
 
  private:
   // Friend RefCounted so that the dtor can be non-public. Using this class
@@ -745,15 +708,19 @@ class CONTENT_EXPORT RenderWidget
   friend class PopupRenderWidget;
   friend class QueueMessageSwapPromiseTest;
   friend class RenderWidgetTest;
-  friend class RenderViewImplTest;  // TODO(ajwong): Can this be removed?
-  FRIEND_TEST_ALL_PREFIXES(RenderWidgetPopupUnittest, EmulatingPopupRect);
+  friend class RenderViewImplTest;
 
-  static scoped_refptr<base::SingleThreadTaskRunner> GetCleanupTaskRunner();
+  // Called by InitFor*() methods on a new RenderWidget. This contains
+  // initialization that occurs whether the RenderWidget is created as undead or
+  // not.
+  void UnconditionalInit(ShowCallback show_callback);
 
-  // Creates the compositor, but leaves it in a stopped state, where it will
-  // not set up IPC channels or begin trying to produce frames until started
-  // via StartStopCompositor().
-  LayerTreeView* InitializeLayerTreeView();
+  // Called by InitFor*() methods when a new RenderWidget is created that is not
+  // undead, or when it is being revived from undead.
+  void LivingInit(blink::WebWidget* web_widget, const ScreenInfo& screen_info);
+  // Initializes the compositor and dependent systems, as part of the
+  // LivingInit() process.
+  void InitCompositing(const ScreenInfo& screen_info);
 
   // If appropriate, initiates the compositor to set up IPC channels and begin
   // its scheduler. Otherwise, pauses the scheduler and tears down its IPC
@@ -764,22 +731,25 @@ class CONTENT_EXPORT RenderWidget
   // browser.
   static void DoDeferredClose(int widget_routing_id);
 
-  gfx::Size GetSizeForWebWidget() const;
+  // Must be called to pass updated values to blink when the widget size, the
+  // visual viewport size, or the device scale factor change.
   void ResizeWebWidget();
 
+  // Enable or disable auto-resize. This is part of
+  // OnUpdateVisualProperties though tests may call to it more directly.
+  void SetAutoResizeMode(bool auto_resize,
+                         const gfx::Size& min_size_before_dsf,
+                         const gfx::Size& max_size_before_dsf,
+                         float device_scale_factor);
+
+  // Sets the zoom level on the RenderView. This is part of
+  // OnUpdateVisualProperties though tests may call to it more directly.
+  void SetZoomLevel(double zoom_level);
+
   // Helper method to get the device_viewport_rect() from the compositor, which
   // is always in physical pixels.
   gfx::Rect CompositorViewportRect() const;
 
-  // Just Close the WebWidget, in cases where the Close() will be deferred.
-  // It is safe to call this multiple times, which happens in the case of
-  // frame widgets beings closed, since subsequent calls are ignored.
-  void CloseWebWidget();
-
-#if BUILDFLAG(USE_EXTERNAL_POPUP_MENU)
-  void SetExternalPopupOriginAdjustmentsForEmulation(ExternalPopupMenu* popup);
-#endif
-
   // RenderWidget IPC message handlers.
   void OnHandleInputEvent(
       const blink::WebInputEvent* event,
@@ -787,6 +757,7 @@ class CONTENT_EXPORT RenderWidget
       const ui::LatencyInfo& latency_info,
       InputEventDispatchType dispatch_type);
   void OnClose();
+  void OnUpdateVisualProperties(const VisualProperties& properties);
   void OnCreatingNewAck();
   void OnEnableDeviceEmulation(const blink::WebDeviceEmulationParams& params);
   void OnDisableDeviceEmulation();
@@ -841,11 +812,6 @@ class CONTENT_EXPORT RenderWidget
   // our state.
   void SetHidden(bool hidden);
 
-  // Sets the fullscreen state for the WebView.
-  // TODO(danakj): This is currently located on RenderWidget but is a page/view
-  // state, and should move to RenderView.
-  void SetIsFullscreen(bool fullscreen);
-
   // Returns a rect that the compositor needs to raster. For a main frame this
   // is always the entire viewport, but for out-of-process iframes this can be
   // constrained to limit overdraw.
@@ -889,9 +855,9 @@ class CONTENT_EXPORT RenderWidget
   blink::WebFrameWidget* GetFrameWidget() const;
 
   // Applies/Removes the DevTools device emulation transformation to/from a
-  // window rect.
-  void ScreenRectToEmulatedIfNeeded(blink::WebRect* window_rect) const;
-  void EmulatedToScreenRectIfNeeded(blink::WebRect* window_rect) const;
+  // screen rect.
+  void ScreenRectToEmulated(gfx::Rect* screen_rect) const;
+  void EmulatedToScreenRect(gfx::Rect* screen_rect) const;
 
   void UpdateSurfaceAndScreenInfo(
       const viz::LocalSurfaceIdAllocation& new_local_surface_id_allocation,
@@ -901,15 +867,6 @@ class CONTENT_EXPORT RenderWidget
   // Used to force the size of a window when running web tests.
   void SetWindowRectSynchronously(const gfx::Rect& new_window_rect);
 
-  void UpdateCaptureSequenceNumber(uint32_t capture_sequence_number);
-
-  // A variant of Send but is fatal if it fails. The browser may
-  // be waiting for this IPC Message and if the send fails the browser will
-  // be left in a state waiting for something that never comes. And if it
-  // never comes then it may later determine this is a hung renderer; so
-  // instead fail right away.
-  void SendOrCrash(IPC::Message* msg);
-
   // Determines whether or not RenderWidget should process IME events from the
   // browser. It always returns true unless there is no WebFrameWidget to
   // handle the event, or there is no page focus.
@@ -920,8 +877,6 @@ class CONTENT_EXPORT RenderWidget
 
   gfx::ColorSpace GetRasterColorSpace() const;
 
-  void UpdateZoom(double zoom_level);
-
 #if BUILDFLAG(ENABLE_PLUGINS)
   // Returns the focused pepper plugin, if any, inside the WebWidget. That is
   // the pepper plugin which is focused inside a frame which belongs to the
@@ -934,20 +889,14 @@ class CONTENT_EXPORT RenderWidget
   // belongs to the frame tree associated with this RenderWidget.
   blink::WebLocalFrame* GetFocusedWebLocalFrameInWidget() const;
 
-  // Called with the resulting frame sink from WarmupCompositor() since frame
-  // sink creation can be asynchronous.
-  void OnReplyForWarmupCompositor(std::unique_ptr<cc::LayerTreeFrameSink> sink);
-
-  // Common code shared to execute the creation of a LayerTreeFrameSink, shared
-  // by the warmup and standard request paths. Callers should verify they really
-  // want to do this before calling it as this method does no verification.
-  void DoRequestNewLayerTreeFrameSink(LayerTreeFrameSinkCallback callback);
-
   // Whether this widget is for a frame. This excludes widgets that are not for
   // a frame (eg popups, pepper), but includes both the main frame
   // (via delegate_) and subframes (via for_child_local_root_frame_).
   bool for_frame() const { return delegate_ || for_child_local_root_frame_; }
 
+  // Whether this widget is for a frame that is currently provisional.
+  bool IsForProvisionalFrame() const;
+
   // Routing ID that allows us to communicate to the parent browser process
   // RenderWidgetHost.
   const int32_t routing_id_;
@@ -956,18 +905,37 @@ class CONTENT_EXPORT RenderWidget
   // features.
   CompositorDependencies* const compositor_deps_;
 
-  // Use GetWebWidget() instead of using webwidget_internal_ directly.
-  // We are responsible for destroying this object via its Close method.
-  // May be NULL when the window is closing.
-  blink::WebWidget* webwidget_internal_ = nullptr;
+  // We are responsible for destroying this object via its Close method, unless
+  // the RenderWidget is associated with a RenderViewImpl through |delegate_|.
+  // Becomes null once close is initiated on the RenderWidget.
+  // TODO(https://crbug.com/995981): For main frame RenderWidgets associated
+  // with a RenderViewImpl through |delegate_|, this is also null when the
+  // RenderWidget is undead.
+  blink::WebWidget* webwidget_ = nullptr;
 
   // The delegate for this object which is just a RenderViewImpl.
   // This member is non-null if and only if the RenderWidget is associated with
   // a RenderViewImpl.
   RenderWidgetDelegate* delegate_ = nullptr;
 
-  // This is lazily constructed and must not outlive webwidget_.
+  // Wraps the LayerTreeHost, providing clients for it with the ability to
+  // outlive RenderWidget during shutdown and keep the client pointers valid.
   std::unique_ptr<LayerTreeView> layer_tree_view_;
+  // This is valid while |layer_tree_view_| is valid.
+  cc::LayerTreeHost* layer_tree_host_ = nullptr;
+
+  // Present when emulation is enabled, only in a main frame RenderWidget. Used
+  // to override values given from the browser such as ScreenInfo,
+  // WidgetScreenRect, WindowScreenRect, and the widget's size.
+  std::unique_ptr<RenderWidgetScreenMetricsEmulator> device_emulator_;
+
+  // When emulation is enabled, and a popup widget is opened, the popup widget
+  // needs these values to move between the popup's (non-emulated) coordinates
+  // and the opener widget's (emulated) coordinates. They are only valid when
+  // the |opener_emulator_scale_| is non-zero.
+  gfx::Point opener_widget_screen_origin_;
+  gfx::Point opener_original_widget_screen_origin_;
+  float opener_emulator_scale_ = 0;
 
   // The rect where this view should be initially shown.
   gfx::Rect initial_rect_;
@@ -975,7 +943,11 @@ class CONTENT_EXPORT RenderWidget
   // Web tests override the device scale factor in the renderer with this. We
   // store it to keep the override if the browser passes along VisualProperties
   // with the real device scale factor. A value of 0.f means this is ignored.
-  float device_scale_factor_for_testing_ = 0.f;
+  float device_scale_factor_for_testing_ = 0;
+  // Web tests override the zoom factor in the renderer with this. We store it
+  // to keep the override if the browser passes along VisualProperties with the
+  // real device scale factor. A value of -INFINITY means this is ignored.
+  double zoom_level_for_testing_ = -INFINITY;
 
   // The size of the RenderWidget in DIPs. This may differ from the viewport
   // set in the compositor, as the viewport can be a subset of the RenderWidget
@@ -1007,21 +979,17 @@ class CONTENT_EXPORT RenderWidget
   bool is_fullscreen_granted_ = false;
 
   // Indicates the display mode.
-  blink::WebDisplayMode display_mode_;
+  blink::mojom::DisplayMode display_mode_;
 
   // It is possible that one ImeEventGuard is nested inside another
   // ImeEventGuard. We keep track of the outermost one, and update it as needed.
   ImeEventGuard* ime_event_guard_ = nullptr;
 
-  bool closed_ = false;
-  // True if we have requested this widget be closed.  No more messages will
-  // be sent, except for a Close.
+  // True once Close() is called, during the self-destruction process, and to
+  // verify destruction always goes through Close().
   bool closing_ = false;
 
-  // True if it is known that the host is in the process of being shut down.
-  bool host_will_close_this_ = false;
-
-  // A RenderWidget is frozen if it is the RenderWidget attached to the
+  // A RenderWidget is undead if it is the RenderWidget attached to the
   // RenderViewImpl for its main frame, but there is a proxy main frame in
   // RenderViewImpl's frame tree. Since proxy frames do not have content they
   // do not need a RenderWidget.
@@ -1030,8 +998,12 @@ class CONTENT_EXPORT RenderWidget
   // unlike the main frame RenderWidget (for now).
   // TODO(419087): In this case the RenderWidget should not exist at all as
   // it has nothing to display, but since we can't destroy it without destroying
-  // the RenderViewImpl, we freeze it instead.
-  bool is_frozen_;
+  // the RenderViewImpl, we mark it as undead instead.
+  // TODO(419087): RenderWidgets attached to a provisional main frame are
+  // undead, but are also semi-active, they are valid and can be used and
+  // receive IPCs etc, even though they have not been swapped in. We should
+  // consider a tri-state here instead.
+  bool is_undead_;
 
   // In web tests, synchronous resizing mode may be used. Normally each widget's
   // size is controlled by IPC from the browser. In synchronous resize mode the
@@ -1046,9 +1018,6 @@ class CONTENT_EXPORT RenderWidget
   // process, without the use of this mode, however it would be overridden by
   // the browser if they disagree.
   bool synchronous_resize_mode_for_testing_ = false;
-  // In web tests, synchronous composites should not be nested inside another
-  // composite, and this bool is used to guard against that.
-  bool in_synchronous_composite_for_testing_ = false;
 
   // Stores information about the current text input.
   blink::WebTextInputInfo text_input_info_;
@@ -1087,7 +1056,13 @@ class CONTENT_EXPORT RenderWidget
   int pending_window_rect_count_ = 0;
   gfx::Rect pending_window_rect_;
 
-  // The screen rects of the view and the window that contains it.
+  // Properties of the screen hosting the RenderWidget. Rects in this structure
+  // do not include any scaling by device scale factor, so are logical pixels
+  // not physical device pixels.
+  ScreenInfo screen_info_;
+  // The screen rects of the view and the window that contains it. These do not
+  // include any scaling by device scale factor, so are logical pixels not
+  // physical device pixels.
   gfx::Rect widget_screen_rect_;
   gfx::Rect window_screen_rect_;
 
@@ -1098,20 +1073,9 @@ class CONTENT_EXPORT RenderWidget
   // The time spent in input handlers this frame. Used to throttle input acks.
   base::TimeDelta total_input_handling_time_this_frame_;
 
-  // Properties of the screen hosting this RenderWidget instance.
-  ScreenInfo screen_info_;
-
   // True if the IME requests updated composition info.
   bool monitor_composition_info_ = false;
 
-  std::unique_ptr<RenderWidgetScreenMetricsEmulator> screen_metrics_emulator_;
-
-  // Popups may be displaced when screen metrics emulation is enabled.
-  // These values are used to properly adjust popup position.
-  gfx::Point popup_view_origin_for_emulation_;
-  gfx::Point popup_screen_origin_for_emulation_;
-  float popup_origin_scale_for_emulation_ = 0.f;
-
   scoped_refptr<FrameSwapMessageQueue> frame_swap_message_queue_;
 
   // Lists of RenderFrameProxy objects that need to be notified of
@@ -1137,18 +1101,6 @@ class CONTENT_EXPORT RenderWidget
   // Wraps the |webwidget_| as a MouseLockDispatcher::LockTarget interface.
   std::unique_ptr<MouseLockDispatcher::LockTarget> webwidget_mouse_lock_target_;
 
-  // Set to true while a warmup is in progress. Set to false if the warmup is
-  // completed or aborted. If aborted, the reply callback is also cancelled by
-  // invalidating the |warmup_weak_ptr_factory_|.
-  bool warmup_frame_sink_request_pending_ = false;
-  // Set after warmup completes without being aborted. This frame sink will be
-  // returned on the next request for a frame sink instead of creating a new
-  // one.
-  std::unique_ptr<cc::LayerTreeFrameSink> warmup_frame_sink_;
-  // Set if a request for a frame sink arrives while a warmup is in progress.
-  // Then this stores the request to be satisfied once the warmup completes.
-  LayerTreeFrameSinkCallback after_warmup_callback_;
-
   viz::LocalSurfaceIdAllocation local_surface_id_allocation_from_parent_;
 
   // Indicates whether this widget has focus.
@@ -1158,6 +1110,13 @@ class CONTENT_EXPORT RenderWidget
   // that are not for a frame (eg popups) and excludes the widget for the main
   // frame (which is attached to the RenderViewImpl).
   bool for_child_local_root_frame_ = false;
+  // RenderWidgets are created for frames, popups and pepper fullscreen. In the
+  // former case, the caller frame takes ownership and eventually passes the
+  // unique_ptr back in Close(). In the latter cases, the browser process takes
+  // ownership via IPC.  These booleans exist to allow us to confirm than an IPC
+  // message to kill the render widget is coming for a popup or fullscreen.
+  bool popup_ = false;
+  bool pepper_fullscreen_ = false;
 
   // A callback into the creator/opener of this widget, to be executed when
   // WebWidgetClient::Show() occurs.
@@ -1200,7 +1159,7 @@ class CONTENT_EXPORT RenderWidget
 
   scoped_refptr<MainThreadEventQueue> input_event_queue_;
 
-  mojo::Binding<mojom::Widget> widget_binding_;
+  mojo::Receiver<mojom::Widget> widget_receiver_;
 
   gfx::Rect compositor_visible_rect_;
 
@@ -1210,12 +1169,6 @@ class CONTENT_EXPORT RenderWidget
 
   uint32_t last_capture_sequence_number_ = 0u;
 
-  // Used to generate a callback for the reply when making the warmup frame
-  // sink, and to cancel that callback if the warmup is aborted.
-  base::WeakPtrFactory<RenderWidget> warmup_weak_ptr_factory_{this};
-  // This factory is invalidated when the WebWidget is closed.
-  base::WeakPtrFactory<RenderWidget> close_weak_ptr_factory_{this};
-  // This factory is invalidated when the RenderWidget is destroyed.
   base::WeakPtrFactory<RenderWidget> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(RenderWidget);
diff --git a/chromium/content/renderer/render_widget_browsertest.cc b/chromium/content/renderer/render_widget_browsertest.cc
index 80b547f35b8..54eea00e641 100644
--- a/chromium/content/renderer/render_widget_browsertest.cc
+++ b/chromium/content/renderer/render_widget_browsertest.cc
@@ -6,6 +6,7 @@
 #include "components/viz/common/surfaces/local_surface_id.h"
 #include "components/viz/common/surfaces/parent_local_surface_id_allocator.h"
 #include "content/common/visual_properties.h"
+#include "content/common/widget_messages.h"
 #include "content/public/renderer/render_frame_visitor.h"
 #include "content/public/test/render_view_test.h"
 #include "content/renderer/compositor/layer_tree_view.h"
@@ -27,8 +28,11 @@ class RenderWidgetTest : public RenderViewTest {
     return static_cast<RenderViewImpl*>(view_)->GetWidget();
   }
 
-  void OnSynchronizeVisualProperties(const VisualProperties& params) {
-    widget()->OnSynchronizeVisualProperties(params);
+  void OnSynchronizeVisualProperties(
+      const VisualProperties& visual_properties) {
+    WidgetMsg_UpdateVisualProperties msg(widget()->routing_id(),
+                                         visual_properties);
+    widget()->OnMessageReceived(msg);
   }
 
   void GetCompositionRange(gfx::Range* range) {
@@ -102,13 +106,12 @@ TEST_F(RenderWidgetTest, OnSynchronizeVisualProperties) {
 
 class RenderWidgetInitialSizeTest : public RenderWidgetTest {
  protected:
-  std::unique_ptr<VisualProperties> InitialVisualProperties() override {
-    std::unique_ptr<VisualProperties> initial_visual_properties(
-        new VisualProperties());
-    initial_visual_properties->new_size = initial_size_;
-    initial_visual_properties->compositor_viewport_pixel_rect =
+  VisualProperties InitialVisualProperties() override {
+    VisualProperties initial_visual_properties;
+    initial_visual_properties.new_size = initial_size_;
+    initial_visual_properties.compositor_viewport_pixel_rect =
         gfx::Rect(initial_size_);
-    initial_visual_properties->local_surface_id_allocation =
+    initial_visual_properties.local_surface_id_allocation =
         local_surface_id_allocator_.GetCurrentLocalSurfaceIdAllocation();
     return initial_visual_properties;
   }
@@ -235,7 +238,11 @@ TEST_F(RenderWidgetTest, ActivePinchGestureUpdatesLayerTreeHost) {
 
   // Sync visual properties on a mainframe RenderWidget.
   visual_properties.is_pinch_gesture_active = true;
-  widget()->OnSynchronizeVisualProperties(visual_properties);
+  {
+    WidgetMsg_UpdateVisualProperties msg(widget()->routing_id(),
+                                         visual_properties);
+    widget()->OnMessageReceived(msg);
+  }
   // We do not expect the |is_pinch_gesture_active| value to propagate to the
   // LayerTreeHost for the main-frame. Since GesturePinch events are handled
   // directly by the layer tree for the main frame, it already knows whether or
diff --git a/chromium/content/renderer/render_widget_delegate.h b/chromium/content/renderer/render_widget_delegate.h
index 1259a599d28..0f84e84fa2a 100644
--- a/chromium/content/renderer/render_widget_delegate.h
+++ b/chromium/content/renderer/render_widget_delegate.h
@@ -8,7 +8,6 @@
 #include "content/common/content_export.h"
 
 namespace blink {
-class WebMouseEvent;
 class WebWidget;
 struct WebDeviceEmulationParams;
 }  // namespace blink
@@ -25,11 +24,6 @@ class CONTENT_EXPORT RenderWidgetDelegate {
  public:
   virtual ~RenderWidgetDelegate() = default;
 
-  // As in RenderWidgetInputHandlerDelegate. Return true if the event was
-  // handled.
-  virtual bool RenderWidgetWillHandleMouseEventForWidget(
-      const blink::WebMouseEvent& event) = 0;
-
   // See comment in RenderWidgetHost::SetActive().
   virtual void SetActiveForWidget(bool active) = 0;
 
@@ -52,7 +46,7 @@ class CONTENT_EXPORT RenderWidgetDelegate {
   // display mode that will be applied to the RenderWidget. The display mode in
   // the RenderWidget is already changed when this method is called.
   virtual void ApplyNewDisplayModeForWidget(
-      const blink::WebDisplayMode& new_display_mode) = 0;
+      blink::mojom::DisplayMode new_display_mode) = 0;
   // Called during handling a SynchronizeVisualProperties message, if auto
   // resize is enabled, with the new auto size limits.
   virtual void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
diff --git a/chromium/content/renderer/render_widget_fullscreen_pepper.cc b/chromium/content/renderer/render_widget_fullscreen_pepper.cc
index 35e871896b2..c6c2121eefa 100644
--- a/chromium/content/renderer/render_widget_fullscreen_pepper.cc
+++ b/chromium/content/renderer/render_widget_fullscreen_pepper.cc
@@ -275,17 +275,17 @@ RenderWidgetFullscreenPepper* RenderWidgetFullscreenPepper::Create(
     int32_t routing_id,
     RenderWidget::ShowCallback show_callback,
     CompositorDependencies* compositor_deps,
+    const ScreenInfo& screen_info,
     PepperPluginInstanceImpl* plugin,
     const blink::WebURL& local_main_frame_url,
-    const ScreenInfo& screen_info,
-    mojom::WidgetRequest widget_request) {
+    mojo::PendingReceiver<mojom::Widget> widget_receiver) {
   DCHECK_NE(MSG_ROUTING_NONE, routing_id);
   DCHECK(show_callback);
-  RenderWidgetFullscreenPepper* widget =
-      new RenderWidgetFullscreenPepper(routing_id, compositor_deps, plugin,
-                                       screen_info, std::move(widget_request));
-  widget->Init(std::move(show_callback),
-               new PepperWidget(widget, local_main_frame_url));
+  RenderWidgetFullscreenPepper* widget = new RenderWidgetFullscreenPepper(
+      routing_id, compositor_deps, plugin, std::move(widget_receiver));
+  widget->InitForPepperFullscreen(
+      std::move(show_callback), new PepperWidget(widget, local_main_frame_url),
+      screen_info);
   return widget;
 }
 
@@ -293,21 +293,17 @@ RenderWidgetFullscreenPepper::RenderWidgetFullscreenPepper(
     int32_t routing_id,
     CompositorDependencies* compositor_deps,
     PepperPluginInstanceImpl* plugin,
-    const ScreenInfo& screen_info,
-    mojom::WidgetRequest widget_request)
+    mojo::PendingReceiver<mojom::Widget> widget_receiver)
     : RenderWidget(routing_id,
                    compositor_deps,
-                   screen_info,
-                   blink::kWebDisplayModeUndefined,
-                   false,
-                   false,
-                   false,
-                   std::move(widget_request)),
+                   /*display_mode=*/blink::mojom::DisplayMode::kUndefined,
+                   /*is_undead=*/false,
+                   /*hidden=*/false,
+                   /*never_visible=*/false,
+                   std::move(widget_receiver)),
       plugin_(plugin),
-      layer_(nullptr),
-      mouse_lock_dispatcher_(new FullscreenMouseLockDispatcher(this)) {
-  pepper_fullscreen_ = true;
-}
+      mouse_lock_dispatcher_(
+          std::make_unique<FullscreenMouseLockDispatcher>(this)) {}
 
 RenderWidgetFullscreenPepper::~RenderWidgetFullscreenPepper() {
 }
@@ -351,7 +347,7 @@ void RenderWidgetFullscreenPepper::SetLayer(cc::Layer* layer) {
   UpdateLayerBounds();
   layer_->SetIsDrawable(true);
   layer_->SetHitTestable(true);
-  layer_tree_view()->SetNonBlinkManagedRootLayer(layer_);
+  layer_tree_host()->SetNonBlinkManagedRootLayer(layer_);
 }
 
 bool RenderWidgetFullscreenPepper::OnMessageReceived(const IPC::Message& msg) {
@@ -384,9 +380,7 @@ void RenderWidgetFullscreenPepper::Close(std::unique_ptr<RenderWidget> widget) {
   RenderWidget::Close(std::move(widget));
 }
 
-void RenderWidgetFullscreenPepper::OnSynchronizeVisualProperties(
-    const VisualProperties& visual_properties) {
-  RenderWidget::OnSynchronizeVisualProperties(visual_properties);
+void RenderWidgetFullscreenPepper::AfterUpdateVisualProperties() {
   UpdateLayerBounds();
 }
 
diff --git a/chromium/content/renderer/render_widget_fullscreen_pepper.h b/chromium/content/renderer/render_widget_fullscreen_pepper.h
index 00b6d0309c1..8053b7e4d2f 100644
--- a/chromium/content/renderer/render_widget_fullscreen_pepper.h
+++ b/chromium/content/renderer/render_widget_fullscreen_pepper.h
@@ -13,6 +13,7 @@
 #include "content/renderer/mouse_lock_dispatcher.h"
 #include "content/renderer/pepper/fullscreen_container.h"
 #include "content/renderer/render_widget.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "third_party/blink/public/web/web_widget.h"
 #include "url/gurl.h"
 
@@ -36,10 +37,10 @@ class RenderWidgetFullscreenPepper : public RenderWidget,
       int32_t routing_id,
       RenderWidget::ShowCallback show_callback,
       CompositorDependencies* compositor_deps,
+      const ScreenInfo& screen_info,
       PepperPluginInstanceImpl* plugin,
       const blink::WebURL& local_main_frame_url,
-      const ScreenInfo& screen_info,
-      mojom::WidgetRequest widget_request);
+      mojo::PendingReceiver<mojom::Widget> widget_receiver);
 
   // pepper::FullscreenContainer API.
   void ScrollRect(int dx, int dy, const blink::WebRect& rect) override;
@@ -58,18 +59,17 @@ class RenderWidgetFullscreenPepper : public RenderWidget,
   }
 
  protected:
-  RenderWidgetFullscreenPepper(int32_t routing_id,
-                               CompositorDependencies* compositor_deps,
-                               PepperPluginInstanceImpl* plugin,
-                               const ScreenInfo& screen_info,
-                               mojom::WidgetRequest widget_request);
+  RenderWidgetFullscreenPepper(
+      int32_t routing_id,
+      CompositorDependencies* compositor_deps,
+      PepperPluginInstanceImpl* plugin,
+      mojo::PendingReceiver<mojom::Widget> widget_receiver);
   ~RenderWidgetFullscreenPepper() override;
 
   // RenderWidget API.
   void DidInitiatePaint() override;
   void Close(std::unique_ptr<RenderWidget> widget) override;
-  void OnSynchronizeVisualProperties(
-      const VisualProperties& visual_properties) override;
+  void AfterUpdateVisualProperties() override;
 
  private:
   void UpdateLayerBounds();
@@ -77,7 +77,7 @@ class RenderWidgetFullscreenPepper : public RenderWidget,
   // The plugin instance this widget wraps.
   PepperPluginInstanceImpl* plugin_;
 
-  cc::Layer* layer_;
+  cc::Layer* layer_ = nullptr;
 
   std::unique_ptr<MouseLockDispatcher> mouse_lock_dispatcher_;
 
diff --git a/chromium/content/renderer/render_widget_screen_metrics_emulator.cc b/chromium/content/renderer/render_widget_screen_metrics_emulator.cc
index 29d798db005..91112bf5163 100644
--- a/chromium/content/renderer/render_widget_screen_metrics_emulator.cc
+++ b/chromium/content/renderer/render_widget_screen_metrics_emulator.cc
@@ -4,7 +4,6 @@
 
 #include "content/renderer/render_widget_screen_metrics_emulator.h"
 
-#include "content/common/visual_properties.h"
 #include "content/public/common/context_menu_params.h"
 #include "content/renderer/render_widget_screen_metrics_emulator_delegate.h"
 
@@ -12,22 +11,27 @@ namespace content {
 
 RenderWidgetScreenMetricsEmulator::RenderWidgetScreenMetricsEmulator(
     RenderWidgetScreenMetricsEmulatorDelegate* delegate,
-    const blink::WebDeviceEmulationParams& params,
-    const VisualProperties& visual_properties,
+    const ScreenInfo& screen_info,
+    const gfx::Size& widget_size,
+    const gfx::Size& visible_viewport_size,
     const gfx::Rect& view_screen_rect,
     const gfx::Rect& window_screen_rect)
     : delegate_(delegate),
-      emulation_params_(params),
-      scale_(1.f),
-      original_visual_properties_(visual_properties),
+      original_screen_info_(screen_info),
+      original_widget_size_(widget_size),
+      original_visible_viewport_size_(visible_viewport_size),
       original_view_screen_rect_(view_screen_rect),
       original_window_screen_rect_(window_screen_rect) {}
 
-RenderWidgetScreenMetricsEmulator::~RenderWidgetScreenMetricsEmulator() {
-  delegate_->SynchronizeVisualProperties(original_visual_properties_);
+RenderWidgetScreenMetricsEmulator::~RenderWidgetScreenMetricsEmulator() =
+    default;
+
+void RenderWidgetScreenMetricsEmulator::DisableAndApply() {
   delegate_->SetScreenMetricsEmulationParameters(false, emulation_params_);
   delegate_->SetScreenRects(original_view_screen_rect_,
                             original_window_screen_rect_);
+  delegate_->SetScreenInfoAndSize(original_screen_info_, original_widget_size_,
+                                  original_visible_viewport_size_);
 }
 
 void RenderWidgetScreenMetricsEmulator::ChangeEmulationParams(
@@ -36,108 +40,128 @@ void RenderWidgetScreenMetricsEmulator::ChangeEmulationParams(
   Apply();
 }
 
-void RenderWidgetScreenMetricsEmulator::Apply() {
-  VisualProperties modified_visual_properties = original_visual_properties_;
-  applied_widget_rect_.set_size(gfx::Size(emulation_params_.view_size));
-
-  if (!applied_widget_rect_.width())
-    applied_widget_rect_.set_width(original_size().width());
-
-  if (!applied_widget_rect_.height())
-    applied_widget_rect_.set_height(original_size().height());
+gfx::Point RenderWidgetScreenMetricsEmulator::ViewRectOrigin() {
+  gfx::Point widget_pos = original_view_rect().origin();
+  if (emulation_params_.view_position)
+    widget_pos = *emulation_params_.view_position;
+  else if (!emulating_desktop())
+    widget_pos = gfx::Point();
+  return widget_pos;
+}
 
-  scale_ = emulation_params_.scale;
-  if (!emulation_params_.view_size.width &&
-      !emulation_params_.view_size.height && scale_) {
-    applied_widget_rect_.set_size(
-        gfx::ScaleToRoundedSize(original_size(), 1.f / scale_));
+void RenderWidgetScreenMetricsEmulator::Apply() {
+  // The WidgetScreenRect gets derived from the widget size of the main frame
+  // widget, not from the original WidgetScreenRect.
+  gfx::Size widget_size = original_widget_size_;
+  // The WindowScreenRect gets derived from the original WindowScreenRect,
+  // though.
+  gfx::Size window_size = original_window_rect().size();
+
+  // If either the width or height are specified by the emulator, then we use
+  // that size, and assume that they have the scale pre-applied to them.
+  if (emulation_params_.view_size.width) {
+    widget_size.set_width(emulation_params_.view_size.width);
+  } else {
+    widget_size.set_width(
+        gfx::ToRoundedInt(widget_size.width() / emulation_params_.scale));
   }
-
-  gfx::Rect window_screen_rect;
-  if (emulation_params_.screen_position ==
-      blink::WebDeviceEmulationParams::kDesktop) {
-    modified_visual_properties.screen_info.rect = original_screen_info().rect;
-    modified_visual_properties.screen_info.available_rect =
-        original_screen_info().available_rect;
-    window_screen_rect = original_window_screen_rect_;
-    if (emulation_params_.view_position) {
-      applied_widget_rect_.set_origin(*emulation_params_.view_position);
-      window_screen_rect.set_origin(*emulation_params_.view_position);
-    } else {
-      applied_widget_rect_.set_origin(original_view_screen_rect_.origin());
-    }
+  if (emulation_params_.view_size.height) {
+    widget_size.set_height(emulation_params_.view_size.height);
   } else {
-    applied_widget_rect_.set_origin(
-        emulation_params_.view_position.value_or(blink::WebPoint()));
-    modified_visual_properties.screen_info.rect = applied_widget_rect_;
-    modified_visual_properties.screen_info.available_rect =
-        applied_widget_rect_;
-    window_screen_rect = applied_widget_rect_;
+    widget_size.set_height(
+        gfx::ToRoundedInt(widget_size.height() / emulation_params_.scale));
   }
 
+  // For mobile emulation, the window size is changed to match the widget size,
+  // as there are no window decorations around the widget.
+  if (!emulating_desktop())
+    window_size = widget_size;
+
+  gfx::Point widget_pos = original_view_rect().origin();
+  gfx::Point window_pos = original_window_rect().origin();
+
+  if (emulation_params_.view_position) {
+    // The emulated widget position overrides the widget and window positions.
+    widget_pos = *emulation_params_.view_position;
+    window_pos = widget_pos;
+  } else if (!emulating_desktop()) {
+    // For mobile emulation, the widget and window are moved to 0,0 if not
+    // explicitly specified.
+    widget_pos = gfx::Point();
+    window_pos = widget_pos;
+  }
+
+  gfx::Rect screen_rect = original_screen_info().rect;
+
   if (!emulation_params_.screen_size.IsEmpty()) {
-    gfx::Rect screen_rect = gfx::Rect(0, 0, emulation_params_.screen_size.width,
-                                      emulation_params_.screen_size.height);
-    modified_visual_properties.screen_info.rect = screen_rect;
-    modified_visual_properties.screen_info.available_rect = screen_rect;
+    // The emulated screen size overrides the real one, and moves the screen's
+    // origin to 0,0.
+    screen_rect = gfx::Rect(emulation_params_.screen_size);
+  } else if (!emulating_desktop()) {
+    // For mobile emulation, the screen is adjusted to match the position and
+    // size of the widget rect, if not explicitly specified.
+    screen_rect = gfx::Rect(widget_pos, widget_size);
   }
 
-  modified_visual_properties.screen_info.device_scale_factor =
-      emulation_params_.device_scale_factor
-          ? emulation_params_.device_scale_factor
-          : original_screen_info().device_scale_factor;
-
-  if (emulation_params_.screen_orientation_type !=
-      blink::kWebScreenOrientationUndefined) {
-    switch (emulation_params_.screen_orientation_type) {
-      case blink::kWebScreenOrientationPortraitPrimary:
-        modified_visual_properties.screen_info.orientation_type =
-            SCREEN_ORIENTATION_VALUES_PORTRAIT_PRIMARY;
-        break;
-      case blink::kWebScreenOrientationPortraitSecondary:
-        modified_visual_properties.screen_info.orientation_type =
-            SCREEN_ORIENTATION_VALUES_PORTRAIT_SECONDARY;
-        break;
-      case blink::kWebScreenOrientationLandscapePrimary:
-        modified_visual_properties.screen_info.orientation_type =
-            SCREEN_ORIENTATION_VALUES_LANDSCAPE_PRIMARY;
-        break;
-      case blink::kWebScreenOrientationLandscapeSecondary:
-        modified_visual_properties.screen_info.orientation_type =
-            SCREEN_ORIENTATION_VALUES_LANDSCAPE_SECONDARY;
-        break;
-      default:
-        modified_visual_properties.screen_info.orientation_type =
-            SCREEN_ORIENTATION_VALUES_DEFAULT;
-        break;
-    }
-    modified_visual_properties.screen_info.orientation_angle =
-        emulation_params_.screen_orientation_angle;
+  float device_scale_factor = original_screen_info().device_scale_factor;
+
+  if (emulation_params_.device_scale_factor)
+    device_scale_factor = emulation_params_.device_scale_factor;
+
+  ScreenOrientationValues orientation_type =
+      original_screen_info().orientation_type;
+  uint16_t orientation_angle = original_screen_info().orientation_angle;
+
+  switch (emulation_params_.screen_orientation_type) {
+    case blink::kWebScreenOrientationUndefined:
+      break;  // Leave as the real value.
+    case blink::kWebScreenOrientationPortraitPrimary:
+      orientation_type = SCREEN_ORIENTATION_VALUES_PORTRAIT_PRIMARY;
+      orientation_angle = emulation_params_.screen_orientation_angle;
+      break;
+    case blink::kWebScreenOrientationPortraitSecondary:
+      orientation_type = SCREEN_ORIENTATION_VALUES_PORTRAIT_SECONDARY;
+      orientation_angle = emulation_params_.screen_orientation_angle;
+      break;
+    case blink::kWebScreenOrientationLandscapePrimary:
+      orientation_type = SCREEN_ORIENTATION_VALUES_LANDSCAPE_PRIMARY;
+      orientation_angle = emulation_params_.screen_orientation_angle;
+      break;
+    case blink::kWebScreenOrientationLandscapeSecondary:
+      orientation_type = SCREEN_ORIENTATION_VALUES_LANDSCAPE_SECONDARY;
+      orientation_angle = emulation_params_.screen_orientation_angle;
+      break;
   }
 
   // Pass three emulation parameters to the blink side:
   // - we keep the real device scale factor in compositor to produce sharp image
   //   even when emulating different scale factor;
-  // - in order to fit into view, WebView applies offset and scale to the
-  //   root layer.
   blink::WebDeviceEmulationParams modified_emulation_params = emulation_params_;
   modified_emulation_params.device_scale_factor =
       original_screen_info().device_scale_factor;
-  modified_emulation_params.scale = scale_;
   delegate_->SetScreenMetricsEmulationParameters(true,
                                                  modified_emulation_params);
 
-  delegate_->SetScreenRects(applied_widget_rect_, window_screen_rect);
-
-  modified_visual_properties.new_size = applied_widget_rect_.size();
-  modified_visual_properties.visible_viewport_size =
-      applied_widget_rect_.size();
-  delegate_->SynchronizeVisualProperties(modified_visual_properties);
+  delegate_->SetScreenRects(gfx::Rect(widget_pos, widget_size),
+                            gfx::Rect(window_pos, window_size));
+
+  ScreenInfo screen_info = original_screen_info();
+  screen_info.device_scale_factor = device_scale_factor;
+  screen_info.rect = screen_rect;
+  screen_info.available_rect = screen_rect;
+  screen_info.orientation_type = orientation_type;
+  screen_info.orientation_angle = orientation_angle;
+  delegate_->SetScreenInfoAndSize(screen_info, /*widget_size=*/widget_size,
+                                  /*visible_viewport_size=*/widget_size);
 }
 
 void RenderWidgetScreenMetricsEmulator::OnSynchronizeVisualProperties(
-    const VisualProperties& params) {
-  original_visual_properties_ = params;
+    const ScreenInfo& screen_info,
+    const gfx::Size& widget_size,
+    const gfx::Size& visible_viewport_size) {
+  original_screen_info_ = screen_info;
+  original_widget_size_ = widget_size;
+  original_visible_viewport_size_ = visible_viewport_size;
   Apply();
 }
 
@@ -146,21 +170,9 @@ void RenderWidgetScreenMetricsEmulator::OnUpdateScreenRects(
     const gfx::Rect& window_screen_rect) {
   original_view_screen_rect_ = view_screen_rect;
   original_window_screen_rect_ = window_screen_rect;
-  if (emulation_params_.screen_position ==
-      blink::WebDeviceEmulationParams::kDesktop) {
+  if (emulating_desktop()) {
     Apply();
   }
 }
 
-void RenderWidgetScreenMetricsEmulator::OnShowContextMenu(
-    ContextMenuParams* params) {
-  params->x *= scale_;
-  params->y *= scale_;
-}
-
-gfx::Rect RenderWidgetScreenMetricsEmulator::AdjustValidationMessageAnchor(
-    const gfx::Rect& anchor) {
-  return gfx::ScaleToEnclosedRect(anchor, scale_);
-}
-
 }  // namespace content
diff --git a/chromium/content/renderer/render_widget_screen_metrics_emulator.h b/chromium/content/renderer/render_widget_screen_metrics_emulator.h
index 4a98f3ec9a9..469a46de837 100644
--- a/chromium/content/renderer/render_widget_screen_metrics_emulator.h
+++ b/chromium/content/renderer/render_widget_screen_metrics_emulator.h
@@ -7,17 +7,14 @@
 
 #include <memory>
 
-#include "content/common/visual_properties.h"
+#include "content/common/content_export.h"
+#include "content/public/common/screen_info.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
-
-namespace gfx {
-class Rect;
-}
+#include "ui/gfx/geometry/rect.h"
+#include "ui/gfx/geometry/size.h"
 
 namespace content {
-
 class RenderWidgetScreenMetricsEmulatorDelegate;
-struct ContextMenuParams;
 
 // RenderWidgetScreenMetricsEmulator class manages screen emulation inside a
 // RenderWidget. This includes resizing, placing view on the screen at desired
@@ -27,54 +24,65 @@ class CONTENT_EXPORT RenderWidgetScreenMetricsEmulator {
  public:
   RenderWidgetScreenMetricsEmulator(
       RenderWidgetScreenMetricsEmulatorDelegate* delegate,
-      const blink::WebDeviceEmulationParams& params,
-      const VisualProperties& visual_properties,
+      const ScreenInfo& screen_info,
+      const gfx::Size& widget_size,
+      const gfx::Size& visible_viewport_size,
       const gfx::Rect& view_screen_rect,
       const gfx::Rect& window_screen_rect);
-  virtual ~RenderWidgetScreenMetricsEmulator();
-
-  // Scale and offset used to convert between host coordinates
-  // and webwidget coordinates.
-  const gfx::Size& original_size() const {
-    return original_visual_properties_.new_size;
-  }
+  ~RenderWidgetScreenMetricsEmulator();
 
-  float scale() const { return scale_; }
-  const gfx::Rect& applied_widget_rect() const { return applied_widget_rect_; }
   const ScreenInfo& original_screen_info() const {
-    return original_visual_properties_.screen_info;
+    return original_screen_info_;
   }
-  const gfx::Rect& original_screen_rect() const {
+  // This rect is the WidgetScreenRect or ViewRect, which is the main frame
+  // widget's bounding box, not including OS window decor, in logical DIP screen
+  // coordinates.
+  const gfx::Rect& original_view_rect() const {
     return original_view_screen_rect_;
   }
+  // This rect is the WindowScreenRect or WindowRect, which is the bounding box
+  // of the main frame's top level window, including OS window decor, in logical
+  // DIP screen coordinates.
+  const gfx::Rect& original_window_rect() const {
+    return original_window_screen_rect_;
+  }
+
+  float scale() const { return emulation_params_.scale; }
+
+  // Emulated position of the main frame widget (aka view) rect.
+  gfx::Point ViewRectOrigin();
 
+  // Disables emulation and applies non-emulated values to the RenderWidget.
+  // Call this before destroying the RenderWidgetScreenMetricsEmulator.
+  void DisableAndApply();
+
+  // Sets new parameters and applies them to the RenderWidget.
   void ChangeEmulationParams(const blink::WebDeviceEmulationParams& params);
 
-  // The following methods alter handlers' behavior for messages related to
-  // widget size and position.
-  void OnSynchronizeVisualProperties(const VisualProperties& params);
+  void OnSynchronizeVisualProperties(const ScreenInfo& screen_info,
+                                     const gfx::Size& widget_size,
+                                     const gfx::Size& visible_viewport_size);
   void OnUpdateScreenRects(const gfx::Rect& view_screen_rect,
                            const gfx::Rect& window_screen_rect);
-  void OnShowContextMenu(ContextMenuParams* params);
-  gfx::Rect AdjustValidationMessageAnchor(const gfx::Rect& anchor);
 
-  // Apply parameters to the render widget.
+ private:
+  bool emulating_desktop() const {
+    return emulation_params_.screen_position ==
+           blink::WebDeviceEmulationParams::kDesktop;
+  }
+
+  // Applies emulated values to the RenderWidget.
   void Apply();
 
- private:
   RenderWidgetScreenMetricsEmulatorDelegate* const delegate_;
 
   // Parameters as passed by RenderWidget::EnableScreenMetricsEmulation.
   blink::WebDeviceEmulationParams emulation_params_;
 
-  // The computed scale and offset used to fit widget into browser window.
-  float scale_;
-
-  // Widget rect as passed to webwidget.
-  gfx::Rect applied_widget_rect_;
-
   // Original values to restore back after emulation ends.
-  VisualProperties original_visual_properties_;
+  ScreenInfo original_screen_info_;
+  gfx::Size original_widget_size_;
+  gfx::Size original_visible_viewport_size_;
   gfx::Rect original_view_screen_rect_;
   gfx::Rect original_window_screen_rect_;
 
diff --git a/chromium/content/renderer/render_widget_screen_metrics_emulator_delegate.h b/chromium/content/renderer/render_widget_screen_metrics_emulator_delegate.h
index 6d94586caae..2ad25361414 100644
--- a/chromium/content/renderer/render_widget_screen_metrics_emulator_delegate.h
+++ b/chromium/content/renderer/render_widget_screen_metrics_emulator_delegate.h
@@ -13,21 +13,20 @@ struct WebDeviceEmulationParams;
 
 namespace content {
 
-struct VisualProperties;
-
 // Consumers of RenderWidgetScreenMetricsEmulatorDelegate implement this
 // delegate in order to transport emulation information across processes.
 class CONTENT_EXPORT RenderWidgetScreenMetricsEmulatorDelegate {
  public:
-  // Synchronize visual properties with the widget.
-  virtual void SynchronizeVisualProperties(
-      const VisualProperties& visual_properties) = 0;
-
   // Passes device emulation parameters to the delegate.
   virtual void SetScreenMetricsEmulationParameters(
       bool enabled,
       const blink::WebDeviceEmulationParams& params) = 0;
 
+  // Passes an updated ScreenInfo and sizes to the delegate.
+  virtual void SetScreenInfoAndSize(const ScreenInfo& screen_info,
+                                    const gfx::Size& widget_size,
+                                    const gfx::Size& visible_viewport_size) = 0;
+
   // Passes new view bounds and window bounds in screen coordinates to the
   // delegate.
   virtual void SetScreenRects(const gfx::Rect& view_screen_rect,
diff --git a/chromium/content/renderer/render_widget_unittest.cc b/chromium/content/renderer/render_widget_unittest.cc
index b05042cf734..166d978b419 100644
--- a/chromium/content/renderer/render_widget_unittest.cc
+++ b/chromium/content/renderer/render_widget_unittest.cc
@@ -41,7 +41,6 @@
 #include "third_party/blink/public/platform/scheduler/test/renderer_scheduler_test_support.h"
 #include "third_party/blink/public/platform/web_coalesced_input_event.h"
 #include "third_party/blink/public/web/web_device_emulation_params.h"
-#include "third_party/blink/public/web/web_page_popup.h"
 #include "third_party/blink/public/web/web_widget.h"
 #include "ui/events/base_event_utils.h"
 #include "ui/events/blink/web_input_event_traits.h"
@@ -150,7 +149,7 @@ class MockHandledEventCallback {
   DISALLOW_COPY_AND_ASSIGN(MockHandledEventCallback);
 };
 
-class StubWebPagePopup : public blink::WebPagePopup {
+class MockWebWidget : public blink::WebWidget {
  public:
   // WebWidget implementation.
   void SetAnimationHost(cc::AnimationHost*) override {}
@@ -159,16 +158,6 @@ class StubWebPagePopup : public blink::WebPagePopup {
     return {};
   }
 
-  // WebPagePopup implementation.
-  blink::WebPoint PositionRelativeToOwner() override { return {}; }
-  blink::WebDocument GetDocument() override { return {}; }
-  blink::WebPagePopupClient* GetClientForTesting() const override {
-    return nullptr;
-  }
-};
-
-class MockWebPagePopup : public StubWebPagePopup {
- public:
   MOCK_METHOD0(DispatchBufferedTouchEvents, blink::WebInputEventResult());
   MOCK_METHOD1(
       HandleInputEvent,
@@ -179,17 +168,18 @@ class MockWebPagePopup : public StubWebPagePopup {
 
 class InteractiveRenderWidget : public RenderWidget {
  public:
-  explicit InteractiveRenderWidget(CompositorDependencies* compositor_deps)
+  InteractiveRenderWidget(CompositorDependencies* compositor_deps,
+                          const ScreenInfo& screen_info)
       : RenderWidget(++next_routing_id_,
                      compositor_deps,
-                     ScreenInfo(),
-                     blink::kWebDisplayModeUndefined,
-                     false,
-                     false,
-                     false,
-                     nullptr),
+                     blink::mojom::DisplayMode::kUndefined,
+                     /*is_undead=*/false,
+                     /*is_hidden=*/false,
+                     /*never_visible=*/false,
+                     mojo::NullReceiver()),
         always_overscroll_(false) {
-    InitForPopup(base::NullCallback(), &mock_page_popup_);
+    UnconditionalInit(base::NullCallback());
+    LivingInit(&mock_webwidget_, screen_info);
 
     mock_input_handler_host_ = std::make_unique<MockWidgetInputHandlerHost>();
 
@@ -197,7 +187,8 @@ class InteractiveRenderWidget : public RenderWidget {
         mojo::PendingReceiver<mojom::WidgetInputHandler>(),
         mock_input_handler_host_->BindNewPipeAndPassRemote());
   }
-  ~InteractiveRenderWidget() override { webwidget_internal_ = nullptr; }
+
+  using RenderWidget::Close;
 
   void SendInputEvent(const blink::WebInputEvent& event,
                       HandledEventCallback callback) {
@@ -213,7 +204,7 @@ class InteractiveRenderWidget : public RenderWidget {
 
   IPC::TestSink* sink() { return &sink_; }
 
-  MockWebPagePopup* mock_webwidget() { return &mock_page_popup_; }
+  MockWebWidget* mock_webwidget() { return &mock_webwidget_; }
 
   MockWidgetInputHandlerHost* mock_input_handler_host() {
     return mock_input_handler_host_.get();
@@ -251,7 +242,7 @@ class InteractiveRenderWidget : public RenderWidget {
  private:
   IPC::TestSink sink_;
   bool always_overscroll_;
-  MockWebPagePopup mock_page_popup_;
+  MockWebWidget mock_webwidget_;
   std::unique_ptr<MockWidgetInputHandlerHost> mock_input_handler_host_;
   static int next_routing_id_;
 
@@ -262,30 +253,28 @@ int InteractiveRenderWidget::next_routing_id_ = 0;
 
 class RenderWidgetUnittest : public testing::Test {
  public:
-  // testing::Test implementation.
   void SetUp() override {
-    widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_);
+    widget_ = std::make_unique<InteractiveRenderWidget>(&compositor_deps_,
+                                                        ScreenInfo());
   }
 
-  void DestroyWidget() {
-    if (widget_) {
-      widget_->PrepareForClose();
-      widget_->Close(std::move(widget_));
-    }
+  void TearDown() override {
+    widget_->Close(std::move(widget_));
+    // RenderWidget::Close() posts some destruction. Don't leak them.
+    base::RunLoop loop;
+    compositor_deps_.GetCleanupTaskRunner()->PostTask(FROM_HERE,
+                                                      loop.QuitClosure());
+    loop.Run();
   }
 
-  void TearDown() override { DestroyWidget(); }
-
   InteractiveRenderWidget* widget() const { return widget_.get(); }
 
   const base::HistogramTester& histogram_tester() const {
     return histogram_tester_;
   }
 
- protected:
-  base::test::TaskEnvironment task_environment_;
-
  private:
+  base::test::TaskEnvironment task_environment_;
   MockRenderProcess render_process_;
   MockRenderThread render_thread_;
   FakeCompositorDependencies compositor_deps_;
@@ -306,6 +295,8 @@ TEST_F(RenderWidgetUnittest, CursorChange) {
   widget()->DidChangeCursor(cursor_info);
   EXPECT_EQ(widget()->sink()->message_count(), 0U);
 
+  EXPECT_CALL(*widget()->mock_webwidget(), HandleInputEvent(_))
+      .WillOnce(::testing::Return(blink::WebInputEventResult::kNotHandled));
   widget()->SendInputEvent(SyntheticWebMouseEventBuilder::Build(
                                blink::WebInputEvent::Type::kMouseLeave),
                            HandledEventCallback());
@@ -428,11 +419,14 @@ TEST_F(RenderWidgetUnittest, AutoResizeAllocatedLocalSurfaceId) {
   allocator.GenerateId();
   visual_properties.local_surface_id_allocation =
       allocator.GetCurrentLocalSurfaceIdAllocation();
-  widget()->SynchronizeVisualProperties(visual_properties);
+  {
+    WidgetMsg_UpdateVisualProperties msg(widget()->routing_id(),
+                                         visual_properties);
+    widget()->OnMessageReceived(msg);
+  }
   EXPECT_EQ(allocator.GetCurrentLocalSurfaceIdAllocation(),
             widget()->local_surface_id_allocation_from_parent());
   EXPECT_FALSE(widget()
-                   ->layer_tree_view()
                    ->layer_tree_host()
                    ->new_local_surface_id_request_for_testing());
 
@@ -441,95 +435,18 @@ TEST_F(RenderWidgetUnittest, AutoResizeAllocatedLocalSurfaceId) {
   EXPECT_EQ(allocator.GetCurrentLocalSurfaceIdAllocation(),
             widget()->local_surface_id_allocation_from_parent());
   EXPECT_TRUE(widget()
-                  ->layer_tree_view()
                   ->layer_tree_host()
                   ->new_local_surface_id_request_for_testing());
 }
 
-class PopupRenderWidget : public RenderWidget {
- public:
-  explicit PopupRenderWidget(CompositorDependencies* compositor_deps)
-      : RenderWidget(routing_id_++,
-                     compositor_deps,
-                     ScreenInfo(),
-                     blink::kWebDisplayModeUndefined,
-                     false,
-                     false,
-                     false,
-                     nullptr) {
-    InitForPopup(RenderWidget::ShowCallback(), &stub_page_popup_);
-  }
-  ~PopupRenderWidget() override { DCHECK(shutdown_); }
-
-  IPC::TestSink* sink() { return &sink_; }
-
-  void SetScreenMetricsEmulationParameters(
-      bool,
-      const blink::WebDeviceEmulationParams&) override {}
-
-  // Shuts down the metrics emulator, the compositor, and destroys the internal
-  // WebWidget. Should be called before destroying the object.
-  void Shutdown(std::unique_ptr<RenderWidget> widget) {
-    shutdown_ = true;
-
-    widget->PrepareForClose();
-    widget->Close(std::move(widget));
-  }
-
- protected:
-
-  bool Send(IPC::Message* msg) override {
-    sink_.OnMessageReceived(*msg);
-    delete msg;
-    return true;
-  }
-
- private:
-  bool shutdown_ = false;
-  IPC::TestSink sink_;
-  StubWebPagePopup stub_page_popup_;
-  static int routing_id_;
-
-  DISALLOW_COPY_AND_ASSIGN(PopupRenderWidget);
-};
-
-int PopupRenderWidget::routing_id_ = 1;
-
-class RenderWidgetPopupUnittest : public testing::Test {
- public:
-  ~RenderWidgetPopupUnittest() override {
-    widget_->Shutdown(std::move(widget_));
-  }
-
-  // testing::Test implementation.
-  void SetUp() override {
-    widget_ = std::make_unique<PopupRenderWidget>(&compositor_deps_);
-  }
-
-  PopupRenderWidget* widget() const { return widget_.get(); }
-  FakeCompositorDependencies compositor_deps_;
-
- protected:
-  base::test::TaskEnvironment task_environment_;
-
- private:
-  MockRenderProcess render_process_;
-  MockRenderThread render_thread_;
-  std::unique_ptr<PopupRenderWidget> widget_;
-};
-
 class StubRenderWidgetDelegate : public RenderWidgetDelegate {
  public:
-  bool RenderWidgetWillHandleMouseEventForWidget(
-      const blink::WebMouseEvent& event) override {
-    return false;
-  }
   void SetActiveForWidget(bool active) override {}
   bool SupportsMultipleWindowsForWidget() override { return true; }
   bool ShouldAckSyntheticInputImmediately() override { return true; }
   void CancelPagePopupForWidget() override {}
   void ApplyNewDisplayModeForWidget(
-      const blink::WebDisplayMode& new_display_mode) override {}
+      blink::mojom::DisplayMode new_display_mode) override {}
   void ApplyAutoResizeLimitsForWidget(const gfx::Size& min_size,
                                       const gfx::Size& max_size) override {}
   void DisableAutoResizeForWidget() override {}
@@ -551,85 +468,34 @@ class StubRenderWidgetDelegate : public RenderWidgetDelegate {
 // Tests that the value of VisualProperties::is_pinch_gesture_active is
 // propagated to the LayerTreeHost when properties are synced for subframes.
 TEST_F(RenderWidgetUnittest, ActivePinchGestureUpdatesLayerTreeHostSubFrame) {
-  auto* layer_tree_host = widget()->layer_tree_view()->layer_tree_host();
+  cc::LayerTreeHost* layer_tree_host = widget()->layer_tree_host();
   EXPECT_FALSE(layer_tree_host->is_external_pinch_gesture_active_for_testing());
   content::VisualProperties visual_properties;
 
   // Sync visual properties on a child RenderWidget.
   visual_properties.is_pinch_gesture_active = true;
-  widget()->OnSynchronizeVisualProperties(visual_properties);
+  {
+    WidgetMsg_UpdateVisualProperties msg(widget()->routing_id(),
+                                         visual_properties);
+    widget()->OnMessageReceived(msg);
+  }
   // We expect the |is_pinch_gesture_active| value to propagate to the
   // LayerTreeHost for sub-frames. Since GesturePinch events are handled
   // directly in the main-frame's layer tree (and only there), information about
   // whether or not we're in a pinch gesture must be communicated separately to
-  // sub-frame layer trees, via SynchronizeVisualProperties. This information
+  // sub-frame layer trees, via OnUpdateVisualProperties. This information
   // is required to allow sub-frame compositors to throttle rastering while
   // pinch gestures are active.
   EXPECT_TRUE(layer_tree_host->is_external_pinch_gesture_active_for_testing());
   visual_properties.is_pinch_gesture_active = false;
-  widget()->OnSynchronizeVisualProperties(visual_properties);
+  {
+    WidgetMsg_UpdateVisualProperties msg(widget()->routing_id(),
+                                         visual_properties);
+    widget()->OnMessageReceived(msg);
+  }
   EXPECT_FALSE(layer_tree_host->is_external_pinch_gesture_active_for_testing());
 }
 
-TEST_F(RenderWidgetPopupUnittest, EmulatingPopupRect) {
-  blink::WebRect popup_screen_rect(200, 250, 100, 400);
-  widget()->SetWindowRect(popup_screen_rect);
-
-  // The view and window rect on a popup type RenderWidget should be
-  // immediately set, without requiring an ACK.
-  EXPECT_EQ(popup_screen_rect.x, widget()->WindowRect().x);
-  EXPECT_EQ(popup_screen_rect.y, widget()->WindowRect().y);
-
-  EXPECT_EQ(popup_screen_rect.x, widget()->ViewRect().x);
-  EXPECT_EQ(popup_screen_rect.y, widget()->ViewRect().y);
-
-  gfx::Rect emulated_window_rect(0, 0, 980, 1200);
-
-  blink::WebDeviceEmulationParams emulation_params;
-  emulation_params.screen_position = blink::WebDeviceEmulationParams::kMobile;
-  emulation_params.view_size = emulated_window_rect.size();
-  emulation_params.view_position = blink::WebPoint(150, 160);
-
-  gfx::Rect parent_window_rect = gfx::Rect(0, 0, 800, 600);
-
-  VisualProperties visual_properties;
-  visual_properties.new_size = parent_window_rect.size();
-
-  std::unique_ptr<PopupRenderWidget> parent_widget(
-      new PopupRenderWidget(&compositor_deps_));
-
-  // Setup emulation on the |parent_widget|.
-  parent_widget->OnSynchronizeVisualProperties(visual_properties);
-  parent_widget->OnEnableDeviceEmulation(emulation_params);
-  // Then use it for the popup widget under test.
-  widget()->ApplyEmulatedScreenMetricsForPopupWidget(parent_widget.get());
-
-  // Position of the popup as seen by the emulated widget.
-  gfx::Point emulated_position(
-      emulation_params.view_position->x + popup_screen_rect.x,
-      emulation_params.view_position->y + popup_screen_rect.y);
-
-  // Both the window and view rects as read from the accessors should have the
-  // emulation parameters applied.
-  EXPECT_EQ(emulated_position.x(), widget()->WindowRect().x);
-  EXPECT_EQ(emulated_position.y(), widget()->WindowRect().y);
-  EXPECT_EQ(emulated_position.x(), widget()->ViewRect().x);
-  EXPECT_EQ(emulated_position.y(), widget()->ViewRect().y);
-
-  // Setting a new window rect while emulated should remove the emulation
-  // transformation from the given rect so that getting the rect, which applies
-  // the transformation to the raw rect, should result in the same value.
-  blink::WebRect popup_emulated_rect(130, 170, 100, 400);
-  widget()->SetWindowRect(popup_emulated_rect);
-
-  EXPECT_EQ(popup_emulated_rect.x, widget()->WindowRect().x);
-  EXPECT_EQ(popup_emulated_rect.y, widget()->WindowRect().y);
-  EXPECT_EQ(popup_emulated_rect.x, widget()->ViewRect().x);
-  EXPECT_EQ(popup_emulated_rect.y, widget()->ViewRect().y);
-
-  parent_widget->Shutdown(std::move(parent_widget));
-}
-
 // Verify desktop memory limit calculations.
 #if !defined(OS_ANDROID)
 TEST(RenderWidgetTest, IgnoreGivenMemoryPolicy) {
@@ -657,7 +523,7 @@ TEST(RenderWidgetTest, LargeScreensUseMoreMemory) {
 
 #if defined(OS_ANDROID)
 TEST_F(RenderWidgetUnittest, ForceSendMetadataOnInput) {
-  auto* layer_tree_host = widget()->layer_tree_view()->layer_tree_host();
+  cc::LayerTreeHost* layer_tree_host = widget()->layer_tree_host();
   // We should not have any force send metadata requests at start.
   EXPECT_FALSE(layer_tree_host->TakeForceSendMetadataRequest());
   // ShowVirtualKeyboard will trigger a text input state update.
@@ -675,15 +541,14 @@ class NotifySwapTimesRenderWidgetUnittest : public RenderWidgetUnittest {
     viz::ParentLocalSurfaceIdAllocator allocator;
     widget()->layer_tree_view()->SetVisible(true);
     allocator.GenerateId();
-    widget()->layer_tree_view()->SetViewportRectAndScale(
+    widget()->layer_tree_host()->SetViewportRectAndScale(
         gfx::Rect(200, 100), 1.f,
         allocator.GetCurrentLocalSurfaceIdAllocation());
 
     auto root_layer = cc::SolidColorLayer::Create();
     root_layer->SetBounds(gfx::Size(200, 100));
     root_layer->SetBackgroundColor(SK_ColorGREEN);
-    widget()->layer_tree_view()->layer_tree_host()->SetNonBlinkManagedRootLayer(
-        root_layer);
+    widget()->layer_tree_host()->SetNonBlinkManagedRootLayer(root_layer);
 
     auto color_layer = cc::SolidColorLayer::Create();
     color_layer->SetBounds(gfx::Size(100, 100));
@@ -720,9 +585,8 @@ class NotifySwapTimesRenderWidgetUnittest : public RenderWidgetUnittest {
             presentation_run_loop.QuitClosure()));
 
     // Composite and wait for the swap to complete.
-    widget()->layer_tree_view()->layer_tree_host()->Composite(
-        base::TimeTicks::Now(),
-        /*raster=*/true);
+    widget()->layer_tree_host()->Composite(base::TimeTicks::Now(),
+                                           /*raster=*/true);
     swap_run_loop.Run();
 
     // Present and wait for it to complete.
diff --git a/chromium/content/renderer/renderer_blink_platform_impl.cc b/chromium/content/renderer/renderer_blink_platform_impl.cc
index 6a81c4a2a94..2a27da46284 100644
--- a/chromium/content/renderer/renderer_blink_platform_impl.cc
+++ b/chromium/content/renderer/renderer_blink_platform_impl.cc
@@ -21,6 +21,7 @@
 #include "base/metrics/histogram_macros.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/single_thread_task_runner.h"
+#include "base/strings/pattern.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/sys_string_conversions.h"
 #include "base/strings/utf_string_conversions.h"
@@ -47,10 +48,9 @@
 #include "content/renderer/media/audio/audio_device_factory.h"
 #include "content/renderer/media/audio_decoder.h"
 #include "content/renderer/media/renderer_webaudiodevice_impl.h"
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
 #include "content/renderer/media/webrtc/peer_connection_tracker.h"
-#include "content/renderer/media/webrtc/transmission_encoding_info_handler.h"
-#include "content/renderer/p2p/port_allocator.h"
+#include "content/renderer/media/webrtc/rtc_peer_connection_handler.h"
+#include "content/renderer/render_frame_impl.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/storage_util.h"
 #include "content/renderer/webgraphicscontext3d_provider_impl.h"
@@ -61,6 +61,7 @@
 #include "gpu/config/gpu_info.h"
 #include "gpu/ipc/client/gpu_channel_host.h"
 #include "media/audio/audio_output_device.h"
+#include "media/base/media_permission.h"
 #include "media/base/media_switches.h"
 #include "media/blink/webcontentdecryptionmodule_impl.h"
 #include "media/filters/stream_parser_factory.h"
@@ -72,7 +73,6 @@
 #include "services/network/public/cpp/features.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/wrapper_shared_url_loader_factory.h"
-#include "services/service_manager/public/cpp/connector.h"
 #include "services/service_manager/public/cpp/interface_provider.h"
 #include "services/viz/public/cpp/gpu/context_provider_command_buffer.h"
 #include "storage/common/database/database_identifier.h"
@@ -87,16 +87,18 @@
 #include "third_party/blink/public/platform/scheduler/web_thread_scheduler.h"
 #include "third_party/blink/public/platform/url_conversion.h"
 #include "third_party/blink/public/platform/web_audio_latency_hint.h"
-#include "third_party/blink/public/platform/web_rtc_certificate_generator.h"
 #include "third_party/blink/public/platform/web_rtc_peer_connection_handler.h"
 #include "third_party/blink/public/platform/web_security_origin.h"
+#include "third_party/blink/public/platform/web_theme_engine.h"
 #include "third_party/blink/public/platform/web_url.h"
 #include "third_party/blink/public/platform/web_url_loader_factory.h"
 #include "third_party/blink/public/platform/web_url_request.h"
 #include "third_party/blink/public/platform/web_vector.h"
+#include "third_party/blink/public/web/modules/peerconnection/peer_connection_dependency_factory.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_user_media_request.h"
 #include "third_party/sqlite/sqlite3.h"
+#include "ui/base/ui_base_switches.h"
 #include "ui/gl/buildflags.h"
 #include "url/gurl.h"
 
@@ -114,8 +116,6 @@
 #include "base/win/windows_version.h"
 #endif
 
-#include "content/renderer/media/webrtc/peer_connection_dependency_factory.h"
-#include "content/renderer/media/webrtc/rtc_certificate_generator.h"
 #include "third_party/blink/public/platform/modules/mediastream/webrtc_uma_histograms.h"
 
 using blink::Platform;
@@ -196,14 +196,7 @@ RendererBlinkPlatformImpl::RendererBlinkPlatformImpl(
 #if defined(OS_LINUX) || defined(OS_MACOSX)
   if (sandboxEnabled()) {
 #if defined(OS_MACOSX)
-    std::unique_ptr<service_manager::Connector> sandbox_connector;
-    if (auto* thread = RenderThreadImpl::current()) {
-      sandbox_connector = thread->GetConnector()->Clone();
-    } else {
-      service_manager::mojom::ConnectorRequest request;
-      sandbox_connector = service_manager::Connector::Create(&request);
-    }
-    sandbox_support_.reset(new WebSandboxSupportMac(sandbox_connector.get()));
+    sandbox_support_ = std::make_unique<WebSandboxSupportMac>();
 #else
     sandbox_support_.reset(new WebSandboxSupportLinux(font_loader_));
 #endif
@@ -313,9 +306,12 @@ blink::WebSandboxSupport* RendererBlinkPlatformImpl::GetSandboxSupport() {
 blink::WebThemeEngine* RendererBlinkPlatformImpl::ThemeEngine() {
   blink::WebThemeEngine* theme_engine =
       GetContentClient()->renderer()->OverrideThemeEngine();
-  if (theme_engine)
-    return theme_engine;
-  return BlinkPlatformImpl::ThemeEngine();
+  if (!theme_engine)
+    theme_engine = BlinkPlatformImpl::ThemeEngine();
+  if (base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kForceHighContrast))
+    theme_engine->SetForcedColors(blink::ForcedColors::kActive);
+  return theme_engine;
 }
 
 bool RendererBlinkPlatformImpl::sandboxEnabled() {
@@ -538,103 +534,50 @@ std::unique_ptr<WebRTCPeerConnectionHandler>
 RendererBlinkPlatformImpl::CreateRTCPeerConnectionHandler(
     WebRTCPeerConnectionHandlerClient* client,
     scoped_refptr<base::SingleThreadTaskRunner> task_runner) {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  DCHECK(render_thread);
-  if (!render_thread)
-    return nullptr;
+  // TODO(crbug.com/787254): Move this method body back to
+  // PeerConnectionDependencyFactory::CreateRTCPeerConnectionHandler
+  // when it the file gets Onion soup'ed.
 
-  PeerConnectionDependencyFactory* rtc_dependency_factory =
-      render_thread->GetPeerConnectionDependencyFactory();
-  return rtc_dependency_factory->CreateRTCPeerConnectionHandler(client,
-                                                                task_runner);
-}
-
-//------------------------------------------------------------------------------
+  // Save histogram data so we can see how much PeerConnection is used.
+  // The histogram counts the number of calls to the JS API
+  // RTCPeerConnection.
+  UpdateWebRTCMethodCount(blink::WebRTCAPIName::kRTCPeerConnection);
 
-std::unique_ptr<blink::WebRTCCertificateGenerator>
-RendererBlinkPlatformImpl::CreateRTCCertificateGenerator() {
-  return std::make_unique<RTCCertificateGenerator>();
+  auto* rtc_dependency_factory =
+      blink::PeerConnectionDependencyFactory::GetInstance();
+  return std::make_unique<RTCPeerConnectionHandler>(
+      client, rtc_dependency_factory, task_runner);
 }
 
 //------------------------------------------------------------------------------
 
 scoped_refptr<base::SingleThreadTaskRunner>
 RendererBlinkPlatformImpl::GetWebRtcWorkerThread() {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  DCHECK(render_thread);
-  PeerConnectionDependencyFactory* rtc_dependency_factory =
-      render_thread->GetPeerConnectionDependencyFactory();
+  auto* rtc_dependency_factory =
+      blink::PeerConnectionDependencyFactory::GetInstance();
   rtc_dependency_factory->EnsureInitialized();
   return rtc_dependency_factory->GetWebRtcWorkerThread();
 }
 
-rtc::Thread* RendererBlinkPlatformImpl::GetWebRtcWorkerThreadRtcThread() {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  DCHECK(render_thread);
-  PeerConnectionDependencyFactory* rtc_dependency_factory =
-      render_thread->GetPeerConnectionDependencyFactory();
-  rtc_dependency_factory->EnsureInitialized();
-  return rtc_dependency_factory->GetWebRtcWorkerThreadRtcThread();
-}
-
-scoped_refptr<base::SingleThreadTaskRunner>
-RendererBlinkPlatformImpl::GetWebRtcSignalingTaskRunner() {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  DCHECK(render_thread);
-  PeerConnectionDependencyFactory* rtc_dependency_factory =
-      render_thread->GetPeerConnectionDependencyFactory();
-  rtc_dependency_factory->EnsureInitialized();
-  return rtc_dependency_factory->GetWebRtcSignalingThread();
-}
-
 std::unique_ptr<cricket::PortAllocator>
 RendererBlinkPlatformImpl::CreateWebRtcPortAllocator(
     blink::WebLocalFrame* frame) {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  DCHECK(render_thread);
-  PeerConnectionDependencyFactory* rtc_dependency_factory =
-      render_thread->GetPeerConnectionDependencyFactory();
+  auto* rtc_dependency_factory =
+      blink::PeerConnectionDependencyFactory::GetInstance();
   rtc_dependency_factory->EnsureInitialized();
   return rtc_dependency_factory->CreatePortAllocator(frame);
 }
 
 std::unique_ptr<webrtc::AsyncResolverFactory>
 RendererBlinkPlatformImpl::CreateWebRtcAsyncResolverFactory() {
-  RenderThreadImpl* render_thread = RenderThreadImpl::current();
-  DCHECK(render_thread);
-  PeerConnectionDependencyFactory* rtc_dependency_factory =
-      render_thread->GetPeerConnectionDependencyFactory();
+  auto* rtc_dependency_factory =
+      blink::PeerConnectionDependencyFactory::GetInstance();
   rtc_dependency_factory->EnsureInitialized();
   return rtc_dependency_factory->CreateAsyncResolverFactory();
 }
 
 //------------------------------------------------------------------------------
 
-std::unique_ptr<webrtc::RtpCapabilities>
-RendererBlinkPlatformImpl::GetRtpSenderCapabilities(
-    const blink::WebString& kind) {
-  PeerConnectionDependencyFactory* pc_dependency_factory =
-      RenderThreadImpl::current()->GetPeerConnectionDependencyFactory();
-  pc_dependency_factory->EnsureInitialized();
-  return pc_dependency_factory->GetSenderCapabilities(kind.Utf8());
-}
-
-std::unique_ptr<webrtc::RtpCapabilities>
-RendererBlinkPlatformImpl::GetRtpReceiverCapabilities(
-    const blink::WebString& kind) {
-  PeerConnectionDependencyFactory* pc_dependency_factory =
-      RenderThreadImpl::current()->GetPeerConnectionDependencyFactory();
-  pc_dependency_factory->EnsureInitialized();
-  return pc_dependency_factory->GetReceiverCapabilities(kind.Utf8());
-}
-
-//------------------------------------------------------------------------------
-
-void RendererBlinkPlatformImpl::UpdateWebRTCAPICount(
-    blink::WebRTCAPIName api_name) {
-  UpdateWebRTCMethodCount(api_name);
-}
-
 base::Optional<double>
 RendererBlinkPlatformImpl::GetWebRtcMaxCaptureFrameRate() {
   const std::string max_fps_str =
@@ -663,13 +606,6 @@ RendererBlinkPlatformImpl::GetAudioSourceLatencyType(
   return AudioDeviceFactory::GetSourceLatencyType(source_type);
 }
 
-blink::WebRtcAudioDeviceImpl*
-RendererBlinkPlatformImpl::GetWebRtcAudioDevice() {
-  PeerConnectionDependencyFactory* pc_dependency_factory =
-      RenderThreadImpl::current()->GetPeerConnectionDependencyFactory();
-  return pc_dependency_factory->GetWebRtcAudioDevice();
-}
-
 base::Optional<std::string>
 RendererBlinkPlatformImpl::GetWebRTCAudioProcessingConfiguration() {
   return GetContentClient()
@@ -677,6 +613,91 @@ RendererBlinkPlatformImpl::GetWebRTCAudioProcessingConfiguration() {
       ->WebRTCPlatformSpecificAudioProcessingConfiguration();
 }
 
+bool RendererBlinkPlatformImpl::ShouldEnforceWebRTCRoutingPreferences() {
+  return GetContentClient()
+      ->renderer()
+      ->ShouldEnforceWebRTCRoutingPreferences();
+}
+
+bool RendererBlinkPlatformImpl::UsesFakeCodecForPeerConnection() {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kUseFakeCodecForPeerConnection);
+}
+
+bool RendererBlinkPlatformImpl::IsWebRtcEncryptionEnabled() {
+  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kDisableWebRtcEncryption);
+}
+
+bool RendererBlinkPlatformImpl::IsWebRtcStunOriginEnabled() {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableWebRtcStunOrigin);
+}
+
+base::Optional<std::string>
+RendererBlinkPlatformImpl::WebRtcStunProbeTrialParameter() {
+  const base::CommandLine* cmd_line = base::CommandLine::ForCurrentProcess();
+  if (!cmd_line->HasSwitch(switches::kWebRtcStunProbeTrialParameter))
+    return base::nullopt;
+
+  return cmd_line->GetSwitchValueASCII(
+      switches::kWebRtcStunProbeTrialParameter);
+}
+
+media::MediaPermission* RendererBlinkPlatformImpl::GetWebRTCMediaPermission(
+    blink::WebLocalFrame* web_frame) {
+  DCHECK(ShouldEnforceWebRTCRoutingPreferences());
+
+  media::MediaPermission* media_permission = nullptr;
+  bool create_media_permission =
+      base::CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kEnforceWebRtcIPPermissionCheck);
+  create_media_permission =
+      create_media_permission ||
+      !StartsWith(
+          base::FieldTrialList::FindFullName("WebRTC-LocalIPPermissionCheck"),
+          "Disabled", base::CompareCase::SENSITIVE);
+  if (create_media_permission) {
+    RenderFrameImpl* render_frame = RenderFrameImpl::FromWebFrame(web_frame);
+    if (render_frame)
+      media_permission = render_frame->GetMediaPermission();
+    DCHECK(media_permission);
+  }
+
+  return media_permission;
+}
+
+void RendererBlinkPlatformImpl::GetWebRTCRendererPreferences(
+    blink::WebLocalFrame* web_frame,
+    blink::WebString* ip_handling_policy,
+    uint16_t* udp_min_port,
+    uint16_t* udp_max_port,
+    bool* allow_mdns_obfuscation) {
+  DCHECK(ip_handling_policy);
+  DCHECK(udp_min_port);
+  DCHECK(udp_max_port);
+  DCHECK(allow_mdns_obfuscation);
+
+  auto* render_frame = RenderFrameImpl::FromWebFrame(web_frame);
+  if (!render_frame)
+    return;
+
+  *ip_handling_policy = blink::WebString::FromUTF8(
+      render_frame->GetRendererPreferences().webrtc_ip_handling_policy);
+  *udp_min_port = render_frame->GetRendererPreferences().webrtc_udp_min_port;
+  *udp_max_port = render_frame->GetRendererPreferences().webrtc_udp_max_port;
+  const std::vector<std::string>& allowed_urls =
+      render_frame->GetRendererPreferences().webrtc_local_ips_allowed_urls;
+  const std::string url(web_frame->GetSecurityOrigin().ToString().Utf8());
+  for (const auto& allowed_url : allowed_urls) {
+    if (base::MatchPattern(url, allowed_url)) {
+      *allow_mdns_obfuscation = false;
+      return;
+    }
+  }
+  *allow_mdns_obfuscation = true;
+}
+
 base::Optional<int> RendererBlinkPlatformImpl::GetAgcStartupMinimumVolume() {
   std::string min_volume_str =
       base::CommandLine::ForCurrentProcess()->GetSwitchValueASCII(
@@ -711,6 +732,31 @@ bool RendererBlinkPlatformImpl::IsWebRtcHWH264DecodingEnabled(
   return true;
 }
 
+bool RendererBlinkPlatformImpl::IsWebRtcHWEncodingEnabled() {
+  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kDisableWebRtcHWEncoding);
+}
+
+bool RendererBlinkPlatformImpl::IsWebRtcHWDecodingEnabled() {
+  return !base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kDisableWebRtcHWDecoding);
+}
+
+bool RendererBlinkPlatformImpl::IsWebRtcSrtpAesGcmEnabled() {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableWebRtcSrtpAesGcm);
+}
+
+bool RendererBlinkPlatformImpl::IsWebRtcSrtpEncryptedHeadersEnabled() {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableWebRtcSrtpEncryptedHeaders);
+}
+
+bool RendererBlinkPlatformImpl::AllowsLoopbackInPeerConnection() {
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kAllowLoopbackInPeerConnection);
+}
+
 blink::WebVideoCaptureImplManager*
 RendererBlinkPlatformImpl::GetVideoCaptureImplManager() {
   RenderThreadImpl* thread = RenderThreadImpl::current();
@@ -897,17 +943,6 @@ void RendererBlinkPlatformImpl::RecordRapporURL(const char* metric,
 
 //------------------------------------------------------------------------------
 
-blink::WebTransmissionEncodingInfoHandler*
-RendererBlinkPlatformImpl::TransmissionEncodingInfoHandler() {
-  if (!web_transmission_encoding_info_handler_) {
-    web_transmission_encoding_info_handler_.reset(
-        new content::TransmissionEncodingInfoHandler());
-  }
-  return web_transmission_encoding_info_handler_.get();
-}
-
-//------------------------------------------------------------------------------
-
 std::unique_ptr<blink::WebDedicatedWorkerHostFactoryClient>
 RendererBlinkPlatformImpl::CreateDedicatedWorkerHostFactoryClient(
     blink::WebDedicatedWorker* worker,
diff --git a/chromium/content/renderer/renderer_blink_platform_impl.h b/chromium/content/renderer/renderer_blink_platform_impl.h
index 0db3cf9498a..d8dce670264 100644
--- a/chromium/content/renderer/renderer_blink_platform_impl.h
+++ b/chromium/content/renderer/renderer_blink_platform_impl.h
@@ -130,21 +130,11 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
   CreateRTCPeerConnectionHandler(
       blink::WebRTCPeerConnectionHandlerClient* client,
       scoped_refptr<base::SingleThreadTaskRunner> task_runner) override;
-  std::unique_ptr<blink::WebRTCCertificateGenerator>
-  CreateRTCCertificateGenerator() override;
   scoped_refptr<base::SingleThreadTaskRunner> GetWebRtcWorkerThread() override;
-  rtc::Thread* GetWebRtcWorkerThreadRtcThread() override;
-  scoped_refptr<base::SingleThreadTaskRunner> GetWebRtcSignalingTaskRunner()
-      override;
   std::unique_ptr<cricket::PortAllocator> CreateWebRtcPortAllocator(
       blink::WebLocalFrame* frame) override;
   std::unique_ptr<webrtc::AsyncResolverFactory>
   CreateWebRtcAsyncResolverFactory() override;
-  std::unique_ptr<webrtc::RtpCapabilities> GetRtpSenderCapabilities(
-      const blink::WebString& kind) override;
-  std::unique_ptr<webrtc::RtpCapabilities> GetRtpReceiverCapabilities(
-      const blink::WebString& kind) override;
-  void UpdateWebRTCAPICount(blink::WebRTCAPIName api_name) override;
   base::Optional<double> GetWebRtcMaxCaptureFrameRate() override;
   scoped_refptr<media::AudioRendererSink> NewAudioRendererSink(
       blink::WebAudioDeviceSourceType source_type,
@@ -152,13 +142,30 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
       const media::AudioSinkParameters& params) override;
   media::AudioLatency::LatencyType GetAudioSourceLatencyType(
       blink::WebAudioDeviceSourceType source_type) override;
-  blink::WebRtcAudioDeviceImpl* GetWebRtcAudioDevice() override;
   base::Optional<std::string> GetWebRTCAudioProcessingConfiguration() override;
+  bool ShouldEnforceWebRTCRoutingPreferences() override;
+  bool UsesFakeCodecForPeerConnection() override;
+  bool IsWebRtcEncryptionEnabled() override;
+  bool IsWebRtcStunOriginEnabled() override;
+  base::Optional<std::string> WebRtcStunProbeTrialParameter() override;
+  media::MediaPermission* GetWebRTCMediaPermission(
+      blink::WebLocalFrame* web_frame) override;
+  void GetWebRTCRendererPreferences(blink::WebLocalFrame* web_frame,
+                                    blink::WebString* ip_handling_policy,
+                                    uint16_t* udp_min_port,
+                                    uint16_t* udp_max_port,
+                                    bool* allow_mdns_obfuscation) override;
   base::Optional<int> GetAgcStartupMinimumVolume() override;
   void TrackGetUserMedia(
       const blink::WebUserMediaRequest& web_request) override;
   bool IsWebRtcHWH264DecodingEnabled(
       webrtc::VideoCodecType video_coded_type) override;
+  bool IsWebRtcHWEncodingEnabled() override;
+  bool IsWebRtcHWDecodingEnabled() override;
+  bool IsWebRtcSrtpAesGcmEnabled() override;
+  bool IsWebRtcSrtpEncryptedHeadersEnabled() override;
+  bool AllowsLoopbackInPeerConnection() override;
+
   blink::WebVideoCaptureImplManager* GetVideoCaptureImplManager() override;
 
   std::unique_ptr<blink::WebGraphicsContext3DProvider>
@@ -179,8 +186,6 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
   void RecordRappor(const char* metric,
                     const blink::WebString& sample) override;
   void RecordRapporURL(const char* metric, const blink::WebURL& url) override;
-  blink::WebTransmissionEncodingInfoHandler* TransmissionEncodingInfoHandler()
-      override;
 
   std::unique_ptr<blink::WebDedicatedWorkerHostFactoryClient>
   CreateDedicatedWorkerHostFactoryClient(
@@ -249,9 +254,6 @@ class CONTENT_EXPORT RendererBlinkPlatformImpl : public BlinkPlatformImpl {
   mojo::PendingRemote<blink::mojom::CodeCacheHost> code_cache_host_remote_;
   mojo::SharedRemote<blink::mojom::CodeCacheHost> code_cache_host_;
 
-  std::unique_ptr<blink::WebTransmissionEncodingInfoHandler>
-      web_transmission_encoding_info_handler_;
-
 #if defined(OS_LINUX)
   sk_sp<font_service::FontLoader> font_loader_;
 #endif
diff --git a/chromium/content/renderer/savable_resources_browsertest.cc b/chromium/content/renderer/savable_resources_browsertest.cc
index 08c18e33258..ceade9d4c24 100644
--- a/chromium/content/renderer/savable_resources_browsertest.cc
+++ b/chromium/content/renderer/savable_resources_browsertest.cc
@@ -44,7 +44,7 @@ class SavableResourcesTest : public ContentBrowserTest {
     // Convert local file path to file URL.
     GURL file_url = net::FilePathToFileURL(page_file_path);
     // Load the test file.
-    NavigateToURL(shell(), file_url);
+    EXPECT_TRUE(NavigateToURL(shell(), file_url));
 
     PostTaskToInProcessRendererAndWait(base::BindOnce(
         &SavableResourcesTest::CheckResources, base::Unretained(this),
diff --git a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.cc b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.cc
index 5f1757e5fd0..4269331b8c7 100644
--- a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.cc
+++ b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.cc
@@ -15,6 +15,7 @@
 #include "content/public/common/content_client.h"
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/service_worker/service_worker_context_client.h"
+#include "content/renderer/worker/fetch_client_settings_object_helpers.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/platform/web_content_settings_client.h"
@@ -28,8 +29,9 @@ namespace content {
 
 // static
 void EmbeddedWorkerInstanceClientImpl::Create(
-    mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient> receiver,
-    scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner) {
+    scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner,
+    mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>
+        receiver) {
   // This won't be leaked because the lifetime will be managed internally.
   // See the class documentation for detail.
   // We can't use MakeStrongBinding because must give the worker thread
@@ -39,6 +41,15 @@ void EmbeddedWorkerInstanceClientImpl::Create(
                                        std::move(initiator_thread_task_runner));
 }
 
+void EmbeddedWorkerInstanceClientImpl::CreateForRequest(
+    scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner,
+    blink::mojom::EmbeddedWorkerInstanceClientRequest request) {
+  // Implicit conversion from EmbeddedWorkerInstanceClientRequest to
+  // mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>.
+  EmbeddedWorkerInstanceClientImpl::Create(
+      std::move(initiator_thread_task_runner), std::move(request));
+}
+
 void EmbeddedWorkerInstanceClientImpl::WorkerContextDestroyed() {
   DCHECK(initiator_thread_task_runner_->BelongsToCurrentThread());
   TRACE_EVENT0("ServiceWorker",
@@ -54,7 +65,8 @@ void EmbeddedWorkerInstanceClientImpl::StartWorker(
                "EmbeddedWorkerInstanceClientImpl::StartWorker");
   auto start_timing = blink::mojom::EmbeddedWorkerStartTiming::New();
   start_timing->start_worker_received_time = base::TimeTicks::Now();
-  auto start_data = BuildStartData(*params);
+  std::unique_ptr<blink::WebEmbeddedWorkerStartData> start_data =
+      BuildStartData(*params);
 
   DCHECK(!params->provider_info->cache_storage ||
          base::FeatureList::IsEnabled(
@@ -78,7 +90,8 @@ void EmbeddedWorkerInstanceClientImpl::StartWorker(
       std::move(params->preference_watcher_request),
       std::move(params->subresource_loader_factories),
       std::move(params->subresource_loader_updater),
-      params->script_url_to_skip_throttling, initiator_thread_task_runner_);
+      params->script_url_to_skip_throttling, initiator_thread_task_runner_,
+      params->service_worker_route_id);
   // Record UMA to indicate StartWorker is received on renderer.
   StartWorkerHistogramEnum metric =
       params->is_installed ? StartWorkerHistogramEnum::RECEIVED_ON_INSTALLED
@@ -93,25 +106,20 @@ void EmbeddedWorkerInstanceClientImpl::StartWorker(
   // when the worker is not installed, or the worker is launched for checking
   // the update.
   if (params->installed_scripts_info) {
-    installed_scripts_manager_params = std::make_unique<
-        blink::WebServiceWorkerInstalledScriptsManagerParams>();
-    installed_scripts_manager_params->installed_scripts_urls =
-        std::move(params->installed_scripts_info->installed_urls);
-    installed_scripts_manager_params->manager_receiver =
-        params->installed_scripts_info->manager_receiver.PassPipe();
-    installed_scripts_manager_params->manager_host_remote =
-        params->installed_scripts_info->manager_host_remote.PassPipe();
-    DCHECK(installed_scripts_manager_params->manager_receiver.is_valid());
-    DCHECK(installed_scripts_manager_params->manager_host_remote.is_valid());
+    installed_scripts_manager_params =
+        std::make_unique<blink::WebServiceWorkerInstalledScriptsManagerParams>(
+            std::move(params->installed_scripts_info->installed_urls),
+            params->installed_scripts_info->manager_receiver.PassPipe(),
+            params->installed_scripts_info->manager_host_remote.PassPipe());
   }
 
-  auto worker = blink::WebEmbeddedWorker::Create(
-      service_worker_context_client_.get(),
+  auto worker =
+      blink::WebEmbeddedWorker::Create(service_worker_context_client_.get());
+  service_worker_context_client_->StartWorkerContextOnInitiatorThread(
+      std::move(worker), std::move(start_data),
       std::move(installed_scripts_manager_params),
       params->content_settings_proxy.PassHandle(), cache_storage.PassPipe(),
       interface_provider.PassHandle(), browser_interface_broker.PassPipe());
-  service_worker_context_client_->StartWorkerContextOnInitiatorThread(
-      std::move(worker), start_data);
 }
 
 void EmbeddedWorkerInstanceClientImpl::StopWorker() {
@@ -155,24 +163,22 @@ void EmbeddedWorkerInstanceClientImpl::OnError() {
   delete this;
 }
 
-blink::WebEmbeddedWorkerStartData
+std::unique_ptr<blink::WebEmbeddedWorkerStartData>
 EmbeddedWorkerInstanceClientImpl::BuildStartData(
     const blink::mojom::EmbeddedWorkerStartParams& params) {
   DCHECK(initiator_thread_task_runner_->BelongsToCurrentThread());
-  blink::WebEmbeddedWorkerStartData start_data;
-  start_data.script_url = params.script_url;
-  start_data.user_agent = blink::WebString::FromUTF8(params.user_agent);
-  start_data.script_type = params.script_type;
-  start_data.wait_for_debugger_mode =
+  auto start_data = std::make_unique<blink::WebEmbeddedWorkerStartData>(
+      FetchClientSettingsObjectFromMojomToWeb(
+          params.outside_fetch_client_settings_object));
+
+  start_data->script_url = params.script_url;
+  start_data->user_agent = blink::WebString::FromUTF8(params.user_agent);
+  start_data->script_type = params.script_type;
+  start_data->wait_for_debugger_mode =
       params.wait_for_debugger
           ? blink::WebEmbeddedWorkerStartData::kWaitForDebugger
           : blink::WebEmbeddedWorkerStartData::kDontWaitForDebugger;
-  start_data.devtools_worker_token = params.devtools_worker_token;
-  start_data.v8_cache_options =
-      static_cast<blink::WebSettings::V8CacheOptions>(params.v8_cache_options);
-  start_data.privacy_preferences = blink::PrivacyPreferences(
-      params.renderer_preferences->enable_do_not_track,
-      params.renderer_preferences->enable_referrers);
+  start_data->devtools_worker_token = params.devtools_worker_token;
 
   return start_data;
 }
diff --git a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
index 6f627901ba2..653266019c7 100644
--- a/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
+++ b/chromium/content/renderer/service_worker/embedded_worker_instance_client_impl.h
@@ -11,7 +11,6 @@
 #include "content/common/content_export.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/receiver.h"
-#include "third_party/blink/public/common/privacy_preferences.h"
 #include "third_party/blink/public/mojom/service_worker/embedded_worker.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_installed_scripts_manager.mojom.h"
 #include "third_party/blink/public/mojom/worker/worker_content_settings_proxy.mojom.h"
@@ -46,9 +45,16 @@ class CONTENT_EXPORT EmbeddedWorkerInstanceClientImpl
   // TODO(shimazu): Create a service worker's execution context by this method
   // instead of just creating an instance of EmbeddedWorkerInstanceClient.
   static void Create(
+      scoped_refptr<base::SingleThreadTaskRunner> initiator_task_runner,
       mojo::PendingReceiver<blink::mojom::EmbeddedWorkerInstanceClient>
-          receiver,
-      scoped_refptr<base::SingleThreadTaskRunner> initiator_task_runner);
+          receiver);
+
+  // TODO(https://crbug.com/955171): Remove this method and use Create once
+  // RenderFrameHostImpl uses service_manager::BinderMap instead of
+  // service_manager::BinderRegistry.
+  static void CreateForRequest(
+      scoped_refptr<base::SingleThreadTaskRunner> initiator_task_runner,
+      blink::mojom::EmbeddedWorkerInstanceClientRequest request);
 
   ~EmbeddedWorkerInstanceClientImpl() override;
 
@@ -74,7 +80,7 @@ class CONTENT_EXPORT EmbeddedWorkerInstanceClientImpl
   // Handler of connection error bound to |receiver_|.
   void OnError();
 
-  blink::WebEmbeddedWorkerStartData BuildStartData(
+  std::unique_ptr<blink::WebEmbeddedWorkerStartData> BuildStartData(
       const blink::mojom::EmbeddedWorkerStartParams& params);
 
   mojo::Receiver<blink::mojom::EmbeddedWorkerInstanceClient> receiver_;
diff --git a/chromium/content/renderer/service_worker/navigation_preload_request.cc b/chromium/content/renderer/service_worker/navigation_preload_request.cc
index 15aa04b8230..96ab9b31c1f 100644
--- a/chromium/content/renderer/service_worker/navigation_preload_request.cc
+++ b/chromium/content/renderer/service_worker/navigation_preload_request.cc
@@ -33,9 +33,9 @@ void NavigationPreloadRequest::OnReceiveResponse(
   response_ = std::make_unique<blink::WebURLResponse>();
   // TODO(horo): Set report_security_info to true when DevTools is attached.
   const bool report_security_info = false;
-  WebURLLoaderImpl::PopulateURLResponse(
-      url_, network::ResourceResponseHead(response_head), response_.get(),
-      report_security_info, -1 /* request_id */);
+  WebURLLoaderImpl::PopulateURLResponse(url_, *response_head, response_.get(),
+                                        report_security_info,
+                                        -1 /* request_id */);
   MaybeReportResponseToOwner();
 }
 
@@ -47,9 +47,9 @@ void NavigationPreloadRequest::OnReceiveRedirect(
       response_head->headers->response_code()));
 
   response_ = std::make_unique<blink::WebURLResponse>();
-  WebURLLoaderImpl::PopulateURLResponse(
-      url_, network::ResourceResponseHead(response_head), response_.get(),
-      false /* report_security_info */, -1 /* request_id */);
+  WebURLLoaderImpl::PopulateURLResponse(url_, *response_head, response_.get(),
+                                        false /* report_security_info */,
+                                        -1 /* request_id */);
   owner_->OnNavigationPreloadResponse(fetch_event_id_, std::move(response_),
                                       mojo::ScopedDataPipeConsumerHandle());
   // This will delete |this|.
diff --git a/chromium/content/renderer/service_worker/service_worker_context_client.cc b/chromium/content/renderer/service_worker/service_worker_context_client.cc
index 0d20663f435..54dfa3a42f0 100644
--- a/chromium/content/renderer/service_worker/service_worker_context_client.cc
+++ b/chromium/content/renderer/service_worker/service_worker_context_client.cc
@@ -107,10 +107,11 @@ ServiceWorkerContextClient::ServiceWorkerContextClient(
     mojo::PendingReceiver<blink::mojom::RendererPreferenceWatcher>
         preference_watcher_receiver,
     std::unique_ptr<blink::URLLoaderFactoryBundleInfo> subresource_loaders,
-    mojo::PendingReceiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
         subresource_loader_updater,
     const GURL& script_url_to_skip_throttling,
-    scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner)
+    scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner,
+    int32_t service_worker_route_id)
     : service_worker_version_id_(service_worker_version_id),
       service_worker_scope_(service_worker_scope),
       script_url_(script_url),
@@ -125,7 +126,8 @@ ServiceWorkerContextClient::ServiceWorkerContextClient(
       pending_subresource_loader_updater_(
           std::move(subresource_loader_updater)),
       owner_(owner),
-      start_timing_(std::move(start_timing)) {
+      start_timing_(std::move(start_timing)),
+      service_worker_route_id_(service_worker_route_id) {
   DCHECK(initiator_thread_task_runner_->RunsTasksInCurrentSequence());
   DCHECK(owner_);
   DCHECK(subresource_loaders);
@@ -171,10 +173,20 @@ ServiceWorkerContextClient::~ServiceWorkerContextClient() {
 
 void ServiceWorkerContextClient::StartWorkerContextOnInitiatorThread(
     std::unique_ptr<blink::WebEmbeddedWorker> worker,
-    const blink::WebEmbeddedWorkerStartData& start_data) {
+    std::unique_ptr<blink::WebEmbeddedWorkerStartData> start_data,
+    std::unique_ptr<blink::WebServiceWorkerInstalledScriptsManagerParams>
+        installed_scripts_manager_params,
+    mojo::ScopedMessagePipeHandle content_settings_handle,
+    mojo::ScopedMessagePipeHandle cache_storage,
+    mojo::ScopedMessagePipeHandle interface_provider,
+    mojo::ScopedMessagePipeHandle browser_interface_broker) {
   DCHECK(initiator_thread_task_runner_->RunsTasksInCurrentSequence());
   worker_ = std::move(worker);
-  worker_->StartWorkerContext(start_data, initiator_thread_task_runner_);
+  worker_->StartWorkerContext(
+      std::move(start_data), std::move(installed_scripts_manager_params),
+      std::move(content_settings_handle), std::move(cache_storage),
+      std::move(interface_provider), std::move(browser_interface_broker),
+      initiator_thread_task_runner_);
 }
 
 blink::WebEmbeddedWorker& ServiceWorkerContextClient::worker() {
@@ -194,28 +206,10 @@ void ServiceWorkerContextClient::WorkerReadyForInspectionOnInitiatorThread(
                                        std::move(receiver));
 }
 
-void ServiceWorkerContextClient::WorkerContextFailedToStartOnInitiatorThread() {
-  DCHECK(initiator_thread_task_runner_->RunsTasksInCurrentSequence());
-  DCHECK(!proxy_);
-
-  instance_host_->OnStopped();
-
-  TRACE_EVENT_NESTABLE_ASYNC_END1(
-      "ServiceWorker", "ServiceWorkerContextClient", this, "Status",
-      "WorkerContextFailedToStartOnInitiatorThread");
-
-  owner_->WorkerContextDestroyed();
-}
-
-void ServiceWorkerContextClient::FailedToLoadClassicScript() {
+void ServiceWorkerContextClient::FailedToFetchClassicScript() {
   DCHECK(worker_task_runner_->RunsTasksInCurrentSequence());
   TRACE_EVENT_NESTABLE_ASYNC_END1("ServiceWorker", "LOAD_SCRIPT", this,
-                                  "Status", "FailedToLoadClassicScript");
-  // Cleanly send an OnStopped() message instead of just breaking the
-  // Mojo connection on termination, for consistency with the other
-  // startup failure paths.
-  instance_host_->OnStopped();
-
+                                  "Status", "FailedToFetchClassicScript");
   // The caller is responsible for terminating the thread which
   // eventually destroys |this|.
 }
@@ -224,11 +218,6 @@ void ServiceWorkerContextClient::FailedToFetchModuleScript() {
   DCHECK(worker_task_runner_->RunsTasksInCurrentSequence());
   TRACE_EVENT_NESTABLE_ASYNC_END1("ServiceWorker", "LOAD_SCRIPT", this,
                                   "Status", "FailedToFetchModuleScript");
-  // Cleanly send an OnStopped() message instead of just breaking the
-  // Mojo connection on termination, for consistency with the other
-  // startup failure paths.
-  instance_host_->OnStopped();
-
   // The caller is responsible for terminating the thread which
   // eventually destroys |this|.
 }
@@ -258,6 +247,11 @@ void ServiceWorkerContextClient::WorkerContextStarted(
 
   DCHECK(controller_receiver_.is_valid());
   proxy_->BindControllerServiceWorker(controller_receiver_.PassPipe());
+
+  GetContentClient()
+      ->renderer()
+      ->DidInitializeServiceWorkerContextOnWorkerThread(
+          proxy_, service_worker_scope_, script_url_);
 }
 
 void ServiceWorkerContextClient::WillEvaluateScript(
@@ -394,7 +388,7 @@ ServiceWorkerContextClient::CreateWorkerFetchContextOnInitiatorThread() {
           ->renderer()
           ->CreateWebSocketHandshakeThrottleProvider(),
       std::move(preference_watcher_receiver_),
-      std::move(pending_subresource_loader_updater_));
+      std::move(pending_subresource_loader_updater_), service_worker_route_id_);
 }
 
 void ServiceWorkerContextClient::OnNavigationPreloadResponse(
diff --git a/chromium/content/renderer/service_worker/service_worker_context_client.h b/chromium/content/renderer/service_worker/service_worker_context_client.h
index f86654d30f9..224ec6f3afd 100644
--- a/chromium/content/renderer/service_worker/service_worker_context_client.h
+++ b/chromium/content/renderer/service_worker/service_worker_context_client.h
@@ -34,6 +34,7 @@
 #include "third_party/blink/public/mojom/service_worker/service_worker_event_status.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_provider.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_registration.mojom.h"
+#include "third_party/blink/public/mojom/worker/subresource_loader_updater.mojom.h"
 #include "third_party/blink/public/platform/modules/service_worker/web_service_worker_error.h"
 #include "third_party/blink/public/web/modules/service_worker/web_service_worker_context_client.h"
 #include "third_party/blink/public/web/modules/service_worker/web_service_worker_context_proxy.h"
@@ -48,6 +49,7 @@ class SingleThreadTaskRunner;
 namespace blink {
 class WebServiceWorkerContextProxy;
 class WebURLResponse;
+struct WebServiceWorkerInstalledScriptsManagerParams;
 }
 
 namespace content {
@@ -103,17 +105,23 @@ class CONTENT_EXPORT ServiceWorkerContextClient
       mojo::PendingReceiver<blink::mojom::RendererPreferenceWatcher>
           preference_watcher_receiver,
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo> subresource_loaders,
-      mojo::PendingReceiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
           subresource_loader_updater,
       const GURL& script_url_to_skip_throttling,
-      scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner);
+      scoped_refptr<base::SingleThreadTaskRunner> initiator_thread_task_runner,
+      int32_t service_worker_route_id);
   // Called on the initiator thread.
   ~ServiceWorkerContextClient() override;
 
   // Called on the initiator thread.
   void StartWorkerContextOnInitiatorThread(
       std::unique_ptr<blink::WebEmbeddedWorker> worker,
-      const blink::WebEmbeddedWorkerStartData& start_data);
+      std::unique_ptr<blink::WebEmbeddedWorkerStartData> start_data,
+      std::unique_ptr<blink::WebServiceWorkerInstalledScriptsManagerParams>,
+      mojo::ScopedMessagePipeHandle content_settings_handle,
+      mojo::ScopedMessagePipeHandle cache_storage,
+      mojo::ScopedMessagePipeHandle interface_provider,
+      mojo::ScopedMessagePipeHandle browser_interface_broker);
   // Called on the initiator thread.
   blink::WebEmbeddedWorker& worker();
 
@@ -121,8 +129,7 @@ class CONTENT_EXPORT ServiceWorkerContextClient
   void WorkerReadyForInspectionOnInitiatorThread(
       mojo::ScopedMessagePipeHandle devtools_agent_ptr_info,
       mojo::ScopedMessagePipeHandle devtools_agent_host_request) override;
-  void WorkerContextFailedToStartOnInitiatorThread() override;
-  void FailedToLoadClassicScript() override;
+  void FailedToFetchClassicScript() override;
   void FailedToFetchModuleScript() override;
   void WorkerScriptLoadedOnWorkerThread() override;
   void WorkerContextStarted(
@@ -223,7 +230,7 @@ class CONTENT_EXPORT ServiceWorkerContextClient
       pending_service_worker_receiver_;
   mojo::PendingReceiver<blink::mojom::ControllerServiceWorker>
       controller_receiver_;
-  mojo::PendingReceiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
+  mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
       pending_subresource_loader_updater_;
 
   // This is bound on the initiator thread.
@@ -270,6 +277,8 @@ class CONTENT_EXPORT ServiceWorkerContextClient
 
   std::unique_ptr<blink::WebEmbeddedWorker> worker_;
 
+  int32_t service_worker_route_id_;
+
   DISALLOW_COPY_AND_ASSIGN(ServiceWorkerContextClient);
 };
 
diff --git a/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.cc b/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.cc
index 87baf905a5a..6620f709c74 100644
--- a/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.cc
+++ b/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.cc
@@ -32,8 +32,9 @@ ServiceWorkerFetchContextImpl::ServiceWorkerFetchContextImpl(
         websocket_handshake_throttle_provider,
     mojo::PendingReceiver<blink::mojom::RendererPreferenceWatcher>
         preference_watcher_receiver,
-    mojo::PendingReceiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
-        pending_subresource_loader_updater)
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+        pending_subresource_loader_updater,
+    int32_t service_worker_route_id)
     : renderer_preferences_(renderer_preferences),
       worker_script_url_(worker_script_url),
       url_loader_factory_info_(std::move(url_loader_factory_info)),
@@ -45,7 +46,8 @@ ServiceWorkerFetchContextImpl::ServiceWorkerFetchContextImpl(
       preference_watcher_pending_receiver_(
           std::move(preference_watcher_receiver)),
       pending_subresource_loader_updater_(
-          std::move(pending_subresource_loader_updater)) {}
+          std::move(pending_subresource_loader_updater)),
+      service_worker_route_id_(service_worker_route_id) {}
 
 ServiceWorkerFetchContextImpl::~ServiceWorkerFetchContextImpl() {}
 
@@ -110,6 +112,7 @@ void ServiceWorkerFetchContextImpl::WillSendRequest(
   }
   auto extra_data = std::make_unique<RequestExtraData>();
   extra_data->set_originated_from_service_worker(true);
+  extra_data->set_render_frame_id(service_worker_route_id_);
 
   const bool needs_to_skip_throttling =
       static_cast<GURL>(request.Url()) == script_url_to_skip_throttling_ &&
diff --git a/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.h b/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.h
index aa2678cdf2b..24dcb7520c1 100644
--- a/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.h
+++ b/chromium/content/renderer/service_worker/service_worker_fetch_context_impl.h
@@ -12,6 +12,7 @@
 #include "third_party/blink/public/mojom/renderer_preference_watcher.mojom.h"
 #include "third_party/blink/public/mojom/renderer_preferences.mojom.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker.mojom.h"
+#include "third_party/blink/public/mojom/worker/subresource_loader_updater.mojom.h"
 #include "third_party/blink/public/platform/web_worker_fetch_context.h"
 #include "url/gurl.h"
 
@@ -22,7 +23,7 @@ class WebSocketHandshakeThrottleProvider;
 
 class CONTENT_EXPORT ServiceWorkerFetchContextImpl final
     : public blink::WebWorkerFetchContext,
-      public blink::mojom::ServiceWorkerSubresourceLoaderUpdater,
+      public blink::mojom::SubresourceLoaderUpdater,
       public blink::mojom::RendererPreferenceWatcher {
  public:
   // |url_loader_factory_info| is used for regular loads from the service worker
@@ -48,8 +49,9 @@ class CONTENT_EXPORT ServiceWorkerFetchContextImpl final
           websocket_handshake_throttle_provider,
       mojo::PendingReceiver<blink::mojom::RendererPreferenceWatcher>
           preference_watcher_receiver,
-      mojo::PendingReceiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
-          pending_subresource_loader_updater);
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+          pending_subresource_loader_updater,
+      int32_t service_worker_route_id);
 
   // blink::WebWorkerFetchContext implementation:
   void SetTerminateSyncLoadEvent(base::WaitableEvent*) override;
@@ -108,20 +110,22 @@ class CONTENT_EXPORT ServiceWorkerFetchContextImpl final
 
   mojo::Receiver<blink::mojom::RendererPreferenceWatcher>
       preference_watcher_receiver_{this};
-  mojo::Receiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
+  mojo::Receiver<blink::mojom::SubresourceLoaderUpdater>
       subresource_loader_updater_{this};
 
   // These mojo objects are kept while starting up the worker thread. Valid
   // until InitializeOnWorkerThread().
   mojo::PendingReceiver<blink::mojom::RendererPreferenceWatcher>
       preference_watcher_pending_receiver_;
-  mojo::PendingReceiver<blink::mojom::ServiceWorkerSubresourceLoaderUpdater>
+  mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
       pending_subresource_loader_updater_;
 
   // This is owned by ThreadedMessagingProxyBase on the main thread.
   base::WaitableEvent* terminate_sync_load_event_ = nullptr;
 
   blink::AcceptLanguagesWatcher* accept_languages_watcher_ = nullptr;
+
+  int32_t service_worker_route_id_;
 };
 
 }  // namespace content
diff --git a/chromium/content/renderer/service_worker/service_worker_fetch_context_impl_unittest.cc b/chromium/content/renderer/service_worker/service_worker_fetch_context_impl_unittest.cc
index 67f108673be..63ebc770364 100644
--- a/chromium/content/renderer/service_worker/service_worker_fetch_context_impl_unittest.cc
+++ b/chromium/content/renderer/service_worker/service_worker_fetch_context_impl_unittest.cc
@@ -48,7 +48,8 @@ TEST_F(ServiceWorkerFetchContextImplTest, SkipThrottling) {
       /*script_loader_factory_info=*/nullptr, kScriptUrlToSkipThrottling,
       std::make_unique<FakeURLLoaderThrottleProvider>(),
       /*websocket_handshake_throttle_provider=*/nullptr, mojo::NullReceiver(),
-      mojo::NullReceiver());
+      mojo::NullReceiver(),
+      /*service_worker_route_id=*/-1);
 
   {
     // Call WillSendRequest() for kScriptURL.
diff --git a/chromium/content/renderer/service_worker/service_worker_network_provider_for_frame.cc b/chromium/content/renderer/service_worker/service_worker_network_provider_for_frame.cc
index d6dec97dd3b..8306936acdf 100644
--- a/chromium/content/renderer/service_worker/service_worker_network_provider_for_frame.cc
+++ b/chromium/content/renderer/service_worker/service_worker_network_provider_for_frame.cc
@@ -137,11 +137,22 @@ ServiceWorkerNetworkProviderForFrame::CreateURLLoader(
             kServiceWorkerInterceptedRequestFromOriginDirtyStyleSheet);
   }
 
+  mojo::PendingRemote<mojom::KeepAliveHandle> keep_alive_handle;
+  if (request.GetKeepalive()) {
+    // This cast is safe because NewDocumentObserver is always created with a
+    // RenderFrameImpl.
+    auto* render_frame_impl =
+        static_cast<RenderFrameImpl*>(observer_->render_frame());
+    render_frame_impl->GetFrameHost()->IssueKeepAliveHandle(
+        keep_alive_handle.InitWithNewPipeAndPassReceiver());
+  }
+
   // Create our own SubresourceLoader to route the request to the controller
   // ServiceWorker.
   return std::make_unique<WebURLLoaderImpl>(
       RenderThreadImpl::current()->resource_dispatcher(),
-      std::move(task_runner_handle), context()->GetSubresourceLoaderFactory());
+      std::move(task_runner_handle), context()->GetSubresourceLoaderFactory(),
+      std::move(keep_alive_handle));
 }
 
 blink::mojom::ControllerServiceWorkerMode
diff --git a/chromium/content/renderer/service_worker/service_worker_provider_context.cc b/chromium/content/renderer/service_worker/service_worker_provider_context.cc
index b0074e22493..a4bbcd6498e 100644
--- a/chromium/content/renderer/service_worker/service_worker_provider_context.cc
+++ b/chromium/content/renderer/service_worker/service_worker_provider_context.cc
@@ -20,8 +20,6 @@
 #include "content/renderer/service_worker/service_worker_subresource_loader.h"
 #include "content/renderer/service_worker/web_service_worker_provider_impl.h"
 #include "content/renderer/worker/worker_thread_registry.h"
-#include "mojo/public/cpp/bindings/pending_receiver.h"
-#include "mojo/public/cpp/bindings/pending_remote.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
 #include "third_party/blink/public/mojom/service_worker/service_worker_object.mojom.h"
@@ -40,7 +38,7 @@ void CreateSubresourceLoaderFactoryForProviderContext(
     std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory_info,
     mojo::PendingReceiver<blink::mojom::ControllerServiceWorkerConnector>
         connector_receiver,
-    network::mojom::URLLoaderFactoryRequest request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
     scoped_refptr<base::SequencedTaskRunner> task_runner) {
   auto connector = base::MakeRefCounted<ControllerServiceWorkerConnector>(
       std::move(remote_container_host), std::move(remote_controller),
@@ -49,7 +47,7 @@ void CreateSubresourceLoaderFactoryForProviderContext(
   ServiceWorkerSubresourceLoaderFactory::Create(
       std::move(connector),
       network::SharedURLLoaderFactory::Create(std::move(fallback_factory_info)),
-      std::move(request), std::move(task_runner));
+      std::move(receiver), std::move(task_runner));
 }
 
 }  // namespace
diff --git a/chromium/content/renderer/service_worker/service_worker_provider_context_unittest.cc b/chromium/content/renderer/service_worker/service_worker_provider_context_unittest.cc
index 53bb0983e7a..18947e9b200 100644
--- a/chromium/content/renderer/service_worker/service_worker_provider_context_unittest.cc
+++ b/chromium/content/renderer/service_worker/service_worker_provider_context_unittest.cc
@@ -24,6 +24,7 @@
 #include "mojo/public/cpp/bindings/associated_binding_set.h"
 #include "mojo/public/cpp/bindings/associated_receiver_set.h"
 #include "mojo/public/cpp/bindings/associated_remote.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
@@ -138,8 +139,9 @@ class FakeURLLoaderFactory final : public network::mojom::URLLoaderFactory {
   FakeURLLoaderFactory() = default;
   ~FakeURLLoaderFactory() override = default;
 
-  void AddBinding(network::mojom::URLLoaderFactoryRequest request) {
-    bindings_.AddBinding(this, std::move(request));
+  void AddReceiver(
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
+    receivers_.Add(this, std::move(receiver));
   }
 
   // network::mojom::URLLoaderFactory:
@@ -158,8 +160,9 @@ class FakeURLLoaderFactory final : public network::mojom::URLLoaderFactory {
     if (start_loader_callback_)
       std::move(start_loader_callback_).Run();
   }
-  void Clone(network::mojom::URLLoaderFactoryRequest factory) override {
-    bindings_.AddBinding(this, std::move(factory));
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> factory)
+      override {
+    receivers_.Add(this, std::move(factory));
   }
 
   void set_start_loader_callback(base::OnceClosure closure) {
@@ -170,7 +173,7 @@ class FakeURLLoaderFactory final : public network::mojom::URLLoaderFactory {
   GURL last_request_url() const { return last_url_; }
 
  private:
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
   std::vector<network::mojom::URLLoaderClientPtr> clients_;
   base::OnceClosure start_loader_callback_;
   GURL last_url_;
@@ -274,7 +277,7 @@ class ServiceWorkerProviderContextTest : public testing::Test {
 
   void EnableNetworkService() {
     network::mojom::URLLoaderFactoryPtr fake_loader_factory;
-    fake_loader_factory_.AddBinding(MakeRequest(&fake_loader_factory));
+    fake_loader_factory_.AddReceiver(MakeRequest(&fake_loader_factory));
     loader_factory_ =
         base::MakeRefCounted<network::WrapperSharedURLLoaderFactory>(
             std::move(fake_loader_factory));
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc b/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
index ae465e5d308..e8422b4e14f 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader.cc
@@ -7,6 +7,7 @@
 #include "base/atomic_sequence_num.h"
 #include "base/bind.h"
 #include "base/callback.h"
+#include "base/command_line.h"
 #include "base/feature_list.h"
 #include "base/metrics/histogram_functions.h"
 #include "base/metrics/histogram_macros.h"
@@ -21,15 +22,13 @@
 #include "content/renderer/render_thread_impl.h"
 #include "content/renderer/renderer_blink_platform_impl.h"
 #include "content/renderer/service_worker/controller_service_worker_connector.h"
-#include "mojo/public/cpp/bindings/binding.h"
-#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
-#include "mojo/public/cpp/bindings/receiver.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "net/base/net_errors.h"
 #include "net/url_request/redirect_util.h"
 #include "net/url_request/url_request.h"
 #include "services/network/public/cpp/features.h"
+#include "services/network/public/cpp/network_switches.h"
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "third_party/blink/public/common/blob/blob_utils.h"
 #include "third_party/blink/public/common/features.h"
@@ -48,14 +47,13 @@ namespace {
 constexpr char kServiceWorkerSubresourceLoaderScope[] =
     "ServiceWorkerSubresourceLoader";
 
-network::ResourceResponseHead RewriteServiceWorkerTime(
+network::mojom::URLResponseHeadPtr RewriteServiceWorkerTime(
     base::TimeTicks service_worker_start_time,
     base::TimeTicks service_worker_ready_time,
-    const network::ResourceResponseHead& response_head) {
-  network::ResourceResponseHead new_head = response_head;
-  new_head.service_worker_start_time = service_worker_start_time;
-  new_head.service_worker_ready_time = service_worker_ready_time;
-  return new_head;
+    network::mojom::URLResponseHeadPtr response_head) {
+  response_head->service_worker_start_time = service_worker_start_time;
+  response_head->service_worker_ready_time = service_worker_ready_time;
+  return response_head;
 }
 
 // A wrapper URLLoaderClient that invokes the given RewriteHeaderCallback
@@ -63,8 +61,8 @@ network::ResourceResponseHead RewriteServiceWorkerTime(
 class HeaderRewritingURLLoaderClient : public network::mojom::URLLoaderClient {
  public:
   using RewriteHeaderCallback =
-      base::RepeatingCallback<network::ResourceResponseHead(
-          const network::ResourceResponseHead&)>;
+      base::RepeatingCallback<network::mojom::URLResponseHeadPtr(
+          network::mojom::URLResponseHeadPtr)>;
 
   HeaderRewritingURLLoaderClient(
       network::mojom::URLLoaderClientPtr url_loader_client,
@@ -79,7 +77,7 @@ class HeaderRewritingURLLoaderClient : public network::mojom::URLLoaderClient {
       network::mojom::URLResponseHeadPtr response_head) override {
     DCHECK(url_loader_client_.is_bound());
     url_loader_client_->OnReceiveResponse(
-        rewrite_header_callback_.Run(response_head));
+        rewrite_header_callback_.Run(std::move(response_head)));
   }
 
   void OnReceiveRedirect(
@@ -87,7 +85,7 @@ class HeaderRewritingURLLoaderClient : public network::mojom::URLLoaderClient {
       network::mojom::URLResponseHeadPtr response_head) override {
     DCHECK(url_loader_client_.is_bound());
     url_loader_client_->OnReceiveRedirect(
-        redirect_info, rewrite_header_callback_.Run(response_head));
+        redirect_info, rewrite_header_callback_.Run(std::move(response_head)));
   }
 
   void OnUploadProgress(int64_t current_position,
@@ -141,8 +139,8 @@ class ServiceWorkerSubresourceLoader::StreamWaiter
   }
 
   // mojom::ServiceWorkerStreamCallback implementations:
-  void OnCompleted() override { owner_->CommitCompleted(net::OK); }
-  void OnAborted() override { owner_->CommitCompleted(net::ERR_ABORTED); }
+  void OnCompleted() override { owner_->OnBodyReadingComplete(net::OK); }
+  void OnAborted() override { owner_->OnBodyReadingComplete(net::ERR_ABORTED); }
 
  private:
   ServiceWorkerSubresourceLoader* owner_;
@@ -170,7 +168,7 @@ ServiceWorkerSubresourceLoader::ServiceWorkerSubresourceLoader(
       body_as_blob_size_(blink::BlobUtils::kUnknownSize),
       controller_connector_(std::move(controller_connector)),
       fetch_request_restarted_(false),
-      blob_reading_complete_(false),
+      body_reading_complete_(false),
       side_data_reading_complete_(false),
       routing_id_(routing_id),
       request_id_(request_id),
@@ -181,9 +179,9 @@ ServiceWorkerSubresourceLoader::ServiceWorkerSubresourceLoader(
       task_runner_(std::move(task_runner)),
       response_source_(network::mojom::FetchResponseSource::kUnspecified) {
   DCHECK(controller_connector_);
-  response_head_.request_start = base::TimeTicks::Now();
-  response_head_.load_timing.request_start = base::TimeTicks::Now();
-  response_head_.load_timing.request_start_time = base::Time::Now();
+  response_head_->request_start = base::TimeTicks::Now();
+  response_head_->load_timing.request_start = base::TimeTicks::Now();
+  response_head_->load_timing.request_start_time = base::Time::Now();
   // base::Unretained() is safe since |url_loader_binding_| is owned by |this|.
   url_loader_binding_.set_connection_error_handler(
       base::BindOnce(&ServiceWorkerSubresourceLoader::OnConnectionError,
@@ -218,7 +216,7 @@ void ServiceWorkerSubresourceLoader::StartRequest(
   // time to set workerStart, since it will either started soon or the fetch
   // event will be dispatched soon.
   // https://w3c.github.io/resource-timing/#dom-performanceresourcetiming-workerstart
-  response_head_.service_worker_start_time = base::TimeTicks::Now();
+  response_head_->service_worker_start_time = base::TimeTicks::Now();
   DispatchFetchEvent();
 }
 
@@ -231,8 +229,8 @@ void ServiceWorkerSubresourceLoader::DispatchFetchEvent() {
       controller_connector_->GetControllerServiceWorker(
           blink::mojom::ControllerServiceWorkerPurpose::FETCH_SUB_RESOURCE);
 
-  response_head_.load_timing.send_start = base::TimeTicks::Now();
-  response_head_.load_timing.send_end = base::TimeTicks::Now();
+  response_head_->load_timing.send_start = base::TimeTicks::Now();
+  response_head_->load_timing.send_end = base::TimeTicks::Now();
 
   TRACE_EVENT1("ServiceWorker",
                "ServiceWorkerSubresourceLoader::DispatchFetchEvent",
@@ -380,7 +378,9 @@ void ServiceWorkerSubresourceLoader::OnFallback(
   // preflight logic is implemented in Blink. So we return a "fallback required"
   // response to Blink.
   // TODO(falken): Remove this mechanism after OOB-CORS ships.
-  if (!network::features::ShouldEnableOutOfBlinkCors() &&
+  if ((base::CommandLine::ForCurrentProcess()->HasSwitch(
+           network::switches::kForceToDisableOutOfBlinkCors) ||
+       !base::FeatureList::IsEnabled(network::features::kOutOfBlinkCors)) &&
       ((resource_request_.mode == network::mojom::RequestMode::kCors ||
         resource_request_.mode ==
             network::mojom::RequestMode::kCorsWithForcedPreflight) &&
@@ -396,10 +396,10 @@ void ServiceWorkerSubresourceLoader::OnFallback(
     //  Add "Service Worker Fallback Required" which DevTools knows means to not
     //  show the response in the Network tab as it's just an internal
     //  implementation mechanism.
-    response_head_.headers = base::MakeRefCounted<net::HttpResponseHeaders>(
+    response_head_->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
         "HTTP/1.1 400 Service Worker Fallback Required");
-    response_head_.was_fetched_via_service_worker = true;
-    response_head_.was_fallback_required_by_service_worker = true;
+    response_head_->was_fetched_via_service_worker = true;
+    response_head_->was_fallback_required_by_service_worker = true;
     CommitResponseHeaders();
     CommitEmptyResponseAndComplete();
     return;
@@ -415,8 +415,8 @@ void ServiceWorkerSubresourceLoader::OnFallback(
   auto client_impl = std::make_unique<HeaderRewritingURLLoaderClient>(
       std::move(url_loader_client_),
       base::BindRepeating(&RewriteServiceWorkerTime,
-                          response_head_.service_worker_start_time,
-                          response_head_.service_worker_ready_time));
+                          response_head_->service_worker_start_time,
+                          response_head_->service_worker_ready_time));
   mojo::MakeStrongBinding(std::move(client_impl), mojo::MakeRequest(&client));
 
   fallback_factory_->CreateLoaderAndStart(
@@ -438,7 +438,7 @@ void ServiceWorkerSubresourceLoader::UpdateResponseTiming(
   // |service_worker_ready_time| becomes web-exposed
   // PerformanceResourceTiming#fetchStart, which is the time just before
   // dispatching the fetch event, so set it to |dispatch_event_time|.
-  response_head_.service_worker_ready_time = timing->dispatch_event_time;
+  response_head_->service_worker_ready_time = timing->dispatch_event_time;
   fetch_event_timing_ = std::move(timing);
 }
 
@@ -452,27 +452,28 @@ void ServiceWorkerSubresourceLoader::StartResponse(
     return;
   }
 
-  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, &response_head_);
+  ServiceWorkerLoaderHelpers::SaveResponseInfo(*response, response_head_.get());
   ServiceWorkerLoaderHelpers::SaveResponseHeaders(
       response->status_code, response->status_text, response->headers,
-      &response_head_);
-  response_head_.response_start = base::TimeTicks::Now();
-  response_head_.load_timing.receive_headers_start = base::TimeTicks::Now();
-  response_head_.load_timing.receive_headers_end =
-      response_head_.load_timing.receive_headers_start;
+      response_head_.get());
+  response_head_->response_start = base::TimeTicks::Now();
+  response_head_->load_timing.receive_headers_start = base::TimeTicks::Now();
+  response_head_->load_timing.receive_headers_end =
+      response_head_->load_timing.receive_headers_start;
   response_source_ = response->response_source;
 
   // Handle a redirect response. ComputeRedirectInfo returns non-null redirect
   // info if the given response is a redirect.
   redirect_info_ = ServiceWorkerLoaderHelpers::ComputeRedirectInfo(
-      resource_request_, response_head_);
+      resource_request_, *response_head_);
   if (redirect_info_) {
     if (redirect_limit_-- == 0) {
       CommitCompleted(net::ERR_TOO_MANY_REDIRECTS);
       return;
     }
-    response_head_.encoded_data_length = 0;
-    url_loader_client_->OnReceiveRedirect(*redirect_info_, response_head_);
+    response_head_->encoded_data_length = 0;
+    url_loader_client_->OnReceiveRedirect(*redirect_info_,
+                                          response_head_.Clone());
     TransitionToStatus(Status::kSentRedirect);
     return;
   }
@@ -480,14 +481,26 @@ void ServiceWorkerSubresourceLoader::StartResponse(
   // We have a non-redirect response. Send the headers to the client.
   CommitResponseHeaders();
 
+  bool body_stream_is_valid =
+      !body_as_stream.is_null() && body_as_stream->stream.is_valid();
+
+  // Handle the case where there is no body content.
+  if (!body_stream_is_valid && !response->blob) {
+    CommitEmptyResponseAndComplete();
+    return;
+  }
+
+  mojo::ScopedDataPipeConsumerHandle data_pipe;
+
   // Handle a stream response body.
-  if (!body_as_stream.is_null() && body_as_stream->stream.is_valid()) {
+  if (body_stream_is_valid) {
     DCHECK(!response->blob);
+    if (response->side_data_blob)
+      DCHECK(base::FeatureList::IsEnabled(features::kCacheStorageEagerReading));
     DCHECK(url_loader_client_.is_bound());
     stream_waiter_ = std::make_unique<StreamWaiter>(
         this, std::move(body_as_stream->callback_receiver));
-    CommitResponseBody(std::move(body_as_stream->stream));
-    return;
+    data_pipe = std::move(body_as_stream->stream);
   }
 
   // Handle a blob response body.
@@ -500,38 +513,40 @@ void ServiceWorkerSubresourceLoader::StartResponse(
 
     // Start reading the body blob immediately. This will allow the body to
     // start buffering in the pipe while the side data is read.
-    mojo::ScopedDataPipeConsumerHandle data_pipe;
     int error = StartBlobReading(&data_pipe);
     if (error != net::OK) {
       CommitCompleted(error);
       return;
     }
+  }
 
-    // Read side data if necessary.
-    auto resource_type =
-        static_cast<content::ResourceType>(resource_request_.resource_type);
-    if (resource_type == content::ResourceType::kScript) {
-      body_as_blob_->ReadSideData(base::BindOnce(
-          &ServiceWorkerSubresourceLoader::OnBlobSideDataReadingComplete,
-          weak_factory_.GetWeakPtr(), std::move(data_pipe)));
-    } else {
-      // Bypass reading side data when the request isn't for script. Currently
-      // side data only exists for scripts (as cached metadata).
-      OnBlobSideDataReadingComplete(std::move(data_pipe),
-                                    base::Optional<mojo_base::BigBuffer>());
-    }
+  DCHECK(data_pipe.is_valid());
 
+  // Read side data if necessary.  We only do this if both the
+  // |side_data_blob| is available to read and the request is destined
+  // for a script.
+  auto resource_type =
+      static_cast<content::ResourceType>(resource_request_.resource_type);
+  if (response->side_data_blob &&
+      resource_type == content::ResourceType::kScript) {
+    side_data_as_blob_.Bind(std::move(response->side_data_blob->blob));
+    side_data_as_blob_->ReadSideData(base::BindOnce(
+        &ServiceWorkerSubresourceLoader::OnSideDataReadingComplete,
+        weak_factory_.GetWeakPtr(), std::move(data_pipe)));
     return;
   }
 
-  CommitEmptyResponseAndComplete();
+  // Otherwise we can immediately complete side data reading so that the
+  // entire resource completes when the main body is read.
+  OnSideDataReadingComplete(std::move(data_pipe),
+                            base::Optional<mojo_base::BigBuffer>());
 }
 
 void ServiceWorkerSubresourceLoader::CommitResponseHeaders() {
   TransitionToStatus(Status::kSentHeader);
   DCHECK(url_loader_client_.is_bound());
   // TODO(kinuko): Fill the ssl_info.
-  url_loader_client_->OnReceiveResponse(response_head_);
+  url_loader_client_->OnReceiveResponse(response_head_.Clone());
 }
 
 void ServiceWorkerSubresourceLoader::CommitResponseBody(
@@ -562,7 +577,7 @@ void ServiceWorkerSubresourceLoader::CommitCompleted(int error_code) {
       TRACE_EVENT_FLAG_FLOW_IN, "error_code", net::ErrorToString(error_code));
 
   if (error_code == net::OK) {
-    bool handled = !response_head_.was_fallback_required_by_service_worker;
+    bool handled = !response_head_->was_fallback_required_by_service_worker;
     RecordTimingMetrics(handled);
   }
 
@@ -602,15 +617,15 @@ void ServiceWorkerSubresourceLoader::RecordTimingMetrics(bool handled) {
   UMA_HISTOGRAM_TIMES(
       "ServiceWorker.LoadTiming.Subresource."
       "ForwardServiceWorkerToWorkerReady",
-      response_head_.service_worker_ready_time -
-          response_head_.service_worker_start_time);
+      response_head_->service_worker_ready_time -
+          response_head_->service_worker_start_time);
 
   // Time spent by fetch handlers.
   UMA_HISTOGRAM_TIMES(
       "ServiceWorker.LoadTiming.Subresource."
       "WorkerReadyToFetchHandlerEnd",
       fetch_event_timing_->respond_with_settled_time -
-          response_head_.service_worker_ready_time);
+          response_head_->service_worker_ready_time);
 
   if (handled) {
     // Mojo message delay. If the controller service worker lives in the same
@@ -620,21 +635,21 @@ void ServiceWorkerSubresourceLoader::RecordTimingMetrics(bool handled) {
     UMA_HISTOGRAM_TIMES(
         "ServiceWorker.LoadTiming.Subresource."
         "FetchHandlerEndToResponseReceived",
-        response_head_.load_timing.receive_headers_end -
+        response_head_->load_timing.receive_headers_end -
             fetch_event_timing_->respond_with_settled_time);
 
     // Time spent reading response body.
     UMA_HISTOGRAM_MEDIUM_TIMES(
         "ServiceWorker.LoadTiming.Subresource."
         "ResponseReceivedToCompleted2",
-        completion_time - response_head_.load_timing.receive_headers_end);
+        completion_time - response_head_->load_timing.receive_headers_end);
     // Same as above, breakdown by response source.
     base::UmaHistogramMediumTimes(
         base::StrCat({"ServiceWorker.LoadTiming.Subresource."
                       "ResponseReceivedToCompleted2",
                       ServiceWorkerUtils::FetchResponseSourceToSuffix(
                           response_source_)}),
-        completion_time - response_head_.load_timing.receive_headers_end);
+        completion_time - response_head_->load_timing.receive_headers_end);
   } else {
     // Mojo message delay (network fallback case). See above for the detail.
     UMA_HISTOGRAM_TIMES(
@@ -704,39 +719,36 @@ int ServiceWorkerSubresourceLoader::StartBlobReading(
                           TRACE_ID_LOCAL(request_id_)),
       TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
   DCHECK(body_pipe);
-  DCHECK(!blob_reading_complete_);
+  DCHECK(!body_reading_complete_);
 
   return ServiceWorkerLoaderHelpers::ReadBlobResponseBody(
       &body_as_blob_, body_as_blob_size_,
-      base::BindOnce(&ServiceWorkerSubresourceLoader::OnBlobReadingComplete,
+      base::BindOnce(&ServiceWorkerSubresourceLoader::OnBodyReadingComplete,
                      weak_factory_.GetWeakPtr()),
       body_pipe);
 }
 
-void ServiceWorkerSubresourceLoader::OnBlobSideDataReadingComplete(
+void ServiceWorkerSubresourceLoader::OnSideDataReadingComplete(
     mojo::ScopedDataPipeConsumerHandle data_pipe,
     base::Optional<mojo_base::BigBuffer> metadata) {
   TRACE_EVENT_WITH_FLOW1(
       "ServiceWorker",
-      "ServiceWorkerSubresourceLoader::OnBlobSideDataReadingComplete",
+      "ServiceWorkerSubresourceLoader::OnSideDataReadingComplete",
       TRACE_ID_WITH_SCOPE(kServiceWorkerSubresourceLoaderScope,
                           TRACE_ID_LOCAL(request_id_)),
       TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT, "metadata size",
       (metadata ? metadata->size() : 0));
   DCHECK(url_loader_client_);
-  DCHECK(body_as_blob_);
   DCHECK(!side_data_reading_complete_);
   side_data_reading_complete_ = true;
 
   if (metadata.has_value())
     url_loader_client_->OnReceiveCachedMetadata(std::move(metadata.value()));
 
-  // We should have started reading the body in parallel before trying to load
-  // side data.
   DCHECK(data_pipe.is_valid());
 
   base::TimeDelta delay =
-      base::TimeTicks::Now() - response_head_.response_start;
+      base::TimeTicks::Now() - response_head_->response_start;
   UMA_HISTOGRAM_TIMES(
       "ServiceWorker.SubresourceNotifyStartLoadingResponseBodyDelay", delay);
 
@@ -745,24 +757,23 @@ void ServiceWorkerSubresourceLoader::OnBlobSideDataReadingComplete(
 
   // If the blob reading completed before the side data reading, then we
   // must manually finalize the blob reading now.
-  if (blob_reading_complete_) {
-    OnBlobReadingComplete(net::OK);
+  if (body_reading_complete_) {
+    OnBodyReadingComplete(net::OK);
   }
 
   // Otherwise we asyncly continue in OnBlobReadingComplete().
 }
 
-void ServiceWorkerSubresourceLoader::OnBlobReadingComplete(int net_error) {
+void ServiceWorkerSubresourceLoader::OnBodyReadingComplete(int net_error) {
   TRACE_EVENT_WITH_FLOW0(
-      "ServiceWorker", "ServiceWorkerSubresourceLoader::OnBlobReadingComplete",
+      "ServiceWorker", "ServiceWorkerSubresourceLoader::OnBodyReadingComplete",
       TRACE_ID_WITH_SCOPE(kServiceWorkerSubresourceLoaderScope,
                           TRACE_ID_LOCAL(request_id_)),
       TRACE_EVENT_FLAG_FLOW_IN | TRACE_EVENT_FLAG_FLOW_OUT);
-  DCHECK(body_as_blob_);
-  blob_reading_complete_ = true;
+  body_reading_complete_ = true;
   // If the side data has not completed reading yet, then we need to delay
   // calling CommitCompleted.  This method will be called again from
-  // OnBlobSideDataReadingComplete().  Only delay for successful reads, though.
+  // OnSideDataReadingComplete().  Only delay for successful reads, though.
   // Abort immediately on error.
   if (!side_data_reading_complete_ && net_error == net::OK)
     return;
@@ -775,25 +786,25 @@ void ServiceWorkerSubresourceLoader::OnBlobReadingComplete(int net_error) {
 void ServiceWorkerSubresourceLoaderFactory::Create(
     scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
     scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
-    network::mojom::URLLoaderFactoryRequest request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
     scoped_refptr<base::SequencedTaskRunner> task_runner) {
   new ServiceWorkerSubresourceLoaderFactory(
       std::move(controller_connector), std::move(fallback_factory),
-      std::move(request), std::move(task_runner));
+      std::move(receiver), std::move(task_runner));
 }
 
 ServiceWorkerSubresourceLoaderFactory::ServiceWorkerSubresourceLoaderFactory(
     scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
     scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
-    network::mojom::URLLoaderFactoryRequest request,
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
     scoped_refptr<base::SequencedTaskRunner> task_runner)
     : controller_connector_(std::move(controller_connector)),
       fallback_factory_(std::move(fallback_factory)),
       task_runner_(std::move(task_runner)) {
   DCHECK(fallback_factory_);
-  bindings_.AddBinding(this, std::move(request));
-  bindings_.set_connection_error_handler(base::BindRepeating(
-      &ServiceWorkerSubresourceLoaderFactory::OnConnectionError,
+  receivers_.Add(this, std::move(receiver));
+  receivers_.set_disconnect_handler(base::BindRepeating(
+      &ServiceWorkerSubresourceLoaderFactory::OnMojoDisconnect,
       base::Unretained(this)));
 }
 
@@ -819,12 +830,12 @@ void ServiceWorkerSubresourceLoaderFactory::CreateLoaderAndStart(
 }
 
 void ServiceWorkerSubresourceLoaderFactory::Clone(
-    network::mojom::URLLoaderFactoryRequest request) {
-  bindings_.AddBinding(this, std::move(request));
+    mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver) {
+  receivers_.Add(this, std::move(receiver));
 }
 
-void ServiceWorkerSubresourceLoaderFactory::OnConnectionError() {
-  if (!bindings_.empty())
+void ServiceWorkerSubresourceLoaderFactory::OnMojoDisconnect() {
+  if (!receivers_.empty())
     return;
   delete this;
 }
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader.h b/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
index fcea0871ce3..f8ad0ba5bbf 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader.h
@@ -12,11 +12,12 @@
 #include "base/time/time.h"
 #include "content/common/content_export.h"
 #include "content/renderer/service_worker/controller_service_worker_connector.h"
-#include "mojo/public/cpp/bindings/binding_set.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/receiver.h"
+#include "mojo/public/cpp/bindings/receiver_set.h"
+#include "mojo/public/cpp/bindings/remote.h"
 #include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/redirect_info.h"
-#include "services/network/public/cpp/resource_response.h"
 #include "services/network/public/mojom/url_loader_factory.mojom.h"
 #include "third_party/blink/public/common/service_worker/service_worker_status_code.h"
 #include "third_party/blink/public/mojom/blob/blob.mojom.h"
@@ -115,10 +116,9 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
   void ResumeReadingBodyFromNet() override;
 
   int StartBlobReading(mojo::ScopedDataPipeConsumerHandle* body_pipe);
-  void OnBlobSideDataReadingComplete(
-      mojo::ScopedDataPipeConsumerHandle data_pipe,
-      base::Optional<mojo_base::BigBuffer> metadata);
-  void OnBlobReadingComplete(int net_error);
+  void OnSideDataReadingComplete(mojo::ScopedDataPipeConsumerHandle data_pipe,
+                                 base::Optional<mojo_base::BigBuffer> metadata);
+  void OnBodyReadingComplete(int net_error);
 
   // Calls url_loader_client_->OnReceiveResponse() with |response_head_|.
   void CommitResponseHeaders();
@@ -142,7 +142,8 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
 
   void TransitionToStatus(Status new_status);
 
-  network::ResourceResponseHead response_head_;
+  network::mojom::URLResponseHeadPtr response_head_ =
+      network::mojom::URLResponseHead::New();
   base::Optional<net::RedirectInfo> redirect_info_;
   int redirect_limit_;
 
@@ -153,8 +154,10 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
   mojo::Receiver<blink::mojom::ServiceWorkerFetchResponseCallback>
       response_callback_receiver_{this};
   // The blob needs to be held while it's read to keep it alive.
-  blink::mojom::BlobPtr body_as_blob_;
+  mojo::Remote<blink::mojom::Blob> body_as_blob_;
   uint64_t body_as_blob_size_;
+  // The blob needs to be held while it's read to keep it alive.
+  mojo::Remote<blink::mojom::Blob> side_data_as_blob_;
 
   scoped_refptr<ControllerServiceWorkerConnector> controller_connector_;
 
@@ -165,7 +168,7 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoader
                  ControllerServiceWorkerConnector::Observer>
       controller_connector_observer_{this};
   bool fetch_request_restarted_;
-  bool blob_reading_complete_;
+  bool body_reading_complete_;
   bool side_data_reading_complete_;
 
   // These are given by the constructor (as the params for
@@ -214,7 +217,7 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoaderFactory
   static void Create(
       scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
       scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       scoped_refptr<base::SequencedTaskRunner> task_runner);
 
   ~ServiceWorkerSubresourceLoaderFactory() override;
@@ -228,23 +231,24 @@ class CONTENT_EXPORT ServiceWorkerSubresourceLoaderFactory
                             network::mojom::URLLoaderClientPtr client,
                             const net::MutableNetworkTrafficAnnotationTag&
                                 traffic_annotation) override;
-  void Clone(network::mojom::URLLoaderFactoryRequest request) override;
+  void Clone(mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver)
+      override;
 
  private:
   ServiceWorkerSubresourceLoaderFactory(
       scoped_refptr<ControllerServiceWorkerConnector> controller_connector,
       scoped_refptr<network::SharedURLLoaderFactory> fallback_factory,
-      network::mojom::URLLoaderFactoryRequest request,
+      mojo::PendingReceiver<network::mojom::URLLoaderFactory> receiver,
       scoped_refptr<base::SequencedTaskRunner> task_runner);
 
-  void OnConnectionError();
+  void OnMojoDisconnect();
 
   scoped_refptr<ControllerServiceWorkerConnector> controller_connector_;
 
   // Used when a request falls back to network.
   scoped_refptr<network::SharedURLLoaderFactory> fallback_factory_;
 
-  mojo::BindingSet<network::mojom::URLLoaderFactory> bindings_;
+  mojo::ReceiverSet<network::mojom::URLLoaderFactory> receivers_;
 
   // The task runner where this factory is running.
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
diff --git a/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc b/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
index 7867910e824..e34ee0ef34d 100644
--- a/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
+++ b/chromium/content/renderer/service_worker/service_worker_subresource_loader_unittest.cc
@@ -25,6 +25,7 @@
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "mojo/public/cpp/bindings/receiver_set.h"
 #include "mojo/public/cpp/bindings/remote.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/bindings/strong_binding.h"
 #include "mojo/public/cpp/system/data_pipe_utils.h"
 #include "net/http/http_util.h"
@@ -52,10 +53,11 @@ class FakeBlob final : public blink::mojom::Blob {
 
  private:
   // Implements blink::mojom::Blob.
-  void Clone(mojo::PendingReceiver<blink::mojom::Blob>) override {
-    NOTREACHED();
+  void Clone(mojo::PendingReceiver<blink::mojom::Blob> receiver) override {
+    receivers_.Add(this, std::move(receiver));
   }
-  void AsDataPipeGetter(network::mojom::DataPipeGetterRequest) override {
+  void AsDataPipeGetter(
+      mojo::PendingReceiver<network::mojom::DataPipeGetter>) override {
     NOTREACHED();
   }
   void ReadRange(
@@ -83,6 +85,7 @@ class FakeBlob final : public blink::mojom::Blob {
     NOTREACHED();
   }
 
+  mojo::ReceiverSet<blink::mojom::Blob> receivers_;
   base::Optional<std::vector<uint8_t>> side_data_;
   std::string body_;
 };
@@ -105,6 +108,14 @@ class FakeControllerServiceWorker
     if (response->blob) {
       response->headers.emplace("Content-Length",
                                 base::NumberToString(response->blob->size));
+
+      // Clone the blob into the side_data_blob to match cache_storage behavior.
+      mojo::Remote<blink::mojom::Blob> blob_remote(
+          std::move(response->blob->blob));
+      blob_remote->Clone(response->blob->blob.InitWithNewPipeAndPassReceiver());
+      response->side_data_blob = blink::mojom::SerializedBlob::New(
+          response->blob->uuid, response->blob->content_type,
+          response->blob->size, blob_remote.Unbind());
     }
     return response;
   }
@@ -167,9 +178,9 @@ class FakeControllerServiceWorker
     blob_body_ = blink::mojom::SerializedBlob::New();
     blob_body_->uuid = "dummy-blob-uuid";
     blob_body_->size = body.size();
-    mojo::MakeStrongBinding(
+    mojo::MakeSelfOwnedReceiver(
         std::make_unique<FakeBlob>(std::move(metadata), std::move(body)),
-        mojo::MakeRequest(&blob_body_->blob));
+        blob_body_->blob.InitWithNewPipeAndPassReceiver());
   }
 
   // Tells this controller to respond to fetch events with a 206 partial
@@ -192,9 +203,10 @@ class FakeControllerServiceWorker
     } else if (element.type() == network::mojom::DataElementType::kDataPipe) {
       // Read the content into |data_pipe|.
       mojo::DataPipe data_pipe;
-      network::mojom::DataPipeGetterPtr ptr(element.ReleaseDataPipeGetter());
+      mojo::Remote<network::mojom::DataPipeGetter> remote(
+          element.ReleaseDataPipeGetter());
       base::RunLoop run_loop;
-      ptr->Read(
+      remote->Read(
           std::move(data_pipe.producer_handle),
           base::BindOnce([](base::OnceClosure quit_closure, int32_t status,
                             uint64_t size) { std::move(quit_closure).Run(); },
@@ -278,8 +290,9 @@ class FakeControllerServiceWorker
         auto blob = blink::mojom::SerializedBlob::New();
         blob->uuid = "dummy-blob-uuid";
         blob->size = size;
-        mojo::MakeStrongBinding(std::make_unique<FakeBlob>(base::nullopt, body),
-                                mojo::MakeRequest(&blob->blob));
+        mojo::MakeSelfOwnedReceiver(
+            std::make_unique<FakeBlob>(base::nullopt, body),
+            blob->blob.InitWithNewPipeAndPassReceiver());
 
         // Respond with a 206 response.
         auto response = OkResponse(std::move(blob), response_source_);
@@ -426,11 +439,10 @@ class FakeServiceWorkerContainerHost
   DISALLOW_COPY_AND_ASSIGN(FakeServiceWorkerContainerHost);
 };
 
-// Returns an expected ResourceResponseHead which is used by stream response
-// related tests.
-std::unique_ptr<network::ResourceResponseHead>
-CreateResponseInfoFromServiceWorker() {
-  auto head = std::make_unique<network::ResourceResponseHead>();
+// Returns an expected network::mojom::URLResponseHeadPtr which is used by
+// stream response related tests.
+network::mojom::URLResponseHeadPtr CreateResponseInfoFromServiceWorker() {
+  auto head = network::mojom::URLResponseHead::New();
   std::string headers = "HTTP/1.1 200 OK\n\n";
   head->headers = base::MakeRefCounted<net::HttpResponseHeaders>(
       net::HttpUtil::AssembleRawHeaders(headers));
@@ -497,8 +509,9 @@ class ServiceWorkerSubresourceLoaderTest : public ::testing::Test {
         net::MutableNetworkTrafficAnnotationTag(TRAFFIC_ANNOTATION_FOR_TESTS));
   }
 
-  void ExpectResponseInfo(const network::ResourceResponseHead& info,
-                          const network::ResourceResponseHead& expected_info) {
+  void ExpectResponseInfo(
+      const network::mojom::URLResponseHead& info,
+      const network::mojom::URLResponseHead& expected_info) {
     EXPECT_EQ(expected_info.headers->response_code(),
               info.headers->response_code());
     EXPECT_EQ(expected_info.was_fetched_via_service_worker,
@@ -616,7 +629,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, Basic) {
 
   client->RunUntilComplete();
 
-  net::LoadTimingInfo load_timing_info = client->response_head().load_timing;
+  net::LoadTimingInfo load_timing_info = client->response_head()->load_timing;
   EXPECT_FALSE(load_timing_info.receive_headers_start.is_null());
   EXPECT_FALSE(load_timing_info.receive_headers_end.is_null());
   EXPECT_LE(load_timing_info.receive_headers_start,
@@ -749,7 +762,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, NoController) {
     client->RunUntilComplete();
 
     EXPECT_TRUE(client->has_received_completion());
-    EXPECT_FALSE(client->response_head().was_fetched_via_service_worker);
+    EXPECT_FALSE(client->response_head()->was_fetched_via_service_worker);
 
     EXPECT_EQ(1, fake_controller_.fetch_event_count());
     EXPECT_EQ(1, fake_container_host_.get_controller_service_worker_count());
@@ -885,8 +898,8 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, StreamResponse) {
   StartRequest(factory, request, &loader, &client);
   client->RunUntilResponseReceived();
 
-  const network::ResourceResponseHead& info = client->response_head();
-  ExpectResponseInfo(info, *CreateResponseInfoFromServiceWorker());
+  auto& info = client->response_head();
+  ExpectResponseInfo(*info, *CreateResponseInfoFromServiceWorker());
 
   // Write the body stream.
   uint32_t written_bytes = sizeof(kResponseBody) - 1;
@@ -944,8 +957,8 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, StreamResponse_Abort) {
   StartRequest(factory, request, &loader, &client);
   client->RunUntilResponseReceived();
 
-  const network::ResourceResponseHead& info = client->response_head();
-  ExpectResponseInfo(info, *CreateResponseInfoFromServiceWorker());
+  auto& info = client->response_head();
+  ExpectResponseInfo(*info, *CreateResponseInfoFromServiceWorker());
 
   // Start writing the body stream, then abort before finishing.
   uint32_t written_bytes = sizeof(kResponseBody) - 1;
@@ -1001,14 +1014,13 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, BlobResponse) {
   StartRequest(factory, request, &loader, &client);
   client->RunUntilResponseReceived();
 
-  std::unique_ptr<network::ResourceResponseHead> expected_info =
-      CreateResponseInfoFromServiceWorker();
+  auto expected_info = CreateResponseInfoFromServiceWorker();
   // |is_in_cache_storage| should be true because |fake_controller_| sets the
   // response source as CacheStorage.
   expected_info->is_in_cache_storage = true;
-  const network::ResourceResponseHead& info = client->response_head();
-  ExpectResponseInfo(info, *expected_info);
-  EXPECT_EQ(39, info.content_length);
+  auto& info = client->response_head();
+  ExpectResponseInfo(*info, *expected_info);
+  EXPECT_EQ(39, info->content_length);
 
   // Test the cached metadata.
   client->RunUntilCachedMetadataReceived();
@@ -1059,8 +1071,8 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, BlobResponseWithoutMetadata) {
   StartRequest(factory, request, &loader, &client);
   client->RunUntilResponseReceived();
 
-  const network::ResourceResponseHead& info = client->response_head();
-  ExpectResponseInfo(info, *CreateResponseInfoFromServiceWorker());
+  auto& info = client->response_head();
+  ExpectResponseInfo(*info, *CreateResponseInfoFromServiceWorker());
 
   client->RunUntilComplete();
   EXPECT_EQ(net::OK, client->completion_status().error_code);
@@ -1106,14 +1118,13 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, BlobResponseNonScript) {
   StartRequest(factory, request, &loader, &client);
   client->RunUntilResponseReceived();
 
-  std::unique_ptr<network::ResourceResponseHead> expected_info =
-      CreateResponseInfoFromServiceWorker();
+  auto expected_info = CreateResponseInfoFromServiceWorker();
   // |is_in_cache_storage| should be true because |fake_controller_| sets the
   // response source as CacheStorage.
   expected_info->is_in_cache_storage = true;
-  const network::ResourceResponseHead& info = client->response_head();
-  ExpectResponseInfo(info, *expected_info);
-  EXPECT_EQ(33, info.content_length);
+  auto& info = client->response_head();
+  ExpectResponseInfo(*info, *expected_info);
+  EXPECT_EQ(33, info->content_length);
 
   client->RunUntilComplete();
   EXPECT_EQ(net::OK, client->completion_status().error_code);
@@ -1149,7 +1160,7 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, FallbackResponse) {
 
   // OnFallback() should complete the network request using network loader.
   EXPECT_TRUE(client->has_received_completion());
-  EXPECT_FALSE(client->response_head().was_fetched_via_service_worker);
+  EXPECT_FALSE(client->response_head()->was_fetched_via_service_worker);
 
   histogram_tester.ExpectUniqueSample(kHistogramSubresourceFetchEvent,
                                       blink::ServiceWorkerStatusCode::kOk, 1);
@@ -1240,9 +1251,9 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RedirectResponse) {
   loader->FollowRedirect({}, {}, base::nullopt);
   client->RunUntilResponseReceived();
 
-  const network::ResourceResponseHead& info = client->response_head();
-  EXPECT_EQ(200, info.headers->response_code());
-  EXPECT_EQ(network::mojom::FetchResponseType::kDefault, info.response_type);
+  auto& info = client->response_head();
+  EXPECT_EQ(200, info->headers->response_code());
+  EXPECT_EQ(network::mojom::FetchResponseType::kDefault, info->response_type);
 
   // Write the body stream.
   uint32_t written_bytes = sizeof(kResponseBody) - 1;
@@ -1387,14 +1398,14 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, CorsFallbackResponseWithoutOORCors) {
     StartRequest(factory, request, &loader, &client);
     client->RunUntilComplete();
 
-    const network::ResourceResponseHead& info = client->response_head();
+    auto& info = client->response_head();
     EXPECT_EQ(test.expected_was_fallback_required_by_service_worker,
-              info.was_fetched_via_service_worker);
+              info->was_fetched_via_service_worker);
     EXPECT_EQ(test.expected_was_fallback_required_by_service_worker,
-              info.was_fallback_required_by_service_worker);
-    if (info.was_fallback_required_by_service_worker) {
+              info->was_fallback_required_by_service_worker);
+    if (info->was_fallback_required_by_service_worker) {
       EXPECT_EQ("HTTP/1.1 400 Service Worker Fallback Required",
-                info.headers->GetStatusLine());
+                info->headers->GetStatusLine());
     }
     histogram_tester.ExpectTotalCount(
         "ServiceWorker.LoadTiming.Subresource."
@@ -1406,7 +1417,6 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, CorsFallbackResponseWithoutOORCors) {
 TEST_F(ServiceWorkerSubresourceLoaderTest, FallbackWithRequestBody_String) {
   const std::string kData = "Hi, this is the request body (string)";
   auto request_body = base::MakeRefCounted<network::ResourceRequestBody>();
-  network::mojom::DataPipeGetterPtr data_pipe_getter_ptr;
   request_body->AppendBytes(kData.c_str(), kData.length());
 
   RunFallbackWithRequestBodyTest(std::move(request_body), kData);
@@ -1415,10 +1425,10 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, FallbackWithRequestBody_String) {
 TEST_F(ServiceWorkerSubresourceLoaderTest, FallbackWithRequestBody_DataPipe) {
   const std::string kData = "Hi, this is the request body (data pipe)";
   auto request_body = base::MakeRefCounted<network::ResourceRequestBody>();
-  network::mojom::DataPipeGetterPtr data_pipe_getter_ptr;
+  mojo::PendingRemote<network::mojom::DataPipeGetter> data_pipe_getter_remote;
   auto data_pipe_getter = std::make_unique<network::TestDataPipeGetter>(
-      kData, mojo::MakeRequest(&data_pipe_getter_ptr));
-  request_body->AppendDataPipe(std::move(data_pipe_getter_ptr));
+      kData, data_pipe_getter_remote.InitWithNewPipeAndPassReceiver());
+  request_body->AppendDataPipe(std::move(data_pipe_getter_remote));
 
   RunFallbackWithRequestBodyTest(std::move(request_body), kData);
 }
@@ -1437,10 +1447,10 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RangeRequest_200Response) {
   EXPECT_EQ(net::OK, client->completion_status().error_code);
 
   // Test the response.
-  const network::ResourceResponseHead& info = client->response_head();
-  ExpectResponseInfo(info, *CreateResponseInfoFromServiceWorker());
-  EXPECT_EQ(33, info.content_length);
-  EXPECT_FALSE(info.headers->HasHeader("Content-Range"));
+  auto& info = client->response_head();
+  ExpectResponseInfo(*info, *CreateResponseInfoFromServiceWorker());
+  EXPECT_EQ(33, info->content_length);
+  EXPECT_FALSE(info->headers->HasHeader("Content-Range"));
   EXPECT_EQ(kResponseBody, TakeResponseBody(client.get()));
 }
 
@@ -1458,12 +1468,12 @@ TEST_F(ServiceWorkerSubresourceLoaderTest, RangeRequest_206Response) {
   EXPECT_EQ(net::OK, client->completion_status().error_code);
 
   // Test the response.
-  const network::ResourceResponseHead& info = client->response_head();
-  EXPECT_EQ(206, info.headers->response_code());
+  auto& info = client->response_head();
+  EXPECT_EQ(206, info->headers->response_code());
   std::string range;
-  ASSERT_TRUE(info.headers->GetNormalizedHeader("Content-Range", &range));
+  ASSERT_TRUE(info->headers->GetNormalizedHeader("Content-Range", &range));
   EXPECT_EQ("bytes 5-13/33", range);
-  EXPECT_EQ(9, info.content_length);
+  EXPECT_EQ(9, info->content_length);
   EXPECT_EQ("is sample", TakeResponseBody(client.get()));
 }
 
@@ -1482,12 +1492,12 @@ TEST_F(ServiceWorkerSubresourceLoaderTest,
   EXPECT_EQ(net::OK, client->completion_status().error_code);
 
   // Test the response.
-  const network::ResourceResponseHead& info = client->response_head();
-  EXPECT_EQ(206, info.headers->response_code());
+  auto& info = client->response_head();
+  EXPECT_EQ(206, info->headers->response_code());
   std::string range;
-  ASSERT_TRUE(info.headers->GetNormalizedHeader("Content-Range", &range));
+  ASSERT_TRUE(info->headers->GetNormalizedHeader("Content-Range", &range));
   EXPECT_EQ("bytes 5-32/33", range);
-  EXPECT_EQ(28, info.content_length);
+  EXPECT_EQ(28, info->content_length);
   EXPECT_EQ("is sample text for the Blob.", TakeResponseBody(client.get()));
 }
 
diff --git a/chromium/content/renderer/service_worker/service_worker_type_converters.cc b/chromium/content/renderer/service_worker/service_worker_type_converters.cc
index cbb2f951144..418a442a632 100644
--- a/chromium/content/renderer/service_worker/service_worker_type_converters.cc
+++ b/chromium/content/renderer/service_worker/service_worker_type_converters.cc
@@ -17,7 +17,7 @@ TypeConverter<blink::WebServiceWorkerObjectInfo,
   if (!input) {
     return blink::WebServiceWorkerObjectInfo(
         blink::mojom::kInvalidServiceWorkerVersionId,
-        blink::mojom::ServiceWorkerState::kUnknown, blink::WebURL(),
+        blink::mojom::ServiceWorkerState::kParsed, blink::WebURL(),
         mojo::ScopedInterfaceEndpointHandle() /* host_remote */,
         mojo::ScopedInterfaceEndpointHandle() /* receiver */);
   }
diff --git a/chromium/content/renderer/stream_texture_host_android.cc b/chromium/content/renderer/stream_texture_host_android.cc
index 29f08c2972f..749ebcc8ef3 100644
--- a/chromium/content/renderer/stream_texture_host_android.cc
+++ b/chromium/content/renderer/stream_texture_host_android.cc
@@ -9,6 +9,7 @@
 #include "gpu/ipc/client/gpu_channel_host.h"
 #include "gpu/ipc/common/command_buffer_id.h"
 #include "gpu/ipc/common/gpu_messages.h"
+#include "gpu/ipc/common/vulkan_ycbcr_info.h"
 #include "ipc/ipc_message_macros.h"
 
 namespace content {
@@ -47,6 +48,8 @@ bool StreamTextureHost::BindToCurrentThread(Listener* listener) {
 bool StreamTextureHost::OnMessageReceived(const IPC::Message& message) {
   bool handled = true;
   IPC_BEGIN_MESSAGE_MAP(StreamTextureHost, message)
+    IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameWithYcbcrInfoAvailable,
+                        OnFrameWithYcbcrInfoAvailable);
     IPC_MESSAGE_HANDLER(GpuStreamTextureMsg_FrameAvailable, OnFrameAvailable);
     IPC_MESSAGE_UNHANDLED(handled = false)
   IPC_END_MESSAGE_MAP()
@@ -58,6 +61,12 @@ void StreamTextureHost::OnChannelError() {
   channel_ = nullptr;
 }
 
+void StreamTextureHost::OnFrameWithYcbcrInfoAvailable(
+    base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) {
+  if (listener_)
+    listener_->OnFrameWithYcbcrInfoAvailable(std::move(ycbcr_info));
+}
+
 void StreamTextureHost::OnFrameAvailable() {
   if (listener_)
     listener_->OnFrameAvailable();
diff --git a/chromium/content/renderer/stream_texture_host_android.h b/chromium/content/renderer/stream_texture_host_android.h
index 231fef5333c..7ccd0f60097 100644
--- a/chromium/content/renderer/stream_texture_host_android.h
+++ b/chromium/content/renderer/stream_texture_host_android.h
@@ -25,6 +25,7 @@ namespace gpu {
 class GpuChannelHost;
 struct Mailbox;
 struct SyncToken;
+struct VulkanYCbCrInfo;
 }
 
 namespace content {
@@ -42,6 +43,8 @@ class CONTENT_EXPORT StreamTextureHost : public IPC::Listener {
   class Listener {
    public:
     virtual void OnFrameAvailable() = 0;
+    virtual void OnFrameWithYcbcrInfoAvailable(
+        base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info) = 0;
     virtual ~Listener() {}
   };
 
@@ -59,6 +62,8 @@ class CONTENT_EXPORT StreamTextureHost : public IPC::Listener {
  private:
   // Message handlers:
   void OnFrameAvailable();
+  void OnFrameWithYcbcrInfoAvailable(
+      base::Optional<gpu::VulkanYCbCrInfo> ycbcr_info);
 
   int32_t route_id_;
   Listener* listener_;
diff --git a/chromium/content/renderer/text_input_client_observer.cc b/chromium/content/renderer/text_input_client_observer.cc
index 5d8955d54ad..ccc9ed5a84c 100644
--- a/chromium/content/renderer/text_input_client_observer.cc
+++ b/chromium/content/renderer/text_input_client_observer.cc
@@ -21,6 +21,7 @@
 #include "third_party/blink/public/platform/web_rect.h"
 #include "third_party/blink/public/platform/web_string.h"
 #include "third_party/blink/public/web/mac/web_substring_util.h"
+#include "third_party/blink/public/web/web_frame_widget.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "third_party/blink/public/web/web_view.h"
 #include "ui/gfx/geometry/rect.h"
@@ -57,7 +58,7 @@ bool TextInputClientObserver::OnMessageReceived(const IPC::Message& message) {
 bool TextInputClientObserver::Send(IPC::Message* message) {
   // This class is attached to the main frame RenderWidget, but sends and
   // receives messages while the main frame is remote (and the RenderWidget is
-  // frozen). The messages are not received on RenderWidgetHostImpl, so there's
+  // undead). The messages are not received on RenderWidgetHostImpl, so there's
   // no need to send through RenderWidget or use its routing id. We avoid this
   // problem then by sending directly through RenderThread instead of through
   // RenderWidget::Send().
diff --git a/chromium/content/renderer/visual_state_browsertest.cc b/chromium/content/renderer/visual_state_browsertest.cc
index bf81f601e73..8c206d8f526 100644
--- a/chromium/content/renderer/visual_state_browsertest.cc
+++ b/chromium/content/renderer/visual_state_browsertest.cc
@@ -103,7 +103,7 @@ IN_PROC_BROWSER_TEST_F(VisualStateTest, DISABLED_CallbackDoesNotDeadlock) {
   // two commits then this test will prove nothing. We could detect this
   // with a high level of confidence if we used a timeout, but that's
   // discouraged (see https://codereview.chromium.org/939673002).
-  NavigateToURL(shell(), GURL("about:blank"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("about:blank")));
   CommitObserver observer(RenderView::FromRoutingID(
       shell()->web_contents()->GetRenderViewHost()->GetRoutingID()));
 
diff --git a/chromium/content/renderer/webclipboard_impl_browsertest.cc b/chromium/content/renderer/webclipboard_impl_browsertest.cc
index 2f71afe4ac9..889ebc35152 100644
--- a/chromium/content/renderer/webclipboard_impl_browsertest.cc
+++ b/chromium/content/renderer/webclipboard_impl_browsertest.cc
@@ -30,7 +30,7 @@ IN_PROC_BROWSER_TEST_F(WebClipboardImplTest, PasteRTF) {
 
   FrameFocusedObserver focus_observer(shell()->web_contents()->GetMainFrame());
   // paste_listener.html takes RTF from the clipboard and sets the title.
-  NavigateToURL(shell(), GetTestUrl(".", "paste_listener.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), GetTestUrl(".", "paste_listener.html")));
   focus_observer.Wait();
 
   const base::string16 expected_title = base::UTF8ToUTF16(rtf_content);
diff --git a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc
index 9272a5799b6..94cacc908e3 100644
--- a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc
+++ b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.cc
@@ -9,6 +9,7 @@
 #include "content/renderer/loader/navigation_response_override_parameters.h"
 #include "content/renderer/loader/web_worker_fetch_context_impl.h"
 #include "content/renderer/service_worker/service_worker_provider_context.h"
+#include "content/renderer/worker/fetch_client_settings_object_helpers.h"
 #include "mojo/public/cpp/bindings/pending_remote.h"
 #include "third_party/blink/public/common/features.h"
 #include "third_party/blink/public/mojom/blob/blob_url_store.mojom.h"
@@ -51,26 +52,13 @@ void DedicatedWorkerHostFactoryClient::CreateWorkerHost(
     const blink::WebSecurityOrigin& script_origin,
     network::mojom::CredentialsMode credentials_mode,
     const blink::WebSecurityOrigin& fetch_client_security_origin,
-    network::mojom::ReferrerPolicy fetch_client_referrer_policy,
-    const blink::WebURL& fetch_client_outgoing_referrer,
-    const blink::WebInsecureRequestPolicy fetch_client_insecure_request_policy,
+    const blink::WebFetchClientSettingsObject& fetch_client_settings_object,
     mojo::ScopedMessagePipeHandle blob_url_token) {
   DCHECK(base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
 
-  auto outside_fetch_client_settings_object =
-      blink::mojom::FetchClientSettingsObject::New();
-  outside_fetch_client_settings_object->referrer_policy =
-      fetch_client_referrer_policy;
-  outside_fetch_client_settings_object->outgoing_referrer =
-      fetch_client_outgoing_referrer;
-  outside_fetch_client_settings_object->insecure_requests_policy =
-      fetch_client_insecure_request_policy & blink::kUpgradeInsecureRequests
-          ? blink::mojom::InsecureRequestsPolicy::kUpgrade
-          : blink::mojom::InsecureRequestsPolicy::kDoNotUpgrade;
-
   factory_->CreateWorkerHostAndStartScriptLoad(
       script_url, script_origin, credentials_mode,
-      std::move(outside_fetch_client_settings_object),
+      FetchClientSettingsObjectFromWebToMojom(fetch_client_settings_object),
       mojo::PendingRemote<blink::mojom::BlobURLToken>(
           std::move(blob_url_token), blink::mojom::BlobURLToken::Version_),
       receiver_.BindNewPipeAndPassRemote(),
@@ -85,11 +73,13 @@ DedicatedWorkerHostFactoryClient::CloneWorkerFetchContext(
   if (base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker)) {
     worker_fetch_context =
         static_cast<WebWorkerFetchContextImpl*>(web_worker_fetch_context)
-            ->CloneForNestedWorker(service_worker_provider_context_.get(),
-                                   subresource_loader_factory_bundle_->Clone(),
-                                   subresource_loader_factory_bundle_
-                                       ->CloneWithoutAppCacheFactory(),
-                                   std::move(task_runner));
+            ->CloneForNestedWorker(
+                service_worker_provider_context_.get(),
+                subresource_loader_factory_bundle_->Clone(),
+                subresource_loader_factory_bundle_
+                    ->CloneWithoutAppCacheFactory(),
+                std::move(pending_subresource_loader_updater_),
+                std::move(task_runner));
     worker_fetch_context->SetResponseOverrideForMainScript(
         std::move(response_override_for_main_script_));
   } else {
@@ -118,7 +108,8 @@ DedicatedWorkerHostFactoryClient::CreateWorkerFetchContext(
           service_worker_provider_context_.get(),
           std::move(renderer_preference), std::move(watcher_receiver),
           subresource_loader_factory_bundle_->Clone(),
-          subresource_loader_factory_bundle_->CloneWithoutAppCacheFactory());
+          subresource_loader_factory_bundle_->CloneWithoutAppCacheFactory(),
+          std::move(pending_subresource_loader_updater_));
   worker_fetch_context->SetResponseOverrideForMainScript(
       std::move(response_override_for_main_script_));
   return worker_fetch_context;
@@ -138,6 +129,8 @@ void DedicatedWorkerHostFactoryClient::OnScriptLoadStarted(
     blink::mojom::WorkerMainScriptLoadParamsPtr main_script_load_params,
     std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
         subresource_loader_factory_bundle_info,
+    mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+        subresource_loader_updater,
     blink::mojom::ControllerServiceWorkerInfoPtr controller_info) {
   DCHECK(base::FeatureList::IsEnabled(blink::features::kPlzDedicatedWorker));
   DCHECK(main_script_load_params);
@@ -150,6 +143,9 @@ void DedicatedWorkerHostFactoryClient::OnScriptLoadStarted(
           std::make_unique<ChildURLLoaderFactoryBundleInfo>(
               std::move(subresource_loader_factory_bundle_info)));
 
+  DCHECK(!pending_subresource_loader_updater_);
+  pending_subresource_loader_updater_ = std::move(subresource_loader_updater);
+
   DCHECK(!service_worker_provider_context_);
   if (service_worker_provider_info) {
     service_worker_provider_context_ =
diff --git a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h
index 9692cce45ac..3a5d1c07c8e 100644
--- a/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h
+++ b/chromium/content/renderer/worker/dedicated_worker_host_factory_client.h
@@ -49,10 +49,7 @@ class DedicatedWorkerHostFactoryClient final
       const blink::WebSecurityOrigin& script_origin,
       network::mojom::CredentialsMode credentials_mode,
       const blink::WebSecurityOrigin& fetch_client_security_origin,
-      network::mojom::ReferrerPolicy fetch_client_referrer_policy,
-      const blink::WebURL& fetch_client_outgoing_referrer,
-      const blink::WebInsecureRequestPolicy
-          fetch_client_insecure_request_policy,
+      const blink::WebFetchClientSettingsObject& fetch_client_settings_object,
       mojo::ScopedMessagePipeHandle blob_url_token) override;
   scoped_refptr<blink::WebWorkerFetchContext> CloneWorkerFetchContext(
       blink::WebWorkerFetchContext* web_worker_fetch_context,
@@ -76,6 +73,8 @@ class DedicatedWorkerHostFactoryClient final
       blink::mojom::WorkerMainScriptLoadParamsPtr main_script_load_params,
       std::unique_ptr<blink::URLLoaderFactoryBundleInfo>
           subresource_loader_factory_bundle_info,
+      mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+          subresource_loader_updater,
       blink::mojom::ControllerServiceWorkerInfoPtr controller_info) override;
   void OnScriptLoadStartFailed() override;
 
@@ -83,6 +82,9 @@ class DedicatedWorkerHostFactoryClient final
   blink::WebDedicatedWorker* worker_;
 
   scoped_refptr<ChildURLLoaderFactoryBundle> subresource_loader_factory_bundle_;
+  mojo::PendingReceiver<blink::mojom::SubresourceLoaderUpdater>
+      pending_subresource_loader_updater_;
+
   scoped_refptr<ServiceWorkerProviderContext> service_worker_provider_context_;
   std::unique_ptr<NavigationResponseOverrideParameters>
       response_override_for_main_script_;
diff --git a/chromium/content/renderer/worker/embedded_shared_worker_stub.cc b/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
index 65a66ec426b..8a6374b5852 100644
--- a/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
+++ b/chromium/content/renderer/worker/embedded_shared_worker_stub.cc
@@ -175,13 +175,15 @@ EmbeddedSharedWorkerStub::CreateWorkerFetchContext() {
   std::unique_ptr<network::SharedURLLoaderFactoryInfo> fallback_factory =
       subresource_loader_factory_bundle_->CloneWithoutAppCacheFactory();
 
+  // |pending_subresource_loader_updater| is not used for shared workers.
   scoped_refptr<WebWorkerFetchContextImpl> worker_fetch_context =
       WebWorkerFetchContextImpl::Create(
           service_worker_provider_context_.get(),
           std::move(renderer_preferences_),
           std::move(preference_watcher_receiver_),
           subresource_loader_factory_bundle_->Clone(),
-          std::move(fallback_factory));
+          std::move(fallback_factory),
+          /*pending_subresource_loader_updater*/ mojo::NullReceiver());
 
   // TODO(horo): To get the correct first_party_to_cookies for the shared
   // worker, we need to check the all documents bounded by the shared worker.
diff --git a/chromium/content/renderer/worker/fetch_client_settings_object_helpers.cc b/chromium/content/renderer/worker/fetch_client_settings_object_helpers.cc
new file mode 100644
index 00000000000..cc04c142153
--- /dev/null
+++ b/chromium/content/renderer/worker/fetch_client_settings_object_helpers.cc
@@ -0,0 +1,28 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/renderer/worker/fetch_client_settings_object_helpers.h"
+
+#include "third_party/blink/public/platform/web_fetch_client_settings_object.h"
+
+namespace content {
+
+blink::mojom::FetchClientSettingsObjectPtr
+FetchClientSettingsObjectFromWebToMojom(
+    const blink::WebFetchClientSettingsObject& web_settings_object) {
+  return blink::mojom::FetchClientSettingsObject::New(
+      web_settings_object.referrer_policy,
+      web_settings_object.outgoing_referrer,
+      web_settings_object.insecure_requests_policy);
+}
+
+blink::WebFetchClientSettingsObject FetchClientSettingsObjectFromMojomToWeb(
+    const blink::mojom::FetchClientSettingsObjectPtr& mojom_settings_object) {
+  return blink::WebFetchClientSettingsObject(
+      mojom_settings_object->referrer_policy,
+      mojom_settings_object->outgoing_referrer,
+      mojom_settings_object->insecure_requests_policy);
+}
+
+}  // namespace content
diff --git a/chromium/content/renderer/worker/fetch_client_settings_object_helpers.h b/chromium/content/renderer/worker/fetch_client_settings_object_helpers.h
new file mode 100644
index 00000000000..1ffc612da42
--- /dev/null
+++ b/chromium/content/renderer/worker/fetch_client_settings_object_helpers.h
@@ -0,0 +1,28 @@
+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_RENDERER_WORKER_FETCH_CLIENT_SETTINGS_OBJECT_HELPERS_H_
+#define CONTENT_RENDERER_WORKER_FETCH_CLIENT_SETTINGS_OBJECT_HELPERS_H_
+
+#include "third_party/blink/public/mojom/loader/fetch_client_settings_object.mojom.h"
+
+namespace blink {
+struct WebFetchClientSettingsObject;
+}  // namespace blink
+
+namespace content {
+
+// Helper functions for converting FetchClientSettingsObject variants.
+// TODO(bashi): Remove these helpers when the Onion Soup is done.
+
+blink::mojom::FetchClientSettingsObjectPtr
+FetchClientSettingsObjectFromWebToMojom(
+    const blink::WebFetchClientSettingsObject& web_settings_object);
+
+blink::WebFetchClientSettingsObject FetchClientSettingsObjectFromMojomToWeb(
+    const blink::mojom::FetchClientSettingsObjectPtr& mojom_settings_object);
+
+}  // namespace content
+
+#endif  // CONTENT_RENDERER_WORKER_FETCH_CLIENT_SETTINGS_OBJECT_HELPERS_H_
diff --git a/chromium/content/shell/BUILD.gn b/chromium/content/shell/BUILD.gn
index eb38b8f6dda..5ff14b45266 100644
--- a/chromium/content/shell/BUILD.gn
+++ b/chromium/content/shell/BUILD.gn
@@ -293,7 +293,6 @@ jumbo_static_library("content_shell_lib") {
     "//components/web_cache/renderer",
     "//content:resources",
     "//content/app/resources",
-    "//content/app/strings",
     "//content/gpu",
     "//content/public/common",
     "//content/public/common:service_names",
@@ -334,6 +333,7 @@ jumbo_static_library("content_shell_lib") {
     "//third_party/blink/public:image_resources",
     "//third_party/blink/public:resources",
     "//third_party/blink/public:test_support",
+    "//third_party/blink/public/strings",
     "//third_party/icu",
     "//ui/base",
     "//ui/base/clipboard",
@@ -516,7 +516,6 @@ repack("pak") {
 
   sources = [
     "$root_gen_dir/content/app/resources/content_resources_100_percent.pak",
-    "$root_gen_dir/content/app/strings/content_strings_en-US.pak",
     "$root_gen_dir/content/browser/tracing/tracing_resources.pak",
     "$root_gen_dir/content/content_resources.pak",
     "$root_gen_dir/content/shell/shell_resources.pak",
@@ -524,6 +523,7 @@ repack("pak") {
     "$root_gen_dir/net/net_resources.pak",
     "$root_gen_dir/third_party/blink/public/resources/blink_resources.pak",
     "$root_gen_dir/third_party/blink/public/resources/blink_scaled_resources_100_percent.pak",
+    "$root_gen_dir/third_party/blink/public/strings/blink_strings_en-US.pak",
     "$root_gen_dir/ui/resources/ui_resources_100_percent.pak",
     "$root_gen_dir/ui/resources/webui_resources.pak",
     "$root_gen_dir/ui/strings/app_locale_settings_en-US.pak",
@@ -534,12 +534,12 @@ repack("pak") {
     ":resources",
     "//content:resources",
     "//content/app/resources",
-    "//content/app/strings",
     "//content/browser/tracing:resources",
     "//mojo/public/js:resources",
     "//net:net_resources",
     "//third_party/blink/public:resources",
     "//third_party/blink/public:scaled_resources_100_percent",
+    "//third_party/blink/public/strings",
     "//ui/resources",
     "//ui/strings",
   ]
@@ -953,6 +953,15 @@ group("content_shell_crash_test") {
     "//testing/scripts/content_shell_crash_test.py",
     "//testing/xvfb.py",
   ]
+  if (is_mac && !use_system_xcode) {
+    data += [
+      # Scripts call otool, which is a symlink to llvm-otool, so we need both.
+      # llvm-otool shells out to llvm-objdump, so that's needed as well.
+      mac_bin_path + "llvm-objdump",
+      mac_bin_path + "llvm-otool",
+      mac_bin_path + "otool",
+    ]
+  }
   if (is_posix) {
     data += [
       "//components/crash/content/tools/generate_breakpad_symbols.py",
diff --git a/chromium/content/shell/android/BUILD.gn b/chromium/content/shell/android/BUILD.gn
index 89c910d42cb..6547898f31d 100644
--- a/chromium/content/shell/android/BUILD.gn
+++ b/chromium/content/shell/android/BUILD.gn
@@ -230,10 +230,12 @@ instrumentation_test_apk("content_shell_test_apk") {
   shared_libraries = [ ":libcontent_native_test" ]
   android_manifest = "javatests/AndroidManifest.xml"
 
+  data_deps = [
+    "//testing/buildbot/filters:content_shell_test_apk_filters",
+  ]
+
   if (enable_chrome_android_internal) {
-    data_deps = [
-      "//clank/build/bot/filters:content_shell_test_apk_filters",
-    ]
+    data_deps += [ "//clank/build/bot/filters:content_shell_test_apk_filters" ]
   }
 }
 
@@ -353,6 +355,7 @@ android_library("content_shell_browsertests_java") {
     "//base:base_java",
     "//content/public/android:content_java",
     "//testing/android/native_test:native_test_java",
+    "//third_party/android_deps:com_android_support_support_compat_java",
     "//ui/android:ui_java",
   ]
   java_files = [ "browsertests/src/org/chromium/content_shell/browsertests/ContentShellBrowserTestActivity.java" ]
diff --git a/chromium/content/shell/common/power_monitor_test_impl.cc b/chromium/content/shell/common/power_monitor_test_impl.cc
index 04abfdba4ae..77e27f69d11 100644
--- a/chromium/content/shell/common/power_monitor_test_impl.cc
+++ b/chromium/content/shell/common/power_monitor_test_impl.cc
@@ -4,15 +4,20 @@
 
 #include "content/shell/common/power_monitor_test_impl.h"
 
-#include "mojo/public/cpp/bindings/strong_binding.h"
+#include <memory>
+#include <utility>
+
+#include "content/shell/common/power_monitor_test.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 
 namespace content {
 
 // static
-void PowerMonitorTestImpl::MakeStrongBinding(
-    mojom::PowerMonitorTestRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<PowerMonitorTestImpl>(),
-                          std::move(request));
+void PowerMonitorTestImpl::MakeSelfOwnedReceiver(
+    mojo::PendingReceiver<mojom::PowerMonitorTest> receiver) {
+  mojo::MakeSelfOwnedReceiver(std::make_unique<PowerMonitorTestImpl>(),
+                              std::move(receiver));
 }
 
 PowerMonitorTestImpl::PowerMonitorTestImpl() {
diff --git a/chromium/content/shell/common/power_monitor_test_impl.h b/chromium/content/shell/common/power_monitor_test_impl.h
index fda5193cec7..39d698e9f23 100644
--- a/chromium/content/shell/common/power_monitor_test_impl.h
+++ b/chromium/content/shell/common/power_monitor_test_impl.h
@@ -5,19 +5,18 @@
 #ifndef CONTENT_SHELL_COMMON_POWER_MONITOR_TEST_IMPL_H_
 #define CONTENT_SHELL_COMMON_POWER_MONITOR_TEST_IMPL_H_
 
-#include <memory>
-
 #include "base/macros.h"
 #include "base/power_monitor/power_monitor.h"
 #include "content/shell/common/power_monitor_test.mojom.h"
+#include "mojo/public/cpp/bindings/pending_receiver.h"
 
 namespace content {
 
 class PowerMonitorTestImpl : public base::PowerObserver,
                              public mojom::PowerMonitorTest {
  public:
-  static void MakeStrongBinding(
-      mojom::PowerMonitorTestRequest request);
+  static void MakeSelfOwnedReceiver(
+      mojo::PendingReceiver<mojom::PowerMonitorTest> receiver);
 
   PowerMonitorTestImpl();
   ~PowerMonitorTestImpl() override;
diff --git a/chromium/content/shell/common/shell_content_client.cc b/chromium/content/shell/common/shell_content_client.cc
index e5038364549..0c42f2e7797 100644
--- a/chromium/content/shell/common/shell_content_client.cc
+++ b/chromium/content/shell/common/shell_content_client.cc
@@ -10,10 +10,10 @@
 #include "base/values.h"
 #include "build/build_config.h"
 #include "content/app/resources/grit/content_resources.h"
-#include "content/app/strings/grit/content_strings.h"
 #include "content/public/common/content_switches.h"
 #include "content/shell/common/shell_switches.h"
 #include "content/shell/grit/shell_resources.h"
+#include "third_party/blink/public/strings/grit/blink_strings.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 
diff --git a/chromium/content/shell/common/web_test/fake_bluetooth_chooser.mojom b/chromium/content/shell/common/web_test/fake_bluetooth_chooser.mojom
index a093ca91358..b8f66e0fd52 100644
--- a/chromium/content/shell/common/web_test/fake_bluetooth_chooser.mojom
+++ b/chromium/content/shell/common/web_test/fake_bluetooth_chooser.mojom
@@ -52,8 +52,12 @@ interface FakeBluetoothChooser {
 
 // FakeBluetoothChooserFactory ensures that FakeBluetoothChoosers are created
 // with an associated FakeBluetoothChooserClient.
+// TODO(crbug.com/955171): Use |pending_associated_remote| instead of
+// |associated| after supporting mojom_js_generator.py completely for
+// associated interfaces.
 interface FakeBluetoothChooserFactory {
-  CreateFakeBluetoothChooser(FakeBluetoothChooser& fake_chooser,
+  CreateFakeBluetoothChooser(
+      pending_receiver<FakeBluetoothChooser> fake_chooser,
       associated FakeBluetoothChooserClient client);
 };
 
diff --git a/chromium/content/shell/common/web_test/web_test_messages.h b/chromium/content/shell/common/web_test/web_test_messages.h
index da860354561..bf87de1d017 100644
--- a/chromium/content/shell/common/web_test/web_test_messages.h
+++ b/chromium/content/shell/common/web_test/web_test_messages.h
@@ -25,9 +25,6 @@ IPC_SYNC_MESSAGE_ROUTED1_1(WebTestHostMsg_ReadFileToString,
 IPC_SYNC_MESSAGE_ROUTED1_1(WebTestHostMsg_RegisterIsolatedFileSystem,
                            std::vector<base::FilePath> /* absolute_filenames */,
                            std::string /* filesystem_id */)
-IPC_SYNC_MESSAGE_ROUTED1_0(
-    WebTestHostMsg_ExcludeSchemeFromRequestInitiatorSiteLockChecks,
-    std::string /* scheme */)
 
 IPC_MESSAGE_ROUTED0(WebTestHostMsg_ClearAllDatabases)
 IPC_MESSAGE_ROUTED1(WebTestHostMsg_SetDatabaseQuota, int /* quota */)
diff --git a/chromium/content/shell/test_runner/BUILD.gn b/chromium/content/shell/test_runner/BUILD.gn
index 42853812f81..7f0f821ad17 100644
--- a/chromium/content/shell/test_runner/BUILD.gn
+++ b/chromium/content/shell/test_runner/BUILD.gn
@@ -43,8 +43,6 @@ jumbo_component("test_runner") {
     "mock_spell_check.h",
     "mock_web_document_subresource_filter.cc",
     "mock_web_document_subresource_filter.h",
-    "mock_web_theme_engine.cc",
-    "mock_web_theme_engine.h",
     "pixel_dump.cc",
     "pixel_dump.h",
     "spell_check_client.cc",
diff --git a/chromium/content/test/BUILD.gn b/chromium/content/test/BUILD.gn
index 56926f8d156..1fe51fd5eaf 100644
--- a/chromium/content/test/BUILD.gn
+++ b/chromium/content/test/BUILD.gn
@@ -10,6 +10,7 @@ import("//build/config/features.gni")
 import("//build/config/jumbo.gni")
 import("//build/config/ui.gni")
 import("//build/nocompile.gni")
+import("//content/common/features.gni")
 import("//media/media_options.gni")
 import("//mojo/public/tools/bindings/mojom.gni")
 import("//net/features.gni")
@@ -66,6 +67,10 @@ jumbo_static_library("test_support") {
     "../browser/native_file_system/mock_native_file_system_permission_context.h",
     "../browser/native_file_system/mock_native_file_system_permission_grant.cc",
     "../browser/native_file_system/mock_native_file_system_permission_grant.h",
+    "../browser/portal/portal_created_observer.cc",
+    "../browser/portal/portal_created_observer.h",
+    "../browser/portal/portal_interceptor_for_testing.cc",
+    "../browser/portal/portal_interceptor_for_testing.h",
     "../browser/renderer_host/input/mock_input_router.cc",
     "../browser/renderer_host/input/mock_input_router.h",
     "../browser/renderer_host/mock_render_widget_host.cc",
@@ -95,6 +100,8 @@ jumbo_static_library("test_support") {
     "../public/test/accessibility_notification_waiter.h",
     "../public/test/audio_service_test_helper.cc",
     "../public/test/audio_service_test_helper.h",
+    "../public/test/back_forward_cache_util.cc",
+    "../public/test/back_forward_cache_util.h",
     "../public/test/background_sync_test_util.cc",
     "../public/test/background_sync_test_util.h",
     "../public/test/blink_test_environment.cc",
@@ -120,8 +127,6 @@ jumbo_static_library("test_support") {
     "../public/test/dump_accessibility_test_helper.h",
     "../public/test/fake_download_item.cc",
     "../public/test/fake_download_item.h",
-    "../public/test/fake_pepper_plugin_instance.cc",
-    "../public/test/fake_pepper_plugin_instance.h",
     "../public/test/fake_service_worker_context.cc",
     "../public/test/fake_service_worker_context.h",
     "../public/test/fake_speech_recognition_manager.cc",
@@ -134,6 +139,8 @@ jumbo_static_library("test_support") {
     "../public/test/hit_test_region_observer.h",
     "../public/test/javascript_test_observer.cc",
     "../public/test/javascript_test_observer.h",
+    "../public/test/media_start_stop_observer.cc",
+    "../public/test/media_start_stop_observer.h",
     "../public/test/mock_browsing_data_remover_delegate.cc",
     "../public/test/mock_browsing_data_remover_delegate.h",
     "../public/test/mock_download_manager.cc",
@@ -159,8 +166,6 @@ jumbo_static_library("test_support") {
     "../public/test/network_service_test_helper.h",
     "../public/test/no_renderer_crashes_assertion.cc",
     "../public/test/no_renderer_crashes_assertion.h",
-    "../public/test/ppapi_test_utils.cc",
-    "../public/test/ppapi_test_utils.h",
     "../public/test/render_view_test.cc",
     "../public/test/render_view_test.h",
     "../public/test/scoped_overscroll_modes.cc",
@@ -232,16 +237,6 @@ jumbo_static_library("test_support") {
     "../public/test/web_contents_binding_set_test_binder.h",
     "../public/test/web_contents_tester.cc",
     "../public/test/web_contents_tester.h",
-    "../renderer/media/webrtc/mock_data_channel_impl.cc",
-    "../renderer/media/webrtc/mock_data_channel_impl.h",
-    "../renderer/media/webrtc/mock_peer_connection_dependency_factory.cc",
-    "../renderer/media/webrtc/mock_peer_connection_dependency_factory.h",
-    "../renderer/media/webrtc/mock_peer_connection_impl.cc",
-    "../renderer/media/webrtc/mock_peer_connection_impl.h",
-    "../renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.cc",
-    "../renderer/media/webrtc/mock_web_rtc_peer_connection_handler_client.h",
-    "../renderer/media/webrtc/test/webrtc_stats_report_obtainer.cc",
-    "../renderer/media/webrtc/test/webrtc_stats_report_obtainer.h",
     "appcache_test_helper.cc",
     "appcache_test_helper.h",
     "barrier_builder.cc",
@@ -256,9 +251,9 @@ jumbo_static_library("test_support") {
     "dwrite_font_fake_sender_win.h",
     "fake_compositor_dependencies.cc",
     "fake_compositor_dependencies.h",
-    "fake_leveldb_database.cc",
-    "fake_leveldb_database.h",
     "fake_mojo_message_dispatch_context.h",
+    "fake_network.cc",
+    "fake_network.h",
     "fake_network_url_loader_factory.cc",
     "fake_network_url_loader_factory.h",
     "fake_plugin_service.cc",
@@ -295,8 +290,6 @@ jumbo_static_library("test_support") {
     "navigation_simulator_impl.h",
     "not_implemented_network_url_loader_factory.cc",
     "not_implemented_network_url_loader_factory.h",
-    "ppapi_unittest.cc",
-    "ppapi_unittest.h",
     "storage_partition_test_utils.cc",
     "storage_partition_test_utils.h",
     "stub_layer_tree_view_delegate.cc",
@@ -308,6 +301,8 @@ jumbo_static_library("test_support") {
     "test_background_sync_context.h",
     "test_background_sync_manager.cc",
     "test_background_sync_manager.h",
+    "test_background_sync_proxy.cc",
+    "test_background_sync_proxy.h",
     "test_blink_web_unit_test_support.cc",
     "test_blink_web_unit_test_support.h",
     "test_content_browser_client.cc",
@@ -367,6 +362,7 @@ jumbo_static_library("test_support") {
     "//services/media_session/public/mojom",
     "//third_party/blink/public:blink",
     "//third_party/blink/public:test_support",
+    "//third_party/blink/public/strings:strings_grit",
   ]
 
   deps = [
@@ -418,7 +414,9 @@ jumbo_static_library("test_support") {
     "//storage/common",
     "//testing/gmock",
     "//testing/gtest",
+    "//third_party/blink/public/strings:strings_grit",
     "//third_party/webrtc/api:libjingle_peerconnection_api",
+    "//third_party/webrtc/api:media_stream_interface",
     "//third_party/webrtc/api:rtc_stats_api",
     "//third_party/webrtc/api:scoped_refptr",
     "//third_party/webrtc/media:rtc_media_base",
@@ -457,7 +455,12 @@ jumbo_static_library("test_support") {
   ]
 
   if (is_android) {
+    sources += [
+      "test_view_android_delegate.cc",
+      "test_view_android_delegate.h",
+    ]
     deps += [
+      ":content_unittests_jni_headers",
       "//content/shell:android_shell_descriptors",
       "//mojo/public/java/system:native_support",
       "//testing/android/native_test:native_browser_test_support",
@@ -479,6 +482,14 @@ jumbo_static_library("test_support") {
   }
 
   if (enable_plugins) {
+    sources += [
+      "../public/test/fake_pepper_plugin_instance.cc",
+      "../public/test/fake_pepper_plugin_instance.h",
+      "../public/test/ppapi_test_utils.cc",
+      "../public/test/ppapi_test_utils.h",
+      "ppapi_unittest.cc",
+      "ppapi_unittest.h",
+    ]
     deps += [
       "//content/ppapi_plugin",
       "//ppapi/host",
@@ -487,11 +498,6 @@ jumbo_static_library("test_support") {
       "//ppapi/shared_impl",
       "//ppapi/shared_impl:test_support",
     ]
-  } else {
-    sources -= [
-      "../public/test/ppapi_test_utils.cc",
-      "ppapi_unittest.cc",
-    ]
   }
 
   if (use_atk) {
@@ -809,12 +815,14 @@ static_library("test_runner_support") {
 if (is_android) {
   import("//build/config/android/rules.gni")
 
+  content_browsertests_manifest =
+      "${target_gen_dir}/content_browsertests_manifest/AndroidManifest.xml"
+
   jinja_template("content_browsertests_manifest") {
     testonly = true
     input =
         "//content/shell/android/browsertests_apk/AndroidManifest.xml.jinja2"
-    output =
-        "${target_gen_dir}/content_browsertests_manifest/AndroidManifest.xml"
+    output = content_browsertests_manifest
   }
 
   android_library("content_browsertests_java") {
@@ -824,6 +832,7 @@ if (is_android) {
       "../shell/android/browsertests_apk/src/org/chromium/content_browsertests_apk/ContentBrowserTestsApplication.java",
     ]
     deps = [
+      ":content_browsertests_manifest",
       ":content_browsertests_resources",
       "//base:base_java",
       "//base:base_java_test_support",
@@ -835,6 +844,7 @@ if (is_android) {
       "//testing/android/native_test:native_test_java",
       "//ui/android:ui_java",
     ]
+    android_manifest_for_lint = content_browsertests_manifest
   }
 
   android_resources("content_browsertests_resources") {
@@ -910,12 +920,13 @@ test("content_browsertests") {
     "../browser/fileapi/fileapi_browsertest.cc",
     "../browser/find_request_manager_browsertest.cc",
     "../browser/font_unique_name_lookup/font_unique_name_browsertest.cc",
+    "../browser/frame_host/ancestor_throttle_browsertest.cc",
     "../browser/frame_host/back_forward_cache_metrics_browsertest.cc",
     "../browser/frame_host/blocked_scheme_navigation_browsertest.cc",
     "../browser/frame_host/frame_tree_browsertest.cc",
     "../browser/frame_host/interstitial_page_impl_browsertest.cc",
     "../browser/frame_host/navigation_controller_impl_browsertest.cc",
-    "../browser/frame_host/navigation_handle_impl_browsertest.cc",
+    "../browser/frame_host/navigation_request_browsertest.cc",
     "../browser/frame_host/render_document_host_browsertest.cc",
     "../browser/frame_host/render_frame_host_impl_browsertest.cc",
     "../browser/frame_host/render_frame_host_manager_browsertest.cc",
@@ -925,8 +936,10 @@ test("content_browsertests") {
     "../browser/generic_sensor/generic_sensor_browsertest.cc",
     "../browser/gpu/gpu_ipc_browsertests.cc",
     "../browser/gpu/in_process_gpu_thread_browsertests.cc",
+    "../browser/gpu/peak_gpu_memory_tracker_impl_browsertest.cc",
     "../browser/idle/idle_browsertest.cc",
     "../browser/indexed_db/indexed_db_browsertest.cc",
+    "../browser/indexed_db/indexed_db_execution_context_connection_tracker_browsertest.cc",
     "../browser/indexed_db/mock_browsertest_indexed_db_class_factory.cc",
     "../browser/indexed_db/mock_browsertest_indexed_db_class_factory.h",
     "../browser/isolated_origin_browsertest.cc",
@@ -936,12 +949,14 @@ test("content_browsertests") {
     "../browser/loader/cors_file_origin_browsertest.cc",
     "../browser/loader/cors_preflight_cache_browsertest.cc",
     "../browser/loader/cross_site_document_blocking_browsertest.cc",
+    "../browser/loader/file_url_loader_factory_browsertest.cc",
     "../browser/loader/loader_browsertest.cc",
     "../browser/loader/prefetch_browsertest.cc",
     "../browser/loader/prefetch_browsertest_base.cc",
     "../browser/loader/prefetch_browsertest_base.h",
     "../browser/loader/reload_cache_control_browsertest.cc",
     "../browser/loader/resource_scheduler_browsertest.cc",
+    "../browser/locks/lock_manager_browsertest.cc",
     "../browser/manifest/manifest_browsertest.cc",
     "../browser/media/encrypted_media_browsertest.cc",
     "../browser/media/media_autoplay_browsertest.cc",
@@ -980,6 +995,7 @@ test("content_browsertests") {
     "../browser/pointer_lock_browsertest_mac.mm",
     "../browser/portal/portal_browsertest.cc",
     "../browser/power_monitor_browsertest.cc",
+    "../browser/process_internals/process_internals_browsertest.cc",
     "../browser/renderer_host/input/autoscroll_browsertest.cc",
     "../browser/renderer_host/input/composited_scrolling_browsertest.cc",
     "../browser/renderer_host/input/compositor_event_ack_browsertest.cc",
@@ -1015,6 +1031,7 @@ test("content_browsertests") {
     "../browser/service_worker/service_worker_clients_api_browsertest.cc",
     "../browser/service_worker/service_worker_file_upload_browsertest.cc",
     "../browser/service_worker/service_worker_no_best_effort_tasks_browsertest.cc",
+    "../browser/service_worker/service_worker_process_browsertest.cc",
     "../browser/session_history_browsertest.cc",
     "../browser/shape_detection/shape_detection_browsertest.cc",
     "../browser/site_per_process_browsertest.cc",
@@ -1066,8 +1083,10 @@ test("content_browsertests") {
     "../browser/webrtc/webrtc_webcam_browsertest.cc",
     "../browser/webrtc/webrtc_webcam_browsertest.h",
     "../browser/webui/web_ui_mojo_browsertest.cc",
+    "../browser/webui/web_ui_security_browsertest.cc",
     "../browser/worker_host/worker_browsertest.cc",
     "../browser/worker_network_isolation_key_browsertest.cc",
+    "../child/webthemeengine_impl_default_browsertest.cc",
     "../renderer/accessibility/render_accessibility_impl_browsertest.cc",
     "../renderer/blink_platform_audio_hardware_browsertest.cc",
     "../renderer/gin_browsertest.cc",
@@ -1227,7 +1246,6 @@ test("content_browsertests") {
       "$root_out_dir/content_shell.pak",
       "data/",
       "//media/test/data/",
-      "//services/test/data/",
     ]
   }
 
@@ -1274,13 +1292,15 @@ test("content_browsertests") {
       "../browser/accessibility/ax_platform_node_win_browsertest.cc",
       "../browser/renderer_host/accessibility_object_lifetime_win_browsertest.cc",
       "../browser/renderer_host/accessibility_tree_linkage_win_browsertest.cc",
+      "../browser/renderer_host/direct_manipulation_test_helper_win.cc",
+      "../browser/renderer_host/direct_manipulation_test_helper_win.h",
       "../browser/renderer_host/direct_manipulation_win_browsertest.cc",
     ]
 
     deps += [
-      "//content/app/strings",
       "//net:net_resources",
       "//third_party/blink/public:resources",
+      "//third_party/blink/public/strings",
       "//third_party/iaccessible2",
       "//third_party/isimpledom",
     ]
@@ -1288,10 +1308,6 @@ test("content_browsertests") {
     libs = [ "uiautomationcore.lib" ]
 
     configs += [ "//build/config/win:delayloads" ]
-
-    if (symbol_level != 0) {
-      data += [ "$root_out_dir/content_browsertests.exe.pdb" ]
-    }
   }
 
   if (is_linux) {
@@ -1536,6 +1552,7 @@ test("content_unittests") {
     "../browser/background_sync/background_sync_manager_unittest.cc",
     "../browser/background_sync/background_sync_metrics_unittest.cc",
     "../browser/background_sync/background_sync_network_observer_unittest.cc",
+    "../browser/background_sync/background_sync_scheduler_unittest.cc",
     "../browser/background_sync/background_sync_service_impl_test_harness.cc",
     "../browser/background_sync/background_sync_service_impl_test_harness.h",
     "../browser/background_sync/one_shot_background_sync_service_impl_unittest.cc",
@@ -1588,12 +1605,6 @@ test("content_unittests") {
     "../browser/dom_storage/session_storage_metadata_unittest.cc",
     "../browser/dom_storage/session_storage_namespace_impl_mojo_unittest.cc",
     "../browser/dom_storage/storage_area_impl_unittest.cc",
-    "../browser/dom_storage/test/fake_leveldb_database_error_on_write.cc",
-    "../browser/dom_storage/test/fake_leveldb_database_error_on_write.h",
-    "../browser/dom_storage/test/fake_leveldb_service.cc",
-    "../browser/dom_storage/test/fake_leveldb_service.h",
-    "../browser/dom_storage/test/mojo_test_with_file_service.cc",
-    "../browser/dom_storage/test/mojo_test_with_file_service.h",
     "../browser/dom_storage/test/storage_area_test_util.cc",
     "../browser/dom_storage/test/storage_area_test_util.h",
     "../browser/download/download_manager_impl_unittest.cc",
@@ -1631,6 +1642,7 @@ test("content_unittests") {
     "../browser/indexed_db/indexed_db_cleanup_on_io_error_unittest.cc",
     "../browser/indexed_db/indexed_db_database_unittest.cc",
     "../browser/indexed_db/indexed_db_dispatcher_host_unittest.cc",
+    "../browser/indexed_db/indexed_db_execution_context_connection_tracker_unittest.cc",
     "../browser/indexed_db/indexed_db_factory_unittest.cc",
     "../browser/indexed_db/indexed_db_fake_backing_store.cc",
     "../browser/indexed_db/indexed_db_fake_backing_store.h",
@@ -1666,11 +1678,9 @@ test("content_unittests") {
     "../browser/indexed_db/scopes/leveldb_scopes_test_utils.h",
     "../browser/indexed_db/scopes/leveldb_scopes_unittest.cc",
     "../browser/indexed_db/scopes/scopes_lock_manager_unittest.cc",
-    "../browser/loader/data_pipe_to_source_stream_unittest.cc",
     "../browser/loader/merkle_integrity_source_stream_unittest.cc",
     "../browser/loader/navigation_url_loader_impl_unittest.cc",
     "../browser/loader/navigation_url_loader_unittest.cc",
-    "../browser/loader/source_stream_to_data_pipe_unittest.cc",
     "../browser/manifest/manifest_icon_downloader_unittest.cc",
     "../browser/media/audible_metrics_unittest.cc",
     "../browser/media/audio_input_stream_broker_unittest.cc",
@@ -1721,6 +1731,8 @@ test("content_unittests") {
     "../browser/presentation/presentation_service_impl_unittest.cc",
     "../browser/renderer_host/clipboard_host_impl_unittest.cc",
     "../browser/renderer_host/cursor_manager_unittest.cc",
+    "../browser/renderer_host/direct_manipulation_test_helper_win.cc",
+    "../browser/renderer_host/direct_manipulation_test_helper_win.h",
     "../browser/renderer_host/direct_manipulation_win_unittest.cc",
     "../browser/renderer_host/dwrite_font_lookup_table_builder_win_unittest.cc",
     "../browser/renderer_host/dwrite_font_proxy_impl_win_unittest.cc",
@@ -1846,6 +1858,7 @@ test("content_unittests") {
     "../browser/web_contents/web_drag_source_mac_unittest.mm",
     "../browser/web_package/bundled_exchanges_reader_unittest.cc",
     "../browser/web_package/bundled_exchanges_url_loader_factory_unittest.cc",
+    "../browser/web_package/bundled_exchanges_utils_unittest.cc",
     "../browser/web_package/signed_exchange_cert_fetcher_unittest.cc",
     "../browser/web_package/signed_exchange_certificate_chain_unittest.cc",
     "../browser/web_package/signed_exchange_envelope_unittest.cc",
@@ -1870,6 +1883,7 @@ test("content_unittests") {
     "../child/dwrite_font_proxy/dwrite_font_proxy_win_unittest.cc",
     "../child/dwrite_font_proxy/font_fallback_win_unittest.cc",
     "../child/font_warmup_win_unittest.cc",
+    "../child/webthemeengine_impl_unittest.cc",
     "../common/android/gin_java_bridge_value_unittest.cc",
     "../common/background_fetch/background_fetch_mojom_traits_unittest.cc",
     "../common/common_param_traits_unittest.cc",
@@ -1888,10 +1902,8 @@ test("content_unittests") {
     "../common/input/touch_event_stream_validator_unittest.cc",
     "../common/inter_process_time_ticks_converter_unittest.cc",
     "../common/mac/attributed_string_coder_unittest.mm",
-    "../common/mime_sniffing_throttle_unittest.cc",
     "../common/origin_util_unittest.cc",
     "../common/page_state_serialization_unittest.cc",
-    "../common/page_zoom_unittest.cc",
     "../common/service_manager/service_manager_connection_impl_unittest.cc",
     "../common/service_worker/service_worker_utils_unittest.cc",
     "../common/tab_switch_time_recorder_unittest.cc",
@@ -1932,27 +1944,13 @@ test("content_unittests") {
     "../renderer/media/batching_media_log_unittest.cc",
     "../renderer/media/inspector_media_event_handler_unittest.cc",
     "../renderer/media/renderer_webaudiodevice_impl_unittest.cc",
-    "../renderer/media/webrtc/fake_rtc_rtp_transceiver.cc",
-    "../renderer/media/webrtc/fake_rtc_rtp_transceiver.h",
-    "../renderer/media/webrtc/media_stream_remote_video_source_unittest.cc",
     "../renderer/media/webrtc/media_stream_track_metrics_unittest.cc",
-    "../renderer/media/webrtc/media_stream_video_webrtc_sink_unittest.cc",
     "../renderer/media/webrtc/peer_connection_dependency_factory_unittest.cc",
     "../renderer/media/webrtc/peer_connection_tracker_unittest.cc",
     "../renderer/media/webrtc/rtc_peer_connection_handler_unittest.cc",
-    "../renderer/media/webrtc/rtc_rtp_receiver_unittest.cc",
-    "../renderer/media/webrtc/rtc_rtp_sender_unittest.cc",
-    "../renderer/media/webrtc/rtc_rtp_transceiver_unittest.cc",
-    "../renderer/media/webrtc/stun_field_trial_unittest.cc",
     "../renderer/media/webrtc/task_queue_factory_unittest.cc",
-    "../renderer/media/webrtc/transceiver_state_surfacer_unittest.cc",
-    "../renderer/media/webrtc/transmission_encoding_info_handler_unittest.cc",
     "../renderer/media/webrtc/webrtc_audio_renderer_unittest.cc",
-    "../renderer/media/webrtc/webrtc_media_stream_track_adapter_map_unittest.cc",
-    "../renderer/media/webrtc/webrtc_media_stream_track_adapter_unittest.cc",
     "../renderer/media/webrtc/webrtc_set_description_observer_unittest.cc",
-    "../renderer/p2p/filtering_network_manager_unittest.cc",
-    "../renderer/p2p/ipc_network_manager_unittest.cc",
     "../renderer/peripheral_content_heuristic_unittest.cc",
     "../renderer/queue_message_swap_promise_unittest.cc",
     "../renderer/render_frame_metadata_observer_impl_unittest.cc",
@@ -1967,6 +1965,7 @@ test("content_unittests") {
     "../test/renderer_audio_output_stream_factory_context_impl_unittest.cc",
     "navigation_simulator_unittest.cc",
     "proxy_service_mojo_unittest.cc",
+    "test_render_frame_host_unittest.cc",
     "url_request_context_builder_mojo_unittest.cc",
   ]
 
@@ -2032,6 +2031,7 @@ test("content_unittests") {
     "//content/browser/service_worker:service_worker_proto",
     "//content/browser/speech/proto",
     "//content/child:for_content_tests",
+    "//content/common:buildflags",
     "//content/gpu",
     "//content/public/browser",
     "//content/public/child",
@@ -2072,8 +2072,6 @@ test("content_unittests") {
     "//services/device/public/cpp:test_support",
     "//services/device/public/cpp/generic_sensor",
     "//services/device/public/mojom",
-    "//services/file:lib",
-    "//services/file/public/mojom",
     "//services/metrics/public/cpp:ukm_builders",
     "//services/metrics/public/mojom",
     "//services/network:network_service",
@@ -2100,7 +2098,7 @@ test("content_unittests") {
     "//third_party/metrics_proto",
     "//third_party/re2",
     "//third_party/sqlite",
-    "//third_party/webrtc/api:libjingle_peerconnection_api",
+    "//third_party/webrtc/api:media_stream_interface",
     "//third_party/webrtc/api:rtc_stats_api",
     "//third_party/webrtc/api/task_queue:task_queue_test",
     "//third_party/webrtc/api/video:video_frame",
@@ -2188,9 +2186,9 @@ test("content_unittests") {
   }
 
   # Screen capture unit tests.
-  if (is_linux || is_mac || is_win) {
-    defines += [ "ENABLE_SCREEN_CAPTURE=1" ]
+  if (enable_screen_capture && !is_android) {
     deps += [
+      "//content/common:buildflags",
       "//media/capture:test_support",
       "//third_party/libyuv",
       "//third_party/webrtc/modules/desktop_capture",
@@ -2268,7 +2266,7 @@ test("content_unittests") {
       "//build/config/freetype",
       "//components/download/internal/common:internal_java",
       "//content/public/android:content_java",
-      "//gpu/ipc/common:android_texture_owner_test_support",
+      "//gpu/command_buffer/service:android_texture_owner_test_support",
       "//media/capture/content/android",
       "//media/capture/content/android:screen_capture_java",
       "//third_party/blink/public/common",
@@ -2432,9 +2430,13 @@ group("test_buildbucket_api_gpu_use_cases") {
 }
 
 if (is_android) {
-  content_java_sources_needing_jni = [ "//content/public/android/javatests/src/org/chromium/content/browser/sms/Fakes.java" ]
+  content_java_sources_needing_jni = [
+    "//content/public/android/javatests/src/org/chromium/content/browser/sms/Fakes.java",
+    "//content/public/android/javatests/src/org/chromium/content/browser/fakes/TestViewAndroidDelegate.java",
+  ]
 
   generate_jni("content_unittests_jni_headers") {
+    testonly = true
     sources = content_java_sources_needing_jni
   }
 
@@ -2448,6 +2450,7 @@ if (is_android) {
       "$google_play_services_package:google_play_services_tasks_java",
       "//base:base_java",
       "//content/public/android:content_java",
+      "//ui/android:ui_full_java",
     ]
   }
 }
diff --git a/chromium/content/test/data/lite_js_test.mojom b/chromium/content/test/data/lite_js_test.mojom
index 9bf8d77b414..c44873f91cb 100644
--- a/chromium/content/test/data/lite_js_test.mojom
+++ b/chromium/content/test/data/lite_js_test.mojom
@@ -17,6 +17,11 @@ union TestUnion {
 // An interface whose definition covers various types of message signatures in
 // order to exercise the lite JS mojom bindings.
 interface TestMessageTarget {
+  enum NestedEnum {
+    kFoo,
+    kBar,
+  };
+
   // Zero arguments, no reply.
   Poke();
 
@@ -27,6 +32,8 @@ interface TestMessageTarget {
   Repeat(string? message, array<int32>? numbers)
       => (string? message, array<int32>? numbers);
 
+  Echo(NestedEnum nested) => (NestedEnum nested);
+
   Flatten(array<TestStruct> values) => (array<int32> values);
   FlattenUnions(array<TestUnion> unions) => (array<int32> x, array<int32> s);
 
@@ -41,4 +48,3 @@ interface Subinterface {
 interface SubinterfaceClient {
   DidFlush(array<int32> values);
 };
-
diff --git a/chromium/content/utility/OWNERS b/chromium/content/utility/OWNERS
index 651168dfc77..25d30834871 100644
--- a/chromium/content/utility/OWNERS
+++ b/chromium/content/utility/OWNERS
@@ -1,6 +1,6 @@
-# Mac Sandbox profiles.
-per-file *.sb=set noparent
-per-file *.sb=rsesek@chromium.org
+# For security review.
+per-file services.*=set noparent
+per-file services.*=file://ipc/SECURITY_OWNERS
 
 # For service-related code
 per-file utility_service_factory.*=rockot@google.com
diff --git a/chromium/content/utility/services.cc b/chromium/content/utility/services.cc
index be0e50a118e..bf64f5fcda3 100644
--- a/chromium/content/utility/services.cc
+++ b/chromium/content/utility/services.cc
@@ -9,7 +9,10 @@
 #include "base/no_destructor.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "content/public/utility/content_utility_client.h"
+#include "mojo/public/cpp/bindings/self_owned_receiver.h"
 #include "mojo/public/cpp/bindings/service_factory.h"
+#include "services/network/network_service.h"
+#include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/video_capture/public/mojom/video_capture_service.mojom.h"
 #include "services/video_capture/video_capture_service_impl.h"
 
@@ -17,12 +20,28 @@ namespace content {
 
 namespace {
 
+auto RunNetworkService(
+    mojo::PendingReceiver<network::mojom::NetworkService> receiver) {
+  auto binders = std::make_unique<service_manager::BinderRegistry>();
+  GetContentClient()->utility()->RegisterNetworkBinders(binders.get());
+  return std::make_unique<network::NetworkService>(
+      std::move(binders), std::move(receiver),
+      /*delay_initialization_until_set_client=*/true);
+}
+
 auto RunVideoCapture(
     mojo::PendingReceiver<video_capture::mojom::VideoCaptureService> receiver) {
   return std::make_unique<video_capture::VideoCaptureServiceImpl>(
       std::move(receiver), base::ThreadTaskRunnerHandle::Get());
 }
 
+mojo::ServiceFactory& GetIOThreadServiceFactory() {
+  static base::NoDestructor<mojo::ServiceFactory> factory{
+      RunNetworkService,
+  };
+  return *factory;
+}
+
 mojo::ServiceFactory& GetMainThreadServiceFactory() {
   static base::NoDestructor<mojo::ServiceFactory> factory{
       RunVideoCapture,
@@ -35,6 +54,9 @@ mojo::ServiceFactory& GetMainThreadServiceFactory() {
 void HandleServiceRequestOnIOThread(
     mojo::GenericPendingReceiver receiver,
     base::SequencedTaskRunner* main_thread_task_runner) {
+  if (GetIOThreadServiceFactory().MaybeRunService(&receiver))
+    return;
+
   // If the request was handled already, we should not reach this point.
   DCHECK(receiver.is_valid());
   auto* embedder_factory =
diff --git a/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.cc b/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.cc
index 50c9bb9dee2..a394549b751 100644
--- a/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.cc
+++ b/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.cc
@@ -16,8 +16,7 @@
 namespace content {
 
 UtilityBlinkPlatformWithSandboxSupportImpl::
-    UtilityBlinkPlatformWithSandboxSupportImpl(
-        service_manager::Connector* connector) {
+    UtilityBlinkPlatformWithSandboxSupportImpl() {
 #if defined(OS_LINUX)
   mojo::PendingRemote<font_service::mojom::FontService> font_service;
   UtilityThread::Get()->BindHostReceiver(
@@ -26,7 +25,7 @@ UtilityBlinkPlatformWithSandboxSupportImpl::
   SkFontConfigInterface::SetGlobal(font_loader_);
   sandbox_support_ = std::make_unique<WebSandboxSupportLinux>(font_loader_);
 #elif defined(OS_MACOSX)
-  sandbox_support_ = std::make_unique<WebSandboxSupportMac>(connector);
+  sandbox_support_ = std::make_unique<WebSandboxSupportMac>();
 #endif
 }
 
diff --git a/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.h b/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.h
index 2dbbd2465cc..c76ee0807be 100644
--- a/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.h
+++ b/chromium/content/utility/utility_blink_platform_with_sandbox_support_impl.h
@@ -20,19 +20,13 @@ namespace blink {
 class WebSandboxSupport;
 }
 
-namespace service_manager {
-class Connector;
-}
-
 namespace content {
 
 // This class extends from UtilityBlinkPlatformImpl with added blink web
 // sandbox support.
 class UtilityBlinkPlatformWithSandboxSupportImpl : public blink::Platform {
  public:
-  UtilityBlinkPlatformWithSandboxSupportImpl() = delete;
-  explicit UtilityBlinkPlatformWithSandboxSupportImpl(
-      service_manager::Connector*);
+  UtilityBlinkPlatformWithSandboxSupportImpl();
   ~UtilityBlinkPlatformWithSandboxSupportImpl() override;
 
   // BlinkPlatformImpl
diff --git a/chromium/content/utility/utility_service_factory.cc b/chromium/content/utility/utility_service_factory.cc
index 9b0759ab820..2c1c7f992f2 100644
--- a/chromium/content/utility/utility_service_factory.cc
+++ b/chromium/content/utility/utility_service_factory.cc
@@ -47,6 +47,7 @@
 #include "base/mac/mach_logging.h"
 #include "sandbox/mac/system_services.h"
 #include "services/service_manager/sandbox/features.h"
+#include "services/service_manager/sandbox/sandbox_type.h"
 #endif
 
 #if defined(OS_WIN)
@@ -59,10 +60,6 @@ namespace content {
 
 namespace {
 
-void TerminateThisProcess() {
-  UtilityThread::Get()->ReleaseProcess();
-}
-
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
 std::unique_ptr<media::CdmAuxiliaryHelper> CreateCdmHelper(
@@ -100,26 +97,6 @@ class ContentCdmServiceClient final : public media::CdmService::Client {
 
 #endif  // BUILDFLAG(ENABLE_LIBRARY_CDMS)
 
-void RunNetworkServiceOnIOThread(
-    service_manager::mojom::ServiceRequest service_request,
-    std::unique_ptr<service_manager::BinderRegistry> network_registry,
-    scoped_refptr<base::SequencedTaskRunner> main_thread_task_runner) {
-  auto service = std::make_unique<network::NetworkService>(
-      std::move(network_registry), nullptr /* request */,
-      std::move(service_request), true);
-
-  // Transfer ownership of the service to itself, and have it post to the main
-  // thread on self-termination to kill the process.
-  auto* raw_service = service.get();
-  raw_service->set_termination_closure(base::BindOnce(
-      [](std::unique_ptr<network::NetworkService> service,
-         scoped_refptr<base::SequencedTaskRunner> main_thread_task_runner) {
-        main_thread_task_runner->PostTask(
-            FROM_HERE, base::BindOnce(&TerminateThisProcess));
-      },
-      std::move(service), std::move(main_thread_task_runner)));
-}
-
 }  // namespace
 
 UtilityServiceFactory::UtilityServiceFactory()
@@ -153,17 +130,6 @@ void UtilityServiceFactory::RunService(
              !base::FeatureList::IsEnabled(
                  features::kTracingServiceInProcess)) {
     service = std::make_unique<tracing::TracingService>(std::move(request));
-  } else if (service_name == mojom::kNetworkServiceName) {
-    // Unlike other services supported by the utility process, the network
-    // service runs on the IO thread and never self-terminates.
-    GetContentClient()->utility()->RegisterNetworkBinders(
-        network_registry_.get());
-    ChildProcess::current()->io_task_runner()->PostTask(
-        FROM_HERE,
-        base::BindOnce(&RunNetworkServiceOnIOThread, std::move(request),
-                       std::move(network_registry_),
-                       base::SequencedTaskRunnerHandle::Get()));
-    return;
   }
 #if BUILDFLAG(ENABLE_LIBRARY_CDMS)
   else if (service_name == media::mojom::kCdmServiceName) {
@@ -199,8 +165,7 @@ UtilityServiceFactory::CreateAudioService(
 #if defined(OS_MACOSX)
   // Don't connect to launch services when running sandboxed
   // (https://crbug.com/874785).
-  if (base::FeatureList::IsEnabled(
-          service_manager::features::kAudioServiceSandbox)) {
+  if (service_manager::IsAudioSandboxEnabled()) {
     sandbox::DisableLaunchServices();
   }
 
diff --git a/chromium/content/utility/utility_thread_impl.cc b/chromium/content/utility/utility_thread_impl.cc
index 22ca1b57210..2cfcc1579af 100644
--- a/chromium/content/utility/utility_thread_impl.cc
+++ b/chromium/content/utility/utility_thread_impl.cc
@@ -25,7 +25,6 @@
 #include "ipc/ipc_sync_channel.h"
 #include "mojo/public/cpp/bindings/pending_receiver.h"
 #include "mojo/public/cpp/bindings/self_owned_receiver.h"
-#include "mojo/public/cpp/bindings/strong_binding.h"
 #include "mojo/public/cpp/system/simple_watcher.h"
 #include "services/service_manager/public/cpp/binder_registry.h"
 #include "services/service_manager/sandbox/switches.h"
@@ -137,9 +136,10 @@ class ResourceUsageReporterImpl : public mojom::ResourceUsageReporter {
   DISALLOW_COPY_AND_ASSIGN(ResourceUsageReporterImpl);
 };
 
-void CreateResourceUsageReporter(mojom::ResourceUsageReporterRequest request) {
-  mojo::MakeStrongBinding(std::make_unique<ResourceUsageReporterImpl>(),
-                          std::move(request));
+void CreateResourceUsageReporter(
+    mojo::PendingReceiver<mojom::ResourceUsageReporter> receiver) {
+  mojo::MakeSelfOwnedReceiver(std::make_unique<ResourceUsageReporterImpl>(),
+                              std::move(receiver));
 }
 #endif  // !defined(OS_ANDROID)
 
@@ -204,8 +204,7 @@ void UtilityThreadImpl::EnsureBlinkInitializedInternal(bool sandbox_support) {
 
   blink_platform_impl_ =
       sandbox_support
-          ? std::make_unique<UtilityBlinkPlatformWithSandboxSupportImpl>(
-                GetConnector())
+          ? std::make_unique<UtilityBlinkPlatformWithSandboxSupportImpl>()
           : std::make_unique<blink::Platform>();
   blink::Platform::CreateMainThreadAndInitialize(blink_platform_impl_.get());
 }
diff --git a/chromium/content/zygote/zygote_browsertest.cc b/chromium/content/zygote/zygote_browsertest.cc
index 8c1a1396da9..b93c8e9b675 100644
--- a/chromium/content/zygote/zygote_browsertest.cc
+++ b/chromium/content/zygote/zygote_browsertest.cc
@@ -35,7 +35,7 @@ IN_PROC_BROWSER_TEST_F(LinuxZygoteBrowserTest, GetLocalTimeHasTimeZone) {
   const char kTestCommand[] =
       "window.domAutomationController.send(new Date().toString());";
 
-  NavigateToURL(shell(), GURL("data:text/html,start page"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("data:text/html,start page")));
   std::string result;
   ASSERT_TRUE(ExecuteScriptAndExtractString(shell(), kTestCommand, &result));
   std::vector<std::string> parts = base::SplitString(
@@ -67,14 +67,14 @@ class LinuxZygoteDisabledBrowserTest : public ContentBrowserTest {
 // Test that the renderer doesn't crash during launch if zygote is disabled.
 IN_PROC_BROWSER_TEST_F(LinuxZygoteDisabledBrowserTest,
                        NoCrashWhenZygoteDisabled) {
-  NavigateToURL(shell(), GURL("data:text/html,start page"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("data:text/html,start page")));
 }
 #endif
 
 #if BUILDFLAG(USE_ZYGOTE_HANDLE)
 IN_PROC_BROWSER_TEST_F(LinuxZygoteDisabledBrowserTest,
                        NoZygoteWhenZygoteDisabled) {
-  NavigateToURL(shell(), GURL("data:text/html,start page"));
+  EXPECT_TRUE(NavigateToURL(shell(), GURL("data:text/html,start page")));
 
   EXPECT_FALSE(service_manager::ZygoteHostImpl::GetInstance()->HasZygote());
 }